The blog of Matt's Forensic Adventure
2015-07-11T22:13:23+01:00
Matt's Forensic Adventure
mboyer@sdf.org
Hacklog #6: Dumping the whole filesystem
2015-01-03T00:00:00+00:00
/2015/01/03/Hacklog#6
<h1>I want it all</h1>
<p>As of the <a href="/PYaffs/2014/09/04/Hacklog%235.html">last post</a>, I know how to use the original firmware's <code>/system/xbin/su</code> to get superuser privileges on the phone. That's pretty cool since it lets me access the full filesystem, but I'm still limited in the sense that I can only do this by interacting with a shell running on the phone from my <a href="/PYaffs/2014/07/16/Hacklog%231.html">Windows VM</a> or with a terminal emulator running on the phone itself. I use Jack Palevich's <a href="https://play.google.com/store/apps/details?id=jackpal.androidterm">Terminal Emulator</a> app for that and while it works very well, there's no denying that the on-screen keyboard is very tiny and the touch detection on this phone is a bit spotty which makes for a cramped and unpleasant experience. While using <code>adb</code> from the VM is certainly still an option, I'd prefer the comfort of using native Linux tools.</p>
<p>Moreover, while being able to run code from a *nix shell on the phone is invaluable, there are things I need to do offline from a full-featured workstation where I've access to reverse-engineering tools. The analysis of <code>/system/xbin/su</code> is a good example of that.</p>
<p>In that case, I was able to get the file onto my laptop by <a href="/PYaffs/2014/08/12/Hacklog%234.html">extracting it</a> using a custom tool from a <a href="/PYaffs/2014/07/31/Hacklog%233.html">flash memory dump</a>. Unfortunately, while PYaffs works well on the <code>/system</code> FS dump, I've not yet gotten it to work on the <a href="/PYaffs/2014/07/21/Hacklog%232.html">other filesystem dumps</a>.</p>
<p>In order to solve both these problems, I want to install a SSH daemon on the phone so I can connect to it wirelessly and use that to copy the entire phone filesystem for analysis.</p>
<h1>Allowing remote connections</h1>
<p>The <code>/system</code> dump I extracted includes a bunch of interesting CLI executables, most of which are implemented by an all-in-one binary, <code>/system/bin/toolbox</code>.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">system/
system/app/
system/app/AccountAndSyncSettings.apk
system/app/AccountAndSyncSettings.odex
system/app/ActivityNetwork.apk
system/app/ApplicationsProvider.apk
system/app/ApplicationsProvider.odex
system/app/Bluetooth.apk
system/app/Bluetooth.odex
system/app/Browser.apk
system/app/Browser.odex
system/app/Calculator3.apk
system/app/Calculator3.odex
system/app/Calendar.apk
system/app/Calendar.odex
system/app/CalendarImporter.apk
system/app/CalendarImporter.odex
system/app/CalendarProvider.apk
system/app/CalendarProvider.odex
system/app/CameraOpen.apk
system/app/CameraOpen.odex
system/app/CellConnService.apk
system/app/CellConnService.odex
system/app/CertInstaller.apk
system/app/CertInstaller.odex
system/app/ContactsProvider.apk
system/app/ContactsProvider.odex
system/app/ContactsSamsungG3.apk
system/app/ContactsSamsungG3.odex
system/app/DefaultContainerService.apk
system/app/DefaultContainerService.odex
system/app/DesktopClock.apk
system/app/DesktopClock.odex
system/app/DownloadProvider.apk
system/app/DownloadProvider.odex
system/app/DownloadProviderUi.apk
system/app/DownloadProviderUi.odex
system/app/DrmProvider.apk
system/app/DrmProvider.odex
system/app/Email.apk
system/app/Email.odex
system/app/EngineerMode.apk
system/app/EngineerMode.odex
system/app/EngineerModeSim.apk
system/app/EngineerModeSim.odex
system/app/FMRadio.apk
system/app/FMRadio.odex
system/app/Facebook.apk
system/app/FactoryMode.apk
system/app/FactoryMode.odex
system/app/FileManager.apk
system/app/FileManager.odex
system/app/GCalib.apk
system/app/GCalib.odex
system/app/Gallery3D.apk
system/app/Gallery3D.odex
system/app/GetJar.apk
system/app/Gmail.apk
system/app/GoogleBackupTransport.apk
system/app/GoogleCalendarSyncAdapter.apk
system/app/GoogleContactsSyncAdapter.apk
system/app/GoogleFeedback.apk
system/app/GoogleServicesFramework.apk
system/app/HTMLViewer.apk
system/app/HTMLViewer.odex
system/app/LatinIME.apk
system/app/LatinIME.odex
system/app/LauncherICS.apk
system/app/LauncherICS.odex
system/app/LiveWallpapersPicker_gles20.apk
system/app/LiveWallpapersPicker_gles20.odex
system/app/LiveWallpapers_gles20.apk
system/app/LiveWallpapers_gles20.odex
system/app/MTKAndroidSuiteDaemon.apk
system/app/MTKAndroidSuiteDaemon.odex
system/app/MagicSmokeWallpapers_gles20.apk
system/app/MagicSmokeWallpapers_gles20.odex
system/app/MediaProvider.apk
system/app/MediaProvider.odex
system/app/MediaTekLocationProvider.apk
system/app/MmsSamsung.apk
system/app/MmsSamsung.odex
system/app/MobileLog.apk
system/app/MtkBt.apk
system/app/MtkBt.odex
system/app/MtkLiveWallpapers.apk
system/app/MtkLiveWallpapers.odex
system/app/MtkWallPaper.apk
system/app/MtkWallPaper.odex
system/app/Music.apk
system/app/Music.odex
system/app/Omacp.apk
system/app/Omacp.odex
system/app/PackageInstaller.apk
system/app/PackageInstaller.odex
system/app/PermissionGrant.apk
system/app/PermissionGrant.odex
system/app/Phone.apk
system/app/Phone.odex
system/app/PicoTts.apk
system/app/PicoTts.odex
system/app/PlayStore.apk
system/app/Protips.apk
system/app/Protips.odex
system/app/Provision.apk
system/app/Provision.odex
system/app/QuickSearchBox.apk
system/app/QuickSearchBox.odex
system/app/SamsungDeskclock.apk
system/app/SamsungDeskclock.odex
system/app/Settings.apk
system/app/Settings.odex
system/app/SettingsProvider.apk
system/app/SettingsProvider.odex
system/app/SoundRecorder.apk
system/app/SoundRecorder.odex
system/app/Stk1.apk
system/app/Stk1.odex
system/app/Stk2.apk
system/app/Stk2.odex
system/app/StkSelection.apk
system/app/StkSelection.odex
system/app/SystemUISamsungStyle1.apk
system/app/SystemUISamsungStyle1.odex
system/app/TelephonyProvider.apk
system/app/TelephonyProvider.odex
system/app/TinyFlashlight.apk
system/app/TtsService.apk
system/app/TtsService.odex
system/app/UserDictionaryProvider.apk
system/app/UserDictionaryProvider.odex
system/app/VideoPlayer.apk
system/app/VideoPlayer.odex
system/app/VisualizationWallpapers_gles20.apk
system/app/VisualizationWallpapers_gles20.odex
system/app/VpnServices.apk
system/app/VpnServices.odex
system/bin/
system/bin/6620_launcher
system/bin/acdktest
system/bin/aee
system/bin/aee_aed
system/bin/aee_debuggerd
system/bin/aee_dumpstate
system/bin/aee_minizip
system/bin/am
system/bin/app_process
system/bin/applypatch
system/bin/atci
system/bin/bmgr
system/bin/boot_logo_updater
system/bin/bootanimation
system/bin/btconfig
system/bin/btlogmask
system/bin/bugreport
system/bin/cat -> toolbox
system/bin/ccaptest
system/bin/ccci_fsd
system/bin/ccci_mdinit
system/bin/chmod -> toolbox
system/bin/chown -> toolbox
system/bin/cmp -> toolbox
system/bin/dalvikvm
system/bin/date -> toolbox
system/bin/dbus-daemon
system/bin/dd -> toolbox
system/bin/debuggerd -> aee_debuggerd
system/bin/dexopt
system/bin/df -> toolbox
system/bin/dhcpcd
system/bin/dm_agent_binder
system/bin/dmesg -> toolbox
system/bin/dnsmasq
system/bin/drmioserver
system/bin/drmserver
system/bin/dumpstate
system/bin/dumpsys
system/bin/dvz
system/bin/em_svr
system/bin/factory
system/bin/fsck_msdos
system/bin/getevent -> toolbox
system/bin/getprop -> toolbox
system/bin/gsensor_calibrator
system/bin/gsm0710muxd
system/bin/gzip
system/bin/hald
system/bin/hd -> toolbox
system/bin/hdc
system/bin/id -> toolbox
system/bin/ifconfig -> toolbox
system/bin/iftop -> toolbox
system/bin/ime
system/bin/input
system/bin/insmod -> toolbox
system/bin/installd
system/bin/ioctl -> toolbox
system/bin/ionice -> toolbox
system/bin/iptables
system/bin/keystore
system/bin/kill -> toolbox
system/bin/kpd_auto
system/bin/linker
system/bin/ln -> toolbox
system/bin/log -> toolbox
system/bin/logcat
system/bin/logwrapper
system/bin/ls -> toolbox
system/bin/lsmod -> toolbox
system/bin/lsof -> toolbox
system/bin/mac_addr
system/bin/md_minilog_util
system/bin/mdpd
system/bin/mediaserver
system/bin/memorydumper
system/bin/mfv_ut
system/bin/mkdir -> toolbox
system/bin/mke2fs
system/bin/mobile_log_d
system/bin/monkey
system/bin/mount -> toolbox
system/bin/msensord
system/bin/mtk_agpsd
system/bin/mtk_ifconfig
system/bin/mtk_netstat
system/bin/mtk_route
system/bin/mtkbt
system/bin/mtpd
system/bin/muxreport
system/bin/mv -> toolbox
system/bin/nandread -> toolbox
system/bin/ndc
system/bin/netcfg
system/bin/netd
system/bin/netdiag
system/bin/netstat -> toolbox
system/bin/newfs_msdos -> toolbox
system/bin/notify -> toolbox
system/bin/nvram_agent_binder
system/bin/nvram_custom
system/bin/nvram_daemon
system/bin/nvram_restore_tool
system/bin/omx_tests
system/bin/p2p_cli
system/bin/p2p_supplicant
system/bin/ping
system/bin/pm
system/bin/pppd
system/bin/printenv -> toolbox
system/bin/ps -> toolbox
system/bin/racoon
system/bin/reboot -> toolbox
system/bin/renice -> toolbox
system/bin/resize2fs
system/bin/rild
system/bin/rm -> toolbox
system/bin/rmdir -> toolbox
system/bin/rmmod -> toolbox
system/bin/route -> toolbox
system/bin/rtt
system/bin/run-as
system/bin/sbchk
system/bin/schedtest
system/bin/schedtop -> toolbox
system/bin/sdcard
system/bin/sendevent -> toolbox
system/bin/service
system/bin/servicemanager
system/bin/setconsole -> toolbox
system/bin/setprop -> toolbox
system/bin/sh
system/bin/shutdown
system/bin/sleep -> toolbox
system/bin/smd -> toolbox
system/bin/start -> toolbox
system/bin/stop -> toolbox
system/bin/stp_dump3
system/bin/surfaceflinger
system/bin/svc
system/bin/sync -> toolbox
system/bin/system_server
system/bin/tc
system/bin/toolbox
system/bin/top -> toolbox
system/bin/umount -> toolbox
system/bin/uptime -> toolbox
system/bin/vdc
system/bin/vmstat -> toolbox
system/bin/vold
system/bin/watchprops -> toolbox
system/bin/wipe -> toolbox
system/bin/wpa_supplicant
system/bin/xlog
system/build.prop
system/etc/
system/etc/NOTICE.html.gz
system/etc/apns-conf.xml
system/etc/dbus.conf
system/etc/dhcpcd/
system/etc/dhcpcd/dhcpcd-hooks/
system/etc/dhcpcd/dhcpcd-hooks/20-dns.conf
system/etc/dhcpcd/dhcpcd-hooks/95-configured
system/etc/dhcpcd/dhcpcd-run-hooks
system/etc/dhcpcd/dhcpcd.conf
system/etc/event-log-tags
system/etc/factory.ini
system/etc/firmware/
system/etc/firmware/DSP_ROM
system/etc/firmware/S_ANDRO_SFL.ini
system/etc/firmware/WIFI_RAM_CODE_MT6628
system/etc/firmware/WMT.cfg
system/etc/firmware/modem.img
system/etc/firmware/mt6628_fm_rom.bin
system/etc/firmware/mt6628_fm_v1_coeff.bin
system/etc/firmware/mt6628_fm_v1_patch.bin
system/etc/firmware/mt6628_fm_v2_coeff.bin
system/etc/firmware/mt6628_fm_v2_patch.bin
system/etc/firmware/mt6628_fm_v3_coeff.bin
system/etc/firmware/mt6628_fm_v3_patch.bin
system/etc/firmware/mt6628_fm_v4_coeff.bin
system/etc/firmware/mt6628_fm_v4_patch.bin
system/etc/firmware/mt6628_fm_v5_coeff.bin
system/etc/firmware/mt6628_fm_v5_patch.bin
system/etc/firmware/mt6628_patch_e1_hdr.bin
system/etc/firmware/mt6628_patch_e2_hdr.bin
system/etc/fm_cust.cfg
system/etc/hosts
system/etc/init.goldfish.sh
system/etc/location_service_conf.xml
system/etc/mtk_omx_core.cfg
system/etc/permissions/
system/etc/permissions/android.hardware.bluetooth.xml
system/etc/permissions/android.hardware.camera.front.xml
system/etc/permissions/android.hardware.camera.xml
system/etc/permissions/android.hardware.location.gps.xml
system/etc/permissions/android.hardware.microphone.xml
system/etc/permissions/android.hardware.sensor.accelerometer.xml
system/etc/permissions/android.hardware.sensor.compass.xml
system/etc/permissions/android.hardware.sensor.gyroscope.xml
system/etc/permissions/android.hardware.sensor.light.xml
system/etc/permissions/android.hardware.sensor.proximity.xml
system/etc/permissions/android.hardware.telephony.gsm.xml
system/etc/permissions/android.hardware.touchscreen.multitouch.distinct.xml
system/etc/permissions/android.hardware.touchscreen.multitouch.jazzhand.xml
system/etc/permissions/android.hardware.touchscreen.multitouch.xml
system/etc/permissions/android.hardware.wifi.xml
system/etc/permissions/android.software.live_wallpaper.xml
system/etc/permissions/android.software.sip.voip.xml
system/etc/permissions/android.software.sip.xml
system/etc/permissions/com.google.android.maps.xml
system/etc/permissions/com.mediatek.framework.xml
system/etc/permissions/features.xml
system/etc/permissions/platform.xml
system/etc/piggy_bank.sh
system/etc/player.cfg
system/etc/ppp/
system/etc/ppp/ip-up-vpn
system/etc/pvplayer.cfg
system/etc/security/
system/etc/security/cacerts.bks
system/etc/security/otacerts.zip
system/etc/spn-conf.xml
system/etc/theme/
system/etc/theme/thememap.xml
system/etc/vold.fstab
system/etc/vold.fstab.fat.nand
system/etc/vold.fstab.nand
system/etc/wifi/
system/etc/wifi/p2p.conf
system/etc/wifi/wpa_supplicant.conf
system/fonts/
system/fonts/Clockopia.ttf
system/fonts/DroidSans-Bold.ttf
system/fonts/DroidSans.ttf
system/fonts/DroidSansArabic.ttf
system/fonts/DroidSansFallback.ttf
system/fonts/DroidSansHebrew.ttf
system/fonts/DroidSansHindi.ttf
system/fonts/DroidSansMono.ttf
system/fonts/DroidSansThai.ttf
system/fonts/DroidSerif-Bold.ttf
system/fonts/DroidSerif-BoldItalic.ttf
system/fonts/DroidSerif-Italic.ttf
system/fonts/DroidSerif-Regular.ttf
system/fonts/Mya.ttf
system/fonts/SegoeWP.ttf
system/framework/
system/framework/DMAgent.jar
system/framework/DMAgent.odex
system/framework/am.jar
system/framework/am.odex
system/framework/android.policy.jar
system/framework/android.policy.odex
system/framework/android.test.runner.jar
system/framework/android.test.runner.odex
system/framework/bmgr.jar
system/framework/bmgr.odex
system/framework/bouncycastle.jar
system/framework/bouncycastle.odex
system/framework/com.android.location.provider.jar
system/framework/com.google.android.maps.jar
system/framework/com.mediatek.framework.jar
system/framework/com.mediatek.framework.odex
system/framework/core-junit.jar
system/framework/core-junit.odex
system/framework/core.jar
system/framework/core.odex
system/framework/emwireless_lib.jar
system/framework/emwireless_lib.odex
system/framework/ext.jar
system/framework/ext.odex
system/framework/framework-res.apk
system/framework/framework.jar
system/framework/framework.odex
system/framework/ime.jar
system/framework/ime.odex
system/framework/input.jar
system/framework/input.odex
system/framework/javax.obex.jar
system/framework/javax.obex.odex
system/framework/monkey.jar
system/framework/monkey.odex
system/framework/mtkBase-res.apk
system/framework/mtklockscreen.jar
system/framework/mtklockscreen.odex
system/framework/pm.jar
system/framework/pm.odex
system/framework/services.jar
system/framework/services.odex
system/framework/sqlite-jdbc.jar
system/framework/sqlite-jdbc.odex
system/framework/svc.jar
system/framework/svc.odex
system/framework/wappush.jar
system/framework/wbxml.jar
system/framework/wbxml.odex
system/lib/
system/lib/drm/
system/lib/drm/plugins/
system/lib/drm/plugins/native/
system/lib/drm/plugins/native/libdrmmtkplugin.so
system/lib/egl/
system/lib/egl/egl.cfg
system/lib/egl/libGLES_android.so
system/lib/hw/
system/lib/hw/gps.default.so
system/lib/hw/gralloc.default.so
system/lib/hw/lights.default.so
system/lib/hw/sensors.mt6575.so
system/lib/libEGL.so
system/lib/libETC1.so
system/lib/libFFTEm.so
system/lib/libGLESv1_CM.so
system/lib/libGLESv2.so
system/lib/libJniAtvService.so
system/lib/libJniVideoSurface.so
system/lib/libMtkOmxAMRNBDec.so
system/lib/libMtkOmxAMRWBDec.so
system/lib/libMtkOmxAacDec.so
system/lib/libMtkOmxAacEnc.so
system/lib/libMtkOmxAmrEnc.so
system/lib/libMtkOmxApeDec.so
system/lib/libMtkOmxAwbEnc.so
system/lib/libMtkOmxCookDec.so
system/lib/libMtkOmxCore.so
system/lib/libMtkOmxG711Dec.so
system/lib/libMtkOmxMp3Dec.so
system/lib/libMtkOmxVdec.so
system/lib/libMtkOmxVenc.so
system/lib/libMtkOmxVorbisDec.so
system/lib/libMtkOmxVorbisEnc.so
system/lib/libOpenSLES.so
system/lib/libRS.so
system/lib/libSR_AudioIn.so
system/lib/libaacdec_mtk.so
system/lib/libacc.so
system/lib/libacdk.so
system/lib/libaed.so
system/lib/libagpssupl.so
system/lib/libamrenc.so
system/lib/libandroid.so
system/lib/libandroid_runtime.so
system/lib/libandroid_servers.so
system/lib/libapedec_mtk.so
system/lib/libappc.so
system/lib/libatvctrlservice.so
system/lib/libaudiocompensationfilter.so
system/lib/libaudiodcrflt.so
system/lib/libaudioeffect_jni.so
system/lib/libaudioeffectparam.so
system/lib/libaudioflinger.so
system/lib/libaudiosetting.so
system/lib/libawb.so
system/lib/libbessound_mtk.so
system/lib/libbinder.so
system/lib/libblisrc.so
system/lib/libbluetoothem_mtk.so
system/lib/libbluetoothinit_mtk.so
system/lib/libbtpcm.so
system/lib/libbwcs_mtk.so
system/lib/libc.so
system/lib/libcamalgo.so
system/lib/libcamera_client.so
system/lib/libcameracustom.so
system/lib/libcameraservice.so
system/lib/libcok.so
system/lib/libcpucapabilities.so
system/lib/libcrypto.so
system/lib/libctest.so
system/lib/libcustom_nvram.so
system/lib/libcutils.so
system/lib/libdalvik-internals.so
system/lib/libdbus.so
system/lib/libdcfdecoderjni.so
system/lib/libdeltat.so
system/lib/libdiskconfig.so
system/lib/libdl.so
system/lib/libdrm1.so
system/lib/libdrm1_jni.so
system/lib/libdrmframework.so
system/lib/libdrmframework_jni.so
system/lib/libdrmmtkutil.so
system/lib/libdvm.so
system/lib/libdvm_debug.so
system/lib/libeffects.so
system/lib/libeis.so
system/lib/libem_chip_support_jni.so
system/lib/libem_dsense_jni.so
system/lib/libem_gpio_jni.so
system/lib/libem_jni.so
system/lib/libem_modem_jni.so
system/lib/libembttest_jni.so
system/lib/libemoji.so
system/lib/libemwifi_jni.so
system/lib/libexif.so
system/lib/libexpat.so
system/lib/libext4_utils.so
system/lib/libextavrcp.so
system/lib/libextavrcp_jni.so
system/lib/libextbip.so
system/lib/libextbip_jni.so
system/lib/libextbpp.so
system/lib/libextbpp_jni.so
system/lib/libextdun_jni.so
system/lib/libextftp.so
system/lib/libextftp_jni.so
system/lib/libexthid.so
system/lib/libexthid_jni.so
system/lib/libextjsr82.so
system/lib/libextmap.so
system/lib/libextmap_jni.so
system/lib/libextopp.so
system/lib/libextopp_jni.so
system/lib/libextpan_jni.so
system/lib/libextpbap.so
system/lib/libextpbap_jni.so
system/lib/libextsimap.so
system/lib/libextsimap_jni.so
system/lib/libextsys.so
system/lib/libextsys_jni.so
system/lib/libfile_op.so
system/lib/libfmar1000.so
system/lib/libfmcust.so
system/lib/libfmjni.so
system/lib/libfmmt6616.so
system/lib/libfmmt6620.so
system/lib/libfmmt6626.so
system/lib/libfmmt6628.so
system/lib/libft.so
system/lib/libgalleryjni.so
system/lib/libgsensorjni.so
system/lib/libgui.so
system/lib/libh264dec_ca9_lib.so
system/lib/libh264dec_customize.so
system/lib/libhandwriting_engine.so
system/lib/libhardware.so
system/lib/libhardware_legacy.so
system/lib/libhciattach_mtk.so
system/lib/libheaacdec_mtk.so
system/lib/libheadphonecompensationfilter.so
system/lib/libhwm.so
system/lib/libicui18n.so
system/lib/libicuuc.so
system/lib/libinput_engine.so
system/lib/libiprouteutil.so
system/lib/libjni_latinime.so
system/lib/libjni_pinyinime.so
system/lib/libjnigraphics.so
system/lib/libjpeg.so
system/lib/liblog.so
system/lib/libm.so
system/lib/libmatv_cust.so
system/lib/libmcamif.so
system/lib/libmedia.so
system/lib/libmedia_jni.so
system/lib/libmediaplayerservice.so
system/lib/libmediatek_drvb.so
system/lib/libmediatek_exceptionlog.so
system/lib/libmemorydumper.so
system/lib/libmexif.so
system/lib/libmhal.so
system/lib/libmhalcontent.so
system/lib/libmhaldrv.so
system/lib/libmhalpipe.so
system/lib/libmhalscenario.so
system/lib/libmhalutility.so
system/lib/libmp3dec_mtk.so
system/lib/libmp4dec_ca9_lib.so
system/lib/libmp4dec_customize.so
system/lib/libmpeg4enc_ca9.so
system/lib/libmpo.so
system/lib/libmpodecoder.so
system/lib/libmpoencoder.so
system/lib/libmpojni.so
system/lib/libmtk_dictionary.so
system/lib/libmtk_telephony_log.so
system/lib/libmtka2dp.so
system/lib/libmtkbtextadp.so
system/lib/libmtkbtextadpa2dp.so
system/lib/libmtkbtextpan.so
system/lib/libmtkbtextspp.so
system/lib/libmtkhdmi_jni.so
system/lib/libmtkosal.so
system/lib/libmtkplayer.so
system/lib/libmtkse.so
system/lib/libmtktvout_jni.so
system/lib/libmtktvout_vlw_jni.so
system/lib/libmtktvout_vw_jni.so
system/lib/libnative.so
system/lib/libnativehelper.so
system/lib/libnetlink.so
system/lib/libnetutils.so
system/lib/libnfc_ndef.so
system/lib/libnvram.so
system/lib/libomx_aacdec_sharedlibrary.so
system/lib/libomx_amrdec_sharedlibrary.so
system/lib/libomx_amrenc_sharedlibrary.so
system/lib/libomx_avcdec_sharedlibrary.so
system/lib/libomx_m4vdec_sharedlibrary.so
system/lib/libomx_m4venc_sharedlibrary.so
system/lib/libomx_mp3dec_sharedlibrary.so
system/lib/libomx_sharedlibrary.so
system/lib/libomx_wmvdec_sharedlibrary.so
system/lib/libopencore_common.so
system/lib/libp2p_client.so
system/lib/libpalsecurity.so
system/lib/libpalwlan_mtk.so
system/lib/libpixelflinger.so
system/lib/libpppbtdun.so
system/lib/librilmtk.so
system/lib/librs_jni.so
system/lib/librtp_jni.so
system/lib/librv9dec_ca9.so
system/lib/librv9dec_customize.so
system/lib/libsec.so
system/lib/libsensorservice.so
system/lib/libskia.so
system/lib/libskiagl.so
system/lib/libsonivox.so
system/lib/libsoundpool.so
system/lib/libsqlite.so
system/lib/libsqlite_jni.so
system/lib/libsrec_jni.so
system/lib/libssl.so
system/lib/libssladp.so
system/lib/libstagefright.so
system/lib/libstagefright_amrnb_common.so
system/lib/libstagefright_avc_common.so
system/lib/libstagefright_color_conversion.so
system/lib/libstagefright_enc_common.so
system/lib/libstagefright_foundation.so
system/lib/libstagefright_omx.so
system/lib/libstagefright_pmemutil.so
system/lib/libstagefrighthw.so
system/lib/libstdc++.so
system/lib/libstlport.so
system/lib/libstlport_shared.so
system/lib/libsurfaceflinger.so
system/lib/libsurfaceflinger_client.so
system/lib/libsystem_server.so
system/lib/libsysutils.so
system/lib/libthread_db.so
system/lib/libtinyxml.so
system/lib/libtracker.so
system/lib/libttspico.so
system/lib/libttssynthproxy.so
system/lib/libtvoutjni.so
system/lib/libtvoutpattern.so
system/lib/libui.so
system/lib/libutilrilmtk.so
system/lib/libutils.so
system/lib/libvcodec_oal.so
system/lib/libvcodec_utility.so
system/lib/libvcodecdrv.so
system/lib/libvo_aacenc.so
system/lib/libvoicesearch.so
system/lib/libvorbisenc_mtk.so
system/lib/libvorbisidec.so
system/lib/libvorbisidec_mtk.so
system/lib/libvp8dec_ca9_lib.so
system/lib/libwebcore.so
system/lib/libwpa_client.so
system/lib/libxml2.so
system/lib/libz.so
system/lib/modules/
system/lib/modules/aed.ko
system/lib/modules/ccci.ko
system/lib/modules/ccci_plat.ko
system/lib/modules/ccmni.ko
system/lib/modules/devinfo.ko
system/lib/modules/eeprom_93cx6.ko
system/lib/modules/lca_core.ko
system/lib/modules/mt6575_m4u.ko
system/lib/modules/mt6575_vcodec_kernel_driver.ko
system/lib/modules/mtk_drvb_75.ko
system/lib/modules/mtk_fm_drv.ko
system/lib/modules/mtk_fm_priv.ko
system/lib/modules/mtk_hif_sdio.ko
system/lib/modules/mtk_hif_sdio_mt6620.ko
system/lib/modules/mtk_stp_bt.ko
system/lib/modules/mtk_stp_bt_mt6620.ko
system/lib/modules/mtk_stp_core_mt6620.ko
system/lib/modules/mtk_stp_gps.ko
system/lib/modules/mtk_stp_gps_mt6620.ko
system/lib/modules/mtk_stp_sdio.ko
system/lib/modules/mtk_stp_sdio_mt6620.ko
system/lib/modules/mtk_stp_uart.ko
system/lib/modules/mtk_stp_uart_mt6620.ko
system/lib/modules/mtk_stp_wmt.ko
system/lib/modules/mtk_stp_wmt_mt6620.ko
system/lib/modules/mtk_wmt_wifi.ko
system/lib/modules/mtkbc.ko
system/lib/modules/mtklfb.ko
system/lib/modules/p2p.ko
system/lib/modules/pvrsrvkm.ko
system/lib/modules/sbup.ko
system/lib/modules/scsi_tgt.ko
system/lib/modules/scsi_wait_scan.ko
system/lib/modules/sec.ko
system/lib/modules/wlan.ko -> wlan_mt6628.ko
system/lib/modules/wlan_mt6620.ko
system/lib/modules/wlan_mt6628.ko
system/lib/mtk-ril.so
system/lib/soundfx/
system/lib/soundfx/libbundlewrapper.so
system/lib/soundfx/libreverbwrapper.so
system/lib/soundfx/libvisualizer.so
system/lost+found/
system/media/
system/media/audio/
system/media/audio/alarms/
system/media/audio/alarms/Alarm_Beep_01.ogg
system/media/audio/alarms/Alarm_Beep_02.ogg
system/media/audio/alarms/Alarm_Beep_03.ogg
system/media/audio/alarms/Alarm_Buzzer.ogg
system/media/audio/alarms/Alarm_Classic.ogg
system/media/audio/alarms/Alarm_Rooster_02.ogg
system/media/audio/notifications/
system/media/audio/notifications/Beat_Box_Android.ogg
system/media/audio/notifications/CaffeineSnake.ogg
system/media/audio/notifications/DearDeer.ogg
system/media/audio/notifications/DontPanic.ogg
system/media/audio/notifications/F1_MissedCall.ogg
system/media/audio/notifications/F1_New_MMS.ogg
system/media/audio/notifications/F1_New_SMS.ogg
system/media/audio/notifications/Heaven.ogg
system/media/audio/notifications/Highwire.ogg
system/media/audio/notifications/KzurbSonar.ogg
system/media/audio/notifications/OnTheHunt.ogg
system/media/audio/notifications/TaDa.ogg
system/media/audio/notifications/Tinkerbell.ogg
system/media/audio/notifications/Voila.ogg
system/media/audio/ringtones/
system/media/audio/ringtones/BeatPlucker.ogg
system/media/audio/ringtones/BentleyDubs.ogg
system/media/audio/ringtones/BirdLoop.ogg
system/media/audio/ringtones/CaribbeanIce.ogg
system/media/audio/ringtones/CrazyDream.ogg
system/media/audio/ringtones/CurveBall.ogg
system/media/audio/ringtones/DreamTheme.ogg
system/media/audio/ringtones/EtherShake.ogg
system/media/audio/ringtones/FriendlyGhost.ogg
system/media/audio/ringtones/GameOverGuitar.ogg
system/media/audio/ringtones/Growl.ogg
system/media/audio/ringtones/InsertCoin.ogg
system/media/audio/ringtones/LoopyLounge.ogg
system/media/audio/ringtones/LoveFlute.ogg
system/media/audio/ringtones/MidEvilJaunt.ogg
system/media/audio/ringtones/MildlyAlarming.ogg
system/media/audio/ringtones/NewPlayer.ogg
system/media/audio/ringtones/Noises1.ogg
system/media/audio/ringtones/Noises2.ogg
system/media/audio/ringtones/Noises3.ogg
system/media/audio/ringtones/OrganDub.ogg
system/media/audio/ringtones/Ring_Classic_02.ogg
system/media/audio/ringtones/Ring_Digital_02.ogg
system/media/audio/ringtones/Ring_Synth_02.ogg
system/media/audio/ringtones/Ring_Synth_04.ogg
system/media/audio/ringtones/RomancingTheTone.ogg
system/media/audio/ringtones/SitarVsSitar.ogg
system/media/audio/ringtones/SpringyJalopy.ogg
system/media/audio/ringtones/Terminated.ogg
system/media/audio/ringtones/TwirlAway.ogg
system/media/audio/ringtones/VeryAlarmed.ogg
system/media/audio/ringtones/World.ogg
system/media/audio/ui/
system/media/audio/ui/Effect_Tick.ogg
system/media/audio/ui/KeypressDelete.ogg
system/media/audio/ui/KeypressReturn.ogg
system/media/audio/ui/KeypressSpacebar.ogg
system/media/audio/ui/KeypressStandard.ogg
system/media/audio/ui/Lock.ogg
system/media/audio/ui/LowBattery.ogg
system/media/audio/ui/Unlock.ogg
system/media/audio/ui/VideoRecord.ogg
system/media/audio/ui/camera_click.ogg
system/media/bootanimation.zip
system/media/bootaudio.mp3
system/media/images/
system/media/images/boot_logo
system/media/shutanimation.zip
system/media/shutaudio.mp3
system/res/
system/res/images/
system/res/images/lcd_test_00.png
system/res/images/lcd_test_01.png
system/res/images/lcd_test_02.png
system/res/images/lcd_test_03.png
system/res/images/lcd_test_04.png
system/res/images/lcd_test_05.png
system/res/images/lcd_test_06.png
system/res/images/lcd_test_07.png
system/secro/
system/secro/lost+found/
system/usr/
system/usr/icu/
system/usr/icu/icudt44l.dat
system/usr/keychars/
system/usr/keychars/mt6575-kpd.kcm.bin
system/usr/keychars/qwerty.kcm.bin
system/usr/keychars/qwerty2.kcm.bin
system/usr/keylayout/
system/usr/keylayout/AVRCP.kl
system/usr/keylayout/mt6575-kpd.kl
system/usr/keylayout/qwerty.kl
system/usr/share/
system/usr/share/bmd/
system/usr/share/bmd/RFFspeed_501.bmd
system/usr/share/bmd/RFFstd_501.bmd
system/usr/share/zoneinfo/
system/usr/share/zoneinfo/zoneinfo.dat
system/usr/share/zoneinfo/zoneinfo.idx
system/usr/share/zoneinfo/zoneinfo.version
system/usr/srec/
system/usr/srec/config/
system/usr/srec/config/en.us/
system/usr/srec/config/en.us/baseline.par
system/usr/srec/config/en.us/baseline11k.par
system/usr/srec/config/en.us/baseline8k.par
system/usr/srec/config/en.us/dictionary/
system/usr/srec/config/en.us/dictionary/basic.ok
system/usr/srec/config/en.us/dictionary/cmu6plus.ok.zip
system/usr/srec/config/en.us/dictionary/enroll.ok
system/usr/srec/config/en.us/g2p/
system/usr/srec/config/en.us/g2p/en-US-ttp.data
system/usr/srec/config/en.us/grammars/
system/usr/srec/config/en.us/grammars/VoiceDialer.g2g
system/usr/srec/config/en.us/grammars/boolean.g2g
system/usr/srec/config/en.us/grammars/phone_type_choice.g2g
system/usr/srec/config/en.us/models/
system/usr/srec/config/en.us/models/generic.swiarb
system/usr/srec/config/en.us/models/generic11.lda
system/usr/srec/config/en.us/models/generic11_f.swimdl
system/usr/srec/config/en.us/models/generic11_m.swimdl
system/usr/srec/config/en.us/models/generic8.lda
system/usr/srec/config/en.us/models/generic8_f.swimdl
system/usr/srec/config/en.us/models/generic8_m.swimdl
system/vendor/
system/vendor/bin/
system/vendor/bin/pvrsrvinit
system/vendor/bin/rc.fac
system/vendor/lib/
system/vendor/lib/egl/
system/vendor/lib/egl/libEGL_mtk.so
system/vendor/lib/egl/libGLESv1_CM_mtk.so
system/vendor/lib/egl/libGLESv2_mtk.so
system/vendor/lib/hw/
system/vendor/lib/hw/gralloc.mt6575.so
system/vendor/lib/libBLPP.so
system/vendor/lib/libIMGegl.so
system/vendor/lib/libPVRScopeServices.so
system/vendor/lib/libglslcompiler.so
system/vendor/lib/libpvr2d.so
system/vendor/lib/libpvrANDROID_WSEGL.so
system/vendor/lib/libsrv_init.so
system/vendor/lib/libsrv_um.so
system/vendor/lib/libusc.so
system/xbin/
system/xbin/dexdump
system/xbin/iwconfig
system/xbin/iwevent
system/xbin/iwgetid
system/xbin/iwlist
system/xbin/iwpriv
system/xbin/iwspy
system/xbin/su
system/xbin/tcpdump
</code></pre></div>
<p>Unfortunately, while there are some pretty powerful tools in there, I couldn't find a SSH daemon in the original firmware. Using the <a href="http://www.openssh.com/">OpenSSH</a> implementation of the <a href="http://datatracker.ietf.org/wg/secsh/documents/">Secure SHell protocol</a> would be possible but this would require me to cross-compile it from my <code>x86_64</code> laptop for the phone's target architecture, <code>arm-*-elf</code>... along with its dependencies, including OpenSSL's libcrypto.</p>
<p>This would be a significant effort, so I chose instead to use <a href="https://matt.ucc.asn.au/dropbear/dropbear.html">dropbear</a>, a more lightweight SSH daemon. For fun, here's a comparison of runtime dependencies for OpenSSH's <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/sshd.8?query=sshd&sec=8"><code>sshd</code></a> and <a href="http://linux.die.net/man/8/dropbear"><code>dropbear</code></a> on Arch Linux:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">528-mboyer@marylou:~/Hacks/Nam-Phone_G40C [master:I=R=S_]$ diff -y arch_sshd_deps.txt arch_dropbear_deps.txt
/lib64/ld-linux-x86-64.so.2 (0x00007f95589a0000) | /lib64/ld-linux-x86-64.so.2 (0x00007ffaaff60000)
libc.so.6 => /usr/lib/libc.so.6 (0x00007f9557440000) | libc.so.6 => /usr/lib/libc.so.6 (0x00007ffaaf560000)
libcom_err.so.2 => /usr/lib/libcom_err.so.2 (0x00007f | libcrypt.so.1 => /usr/lib/libcrypt.so.1 (0x00007ffaaf
libcrypt.so.1 => /usr/lib/libcrypt.so.1 (0x00007f9557 | libutil.so.1 => /usr/lib/libutil.so.1 (0x00007ffaafd5
libcrypto.so.1.0.0 => /usr/lib/libcrypto.so.1.0.0 (0x | libz.so.1 => /usr/lib/libz.so.1 (0x00007ffaafb40000)
libdl.so.2 => /usr/lib/libdl.so.2 (0x00007f9557238000 | linux-vdso.so.1 (0x00007fff45002000)
libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 ( <
libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x0000 <
libkeyutils.so.1 => /usr/lib/libkeyutils.so.1 (0x0000 <
libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x00007f95577e <
libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 ( <
libpam.so.0 => /usr/lib/libpam.so.0 (0x00007f95587900 <
libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007f <
libresolv.so.2 => /usr/lib/libresolv.so.2 (0x00007f95 <
libutil.so.1 => /usr/lib/libutil.so.1 (0x00007f955817 <
libz.so.1 => /usr/lib/libz.so.1 (0x00007f9557f58000) <
linux-vdso.so.1 (0x00007fff32c02000) <
</code></pre></div>
<p>One particular problem in this situation is that I do not want the SSH daemon executable to rely on shared object code, as it will likely be missing on the phone or there but not-quite-working.</p>
<p>In other words, I want a big, fat statically-linked binary that's entirely self-contained. And so I was delighted to find one such ready-made binary, complete with a how-to for setting up public key authentication (it's not <em>quite</em> the same as OpenSSH) on <a href="http://www.cri.ch/sven/doku.php/blog/running-dropbear-on-android">Sven's blog</a>.</p>
<p>I used the microSD slot on the phone to transfer the dropbear executables onto the phone and, <a href="http://linux.die.net/man/1/cp"><code>cp(1)</code></a> being conspicuously absent from the firmware, <code>toolbox</code>'s <code>dd(1)</code> to copy them from the card's to the read-write <code>/data</code> filesystem where proper *nix file permissions could be set, unlike the card's FAT32 filesystem. I followed the steps on the page and was able to connect to the dropbear process.</p>
<p>There was a slight hurdle, however, with the call to <code>getusershell()</code> that dropbear <a href="https://github.com/mkj/dropbear/blob/master/svr-auth.c#L294">performs</a> to validate the shell it would spawn for the user attempting to log in the event of a successful authentication.</p>
<p>The build of dropbear from that page has a patch applied to it that mocks the call to <a href="http://linux.die.net/man/3/getpwnam"><code>getpwnam(3)</code></a> to ensure that the user is always found and its login shell is hardcoded to <code>/system/xbin/sh</code>. This is great, but dropbear still attempts to open up <code>/etc/shells</code> to <a href="https://github.com/mkj/dropbear/blob/master/compat.c#L236">check</a> that this is a registered login shell and, failing that, attempts to default to <code>/bin/sh</code>, then <code>/bin/csh</code>... neither of which exists on the phone.</p>
<p>I considered patching the dropbear source and recompiling it, but decided remounting <code>/system</code> read-write (<code>/etc</code> being symlinked to <code>/system/etc</code>) and echoing <code>/system/bin/sh</code> into <code>/system/etc/shells</code> was the more pragmatic approach, even though as a forensic exercise I really shouldn't touch a read-only file system. I'm not proud.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">629-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [master:I±R=S+]$ ssh -v -i ../nam_id_rsa_openssh root@<phone>
OpenSSH_6.7p1, OpenSSL 1.0.1j 15 Oct 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to A.B.C.D [A.B.C.D] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file ../nam_id_rsa_openssh type -1
debug1: key_load_public: No such file or directory
debug1: identity file ../nam_id_rsa_openssh-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.7
debug1: Remote protocol version 2.0, remote software version dropbear_0.52
debug1: no match: dropbear_0.52
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: sending SSH2_MSG_KEXDH_INIT
debug1: expecting SSH2_MSG_KEXDH_REPLY
debug1: Server host key: RSA 0e:98:fa:4e:51:e6:5a:51:3e:cd:a5:69:1b:f5:36:54
debug1: Host 'A.B.C.D' is known and matches the RSA host key.
debug1: Found key in /home/mboyer/.ssh/known_hosts:10
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: ../nam_id_rsa_openssh
debug1: Authentication succeeded (publickey).
Authenticated to A.B.C.D ([A.B.C.D]:22).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
[1007] Jun 01 19:07:17 lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
[1007] Jun 01 19:07:17 lastlog_openseek: /var/log/lastlog is not a file or directory!
# id
id: not found
# set
HOME=/data/dropbear
IFS='
'
LOGNAME=root
OPTIND=1
PATH=/usr/bin:/bin
PS1='# '
PS2='> '
PS4='+ '
SHELL=/system/bin/sh
TERM=screen-256color
USER=root
_=id
# export PATH=/system/bin:/system/xbin
# id
uid=0(root) gid=0(root) groups=0(root)
#
</code></pre></div>
<p>And so finally I was able to connect to my phone from my regular Linux environment. If only all <a href="http://australianmuseum.net.au/Drop-Bear">drop bear</a> encounters went so well!</p>
<p><img src="http://fc03.deviantart.net/fs71/f/2011/317/2/5/woot_shirt___drop_bears_v2_by_fablefire-d4g4ssa.jpg" alt="Dropbears!"></p>
<blockquote>
<p>Dropbear illustration ©<a href="http://fablefire.deviantart.com/art/Woot-Shirt-Drop-Bears-v2-268962490">fablefire</a></p>
</blockquote>
<h1>Archiving the FS</h1>
<p>Being able to connect to the phone is very nice, but I still need a way to copy the whole <a href="http://www.ibm.com/developerworks/library/l-virtual-filesystem-switch/index.html">Virtual FileSystem</a> onto my laptop. Using <a href="http://linux.die.net/man/1/sftp"><code>sftp</code></a> is not an option, since that would require a <a href="http://linux.die.net/man/8/sftp-server">sftp-server</a> executable to be present on the phone. Likewise, <a href="http://linux.die.net/man/1/scp"><code>scp</code></a> would need to be present on both peers, as explained in this excellent blog <a href="https://blogs.oracle.com/janp/entry/how_the_scp_protocol_works">post</a>.</p>
<p>Instead, I'll do this the old school way with <a href="http://linux.die.net/man/1/tar"><code>tar(1)</code></a> and <a href="http://linux.die.net/man/1/nc"><code>netcat(1)</code></a>. Neither is present on the phone's firmware, but I was very lucky to find a ready-made <a href="https://github.com/zoobab/busybox-static-for-android">build of busybox</a> for my phone's target architecture with minimal versions of both.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text"># busybox tar -cv -f - --exclude='sys/*' --exclude='dev/*' --exclude='proc/*' / | busybox nc <laptop> <arbitrary port>
</code></pre></div>
<p>And just like that, I now have a full archive of my phone's filesystem which I can now map and analyse!</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">dr-x------ 0/0 0 2012-06-01 21:52 config/
drwxrwx--- 1000/2001 0 2012-06-01 22:32 cache/
-rwxrwx--- 1000/1000 1314 2012-06-01 22:32 cache/com.android.providers.settings.data
drwxrwx--- 0/0 0 2012-06-01 01:13 cache/lost+found/
drwxrwx--- 1000/2001 0 2009-01-01 00:05 cache/recovery/
-rw-r----- 0/0 4525 2009-01-01 00:04 cache/recovery/last_log
lrwxrwxrwx 0/0 0 2012-06-01 21:52 sdcard -> /mnt/sdcard
drwxr-xr-x 0/0 0 2012-06-01 21:52 acct/
drwxr-xr-x 0/0 0 2012-06-01 21:52 acct/uid/
drwxrwxr-x 0/10056 0 2012-06-01 21:53 acct/uid/10056/
-r--r--r-- 0/10056 0 2012-06-01 21:53 acct/uid/10056/cpuacct.power
-r--r--r-- 0/10056 0 2012-06-01 21:53 acct/uid/10056/cpuacct.cpufreq
-r--r--r-- 0/10056 0 2012-06-01 21:53 acct/uid/10056/cpuacct.stat
-r--r--r-- 0/10056 0 2012-06-01 21:53 acct/uid/10056/cpuacct.usage_percpu
-rw-r--r-- 0/10056 0 2012-06-01 21:53 acct/uid/10056/cpuacct.usage
--w--w--w- 0/10056 0 2012-06-01 21:53 acct/uid/10056/cgroup.event_control
-rw-r--r-- 0/10056 0 2012-06-01 21:53 acct/uid/10056/notify_on_release
-r--r--r-- 0/10056 0 2012-06-01 21:53 acct/uid/10056/cgroup.procs
-rw-r--r-- 0/10056 0 2012-06-01 21:53 acct/uid/10056/tasks
drwxrwxr-x 0/10039 0 2012-06-01 21:52 acct/uid/10039/
-r--r--r-- 0/10039 0 2012-06-01 21:52 acct/uid/10039/cpuacct.power
-r--r--r-- 0/10039 0 2012-06-01 21:52 acct/uid/10039/cpuacct.cpufreq
-r--r--r-- 0/10039 0 2012-06-01 21:52 acct/uid/10039/cpuacct.stat
-r--r--r-- 0/10039 0 2012-06-01 21:52 acct/uid/10039/cpuacct.usage_percpu
-rw-r--r-- 0/10039 0 2012-06-01 21:52 acct/uid/10039/cpuacct.usage
--w--w--w- 0/10039 0 2012-06-01 21:52 acct/uid/10039/cgroup.event_control
-rw-r--r-- 0/10039 0 2012-06-01 21:52 acct/uid/10039/notify_on_release
-r--r--r-- 0/10039 0 2012-06-01 21:52 acct/uid/10039/cgroup.procs
-rw-r--r-- 0/10039 0 2012-06-01 21:52 acct/uid/10039/tasks
drwxrwxr-x 0/10054 0 2012-06-01 21:52 acct/uid/10054/
-r--r--r-- 0/10054 0 2012-06-01 21:52 acct/uid/10054/cpuacct.power
-r--r--r-- 0/10054 0 2012-06-01 21:52 acct/uid/10054/cpuacct.cpufreq
-r--r--r-- 0/10054 0 2012-06-01 21:52 acct/uid/10054/cpuacct.stat
-r--r--r-- 0/10054 0 2012-06-01 21:52 acct/uid/10054/cpuacct.usage_percpu
-rw-r--r-- 0/10054 0 2012-06-01 21:52 acct/uid/10054/cpuacct.usage
--w--w--w- 0/10054 0 2012-06-01 21:52 acct/uid/10054/cgroup.event_control
-rw-r--r-- 0/10054 0 2012-06-01 21:52 acct/uid/10054/notify_on_release
-r--r--r-- 0/10054 0 2012-06-01 21:52 acct/uid/10054/cgroup.procs
-rw-r--r-- 0/10054 0 2012-06-01 21:52 acct/uid/10054/tasks
drwxrwxr-x 0/10036 0 2012-06-01 21:52 acct/uid/10036/
-r--r--r-- 0/10036 0 2012-06-01 21:52 acct/uid/10036/cpuacct.power
-r--r--r-- 0/10036 0 2012-06-01 21:52 acct/uid/10036/cpuacct.cpufreq
-r--r--r-- 0/10036 0 2012-06-01 21:52 acct/uid/10036/cpuacct.stat
-r--r--r-- 0/10036 0 2012-06-01 21:52 acct/uid/10036/cpuacct.usage_percpu
-rw-r--r-- 0/10036 0 2012-06-01 21:52 acct/uid/10036/cpuacct.usage
--w--w--w- 0/10036 0 2012-06-01 21:52 acct/uid/10036/cgroup.event_control
-rw-r--r-- 0/10036 0 2012-06-01 21:52 acct/uid/10036/notify_on_release
-r--r--r-- 0/10036 0 2012-06-01 21:52 acct/uid/10036/cgroup.procs
-rw-r--r-- 0/10036 0 2012-06-01 21:52 acct/uid/10036/tasks
drwxrwxr-x 0/10027 0 2012-06-01 21:52 acct/uid/10027/
-r--r--r-- 0/10027 0 2012-06-01 21:52 acct/uid/10027/cpuacct.power
-r--r--r-- 0/10027 0 2012-06-01 21:52 acct/uid/10027/cpuacct.cpufreq
-r--r--r-- 0/10027 0 2012-06-01 21:52 acct/uid/10027/cpuacct.stat
-r--r--r-- 0/10027 0 2012-06-01 21:52 acct/uid/10027/cpuacct.usage_percpu
-rw-r--r-- 0/10027 0 2012-06-01 21:52 acct/uid/10027/cpuacct.usage
--w--w--w- 0/10027 0 2012-06-01 21:52 acct/uid/10027/cgroup.event_control
-rw-r--r-- 0/10027 0 2012-06-01 21:52 acct/uid/10027/notify_on_release
-r--r--r-- 0/10027 0 2012-06-01 21:52 acct/uid/10027/cgroup.procs
-rw-r--r-- 0/10027 0 2012-06-01 21:52 acct/uid/10027/tasks
drwxrwxr-x 0/10011 0 2012-06-01 21:52 acct/uid/10011/
-r--r--r-- 0/10011 0 2012-06-01 21:52 acct/uid/10011/cpuacct.power
-r--r--r-- 0/10011 0 2012-06-01 21:52 acct/uid/10011/cpuacct.cpufreq
-r--r--r-- 0/10011 0 2012-06-01 21:52 acct/uid/10011/cpuacct.stat
-r--r--r-- 0/10011 0 2012-06-01 21:52 acct/uid/10011/cpuacct.usage_percpu
-rw-r--r-- 0/10011 0 2012-06-01 21:52 acct/uid/10011/cpuacct.usage
--w--w--w- 0/10011 0 2012-06-01 21:52 acct/uid/10011/cgroup.event_control
-rw-r--r-- 0/10011 0 2012-06-01 21:52 acct/uid/10011/notify_on_release
-r--r--r-- 0/10011 0 2012-06-01 21:52 acct/uid/10011/cgroup.procs
-rw-r--r-- 0/10011 0 2012-06-01 21:52 acct/uid/10011/tasks
drwxrwxr-x 0/10006 0 2012-06-01 21:52 acct/uid/10006/
-r--r--r-- 0/10006 0 2012-06-01 21:52 acct/uid/10006/cpuacct.power
-r--r--r-- 0/10006 0 2012-06-01 21:52 acct/uid/10006/cpuacct.cpufreq
-r--r--r-- 0/10006 0 2012-06-01 21:52 acct/uid/10006/cpuacct.stat
-r--r--r-- 0/10006 0 2012-06-01 21:52 acct/uid/10006/cpuacct.usage_percpu
-rw-r--r-- 0/10006 0 2012-06-01 21:52 acct/uid/10006/cpuacct.usage
--w--w--w- 0/10006 0 2012-06-01 21:52 acct/uid/10006/cgroup.event_control
-rw-r--r-- 0/10006 0 2012-06-01 21:52 acct/uid/10006/notify_on_release
-r--r--r-- 0/10006 0 2012-06-01 21:52 acct/uid/10006/cgroup.procs
-rw-r--r-- 0/10006 0 2012-06-01 21:52 acct/uid/10006/tasks
drwxrwxr-x 0/10017 0 2012-06-01 21:52 acct/uid/10017/
-r--r--r-- 0/10017 0 2012-06-01 21:52 acct/uid/10017/cpuacct.power
-r--r--r-- 0/10017 0 2012-06-01 21:52 acct/uid/10017/cpuacct.cpufreq
-r--r--r-- 0/10017 0 2012-06-01 21:52 acct/uid/10017/cpuacct.stat
-r--r--r-- 0/10017 0 2012-06-01 21:52 acct/uid/10017/cpuacct.usage_percpu
-rw-r--r-- 0/10017 0 2012-06-01 21:52 acct/uid/10017/cpuacct.usage
--w--w--w- 0/10017 0 2012-06-01 21:52 acct/uid/10017/cgroup.event_control
-rw-r--r-- 0/10017 0 2012-06-01 21:52 acct/uid/10017/notify_on_release
-r--r--r-- 0/10017 0 2012-06-01 21:52 acct/uid/10017/cgroup.procs
-rw-r--r-- 0/10017 0 2012-06-01 21:52 acct/uid/10017/tasks
drwxrwxr-x 0/10016 0 2012-06-01 21:52 acct/uid/10016/
-r--r--r-- 0/10016 0 2012-06-01 21:52 acct/uid/10016/cpuacct.power
-r--r--r-- 0/10016 0 2012-06-01 21:52 acct/uid/10016/cpuacct.cpufreq
-r--r--r-- 0/10016 0 2012-06-01 21:52 acct/uid/10016/cpuacct.stat
-r--r--r-- 0/10016 0 2012-06-01 21:52 acct/uid/10016/cpuacct.usage_percpu
-rw-r--r-- 0/10016 0 2012-06-01 21:52 acct/uid/10016/cpuacct.usage
--w--w--w- 0/10016 0 2012-06-01 21:52 acct/uid/10016/cgroup.event_control
-rw-r--r-- 0/10016 0 2012-06-01 21:52 acct/uid/10016/notify_on_release
-r--r--r-- 0/10016 0 2012-06-01 21:52 acct/uid/10016/cgroup.procs
-rw-r--r-- 0/10016 0 2012-06-01 21:52 acct/uid/10016/tasks
drwxrwxr-x 0/10009 0 2012-06-01 21:52 acct/uid/10009/
-r--r--r-- 0/10009 0 2012-06-01 21:52 acct/uid/10009/cpuacct.power
-r--r--r-- 0/10009 0 2012-06-01 21:52 acct/uid/10009/cpuacct.cpufreq
-r--r--r-- 0/10009 0 2012-06-01 21:52 acct/uid/10009/cpuacct.stat
-r--r--r-- 0/10009 0 2012-06-01 21:52 acct/uid/10009/cpuacct.usage_percpu
-rw-r--r-- 0/10009 0 2012-06-01 21:52 acct/uid/10009/cpuacct.usage
--w--w--w- 0/10009 0 2012-06-01 21:52 acct/uid/10009/cgroup.event_control
-rw-r--r-- 0/10009 0 2012-06-01 21:52 acct/uid/10009/notify_on_release
-r--r--r-- 0/10009 0 2012-06-01 21:52 acct/uid/10009/cgroup.procs
-rw-r--r-- 0/10009 0 2012-06-01 21:52 acct/uid/10009/tasks
drwxrwxr-x 0/10012 0 2012-06-01 21:52 acct/uid/10012/
-r--r--r-- 0/10012 0 2012-06-01 21:52 acct/uid/10012/cpuacct.power
-r--r--r-- 0/10012 0 2012-06-01 21:52 acct/uid/10012/cpuacct.cpufreq
-r--r--r-- 0/10012 0 2012-06-01 21:52 acct/uid/10012/cpuacct.stat
-r--r--r-- 0/10012 0 2012-06-01 21:52 acct/uid/10012/cpuacct.usage_percpu
-rw-r--r-- 0/10012 0 2012-06-01 21:52 acct/uid/10012/cpuacct.usage
--w--w--w- 0/10012 0 2012-06-01 21:52 acct/uid/10012/cgroup.event_control
-rw-r--r-- 0/10012 0 2012-06-01 21:52 acct/uid/10012/notify_on_release
-r--r--r-- 0/10012 0 2012-06-01 21:52 acct/uid/10012/cgroup.procs
-rw-r--r-- 0/10012 0 2012-06-01 21:52 acct/uid/10012/tasks
drwxrwxr-x 0/10010 0 2012-06-01 21:52 acct/uid/10010/
-r--r--r-- 0/10010 0 2012-06-01 21:52 acct/uid/10010/cpuacct.power
-r--r--r-- 0/10010 0 2012-06-01 21:52 acct/uid/10010/cpuacct.cpufreq
-r--r--r-- 0/10010 0 2012-06-01 21:52 acct/uid/10010/cpuacct.stat
-r--r--r-- 0/10010 0 2012-06-01 21:52 acct/uid/10010/cpuacct.usage_percpu
-rw-r--r-- 0/10010 0 2012-06-01 21:52 acct/uid/10010/cpuacct.usage
--w--w--w- 0/10010 0 2012-06-01 21:52 acct/uid/10010/cgroup.event_control
-rw-r--r-- 0/10010 0 2012-06-01 21:52 acct/uid/10010/notify_on_release
-r--r--r-- 0/10010 0 2012-06-01 21:52 acct/uid/10010/cgroup.procs
-rw-r--r-- 0/10010 0 2012-06-01 21:52 acct/uid/10010/tasks
drwxrwxr-x 0/1014 0 2012-06-01 21:52 acct/uid/1014/
-r--r--r-- 0/1014 0 2012-06-01 21:52 acct/uid/1014/cpuacct.power
-r--r--r-- 0/1014 0 2012-06-01 21:52 acct/uid/1014/cpuacct.cpufreq
-r--r--r-- 0/1014 0 2012-06-01 21:52 acct/uid/1014/cpuacct.stat
-r--r--r-- 0/1014 0 2012-06-01 21:52 acct/uid/1014/cpuacct.usage_percpu
-rw-r--r-- 0/1014 0 2012-06-01 21:52 acct/uid/1014/cpuacct.usage
--w--w--w- 0/1014 0 2012-06-01 21:52 acct/uid/1014/cgroup.event_control
-rw-r--r-- 0/1014 0 2012-06-01 21:52 acct/uid/1014/notify_on_release
-r--r--r-- 0/1014 0 2012-06-01 21:52 acct/uid/1014/cgroup.procs
-rw-r--r-- 0/1014 0 2012-06-01 21:52 acct/uid/1014/tasks
drwxrwxr-x 0/10000 0 2012-06-01 21:52 acct/uid/10000/
-r--r--r-- 0/10000 0 2012-06-01 21:52 acct/uid/10000/cpuacct.power
-r--r--r-- 0/10000 0 2012-06-01 21:52 acct/uid/10000/cpuacct.cpufreq
-r--r--r-- 0/10000 0 2012-06-01 21:52 acct/uid/10000/cpuacct.stat
-r--r--r-- 0/10000 0 2012-06-01 21:52 acct/uid/10000/cpuacct.usage_percpu
-rw-r--r-- 0/10000 0 2012-06-01 21:52 acct/uid/10000/cpuacct.usage
--w--w--w- 0/10000 0 2012-06-01 21:52 acct/uid/10000/cgroup.event_control
-rw-r--r-- 0/10000 0 2012-06-01 21:52 acct/uid/10000/notify_on_release
-r--r--r-- 0/10000 0 2012-06-01 21:52 acct/uid/10000/cgroup.procs
-rw-r--r-- 0/10000 0 2012-06-01 21:52 acct/uid/10000/tasks
drwxrwxr-x 0/1010 0 2012-06-01 21:52 acct/uid/1010/
-r--r--r-- 0/1010 0 2012-06-01 21:52 acct/uid/1010/cpuacct.power
-r--r--r-- 0/1010 0 2012-06-01 21:52 acct/uid/1010/cpuacct.cpufreq
-r--r--r-- 0/1010 0 2012-06-01 21:52 acct/uid/1010/cpuacct.stat
-r--r--r-- 0/1010 0 2012-06-01 21:52 acct/uid/1010/cpuacct.usage_percpu
-rw-r--r-- 0/1010 0 2012-06-01 21:52 acct/uid/1010/cpuacct.usage
--w--w--w- 0/1010 0 2012-06-01 21:52 acct/uid/1010/cgroup.event_control
-rw-r--r-- 0/1010 0 2012-06-01 21:52 acct/uid/1010/notify_on_release
-r--r--r-- 0/1010 0 2012-06-01 21:52 acct/uid/1010/cgroup.procs
-rw-r--r-- 0/1010 0 2012-06-01 21:52 acct/uid/1010/tasks
drwxrwxr-x 0/1007 0 2012-06-01 21:52 acct/uid/1007/
-r--r--r-- 0/1007 0 2012-06-01 21:52 acct/uid/1007/cpuacct.power
-r--r--r-- 0/1007 0 2012-06-01 21:52 acct/uid/1007/cpuacct.cpufreq
-r--r--r-- 0/1007 0 2012-06-01 21:52 acct/uid/1007/cpuacct.stat
-r--r--r-- 0/1007 0 2012-06-01 21:52 acct/uid/1007/cpuacct.usage_percpu
-rw-r--r-- 0/1007 0 2012-06-01 21:52 acct/uid/1007/cpuacct.usage
--w--w--w- 0/1007 0 2012-06-01 21:52 acct/uid/1007/cgroup.event_control
-rw-r--r-- 0/1007 0 2012-06-01 21:52 acct/uid/1007/notify_on_release
-r--r--r-- 0/1007 0 2012-06-01 21:52 acct/uid/1007/cgroup.procs
-rw-r--r-- 0/1007 0 2012-06-01 21:52 acct/uid/1007/tasks
drwxrwxr-x 0/10029 0 2012-06-01 21:52 acct/uid/10029/
-r--r--r-- 0/10029 0 2012-06-01 21:52 acct/uid/10029/cpuacct.power
-r--r--r-- 0/10029 0 2012-06-01 21:52 acct/uid/10029/cpuacct.cpufreq
-r--r--r-- 0/10029 0 2012-06-01 21:52 acct/uid/10029/cpuacct.stat
-r--r--r-- 0/10029 0 2012-06-01 21:52 acct/uid/10029/cpuacct.usage_percpu
-rw-r--r-- 0/10029 0 2012-06-01 21:52 acct/uid/10029/cpuacct.usage
--w--w--w- 0/10029 0 2012-06-01 21:52 acct/uid/10029/cgroup.event_control
-rw-r--r-- 0/10029 0 2012-06-01 21:52 acct/uid/10029/notify_on_release
-r--r--r-- 0/10029 0 2012-06-01 21:52 acct/uid/10029/cgroup.procs
-rw-r--r-- 0/10029 0 2012-06-01 21:52 acct/uid/10029/tasks
drwxrwxr-x 0/10034 0 2012-06-01 21:52 acct/uid/10034/
-r--r--r-- 0/10034 0 2012-06-01 21:52 acct/uid/10034/cpuacct.power
-r--r--r-- 0/10034 0 2012-06-01 21:52 acct/uid/10034/cpuacct.cpufreq
-r--r--r-- 0/10034 0 2012-06-01 21:52 acct/uid/10034/cpuacct.stat
-r--r--r-- 0/10034 0 2012-06-01 21:52 acct/uid/10034/cpuacct.usage_percpu
-rw-r--r-- 0/10034 0 2012-06-01 21:52 acct/uid/10034/cpuacct.usage
--w--w--w- 0/10034 0 2012-06-01 21:52 acct/uid/10034/cgroup.event_control
-rw-r--r-- 0/10034 0 2012-06-01 21:52 acct/uid/10034/notify_on_release
-r--r--r-- 0/10034 0 2012-06-01 21:52 acct/uid/10034/cgroup.procs
-rw-r--r-- 0/10034 0 2012-06-01 21:52 acct/uid/10034/tasks
drwxrwxr-x 0/10022 0 2012-06-01 21:52 acct/uid/10022/
-r--r--r-- 0/10022 0 2012-06-01 21:52 acct/uid/10022/cpuacct.power
-r--r--r-- 0/10022 0 2012-06-01 21:52 acct/uid/10022/cpuacct.cpufreq
-r--r--r-- 0/10022 0 2012-06-01 21:52 acct/uid/10022/cpuacct.stat
-r--r--r-- 0/10022 0 2012-06-01 21:52 acct/uid/10022/cpuacct.usage_percpu
-rw-r--r-- 0/10022 0 2012-06-01 21:52 acct/uid/10022/cpuacct.usage
--w--w--w- 0/10022 0 2012-06-01 21:52 acct/uid/10022/cgroup.event_control
-rw-r--r-- 0/10022 0 2012-06-01 21:52 acct/uid/10022/notify_on_release
-r--r--r-- 0/10022 0 2012-06-01 21:52 acct/uid/10022/cgroup.procs
-rw-r--r-- 0/10022 0 2012-06-01 21:52 acct/uid/10022/tasks
drwxrwxr-x 0/10018 0 2012-06-01 21:52 acct/uid/10018/
-r--r--r-- 0/10018 0 2012-06-01 21:52 acct/uid/10018/cpuacct.power
-r--r--r-- 0/10018 0 2012-06-01 21:52 acct/uid/10018/cpuacct.cpufreq
-r--r--r-- 0/10018 0 2012-06-01 21:52 acct/uid/10018/cpuacct.stat
-r--r--r-- 0/10018 0 2012-06-01 21:52 acct/uid/10018/cpuacct.usage_percpu
-rw-r--r-- 0/10018 0 2012-06-01 21:52 acct/uid/10018/cpuacct.usage
