Is there possible to get root using Toybox instead of Busybox?

[Ivan Alex HC]

title, because Toybox is not well documented around about root questions

[Luxferre]

Sure! As long as you have a way of delivering the unzip binary from the app (see the thread about Wallace method (not Wallace Lite) for reference) or otherwise launching the gateways you need, then the toybox instead of busybox doesn't matter.

The only useful difference of busybox is that it already includes the unzip binary itself. If your system includes curl or wget, you can even download the necessary binaries from outside, not having to extract them from the app archive.

[Ivan Alex HC]

i ask this because my Doro have toybox, no busybox

[Ivan Alex HC]

from my Doro 7060 the list of available commands:

ivan@ivan-linux:~$ adb shell

shell@msm8909_512:/ $ toybox

acpi base64 basename blkid blockdev bzcat cal cat chattr chcon chgrp

chmod chown chroot cksum clear cmp comm cp cpio cut date dd df dirname

dmesg dos2unix du echo egrep env expand expr fallocate false fgrep

find free freeramdisk fsfreeze getenforce getprop grep groups head

help hostname hwclock id ifconfig inotifyd insmod install kill killall

ln load_policy logname losetup ls lsattr lsmod lsusb makedevs md5sum

mkdir mkfifo mknod mkswap mktemp modinfo more mount mountpoint mv

nbd-client nc netcat netstat nice nl nohup od partprobe paste patch

pgrep pidof pivot_root pkill pmap printenv printf pwd pwdx readlink

realpath renice restorecon rev rfkill rm rmdir rmmod route runcon

sed seq setenforce setprop setsid sha1sum sleep sort split stat strings

swapoff swapon switch_root sync sysctl tac tail tar taskset tee time

timeout top touch tr traceroute traceroute6 true truncate tty umount

uname uniq unix2dos usleep vconfig vmstat wc which whoami xargs yes

What can I try to do to get a root access?

[Ivan Alex HC]

Here also the content of /system/bin:

