Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Beezie>cd c:/tools

c:\tools>adb shell
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
$ exit
exit

c:\tools>adb push c:\downloads\zImage /data/local/tm/zImage
1774 KB/s (5061880 bytes in 2.786s)

c:\tools>adb push c:\downloads\flash_image /data/local/tmp/flash_image
115 KB/s (9720 bytes in 0.082s)

c:\tools>adb push c:\downloads\zImage /data/local/tmp/zImage
1815 KB/s (5061880 bytes in 2.723s)

c:\tools>adb push c:\downloads\rage.bin /data/local/tmp/rage.bin
119 KB/s (5392 bytes in 0.044s)

c:\tools>adb push c:\downloads\recovery.bin /data/local/tmp/recovery.bin
1707 KB/s (5326568 bytes in 3.047s)

c:\tools>adb shell
$ cd /data/local/tmp
cd /data/local/tmp
$ chmod 755 flash_image
chmod 755 flash_image
$ chmod 755 rage.bin
chmod 755 rage.bin
$ ./rage.bin
./rage.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C

[*] checking NPROC limit ...
[+] RLIMIT_NPROC={1344, 1344}
[*] Searching for adb ...
[+] Found adb as PID 1894
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$

c:\tools>adb shell
# cd /data/local/tmp
cd /data/local/tmp
# ./flash_image boot zImage
./flash_image boot zImage
bml_scan_partitions start!
XSR VERSION: 1.5.2-p4

minor       position           size    blocks       id
   1: 0x00000000-0x00020000 0x00020000      1        0
   2: 0x00020000-0x00160000 0x00140000     10        1
   3: 0x00160000-0x001c0000 0x00060000      3        2
   4: 0x001c0000-0x00800000 0x00640000     50        3
   5: 0x00800000-0x09e00000 0x09600000   1200        4
   6: 0x09e00000-0x17b80000 0x0dd80000   1772        5
   7: 0x17b80000-0x1ef00000 0x07380000    924        6
   8: 0x1ef00000-0x1f540000 0x00640000     50        7

(0) bad mapping information
  No  BadBlock   RsvBlock
   0:      190      4014
   1:     2014      4015
   2:     2293      4016
   3:     2949      4017
   4:     3061      4018
   5:     3564      4019

1: 20000        1       boot12: 140000  10      boot23: 60000   3       boot34:
640000  50      boot5: 9600000  1200    system6: dd80000        1772    data7: 7
380000  924     cache8: 640000  50      recoveryflash_image] bml_read_data : 204
8 bytesflashing boot from zImagebml_write_partition: /dev/block/bml4 open, index
 : 4
BML ready..!!
boot partition unlock, bmlid : 4
boot partition erase, bmlid : 4
flash_image] bml_write_dataLast bytes  wrote 2048, len : 1272Write Result : 5061
880 kbytes#

# reboot
reboot

c:\tools>adb shell
$ su
su
su: permission denied
$ cd /data/local/temp
cd /data/local/temp
cd: can't cd to /data/local/temp
$ cd /data/local/tmp
cd /data/local/tmp
$ ./rage.bin
./rage.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C

[*] checking NPROC limit ...
[+] RLIMIT_NPROC={1344, 1344}
[*] Searching for adb ...
[+] Found adb as PID 1924
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$

c:\tools>adb shell
# cd /system/usr keylayout
cd /system/usr keylayout
cd: bad substitution
# cd /system/usr/keylayout
cd /system/usr/keylayout
# ls
ls
AVRCP.kl               s3c-keypad-rev001a.kl  s3c-keypad-rev0050.kl
qwerty.kl              s3c-keypad-rev0020.kl  sec_headset.kl
s3c-keypad-rev0000.kl  s3c-keypad-rev0030.kl
s3c-keypad-rev0010.kl  s3c-keypad-rev0040.kl
# cp -r /system/usr/keylayout /sdcard/keylayout
cp -r /system/usr/keylayout /sdcard/keylayout
#
c:\tools>adb shell
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
$ su
su
su: permission denied
$ cd /data/local/tmp
cd /data/local/tmp
$ ./rage.bin
./rage.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C

[*] checking NPROC limit ...
[+] RLIMIT_NPROC={1344, 1344}
[*] Searching for adb ...
[+] Found adb as PID 4897
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$
c:\tools>adb shell
# run redbend_ua restore /dev/blocl/bml5 zImage
run redbend_ua restore /dev/blocl/bml5 zImage
run: not found
# redbend_ua restore /dev/blocl/bml5 zImage
redbend_ua restore /dev/blocl/bml5 zImage
RedBend Update Agent 6,1,7,10
commands:
 img [partition name] [delta file] [device node] [temp path]
 fs [partition name] [delta file] [mount point] [temp path]
 png [png file name]
 all
# redbend_ua restore /dev/block/bml5 zImage
redbend_ua restore /dev/block/bml5 zImage
RedBend Update Agent 6,1,7,10
commands:
 img [partition name] [delta file] [device node] [temp path]
 fs [partition name] [delta file] [mount point] [temp path]
 png [png file name]
 all
# redbend_ua restore zImage /dev/block/bml5
redbend_ua restore zImage /dev/block/bml5
RedBend Update Agent 6,1,7,10
commands:
 img [partition name] [delta file] [device node] [temp path]
 fs [partition name] [delta file] [mount point] [temp path]
 png [png file name]
 all
# redbend_wa
redbend_wa
redbend_wa: not found
# redbend_ua
redbend_ua
RedBend Update Agent 6,1,7,10
commands:
 img [partition name] [delta file] [device node] [temp path]
 fs [partition name] [delta file] [mount point] [temp path]
 png [png file name]
 all
#