--w--w--w- 0/10018 0 2012-06-01 21:52 acct/uid/10018/cgroup.event_control
-rw-r--r-- 0/10018 0 2012-06-01 21:52 acct/uid/10018/notify_on_release
-r--r--r-- 0/10018 0 2012-06-01 21:52 acct/uid/10018/cgroup.procs
-rw-r--r-- 0/10018 0 2012-06-01 21:52 acct/uid/10018/tasks
drwxrwxr-x 0/10021 0 2012-06-01 21:52 acct/uid/10021/
-r--r--r-- 0/10021 0 2012-06-01 21:52 acct/uid/10021/cpuacct.power
-r--r--r-- 0/10021 0 2012-06-01 21:52 acct/uid/10021/cpuacct.cpufreq
-r--r--r-- 0/10021 0 2012-06-01 21:52 acct/uid/10021/cpuacct.stat
-r--r--r-- 0/10021 0 2012-06-01 21:52 acct/uid/10021/cpuacct.usage_percpu
-rw-r--r-- 0/10021 0 2012-06-01 21:52 acct/uid/10021/cpuacct.usage
--w--w--w- 0/10021 0 2012-06-01 21:52 acct/uid/10021/cgroup.event_control
-rw-r--r-- 0/10021 0 2012-06-01 21:52 acct/uid/10021/notify_on_release
-r--r--r-- 0/10021 0 2012-06-01 21:52 acct/uid/10021/cgroup.procs
-rw-r--r-- 0/10021 0 2012-06-01 21:52 acct/uid/10021/tasks
drwxrwxr-x 0/10023 0 2012-06-01 21:52 acct/uid/10023/
-r--r--r-- 0/10023 0 2012-06-01 21:52 acct/uid/10023/cpuacct.power
-r--r--r-- 0/10023 0 2012-06-01 21:52 acct/uid/10023/cpuacct.cpufreq
-r--r--r-- 0/10023 0 2012-06-01 21:52 acct/uid/10023/cpuacct.stat
-r--r--r-- 0/10023 0 2012-06-01 21:52 acct/uid/10023/cpuacct.usage_percpu
-rw-r--r-- 0/10023 0 2012-06-01 21:52 acct/uid/10023/cpuacct.usage
--w--w--w- 0/10023 0 2012-06-01 21:52 acct/uid/10023/cgroup.event_control
-rw-r--r-- 0/10023 0 2012-06-01 21:52 acct/uid/10023/notify_on_release
-r--r--r-- 0/10023 0 2012-06-01 21:52 acct/uid/10023/cgroup.procs
-rw-r--r-- 0/10023 0 2012-06-01 21:52 acct/uid/10023/tasks
drwxrwxr-x 0/1003 0 2012-06-01 21:52 acct/uid/1003/
-r--r--r-- 0/1003 0 2012-06-01 21:52 acct/uid/1003/cpuacct.power
-r--r--r-- 0/1003 0 2012-06-01 21:52 acct/uid/1003/cpuacct.cpufreq
-r--r--r-- 0/1003 0 2012-06-01 21:52 acct/uid/1003/cpuacct.stat
-r--r--r-- 0/1003 0 2012-06-01 21:52 acct/uid/1003/cpuacct.usage_percpu
-rw-r--r-- 0/1003 0 2012-06-01 21:52 acct/uid/1003/cpuacct.usage
--w--w--w- 0/1003 0 2012-06-01 21:52 acct/uid/1003/cgroup.event_control
-rw-r--r-- 0/1003 0 2012-06-01 21:52 acct/uid/1003/notify_on_release
-r--r--r-- 0/1003 0 2012-06-01 21:52 acct/uid/1003/cgroup.procs
-rw-r--r-- 0/1003 0 2012-06-01 21:52 acct/uid/1003/tasks
drwx------ 0/1001 0 2012-06-01 21:52 acct/uid/1001/
-r--r--r-- 0/1001 0 2012-06-01 21:52 acct/uid/1001/cpuacct.power
-r--r--r-- 0/1001 0 2012-06-01 21:52 acct/uid/1001/cpuacct.cpufreq
-r--r--r-- 0/1001 0 2012-06-01 21:52 acct/uid/1001/cpuacct.stat
-r--r--r-- 0/1001 0 2012-06-01 21:52 acct/uid/1001/cpuacct.usage_percpu
-rw-r--r-- 0/1001 0 2012-06-01 21:52 acct/uid/1001/cpuacct.usage
--w--w--w- 0/1001 0 2012-06-01 21:52 acct/uid/1001/cgroup.event_control
-rw-r--r-- 0/1001 0 2012-06-01 21:52 acct/uid/1001/notify_on_release
-r--r--r-- 0/1001 0 2012-06-01 21:52 acct/uid/1001/cgroup.procs
-rw-r--r-- 0/1001 0 2012-06-01 21:52 acct/uid/1001/tasks
drwxrwxr-x 0/9999 0 2012-06-01 21:52 acct/uid/9999/
-r--r--r-- 0/9999 0 2012-06-01 21:52 acct/uid/9999/cpuacct.power
-r--r--r-- 0/9999 0 2012-06-01 21:52 acct/uid/9999/cpuacct.cpufreq
-r--r--r-- 0/9999 0 2012-06-01 21:52 acct/uid/9999/cpuacct.stat
-r--r--r-- 0/9999 0 2012-06-01 21:52 acct/uid/9999/cpuacct.usage_percpu
-rw-r--r-- 0/9999 0 2012-06-01 21:52 acct/uid/9999/cpuacct.usage
--w--w--w- 0/9999 0 2012-06-01 21:52 acct/uid/9999/cgroup.event_control
-rw-r--r-- 0/9999 0 2012-06-01 21:52 acct/uid/9999/notify_on_release
-r--r--r-- 0/9999 0 2012-06-01 21:52 acct/uid/9999/cgroup.procs
-rw-r--r-- 0/9999 0 2012-06-01 21:52 acct/uid/9999/tasks
drwxrwxr-x 0/1000 0 2012-06-01 21:52 acct/uid/1013/
-r--r--r-- 0/1000 0 2012-06-01 21:52 acct/uid/1013/cpuacct.power
-r--r--r-- 0/1000 0 2012-06-01 21:52 acct/uid/1013/cpuacct.cpufreq
-r--r--r-- 0/1000 0 2012-06-01 21:52 acct/uid/1013/cpuacct.stat
-r--r--r-- 0/1000 0 2012-06-01 21:52 acct/uid/1013/cpuacct.usage_percpu
-rw-r--r-- 0/1000 0 2012-06-01 21:52 acct/uid/1013/cpuacct.usage
--w--w--w- 0/1000 0 2012-06-01 21:52 acct/uid/1013/cgroup.event_control
-rw-r--r-- 0/1000 0 2012-06-01 21:52 acct/uid/1013/notify_on_release
-r--r--r-- 0/1000 0 2012-06-01 21:52 acct/uid/1013/cgroup.procs
-rw-r--r-- 0/1000 0 2012-06-01 21:52 acct/uid/1013/tasks
drwxrwxr-x 0/2000 0 2012-06-01 21:52 acct/uid/2000/
-r--r--r-- 0/2000 0 2012-06-01 21:52 acct/uid/2000/cpuacct.power
-r--r--r-- 0/2000 0 2012-06-01 21:52 acct/uid/2000/cpuacct.cpufreq
-r--r--r-- 0/2000 0 2012-06-01 21:52 acct/uid/2000/cpuacct.stat
-r--r--r-- 0/2000 0 2012-06-01 21:52 acct/uid/2000/cpuacct.usage_percpu
-rw-r--r-- 0/2000 0 2012-06-01 21:52 acct/uid/2000/cpuacct.usage
--w--w--w- 0/2000 0 2012-06-01 21:52 acct/uid/2000/cgroup.event_control
-rw-r--r-- 0/2000 0 2012-06-01 21:52 acct/uid/2000/notify_on_release
-r--r--r-- 0/2000 0 2012-06-01 21:52 acct/uid/2000/cgroup.procs
-rw-r--r-- 0/2000 0 2012-06-01 21:52 acct/uid/2000/tasks
drwxrwxr-x 0/1017 0 2012-06-01 21:52 acct/uid/1017/
-r--r--r-- 0/1017 0 2012-06-01 21:52 acct/uid/1017/cpuacct.power
-r--r--r-- 0/1017 0 2012-06-01 21:52 acct/uid/1017/cpuacct.cpufreq
-r--r--r-- 0/1017 0 2012-06-01 21:52 acct/uid/1017/cpuacct.stat
-r--r--r-- 0/1017 0 2012-06-01 21:52 acct/uid/1017/cpuacct.usage_percpu
-rw-r--r-- 0/1017 0 2012-06-01 21:52 acct/uid/1017/cpuacct.usage
--w--w--w- 0/1017 0 2012-06-01 21:52 acct/uid/1017/cgroup.event_control
-rw-r--r-- 0/1017 0 2012-06-01 21:52 acct/uid/1017/notify_on_release
-r--r--r-- 0/1017 0 2012-06-01 21:52 acct/uid/1017/cgroup.procs
-rw-r--r-- 0/1017 0 2012-06-01 21:52 acct/uid/1017/tasks
drwxrwxr-x 0/1002 0 2012-06-01 21:52 acct/uid/1002/
-r--r--r-- 0/1002 0 2012-06-01 21:52 acct/uid/1002/cpuacct.power
-r--r--r-- 0/1002 0 2012-06-01 21:52 acct/uid/1002/cpuacct.cpufreq
-r--r--r-- 0/1002 0 2012-06-01 21:52 acct/uid/1002/cpuacct.stat
-r--r--r-- 0/1002 0 2012-06-01 21:52 acct/uid/1002/cpuacct.usage_percpu
-rw-r--r-- 0/1002 0 2012-06-01 21:52 acct/uid/1002/cpuacct.usage
--w--w--w- 0/1002 0 2012-06-01 21:52 acct/uid/1002/cgroup.event_control
-rw-r--r-- 0/1002 0 2012-06-01 21:52 acct/uid/1002/notify_on_release
-r--r--r-- 0/1002 0 2012-06-01 21:52 acct/uid/1002/cgroup.procs
-rw-r--r-- 0/1002 0 2012-06-01 21:52 acct/uid/1002/tasks
drwxrwxr-x 0/0 0 2012-06-01 21:52 acct/uid/1000/
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/1000/cpuacct.power
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/1000/cpuacct.cpufreq
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/1000/cpuacct.stat
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/1000/cpuacct.usage_percpu
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/uid/1000/cpuacct.usage
--w--w--w- 0/0 0 2012-06-01 21:52 acct/uid/1000/cgroup.event_control
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/uid/1000/notify_on_release
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/1000/cgroup.procs
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/uid/1000/tasks
drwxrwxr-x 0/0 0 2012-06-01 21:52 acct/uid/0/
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/0/cpuacct.power
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/0/cpuacct.cpufreq
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/0/cpuacct.stat
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/0/cpuacct.usage_percpu
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/uid/0/cpuacct.usage
--w--w--w- 0/0 0 2012-06-01 21:52 acct/uid/0/cgroup.event_control
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/uid/0/notify_on_release
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/0/cgroup.procs
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/uid/0/tasks
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/cpuacct.power
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/cpuacct.cpufreq
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/cpuacct.stat
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/cpuacct.usage_percpu
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/uid/cpuacct.usage
--w--w--w- 0/0 0 2012-06-01 21:52 acct/uid/cgroup.event_control
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/uid/notify_on_release
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/uid/cgroup.procs
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/uid/tasks
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/cpuacct.power
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/cpuacct.cpufreq
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/cpuacct.stat
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/cpuacct.usage_percpu
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/cpuacct.usage
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/release_agent
--w--w--w- 0/0 0 2012-06-01 21:52 acct/cgroup.event_control
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/notify_on_release
-r--r--r-- 0/0 0 2012-06-01 21:52 acct/cgroup.procs
-rw-r--r-- 0/0 0 2012-06-01 21:52 acct/tasks
drwxrwxr-x 0/1000 0 2012-06-01 21:52 mnt/
drwxr-xr-x 0/1000 0 2012-06-01 21:52 mnt/obb/
drwxr-xr-x 0/1000 0 2012-06-01 21:52 mnt/asec/
drwx------ 0/0 0 2012-06-01 21:52 mnt/secure/
d---rwxr-x 1000/1015 0 2012-06-01 21:52 mnt/secure/asec/
drwx------ 0/0 0 2012-06-01 21:52 mnt/secure/staging/
d---rwxr-x 1000/1015 0 2012-06-01 21:52 mnt/sdcard/
lrwxrwxrwx 0/0 0 2012-06-01 21:52 vendor -> /system/vendor
lrwxrwxrwx 0/0 0 2012-06-01 21:52 d -> /sys/kernel/debug
lrwxrwxrwx 0/0 0 2012-06-01 21:52 etc -> /system/etc
-rw-r--r-- 0/0 4494 1970-01-01 01:00 ueventd.rc
-rw-r--r-- 0/0 0 1970-01-01 01:00 ueventd.goldfish.rc
drwxr-xr-x 0/0 0 2012-06-01 01:00 system/
drwxr-xr-x 0/0 0 2013-04-03 07:28 system/usr/
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/usr/srec/
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/usr/srec/config/
drwxr-xr-x 0/0 0 2013-04-03 07:29 system/usr/srec/config/en.us/
drwxr-xr-x 0/0 0 2013-04-03 07:29 system/usr/srec/config/en.us/grammars/
-rw-r--r-- 0/0 1395 2013-04-03 07:29 system/usr/srec/config/en.us/grammars/phone_type_choice.g2g
-rw-r--r-- 0/0 622 2013-04-03 07:29 system/usr/srec/config/en.us/grammars/boolean.g2g
-rw-r--r-- 0/0 55581 2013-04-03 07:29 system/usr/srec/config/en.us/grammars/VoiceDialer.g2g
-rw-r--r-- 0/0 4623 2013-03-08 10:10 system/usr/srec/config/en.us/baseline.par
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/usr/srec/config/en.us/models/
-rw-r--r-- 0/0 10954 2013-03-08 10:10 system/usr/srec/config/en.us/models/generic11.lda
-rw-r--r-- 0/0 287087 2013-03-08 10:10 system/usr/srec/config/en.us/models/generic11_m.swimdl
-rw-r--r-- 0/0 42996 2013-03-08 10:10 system/usr/srec/config/en.us/models/generic.swiarb
-rw-r--r-- 0/0 10954 2013-03-08 10:10 system/usr/srec/config/en.us/models/generic8.lda
-rw-r--r-- 0/0 286565 2013-03-08 10:10 system/usr/srec/config/en.us/models/generic11_f.swimdl
-rw-r--r-- 0/0 280321 2013-03-08 10:10 system/usr/srec/config/en.us/models/generic8_f.swimdl
-rw-r--r-- 0/0 283917 2013-03-08 10:10 system/usr/srec/config/en.us/models/generic8_m.swimdl
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/usr/srec/config/en.us/g2p/
-rw-r--r-- 0/0 22693 2013-03-08 10:10 system/usr/srec/config/en.us/g2p/en-US-ttp.data
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/usr/srec/config/en.us/dictionary/
-rw-r--r-- 0/0 419 2013-03-08 10:10 system/usr/srec/config/en.us/dictionary/enroll.ok
-rw-r--r-- 0/0 628151 2013-03-08 10:10 system/usr/srec/config/en.us/dictionary/cmu6plus.ok.zip
-rw-r--r-- 0/0 254 2013-03-08 10:10 system/usr/srec/config/en.us/dictionary/basic.ok
-rw-r--r-- 0/0 4896 2013-03-08 10:10 system/usr/srec/config/en.us/baseline11k.par
-rw-r--r-- 0/0 4895 2013-03-08 10:10 system/usr/srec/config/en.us/baseline8k.par
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/usr/share/
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/usr/share/bmd/
-rw-r--r-- 0/0 12862 2013-03-08 10:10 system/usr/share/bmd/RFFspeed_501.bmd
-rw-r--r-- 0/0 19586 2013-03-08 10:10 system/usr/share/bmd/RFFstd_501.bmd
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/usr/share/zoneinfo/
-rw-r--r-- 0/0 6 2013-03-08 10:09 system/usr/share/zoneinfo/zoneinfo.version
-rw-r--r-- 0/0 29536 2013-03-08 10:09 system/usr/share/zoneinfo/zoneinfo.idx
-rw-r--r-- 0/0 503608 2013-03-08 10:09 system/usr/share/zoneinfo/zoneinfo.dat
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/usr/keylayout/
-rw-r--r-- 0/0 1834 2013-03-08 10:11 system/usr/keylayout/qwerty.kl
-rw-r--r-- 0/0 245 2013-03-08 10:11 system/usr/keylayout/AVRCP.kl
-rw-r--r-- 0/0 1612 2013-04-03 07:11 system/usr/keylayout/mt6575-kpd.kl
drwxr-xr-x 0/0 0 2013-04-03 07:28 system/usr/keychars/
-rw-r--r-- 0/0 896 2013-04-03 07:26 system/usr/keychars/qwerty.kcm.bin
-rw-r--r-- 0/0 896 2013-04-03 07:26 system/usr/keychars/qwerty2.kcm.bin
-rw-r--r-- 0/0 896 2013-04-03 07:26 system/usr/keychars/mt6575-kpd.kcm.bin
drwxr-xr-x 0/0 0 2013-04-03 07:23 system/usr/icu/
-rw-r--r-- 0/0 6140032 2013-03-08 10:10 system/usr/icu/icudt44l.dat
drwxr-xr-x 0/0 0 2013-04-03 07:23 system/fonts/
-rw-r--r-- 0/0 194488 2013-03-08 10:10 system/fonts/DroidSans-Bold.ttf
-rw-r--r-- 0/0 23076 2013-03-08 10:10 system/fonts/DroidSansHebrew.ttf
-rw-r--r-- 0/0 185228 2013-03-08 10:10 system/fonts/DroidSerif-Bold.ttf
-rw-r--r-- 0/0 172916 2013-03-08 10:10 system/fonts/DroidSerif-Regular.ttf
-rw-r--r-- 0/0 190304 2013-03-08 10:10 system/fonts/DroidSerif-BoldItalic.ttf
-rw-r--r-- 0/0 190776 2013-03-08 10:10 system/fonts/DroidSans.ttf
-rw-r--r-- 0/0 142336 2013-04-01 08:22 system/fonts/DroidSansHindi.ttf
-rw-r--r-- 0/0 177560 2013-03-08 10:10 system/fonts/DroidSerif-Italic.ttf
-rw-r--r-- 0/0 3725920 2013-03-08 10:10 system/fonts/DroidSansFallback.ttf
-rw-r--r-- 0/0 62388 2013-03-08 10:10 system/fonts/SegoeWP.ttf
-rw-r--r-- 0/0 35880 2013-03-08 10:10 system/fonts/DroidSansArabic.ttf
-rw-r--r-- 0/0 6880 2013-03-08 10:10 system/fonts/Clockopia.ttf
-rw-r--r-- 0/0 119380 2013-03-08 10:10 system/fonts/DroidSansMono.ttf
-rw-r--r-- 0/0 36028 2013-03-08 10:10 system/fonts/DroidSansThai.ttf
-rw-r--r-- 0/0 417112 2013-03-08 10:10 system/fonts/Mya.ttf
drwxr-xr-x 0/2000 0 2013-04-03 07:34 system/bin/
-rwxr-xr-x 0/2000 22308 2013-04-03 07:09 system/bin/mfv_ut
-rwxr-xr-x 0/2000 56388 2013-03-08 10:10 system/bin/p2p_cli
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/iftop -> toolbox
-rwxr-xr-x 0/2000 13888 2013-04-03 07:09 system/bin/ccci_mdinit
-rwxr-xr-x 0/2000 64580 2013-04-03 07:29 system/bin/ccaptest
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/sync -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/smd -> toolbox
-rwxr-xr-x 0/2000 9876 2013-04-03 07:29 system/bin/acdktest
-rwxr-xr-x 0/2000 25832 2013-04-03 07:29 system/bin/dm_agent_binder
-rwxr-xr-x 0/2000 5604 2013-04-03 07:29 system/bin/gzip
-rwxr-xr-x 0/2000 9796 2013-04-03 07:30 system/bin/dexopt
-rwxr-xr-x 0/2000 9764 2013-04-03 07:29 system/bin/boot_logo_updater
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/umount -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/start -> toolbox
-rwxr-xr-x 0/2000 9812 2013-04-03 07:29 system/bin/dumpsys
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/mount -> toolbox
-rwxr-xr-x 0/2000 22420 2013-04-03 07:29 system/bin/installd
-rwxr-xr-x 0/2000 5552 2013-04-03 07:29 system/bin/ndc
-rwxr-xr-x 0/2000 44596 2013-04-03 07:29 system/bin/dhcpcd
-rwxr-xr-x 0/2000 5520 2013-04-03 07:33 system/bin/mediaserver
-rwxr-xr-x 0/2000 104740 2013-04-03 07:29 system/bin/dnsmasq
-rwxr-xr-x 0/2000 46768 2013-04-03 07:29 system/bin/sbchk
-rwxr-xr-x 0/2000 10004 2013-04-03 07:29 system/bin/servicemanager
-rwxr-xr-x 0/2000 205 2013-03-08 10:10 system/bin/monkey
-rwxr-xr-x 0/2000 9748 2013-04-03 07:29 system/bin/sdcard
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/dmesg -> toolbox
-rwxr-xr-x 0/2000 22532 2013-04-03 07:29 system/bin/netdiag
-rwxr-xr-x 0/2000 956436 2013-04-03 07:09 system/bin/mtkbt
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/notify -> toolbox
-rwxr-xr-x 0/2000 5488 2013-04-03 07:34 system/bin/system_server
-rwxr-xr-x 0/2000 5536 2013-04-03 07:09 system/bin/md_minilog_util
-rwxr-xr-x 0/2000 5472 2013-04-03 07:30 system/bin/surfaceflinger
-rwxr-xr-x 0/2000 41796 2013-04-03 07:09 system/bin/mobile_log_d
-rwsr-s--- 0/2000 59836 2013-04-03 07:29 system/bin/run-as
-rwxr-xr-x 0/2000 117980 2013-04-03 07:29 system/bin/resize2fs
-rwxr-xr-x 0/2000 55972 2013-04-03 07:29 system/bin/vold
-rwxr-xr-x 0/2000 18324 2013-04-03 07:29 system/bin/mtpd
-rwxr-xr-x 0/2000 18340 2013-04-03 07:29 system/bin/hald
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/log -> toolbox
-rwxr-xr-x 0/2000 308420 2013-04-03 07:29 system/bin/wpa_supplicant
-rwxr-xr-x 0/2000 5556 2013-04-03 07:29 system/bin/bugreport
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/sleep -> toolbox
-rwxr-xr-x 0/2000 32616 2013-04-03 07:31 system/bin/omx_tests
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/mv -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/setprop -> toolbox
-rwxr-xr-x 0/2000 42592 2013-04-03 07:09 system/bin/ccci_fsd
-rwxr-xr-x 0/2000 14308 2013-03-08 10:10 system/bin/aee
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/route -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/chown -> toolbox
-rwxr-xr-x 0/2000 17780 2013-04-03 07:29 system/bin/drmioserver
-rwxr-xr-x 0/2000 186964 2013-04-03 07:29 system/bin/mke2fs
-rwxr-xr-x 0/2000 13952 2013-04-03 07:29 system/bin/logcat
-rwxr-xr-x 0/2000 14000 2013-04-03 07:29 system/bin/mtk_route
-rwxr-xr-x 0/2000 5604 2013-04-03 07:09 system/bin/btlogmask
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/stop -> toolbox
-rwxr-xr-x 0/2000 366052 2013-03-08 10:10 system/bin/p2p_supplicant
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/cmp -> toolbox
-rwxr-xr-x 0/2000 48300 2013-03-08 10:10 system/bin/aee_minizip
-rwxr-xr-x 0/2000 10032 2013-04-03 07:09 system/bin/nvram_daemon
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/ps -> toolbox
-rwxr-xr-x 0/2000 5552 2013-04-03 07:29 system/bin/vdc
-rwxr-xr-x 0/2000 14260 2013-04-03 07:30 system/bin/em_svr
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/getevent -> toolbox
-rwxr-xr-x 0/2000 49924 2013-04-03 07:29 system/bin/applypatch
-rwxr-xr-x 0/2000 9968 2013-04-03 07:09 system/bin/shutdown
-rwxr-xr-x 0/2000 51204 2013-04-03 07:29 system/bin/gsm0710muxd
-rwxr-xr-x 0/2000 14436 2013-04-03 07:29 system/bin/mtk_ifconfig
-rwxr-xr-x 0/2000 34068 2013-04-03 07:30 system/bin/drmserver
-rwxr-xr-x 0/2000 22844 2013-03-08 10:10 system/bin/aee_dumpstate
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/kill -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/renice -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/id -> toolbox
-rwxr-xr-x 0/2000 116724 2013-04-03 07:29 system/bin/iptables
-rwxr-xr-x 0/2000 5424 2013-04-03 07:09 system/bin/muxreport
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/rmmod -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/watchprops -> toolbox
-rwxr-s--- 0/3003 5660 2013-04-03 07:29 system/bin/netcfg
-rwxr-xr-x 0/2000 5520 2013-04-03 07:29 system/bin/dalvikvm
-rwxr-xr-x 0/2000 14772 2013-04-03 07:30 system/bin/mac_addr
-rwxr-xr-x 0/2000 16756 2013-04-03 07:09 system/bin/nvram_agent_binder
-rwxr-xr-x 0/2000 9800 2013-04-03 07:09 system/bin/xlog
-rwxr-xr-x 0/2000 18064 2013-04-03 07:09 system/bin/stp_dump3
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/rm -> toolbox
-rwxr-xr-x 0/2000 14052 2013-04-03 07:09 system/bin/6620_launcher
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/rmdir -> toolbox
-rwxr-xr-x 0/2000 5456 2013-04-03 07:30 system/bin/memorydumper
-rwxr-xr-x 0/2000 199 2013-03-08 10:10 system/bin/bmgr
-rwxr-sr-x 0/3004 26720 2013-04-03 07:29 system/bin/ping
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/dd -> toolbox
-rwxr-xr-x 0/2000 26752 2013-04-03 07:29 system/bin/fsck_msdos
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/top -> toolbox
-rwxr-xr-x 0/2000 5552 2013-04-03 07:29 system/bin/hdc
-rwxr-xr-x 0/2000 14772 2013-04-03 07:30 system/bin/nvram_restore_tool
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/debuggerd -> aee_debuggerd
-rwxr-xr-x 0/2000 191 2013-03-08 10:10 system/bin/am
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/chmod -> toolbox
-rwxr-xr-x 0/2000 194 2013-03-08 10:10 system/bin/ime
-rwxr-xr-x 0/2000 201 2013-03-08 10:10 system/bin/input
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/lsmod -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/wipe -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/lsof -> toolbox
-rwxr-xr-x 0/2000 18260 2013-04-03 07:29 system/bin/mtk_netstat
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/printenv -> toolbox
-rwxr-xr-x 0/2000 18060 2013-04-03 07:29 system/bin/atci
-rwxr-xr-x 0/2000 78712 2013-04-03 07:29 system/bin/sh
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/nandread -> toolbox
-rwxr-xr-x 0/2000 324004 2013-04-03 07:30 system/bin/factory
-rwxr-xr-x 0/2000 10100 2013-04-03 07:09 system/bin/mdpd
-rwxr-xr-x 0/2000 44456 2013-03-08 10:10 system/bin/aee_aed
-rwxr-xr-x 0/2000 30420 2013-04-03 07:29 system/bin/aee_debuggerd
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/ls -> toolbox
-rwxr-xr-x 0/2000 109504 2013-04-03 07:29 system/bin/dbus-daemon
-rwxr-xr-x 0/2000 191 2013-03-08 10:10 system/bin/pm
-rwxr-xr-x 0/2000 63364 2013-04-03 07:30 system/bin/gsensor_calibrator
-rwxr-xr-x 0/2000 13380 2013-03-08 10:10 system/bin/rtt
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/setconsole -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/df -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/ioctl -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/hd -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/getprop -> toolbox
-rwxr-xr-x 0/2000 142532 2013-04-03 07:29 system/bin/racoon
-rwxr-xr-x 0/2000 31204 2013-04-03 07:30 system/bin/netd
-rwxr-xr-x 0/2000 9860 2013-04-03 07:29 system/bin/service
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/sendevent -> toolbox
-rwxr-xr-x 0/2000 23688 2013-04-03 07:30 system/bin/bootanimation
-rwxr-xr-x 0/2000 9792 2013-04-03 07:29 system/bin/logwrapper
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/reboot -> toolbox
-rwxr-xr-x 0/2000 139780 2013-04-03 07:29 system/bin/pppd
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/vmstat -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/mkdir -> toolbox
-rwxr-xr-x 0/2000 39436 2013-04-03 07:29 system/bin/linker
-rwxr-xr-x 0/2000 9808 2013-04-03 07:09 system/bin/rild
-rwxr-xr-x 0/2000 67956 2013-04-03 07:29 system/bin/tc
-rwxr-xr-x 0/2000 192 2013-03-08 10:10 system/bin/svc
-rwxr-xr-x 0/2000 5676 2013-04-03 07:29 system/bin/kpd_auto
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/schedtop -> toolbox
-rwxr-xr-x 0/2000 5548 2013-04-03 07:29 system/bin/dvz
-rwxr-xr-x 0/2000 34544 2013-04-03 07:29 system/bin/dumpstate
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/newfs_msdos -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/ifconfig -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/cat -> toolbox
-rwxr-xr-x 0/2000 5520 2013-04-03 07:29 system/bin/msensord
-rwxr-xr-x 0/2000 18080 2013-04-03 07:09 system/bin/mtk_agpsd
-rwxr-xr-x 0/2000 9700 2013-04-03 07:09 system/bin/btconfig
-rwxr-xr-x 0/2000 5392 2013-04-03 07:29 system/bin/schedtest
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/ln -> toolbox
-rwxr-xr-x 0/2000 81544 2013-04-03 07:29 system/bin/toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/insmod -> toolbox
-rwxr-xr-x 0/2000 9812 2013-04-03 07:30 system/bin/nvram_custom
-rwxr-xr-x 0/2000 10112 2013-04-03 07:29 system/bin/keystore
-rwxr-xr-x 0/2000 5736 2013-04-03 07:30 system/bin/app_process
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/uptime -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/date -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/netstat -> toolbox
lrwxr-xr-x 0/2000 0 2013-04-03 07:29 system/bin/ionice -> toolbox
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/res/
drwxr-xr-x 0/0 0 2013-04-03 07:19 system/res/images/
-rw-r--r-- 0/0 2884 2013-03-08 10:10 system/res/images/lcd_test_04.png
-rw-r--r-- 0/0 836670 2013-03-08 10:10 system/res/images/lcd_test_06.png
-rw-r--r-- 0/0 574881 2013-03-08 10:10 system/res/images/lcd_test_07.png
-rw-r--r-- 0/0 2783 2013-03-08 10:10 system/res/images/lcd_test_03.png
-rw-r--r-- 0/0 2782 2013-03-08 10:10 system/res/images/lcd_test_01.png
-rw-r--r-- 0/0 2783 2013-03-08 10:10 system/res/images/lcd_test_02.png
-rw-r--r-- 0/0 2781 2013-03-08 10:10 system/res/images/lcd_test_00.png
-rw-r--r-- 0/0 107696 2013-03-08 10:10 system/res/images/lcd_test_05.png
drwxr-xr-x 0/0 0 2012-06-01 20:03 system/etc/
drwxr-xr-x 0/0 0 2013-04-03 07:25 system/etc/permissions/
-rw-r--r-- 0/0 815 2013-04-03 07:11 system/etc/permissions/android.hardware.sensor.proximity.xml
-rw-r--r-- 0/0 8150 2013-03-08 10:10 system/etc/permissions/platform.xml
-rw-r--r-- 0/0 818 2013-04-03 07:11 system/etc/permissions/android.hardware.sensor.compass.xml
-rw-r--r-- 0/0 824 2013-04-03 07:11 system/etc/permissions/android.hardware.sensor.accelerometer.xml
-rw-r--r-- 0/0 839 2013-04-03 07:11 system/etc/permissions/android.hardware.bluetooth.xml
-rw-r--r-- 0/0 841 2013-04-03 07:11 system/etc/permissions/android.hardware.microphone.xml
-rw-r--r-- 0/0 173 2013-03-08 10:10 system/etc/permissions/com.mediatek.framework.xml
-rw-r--r-- 0/0 826 2013-03-08 10:10 system/etc/permissions/android.hardware.camera.front.xml
-rw-r--r-- 0/0 939 2013-04-03 07:11 system/etc/permissions/android.hardware.camera.xml
-rw-r--r-- 0/0 815 2013-04-03 07:11 system/etc/permissions/android.hardware.sensor.gyroscope.xml
-rw-r--r-- 0/0 834 2013-04-03 07:11 system/etc/permissions/android.software.live_wallpaper.xml
-rw-r--r-- 0/0 829 2013-04-03 07:11 system/etc/permissions/android.hardware.wifi.xml
-rw-r--r-- 0/0 1026 2013-04-03 07:11 system/etc/permissions/android.hardware.touchscreen.multitouch.distinct.xml
-rw-r--r-- 0/0 816 2013-04-03 07:11 system/etc/permissions/android.hardware.sensor.light.xml
-rw-r--r-- 0/0 942 2013-04-03 07:11 system/etc/permissions/android.hardware.location.gps.xml
-rw-r--r-- 0/0 881 2013-04-03 07:11 system/etc/permissions/android.hardware.telephony.gsm.xml
-rw-r--r-- 0/0 816 2013-04-03 07:09 system/etc/permissions/com.google.android.maps.xml
-rw-r--r-- 0/0 828 2013-04-03 07:11 system/etc/permissions/android.software.sip.xml
-rw-r--r-- 0/0 840 2013-04-03 07:09 system/etc/permissions/features.xml
-rw-r--r-- 0/0 985 2013-04-03 07:11 system/etc/permissions/android.hardware.touchscreen.multitouch.xml
-rw-r--r-- 0/0 880 2013-04-03 07:11 system/etc/permissions/android.software.sip.voip.xml
-rw-r--r-- 0/0 1094 2013-04-03 07:11 system/etc/permissions/android.hardware.touchscreen.multitouch.jazzhand.xml
-rw-r--r-- 0/0 663 2013-03-08 10:10 system/etc/pvplayer.cfg
-rw-r--r-- 0/0 55600 2013-04-03 07:36 system/etc/NOTICE.html.gz
-rw-r--r-- 0/0 1478 2013-04-03 07:11 system/etc/mtk_omx_core.cfg
-rw-r--r-- 0/0 1236 2013-04-03 07:11 system/etc/vold.fstab.fat.nand
-rw-r--r-- 0/0 51 2013-03-08 10:11 system/etc/hosts
-rw-r--r-- 0/0 324 2013-04-03 07:09 system/etc/location_service_conf.xml
drwxr-xr-x 0/0 0 2013-04-03 07:25 system/etc/dhcpcd/
drwxr-xr-x 0/0 0 2013-04-03 07:25 system/etc/dhcpcd/dhcpcd-hooks/
-rw-r--r-- 0/0 803 2013-03-08 10:10 system/etc/dhcpcd/dhcpcd-hooks/20-dns.conf
-rw-r--r-- 0/0 803 2013-03-08 10:10 system/etc/dhcpcd/dhcpcd-hooks/95-configured
-rw-r--r-- 0/0 332 2013-03-08 10:10 system/etc/dhcpcd/dhcpcd.conf
-r-xr-x--- 1014/2000 1009 2013-03-08 10:10 system/etc/dhcpcd/dhcpcd-run-hooks
drwxr-xr-x 0/0 0 2013-04-03 07:29 system/etc/ppp/
-r-xr-xr-x 0/0 5520 2013-04-03 07:29 system/etc/ppp/ip-up-vpn
-r--r----- 1002/1002 935 2013-03-08 10:11 system/etc/dbus.conf
drwxr-xr-x 0/0 0 2013-04-03 07:25 system/etc/theme/
-rw-r--r-- 0/0 46595 2013-03-08 10:10 system/etc/theme/thememap.xml
-rw-r--r-- 0/0 1095 2013-04-03 07:11 system/etc/vold.fstab.nand
-rw-r--r-- 0/0 11649 2013-04-03 07:23 system/etc/event-log-tags
-rw-r--r-- 0/0 2303 2013-03-08 10:10 system/etc/piggy_bank.sh
-rw-r--r-- 0/0 659 2013-04-03 07:12 system/etc/fm_cust.cfg
drwxr-xr-x 0/0 0 2013-04-03 07:25 system/etc/firmware/
-rw-r--r-- 0/0 156896 2013-03-08 10:10 system/etc/firmware/WIFI_RAM_CODE_MT6628
-rw-r--r-- 0/0 1092 2013-04-03 07:12 system/etc/firmware/mt6628_fm_v2_coeff.bin
-rw-r--r-- 0/0 18438 2013-04-03 07:12 system/etc/firmware/mt6628_fm_rom.bin
-rw-r--r-- 0/0 2715236 2013-04-03 07:12 system/etc/firmware/modem.img
-rw-r--r-- 0/0 1092 2013-04-03 07:12 system/etc/firmware/mt6628_fm_v3_coeff.bin
-rw-r--r-- 0/0 1028 2013-04-03 07:12 system/etc/firmware/mt6628_fm_v2_patch.bin
-rw-r--r-- 0/0 687848 2013-04-03 07:12 system/etc/firmware/DSP_ROM
-rw-r--r-- 0/0 79 2013-04-03 07:12 system/etc/firmware/WMT.cfg
-rw-r--r-- 0/0 1028 2013-04-03 07:12 system/etc/firmware/mt6628_fm_v3_patch.bin
-rw-r--r-- 0/0 1028 2013-04-03 07:12 system/etc/firmware/mt6628_fm_v1_patch.bin
-rw-r--r-- 0/0 1028 2013-04-03 07:12 system/etc/firmware/mt6628_fm_v4_patch.bin
-rw-r--r-- 0/0 270 2013-04-03 07:19 system/etc/firmware/S_ANDRO_SFL.ini
-rw-r--r-- 0/0 1092 2013-04-03 07:12 system/etc/firmware/mt6628_fm_v4_coeff.bin
-rw-r--r-- 0/0 20564 2013-04-03 07:12 system/etc/firmware/mt6628_patch_e2_hdr.bin
-rw-r--r-- 0/0 1092 2013-04-03 07:12 system/etc/firmware/mt6628_fm_v1_coeff.bin
-rw-r--r-- 0/0 28496 2013-04-03 07:12 system/etc/firmware/mt6628_patch_e1_hdr.bin
-rw-r--r-- 0/0 1092 2013-04-03 07:12 system/etc/firmware/mt6628_fm_v5_coeff.bin
-rw-r--r-- 0/0 1028 2013-04-03 07:12 system/etc/firmware/mt6628_fm_v5_patch.bin
-rw-r--r-- 0/0 187551 2013-04-03 07:11 system/etc/apns-conf.xml
-rw-r--r-- 0/0 47138 2013-04-03 07:09 system/etc/spn-conf.xml
-r-xr-x--- 0/2000 3164 2013-03-08 10:11 system/etc/init.goldfish.sh
drwxr-xr-x 0/0 0 2013-04-03 07:25 system/etc/wifi/
-rw-r--r-- 0/0 385 2013-03-08 10:10 system/etc/wifi/p2p.conf
-rw-r--r-- 0/0 282 2013-03-08 10:10 system/etc/wifi/wpa_supplicant.conf
-rw-r--r-- 0/0 1209 2013-04-03 07:11 system/etc/vold.fstab
drwxr-xr-x 0/0 0 2013-04-03 07:23 system/etc/security/
-rw-r--r-- 0/0 1125 2013-04-03 07:23 system/etc/security/otacerts.zip
-rw-r--r-- 0/0 141644 2013-03-08 10:10 system/etc/security/cacerts.bks
-rw-r--r-- 0/0 1185 2013-04-03 07:11 system/etc/factory.ini
-rw-r--r-- 0/0 527 2013-04-03 07:11 system/etc/player.cfg
-rw-rw-rw- 0/0 15 2012-06-01 20:03 system/etc/shells
drwxr-xr-x 0/2000 0 2013-04-03 07:25 system/vendor/
drwxr-xr-x 0/2000 0 2013-04-03 07:25 system/vendor/lib/
-rw-r--r-- 0/0 63412 2013-03-08 10:10 system/vendor/lib/libIMGegl.so
drwxr-xr-x 0/2000 0 2013-04-03 07:25 system/vendor/lib/egl/
-rw-r--r-- 0/0 9368 2013-03-08 10:10 system/vendor/lib/egl/libEGL_mtk.so
-rw-r--r-- 0/0 417480 2013-03-08 10:10 system/vendor/lib/egl/libGLESv1_CM_mtk.so
-rw-r--r-- 0/0 343608 2013-03-08 10:10 system/vendor/lib/egl/libGLESv2_mtk.so
-rw-r--r-- 0/0 249324 2013-03-08 10:10 system/vendor/lib/libglslcompiler.so
-rw-r--r-- 0/0 972752 2013-03-08 10:10 system/vendor/lib/libusc.so
-rw-r--r-- 0/0 153360 2013-03-08 10:10 system/vendor/lib/libsrv_um.so
-rw-r--r-- 0/0 91272 2013-03-08 10:10 system/vendor/lib/libsrv_init.so
-rw-r--r-- 0/0 21860 2013-03-08 10:10 system/vendor/lib/libpvr2d.so
-rw-r--r-- 0/0 9340 2013-03-08 10:10 system/vendor/lib/libPVRScopeServices.so
-rw-r--r-- 0/0 18104 2013-03-08 10:10 system/vendor/lib/libBLPP.so
drwxr-xr-x 0/2000 0 2013-04-03 07:25 system/vendor/lib/hw/
-rw-r--r-- 0/0 14384 2013-03-08 10:10 system/vendor/lib/hw/gralloc.mt6575.so
-rw-r--r-- 0/0 9716 2013-03-08 10:10 system/vendor/lib/libpvrANDROID_WSEGL.so
drwxr-xr-x 0/2000 0 2013-04-03 07:25 system/vendor/bin/
-rwxr-xr-x 0/2000 447 2013-03-08 10:10 system/vendor/bin/rc.fac
-rwxr-xr-x 0/2000 5472 2013-03-08 10:10 system/vendor/bin/pvrsrvinit
drwxr-xr-x 0/0 0 2013-04-03 07:25 system/media/
-rw-r--r-- 0/0 65182 2013-03-21 06:13 system/media/shutanimation.zip
-rw-r--r-- 0/0 126268 2013-03-08 10:10 system/media/shutaudio.mp3
drwxr-xr-x 0/0 0 2013-04-03 07:25 system/media/images/
-rw-r--r-- 0/0 307200 2013-04-03 07:17 system/media/images/boot_logo
drwxr-xr-x 0/0 0 2013-04-03 07:23 system/media/audio/
drwxr-xr-x 0/0 0 2013-04-03 07:23 system/media/audio/ringtones/
-rw-r--r-- 0/0 36620 2013-03-08 10:10 system/media/audio/ringtones/Terminated.ogg
-rw-r--r-- 0/0 30759 2013-03-08 10:10 system/media/audio/ringtones/BentleyDubs.ogg
-rw-r--r-- 0/0 46425 2013-03-08 10:10 system/media/audio/ringtones/FriendlyGhost.ogg
-rw-r--r-- 0/0 15563 2013-03-08 10:10 system/media/audio/ringtones/NewPlayer.ogg
-rw-r--r-- 0/0 49978 2013-03-08 10:10 system/media/audio/ringtones/GameOverGuitar.ogg
-rw-r--r-- 0/0 34627 2013-03-08 10:10 system/media/audio/ringtones/LoveFlute.ogg
-rw-r--r-- 0/0 26144 2013-03-08 10:10 system/media/audio/ringtones/SpringyJalopy.ogg
-rw-r--r-- 0/0 26662 2013-03-08 10:10 system/media/audio/ringtones/Noises3.ogg
-rw-r--r-- 0/0 41828 2013-03-08 10:10 system/media/audio/ringtones/BirdLoop.ogg
-rw-r--r-- 0/0 26298 2013-03-08 10:10 system/media/audio/ringtones/TwirlAway.ogg
-rw-r--r-- 0/0 28691 2013-03-08 10:10 system/media/audio/ringtones/VeryAlarmed.ogg
-rw-r--r-- 0/0 31563 2013-03-08 10:10 system/media/audio/ringtones/EtherShake.ogg
-rw-r--r-- 0/0 32640 2013-03-08 10:10 system/media/audio/ringtones/OrganDub.ogg
-rw-r--r-- 0/0 39025 2013-03-08 10:10 system/media/audio/ringtones/Noises2.ogg
-rw-r--r-- 0/0 175423 2013-03-08 10:10 system/media/audio/ringtones/DreamTheme.ogg
-rw-r--r-- 0/0 28433 2013-03-08 10:10 system/media/audio/ringtones/BeatPlucker.ogg
-rw-r--r-- 0/0 43965 2013-03-08 10:10 system/media/audio/ringtones/Ring_Synth_04.ogg
-rw-r--r-- 0/0 36287 2013-03-08 10:10 system/media/audio/ringtones/Noises1.ogg
-rw-r--r-- 0/0 31136 2013-03-08 10:10 system/media/audio/ringtones/World.ogg
-rw-r--r-- 0/0 41094 2013-03-08 10:10 system/media/audio/ringtones/Growl.ogg
-rw-r--r-- 0/0 52809 2013-03-08 10:10 system/media/audio/ringtones/Ring_Synth_02.ogg
-rw-r--r-- 0/0 28898 2013-03-08 10:10 system/media/audio/ringtones/SitarVsSitar.ogg
-rw-r--r-- 0/0 38307 2013-03-08 10:10 system/media/audio/ringtones/LoopyLounge.ogg
-rw-r--r-- 0/0 30615 2013-03-08 10:10 system/media/audio/ringtones/CaribbeanIce.ogg
-rw-r--r-- 0/0 30925 2013-03-08 10:10 system/media/audio/ringtones/CurveBall.ogg
-rw-r--r-- 0/0 28124 2013-03-08 10:10 system/media/audio/ringtones/MidEvilJaunt.ogg
-rw-r--r-- 0/0 21007 2013-03-08 10:10 system/media/audio/ringtones/Ring_Digital_02.ogg
-rw-r--r-- 0/0 31641 2013-03-08 10:10 system/media/audio/ringtones/RomancingTheTone.ogg
-rw-r--r-- 0/0 34864 2013-03-08 10:10 system/media/audio/ringtones/MildlyAlarming.ogg
-rw-r--r-- 0/0 206809 2013-03-08 10:10 system/media/audio/ringtones/CrazyDream.ogg
-rw-r--r-- 0/0 15146 2013-03-08 10:10 system/media/audio/ringtones/InsertCoin.ogg
-rw-r--r-- 0/0 59024 2013-03-08 10:10 system/media/audio/ringtones/Ring_Classic_02.ogg
drwxr-xr-x 0/0 0 2013-04-03 07:23 system/media/audio/alarms/
-rw-r--r-- 0/0 11368 2013-03-08 10:10 system/media/audio/alarms/Alarm_Buzzer.ogg
-rw-r--r-- 0/0 21153 2013-03-08 10:10 system/media/audio/alarms/Alarm_Beep_03.ogg
-rw-r--r-- 0/0 73946 2013-03-08 10:10 system/media/audio/alarms/Alarm_Classic.ogg
-rw-r--r-- 0/0 11160 2013-03-08 10:10 system/media/audio/alarms/Alarm_Rooster_02.ogg
-rw-r--r-- 0/0 16130 2013-03-08 10:10 system/media/audio/alarms/Alarm_Beep_01.ogg
-rw-r--r-- 0/0 5898 2013-03-08 10:10 system/media/audio/alarms/Alarm_Beep_02.ogg
drwxr-xr-x 0/0 0 2013-04-03 07:23 system/media/audio/notifications/
-rw-r--r-- 0/0 38517 2013-03-08 10:10 system/media/audio/notifications/Heaven.ogg
-rw-r--r-- 0/0 18659 2013-03-08 10:10 system/media/audio/notifications/DearDeer.ogg
-rw-r--r-- 0/0 15619 2013-03-08 10:10 system/media/audio/notifications/KzurbSonar.ogg
-rw-r--r-- 0/0 20052 2013-03-08 10:10 system/media/audio/notifications/OnTheHunt.ogg
-rw-r--r-- 0/0 18858 2013-03-08 10:10 system/media/audio/notifications/Tinkerbell.ogg
-rw-r--r-- 0/0 19121 2013-03-08 10:10 system/media/audio/notifications/CaffeineSnake.ogg
-rw-r--r-- 0/0 11941 2013-03-08 10:10 system/media/audio/notifications/F1_New_SMS.ogg
-rw-r--r-- 0/0 20983 2013-03-08 10:10 system/media/audio/notifications/F1_New_MMS.ogg
-rw-r--r-- 0/0 16985 2013-03-08 10:10 system/media/audio/notifications/DontPanic.ogg
-rw-r--r-- 0/0 34601 2013-03-08 10:10 system/media/audio/notifications/Beat_Box_Android.ogg
-rw-r--r-- 0/0 43522 2013-03-08 10:10 system/media/audio/notifications/TaDa.ogg
-rw-r--r-- 0/0 18442 2013-03-08 10:10 system/media/audio/notifications/Highwire.ogg
-rw-r--r-- 0/0 11950 2013-03-08 10:10 system/media/audio/notifications/F1_MissedCall.ogg
-rw-r--r-- 0/0 16487 2013-03-08 10:10 system/media/audio/notifications/Voila.ogg
drwxr-xr-x 0/0 0 2013-04-03 07:23 system/media/audio/ui/
-rw-r--r-- 0/0 3994 2013-03-08 10:10 system/media/audio/ui/Effect_Tick.ogg
-rw-r--r-- 0/0 4661 2013-03-08 10:10 system/media/audio/ui/Lock.ogg
-rw-r--r-- 0/0 7392 2013-03-08 10:10 system/media/audio/ui/KeypressSpacebar.ogg
-rw-r--r-- 0/0 6585 2013-03-08 10:10 system/media/audio/ui/LowBattery.ogg
-rw-r--r-- 0/0 10289 2013-03-08 10:10 system/media/audio/ui/camera_click.ogg
-rw-r--r-- 0/0 5582 2013-03-08 10:10 system/media/audio/ui/VideoRecord.ogg
-rw-r--r-- 0/0 4666 2013-03-08 10:10 system/media/audio/ui/Unlock.ogg
-rw-r--r-- 0/0 6193 2013-03-08 10:10 system/media/audio/ui/KeypressDelete.ogg
-rw-r--r-- 0/0 5194 2013-03-08 10:10 system/media/audio/ui/KeypressStandard.ogg
-rw-r--r-- 0/0 7972 2013-03-08 10:10 system/media/audio/ui/KeypressReturn.ogg
-rw-r--r-- 0/0 126268 2013-03-08 10:10 system/media/bootaudio.mp3
-rw-r--r-- 0/0 18932 2013-03-21 07:54 system/media/bootanimation.zip
drwxr-xr-x 0/0 0 2013-04-03 07:34 system/lib/
-rw-r--r-- 0/0 85448 2013-04-03 07:31 system/lib/libomx_sharedlibrary.so
-rw-r--r-- 0/0 5272 2013-04-03 07:29 system/lib/libstagefright_enc_common.so
-rw-r--r-- 0/0 17328 2013-04-03 07:11 system/lib/libdalvik-internals.so
-rw-r--r-- 0/0 5368 2013-04-03 07:30 system/lib/libem_dsense_jni.so
-rw-r--r-- 0/0 63832 2013-04-03 07:29 system/lib/libcutils.so
-rw-r--r-- 0/0 10044 2013-04-03 07:30 system/lib/libgalleryjni.so
-rw-r--r-- 0/0 724016 2013-04-03 07:09 system/lib/libdvm_debug.so
-rw-r--r-- 0/0 5352 2013-04-03 07:30 system/lib/libmatv_cust.so
-rw-r--r-- 0/0 482920 2013-04-03 07:30 system/lib/libmedia.so
-rw-r--r-- 0/0 19232 2013-04-03 07:30 system/lib/libfmmt6628.so
-rw-r--r-- 0/0 30332 2013-03-08 10:10 system/lib/libp2p_client.so
-rw-r--r-- 0/0 34752 2013-04-03 07:09 system/lib/libMtkOmxVorbisEnc.so
-rw-r--r-- 0/0 22656 2013-04-03 07:09 system/lib/libexthid.so
-rw-r--r-- 0/0 31712 2013-04-03 07:09 system/lib/libextmap_jni.so
-rw-r--r-- 0/0 342888 2013-04-03 07:30 system/lib/libsonivox.so
-rw-r--r-- 0/0 96792 2013-04-03 07:32 system/lib/libomx_amrenc_sharedlibrary.so
-rw-r--r-- 0/0 23312 2013-04-03 07:09 system/lib/libextbip_jni.so
-rw-r--r-- 0/0 260152 2013-04-03 07:09 system/lib/libh264dec_ca9_lib.so
-rw-r--r-- 0/0 34344 2013-04-03 07:29 system/lib/libdrm1.so
-rw-r--r-- 0/0 60872 2013-04-03 07:30 system/lib/libandroid.so
-rw-r--r-- 0/0 88276 2013-03-08 10:10 system/lib/libvorbisenc_mtk.so
-rw-r--r-- 0/0 13700 2013-04-03 07:29 system/lib/libnetlink.so
drwxr-xr-x 0/0 0 2013-04-03 07:25 system/lib/modules/
-rw-r--r-- 0/0 3104 2013-04-03 07:20 system/lib/modules/eeprom_93cx6.ko
-rw-r--r-- 0/0 4624 2013-04-03 07:20 system/lib/modules/mtk_wmt_wifi.ko
-rw-r--r-- 0/0 141276 2013-04-03 07:20 system/lib/modules/mtk_stp_wmt_mt6620.ko
-rw-r--r-- 0/0 93708 2013-04-03 07:09 system/lib/modules/mt6575_m4u.ko
-rw-r--r-- 0/0 135672 2013-04-03 07:09 system/lib/modules/ccci.ko
-rw-r--r-- 0/0 186252 2013-04-03 07:20 system/lib/modules/pvrsrvkm.ko
-rw-r--r-- 0/0 102808 2013-04-03 07:20 system/lib/modules/mtk_stp_core_mt6620.ko
-rw-r--r-- 0/0 9852 2013-04-03 07:20 system/lib/modules/mtk_stp_uart.ko
-rw-r--r-- 0/0 21744 2013-04-03 07:20 system/lib/modules/mtk_hif_sdio_mt6620.ko
-rw-r--r-- 0/0 2760 2013-03-08 10:10 system/lib/modules/devinfo.ko
-rw-r--r-- 0/0 7828 2013-03-08 10:10 system/lib/modules/mtk_drvb_75.ko
-rw-r--r-- 0/0 44728 2013-04-03 07:20 system/lib/modules/mtk_stp_sdio.ko
-rw-r--r-- 0/0 5612 2013-04-03 07:20 system/lib/modules/mtk_fm_priv.ko
-rw-r--r-- 0/0 91446 2013-03-08 10:10 system/lib/modules/lca_core.ko
-rw-r--r-- 0/0 15852 2013-04-03 07:20 system/lib/modules/scsi_tgt.ko
-rw-r--r-- 0/0 61708 2013-03-08 10:10 system/lib/modules/sec.ko
-rw-r--r-- 0/0 118716 2013-03-08 10:10 system/lib/modules/p2p.ko
-rw-r--r-- 0/0 19252 2013-04-03 07:20 system/lib/modules/mtklfb.ko
-rw-r--r-- 0/0 90632 2013-04-03 07:20 system/lib/modules/ccci_plat.ko
-rw-r--r-- 0/0 61732 2013-03-08 10:10 system/lib/modules/sbup.ko
-rw-r--r-- 0/0 2156 2013-04-03 07:20 system/lib/modules/scsi_wait_scan.ko
-rw-r--r-- 0/0 11504 2013-04-03 07:20 system/lib/modules/mtkbc.ko
-rw-r--r-- 0/0 30276 2013-04-03 07:09 system/lib/modules/aed.ko
-rw-r--r-- 0/0 12132 2013-04-03 07:20 system/lib/modules/mtk_stp_sdio_mt6620.ko
-rw-r--r-- 0/0 8608 2013-04-03 07:20 system/lib/modules/mtk_stp_gps.ko
-rw-r--r-- 0/0 14448 2013-04-03 07:20 system/lib/modules/mtk_stp_bt_mt6620.ko
-rw-r--r-- 0/0 26952 2013-04-03 07:20 system/lib/modules/mtk_hif_sdio.ko
lrw-r--r-- 0/0 0 2013-04-03 07:24 system/lib/modules/wlan.ko -> wlan_mt6628.ko
-rw-r--r-- 0/0 121904 2013-04-03 07:20 system/lib/modules/mtk_fm_drv.ko
-rw-r--r-- 0/0 9192 2013-04-03 07:20 system/lib/modules/mtk_stp_uart_mt6620.ko
-rw-r--r-- 0/0 10172 2013-04-03 07:20 system/lib/modules/mtk_stp_gps_mt6620.ko
-rw-r--r-- 0/0 15284 2013-04-03 07:09 system/lib/modules/ccmni.ko
-rw-r--r-- 0/0 11892 2013-04-03 07:20 system/lib/modules/mtk_stp_bt.ko
-rw-r--r-- 0/0 253732 2013-04-03 07:20 system/lib/modules/mtk_stp_wmt.ko
-rw-r--r-- 0/0 345908 2013-04-03 07:09 system/lib/modules/wlan_mt6628.ko
-rw-r--r-- 0/0 28744 2013-04-03 07:09 system/lib/modules/mt6575_vcodec_kernel_driver.ko
-rw-r--r-- 0/0 346432 2013-04-03 07:09 system/lib/modules/wlan_mt6620.ko
-rw-r--r-- 0/0 57640 2013-04-03 07:33 system/lib/libmedia_jni.so
-rw-r--r-- 0/0 68288 2013-04-03 07:30 system/lib/libsensorservice.so
-rw-r--r-- 0/0 19168 2013-04-03 07:09 system/lib/libexthid_jni.so
-rw-r--r-- 0/0 212120 2013-04-03 07:30 system/lib/libui.so
-rw-r--r-- 0/0 93224 2013-04-03 07:30 system/lib/libmcamif.so
-rw-r--r-- 0/0 486480 2013-04-03 07:09 system/lib/libmhalpipe.so
-rw-r--r-- 0/0 9736 2013-04-03 07:29 system/lib/libwpa_client.so
-rw-r--r-- 0/0 106488 2013-04-03 07:30 system/lib/libsurfaceflinger_client.so
-rw-r--r-- 0/0 46380 2013-03-08 10:10 system/lib/libcok.so
-rw-r--r-- 0/0 184400 2013-04-03 07:30 system/lib/libft.so
-rw-r--r-- 0/0 13804 2013-04-03 07:30 system/lib/libembttest_jni.so
-rw-r--r-- 0/0 92648 2013-04-03 07:11 system/lib/libtracker.so
-rw-r--r-- 0/0 226696 2013-04-03 07:09 system/lib/libacdk.so
-rw-r--r-- 0/0 18088 2013-04-03 07:29 system/lib/libsysutils.so
-rw-r--r-- 0/0 38095 2013-04-03 07:09 system/lib/libvoicesearch.so
-rw-r--r-- 0/0 5320 2013-04-03 07:30 system/lib/libem_modem_jni.so
-rw-r--r-- 0/0 9392 2013-04-03 07:29 system/lib/libdl.so
-rw-r--r-- 0/0 5384 2013-04-03 07:09 system/lib/libvcodec_oal.so
-rw-r--r-- 0/0 14208 2013-04-03 07:09 system/lib/libextsimap.so
drwxr-xr-x 0/0 0 2013-04-03 07:09 system/lib/drm/
drwxr-xr-x 0/0 0 2013-04-03 07:09 system/lib/drm/plugins/
drwxr-xr-x 0/0 0 2013-04-03 07:09 system/lib/drm/plugins/native/
-rw-r--r-- 0/0 61884 2013-04-03 07:09 system/lib/drm/plugins/native/libdrmmtkplugin.so
-rw-r--r-- 0/0 5256 2013-04-03 07:09 system/lib/libbwcs_mtk.so
-rw-r--r-- 0/0 137580 2013-04-03 07:09 system/lib/libmpeg4enc_ca9.so
-rw-r--r-- 0/0 13928 2013-04-03 07:09 system/lib/libstagefrighthw.so
-rw-r--r-- 0/0 56384 2013-04-03 07:09 system/lib/libextjsr82.so
-rw-r--r-- 0/0 117224 2013-04-03 07:29 system/lib/libvorbisidec.so
-rw-r--r-- 0/0 5448 2013-04-03 07:09 system/lib/libmediatek_exceptionlog.so
-rw-r--r-- 0/0 13828 2013-04-03 07:09 system/lib/libeis.so
-rw-r--r-- 0/0 168696 2013-04-03 07:29 system/lib/libutils.so
-rw-r--r-- 0/0 5400 2013-04-03 07:09 system/lib/libutilrilmtk.so
-rw-r--r-- 0/0 18240 2013-04-03 07:09 system/lib/libextavrcp.so
-rw-r--r-- 0/0 10000 2013-04-03 07:09 system/lib/libextsys.so
-rw-r--r-- 0/0 141880 2013-04-03 07:32 system/lib/libomx_m4vdec_sharedlibrary.so
-rw-r--r-- 0/0 5580 2013-04-03 07:30 system/lib/libgsensorjni.so
-rw-r--r-- 0/0 22600 2013-04-03 07:29 system/lib/libhardware_legacy.so
-rw-r--r-- 0/0 5452 2013-04-03 07:30 system/lib/libmtktvout_jni.so
-rw-r--r-- 0/0 5496 2013-04-03 07:29 system/lib/libhardware.so
-rw-r--r-- 0/0 91332 2013-04-03 07:29 system/lib/libm.so
-rw-r--r-- 0/0 5288 2013-04-03 07:29 system/lib/libem_chip_support_jni.so
-rw-r--r-- 0/0 34784 2013-04-03 07:09 system/lib/libMtkOmxAwbEnc.so
-rw-r--r-- 0/0 628760 2013-04-03 07:30 system/lib/libaudioflinger.so
-rw-r--r-- 0/0 186600 2013-04-03 07:32 system/lib/libomx_aacdec_sharedlibrary.so
-rw-r--r-- 0/0 9960 2013-04-03 07:33 system/lib/libsystem_server.so
-rw-r--r-- 0/0 9440 2013-04-03 07:09 system/lib/libmhal.so
-rw-r--r-- 0/0 202696 2013-04-03 07:09 system/lib/libjpeg.so
-rw-r--r-- 0/0 44256 2013-04-03 07:09 system/lib/libextmap.so
-rw-r--r-- 0/0 26752 2013-04-03 07:09 system/lib/libmtkplayer.so
-rw-r--r-- 0/0 30688 2013-04-03 07:09 system/lib/libMtkOmxAMRNBDec.so
-rw-r--r-- 0/0 21868 2013-04-03 07:09 system/lib/libhwm.so
-rw-r--r-- 0/0 10172 2013-04-03 07:30 system/lib/libdcfdecoderjni.so
-rw-r--r-- 0/0 30688 2013-04-03 07:09 system/lib/libMtkOmxAMRWBDec.so
-rw-r--r-- 0/0 34784 2013-04-03 07:09 system/lib/libMtkOmxAmrEnc.so
-rw-r--r-- 0/0 648056 2013-04-03 07:30 system/lib/libandroid_runtime.so
-rw-r--r-- 0/0 103960 2013-04-03 07:30 system/lib/libpixelflinger.so
-rw-r--r-- 0/0 19072 2013-04-03 07:09 system/lib/libextbpp_jni.so
-rw-r--r-- 0/0 83528 2013-04-03 07:29 system/lib/libz.so
-rw-r--r-- 0/0 64536 2013-04-03 07:31 system/lib/libstagefright_omx.so
-rw-r--r-- 0/0 34800 2013-04-03 07:09 system/lib/libMtkOmxAacEnc.so
-rw-r--r-- 0/0 9952 2013-04-03 07:09 system/lib/libextpbap.so
-rw-r--r-- 0/0 5400 2013-04-03 07:29 system/lib/libstdc++.so
-rw-r--r-- 0/0 50580 2013-04-03 07:29 system/lib/libstagefright_amrnb_common.so
-rw-r--r-- 0/0 35792 2013-04-03 07:30 system/lib/libdrmframework_jni.so
-rw-r--r-- 0/0 393496 2013-04-03 07:11 system/lib/libstlport_shared.so
-rw-r--r-- 0/0 5472 2013-04-03 07:30 system/lib/libmtktvout_vlw_jni.so
-rw-r--r-- 0/0 83616 2013-03-08 10:10 system/lib/libaacdec_mtk.so
-rw-r--r-- 0/0 63432 2013-04-03 07:30 system/lib/libcameraservice.so
-rw-r--r-- 0/0 63592 2013-04-03 07:09 system/lib/libMtkOmxVdec.so
-rw-r--r-- 0/0 80616 2013-04-03 07:29 system/lib/libexpat.so
-rw-r--r-- 0/0 435772 2013-04-03 07:09 system/lib/libvp8dec_ca9_lib.so
-rw-r--r-- 0/0 61600 2013-04-03 07:09 system/lib/libextbip.so
-rw-r--r-- 0/0 26120 2013-04-03 07:30 system/lib/libaudiocompensationfilter.so
-rw-r--r-- 0/0 777064 2013-04-03 07:29 system/lib/libcrypto.so
-rw-r--r-- 0/0 236968 2013-04-03 07:30 system/lib/libsurfaceflinger.so
-rw-r--r-- 0/0 132320 2013-03-08 10:10 system/lib/libvorbisidec_mtk.so
-rw-r--r-- 0/0 9820 2013-04-03 07:29 system/lib/libhciattach_mtk.so
-rw-r--r-- 0/0 39200 2013-04-03 07:30 system/lib/libstagefright_foundation.so
-rw-r--r-- 0/0 112536 2013-04-03 07:09 system/lib/mtk-ril.so
-rw-r--r-- 0/0 17504 2013-04-03 07:29 system/lib/libjni_latinime.so
-rw-r--r-- 0/0 5256 2013-04-03 07:09 system/lib/libaudiodcrflt.so
-rw-r--r-- 0/0 13724 2013-04-03 07:30 system/lib/libmtk_dictionary.so
-rw-r--r-- 0/0 1063776 2013-04-03 07:09 system/lib/libagpssupl.so
-rw-r--r-- 0/0 39212 2013-04-03 07:29 system/lib/libext4_utils.so
-rw-r--r-- 0/0 5472 2013-04-03 07:30 system/lib/libmtktvout_vw_jni.so
-rw-r--r-- 0/0 9596 2013-04-03 07:09 system/lib/libmediatek_drvb.so
-rw-r--r-- 0/0 13804 2013-04-03 07:11 system/lib/libcpucapabilities.so
-rw-r--r-- 0/0 21528 2013-04-03 07:30 system/lib/libaudioeffectparam.so
-rw-r--r-- 0/0 26120 2013-04-03 07:30 system/lib/libheadphonecompensationfilter.so
-rw-r--r-- 0/0 165792 2013-03-08 10:10 system/lib/libheaacdec_mtk.so
-rw-r--r-- 0/0 11756 2013-04-03 07:11 system/lib/libnative.so
-rw-r--r-- 0/0 30000 2013-04-03 07:30 system/lib/libmemorydumper.so
drwxr-xr-x 0/0 0 2013-04-03 07:29 system/lib/soundfx/
-rw-r--r-- 0/0 30032 2013-04-03 07:29 system/lib/soundfx/libreverbwrapper.so
-rw-r--r-- 0/0 71836 2013-04-03 07:29 system/lib/soundfx/libbundlewrapper.so
-rw-r--r-- 0/0 5408 2013-04-03 07:29 system/lib/soundfx/libvisualizer.so
-rw-r--r-- 0/0 153012 2013-04-03 07:09 system/lib/libamrenc.so
-rw-r--r-- 0/0 101808 2013-04-03 07:09 system/lib/libdrmmtkutil.so
-rw-r--r-- 0/0 13648 2013-04-03 07:29 system/lib/libthread_db.so
-rw-r--r-- 0/0 368744 2013-04-03 07:30 system/lib/libopencore_common.so
-rw-r--r-- 0/0 18560 2013-04-03 07:09 system/lib/libmtka2dp.so
-rw-r--r-- 0/0 5500 2013-04-03 07:30 system/lib/libmtkhdmi_jni.so
-rw-r--r-- 0/0 18228 2013-04-03 07:30 system/lib/libttssynthproxy.so
-rw-r--r-- 0/0 9904 2013-04-03 07:09 system/lib/libmpodecoder.so
-rw-r--r-- 0/0 5336 2013-04-03 07:29 system/lib/libdeltat.so
drwxr-xr-x 0/0 0 2013-04-03 07:29 system/lib/hw/
-rw-r--r-- 0/0 9772 2013-04-03 07:29 system/lib/hw/lights.default.so
-rw-r--r-- 0/0 14272 2013-04-03 07:29 system/lib/hw/gralloc.default.so
-rw-r--r-- 0/0 10124 2013-04-03 07:29 system/lib/hw/sensors.mt6575.so
-rw-r--r-- 0/0 5208 2013-04-03 07:29 system/lib/hw/gps.default.so
-rw-r--r-- 0/0 67656 2013-04-03 07:32 system/lib/libomx_mp3dec_sharedlibrary.so
-rw-r--r-- 0/0 84008 2013-04-03 07:32 system/lib/libomx_avcdec_sharedlibrary.so
-rw-r--r-- 0/0 18012 2013-04-03 07:09 system/lib/libextsimap_jni.so
-rw-r--r-- 0/0 18016 2013-04-03 07:09 system/lib/libmtkbtextadp.so
-rw-r--r-- 0/0 27052 2013-04-03 07:09 system/lib/libvcodecdrv.so
-rw-r--r-- 0/0 155176 2013-04-03 07:09 system/lib/libbinder.so
-rw-r--r-- 0/0 17664 2013-04-03 07:09 system/lib/libmexif.so
-rw-r--r-- 0/0 34768 2013-04-03 07:09 system/lib/libtinyxml.so
-rw-r--r-- 0/0 5336 2013-04-03 07:09 system/lib/libextsys_jni.so
-rw-r--r-- 0/0 54380 2013-03-08 10:10 system/lib/libblisrc.so
-rw-r--r-- 0/0 17520 2013-04-03 07:09 system/lib/libGLESv2.so
-rw-r--r-- 0/0 9872 2013-04-03 07:30 system/lib/libmpojni.so
-rw-r--r-- 0/0 105440 2013-04-03 07:29 system/lib/libdrmframework.so
-rw-r--r-- 0/0 5248 2013-04-03 07:30 system/lib/libjnigraphics.so
-rw-r--r-- 0/0 5036 2013-03-08 10:10 system/lib/libappc.so
-rw-r--r-- 0/0 277160 2013-04-03 07:29 system/lib/libdbus.so
-rw-r--r-- 0/0 19248 2013-04-03 07:30 system/lib/libfmmt6620.so
-rw-r--r-- 0/0 27688 2013-04-03 07:29 system/lib/libcustom_nvram.so
-rw-r--r-- 0/0 9492 2013-04-03 07:09 system/lib/libmhalutility.so
-rw-r--r-- 0/0 177524 2013-03-08 10:10 system/lib/libawb.so
-rw-r--r-- 0/0 442828 2013-04-03 07:09 system/lib/libmhaldrv.so
-rw-r--r-- 0/0 45112 2013-04-03 07:30 system/lib/libexif.so
-rw-r--r-- 0/0 23680 2013-04-03 07:30 system/lib/libfmmt6626.so
-rw-r--r-- 0/0 37424 2013-04-03 07:09 system/lib/libatvctrlservice.so
-rw-r--r-- 0/0 67848 2013-04-03 07:29 system/lib/libjni_pinyinime.so
-rw-r--r-- 0/0 988760 2013-04-03 07:29 system/lib/libicui18n.so
-rw-r--r-- 0/0 169528 2013-04-03 07:32 system/lib/libmediaplayerservice.so
-rw-r--r-- 0/0 14672 2013-04-03 07:09 system/lib/libextpan_jni.so
-rw-r--r-- 0/0 7860 2013-04-03 07:09 system/lib/libmp4dec_customize.so
-rw-r--r-- 0/0 8152 2013-03-08 10:10 system/lib/libsec.so
-rw-r--r-- 0/0 26092 2013-04-03 07:30 system/lib/libsqlite_jni.so
-rw-r--r-- 0/0 207168 2013-04-03 07:09 system/lib/libMtkOmxAacDec.so
-rw-r--r-- 0/0 35048 2013-04-03 07:29 system/lib/libacc.so
-rw-r--r-- 0/0 89528 2013-04-03 07:09 system/lib/libmtkosal.so
-rw-r--r-- 0/0 724016 2013-04-03 07:09 system/lib/libdvm.so
-rw-r--r-- 0/0 133640 2013-04-03 07:32 system/lib/libomx_amrdec_sharedlibrary.so
-rw-r--r-- 0/0 135060 2013-04-03 07:29 system/lib/libcameracustom.so
-rw-r--r-- 0/0 13684 2013-04-03 07:29 system/lib/libdiskconfig.so
-rw-r--r-- 0/0 183128 2013-04-03 07:29 system/lib/libssl.so
-rw-r--r-- 0/0 9784 2013-04-03 07:29 system/lib/libemoji.so
-rw-r--r-- 0/0 5580 2013-04-03 07:30 system/lib/libtvoutjni.so
