DirtyCow Test

Jan 30, 2014
20
2
0
I just read through it again. I was getting overly excited and skimming a lot.

I figured out what I needed to figure out on my own. Offer rescinded, I guess. I had an RS988 that was being mucked up by rent-a-center lock. I used Debloater to disable *right* after removing from phone admins...deleted some files/folders with permissions admin(partially cool program), .........I had been wanting to delete the persistant folders, etc.
 

SilverZero

Senior Member
May 18, 2010
1,523
392
0
On the Sprint G5, couldn't we use this to pull the Android 7.0 update file, modify it, replace it and then let it install since it wouldn't be able to revert?
Seems to me it wouldn't flash in the first place because as soon as you modify it you break the signature. If it was going to be that easy somebody would have done it with a previous OTA.
 

Warboy

Senior Member
Jan 25, 2008
383
130
0
Kansas City, MO
Seems to me it wouldn't flash in the first place because as soon as you modify it you break the signature. If it was going to be that easy somebody would have done it with a previous OTA.
we couldn't do it with previous OTAs because it required root permissions to write the file to my knowledge since it's not stored in the user partition.

The OTA file should have less security on it than a TOT file.
 

SilverZero

Senior Member
May 18, 2010
1,523
392
0
On the Sprint G5, couldn't we use this to pull the Android 7.0 update file, modify it, replace it and then let it install since it wouldn't be able to revert?
we couldn't do it with previous OTAs because it required root permissions to write the file to my knowledge since it's not stored in the user partition.

The OTA file should have less security on it than a TOT file.
Isn't the file still signed? And wouldn't modifying it at all break the signature? And isn't the big issue at hand that the bootloader won't flash an unsigned image?
 

Warboy

Senior Member
Jan 25, 2008
383
130
0
Kansas City, MO
Isn't the file still signed? And wouldn't modifying it at all break the signature? And isn't the big issue at hand that the bootloader won't flash an unsigned image?
Well, A update would trigger a refresh of all signatures wouldn't? especially a major version update. So if we can modify the update enough to force our signatures?
 

henryjumbo

Member
Nov 2, 2014
38
13
0
Do you mean like some type of "man-in-the-middle" method? I would guess that the device is set to retrieve a signed update and if a modified or unsigned update is created the lock bootloader would cease to load the suspected update.

I wonder if it would be possible to use DirtyCow exploit to unlock the bootloader with some kind of Loki hack?
 
Last edited: