Database Users

[Q] Flash_image file?

Does anyone have the flash_image file. My rom is new and doesn't have it.

here you go
to install it is
Code:
adb remount
adb push flash_image /system/bin/flash_image
adb shell chown 755 /system/bin/flash_image

Downgrade from 1.72 issues with cmd

Android SDK installed in programfiles
ADB in this folder : C:\Program Files\Android\android-sdk-windows\platform-tools
written in cmd, with USB debugging activated and charge only.
C:\Users\any\adb devices. my device shows!
Is this the right thing to insert to cmd or the one below
1. Answers!
adb push psneuter /data/local/tmp : A bunch adb commands shows
adb push misc_version /data/local/tmp : A bunch adb commands shows
adb shell chmod 777 /data/local/tmp/psneuter :unable to chmod, no such file
adb shell chmod 777 /data/local/tmp/misc_version :unable to chmod no such file
adb shell /data/local/tmp/psneuter : Not found
adb shell :$
or this
2.
adb push psneuter C:\Program Files\Android\android-sdk-windows\platform-tools
adb push misc_version C:\Program Files\Android\android-sdk-windows\platform-tools
adb shell chmod 777 C:\Program Files\Android\android-sdk-windows\platform-tools/psneuter
adb shell chmod 777 C:\Program Files\Android\android-sdk-windows\platform-toolsmisc_version
adb shell C:\Program Files\Android\android-sdk-windows\platform-toolspsneuter
adb shell :$
Have I installed the Android SDK in the wrong folder or what is thats going wrong?

First is correct, but you have to have psneuter & change_misc files in current directory so adb push could find them.

Whats the current directory?

Probably C:\Program Files\Android\android-sdk-windows\platform-tools.
You can also use it like this: adb push c:\some_directory\psneuter /data/local/tmp
Syntax is: adb push [what you want to push] [where you want it to go]

istopp said:
Whats the current directory?
Click to expand...
Click to collapse
Current directoty is the folder you are in.

Could you resolved the above problem?
because even i am not able to use adb shell chmod 777 command, its shows the same result.
Any help will be appreciated.
Thanks.

Thanks a lot, i just copied the content of the C:\Program Files\Android\android-sdk-windows\platform-tools directory to C:\Users\any\ and tried then, work perfect, finally got the # instead of $
What are the instructions im suppose to follow in the bootloader? fastboot,recovery,factory reset,simlock or image CRC?

istopp said:
Thanks a lot, i just copied the content of the C:\Program Files\Android\android-sdk-windows\platform-tools directory to C:\Users\any\ and tried then, work perfect, finally got the # instead of $
What are the instructions im suppose to follow in the bootloader? fastboot,recovery,factory reset,simlock or image CRC?
Click to expand...
Click to collapse
None of the above. If you've done it correctly, the phone should find PD98IMG.zip on its own. Is your device branded? If so, make sure you have correctly created your Goldcard.

Official update to 1.82.405.1 stock ROM (from 1.72..) and root

Hi there,
I tried if it is possible root on stock ROM 1.82.405.1 on HTC Desire Z. YES, we can!
This is a little "how to" with all previous roots and updates from "1.34.." to actual 1.82.405.1 stock ROM:
Permanent root on HTC ESIRE Z using linux
Software No. 1.34...
Necessary files:
adb (Android SDK)
gfree_02
psneuter
Terminal emulator (Android)
Optional files:
gfree_verify
Settings on Phone:
Menu-Settings-Applications-Development-USB debugging [yop]
USB connected to PC – only charge (card not mounted to PC)
Procedure on PC:
Check your device is properly conneted:
$ ./adb devices
It has to be like this : SH0BFRT00451 device
Than continue:
$ ./adb push su /sdcard/su
$ ./adb push Superuser.apk /sdcard/Superuser.apk
$ ./adb push rage /data/local/tmp/rage
$ ./adb push busybox /data/local/tmp/busybox
$ ./adb push root /data/local/tmp/root
$ ./adb shell chmod 0755 /data/local/tmp/*
On Android:
Launch Terminal Emulator
$ /data/local/tmp/rage
Wait for the message: "Forked #### childs."
Menu > Reset Term - Terminal Emulator will exit.
Launch Terminal Emulator, it Force Closes. Launch a second time, and you'll have a root shell
Procedure on PC:
$ ./adb push gfree /data/local
On Android:
# cd /data/local
# chmod 777 gfree
# ./gfree -f
# sync
# /data/local/tmp/root
# sync
there can be some errors with directory create – it is ok.
update to 1.72 via system and do following again:
./adb push su /sdcard/su
./adb push Superuser.apk /sdcard/Superuser.apk
./adb push busybox /data/local/tmp/busybox
./adb push root /data/local/tmp/root
./adb shell chmod 0755 /data/local/tmp/*
./adb push psneuter /data/local/tmp/psneuter
./adb shell chmod 777 /data/local/tmp/psneuter
./adb shell /data/local/tmp/psneuter
./adb shell
Finally execute this inside the shell you opened with the previous command >adb shell<:
/data/local/tmp/root
restart mobile and you have root....
update from 1.72 to 1.82 via system and again root:
./adb push su /sdcard/su
./adb push Superuser.apk /sdcard/Superuser.apk
./adb push busybox /data/local/tmp/busybox
./adb push root /data/local/tmp/root
./adb shell chmod 0755 /data/local/tmp/*
./adb push psneuter /data/local/tmp/psneuter
./adb shell chmod 777 /data/local/tmp/psneuter
./adb shell /data/local/tmp/psneuter
./adb shell
Finally execute this inside the shell you opened with the previous command >adb shell<:
/data/local/tmp/root
restart mobile and you have root....
Superusere error is patchable by this:
http://forum.xda-developers.com/showthread.php?t=886999
check /sys/devices/system/cpu/cpu0/cpufreq/current_scaling_freq​