-rw-r--r-- 0/0 9760 2013-04-03 07:09 system/lib/libpalwlan_mtk.so
-rw-r--r-- 0/0 26792 2013-04-03 07:30 system/lib/libsoundpool.so
-rw-r--r-- 0/0 13980 2013-04-03 07:09 system/lib/libextopp_jni.so
-rw-r--r-- 0/0 110272 2013-04-03 07:09 system/lib/libextftp.so
-rw-r--r-- 0/0 80352 2013-04-03 07:09 system/lib/libextopp.so
-rw-r--r-- 0/0 9532 2013-04-03 07:09 system/lib/libbtpcm.so
-rw-r--r-- 0/0 18148 2013-04-03 07:30 system/lib/libaudioeffect_jni.so
-rw-r--r-- 0/0 19180 2013-04-03 07:29 system/lib/libbluetoothinit_mtk.so
-rw-r--r-- 0/0 112496 2013-04-03 07:29 system/lib/libvo_aacenc.so
-rw-r--r-- 0/0 5368 2013-04-03 07:09 system/lib/librv9dec_customize.so
-rw-r--r-- 0/0 23664 2013-04-03 07:30 system/lib/libfmmt6616.so
-rw-r--r-- 0/0 30688 2013-04-03 07:09 system/lib/libMtkOmxG711Dec.so
-rw-r--r-- 0/0 9624 2013-04-03 07:29 system/lib/libeffects.so
-rw-r--r-- 0/0 13892 2013-04-03 07:30 system/lib/libdrm1_jni.so
-rw-r--r-- 0/0 22332 2013-04-03 07:09 system/lib/libextftp_jni.so
-rw-r--r-- 0/0 54008 2013-04-03 07:09 system/lib/librilmtk.so
-rw-r--r-- 0/0 46768 2013-04-03 07:09 system/lib/libmtkbtextspp.so
-rw-r--r-- 0/0 1573944 2013-04-03 07:30 system/lib/libstagefright.so
-rw-r--r-- 0/0 9976 2013-04-03 07:09 system/lib/libMtkOmxCore.so
-rw-r--r-- 0/0 5328 2013-04-03 07:30 system/lib/libSR_AudioIn.so
-rw-r--r-- 0/0 58440 2013-03-08 10:10 system/lib/libapedec_mtk.so
-rw-r--r-- 0/0 67888 2013-04-03 07:09 system/lib/libssladp.so
-rw-r--r-- 0/0 113632 2013-04-03 07:31 system/lib/librtp_jni.so
-rw-r--r-- 0/0 13960 2013-04-03 07:29 system/lib/libstagefright_pmemutil.so
-rw-r--r-- 0/0 49896 2013-04-03 07:09 system/lib/libMtkOmxVenc.so
-rw-r--r-- 0/0 24208 2013-04-03 07:09 system/lib/libextbpp.so
-rw-r--r-- 0/0 17880 2013-04-03 07:30 system/lib/libstagefright_color_conversion.so
-rw-r--r-- 0/0 21696 2013-04-03 07:29 system/lib/libstagefright_avc_common.so
-rw-r--r-- 0/0 5468 2013-04-03 07:30 system/lib/libem_jni.so
-rw-r--r-- 0/0 23112 2013-04-03 07:09 system/lib/libvcodec_utility.so
-rw-r--r-- 0/0 47840 2013-04-03 07:09 system/lib/libextavrcp_jni.so
-rw-r--r-- 0/0 38480 2013-04-03 07:09 system/lib/libfile_op.so
-rw-r--r-- 0/0 5336 2013-04-03 07:29 system/lib/libfmcust.so
-rw-r--r-- 0/0 22408 2013-04-03 07:32 system/lib/libomx_wmvdec_sharedlibrary.so
-rw-r--r-- 0/0 189784 2013-04-03 07:30 system/lib/libnativehelper.so
-rw-r--r-- 0/0 340032 2013-04-03 07:29 system/lib/libxml2.so
-rw-r--r-- 0/0 38416 2013-04-03 07:09 system/lib/libnvram.so
-rw-r--r-- 0/0 103688 2013-03-08 10:10 system/lib/libbessound_mtk.so
-rw-r--r-- 0/0 132988 2013-04-03 07:09 system/lib/libmp4dec_ca9_lib.so
-rw-r--r-- 0/0 5304 2013-04-03 07:29 system/lib/libnfc_ndef.so
-rw-r--r-- 0/0 17892 2013-04-03 07:09 system/lib/liblog.so
-rw-r--r-- 0/0 4569304 2013-04-03 07:32 system/lib/libwebcore.so
-rw-r--r-- 0/0 166360 2013-04-03 07:30 system/lib/libRS.so
-rw-r--r-- 0/0 19104 2013-04-03 07:30 system/lib/libfmar1000.so
-rw-r--r-- 0/0 23944 2013-04-03 07:29 system/lib/libiprouteutil.so
-rw-r--r-- 0/0 5256 2013-04-03 07:09 system/lib/libh264dec_customize.so
-rw-r--r-- 0/0 60608 2013-04-03 07:33 system/lib/libemwifi_jni.so
-rw-r--r-- 0/0 43288 2013-04-03 07:30 system/lib/libskiagl.so
-rw-r--r-- 0/0 1346884 2013-04-03 07:09 system/lib/libcamalgo.so
-rw-r--r-- 0/0 9408 2013-04-03 07:09 system/lib/libETC1.so
-rw-r--r-- 0/0 27312 2013-03-08 10:10 system/lib/libaed.so
-rw-r--r-- 0/0 61624 2013-04-03 07:34 system/lib/libandroid_servers.so
-rw-r--r-- 0/0 71496 2013-04-03 07:09 system/lib/libmp3dec_mtk.so
-rw-r--r-- 0/0 9612 2013-04-03 07:09 system/lib/libpppbtdun.so
-rw-r--r-- 0/0 13900 2013-04-03 07:09 system/lib/libextpbap_jni.so
-rw-r--r-- 0/0 21616 2013-04-03 07:09 system/lib/libGLESv1_CM.so
-rw-r--r-- 0/0 9564 2013-04-03 07:29 system/lib/libem_gpio_jni.so
-rw-r--r-- 0/0 816152 2013-04-03 07:29 system/lib/libicuuc.so
-rw-r--r-- 0/0 69792 2013-04-03 07:31 system/lib/libOpenSLES.so
-rw-r--r-- 0/0 30704 2013-04-03 07:09 system/lib/libMtkOmxMp3Dec.so
-rw-r--r-- 0/0 9756 2013-04-03 07:09 system/lib/libmpoencoder.so
-rw-r--r-- 0/0 286296 2013-04-03 07:29 system/lib/libc.so
-rw-r--r-- 0/0 38152 2013-04-03 07:09 system/lib/libpalsecurity.so
-rw-r--r-- 0/0 9660 2013-04-03 07:09 system/lib/libJniVideoSurface.so
-rw-r--r-- 0/0 5440 2013-04-03 07:09 system/lib/libmhalcontent.so
-rw-r--r-- 0/0 224408 2013-04-03 07:29 system/lib/libttspico.so
-rw-r--r-- 0/0 9512 2013-04-03 07:29 system/lib/libbluetoothem_mtk.so
drwxr-xr-x 0/0 0 2013-04-03 07:09 system/lib/egl/
-rw-r--r-- 0/0 20 2013-04-03 07:09 system/lib/egl/egl.cfg
-rw-r--r-- 0/0 118248 2013-04-03 07:09 system/lib/egl/libGLES_android.so
-rw-r--r-- 0/0 235616 2013-04-03 07:29 system/lib/libstlport.so
-rw-r--r-- 0/0 34816 2013-04-03 07:09 system/lib/libMtkOmxApeDec.so
-rw-r--r-- 0/0 65680 2013-04-03 07:09 system/lib/libmtk_telephony_log.so
-rw-r--r-- 0/0 38176 2013-04-03 07:30 system/lib/libfmjni.so
-rw-r--r-- 0/0 194232 2013-04-03 07:30 system/lib/libFFTEm.so
-rw-r--r-- 0/0 56224 2013-04-03 07:09 system/lib/libmtkbtextadpa2dp.so
-rw-r--r-- 0/0 18012 2013-04-03 07:09 system/lib/libextdun_jni.so
-rw-r--r-- 0/0 879532 2013-04-03 07:09 system/lib/librv9dec_ca9.so
-rw-r--r-- 0/0 5404 2013-04-03 07:29 system/lib/libhandwriting_engine.so
-rw-r--r-- 0/0 40684 2013-04-03 07:09 system/lib/libmpo.so
-rw-r--r-- 0/0 21956 2013-04-03 07:29 system/lib/libnetutils.so
-rw-r--r-- 0/0 151952 2013-04-03 07:09 system/lib/libmhalscenario.so
-rw-r--r-- 0/0 23808 2013-04-03 07:09 system/lib/libJniAtvService.so
-rw-r--r-- 0/0 182952 2013-04-03 07:32 system/lib/libomx_m4venc_sharedlibrary.so
-rw-r--r-- 0/0 53160 2013-04-03 07:09 system/lib/libEGL.so
-rw-r--r-- 0/0 48472 2013-04-03 07:30 system/lib/libgui.so
-rw-r--r-- 0/0 5360 2013-04-03 07:29 system/lib/libctest.so
-rw-r--r-- 0/0 23560 2013-04-03 07:30 system/lib/librs_jni.so
-rw-r--r-- 0/0 30696 2013-04-03 07:09 system/lib/libMtkOmxCookDec.so
-rw-r--r-- 0/0 10176 2013-04-03 07:09 system/lib/libmtkbtextpan.so
-rw-r--r-- 0/0 30720 2013-04-03 07:09 system/lib/libMtkOmxVorbisDec.so
-rw-r--r-- 0/0 5224 2013-04-03 07:30 system/lib/libtvoutpattern.so
-rw-r--r-- 0/0 334408 2013-04-03 07:29 system/lib/libsqlite.so
-rw-r--r-- 0/0 359800 2013-04-03 07:30 system/lib/libsrec_jni.so
-rw-r--r-- 0/0 5272 2013-04-03 07:30 system/lib/libaudiosetting.so
-rw-r--r-- 0/0 231184 2013-04-03 07:09 system/lib/libmtkse.so
-rw-r--r-- 0/0 1156024 2013-04-03 07:30 system/lib/libskia.so
-rw-r--r-- 0/0 33200 2013-04-03 07:29 system/lib/libinput_engine.so
-rw-r--r-- 0/0 90328 2013-04-03 07:30 system/lib/libcamera_client.so
drwxr-xr-x 0/2000 0 2013-04-03 07:30 system/xbin/
-rwxr-xr-x 0/2000 60276 2013-04-03 07:29 system/xbin/dexdump
-rwsr-sr-x 0/0 9820 2013-04-03 07:30 system/xbin/su
-rwxr-xr-x 0/2000 31508 2013-04-03 07:29 system/xbin/iwlist
-rwxr-xr-x 0/2000 17924 2013-04-03 07:29 system/xbin/iwspy
-rwxr-xr-x 0/2000 31176 2013-04-03 07:29 system/xbin/iwconfig
-rwxr-xr-x 0/2000 18024 2013-04-03 07:29 system/xbin/iwpriv
-rwxr-xr-x 0/2000 18360 2013-04-03 07:29 system/xbin/iwevent
-rwxr-xr-x 0/0 617348 2013-04-03 07:29 system/xbin/tcpdump
-rwxr-xr-x 0/2000 14280 2013-04-03 07:29 system/xbin/iwgetid
-rw-r--r-- 0/0 3834 2013-04-03 07:23 system/build.prop
drwxr-xr-x 0/0 0 2012-06-01 21:52 system/secro/
drwx------ 0/0 0 2012-06-01 21:52 system/secro/lost+found/
drwx------ 0/0 0 2012-06-01 21:52 system/lost+found/
drwxr-xr-x 0/0 0 2013-04-03 07:35 system/framework/
-rw-r--r-- 0/0 59880 2013-04-03 07:35 system/framework/com.mediatek.framework.odex
-rw-r--r-- 0/0 313 2013-04-03 07:26 system/framework/ext.jar
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/bmgr.jar
-rw-r--r-- 0/0 299816 2013-04-03 07:33 system/framework/android.policy.odex
-rw-r--r-- 0/0 158075 2013-04-03 07:09 system/framework/com.google.android.maps.jar
-rw-r--r-- 0/0 313 2013-04-03 07:35 system/framework/services.jar
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/android.policy.jar
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/am.jar
-rw-r--r-- 0/0 60552 2013-04-03 07:35 system/framework/javax.obex.odex
-rw-r--r-- 0/0 147608 2013-04-03 07:35 system/framework/sqlite-jdbc.odex
-rw-r--r-- 0/0 7840 2013-04-03 07:35 system/framework/DMAgent.odex
-rw-r--r-- 0/0 313 2013-04-03 07:26 system/framework/bouncycastle.jar
-rw-r--r-- 0/0 13736 2013-04-03 07:35 system/framework/bmgr.odex
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/DMAgent.jar
-rw-r--r-- 0/0 22512 2013-04-03 07:35 system/framework/wbxml.odex
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/wbxml.jar
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/input.jar
-rw-r--r-- 0/0 10215864 2013-04-03 07:31 system/framework/framework.odex
-rw-r--r-- 0/0 313 2013-04-03 07:26 system/framework/core-junit.jar
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/javax.obex.jar
-rw-r--r-- 0/0 28144 2013-04-03 07:35 system/framework/am.odex
-rw-r--r-- 0/0 6741 2013-04-03 07:09 system/framework/wappush.jar
-rw-r--r-- 0/0 7847171 2013-04-03 07:26 system/framework/framework-res.apk
-rw-r--r-- 0/0 1392664 2013-04-03 07:29 system/framework/ext.odex
-rw-r--r-- 0/0 194096 2013-04-03 07:35 system/framework/android.test.runner.odex
-rw-r--r-- 0/0 89576 2013-04-03 07:35 system/framework/monkey.odex
-rw-r--r-- 0/0 8352 2013-04-03 07:35 system/framework/svc.odex
-rw-r--r-- 0/0 778712 2013-04-03 07:29 system/framework/bouncycastle.odex
-rw-r--r-- 0/0 313 2013-04-03 07:35 system/framework/mtklockscreen.jar
-rw-r--r-- 0/0 23968 2013-04-03 07:35 system/framework/core-junit.odex
-rw-r--r-- 0/0 313 2013-04-03 07:35 system/framework/emwireless_lib.jar
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/monkey.jar
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/ime.jar
-rw-r--r-- 0/0 1830520 2013-04-03 07:35 system/framework/services.odex
-rw-r--r-- 0/0 30525 2013-04-03 07:09 system/framework/com.android.location.provider.jar
-rw-r--r-- 0/0 130880 2013-04-03 07:35 system/framework/mtklockscreen.odex
-rw-r--r-- 0/0 6672 2013-04-03 07:35 system/framework/ime.odex
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/svc.jar
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/com.mediatek.framework.jar
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/pm.jar
-rw-r--r-- 0/0 12413 2013-04-03 07:31 system/framework/framework.jar
-rw-r--r-- 0/0 28368 2013-04-03 07:35 system/framework/pm.odex
-rw-r--r-- 0/0 313 2013-04-03 07:33 system/framework/android.test.runner.jar
-rw-r--r-- 0/0 4656 2013-04-03 07:35 system/framework/emwireless_lib.odex
-rw-r--r-- 0/0 1815772 2013-04-03 07:26 system/framework/mtkBase-res.apk
-rw-r--r-- 0/0 22909 2013-04-03 07:26 system/framework/core.jar
-rw-r--r-- 0/0 4803280 2013-04-03 07:29 system/framework/core.odex
-rw-r--r-- 0/0 313 2013-04-03 07:29 system/framework/sqlite-jdbc.jar
-rw-r--r-- 0/0 4360 2013-04-03 07:35 system/framework/input.odex
drwxr-xr-x 0/0 0 2013-04-03 07:36 system/app/
-rw-r--r-- 0/0 14984 2013-04-03 07:35 system/app/TtsService.apk
-rw-r--r-- 0/0 258274 2013-04-03 07:35 system/app/QuickSearchBox.apk
-rw-r--r-- 0/0 8128 2013-04-03 07:35 system/app/MTKAndroidSuiteDaemon.apk
-rw-r--r-- 0/0 22640 2013-04-03 07:35 system/app/CalendarImporter.apk
-rw-r--r-- 0/0 918792 2013-04-03 07:35 system/app/DownloadProvider.odex
-rw-r--r-- 0/0 301944 2013-04-03 07:36 system/app/SystemUISamsungStyle1.odex
-rw-r--r-- 0/0 1210768 2013-04-03 07:35 system/app/MmsSamsung.odex
-rw-r--r-- 0/0 657545 2013-04-03 07:35 system/app/Music.apk
-rw-r--r-- 0/0 2807062 2013-04-03 07:36 system/app/Phone.apk
-rw-r--r-- 0/0 477736 2013-04-03 07:35 system/app/ContactsProvider.odex
-rw-r--r-- 0/0 949871 2013-04-03 07:35 system/app/Calculator3.apk
-rw-r--r-- 0/0 51880 2013-04-03 07:35 system/app/SoundRecorder.odex
-rw-r--r-- 0/0 199448 2013-04-03 07:35 system/app/TelephonyProvider.odex
-rw-r--r-- 0/0 16416 2013-04-03 07:35 system/app/PicoTts.odex
-rw-r--r-- 0/0 61800 2013-04-03 07:35 system/app/CellConnService.odex
-rw-r--r-- 0/0 64777 2013-04-03 07:35 system/app/PermissionGrant.apk
-rw-r--r-- 0/0 99456 2013-04-03 07:35 system/app/EngineerModeSim.odex
-rw-r--r-- 0/0 577288 2013-04-03 07:35 system/app/Browser.odex
-rw-r--r-- 0/0 623008 2013-04-03 07:35 system/app/Gallery3D.odex
-rw-r--r-- 0/0 33056 2013-04-03 07:35 system/app/DrmProvider.odex
-rw-r--r-- 0/0 61928 2013-04-03 07:35 system/app/SettingsProvider.odex
-rw-r--r-- 0/0 614056 2013-04-03 07:35 system/app/CameraOpen.odex
-rw-r--r-- 0/0 105592 2013-04-03 07:35 system/app/CalendarImporter.odex
-rw-r--r-- 0/0 71317 2013-04-03 07:35 system/app/Stk2.apk
-rw-r--r-- 0/0 70936 2013-04-03 07:35 system/app/DownloadProvider.apk
-rw-r--r-- 0/0 4458063 2013-04-03 07:36 system/app/Settings.apk
-rw-r--r-- 0/0 164168 2013-04-03 07:35 system/app/Omacp.odex
-rw-r--r-- 0/0 16007 2013-04-03 07:19 system/app/ActivityNetwork.apk
-rw-r--r-- 0/0 132592 2013-04-03 07:35 system/app/FactoryMode.odex
-rw-r--r-- 0/0 18664 2013-04-03 07:35 system/app/GCalib.odex
-rw-r--r-- 0/0 99144 2013-04-03 07:35 system/app/Stk1.odex
-rw-r--r-- 0/0 594608 2013-04-03 07:35 system/app/MtkBt.apk
-rw-r--r-- 0/0 2248063 2013-04-03 07:19 system/app/Gmail.apk
-rw-r--r-- 0/0 28961 2013-04-03 07:35 system/app/EngineerModeSim.apk
-rw-r--r-- 0/0 40096 2013-04-03 07:35 system/app/CertInstaller.odex
-rw-r--r-- 0/0 43672 2013-04-03 07:35 system/app/MtkLiveWallpapers.odex
-rw-r--r-- 0/0 3906918 2013-04-03 07:35 system/app/LauncherICS.apk
-rw-r--r-- 0/0 14067 2013-04-03 07:35 system/app/TelephonyProvider.apk
-rw-r--r-- 0/0 140028 2013-04-03 07:35 system/app/Bluetooth.apk
-rw-r--r-- 0/0 16016 2013-04-03 07:35 system/app/DefaultContainerService.odex
-rw-r--r-- 0/0 31208 2013-04-03 07:35 system/app/PackageInstaller.odex
-rw-r--r-- 0/0 61599 2013-04-03 07:35 system/app/PackageInstaller.apk
-rw-r--r-- 0/0 385072 2013-04-03 07:35 system/app/Calendar.odex
-rw-r--r-- 0/0 669520 2013-04-03 07:35 system/app/EngineerMode.odex
-rw-r--r-- 0/0 140672 2013-04-03 07:35 system/app/Calculator3.odex
-rw-r--r-- 0/0 200536 2013-04-03 07:35 system/app/Bluetooth.odex
-rw-r--r-- 0/0 1255800 2013-04-03 07:19 system/app/TinyFlashlight.apk
-rw-r--r-- 0/0 1088912 2013-04-03 07:35 system/app/MtkBt.odex
-rw-r--r-- 0/0 74232 2013-04-03 07:35 system/app/LiveWallpapers_gles20.odex
-rw-r--r-- 0/0 7928 2013-04-03 07:35 system/app/HTMLViewer.odex
-rw-r--r-- 0/0 264560 2013-04-03 07:36 system/app/SamsungDeskclock.odex
-rw-r--r-- 0/0 38336 2013-04-03 07:35 system/app/VisualizationWallpapers_gles20.odex
-rw-r--r-- 0/0 1051064 2013-04-03 07:35 system/app/QuickSearchBox.odex
-rw-r--r-- 0/0 114236 2013-04-03 07:35 system/app/Protips.apk
-rw-r--r-- 0/0 117656 2013-04-03 07:19 system/app/GoogleCalendarSyncAdapter.apk
-rw-r--r-- 0/0 22232 2013-04-03 07:35 system/app/ApplicationsProvider.odex
-rw-r--r-- 0/0 139893 2013-04-03 07:35 system/app/VisualizationWallpapers_gles20.apk
-rw-r--r-- 0/0 239773 2013-04-03 07:35 system/app/FileManager.apk
-rw-r--r-- 0/0 3002748 2013-04-03 07:36 system/app/LatinIME.apk
-rw-r--r-- 0/0 50859 2013-04-03 07:19 system/app/MobileLog.apk
-rw-r--r-- 0/0 71190 2013-04-03 07:35 system/app/Stk1.apk
-rw-r--r-- 0/0 127726 2013-04-03 07:19 system/app/GoogleContactsSyncAdapter.apk
-rw-r--r-- 0/0 295359 2013-04-03 07:35 system/app/Calendar.apk
-rw-r--r-- 0/0 121470 2013-04-03 07:19 system/app/GoogleFeedback.apk
-rw-r--r-- 0/0 125442 2013-04-03 07:19 system/app/GetJar.apk
-rw-r--r-- 0/0 118320 2013-04-03 07:35 system/app/VideoPlayer.odex
-rw-r--r-- 0/0 9635 2013-04-03 07:35 system/app/ApplicationsProvider.apk
-rw-r--r-- 0/0 11920 2013-04-03 07:35 system/app/DesktopClock.odex
-rw-r--r-- 0/0 2779 2013-04-03 07:35 system/app/Provision.apk
-rw-r--r-- 0/0 624224 2013-04-03 07:35 system/app/LauncherICS.odex
-rw-r--r-- 0/0 930976 2013-04-03 07:35 system/app/CalendarProvider.odex
-rw-r--r-- 0/0 3063495 2013-04-03 07:35 system/app/FactoryMode.apk
-rw-r--r-- 0/0 328016 2013-04-03 07:36 system/app/LatinIME.odex
-rw-r--r-- 0/0 25104 2013-04-03 07:35 system/app/MagicSmokeWallpapers_gles20.odex
-rw-r--r-- 0/0 3558 2013-04-03 07:35 system/app/UserDictionaryProvider.apk
-rw-r--r-- 0/0 99868 2013-04-03 07:35 system/app/DesktopClock.apk
-rw-r--r-- 0/0 19259 2013-04-03 07:35 system/app/StkSelection.apk
-rw-r--r-- 0/0 39750 2013-04-03 07:35 system/app/CellConnService.apk
-rw-r--r-- 0/0 118326 2013-04-03 07:35 system/app/SoundRecorder.apk
-rw-r--r-- 0/0 22949 2013-04-03 07:35 system/app/SettingsProvider.apk
-rw-r--r-- 0/0 35824 2013-04-03 07:35 system/app/CertInstaller.apk
-rw-r--r-- 0/0 9157 2013-04-03 07:19 system/app/MediaTekLocationProvider.apk
-rw-r--r-- 0/0 53318 2013-04-03 07:35 system/app/CalendarProvider.apk
-rw-r--r-- 0/0 1668309 2013-04-03 07:35 system/app/MtkLiveWallpapers.apk
-rw-r--r-- 0/0 373297 2013-04-03 07:35 system/app/MagicSmokeWallpapers_gles20.apk
-rw-r--r-- 0/0 1521744 2013-04-03 07:35 system/app/Email.odex
-rw-r--r-- 0/0 3267784 2013-04-03 07:36 system/app/ContactsSamsungG3.odex
-rw-r--r-- 0/0 592037 2013-04-03 07:35 system/app/Email.apk
-rw-r--r-- 0/0 37496 2013-04-03 07:35 system/app/TtsService.odex
-rw-r--r-- 0/0 132112 2013-04-03 07:35 system/app/AccountAndSyncSettings.apk
-rw-r--r-- 0/0 10552 2013-04-03 07:35 system/app/Protips.odex
-rw-r--r-- 0/0 2077393 2013-04-03 07:35 system/app/LiveWallpapers_gles20.apk
-rw-r--r-- 0/0 3272310 2013-04-03 07:35 system/app/GCalib.apk
-rw-r--r-- 0/0 5382 2013-04-03 07:35 system/app/DefaultContainerService.apk
-rw-r--r-- 0/0 22464 2013-04-03 07:35 system/app/LiveWallpapersPicker_gles20.odex
-rw-r--r-- 0/0 7938 2013-04-03 07:35 system/app/VpnServices.apk
-rw-r--r-- 0/0 566496 2013-04-03 07:35 system/app/MTKAndroidSuiteDaemon.odex
-rw-r--r-- 0/0 29072 2013-04-03 07:35 system/app/PermissionGrant.odex
-rw-r--r-- 0/0 55232 2013-04-03 07:35 system/app/MtkWallPaper.odex
-rw-r--r-- 0/0 131344 2013-04-03 07:35 system/app/MediaProvider.odex
-rw-r--r-- 0/0 432779 2013-04-03 07:35 system/app/Gallery3D.apk
-rw-r--r-- 0/0 928698 2013-04-03 07:35 system/app/Browser.apk
-rw-r--r-- 0/0 33469 2013-04-03 07:35 system/app/LiveWallpapersPicker_gles20.apk
-rw-r--r-- 0/0 1629934 2013-04-03 07:36 system/app/SamsungDeskclock.apk
-rw-r--r-- 0/0 46232 2013-04-03 07:35 system/app/AccountAndSyncSettings.odex
-rw-r--r-- 0/0 2988920 2013-04-03 07:36 system/app/ContactsSamsungG3.apk
-rw-r--r-- 0/0 14701122 2013-04-03 07:19 system/app/Facebook.apk
-rw-r--r-- 0/0 60784 2013-04-03 07:35 system/app/DownloadProviderUi.odex
-rw-r--r-- 0/0 3272640 2013-04-03 07:36 system/app/Phone.odex
-rw-r--r-- 0/0 189613 2013-04-03 07:35 system/app/EngineerMode.apk
-rw-r--r-- 0/0 1928 2013-04-03 07:35 system/app/Provision.odex
-rw-r--r-- 0/0 130336 2013-04-03 07:35 system/app/FileManager.odex
-rw-r--r-- 0/0 80092 2013-04-03 07:35 system/app/Omacp.apk
-rw-r--r-- 0/0 238384 2013-04-03 07:35 system/app/FMRadio.odex
-rw-r--r-- 0/0 8411 2013-04-03 07:35 system/app/HTMLViewer.apk
-rw-r--r-- 0/0 1423912 2013-04-03 07:36 system/app/Settings.odex
-rw-r--r-- 0/0 79475 2013-04-03 07:35 system/app/DownloadProviderUi.apk
-rw-r--r-- 0/0 19730 2013-04-03 07:35 system/app/MediaProvider.apk
-rw-r--r-- 0/0 32608 2013-04-03 07:35 system/app/VpnServices.odex
-rw-r--r-- 0/0 119137 2013-04-03 07:35 system/app/VideoPlayer.apk
-rw-r--r-- 0/0 98464 2013-04-03 07:35 system/app/Stk2.odex
-rw-r--r-- 0/0 1077730 2013-04-03 07:35 system/app/MmsSamsung.apk
-rw-r--r-- 0/0 12114 2013-04-03 07:35 system/app/PicoTts.apk
-rw-r--r-- 0/0 7481376 2013-04-03 07:35 system/app/MtkWallPaper.apk
-rw-r--r-- 0/0 12056 2013-04-03 07:35 system/app/DrmProvider.apk
-rw-r--r-- 0/0 1116792 2013-04-03 07:36 system/app/SystemUISamsungStyle1.apk
-rw-r--r-- 0/0 375136 2013-04-03 07:35 system/app/Music.odex
-rw-r--r-- 0/0 30632 2013-04-03 07:35 system/app/StkSelection.odex
-rw-r--r-- 0/0 37927 2013-04-03 07:19 system/app/GoogleBackupTransport.apk
-rw-r--r-- 0/0 2238742 2013-04-03 07:19 system/app/GoogleServicesFramework.apk
-rw-r--r-- 0/0 5617931 2013-04-03 07:19 system/app/PlayStore.apk
-rw-r--r-- 0/0 50920 2013-04-03 07:35 system/app/ContactsProvider.apk
-rw-r--r-- 0/0 229130 2013-04-03 07:35 system/app/FMRadio.apk
-rw-r--r-- 0/0 16224 2013-04-03 07:35 system/app/UserDictionaryProvider.odex
-rw-r--r-- 0/0 958937 2013-04-03 07:35 system/app/CameraOpen.apk
drwxr-xr-x 0/0 0 2012-06-01 21:52 sys/
drwxr-x--- 0/0 0 1970-01-01 01:00 sbin/
lrwxrwxrwx 0/0 0 1970-01-01 01:00 sbin/ueventd -> ../init
-rwxr-x--- 0/0 187268 1970-01-01 01:00 sbin/tune2fs
-rwxr-x--- 0/0 18128 1970-01-01 01:00 sbin/meta_tst
-rwxr-x--- 0/0 98396 1970-01-01 01:00 sbin/meta_init
-rwxr-x--- 0/0 279580 1970-01-01 01:00 sbin/e2fsck
-rwxr-x--- 0/0 98396 1970-01-01 01:00 sbin/advanced_meta_init
-rwxr-x--- 0/0 117996 1970-01-01 01:00 sbin/adbd
lrwxrwxrwx 0/0 0 1970-01-01 01:00 res -> /system/res
dr-xr-xr-x 0/0 0 1970-01-01 01:00 proc/
-rw-r--r-- 0/0 7451 1970-01-01 01:00 meta_init.rc
-rwxr-x--- 0/0 27852 1970-01-01 01:00 init.rc
-rwxr-x--- 0/0 1677 1970-01-01 01:00 init.goldfish.rc
-rwxr-x--- 0/0 12110 1970-01-01 01:00 init.factory.rc
-rwxr-x--- 0/0 134 1970-01-01 01:00 init.aee.customer.rc
-rwxr-x--- 0/0 98396 1970-01-01 01:00 init
-rw-r--r-- 0/0 141 1970-01-01 01:00 default.prop
drwxrwx--x 1000/1000 0 2012-06-01 22:14 data/
-rw-rw-rw- 0/0 7 2012-06-01 22:19 data/exclude_from_tarball
-rw-rw-rw- 0/0 9728 2012-06-01 22:06 data/cache.tar
-rwxr-xr-x 0/0 1926944 2012-06-01 21:54 data/busybox
-rw------- 1000/1000 4194304 2012-06-01 21:52 data/piggybank
drwx------ 1000/1000 0 2012-06-01 01:13 data/secure/
drwxrwxr-x 1000/1000 0 2012-06-01 01:13 data/secure/system/
drwx------ 0/0 0 2012-06-01 21:56 data/dropbear/
-rwxr-xr-x 0/0 907007 2012-06-01 17:37 data/dropbear/dropbear
drwx------ 0/0 0 2012-06-01 18:37 data/dropbear/.ssh/
-rw------- 0/0 312 2012-06-01 18:39 data/dropbear/.ssh/authorized_keys
-rw------- 0/0 425 2012-06-01 17:54 data/dropbear/dropbear_rsa_host_key
-rwxr-xr-x 0/0 743769 2012-06-01 17:53 data/dropbear/dropbearkey
-rwxr-xr-x 0/0 738452 2012-06-01 18:40 data/dropbear/dropbearconvert
drwxrwxr-x 1000/1000 0 2012-06-01 22:22 data/system/
-rw------- 1000/1000 31948 2012-06-01 22:22 data/system/batterystats.bin
-rw-rw-r-- 1000/1000 3924 2012-06-01 21:52 data/system/packages.list
-rw-rw-r-- 1000/1000 83768 2012-06-01 21:52 data/system/packages.xml
-rw------- 1000/1000 153 2012-06-01 21:52 data/system/wallpaper_info.xml
-rw------- 1000/1000 227 2012-06-01 20:34 data/system/appwidgets.xml
-rwxrwxr-- 1000/1000 57 2012-06-01 01:13 data/system/uiderrors.txt
drwx------ 1000/1000 0 2012-06-01 21:41 data/system/usagestats/
-rw------- 1000/1000 576 2014-07-20 10:30 data/system/usagestats/usage-20140720
-rw------- 1000/1000 1320 2014-07-16 00:28 data/system/usagestats/usage-20140715
-rw------- 1000/1000 416 2014-07-20 08:50 data/system/usagestats/usage-20140719
-rw------- 1000/1000 3812 2012-06-01 21:41 data/system/usagestats/usage-20120601
-rw------- 1000/1000 1144 2014-07-14 00:02 data/system/usagestats/usage-20140713
-rw------- 1000/1000 0 2014-07-09 00:27 data/system/usagestats/usage-20140708
-rw------- 1000/1000 4096 2012-06-01 21:52 data/system/entropy.dat
drwx------ 1000/1000 0 2012-06-01 01:13 data/system/throttle/
-rw------- 1000/1000 57 2012-06-01 22:33 data/system/throttle/temp
-rw------- 1000/1000 291 2012-06-01 01:13 data/system/called_pre_boots.dat
drwx------ 1000/1000 0 2012-06-01 22:22 data/system/dropbox/
-rw------- 1000/1000 39 2012-06-01 22:22 data/system/dropbox/event_data@1338585758733.txt
-rw------- 1000/1000 63 2012-06-01 21:52 data/system/dropbox/event_data@1338583958645.txt
-rw------- 1000/1000 84 2012-06-01 21:52 data/system/dropbox/event_log@1338583958640.txt
-rw------- 1000/1000 248 2012-06-01 21:52 data/system/dropbox/SYSTEM_BOOT@1338583956161.txt
-rw------- 1000/1000 39 2012-06-17 15:42 data/system/dropbox/event_data@1338508840059.txt
-rw------- 1000/1000 39 2012-06-16 17:42 data/system/dropbox/event_data@1338508840015.txt
-rw------- 1000/1000 39 2012-06-16 13:42 data/system/dropbox/event_data@1338508840007.txt
-rw------- 1000/1000 39 2012-06-01 04:21 data/system/dropbox/event_data@1338520861377.txt
-rw------- 1000/1000 63 2012-06-01 02:21 data/system/dropbox/event_data@1338513661156.txt
-rw------- 1000/1000 84 2012-06-01 02:21 data/system/dropbox/event_log@1338513661112.txt
-rw------- 1000/1000 39 2012-06-16 03:42 data/system/dropbox/event_data@1338508839987.txt
-rw------- 1000/1000 39 2012-06-16 08:42 data/system/dropbox/event_data@1338508839997.txt
-rw------- 1000/1000 39 2012-06-16 21:42 data/system/dropbox/event_data@1338508840023.txt
-rw------- 1000/1000 39 2012-06-17 11:42 data/system/dropbox/event_data@1338508840051.txt
-rw------- 1000/1000 39 2012-06-17 15:12 data/system/dropbox/event_data@1338508840058.txt
-rw------- 1000/1000 39 2012-06-17 02:12 data/system/dropbox/event_data@1338508840032.txt
-rw------- 1000/1000 39 2012-06-17 19:42 data/system/dropbox/event_data@1338508840067.txt
-rw------- 1000/1000 39 2012-06-18 01:42 data/system/dropbox/event_data@1338508840079.txt
-rw------- 1000/1000 39 2012-06-16 17:12 data/system/dropbox/event_data@1338508840014.txt
-rw------- 1000/1000 63 2012-06-18 21:29 data/system/dropbox/event_data@1338508840082.txt
-rw------- 1000/1000 39 2012-06-18 00:42 data/system/dropbox/event_data@1338508840077.txt
-rw------- 1000/1000 84 2012-06-18 21:29 data/system/dropbox/event_log@1338508840081.txt
-rw------- 1000/1000 39 2012-06-16 08:12 data/system/dropbox/event_data@1338508839996.txt
-rw------- 1000/1000 39 2012-06-01 19:51 data/system/dropbox/event_data@1338576663283.txt
-rw------- 1000/1000 39 2012-06-01 15:21 data/system/dropbox/event_data@1338560462374.txt
-rw------- 1000/1000 39 2012-06-01 07:21 data/system/dropbox/event_data@1338531661655.txt
-rw------- 1000/1000 39 2012-06-17 06:42 data/system/dropbox/event_data@1338508840041.txt
-rw------- 1000/1000 39 2012-06-17 14:42 data/system/dropbox/event_data@1338508840057.txt
-rw------- 1000/1000 39 2012-06-16 21:12 data/system/dropbox/event_data@1338508840022.txt
-rw------- 1000/1000 39 2012-06-17 01:42 data/system/dropbox/event_data@1338508840031.txt
-rw------- 1000/1000 39 2012-06-01 10:21 data/system/dropbox/event_data@1338542461910.txt
-rw------- 1000/1000 39 2012-06-17 19:12 data/system/dropbox/event_data@1338508840066.txt
-rw------- 1000/1000 39 2012-06-18 00:12 data/system/dropbox/event_data@1338508840076.txt
-rw------- 1000/1000 39 2012-06-16 03:12 data/system/dropbox/event_data@1338508839986.txt
-rw------- 1000/1000 39 2012-06-16 13:12 data/system/dropbox/event_data@1338508840006.txt
-rw------- 1000/1000 39 2012-06-16 07:42 data/system/dropbox/event_data@1338508839995.txt
-rw------- 1000/1000 39 2012-06-01 03:51 data/system/dropbox/event_data@1338519061341.txt
-rw------- 1000/1000 63 2012-06-01 02:51 data/system/dropbox/event_data@1338515461261.txt
-rw------- 1000/1000 39 2012-06-17 14:12 data/system/dropbox/event_data@1338508840056.txt
-rw------- 1000/1000 84 2012-06-01 02:51 data/system/dropbox/event_log@1338515461258.txt
-rw------- 1000/1000 39 2012-06-16 02:42 data/system/dropbox/event_data@1338508839985.txt
-rw------- 1000/1000 39 2012-06-17 06:12 data/system/dropbox/event_data@1338508840040.txt
-rw------- 1000/1000 248 2012-06-01 02:20 data/system/dropbox/SYSTEM_BOOT@1338513656319.txt
-rw------- 1000/1000 39 2012-06-17 01:12 data/system/dropbox/event_data@1338508840030.txt
-rw------- 1000/1000 248 2012-06-18 21:29 data/system/dropbox/SYSTEM_BOOT@1338508840080.txt
-rw------- 1000/1000 39 2012-06-16 12:42 data/system/dropbox/event_data@1338508840005.txt
-rw------- 1000/1000 39 2012-06-17 11:12 data/system/dropbox/event_data@1338508840050.txt
-rw------- 1000/1000 39 2012-06-17 18:42 data/system/dropbox/event_data@1338508840065.txt
-rw------- 1000/1000 39 2012-06-17 23:42 data/system/dropbox/event_data@1338508840075.txt
-rw------- 1000/1000 39 2012-06-16 16:42 data/system/dropbox/event_data@1338508840013.txt
-rw------- 1000/1000 63 2012-06-01 20:51 data/system/dropbox/event_data@1338580263410.txt
-rw------- 1000/1000 39 2012-06-16 07:12 data/system/dropbox/event_data@1338508839994.txt
-rw------- 1000/1000 84 2012-06-01 20:51 data/system/dropbox/event_log@1338580263406.txt
-rw------- 1000/1000 63 2012-06-01 18:21 data/system/dropbox/event_data@1338571263112.txt
-rw------- 1000/1000 39 2012-06-17 10:42 data/system/dropbox/event_data@1338508840049.txt
-rw------- 1000/1000 39 2012-06-17 18:12 data/system/dropbox/event_data@1338508840064.txt
-rw------- 1000/1000 39 2012-06-17 23:12 data/system/dropbox/event_data@1338508840074.txt
-rw------- 1000/1000 84 2012-06-01 18:21 data/system/dropbox/event_log@1338571263108.txt
-rw------- 1000/1000 63 2012-06-01 18:51 data/system/dropbox/event_data@1338573063210.txt
-rw------- 1000/1000 39 2012-06-16 02:12 data/system/dropbox/event_data@1338508839984.txt
-rw------- 1000/1000 39 2012-06-16 12:12 data/system/dropbox/event_data@1338508840004.txt
-rw------- 1000/1000 39 2012-06-16 20:42 data/system/dropbox/event_data@1338508840021.txt
-rw------- 1000/1000 39 2012-06-17 05:42 data/system/dropbox/event_data@1338508840039.txt
-rw------- 1000/1000 39 2012-06-01 06:51 data/system/dropbox/event_data@1338529861567.txt
-rw------- 1000/1000 84 2012-06-01 18:51 data/system/dropbox/event_log@1338573063206.txt
-rw------- 1000/1000 39 2012-06-01 16:51 data/system/dropbox/event_data@1338565862489.txt
-rw------- 1000/1000 39 2012-06-16 16:12 data/system/dropbox/event_data@1338508840012.txt
-rw------- 1000/1000 39 2012-06-01 09:51 data/system/dropbox/event_data@1338540661874.txt
-rw------- 1000/1000 39 2012-06-01 12:21 data/system/dropbox/event_data@1338549662069.txt
-rw------- 1000/1000 39 2012-06-01 14:51 data/system/dropbox/event_data@1338558662337.txt
-rw------- 1000/1000 39 2012-06-17 00:42 data/system/dropbox/event_data@1338508840029.txt
-rw------- 1000/1000 39 2012-06-17 13:42 data/system/dropbox/event_data@1338508840055.txt
-rw------- 1000/1000 39 2012-06-17 22:42 data/system/dropbox/event_data@1338508840073.txt
-rw------- 1000/1000 248 2012-06-01 18:46 data/system/dropbox/SYSTEM_BOOT@1338572811349.txt
-rw------- 1000/1000 39 2012-06-18 23:29 data/system/dropbox/event_data@1338508840086.txt
-rw------- 1000/1000 39 2012-06-17 05:12 data/system/dropbox/event_data@1338508840038.txt
-rw------- 1000/1000 39 2012-06-16 11:42 data/system/dropbox/event_data@1338508840003.txt
-rw------- 1000/1000 39 2012-06-16 06:42 data/system/dropbox/event_data@1338508839993.txt
-rw------- 1000/1000 39 2012-06-01 06:21 data/system/dropbox/event_data@1338528061521.txt
-rw------- 1000/1000 248 2012-06-01 20:44 data/system/dropbox/SYSTEM_BOOT@1338579844990.txt
-rw------- 1000/1000 39 2012-06-16 01:42 data/system/dropbox/event_data@1338508839983.txt
-rw------- 1000/1000 39 2012-06-16 20:12 data/system/dropbox/event_data@1338508840020.txt
-rw------- 1000/1000 39 2012-06-01 21:21 data/system/dropbox/event_data@1338582063445.txt
-rw------- 1000/1000 39 2012-06-16 15:42 data/system/dropbox/event_data@1338508840011.txt
-rw------- 1000/1000 39 2012-06-17 10:12 data/system/dropbox/event_data@1338508840048.txt
-rw------- 1000/1000 39 2012-06-17 17:42 data/system/dropbox/event_data@1338508840063.txt
-rw------- 1000/1000 39 2012-06-17 22:12 data/system/dropbox/event_data@1338508840072.txt
-rw------- 1000/1000 39 2012-06-18 01:12 data/system/dropbox/event_data@1338508840078.txt
-rw------- 1000/1000 39 2012-06-17 00:12 data/system/dropbox/event_data@1338508840028.txt
-rw------- 1000/1000 39 2012-06-17 13:12 data/system/dropbox/event_data@1338508840054.txt
-rw------- 1000/1000 39 2012-06-01 09:21 data/system/dropbox/event_data@1338538861835.txt
-rw------- 1000/1000 39 2012-06-16 01:12 data/system/dropbox/event_data@1338508839982.txt
-rw------- 1000/1000 39 2012-06-16 19:42 data/system/dropbox/event_data@1338508840019.txt
-rw------- 1000/1000 39 2012-06-16 06:12 data/system/dropbox/event_data@1338508839992.txt
-rw------- 1000/1000 39 2012-06-17 04:42 data/system/dropbox/event_data@1338508840037.txt
-rw------- 1000/1000 39 2012-06-16 11:12 data/system/dropbox/event_data@1338508840002.txt
-rw------- 1000/1000 248 2012-06-01 18:13 data/system/dropbox/SYSTEM_BOOT@1338570801667.txt
-rw------- 1000/1000 39 2012-06-17 17:12 data/system/dropbox/event_data@1338508840062.txt
-rw------- 1000/1000 39 2012-06-17 21:42 data/system/dropbox/event_data@1338508840071.txt
-rw------- 1000/1000 39 2012-06-17 09:42 data/system/dropbox/event_data@1338508840047.txt
-rw------- 1000/1000 39 2012-06-16 00:42 data/system/dropbox/event_data@1338508839981.txt
-rw------- 1000/1000 39 2012-06-01 14:21 data/system/dropbox/event_data@1338556862250.txt
-rw------- 1000/1000 39 2012-06-01 20:21 data/system/dropbox/event_data@1338578463318.txt
-rw------- 1000/1000 39 2012-06-16 05:42 data/system/dropbox/event_data@1338508839991.txt
-rw------- 1000/1000 39 2012-06-16 23:42 data/system/dropbox/event_data@1338508840027.txt
-rw------- 1000/1000 39 2012-06-16 19:12 data/system/dropbox/event_data@1338508840018.txt
-rw------- 1000/1000 39 2012-06-01 05:51 data/system/dropbox/event_data@1338526261488.txt
-rw------- 1000/1000 39 2012-06-17 04:12 data/system/dropbox/event_data@1338508840036.txt
-rw------- 1000/1000 39 2012-06-01 11:51 data/system/dropbox/event_data@1338547862029.txt
-rw------- 1000/1000 39 2012-06-18 22:59 data/system/dropbox/event_data@1338508840085.txt
-rw------- 1000/1000 39 2012-06-16 10:42 data/system/dropbox/event_data@1338508840001.txt
-rw------- 1000/1000 39 2012-06-16 15:12 data/system/dropbox/event_data@1338508840010.txt
-rw------- 1000/1000 39 2012-06-17 16:42 data/system/dropbox/event_data@1338508840061.txt
-rw------- 1000/1000 39 2012-06-17 09:12 data/system/dropbox/event_data@1338508840046.txt
-rw------- 1000/1000 39 2012-06-16 00:12 data/system/dropbox/event_data@1338508839980.txt
-rw------- 1000/1000 39 2012-06-16 05:12 data/system/dropbox/event_data@1338508839990.txt
-rw------- 1000/1000 39 2012-06-17 21:12 data/system/dropbox/event_data@1338508840070.txt
-rw------- 1000/1000 39 2012-06-01 19:21 data/system/dropbox/event_data@1338574863247.txt
-rw------- 1000/1000 39 2012-06-01 08:51 data/system/dropbox/event_data@1338537061797.txt
-rw------- 1000/1000 39 2012-06-17 12:42 data/system/dropbox/event_data@1338508840053.txt
-rw------- 1000/1000 39 2012-06-16 23:12 data/system/dropbox/event_data@1338508840026.txt
-rw------- 1000/1000 248 2012-06-01 01:00 data/system/dropbox/SYSTEM_BOOT@1338508840087.txt
-rw------- 1000/1000 39 2012-06-17 03:42 data/system/dropbox/event_data@1338508840035.txt
-rw------- 1000/1000 39 2012-06-01 13:51 data/system/dropbox/event_data@1338555062211.txt
-rw------- 1000/1000 39 2012-06-18 22:29 data/system/dropbox/event_data@1338508840084.txt
-rw------- 1000/1000 39 2012-06-01 05:21 data/system/dropbox/event_data@1338524461452.txt
-rw------- 1000/1000 39 2012-06-16 10:12 data/system/dropbox/event_data@1338508840000.txt
-rw------- 1000/1000 39 2012-06-16 14:42 data/system/dropbox/event_data@1338508840009.txt
-rw------- 1000/1000 39 2012-06-17 08:42 data/system/dropbox/event_data@1338508840045.txt
-rw------- 1000/1000 39 2012-06-16 04:42 data/system/dropbox/event_data@1338508839989.txt
-rw------- 1000/1000 39 2012-06-17 20:42 data/system/dropbox/event_data@1338508840069.txt
-rw------- 1000/1000 39 2012-06-15 23:42 data/system/dropbox/event_data@1338508839979.txt
-rw------- 1000/1000 39 2012-06-01 11:21 data/system/dropbox/event_data@1338546061989.txt
-rw------- 1000/1000 39 2012-06-16 22:42 data/system/dropbox/event_data@1338508840025.txt
-rw------- 1000/1000 39 2012-06-17 16:12 data/system/dropbox/event_data@1338508840060.txt
-rw------- 1000/1000 39 2012-06-01 16:21 data/system/dropbox/event_data@1338564062448.txt
-rw------- 1000/1000 39 2012-06-16 18:42 data/system/dropbox/event_data@1338508840017.txt
-rw------- 1000/1000 39 2012-06-17 03:12 data/system/dropbox/event_data@1338508840034.txt
-rw------- 1000/1000 39 2012-06-17 08:12 data/system/dropbox/event_data@1338508840044.txt
-rw------- 1000/1000 39 2012-06-16 09:42 data/system/dropbox/event_data@1338508839999.txt
-rw------- 1000/1000 39 2012-06-16 14:12 data/system/dropbox/event_data@1338508840008.txt
-rw------- 1000/1000 39 2012-06-01 08:21 data/system/dropbox/event_data@1338535261758.txt
-rw------- 1000/1000 63 2012-06-01 01:30 data/system/dropbox/event_data@1338510642682.txt
-rw------- 1000/1000 34 2012-06-01 01:30 data/system/dropbox/event_log@1338510642676.txt
-rw------- 1000/1000 63 2012-06-01 17:21 data/system/dropbox/event_data@1338567662971.txt
-rw------- 1000/1000 84 2012-06-01 17:21 data/system/dropbox/event_log@1338567662967.txt
-rw------- 1000/1000 39 2012-06-17 20:12 data/system/dropbox/event_data@1338508840068.txt
-rw------- 1000/1000 39 2012-06-01 13:21 data/system/dropbox/event_data@1338553262172.txt
-rw------- 1000/1000 39 2012-06-01 17:51 data/system/dropbox/event_data@1338569463014.txt
-rw------- 1000/1000 39 2012-06-16 22:12 data/system/dropbox/event_data@1338508840024.txt
-rw------- 1000/1000 39 2012-06-18 21:59 data/system/dropbox/event_data@1338508840083.txt
-rw------- 1000/1000 39 2012-06-16 18:12 data/system/dropbox/event_data@1338508840016.txt
-rw------- 1000/1000 39 2012-06-17 07:42 data/system/dropbox/event_data@1338508840043.txt
-rw------- 1000/1000 39 2012-06-16 09:12 data/system/dropbox/event_data@1338508839998.txt
-rw------- 1000/1000 39 2012-06-17 02:42 data/system/dropbox/event_data@1338508840033.txt
-rw------- 1000/1000 39 2012-06-01 10:51 data/system/dropbox/event_data@1338544261949.txt
-rw------- 1000/1000 39 2012-06-01 04:51 data/system/dropbox/event_data@1338522661412.txt
-rw------- 1000/1000 39 2012-06-17 12:12 data/system/dropbox/event_data@1338508840052.txt
-rw------- 1000/1000 39 2012-06-16 04:12 data/system/dropbox/event_data@1338508839988.txt
-rw------- 1000/1000 39 2012-06-01 03:21 data/system/dropbox/event_data@1338517261305.txt
-rw------- 1000/1000 39 2012-06-01 15:51 data/system/dropbox/event_data@1338562262410.txt
-rw------- 1000/1000 39 2012-06-01 07:51 data/system/dropbox/event_data@1338533461715.txt
-rw------- 1000/1000 248 2012-06-01 02:27 data/system/dropbox/SYSTEM_BOOT@1338514056784.txt
-rw------- 1000/1000 39 2012-06-17 07:12 data/system/dropbox/event_data@1338508840042.txt
-rw------- 1000/1000 248 2012-06-01 17:03 data/system/dropbox/SYSTEM_BOOT@1338566580491.txt
-rw------- 1000/1000 39 2012-06-01 12:51 data/system/dropbox/event_data@1338551462107.txt
drwxrwx--x 1000/1000 0 2014-04-06 22:46 data/system/shared_prefs/
-rw-rw---- 1000/1000 206 2014-04-06 22:46 data/system/shared_prefs/log_files.xml
drwx------ 1000/1000 0 2012-06-01 22:34 data/system/sync/
-rw------- 1000/1000 584 2012-06-01 22:34 data/system/sync/status.bin
-rw------- 1000/1000 260 2012-06-01 22:22 data/system/sync/stats.bin
-rw------- 1000/1000 384 2012-06-01 22:27 data/system/sync/pending.bin
-rw------- 1000/1000 1227 2012-06-01 21:52 data/system/sync/accounts.xml
-rw-rw---- 1000/1000 23552 2014-07-07 22:00 data/system/accounts.db
drwxrwx--x 1000/1000 0 2014-04-06 16:42 data/system/registered_services/
-rw------- 1000/1000 767 2014-04-06 16:42 data/system/registered_services/android.content.SyncAdapter.xml
-rw------- 1000/1000 229 2012-06-01 01:13 data/system/registered_services/android.accounts.AccountAuthenticator.xml
-rw------- 1000/1000 1572864 2012-06-01 01:13 data/appbank
drwx------ 1000/1000 0 2012-06-01 21:52 data/backup/
-rw------- 1000/1000 152 2012-06-01 21:52 data/backup/processed
drwx------ 1000/1000 0 2012-06-01 22:41 data/backup/com.google.android.backup.BackupTransportService/
-rwxrwx--- 1000/1000 214 2012-06-01 22:41 data/backup/com.google.android.backup.BackupTransportService/@pm@
-rwxrwx--- 1000/1000 112 2014-04-06 23:47 data/backup/com.google.android.backup.BackupTransportService/com.android.inputmethod.latin
-rwxrwx--- 1000/1000 8 2014-04-06 23:47 data/backup/com.google.android.backup.BackupTransportService/com.android.providers.userdictionary
-rwxrwx--- 1000/1000 0 2014-04-06 23:47 data/backup/com.google.android.backup.BackupTransportService/com.android.vending
-rwxrwx--- 1000/1000 100 2014-04-06 23:47 data/backup/com.google.android.backup.BackupTransportService/android
-rwxrwx--- 1000/1000 36 2014-04-11 23:25 data/backup/com.google.android.backup.BackupTransportService/com.android.providers.settings
-rwxrwx--- 1000/1000 36 2014-04-06 23:47 data/backup/com.google.android.backup.BackupTransportService/com.android.browser
-rwxrwx--- 1000/1000 36 2012-06-01 22:41 data/backup/com.google.android.backup.BackupTransportService/com.android.providers.settings.new
drwx------ 1000/1000 0 2012-06-01 01:13 data/backup/com.android.internal.backup.LocalTransport/
drwx------ 1000/1000 0 2012-06-01 22:41 data/backup/pending/
-rw------- 1000/1000 32 2012-06-01 22:41 data/backup/pending/journal654101.tmp
-rw------- 1000/1000 24 2014-04-06 21:10 data/backup/ancestral
-rw-rw-rw- 0/9997 30 2012-06-01 21:52 data/BT_Addr
drwxrwxr-x 1000/1000 0 2012-06-01 21:52 data/anr/
-rw-rw-rw- 1000/1000 0 2012-06-01 21:52 data/anr/traces.txt
drwxrwxrwx 0/0 0 2012-06-01 01:13 data/core/
-rw-rw---- 0/9997 6336 2012-06-01 01:13 data/AllMap
-rw-rw---- 0/9997 17454 2012-06-01 01:13 data/AllFile
-rw-rw-rw- 1000/1000 0 2012-06-01 01:13 data/combo_t32.cmm
drwxrwx--- 1002/3002 0 2014-04-06 14:48 data/@btmtk/
-rw-rw-rw- 1002/3002 484 2014-04-06 14:48 data/@btmtk/cod
-rw-rw-rw- 1002/3002 20 2014-04-06 14:48 data/@btmtk/le
-rw-rw-rw- 1002/3002 6728 2014-04-06 14:48 data/@btmtk/devdb
drwxrwxrwx 1002/3002 0 2014-04-06 18:26 data/@btmtk/profile/
-rw-r--r-- 1002/3002 0 2014-04-06 18:26 data/@btmtk/profile/bpp_xhtml.bin
-rw-r--r-- 1002/3002 0 2014-04-06 18:26 data/@btmtk/profile/BppSoapI.txt
-rw-r--r-- 1002/3002 0 2014-04-06 18:26 data/@btmtk/profile/BppSoapO.txt
-rw-rw-rw- 1000/1000 248 2012-06-01 01:13 data/@btmtk/host_cache
drwxr-xr-x 0/0 0 2012-06-01 01:13 data/amit/
drwxrwx--x 1000/1000 0 2012-06-01 20:34 data/dalvik-cache/
-rw-r--r-- 1000/10018 1142408 2013-04-03 07:19 data/dalvik-cache/system@app@GoogleServicesFramework.apk@classes.dex
-rw-r--r-- 1000/10019 80688 2013-04-03 07:19 data/dalvik-cache/system@app@GoogleFeedback.apk@classes.dex
-rw-r--r-- 1000/10018 276752 2013-04-03 07:19 data/dalvik-cache/system@app@GoogleContactsSyncAdapter.apk@classes.dex
-rw-r--r-- 1000/10018 236936 2013-04-03 07:19 data/dalvik-cache/system@app@GoogleCalendarSyncAdapter.apk@classes.dex
-rw-r--r-- 1000/1000 72880 2013-04-03 07:19 data/dalvik-cache/system@app@GoogleBackupTransport.apk@classes.dex
-rw-r--r-- 1000/10017 2119616 2013-04-03 07:19 data/dalvik-cache/system@app@Gmail.apk@classes.dex
-rw-r--r-- 1000/10016 193880 2013-04-03 07:19 data/dalvik-cache/system@app@GetJar.apk@classes.dex
-rw-r--r-- 1000/10054 918496 2014-04-06 21:11 data/dalvik-cache/data@app@com.noshufou.android.su-1.apk@classes.dex
-rw-r--r-- 1000/10012 6003464 2013-04-03 07:19 data/dalvik-cache/system@app@Facebook.apk@classes.dex
-rw-r--r-- 1000/10057 39816 2014-04-06 23:47 data/dalvik-cache/data@app@info.yeppp.cpuid-1.apk@classes.dex
-rw-r--r-- 1000/1001 26432 2013-04-03 07:19 data/dalvik-cache/system@app@ActivityNetwork.apk@classes.dex
-rw-r--r-- 1000/1000 15272 2013-04-03 07:09 data/dalvik-cache/system@framework@wappush.jar@classes.dex
-rw-r--r-- 1000/1000 74120 2013-04-03 07:09 data/dalvik-cache/system@framework@com.android.location.provider.jar@classes.dex
-rw-r--r-- 1000/1000 356648 2013-04-03 07:09 data/dalvik-cache/system@framework@com.google.android.maps.jar@classes.dex
-rw-r--r-- 1000/10053 439624 2014-04-06 18:51 data/dalvik-cache/data@app@aws.apps.underthehood-1.apk@classes.dex
-rw-r--r-- 1000/10042 512464 2013-04-03 07:19 data/dalvik-cache/system@app@TinyFlashlight.apk@classes.dex
-rw-r--r-- 1000/10056 283312 2014-04-06 21:17 data/dalvik-cache/data@app@jackpal.androidterm-1.apk@classes.dex
-rw-r--r-- 1000/10052 933344 2014-04-06 18:50 data/dalvik-cache/data@app@aws.apps.networkInfoIi-1.apk@classes.dex
-rw-r--r-- 1000/10036 3812592 2013-04-03 07:19 data/dalvik-cache/system@app@PlayStore.apk@classes.dex
-rw-r--r-- 1000/10046 999248 2014-04-06 14:31 data/dalvik-cache/data@app@com.cpuid.cpu_z-1.apk@classes.dex
-rw-r--r-- 1000/1001 57632 2013-04-03 07:19 data/dalvik-cache/system@app@MobileLog.apk@classes.dex
-rw-r--r-- 1000/10026 4456 2013-04-03 07:19 data/dalvik-cache/system@app@MediaTekLocationProvider.apk@classes.dex
-rw-r--r-- 1000/10055 711896 2014-04-06 21:13 data/dalvik-cache/data@app@org.openintents.filemanager-1.apk@classes.dex
drwx------ 0/0 0 2012-06-01 21:52 data/property/
-rw------- 0/0 1 2012-06-01 21:52 data/property/persist.radio.default_sim_mode
-rw------- 0/0 1 2012-06-01 21:52 data/property/persist.sys.mute.state
-rw------- 0/0 15 2012-06-01 21:52 data/property/persist.mdp_msg
-rw------- 0/0 5 2012-06-01 21:52 data/property/persist.dm.lock
-rw------- 0/0 1 2012-06-18 01:28 data/property/persist.service.adb.enable
-rw------- 0/0 1 2012-06-01 01:13 data/property/persist.radio.default_sim
-rw------- 0/0 13 2012-06-01 01:13 data/property/persist.sys.timezone
-rw------- 0/0 1 2012-06-01 01:13 data/property/persist.sys.boot.count
-rw------- 0/0 4 2014-04-06 16:42 data/property/persist.sys.sd.defaultpath
drwxrwx--x 1000/1000 0 2012-06-01 20:34 data/app/
-rw-r--r-- 1000/1000 996475 2014-04-06 21:13 data/app/org.openintents.filemanager-1.apk
-rw-r--r-- 1000/1000 1468798 2014-04-06 21:11 data/app/com.noshufou.android.su-1.apk
-rw-r--r-- 1000/1000 155622 2014-04-06 23:47 data/app/info.yeppp.cpuid-1.apk
-rw-r--r-- 1000/1000 466229 2014-04-06 18:51 data/app/aws.apps.underthehood-1.apk
-rw-r--r-- 1000/1000 712535 2014-04-06 18:50 data/app/aws.apps.networkInfoIi-1.apk
-rw-r--r-- 1000/1000 486115 2014-04-06 21:17 data/app/jackpal.androidterm-1.apk
-rw-r--r-- 1000/1000 815711 2014-04-06 14:31 data/app/com.cpuid.cpu_z-1.apk
drwxrwx--x 1000/1000 0 2012-06-01 01:13 data/app-private/
drwxrwx--x 1000/1000 0 2012-06-01 20:34 data/data/
drwxr-x--x 10018/10018 0 2014-04-06 16:53 data/data/com.google.android.gsf/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.google.android.gsf/lib/
drwxrwx--x 10018/10018 0 2014-04-06 16:53 data/data/com.google.android.gsf/cache/
drwxrwx--x 10018/10018 0 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/
-rw------- 10018/10018 26720 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/d0e256c9
-rw------- 10018/10018 25144 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/7b64141e
-rw------- 10018/10018 823 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/b51857f5
-rw------- 10018/10018 26612 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/0e47d245
-rw------- 10018/10018 1225 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/6cae3189
-rw------- 10018/10018 948 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/355a5e86
-rw------- 10018/10018 41706 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/5e8c76b6
-rw------- 10018/10018 41720 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/468ea6aa
-rw------- 10018/10018 908 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/0df4a538
-rw------- 10018/10018 2357 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/4ca4fbc7
-rw------- 10018/10018 7202 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/22023031
-rw------- 10018/10018 8142 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/0f5866c3
-rw------- 10018/10018 681 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/f00caf44
-rw------- 10018/10018 4250 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/4f799626
-rw------- 10018/10018 4203 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/9887545f
-rw------- 10018/10018 25312 2014-04-06 16:53 data/data/com.google.android.gsf/cache/webviewCache/cd2469fd
drwxrwx--x 10018/10018 0 2012-06-01 01:00 data/data/com.google.android.gsf/files/
drwxrwx--x 10018/10018 0 2012-06-01 22:22 data/data/com.google.android.gsf/shared_prefs/
-rw-rw---- 10018/10018 242 2012-06-01 22:22 data/data/com.google.android.gsf/shared_prefs/EventLogService.xml
-rw-rw---- 10018/10018 539 2012-06-01 20:38 data/data/com.google.android.gsf/shared_prefs/CheckinService.xml
-rw-rw---- 10018/10018 152 2009-01-01 00:01 data/data/com.google.android.gsf/shared_prefs/update.xml
-rw-rw---- 10018/10018 117 2014-04-06 14:29 data/data/com.google.android.gsf/shared_prefs/com.google.android.gsf_preferences.xml
drwxrwx--x 10018/10018 0 2012-06-01 22:40 data/data/com.google.android.gsf/databases/
-rw-rw---- 10018/10018 14336 2014-04-06 16:53 data/data/com.google.android.gsf/databases/webviewCache.db
-rw-rw---- 10018/10018 14336 2014-04-06 16:53 data/data/com.google.android.gsf/databases/webview.db
-rw-rw---- 10018/10018 24576 2012-06-01 21:52 data/data/com.google.android.gsf/databases/talk.db
-rw-rw---- 10018/10018 7168 2014-04-06 16:44 data/data/com.google.android.gsf/databases/googlesettings.db
-rw-rw---- 10018/10018 11264 2014-07-07 22:00 data/data/com.google.android.gsf/databases/subscribedfeeds.db
-rw-rw---- 10018/10018 48128 2014-07-07 22:00 data/data/com.google.android.gsf/databases/gservices.db
-rw-rw---- 10018/10018 5120 2012-06-01 01:00 data/data/com.google.android.gsf/databases/gls.db
drwxrwx--x 10018/10018 0 2014-04-06 14:30 data/data/com.google.android.gsf/app_sslcache/
-rw------- 10018/10018 5792 2014-07-07 22:00 data/data/com.google.android.gsf/app_sslcache/android.clients.google.com.443
-rw------- 10018/10018 5792 2014-07-07 23:24 data/data/com.google.android.gsf/app_sslcache/mtalk.google.com.5228
drwxr-x--x 10019/10019 0 2012-06-01 01:13 data/data/com.google.android.feedback/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.google.android.feedback/lib/
drwxr-x--x 10018/10018 0 2014-04-06 14:30 data/data/com.google.android.syncadapters.contacts/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.google.android.syncadapters.contacts/lib/
drwxrwx--x 10018/10018 0 2014-04-06 14:34 data/data/com.google.android.syncadapters.contacts/app_sslcache/
-rw------- 10018/10018 5792 2014-04-06 14:34 data/data/com.google.android.syncadapters.contacts/app_sslcache/android.clients.google.com.443
drwxr-x--x 10018/10018 0 2014-04-06 14:30 data/data/com.google.android.syncadapters.calendar/
drwxrwx--x 10018/10018 0 2014-04-06 14:31 data/data/com.google.android.syncadapters.calendar/app_sslcache/
-rw------- 10018/10018 5792 2014-04-06 14:31 data/data/com.google.android.syncadapters.calendar/app_sslcache/android.clients.google.com.443
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.google.android.syncadapters.calendar/lib/
drwxr-x--x 1000/1000 0 2012-06-01 01:13 data/data/com.google.android.backup/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.google.android.backup/lib/
drwxrwx--x 1000/1000 0 2012-06-01 22:41 data/data/com.google.android.backup/shared_prefs/
-rw-rw---- 1000/1000 556 2012-06-01 22:41 data/data/com.google.android.backup/shared_prefs/BackupTransport.backupScheduler.xml
-rw-rw---- 1000/1000 217 2012-06-01 21:52 data/data/com.google.android.backup/shared_prefs/BackupTransport.restoreScheduler.xml
drwxrwx--x 1000/1000 0 2014-04-06 21:09 data/data/com.google.android.backup/app_sslcache/
-rw------- 1000/1000 5792 2014-04-11 22:24 data/data/com.google.android.backup/app_sslcache/android.clients.google.com.443
drwxr-x--x 10017/10017 0 2014-04-06 16:20 data/data/com.google.android.gm/
drwxrwx--x 10017/10017 0 2014-04-06 16:20 data/data/com.google.android.gm/files/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.google.android.gm/lib/
drwxrwx--x 10017/10017 0 2014-04-06 15:04 data/data/com.google.android.gm/cache/
drwxrwx--x 10017/10017 0 2012-06-01 22:08 data/data/com.google.android.gm/databases/
-rw-rw---- 10017/10017 72704 2012-06-01 01:05 data/data/com.google.android.gm/databases/mailstore.redacted@gmail.com.db
-rw------- 10017/10017 0 2014-04-06 16:20 data/data/com.google.android.gm/databases/gmail.db-journal
-rw-rw---- 10017/10017 4096 2014-04-06 16:20 data/data/com.google.android.gm/databases/gmail.db
-rw-rw---- 10017/10017 5120 2014-04-06 15:04 data/data/com.google.android.gm/databases/downloads.db
