Wednesday, September 14, 2011

Rooting the Samsung Admire

The bug I ended up using is humorously similar to the one I used on the Droid 3. I found that whenever an application crashes (via segmentation fault, etc.) a dump file is created at/data/log/dumpState_app_native.log by root, with world-writable permissions.
This file’s parent directory is world-writable, so by placing a symbolic link at this location and causing a program to crash, it’s possible to create a world-writable file anywhere on disk.
The Samsung Admire conveniently doesn’t have an existing /data/local.prop, the properties file I leveraged with Droid 3 to get root, allowing us to create our own.
The Motorola-specific property I used to prevent ADB from dropping privileges on Droid 3 obviously won’t work here, but the ro.kernel.qemu property will accomplish the same thing.
You can download a one-click root script for Linux and OS X here. I’ll mirror a Windows version as soon as someone ports it. Feel free to e-mail me if you find this exploit works on other Samsung phones, and I’ll update this post.
Update: this exploit is also confirmed to work on the Samsung Galaxy Prevail.

No comments:

Post a Comment