Android Vroot Write Up – Simple

Vroot Technical Write-up
By: John Hale (john.b.hale@gmail.com)

This is my first writeup on any sort of exploit/bug/anything in quite some time, so pardon if I misuse some phrases ☺

Firstly, I wanted to say, I was interested in this because, it seems that it can root pretty much any device with ease. Some people reported that it used certain bugs and others reported other bugs. Well, I have figured out what it actually does.

Here we go.

Firstly, It will grab your IMEI and Serial Number and Model Number of your device then it will query their server. (I have looked into this countless times) it looks pretty much legit. All they are doing is figuring out which device you own / version of android its on so they can chose which exploit to use on your device.

With the above said, This is the reason for this writeup, people have wrote that it uses put_user/get_user and other things. Well, the fact is, It uses a mass amount of exploits.

This is the process:

A) Acquire Vroot English version : http://www.mgyun.com/en/getvroot
B) Install it and set your phone to USB debug mode
C) Don’t worry about any drivers in windows! It will download them!
D) Plug your phone in when it asks. And sit back and profit.
E) This may seem interesting, and I will explain in a second ☺

Once you run this and install this on your computer, Personally, I have not seen anything malware related. Someone else may want to chime in if they have looked at it. Once you run this, the app will dump a few files into the following directory:

/data/local/tmp/
.rommaster_root – exploit wrapper
.rommaster_root.sh – simple bash script to remount system after root.

.rommaster_root will check your device to see what it is vulnerable to, then it will unpack a shared library called .xiny[Random Number]. This shared library is the actual exploit for your device. The only way to aquire this file, is to patch the original .rommaster_root file so it does not unlink() the shared library.

So far, I have seen that it is using, put_user/get_user/MSM camera vuln and I am sure there is others but I don’t own the devices to test this.

I will include a .zip with sample files. This will include the unwrapped .xin file for the MSM camera vulnerability. Personally, I have not had time to reverse and see how this works. But, maybe someone out there is interested!

I have also put together a simple C file that will load the library and try to run the exploit from the shared library. Honestly, this is useless ☺ You need to patch the actual rommaster__root file in order to get anything to work in any way shape or form.

Tests ran on the Verizon Note 3 on the latest android firmware:

1) No knox trip (GREAT)
2) The exploit somehow gains access to either the camera user or system user then tries to open all the /dev/v4l-subdev* devices and run an ioctl() on it.
3) This is as far as I have gotten. And, I believe with no real help, I wont be going any further.

Thanks to #vrootreverse on irc.freenode.net , people testing and helping out.
Maximus64 , zenofex and others.

For more information, Please follow me on twitter @rhcp011235 or feel free to email me.

China ASM dump of this exploit:

http://ziliao1.com/Article/Show/AB2CC26186ADB0328D4EAAA36DDA72A9

If I find time, I will update this, or post more details.

Cheers!

Link to files as promised: https://drive.google.com/file/d/0B0g-ojj_rL70TjZ0cW02TmFGbkk/edit?usp=sharing

Share

Well, Hello All, I am back in the Android World And I bring gifts!

Hello guys!

I have been having fun with my iPhone5 and iPhone5s and my other Apple products for some time. And, I have figured I should return some stuff to the android world as well. I recently got a LG G2 for Verizon during the Amazon Failure where you could buy the phone for $200 out-right. and, I have a Galaxy S4 , Nexus7.

I just got my Mac build system working to a few good friends over at CM team. Thank a ton! 5 days killing myself, I felt like a kid again. That is sarcasm, I don’t mean it in an offensive way. Everyone should learn, but hey :)

I will be posting the builds here as I make them.

Keep an eye on them!

#KITKAT here we #COME

Follow me on twitter @rhcp011235 and @temperedarmor

[ Grouper Nexus 7 2012 Wifi ]
Build date: 11/15/2013 http://d-h.st/OUq

Share

Why T-mobile is making a PR scheme / Going contractless

Many of you are reading all the blogs and media about the T-Mobile IPhone scheme and their plan to go contract-less. I figured, I would write something with some facts and some educated thoughts. Since, All the blogs only focus on the good.

Let’s start out with the facts. Incase, you are wondering I’ve had T-Mobile on five different occasions.

1) Yes, inside a major city, they service is great and their data is great. 100% agree. Now, with that being said. ANY wireless provider in the metro area can provide equal or better service. And, I am talking about pre-paid and post-paid. You can get whatever you want and you will see the same results.