drwxrwx--x 10017/10017 0 2012-06-01 01:00 data/data/com.google.android.gm/shared_prefs/
-rw-rw---- 10017/10017 543 2012-06-01 01:00 data/data/com.google.android.gm/shared_prefs/Gmail.xml
-rw-rw---- 10017/10017 126 2014-04-06 15:03 data/data/com.google.android.gm/shared_prefs/_has_set_default_values.xml
drwxrwx--x 10017/10017 0 2014-04-06 16:20 data/data/com.google.android.gm/app_sslcache/
-rw------- 10017/10017 5792 2014-07-07 22:00 data/data/com.google.android.gm/app_sslcache/android.clients.google.com.443
drwxr-x--x 10016/10016 0 2014-04-06 15:02 data/data/getjar.android.client/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/getjar.android.client/lib/
drwxrwx--x 10016/10016 0 2014-07-20 10:20 data/data/getjar.android.client/shared_prefs/
-rw-rw---- 10016/10016 174 2014-07-20 10:20 data/data/getjar.android.client/shared_prefs/timestamp.xml
-rw-rw---- 10016/10016 267 2014-04-06 16:32 data/data/getjar.android.client/shared_prefs/GetJarClientPrefs.xml
drwxrwx--x 10016/10016 0 2014-04-06 15:02 data/data/getjar.android.client/files/
drwxrwx--x 10016/10016 0 2014-04-06 16:39 data/data/getjar.android.client/cache/
drwxrwx--x 10016/10016 0 2014-04-06 16:39 data/data/getjar.android.client/cache/webviewCache/
drwxrwx--x 10016/10016 0 2012-06-01 22:33 data/data/getjar.android.client/databases/
-rw-rw---- 10016/10016 7168 2014-07-07 22:00 data/data/getjar.android.client/databases/GetJarDBEvents
-rw-rw---- 10016/10016 6144 2012-06-01 22:33 data/data/getjar.android.client/databases/GetJarDBRunning
-rw-rw---- 10016/10016 12288 2012-06-01 22:03 data/data/getjar.android.client/databases/GetJarDB
-rw-rw---- 10016/10016 6144 2014-04-06 16:39 data/data/getjar.android.client/databases/webviewCache.db
-rw-rw---- 10016/10016 14336 2014-04-06 15:02 data/data/getjar.android.client/databases/webview.db
drwxr-x--x 10055/10055 0 2012-06-01 21:52 data/data/org.openintents.filemanager/
drwxr-xr-x 1000/1000 0 2012-06-01 21:52 data/data/org.openintents.filemanager/lib/
-rwxr-xr-x 1000/1000 13388 2014-02-14 22:26 data/data/org.openintents.filemanager/lib/libaccess.so
drwxrwx--x 10055/10055 0 2014-04-06 21:14 data/data/org.openintents.filemanager/shared_prefs/
-rw-rw---- 10055/10055 192 2014-04-06 21:14 data/data/org.openintents.filemanager/shared_prefs/org.openintents.filemanager_preferences.xml
drwxrwx--x 10055/10055 0 2014-04-06 21:14 data/data/org.openintents.filemanager/databases/
-rw-rw---- 10055/10055 5120 2014-04-06 21:14 data/data/org.openintents.filemanager/databases/filemanager_search.db
-rw-rw---- 10055/10055 5120 2014-04-06 21:14 data/data/org.openintents.filemanager/databases/org.openintents.filemanager
drwxr-x--x 1000/1000 0 2012-06-01 01:13 data/data/srclib.huyanwei.bubble/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/srclib.huyanwei.bubble/lib/
drwxr-x--x 10054/10054 0 2012-06-01 21:52 data/data/com.noshufou.android.su/
drwxr-xr-x 1000/1000 0 2012-06-01 21:52 data/data/com.noshufou.android.su/lib/
drwxrwx--x 10054/10054 0 2014-04-06 21:12 data/data/com.noshufou.android.su/files/
-rw-rw---- 10054/10054 380532 2014-04-06 21:12 data/data/com.noshufou.android.su/files/su
-rwx------ 10054/10054 93480 2014-04-06 21:12 data/data/com.noshufou.android.su/files/sutools
drwxrwx--x 10054/10054 0 2014-04-06 21:12 data/data/com.noshufou.android.su/cache/
drwxrwx--x 10054/10054 0 2014-04-06 21:12 data/data/com.noshufou.android.su/cache/webviewCache/
drwxrwx--x 10054/10054 0 2014-04-06 21:38 data/data/com.noshufou.android.su/databases/
-rw-rw---- 10054/10054 7168 2014-04-06 21:38 data/data/com.noshufou.android.su/databases/permissions.sqlite
-rw-rw---- 10054/10054 7168 2014-04-06 21:12 data/data/com.noshufou.android.su/databases/su.db
-rw-rw---- 10054/10054 6144 2014-04-06 21:12 data/data/com.noshufou.android.su/databases/webviewCache.db
-rw-rw---- 10054/10054 14336 2014-04-06 21:12 data/data/com.noshufou.android.su/databases/webview.db
drwxrwx--x 10054/10054 0 2012-06-01 21:52 data/data/com.noshufou.android.su/shared_prefs/
-rw-rw---- 10054/10054 842 2012-06-01 21:52 data/data/com.noshufou.android.su/shared_prefs/com.noshufou.android.su_preferences.xml
drwxr-x--x 10015/10015 0 2014-04-06 15:03 data/data/com.cooliris.media/
drwxrwx--x 10015/10015 0 2014-04-06 14:30 data/data/com.cooliris.media/databases/
-rw-rw---- 10015/10015 10240 2014-04-06 14:30 data/data/com.cooliris.media/databases/picasa.db
drwxrwx--x 10015/10015 0 2014-04-06 15:03 data/data/com.cooliris.media/files/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.cooliris.media/lib/
drwxr-x--x 10014/10014 0 2014-04-06 16:54 data/data/com.mediatek.FMRadio/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.FMRadio/lib/
drwxrwx--x 10014/10014 0 2014-04-06 16:54 data/data/com.mediatek.FMRadio/databases/
-rw-rw---- 10014/10014 5120 2014-04-06 16:54 data/data/com.mediatek.FMRadio/databases/FMRadio.db
drwxr-x--x 10013/10013 0 2012-06-01 01:13 data/data/com.mediatek.filemanager/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.filemanager/lib/
drwxr-x--x 1001/1001 0 2012-06-01 01:13 data/data/com.mediatek.factorymode/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.factorymode/lib/
drwxr-x--x 10012/10012 0 2014-04-06 22:38 data/data/com.facebook.katana/
drwxrwx--x 10012/10012 0 2014-04-06 18:27 data/data/com.facebook.katana/cache/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.facebook.katana/lib/
drwxrwx--x 10012/10012 0 2014-04-06 18:27 data/data/com.facebook.katana/app_fd-crash-reports/
drwxrwx--x 10012/10012 0 2012-06-01 18:46 data/data/com.facebook.katana/shared_prefs/
-rw-rw---- 10012/10012 1011 2012-06-01 18:46 data/data/com.facebook.katana/shared_prefs/com.facebook.orca_preferences.xml
drwxrwx--x 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/databases/
-rw-rw---- 10012/10012 17408 2012-06-01 21:52 data/data/com.facebook.katana/databases/analytics_db2
-rw-rw---- 10012/10012 48128 2014-04-06 23:04 data/data/com.facebook.katana/databases/fb.db
-rw-rw---- 10012/10012 7168 2012-06-01 21:52 data/data/com.facebook.katana/databases/qe_db
-rw-rw---- 10012/10012 5120 2014-04-06 18:27 data/data/com.facebook.katana/databases/pages_db
-rw-rw---- 10012/10012 5120 2014-04-06 18:27 data/data/com.facebook.katana/databases/timeline_db
-rw-rw---- 10012/10012 21504 2014-04-06 18:27 data/data/com.facebook.katana/databases/contacts_db2
-rw-rw---- 10012/10012 30720 2014-04-06 18:27 data/data/com.facebook.katana/databases/threads_db2
-rw-rw---- 10012/10012 5120 2012-06-01 21:52 data/data/com.facebook.katana/databases/prefs_db
-rw-rw---- 10012/10012 14336 2014-04-06 18:27 data/data/com.facebook.katana/databases/newsfeed_db
drwxrwx--x 10012/10012 0 2014-04-06 18:27 data/data/com.facebook.katana/app_secondary_program_dex_opt/
-rw-r--r-- 10012/10012 2940784 2014-04-06 18:27 data/data/com.facebook.katana/app_secondary_program_dex_opt/program-7772540e669eed213d8f05aff15ddc1fbed66715.dex.dex
drwxrwx--x 10012/10012 0 2014-04-06 18:27 data/data/com.facebook.katana/app_secondary_program_dex/
-rw------- 10012/10012 1125223 2014-04-06 18:27 data/data/com.facebook.katana/app_secondary_program_dex/program-7772540e669eed213d8f05aff15ddc1fbed66715.dex.jar
-rw------- 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/app_secondary_program_dex/lock
drwxrwx--x 10012/10012 0 2014-04-06 18:27 data/data/com.facebook.katana/app_outdex/
-rw-r--r-- 10012/10012 90080 2014-04-06 18:27 data/data/com.facebook.katana/app_outdex/libphonenumber-5.2.dex.2.dex
drwxrwx--x 10012/10012 0 2014-04-06 18:27 data/data/com.facebook.katana/app_dex/
-rw------- 10012/10012 161595 2014-04-06 18:27 data/data/com.facebook.katana/app_dex/libphonenumber-5.2.dex.2.jar
-rw------- 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/app_dex/libphonenumber-5.2.dex.lock
-rw------- 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/app_dex/nine_old_androids.dex.lock
-rw------- 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/app_dex/diffutils-1.2.1.dex.lock
-rw------- 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/app_dex/json-path-0.5.4-FB-Custom.dex.lock
-rw------- 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/app_dex/json_simple-1.1.dex.lock
-rw------- 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/app_dex/jackson-datatype-guava-2.0.4.dex.lock
-rw------- 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/app_dex/jackson-databind-2.0.5.dex.lock
-rw------- 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/app_dex/jackson-core-2.0.5.dex.lock
-rw------- 10012/10012 0 2012-06-01 21:52 data/data/com.facebook.katana/app_dex/guava-10.0.1-fork.dex.lock
drwxrwx--x 10012/10012 0 2012-06-01 20:44 data/data/com.facebook.katana/app_acra-reports/
-rw------- 10012/10012 11319 2012-06-01 01:24 data/data/com.facebook.katana/app_acra-reports/1338510257000-124972-approved.stacktrace
-rw------- 10012/10012 11261 2012-06-01 20:44 data/data/com.facebook.katana/app_acra-reports/1338579845000-124972-approved.stacktrace
-rw------- 10012/10012 11291 2012-06-01 18:46 data/data/com.facebook.katana/app_acra-reports/1338572807000-124972-approved.stacktrace
drwxrwx--x 10012/10012 0 2014-04-06 22:38 data/data/com.facebook.katana/files/
-rw------- 10012/10012 36 2014-04-06 22:38 data/data/com.facebook.katana/files/ACRA-INSTALLATION
drwxr-x--x 1000/1000 0 2012-06-01 01:13 data/data/com.android.simmelock/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.simmelock/lib/
drwxr-x--x 1001/1001 0 2012-06-01 01:13 data/data/com.mediatek.engineermode/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.engineermode/lib/
drwxr-x--x 10011/10011 0 2012-06-01 01:00 data/data/com.android.email/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.email/lib/
drwxrwx--x 10011/10011 0 2012-06-01 01:00 data/data/com.android.email/shared_prefs/
-rw-rw---- 10011/10011 125 2012-06-01 01:00 data/data/com.android.email/shared_prefs/AndroidMail.Main.xml
drwxrwx--x 10011/10011 0 2012-06-01 01:00 data/data/com.android.email/files/
-rw------- 10011/10011 18 2012-06-01 01:00 data/data/com.android.email/files/deviceName
drwxrwx--x 10011/10011 0 2012-06-01 01:00 data/data/com.android.email/databases/
-rw-rw---- 10011/10011 6144 2012-06-01 01:00 data/data/com.android.email/databases/EmailProviderBody.db
-rw-rw---- 10011/10011 28672 2012-06-01 01:00 data/data/com.android.email/databases/EmailProvider.db
drwxrwx--x 10011/10011 0 2012-06-01 01:00 data/data/com.android.email/cache/
drwxr-x--x 10010/10010 0 2012-06-01 01:00 data/data/com.android.providers.drm/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.drm/lib/
drwxr-xr-x 10010/10010 0 2012-06-01 01:00 data/data/com.android.providers.drm/files/
drwxr-xr-x 10010/10010 0 2012-06-01 21:53 data/data/com.android.providers.drm/files/st/
-rw-rw-rw- 10010/10010 24 2012-06-01 21:53 data/data/com.android.providers.drm/files/st/st.dat
drwxr-xr-x 10010/10010 0 2012-06-01 21:52 data/data/com.android.providers.drm/files/id/
-rw-r--r-- 10010/10010 15 2012-06-01 21:52 data/data/com.android.providers.drm/files/id/id.dat
drwxr-x--x 10010/10010 0 2012-06-01 01:13 data/data/com.android.providers.downloads.ui/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.downloads.ui/lib/
drwxr-x--x 10010/10010 0 2012-06-01 01:00 data/data/com.android.providers.downloads/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.downloads/lib/
drwxrwx--x 10010/10010 0 2012-06-01 21:52 data/data/com.android.providers.downloads/databases/
-rw-rw---- 10010/10010 10240 2014-07-07 23:08 data/data/com.android.providers.downloads/databases/downloads.db
drwxr-x--x 1000/1000 0 2012-06-01 01:13 data/data/com.android.juzhen/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.juzhen/lib/
drwxr-x--x 10009/10009 0 2012-06-01 01:13 data/data/com.android.defcontainer/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.defcontainer/lib/
drwxr-x--x 10000/10000 0 2014-04-06 16:27 data/data/com.android.contacts/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.contacts/lib/
drwxrwx--x 10000/10000 0 2014-04-06 18:52 data/data/com.android.contacts/shared_prefs/
-rw-rw---- 10000/10000 125 2014-04-06 18:52 data/data/com.android.contacts/shared_prefs/dialtacts.xml
-rw-rw---- 10000/10000 119 2014-04-06 17:02 data/data/com.android.contacts/shared_prefs/com.android.contacts_preferences.xml
drwxr-x--x 10000/10000 0 2012-06-01 01:13 data/data/com.android.providers.contacts/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.contacts/lib/
drwxrwx--x 10000/10000 0 2012-06-01 01:13 data/data/com.android.providers.contacts/shared_prefs/
-rw-rw---- 10000/10000 107 2012-06-01 01:13 data/data/com.android.providers.contacts/shared_prefs/com.android.providers.contacts_preferences.xml
-rw-rw---- 10000/10000 108 2012-06-01 01:13 data/data/com.android.providers.contacts/shared_prefs/ContactsUpgradeReceiver.xml
drwxrwx--x 10000/10000 0 2012-06-01 22:40 data/data/com.android.providers.contacts/databases/
-rw-rw---- 10000/10000 180224 2014-04-06 14:34 data/data/com.android.providers.contacts/databases/contacts2.db
-rw------- 10000/10000 0 2014-04-06 21:55 data/data/com.android.providers.contacts/databases/contacts2.db-mj1E426E53
drwxr-x--x 10008/10008 0 2012-06-01 01:13 data/data/com.android.certinstaller/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.certinstaller/lib/
drwxr-x--x 1001/1001 0 2012-06-01 01:13 data/data/com.mediatek.CellConnService/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.CellConnService/lib/
drwxr-x--x 10007/10007 0 2014-04-06 14:29 data/data/com.mediatek.camera/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.camera/lib/
drwxrwx--x 10007/10007 0 2012-06-18 22:14 data/data/com.mediatek.camera/shared_prefs/
-rw-rw---- 10007/10007 904 2012-06-18 22:14 data/data/com.mediatek.camera/shared_prefs/com.mediatek.camera_preferences_0.xml
-rw-rw---- 10007/10007 279 2014-04-06 14:29 data/data/com.mediatek.camera/shared_prefs/com.mediatek.camera_preferences.xml
drwxr-x--x 10006/10006 0 2012-06-01 01:13 data/data/com.android.providers.calendar/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.calendar/lib/
drwxrwx--x 10006/10006 0 2012-06-01 21:52 data/data/com.android.providers.calendar/databases/
-rw-rw---- 10006/10006 36864 2009-01-01 00:01 data/data/com.android.providers.calendar/databases/calendar.db
drwxrwx--x 10006/10006 0 2012-06-01 01:13 data/data/com.android.providers.calendar/shared_prefs/
-rw-rw---- 10006/10006 108 2012-06-01 01:13 data/data/com.android.providers.calendar/shared_prefs/CalendarUpgradeReceiver.xml
drwxr-x--x 10005/10005 0 2012-06-01 01:13 data/data/com.mediatek.calendarimporter/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.calendarimporter/lib/
drwxr-x--x 10004/10004 0 2014-04-06 16:29 data/data/com.android.calendar/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.calendar/lib/
drwxrwx--x 10004/10004 0 2014-04-06 17:03 data/data/com.android.calendar/shared_prefs/
-rw-rw---- 10004/10004 635 2014-04-06 17:03 data/data/com.android.calendar/shared_prefs/com.android.calendar_preferences.xml
-rw-rw---- 10004/10004 126 2014-04-06 16:29 data/data/com.android.calendar/shared_prefs/_has_set_default_values.xml
drwxr-x--x 10003/10003 0 2014-04-06 16:43 data/data/com.android.calculatorsun/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.calculatorsun/lib/
drwxrwx--x 10003/10003 0 2014-04-06 16:43 data/data/com.android.calculatorsun/files/
-rw-rw---- 10003/10003 16 2014-04-06 16:43 data/data/com.android.calculatorsun/files/calculator.data
drwxr-x--x 10002/10002 0 2014-04-06 14:28 data/data/com.android.browser/
drwxrwx--x 10002/10002 0 2014-04-06 23:47 data/data/com.android.browser/cache/
drwxrwx--x 10002/10002 0 2012-06-01 21:32 data/data/com.android.browser/cache/webviewCache/
-rw------- 10002/10002 3638 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/0d2d655a
-rw------- 10002/10002 11388 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/e38e3ac4
-rw------- 10002/10002 1927 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/001abb55
-rw------- 10002/10002 3271 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/8d7aba56
-rw------- 10002/10002 6067 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/c73ad169
-rw------- 10002/10002 2536 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/6453b8f6
-rw------- 10002/10002 325 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/34849d6a
-rw------- 10002/10002 2490 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/53c92bf4
-rw------- 10002/10002 4274 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/139e15cc
-rw------- 10002/10002 918 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/4b804cba
-rw------- 10002/10002 312 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/55b10ee8
-rw------- 10002/10002 2657 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/80f9d7d9
-rw------- 10002/10002 5418 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/ebc323c7
-rw------- 10002/10002 165 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/2fd4eb4f
-rw------- 10002/10002 50 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/252234e1
-rw------- 10002/10002 80146 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/926e4922
-rw------- 10002/10002 4777 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/3d1184fb
-rw------- 10002/10002 281 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/96b38b32
-rw------- 10002/10002 2414 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/2627365c
-rw------- 10002/10002 51 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/6c2e193c
-rw------- 10002/10002 7628 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/0d79f0f2
-rw------- 10002/10002 30873 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/d27f7aa5
-rw------- 10002/10002 2539 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/a98408e9
-rw------- 10002/10002 75 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/33f0a3da
-rw------- 10002/10002 2714 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/2e90316e
-rw------- 10002/10002 4482 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/aeaa28bb
-rw------- 10002/10002 2240 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/3dbf2bc7
-rw------- 10002/10002 28100 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/05824505
-rw------- 10002/10002 60 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/044527fb
-rw------- 10002/10002 5166 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/78c04cfa
-rw------- 10002/10002 50 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/8c960cf8
-rw------- 10002/10002 15690 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/06132372
-rw------- 10002/10002 40149 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/7daacc1c
-rw------- 10002/10002 206372 2014-04-06 17:01 data/data/com.android.browser/cache/webviewCache/69dcabf0
-rw------- 10002/10002 40166 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/9ef6630b
-rw------- 10002/10002 50 2014-04-06 16:56 data/data/com.android.browser/cache/webviewCache/3ee42df8
-rw------- 10002/10002 6626 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/77859a02
-rw------- 10002/10002 94840 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/b36b6dd3
-rw------- 10002/10002 41555 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/74fce48c
-rw------- 10002/10002 64642 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/431299da
-rw------- 10002/10002 6411 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/fdfbab2b
-rw------- 10002/10002 5389 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/87b3add8
-rw------- 10002/10002 72860 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/2498f4e9
-rw------- 10002/10002 8645 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/46c865f0
-rw------- 10002/10002 7931 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/6a2b37a8
-rw------- 10002/10002 52829 2014-04-06 17:01 data/data/com.android.browser/cache/webviewCache/5936f629
-rw------- 10002/10002 10083 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/e08c6f71
-rw------- 10002/10002 6323 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/78dc743a
-rw------- 10002/10002 5502 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/1a44cf79
-rw------- 10002/10002 96864 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/d4b2c873
-rw------- 10002/10002 44 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/733977b2
-rw------- 10002/10002 44 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/92fa9e90
-rw------- 10002/10002 8602 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/64a9d045
-rw------- 10002/10002 1673 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/c5ac4bb7
-rw------- 10002/10002 23535 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/6f984eef
-rw------- 10002/10002 1823 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/296a584b
-rw------- 10002/10002 2744 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/e5cd0861
-rw------- 10002/10002 8075 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/b4ab6bd8
-rw------- 10002/10002 117415 2014-04-06 16:50 data/data/com.android.browser/cache/webviewCache/8501a548
-rw------- 10002/10002 237 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/74004be9
-rw------- 10002/10002 2265 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/1bd14f7c
-rw------- 10002/10002 237 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/7353a04a
-rw------- 10002/10002 192065 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/828f2113
-rw------- 10002/10002 376 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/ca8dc40a
-rw------- 10002/10002 41972 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/703f5da5
-rw------- 10002/10002 381 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/cb3a6fa9
-rw------- 10002/10002 1150 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/48e1a1c8
-rw------- 10002/10002 1455 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/1cfff133
-rw------- 10002/10002 26756 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/1fd37782
-rw------- 10002/10002 29332 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/c3f40dbb
-rw------- 10002/10002 26736 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/1394f889
-rw------- 10002/10002 27600 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/60ae115e
-rw------- 10002/10002 237133 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/db78c145
-rw------- 10002/10002 2166 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/19e7b68a
-rw------- 10002/10002 178 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/e8932846
-rw------- 10002/10002 9626 2012-06-01 01:06 data/data/com.android.browser/cache/webviewCache/4fb4da93
-rw------- 10002/10002 178 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/c517be82
-rw------- 10002/10002 888 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/770eae09
-rw------- 10002/10002 237 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/abe50d23
-rw------- 10002/10002 178 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/e93fd3e5
-rw------- 10002/10002 178 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/c5c46a21
-rw------- 10002/10002 5430 2014-04-06 16:49 data/data/com.android.browser/cache/webviewCache/3d7c2041
-rw------- 10002/10002 768 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/02728544
-rw------- 10002/10002 808 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/031f30e3
-rw------- 10002/10002 186872 2014-04-06 16:49 data/data/com.android.browser/cache/webviewCache/54648178
-rw------- 10002/10002 268128 2012-06-01 01:06 data/data/com.android.browser/cache/webviewCache/42abb6f0
-rw------- 10002/10002 75583 2014-04-06 16:49 data/data/com.android.browser/cache/webviewCache/2d66964b
-rw------- 10002/10002 9813 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/4c8e3511
-rw------- 10002/10002 16217 2014-04-06 16:49 data/data/com.android.browser/cache/webviewCache/4d82ba01
-rw------- 10002/10002 330446 2014-04-06 16:49 data/data/com.android.browser/cache/webviewCache/ac79dcb6
-rw------- 10002/10002 237 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/ab386184
-rw------- 10002/10002 2077 2014-04-06 16:49 data/data/com.android.browser/cache/webviewCache/207ff6d2
-rw------- 10002/10002 321429 2012-06-01 01:06 data/data/com.android.browser/cache/webviewCache/a16b11a9
-rw------- 10002/10002 66810 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/e99457a2
-rw------- 10002/10002 1762 2014-04-06 16:49 data/data/com.android.browser/cache/webviewCache/9fd7d2ba
-rw------- 10002/10002 95 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/816ab5c5
-rw------- 10002/10002 108623 2014-04-06 16:49 data/data/com.android.browser/cache/webviewCache/61969b37
-rw------- 10002/10002 26161 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/5c960a1a
-rw------- 10002/10002 4210 2012-06-01 01:06 data/data/com.android.browser/cache/webviewCache/9ab1c366
-rw------- 10002/10002 894 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/a112be2e
-rw------- 10002/10002 546 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/ad32f2db
-rw------- 10002/10002 418 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/5e26ef36
-rw------- 10002/10002 16214 2012-06-01 01:06 data/data/com.android.browser/cache/webviewCache/5132e0c4
-rw------- 10002/10002 122 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/83d8a7ec
-rw------- 10002/10002 173066 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/8417310c
-rw------- 10002/10002 220 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/37fc44d7
-rw------- 10002/10002 14089 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/0482120b
-rw------- 10002/10002 247 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/46baf96d
-rw------- 10002/10002 4748 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/debcabee
-rw------- 10002/10002 14783 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/25a10c53
-rw------- 10002/10002 222 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/04d42ce2
-rw------- 10002/10002 35 2014-04-06 18:40 data/data/com.android.browser/cache/webviewCache/96b9931e
-rw------- 10002/10002 5314 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/a3afc608
-rw------- 10002/10002 150 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/b9ddccb1
-rw------- 10002/10002 67 2014-04-06 18:40 data/data/com.android.browser/cache/webviewCache/118c6753
-rw------- 10002/10002 2733 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/6deb5845
-rw------- 10002/10002 50 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/aee7e6b3
-rw------- 10002/10002 162 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/76c67f8d
-rw------- 10002/10002 2719 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/7d70a114
-rw------- 10002/10002 471 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/e8b39f68
-rw------- 10002/10002 58763 2014-04-06 18:40 data/data/com.android.browser/cache/webviewCache/3c83379e
-rw------- 10002/10002 2346 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/0c768867
-rw------- 10002/10002 5105 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/38263104
-rw------- 10002/10002 49218 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/815c519d
-rw------- 10002/10002 67 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/81d9e152
-rw------- 10002/10002 2109 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/2649792d
-rw------- 10002/10002 7200 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/afd3e376
-rw------- 10002/10002 1290 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/ad332301
-rw------- 10002/10002 403 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/a7c055a9
-rw------- 10002/10002 35 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/447f0ca3
-rw------- 10002/10002 4898 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/9b37d987
-rw------- 10002/10002 952 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/df6b2195
-rw------- 10002/10002 93085 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/0ba48d80
-rw------- 10002/10002 4764 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/4bad5aca
-rw------- 10002/10002 2527 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/b8617c9a
-rw------- 10002/10002 16982 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/a48acfc0
-rw------- 10002/10002 6355 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/b6216a99
-rw------- 10002/10002 395 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/7c51c6f4
-rw------- 10002/10002 62364 2014-04-06 18:39 data/data/com.android.browser/cache/webviewCache/19c88678
-rw------- 10002/10002 18956 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/e88b6da6
-rw------- 10002/10002 25397 2014-04-06 18:39 data/data/com.android.browser/cache/webviewCache/893a369a
-rw------- 10002/10002 35 2014-04-06 18:39 data/data/com.android.browser/cache/webviewCache/1f4904fb
-rw------- 10002/10002 131284 2012-06-01 01:06 data/data/com.android.browser/cache/webviewCache/af4459d3
-rw------- 10002/10002 67 2014-04-06 18:39 data/data/com.android.browser/cache/webviewCache/0e349493
-rw------- 10002/10002 402 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/a03ea3f1
-rw------- 10002/10002 78092 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/1812b01e
-rw------- 10002/10002 44195 2014-04-06 16:55 data/data/com.android.browser/cache/webviewCache/7d872fce
-rw------- 10002/10002 239410 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/fc62e103
-rw------- 10002/10002 78022 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/ca992fed
-rw------- 10002/10002 35 2014-04-06 18:39 data/data/com.android.browser/cache/webviewCache/ac86f2f5
-rw------- 10002/10002 67 2014-04-06 18:39 data/data/com.android.browser/cache/webviewCache/3cd26879
-rw------- 10002/10002 2030 2014-04-06 18:39 data/data/com.android.browser/cache/webviewCache/3d0b0310
-rw------- 10002/10002 35 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/34ac5f4b
-rw------- 10002/10002 3639 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/968c8e66
-rw------- 10002/10002 131171 2014-04-06 16:58 data/data/com.android.browser/cache/webviewCache/d2226960
-rw------- 10002/10002 67 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/de54db79
-rw------- 10002/10002 1735 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/f4a3fc5c
-rw------- 10002/10002 1172 2012-06-01 21:32 data/data/com.android.browser/cache/webviewCache/df6d7f4a
-rw------- 10002/10002 2481 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/eecb3b0d
-rw------- 10002/10002 3328 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/56fad9b7
-rw------- 10002/10002 2597 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/913119e4
-rw------- 10002/10002 2255 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/a0f349ad
-rw------- 10002/10002 2152 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/1cbaf6ca
-rw------- 10002/10002 2936 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/da747e23
-rw------- 10002/10002 3112 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/5210f7cb
-rw------- 10002/10002 2093 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/100e2e78
-rw------- 10002/10002 2856 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/0d73a9ac
-rw------- 10002/10002 35 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/90f5de33
-rw------- 10002/10002 2618 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/160fef93
-rw------- 10002/10002 2873 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/e734cbcb
-rw------- 10002/10002 1169 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/83b0719c
-rw------- 10002/10002 7416 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/fc2eaa4b
-rw------- 10002/10002 7752 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/99b45b66
-rw------- 10002/10002 5091 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/11069b34
-rw------- 10002/10002 2420 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/c6ac45f8
-rw------- 10002/10002 4854 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/615b915e
-rw------- 10002/10002 1322 2014-04-06 16:57 data/data/com.android.browser/cache/webviewCache/111c72f3
-rw------- 10002/10002 3140 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/4ae6a60b
-rw------- 10002/10002 6602 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/e75d60d3
-rw------- 10002/10002 2885 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/bdc93ced
-rw------- 10002/10002 7457 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/ed9c8eb2
-rw------- 10002/10002 20679 2014-04-06 16:57 data/data/com.android.browser/cache/webviewCache/81c0ad66
-rw------- 10002/10002 2193 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/7a33a846
-rw------- 10002/10002 6530 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/777e46dc
-rw------- 10002/10002 6195 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/f1fce19b
-rw------- 10002/10002 2598 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/35f466b7
-rw------- 10002/10002 1037 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/d2cae08e
-rw------- 10002/10002 67 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/6b004c05
-rw------- 10002/10002 5091 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/d1ea9869
-rw------- 10002/10002 731 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/f9e499db
-rw------- 10002/10002 15240 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/9cb6e7a5
-rw------- 10002/10002 6157 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/85579ea3
-rw------- 10002/10002 4526 2012-06-01 02:21 data/data/com.android.browser/cache/webviewCache/257d20a0
-rw------- 10002/10002 2375 2014-04-06 17:00 data/data/com.android.browser/cache/webviewCache/3511889a
drwxrwx--x 10002/10002 0 2012-06-01 21:32 data/data/com.android.browser/app_icons/
-rw-rw---- 10002/10002 18432 2012-06-01 21:32 data/data/com.android.browser/app_icons/WebpageIcons.db
drwxrwx--x 10002/10002 0 2014-04-06 14:28 data/data/com.android.browser/app_thumbnails/
drwxrwx--x 10002/10002 0 2014-04-06 17:02 data/data/com.android.browser/shared_prefs/
-rw-rw---- 10002/10002 118 2014-04-06 17:01 data/data/com.android.browser/shared_prefs/WebViewSettings.xml
-rw-rw---- 10002/10002 169 2014-04-06 17:02 data/data/com.android.browser/shared_prefs/com.android.browser_preferences.xml
drwxrwx--x 10002/10002 0 2014-04-06 14:28 data/data/com.android.browser/app_geolocation/
-rw-rw---- 10002/10002 0 2014-04-06 14:28 data/data/com.android.browser/app_geolocation/CachedGeoposition.db
drwxrwx--x 10002/10002 0 2014-04-06 14:28 data/data/com.android.browser/app_databases/
drwxrwx--- 10002/10002 0 2012-06-01 02:21 data/data/com.android.browser/app_databases/localstorage/
-rw------- 10002/10002 4096 2014-04-06 17:00 data/data/com.android.browser/app_databases/localstorage/http_www.reddit.com_0.localstorage
-rw------- 10002/10002 412672 2012-06-01 01:26 data/data/com.android.browser/app_databases/localstorage/http_www.google.com_0.localstorage
-rw------- 10002/10002 4096 2014-04-06 14:28 data/data/com.android.browser/app_databases/localstorage/http_sinfest.net_0.localstorage
-rw-rw---- 10002/10002 0 2014-04-06 14:28 data/data/com.android.browser/app_databases/Databases.db
drwxrwx--x 10002/10002 0 2014-04-06 14:28 data/data/com.android.browser/app_appcache/
-rw-rw---- 10002/10002 18432 2014-04-06 14:28 data/data/com.android.browser/app_appcache/ApplicationCache.db
drwxrwx--x 10002/10002 0 2012-06-01 21:35 data/data/com.android.browser/databases/
-rw-rw---- 10002/10002 12288 2012-06-01 21:32 data/data/com.android.browser/databases/browser.db
-rw-rw---- 10002/10002 126976 2012-06-01 21:32 data/data/com.android.browser/databases/webviewCache.db
-rw-rw---- 10002/10002 37888 2012-06-01 02:54 data/data/com.android.browser/databases/webview.db
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.browser/lib/
drwxr-x--x 10001/10001 0 2012-06-01 01:13 data/data/com.android.bluetooth/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.bluetooth/lib/
drwxr-x--x 10057/10057 0 2012-06-01 21:52 data/data/info.yeppp.cpuid/
drwxr-xr-x 1000/1000 0 2012-06-01 21:52 data/data/info.yeppp.cpuid/lib/
-rwxr-xr-x 1000/1000 70692 2013-03-01 22:22 data/data/info.yeppp.cpuid/lib/libyeppp.so
-rwxr-xr-x 1000/1000 37600 2013-03-01 22:22 data/data/info.yeppp.cpuid/lib/libyeppp-jni.so
drwxr-x--x 10000/10000 0 2012-06-01 01:13 data/data/com.android.providers.applications/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.applications/lib/
drwxr-x--x 1001/1001 0 2012-06-01 01:14 data/data/com.android.ActivityNetwork/
drwx------ 1001/1001 0 2012-06-01 01:14 data/data/com.android.ActivityNetwork/files/
-rw------- 1001/1001 197 2012-06-01 21:52 data/data/com.android.ActivityNetwork/files/NetworkingSetting
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.ActivityNetwork/lib/
drwxr-x--x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.subscribedfeeds/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.subscribedfeeds/lib/
drwxr-x--x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek/lib/
drwxr-x--x 10053/10053 0 2012-06-01 21:52 data/data/aws.apps.underthehood/
drwxr-xr-x 1000/1000 0 2012-06-01 21:52 data/data/aws.apps.underthehood/lib/
drwxr-x--x 1000/1000 0 2012-06-01 01:13 data/data/com.android.server.vpn/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.server.vpn/lib/
drwxr-x--x 10045/10045 0 2012-06-01 01:13 data/data/com.android.musicvis/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.musicvis/lib/
drwxr-x--x 10044/10044 0 2012-06-01 01:13 data/data/com.mediatek.videoplayer/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.videoplayer/lib/
drwxr-x--x 10000/10000 0 2012-06-01 01:13 data/data/com.android.providers.userdictionary/
drwxrwx--x 10000/10000 0 2012-06-01 01:13 data/data/com.android.providers.userdictionary/databases/
-rw-rw---- 10000/10000 4096 2012-06-01 01:13 data/data/com.android.providers.userdictionary/databases/user_dict.db
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.userdictionary/lib/
drwxr-x--x 10043/10043 0 2012-06-01 01:13 data/data/android.tts/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/android.tts/lib/
drwxr-x--x 10042/10042 0 2012-06-01 01:06 data/data/com.devuni.flashlight/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.devuni.flashlight/lib/
drwxrwx--x 10042/10042 0 2012-06-01 01:06 data/data/com.devuni.flashlight/cache/
drwxrwx--x 10042/10042 0 2012-06-01 01:06 data/data/com.devuni.flashlight/cache/webviewCache/
drwxrwx--x 10042/10042 0 2012-06-01 01:06 data/data/com.devuni.flashlight/databases/
-rw-rw---- 10042/10042 6144 2012-06-01 01:06 data/data/com.devuni.flashlight/databases/webviewCache.db
-rw-rw---- 10042/10042 14336 2012-06-01 01:06 data/data/com.devuni.flashlight/databases/webview.db
drwxrwx--x 10042/10042 0 2012-06-01 01:07 data/data/com.devuni.flashlight/shared_prefs/
-rw-rw---- 10042/10042 110 2012-06-01 01:07 data/data/com.devuni.flashlight/shared_prefs/w_com.devuni.flashlight.widgets.LEDWidget.xml
-rw-rw---- 10042/10042 182 2012-06-01 01:07 data/data/com.devuni.flashlight/shared_prefs/w_com.devuni.flashlight.widgets.MorseWidget.xml
-rw-rw---- 10042/10042 193 2012-06-01 01:07 data/data/com.devuni.flashlight/shared_prefs/w_com.devuni.flashlight.widgets.StrobeWidget.xml
-rw-rw---- 10042/10042 218 2012-06-01 01:06 data/data/com.devuni.flashlight/shared_prefs/w_com.devuni.flashlight.widgets.BulbWidget.xml
-rw-rw---- 10042/10042 111 2012-06-01 01:06 data/data/com.devuni.flashlight/shared_prefs/w_com.devuni.flashlight.widgets.WarningWidget.xml
-rw-rw---- 10042/10042 225 2012-06-01 01:06 data/data/com.devuni.flashlight/shared_prefs/w_com.devuni.flashlight.widgets.ColorWidget.xml
-rw-rw---- 10042/10042 182 2012-06-01 01:06 data/data/com.devuni.flashlight/shared_prefs/vPrefs_135_10_1_Nam-Phone_G40C_s822_zxd_d.xml
-rw-rw---- 10042/10042 106 2012-06-01 01:06 data/data/com.devuni.flashlight/shared_prefs/w_settings.xml
drwxrwx--x 10042/10042 0 2012-06-01 01:06 data/data/com.devuni.flashlight/files/
-rw------- 10042/10042 58 2012-06-01 01:07 data/data/com.devuni.flashlight/files/.flurryagent.75859e7c
drwxr-x--x 1001/1001 0 2012-06-01 01:13 data/data/com.android.providers.telephony/
drwxrwx--x 1001/1001 0 2012-06-01 21:52 data/data/com.android.providers.telephony/databases/
-rw-rw---- 1001/1001 13312 2012-06-01 01:00 data/data/com.android.providers.telephony/databases/telephony.db
-rw-rw---- 1001/1001 53248 2012-06-01 01:13 data/data/com.android.providers.telephony/databases/mmssms.db
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.telephony/lib/
drwxr-x--x 1000/1000 0 2012-06-01 01:13 data/data/com.android.systemui/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.systemui/lib/
drwxr-x--x 10041/10041 0 2012-06-01 01:13 data/data/com.mediatek.StkSelection/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.StkSelection/lib/
drwxr-x--x 1001/1001 0 2012-06-01 01:13 data/data/com.android.stk2/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.stk2/lib/
drwxr-x--x 1001/1001 0 2012-06-01 01:13 data/data/com.android.stk/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.stk/lib/
drwxr-x--x 10040/10040 0 2012-06-01 01:13 data/data/com.android.soundrecorder/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.soundrecorder/lib/
drwxr-x--x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.settings/
drwxrwx--x 1000/1000 0 2012-06-01 21:52 data/data/com.android.providers.settings/databases/
-rw-rw---- 1000/1000 36864 2012-06-01 21:52 data/data/com.android.providers.settings/databases/settings.db
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.settings/lib/
drwxr-x--x 1000/1000 0 2012-06-01 01:00 data/data/com.android.settings/
drwxrwx--x 1000/1000 0 2012-06-01 20:34 data/data/com.android.settings/databases/
-rw-rw---- 1000/1000 4096 2012-06-01 01:00 data/data/com.android.settings/databases/schpwrs.db
-rw-rw---- 1000/1000 5120 2014-04-06 16:40 data/data/com.android.settings/databases/themes.db
drwxrwx--x 1000/1000 0 2012-06-01 20:34 data/data/com.android.settings/shared_prefs/
-rw-rw---- 1000/1000 444 2012-06-01 20:34 data/data/com.android.settings/shared_prefs/PackageManagerReceiver.xml
-rw-rw---- 1000/1000 380 2012-06-18 01:28 data/data/com.android.settings/shared_prefs/com.android.settings_preferences.xml
-rw-rw---- 1000/1000 65 2014-04-06 14:48 data/data/com.android.settings/shared_prefs/dock_settings.xml
-rw-rw---- 1000/1000 65 2012-06-01 01:00 data/data/com.android.settings/shared_prefs/AlarmClock.xml
drwx------ 1000/1000 0 2012-06-01 01:13 data/data/com.android.settings/mtk/
drwx------ 1000/1000 0 2012-06-01 01:13 data/data/com.android.settings/files/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.settings/lib/
drwxr-x--x 1000/1000 0 2012-06-01 01:00 data/data/com.sunmontech.deskclock.jason.alarmclock/
drwxrwx--x 1000/1000 0 2012-06-01 01:00 data/data/com.sunmontech.deskclock.jason.alarmclock/databases/
-rw-rw---- 1000/1000 4096 2012-06-01 01:00 data/data/com.sunmontech.deskclock.jason.alarmclock/databases/alarms.db
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.sunmontech.deskclock.jason.alarmclock/lib/
drwxr-x--x 10039/10039 0 2014-04-06 17:02 data/data/com.android.quicksearchbox/
drwxrwx--x 10039/10039 0 2014-04-06 16:59 data/data/com.android.quicksearchbox/databases/
-rw-rw---- 10039/10039 15360 2014-04-06 16:59 data/data/com.android.quicksearchbox/databases/qsb-log.db
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.quicksearchbox/lib/
drwxrwx--x 10039/10039 0 2012-06-01 20:07 data/data/com.android.quicksearchbox/shared_prefs/
-rw-rw---- 10039/10039 521 2012-06-01 20:07 data/data/com.android.quicksearchbox/shared_prefs/SearchSettings.xml
-rw-rw---- 10039/10039 125 2012-06-01 20:07 data/data/com.android.quicksearchbox/shared_prefs/SearchWidgetConfig.xml
-rw-rw---- 10039/10039 174 2014-04-06 17:02 data/data/com.android.quicksearchbox/shared_prefs/com.android.quicksearchbox_preferences.xml
drwxr-x--x 10038/10038 0 2012-06-01 01:13 data/data/com.android.provision/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.provision/lib/
drwxr-x--x 10052/10052 0 2012-06-01 21:52 data/data/aws.apps.networkInfoIi/
drwxr-xr-x 1000/1000 0 2012-06-01 21:52 data/data/aws.apps.networkInfoIi/lib/
drwxrwx--x 10052/10052 0 2014-04-06 18:51 data/data/aws.apps.networkInfoIi/shared_prefs/
-rw-rw---- 10052/10052 126 2014-04-06 18:51 data/data/aws.apps.networkInfoIi/shared_prefs/_has_set_default_values.xml
-rw-rw---- 10052/10052 459 2014-04-06 18:51 data/data/aws.apps.networkInfoIi/shared_prefs/aws.apps.networkInfoIi_preferences.xml
drwxr-x--x 10037/10037 0 2012-06-01 01:13 data/data/com.android.protips/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.protips/lib/
drwxr-x--x 10036/10036 0 2014-04-06 14:30 data/data/com.android.vending/
drwxrwx--x 10036/10036 0 2012-06-01 22:13 data/data/com.android.vending/shared_prefs/
-rw-rw---- 10036/10036 887 2012-06-01 22:13 data/data/com.android.vending/shared_prefs/finsky.xml
-rw-rw---- 10036/10036 219 2014-04-06 14:34 data/data/com.android.vending/shared_prefs/com.android.vending_preferences.xml
-rw-rw---- 10036/10036 2467 2014-04-06 14:30 data/data/com.android.vending/shared_prefs/billing_preferences.xml
-rw-rw---- 10036/10036 1887 2014-04-06 21:09 data/data/com.android.vending/shared_prefs/vending_preferences.xml
drwxrwx--x 10036/10036 0 2012-06-01 22:13 data/data/com.android.vending/databases/
-rw-rw---- 10036/10036 16384 2014-07-07 22:00 data/data/com.android.vending/databases/library.db
-rw-rw---- 10036/10036 17408 2014-07-07 23:08 data/data/com.android.vending/databases/localappstate.db
-rw-rw---- 10036/10036 5120 2014-04-06 23:47 data/data/com.android.vending/databases/suggestions.db
drwxrwx--x 10036/10036 0 2012-06-01 01:01 data/data/com.android.vending/app_carrier_billing/
drwxrwx--x 10036/10036 0 2014-04-06 14:31 data/data/com.android.vending/app_sslcache/
-rw------- 10036/10036 5792 2014-07-07 23:08 data/data/com.android.vending/app_sslcache/android.clients.google.com.443
-rw------- 10036/10036 5208 2014-04-06 23:47 data/data/com.android.vending/app_sslcache/lh5.ggpht.com.443
-rw------- 10036/10036 5208 2014-04-06 23:47 data/data/com.android.vending/app_sslcache/lh3.ggpht.com.443
-rw------- 10036/10036 5208 2014-04-06 23:47 data/data/com.android.vending/app_sslcache/lh6.ggpht.com.443
-rw------- 10036/10036 5208 2014-04-06 23:47 data/data/com.android.vending/app_sslcache/lh4.ggpht.com.443
-rw------- 10036/10036 5792 2014-04-06 23:47 data/data/com.android.vending/app_sslcache/market.android.com.443
drwxrwx--x 10036/10036 0 2014-04-06 23:47 data/data/com.android.vending/cache/
-rw------- 10036/10036 1540 2014-04-06 17:06 data/data/com.android.vending/cache/thmb_com.myfitnesspal.android
-rw------- 10036/10036 3691 2014-04-06 23:47 data/data/com.android.vending/cache/thmb_com.cpuid.cpu_z
-rw------- 10036/10036 4932 2014-04-06 15:00 data/data/com.android.vending/cache/thmb_com.keramidas.TitaniumBackup
-rw------- 10036/10036 2715 2014-04-06 21:16 data/data/com.android.vending/cache/thmb_jackpal.androidterm
-rw------- 10036/10036 4406 2014-04-06 17:08 data/data/com.android.vending/cache/thmb_lysesoft.andftp
drwx------ 10036/10036 0 2014-04-07 20:35 data/data/com.android.vending/cache/images/
drwx------ 10036/10036 0 2014-07-09 00:28 data/data/com.android.vending/cache/main/
-rw------- 10036/10036 4463 2014-04-06 16:47 data/data/com.android.vending/cache/thmb_org.mozilla.firefox
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.vending/lib/
drwxrwx--x 10036/10036 0 2014-04-06 14:30 data/data/com.android.vending/app_widgets/
drwxr-x--x 10035/10035 0 2012-06-01 01:13 data/data/com.svox.pico/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.svox.pico/lib/
drwxr-x--x 10056/10056 0 2012-06-01 21:52 data/data/jackpal.androidterm/
drwxr-xr-x 1000/1000 0 2012-06-01 21:52 data/data/jackpal.androidterm/lib/
-rwxr-xr-x 1000/1000 17612 2014-03-30 12:48 data/data/jackpal.androidterm/lib/libjackpal-androidterm4.so
drwxrwx--x 10056/10056 0 2012-06-01 01:27 data/data/jackpal.androidterm/shared_prefs/
-rw-rw---- 10056/10056 847 2012-06-01 01:27 data/data/jackpal.androidterm/shared_prefs/jackpal.androidterm_preferences.xml
drwxrwx--x 10056/10056 0 2014-04-06 21:17 data/data/jackpal.androidterm/app_HOME/
drwxr-x--x 1001/1001 0 2012-06-01 01:00 data/data/com.android.phone/
drwx------ 1001/1001 0 2012-06-01 21:52 data/data/com.android.phone/minilog/
drwx------ 1001/1001 0 2012-06-01 21:52 data/data/com.android.phone/minilog/out_06-01_21-52-26-307/
-rw------- 0/0 10240 2012-06-01 21:52 data/data/com.android.phone/minilog/out_06-01_21-52-26-307/MT71_000.dmp
-rw------- 1001/1001 0 2012-06-01 21:52 data/data/com.android.phone/minilog/out_06-01_21-52-26-307/mini.log
drwx------ 1001/1001 0 2014-05-05 17:58 data/data/com.android.phone/minilog/out_05-05_17-58-02-513/
-rw------- 0/0 10240 2014-05-05 17:58 data/data/com.android.phone/minilog/out_05-05_17-58-02-513/MT71_000.dmp
-rw------- 1001/1001 0 2014-05-05 17:58 data/data/com.android.phone/minilog/out_05-05_17-58-02-513/mini.log
drwx------ 1001/1001 0 2014-07-20 10:10 data/data/com.android.phone/minilog/out_07-20_10-10-03-558/
-rw------- 0/0 10240 2014-07-20 10:10 data/data/com.android.phone/minilog/out_07-20_10-10-03-558/MT71_000.dmp
-rw------- 1001/1001 0 2014-07-20 10:10 data/data/com.android.phone/minilog/out_07-20_10-10-03-558/mini.log
drwx------ 1001/1001 0 2014-07-09 00:28 data/data/com.android.phone/minilog/out_07-09_00-28-20-680/
-rw------- 0/0 10240 2014-07-09 00:28 data/data/com.android.phone/minilog/out_07-09_00-28-20-680/MT71_000.dmp
-rw------- 1001/1001 0 2014-07-09 00:28 data/data/com.android.phone/minilog/out_07-09_00-28-20-680/mini.log
drwx------ 1001/1001 0 2014-04-07 20:35 data/data/com.android.phone/minilog/out_04-07_20-35-23-867/
-rw------- 0/0 10240 2014-04-07 20:35 data/data/com.android.phone/minilog/out_04-07_20-35-23-867/MT71_000.dmp
-rw------- 1001/1001 0 2014-04-07 20:35 data/data/com.android.phone/minilog/out_04-07_20-35-23-867/mini.log
drwx------ 1001/1001 0 2014-07-16 00:11 data/data/com.android.phone/minilog/out_07-16_00-11-00-720/
-rw------- 0/0 10240 2014-07-16 00:11 data/data/com.android.phone/minilog/out_07-16_00-11-00-720/MT71_000.dmp
-rw------- 1001/1001 0 2014-07-16 00:11 data/data/com.android.phone/minilog/out_07-16_00-11-00-720/mini.log
drwx------ 1001/1001 0 2014-07-19 22:26 data/data/com.android.phone/minilog/out_07-19_22-26-58-811/
-rw------- 0/0 10240 2014-07-19 22:26 data/data/com.android.phone/minilog/out_07-19_22-26-58-811/MT71_000.dmp
-rw------- 1001/1001 0 2014-07-19 22:26 data/data/com.android.phone/minilog/out_07-19_22-26-58-811/mini.log
drwx------ 1001/1001 0 2014-04-06 23:47 data/data/com.android.phone/minilog/out_04-06_23-47-19-555/
-rw------- 0/0 10240 2014-04-06 23:47 data/data/com.android.phone/minilog/out_04-06_23-47-19-555/MT71_000.dmp
-rw------- 1001/1001 0 2014-04-06 23:47 data/data/com.android.phone/minilog/out_04-06_23-47-19-555/mini.log
drwx------ 1001/1001 0 2014-04-06 22:17 data/data/com.android.phone/minilog/out_04-06_22-17-43-587/
-rw------- 0/0 10240 2014-04-06 22:17 data/data/com.android.phone/minilog/out_04-06_22-17-43-587/MT71_000.dmp
-rw------- 1001/1001 0 2014-04-06 22:17 data/data/com.android.phone/minilog/out_04-06_22-17-43-587/mini.log
drwx------ 1001/1001 0 2014-07-13 14:14 data/data/com.android.phone/minilog/out_07-13_14-14-58-605/
-rw------- 0/0 10240 2014-07-13 14:14 data/data/com.android.phone/minilog/out_07-13_14-14-58-605/MT71_000.dmp
-rw------- 1001/1001 0 2014-07-13 14:14 data/data/com.android.phone/minilog/out_07-13_14-14-58-605/mini.log
drwx------ 1001/1001 0 2014-04-06 21:54 data/data/com.android.phone/minilog/out_04-06_21-54-54-745/
