Database Users

[Q][DEV] Writing to /data partition without root?

Hello I am desperately trying to run a shell script from my java app.
I tried to use http://developer.android.com/reference/java/lang/Runtime.html#exec%28java.lang.String%29 Runtime Exec to run it and it works except nothing really happens and the script is not executed.
My command was "/system/bin/sh /data/local/test.sh", of course properly chmodded. I tried running the test.sh directly, even tried opening a SH instance and pushing commands to the console via output buffer - nothing works.
When I try to run SU for example using any of these methods, I get prompted for superuser access, so it does work, just doesn't work like I want.
Anybody has any idea what's wrong? Or alternative way to run a script post-boot? (init.d executes too early in the startup process for my needs)

Are you capturing the error stream, or just the output stream?

This is everything I tried:
Code:
String[] str = { "/system/bin/sh", "/data/local/test.sh" };
Process p = Runtime.getRuntime().exec(str);
p.waitFor();
Code:
Process p2 = Runtime.getRuntime().exec("/system/bin/sh /data/local/test.sh");
p2.waitFor();
Code:
Runtime runtime = Runtime.getRuntime();
Process p = runtime.exec("/system/bin/sh");
OutputStream os = p.getOutputStream();
String str = "/data/local/test.sh";
byte[] cmds = str.getBytes();
os.write(cmds);
os.flush();
os.close();
calling just "/system/bin/sh" or "su" works - it actually waits indefinitely in each approach but once I try to execute a script it won't budge. I also attempted to run other parametrized commands like "setprop persist.sys.use_dithering 0" and it also failed. I'll try to intercept the error stream, good point.

nik3r said:
This is everything I tried:
Code:
String[] str = { "/system/bin/sh", "/data/local/test.sh" };
Process p = Runtime.getRuntime().exec(str);
p.waitFor();
Click to expand...
Click to collapse
You need the "-c" option to execute a script:
Sorry I missed that in your first post.
Code:
String[] str = { "/system/bin/sh", [COLOR="Red"]"-c",[/COLOR] "/data/local/test.sh" };
Process p = Runtime.getRuntime().exec(str);
p.waitFor();

nope, this is what I have
Code:
String[] str = { "/system/bin/sh", "-c", "/data/local/test.sh" };
Process p = Runtime.getRuntime().exec(str);
p.waitFor();
still no effect, the /data/local/test.sh is 0777 and only contains
Code:
echo "success" > /data/local/testresult.txt
The same command works from ADB even without the -c switch but with the exec command nothing happens.

finally progress
Update: according to the error output the file gets executed BUT it doesn't have permission to write in /data/local/ same problem if I try to write to this dir with java API.
My script needs to write there so I have only one question - is there a permission that would allow me to execute a script with access right to /data partition without root?
I want to modify the userdata partition after first boot of the ROM but I can't ask the user for root, I want to execute my tweaks and reboot the device before even the android login wizard appears so asking for root that has a prompt with timeout is not an option.
I know of an alternative way to do it but it's even more hacky than this and I would like to avoid someone vomiting over my code

Does it need to be /data/local? /data/local/tmp is world-writable on most devices.

In the end it needs to be /data/data/ actually, I want to mess with default settings of apps, system settings database for example... does that mean I need root or game over? Is there no permission for app to get access to the userdata partition?

As far as I know, the Dalvik system was set up that way on purpose to prevent errant apps from causing any problems elsewhere, and to maintain decent security (look how out of control Windows has become), so to answer your question, Yes, I believe you will need root.

nik3r said:
In the end it needs to be /data/data/ actually, I want to mess with default settings of apps, system settings database for example... does that mean I need root or game over? Is there no permission for app to get access to the userdata partition?
Click to expand...
Click to collapse
No, you can't write to /data/data without root (as that would be a major security risk).

Ok thanks guys I will try my dirty workaround

Scripting Commands in Android App?

Hi All,
Things I am trying to do:
1. Connect to remote system
2. Run perl command and get the output on screen.
Could you please guide me on the process where in I can connect to a remote windows/unix machine and run build commands.
Any examples?
Thanks for your help.
Thanks,
Kino

