root sonim xp3800
I’m not gonna go through everything cus it’s already documented very well in the repo. I’ll just go over the basics of what this is.
There are 2 parts to this repo and the releases.
- The app (more on this below)
- The firehose (for magisk style root)
The app
apps features
- Persistent root (yes persistent!) with insanely fast speeds and reliability
- APK and xapk local installation (no adb needed) using root
more info
This is built on CVE-2019-2215. The xp3800 is also vulnerable, but this exploit was never written for 32bit architecture. So besides reverse engineering the kernel to get all the offsets (which wasn’t easy at all), the actual exploit caused a kernel panic every single time. The method the original exploit uses to corrupt and read write kernel memory, due to 32bit differences couldn’t work as is. After some failed attempts, I got it working and after a lot of debugging and improving, kernel panics are down to 0 (as much as I tried) and reliability is basically %100 (technically the workaround introduces a race condition but after the improvements it just works). 1 of the (or the main) part that makes this so fast and reliable, is that the exploit only runs once to set up a root daemon. After that, every invocation just uses that running daemon. The su binary is put into /system/binso it’s totally persistent. There’s also no dm verity active on this device so editing /system you get for free.
All this and more and a step by step deep dive of the entire exploit, port age daemon is well documented in the docs of the repo.
Repo
The amount of hours this took me is - let’s just say more then I thought it would. But it was all worth it. I love doing this type of low level exploitation. I’d appreciate feedback weather a star on GitHub or feedback on using the app or what you think about it.