-rw------- 0/0 10240 2014-04-06 21:54 data/data/com.android.phone/minilog/out_04-06_21-54-54-745/MT71_000.dmp
-rw------- 1001/1001 0 2014-04-06 21:54 data/data/com.android.phone/minilog/out_04-06_21-54-54-745/mini.log
drwx------ 1001/1001 0 2014-04-06 22:43 data/data/com.android.phone/minilog/out_04-06_22-43-40-446/
-rw------- 0/0 10240 2014-04-06 22:43 data/data/com.android.phone/minilog/out_04-06_22-43-40-446/MT71_000.dmp
-rw------- 1001/1001 0 2014-04-06 22:43 data/data/com.android.phone/minilog/out_04-06_22-43-40-446/mini.log
drwx------ 1001/1001 0 2014-04-07 21:11 data/data/com.android.phone/minilog/out_04-07_21-11-28-066/
-rw------- 0/0 10240 2014-04-07 21:11 data/data/com.android.phone/minilog/out_04-07_21-11-28-066/MT71_000.dmp
-rw------- 1001/1001 0 2014-04-07 21:11 data/data/com.android.phone/minilog/out_04-07_21-11-28-066/mini.log
drwx------ 1001/1001 0 2014-05-24 15:33 data/data/com.android.phone/minilog/out_05-24_15-33-19-696/
-rw------- 0/0 10240 2014-05-24 15:33 data/data/com.android.phone/minilog/out_05-24_15-33-19-696/MT71_000.dmp
-rw------- 1001/1001 0 2014-05-24 15:33 data/data/com.android.phone/minilog/out_05-24_15-33-19-696/mini.log
drwx------ 1001/1001 0 2014-07-07 22:00 data/data/com.android.phone/minilog/out_07-07_22-00-00-609/
-rw------- 0/0 10240 2014-07-07 22:00 data/data/com.android.phone/minilog/out_07-07_22-00-00-609/MT71_000.dmp
-rw------- 1001/1001 0 2014-07-07 22:00 data/data/com.android.phone/minilog/out_07-07_22-00-00-609/mini.log
drwx------ 1001/1001 0 2014-07-15 20:38 data/data/com.android.phone/minilog/out_07-15_20-38-26-576/
-rw------- 0/0 10240 2014-07-15 20:38 data/data/com.android.phone/minilog/out_07-15_20-38-26-576/MT71_000.dmp
-rw------- 1001/1001 0 2014-07-15 20:38 data/data/com.android.phone/minilog/out_07-15_20-38-26-576/mini.log
drwx------ 1001/1001 0 2014-07-07 23:07 data/data/com.android.phone/minilog/out_07-07_23-07-22-968/
-rw------- 0/0 10240 2014-07-07 23:07 data/data/com.android.phone/minilog/out_07-07_23-07-22-968/MT71_000.dmp
-rw------- 1001/1001 0 2014-07-07 23:07 data/data/com.android.phone/minilog/out_07-07_23-07-22-968/mini.log
drwx------ 1001/1001 0 2014-07-20 09:39 data/data/com.android.phone/minilog/out_07-20_09-39-02-462/
-rw------- 0/0 10240 2014-07-20 09:39 data/data/com.android.phone/minilog/out_07-20_09-39-02-462/MT71_000.dmp
-rw------- 1001/1001 0 2014-07-20 09:39 data/data/com.android.phone/minilog/out_07-20_09-39-02-462/mini.log
drwx------ 1001/1001 0 2014-07-19 22:14 data/data/com.android.phone/minilog/out_07-19_22-14-39-506/
-rw------- 0/0 10240 2014-07-19 22:14 data/data/com.android.phone/minilog/out_07-19_22-14-39-506/MT71_000.dmp
-rw------- 1001/1001 0 2014-07-19 22:14 data/data/com.android.phone/minilog/out_07-19_22-14-39-506/mini.log
drwx------ 1001/1001 0 2014-04-06 21:56 data/data/com.android.phone/minilog/out_04-06_21-56-02-973/
-rw------- 0/0 10240 2014-04-06 21:56 data/data/com.android.phone/minilog/out_04-06_21-56-02-973/MT71_000.dmp
-rw------- 1001/1001 0 2014-04-06 21:56 data/data/com.android.phone/minilog/out_04-06_21-56-02-973/mini.log
drwxrwx--x 1001/1001 0 2014-04-06 16:51 data/data/com.android.phone/shared_prefs/
-rw-rw---- 1001/1001 115 2014-04-06 16:51 data/data/com.android.phone/shared_prefs/com.android.phone_preferences.xml
-rw-rw---- 1001/1001 126 2012-06-01 01:13 data/data/com.android.phone/shared_prefs/_has_set_default_values.xml
-rw-rw---- 1001/1001 65 2014-04-06 14:40 data/data/com.android.phone/shared_prefs/RADIO_STATUS.xml
drwxrwx--x 1001/1001 0 2012-06-01 01:00 data/data/com.android.phone/files/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.phone/lib/
drwxr-x--x 10034/10034 0 2012-06-01 17:35 data/data/srclib.huyanwei.permissiongrant/
drwxrwx--x 10034/10034 0 2012-06-01 17:35 data/data/srclib.huyanwei.permissiongrant/databases/
-rw-rw---- 10034/10034 9216 2012-06-01 17:35 data/data/srclib.huyanwei.permissiongrant/databases/permissiongrant.sqlite
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/srclib.huyanwei.permissiongrant/lib/
drwxr-x--x 10033/10033 0 2012-06-01 01:13 data/data/com.android.packageinstaller/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.packageinstaller/lib/
drwxr-x--x 10027/10027 0 2012-06-01 01:00 data/data/com.mediatek.omacp/
drwxrwx--x 10027/10027 0 2012-06-01 01:00 data/data/com.mediatek.omacp/databases/
-rw-rw---- 10027/10027 4096 2012-06-01 01:00 data/data/com.mediatek.omacp/databases/omacp.db
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.omacp/lib/
drwxr-x--x 10032/10032 0 2012-06-01 01:13 data/data/com.android.music/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.music/lib/
drwxr-x--x 10031/10031 0 2012-06-01 01:13 data/data/com.mediatek.launcher.wallpaper/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.launcher.wallpaper/lib/
drwxr-x--x 10030/10030 0 2012-06-01 01:13 data/data/com.mediatek.wallpaper/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.wallpaper/lib/
drwxr-x--x 10046/10046 0 2012-06-01 21:52 data/data/com.cpuid.cpu_z/
drwxr-xr-x 1000/1000 0 2012-06-01 21:52 data/data/com.cpuid.cpu_z/lib/
-rwxr-xr-x 1000/1000 13384 2014-01-14 15:37 data/data/com.cpuid.cpu_z/lib/libcpuid.so
drwxrwx--x 10046/10046 0 2014-07-15 21:08 data/data/com.cpuid.cpu_z/shared_prefs/
-rw-rw---- 10046/10046 300 2014-07-15 21:08 data/data/com.cpuid.cpu_z/shared_prefs/CPUZ_SETTINGS.xml
drwxrwx--x 10046/10046 0 2014-07-09 00:28 data/data/com.cpuid.cpu_z/databases/
-rw-rw---- 10046/10046 20480 2014-07-09 00:28 data/data/com.cpuid.cpu_z/databases/webviewCache.db
-rw-rw---- 10046/10046 14336 2014-04-06 14:32 data/data/com.cpuid.cpu_z/databases/webview.db
drwxrwx--x 10046/10046 0 2014-07-15 21:07 data/data/com.cpuid.cpu_z/cache/
drwxrwx--x 10046/10046 0 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/
-rw------- 10046/10046 25144 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/7b310abb
-rw------- 10046/10046 26612 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/0e14c8e2
-rw------- 10046/10046 432022 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/8e929841
-rw------- 10046/10046 445381 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/c19a99da
-rw------- 10046/10046 163 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/0eb13b07
-rw------- 10046/10046 538 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/69308ec6
-rw------- 10046/10046 452 2014-07-09 00:28 data/data/com.cpuid.cpu_z/cache/webviewCache/e9634146
-rw------- 10046/10046 316499 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/a9acac08
-rw------- 10046/10046 418369 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/419ffee6
-rw------- 10046/10046 6871 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/89e08aa5
-rw------- 10046/10046 300191 2014-04-06 17:09 data/data/com.cpuid.cpu_z/cache/webviewCache/087444bb
-rw------- 10046/10046 46958 2014-04-06 17:09 data/data/com.cpuid.cpu_z/cache/webviewCache/60fe2e03
-rw------- 10046/10046 906 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/8c181d5c
-rw------- 10046/10046 85537 2014-04-06 17:09 data/data/com.cpuid.cpu_z/cache/webviewCache/0f66d051
-rw------- 10046/10046 258938 2014-04-06 17:09 data/data/com.cpuid.cpu_z/cache/webviewCache/1fa6e6f2
-rw------- 10046/10046 93179 2014-04-06 17:09 data/data/com.cpuid.cpu_z/cache/webviewCache/12287dfb
-rw------- 10046/10046 266223 2014-04-06 17:09 data/data/com.cpuid.cpu_z/cache/webviewCache/61b46a9a
-rw------- 10046/10046 2771 2014-04-06 17:09 data/data/com.cpuid.cpu_z/cache/webviewCache/aae3a0ef
-rw------- 10046/10046 198547 2014-04-06 17:09 data/data/com.cpuid.cpu_z/cache/webviewCache/c188b9b0
-rw------- 10046/10046 58662 2014-04-06 17:09 data/data/com.cpuid.cpu_z/cache/webviewCache/fceea475
-rw------- 10046/10046 51851 2014-04-06 14:32 data/data/com.cpuid.cpu_z/cache/webviewCache/9775e180
-rw------- 10046/10046 92624 2014-04-06 14:32 data/data/com.cpuid.cpu_z/cache/webviewCache/da4e7125
-rw------- 10046/10046 114356 2014-04-06 14:32 data/data/com.cpuid.cpu_z/cache/webviewCache/c465823d
-rw------- 10046/10046 128745 2014-04-06 14:32 data/data/com.cpuid.cpu_z/cache/webviewCache/5bc3866d
-rw------- 10046/10046 7592 2014-04-06 14:32 data/data/com.cpuid.cpu_z/cache/webviewCache/e84f353e
-rw------- 10046/10046 291 2014-04-06 14:32 data/data/com.cpuid.cpu_z/cache/webviewCache/a3cfc191
-rw------- 10046/10046 432 2014-04-06 14:32 data/data/com.cpuid.cpu_z/cache/webviewCache/8e2a3eff
-rw------- 10046/10046 132 2014-04-06 14:32 data/data/com.cpuid.cpu_z/cache/webviewCache/05fed225
-rw------- 10046/10046 1817 2014-04-06 14:32 data/data/com.cpuid.cpu_z/cache/webviewCache/aa5058dc
-rw------- 10046/10046 170180 2014-07-07 23:08 data/data/com.cpuid.cpu_z/cache/webviewCache/e92f4f01
-rw------- 10046/10046 109193 2014-07-09 00:28 data/data/com.cpuid.cpu_z/cache/webviewCache/3e5e51cb
drwxr-x--x 10029/10029 0 2014-04-06 14:48 data/data/com.mediatek.bluetooth/
drwxrwx--x 10029/10029 0 2014-04-06 14:48 data/data/com.mediatek.bluetooth/shared_prefs/
-rw-rw---- 10029/10029 171 2014-04-06 14:48 data/data/com.mediatek.bluetooth/shared_prefs/simap_server_settings.xml
drwxrwx--x 10029/10029 0 2014-04-06 18:26 data/data/com.mediatek.bluetooth/databases/
-rw-rw---- 10029/10029 4096 2014-04-06 14:48 data/data/com.mediatek.bluetooth/databases/share.db
-rw-rw---- 10029/10029 4096 2014-04-06 16:54 data/data/com.mediatek.bluetooth/databases/prxm.db
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.bluetooth/lib/
drwxr-x--x 10028/10028 0 2012-06-01 01:13 data/data/com.mediatek.apst.target/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.apst.target/lib/
drwxr-x--x 1001/1001 0 2012-06-01 01:00 data/data/com.mediatek.mobilelog/
drwx------ 1001/1001 0 2012-06-01 01:00 data/data/com.mediatek.mobilelog/files/
-rw------- 1001/1001 330 2012-06-01 01:00 data/data/com.mediatek.mobilelog/files/MobileLogSettings.xml
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.mediatek.mobilelog/lib/
drwxr-x--x 10027/10027 0 2012-06-01 01:00 data/data/com.android.mms/
drwxrwx--x 10027/10027 0 2014-04-06 16:54 data/data/com.android.mms/shared_prefs/
-rw-rw---- 10027/10027 126 2012-06-01 01:00 data/data/com.android.mms/shared_prefs/_has_set_default_values.xml
-rw-rw---- 10027/10027 685 2014-04-06 16:54 data/data/com.android.mms/shared_prefs/com.android.mms_preferences.xml
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.mms/lib/
drwxr-x--x 10026/10026 0 2012-06-01 01:13 data/data/com.android.networklocationservice/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.networklocationservice/lib/
drwxr-x--x 10010/10010 0 2012-06-01 01:00 data/data/com.android.providers.media/
drwxrwx--x 10010/10010 0 2012-06-01 17:03 data/data/com.android.providers.media/databases/
-rw-rw---- 10010/10010 59392 2012-06-01 01:00 data/data/com.android.providers.media/databases/internal.db
-rw-rw---- 10010/10010 43008 2012-06-01 21:52 data/data/com.android.providers.media/databases/external-482d9689.db
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.providers.media/lib/
drwxr-x--x 10025/10025 0 2012-06-01 01:13 data/data/com.android.magicsmoke/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.magicsmoke/lib/
drwxr-x--x 10024/10024 0 2012-06-01 01:13 data/data/com.android.wallpaper.livepicker/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.wallpaper.livepicker/lib/
drwxr-x--x 10023/10023 0 2012-06-01 01:13 data/data/com.android.wallpaper/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.wallpaper/lib/
drwxr-x--x 10022/10022 0 2012-06-01 01:00 data/data/com.android.launcher/
drwxrwx--x 10022/10022 0 2012-06-01 01:13 data/data/com.android.launcher/files/
-rw-rw---- 10022/10022 15 2012-06-01 01:13 data/data/com.android.launcher/files/launcher.preferences
drwxrwx--x 10022/10022 0 2012-06-01 20:43 data/data/com.android.launcher/databases/
-rw-rw---- 10022/10022 7168 2012-06-01 20:43 data/data/com.android.launcher/databases/launcherics.db
drwxrwx--x 10022/10022 0 2014-04-06 14:55 data/data/com.android.launcher/shared_prefs/
-rw-rw---- 10022/10022 184 2014-04-06 14:55 data/data/com.android.launcher/shared_prefs/com.android.Launcher.prefs.xml
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.launcher/lib/
drwxr-x--x 10021/10021 0 2014-04-06 16:53 data/data/com.android.inputmethod.latin/
drwxrwx--x 10021/10021 0 2012-06-01 01:13 data/data/com.android.inputmethod.latin/databases/
-rw-rw---- 10021/10021 4096 2012-06-01 01:13 data/data/com.android.inputmethod.latin/databases/auto_dict.db
-rw-rw---- 10021/10021 5120 2012-06-01 01:13 data/data/com.android.inputmethod.latin/databases/userbigram_dict.db
drwxrwx--x 10021/10021 0 2014-04-06 16:54 data/data/com.android.inputmethod.latin/shared_prefs/
-rw-rw---- 10021/10021 515 2014-04-06 16:54 data/data/com.android.inputmethod.latin/shared_prefs/com.android.inputmethod.latin_preferences.xml
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.inputmethod.latin/lib/
drwxr-x--x 10020/10020 0 2012-06-01 01:13 data/data/com.android.htmlviewer/
drwxr-xr-x 1000/1000 0 2012-06-01 01:13 data/data/com.android.htmlviewer/lib/
drwxrwx--x 2000/2000 0 2012-06-01 21:52 data/local/
drwxrwx--x 2000/2000 0 2012-06-01 21:52 data/local/tmp/
drwxrwx--- 0/0 0 2012-06-01 01:13 data/lost+found/
drwxrwx--t 1000/9998 0 2012-06-01 01:13 data/misc/
drwxr-xr-x 0/9997 0 2012-06-01 01:13 data/misc/touchpanel/
-rw-rw---- 0/2002 16 2009-01-02 07:45 data/misc/touchpanel/calibration
drwxr-x--- 1000/1000 0 2012-06-01 21:52 data/misc/stp_dump/
drwxrwxrwx 0/0 0 2012-06-01 01:13 data/misc/ppp/
drwxrwxrwx 1008/1008 0 2012-06-01 01:13 data/misc/akmd/
drwxrwxrwx 1000/1000 0 2012-06-01 01:13 data/misc/sensors/
drwxrwx--- 1000/1000 0 2014-04-06 14:28 data/misc/rtc/
-rw-rw-rw- 1000/1000 4 2014-04-09 20:56 data/misc/rtc/deltat
drwxr-x--- 1010/1010 0 2012-06-01 21:52 data/misc/wpa_supplicant/
-rw------- 2000/2000 27 2012-06-01 01:13 data/misc/xlog-filter
drwxrwx--- 1014/1014 0 2012-06-01 22:21 data/misc/dhcp/
-r-------- 1014/1014 298 2012-06-01 22:21 data/misc/dhcp/dhcpcd-wlan0.lease
-rw-r--r-- 1014/1014 0 2012-06-01 20:38 data/misc/dhcp/dhcpcd-wlan0.pid
drwxrwx--- 1010/1010 0 2012-06-01 01:01 data/misc/wifi/
-rw-rw---- 1000/1010 435 2014-04-06 16:18 data/misc/wifi/wpa_supplicant.conf
drwxrwx--- 1010/1010 0 2012-06-01 21:52 data/misc/wifi/sockets/
drwx------ 1000/1000 0 2012-06-01 01:13 data/misc/systemkeys/
drwxrwx--- 1000/1000 0 2012-06-01 01:13 data/misc/vpn/
drwxrwx--- 1000/1000 0 2012-06-01 01:13 data/misc/vpn/profiles/
drwx------ 1017/1017 0 2012-06-01 01:13 data/misc/keystore/
drwxrwx--- 1000/1000 0 2012-06-01 01:13 data/misc/bluetooth/
drwxrwx--- 1002/1002 0 2012-06-01 01:13 data/misc/bluetoothd/
drwxrwx--- 0/9997 0 2012-06-01 01:13 data/nvram/
-rw-rw---- 0/9997 4 2012-06-01 01:13 data/nvram/RestoreFlag
drwxrwx--- 0/9997 0 2012-06-01 01:13 data/nvram/APCFG/
drwxrwx--- 0/9997 0 2014-07-20 11:44 data/nvram/APCFG/APRDCL/
-rw-rw---- 0/9997 530 2012-06-01 01:13 data/nvram/APCFG/APRDCL/Headphone_CompFlt
-rw-rw---- 0/9997 530 2012-06-01 01:13 data/nvram/APCFG/APRDCL/Audio_CompFlt
-rw-rw---- 0/9997 170 2012-06-01 01:13 data/nvram/APCFG/APRDCL/Audio_Vol_custom
-rw-rw---- 0/9997 2418 2012-06-01 01:13 data/nvram/APCFG/APRDCL/Audio_Wb_Sph
-rw-rw---- 0/9997 1446 2012-06-01 01:13 data/nvram/APCFG/APRDCL/Audio_Sph
-rw-rw---- 0/9997 78 2012-06-01 21:52 data/nvram/APCFG/APRDCL/AUXADC
-rw-rw---- 0/9997 14 2012-06-01 01:13 data/nvram/APCFG/APRDCL/HWMON_ACC
-rw-rw---- 0/9997 2294 2014-07-20 11:44 data/nvram/APCFG/APRDCL/FILE_VER
-rw-rw---- 0/9997 59488 2014-07-20 11:44 data/nvram/APCFG/APRDCL/CAMERA_DEFECT
-rw-rw---- 0/9997 163840 2014-07-20 11:44 data/nvram/APCFG/APRDCL/CAMERA_SHADING
-rw-rw---- 0/9997 20480 2014-07-20 11:44 data/nvram/APCFG/APRDCL/CAMERA_Para
drwxrwx--- 0/9997 0 2012-06-01 01:13 data/nvram/APCFG/APRDEB/
-rw-rw---- 0/9997 18 2012-06-01 01:13 data/nvram/APCFG/APRDEB/OMADM_USB
-rw-rw---- 0/9997 32 2012-06-01 21:52 data/nvram/APCFG/APRDEB/BT_Addr
-rw-rw---- 0/9997 1026 2012-06-01 01:13 data/nvram/APCFG/APRDEB/PRODUCT_INFO
-rw-rw---- 0/9997 514 2012-06-01 01:13 data/nvram/APCFG/APRDEB/WIFI
-rw-rw---- 0/9997 6 2012-06-01 01:13 data/nvram/APCFG/APRDEB/WIFI_CUSTOM
drwxr-xr-x 0/0 0 2012-06-01 01:13 data/nvram/dm/
drwx------ 0/0 0 2012-06-01 01:13 data/nvram/md/
drwxrwx--- 0/9997 0 2012-06-01 01:13 data/nvram/md/NVRAM/
d--------- 0/0 0 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_CORE/
---------- 0/0 36 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_CORE/MT00B000
---------- 0/0 36 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_CORE/MT00A000
---------- 0/0 36 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_CORE/MT01_000
---------- 0/0 36 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_CORE/MT01_001
---------- 0/0 4 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_CORE/MT02_001
---------- 0/0 144 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_CORE/NV01B000
---------- 0/0 144 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_CORE/NV01A000
d--------- 0/0 0 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/
---------- 0/0 5140 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT03_000
---------- 0/0 1050 2009-01-01 00:01 data/nvram/md/NVRAM/NVD_DATA/MT04_000
---------- 0/0 514 2012-06-01 21:52 data/nvram/md/NVRAM/NVD_DATA/MT0W_000
---------- 0/0 16 2014-07-20 11:45 data/nvram/md/NVRAM/NVD_DATA/MT0X_000
---------- 0/0 1564 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT0Y_002
---------- 0/0 38 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/CT04_004
---------- 0/0 18 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT17_005
---------- 0/0 1440 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT18_000
---------- 0/0 18 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT19_000
---------- 0/0 2002 2014-07-20 11:45 data/nvram/md/NVRAM/NVD_DATA/MT1A_007
---------- 0/0 442 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT67_003
---------- 0/0 242 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT68_000
---------- 0/0 218 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT69_001
---------- 0/0 185 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6A_000
---------- 0/0 1942 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6B_000
---------- 0/0 50 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6D_000
---------- 0/0 18 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6E_000
---------- 0/0 3240 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT48_001
---------- 0/0 8 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT49_000
---------- 0/0 228 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT4A_001
---------- 0/0 16 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT4B_000
---------- 0/0 8 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT4C_002
---------- 0/0 20 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT4D_001
---------- 0/0 3720 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT40_001
---------- 0/0 144 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT41_001
---------- 0/0 36 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT42_002
---------- 0/0 168 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT43_000
---------- 0/0 48 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT44_000
---------- 0/0 44 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT45_000
---------- 0/0 232 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT46_002
---------- 0/0 80 2012-06-01 21:52 data/nvram/md/NVRAM/NVD_DATA/MT6G_003
---------- 0/0 880 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MP0C_003
---------- 0/0 11112 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6H_003
---------- 0/0 124 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6I_000
---------- 0/0 6 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6U_000
---------- 0/0 116 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6J_001
---------- 0/0 200 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6K_004
---------- 0/0 18 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6S_005
---------- 0/0 4 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT6W_000
---------- 0/0 10280 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MT71_000
---------- 0/0 94 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MP4Y_000
---------- 0/0 3 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MP5F_000
---------- 0/0 3 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MP4Z_000
---------- 0/0 3 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MP95_000
---------- 0/0 3 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MP96_000
---------- 0/0 88 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MP97_000
---------- 0/0 10 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MPDS_000
---------- 0/0 3 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MP5G_000
---------- 0/0 978 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MPDC_000
---------- 0/0 6 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MPDD_000
---------- 0/0 10 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_DATA/MPDE_000
drwxrwx--- 0/9997 0 2012-06-01 01:13 data/nvram/md/NVRAM/IMPORTNT/
-rw-rw---- 0/9997 1920 2012-06-01 01:13 data/nvram/md/NVRAM/IMPORTNT/ST33A004
-rw-rw---- 0/9997 1920 2012-06-01 01:13 data/nvram/md/NVRAM/IMPORTNT/ST33B004
-rw-rw---- 0/9997 4 2012-06-01 01:13 data/nvram/md/NVRAM/IMPORTNT/MP0D_000
drwxrwx--- 0/9997 0 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/
-rw-rw---- 0/9997 6 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0Q_002
-rw-rw---- 0/9997 34 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0P_003
-rw-rw---- 0/9997 18 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0O_002
-rw-rw---- 0/9997 18 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0N_002
-rw-rw---- 0/9997 18 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0M_002
-rw-rw---- 0/9997 18 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0L_002
-rw-rw---- 0/9997 210 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0K_005
-rw-rw---- 0/9997 46 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0J_004
-rw-rw---- 0/9997 10 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0I_002
-rw-rw---- 0/9997 66 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0H_002
-rw-rw---- 0/9997 66 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0G_002
-rw-rw---- 0/9997 66 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0F_002
-rw-rw---- 0/9997 66 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0E_002
-rw-rw---- 0/9997 666 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0D_002
-rw-rw---- 0/9997 666 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0C_002
-rw-rw---- 0/9997 666 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0B_002
-rw-rw---- 0/9997 666 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0A_002
-rw-rw---- 0/9997 666 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT09_002
-rw-rw---- 0/9997 666 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT08_002
-rw-rw---- 0/9997 666 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT07_002
-rw-rw---- 0/9997 666 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT06_002
-rw-rw---- 0/9997 262 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT05_002
-rw-rw---- 0/9997 1354 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MPA8_000
-rw-rw---- 0/9997 314 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MPA2_000
-rw-rw---- 0/9997 66 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MP09_001
-rw-rw---- 0/9997 106 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT1F_000
-rw-rw---- 0/9997 18 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT1U_000
-rw-rw---- 0/9997 132 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0V_000
-rw-rw---- 0/9997 246 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0U_000
-rw-rw---- 0/9997 246 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0T_000
-rw-rw---- 0/9997 22 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0S_000
-rw-rw---- 0/9997 22 2012-06-01 01:13 data/nvram/md/NVRAM/CALIBRAT/MT0R_000
drwxrwx--- 0/9997 0 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_IMEI/
-rw-rw---- 0/9997 384 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_IMEI/ST6TA001
-rw-rw---- 0/9997 384 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_IMEI/ST6TB001
-rw-rw---- 0/9997 120 2012-06-01 01:13 data/nvram/md/NVRAM/NVD_IMEI/MP0B_001
drwxr-xr-x 1000/1000 0 2014-04-06 22:46 data/tombstones/
-rw-r--r-- 1000/1000 67161 2014-04-06 22:46 data/tombstones/tombstone_01
-rw-r--r-- 1000/1000 13155 2014-04-06 22:23 data/tombstones/tombstone_00
-rw-r--r-- 0/0 26646 1970-01-01 01:00 advanced_meta_init.rc
drwx------ 0/0 0 2013-04-03 07:17 root/
drwxr-xr-x 0/0 0 2012-06-01 22:00 dev/
</code></pre></div>
<p>I've only just had a quick look at the names of the files but some certainly sound interesting. What's dropbox doing here? I'm guessing <code>/data/data/srclib.huyanwei.permissiongrant/databases/permissiongrant.sqlite</code> has something to do with <code>/system/xbin/su</code>, but I'm curious to know what exactly. I wonder what the "MobileLog" files really do. And why do we need ext2 tools on a Yaffs-based phone anyway?</p>
Hacklog #5: Hacking the rootkit
2014-09-04T00:00:00+01:00
/2014/09/04/Hacklog#5
<h1>A first look at su(1)</h1>
<p>So I <a href="/PYaffs/2014/08/12/Hacklog%234.html">now</a> have access to the full filesystem mounted under <code>/system</code> on the phone. As I stated in the very first post, I have a special interest in <code>/system/xbin/su</code>. Based on the file's name and permissions, I have a <a href="/PYaffs/2014/07/15/Hacklog%230.html">strong expectation</a> it can be used to acquire superuser privileges.</p>
<p>I extracted the file using <a href="https://github.com/mattboyer/PYaffs">PYaffs</a> and proceeded to inspect it.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">517-mboyer@marylou:~/Hacks/Nam-Phone_G40C [master:I±R=]$ stat su
File: ‘su’
Size: 9820 Blocks: 24 IO Block: 4096 regular file
Device: fe01h/65025d Inode: 1070451 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ mboyer) Gid: ( 1000/ mboyer)
Access: 2014-08-16 11:27:56.659942421 +0100
Modify: 2014-08-02 10:23:16.973937402 +0100
Change: 2014-08-02 10:23:16.973937402 +0100
Birth: -
503-mboyer@marylou:~/Hacks/Nam-Phone_G40C [master:I±R=]$ file su
su: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked (uses shared libs), stripped
</code></pre></div>
<p>That's par for the course, there's nothing in the output of <a href="http://linux.die.net/man/1/file"><code>file(1)</code></a> here I'd call surprising.</p>
<h2>Building binutils for ARM</h2>
<p>I've spent some time <a href="https://github.com/mattboyer/optenum">poking around ELF binaries</a> in my day and so my first port of call was to build the excellent GNU Binutils package for the target architecture:</p>
<div class="highlight"><pre><code class="language-bash" data-lang="bash">./configure --prefix<span class="o">=</span><span class="nv">$HOME</span>/Hacks/Nam-Phone_G40C/binutils_ARM/ --disable-nls --target<span class="o">=</span>arm-none-elf <span class="o">&&</span> make
<span class="nb">cd</span> ../..
ls
<span class="nb">cd</span> -
make install</code></pre></div>
<h2>A closer look</h2>
<p>Since I aim to find out what it is <em>exactly</em> this <code>su</code> does, the first order of business was to find out more about the dynamic symbols it references. It's a fairly small file, weighing in at 9820 bytes and so it makes sense that much of what it does is factored out in external libraries. If these symbol refer to well-known API calls, then this would allow me to make inferences regarding the behaviour and function of the program.</p>
<p>Time to break out my ARM build of <a href="http://linux.die.net/man/1/nm"><code>nm(1)</code></a>!</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">578-mboyer@marylou:~/Hacks/Nam-Phone_G40C [master:I±R=]$ export PATH="$PWD/binutils_ARM/arm-none-elf/bin:${PATH}"
581-mboyer@marylou:~/Hacks/Nam-Phone_G40C [master:I±R=]$ nm -CD ~/Hacks/Nam-Phone_G40C/su
U accept
U __aeabi_unwind_cpp_pr0
U atexit
U atoi
U bind
U bsd_signal
0000b200 A __bss_end__
0000b200 A _bss_end__
0000a1dc A __bss_start
0000a1dc A __bss_start__
0000a1d0 D __data_start
0000a1e0 B __dso_handle
0000a1dc A _edata
0000b200 A _end
0000b200 A __end__
U __errno
U execlp
U execvp
00009ce8 A __exidx_end
00009c8d A __exidx_start
U exit
0000a010 T __FINI_ARRAY__
U free
U getppid
0000a008 T __INIT_ARRAY__
U __libc_init
U listen
U malloc
U memcpy
U memset
U mkdir
U mktemp
U property_get
U putchar
U puts
U read
U select
U setgid
U setuid
U snprintf
U socket
U sprintf
00080000 A _stack
U __stack_chk_fail
U __stack_chk_guard
U stat
U strcmp
U strcpy
U unlink
U android::defaultServiceManager()
00008ed0 W android::sp<android::IBinder>::~sp()
U android::Parcel::writeInt32(int)
U android::Parcel::writeString16(unsigned short const*, unsigned int)
U android::Parcel::writeString16(android::String16 const&)
U android::Parcel::writeStrongBinder(android::sp<android::IBinder> const&)
U android::Parcel::writeInterfaceToken(android::String16 const&)
U android::Parcel::Parcel()
U android::Parcel::~Parcel()
U android::String16::String16(char const*)
U android::String16::~String16()
U android::Parcel::dataPosition() const
U android::Parcel::setDataPosition(unsigned int) const
U android::RefBase::decStrong(void const*) const
</code></pre></div>
<p>There are some C++ symbols in there that look like they belong to <a href="http://developer.android.com/reference/android/os/Parcel.html">some sort of Android API</a>. The rest look like fairly common C standard library stuff. What's of particular interest here is the presence of <a href="http://linux.die.net/man/3/socket"><code>socket(3)</code></a> and <a href="http://linux.die.net/man/3/bind"><code>bind(3)</code></a>. These are a strong indication that this program does sockety stuff.</p>
<h1>Deconstructing the binary</h1>
<h2>Come feel the ARMs around you</h2>
<p>As shown in the output of <a href="http://linux.die.net/man/1/file"><code>file(1)</code></a> above, my <code>su</code> is compiled for the ARM CPU in my phone. I've dealt with <a href="https://github.com/mattboyer/optenum">x86</a>, <a href="http://nighthacks.com/roller/jag/resource/SunRIP.jpg">SPARC</a>, <a href="http://www.ticalc.org/basics/calculators/ti-92plus.html#9">m68k</a> and even <a href="http://www.ticalc.org/basics/calculators/ti-86.html#9">Z80</a> assembly at various points in the past, but this is the first time I'm going to have to wade through ARM code.</p>
<p>Or <a href="http://infocenter.arm.com/help/topic/com.arm.doc.ddi0210c/CACBCAAE.html">Thumb-2</a> code, rather:</p>
<div class="highlight"><pre><code class="language-objdump" data-lang="objdump"><span class="x">ELF Header:</span>
<span class="x"> Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 </span>
<span class="x"> Class: ELF32</span>
<span class="x"> Data: 2's complement, little endian</span>
<span class="x"> Version: 1 (current)</span>
<span class="x"> OS/ABI: UNIX - System V</span>
<span class="x"> ABI Version: 0</span>
<span class="x"> Type: EXEC (Executable file)</span>
<span class="x"> Machine: ARM</span>
<span class="x"> Version: 0x1</span>
<span class="x"> Entry point address: 0x8ea0</span>
<span class="x"> Start of program headers: 52 (bytes into file)</span>
<span class="x"> Start of section headers: 8940 (bytes into file)</span>
<span class="x"> Flags: 0x5000000, Version5 EABI</span>
<span class="x"> Size of this header: 52 (bytes)</span>
<span class="x"> Size of program headers: 32 (bytes)</span>
<span class="x"> Number of program headers: 7</span>
<span class="x"> Size of section headers: 40 (bytes)</span>
<span class="x"> Number of section headers: 22</span>
<span class="x"> Section header string table index: 21</span>
<span class="x">Section Headers:</span>
<span class="x"> [Nr] Name Type Addr Off Size ES Flg Lk Inf Al</span>
<span class="x"> [ 0] NULL 00000000 000000 000000 00 0 0 0</span>
<span class="x"> [ 1] .interp PROGBITS 00008114 000114 000013 00 A 0 0 1</span>
<span class="x"> [ 2] .hash HASH 00008128 000128 00019c 04 A 3 0 4</span>
<span class="x"> [ 3] .dynsym DYNSYM 000082c4 0002c4 000400 10 A 4 0 4</span>
<span class="x"> [ 4] .dynstr STRTAB 000086c4 0006c4 00041f 00 A 0 0 1</span>
<span class="x"> [ 5] .rel.plt REL 00008ae4 000ae4 000170 08 A 3 2 4</span>
<span class="x"> [ 6] .rel.dyn REL 00008c54 000c54 000008 08 A 3 2 4</span>
<span class="x"> [ 7] .plt PROGBITS 00008c5c 000c5c 00023c 00 AX 0 0 4</span>
<span class="x"> [ 8] .text PROGBITS 00008ea0 000ea0 000b84 00 AX 0 0 16</span>
<span class="x"> [ 9] .rodata PROGBITS 00009a24 001a24 000269 01 AMS 0 0 1</span>
<span class="x"> [10] .ARM.exidx ARM_EXIDX 00009c90 001c90 000058 08 A 8 0 4</span>
<span class="x"> [11] .preinit_array PREINIT_ARRAY 0000a000 002000 000008 00 WA 0 0 1</span>
<span class="x"> [12] .init_array INIT_ARRAY 0000a008 002008 000008 00 WA 0 0 1</span>
<span class="x"> [13] .fini_array FINI_ARRAY 0000a010 002010 000008 00 WA 0 0 1</span>
<span class="x"> [14] .ctors PROGBITS 0000a018 002018 000008 00 WA 0 0 1</span>
<span class="x"> [15] .dynamic DYNAMIC 0000a020 002020 0000e8 08 WA 4 0 4</span>
<span class="x"> [16] .got PROGBITS 0000a108 002108 0000c8 00 WA 0 0 4</span>
<span class="x"> [17] .data PROGBITS 0000a1d0 0021d0 00000c 00 WA 0 0 4</span>
<span class="x"> [18] .bss NOBITS 0000a1e0 0021e0 001020 00 WA 0 0 16</span>
<span class="x"> [19] .note.gnu.gold-ve NOTE 00000000 0021e0 000018 00 0 0 4</span>
<span class="x"> [20] .ARM.attributes ARM_ATTRIBUTES 00000000 0021f8 000032 00 0 0 1</span>
<span class="x"> [21] .shstrtab STRTAB 00000000 00222a 0000c2 00 0 0 1</span>
<span class="x">Key to Flags:</span>
<span class="x"> W (write), A (alloc), X (execute), M (merge), S (strings)</span>
<span class="x"> I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)</span>
<span class="x"> O (extra OS processing required) o (OS specific), p (processor specific)</span>
<span class="x">There are no section groups in this file.</span>
<span class="x">Program Headers:</span>
<span class="x"> Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align</span>
<span class="x"> PHDR 0x000034 0x00008034 0x00008034 0x000e0 0x000e0 R 0x4</span>
<span class="x"> INTERP 0x000114 0x00008114 0x00008114 0x00013 0x00013 R 0x1</span>
<span class="x"> [Requesting program interpreter: /system/bin/linker]</span>
<span class="x"> LOAD 0x000000 0x00008000 0x00008000 0x01ce8 0x01ce8 R E 0x1000</span>
<span class="x"> LOAD 0x002000 0x0000a000 0x0000a000 0x001dc 0x01200 RW 0x1000</span>
<span class="x"> DYNAMIC 0x002020 0x0000a020 0x0000a020 0x000e8 0x000e8 RW 0x4</span>
<span class="x"> GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0</span>
<span class="x"> EXIDX 0x001c90 0x00009c90 0x00009c90 0x00058 0x00058 R 0x4</span>
<span class="x"> Section to Segment mapping:</span>
<span class="x"> Segment Sections...</span>
<span class="x"> 00 </span>
<span class="x"> 01 .interp </span>
<span class="x"> 02 .interp .hash .dynsym .dynstr .rel.plt .rel.dyn .plt .text .rodata .ARM.exidx </span>
<span class="x"> 03 .preinit_array .init_array .fini_array .ctors .dynamic .got .data .bss </span>
<span class="x"> 04 .dynamic </span>
<span class="x"> 05 </span>
<span class="x"> 06 .ARM.exidx </span>
<span class="x">Dynamic section at offset 0x2020 contains 29 entries:</span>
<span class="x"> Tag Type Name/Value</span>
<span class="x"> 0x00000003 (PLTGOT) 0xa10c</span>
<span class="x"> 0x00000002 (PLTRELSZ) 368 (bytes)</span>
<span class="x"> 0x00000017 (JMPREL) 0x8ae4</span>
<span class="x"> 0x00000014 (PLTREL) REL</span>
<span class="x"> 0x00000011 (REL) 0x8c54</span>
<span class="x"> 0x00000012 (RELSZ) 8 (bytes)</span>
<span class="x"> 0x00000013 (RELENT) 8 (bytes)</span>
<span class="x"> 0x00000015 (DEBUG) 0x0</span>
<span class="x"> 0x00000006 (SYMTAB) 0x82c4</span>
<span class="x"> 0x0000000b (SYMENT) 16 (bytes)</span>
<span class="x"> 0x00000005 (STRTAB) 0x86c4</span>
<span class="x"> 0x0000000a (STRSZ) 1055 (bytes)</span>
<span class="x"> 0x00000004 (HASH) 0x8128</span>
<span class="x"> 0x00000001 (NEEDED) Shared library: [liblog.so]</span>
<span class="x"> 0x00000001 (NEEDED) Shared library: [libsqlite.so]</span>
<span class="x"> 0x00000001 (NEEDED) Shared library: [libcutils.so]</span>
<span class="x"> 0x00000001 (NEEDED) Shared library: [libbinder.so]</span>
<span class="x"> 0x00000001 (NEEDED) Shared library: [libutils.so]</span>
<span class="x"> 0x00000001 (NEEDED) Shared library: [libc.so]</span>
<span class="x"> 0x00000001 (NEEDED) Shared library: [libstdc++.so]</span>
<span class="x"> 0x00000001 (NEEDED) Shared library: [libm.so]</span>
<span class="x"> 0x00000020 (PREINIT_ARRAY) 0xa000</span>
<span class="x"> 0x00000021 (PREINIT_ARRAYSZ) 0x8</span>
<span class="x"> 0x00000019 (INIT_ARRAY) 0xa008</span>
<span class="x"> 0x0000001b (INIT_ARRAYSZ) 8 (bytes)</span>
<span class="x"> 0x0000001a (FINI_ARRAY) 0xa010</span>
<span class="x"> 0x0000001c (FINI_ARRAYSZ) 8 (bytes)</span>
<span class="x"> 0x0000001e (FLAGS) </span>
<span class="x"> 0x00000000 (NULL) 0x0</span>
<span class="x">Relocation section '.rel.plt' at offset 0xae4 contains 46 entries:</span>
<span class="x"> Offset Info Type Sym.Value Sym. Name</span>
<span class="x">0000a118 00003416 R_ARM_JUMP_SLOT 00000000 __libc_init</span>
<span class="x">0000a11c 00002516 R_ARM_JUMP_SLOT 00000000 _ZNK7android7RefBase9d</span>
<span class="x">0000a120 00001a16 R_ARM_JUMP_SLOT 00000000 memset</span>
<span class="x">0000a124 00001f16 R_ARM_JUMP_SLOT 00000000 property_get</span>
<span class="x">0000a128 00001b16 R_ARM_JUMP_SLOT 00000000 atoi</span>
<span class="x">0000a12c 00003116 R_ARM_JUMP_SLOT 00000000 _ZN7android21defaultSe</span>
<span class="x">0000a130 00002f16 R_ARM_JUMP_SLOT 00000000 _ZN7android8String16C1</span>
<span class="x">0000a134 00002616 R_ARM_JUMP_SLOT 00000000 _ZN7android8String16D1</span>
<span class="x">0000a138 00002a16 R_ARM_JUMP_SLOT 00000000 _ZN7android6ParcelC1Ev</span>
<span class="x">0000a13c 00002d16 R_ARM_JUMP_SLOT 00000000 _ZN7android6Parcel19wr</span>
<span class="x">0000a140 00002e16 R_ARM_JUMP_SLOT 00000000 _ZN7android6Parcel17wr</span>
<span class="x">0000a144 00002716 R_ARM_JUMP_SLOT 00000000 _ZN7android6Parcel13wr</span>
<span class="x">0000a148 00002916 R_ARM_JUMP_SLOT 00000000 _ZN7android6Parcel10wr</span>
<span class="x">0000a14c 00003216 R_ARM_JUMP_SLOT 00000000 _ZN7android6Parcel13wr</span>
<span class="x">0000a150 00003016 R_ARM_JUMP_SLOT 00000000 _ZNK7android6Parcel12d</span>
<span class="x">0000a154 00002816 R_ARM_JUMP_SLOT 00000000 _ZNK7android6Parcel15s</span>
<span class="x">0000a158 00002b16 R_ARM_JUMP_SLOT 00000000 _ZN7android6ParcelD1Ev</span>
<span class="x">0000a15c 00000216 R_ARM_JUMP_SLOT 00000000 __stack_chk_fail</span>
<span class="x">0000a160 00003e16 R_ARM_JUMP_SLOT 00000000 puts</span>
<span class="x">0000a164 00003d16 R_ARM_JUMP_SLOT 00000000 putchar</span>
<span class="x">0000a168 00003516 R_ARM_JUMP_SLOT 00000000 exit</span>
<span class="x">0000a16c 00002016 R_ARM_JUMP_SLOT 00000000 socket</span>
<span class="x">0000a170 00000a16 R_ARM_JUMP_SLOT 00000000 strcpy</span>
<span class="x">0000a174 00003c16 R_ARM_JUMP_SLOT 00000000 mktemp</span>
<span class="x">0000a178 00000516 R_ARM_JUMP_SLOT 00000000 snprintf</span>
<span class="x">0000a17c 00001d16 R_ARM_JUMP_SLOT 00000000 unlink</span>
<span class="x">0000a180 00002116 R_ARM_JUMP_SLOT 00000000 bind</span>
<span class="x">0000a184 00000416 R_ARM_JUMP_SLOT 00000000 __errno</span>
<span class="x">0000a188 00002216 R_ARM_JUMP_SLOT 00000000 listen</span>
<span class="x">0000a18c 00002416 R_ARM_JUMP_SLOT 00000000 select</span>
<span class="x">0000a190 00002316 R_ARM_JUMP_SLOT 00000000 accept</span>
<span class="x">0000a194 00000616 R_ARM_JUMP_SLOT 00000000 strcmp</span>
<span class="x">0000a198 00003816 R_ARM_JUMP_SLOT 00000000 execvp</span>
<span class="x">0000a19c 00003916 R_ARM_JUMP_SLOT 00000000 execlp</span>
<span class="x">0000a1a0 00000816 R_ARM_JUMP_SLOT 00000000 free</span>
<span class="x">0000a1a4 00001c16 R_ARM_JUMP_SLOT 00000000 read</span>
<span class="x">0000a1a8 00000b16 R_ARM_JUMP_SLOT 00000000 malloc</span>
<span class="x">0000a1ac 00000716 R_ARM_JUMP_SLOT 00000000 memcpy</span>
<span class="x">0000a1b0 00003716 R_ARM_JUMP_SLOT 00000000 setgid</span>
<span class="x">0000a1b4 00003616 R_ARM_JUMP_SLOT 00000000 getppid</span>
<span class="x">0000a1b8 00000916 R_ARM_JUMP_SLOT 00000000 sprintf</span>
<span class="x">0000a1bc 00001e16 R_ARM_JUMP_SLOT 00000000 stat</span>
<span class="x">0000a1c0 00003316 R_ARM_JUMP_SLOT 00000000 mkdir</span>
<span class="x">0000a1c4 00003a16 R_ARM_JUMP_SLOT 00000000 setuid</span>
<span class="x">0000a1c8 00003b16 R_ARM_JUMP_SLOT 00000000 bsd_signal</span>
<span class="x">0000a1cc 00003f16 R_ARM_JUMP_SLOT 00000000 atexit</span>
<span class="x">Relocation section '.rel.dyn' at offset 0xc54 contains 1 entries:</span>
<span class="x"> Offset Info Type Sym.Value Sym. Name</span>
<span class="x">0000a108 00000315 R_ARM_GLOB_DAT 00000000 __stack_chk_guard</span>
<span class="x">Unwind table index '.ARM.exidx' at offset 0x1c90 contains 11 entries:</span>
<span class="x">0x9a1c: 0x1 [cantunwind]</span>
<span class="x">0x8ed0: 0x80a8b0b0</span>
<span class="x"> Compact model index: 0</span>
<span class="x"> 0xa8 pop {r4, r14}</span>
<span class="x"> 0xb0 finish</span>
<span class="x"> 0xb0 finish</span>
<span class="x">0x8eec: 0x80b0b0b0</span>
<span class="x"> Compact model index: 0</span>
<span class="x"> 0xb0 finish</span>
<span class="x"> 0xb0 finish</span>
<span class="x"> 0xb0 finish</span>
<span class="x">0x8ef4: 0x803eafb0</span>
<span class="x"> Compact model index: 0</span>
<span class="x"> 0x3e vsp = vsp + 252</span>
<span class="x"> 0xaf pop {r4, r5, r6, r7, r8, r9, r10, r11, r14}</span>
<span class="x"> 0xb0 finish</span>
<span class="x">0x9534: 0x80a8b0b0</span>
<span class="x"> Compact model index: 0</span>
<span class="x"> 0xa8 pop {r4, r14}</span>
<span class="x"> 0xb0 finish</span>
<span class="x"> 0xb0 finish</span>
<span class="x">0x958c: 0x801eafb0</span>
<span class="x"> Compact model index: 0</span>
<span class="x"> 0x1e vsp = vsp + 124</span>
<span class="x"> 0xaf pop {r4, r5, r6, r7, r8, r9, r10, r11, r14}</span>
<span class="x"> 0xb0 finish</span>
<span class="x">0x966c: 0x8023aab0</span>
<span class="x"> Compact model index: 0</span>
<span class="x"> 0x23 vsp = vsp + 144</span>
<span class="x"> 0xaa pop {r4, r5, r6, r14}</span>
<span class="x"> 0xb0 finish</span>
<span class="x">0x96d0: 0x80aab0b0</span>
<span class="x"> Compact model index: 0</span>
<span class="x"> 0xaa pop {r4, r5, r6, r14}</span>
<span class="x"> 0xb0 finish</span>
<span class="x"> 0xb0 finish</span>
<span class="x">0x9754: 0x80a8b0b0</span>
<span class="x"> Compact model index: 0</span>
<span class="x"> 0xa8 pop {r4, r14}</span>
<span class="x"> 0xb0 finish</span>
<span class="x"> 0xb0 finish</span>
<span class="x">0x97ac: 0x80aab0b0</span>
<span class="x"> Compact model index: 0</span>
<span class="x"> 0xaa pop {r4, r5, r6, r14}</span>
<span class="x"> 0xb0 finish</span>
<span class="x"> 0xb0 finish</span>
<span class="x">0x97d8: 0x802c3fab</span>
<span class="x"> Compact model index: 0</span>
<span class="x"> 0x2c vsp = vsp + 180</span>
<span class="x"> 0x3f vsp = vsp + 256</span>
<span class="x"> 0xab pop {r4, r5, r6, r7, r14}</span>
<span class="x">Symbol table '.dynsym' contains 64 entries:</span>
<span class="x"> Num: Value Size Type Bind Vis Ndx Name</span>
<span class="x"> 0: 00000000 0 NOTYPE LOCAL DEFAULT UND </span>
<span class="x"> 1: 00000000 0 FUNC GLOBAL DEFAULT UND __aeabi_unwind_cpp_pr0</span>
<span class="x"> 2: 00000000 0 FUNC GLOBAL DEFAULT UND __stack_chk_fail</span>
<span class="x"> 3: 00000000 0 OBJECT GLOBAL DEFAULT UND __stack_chk_guard</span>
<span class="x"> 4: 00000000 0 FUNC GLOBAL DEFAULT UND __errno</span>
<span class="x"> 5: 00000000 0 FUNC GLOBAL DEFAULT UND snprintf</span>
<span class="x"> 6: 00000000 0 FUNC GLOBAL DEFAULT UND strcmp</span>
<span class="x"> 7: 00000000 0 FUNC GLOBAL DEFAULT UND memcpy</span>
<span class="x"> 8: 00000000 0 FUNC GLOBAL DEFAULT UND free</span>
<span class="x"> 9: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf</span>
<span class="x"> 10: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy</span>
<span class="x"> 11: 00000000 0 FUNC GLOBAL DEFAULT UND malloc</span>
<span class="x"> 12: 0000a1e0 0 NOTYPE GLOBAL DEFAULT 18 __dso_handle</span>
<span class="x"> 13: 0000a008 0 NOTYPE GLOBAL DEFAULT 12 __INIT_ARRAY__</span>
<span class="x"> 14: 0000a010 0 NOTYPE GLOBAL DEFAULT 13 __FINI_ARRAY__</span>
<span class="x"> 15: 00009c8d 0 NOTYPE GLOBAL DEFAULT ABS __exidx_start</span>
<span class="x"> 16: 00009ce8 0 NOTYPE GLOBAL DEFAULT ABS __exidx_end</span>
<span class="x"> 17: 0000a1d0 0 NOTYPE GLOBAL DEFAULT 17 __data_start</span>
<span class="x"> 18: 0000a1dc 0 NOTYPE GLOBAL DEFAULT ABS _edata</span>
<span class="x"> 19: 0000a1dc 0 NOTYPE GLOBAL DEFAULT ABS __bss_start</span>
<span class="x"> 20: 0000a1dc 0 NOTYPE GLOBAL DEFAULT ABS __bss_start__</span>
<span class="x"> 21: 0000b200 0 NOTYPE GLOBAL DEFAULT ABS _bss_end__</span>
<span class="x"> 22: 0000b200 0 NOTYPE GLOBAL DEFAULT ABS __bss_end__</span>
<span class="x"> 23: 0000b200 0 NOTYPE GLOBAL DEFAULT ABS __end__</span>
<span class="x"> 24: 0000b200 0 NOTYPE GLOBAL DEFAULT ABS _end</span>
<span class="x"> 25: 00080000 0 NOTYPE GLOBAL DEFAULT ABS _stack</span>
<span class="x"> 26: 00000000 0 FUNC GLOBAL DEFAULT UND memset</span>
<span class="x"> 27: 00000000 0 FUNC GLOBAL DEFAULT UND atoi</span>
<span class="x"> 28: 00000000 0 FUNC GLOBAL DEFAULT UND read</span>
<span class="x"> 29: 00000000 0 FUNC GLOBAL DEFAULT UND unlink</span>
<span class="x"> 30: 00000000 0 FUNC GLOBAL DEFAULT UND stat</span>
<span class="x"> 31: 00000000 0 FUNC GLOBAL DEFAULT UND property_get</span>
<span class="x"> 32: 00000000 0 FUNC GLOBAL DEFAULT UND socket</span>
<span class="x"> 33: 00000000 0 FUNC GLOBAL DEFAULT UND bind</span>
<span class="x"> 34: 00000000 0 FUNC GLOBAL DEFAULT UND listen</span>
<span class="x"> 35: 00000000 0 FUNC GLOBAL DEFAULT UND accept</span>
<span class="x"> 36: 00000000 0 FUNC GLOBAL DEFAULT UND select</span>
<span class="x"> 37: 00000000 0 FUNC GLOBAL DEFAULT UND _ZNK7android7RefBase9decS</span>
<span class="x"> 38: 00000000 0 FUNC GLOBAL DEFAULT UND _ZN7android8String16D1Ev</span>
<span class="x"> 39: 00000000 0 FUNC GLOBAL DEFAULT UND _ZN7android6Parcel13write</span>
<span class="x"> 40: 00000000 0 FUNC GLOBAL DEFAULT UND _ZNK7android6Parcel15setD</span>
<span class="x"> 41: 00000000 0 FUNC GLOBAL DEFAULT UND _ZN7android6Parcel10write</span>
<span class="x"> 42: 00000000 0 FUNC GLOBAL DEFAULT UND _ZN7android6ParcelC1Ev</span>
<span class="x"> 43: 00000000 0 FUNC GLOBAL DEFAULT UND _ZN7android6ParcelD1Ev</span>
<span class="x"> 44: 00008ed1 26 FUNC WEAK DEFAULT 8 _ZN7android2spINS_7IBinde</span>
<span class="x"> 45: 00000000 0 FUNC GLOBAL DEFAULT UND _ZN7android6Parcel19write</span>
<span class="x"> 46: 00000000 0 FUNC GLOBAL DEFAULT UND _ZN7android6Parcel17write</span>
<span class="x"> 47: 00000000 0 FUNC GLOBAL DEFAULT UND _ZN7android8String16C1EPK</span>
<span class="x"> 48: 00000000 0 FUNC GLOBAL DEFAULT UND _ZNK7android6Parcel12data</span>
<span class="x"> 49: 00000000 0 FUNC GLOBAL DEFAULT UND _ZN7android21defaultServi</span>
<span class="x"> 50: 00000000 0 FUNC GLOBAL DEFAULT UND _ZN7android6Parcel13write</span>
<span class="x"> 51: 00000000 0 FUNC GLOBAL DEFAULT UND mkdir</span>
<span class="x"> 52: 00000000 0 FUNC GLOBAL DEFAULT UND __libc_init</span>
<span class="x"> 53: 00000000 0 FUNC GLOBAL DEFAULT UND exit</span>
<span class="x"> 54: 00000000 0 FUNC GLOBAL DEFAULT UND getppid</span>
<span class="x"> 55: 00000000 0 FUNC GLOBAL DEFAULT UND setgid</span>
<span class="x"> 56: 00000000 0 FUNC GLOBAL DEFAULT UND execvp</span>
<span class="x"> 57: 00000000 0 FUNC GLOBAL DEFAULT UND execlp</span>
<span class="x"> 58: 00000000 0 FUNC GLOBAL DEFAULT UND setuid</span>
<span class="x"> 59: 00000000 0 FUNC GLOBAL DEFAULT UND bsd_signal</span>
<span class="x"> 60: 00000000 0 FUNC GLOBAL DEFAULT UND mktemp</span>
<span class="x"> 61: 00000000 0 FUNC GLOBAL DEFAULT UND putchar</span>
<span class="x"> 62: 00000000 0 FUNC GLOBAL DEFAULT UND puts</span>
<span class="x"> 63: 00000000 0 FUNC GLOBAL DEFAULT UND atexit</span>
<span class="x">Histogram for bucket list length (total of 37 buckets):</span>
<span class="x"> Length Number % of total Coverage</span>
<span class="x"> 0 6 ( 16.2%)</span>
<span class="x"> 1 13 ( 35.1%) 20.6%</span>
<span class="x"> 2 8 ( 21.6%) 46.0%</span>
<span class="x"> 3 6 ( 16.2%) 74.6%</span>
<span class="x"> 4 4 ( 10.8%) 100.0%</span>
<span class="x">No version information found in this file.</span>
<span class="x">Displaying notes found at file offset 0x000021e0 with length 0x00000018:</span>
<span class="x"> Owner Data size Description</span>
<span class="x"> GNU 0x00000008 NT_GNU_GOLD_VERSION (gold version)</span>
<span class="x">Attribute Section: aeabi</span>
<span class="x">File Attributes</span>
<span class="x"> Tag_CPU_name: "ARM v7"</span>
<span class="x"> Tag_CPU_arch: v7</span>
<span class="x"> Tag_CPU_arch_profile: Application</span>
<span class="x"> Tag_ARM_ISA_use: Yes</span>
<span class="x"> Tag_THUMB_ISA_use: Thumb-2</span>
<span class="x"> Tag_FP_arch: VFPv3</span>
<span class="x"> Tag_Advanced_SIMD_arch: NEONv1</span>
<span class="x"> Tag_ABI_PCS_wchar_t: 4</span>
<span class="x"> Tag_ABI_FP_denormal: Needed</span>
<span class="x"> Tag_ABI_FP_exceptions: Needed</span>
<span class="x"> Tag_ABI_FP_number_model: IEEE 754</span>
<span class="x"> Tag_ABI_align_needed: 8-byte</span>
<span class="x"> Tag_ABI_enum_size: int</span>
<span class="x"> Tag_ABI_HardFP_use: SP and DP</span></code></pre></div>
<p>The thing about assembly is that it's a lot easier to read than it is to write. It's even easier when one focuses on reverse-engineering a small body of code! For that sort of job, the only thing one really needs is a passing familiarity with <a href="http://infocenter.arm.com/help/topic/com.arm.doc.dui0489e/Chddgcje.html">basic instructions</a> (shifting values between registers, basic arithmetic and comparisons), <a href="http://infocenter.arm.com/help/topic/com.arm.doc.dui0489e/Chdhbfcd.html">memory access</a> (reading and writing to memory, as opposed to the registers) and knowledge of <a href="http://infocenter.arm.com/help/topic/com.arm.doc.ihi0042e/IHI0042E_aapcs.pdf">how argument and return value passing work</a>. The ARM documentation is pretty good for all of that and it's quite readable as well.</p>
<p>One thing I learned the hard way is that when an instruction references the program counter register <code>pc</code>, its value is that of the <em>next instruction</em>'s offset, ie. the current instruction plus an offset of 2 bytes if running in Thumb mode or 4 bytes if running in ARM mode.</p>
<h2>Disassembly</h2>
<p>This is where the fun <strong>really</strong> begins. I want to get superuser privileges out of this binary. Just running <code>su</code> from an unprivileged interactive shell does <em>not</em> yield this result so I'm assuming that I need to do something else, possibly by means of a socket to trigger privilege escalation.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ id
id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),10
15(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
$ su
su
$ id
id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),10
15(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
$ su -h
su -h
Usage: su [options]
Options:
-c,--command cmd run cmd.