But do we need to be already on 1.82++ or do we need to downgrade to 1.34++ because I don't really understand what we have to do!
PS: really really thank you!!!!! (all other root methods failed for me, so fingers crossed that this one will work!)

You need to have S-OFF; if you don't you need to go to 1.34 to get it, then upgrade back up the chain...

oh, thanks... I guess I'll have to downgrade then, wouldn't I

I guess so, but should only have to do it once...
Sent from my HTC Vision using XDA App

I rooted my 1.72 device a while ago with this tut: http://forum.xda-developers.com/showthread.php?t=905261
Should I be fine by just executing the latest part off this tut?
Code:
update from 1.72 to 1.82 via system and again root:
./adb push su /sdcard/su
./adb push Superuser.apk /sdcard/Superuser.apk
./adb push busybox /data/local/tmp/busybox
./adb push root /data/local/tmp/root
./adb shell chmod 0755 /data/local/tmp/*
./adb push psneuter /data/local/tmp/psneuter
./adb shell chmod 777 /data/local/tmp/psneuter
./adb shell /data/local/tmp/psneuter
./adb shell
Finally execute this inside the shell you opened with the previous command >adb shell<:
/data/local/tmp/root
restart mobile and you have root....

I got error:
E:signature verification failed
I'm using clockwork recovery 2.5.1.3. I think that's the reason, anyone got a fix for this?

hi, I have desire Z with bootloader 1.82.405.1 , from which stage should I start the rooting process?

[Q] need help rooting mytouch 4g 2.3.4

Ok after about 11 hrs I need help I cant get past cd /data/local/tmp says it cant find path and ./misc_version -s 1.00.000.0 cant find path. PLEASE HELP.. Ive rooted my evo's but this is giving me trouble
C:\Users\Josh>adb shell
^C
C:\Users\Josh>adb push fre3vo /data/local/tmp
C:\Users\Josh>adb shell
C:\Users\Josh>adb push misc_version /data/local/tmp/misc_version
C:\Users\Josh>adb push flashgc /data/local/tmp/flashgc
C:\Users\Josh>adb shell chmod 777 /data/local/tmp/*
C:\Users\Josh>adb shell chmod 777 /data/local/tmp/misc_version -s 1.00.000.0
C:\Users\Josh>adb push misc_version -s 1.00.000.0 /data/local/tmp
C:\Users\Josh>adb shell
^C
C:\Users\Josh>./flashgc
'.' is not recognized as an internal or external command,
operable program or batch file.
C:\Users\Josh>adb push ./flashgc
C:\Users\Josh>./flashgc
'.' is not recognized as an internal or external command,
operable program or batch file.
C:\Users\Josh>cd\adb
The system cannot find the path specified.
C:\Users\Josh>

Why on earth are you Ctrl-Breaking the ADB shell? You're supposed to work in it.

Im lost in it. Ive never really use adb..

When you write "adb shell" you get "$" sign, right? Just keep writing the commands after this sign, as if nothing happened.
Follow the guide exactly. Look at my signature, go to Glacier Wiki, section "Root", subsection "Gingerbread", guide for downgrading. It's written in the most understandable way possible. If you still don't understand - please reconsider rooting until you get familiar with ADB, which is not hard to do - there are guides all over the internet that show how to work with ADB, including video guides.

No when I adb Shell I get #. I did figure out you can get SU permission on terminal emulator when you use Super Tool V3. To me thats a easier temp root.

If you get "#" - it means you're getting a root shell, and good to go.
Just write the ADB commands in it.

Ya I found out what I was doing wrong. I placed a data folder then a local folder and tmp in SD card. Then I got it. But I used super V tool 3 to get temp shell root access. It gave me a better shell root.