Hi!
I've made something similar - An App that runs some shell scripts on an Ubuntu server over SSH.
Here are some code snippets, hope this helps you
Code:
JSch jsch = new JSch();
Session session = jsch.getSession([I]'ssh-username'[/I],IP, [I]'ssh-port'[/I]);
session.setPassword(SW); // SW ... password ssh-user (for me it's the same pw, ssh-user = su)
Properties prop = new Properties();
prop.put("StrictHostKeyChecking", "no");
session.setConfig(prop);
session.connect();
Channel channel = session.openChannel("exec");
Code:
if(SU) // If Command should run as SU
{
sudoCommand = "sudo -S -p '' " + command;
}
else
{
sudoCommand = command;
}
((ChannelExec) channel).setCommand(sudoCommand);
((ChannelExec) channel).setPty(true);
channel.connect();
OutputStream out = channel.getOutputStream();
ByteArrayOutputStream responseStream = new ByteArrayOutputStream();
channel.setOutputStream(responseStream);
if(SU)
{
out.write((SW + "\n").getBytes());
out.flush();
}
Thread.sleep(1000);
out.write(("logout" + "\n").getBytes());
out.flush();
Thread.sleep(500);
out.write(("exit" + "\n").getBytes());
out.flush();
out.close();
session.disconnect();
channel.disconnect();

Thank you LinuxForce. Thats helpful. I am trying to work on this.
LinuxForce said:
Hi!
I've made something similar - An App that runs some shell scripts on an Ubuntu server over SSH.
Here are some code snippets, hope this helps you
Click to expand...
Click to collapse

Hacking Clarity Ensemble phone

The Clarity Ensemble phone is an Android-based captioning land-line phone. The newest model has an 8" touchscreen. Older model has 7" touchscreen. It comes with an app that runs at startup and keeps you from gaining access to the Android home screen or any other Android apps or settings. While booting up you momentarily see the time and can pull down to touch on Settings and bring up the regular Android settings but very soon as the boot process continues the splash screen and later the ThorB app will take over the screen.
In order to telnet to the device, you first need to start telnetd running on the Ensemble. This can be done by configuring your computer to appear to the Ensemble to be the update server. I directly connected the phone to a laptop Ethernet port. On the laptop, I installed a DHCP server, a DNS server, and a web server. I am running Windows and I used "DHCP Server for Windows" version 2.5.1, ApateDNS, and WWebserver with PHP 5.4.45. I set the laptop to a static IP of 8.8.4.4 since Wireshark revealed that the Ensemble was using that as the DNS server. I set ApateDNS server to return 8.8.4.4 as the IP address for all queries.
In my htdocs folder, I created a directory called thorbfota and inside that a directory called purple_prod. Inside purple_prod I created three files, download_file.php, query_site.php, and query_versions.php.
Code:
<?php
//download_file.php
ignore_user_abort(true);
set_time_limit(0);
//Replace with actual path to your files
$path = "C:/Users/User/Documents/ClarityEnsembleFiles/";
$dl_file = preg_replace("([^\w\s\d\-_~,;:\[\]\(\).]|[\.]{2,})", '', $_GET['filename']);
$dl_file = filter_var($dl_file, FILTER_SANITIZE_URL);
$fullPath = $path.$dl_file;
if ($fd = fopen ($fullPath, "r")) {
$fsize = filesize($fullPath);
$path_parts = pathinfo($fullPath);
$ext = strtolower($path_parts["extension"]);
switch ($ext) {
case "pdf":
header("Content-type: application/pdf");
header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
break;
case "bin":
header("Content-type: application/octet-stream");
header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
break;
case "zip":
header("Content-type: application/zip");
header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
break;
case "apk":
header("Content-type: application/vnd.android.package-archive");
header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
break;
//Add more headers for other content types here
default;
header("Content-type: application/octet-stream");
header("Content-Disposition: filename=\"".$path_parts["basename"]."\"");
break;
}
header("Content-length: $fsize");
header("Cache-control: private");
while(!feof($fd)) {
$buffer = fread($fd, 2048);
echo $buffer;
}
}
fclose ($fd);
exit;
Code:
<?php
//query_site.php
//This forum would not allow me to post links since this is my first post.
//Feel free to move the "h" below right up against the "ttp..."
echo "h" . "ttp://clarityengineering.us/thorbfota/purple_prod/";
?>
Code:
<?php
//query_versions.php
//Replace with actual path to your files
$path = "C:/Users/User/Documents/ClarityEnsembleFiles/";
//Replace file versions with your current version numbers
//To cause phone to update a file, use a number larger that the current version
$file = "ThorB.apk";
$file_ver = "2.63";
$fullPath = $path.$file;
echo $file . "=" . $file_ver . "," . strtoupper(md5_file($fullPath)) . "|\r";
$file = "thorb-ota.zip";
$file_ver = "20150305.182516";
$fullPath = $path.$file;
echo $file . "=" . $file_ver . "," . strtoupper(md5_file($fullPath)) . "|\r";
$file = "dcx.bin";
$file_ver = "b033";
$fullPath = $path.$file;
echo $file . "=" . $file_ver . "," . strtoupper(md5_file($fullPath)) . "|\r";
$file = "eep.bin";
$file_ver = "be25";
$fullPath = $path.$file;
echo $file . "=" . $file_ver . "," . strtoupper(md5_file($fullPath)) . "|\n";
echo "survey=0,0|";
?>
I found that eep.bin was actually just a shell script that is downloaded to the device and run as root. I put my update files in "C:\Users\User\Documents\ClarityEnsembleFiles" but you can put them anywhere you like, just make sure to update the php files above to reflect their location. So far I have only used eep.bin but to keep my php script happy I also created placeholder files, dcx.bin, thorb-ota.zip, and ThorB.apk and placed them with eep.bin in my ClarityEnsembleFiles folder. Below is my eep.bin that starts telnet and simulates pressing the Home button. Just touch "Home Sample" when the "Complete action using" window pops up on the Ensemble. The semicolon at the end of the line avoids having the carriage return kill the command. Alternatively, you could run dos2unix on the eep.bin file and not need the semicolon at the line end.
Code:
#eep.bin
telnetd -l /system/bin/sh;am start -a android.intent.action.MAIN -c android.intent.category.HOME;
Every time you change the eep.bin file and want to run it on the phone make sure to close the Software upgrade screen and touch "Check now" button and then "Upgrade" button.
To install apps on the phone, first download the apk file to the phone with wget and then run "pm install -r YourApp.apk".
I have not found a physical Home, Back or Menu button on the phone so one of the first things you may want to install is a software solution for those. I installed "To Home" and it didn't work when configured with the root option for "Floating Buttons". It works fine when configured with the non-root option for "Floating Buttons". I have not tried any of the several other soft button apps available.
There is a 14 pin connector on the underside of the phone that presumably is used in the factory to connect to a dock for programming. I have not investigated the function of any of the pins but I suspect USB is there as well as possibly serial port(s) and maybe JTAG.
Before connecting the phone to the internet, you probably will want to either disable/uninstall the ThorB.apk app or create a firewall on the phone or on your router to keep it from being able to automatically update and from being able to report back to it's maker.
Besides being available for purchase, the phone is also available from ClearCaptions at no charge if you provide them with a 3rd party certification of being hard of hearing.
As far as using the phone, "Federal law prohibits anyone but registered users with hearing loss from using this device with the captions on." So if your hearing it fine, make sure to turn captions off or don't turn them on.

Telnet is great but I wanted a more secure connection to the phone so I set up an Android cross-compiler and compiled the latest version of dropbear (dropbear-2016.73). I don't have a 64-bit computer so in order to use the latest version of the Android toolchain, I had to boot into Windows and install Cygwin.
Thanks to serasihay for patches to an earlier version of dropbear. I adapted them to work with the latest version of dropbear. The patch can be found by searching dropbear-2016.73-android-20160427.patch on pastebin. Most of the warnings generated during compile were from pre-patched dropbear code and can be viewed on pastebin by searching for "Compile warnings for compiling dropbear-2016.73.android"
After setting up the toolchain, dropbear can be compiled with the following commands:
Code:
tar jxf dropbear-2016.73.tar.bz2
cd dropbear-2016.73
patch -p1 < /path/to/patch/dropbear-2016.73-android-20160426.patch
./configure --build=x86-windows --host=arm-linux-androideabi --disable-zlib --disable-largefile --disable-loginfunc --disable-shadow --disable-utmp --disable-utmpx --disable-wtmp --disable-wtmpx --disable-pututline --disable-pututxline --disable-lastlog
make MULTI=1 SCPPROGRESS=1 PROGRAMS="dropbear dropbearkey scp dbclient"
arm-linux-androideabi-strip.exe dropbearmulti
This generates a single binary file, dropbearmulti which you will want to copy to the phone to /system/xbin/dropbearmulti. Next, you will want to create symbolic links like this:
Code:
cd /system/xbin
ln -s dropbearmulti dbclient
ln -s dropbearmulti dropbear
ln -s dropbearmulti dropbearkey
ln -s dropbearmulti scp
I should probably redo the patch to enable the -R option to create the host keys but for now you can do it with:
Code:
mkdir /etc/dropbear
dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key
dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key
dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key
To start dropbear every time the phone boots, I put my startup command in /system/etc/install-recovery.sh since it is called by init.rc. I would have put it straight in init.rc but init.rc is recreated from boot.img every boot and I didn't feel like getting into changing boot.img yet. Just make sure to make install-recovery.sh executable. The following line is what I use to start dropbear:
Code:
dropbear -A -N root -R /data/.ssh/authorized_keys -U 0 -G 0
Next you will need to copy your public key(s) into /data/.ssh/authorized_keys. You should now be able to ssh to your Clarity Ensemble phone. You can also use scp to copy files to and from the phone. If you use Putty pscp to transfer files, make sure to use the -scp option to force SCP protocol. If not, you will get the error "/usr/libexec/sftp-server: not found" since pscp tries to use sftp which is not installed on the phone.