2) T-Mobile will not cancel your ETF for any reason. I personally had no service in my home. They said I had to use wifi-calling, which did not work. By law, if a service provider cannot provide you with service in your home area, they are supposed to let you out of your ETF. Well, They did not, I had to contact the BBB, FCC , MX state , other parties and they finally let me go. Again, with this being said, T-Mobile gets approximately 147 BBB complaints PER DAY. I am not sure of the counts for the FCC / MX and others.

3) T-Mobile has been telling us about re-farming of the towers for almost two years now. So, they can bring in 1900 MHz and better their service. Well, I can personally say, they have only brought it up in a small amount of places and now they are trying to roll out LTE (Again, In the major cities ). So for the past five years , they got partial 1900 up and partial LTE up. I wonder how long it will take for them to get anything really done?

4) The all-powerful Apple IPhone! They are finally announcing a new Apple IPhone for T-Mobile. It was supposed to run on their 1900 network (ATT MODEL) , I guess this is not going to happen, then again who knows the real truth? But, again this is another PR standpoint for them to get more customers. Same goes with this new contract-less idea. What do you do when you have terrible service , terrible customer service , and you don’t carry an Apple IPhone? You go for a hail-marry attempt which is worded above.

Now for opinion part of the entry.

1) We all know they have 5-8 different pre-paid companies selling T-Mobile service and we all know why. It’s to get people to sign up for what they don’t know and when the service bombs on them. They can’t complain to T-Mobile because technically, they do not own it.

2) Will LTE come through? Will 1900 come though? Will any of these promises come through? Personally, I believe sure, in the major cities. And, the rest of the population outside of the major cites will wait many years till they see anything. They logically only turn on LTE / 1900 to the newest equipment they own. It’s cost effective.

3) Do I think you should run out and kill your current service because T-Mobile promises all this? No!, I believe in waiting to see what they will really do. They are much like politicians and will play the PR game. And, of course try to get people to jump onto the new things. Hopefully, you will not be one of those early adopters and be fooled.

This is all I have to say about this. Comments have been turned off on my site. If you would like to reply, You can reply on twitter or ADN @rhcp011235 or on G+.

Share

Why Android is terrible

I think a lot of people who know me, know that I love android and I have my hate for it. I figured I would voice my concerns and ideas for the fun of it for whoever reads my site.

A) The market is flooded with android devices. (This is also know as market saturation)
B) The OEMS’s rather release a new device then fix the older devices with issues. So, they issue a NEW device with the issue fixed but with new issues.
C) We got google. So we rely on google services. Gtalk, Gmail and others. One of them go down. Who’s fault is it? Google? Your rom? your phone? your provider?
D) Google decides to release a NEXUS device (which by definition is the most up to date phone on the market) – They give the grant to samsung who screws up the radio / old hardware and many other things. Then, Good old GOOLE drops support for all CDMA devices. So, no more NEXUS folks. Now, You get to rely on 15yr old’s we call devs. I wont name them because we all know who they are. (How they acquire these devices? HMMM! I’ll let you figure that out!)
E) Now, lets introduce android tablets! Yea! Now, we have another 100 devices all with issues and more market saturation. no one fixes anything and we are left with the 15yr olds.

Now, lets go to next level. I will not say I love apple nor will I say I hate them. I agree their products are somewhat insanely priced and sometimes even just crazy. But, let’s talk about phones / tablets. They have released a total of 5 phones in a total of (5 years) correct me if im wrong please. And, all of these devices have been up to date. and all work flawlessly. Even the ipad’s there is 3 of them, all of them work 100% flawlessly, maybe no flash? Webmasters have found a way around flash, its called HTML5. Now, again, with an iphone, you have the phone,provider and that is all for fail points. Of course you have the software, but thats written by highly knowledgeable people and its updated regularly. Sure its 3G only for now, HSPD+ on GSM. But at least you have two fail points VS 100 or so.

What I am trying to say, why cant providers? OEMS? people? realize putting out new devices does NOT help us?! They need to fix the problems at hand NOT create new ones!

Share

[DEV] How to apply OTA HTC [TESTED ON ONE S]

Hello guys,

Many of you many not know, I wound up bricking my one S yesterday and I had to buy a new one for $50 from TMO. I am currently not in the money and having issues. I am hoping people will donate to help me out since I’m Posting this info.

For the ONE S:

Before you start. You must be on STOCK recovery + STOCK TMO firmware (not the one from the leaked RUU) – You have been warned.

Steps:

A) Download the OTA from:
B) you must have temp root. or perm root. However you want to do it.
C) adb push OTA_Ville_U_TMOUS_1.84.531.2-1.53.531.16_release_2651973pm4j0bopq68v1g1.zip /mnt/sdcard/
D) adb shell
E) cp OTA_Ville_U_TMOUS_1.84.531.2-1.53.531.16_release_2651973pm4j0bopq68v1g1.zip /cache/update.zip (AS ROOT) / if cp does not work. You need busybox.
F) cd /cache/
G) mkdir recovery
G1) cd recovery
H) echo “–update_package=/cache/update.zip” > command
H2) exit from adb on the phone (just type exit and hit enter)
I) adb reboot recovery

NOTE: I will put up scripts for linux/osx for this. I may do a windows one as well. Also, for those who just used a nandroid (I will put up flashable zips for the stuff you need) The nandroid is not enough for an update.

None of this comes to you as brickproof. It took me 2 phones to get this right. Follow the steps and you should be fine. This also should work on ANY HTC phone.

PROFIT. To figure all this out. it cost me $50 bucks + a gas and two phones!

Please help by donating.

Nandroid of the update – Nandroid of OTA
If you choose this option – you need to flash the below in TWRP

You can flash this via TWRP ONLY – Firmware update (it has all the updates) needed

Share

Verizon Service / Phones [Fact and opinion ]

Ok, So we all ready about my phone saga. Well, Now I will bring out the truth to it all.

FACTS:

I was a proud and happy customer with Verizon Wireless for a little over 1 year. I had almost every device they sold and I bought them all out-right. The first 7 months was 100% wonderful. Full LTE speeds and great coverage. I will say they were far the best. All of this is saying coverage. The last few months of my service, I had noticed I went from -75 which is GREAT to -90+ on all my devices, sometimes to -105 (no service at all)

  • I have called into customer care and I have told them my issues. They have sent me out various device changes. This was very nice of them. 3 of them were DOA (Dead on arrival) and also one of them came with out a back ( they totally switched my device for a Droid 4) – All devices same thing. So, we ruled out device issue. Personally, I ruled it out before they did. 6 devices all same issue? Better chance of winning the lotto.
  • Next phase of trying to figure this out. Was to put in trouble tickets. I put in a total of 6 tickets. I may be off by one. The very first trouble ticket was erased from the system and never existed. So, I called and talked to a manager. They came back with nothing. I called again put in another and they wanted to swap devices again. and yet again, the ticket was useless.
  • Phase 3. Support cant help you? Mangers cant help you? You contact higher up people.

    Person A)
    Karen Schulz
    864-987-2006
    Karen.Schulz@VerizonWireless.com
    Position: North and South Carolina/Tennessee PR

    So, I talked with her via email and phone. Finally she agreed to babysit my ticket. Saying that as a PR person. Babysit your ticket. That got me angry. But, I held it in. So she writes me back a week later. That my coverage is 100%, I wont get a wireless extender B) I cant get out of my ETF and Im stuck.

    Now, my account sat under her. and, nothing could be touched without her approval. This was fair to me? So, I contacted yet another manager who opened another ticket. This ticket comes back that I am “marginal coverage” and I can cancel service with no ETF!

    So, Now, PR sends out people and they scan and tell me I am 100% and now Im told I’m marginal. So, I have two ideas. A) they want to get rid of me? B) They dont know what is going on. So, I call again. I ask a SIMPLE and BASIC question. Why was I told 100% one day and next day marginal? No answers. I kept calling asking this simple question. Yet no answers.

    Now, I am told that my account is now LOCKED by an exec. Now, I am even more mad. Lock my account down for asking a question? I feel like I am living in china or russia. I have no rights?

  • Final person.
    Karen Milbrodt
    Analyst-South Area Executive Relations
    Verizon Wireless
    (O) 770-521-5640
    (F) 678-339-8649
    Hours: 8:45 AM – 5:15 PM, M-F, EST
    karen.milbrodt@VerizonWireless.com

    In short her title and job is: Deal with Irate people and cancel them. She calls me and says I have until may 4th to cancel my line and I have a letter. I have no such letter. So, she emails me a PDF stating that I was canceled due to harassment. Before I get to the legal setup of this. A) How in the world is asking a simple question harassment for what I am paying for?