-h,--help help
Author:huyanwei
Email:srclib@hotmail.com
$
</code></pre></div>
<p>I used <code>objdump -Csd</code> to dump all sections of the <code>su</code> executable and disassemble the <code>.text</code> section into human-readable ARM assembly in one go:</p>
<div class="highlight"><pre><code class="language-objdump" data-lang="objdump"><span class="nl">./su</span><span class="p">:</span> file format <span class="s">elf32-littlearm</span>
<span class="x">Contents of section .interp:</span>
<span class="x"> 8114 2f737973 74656d2f 62696e2f 6c696e6b /system/bin/link</span>
<span class="x"> 8124 657200 er. </span>
<span class="x">Contents of section .hash:</span>
<span class="x"> 8128 25000000 40000000 17000000 32000000 %...@.......2...</span>
<span class="x"> 8138 31000000 33000000 01000000 00000000 1...3...........</span>
<span class="x"> 8148 28000000 2d000000 2b000000 3b000000 (...-...+...;...</span>
<span class="x"> 8158 3a000000 03000000 36000000 00000000 :.......6.......</span>
<span class="x"> 8168 15000000 37000000 00000000 26000000 ....7.......&...</span>
<span class="x"> 8178 3e000000 3f000000 2e000000 1c000000 >...?...........</span>
<span class="x"> 8188 34000000 2c000000 2f000000 00000000 4...,.../.......</span>
<span class="x"> 8198 00000000 3c000000 3d000000 35000000 ....<...=...5...</span>
<span class="x"> 81a8 02000000 18000000 1a000000 00000000 ................</span>
<span class="x"> 81b8 2a000000 39000000 0c000000 00000000 *...9...........</span>
<span class="x"> 81c8 00000000 00000000 00000000 00000000 ................</span>
<span class="x"> 81d8 00000000 00000000 00000000 00000000 ................</span>
<span class="x"> 81e8 00000000 00000000 00000000 00000000 ................</span>
<span class="x"> 81f8 00000000 00000000 00000000 0b000000 ................</span>
<span class="x"> 8208 00000000 00000000 00000000 08000000 ................</span>
<span class="x"> 8218 00000000 14000000 11000000 16000000 ................</span>
<span class="x"> 8228 07000000 00000000 04000000 0a000000 ................</span>
<span class="x"> 8238 13000000 12000000 00000000 00000000 ................</span>
<span class="x"> 8248 10000000 00000000 00000000 05000000 ................</span>
<span class="x"> 8258 1d000000 00000000 22000000 00000000 ........".......</span>
<span class="x"> 8268 0d000000 27000000 00000000 21000000 ....'.......!...</span>
<span class="x"> 8278 00000000 23000000 0f000000 24000000 ....#.......$...</span>
<span class="x"> 8288 19000000 06000000 00000000 1b000000 ................</span>
<span class="x"> 8298 30000000 0e000000 00000000 20000000 0........... ...</span>
<span class="x"> 82a8 25000000 38000000 00000000 29000000 %...8.......)...</span>
<span class="x"> 82b8 1f000000 1e000000 09000000 ............ </span>
<span class="x">Contents of section .dynsym:</span>
<span class="x"> 82c4 00000000 00000000 00000000 00000000 ................</span>
<span class="x"> 82d4 01000000 00000000 00000000 12000000 ................</span>
<span class="x"> 82e4 18000000 00000000 00000000 12000000 ................</span>
<span class="x"> 82f4 29000000 00000000 00000000 11000000 )...............</span>
<span class="x"> 8304 3b000000 00000000 00000000 12000000 ;...............</span>
<span class="x"> 8314 43000000 00000000 00000000 12000000 C...............</span>
<span class="x"> 8324 4c000000 00000000 00000000 12000000 L...............</span>
<span class="x"> 8334 53000000 00000000 00000000 12000000 S...............</span>
<span class="x"> 8344 5a000000 00000000 00000000 12000000 Z...............</span>
<span class="x"> 8354 5f000000 00000000 00000000 12000000 _...............</span>
<span class="x"> 8364 67000000 00000000 00000000 12000000 g...............</span>
<span class="x"> 8374 6e000000 00000000 00000000 12000000 n...............</span>
<span class="x"> 8384 75000000 e0a10000 00000000 10001200 u...............</span>
<span class="x"> 8394 82000000 08a00000 00000000 10000c00 ................</span>
<span class="x"> 83a4 91000000 10a00000 00000000 10000d00 ................</span>
<span class="x"> 83b4 a0000000 8d9c0000 00000000 1000f1ff ................</span>
<span class="x"> 83c4 ae000000 e89c0000 00000000 1000f1ff ................</span>
<span class="x"> 83d4 ba000000 d0a10000 00000000 10001100 ................</span>
<span class="x"> 83e4 c7000000 dca10000 00000000 1000f1ff ................</span>
<span class="x"> 83f4 ce000000 dca10000 00000000 1000f1ff ................</span>
<span class="x"> 8404 da000000 dca10000 00000000 1000f1ff ................</span>
<span class="x"> 8414 e8000000 00b20000 00000000 1000f1ff ................</span>
<span class="x"> 8424 f3000000 00b20000 00000000 1000f1ff ................</span>
<span class="x"> 8434 ff000000 00b20000 00000000 1000f1ff ................</span>
<span class="x"> 8444 07010000 00b20000 00000000 1000f1ff ................</span>
<span class="x"> 8454 0c010000 00000800 00000000 1000f1ff ................</span>
<span class="x"> 8464 13010000 00000000 00000000 12000000 ................</span>
<span class="x"> 8474 1a010000 00000000 00000000 12000000 ................</span>
<span class="x"> 8484 1f010000 00000000 00000000 12000000 ................</span>
<span class="x"> 8494 24010000 00000000 00000000 12000000 $...............</span>
<span class="x"> 84a4 2b010000 00000000 00000000 12000000 +...............</span>
<span class="x"> 84b4 30010000 00000000 00000000 12000000 0...............</span>
<span class="x"> 84c4 3d010000 00000000 00000000 12000000 =...............</span>
<span class="x"> 84d4 44010000 00000000 00000000 12000000 D...............</span>
<span class="x"> 84e4 49010000 00000000 00000000 12000000 I...............</span>
<span class="x"> 84f4 50010000 00000000 00000000 12000000 P...............</span>
<span class="x"> 8504 57010000 00000000 00000000 12000000 W...............</span>
<span class="x"> 8514 5e010000 00000000 00000000 12000000 ^...............</span>
<span class="x"> 8524 81010000 00000000 00000000 12000000 ................</span>
<span class="x"> 8534 9a010000 00000000 00000000 12000000 ................</span>
<span class="x"> 8544 cc010000 00000000 00000000 12000000 ................</span>
<span class="x"> 8554 f3010000 00000000 00000000 12000000 ................</span>
<span class="x"> 8564 14020000 00000000 00000000 12000000 ................</span>
<span class="x"> 8574 2b020000 00000000 00000000 12000000 +...............</span>
<span class="x"> 8584 42020000 d18e0000 1a000000 22000800 B..........."...</span>
<span class="x"> 8594 63020000 00000000 00000000 12000000 c...............</span>
<span class="x"> 85a4 9b020000 00000000 00000000 12000000 ................</span>
<span class="x"> 85b4 d9020000 00000000 00000000 12000000 ................</span>
<span class="x"> 85c4 f4020000 00000000 00000000 12000000 ................</span>
<span class="x"> 85d4 18030000 00000000 00000000 12000000 ................</span>
<span class="x"> 85e4 3d030000 00000000 00000000 12000000 =...............</span>
<span class="x"> 85f4 64030000 00000000 00000000 12000000 d...............</span>
<span class="x"> 8604 6a030000 00000000 00000000 12000000 j...............</span>
<span class="x"> 8614 76030000 00000000 00000000 12000000 v...............</span>
<span class="x"> 8624 7b030000 00000000 00000000 12000000 {...............</span>
<span class="x"> 8634 83030000 00000000 00000000 12000000 ................</span>
<span class="x"> 8644 8a030000 00000000 00000000 12000000 ................</span>
<span class="x"> 8654 91030000 00000000 00000000 12000000 ................</span>
<span class="x"> 8664 98030000 00000000 00000000 12000000 ................</span>
<span class="x"> 8674 9f030000 00000000 00000000 12000000 ................</span>
<span class="x"> 8684 aa030000 00000000 00000000 12000000 ................</span>
<span class="x"> 8694 b1030000 00000000 00000000 12000000 ................</span>
<span class="x"> 86a4 b9030000 00000000 00000000 12000000 ................</span>
<span class="x"> 86b4 be030000 00000000 00000000 12000000 ................</span>
<span class="x">Contents of section .dynstr:</span>
<span class="x"> 86c4 005f5f61 65616269 5f756e77 696e645f .__aeabi_unwind_</span>
<span class="x"> 86d4 6370705f 70723000 5f5f7374 61636b5f cpp_pr0.__stack_</span>
<span class="x"> 86e4 63686b5f 6661696c 005f5f73 7461636b chk_fail.__stack</span>
<span class="x"> 86f4 5f63686b 5f677561 7264005f 5f657272 _chk_guard.__err</span>
<span class="x"> 8704 6e6f0073 6e707269 6e746600 73747263 no.snprintf.strc</span>
<span class="x"> 8714 6d70006d 656d6370 79006672 65650073 mp.memcpy.free.s</span>
<span class="x"> 8724 7072696e 74660073 74726370 79006d61 printf.strcpy.ma</span>
<span class="x"> 8734 6c6c6f63 005f5f64 736f5f68 616e646c lloc.__dso_handl</span>
<span class="x"> 8744 65005f5f 494e4954 5f415252 41595f5f e.__INIT_ARRAY__</span>
<span class="x"> 8754 005f5f46 494e495f 41525241 595f5f00 .__FINI_ARRAY__.</span>
<span class="x"> 8764 5f5f6578 6964785f 73746172 74005f5f __exidx_start.__</span>
<span class="x"> 8774 65786964 785f656e 64005f5f 64617461 exidx_end.__data</span>
<span class="x"> 8784 5f737461 7274005f 65646174 61005f5f _start._edata.__</span>
<span class="x"> 8794 6273735f 73746172 74005f5f 6273735f bss_start.__bss_</span>
<span class="x"> 87a4 73746172 745f5f00 5f627373 5f656e64 start__._bss_end</span>
<span class="x"> 87b4 5f5f005f 5f627373 5f656e64 5f5f005f __.__bss_end__._</span>
<span class="x"> 87c4 5f656e64 5f5f005f 656e6400 5f737461 _end__._end._sta</span>
<span class="x"> 87d4 636b006d 656d7365 74006174 6f690072 ck.memset.atoi.r</span>
<span class="x"> 87e4 65616400 756e6c69 6e6b0073 74617400 ead.unlink.stat.</span>
<span class="x"> 87f4 70726f70 65727479 5f676574 00736f63 property_get.soc</span>
<span class="x"> 8804 6b657400 62696e64 006c6973 74656e00 ket.bind.listen.</span>
<span class="x"> 8814 61636365 70740073 656c6563 74005f5a accept.select._Z</span>
<span class="x"> 8824 4e4b3761 6e64726f 69643752 65664261 NK7android7RefBa</span>
<span class="x"> 8834 73653964 65635374 726f6e67 45504b76 se9decStrongEPKv</span>
<span class="x"> 8844 005f5a4e 37616e64 726f6964 38537472 ._ZN7android8Str</span>
<span class="x"> 8854 696e6731 36443145 76005f5a 4e37616e ing16D1Ev._ZN7an</span>
<span class="x"> 8864 64726f69 64365061 7263656c 31337772 droid6Parcel13wr</span>
<span class="x"> 8874 69746553 7472696e 67313645 524b4e53 iteString16ERKNS</span>
<span class="x"> 8884 5f385374 72696e67 31364500 5f5a4e4b _8String16E._ZNK</span>
<span class="x"> 8894 37616e64 726f6964 36506172 63656c31 7android6Parcel1</span>
<span class="x"> 88a4 35736574 44617461 506f7369 74696f6e 5setDataPosition</span>
<span class="x"> 88b4 456a005f 5a4e3761 6e64726f 69643650 Ej._ZN7android6P</span>
<span class="x"> 88c4 61726365 6c313077 72697465 496e7433 arcel10writeInt3</span>
<span class="x"> 88d4 32456900 5f5a4e37 616e6472 6f696436 2Ei._ZN7android6</span>
<span class="x"> 88e4 50617263 656c4331 4576005f 5a4e3761 ParcelC1Ev._ZN7a</span>
<span class="x"> 88f4 6e64726f 69643650 61726365 6c443145 ndroid6ParcelD1E</span>
<span class="x"> 8904 76005f5a 4e37616e 64726f69 64327370 v._ZN7android2sp</span>
<span class="x"> 8914 494e535f 37494269 6e646572 45454431 INS_7IBinderEED1</span>
<span class="x"> 8924 4576005f 5a4e3761 6e64726f 69643650 Ev._ZN7android6P</span>
<span class="x"> 8934 61726365 6c313977 72697465 496e7465 arcel19writeInte</span>
<span class="x"> 8944 72666163 65546f6b 656e4552 4b4e535f rfaceTokenERKNS_</span>
<span class="x"> 8954 38537472 696e6731 3645005f 5a4e3761 8String16E._ZN7a</span>
<span class="x"> 8964 6e64726f 69643650 61726365 6c313777 ndroid6Parcel17w</span>
<span class="x"> 8974 72697465 5374726f 6e674269 6e646572 riteStrongBinder</span>
<span class="x"> 8984 45524b4e 535f3273 70494e53 5f374942 ERKNS_2spINS_7IB</span>
<span class="x"> 8994 696e6465 72454545 005f5a4e 37616e64 inderEEE._ZN7and</span>
<span class="x"> 89a4 726f6964 38537472 696e6731 36433145 roid8String16C1E</span>
<span class="x"> 89b4 504b6300 5f5a4e4b 37616e64 726f6964 PKc._ZNK7android</span>
<span class="x"> 89c4 36506172 63656c31 32646174 61506f73 6Parcel12dataPos</span>
<span class="x"> 89d4 6974696f 6e457600 5f5a4e37 616e6472 itionEv._ZN7andr</span>
<span class="x"> 89e4 6f696432 31646566 61756c74 53657276 oid21defaultServ</span>
<span class="x"> 89f4 6963654d 616e6167 65724576 005f5a4e iceManagerEv._ZN</span>
<span class="x"> 8a04 37616e64 726f6964 36506172 63656c31 7android6Parcel1</span>
<span class="x"> 8a14 33777269 74655374 72696e67 31364550 3writeString16EP</span>
<span class="x"> 8a24 4b746a00 6d6b6469 72005f5f 6c696263 Ktj.mkdir.__libc</span>
<span class="x"> 8a34 5f696e69 74006578 69740067 65747070 _init.exit.getpp</span>
<span class="x"> 8a44 69640073 65746769 64006578 65637670 id.setgid.execvp</span>
<span class="x"> 8a54 00657865 636c7000 73657475 69640062 .execlp.setuid.b</span>
<span class="x"> 8a64 73645f73 69676e61 6c006d6b 74656d70 sd_signal.mktemp</span>
<span class="x"> 8a74 00707574 63686172 00707574 73006174 .putchar.puts.at</span>
<span class="x"> 8a84 65786974 006c6962 6c6f672e 736f006c exit.liblog.so.l</span>
<span class="x"> 8a94 69627371 6c697465 2e736f00 6c696263 ibsqlite.so.libc</span>
<span class="x"> 8aa4 7574696c 732e736f 006c6962 62696e64 utils.so.libbind</span>
<span class="x"> 8ab4 65722e73 6f006c69 62757469 6c732e73 er.so.libutils.s</span>
<span class="x"> 8ac4 6f006c69 62632e73 6f006c69 62737464 o.libc.so.libstd</span>
<span class="x"> 8ad4 632b2b2e 736f006c 69626d2e 736f00 c++.so.libm.so. </span>
<span class="x">Contents of section .rel.plt:</span>
<span class="x"> 8ae4 18a10000 16340000 1ca10000 16250000 .....4.......%..</span>
<span class="x"> 8af4 20a10000 161a0000 24a10000 161f0000 .......$.......</span>
<span class="x"> 8b04 28a10000 161b0000 2ca10000 16310000 (.......,....1..</span>
<span class="x"> 8b14 30a10000 162f0000 34a10000 16260000 0..../..4....&..</span>
<span class="x"> 8b24 38a10000 162a0000 3ca10000 162d0000 8....*..<....-..</span>
<span class="x"> 8b34 40a10000 162e0000 44a10000 16270000 @.......D....'..</span>
<span class="x"> 8b44 48a10000 16290000 4ca10000 16320000 H....)..L....2..</span>
<span class="x"> 8b54 50a10000 16300000 54a10000 16280000 P....0..T....(..</span>
<span class="x"> 8b64 58a10000 162b0000 5ca10000 16020000 X....+..\.......</span>
<span class="x"> 8b74 60a10000 163e0000 64a10000 163d0000 `....>..d....=..</span>
<span class="x"> 8b84 68a10000 16350000 6ca10000 16200000 h....5..l.... ..</span>
<span class="x"> 8b94 70a10000 160a0000 74a10000 163c0000 p.......t....<..</span>
<span class="x"> 8ba4 78a10000 16050000 7ca10000 161d0000 x.......|.......</span>
<span class="x"> 8bb4 80a10000 16210000 84a10000 16040000 .....!..........</span>
<span class="x"> 8bc4 88a10000 16220000 8ca10000 16240000 .....".......$..</span>
<span class="x"> 8bd4 90a10000 16230000 94a10000 16060000 .....#..........</span>
<span class="x"> 8be4 98a10000 16380000 9ca10000 16390000 .....8.......9..</span>
<span class="x"> 8bf4 a0a10000 16080000 a4a10000 161c0000 ................</span>
<span class="x"> 8c04 a8a10000 160b0000 aca10000 16070000 ................</span>
<span class="x"> 8c14 b0a10000 16370000 b4a10000 16360000 .....7.......6..</span>
<span class="x"> 8c24 b8a10000 16090000 bca10000 161e0000 ................</span>
<span class="x"> 8c34 c0a10000 16330000 c4a10000 163a0000 .....3.......:..</span>
<span class="x"> 8c44 c8a10000 163b0000 cca10000 163f0000 .....;.......?..</span>
<span class="x">Contents of section .rel.dyn:</span>
<span class="x"> 8c54 08a10000 15030000 ........ </span>
<span class="x">Contents of section .plt:</span>
<span class="x"> 8c5c 04e02de5 04e09fe5 0ee08fe0 08f0bee5 ..-.............</span>
<span class="x"> 8c6c a0140000 00c68fe2 01ca8ce2 a0f4bce5 ................</span>
<span class="x"> 8c7c 00c68fe2 01ca8ce2 98f4bce5 00c68fe2 ................</span>
<span class="x"> 8c8c 01ca8ce2 90f4bce5 00c68fe2 01ca8ce2 ................</span>
<span class="x"> 8c9c 88f4bce5 00c68fe2 01ca8ce2 80f4bce5 ................</span>
<span class="x"> 8cac 00c68fe2 01ca8ce2 78f4bce5 00c68fe2 ........x.......</span>
<span class="x"> 8cbc 01ca8ce2 70f4bce5 00c68fe2 01ca8ce2 ....p...........</span>
<span class="x"> 8ccc 68f4bce5 00c68fe2 01ca8ce2 60f4bce5 h...........`...</span>
<span class="x"> 8cdc 00c68fe2 01ca8ce2 58f4bce5 00c68fe2 ........X.......</span>
<span class="x"> 8cec 01ca8ce2 50f4bce5 00c68fe2 01ca8ce2 ....P...........</span>
<span class="x"> 8cfc 48f4bce5 00c68fe2 01ca8ce2 40f4bce5 H...........@...</span>
<span class="x"> 8d0c 00c68fe2 01ca8ce2 38f4bce5 00c68fe2 ........8.......</span>
<span class="x"> 8d1c 01ca8ce2 30f4bce5 00c68fe2 01ca8ce2 ....0...........</span>
<span class="x"> 8d2c 28f4bce5 00c68fe2 01ca8ce2 20f4bce5 (........... ...</span>
<span class="x"> 8d3c 00c68fe2 01ca8ce2 18f4bce5 00c68fe2 ................</span>
<span class="x"> 8d4c 01ca8ce2 10f4bce5 00c68fe2 01ca8ce2 ................</span>
<span class="x"> 8d5c 08f4bce5 00c68fe2 01ca8ce2 00f4bce5 ................</span>
<span class="x"> 8d6c 00c68fe2 01ca8ce2 f8f3bce5 00c68fe2 ................</span>
<span class="x"> 8d7c 01ca8ce2 f0f3bce5 00c68fe2 01ca8ce2 ................</span>
<span class="x"> 8d8c e8f3bce5 00c68fe2 01ca8ce2 e0f3bce5 ................</span>
<span class="x"> 8d9c 00c68fe2 01ca8ce2 d8f3bce5 00c68fe2 ................</span>
<span class="x"> 8dac 01ca8ce2 d0f3bce5 00c68fe2 01ca8ce2 ................</span>
<span class="x"> 8dbc c8f3bce5 00c68fe2 01ca8ce2 c0f3bce5 ................</span>
<span class="x"> 8dcc 00c68fe2 01ca8ce2 b8f3bce5 00c68fe2 ................</span>
<span class="x"> 8ddc 01ca8ce2 b0f3bce5 00c68fe2 01ca8ce2 ................</span>
<span class="x"> 8dec a8f3bce5 00c68fe2 01ca8ce2 a0f3bce5 ................</span>
<span class="x"> 8dfc 00c68fe2 01ca8ce2 98f3bce5 00c68fe2 ................</span>
<span class="x"> 8e0c 01ca8ce2 90f3bce5 00c68fe2 01ca8ce2 ................</span>
<span class="x"> 8e1c 88f3bce5 00c68fe2 01ca8ce2 80f3bce5 ................</span>
<span class="x"> 8e2c 00c68fe2 01ca8ce2 78f3bce5 00c68fe2 ........x.......</span>
<span class="x"> 8e3c 01ca8ce2 70f3bce5 00c68fe2 01ca8ce2 ....p...........</span>
<span class="x"> 8e4c 68f3bce5 00c68fe2 01ca8ce2 60f3bce5 h...........`...</span>
<span class="x"> 8e5c 00c68fe2 01ca8ce2 58f3bce5 00c68fe2 ........X.......</span>
<span class="x"> 8e6c 01ca8ce2 50f3bce5 00c68fe2 01ca8ce2 ....P...........</span>
<span class="x"> 8e7c 48f3bce5 00c68fe2 01ca8ce2 40f3bce5 H...........@...</span>
<span class="x"> 8e8c 00c68fe2 01ca8ce2 38f3bce5 ........8... </span>
<span class="x">Contents of section .text:</span>
<span class="x"> 8ea0 0d00a0e1 0010a0e3 04208fe2 04308fe2 ......... ...0..</span>
<span class="x"> 8eb0 6effffea d80200ea 00a00000 08a00000 n...............</span>
<span class="x"> 8ec0 10a00000 18a00000 0000a0e1 0000a0e1 ................</span>
<span class="x"> 8ed0 10b50446 036833b1 1a682146 52f80c0c ...F.h3..h!FR...</span>
<span class="x"> 8ee0 1818fff7 ccee2046 10bd00bf 00230360 ...... F.....#.`</span>
<span class="x"> 8ef0 704700bf 2de9f04f dff8f092 bfb0bc4d pG..-..O.......M</span>
<span class="x"> 8f00 80467d44 0f4655f8 09603021 92462691 .F}D.FU..`0!.F&.</span>
<span class="x"> 8f10 32680021 3d9227a8 5822fff7 b6ee26ac 2h.!=.'.X"....&.</span>
<span class="x"> 8f20 b4482146 7844b44a 7a4423ae fff7b2ee .H!FxD.JzD#.....</span>
<span class="x"> 8f30 2046fff7 b6ee0446 25a8fff7 b8eeddf8 F.....F%.......</span>
<span class="x"> 8f40 94b0ae49 dbf80000 7944d0f8 14903046 ...I....yD....0F</span>
<span class="x"> 8f50 fff7b2ee 24a85946 3246c847 3046fff7 ....$.YF2F.G0F..</span>
<span class="x"> 8f60 b2ee249b 13b94ff0 ff3722e1 0eae3046 ..$...O..7"...0F</span>
<span class="x"> 8f70 fff7aeee 02a8fff7 acee0df1 8809a049 ...............I</span>
<span class="x"> 8f80 48467944 fff798ee 49463046 fff7a6ee HFyD....IF0F....</span>
<span class="x"> 8f90 4846fff7 98ee0df1 84094846 fff7a6ff HF........HF....</span>
<span class="x"> 8fa0 49463046 fff7a0ee 4846fff7 91ff0df1 IF0F....HF......</span>
<span class="x"> 8fb0 80099449 48467944 fff77eee 49463046 ...IHFyD..~.IF0F</span>
<span class="x"> 8fc0 fff798ee 4846fff7 7eee0021 3046fff7 ....HF..~..!0F..</span>
<span class="x"> 8fd0 98ee0021 30460a46 fff798ee 00213046 ...!0F.F.....!0F</span>
<span class="x"> 8fe0 fff78eee 032c04dd 00213046 0a46fff7 .....,...!0F.F..</span>
<span class="x"> 8ff0 8eee0021 0eae0a46 3046fff7 88ee0021 ...!...F0F.....!</span>
<span class="x"> 9000 3046fff7 7eee062c 09dd0021 3046fff7 0F..~..,...!0F..</span>
<span class="x"> 9010 78ee0e2c 03dd3046 0021fff7 72ee0eac x..,..0F.!..r...</span>
<span class="x"> 9020 4ff0ff31 20461fae fff76aee 2046fff7 O..1 F....j. F..</span>
<span class="x"> 9030 74ee6d49 81462046 fff762ee 07212046 t.mI.F F..b..! F</span>
<span class="x"> 9040 fff75eee 00212046 fff75aee 30466e49 ..^..! F..Z.0FnI</span>
<span class="x"> 9050 7944fff7 32ee3146 2046fff7 4cee3046 yD..2.1F F..L.0F</span>
<span class="x"> 9060 fff730ee 00212046 1eaefff7 4aee3046 ..0..! F....J.0F</span>
<span class="x"> 9070 4146fff7 22ee3146 2046fff7 3cee3046 AF..".1F F..<.0F</span>
<span class="x"> 9080 fff720ee 00212046 1daefff7 3aee3046 .. ..! F....:.0F</span>
<span class="x"> 9090 5e497944 fff710ee 31462046 fff72aee ^IyD....1F F..*.</span>
<span class="x"> 90a0 3046fff7 10ee0121 2046fff7 2aee3946 0F.....! F..*.9F</span>
<span class="x"> 90b0 20461caf fff724ee 00212046 fff720ee F....$..! F.. .</span>
<span class="x"> 90c0 38465349 7944fff7 f8ed3946 2046fff7 8FSIyD....9F F..</span>
<span class="x"> 90d0 12ee3846 fff7f6ed 01212046 1baffff7 ..8F.....! F....</span>
<span class="x"> 90e0 10ee5146 2046fff7 0cee2046 fff714ee ..QF F.... F....</span>
<span class="x"> 90f0 a9f10401 06462046 fff714ee c9eb0601 .....F F........</span>
<span class="x"> 9100 2046fff7 feed3146 20461aae fff70aee F....1F F......</span>
<span class="x"> 9110 00212046 0a46fff7 faed4ff0 ff312046 .! F.F....O..1 F</span>
<span class="x"> 9120 fff7eeed 3846fff7 e1fe3946 2046fff7 ....8F....9F F..</span>
<span class="x"> 9130 dced3846 fff7ccfe 4ff0ff31 2046fff7 ..8F....O..1 F..</span>
<span class="x"> 9140 e0ed0021 20460a46 fff7e0ed 4ff0ff31 ...! F.F....O..1</span>
<span class="x"> 9150 2046fff7 d6ed3046 2e497944 fff7aced F....0F.IyD....</span>
<span class="x"> 9160 31462046 fff7c6ed 3046fff7 aced0021 1F F....0F.....!</span>
<span class="x"> 9170 204602ae fff7c4ed 00212046 fff7c0ed F.......! F....</span>
<span class="x"> 9180 4ff0ff31 2046fff7 bced2498 00210368 O..1 F....$..!.h</span>
<span class="x"> 9190 22460091 0e215f69 3346b847 0028b4bf "F...!_i3F.G.(..</span>
<span class="x"> 91a0 4ff0ff37 00273046 fff7c2ed 2046fff7 O..7.'0F.... F..</span>
<span class="x"> 91b0 c0ed24a8 fff78cfe 259b33b1 1a6825a9 ..$.....%.3..h%.</span>
<span class="x"> 91c0 52f80c0c 1818fff7 5aed3d99 dff81cc0 R.......Z.=.....</span>
<span class="x"> 91d0 384655f8 0c201368 994201d0 fff7aeed 8FU.. .h.B......</span>
<span class="x"> 91e0 3fb0bde8 f08f00bf 424e444c fcffffff ?.......BNDL....</span>
<span class="x"> 91f0 06120000 fc0a0000 0d0b0000 ef0a0000 ................</span>
<span class="x"> 9200 be0a0000 a70a0000 350a0000 ff090000 ........5.......</span>
<span class="x"> 9210 d1090000 3f090000 2de9f04f dff8e892 ....?...-..O....</span>
<span class="x"> 9220 bfb0ba4d 80467d44 0f4655f8 09603021 ...M.F}D.FU..`0!</span>
<span class="x"> 9230 92462691 32680021 3d9227a8 5822fff7 .F&.2h.!=.'.X"..</span>
<span class="x"> 9240 24ed26ac b2482146 7844b24a 7a4423ae $.&..H!FxD.JzD#.</span>
<span class="x"> 9250 fff720ed 2046fff7 24ed0446 25a8fff7 .. . F..$..F%...</span>
<span class="x"> 9260 26edddf8 94b0ac49 dbf80000 7944d0f8 &......I....yD..</span>
<span class="x"> 9270 14903046 fff720ed 24a85946 3246c847 ..0F.. .$.YF2F.G</span>
<span class="x"> 9280 3046fff7 20ed249b 13b94ff0 ff371fe1 0F.. .$...O..7..</span>
<span class="x"> 9290 0fae3046 fff71ced 03a8fff7 1aed0df1 ..0F............</span>
<span class="x"> 92a0 88099e49 48467944 fff706ed 49463046 ...IHFyD....IF0F</span>
<span class="x"> 92b0 fff714ed 4846fff7 06ed0df1 84094846 ....HF........HF</span>
<span class="x"> 92c0 fff714fe 49463046 fff70eed 4846fff7 ....IF0F....HF..</span>
<span class="x"> 92d0 fffd0df1 80099249 48467944 fff7ecec .......IHFyD....</span>
<span class="x"> 92e0 49463046 fff706ed 4846fff7 ecec0021 IF0F....HF.....!</span>
<span class="x"> 92f0 3046fff7 06ed0021 30460a46 fff706ed 0F.....!0F.F....</span>
<span class="x"> 9300 00213046 fff7fcec 032c04dd 00213046 .!0F.....,...!0F</span>
<span class="x"> 9310 0a46fff7 fcec0021 0fae0a46 3046fff7 .F.....!...F0F..</span>
<span class="x"> 9320 f6ec0021 3046fff7 ecec062c 09dd0021 ...!0F.....,...!</span>
<span class="x"> 9330 3046fff7 e6ec0e2c 03dd3046 0021fff7 0F.....,..0F.!..</span>
<span class="x"> 9340 e0ec0fac 4ff0ff31 20461fae fff7d8ec ....O..1 F......</span>
<span class="x"> 9350 2046fff7 e2ec6b49 81462046 fff7d0ec F....kI.F F....</span>
<span class="x"> 9360 07212046 fff7ccec 00212046 fff7c8ec .! F.....! F....</span>
<span class="x"> 9370 30466c49 7944fff7 a0ec3146 2046fff7 0FlIyD....1F F..</span>
<span class="x"> 9380 baec3046 fff79eec 01212046 1eaefff7 ..0F.....! F....</span>
<span class="x"> 9390 b8ec4146 2046fff7 b4ec0021 2046fff7 ..AF F.....! F..</span>
<span class="x"> 93a0 b0ec3046 60497944 fff786ec 31462046 ..0F`IyD....1F F</span>
<span class="x"> 93b0 fff7a0ec 3046fff7 86ec0121 2046fff7 ....0F.....! F..</span>
<span class="x"> 93c0 a0ec3946 20461daf fff79aec 00212046 ..9F F.......! F</span>
<span class="x"> 93d0 fff796ec 38465549 7944fff7 6eec3946 ....8FUIyD..n.9F</span>
<span class="x"> 93e0 2046fff7 88ec3846 fff76cec 01212046 F....8F..l..! F</span>
<span class="x"> 93f0 1caffff7 86ec5146 2046fff7 82ec2046 ......QF F.... F</span>
<span class="x"> 9400 fff78aec a9f10401 06462046 fff78aec .........F F....</span>
<span class="x"> 9410 c9eb0601 2046fff7 74ec3146 20461bae .... F..t.1F F..</span>
<span class="x"> 9420 fff780ec 00212046 0a46fff7 70ec4ff0 .....! F.F..p.O.</span>
<span class="x"> 9430 ff312046 fff764ec 3846fff7 57fd3946 .1 F..d.8F..W.9F</span>
<span class="x"> 9440 2046fff7 52ec3846 fff742fd 4ff0ff31 F..R.8F..B.O..1</span>
<span class="x"> 9450 2046fff7 56ec0021 20460a46 fff756ec F..V..! F.F..V.</span>
<span class="x"> 9460 4ff0ff31 2046fff7 4cec3046 30497944 O..1 F..L.0F0IyD</span>
<span class="x"> 9470 fff722ec 31462046 fff73cec 3046fff7 ..".1F F..<.0F..</span>
<span class="x"> 9480 22ec0021 20460a46 fff740ec 00212046 "..! F.F..@..! F</span>
<span class="x"> 9490 03aefff7 36ec0021 2046fff7 32ec4ff0 ....6..! F..2.O.</span>
<span class="x"> 94a0 ff312046 fff72cec 24980021 03682246 .1 F..,.$..!.h"F</span>
<span class="x"> 94b0 00910e21 5f693346 b8470028 b4bf4ff0 ...!_i3F.G.(..O.</span>
<span class="x"> 94c0 ff370027 3046fff7 34ec2046 fff730ec .7.'0F..4. F..0.</span>
<span class="x"> 94d0 24a8fff7 fdfc259b 33b11a68 25a952f8 $.....%.3..h%.R.</span>
<span class="x"> 94e0 0c0c1818 fff7caeb 3d99dff8 1cc03846 ........=.....8F</span>
<span class="x"> 94f0 55f80c20 13689942 01d0fff7 20ec3fb0 U.. .h.B.... .?.</span>
<span class="x"> 9500 bde8f08f 424e444c fcffffff e20e0000 ....BNDL........</span>
<span class="x"> 9510 d8070000 e9070000 cb070000 9a070000 ................</span>
<span class="x"> 9520 e9070000 78070000 eb060000 bd060000 ....x...........</span>
<span class="x"> 9530 2b060000 10b50f48 7844fff7 06ec0e48 +......HxD.....H</span>
<span class="x"> 9540 7844fff7 02ec0d48 7844fff7 feeb0c48 xD.....HxD.....H</span>
<span class="x"> 9550 7844fff7 faeb0a20 fff7fceb 09487844 xD..... .....HxD</span>
<span class="x"> 9560 fff7f2eb 08487844 fff7eeeb 0020fff7 .....HxD..... ..</span>
<span class="x"> 9570 f8eb00bf c1050000 cd050000 ce050000 ................</span>
<span class="x"> 9580 e3050000 ee050000 f6050000 2de9f04f ............-..O</span>
<span class="x"> 9590 30499fb0 0022304d 7d446858 03680120 0I..."0M}DhX.h. </span>
<span class="x"> 95a0 01461d93 fff7e2eb 04460028 b8bf4ff0 .F.......F.(..O.</span>
<span class="x"> 95b0 ff3440db 0df10409 284fdff8 a480294e .4@.....(O....)N</span>
<span class="x"> 95c0 dff8a4a0 7f44f844 7e4409f1 020bfa44 .....D.D~D.....D</span>
<span class="x"> 95d0 00216e22 4846fff7 58eb4146 38464ff0 .!n"HF..X.AF8FO.</span>
<span class="x"> 95e0 0102adf8 0420fff7 c8eb3846 fff7caeb ..... ....8F....</span>
<span class="x"> 95f0 6c210346 524646f8 f80c5846 fff7c8eb l!.FRFF...XF....</span>
<span class="x"> 9600 56f8f80c fff7caeb 6e222046 4946fff7 V.......n" FIF..</span>
<span class="x"> 9610 cceb0028 07dafff7 ceeb0368 622bd7d0 ...(.......hb+..</span>
<span class="x"> 9620 6ff00104 07e02046 0121fff7 caeb0028 o..... F.!.....(</span>
<span class="x"> 9630 b8bf6ff0 02041d99 dff818c0 204655f8 ..o......... FU.</span>
<span class="x"> 9640 0c301a68 914201d0 fff778eb 1fb0bde8 .0.h.B....x.....</span>
<span class="x"> 9650 f08f00bf fcffffff 700b0000 280c0000 ........p...(...</span>
<span class="x"> 9660 af050000 1c1d0000 e8050000 70b58022 ............p.."</span>
<span class="x"> 9670 a4b00546 1e2402ae 22943046 00242146 ...F.$..".0F.$!F</span>
<span class="x"> 9680 2394fff7 02eb6b11 01210df1 900c05f0 #.....k..!......</span>
<span class="x"> 9690 1f020ceb 830011fa 02f222ab 50f8881c ..........".P...</span>
<span class="x"> 96a0 0a433146 40f8882c 681c0093 22462346 .C1F@..,h..."F#F</span>
<span class="x"> 96b0 fff78ceb a04206dd 28462146 2246fff7 .....B..(F!F"F..</span>
<span class="x"> 96c0 8ceba042 01da4ff0 ff3024b0 70bd00bf ...B..O..0$.p...</span>
<span class="x"> 96d0 70b50020 184b7b44 5a681968 fff79cfd p.. .K{DZh.h....</span>
<span class="x"> 96e0 164b7b44 53f8f42c 022a1bdd 53f8f04c .K{DS..,.*..S..L</span>
<span class="x"> 96f0 13496568 79442846 fff774eb 28b11149 .IehyD(F..t.(..I</span>
<span class="x"> 9700 28467944 fff76eeb 60b904f1 0801a068 (FyD..n.`......h</span>
<span class="x"> 9710 fff76eeb 00280cda 0b487844 fff714eb ..n..(...HxD....</span>
<span class="x"> 9720 012007e0 09480a49 78447944 0022fff7 . ...H.IxDyD."..</span>
<span class="x"> 9730 66eb0020 70bd00bf f60a0000 021c0000 f.. p...........</span>
<span class="x"> 9740 c5040000 ba040000 ac040000 b4040000 ................</span>
<span class="x"> 9750 c1040000 10b5054b 4ff0ff30 7b441968 .......KO..0{D.h</span>
<span class="x"> 9760 5a68fff7 59fd0120 10bd00bf 700a0000 Zh..Y.. ....p...</span>
<span class="x"> 9770 10b5074c 7c4454f8 f80cfff7 10eb54f8 ...L|DT.......T.</span>
<span class="x"> 9780 f00c20b1 fff740eb 002344f8 f03c10bd .. ...@..#D..<..</span>
<span class="x"> 9790 701b0000 10b5fff7 ebff10bd 10b50446 p..............F</span>
<span class="x"> 97a0 fff7e6ff 2046fff7 dcea00bf 70b50546 .... F......p..F</span>
<span class="x"> 97b0 0c462846 fff75aff 00280adb 3f222146 .F(F..Z..(..?"!F</span>
<span class="x"> 97c0 fff728eb 002804db f3d00023 23541846 ..(..(.....##T.F</span>
<span class="x"> 97d0 01e04ff0 ff3070bd f0b50646 edb07a4d ..O..0p....F..zM</span>
<span class="x"> 97e0 0f467d44 79496858 022e0368 6b930ed1 .F}DyIhX...hk...</span>
<span class="x"> 97f0 7c687749 20467944 fff7f4ea 28b17549 |hwI FyD....(.uI</span>
<span class="x"> 9800 20467944 fff7eeea 08b9fff7 93fe721c FyD..........r.</span>
<span class="x"> 9810 714c9000 7c4444f8 f46cfff7 02eb44f8 qL..|DD..l....D.</span>
<span class="x"> 9820 f00c88b1 54f8f42c 511c8a00 0021fff7 ....T..,Q....!..</span>
<span class="x"> 9830 2cea54f8 f43c54f8 f00c9a00 3946fff7 ,.T..<T.....9F..</span>
<span class="x"> 9840 f6ea012e 03dc12e0 44f8f40c abe06349 ........D.....cI</span>
<span class="x"> 9850 78687944 fff7c6ea 064640b9 60487844 xhyD.....F@.`HxD</span>
<span class="x"> 9860 fff772ea 3046fff7 e8ea58b3 2de0fff7 ..r.0F....X.-...</span>
<span class="x"> 9870 eaea1bae 00214ff4 80725a4c 7c446060 .....!O..rZL|D``</span>
<span class="x"> 9880 3046fff7 02ea6268 30465749 79446f46 0F....bh0FWIyDoF</span>
<span class="x"> 9890 fff7deea 30466946 fff7e0ea 4022069e ....0FiF....@"..</span>
<span class="x"> 98a0 00212660 5bae3046 fff7eee9 4ff4fc71 .!&`[.0F....O..q</span>
<span class="x"> 98b0 4e487844 fff7d8ea fff768fe a0600028 NHxD......h..`.(</span>
<span class="x"> 98c0 33da2de0 fff7d6ea 10b14948 78441be0 3.-.......IHxD..</span>
<span class="x"> 98d0 54f8f40c 03281add 54f8f04c 4549a668 T....(..T..LEI.h</span>
<span class="x"> 98e0 79443046 fff77eea 28b14349 30467944 yD0F..~.(.CI0FyD</span>
<span class="x"> 98f0 fff778ea 58b904f1 0c01e068 fff778ea ..x.X......h..x.</span>
<span class="x"> 9900 002853da 3d487844 fff71eea 06e03c48 .(S.=HxD......<H</span>
<span class="x"> 9910 3c497844 79440022 fff770ea 012046e0 <IxDyD."..p.. F.</span>
<span class="x"> 9920 fff718ff 4ff0ff30 41e06268 2168364f ....O..0A.bh!h6O</span>
<span class="x"> 9930 7f4457f8 f80c354d fff7dcfa 7d440120 .DW...5M....}D. </span>
<span class="x"> 9940 2946fff7 9eea0d20 2946fff7 9aea0f20 )F..... )F..... </span>
<span class="x"> 9950 2946fff7 96ea2946 0620fff7 92ea2c48 )F....)F. ....,H</span>
<span class="x"> 9960 7844fff7 94eaa068 3146fff7 1fff0028 xD.....h1F.....(</span>
<span class="x"> 9970 08da6ff0 01002168 6268fff7 4dfc0120 ..o...!hbh..M.. </span>
<span class="x"> 9980 fff7eee9 23493046 7944fff7 2cea50b1 ....#I0FyD..,.P.</span>
<span class="x"> 9990 21493046 7944fff7 26ea0446 18b9fff7 !I0FyD..&..F....</span>
<span class="x"> 99a0 97fe2046 ece7fff7 d5fee8e7 00206b99 .. F......... k.</span>
<span class="x"> 99b0 dff818c0 55f80c20 13689942 01d0fff7 ....U.. .h.B....</span>
<span class="x"> 99c0 bee96db0 f0bd00bf 26090000 fcffffff ..m.....&.......</span>
<span class="x"> 99d0 f8030000 ef030000 d01a0000 a6030000 ................</span>
<span class="x"> 99e0 a7030000 50090000 98030000 7b030000 ....P.......{...</span>
<span class="x"> 99f0 8d030000 d9020000 ce020000 65030000 ............e...</span>
<span class="x"> 9a00 ca020000 d7020000 b4190000 5dfeffff ............]...</span>
<span class="x"> 9a10 31feffff f6020000 ef020000 04f01fe5 1...............</span>
<span class="x"> 9a20 d9970000 .... </span>
<span class="x">Contents of section .rodata:</span>
<span class="x"> 9a24 726f2e62 75696c64 2e766572 73696f6e ro.build.version</span>
<span class="x"> 9a34 2e73646b 00300061 63746976 69747900 .sdk.0.activity.</span>
<span class="x"> 9a44 616e6472 6f69642e 6170702e 49416374 android.app.IAct</span>
<span class="x"> 9a54 69766974 794d616e 61676572 00737263 ivityManager.src</span>
<span class="x"> 9a64 6c69622e 68757961 6e776569 2e706572 lib.huyanwei.per</span>
<span class="x"> 9a74 6d697373 696f6e67 72616e74 2e726571 missiongrant.req</span>
<span class="x"> 9a84 75657374 00736f63 6b65745f 61646472 uest.socket_addr</span>
<span class="x"> 9a94 00756964 00706964 00737263 6c69622e .uid.pid.srclib.</span>
<span class="x"> 9aa4 68757961 6e776569 2e706572 6d697373 huyanwei.permiss</span>
<span class="x"> 9ab4 696f6e67 72616e74 2e62726f 61646361 iongrant.broadca</span>
<span class="x"> 9ac4 73740073 72636c69 622e6875 79616e77 st.srclib.huyanw</span>
<span class="x"> 9ad4 65692e70 65726d69 7373696f 6e677261 ei.permissiongra</span>
<span class="x"> 9ae4 6e742e72 6573706f 6e736500 6772616e nt.response.gran</span>
<span class="x"> 9af4 745f7265 73756c74 00557361 67653a20 t_result.Usage: </span>
<span class="x"> 9b04 7375205b 6f707469 6f6e735d 004f7074 su [options].Opt</span>
<span class="x"> 9b14 696f6e73 3a002020 2d632c2d 2d636f6d ions:. -c,--com</span>
<span class="x"> 9b24 6d616e64 20636d64 20207275 6e20636d mand cmd run cm</span>
<span class="x"> 9b34 642e0020 202d682c 2d2d6865 6c702020 d.. -h,--help </span>
<span class="x"> 9b44 20202020 20202068 656c7000 41757468 help.Auth</span>
<span class="x"> 9b54 6f723a68 7579616e 77656900 456d6169 or:huyanwei.Emai</span>
<span class="x"> 9b64 6c3a7372 636c6962 40686f74 6d61696c l:srclib@hotmail</span>
<span class="x"> 9b74 2e636f6d 002f6461 74612f64 6174612f .com./data/data/</span>
<span class="x"> 9b84 7372636c 69622e68 7579616e 7765692e srclib.huyanwei.</span>
<span class="x"> 9b94 7065726d 69737369 6f6e6772 616e742f permissiongrant/</span>
<span class="x"> 9ba4 2e736f63 6b65742e 7372636c 69622e58 .socket.srclib.X</span>
<span class="x"> 9bb4 58585858 58002573 002d6300 2d2d636f XXXXX.%s.-c.--co</span>
<span class="x"> 9bc4 6d6d616e 64007375 202d6320 636f6d6d mmand.su -c comm</span>
<span class="x"> 9bd4 616e6420 6572726f 722e0d00 2f737973 and error.../sys</span>
<span class="x"> 9be4 74656d2f 62696e2f 73680073 68002d68 tem/bin/sh.sh.-h</span>
<span class="x"> 9bf4 002d2d68 656c7000 2a236875 79616e77 .--help.*#huyanw</span>
<span class="x"> 9c04 6569232a 00687579 616e7765 69206772 ei#*.huyanwei gr</span>
<span class="x"> 9c14 616e7420 73756363 65737366 756c202e ant successful .</span>
<span class="x"> 9c24 2e2e0d00 2f70726f 632f2564 002f6461 ..../proc/%d./da</span>
<span class="x"> 9c34 74612f64 6174612f 7372636c 69622e68 ta/data/srclib.h</span>
<span class="x"> 9c44 7579616e 7765692e 7065726d 69737369 uyanwei.permissi</span>
<span class="x"> 9c54 6f6e6772 616e742f 00737520 73776974 ongrant/.su swit</span>
<span class="x"> 9c64 63682065 72726f72 2e0d0073 7520636f ch error...su co</span>
<span class="x"> 9c74 6d6d616e 64206572 726f722e 0d004445 mmand error...DE</span>
<span class="x"> 9c84 4e590041 4c4c4f57 00 NY.ALLOW. </span>
<span class="x">Contents of section .ARM.exidx:</span>
<span class="x"> 9c90 8cfdff7f 01000000 38f2ff7f b0b0a880 ........8.......</span>
<span class="x"> 9ca0 4cf2ff7f b0b0b080 4cf2ff7f b0af3e80 L.......L.....>.</span>
<span class="x"> 9cb0 84f8ff7f b0b0a880 d4f8ff7f b0af1e80 ................</span>
<span class="x"> 9cc0 acf9ff7f b0aa2380 08faff7f b0b0aa80 ......#.........</span>
<span class="x"> 9cd0 84faff7f b0b0a880 d4faff7f b0b0aa80 ................</span>
<span class="x"> 9ce0 f8faff7f ab3f2c80 .....?,. </span>
<span class="x">Contents of section .preinit_array:</span>
<span class="x"> a000 ffffffff 00000000 ........ </span>
<span class="x">Contents of section .init_array:</span>
<span class="x"> a008 ffffffff 00000000 ........ </span>
<span class="x">Contents of section .fini_array:</span>
<span class="x"> a010 ffffffff 00000000 ........ </span>
<span class="x">Contents of section .ctors:</span>
<span class="x"> a018 ffffffff 00000000 ........ </span>
<span class="x">Contents of section .dynamic:</span>
<span class="x"> a020 03000000 0ca10000 02000000 70010000 ............p...</span>
<span class="x"> a030 17000000 e48a0000 14000000 11000000 ................</span>
<span class="x"> a040 11000000 548c0000 12000000 08000000 ....T...........</span>
<span class="x"> a050 13000000 08000000 15000000 00000000 ................</span>
<span class="x"> a060 06000000 c4820000 0b000000 10000000 ................</span>
<span class="x"> a070 05000000 c4860000 0a000000 1f040000 ................</span>
<span class="x"> a080 04000000 28810000 01000000 c5030000 ....(...........</span>
<span class="x"> a090 01000000 cf030000 01000000 dc030000 ................</span>
<span class="x"> a0a0 01000000 e9030000 01000000 f6030000 ................</span>
<span class="x"> a0b0 01000000 02040000 01000000 0a040000 ................</span>
<span class="x"> a0c0 01000000 17040000 20000000 00a00000 ........ .......</span>
<span class="x"> a0d0 21000000 08000000 19000000 08a00000 !...............</span>
<span class="x"> a0e0 1b000000 08000000 1a000000 10a00000 ................</span>
<span class="x"> a0f0 1c000000 08000000 1e000000 00000000 ................</span>
<span class="x"> a100 00000000 00000000 ........ </span>
<span class="x">Contents of section .got:</span>
<span class="x"> a108 00000000 00000000 00000000 00000000 ................</span>
<span class="x"> a118 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a128 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a138 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a148 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a158 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a168 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a178 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a188 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a198 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a1a8 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a1b8 5c8c0000 5c8c0000 5c8c0000 5c8c0000 \...\...\...\...</span>
<span class="x"> a1c8 5c8c0000 5c8c0000 \...\... </span>
<span class="x">Contents of section .data:</span>
<span class="x"> a1d0 ffffffff ffffffff ffffffff ............ </span>
<span class="x">Contents of section .note.gnu.gold-version:</span>
<span class="x"> 0000 04000000 08000000 04000000 474e5500 ............GNU.</span>
<span class="x"> 0010 676f6c64 20312e39 gold 1.9 </span>
<span class="x">Contents of section .ARM.attributes:</span>
<span class="x"> 0000 41310000 00616561 62690001 27000000 A1...aeabi..'...</span>
<span class="x"> 0010 0541524d 20763700 060a0741 08010902 .ARM v7....A....</span>
<span class="x"> 0020 0a030c01 12041401 15011703 18011a02 ................</span>
<span class="x"> 0030 1b03 .. </span>
Disassembly of section <span class="nl">.plt</span><span class="p">:</span>
<span class="mh">00008c5c</span> <span class="p"><</span><span class="nf">__libc_init@plt</span><span class="p">-</span><span class="mh">0x14</span><span class="p">>:</span>
<span class="x"> 8c5c: e52de004 push {lr} ; (str lr, [sp, #-4]!)</span>
<span class="x"> 8c60: e59fe004 ldr lr, [pc, #4] ; 8c6c <__libc_init@plt-0x4></span>
<span class="x"> 8c64: e08fe00e add lr, pc, lr</span>
<span class="x"> 8c68: e5bef008 ldr pc, [lr, #8]!</span>
<span class="x"> 8c6c: 000014a0 andeq r1, r0, r0, lsr #9</span>
<span class="mh">00008c70</span> <span class="p"><</span><span class="nf">__libc_init@plt</span><span class="p">>:</span>
<span class="x"> 8c70: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8c74: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8c78: e5bcf4a0 ldr pc, [ip, #1184]! ; 0x4a0</span>
<span class="mh">00008c7c</span> <span class="p"><</span><span class="nf">android::RefBase::decStrong(void const*) const@plt</span><span class="p">>:</span>
<span class="x"> 8c7c: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8c80: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8c84: e5bcf498 ldr pc, [ip, #1176]! ; 0x498</span>
<span class="mh">00008c88</span> <span class="p"><</span><span class="nf">memset@plt</span><span class="p">>:</span>
<span class="x"> 8c88: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8c8c: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8c90: e5bcf490 ldr pc, [ip, #1168]! ; 0x490</span>
<span class="mh">00008c94</span> <span class="p"><</span><span class="nf">property_get@plt</span><span class="p">>:</span>
<span class="x"> 8c94: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8c98: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8c9c: e5bcf488 ldr pc, [ip, #1160]! ; 0x488</span>
<span class="mh">00008ca0</span> <span class="p"><</span><span class="nf">atoi@plt</span><span class="p">>:</span>
<span class="x"> 8ca0: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8ca4: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8ca8: e5bcf480 ldr pc, [ip, #1152]! ; 0x480</span>
<span class="mh">00008cac</span> <span class="p"><</span><span class="nf">android::defaultServiceManager()@plt</span><span class="p">>:</span>
<span class="x"> 8cac: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8cb0: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8cb4: e5bcf478 ldr pc, [ip, #1144]! ; 0x478</span>
<span class="mh">00008cb8</span> <span class="p"><</span><span class="nf">android::String16::String16(char const*)@plt</span><span class="p">>:</span>
<span class="x"> 8cb8: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8cbc: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8cc0: e5bcf470 ldr pc, [ip, #1136]! ; 0x470</span>
<span class="mh">00008cc4</span> <span class="p"><</span><span class="nf">android::String16::~String16()@plt</span><span class="p">>:</span>
<span class="x"> 8cc4: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8cc8: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8ccc: e5bcf468 ldr pc, [ip, #1128]! ; 0x468</span>
<span class="mh">00008cd0</span> <span class="p"><</span><span class="nf">android::Parcel::Parcel()@plt</span><span class="p">>:</span>
<span class="x"> 8cd0: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8cd4: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8cd8: e5bcf460 ldr pc, [ip, #1120]! ; 0x460</span>
<span class="mh">00008cdc</span> <span class="p"><</span><span class="nf">android::Parcel::writeInterfaceToken(android::String16 const&)@plt</span><span class="p">>:</span>
<span class="x"> 8cdc: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8ce0: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8ce4: e5bcf458 ldr pc, [ip, #1112]! ; 0x458</span>
<span class="mh">00008ce8</span> <span class="p"><</span><span class="nf">android::Parcel::writeStrongBinder(android::sp<android::IBinder> const&)@plt</span><span class="p">>:</span>
<span class="x"> 8ce8: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8cec: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8cf0: e5bcf450 ldr pc, [ip, #1104]! ; 0x450</span>
<span class="mh">00008cf4</span> <span class="p"><</span><span class="nf">android::Parcel::writeString16(android::String16 const&)@plt</span><span class="p">>:</span>
<span class="x"> 8cf4: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8cf8: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8cfc: e5bcf448 ldr pc, [ip, #1096]! ; 0x448</span>
<span class="mh">00008d00</span> <span class="p"><</span><span class="nf">android::Parcel::writeInt32(int)@plt</span><span class="p">>:</span>
<span class="x"> 8d00: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d04: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d08: e5bcf440 ldr pc, [ip, #1088]! ; 0x440</span>
<span class="mh">00008d0c</span> <span class="p"><</span><span class="nf">android::Parcel::writeString16(unsigned short const*, unsigned int)@plt</span><span class="p">>:</span>
<span class="x"> 8d0c: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d10: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d14: e5bcf438 ldr pc, [ip, #1080]! ; 0x438</span>
<span class="mh">00008d18</span> <span class="p"><</span><span class="nf">android::Parcel::dataPosition() const@plt</span><span class="p">>:</span>
<span class="x"> 8d18: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d1c: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d20: e5bcf430 ldr pc, [ip, #1072]! ; 0x430</span>
<span class="mh">00008d24</span> <span class="p"><</span><span class="nf">android::Parcel::setDataPosition(unsigned int) const@plt</span><span class="p">>:</span>
<span class="x"> 8d24: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d28: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d2c: e5bcf428 ldr pc, [ip, #1064]! ; 0x428</span>
<span class="mh">00008d30</span> <span class="p"><</span><span class="nf">android::Parcel::~Parcel()@plt</span><span class="p">>:</span>
<span class="x"> 8d30: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d34: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d38: e5bcf420 ldr pc, [ip, #1056]! ; 0x420</span>
<span class="mh">00008d3c</span> <span class="p"><</span><span class="nf">__stack_chk_fail@plt</span><span class="p">>:</span>
<span class="x"> 8d3c: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d40: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d44: e5bcf418 ldr pc, [ip, #1048]! ; 0x418</span>
<span class="mh">00008d48</span> <span class="p"><</span><span class="nf">puts@plt</span><span class="p">>:</span>
<span class="x"> 8d48: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d4c: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d50: e5bcf410 ldr pc, [ip, #1040]! ; 0x410</span>
<span class="mh">00008d54</span> <span class="p"><</span><span class="nf">putchar@plt</span><span class="p">>:</span>
<span class="x"> 8d54: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d58: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d5c: e5bcf408 ldr pc, [ip, #1032]! ; 0x408</span>
<span class="mh">00008d60</span> <span class="p"><</span><span class="nf">exit@plt</span><span class="p">>:</span>
<span class="x"> 8d60: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d64: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d68: e5bcf400 ldr pc, [ip, #1024]! ; 0x400</span>
<span class="mh">00008d6c</span> <span class="p"><</span><span class="nf">socket@plt</span><span class="p">>:</span>
<span class="x"> 8d6c: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d70: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d74: e5bcf3f8 ldr pc, [ip, #1016]! ; 0x3f8</span>
<span class="mh">00008d78</span> <span class="p"><</span><span class="nf">strcpy@plt</span><span class="p">>:</span>
<span class="x"> 8d78: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d7c: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d80: e5bcf3f0 ldr pc, [ip, #1008]! ; 0x3f0</span>
<span class="mh">00008d84</span> <span class="p"><</span><span class="nf">mktemp@plt</span><span class="p">>:</span>
<span class="x"> 8d84: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d88: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d8c: e5bcf3e8 ldr pc, [ip, #1000]! ; 0x3e8</span>
<span class="mh">00008d90</span> <span class="p"><</span><span class="nf">snprintf@plt</span><span class="p">>:</span>
<span class="x"> 8d90: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8d94: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8d98: e5bcf3e0 ldr pc, [ip, #992]! ; 0x3e0</span>
<span class="mh">00008d9c</span> <span class="p"><</span><span class="nf">unlink@plt</span><span class="p">>:</span>
<span class="x"> 8d9c: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8da0: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8da4: e5bcf3d8 ldr pc, [ip, #984]! ; 0x3d8</span>
<span class="mh">00008da8</span> <span class="p"><</span><span class="nf">bind@plt</span><span class="p">>:</span>
<span class="x"> 8da8: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8dac: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8db0: e5bcf3d0 ldr pc, [ip, #976]! ; 0x3d0</span>
<span class="mh">00008db4</span> <span class="p"><</span><span class="nf">__errno@plt</span><span class="p">>:</span>
<span class="x"> 8db4: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8db8: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8dbc: e5bcf3c8 ldr pc, [ip, #968]! ; 0x3c8</span>
<span class="mh">00008dc0</span> <span class="p"><</span><span class="nf">listen@plt</span><span class="p">>:</span>
<span class="x"> 8dc0: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8dc4: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8dc8: e5bcf3c0 ldr pc, [ip, #960]! ; 0x3c0</span>
<span class="mh">00008dcc</span> <span class="p"><</span><span class="nf">select@plt</span><span class="p">>:</span>
