View Single Post
Old 12-30-2011, 11:26 AM   #41
ixtab
(offline)
ixtab ought to be getting tired of karma fortunes by now.ixtab ought to be getting tired of karma fortunes by now.ixtab ought to be getting tired of karma fortunes by now.ixtab ought to be getting tired of karma fortunes by now.ixtab ought to be getting tired of karma fortunes by now.ixtab ought to be getting tired of karma fortunes by now.ixtab ought to be getting tired of karma fortunes by now.ixtab ought to be getting tired of karma fortunes by now.ixtab ought to be getting tired of karma fortunes by now.ixtab ought to be getting tired of karma fortunes by now.ixtab ought to be getting tired of karma fortunes by now.
 
ixtab's Avatar
 
Posts: 2,903
Karma: 6677557
Join Date: Dec 2011
Device: K3, K4, K5, KPW, KPW2
I think I just found an alternative way of jailbreaking the device. I actually stumbled upon this while looking for a way to de-brick a KT which is not showing any UI, but is at least capable of booting up to the point of announcing itself as a USB device.

So here's how it goes:
- /etc/upstart/filesystems.conf contains a line to extract, and then delete, /mnt/us/data.tar.gz if present
- this file can be made to contain absolute path locations. ("tar cvfzP").
- This alone only allows us to write to whatever is already mounted read-write. But that includes, for example, "/var/local/system/locale".
- The locale file in turn is sourced from pretty much everywhere ("source /var/local/system/locale"), and can contain shell code.

I'm attaching a proof-of-concept exploit. *RENAME* RUNME.sh.txt to RUNME.sh, then just copy both files to /mnt/us (or even just into the root folder via USB drive). Then reboot. The result should be:
- Three new files in /mnt/us/, namely RUNME.{done,out,err}. For reasons completely obscure to me, sometimes the .out file stays empty, even though it shouldn't. May just be a FS syncing problem though. In any case, the actual execution DID take place in all cases (for me).
- For the proof-of-concept, a copy of /opt/amazon/ebook/config/locales/default.properties has been made as "jb.properties".

As said, this may not only be useful for jailbreaking, but also for de-bricking devices which don't properly get the UI running anymore. As long as USB drive access works, this method should also work. For a bricked device, the reboot is achieved by long-pressing (30 secs?) the power button.

Let me know if this is reproducible.

UPDATE: For newbies: This is NOT a jailbreak! DO NOT USE THIS UNLESS YOU KNOW WHY AND HOW TO USE IT CORRECTLY!
Attached Files
File Type: gz data.tar.gz (207 Bytes, 3695 views)
File Type: txt RUNME.sh.txt (207 Bytes, 1793 views)

Last edited by ixtab; 10-23-2012 at 05:37 PM.
ixtab is offline   Reply With Quote