    Now legal: Harassment is, I have to be told in a letter called a “cease and desist” letter or a C&D by legal. Or, I can be told by a auth rep not to call anymore. Neither one was told to me nor sent to me. So, their reason for cancel is not legal by any means. This letter will be posted in full detail and so will all emails.

  • During this four days, I had to work and I couldn’t deal with all this. SO my wife decided to swap us to sprint through a 3rd party dealer. You may read all about this in my phone saga write up. We ended up on T-mobile which has been great! and they are super nice.

    PROBLEMS CURRENT:

    A) Verizon Wireless owe’s me money for a laptop Dock I bought for a Verizon Droid Razr, I never got the funds back and I was promised by the exec above that she would look into it. Which was a LIE. Yet once again LIED to.

    B) I was told I was given 1,200+K in credits. This was because their shipping method switched from Fedex to USPS -> Fedex -> USPS. Every item I have with them show up as not delivered and I have never paid a penny. Which obviously means the device was found. The credits they gave me for devices they could not find. Personally, Why would I want to keep crap? I want my changed phone what I am going to do with a broken phone.

    Dear Verizon, If you want this to stop.
    A) Return my money for the moto dock.
    B) Return my funds for the last 6 months.
    C) Give me something in writing you will leave me alone.

    If you do not comply with this. I will be posting full info. And, under the freedom of press, I can post whatever I want. So, get ready.

    P.S. During all of this fun. I LOST MY JOB! Because, I was taking out the pain and yelling out on my boss and co-workers. This was ALL over a phone.

    If you care and can help please feel free to donate to me.

    Thanks for your read. You may post your comments.

    Share

[DEV] TWRP for the HTC ONE S

I think everyone that knows me, already knows I do not want to run anything written by koush or pushed by koush. So, my first goal was to get twrp on this phone!

Thanks to Toast and Eyeballer, They had a tree for the ONE X which is quite close and I only had to swap the fstab to get a working recovery! , Eyeballer and toast fixed up a few things. and its now 100% stable.

Download TWRP for the ONE S

If you feel like donating to keep this site up and help my situation atm. Please feel free.

Share

Phone + Service Saga

Not sure if you have been following me on twitter. But, I had some issues with Verizon Wireless and they canceled my account due to harassment. In their TOS they can really cancel you for anything. But in this case, I was never told to stop calling nor was sent a letter to stop. My issue was pretty simple, my signal and data went from 4 bars (-75) 30mb/s to (1 or 0 bars) -100 and 4-8mbs. I simply wanted to know why. They sent people out here and said im in perfect service area and if I wanted to leave Id have to pay ETF and whatnot. Then I called again and they sent more people out and the ticket was marked that I was in a marginal area (meaning low or no service) – Was this real? or their way to get rid of me? So, just like any other person, I called in yet once again, I wanted to know how I went from perfect service to now (none and marginal in one day) – No answers to anything. Finally I got a letter stating that I need to port out by May 4th. So, rather then try to keep me as a customer and help me, they would rather just cancel and ban.

So, My wife now goes out and gets sprint. She got a 27% discount and we got 3 lines. Great deal! Day 1 two of the three devices are broken. and we are at the store. They tell us we cannot swap them because your wife got it at a 3rd party. So we go to deal with him. He wont swap them out. So. now i’m on the phone with sprint customer service and fighting back and forth and after about 50 calls, someone calls this 3rd party and forces them to swap phones. For whatever reason my wife just swaps mine and doesnt swap hers. This is like day 5-6 into our 14 day trial, so, after all of this I take a day in bed just to relax from all the stress. Next day, we say lets take a ride and see how this thing works out. So we ride around the area. no signal / roaming and no 3G/4G. so, again now i’m on the phone with sprint, they look into the area saying everything is ok. maybe its the devices again, and they send me out a an Airware device which is like VZW’s VOIP device for the home. Needless to say, this device makes the calls worse!, need to add in it took over a week to get the airwave. So, now we are into day 11 almost. Of-course now I am nervous. So, I call yet once again trying to find out when my 14th day is. They tell me monday (and they note it) turns out sunday was my 14th day. So 100 more phone calls to get them waive the ETF and now I got three devices to sell. And, I need to find a way not to pay the bill they want to make me pay.

