webOS Forums - форум пользователей телевизоров LG на webOS

[teffd]

Ребята привет. кто-нибудь пробовал в root webos, установить Kodi?

Даже если запустить его бинарник (что очень сложно, т.к у него очень много зависимостей) под armv7a (32-bit) внутри ТВ, то ничего на экране ТВ показываться не будет.
Нужно полностью переписывать приложение, т.к. управление видео и вывод картинки в webOS сильно отличается от, например, Android.

[J4ZZ]

Hi guys.
Sorry, but I don't speek russian but maybe english is ok.

I tried to root Linux LGwebOSTV 3.16.7-77.deua.4 #1 SMP PREEMPT Mon Jun 26 18:48:42 KST 2017 armv7l GNU/Linux but it didn't work. (2016 Model with WebOS 3.0)
It seems that the firstg injection doesn't work.
I tried step by step in terminal and checked if there were changes to ApplicationInstallerUtility. But nothing happend.
Also the injected rep script contains a path (/var/palm/jail/com.palm.devmode.openssh/media/developer/su to copy "su" to /dev/shm/test) that isn't available.
My working dir is /media/developer/ only so I changed the path in the "rep" script and tried again, but no difference.

I wonder how brunor6 succeeded on WebOS 3.5 (which kernel version does it have?)
because as far as I know the dirtyc0w exploit used in this tool should still work on 3.16.7 kernel, shouldn't it?
Can someone tell me, what I'm possibly doing wrong or give any guidance in what to try else?

Best

[Bakugan]

J4ZZ
Try this instruction in English:
https://forum.xda-developers.com/showpo ... ostcount=4

[J4ZZ]

Sekil's instructions are fine. It's not the instructions I'm having problems with.
It's basically my kernel version probably won't let the exploit do it's magic and so "Stage 3" doesn't complete.

How can I verify or check if "firstg" is actually successful?

[teffd]

Sekil's instructions are fine. It's not the instructions I'm having problems with.
It's basically my kernel version probably won't let the exploit do it's magic and so "Stage 3" doesn't complete.

How can I verify or check if "firstg" is actually successful?

It's successful if see you "second stage".

rt.sh

Код: Выделить всё

#!/bin/sh
echo "first stage"
./firstg /usr/bin/ApplicationInstallerUtility rep > /dev/null 2>&1
sleep 2
echo "second stage"
./secstg > /dev/null 2>&1
sleep 2
echo "third stage - "
echo "try install any app from market"
echo "wait..."
while [ ! -f /dev/shm/test/su ]
do
  sleep 2
  echo "try install any app from market"
done
sleep 1
echo "third stage ok"
echo "try get root - input password 1111"
/dev/shm/test/su

Analysis of the exploit - http://forums.webosnation.com/lg-webos- ... ost3450911

[J4ZZ]

I see 'Second Stage' and even 'Third Stage' after a while but nothing happens when trying to install Apps,
except it just installs the app and that's it.
So either nothing is written to ApplicationInstallerUtility at all or it doesn't get called properly when the install procedure is called in stage3 or my kernel version is an already patched one.
How can I check if my kernel version is still vulnerable to dirtyc0w?

[teffd]

How can I check if my kernel version is still vulnerable to dirtyc0w?

http://davemacaulay.com/easily-test-dir ... erability/

Try to clean everything in /media/developer from the exploit, because that exploit doesn't work at the second run.

[J4ZZ]

Thanks for the link but one needs to be root to run the script.

I also tested with a clean /media/developer directory (only /.ssh is left) but nothing changed.

Код: Выделить всё

/media/developer $ ./root
tar: .: Cannot utime: Operation not permitted
tar: Error exit delayed from previous errors
first stage
second stage
third stage -
try install any app from market
wait...
try install any app from market
try install any app from market
...
^C


Do I have to reboot the TV or toggle developer mode off/on again before trying again?

[teffd]

Код: Выделить всё

/media/developer $ ./root
tar: .: Cannot utime: Operation not permitted
tar: Error exit delayed from previous errors


You should debug errors. It's not supposed to happen. You've never mentioned it here which is strange.

https://askubuntu.com/questions/631562/ ... hive-on-an

[J4ZZ]

Utime only tries to re-set the time stamps of the extracted files, which shouldn't be relevant for the script to work.
Anyway since I'm only prisoner I cannot chown or chmod neither /bin/tar nor /tmp like suggested in the guides!
Any other ideas?
Did LG possibly changed something with the developer account permissions in my firmware? Why did it work for brunor on WebOS 3.5?