Showing posts with label Hacking. Show all posts
Showing posts with label Hacking. Show all posts

Friday, November 7, 2008

Howto: Prevent OTA Update for the G1 Phone to retain Root access


OTA updates are all cryptographically signed to prevent you from spoofing the update and installing something on your phone that you shouldn't. Ironically, this signature checking makes it relatively easy for you to prevent OTA updates from being applied once you have gotten root access on your phone.

To prevent OTA updates, you can simply move the otakeys.zip file from the expected location to another location on your device.

mv /system/etc/security/otacerts.zip /system/etc/security/otacerts.zip.nothankyou

That one line will move the otakeys to a location the updater can't check for it - and once the OTA update is downloaded, it will be unable to apply.

Note, however, the OTA update will say "failed" and then immediately restart downloading it once the signature check fails - so this fix is less than ideal but will at least prevent you from waking up one day to a phone that doesn't love you as much as it did the day before.

It should also be noted that the "recovery mode" of the phone does NOT use the otakeys.zip to check for the signature - currently it uses a compiled-in list of signatures to check for - so moving the otakeys.zip has no effect at all on doing an SD Card update.


Original content for this was originally found here

Wednesday, November 5, 2008

Root your Android G1 Phone and install Busybox on it!

As you seen before this post I have managed to gain root on the G1 phone, in the mean time their has been easier steps on getting root, and installing busybox...

Here are the steps you can take:

1. Download and install a terminal emulator on your phone. (Click here for Term.apk)
2. Make sure your phone is not connected to your PC and open up the Terminal Emulator and run 'telnetd'
3. Now telnet into your phone from your PC (run 'netstat' in the terminal emulator to get the phone's IP)
4. In the telnet terminal you are now root!

5. (optional) To permanently enable root access you can create an "su" command in /system/bin (Warning: creating su on your system could make you vulnerable to malicious software. You could name it something besides su, but you could still be vulnerable):

mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /system/bin
cat sh > su
chmod 4755 su

Now you can fire up the Terminal Emulator and run "su" to be root.

Now once that is all done download http://www.billrocks.org/android_libs/bin/busybox to the sdcard, then do:

cat /sdcard/busybox >/system/bin/busybox

chmod 4755 /system/bin/busybox, now you can execute hundreds of busybox commands like a full linux shell!



Tuesday, November 4, 2008

Howto: Get ROOT on your Android G1 and Telnet to your phone!

Grab pTerminal from the market, reboot your phone, open pterminal quickly, cd to /system/bin/
then enter telnetd 2 or 3 times, then type telnet "your phone ip"

Take a look:
kyle@ion:~$ telnet 192.168.0.88
Trying 192.168.0.88...
Connected to 192.168.0.88.
Escape character is '^]'.
# id
uid=0(root) gid=0(root)
# cd proc
# cat version
Linux version 2.6.25-01843-gfea26b0 (android-build@apa27.mtv.corp.google.com) (gcc version 4.2.1) #6 PREEMPT Mon Oct 6 14:13:36 PDT 2008