So can you post a video or pics of what the device screen looks like now? can you actually use the device as a tablet?

Two processes start when I programatically start a shell, but only on one phone

I have the same app on two different phones that have root access but I get different behavior from them while creating a shell. One phone runs CM12, the other runs CM13. My program runs a compiled executable and basically uses the code below. The executables I run won't stop until I close the shell. For this thread, we'll call it "specialProgram". I use 'ps' while using a terminal emulator to check what processes are running.
Code:
........
..................
Process process = Runtime.getRuntime().exec("su");
int processID = -1;
try {
Field f = process.getClass().getDeclaredField("pid");
f.setAccessible(true);
processID = f.getLong(process);
f.setAccessible(false);
} catch (Exception e) {}
System.out.println("Process: " + processID);
OutputStream stdout = process.getOutputStream();
stdout.write("specialProgram\n").getBytes());
..................
........
The phone that runs CM12 will create two processes, one call "su" and another called "specialProgram". The process ID for the process that is called "su", matches the processID for my variable 'processID'.
The phone that runs CM13 will only create a process called "specialProgram". This processes ID matches what my variable 'processID' becomes.
What I assume is that I'm creating a new process from within that shell, when I write to the OutputStream. But this only happens on one of my phones. Why?

So I think I figured it out. When I run
Code:
Process process = Runtime.getRuntime().exec("su");
it creates a process. And then when I run
Code:
stdout.write("specialProgram\n").getBytes());
it create another process. Closing the first process won't close the second process. I made my own class to properly close them though.

S8 - re-enable setup / start up wizard

Hi, I've rooted my Samsung S8 SM-G950F and installed TeamWin Recovery. I've also installed a couple of apps. I will be giving the phone as a present to someone and want them to think it is utterly new, I don't want them to realise I've been on it!
So I need to re-enable the startup wizard on next load...
I've enabled developer options, enabled OEM unlock and USB debugging. I've successfully connected through WINDOWS via USB using Android Studio ADB terminal.
I have once managed to do what I'm asking, so I know i'ts possible - but as I was testing it, I went back through and completed the wizard thinking I'll just redo what I did but now I can't for the life of me replicate what I did to re-enable it!!
These are the commands I entered via ADB, in the order I think I did them:
adb shell
su
pm enable com.sec.android.app.SecSetupWizard/.SecSetupWizardActivity
-> resulted in: Component {com.sec.android.app.SecSetupWizard/com.sec.android.app.SecSetupWizard.SecSetupWizardActivity} new state: enabled
pm enable com.sec.android.app.SecSetupWizard/.SecureInterceptActivity
-> resulted in: Component {com.sec.android.app.SecSetupWizard/com.sec.android.app.SecSetupWizard.SecureInterceptActivity} new state: enabled
am start -n com.sec.android.app.SecSetupWizard/.SecureInterceptActivity
-> resulted in: Starting: Intent { cmp=com.sec.android.app.SecSetupWizard/.SecureInterceptActivity launchParam=MultiScreenLaunchParams { mDisplayId=0 mBaseDisplayId=0 mFlags=0 } }
am start -n com.sec.android.app.SecSetupWizard/.SecSetupWizardActivity
-> resulted in: Starting: Intent { cmp=com.sec.android.app.SecSetupWizard/.SecSetupWizardActivity launchParam=MultiScreenLaunchParams { mDisplayId=0 mBaseDisplayId=0 mFlags=0 } }
pm enable com.google.android.setupwizard/.SetupWizardActivity
-> resulted in: Component {com.google.android.setupwizard/com.google.android.setupwizard.SetupWizardActivity} new state: enabled
am start -n com.google.android.setupwizard/.SetupWizardActivity
-> resulted in: Starting: Intent { cmp=com.google.android.setupwizard/.SetupWizardActivity launchParam=MultiScreenLaunchParams { mDisplayId=0 mBaseDisplayId=0 mFlags=0 } }
reboot
I ran this while screen was locked and avoided interacting with the screen at any point.

Why don't you reinstall the software with odin?

The apps I install need configuring once installed..

I did it..
adb shell am start -a android.intent.action.MAIN -n com.google.android.setupwizard/.SetupWizardTestActivity
I then entered:
reboot
and there it was! So I just turned the phone off.