yandex-station-2-s905x2-root
A single read() of a sysfs node returns a root shell.
- Root exploit
- Stable
- Medium brick risk
This project hasn't been claimed by its maintainer yet, so its details come from the community. Is it yours? Claim it
Before you start
- How hard is it?
- HardUses the command line or developer tools.
- What you need
- Comfort with the command line
- A computer
- Can it break my device?
- Small chance of trouble, with a way to recover.
- Can I undo it?
- The project doesn't say. Assume you can't.
Did it work for you?
Did yandex-station-2-s905x2-root work on your Yandex Station?
No reports yet.
One-tap reports from owners. Bricked reports are checked before they count.
Compatibility
Devices: Yandex Station.
No compatibility information yet.
Getting started
From the project's README ("Quick start"):
build only python tools/build.py /path/to/android-ndk-r26d
build, push and run python tools/build.py /path/to/android-ndk-r26d --device python tools/build.py /path/to/android-ndk-r26d --device --serial <host>:5555
The script checks uptime before running, verifies md5 after push, and prints the tail of the log.
The binary is not committed, and its md5 depends on the payload compiled into it, so there is no single expected value. What the check is for is comparing the local md5 against the one read back from the device after the push: that is what catches the silent push failure described under Pitfalls. The value below belongs to the build that dumps boot.img — the payload the reference run used. A build with a different payload will not match it, and that is expected:
7d59c29b246ec99ce578a095ae0bfa43
By hand:
CC=$NDK/toolchains/llvm/prebuilt/windows-x8664/bin/armv7a-linux-androideabi21-clang.cmd cd src && "$CC" -O2 -fPIE -pie -DSHELL -o reader4 reader4.c -ldl
adb connect <host>:5555 adb push reader4 /data/local/tmp/reader4 adb shell "md5sum /data/local/tmp/reader4" # compare with the local copy adb shell "chmod 755 /data/local/tmp/reader4" adb shell "rm -f /data/local/tmp/r4.log; timeout 240 /data/local/tmp/reader4 > /data/local/tmp/r4.log 2>&1; echo RUNDONE; id; getenforce"
Risk and recovery
- Brick risk
- Medium
- Requires opening the device
- No
Credits, license and support
- License
- MIT