That’s right!! you can now install apps directly on the phone without using ADB!!
(sorry if I seem too excited)
as widely discussed on this forums, it’s impossible to install apps directly onto Sonim phone’s, and it’s implemented with deep signature and hash checks which makes it basically impossible to bypass till i made this. this app I made features an extremely simple UI with 1 simple button to choose a file which opens up sonim’s default file selector and allows you to choose any apk file which when selected gets installed automatically. fully works with dpad.
g is not needed but why not. if there is one alreadt you’ll have to find out if theres a way to remove it. i have no clue but probably yes. otherwise how do filters do it? (the ones that work with device owner)
btw @Dev-in-the-BM_2.0 I’m working on it now. will see if its not too hard. (it requires changing tons of code)
I tried and got a milion times the same stupid error of it not being the right version of dhizuku or not the right repo. its pretty clearly not the case but remind me tom and also if anyone else wants this lmk
if you’re a terminal user (any terminal including but not limited to termux) you can download this file and copy it to the terminals home directory and run chmod +x su.exe (or whatever you rename it to. Couldn’t upload file with no extension lol) and then ./su.exe which will give you temporary root and pm install path/to/anything.apk will now work directly from terminal without setting device owner.
Seems like i can’t upload it here normally at all. Let me know how i can if yes.
Can’t put it on drive either as it gets detected as virus. (it’s a root exploit) so if anyone has a way i can upload it…
otherwise you can find it on the github repo i think i posted a link there
How It Works (Technical Flow)
1. Binder Exploitation: Opens /dev/binder (Android IPC mechanism) and uses
epoll to trigger a use-after-free vulnerability in the kernel's waitqueue
handling
2. Memory Corruption:
- Uses EPOLL_CTL_DEL to trigger the bug
- Leverages iovec structures with readv/writev to achieve kernel read/write
primitives
3. Kernel Memory Access:
- Leaks kernel memory via corrupted pipe buffers
- Locates task_struct (process descriptor) in kernel memory
- Finds and patches addr_limit to gain arbitrary kernel R/W
4. Privilege Escalation:
- Locates cred structure (credentials)
- Overwrites UIDs to 0 (root)
- Enables all capabilities
- Disables SECCOMP (sandboxing)
- Disables SELinux enforcing mode
- Patches kallsyms format strings to bypass KASLR protections
5. Shell Spawn: Finally "pops out root shell" with full privileges
Key Strings That Reveal Its Purpose
MAIN: setting root credentials
changing UIDs to 0
MAIN: UID = 0
MAIN: enabling capabilities
MAIN: disabling SECCOMP
MAIN: disabled selinux enforcing
MAIN: root privileges ready
MAIN: popping out root shell
Usage Flags
- -quiet - Suppresses verbose output
- -dump - Dumps memory for debugging
Summary
This is a rooting binary for Android - a compiled kernel exploit that
leverages a binder/epoll vulnerability to escalate from unprivileged app
context to full root access. It's designed for kernel version 3.x/4.x Android
devices and appears to target the waitqueue offset at 0x98.
perfectly put. I’d just add that this script specifically unlike many others has very robust checking to ensure it gets the exact locations and structures where it has to write to which is critical since the xp5 is a very specific structure not similar to many others.
Also important I forgot to mention this will ONLY work on the xp58. Won’t work on any other sonim version.
