LightBlog

lundi 4 avril 2016

[Please help testing] Root exploit - iovyroot for Xperia M5 family

So, good news everybody, @zxz0O0 recently released a root exploit based on CVE-2015-1805 entitled iovyroot that allows getting temporary root on Xperia Z3+/Z4/Z5 family (they can't get permanent root with locked bootloader because of dm-verity). For our luck, this same vulnerability is also present on some firmwares of Xperia M5, and unlikely the flagships, those exploitable firmwares doesn't have dm-verity, which means we can get root access without depending of proprietary stuff like KingRoot with its dubious root managing app.


How to test
First, please note this is just a test version, it won't actually root the device, only check if the exploit works. After confirming the exploit is working as intended, an official iovyroot update will be released with support to Xperia M5 family. Following this update, I'll release a simple SuperSU installer so we can easily get root and SuperSU without depending of KingRoot and its dubious stuff in future.

To test, enable USB Debugging on your device and make sure ADB drivers are installed, then download and run the ZIP package attached at this thread. If the exploit works for you, the output should be something like this:
Code:

iovyroot by zxz0O0
poc by idler1984

[+] Changing fd limit from 1024 to 4096
[+] Changing process priority to highest
[+] Getting pipes
[+] Allocating memory
[+] Installing JOP
    [+] Patching address 0xffffffc0011f52b0
    [+] Start map/unmap thread
    [+] Start write thread
    [+] Spraying kernel heap
    [+] Start read thread
    [+] Done
[+] Patching addr_limit
    [+] Patching address 0xffffffc003618008
    [+] Start map/unmap thread
    [+] Start write thread
    [+] Spraying kernel heap
    [+] Start read thread
    [+] Done
[+] Removing JOP
got root lmao
Press any key to exit...

After testing, reply to this thread listing your firmware version and variant and confirming wether the exploit worked or not. Please note also that only the firmwares listed below either on "Confirmed working" or "Needs Testing" are supported. That's because Sony already fixed this exploit on the newer firmwares...

Furthermore, if anyone is seeking for FTFs of the older firmwares to test, they are still available on XperiFirm under some regions/carriers. Also, if you're wiling to downgrade your device with Flashtool for testing, make sure you're using version 0.9.20.0 or newer and answer yes when it asks if you want to use the .fsc script, otherwise you may brick your phone. If you already have Flashtool installed, it's recommended to trigger a manual devices sync (Devices => Devices Sync => Manual Sync) to make sure you get the .fsc script for M5 since its inclusion in the database was something done recently...


Firmwares that needs testing
For single SIM variants (E5603, E5606 and E5653):
- 30.0.A.1.23
- 30.1.A.1.33

For dual SIM variants ( E5633, E5643 and E5663):
- 30.0.B.1.23


Firmwares confirmed working
- 30.1.B.1.33 on E5643 by @mbc07

Attached Files
File Type: zip iovyroot_E56XX_test.zip - [Click for QR Code] (514.0 KB)


from xda-developers http://ift.tt/1q1eqB2
via IFTTT

Aucun commentaire:

Enregistrer un commentaire