So, after all this, My wife just says lets just go back to VZW under my name. So, now i have Sprint/VZW both clipped to my side. Between all the fighting and phone calls and pure anger on my side. Now, I wind up losing my job! Because, I bring the anger into work. fun month eh?

Finally, I just say the hell with all this, lets just get T-mobile, I dont even care about unlimited data anymore. They are cheap, my wife gets 15% and we can get two HTC ONE S phones one for free. So far, this is the best service ive seen in years. They finally made wifi calling FREE so im on wifi at home 100% of the time. and when i’m out everything works great. I mean i do hit spots where it will drop to 2G for 10 seconds then go back to 4G. but the hand-off time is instant vs sprint/VZW. also, when i want to use wifi calling I dont need any boxes or anything it just connects when i turn on wifi and BOOM! and its FREE!

My conclusion to all this. I do not fully understand how TMO’s wifi calling works, But, why cant all carriers offer this to their customers? This would solve many issues and cause less people to call. For example: My service at home is just fine! but, if it wasn’t, I would be calling and crying just like any other. I turn on wifi and wifi calling comes on. I can call / send texts / use data and its PERFECT.

So the question is, how does it work? why dont others offer this for free? seems like a good way to get customer retention. Also, the TMO reps are amazing. I actually got a call from the rep a day later asking me if my port from sprint worked! I was like are you serious? He said huh? I was like I never had a rep from any Wireless service call me and say “Did you port go in ok” he laughed and said im just trying my best to help you. That made me feel extra special.

Share

Have not posted to my blog in some time now.

Well,

I guess whom ever is reading my blog, is wondering why I have not been blogging.

A) I have lost my pitbull that I have had for 11 years. She died in her sleep a day ago. And, To be honest I am taking it quite hard. I kind of knew it was coming. But, She was a really special dog. And, very close to my family and anyone who knew her, she was a saint. This is my latest issue.



B) I have been having phone issues with pretty much every carrier. I guess living out here in north carolina has been a bad move. If i was still in NYC. Virgin mobile or Metropcs would be doing just fine. Here im stuck with expensive carriers. So much for being in a cheap state eh? So, dealing with contracts and getting out of them, credit checks. Has left me with no time for anything.

C) I have been working with a new company. I am trying my best to fit in with them. And, somehow manage all of the above. It’s quite hard and I hope they understand I just need some time to break/feel into things. Everyone seems very nice and prof. so I assume all is ok.

Hopefully, I can pull through everything and possibly get more stuff going on. Maybe I can update things on here. Money has been an issue lately. I honestly do not want to sound like a person that is begging. But, people donate $1 (which is .85 cents) after paypal takes it out. Some have been nice and sent $5 or $10. So, we shall see if I can even keep this site up.

Thanks for reading. Welcome to comment on it.

My mom has setup a site for my pet. If you would like to see. http://chewy-hale.forevermissed.com/

Share

Samsung Verizon Network Extender [ Brief Overview ] [ Updated with Flow Charts ]

Well,

 

Verizon has been giving me the run around on my signal issues on ALL my devices both 3G and 4G devices. This includes signal issues inside my house as well as outside. So, after 20-30 calls, they want to send me a network extender. So, I’m thinking to myself this is cool. So, again, turns out, its a signal extender that uses your internet connection to place calls. Basically, The device turns into a MINI tower which you can connect ANY VZW device up to within 50 or so feet, then, it will place the call over VOIP (Over your INET).

Now, With the above said. How in the world does this fix any issue? I can get any SIP device / Magic jack and other setups, and make free calls from my house. oh, and to add to that, When you place calls over this device (It comes out of your airtime minutes)

 

I have some pics of the unboxing.

 

http://minus.com/mbcxKFUkza/

 

Conclusion: If this item was not FREE and I actually paid 249.99 + shipping. I would have flipped out on the phone and had been sent to a hospital. $249 dollar device to for SIP. When they cost < $30 USD.

Normal Verizon / Carrier Setup (I made this in omnigraffle)

 
normal carrier type setup
 

This is how the Network Extender works (quite stupid if you ask me)
VZW Network Extender

 

Share
Return top

INFORMATION

Change this sentence and title from admin Theme option page.
 
mrcellphoneunlocker.com