Re: [PLUG] Hacking Tizen via microSD silliness

[Aaron Mulder <ammulder@alumni.princeton.edu>]

If that was going to work, would it work to use an SD card with the
physical read-only switch on it, throw the switch, and use an adapter
like this:

https://www.amazon.com/SD-to-Micro-Adapter/dp/B0143QFXYO

I don't know how those switches work -- whether the card enforces it
or whether it relies on the OS, but it would certainly be easier to
try than the FPGA business.

Thanks,
      Aaron

On Tue, May 22, 2018 at 7:27 AM, Philip Rushik <prushik@gmail.com> wrote:
> Hey everybody,
>
> I have a weird phone, the Samsung Z1 (the first Tizen based phone). I would
> like to get root access to it, though because its not a common (in the US)
> phone, there are no prepackaged root exploits available for it.
>
> I noticed that it does something weird with microSD cards though. It
> automounts the
> file system when the card is inserted, but does not mount with nosuid or
> noexec flags. I thought this would make rooting it easy, but it turns out it
> does something much stupider to prevent me from inserting a suid root su or
> sh. To prevent using suid root programs from an SD card, the phone goes
> through the microSD card when it is mounted and rewrites the owner of all
> files (uid 1005 iirc). And yes, it does actually modify the card, not just
> treat all files as logically uid 1005.
>
> My next thought was to make a microSD card shaped connector that attaches to
> an SD card, but with an FPGA in between, and the FPGA would pass through all
> reads, but intercept writes and just pretend they were successful. That way,
> the phone wouldn't be able to rewrite the owner and all suid executables
> would remain suid root when I tried to execute them, thus giving me root
> access.
>
> However, this seems like it would be a big time/work investment, can anybody
> think of an easier solution?
>
> ___________________________________________________________________________
> Philadelphia Linux Users Group         --        http://www.phillylinux.org
> Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
> General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug
>
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug