Revolutionary - zergRush local root 2.2/2.3 [22-10: Samsung/SE update]

Search This thread

paxChristos

Retired Forum Moderator
Aug 27, 2011
2,032
1,779
37
West Bend
Searched high and low for a stock system dump of the Exhibit. No luck. Any ideas please? Thank you!!!

Sorry dude, looks like there aren't any hiding out there (even samsung doesn't have a stock rom available)

what you could try is find somebody else with an exhibit, and have them pull /system/app and then on your phone, re-root it, and push their file....
(1) other person types "adb pull /system/app C:\[path to where they want to save it]
2) zips up file, and emails it/puts it on dropbox/etc
3) you download and extract file and type "adb push C:\[path to where you saved it] /system/app")

Good luck, I suggest you offer people $$ to do it...
 

Camaro305

Senior Member
Feb 15, 2011
162
26
Sorry dude, looks like there aren't any hiding out there (even samsung doesn't have a stock rom available)

what you could try is find somebody else with an exhibit, and have them pull /system/app and then on your phone, re-root it, and push their file....
(1) other person types "adb pull /system/app C:\[path to where they want to save it]
2) zips up file, and emails it/puts it on dropbox/etc
3) you download and extract file and type "adb push C:\[path to where you saved it] /system/app")

Good luck, I suggest you offer people $$ to do it...

My wife has the same phone as me. So I could try to grab hers. Could you please tell me how to execute those commands? Would I just install the android sdk on a pc and issue those commands via command prompt?
 

saugatdb

Senior Member
Jan 12, 2011
170
28
Kolkata
Works like a charm for SE xperia mini pro sk17i, bootloader is still locked to use the DRM contents of SE. thanks :)
 

Camaro305

Senior Member
Feb 15, 2011
162
26
sent you a pm, check that.

Sent from my R800x using XDA App

I ran adb pull command on the system/app on my phone and it copied a bunch of .apk and .odex files to my c drive. I assume I'm missing some critical .apk's and .odex's and by doing this on my wife's phone, then pushing them to mine, will fix the problem?
 

cmstlist

Senior Member
Jan 11, 2010
3,349
522
Toronto
Google Pixel 4a
Sorry dude, looks like there aren't any hiding out there (even samsung doesn't have a stock rom available)

what you could try is find somebody else with an exhibit, and have them pull /system/app and then on your phone, re-root it, and push their file....
(1) other person types "adb pull /system/app C:\[path to where they want to save it]
2) zips up file, and emails it/puts it on dropbox/etc
3) you download and extract file and type "adb push C:\[path to where you saved it] /system/app")

Good luck, I suggest you offer people $$ to do it...

What you propose has one serious flaw - if you are copying to your desktop and back, you will lose proper file permissions. This can seriously f**k up Android.
 
Last edited:

Camaro305

Senior Member
Feb 15, 2011
162
26
What you propose has one serious flaw - if you are copying to your desktop and back, you will lose proper file permissions. This can serious f**k up Android.

So basically what it seems like I've done, is use Titanium Backup to delete (not freeze) some necessary files/apps from the phone after using the zergrush root method. I'm confused at what to do now, since pulling and pushing seems like it won't help?
 

paxChristos

Retired Forum Moderator
Aug 27, 2011
2,032
1,779
37
West Bend
What you propose has one serious flaw - if you are copying to your desktop and back, you will lose proper file permissions. This can serious f**k up Android.

You are completely right, wow I can't believe I forgot that.

@Camaro305 -- You'll have to chmod 755 [app.apk] & [.odex] and chown root.shell [app.apk] & [.odex] every single file you push before even attempting to reboot

you'll need to have root to run this.
 

Camaro305

Senior Member
Feb 15, 2011
162
26
That's probably the best option out there :p

If you do root again, be very very careful about what you remove. There really isn't much information out there for the Exhibit, and unless you wanna be the pathfinder for everybody, be careful :p

I'm done with root. I'll deal with the bloatware. :D Thanks tons!!!
 

Top Liked Posts

  • There are no posts matching your filters.
  • 87
    revolutionary-banner.png


    Hello!

    We would like to announce the public availability of the root exploit we use in Revolutionary, named zergRush.

    This local root exploit should be Android-wide, across Froyo (2.2) and Gingerbread (2.3). However, this will not work on Android Honeycomb and up (3.0+).

    Simultaneously, we're also releasing source code for this root exploit through our github.

    The binary is available from here: zergRush binary.

    The exploit source is available here: Revolutionary GitHub.

    Usage:

    You will need adb shell to execute this exploit. We need shell permissions.
    Push the binary onto /data/local/ and execute these commands in a shell:

    Code:
    $ chmod 755 /data/local/zergRush
    $ /data/local/zergRush

    The resulting output should look something like this:

    Code:
    [**] Zerg rush - Android 2.2/2.3 local root
    [**] (C) 2011 Revolutionary. All rights reserved.
    
    [**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
    
    [+] Found a GingerBread ! 0x00017118
    [*] Sending 149 zerglings ...
    [*] Trying a new path ...
    [*] Sending 149 zerglings ...
    [*] Trying a new path ...
    [*] Sending 149 zerglings ...
    [*] Trying a new path ...
    [*] Sending 149 zerglings ...
    [+] Zerglings caused crash (good news): 0x401219c4 0x0054
    [*] Researching Metabolic Boost ...
    [+] Speedlings on the go ! 0xafd260a9 0xafd39f9f
    [*] Poping 24 more zerglings
    [*] Sending 173 zerglings ...
    
    [+] Rush did it ! It's a GG, man !
    [+] Killing ADB and restarting as root..enjoy!

    *reconnect adb shell*

    Code:
    # id
    uid=0 gid=0

    That is all folks!

    Update 20-10-2011: zergRush has been updated to include some support for Sony Ericsson phones, updates for Samsung coming soon!
    Update 22-10-2011: updates for Samsung phones, get the new download (or build yourself)
    8
    I have tried the most recent zergRush on my Vizio VTAB 1008 running Gingerbread 2.3.2 and this exploit did not work. Here is the complete output which I ran in manual mode.

    $ ./zergRush

    [**] Zerg rush - Android 2.2/2.3 local root
    [**] (C) 2011 Revolutionary. All rights reserved.

    [**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

    [+] Found a GingerBread ! 0x00015118
    [*] Scooting ...
    [*] Sending 149 zerglings ...
    [+] Zerglings found a way to enter ! 0x10
    [+] Overseer found a path ! 0x000151e0
    [*] Sending 149 zerglings ...
    [+] Zerglings caused crash (good news): 0x40119cd4 0x0054
    [*] Researching Metabolic Boost ...
    [+] Speedlings on the go ! 0x8001a737 0x8003a4bf
    [*] Popping 24 more zerglings
    [*] Sending 173 zerglings ...

    [-] Bad luck, our rush did not succeed :(

    I did notice that other earlier versions of zergRush had been tried on this tablet but none succeeded in rooting it.

    Is it possible to modify the exploit so that it could succeed on this device? Or is it possible that this vulnerability has been patched and will not succeed at all?

    Any help provided by anyone will be HUGELY appreciated. If this helps, I do have the Android source code installed and am able to compile this from source code as needed.

    All other exploits have failed on this tablet. I have tried rageagainsthecage, gingerbreak, etc. It is difficult to believe that Vizio has made such a secure tablet with no exploitable vulnerabilities.

    Thanks again... Getting desperate...

    New version updated to fix this problem, check the GIT ;)
    2
    Getting "[-] Cannot copy boomsh.: Permission denied" from the shell when attempting to run zergRush on HTC Amaze. This was the 2nd time running on this phone after a reboot. The 1st time was successful, however my wife pulled me away so I couldn't finish what I wanted to do with root. No, I'm not going to divorce her over this. :)

    Code:
    macpro:platform-tools $ /android/platform-tools/adb push /android/temp/zergRush /data/local/zergRush
    2076 KB/s (21215 bytes in 0.009s)
    macpro:platform-tools $ /android/platform-tools/adb shell
    $ chmod 755 /data/local/zergRush
    $ /data/local/zergRush
    
    [**] Zerg rush - Android 2.2/2.3 local root
    [**] (C) 2011 Revolutionary. All rights reserved.
    
    [**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
    
    [-] Cannot copy boomsh.: Permission denied
    $ macpro:platform-tools $

    You may need to create /data/local/tmp first.
    Also, if you've already ran this once, you might need to clean up this directory - remove boomsh/sh.
    2
    Anyone that might still find use in this exploit should have a look at DooMLoRD's Easy Rooting Toolkit which uses the zergRush exploit
    1
    Reboot?

    It worked in my HTC Chacha. Then I remounted System as rw. And then after a while(about 30 secs), my device reboots.
    I tried it twice, after deleting /data/local/tmp/*
    Is it normal? My device is S-ON.

    Edited: I found it, it is because I modified the system partition, because after reboot it was as before.
    Thank you.