ivan@ivan-linux:~/KaiOS/Doro-system/bin$ ls

acpi                  ime                    renice
adsprpcd              imsdatadaemon          requestsync
am                    imsqmidaemon           resize2fs
applypatch            ims_rtp_daemon         restorecon
appops                inotifyd               rild
appwidget             input                  rm
atrace                insmod                 rmdir
audiod                internal_sdcard        rmmod
audio_test.sh         ioctl                  rmnetcli
b2g-info              ionice                 rmt_storage
b2g-prlimit           ip                     route
b2g-ps                ip6tables              run-as
b2g.sh                iptables               runcon
basename              irsc_util              schedtest
bcc                   keystore               screencap
bdt                   kill                   screenrecord
bin.7z                killer                 sdcard
blkid                 ld.mc                  secdiscard
blockdev              linker                 secure_ui_sample_client
bluetoothd            lmdmesgservice         sed
bmgr                  lminitlogservice       sendevent
bootanimation         lmlogcatservice        sensorservice
btnvtool              lmqxdmservice          seq
bu                    lmtcpdumpservice       service
bugreport             ln                     servicemanager
bzcat                 load_policy            setenforce
cal                   loc_launcher           setprop
cat                   log                    setsid
chcon                 logcat                 settings
chgrp                 logname                setup_fs
chmod                 logwrapper             sgdisk
chown                 losetup                sh
chroot                lowi-server            sha1sum
cksum                 ls                     sleep
cktnvtool_diag        lsmod                  sm
clatd                 lsof                   sort
clear                 lsusb                  split
cmp                   make_ext4fs            ssr_diag
cnd                   make_f2fs              ssr_setup
comm                  md5sum                 start
content               mdnsd                  stat
cp                    media                  stop
cpio                  mediaserver            strings
cplay                 mkdir                  subsystem_ramdump
curl                  mknod                  svc
cut                   mkswap                 swapoff
date                  mktemp                 swapon
dd                    mm-audio-ftm           sync
debuggerd             mmi                    sysctl
df                    mmi_agent32            tac
dhcpcd                mmi_debug              tail
diag_callback_client  mmi_diag               tar
diag_dci_sample       mm-pp-daemon           taskset
diag_klog             mm-qcamera-app         tbaseLoader
diag_mdlog            mm-qcamera-daemon      tc
diag_qshrink4_daemon  mm-qjpeg-dec-test      tee
diag_socket_log       mm-qjpeg-enc-test      telecom
diag_uart_log         mm-qomx-idec-test      test_diag
dirname               mm-qomx-ienc-test      tftp_server
dmesg                 mm-vidc-omx-test       time
dnsmasq               modinfo                time_daemon
dos2unix              more                   timeout
dpm                   mount                  tinycap
du                    mountpoint             tinymix
dumpstate             msm-vidc-test          tinypcminfo
dumpsys               mtdinfo                tinyplay
dun-server            mv                     toolbox
e2fsck                nandread               top
ebtables              ndc                    touch
echo                  netd                   toybox
egrep                 netmgrd                tr
env                   netstat                true
expand                newfs_msdos            truncate
expr                  nice                   tzdatacheck
ext4_resize           nl                     ubiattach
fakeappops            nl_listener            ubiblock
fallocate             nohup                  ubicrc32
false                 n_smux                 ubidetach
fgrep                 od                     ubiformat
find                  paste                  ubimkvol
fmconfig              patch                  ubirename
fmfactorytest         pgrep                  ubirmvol
fmfactorytestserver   pidof                  ubirsvol
fm_qsoc_patches       ping                   uiautomator
free                  ping6                  umount
fsck.f2fs             pkill                  uname
ftmdaemon             PktRspTest             uniq
garden_app            pm                     unix2dos
gatekeeperd           pmap                   updater
getenforce            pm-service             uptime
getevent              pnscr                  usleep
getprop               port-bridge            vdc
gonksched             printenv               vm_bms
gpsone_daemon         printf                 vmstat
gps_test              prlimit                vold
grep                  ps                     wakelock.sh
groups                ptt_socket_app         watchprops
gzip                  pwd                    wc
hal_proxy_daemon      qcom-system-daemon     wcnss_service
hci_qcomm_init        qmi-framework-tests    wdsdaemon
head                  qmi_simple_ril_test    which
hid                   qmuxd                  whoami
hostapd               qseecomd               WifiLogger_app
hostapd_cli           qseecom_sample_client  wm
hostname              racoon                 wpa_supplicant
hwclock               radish                 xargs
id                    radvd                  xtwifi-client
idmap                 readlink               xtwifi-inet-agent
ifconfig              realpath               yes
iftop                 reboot

I don't know why them are azure or green on my terminal, but can be a clue

Il giorno giovedì 26 settembre 2019 00:11:12 UTC+2, Ivan Alex HC ha scritto:

[saperski]

Hi,

you can use "cpio" instead of "unzip" - just build a cpio archive with "find <files> | cpio -odmu > archive.cpio" and you can unpack it with "cpio -iv < archive.cpio". This is used to build initrd images and such.

There are two interesting things there, what is "bin.7z" archive? this is pretty unusual.  privot_root and switch_root can have interesting effects - one can tell the system that / is now somewhere else.

saper

[Ivan Alex HC]

Hi Saper, bin.7z is the archive containing the /bin folder that I've shared on discord, but here the content of /system, or at least a part of it

I'd like to know how to work with a cpio archive (and what it should contain).

[saperski]

On Thursday, September 26, 2019 at 8:53:32 PM UTC+2, Ivan Alex HC wrote:

I'd like to know how to work with a cpio archive (and what it should contain).

cpio is just an idea to not to have to use unzip, that's all... so if you need to unpack something, you can use that...

[Luxferre]

Ivan, azure ones are symlinks, green ones are real files.