DirtyCow Test

Someone please test this. I can't right now (at work, don't have G5) so please update me. It works on my HTC 10 but I do not know if it will work on the G5...
CODE:
adb push arm64-v8a/dirtycow /data/local/tmp
adb push arm64-v8a/run-as /data/local/tmp
adb shell 'chmod 777 /data/local/tmp/run-as'
adb shell 'chmod 777 /data/local/tmp/dirtycow'
adb shell '/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as'
adb shell /system/bin/run-as

Honestly Annoying said:
Someone please test this. I can't right now (at work, don't have G5) so please update me. It works on my HTC 10 but I do not know if it will work on the G5...
CODE:
adb push arm64-v8a/dirtycow /data/local/tmp
adb push arm64-v8a/run-as /data/local/tmp
adb shell 'chmod 777 /data/local/tmp/run-as'
adb shell '/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as'
Click to expand...
Click to collapse
I tested those commands but what result are you waiting for ?

YassGo said:
I tested those commands but what result are you waiting for ?
Click to expand...
Click to collapse
Well, what happened?
Also, try and open an adb shell with "adb shell"
EDIT Goddamnit I forgot the last command. My bad! Please try again.

Honestly Annoying said:
Well, what happened?
Also, try and open an adb shell with "adb shell"
Click to expand...
Click to collapse
That's what I've did for the last two commands :
C:\>adb push arm64-v8a/dirtycow /data/local/tmp
[100%] /data/local/tmp/dirtycow
C:\>adb push arm64-v8a/run-as /data/local/tmp
[100%] /data/local/tmp/run-as
C:\>adb shell
[email protected]:/ $ chmod 777 /data/local/tmp/run-as
tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as
/system/bin/sh: /data/local/tmp/dirtycow: can't execute: Permission denied

YassGo said:
That's what I've did for the last two commands :
C:\>adb push arm64-v8a/dirtycow /data/local/tmp
[100%] /data/local/tmp/dirtycow
C:\>adb push arm64-v8a/run-as /data/local/tmp
[100%] /data/local/tmp/run-as
C:\>adb shell
[email protected]:/ $ chmod 777 /data/local/tmp/run-as
tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as
/system/bin/sh: /data/local/tmp/dirtycow: can't execute: Permission denied
Click to expand...
Click to collapse
You aren't running my commands. Just copy and post exactly what I posted

C:\>adb push arm64-v8a/dirtycow /data/local/tmp
[100%] /data/local/tmp/dirtycow
C:\>adb push arm64-v8a/run-as /data/local/tmp
[100%] /data/local/tmp/run-as
C:\>adb shell 'chmod 777 /data/local/tmp/run-as'
/system/bin/sh: chmod 777 /data/local/tmp/run-as: not found
C:\>adb shell '/data/local/tmp/dirtycow /system/bin/run-as /da
s'
/system/bin/sh: /data/local/tmp/dirtycow /system/bin/run-as /d
as: not found
C:\>adb shell /system/bin/run-as
run-as: Usage:
run-as <package-name> [--user <uid>] <command> [<args>]

YassGo said:
C:\>adb push arm64-v8a/dirtycow /data/local/tmp
[100%] /data/local/tmp/dirtycow
C:\>adb push arm64-v8a/run-as /data/local/tmp
[100%] /data/local/tmp/run-as
C:\>adb shell 'chmod 777 /data/local/tmp/run-as'
/system/bin/sh: chmod 777 /data/local/tmp/run-as: not found
C:\>adb shell '/data/local/tmp/dirtycow /system/bin/run-as /da
s'
/system/bin/sh: /data/local/tmp/dirtycow /system/bin/run-as /d
as: not found
C:\>adb shell /system/bin/run-as
run-as: Usage:
run-as <package-name> [--user <uid>] <command> [<args>]
Click to expand...
Click to collapse
It sounds like there's a problem with your /tmp/ directory. Try running "adb shell 'chmod 777 /data/local/tmp/' "

C:\>adb shell 'chmod 777 /data/local/tmp/'
/system/bin/sh: chmod 777 /data/local/tmp/: not found
I can't even ls local directory....but I see your two files in tmp
255|[email protected]:/data/local $ cd tmp
[email protected]:/data/local/tmp $ ls
dirtycow
run-as
[email protected]:/data/local/tmp $

YassGo said:
C:\>adb shell 'chmod 777 /data/local/tmp/'
/system/bin/sh: chmod 777 /data/local/tmp/: not found
I can't even ls local or tmp directory....
Click to expand...
Click to collapse
What the heck dude?? I've never heard of that error... it seems like you just don't have a tmp directory.