<span class="x"> 8dcc: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8dd0: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8dd4: e5bcf3b8 ldr pc, [ip, #952]! ; 0x3b8</span>
<span class="mh">00008dd8</span> <span class="p"><</span><span class="nf">accept@plt</span><span class="p">>:</span>
<span class="x"> 8dd8: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8ddc: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8de0: e5bcf3b0 ldr pc, [ip, #944]! ; 0x3b0</span>
<span class="mh">00008de4</span> <span class="p"><</span><span class="nf">strcmp@plt</span><span class="p">>:</span>
<span class="x"> 8de4: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8de8: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8dec: e5bcf3a8 ldr pc, [ip, #936]! ; 0x3a8</span>
<span class="mh">00008df0</span> <span class="p"><</span><span class="nf">execvp@plt</span><span class="p">>:</span>
<span class="x"> 8df0: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8df4: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8df8: e5bcf3a0 ldr pc, [ip, #928]! ; 0x3a0</span>
<span class="mh">00008dfc</span> <span class="p"><</span><span class="nf">execlp@plt</span><span class="p">>:</span>
<span class="x"> 8dfc: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e00: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e04: e5bcf398 ldr pc, [ip, #920]! ; 0x398</span>
<span class="mh">00008e08</span> <span class="p"><</span><span class="nf">free@plt</span><span class="p">>:</span>
<span class="x"> 8e08: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e0c: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e10: e5bcf390 ldr pc, [ip, #912]! ; 0x390</span>
<span class="mh">00008e14</span> <span class="p"><</span><span class="nf">read@plt</span><span class="p">>:</span>
<span class="x"> 8e14: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e18: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e1c: e5bcf388 ldr pc, [ip, #904]! ; 0x388</span>
<span class="mh">00008e20</span> <span class="p"><</span><span class="nf">malloc@plt</span><span class="p">>:</span>
<span class="x"> 8e20: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e24: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e28: e5bcf380 ldr pc, [ip, #896]! ; 0x380</span>
<span class="mh">00008e2c</span> <span class="p"><</span><span class="nf">memcpy@plt</span><span class="p">>:</span>
<span class="x"> 8e2c: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e30: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e34: e5bcf378 ldr pc, [ip, #888]! ; 0x378</span>
<span class="mh">00008e38</span> <span class="p"><</span><span class="nf">setgid@plt</span><span class="p">>:</span>
<span class="x"> 8e38: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e3c: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e40: e5bcf370 ldr pc, [ip, #880]! ; 0x370</span>
<span class="mh">00008e44</span> <span class="p"><</span><span class="nf">getppid@plt</span><span class="p">>:</span>
<span class="x"> 8e44: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e48: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e4c: e5bcf368 ldr pc, [ip, #872]! ; 0x368</span>
<span class="mh">00008e50</span> <span class="p"><</span><span class="nf">sprintf@plt</span><span class="p">>:</span>
<span class="x"> 8e50: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e54: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e58: e5bcf360 ldr pc, [ip, #864]! ; 0x360</span>
<span class="mh">00008e5c</span> <span class="p"><</span><span class="nf">stat@plt</span><span class="p">>:</span>
<span class="x"> 8e5c: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e60: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e64: e5bcf358 ldr pc, [ip, #856]! ; 0x358</span>
<span class="mh">00008e68</span> <span class="p"><</span><span class="nf">mkdir@plt</span><span class="p">>:</span>
<span class="x"> 8e68: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e6c: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e70: e5bcf350 ldr pc, [ip, #848]! ; 0x350</span>
<span class="mh">00008e74</span> <span class="p"><</span><span class="nf">setuid@plt</span><span class="p">>:</span>
<span class="x"> 8e74: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e78: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e7c: e5bcf348 ldr pc, [ip, #840]! ; 0x348</span>
<span class="mh">00008e80</span> <span class="p"><</span><span class="nf">bsd_signal@plt</span><span class="p">>:</span>
<span class="x"> 8e80: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e84: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e88: e5bcf340 ldr pc, [ip, #832]! ; 0x340</span>
<span class="mh">00008e8c</span> <span class="p"><</span><span class="nf">atexit@plt</span><span class="p">>:</span>
<span class="x"> 8e8c: e28fc600 add ip, pc, #0, 12</span>
<span class="x"> 8e90: e28cca01 add ip, ip, #4096 ; 0x1000</span>
<span class="x"> 8e94: e5bcf338 ldr pc, [ip, #824]! ; 0x338</span>
Disassembly of section <span class="nl">.text</span><span class="p">:</span>
<span class="mh">00008ea0</span> <span class="p"><</span><span class="nf">android::sp<android::IBinder>::~sp()</span><span class="p">-</span><span class="mh">0x30</span><span class="p">>:</span>
<span class="x"> 8ea0: e1a0000d mov r0, sp</span>
<span class="x"> 8ea4: e3a01000 mov r1, #0</span>
<span class="x"> 8ea8: e28f2004 add r2, pc, #4</span>
<span class="x"> 8eac: e28f3004 add r3, pc, #4</span>
<span class="x"> 8eb0: eaffff6e b 8c70 <__libc_init@plt></span>
<span class="x"> 8eb4: ea0002d8 b 9a1c <android::sp<android::IBinder>::~sp()+0xb4c></span>
<span class="x"> 8eb8: 0000a000 andeq sl, r0, r0</span>
<span class="x"> 8ebc: 0000a008 andeq sl, r0, r8</span>
<span class="x"> 8ec0: 0000a010 andeq sl, r0, r0, lsl r0</span>
<span class="x"> 8ec4: 0000a018 andeq sl, r0, r8, lsl r0</span>
<span class="x"> 8ec8: e1a00000 nop ; (mov r0, r0)</span>
<span class="x"> 8ecc: e1a00000 nop ; (mov r0, r0)</span>
<span class="mh">00008ed0</span> <span class="p"><</span><span class="nf">android::sp<android::IBinder>::~sp()</span><span class="p">>:</span>
<span class="x"> 8ed0: b510 push {r4, lr}</span>
<span class="x"> 8ed2: 4604 mov r4, r0</span>
<span class="x"> 8ed4: 6803 ldr r3, [r0, #0]</span>
<span class="x"> 8ed6: b133 cbz r3, 8ee6 <android::sp<android::IBinder>::~sp()+0x16></span>
<span class="x"> 8ed8: 681a ldr r2, [r3, #0]</span>
<span class="x"> 8eda: 4621 mov r1, r4</span>
<span class="x"> 8edc: f852 0c0c ldr.w r0, [r2, #-12]</span>
<span class="x"> 8ee0: 1818 adds r0, r3, r0</span>
<span class="x"> 8ee2: f7ff eecc blx 8c7c <android::RefBase::decStrong(void const*) const@plt></span>
<span class="x"> 8ee6: 4620 mov r0, r4</span>
<span class="x"> 8ee8: bd10 pop {r4, pc}</span>
<span class="x"> 8eea: bf00 nop</span>
<span class="x"> 8eec: 2300 movs r3, #0</span>
<span class="x"> 8eee: 6003 str r3, [r0, #0]</span>
<span class="x"> 8ef0: 4770 bx lr</span>
<span class="x"> 8ef2: bf00 nop</span>
<span class="x"> 8ef4: e92d 4ff0 stmdb sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}</span>
<span class="x"> 8ef8: f8df 92f0 ldr.w r9, [pc, #752] ; 91ec <android::sp<android::IBinder>::~sp()+0x31c></span>
<span class="x"> 8efc: b0bf sub sp, #252 ; 0xfc</span>
<span class="x"> 8efe: 4dbc ldr r5, [pc, #752] ; (91f0 <android::sp<android::IBinder>::~sp()+0x320>)</span>
<span class="x"> 8f00: 4680 mov r8, r0</span>
<span class="x"> 8f02: 447d add r5, pc</span>
<span class="x"> 8f04: 460f mov r7, r1</span>
<span class="x"> 8f06: f855 6009 ldr.w r6, [r5, r9]</span>
<span class="x"> 8f0a: 2130 movs r1, #48 ; 0x30</span>
<span class="x"> 8f0c: 4692 mov sl, r2</span>
<span class="x"> 8f0e: 9126 str r1, [sp, #152] ; 0x98</span>
<span class="x"> 8f10: 6832 ldr r2, [r6, #0]</span>
<span class="x"> 8f12: 2100 movs r1, #0</span>
<span class="x"> 8f14: 923d str r2, [sp, #244] ; 0xf4</span>
<span class="x"> 8f16: a827 add r0, sp, #156 ; 0x9c</span>
<span class="x"> 8f18: 2258 movs r2, #88 ; 0x58</span>
<span class="x"> 8f1a: f7ff eeb6 blx 8c88 <memset@plt></span>
<span class="x"> 8f1e: ac26 add r4, sp, #152 ; 0x98</span>
<span class="x"> 8f20: 48b4 ldr r0, [pc, #720] ; (91f4 <android::sp<android::IBinder>::~sp()+0x324>)</span>
<span class="x"> 8f22: 4621 mov r1, r4</span>
<span class="x"> 8f24: 4478 add r0, pc</span>
<span class="x"> 8f26: 4ab4 ldr r2, [pc, #720] ; (91f8 <android::sp<android::IBinder>::~sp()+0x328>)</span>
<span class="x"> 8f28: 447a add r2, pc</span>
<span class="x"> 8f2a: ae23 add r6, sp, #140 ; 0x8c</span>
<span class="x"> 8f2c: f7ff eeb2 blx 8c94 <property_get@plt></span>
<span class="x"> 8f30: 4620 mov r0, r4</span>
<span class="x"> 8f32: f7ff eeb6 blx 8ca0 <atoi@plt></span>
<span class="x"> 8f36: 4604 mov r4, r0</span>
<span class="x"> 8f38: a825 add r0, sp, #148 ; 0x94</span>
<span class="x"> 8f3a: f7ff eeb8 blx 8cac <android::defaultServiceManager()@plt></span>
<span class="x"> 8f3e: f8dd b094 ldr.w fp, [sp, #148] ; 0x94</span>
<span class="x"> 8f42: 49ae ldr r1, [pc, #696] ; (91fc <android::sp<android::IBinder>::~sp()+0x32c>)</span>
<span class="x"> 8f44: f8db 0000 ldr.w r0, [fp]</span>
<span class="x"> 8f48: 4479 add r1, pc</span>
<span class="x"> 8f4a: f8d0 9014 ldr.w r9, [r0, #20]</span>
<span class="x"> 8f4e: 4630 mov r0, r6</span>
<span class="x"> 8f50: f7ff eeb2 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 8f54: a824 add r0, sp, #144 ; 0x90</span>
<span class="x"> 8f56: 4659 mov r1, fp</span>
<span class="x"> 8f58: 4632 mov r2, r6</span>
<span class="x"> 8f5a: 47c8 blx r9</span>
<span class="x"> 8f5c: 4630 mov r0, r6</span>
<span class="x"> 8f5e: f7ff eeb2 blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 8f62: 9b24 ldr r3, [sp, #144] ; 0x90</span>
<span class="x"> 8f64: b913 cbnz r3, 8f6c <android::sp<android::IBinder>::~sp()+0x9c></span>
<span class="x"> 8f66: f04f 37ff mov.w r7, #4294967295 ; 0xffffffff</span>
<span class="x"> 8f6a: e122 b.n 91b2 <android::sp<android::IBinder>::~sp()+0x2e2></span>
<span class="x"> 8f6c: ae0e add r6, sp, #56 ; 0x38</span>
<span class="x"> 8f6e: 4630 mov r0, r6</span>
<span class="x"> 8f70: f7ff eeae blx 8cd0 <android::Parcel::Parcel()@plt></span>
<span class="x"> 8f74: a802 add r0, sp, #8</span>
<span class="x"> 8f76: f7ff eeac blx 8cd0 <android::Parcel::Parcel()@plt></span>
<span class="x"> 8f7a: f10d 0988 add.w r9, sp, #136 ; 0x88</span>
<span class="x"> 8f7e: 49a0 ldr r1, [pc, #640] ; (9200 <android::sp<android::IBinder>::~sp()+0x330>)</span>
<span class="x"> 8f80: 4648 mov r0, r9</span>
<span class="x"> 8f82: 4479 add r1, pc</span>
<span class="x"> 8f84: f7ff ee98 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 8f88: 4649 mov r1, r9</span>
<span class="x"> 8f8a: 4630 mov r0, r6</span>
<span class="x"> 8f8c: f7ff eea6 blx 8cdc <android::Parcel::writeInterfaceToken(android::String16 const&)@plt></span>
<span class="x"> 8f90: 4648 mov r0, r9</span>
<span class="x"> 8f92: f7ff ee98 blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 8f96: f10d 0984 add.w r9, sp, #132 ; 0x84</span>
<span class="x"> 8f9a: 4648 mov r0, r9</span>
<span class="x"> 8f9c: f7ff ffa6 bl 8eec <android::sp<android::IBinder>::~sp()+0x1c></span>
<span class="x"> 8fa0: 4649 mov r1, r9</span>
<span class="x"> 8fa2: 4630 mov r0, r6</span>
<span class="x"> 8fa4: f7ff eea0 blx 8ce8 <android::Parcel::writeStrongBinder(android::sp<android::IBinder> const&)@plt></span>
<span class="x"> 8fa8: 4648 mov r0, r9</span>
<span class="x"> 8faa: f7ff ff91 bl 8ed0 <android::sp<android::IBinder>::~sp()></span>
<span class="x"> 8fae: f10d 0980 add.w r9, sp, #128 ; 0x80</span>
<span class="x"> 8fb2: 4994 ldr r1, [pc, #592] ; (9204 <android::sp<android::IBinder>::~sp()+0x334>)</span>
<span class="x"> 8fb4: 4648 mov r0, r9</span>
<span class="x"> 8fb6: 4479 add r1, pc</span>
<span class="x"> 8fb8: f7ff ee7e blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 8fbc: 4649 mov r1, r9</span>
<span class="x"> 8fbe: 4630 mov r0, r6</span>
<span class="x"> 8fc0: f7ff ee98 blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 8fc4: 4648 mov r0, r9</span>
<span class="x"> 8fc6: f7ff ee7e blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 8fca: 2100 movs r1, #0</span>
<span class="x"> 8fcc: 4630 mov r0, r6</span>
<span class="x"> 8fce: f7ff ee98 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 8fd2: 2100 movs r1, #0</span>
<span class="x"> 8fd4: 4630 mov r0, r6</span>
<span class="x"> 8fd6: 460a mov r2, r1</span>
<span class="x"> 8fd8: f7ff ee98 blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 8fdc: 2100 movs r1, #0</span>
<span class="x"> 8fde: 4630 mov r0, r6</span>
<span class="x"> 8fe0: f7ff ee8e blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 8fe4: 2c03 cmp r4, #3</span>
<span class="x"> 8fe6: dd04 ble.n 8ff2 <android::sp<android::IBinder>::~sp()+0x122></span>
<span class="x"> 8fe8: 2100 movs r1, #0</span>
<span class="x"> 8fea: 4630 mov r0, r6</span>
<span class="x"> 8fec: 460a mov r2, r1</span>
<span class="x"> 8fee: f7ff ee8e blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 8ff2: 2100 movs r1, #0</span>
<span class="x"> 8ff4: ae0e add r6, sp, #56 ; 0x38</span>
<span class="x"> 8ff6: 460a mov r2, r1</span>
<span class="x"> 8ff8: 4630 mov r0, r6</span>
<span class="x"> 8ffa: f7ff ee88 blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 8ffe: 2100 movs r1, #0</span>
<span class="x"> 9000: 4630 mov r0, r6</span>
<span class="x"> 9002: f7ff ee7e blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9006: 2c06 cmp r4, #6</span>
<span class="x"> 9008: dd09 ble.n 901e <android::sp<android::IBinder>::~sp()+0x14e></span>
<span class="x"> 900a: 2100 movs r1, #0</span>
<span class="x"> 900c: 4630 mov r0, r6</span>
<span class="x"> 900e: f7ff ee78 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9012: 2c0e cmp r4, #14</span>
<span class="x"> 9014: dd03 ble.n 901e <android::sp<android::IBinder>::~sp()+0x14e></span>
<span class="x"> 9016: 4630 mov r0, r6</span>
<span class="x"> 9018: 2100 movs r1, #0</span>
<span class="x"> 901a: f7ff ee72 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 901e: ac0e add r4, sp, #56 ; 0x38</span>
<span class="x"> 9020: f04f 31ff mov.w r1, #4294967295 ; 0xffffffff</span>
<span class="x"> 9024: 4620 mov r0, r4</span>
<span class="x"> 9026: ae1f add r6, sp, #124 ; 0x7c</span>
<span class="x"> 9028: f7ff ee6a blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 902c: 4620 mov r0, r4</span>
<span class="x"> 902e: f7ff ee74 blx 8d18 <android::Parcel::dataPosition() const@plt></span>
<span class="x"> 9032: 496d ldr r1, [pc, #436] ; (91e8 <android::sp<android::IBinder>::~sp()+0x318>)</span>
<span class="x"> 9034: 4681 mov r9, r0</span>
<span class="x"> 9036: 4620 mov r0, r4</span>
<span class="x"> 9038: f7ff ee62 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 903c: 2107 movs r1, #7</span>
<span class="x"> 903e: 4620 mov r0, r4</span>
<span class="x"> 9040: f7ff ee5e blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9044: 2100 movs r1, #0</span>
<span class="x"> 9046: 4620 mov r0, r4</span>
<span class="x"> 9048: f7ff ee5a blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 904c: 4630 mov r0, r6</span>
<span class="x"> 904e: 496e ldr r1, [pc, #440] ; (9208 <android::sp<android::IBinder>::~sp()+0x338>)</span>
<span class="x"> 9050: 4479 add r1, pc</span>
<span class="x"> 9052: f7ff ee32 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 9056: 4631 mov r1, r6</span>
<span class="x"> 9058: 4620 mov r0, r4</span>
<span class="x"> 905a: f7ff ee4c blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 905e: 4630 mov r0, r6</span>
<span class="x"> 9060: f7ff ee30 blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 9064: 2100 movs r1, #0</span>
<span class="x"> 9066: 4620 mov r0, r4</span>
<span class="x"> 9068: ae1e add r6, sp, #120 ; 0x78</span>
<span class="x"> 906a: f7ff ee4a blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 906e: 4630 mov r0, r6</span>
<span class="x"> 9070: 4641 mov r1, r8</span>
<span class="x"> 9072: f7ff ee22 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 9076: 4631 mov r1, r6</span>
<span class="x"> 9078: 4620 mov r0, r4</span>
<span class="x"> 907a: f7ff ee3c blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 907e: 4630 mov r0, r6</span>
<span class="x"> 9080: f7ff ee20 blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 9084: 2100 movs r1, #0</span>
<span class="x"> 9086: 4620 mov r0, r4</span>
<span class="x"> 9088: ae1d add r6, sp, #116 ; 0x74</span>
<span class="x"> 908a: f7ff ee3a blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 908e: 4630 mov r0, r6</span>
<span class="x"> 9090: 495e ldr r1, [pc, #376] ; (920c <android::sp<android::IBinder>::~sp()+0x33c>)</span>
<span class="x"> 9092: 4479 add r1, pc</span>
<span class="x"> 9094: f7ff ee10 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 9098: 4631 mov r1, r6</span>
<span class="x"> 909a: 4620 mov r0, r4</span>
<span class="x"> 909c: f7ff ee2a blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 90a0: 4630 mov r0, r6</span>
<span class="x"> 90a2: f7ff ee10 blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 90a6: 2101 movs r1, #1</span>
<span class="x"> 90a8: 4620 mov r0, r4</span>
<span class="x"> 90aa: f7ff ee2a blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 90ae: 4639 mov r1, r7</span>
<span class="x"> 90b0: 4620 mov r0, r4</span>
<span class="x"> 90b2: af1c add r7, sp, #112 ; 0x70</span>
<span class="x"> 90b4: f7ff ee24 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 90b8: 2100 movs r1, #0</span>
<span class="x"> 90ba: 4620 mov r0, r4</span>
<span class="x"> 90bc: f7ff ee20 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 90c0: 4638 mov r0, r7</span>
<span class="x"> 90c2: 4953 ldr r1, [pc, #332] ; (9210 <android::sp<android::IBinder>::~sp()+0x340>)</span>
<span class="x"> 90c4: 4479 add r1, pc</span>
<span class="x"> 90c6: f7ff edf8 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 90ca: 4639 mov r1, r7</span>
<span class="x"> 90cc: 4620 mov r0, r4</span>
<span class="x"> 90ce: f7ff ee12 blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 90d2: 4638 mov r0, r7</span>
<span class="x"> 90d4: f7ff edf6 blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 90d8: 2101 movs r1, #1</span>
<span class="x"> 90da: 4620 mov r0, r4</span>
<span class="x"> 90dc: af1b add r7, sp, #108 ; 0x6c</span>
<span class="x"> 90de: f7ff ee10 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 90e2: 4651 mov r1, sl</span>
<span class="x"> 90e4: 4620 mov r0, r4</span>
<span class="x"> 90e6: f7ff ee0c blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 90ea: 4620 mov r0, r4</span>
<span class="x"> 90ec: f7ff ee14 blx 8d18 <android::Parcel::dataPosition() const@plt></span>
<span class="x"> 90f0: f1a9 0104 sub.w r1, r9, #4</span>
<span class="x"> 90f4: 4606 mov r6, r0</span>
<span class="x"> 90f6: 4620 mov r0, r4</span>
<span class="x"> 90f8: f7ff ee14 blx 8d24 <android::Parcel::setDataPosition(unsigned int) const@plt></span>
<span class="x"> 90fc: ebc9 0106 rsb r1, r9, r6</span>
<span class="x"> 9100: 4620 mov r0, r4</span>
<span class="x"> 9102: f7ff edfe blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9106: 4631 mov r1, r6</span>
<span class="x"> 9108: 4620 mov r0, r4</span>
<span class="x"> 910a: ae1a add r6, sp, #104 ; 0x68</span>
<span class="x"> 910c: f7ff ee0a blx 8d24 <android::Parcel::setDataPosition(unsigned int) const@plt></span>
<span class="x"> 9110: 2100 movs r1, #0</span>
<span class="x"> 9112: 4620 mov r0, r4</span>
<span class="x"> 9114: 460a mov r2, r1</span>
<span class="x"> 9116: f7ff edfa blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 911a: f04f 31ff mov.w r1, #4294967295 ; 0xffffffff</span>
<span class="x"> 911e: 4620 mov r0, r4</span>
<span class="x"> 9120: f7ff edee blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9124: 4638 mov r0, r7</span>
<span class="x"> 9126: f7ff fee1 bl 8eec <android::sp<android::IBinder>::~sp()+0x1c></span>
<span class="x"> 912a: 4639 mov r1, r7</span>
<span class="x"> 912c: 4620 mov r0, r4</span>
<span class="x"> 912e: f7ff eddc blx 8ce8 <android::Parcel::writeStrongBinder(android::sp<android::IBinder> const&)@plt></span>
<span class="x"> 9132: 4638 mov r0, r7</span>
<span class="x"> 9134: f7ff fecc bl 8ed0 <android::sp<android::IBinder>::~sp()></span>
<span class="x"> 9138: f04f 31ff mov.w r1, #4294967295 ; 0xffffffff</span>
<span class="x"> 913c: 4620 mov r0, r4</span>
<span class="x"> 913e: f7ff ede0 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9142: 2100 movs r1, #0</span>
<span class="x"> 9144: 4620 mov r0, r4</span>
<span class="x"> 9146: 460a mov r2, r1</span>
<span class="x"> 9148: f7ff ede0 blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 914c: f04f 31ff mov.w r1, #4294967295 ; 0xffffffff</span>
<span class="x"> 9150: 4620 mov r0, r4</span>
<span class="x"> 9152: f7ff edd6 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9156: 4630 mov r0, r6</span>
<span class="x"> 9158: 492e ldr r1, [pc, #184] ; (9214 <android::sp<android::IBinder>::~sp()+0x344>)</span>
<span class="x"> 915a: 4479 add r1, pc</span>
<span class="x"> 915c: f7ff edac blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 9160: 4631 mov r1, r6</span>
<span class="x"> 9162: 4620 mov r0, r4</span>
<span class="x"> 9164: f7ff edc6 blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 9168: 4630 mov r0, r6</span>
<span class="x"> 916a: f7ff edac blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 916e: 2100 movs r1, #0</span>
<span class="x"> 9170: 4620 mov r0, r4</span>
<span class="x"> 9172: ae02 add r6, sp, #8</span>
<span class="x"> 9174: f7ff edc4 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9178: 2100 movs r1, #0</span>
<span class="x"> 917a: 4620 mov r0, r4</span>
<span class="x"> 917c: f7ff edc0 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9180: f04f 31ff mov.w r1, #4294967295 ; 0xffffffff</span>
<span class="x"> 9184: 4620 mov r0, r4</span>
<span class="x"> 9186: f7ff edbc blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 918a: 9824 ldr r0, [sp, #144] ; 0x90</span>
<span class="x"> 918c: 2100 movs r1, #0</span>
<span class="x"> 918e: 6803 ldr r3, [r0, #0]</span>
<span class="x"> 9190: 4622 mov r2, r4</span>
<span class="x"> 9192: 9100 str r1, [sp, #0]</span>
<span class="x"> 9194: 210e movs r1, #14</span>
<span class="x"> 9196: 695f ldr r7, [r3, #20]</span>
<span class="x"> 9198: 4633 mov r3, r6</span>
<span class="x"> 919a: 47b8 blx r7</span>
<span class="x"> 919c: 2800 cmp r0, #0</span>
<span class="x"> 919e: bfb4 ite lt</span>
<span class="x"> 91a0: f04f 37ff movlt.w r7, #4294967295 ; 0xffffffff</span>
<span class="x"> 91a4: 2700 movge r7, #0</span>
<span class="x"> 91a6: 4630 mov r0, r6</span>
<span class="x"> 91a8: f7ff edc2 blx 8d30 <android::Parcel::~Parcel()@plt></span>
<span class="x"> 91ac: 4620 mov r0, r4</span>
<span class="x"> 91ae: f7ff edc0 blx 8d30 <android::Parcel::~Parcel()@plt></span>
<span class="x"> 91b2: a824 add r0, sp, #144 ; 0x90</span>
<span class="x"> 91b4: f7ff fe8c bl 8ed0 <android::sp<android::IBinder>::~sp()></span>
<span class="x"> 91b8: 9b25 ldr r3, [sp, #148] ; 0x94</span>
<span class="x"> 91ba: b133 cbz r3, 91ca <android::sp<android::IBinder>::~sp()+0x2fa></span>
<span class="x"> 91bc: 681a ldr r2, [r3, #0]</span>
<span class="x"> 91be: a925 add r1, sp, #148 ; 0x94</span>
<span class="x"> 91c0: f852 0c0c ldr.w r0, [r2, #-12]</span>
<span class="x"> 91c4: 1818 adds r0, r3, r0</span>
<span class="x"> 91c6: f7ff ed5a blx 8c7c <android::RefBase::decStrong(void const*) const@plt></span>
<span class="x"> 91ca: 993d ldr r1, [sp, #244] ; 0xf4</span>
<span class="x"> 91cc: f8df c01c ldr.w ip, [pc, #28] ; 91ec <android::sp<android::IBinder>::~sp()+0x31c></span>
<span class="x"> 91d0: 4638 mov r0, r7</span>
<span class="x"> 91d2: f855 200c ldr.w r2, [r5, ip]</span>
<span class="x"> 91d6: 6813 ldr r3, [r2, #0]</span>
<span class="x"> 91d8: 4299 cmp r1, r3</span>
<span class="x"> 91da: d001 beq.n 91e0 <android::sp<android::IBinder>::~sp()+0x310></span>
<span class="x"> 91dc: f7ff edae blx 8d3c <__stack_chk_fail@plt></span>
<span class="x"> 91e0: b03f add sp, #252 ; 0xfc</span>
<span class="x"> 91e2: e8bd 8ff0 ldmia.w sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}</span>
<span class="x"> 91e6: bf00 nop</span>
<span class="x"> 91e8: 4e42 ldr r6, [pc, #264] ; (92f4 <android::sp<android::IBinder>::~sp()+0x424>)</span>
<span class="x"> 91ea: 4c44 ldr r4, [pc, #272] ; (92fc <android::sp<android::IBinder>::~sp()+0x42c>)</span>
<span class="x"> 91ec: fffc ffff ; <UNDEFINED> instruction: 0xfffcffff</span>
<span class="x"> 91f0: 1206 asrs r6, r0, #8</span>
<span class="x"> 91f2: 0000 movs r0, r0</span>
<span class="x"> 91f4: 0afc lsrs r4, r7, #11</span>
<span class="x"> 91f6: 0000 movs r0, r0</span>
<span class="x"> 91f8: 0b0d lsrs r5, r1, #12</span>
<span class="x"> 91fa: 0000 movs r0, r0</span>
<span class="x"> 91fc: 0aef lsrs r7, r5, #11</span>
<span class="x"> 91fe: 0000 movs r0, r0</span>
<span class="x"> 9200: 0abe lsrs r6, r7, #10</span>
<span class="x"> 9202: 0000 movs r0, r0</span>
<span class="x"> 9204: 0aa7 lsrs r7, r4, #10</span>
<span class="x"> 9206: 0000 movs r0, r0</span>
<span class="x"> 9208: 0a35 lsrs r5, r6, #8</span>
<span class="x"> 920a: 0000 movs r0, r0</span>
<span class="x"> 920c: 09ff lsrs r7, r7, #7</span>
<span class="x"> 920e: 0000 movs r0, r0</span>
<span class="x"> 9210: 09d1 lsrs r1, r2, #7</span>
<span class="x"> 9212: 0000 movs r0, r0</span>
<span class="x"> 9214: 093f lsrs r7, r7, #4</span>
<span class="x"> 9216: 0000 movs r0, r0</span>
<span class="x"> 9218: e92d 4ff0 stmdb sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}</span>
<span class="x"> 921c: f8df 92e8 ldr.w r9, [pc, #744] ; 9508 <android::sp<android::IBinder>::~sp()+0x638></span>
<span class="x"> 9220: b0bf sub sp, #252 ; 0xfc</span>
<span class="x"> 9222: 4dba ldr r5, [pc, #744] ; (950c <android::sp<android::IBinder>::~sp()+0x63c>)</span>
<span class="x"> 9224: 4680 mov r8, r0</span>
<span class="x"> 9226: 447d add r5, pc</span>
<span class="x"> 9228: 460f mov r7, r1</span>
<span class="x"> 922a: f855 6009 ldr.w r6, [r5, r9]</span>
<span class="x"> 922e: 2130 movs r1, #48 ; 0x30</span>
<span class="x"> 9230: 4692 mov sl, r2</span>
<span class="x"> 9232: 9126 str r1, [sp, #152] ; 0x98</span>
<span class="x"> 9234: 6832 ldr r2, [r6, #0]</span>
<span class="x"> 9236: 2100 movs r1, #0</span>
<span class="x"> 9238: 923d str r2, [sp, #244] ; 0xf4</span>
<span class="x"> 923a: a827 add r0, sp, #156 ; 0x9c</span>
<span class="x"> 923c: 2258 movs r2, #88 ; 0x58</span>
<span class="x"> 923e: f7ff ed24 blx 8c88 <memset@plt></span>
<span class="x"> 9242: ac26 add r4, sp, #152 ; 0x98</span>
<span class="x"> 9244: 48b2 ldr r0, [pc, #712] ; (9510 <android::sp<android::IBinder>::~sp()+0x640>)</span>
<span class="x"> 9246: 4621 mov r1, r4</span>
<span class="x"> 9248: 4478 add r0, pc</span>
<span class="x"> 924a: 4ab2 ldr r2, [pc, #712] ; (9514 <android::sp<android::IBinder>::~sp()+0x644>)</span>
<span class="x"> 924c: 447a add r2, pc</span>
<span class="x"> 924e: ae23 add r6, sp, #140 ; 0x8c</span>
<span class="x"> 9250: f7ff ed20 blx 8c94 <property_get@plt></span>
<span class="x"> 9254: 4620 mov r0, r4</span>
<span class="x"> 9256: f7ff ed24 blx 8ca0 <atoi@plt></span>
<span class="x"> 925a: 4604 mov r4, r0</span>
<span class="x"> 925c: a825 add r0, sp, #148 ; 0x94</span>
<span class="x"> 925e: f7ff ed26 blx 8cac <android::defaultServiceManager()@plt></span>
<span class="x"> 9262: f8dd b094 ldr.w fp, [sp, #148] ; 0x94</span>
<span class="x"> 9266: 49ac ldr r1, [pc, #688] ; (9518 <android::sp<android::IBinder>::~sp()+0x648>)</span>
<span class="x"> 9268: f8db 0000 ldr.w r0, [fp]</span>
<span class="x"> 926c: 4479 add r1, pc</span>
<span class="x"> 926e: f8d0 9014 ldr.w r9, [r0, #20]</span>
<span class="x"> 9272: 4630 mov r0, r6</span>
<span class="x"> 9274: f7ff ed20 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 9278: a824 add r0, sp, #144 ; 0x90</span>
<span class="x"> 927a: 4659 mov r1, fp</span>
<span class="x"> 927c: 4632 mov r2, r6</span>
<span class="x"> 927e: 47c8 blx r9</span>
<span class="x"> 9280: 4630 mov r0, r6</span>
<span class="x"> 9282: f7ff ed20 blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 9286: 9b24 ldr r3, [sp, #144] ; 0x90</span>
<span class="x"> 9288: b913 cbnz r3, 9290 <android::sp<android::IBinder>::~sp()+0x3c0></span>
<span class="x"> 928a: f04f 37ff mov.w r7, #4294967295 ; 0xffffffff</span>
<span class="x"> 928e: e11f b.n 94d0 <android::sp<android::IBinder>::~sp()+0x600></span>
<span class="x"> 9290: ae0f add r6, sp, #60 ; 0x3c</span>
<span class="x"> 9292: 4630 mov r0, r6</span>
<span class="x"> 9294: f7ff ed1c blx 8cd0 <android::Parcel::Parcel()@plt></span>
<span class="x"> 9298: a803 add r0, sp, #12</span>
<span class="x"> 929a: f7ff ed1a blx 8cd0 <android::Parcel::Parcel()@plt></span>
<span class="x"> 929e: f10d 0988 add.w r9, sp, #136 ; 0x88</span>
<span class="x"> 92a2: 499e ldr r1, [pc, #632] ; (951c <android::sp<android::IBinder>::~sp()+0x64c>)</span>
<span class="x"> 92a4: 4648 mov r0, r9</span>
<span class="x"> 92a6: 4479 add r1, pc</span>
<span class="x"> 92a8: f7ff ed06 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 92ac: 4649 mov r1, r9</span>
<span class="x"> 92ae: 4630 mov r0, r6</span>
<span class="x"> 92b0: f7ff ed14 blx 8cdc <android::Parcel::writeInterfaceToken(android::String16 const&)@plt></span>
<span class="x"> 92b4: 4648 mov r0, r9</span>
<span class="x"> 92b6: f7ff ed06 blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 92ba: f10d 0984 add.w r9, sp, #132 ; 0x84</span>
<span class="x"> 92be: 4648 mov r0, r9</span>
<span class="x"> 92c0: f7ff fe14 bl 8eec <android::sp<android::IBinder>::~sp()+0x1c></span>
<span class="x"> 92c4: 4649 mov r1, r9</span>
<span class="x"> 92c6: 4630 mov r0, r6</span>
<span class="x"> 92c8: f7ff ed0e blx 8ce8 <android::Parcel::writeStrongBinder(android::sp<android::IBinder> const&)@plt></span>
<span class="x"> 92cc: 4648 mov r0, r9</span>
<span class="x"> 92ce: f7ff fdff bl 8ed0 <android::sp<android::IBinder>::~sp()></span>
<span class="x"> 92d2: f10d 0980 add.w r9, sp, #128 ; 0x80</span>
<span class="x"> 92d6: 4992 ldr r1, [pc, #584] ; (9520 <android::sp<android::IBinder>::~sp()+0x650>)</span>
<span class="x"> 92d8: 4648 mov r0, r9</span>
<span class="x"> 92da: 4479 add r1, pc</span>
<span class="x"> 92dc: f7ff ecec blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 92e0: 4649 mov r1, r9</span>
<span class="x"> 92e2: 4630 mov r0, r6</span>
<span class="x"> 92e4: f7ff ed06 blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 92e8: 4648 mov r0, r9</span>
<span class="x"> 92ea: f7ff ecec blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 92ee: 2100 movs r1, #0</span>
<span class="x"> 92f0: 4630 mov r0, r6</span>
<span class="x"> 92f2: f7ff ed06 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 92f6: 2100 movs r1, #0</span>
<span class="x"> 92f8: 4630 mov r0, r6</span>
<span class="x"> 92fa: 460a mov r2, r1</span>
<span class="x"> 92fc: f7ff ed06 blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 9300: 2100 movs r1, #0</span>
<span class="x"> 9302: 4630 mov r0, r6</span>
<span class="x"> 9304: f7ff ecfc blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9308: 2c03 cmp r4, #3</span>
<span class="x"> 930a: dd04 ble.n 9316 <android::sp<android::IBinder>::~sp()+0x446></span>
<span class="x"> 930c: 2100 movs r1, #0</span>
<span class="x"> 930e: 4630 mov r0, r6</span>
<span class="x"> 9310: 460a mov r2, r1</span>
<span class="x"> 9312: f7ff ecfc blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 9316: 2100 movs r1, #0</span>
<span class="x"> 9318: ae0f add r6, sp, #60 ; 0x3c</span>
<span class="x"> 931a: 460a mov r2, r1</span>
<span class="x"> 931c: 4630 mov r0, r6</span>
<span class="x"> 931e: f7ff ecf6 blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 9322: 2100 movs r1, #0</span>
<span class="x"> 9324: 4630 mov r0, r6</span>
<span class="x"> 9326: f7ff ecec blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 932a: 2c06 cmp r4, #6</span>
<span class="x"> 932c: dd09 ble.n 9342 <android::sp<android::IBinder>::~sp()+0x472></span>
<span class="x"> 932e: 2100 movs r1, #0</span>
<span class="x"> 9330: 4630 mov r0, r6</span>
<span class="x"> 9332: f7ff ece6 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9336: 2c0e cmp r4, #14</span>
<span class="x"> 9338: dd03 ble.n 9342 <android::sp<android::IBinder>::~sp()+0x472></span>
<span class="x"> 933a: 4630 mov r0, r6</span>
<span class="x"> 933c: 2100 movs r1, #0</span>
<span class="x"> 933e: f7ff ece0 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9342: ac0f add r4, sp, #60 ; 0x3c</span>
<span class="x"> 9344: f04f 31ff mov.w r1, #4294967295 ; 0xffffffff</span>
<span class="x"> 9348: 4620 mov r0, r4</span>
<span class="x"> 934a: ae1f add r6, sp, #124 ; 0x7c</span>
<span class="x"> 934c: f7ff ecd8 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9350: 4620 mov r0, r4</span>
<span class="x"> 9352: f7ff ece2 blx 8d18 <android::Parcel::dataPosition() const@plt></span>
<span class="x"> 9356: 496b ldr r1, [pc, #428] ; (9504 <android::sp<android::IBinder>::~sp()+0x634>)</span>
<span class="x"> 9358: 4681 mov r9, r0</span>
<span class="x"> 935a: 4620 mov r0, r4</span>
<span class="x"> 935c: f7ff ecd0 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9360: 2107 movs r1, #7</span>
<span class="x"> 9362: 4620 mov r0, r4</span>
<span class="x"> 9364: f7ff eccc blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9368: 2100 movs r1, #0</span>
<span class="x"> 936a: 4620 mov r0, r4</span>
<span class="x"> 936c: f7ff ecc8 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9370: 4630 mov r0, r6</span>
<span class="x"> 9372: 496c ldr r1, [pc, #432] ; (9524 <android::sp<android::IBinder>::~sp()+0x654>)</span>
<span class="x"> 9374: 4479 add r1, pc</span>
<span class="x"> 9376: f7ff eca0 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 937a: 4631 mov r1, r6</span>
<span class="x"> 937c: 4620 mov r0, r4</span>
<span class="x"> 937e: f7ff ecba blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 9382: 4630 mov r0, r6</span>
<span class="x"> 9384: f7ff ec9e blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 9388: 2101 movs r1, #1</span>
<span class="x"> 938a: 4620 mov r0, r4</span>
<span class="x"> 938c: ae1e add r6, sp, #120 ; 0x78</span>
<span class="x"> 938e: f7ff ecb8 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9392: 4641 mov r1, r8</span>
<span class="x"> 9394: 4620 mov r0, r4</span>
<span class="x"> 9396: f7ff ecb4 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 939a: 2100 movs r1, #0</span>
<span class="x"> 939c: 4620 mov r0, r4</span>
<span class="x"> 939e: f7ff ecb0 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 93a2: 4630 mov r0, r6</span>
<span class="x"> 93a4: 4960 ldr r1, [pc, #384] ; (9528 <android::sp<android::IBinder>::~sp()+0x658>)</span>
<span class="x"> 93a6: 4479 add r1, pc</span>
<span class="x"> 93a8: f7ff ec86 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 93ac: 4631 mov r1, r6</span>
<span class="x"> 93ae: 4620 mov r0, r4</span>
<span class="x"> 93b0: f7ff eca0 blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 93b4: 4630 mov r0, r6</span>
<span class="x"> 93b6: f7ff ec86 blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 93ba: 2101 movs r1, #1</span>
<span class="x"> 93bc: 4620 mov r0, r4</span>
<span class="x"> 93be: f7ff eca0 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 93c2: 4639 mov r1, r7</span>
<span class="x"> 93c4: 4620 mov r0, r4</span>
<span class="x"> 93c6: af1d add r7, sp, #116 ; 0x74</span>
<span class="x"> 93c8: f7ff ec9a blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 93cc: 2100 movs r1, #0</span>
<span class="x"> 93ce: 4620 mov r0, r4</span>
<span class="x"> 93d0: f7ff ec96 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 93d4: 4638 mov r0, r7</span>
<span class="x"> 93d6: 4955 ldr r1, [pc, #340] ; (952c <android::sp<android::IBinder>::~sp()+0x65c>)</span>
<span class="x"> 93d8: 4479 add r1, pc</span>
<span class="x"> 93da: f7ff ec6e blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 93de: 4639 mov r1, r7</span>
<span class="x"> 93e0: 4620 mov r0, r4</span>
<span class="x"> 93e2: f7ff ec88 blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 93e6: 4638 mov r0, r7</span>
<span class="x"> 93e8: f7ff ec6c blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 93ec: 2101 movs r1, #1</span>
<span class="x"> 93ee: 4620 mov r0, r4</span>
<span class="x"> 93f0: af1c add r7, sp, #112 ; 0x70</span>
<span class="x"> 93f2: f7ff ec86 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 93f6: 4651 mov r1, sl</span>
<span class="x"> 93f8: 4620 mov r0, r4</span>
<span class="x"> 93fa: f7ff ec82 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 93fe: 4620 mov r0, r4</span>
<span class="x"> 9400: f7ff ec8a blx 8d18 <android::Parcel::dataPosition() const@plt></span>
<span class="x"> 9404: f1a9 0104 sub.w r1, r9, #4</span>
<span class="x"> 9408: 4606 mov r6, r0</span>
<span class="x"> 940a: 4620 mov r0, r4</span>
<span class="x"> 940c: f7ff ec8a blx 8d24 <android::Parcel::setDataPosition(unsigned int) const@plt></span>
<span class="x"> 9410: ebc9 0106 rsb r1, r9, r6</span>
<span class="x"> 9414: 4620 mov r0, r4</span>
<span class="x"> 9416: f7ff ec74 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 941a: 4631 mov r1, r6</span>
<span class="x"> 941c: 4620 mov r0, r4</span>
<span class="x"> 941e: ae1b add r6, sp, #108 ; 0x6c</span>
<span class="x"> 9420: f7ff ec80 blx 8d24 <android::Parcel::setDataPosition(unsigned int) const@plt></span>
<span class="x"> 9424: 2100 movs r1, #0</span>
<span class="x"> 9426: 4620 mov r0, r4</span>
<span class="x"> 9428: 460a mov r2, r1</span>
<span class="x"> 942a: f7ff ec70 blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 942e: f04f 31ff mov.w r1, #4294967295 ; 0xffffffff</span>
<span class="x"> 9432: 4620 mov r0, r4</span>
<span class="x"> 9434: f7ff ec64 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9438: 4638 mov r0, r7</span>
<span class="x"> 943a: f7ff fd57 bl 8eec <android::sp<android::IBinder>::~sp()+0x1c></span>
<span class="x"> 943e: 4639 mov r1, r7</span>
<span class="x"> 9440: 4620 mov r0, r4</span>
<span class="x"> 9442: f7ff ec52 blx 8ce8 <android::Parcel::writeStrongBinder(android::sp<android::IBinder> const&)@plt></span>
<span class="x"> 9446: 4638 mov r0, r7</span>
<span class="x"> 9448: f7ff fd42 bl 8ed0 <android::sp<android::IBinder>::~sp()></span>
<span class="x"> 944c: f04f 31ff mov.w r1, #4294967295 ; 0xffffffff</span>
<span class="x"> 9450: 4620 mov r0, r4</span>
<span class="x"> 9452: f7ff ec56 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9456: 2100 movs r1, #0</span>
<span class="x"> 9458: 4620 mov r0, r4</span>
<span class="x"> 945a: 460a mov r2, r1</span>
<span class="x"> 945c: f7ff ec56 blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 9460: f04f 31ff mov.w r1, #4294967295 ; 0xffffffff</span>
<span class="x"> 9464: 4620 mov r0, r4</span>
<span class="x"> 9466: f7ff ec4c blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 946a: 4630 mov r0, r6</span>
<span class="x"> 946c: 4930 ldr r1, [pc, #192] ; (9530 <android::sp<android::IBinder>::~sp()+0x660>)</span>
<span class="x"> 946e: 4479 add r1, pc</span>
<span class="x"> 9470: f7ff ec22 blx 8cb8 <android::String16::String16(char const*)@plt></span>
<span class="x"> 9474: 4631 mov r1, r6</span>
<span class="x"> 9476: 4620 mov r0, r4</span>
<span class="x"> 9478: f7ff ec3c blx 8cf4 <android::Parcel::writeString16(android::String16 const&)@plt></span>
<span class="x"> 947c: 4630 mov r0, r6</span>
<span class="x"> 947e: f7ff ec22 blx 8cc4 <android::String16::~String16()@plt></span>
<span class="x"> 9482: 2100 movs r1, #0</span>
<span class="x"> 9484: 4620 mov r0, r4</span>
<span class="x"> 9486: 460a mov r2, r1</span>
<span class="x"> 9488: f7ff ec40 blx 8d0c <android::Parcel::writeString16(unsigned short const*, unsigned int)@plt></span>
<span class="x"> 948c: 2100 movs r1, #0</span>
<span class="x"> 948e: 4620 mov r0, r4</span>
<span class="x"> 9490: ae03 add r6, sp, #12</span>
<span class="x"> 9492: f7ff ec36 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 9496: 2100 movs r1, #0</span>
<span class="x"> 9498: 4620 mov r0, r4</span>
<span class="x"> 949a: f7ff ec32 blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 949e: f04f 31ff mov.w r1, #4294967295 ; 0xffffffff</span>
<span class="x"> 94a2: 4620 mov r0, r4</span>
<span class="x"> 94a4: f7ff ec2c blx 8d00 <android::Parcel::writeInt32(int)@plt></span>
<span class="x"> 94a8: 9824 ldr r0, [sp, #144] ; 0x90</span>
<span class="x"> 94aa: 2100 movs r1, #0</span>
<span class="x"> 94ac: 6803 ldr r3, [r0, #0]</span>
<span class="x"> 94ae: 4622 mov r2, r4</span>
<span class="x"> 94b0: 9100 str r1, [sp, #0]</span>
<span class="x"> 94b2: 210e movs r1, #14</span>
<span class="x"> 94b4: 695f ldr r7, [r3, #20]</span>
<span class="x"> 94b6: 4633 mov r3, r6</span>
<span class="x"> 94b8: 47b8 blx r7</span>
<span class="x"> 94ba: 2800 cmp r0, #0</span>
<span class="x"> 94bc: bfb4 ite lt</span>
<span class="x"> 94be: f04f 37ff movlt.w r7, #4294967295 ; 0xffffffff</span>
<span class="x"> 94c2: 2700 movge r7, #0</span>
<span class="x"> 94c4: 4630 mov r0, r6</span>
<span class="x"> 94c6: f7ff ec34 blx 8d30 <android::Parcel::~Parcel()@plt></span>
<span class="x"> 94ca: 4620 mov r0, r4</span>
<span class="x"> 94cc: f7ff ec30 blx 8d30 <android::Parcel::~Parcel()@plt></span>
<span class="x"> 94d0: a824 add r0, sp, #144 ; 0x90</span>
<span class="x"> 94d2: f7ff fcfd bl 8ed0 <android::sp<android::IBinder>::~sp()></span>
<span class="x"> 94d6: 9b25 ldr r3, [sp, #148] ; 0x94</span>
<span class="x"> 94d8: b133 cbz r3, 94e8 <android::sp<android::IBinder>::~sp()+0x618></span>
<span class="x"> 94da: 681a ldr r2, [r3, #0]</span>
<span class="x"> 94dc: a925 add r1, sp, #148 ; 0x94</span>
<span class="x"> 94de: f852 0c0c ldr.w r0, [r2, #-12]</span>
<span class="x"> 94e2: 1818 adds r0, r3, r0</span>
<span class="x"> 94e4: f7ff ebca blx 8c7c <android::RefBase::decStrong(void const*) const@plt></span>
<span class="x"> 94e8: 993d ldr r1, [sp, #244] ; 0xf4</span>
<span class="x"> 94ea: f8df c01c ldr.w ip, [pc, #28] ; 9508 <android::sp<android::IBinder>::~sp()+0x638></span>
<span class="x"> 94ee: 4638 mov r0, r7</span>
<span class="x"> 94f0: f855 200c ldr.w r2, [r5, ip]</span>
<span class="x"> 94f4: 6813 ldr r3, [r2, #0]</span>
<span class="x"> 94f6: 4299 cmp r1, r3</span>
<span class="x"> 94f8: d001 beq.n 94fe <android::sp<android::IBinder>::~sp()+0x62e></span>
<span class="x"> 94fa: f7ff ec20 blx 8d3c <__stack_chk_fail@plt></span>
<span class="x"> 94fe: b03f add sp, #252 ; 0xfc</span>
<span class="x"> 9500: e8bd 8ff0 ldmia.w sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}</span>
<span class="x"> 9504: 4e42 ldr r6, [pc, #264] ; (9610 <android::sp<android::IBinder>::~sp()+0x740>)</span>
<span class="x"> 9506: 4c44 ldr r4, [pc, #272] ; (9618 <android::sp<android::IBinder>::~sp()+0x748>)</span>
<span class="x"> 9508: fffc ffff ; <UNDEFINED> instruction: 0xfffcffff</span>
<span class="x"> 950c: 0ee2 lsrs r2, r4, #27</span>
<span class="x"> 950e: 0000 movs r0, r0</span>
<span class="x"> 9510: 07d8 lsls r0, r3, #31</span>
<span class="x"> 9512: 0000 movs r0, r0</span>
<span class="x"> 9514: 07e9 lsls r1, r5, #31</span>
<span class="x"> 9516: 0000 movs r0, r0</span>
<span class="x"> 9518: 07cb lsls r3, r1, #31</span>
<span class="x"> 951a: 0000 movs r0, r0</span>
<span class="x"> 951c: 079a lsls r2, r3, #30</span>
<span class="x"> 951e: 0000 movs r0, r0</span>
<span class="x"> 9520: 07e9 lsls r1, r5, #31</span>
<span class="x"> 9522: 0000 movs r0, r0</span>
<span class="x"> 9524: 0778 lsls r0, r7, #29</span>
<span class="x"> 9526: 0000 movs r0, r0</span>
<span class="x"> 9528: 06eb lsls r3, r5, #27</span>
<span class="x"> 952a: 0000 movs r0, r0</span>
<span class="x"> 952c: 06bd lsls r5, r7, #26</span>
<span class="x"> 952e: 0000 movs r0, r0</span>
<span class="x"> 9530: 062b lsls r3, r5, #24</span>
<span class="x"> 9532: 0000 movs r0, r0</span>
<span class="x"> 9534: b510 push {r4, lr}</span>
<span class="x"> 9536: 480f ldr r0, [pc, #60] ; (9574 <android::sp<android::IBinder>::~sp()+0x6a4>)</span>
<span class="x"> 9538: 4478 add r0, pc</span>
<span class="x"> 953a: f7ff ec06 blx 8d48 <puts@plt></span>
<span class="x"> 953e: 480e ldr r0, [pc, #56] ; (9578 <android::sp<android::IBinder>::~sp()+0x6a8>)</span>
<span class="x"> 9540: 4478 add r0, pc</span>
<span class="x"> 9542: f7ff ec02 blx 8d48 <puts@plt></span>
<span class="x"> 9546: 480d ldr r0, [pc, #52] ; (957c <android::sp<android::IBinder>::~sp()+0x6ac>)</span>
<span class="x"> 9548: 4478 add r0, pc</span>
<span class="x"> 954a: f7ff ebfe blx 8d48 <puts@plt></span>
<span class="x"> 954e: 480c ldr r0, [pc, #48] ; (9580 <android::sp<android::IBinder>::~sp()+0x6b0>)</span>
<span class="x"> 9550: 4478 add r0, pc</span>
<span class="x"> 9552: f7ff ebfa blx 8d48 <puts@plt></span>
<span class="x"> 9556: 200a movs r0, #10</span>
<span class="x"> 9558: f7ff ebfc blx 8d54 <putchar@plt></span>
<span class="x"> 955c: 4809 ldr r0, [pc, #36] ; (9584 <android::sp<android::IBinder>::~sp()+0x6b4>)</span>
<span class="x"> 955e: 4478 add r0, pc</span>
<span class="x"> 9560: f7ff ebf2 blx 8d48 <puts@plt></span>
<span class="x"> 9564: 4808 ldr r0, [pc, #32] ; (9588 <android::sp<android::IBinder>::~sp()+0x6b8>)</span>
<span class="x"> 9566: 4478 add r0, pc</span>
<span class="x"> 9568: f7ff ebee blx 8d48 <puts@plt></span>
<span class="x"> 956c: 2000 movs r0, #0</span>
<span class="x"> 956e: f7ff ebf8 blx 8d60 <exit@plt></span>
<span class="x"> 9572: bf00 nop</span>
<span class="x"> 9574: 05c1 lsls r1, r0, #23</span>
<span class="x"> 9576: 0000 movs r0, r0</span>
<span class="x"> 9578: 05cd lsls r5, r1, #23</span>
<span class="x"> 957a: 0000 movs r0, r0</span>
<span class="x"> 957c: 05ce lsls r6, r1, #23</span>
<span class="x"> 957e: 0000 movs r0, r0</span>
<span class="x"> 9580: 05e3 lsls r3, r4, #23</span>
<span class="x"> 9582: 0000 movs r0, r0</span>
<span class="x"> 9584: 05ee lsls r6, r5, #23</span>
<span class="x"> 9586: 0000 movs r0, r0</span>
<span class="x"> 9588: 05f6 lsls r6, r6, #23</span>
<span class="x"> 958a: 0000 movs r0, r0</span>
<span class="x"> 958c: e92d 4ff0 stmdb sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}</span>
<span class="x"> 9590: 4930 ldr r1, [pc, #192] ; (9654 <android::sp<android::IBinder>::~sp()+0x784>)</span>
<span class="x"> 9592: b09f sub sp, #124 ; 0x7c</span>
<span class="x"> 9594: 2200 movs r2, #0</span>
<span class="x"> 9596: 4d30 ldr r5, [pc, #192] ; (9658 <android::sp<android::IBinder>::~sp()+0x788>)</span>
<span class="x"> 9598: 447d add r5, pc</span>
<span class="x"> 959a: 5868 ldr r0, [r5, r1]</span>
<span class="x"> 959c: 6803 ldr r3, [r0, #0]</span>
<span class="x"> 959e: 2001 movs r0, #1</span>
<span class="x"> 95a0: 4601 mov r1, r0</span>
<span class="x"> 95a2: 931d str r3, [sp, #116] ; 0x74</span>
<span class="x"> 95a4: f7ff ebe2 blx 8d6c <socket@plt></span>
<span class="x"> 95a8: 4604 mov r4, r0</span>
<span class="x"> 95aa: 2800 cmp r0, #0</span>
<span class="x"> 95ac: bfb8 it lt</span>
<span class="x"> 95ae: f04f 34ff movlt.w r4, #4294967295 ; 0xffffffff</span>
<span class="x"> 95b2: db40 blt.n 9636 <android::sp<android::IBinder>::~sp()+0x766></span>
<span class="x"> 95b4: f10d 0904 add.w r9, sp, #4</span>
<span class="x"> 95b8: 4f28 ldr r7, [pc, #160] ; (965c <android::sp<android::IBinder>::~sp()+0x78c>)</span>
<span class="x"> 95ba: f8df 80a4 ldr.w r8, [pc, #164] ; 9660 <android::sp<android::IBinder>::~sp()+0x790></span>
<span class="x"> 95be: 4e29 ldr r6, [pc, #164] ; (9664 <android::sp<android::IBinder>::~sp()+0x794>)</span>
<span class="x"> 95c0: f8df a0a4 ldr.w sl, [pc, #164] ; 9668 <android::sp<android::IBinder>::~sp()+0x798></span>
<span class="x"> 95c4: 447f add r7, pc</span>
<span class="x"> 95c6: 44f8 add r8, pc</span>
<span class="x"> 95c8: 447e add r6, pc</span>
<span class="x"> 95ca: f109 0b02 add.w fp, r9, #2</span>
<span class="x"> 95ce: 44fa add sl, pc</span>
<span class="x"> 95d0: 2100 movs r1, #0</span>
<span class="x"> 95d2: 226e movs r2, #110 ; 0x6e</span>
<span class="x"> 95d4: 4648 mov r0, r9</span>
<span class="x"> 95d6: f7ff eb58 blx 8c88 <memset@plt></span>
<span class="x"> 95da: 4641 mov r1, r8</span>
<span class="x"> 95dc: 4638 mov r0, r7</span>
<span class="x"> 95de: f04f 0201 mov.w r2, #1</span>
<span class="x"> 95e2: f8ad 2004 strh.w r2, [sp, #4]</span>
<span class="x"> 95e6: f7ff ebc8 blx 8d78 <strcpy@plt></span>
<span class="x"> 95ea: 4638 mov r0, r7</span>
<span class="x"> 95ec: f7ff ebca blx 8d84 <mktemp@plt></span>
<span class="x"> 95f0: 216c movs r1, #108 ; 0x6c</span>
<span class="x"> 95f2: 4603 mov r3, r0</span>
<span class="x"> 95f4: 4652 mov r2, sl</span>
<span class="x"> 95f6: f846 0cf8 str.w r0, [r6, #-248]</span>
<span class="x"> 95fa: 4658 mov r0, fp</span>
<span class="x"> 95fc: f7ff ebc8 blx 8d90 <snprintf@plt></span>
<span class="x"> 9600: f856 0cf8 ldr.w r0, [r6, #-248]</span>
<span class="x"> 9604: f7ff ebca blx 8d9c <unlink@plt></span>
<span class="x"> 9608: 226e movs r2, #110 ; 0x6e</span>
<span class="x"> 960a: 4620 mov r0, r4</span>
<span class="x"> 960c: 4649 mov r1, r9</span>
<span class="x"> 960e: f7ff ebcc blx 8da8 <bind@plt></span>
<span class="x"> 9612: 2800 cmp r0, #0</span>
<span class="x"> 9614: da07 bge.n 9626 <android::sp<android::IBinder>::~sp()+0x756></span>
<span class="x"> 9616: f7ff ebce blx 8db4 <__errno@plt></span>
<span class="x"> 961a: 6803 ldr r3, [r0, #0]</span>
<span class="x"> 961c: 2b62 cmp r3, #98 ; 0x62</span>
<span class="x"> 961e: d0d7 beq.n 95d0 <android::sp<android::IBinder>::~sp()+0x700></span>
<span class="x"> 9620: f06f 0401 mvn.w r4, #1</span>
<span class="x"> 9624: e007 b.n 9636 <android::sp<android::IBinder>::~sp()+0x766></span>
<span class="x"> 9626: 4620 mov r0, r4</span>
<span class="x"> 9628: 2101 movs r1, #1</span>
<span class="x"> 962a: f7ff ebca blx 8dc0 <listen@plt></span>
<span class="x"> 962e: 2800 cmp r0, #0</span>
<span class="x"> 9630: bfb8 it lt</span>
<span class="x"> 9632: f06f 0402 mvnlt.w r4, #2</span>
<span class="x"> 9636: 991d ldr r1, [sp, #116] ; 0x74</span>
<span class="x"> 9638: f8df c018 ldr.w ip, [pc, #24] ; 9654 <android::sp<android::IBinder>::~sp()+0x784></span>
<span class="x"> 963c: 4620 mov r0, r4</span>
<span class="x"> 963e: f855 300c ldr.w r3, [r5, ip]</span>
<span class="x"> 9642: 681a ldr r2, [r3, #0]</span>
<span class="x"> 9644: 4291 cmp r1, r2</span>
<span class="x"> 9646: d001 beq.n 964c <android::sp<android::IBinder>::~sp()+0x77c></span>
<span class="x"> 9648: f7ff eb78 blx 8d3c <__stack_chk_fail@plt></span>
