Testing and stuff

Gingerbreak is not that easy and needs to be carefully tested.
Additionally, I wait for a particular device to be
released. I am not waiting for the fun of it.
But as always, no guarantee for anything.

Zimperlich sources

Since there were some requests I made the source of
the zygote jailbreak, zimperlich, available here.


Its straight forward code just like the adb setuid() one.
Most of the time I spent getting the Makefile right and
tricking zygote to spawn the right amount of processes and
calling setuid() once more when we are already running.
Keeping in mind that I dont like Java.


I solved this with a ContentProvider and giving it a new
process name in AndroidManifest.xml, so the ContentProvider
is guaranteed to be invoked as a new process.
If the NPROC limit is reached this will be the root
process.


Also, we want some native code carried along with the .apk
for convenient purposes. The Android ABI requires that
it must be named libNAME.so but in fact it is of
type ET_EXEC and not ET_DYN so we can execute it as
binary.


If you look at the Makefile you can imagine that this
was a horror. You require a complete Android build in
$AROOT to succeed.


Of course you could also mis-use the RageAgainstTheCage
binary to exploit zygote (and not adb) if called from
an .apk like the z4root did. But I think nobody noticed
or cared that a different setuid() bug was actually exploited.
Thats at least what my short analysis showed. If I am wrong
I will remove this paragraph. So, only use the original
old but gold code on the commandline as proposed
to get the real deal! :)

Cloud Clock trickery

I spent some time fumbling with HTTP again but not related
to Web 2.O. Rather I was interested in how HTTP could
replace NTP since web servers reply with a Date: string
upon each request. The result can be found here.
It is basically a daemon that fetches Date: of
pre-configured servers and tries to minimize RTT and
local I/O impact when setting the time. It also runs as
a user chrooted, keeping CAP_SYS_TIME.
It should also work with IPv6 nodes. If you want to use
my lophttpd web server along with httpdated, you need
to update it to the latest version.


Feel free to comment if you have ideas or see problems
but do not bother me with "NTP is much more better and
more correct". I know that :-)

ELF process dumping trickery

I made a small tool available here which allows to
dump ELF binaries from memory to disk in cases
where the original image has been altered/deleted/crypted
etc.
There is no way to make it 100% reliable as the state
of the program might not be the same as when just loaded
and therefore you can have dangling pointers etc.
in .data. However it works surprisingly well for a lot
of programs.
Some info is lost during loading anyway and has to be
restored heuristically. We rely on linear ascending
PLT jump-slots for example.


I only tested it on x86-64 but it has basic support
for x86 as well. The de-relocation of the image has
to be checked though. All other architectures like
PPC64 etc. can easily be added by adding appropriate
R_ types to the switch() clause.

Happy birthday to a good friend. You are not 25, you are almost 31 :-)

According to some news site its the 25th birthday of
the computer virus. Or not.


While most of the scientists and malware analysts know
that Fred Cohen did one of the first virus research in 1984,
it is a little known fact that in February 1980 a Diploma Thesis
at the University of Dortmund already discussed self replicating programs (in german). The 80's must have been such a great time. :-)
If you are interested, I also discussed some virus related issues
for UNIX in 2009 here.

adb trickery #2

Apparently some vendors have reviewed android and also fixed
the ashmem issue in 2.2.1 (along with adb and zygote).


However, I got the first reports for KillingInTheNameOf
working on 2.1 devices. So I made it available
here.


It was really my favorite and I hoped it would become
the Gingerbreak, but 2.3 is not using
ashmem for system properties. Thats life :)




[Update:] it seems like the property space has become
the new playground for breaking froyo devices since this post,
as the ashmem implementation has some shortcomings if
it comes to properly protecting the property space :-)
The security of the whole system relies on the property
space due to ro.secure and other properties.
However for Gingerbread, the property implementation has been
redesigned AFAIK.


Also check out this link for another method of exploiting
ashmem which apparently also works on 2.2.1 devices.


My Gingerbreak works, but I wont release it before a couple
of devices are in the wild so the issue is not fixed before
it can become useful.

Zygote trickery -- 743C 27C3 release

The Gingerbread source has recently been released and
a root vulnerability has been fixed inside the
zygote/dalvik framework (if you dont know what it is,
call it a framework). I hoped that this exploit would
still work on Gingerbread, but since the bug is too
similar to the adb issue it has been fixed as well.
Thus, this only affects android phones < 2.3 but
it also works without debugging being enabled e.g.
from inside an evil app.


As always: the code is AS IS.
If you use it, it may crash your
device and makes it totally useless, SO YOU USE IT AT YOUR OWN RISK! THERE IS NO GUARANTEE
THAT IT WILL WORK AT ALL.


If you dont know what jailbreaking is about, dont do it anyways.
Once executed it should create a /system/bin/rootshell or
+s /system/bin/sh.


The apk can be found here. Nevermind the simple GUI,
it was pasted together from various sample/demo programs
just to make it easier to have an activity to start
for zygote.


And fear my publishing skillz! :D

The bootdisk and the rootdisk

The recent discussion at the pub was of course about
the bits and bytes but this time with view on historical
facts. Someone remembers the bootdisk and the rootdisk?
When it was not possible to boot from CD-ROM it was
necessary to dd a bootdisk and a rootdisk image to floppy
disks. After a few installs, one of them was always fscked.
So why were we using Linux at all? Wasn't it a funny time
with TurboPascal at school? Or even better with BorlandC++
which I got hands on in '94 or so on a low-price
(b/c outdated-)version. For a price of just 80 DM
which was still high enough at that time one also got the incredible TurboDebugger and there the fun starts.

While I am not going to explain for what reason exactly
TurboDebugger was cool (I know the even more cool guys
used SoftIce :) it showed you the hard way why
RealMode really sucked in particular if there is a ProtectedMode
since years. So isnt there any good OS utilizing that?
Whats this "Linux" ...?

Gingerbread

If someone already has got a Gingerbread and wants to

save the world, let me know.

Happy Birthday to .no

Special greetings and congratulations to Uschluh today
where the one and only root is celebrating his BD.
May be the force with you to withstand all evil of life
in whatever shape it will appear: users, bosses, women,
burning switches or Fedora 14.
You've got the power. Looking forward to a new Gewaltmarsch. :)