Honestly Annoying said:
What the heck dude?? I've never heard of that error... it seems like you just don't have a tmp directory.
Click to expand...
Click to collapse
Sorry dude I edited my message.
adb push arm64-v8a/dirtycow /data/local/tmp
adb push arm64-v8a/run-as /data/local/tmp
adb shell 'chmod 777 /data/local/tmp/run-as'
adb shell 'chmod 777 /data/local/tmp/dirtycow'
adb shell '/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as'
--> warning: new file size (5960) and file old size (14192) diffe
size 14192
[*] mmap 0x7f7eb44000
[*] exploit (patch)
[*] currently 0x7f7eb44000=10102464c457f
[*] madvise = 0x7f7eb44000 14192
[*] madvise = 0 1048576
[*] /proc/self/mem 1996488704 1048576
[*] exploited 0x7f7eb44000=10102464c457f
adb shell /system/bin/run-as
--> running as uid 2000
uid 0

YassGo said:
Sorry dude I edited my message.
Click to expand...
Click to collapse
Ah okay see that now. Do this
adb shell
/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as
/system/bin/run-as
Basically, this adds the "run-as" to the /system/bin directory, which is only accessible by root

Honestly Annoying said:
Ah okay see that now. Do this
adb shell
/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as
/system/bin/run-as
Basically, this adds the "run-as" to the /system/bin directory, which is only accessible by root
Click to expand...
Click to collapse
Okay you forgot chmod 777 on the dirtycow file. Here's what I get now with the last two commands :
adb push arm64-v8a/dirtycow /data/local/tmp
adb push arm64-v8a/run-as /data/local/tmp
adb shell 'chmod 777 /data/local/tmp/run-as'
adb shell 'chmod 777 /data/local/tmp/dirtycow'
adb shell '/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as'
--> warning: new file size (5960) and file old size (14192) diffe
size 14192
[*] mmap 0x7f7eb44000[*] exploit (patch)[*] currently 0x7f7eb44000=10102464c457f[*] madvise = 0x7f7eb44000 14192[*] madvise = 0 1048576[*] /proc/self/mem 1996488704 1048576[*] exploited 0x7f7eb44000=10102464c457f
adb shell /system/bin/run-as
--> running as uid 2000
uid 0

YassGo said:
Okay you forgot chmod 777 on the dirtycow file. Here's what I get now with the last two commands :
adb push arm64-v8a/dirtycow /data/local/tmp
adb push arm64-v8a/run-as /data/local/tmp
adb shell 'chmod 777 /data/local/tmp/run-as'
adb shell 'chmod 777 /data/local/tmp/dirtycow'
adb shell '/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as'
--> warning: new file size (5960) and file old size (14192) diffe
size 14192
[*] mmap 0x7f7eb44000[*] exploit (patch)[*] currently 0x7f7eb44000=10102464c457f[*] madvise = 0x7f7eb44000 14192[*] madvise = 0 1048576[*] /proc/self/mem 1996488704 1048576[*] exploited 0x7f7eb44000=10102464c457f
adb shell /system/bin/run-as
--> running as uid 2000
uid 0
Click to expand...
Click to collapse
Oh crap so sorry! Now run
adb shell
whoami
cd /data
ls
Please post results of that!

[email protected]:/data/local/tmp $ whoami
shell
[email protected]:/data/local/tmp $ cd /data
[email protected]:/data $ ls
opendir failed, Permission denied

YassGo said:
[email protected]:/data/local/tmp $ whoami
shell
[email protected]:/data/local/tmp $ cd /data
[email protected]:/data $ ls
opendir failed, Permission denied
Click to expand...
Click to collapse
Okay, so here's what I can see of this then. This DOES open a root shell, but it closes the shell right after placing "run-as" into /system/bin. If we can keep the shell open then bam root!

YassGo said:
[email protected]:/data/local/tmp $ whoami
shell
[email protected]:/data/local/tmp $ cd /data
[email protected]:/data $ ls
opendir failed, Permission denied
Click to expand...
Click to collapse
WAIT actually try running
SEE NEXT POST

[email protected]:/data $ cd /data/local/tmp
[email protected]:/data/local/tmp $ run-as cat /init.flo.diag.rc
running as uid 2000
uid 0

YassGo said:
[email protected]:/data $ cd /data/local/tmp
[email protected]:/data/local/tmp $ run-as cat /init.flo.diag.rc
running as uid 2000
uid 0
Click to expand...
Click to collapse
Oops, close that root shell and just do
adb shell
run-as cat /init.flo.diag.rc

C:\>adb shell
[email protected]:/ $ run-as cat /init.flo.diag.rc
running as uid 2000
uid 0

YassGo said:
C:\>adb shell
[email protected]:/ $ run-as cat /init.flo.diag.rc
running as uid 2000
uid 0
Click to expand...
Click to collapse
wtf it should be working.
Here's some to try, tell me if any of these work
adb shell
run-as id
run-as ls -lZ /sbin/
run-as ls -lZ /data/