forked from CunningLogic/BurritoRoot
-
Notifications
You must be signed in to change notification settings - Fork 0
/
README
118 lines (97 loc) · 3.88 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
Please see the LICENSE file
BurritoRoot is a root exploit for the Kindle Fire, released to gain root on the 6.2.1 firmware. Originally
licensed under a proprietary license, we re-released under the GPL due to blatant code theft by the author
of 'unlockroot'. Not only is he a thief, but a moron, hell he stole the unroot code of our's that was broken.
How it all works
In /sbin/adbd is a secondary property check to see if adbD can run as root, "service.root.amazon.allow". Normally
this can only be set by a system or root process.
<snippet>
.rodata:000203EC aService_root_0 DCB "service.root.amazon.allow",0
.rodata:000203EC ; DATA XREF: .text:0000EFECo
.rodata:00020406 ALIGN 4
.rodata:00020408 a1_0 unicode 0, <1>,0 ; DATA XREF: .text:0000EFF0o
.rodata:00020408 ; .text:0000F000o
.rodata:0002040C aAdbdCannotRunA DCB "adbd cannot run as root in production builds",0xA,0
.rodata:0002040C ; DATA XREF: .text:0000EFF4o
.rodata:0002043A ALIGN 4
.rodata:0002043C aService_adb__1 DCB "service.adb.root",0 ; DATA XREF: .text:0000EFFCo
.rodata:0002044D ALIGN 0x10
.rodata:00020450 aRestartingAdbd DCB "restarting adbd as root",0xA,0
.rodata:00020450 ; DATA XREF: .text:0
</snippet>
In Services.jar is the BroadcastReveiver com.lab126.services.EasterEggReceiver that allows the above property to
be set with a broadcast from any application.
<snippet>
.method private enable(Z)V
.locals 2
.parameter "enabled"
.prologue
.line 47
if-eqz p1, :cond_0
const-string v1, "1"
move-object v0, v1
.line 49
.local v0, value:Ljava/lang/String;
:goto_0
const-string v1, "service.root.amazon.allow"
invoke-static {v1, v0}, Landroid/os/SystemProperties;->set(Ljava/lang/String;Ljava/lang/String;)V
.line 51
return-void
.line 47
.end local v0 #value:Ljava/lang/String;
:cond_0
const-string v1, "0"
move-object v0, v1
goto :goto_0
.end method
</snipper>
After causing this property to be set, the user can simply do "adb root" and then adbD will run as root.
/**
* @author jcase - Justin Case - [email protected]
* @author TeamAndIRC - http://twitter.com/TeamAndIRC
*
* Testers:
* VashyPooh
* Trevor Eckhart
*
* Great Being of Knowledge:
* IOMonster
*
* Supporters:
* http://AndroidPolice.com
* http://RootzWiki.com - b16 for the graphics!
*
* Copyright 2011 CunningLogic
* This file is part of BurritoRoot.
*
* BurritoRoot is free software: you can redistribute it and/or modify it under the terms of the
* GNU eneral Public License as published by the Free Software Foundation, either version 3 of
* the License, or (at your option) any later version.
*
* BurritoRoot is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License along with Foobar. If not, see
* http://www.gnu.org/licenses/gpl-3.0.txt
*
*/
/**
* The Wall Of Shame
*
* Organizations and persons listed below have violated the copyright and/or licensing of BurritoRoot
* and have had their rights to use any part or derivative of BurritoRoot revoked.
*
* You are scum, you steal the hard work of our developers. You even stole my non working unroot code
* you f*cking bum.
*
* Author of unlockroot
* http://www(dot)unlockroot(dot)com
* Liang Bing
* Hong Kong
* tel: 86 01088524866
* fax: 86 01088524866
*
*/