78 lines
1.9 KiB
Bash
78 lines
1.9 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
repo_root="$(cd "$(dirname "$0")/.." && pwd)"
|
||
|
|
adb_bin="${ADB_BIN:-adb}"
|
||
|
|
serial=""
|
||
|
|
assume_yes=0
|
||
|
|
|
||
|
|
while [[ $# -gt 0 ]]; do
|
||
|
|
case "$1" in
|
||
|
|
--serial)
|
||
|
|
serial="$2"
|
||
|
|
shift 2
|
||
|
|
;;
|
||
|
|
--yes)
|
||
|
|
assume_yes=1
|
||
|
|
shift
|
||
|
|
;;
|
||
|
|
*)
|
||
|
|
echo "Usage: $0 [--serial ADB_SERIAL] [--yes]" >&2
|
||
|
|
exit 2
|
||
|
|
;;
|
||
|
|
esac
|
||
|
|
done
|
||
|
|
|
||
|
|
adb_args=()
|
||
|
|
if [[ -n "$serial" ]]; then
|
||
|
|
adb_args=(-s "$serial")
|
||
|
|
fi
|
||
|
|
|
||
|
|
"$repo_root/scripts/check-target.sh" "$serial"
|
||
|
|
|
||
|
|
if command -v shasum >/dev/null 2>&1; then
|
||
|
|
(cd "$repo_root" && shasum -a 256 -c SHA256SUMS)
|
||
|
|
else
|
||
|
|
(cd "$repo_root" && sha256sum -c SHA256SUMS)
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [[ "$assume_yes" != 1 ]]; then
|
||
|
|
printf 'Type ROOT to run the kernel exploit on this tablet: '
|
||
|
|
read -r confirmation
|
||
|
|
[[ "$confirmation" == ROOT ]] || exit 3
|
||
|
|
fi
|
||
|
|
|
||
|
|
"$adb_bin" "${adb_args[@]}" push \
|
||
|
|
"$repo_root/bin/hp-slate7-cve-2015-1805-root" \
|
||
|
|
/data/local/tmp/cve-2015-1805-root
|
||
|
|
"$adb_bin" "${adb_args[@]}" push \
|
||
|
|
"$repo_root/bin/hp-slate7-install-root" \
|
||
|
|
/data/local/tmp/install-root
|
||
|
|
"$adb_bin" "${adb_args[@]}" push \
|
||
|
|
"$repo_root/bin/hp-slate7-su" \
|
||
|
|
/data/local/tmp/rootsh-armv7
|
||
|
|
|
||
|
|
"$adb_bin" "${adb_args[@]}" shell \
|
||
|
|
'chmod 755 /data/local/tmp/cve-2015-1805-root /data/local/tmp/install-root /data/local/tmp/rootsh-armv7; sync'
|
||
|
|
|
||
|
|
set +e
|
||
|
|
"$adb_bin" "${adb_args[@]}" shell \
|
||
|
|
'/data/local/tmp/cve-2015-1805-root; rc=$?; echo DEVICE_RC=$rc; exit $rc'
|
||
|
|
exploit_rc=$?
|
||
|
|
set -e
|
||
|
|
|
||
|
|
if [[ "$exploit_rc" != 0 ]]; then
|
||
|
|
echo "Exploit did not complete cleanly. Reboot before any retry." >&2
|
||
|
|
exit "$exploit_rc"
|
||
|
|
fi
|
||
|
|
|
||
|
|
"$adb_bin" "${adb_args[@]}" wait-for-device
|
||
|
|
root_id="$($adb_bin "${adb_args[@]}" shell '/system/xbin/su -c id' | tr -d '\r')"
|
||
|
|
echo "$root_id"
|
||
|
|
[[ "$root_id" == uid=0\(* ]] || {
|
||
|
|
echo "Root verification failed." >&2
|
||
|
|
exit 4
|
||
|
|
}
|
||
|
|
|
||
|
|
echo "Root verified. See README.RU.md for cleanup and reboot verification."
|