<span class="x"> 964c: b01f add sp, #124 ; 0x7c</span>
<span class="x"> 964e: e8bd 8ff0 ldmia.w sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}</span>
<span class="x"> 9652: bf00 nop</span>
<span class="x"> 9654: fffc ffff ; <UNDEFINED> instruction: 0xfffcffff</span>
<span class="x"> 9658: 0b70 lsrs r0, r6, #13</span>
<span class="x"> 965a: 0000 movs r0, r0</span>
<span class="x"> 965c: 0c28 lsrs r0, r5, #16</span>
<span class="x"> 965e: 0000 movs r0, r0</span>
<span class="x"> 9660: 05af lsls r7, r5, #22</span>
<span class="x"> 9662: 0000 movs r0, r0</span>
<span class="x"> 9664: 1d1c adds r4, r3, #4</span>
<span class="x"> 9666: 0000 movs r0, r0</span>
<span class="x"> 9668: 05e8 lsls r0, r5, #23</span>
<span class="x"> 966a: 0000 movs r0, r0</span>
<span class="x"> 966c: b570 push {r4, r5, r6, lr}</span>
<span class="x"> 966e: 2280 movs r2, #128 ; 0x80</span>
<span class="x"> 9670: b0a4 sub sp, #144 ; 0x90</span>
<span class="x"> 9672: 4605 mov r5, r0</span>
<span class="x"> 9674: 241e movs r4, #30</span>
<span class="x"> 9676: ae02 add r6, sp, #8</span>
<span class="x"> 9678: 9422 str r4, [sp, #136] ; 0x88</span>
<span class="x"> 967a: 4630 mov r0, r6</span>
<span class="x"> 967c: 2400 movs r4, #0</span>
<span class="x"> 967e: 4621 mov r1, r4</span>
<span class="x"> 9680: 9423 str r4, [sp, #140] ; 0x8c</span>
<span class="x"> 9682: f7ff eb02 blx 8c88 <memset@plt></span>
<span class="x"> 9686: 116b asrs r3, r5, #5</span>
<span class="x"> 9688: 2101 movs r1, #1</span>
<span class="x"> 968a: f10d 0c90 add.w ip, sp, #144 ; 0x90</span>
<span class="x"> 968e: f005 021f and.w r2, r5, #31</span>
<span class="x"> 9692: eb0c 0083 add.w r0, ip, r3, lsl #2</span>
<span class="x"> 9696: fa11 f202 lsls.w r2, r1, r2</span>
<span class="x"> 969a: ab22 add r3, sp, #136 ; 0x88</span>
<span class="x"> 969c: f850 1c88 ldr.w r1, [r0, #-136]</span>
<span class="x"> 96a0: 430a orrs r2, r1</span>
<span class="x"> 96a2: 4631 mov r1, r6</span>
<span class="x"> 96a4: f840 2c88 str.w r2, [r0, #-136]</span>
<span class="x"> 96a8: 1c68 adds r0, r5, #1</span>
<span class="x"> 96aa: 9300 str r3, [sp, #0]</span>
<span class="x"> 96ac: 4622 mov r2, r4</span>
<span class="x"> 96ae: 4623 mov r3, r4</span>
<span class="x"> 96b0: f7ff eb8c blx 8dcc <select@plt></span>
<span class="x"> 96b4: 42a0 cmp r0, r4</span>
<span class="x"> 96b6: dd06 ble.n 96c6 <android::sp<android::IBinder>::~sp()+0x7f6></span>
<span class="x"> 96b8: 4628 mov r0, r5</span>
<span class="x"> 96ba: 4621 mov r1, r4</span>
<span class="x"> 96bc: 4622 mov r2, r4</span>
<span class="x"> 96be: f7ff eb8c blx 8dd8 <accept@plt></span>
<span class="x"> 96c2: 42a0 cmp r0, r4</span>
<span class="x"> 96c4: da01 bge.n 96ca <android::sp<android::IBinder>::~sp()+0x7fa></span>
<span class="x"> 96c6: f04f 30ff mov.w r0, #4294967295 ; 0xffffffff</span>
<span class="x"> 96ca: b024 add sp, #144 ; 0x90</span>
<span class="x"> 96cc: bd70 pop {r4, r5, r6, pc}</span>
<span class="x"> 96ce: bf00 nop</span>
<span class="x"> 96d0: b570 push {r4, r5, r6, lr}</span>
<span class="x"> 96d2: 2000 movs r0, #0</span>
<span class="x"> 96d4: 4b18 ldr r3, [pc, #96] ; (9738 <android::sp<android::IBinder>::~sp()+0x868>)</span>
<span class="x"> 96d6: 447b add r3, pc</span>
<span class="x"> 96d8: 685a ldr r2, [r3, #4]</span>
<span class="x"> 96da: 6819 ldr r1, [r3, #0]</span>
<span class="x"> 96dc: f7ff fd9c bl 9218 <android::sp<android::IBinder>::~sp()+0x348></span>
<span class="x"> 96e0: 4b16 ldr r3, [pc, #88] ; (973c <android::sp<android::IBinder>::~sp()+0x86c>)</span>
<span class="x"> 96e2: 447b add r3, pc</span>
<span class="x"> 96e4: f853 2cf4 ldr.w r2, [r3, #-244]</span>
<span class="x"> 96e8: 2a02 cmp r2, #2</span>
<span class="x"> 96ea: dd1b ble.n 9724 <android::sp<android::IBinder>::~sp()+0x854></span>
<span class="x"> 96ec: f853 4cf0 ldr.w r4, [r3, #-240]</span>
<span class="x"> 96f0: 4913 ldr r1, [pc, #76] ; (9740 <android::sp<android::IBinder>::~sp()+0x870>)</span>
<span class="x"> 96f2: 6865 ldr r5, [r4, #4]</span>
<span class="x"> 96f4: 4479 add r1, pc</span>
<span class="x"> 96f6: 4628 mov r0, r5</span>
<span class="x"> 96f8: f7ff eb74 blx 8de4 <strcmp@plt></span>
<span class="x"> 96fc: b128 cbz r0, 970a <android::sp<android::IBinder>::~sp()+0x83a></span>
<span class="x"> 96fe: 4911 ldr r1, [pc, #68] ; (9744 <android::sp<android::IBinder>::~sp()+0x874>)</span>
<span class="x"> 9700: 4628 mov r0, r5</span>
<span class="x"> 9702: 4479 add r1, pc</span>
<span class="x"> 9704: f7ff eb6e blx 8de4 <strcmp@plt></span>
<span class="x"> 9708: b960 cbnz r0, 9724 <android::sp<android::IBinder>::~sp()+0x854></span>
<span class="x"> 970a: f104 0108 add.w r1, r4, #8</span>
<span class="x"> 970e: 68a0 ldr r0, [r4, #8]</span>
<span class="x"> 9710: f7ff eb6e blx 8df0 <execvp@plt></span>
<span class="x"> 9714: 2800 cmp r0, #0</span>
<span class="x"> 9716: da0c bge.n 9732 <android::sp<android::IBinder>::~sp()+0x862></span>
<span class="x"> 9718: 480b ldr r0, [pc, #44] ; (9748 <android::sp<android::IBinder>::~sp()+0x878>)</span>
<span class="x"> 971a: 4478 add r0, pc</span>
<span class="x"> 971c: f7ff eb14 blx 8d48 <puts@plt></span>
<span class="x"> 9720: 2001 movs r0, #1</span>
<span class="x"> 9722: e007 b.n 9734 <android::sp<android::IBinder>::~sp()+0x864></span>
<span class="x"> 9724: 4809 ldr r0, [pc, #36] ; (974c <android::sp<android::IBinder>::~sp()+0x87c>)</span>
<span class="x"> 9726: 490a ldr r1, [pc, #40] ; (9750 <android::sp<android::IBinder>::~sp()+0x880>)</span>
<span class="x"> 9728: 4478 add r0, pc</span>
<span class="x"> 972a: 4479 add r1, pc</span>
<span class="x"> 972c: 2200 movs r2, #0</span>
<span class="x"> 972e: f7ff eb66 blx 8dfc <execlp@plt></span>
<span class="x"> 9732: 2000 movs r0, #0</span>
<span class="x"> 9734: bd70 pop {r4, r5, r6, pc}</span>
<span class="x"> 9736: bf00 nop</span>
<span class="x"> 9738: 0af6 lsrs r6, r6, #11</span>
<span class="x"> 973a: 0000 movs r0, r0</span>
<span class="x"> 973c: 1c02 adds r2, r0, #0</span>
<span class="x"> 973e: 0000 movs r0, r0</span>
<span class="x"> 9740: 04c5 lsls r5, r0, #19</span>
<span class="x"> 9742: 0000 movs r0, r0</span>
<span class="x"> 9744: 04ba lsls r2, r7, #18</span>
<span class="x"> 9746: 0000 movs r0, r0</span>
<span class="x"> 9748: 04ac lsls r4, r5, #18</span>
<span class="x"> 974a: 0000 movs r0, r0</span>
<span class="x"> 974c: 04b4 lsls r4, r6, #18</span>
<span class="x"> 974e: 0000 movs r0, r0</span>
<span class="x"> 9750: 04c1 lsls r1, r0, #19</span>
<span class="x"> 9752: 0000 movs r0, r0</span>
<span class="x"> 9754: b510 push {r4, lr}</span>
<span class="x"> 9756: 4b05 ldr r3, [pc, #20] ; (976c <android::sp<android::IBinder>::~sp()+0x89c>)</span>
<span class="x"> 9758: f04f 30ff mov.w r0, #4294967295 ; 0xffffffff</span>
<span class="x"> 975c: 447b add r3, pc</span>
<span class="x"> 975e: 6819 ldr r1, [r3, #0]</span>
<span class="x"> 9760: 685a ldr r2, [r3, #4]</span>
<span class="x"> 9762: f7ff fd59 bl 9218 <android::sp<android::IBinder>::~sp()+0x348></span>
<span class="x"> 9766: 2001 movs r0, #1</span>
<span class="x"> 9768: bd10 pop {r4, pc}</span>
<span class="x"> 976a: bf00 nop</span>
<span class="x"> 976c: 0a70 lsrs r0, r6, #9</span>
<span class="x"> 976e: 0000 movs r0, r0</span>
<span class="x"> 9770: b510 push {r4, lr}</span>
<span class="x"> 9772: 4c07 ldr r4, [pc, #28] ; (9790 <android::sp<android::IBinder>::~sp()+0x8c0>)</span>
<span class="x"> 9774: 447c add r4, pc</span>
<span class="x"> 9776: f854 0cf8 ldr.w r0, [r4, #-248]</span>
<span class="x"> 977a: f7ff eb10 blx 8d9c <unlink@plt></span>
<span class="x"> 977e: f854 0cf0 ldr.w r0, [r4, #-240]</span>
<span class="x"> 9782: b120 cbz r0, 978e <android::sp<android::IBinder>::~sp()+0x8be></span>
<span class="x"> 9784: f7ff eb40 blx 8e08 <free@plt></span>
<span class="x"> 9788: 2300 movs r3, #0</span>
<span class="x"> 978a: f844 3cf0 str.w r3, [r4, #-240]</span>
<span class="x"> 978e: bd10 pop {r4, pc}</span>
<span class="x"> 9790: 1b70 subs r0, r6, r5</span>
<span class="x"> 9792: 0000 movs r0, r0</span>
<span class="x"> 9794: b510 push {r4, lr}</span>
<span class="x"> 9796: f7ff ffeb bl 9770 <android::sp<android::IBinder>::~sp()+0x8a0></span>
<span class="x"> 979a: bd10 pop {r4, pc}</span>
<span class="x"> 979c: b510 push {r4, lr}</span>
<span class="x"> 979e: 4604 mov r4, r0</span>
<span class="x"> 97a0: f7ff ffe6 bl 9770 <android::sp<android::IBinder>::~sp()+0x8a0></span>
<span class="x"> 97a4: 4620 mov r0, r4</span>
<span class="x"> 97a6: f7ff eadc blx 8d60 <exit@plt></span>
<span class="x"> 97aa: bf00 nop</span>
<span class="x"> 97ac: b570 push {r4, r5, r6, lr}</span>
<span class="x"> 97ae: 4605 mov r5, r0</span>
<span class="x"> 97b0: 460c mov r4, r1</span>
<span class="x"> 97b2: 4628 mov r0, r5</span>
<span class="x"> 97b4: f7ff ff5a bl 966c <android::sp<android::IBinder>::~sp()+0x79c></span>
<span class="x"> 97b8: 2800 cmp r0, #0</span>
<span class="x"> 97ba: db0a blt.n 97d2 <android::sp<android::IBinder>::~sp()+0x902></span>
<span class="x"> 97bc: 223f movs r2, #63 ; 0x3f</span>
<span class="x"> 97be: 4621 mov r1, r4</span>
<span class="x"> 97c0: f7ff eb28 blx 8e14 <read@plt></span>
<span class="x"> 97c4: 2800 cmp r0, #0</span>
<span class="x"> 97c6: db04 blt.n 97d2 <android::sp<android::IBinder>::~sp()+0x902></span>
<span class="x"> 97c8: d0f3 beq.n 97b2 <android::sp<android::IBinder>::~sp()+0x8e2></span>
<span class="x"> 97ca: 2300 movs r3, #0</span>
<span class="x"> 97cc: 5423 strb r3, [r4, r0]</span>
<span class="x"> 97ce: 4618 mov r0, r3</span>
<span class="x"> 97d0: e001 b.n 97d6 <android::sp<android::IBinder>::~sp()+0x906></span>
<span class="x"> 97d2: f04f 30ff mov.w r0, #4294967295 ; 0xffffffff</span>
<span class="x"> 97d6: bd70 pop {r4, r5, r6, pc}</span>
<span class="x"> 97d8: b5f0 push {r4, r5, r6, r7, lr}</span>
<span class="x"> 97da: 4606 mov r6, r0</span>
<span class="x"> 97dc: b0ed sub sp, #436 ; 0x1b4</span>
<span class="x"> 97de: 4d7a ldr r5, [pc, #488] ; (99c8 <android::sp<android::IBinder>::~sp()+0xaf8>)</span>
<span class="x"> 97e0: 460f mov r7, r1</span>
<span class="x"> 97e2: 447d add r5, pc</span>
<span class="x"> 97e4: 4979 ldr r1, [pc, #484] ; (99cc <android::sp<android::IBinder>::~sp()+0xafc>)</span>
<span class="x"> 97e6: 5868 ldr r0, [r5, r1]</span>
<span class="x"> 97e8: 2e02 cmp r6, #2</span>
<span class="x"> 97ea: 6803 ldr r3, [r0, #0]</span>
<span class="x"> 97ec: 936b str r3, [sp, #428] ; 0x1ac</span>
<span class="x"> 97ee: d10e bne.n 980e <android::sp<android::IBinder>::~sp()+0x93e></span>
<span class="x"> 97f0: 687c ldr r4, [r7, #4]</span>
<span class="x"> 97f2: 4977 ldr r1, [pc, #476] ; (99d0 <android::sp<android::IBinder>::~sp()+0xb00>)</span>
<span class="x"> 97f4: 4620 mov r0, r4</span>
<span class="x"> 97f6: 4479 add r1, pc</span>
<span class="x"> 97f8: f7ff eaf4 blx 8de4 <strcmp@plt></span>
<span class="x"> 97fc: b128 cbz r0, 980a <android::sp<android::IBinder>::~sp()+0x93a></span>
<span class="x"> 97fe: 4975 ldr r1, [pc, #468] ; (99d4 <android::sp<android::IBinder>::~sp()+0xb04>)</span>
<span class="x"> 9800: 4620 mov r0, r4</span>
<span class="x"> 9802: 4479 add r1, pc</span>
<span class="x"> 9804: f7ff eaee blx 8de4 <strcmp@plt></span>
<span class="x"> 9808: b908 cbnz r0, 980e <android::sp<android::IBinder>::~sp()+0x93e></span>
<span class="x"> 980a: f7ff fe93 bl 9534 <android::sp<android::IBinder>::~sp()+0x664></span>
<span class="x"> 980e: 1c72 adds r2, r6, #1</span>
<span class="x"> 9810: 4c71 ldr r4, [pc, #452] ; (99d8 <android::sp<android::IBinder>::~sp()+0xb08>)</span>
<span class="x"> 9812: 0090 lsls r0, r2, #2</span>
<span class="x"> 9814: 447c add r4, pc</span>
<span class="x"> 9816: f844 6cf4 str.w r6, [r4, #-244]</span>
<span class="x"> 981a: f7ff eb02 blx 8e20 <malloc@plt></span>
<span class="x"> 981e: f844 0cf0 str.w r0, [r4, #-240]</span>
<span class="x"> 9822: b188 cbz r0, 9848 <android::sp<android::IBinder>::~sp()+0x978></span>
<span class="x"> 9824: f854 2cf4 ldr.w r2, [r4, #-244]</span>
<span class="x"> 9828: 1c51 adds r1, r2, #1</span>
<span class="x"> 982a: 008a lsls r2, r1, #2</span>
<span class="x"> 982c: 2100 movs r1, #0</span>
<span class="x"> 982e: f7ff ea2c blx 8c88 <memset@plt></span>
<span class="x"> 9832: f854 3cf4 ldr.w r3, [r4, #-244]</span>
<span class="x"> 9836: f854 0cf0 ldr.w r0, [r4, #-240]</span>
<span class="x"> 983a: 009a lsls r2, r3, #2</span>
<span class="x"> 983c: 4639 mov r1, r7</span>
<span class="x"> 983e: f7ff eaf6 blx 8e2c <memcpy@plt></span>
<span class="x"> 9842: 2e01 cmp r6, #1</span>
<span class="x"> 9844: dc03 bgt.n 984e <android::sp<android::IBinder>::~sp()+0x97e></span>
<span class="x"> 9846: e012 b.n 986e <android::sp<android::IBinder>::~sp()+0x99e></span>
<span class="x"> 9848: f844 0cf4 str.w r0, [r4, #-244]</span>
<span class="x"> 984c: e0ab b.n 99a6 <android::sp<android::IBinder>::~sp()+0xad6></span>
<span class="x"> 984e: 4963 ldr r1, [pc, #396] ; (99dc <android::sp<android::IBinder>::~sp()+0xb0c>)</span>
<span class="x"> 9850: 6878 ldr r0, [r7, #4]</span>
<span class="x"> 9852: 4479 add r1, pc</span>
<span class="x"> 9854: f7ff eac6 blx 8de4 <strcmp@plt></span>
<span class="x"> 9858: 4606 mov r6, r0</span>
<span class="x"> 985a: b940 cbnz r0, 986e <android::sp<android::IBinder>::~sp()+0x99e></span>
<span class="x"> 985c: 4860 ldr r0, [pc, #384] ; (99e0 <android::sp<android::IBinder>::~sp()+0xb10>)</span>
<span class="x"> 985e: 4478 add r0, pc</span>
<span class="x"> 9860: f7ff ea72 blx 8d48 <puts@plt></span>
<span class="x"> 9864: 4630 mov r0, r6</span>
<span class="x"> 9866: f7ff eae8 blx 8e38 <setgid@plt></span>
<span class="x"> 986a: b358 cbz r0, 98c4 <android::sp<android::IBinder>::~sp()+0x9f4></span>
<span class="x"> 986c: e02d b.n 98ca <android::sp<android::IBinder>::~sp()+0x9fa></span>
<span class="x"> 986e: f7ff eaea blx 8e44 <getppid@plt></span>
<span class="x"> 9872: ae1b add r6, sp, #108 ; 0x6c</span>
<span class="x"> 9874: 2100 movs r1, #0</span>
<span class="x"> 9876: f44f 7280 mov.w r2, #256 ; 0x100</span>
<span class="x"> 987a: 4c5a ldr r4, [pc, #360] ; (99e4 <android::sp<android::IBinder>::~sp()+0xb14>)</span>
<span class="x"> 987c: 447c add r4, pc</span>
<span class="x"> 987e: 6060 str r0, [r4, #4]</span>
<span class="x"> 9880: 4630 mov r0, r6</span>
<span class="x"> 9882: f7ff ea02 blx 8c88 <memset@plt></span>
<span class="x"> 9886: 6862 ldr r2, [r4, #4]</span>
<span class="x"> 9888: 4630 mov r0, r6</span>
<span class="x"> 988a: 4957 ldr r1, [pc, #348] ; (99e8 <android::sp<android::IBinder>::~sp()+0xb18>)</span>
<span class="x"> 988c: 4479 add r1, pc</span>
<span class="x"> 988e: 466f mov r7, sp</span>
<span class="x"> 9890: f7ff eade blx 8e50 <sprintf@plt></span>
<span class="x"> 9894: 4630 mov r0, r6</span>
<span class="x"> 9896: 4669 mov r1, sp</span>
<span class="x"> 9898: f7ff eae0 blx 8e5c <stat@plt></span>
<span class="x"> 989c: 2240 movs r2, #64 ; 0x40</span>
<span class="x"> 989e: 9e06 ldr r6, [sp, #24]</span>
<span class="x"> 98a0: 2100 movs r1, #0</span>
<span class="x"> 98a2: 6026 str r6, [r4, #0]</span>
<span class="x"> 98a4: ae5b add r6, sp, #364 ; 0x16c</span>
<span class="x"> 98a6: 4630 mov r0, r6</span>
<span class="x"> 98a8: f7ff e9ee blx 8c88 <memset@plt></span>
<span class="x"> 98ac: f44f 71fc mov.w r1, #504 ; 0x1f8</span>
<span class="x"> 98b0: 484e ldr r0, [pc, #312] ; (99ec <android::sp<android::IBinder>::~sp()+0xb1c>)</span>
<span class="x"> 98b2: 4478 add r0, pc</span>
<span class="x"> 98b4: f7ff ead8 blx 8e68 <mkdir@plt></span>
<span class="x"> 98b8: f7ff fe68 bl 958c <android::sp<android::IBinder>::~sp()+0x6bc></span>
<span class="x"> 98bc: 60a0 str r0, [r4, #8]</span>
<span class="x"> 98be: 2800 cmp r0, #0</span>
<span class="x"> 98c0: da33 bge.n 992a <android::sp<android::IBinder>::~sp()+0xa5a></span>
<span class="x"> 98c2: e02d b.n 9920 <android::sp<android::IBinder>::~sp()+0xa50></span>
<span class="x"> 98c4: f7ff ead6 blx 8e74 <setuid@plt></span>
<span class="x"> 98c8: b110 cbz r0, 98d0 <android::sp<android::IBinder>::~sp()+0xa00></span>
<span class="x"> 98ca: 4849 ldr r0, [pc, #292] ; (99f0 <android::sp<android::IBinder>::~sp()+0xb20>)</span>
<span class="x"> 98cc: 4478 add r0, pc</span>
<span class="x"> 98ce: e01b b.n 9908 <android::sp<android::IBinder>::~sp()+0xa38></span>
<span class="x"> 98d0: f854 0cf4 ldr.w r0, [r4, #-244]</span>
<span class="x"> 98d4: 2803 cmp r0, #3</span>
<span class="x"> 98d6: dd1a ble.n 990e <android::sp<android::IBinder>::~sp()+0xa3e></span>
<span class="x"> 98d8: f854 4cf0 ldr.w r4, [r4, #-240]</span>
<span class="x"> 98dc: 4945 ldr r1, [pc, #276] ; (99f4 <android::sp<android::IBinder>::~sp()+0xb24>)</span>
<span class="x"> 98de: 68a6 ldr r6, [r4, #8]</span>
<span class="x"> 98e0: 4479 add r1, pc</span>
<span class="x"> 98e2: 4630 mov r0, r6</span>
<span class="x"> 98e4: f7ff ea7e blx 8de4 <strcmp@plt></span>
<span class="x"> 98e8: b128 cbz r0, 98f6 <android::sp<android::IBinder>::~sp()+0xa26></span>
<span class="x"> 98ea: 4943 ldr r1, [pc, #268] ; (99f8 <android::sp<android::IBinder>::~sp()+0xb28>)</span>
<span class="x"> 98ec: 4630 mov r0, r6</span>
<span class="x"> 98ee: 4479 add r1, pc</span>
<span class="x"> 98f0: f7ff ea78 blx 8de4 <strcmp@plt></span>
<span class="x"> 98f4: b958 cbnz r0, 990e <android::sp<android::IBinder>::~sp()+0xa3e></span>
<span class="x"> 98f6: f104 010c add.w r1, r4, #12</span>
<span class="x"> 98fa: 68e0 ldr r0, [r4, #12]</span>
<span class="x"> 98fc: f7ff ea78 blx 8df0 <execvp@plt></span>
<span class="x"> 9900: 2800 cmp r0, #0</span>
<span class="x"> 9902: da53 bge.n 99ac <android::sp<android::IBinder>::~sp()+0xadc></span>
<span class="x"> 9904: 483d ldr r0, [pc, #244] ; (99fc <android::sp<android::IBinder>::~sp()+0xb2c>)</span>
<span class="x"> 9906: 4478 add r0, pc</span>
<span class="x"> 9908: f7ff ea1e blx 8d48 <puts@plt></span>
<span class="x"> 990c: e006 b.n 991c <android::sp<android::IBinder>::~sp()+0xa4c></span>
<span class="x"> 990e: 483c ldr r0, [pc, #240] ; (9a00 <android::sp<android::IBinder>::~sp()+0xb30>)</span>
<span class="x"> 9910: 493c ldr r1, [pc, #240] ; (9a04 <android::sp<android::IBinder>::~sp()+0xb34>)</span>
<span class="x"> 9912: 4478 add r0, pc</span>
<span class="x"> 9914: 4479 add r1, pc</span>
<span class="x"> 9916: 2200 movs r2, #0</span>
<span class="x"> 9918: f7ff ea70 blx 8dfc <execlp@plt></span>
<span class="x"> 991c: 2001 movs r0, #1</span>
<span class="x"> 991e: e046 b.n 99ae <android::sp<android::IBinder>::~sp()+0xade></span>
<span class="x"> 9920: f7ff ff18 bl 9754 <android::sp<android::IBinder>::~sp()+0x884></span>
<span class="x"> 9924: f04f 30ff mov.w r0, #4294967295 ; 0xffffffff</span>
<span class="x"> 9928: e041 b.n 99ae <android::sp<android::IBinder>::~sp()+0xade></span>
<span class="x"> 992a: 6862 ldr r2, [r4, #4]</span>
<span class="x"> 992c: 6821 ldr r1, [r4, #0]</span>
<span class="x"> 992e: 4f36 ldr r7, [pc, #216] ; (9a08 <android::sp<android::IBinder>::~sp()+0xb38>)</span>
<span class="x"> 9930: 447f add r7, pc</span>
<span class="x"> 9932: f857 0cf8 ldr.w r0, [r7, #-248]</span>
<span class="x"> 9936: 4d35 ldr r5, [pc, #212] ; (9a0c <android::sp<android::IBinder>::~sp()+0xb3c>)</span>
<span class="x"> 9938: f7ff fadc bl 8ef4 <android::sp<android::IBinder>::~sp()+0x24></span>
<span class="x"> 993c: 447d add r5, pc</span>
<span class="x"> 993e: 2001 movs r0, #1</span>
<span class="x"> 9940: 4629 mov r1, r5</span>
<span class="x"> 9942: f7ff ea9e blx 8e80 <bsd_signal@plt></span>
<span class="x"> 9946: 200d movs r0, #13</span>
<span class="x"> 9948: 4629 mov r1, r5</span>
<span class="x"> 994a: f7ff ea9a blx 8e80 <bsd_signal@plt></span>
<span class="x"> 994e: 200f movs r0, #15</span>
<span class="x"> 9950: 4629 mov r1, r5</span>
<span class="x"> 9952: f7ff ea96 blx 8e80 <bsd_signal@plt></span>
<span class="x"> 9956: 4629 mov r1, r5</span>
<span class="x"> 9958: 2006 movs r0, #6</span>
<span class="x"> 995a: f7ff ea92 blx 8e80 <bsd_signal@plt></span>
<span class="x"> 995e: 482c ldr r0, [pc, #176] ; (9a10 <android::sp<android::IBinder>::~sp()+0xb40>)</span>
<span class="x"> 9960: 4478 add r0, pc</span>
<span class="x"> 9962: f7ff ea94 blx 8e8c <atexit@plt></span>
<span class="x"> 9966: 68a0 ldr r0, [r4, #8]</span>
<span class="x"> 9968: 4631 mov r1, r6</span>
<span class="x"> 996a: f7ff ff1f bl 97ac <android::sp<android::IBinder>::~sp()+0x8dc></span>
<span class="x"> 996e: 2800 cmp r0, #0</span>
<span class="x"> 9970: da08 bge.n 9984 <android::sp<android::IBinder>::~sp()+0xab4></span>
<span class="x"> 9972: f06f 0001 mvn.w r0, #1</span>
<span class="x"> 9976: 6821 ldr r1, [r4, #0]</span>
<span class="x"> 9978: 6862 ldr r2, [r4, #4]</span>
<span class="x"> 997a: f7ff fc4d bl 9218 <android::sp<android::IBinder>::~sp()+0x348></span>
<span class="x"> 997e: 2001 movs r0, #1</span>
<span class="x"> 9980: f7ff e9ee blx 8d60 <exit@plt></span>
<span class="x"> 9984: 4923 ldr r1, [pc, #140] ; (9a14 <android::sp<android::IBinder>::~sp()+0xb44>)</span>
<span class="x"> 9986: 4630 mov r0, r6</span>
<span class="x"> 9988: 4479 add r1, pc</span>
<span class="x"> 998a: f7ff ea2c blx 8de4 <strcmp@plt></span>
<span class="x"> 998e: b150 cbz r0, 99a6 <android::sp<android::IBinder>::~sp()+0xad6></span>
<span class="x"> 9990: 4921 ldr r1, [pc, #132] ; (9a18 <android::sp<android::IBinder>::~sp()+0xb48>)</span>
<span class="x"> 9992: 4630 mov r0, r6</span>
<span class="x"> 9994: 4479 add r1, pc</span>
<span class="x"> 9996: f7ff ea26 blx 8de4 <strcmp@plt></span>
<span class="x"> 999a: 4604 mov r4, r0</span>
<span class="x"> 999c: b918 cbnz r0, 99a6 <android::sp<android::IBinder>::~sp()+0xad6></span>
<span class="x"> 999e: f7ff fe97 bl 96d0 <android::sp<android::IBinder>::~sp()+0x800></span>
<span class="x"> 99a2: 4620 mov r0, r4</span>
<span class="x"> 99a4: e7ec b.n 9980 <android::sp<android::IBinder>::~sp()+0xab0></span>
<span class="x"> 99a6: f7ff fed5 bl 9754 <android::sp<android::IBinder>::~sp()+0x884></span>
<span class="x"> 99aa: e7e8 b.n 997e <android::sp<android::IBinder>::~sp()+0xaae></span>
<span class="x"> 99ac: 2000 movs r0, #0</span>
<span class="x"> 99ae: 996b ldr r1, [sp, #428] ; 0x1ac</span>
<span class="x"> 99b0: f8df c018 ldr.w ip, [pc, #24] ; 99cc <android::sp<android::IBinder>::~sp()+0xafc></span>
<span class="x"> 99b4: f855 200c ldr.w r2, [r5, ip]</span>
<span class="x"> 99b8: 6813 ldr r3, [r2, #0]</span>
<span class="x"> 99ba: 4299 cmp r1, r3</span>
<span class="x"> 99bc: d001 beq.n 99c2 <android::sp<android::IBinder>::~sp()+0xaf2></span>
<span class="x"> 99be: f7ff e9be blx 8d3c <__stack_chk_fail@plt></span>
<span class="x"> 99c2: b06d add sp, #436 ; 0x1b4</span>
<span class="x"> 99c4: bdf0 pop {r4, r5, r6, r7, pc}</span>
<span class="x"> 99c6: bf00 nop</span>
<span class="x"> 99c8: 0926 lsrs r6, r4, #4</span>
<span class="x"> 99ca: 0000 movs r0, r0</span>
<span class="x"> 99cc: fffc ffff ; <UNDEFINED> instruction: 0xfffcffff</span>
<span class="x"> 99d0: 03f8 lsls r0, r7, #15</span>
<span class="x"> 99d2: 0000 movs r0, r0</span>
<span class="x"> 99d4: 03ef lsls r7, r5, #15</span>
<span class="x"> 99d6: 0000 movs r0, r0</span>
<span class="x"> 99d8: 1ad0 subs r0, r2, r3</span>
<span class="x"> 99da: 0000 movs r0, r0</span>
<span class="x"> 99dc: 03a6 lsls r6, r4, #14</span>
<span class="x"> 99de: 0000 movs r0, r0</span>
<span class="x"> 99e0: 03a7 lsls r7, r4, #14</span>
<span class="x"> 99e2: 0000 movs r0, r0</span>
<span class="x"> 99e4: 0950 lsrs r0, r2, #5</span>
<span class="x"> 99e6: 0000 movs r0, r0</span>
<span class="x"> 99e8: 0398 lsls r0, r3, #14</span>
<span class="x"> 99ea: 0000 movs r0, r0</span>
<span class="x"> 99ec: 037b lsls r3, r7, #13</span>
<span class="x"> 99ee: 0000 movs r0, r0</span>
<span class="x"> 99f0: 038d lsls r5, r1, #14</span>
<span class="x"> 99f2: 0000 movs r0, r0</span>
<span class="x"> 99f4: 02d9 lsls r1, r3, #11</span>
<span class="x"> 99f6: 0000 movs r0, r0</span>
<span class="x"> 99f8: 02ce lsls r6, r1, #11</span>
<span class="x"> 99fa: 0000 movs r0, r0</span>
<span class="x"> 99fc: 0365 lsls r5, r4, #13</span>
<span class="x"> 99fe: 0000 movs r0, r0</span>
<span class="x"> 9a00: 02ca lsls r2, r1, #11</span>
<span class="x"> 9a02: 0000 movs r0, r0</span>
<span class="x"> 9a04: 02d7 lsls r7, r2, #11</span>
<span class="x"> 9a06: 0000 movs r0, r0</span>
<span class="x"> 9a08: 19b4 adds r4, r6, r6</span>
<span class="x"> 9a0a: 0000 movs r0, r0</span>
<span class="x"> 9a0c: fe5d ffff mrc2 15, 2, pc, cr13, cr15, {7}</span>
<span class="x"> 9a10: fe31 ffff mrc2 15, 1, pc, cr1, cr15, {7}</span>
<span class="x"> 9a14: 02f6 lsls r6, r6, #11</span>
<span class="x"> 9a16: 0000 movs r0, r0</span>
<span class="x"> 9a18: 02ef lsls r7, r5, #11</span>
<span class="x"> 9a1a: 0000 movs r0, r0</span>
<span class="x"> 9a1c: f004 e51f ; <UNDEFINED> instruction: 0xf004e51f</span>
<span class="x"> 9a20: 97d9 str r7, [sp, #868] ; 0x364</span>
...</code></pre></div>
<p>I can see there are human-readable strings in the <code>.rodata</code> section. It's very likely that constant function call arguments are to be found in this section.</p>
<p>Reverse-engineering is largely an exercise in pattern identification and in this way it is one step removed from pathological <a href="http://en.wikipedia.org/wiki/Pareidolia">pareidolia</a>. Something <em>Gestalt</em> something something <a href="http://en.wikipedia.org/wiki/Bicameralism_%28psychology%29">bicameral</a> <a href="http://michaelprescott.typepad.com/.a/6a00d83451574c69e201901b7e2e2f970b-pi">mind</a>. This is why reliable information is so valuable in this process - it's what anchors us to the reality of the system under study.</p>
<p>So yeah. I'll have to watch out for addresses that point to <code>.rodata</code>.</p>
<p>The <code>.text</code> section in this file is large enough that figuring it out in its entirety would be a protracted exercise. Since what I really want is for this <code>su</code> to give me a root shell, I've decided to start from somewhere I know implements this behaviour I want and work my way back until I find out how I can trigger that.</p>
<p>I know thanks to <code>nm(1)</code> that my <code>su</code> has a linker table entry for <a href="http://linux.die.net/man/3/setuid"><code>setuid(3)</code></a>. The output of <code>objdump</code> very conveniently includes the names of PLT entries after the <a href="http://infocenter.arm.com/help/topic/com.arm.doc.dui0489e/Cihfddaf.html"><code>bl</code></a> and <a href="http://infocenter.arm.com/help/topic/com.arm.doc.dui0489e/Cihfddaf.html"><code>blx</code></a> function call instructions. As it happens, there's only one call to <code>setuid</code>, so I know that no matter what, I want to execute the instruction at offset <code>0x98c4</code>.</p>
<p>All that's left to do now is work my way up until I can figure out how I can cause <code>su</code> to execute this call. I've chosen to focus on the section of code in <code>.text</code> between this call and the first function header found before it, in this case the <code>push {r4, r5, r6, r7, lr}</code> at offset <code>0x97d8</code>. Here's the relevant section of disassembled ARM code:</p>
<div class="highlight"><pre><code class="language-objdump" data-lang="objdump"><span class="x">97d8: b5f0 push {r4, r5, r6, r7, lr}</span>
<span class="x">97da: 4606 mov r6, r0</span>
<span class="x">97dc: b0ed sub sp, #436 ; 0x1b4</span>
<span class="x">97de: 4d7a ldr r5, [pc, #488] ; (99c8 <android::sp<android::IBinder>::~sp()+0xaf8>)</span>
<span class="x">97e0: 460f mov r7, r1</span>
<span class="x">97e2: 447d add r5, pc</span>
<span class="x">97e4: 4979 ldr r1, [pc, #484] ; (99cc <android::sp<android::IBinder>::~sp()+0xafc>)</span>
<span class="x">97e6: 5868 ldr r0, [r5, r1]</span>
<span class="x">97e8: 2e02 cmp r6, #2</span>
<span class="x">97ea: 6803 ldr r3, [r0, #0]</span>
<span class="x">97ec: 936b str r3, [sp, #428] ; 0x1ac</span>
<span class="x">97ee: d10e bne.n 980e <android::sp<android::IBinder>::~sp()+0x93e></span>
<span class="x">97f0: 687c ldr r4, [r7, #4]</span>
<span class="x">97f2: 4977 ldr r1, [pc, #476] ; (99d0 <android::sp<android::IBinder>::~sp()+0xb00>)</span>
<span class="x">97f4: 4620 mov r0, r4</span>
<span class="x">97f6: 4479 add r1, pc</span>
<span class="x">97f8: f7ff eaf4 blx 8de4 <strcmp@plt></span>
<span class="x">97fc: b128 cbz r0, 980a <android::sp<android::IBinder>::~sp()+0x93a></span>
<span class="x">97fe: 4975 ldr r1, [pc, #468] ; (99d4 <android::sp<android::IBinder>::~sp()+0xb04>)</span>
<span class="x">9800: 4620 mov r0, r4</span>
<span class="x">9802: 4479 add r1, pc</span>
<span class="x">9804: f7ff eaee blx 8de4 <strcmp@plt></span>
<span class="x">9808: b908 cbnz r0, 980e <android::sp<android::IBinder>::~sp()+0x93e></span>
<span class="x">980a: f7ff fe93 bl 9534 <android::sp<android::IBinder>::~sp()+0x664></span>
<span class="x">980e: 1c72 adds r2, r6, #1</span>
<span class="x">9810: 4c71 ldr r4, [pc, #452] ; (99d8 <android::sp<android::IBinder>::~sp()+0xb08>)</span>
<span class="x">9812: 0090 lsls r0, r2, #2</span>
<span class="x">9814: 447c add r4, pc</span>
<span class="x">9816: f844 6cf4 str.w r6, [r4, #-244]</span>
<span class="x">981a: f7ff eb02 blx 8e20 <malloc@plt></span>
<span class="x">981e: f844 0cf0 str.w r0, [r4, #-240]</span>
<span class="x">9822: b188 cbz r0, 9848 <android::sp<android::IBinder>::~sp()+0x978></span>
<span class="x">9824: f854 2cf4 ldr.w r2, [r4, #-244]</span>
<span class="x">9828: 1c51 adds r1, r2, #1</span>
<span class="x">982a: 008a lsls r2, r1, #2</span>
<span class="x">982c: 2100 movs r1, #0</span>
<span class="x">982e: f7ff ea2c blx 8c88 <memset@plt></span>
<span class="x">9832: f854 3cf4 ldr.w r3, [r4, #-244]</span>
<span class="x">9836: f854 0cf0 ldr.w r0, [r4, #-240]</span>
<span class="x">983a: 009a lsls r2, r3, #2</span>
<span class="x">983c: 4639 mov r1, r7</span>
<span class="x">983e: f7ff eaf6 blx 8e2c <memcpy@plt></span>
<span class="x">9842: 2e01 cmp r6, #1</span>
<span class="x">9844: dc03 bgt.n 984e <android::sp<android::IBinder>::~sp()+0x97e></span>
<span class="x">9846: e012 b.n 986e <android::sp<android::IBinder>::~sp()+0x99e></span>
<span class="x">9848: f844 0cf4 str.w r0, [r4, #-244]</span>
<span class="x">984c: e0ab b.n 99a6 <android::sp<android::IBinder>::~sp()+0xad6></span>
<span class="x">984e: 4963 ldr r1, [pc, #396] ; (99dc <android::sp<android::IBinder>::~sp()+0xb0c>)</span>
<span class="x">9850: 6878 ldr r0, [r7, #4]</span>
<span class="x">9852: 4479 add r1, pc</span>
<span class="x">9854: f7ff eac6 blx 8de4 <strcmp@plt></span>
<span class="x">9858: 4606 mov r6, r0</span>
<span class="x">985a: b940 cbnz r0, 986e <android::sp<android::IBinder>::~sp()+0x99e></span>
<span class="x">985c: 4860 ldr r0, [pc, #384] ; (99e0 <android::sp<android::IBinder>::~sp()+0xb10>)</span>
<span class="x">985e: 4478 add r0, pc</span>
<span class="x">9860: f7ff ea72 blx 8d48 <puts@plt></span>
<span class="x">9864: 4630 mov r0, r6</span>
<span class="x">9866: f7ff eae8 blx 8e38 <setgid@plt></span>
<span class="x">986a: b358 cbz r0, 98c4 <android::sp<android::IBinder>::~sp()+0x9f4></span>
<span class="x">986c: e02d b.n 98ca <android::sp<android::IBinder>::~sp()+0x9fa></span>
<span class="x">986e: f7ff eaea blx 8e44 <getppid@plt></span>
<span class="x">9872: ae1b add r6, sp, #108 ; 0x6c</span>
<span class="x">9874: 2100 movs r1, #0</span>
<span class="x">9876: f44f 7280 mov.w r2, #256 ; 0x100</span>
<span class="x">987a: 4c5a ldr r4, [pc, #360] ; (99e4 <android::sp<android::IBinder>::~sp()+0xb14>)</span>
<span class="x">987c: 447c add r4, pc</span>
<span class="x">987e: 6060 str r0, [r4, #4]</span>
<span class="x">9880: 4630 mov r0, r6</span>
<span class="x">9882: f7ff ea02 blx 8c88 <memset@plt></span>
<span class="x">9886: 6862 ldr r2, [r4, #4]</span>
<span class="x">9888: 4630 mov r0, r6</span>
<span class="x">988a: 4957 ldr r1, [pc, #348] ; (99e8 <android::sp<android::IBinder>::~sp()+0xb18>)</span>
<span class="x">988c: 4479 add r1, pc</span>
<span class="x">988e: 466f mov r7, sp</span>
<span class="x">9890: f7ff eade blx 8e50 <sprintf@plt></span>
<span class="x">9894: 4630 mov r0, r6</span>
<span class="x">9896: 4669 mov r1, sp</span>
<span class="x">9898: f7ff eae0 blx 8e5c <stat@plt></span>
<span class="x">989c: 2240 movs r2, #64 ; 0x40</span>
<span class="x">989e: 9e06 ldr r6, [sp, #24]</span>
<span class="x">98a0: 2100 movs r1, #0</span>
<span class="x">98a2: 6026 str r6, [r4, #0]</span>
<span class="x">98a4: ae5b add r6, sp, #364 ; 0x16c</span>
<span class="x">98a6: 4630 mov r0, r6</span>
<span class="x">98a8: f7ff e9ee blx 8c88 <memset@plt></span>
<span class="x">98ac: f44f 71fc mov.w r1, #504 ; 0x1f8</span>
<span class="x">98b0: 484e ldr r0, [pc, #312] ; (99ec <android::sp<android::IBinder>::~sp()+0xb1c>)</span>
<span class="x">98b2: 4478 add r0, pc</span>
<span class="x">98b4: f7ff ead8 blx 8e68 <mkdir@plt></span>
<span class="x">98b8: f7ff fe68 bl 958c <android::sp<android::IBinder>::~sp()+0x6bc></span>
<span class="x">98bc: 60a0 str r0, [r4, #8]</span>
<span class="x">98be: 2800 cmp r0, #0</span>
<span class="x">98c0: da33 bge.n 992a <android::sp<android::IBinder>::~sp()+0xa5a></span>
<span class="x">98c2: e02d b.n 9920 <android::sp<android::IBinder>::~sp()+0xa50></span>
<span class="x">98c4: f7ff ead6 blx 8e74 <setuid@plt> ; <--- I want this!</span>
<span class="x">98c8: b110 cbz r0, 98d0 <android::sp<android::IBinder>::~sp()+0xa00></span>
<span class="x">98ca: 4849 ldr r0, [pc, #292] ; (99f0 <android::sp<android::IBinder>::~sp()+0xb20>)</span>
<span class="x">98cc: 4478 add r0, pc</span>
<span class="x">98ce: e01b b.n 9908 <android::sp<android::IBinder>::~sp()+0xa38></span></code></pre></div>
<h2>Scratching the Turing turntable</h2>
<p>The instruction immediately preceding the call to <code>setuid</code> is a <a href="http://infocenter.arm.com/help/topic/com.arm.doc.dui0489e/Cihfddaf.html"><code>b.n</code></a> unconditional branch and the one before <em>that</em> is a <a href="http://infocenter.arm.com/help/topic/com.arm.doc.dui0489e/Cihfddaf.html"><code>bge.n</code></a> conditional branch. This is a pattern typical of compiled code that is found at the "seams" between sequences of instructions compiled from different control flow branches. The upshot is that if and when the ARM CPU executes the instruction at offset <code>0x98c4</code>, it must be after it's jumped there from somewhere else.</p>
<p>Sure enough, there's a <a href="http://infocenter.arm.com/help/topic/com.arm.doc.dui0489e/Cjaghefc.html"><code>cbz</code></a> conditional branching instruction that points here at offset <code>0x986a</code>:</p>
<div class="highlight"><pre><code class="language-objdump" data-lang="objdump"><span class="x">985c: 4860 ldr r0, [pc, #384] ; (99e0 <android::sp<android::IBinder>::~sp()+0xb10>)</span>
<span class="x">985e: 4478 add r0, pc</span>
<span class="x">9860: f7ff ea72 blx 8d48 <puts@plt></span>
<span class="x">9864: 4630 mov r0, r6</span>
<span class="x">9866: f7ff eae8 blx 8e38 <setgid@plt></span>
<span class="x">986a: b358 cbz r0, 98c4 <android::sp<android::IBinder>::~sp()+0x9f4></span></code></pre></div>
<p>So that makes sense, right? First we set the effective Group ID with <a href="http://linux.die.net/man/3/setgid"><code>setgid(3)</code></a> then if that returned 0, we move on to the effective UID. We even reuse the <code>0</code> return code from <code>setgid</code> as <code>setuid</code>'s argument.</p>
<p>The GID is loaded into <code>r0</code> from <code>r6</code> at <code>0x9864</code>. Before that, there's a call to <a href="http://linux.die.net/man/3/puts"><code>puts(3)</code></a>. The argument given to <code>puts</code> in <code>r0</code> is <code>*0x99e0(==0x03a7) + 0x985e + 0x4 == 0x9c09</code>, which points to a string in <code>.rodata</code>: "<code>huyanwei grant successful ...\n</code>". Looks like I'm on the right track, alright!</p>
<p>This call to <code>puts(3)</code> is preceded by a call to <a href="http://linux.die.net/man/3/strcmp"><code>strcmp(3)</code></a> and a <code>cbnz</code> conditional branch instruction:</p>
<div class="highlight"><pre><code class="language-objdump" data-lang="objdump"><span class="x">984e: 4963 ldr r1, [pc, #396] ; (99dc <android::sp<android::IBinder>::~sp()+0xb0c>)</span>
<span class="x">9850: 6878 ldr r0, [r7, #4]</span>
<span class="x">9852: 4479 add r1, pc</span>
<span class="x">9854: f7ff eac6 blx 8de4 <strcmp@plt></span>
<span class="x">9858: 4606 mov r6, r0</span>
<span class="x">985a: b940 cbnz r0, 986e <android::sp<android::IBinder>::~sp()+0x99e></span></code></pre></div>
<p>This is very promising, as it means a zero return value in this call to <code>strcmp</code> is what triggers the privilege escalation performed by <code>setgid</code> then <code>setuid</code>.</p>
<p>So what are we comparing, and against what? The second argument passed to <code>strcmp</code> in <code>r1</code> is a static <code>char*</code> with a value of <code>*0x99dc(==0x03a6) + 0x9852 + 0x4 == 0x9bfc</code>. This once again points to a string in <code>.rodata</code> with the value "<code>*#huyanwei#*</code>". This includes the name of the author and looks like some sort of hardcoded passphrase. But what are we comparing against this value? The immediate answer is <code>*(r7+4)</code> but what is at that address?</p>
<p>To find out more, I searched for instructions before the call to <code>strcmp</code> that involve the <code>r7</code> register. There's a <code>mov r1, r7</code> at offset <code>0x983c</code> where we use <code>r7</code> as the second argument in a call to <a href="http://linux.die.net/man/3/memcpy"><code>memcpy(3)</code></a>, ie. as the source. Before that, we have the following:</p>
<div class="highlight"><pre><code class="language-objdump" data-lang="objdump"><span class="x">97f0: 687c ldr r4, [r7, #4]</span>
<span class="x">97f2: 4977 ldr r1, [pc, #476] ; (99d0 <android::sp<android::IBinder>::~sp()+0xb00>)</span>
<span class="x">97f4: 4620 mov r0, r4</span>
<span class="x">97f6: 4479 add r1, pc</span>
<span class="x">97f8: f7ff eaf4 blx 8de4 <strcmp@plt></span>
<span class="x">97fc: b128 cbz r0, 980a <android::sp<android::IBinder>::~sp()+0x93a></span>
<span class="x">97fe: 4975 ldr r1, [pc, #468] ; (99d4 <android::sp<android::IBinder>::~sp()+0xb04>)</span>
<span class="x">9800: 4620 mov r0, r4</span>
<span class="x">9802: 4479 add r1, pc</span>
<span class="x">9804: f7ff eaee blx 8de4 <strcmp@plt></span>
<span class="x">9808: b908 cbnz r0, 980e <android::sp<android::IBinder>::~sp()+0x93e></span>
<span class="x">980a: f7ff fe93 bl 9534 <android::sp<android::IBinder>::~sp()+0x664></span></code></pre></div>
<p>So we copy <code>*(r7 + 4)</code> - the same address we'll later compare against <code>*#huyanwei#*</code> to decide whether to escalate privileges - into <code>r4</code> and then <code>r0</code>. This becomes the first argument passed in another call to <code>strcmp</code> at offset <code>0x97f8</code>. What's the second argument, then? <code>*0x99d0 (==0x3f8) + 0x97f6 + 4 == 0x9bf2</code>, which points to a string in <code>.rodata</code>: "<code>-h</code>".</p>
<p>Wait a minute! That looks a lot like one of the CLI options documented in the usage message, doesn't it? If <code>*(r7 + 4)</code> is indeed equal to "<code>-h</code>" then we jump to <code>0x980a</code>, else we compare that address again, this time to <code>*0x99d4 (==0x3ef) + 0x9802 + 4 == 0x9bf5</code>. Once again, this points to <code>.rodata</code> and this time to "<code>--help</code>".</p>
<p>I can now reasonably infer that <code>r7 + 4</code> points to the first CLI argument given to <code>su</code>. Considering we have <code>mov r7, r1</code> at offset <code>0x97e0</code> immediately after the function header, this would mean that -<strong><em>GASP!</em></strong>- <code>r1</code> was <code>argv</code> when the function was called!</p>
<p>Since we're looking at 32-bit ARM code, <code>argv + 4 == argv[1]</code>. This would make the function starting at <code>0x97d8</code> the program's <code>main</code> and <code>r0</code> our <code>argc</code>.</p>
<h2>Let's try it out</h2>
<p>I tried running su with <code>*#huyanwei#*</code> as the first argument on the CLI:</p>
<p><img src="/PYaffs/images/su_successful.png" alt="That escalated quickly"></p>
<p>...and it worked. Yay!</p>
<h1>Now what?</h1>
<p>So I've finally obtained superuser privileges on my phone. I did this by leveraging a rootkit that was present out of the box rather than writing a proper exploit. The whole experience was a bit hollow - I really expected to have to figure out what <code>su</code> does with sockets and build a program that would trigger escalation in this way. I was looking forward to that. Instead, I got there by feeding it a magic string as a CLI argument. It's expedient but a bit disappointing all the same. For a moment there, I... I believed. And I wanted more.</p>
<p>I did a teeny bit of searching online and there <em>are</em> pages that reference the author's name, Huyan Wei. They are mostly in Chinese however, which I cannot read. I chose not to spend too much time searching for third-party information as I know from bitter experience that nothing kills momentum on a little project like this quite like stumbling upon the answers.</p>
<p>As things stand I thought I should recap the objectives I set in the <a href="/PYaffs/2014/07/15/Hacklog%230.html">first hacklog</a>:</p>
<ul>
<li>✔ Gain superuser privileges</li>
<li>✔ Access the full filesystem (superuser privilege lets me access the full filesystem)</li>
<li>✘ Investigate the presence of <code>su(1)</code>, <code>tcpdump(1)</code></li>
</ul>
<p>So far, this project has been more about hacking than it has been about forensics. Now that I have unfettered access to the device, I expect this to change and future posts to focus more on the <em>what</em> than the <em>how do I get access</em>.</p>
Hacklog #4: Dump format and YAFFS
2014-08-12T00:00:00+01:00
/2014/08/12/Hacklog#4
<h1>Leitmotif</h1>
<p>Well over twenty years ago, the movie <a href="http://www.imdb.com/title/tt0107290/">Jurassic Park</a> came out. I remember there was a lot of exposition in the first act. In particular, there's a scene where a small group of people is given access -for the first time!- to an area of the island where very large dinosaurs roam free.</p>
<p>Among them is a man who is some sort of scientist and definitely not a people person. They happen upon a dino-sized <em>dump</em> of dino poo and yer man deadpans:</p>
<blockquote>
<p>That is one big pile of shit.</p>
</blockquote>
<p><img src="/PYaffs/images/BPOS.jpg" alt=""That is one big pile of shit""></p>
<p>He's not alone, of course. Accompanying him on the tour is Dr Sattler, a paleobotanist. Dr Sattler takes a keen interest in how plant life has been recreated in the park and seizes the opportunity to <em>explore the dump</em>:</p>
<p><img src="/PYaffs/images/reverse_engineering.jpg" alt=""Reverse-engineering""></p>
<p>That scene, and this picture in particular, summarises this whole post.</p>
<p>Reverse engineering is a dirty job but someone's gotta do it.</p>
<h1>The Madcap YAFFS</h1>
<p>So I <a href="/PYaffs/2014/07/31/Hacklog%233.html">finally</a> have a raw Flash ROM dump of the partition on which my phone's <code>/system</code> filesystem <a href="/PYaffs/2014/07/21/Hacklog%232.html">lives</a>. I'm no longer constrained by file permissions - everything on that filesystem I now have access to.</p>
<p>I only need to figure out how.</p>
<h2>Context</h2>
<p>As I saw in the output of <a href="http://linux.die.net/man/8/mount"><code>mount(8)</code></a>, <code>/system</code> is a <code>yaffs2</code> filesystem, mounted read-only:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ mount
/dev/block/mtdblock11 /system yaffs2 ro,noatime 0 0
</code></pre></div>
<p><a href="http://www.yaffs.net/yaffs-2-specification"><code>YAFFS2</code></a> is the second revision of <a href="http://www.yaffs.net/yaffs-original-specification"><code>YAFFS</code></a>, a Flash-optimised filesystem that's been around a while.</p>
<p>My first idea was to open the <code>/system</code> dump with a YAFFS access tool. None of them worked with the dumps I got out of my phone and this little project lost momentum and got stalled there for almost three months.</p>
<p>I eventually picked it up again and decided to do this the hard way. In order to access the filesystem's contents out-of-band, I had to spend time reading and digesting both filesystems' specification documents. The YAFFS2 spec is not a standalone document so familiarity with YAFFS stuff is pretty much required.</p>
<h2>A YAFFS primer</h2>
<p>The basic unit of data storage in YAFFS is a <strong>chunk</strong>. A chunk may contain <em>either</em> filesystem stuff of the kind displayed by <a href="http://linux.die.net/man/1/stat"><code>stat(1)</code></a> (viz. inodes, file names, permissions, etc.) <em>or</em> file data.</p>
<p>Within the scope of the YAFFS documentation, filesystem entities such as files and directories are called <strong>objects</strong>. Every object has its metadata stored in a dedicated chunk in a data structure the YAFFS documentation calls an <strong>object header</strong></p>
<p>The format for object headers is defined in <a href="http://www.aleph1.co.uk/gitweb?p=yaffs2.git;a=blob;f=yaffs_guts.h;h=231f8ac567eb86e3583f4c1fc436e9c89a4ca2c8;hb=HEAD#l312"><code>yaffs_guts.h</code></a> in the form of this plain old C struct:</p>
<div class="highlight"><pre><code class="language-c" data-lang="c"><span class="k">struct</span> <span class="n">yaffs_obj_hdr</span> <span class="p">{</span>
<span class="k">enum</span> <span class="n">yaffs_obj_type</span> <span class="n">type</span><span class="p">;</span>
<span class="cm">/* Apply to everything */</span>
<span class="kt">int</span> <span class="n">parent_obj_id</span><span class="p">;</span>
<span class="n">u16</span> <span class="n">sum_no_longer_used</span><span class="p">;</span> <span class="cm">/* checksum of name. No longer used */</span>
<span class="n">YCHAR</span> <span class="n">name</span><span class="p">[</span><span class="n">YAFFS_MAX_NAME_LENGTH</span> <span class="o">+</span> <span class="mi">1</span><span class="p">];</span>
<span class="cm">/* The following apply to all object types except for hard links */</span>
<span class="n">u32</span> <span class="n">yst_mode</span><span class="p">;</span> <span class="cm">/* protection */</span>
<span class="n">u32</span> <span class="n">yst_uid</span><span class="p">;</span>
<span class="n">u32</span> <span class="n">yst_gid</span><span class="p">;</span>
<span class="n">u32</span> <span class="n">yst_atime</span><span class="p">;</span>
<span class="n">u32</span> <span class="n">yst_mtime</span><span class="p">;</span>
<span class="n">u32</span> <span class="n">yst_ctime</span><span class="p">;</span>
<span class="cm">/* File size applies to files only */</span>
<span class="n">u32</span> <span class="n">file_size_low</span><span class="p">;</span>
<span class="cm">/* Equivalent object id applies to hard links only. */</span>
<span class="kt">int</span> <span class="n">equiv_id</span><span class="p">;</span>
<span class="cm">/* Alias is for symlinks only. */</span>
<span class="n">YCHAR</span> <span class="n">alias</span><span class="p">[</span><span class="n">YAFFS_MAX_ALIAS_LENGTH</span> <span class="o">+</span> <span class="mi">1</span><span class="p">];</span>
<span class="n">u32</span> <span class="n">yst_rdev</span><span class="p">;</span> <span class="cm">/* stuff for block and char devices (major/min) */</span>
<span class="n">u32</span> <span class="n">win_ctime</span><span class="p">[</span><span class="mi">2</span><span class="p">];</span>
<span class="n">u32</span> <span class="n">win_atime</span><span class="p">[</span><span class="mi">2</span><span class="p">];</span>
<span class="n">u32</span> <span class="n">win_mtime</span><span class="p">[</span><span class="mi">2</span><span class="p">];</span>
<span class="n">u32</span> <span class="n">inband_shadowed_obj_id</span><span class="p">;</span>
<span class="n">u32</span> <span class="n">inband_is_shrink</span><span class="p">;</span>
<span class="n">u32</span> <span class="n">file_size_high</span><span class="p">;</span>
<span class="n">u32</span> <span class="n">reserved</span><span class="p">[</span><span class="mi">1</span><span class="p">];</span>
<span class="kt">int</span> <span class="n">shadows_obj</span><span class="p">;</span> <span class="cm">/* This object header shadows the</span>
<span class="cm"> specified object if > 0 */</span>
<span class="cm">/* is_shrink applies to object headers written when wemake a hole. */</span>
<span class="n">u32</span> <span class="n">is_shrink</span><span class="p">;</span>
<span class="p">};</span></code></pre></div>
<p>As the YAFFS documentation points out, this is not just an in-memory structure, but also the format in which header information is stored on the NAND (ie. on the raw MTD). This was my starting point.</p>
<p>A given file may be split across several data chunks, independently of its header chunk. Since the object header format doesn't have any references to other chunks, it follows that some sort of metadata is needed <em>around</em> data chunks for the filesystem implementation to know what file a given chunk belongs to, and where that chunk falls in the ordered list of data chunks that comprise the whole file.</p>
<p>This data is stored in what the YAFFS docs call <strong>spare</strong> data. The docs mention that spare data is interleaved with "actual" chunk data but doesn't say much more beyond that.</p>
<p>The YAFFS2 document on the author's website is very vague when it comes to the format of spare data. In the original YAFFS docs, spare data is said to have a fixed sized of 16 bytes per chunk, each comprised of 8 bytes of a packed data structure referred to as of <strong>tags</strong>, 6 bytes of <a href="http://en.wikipedia.org/wiki/ECC_memory">ECC</a> redundancy bits for for the chunk, a 1-byte block damaged chunk flag and an unused 16th byte.</p>
<p>The <strong>tags</strong> <a href="http://www.aleph1.co.uk/gitweb?p=yaffs2.git;a=blob;f=yaffs_guts.h;hb=7e5cf0fa1b694f835cdc184a8395b229fa29f9ae#l146">data structure</a> is as follows:</p>
<div class="highlight"><pre><code class="language-c" data-lang="c"><span class="k">struct</span> <span class="n">yaffs_tags</span> <span class="p">{</span>
<span class="n">u32</span> <span class="nl">chunk_id</span><span class="p">:</span><span class="mi">20</span><span class="p">;</span>
<span class="n">u32</span> <span class="nl">serial_number</span><span class="p">:</span><span class="mi">2</span><span class="p">;</span>
<span class="n">u32</span> <span class="nl">n_bytes_lsb</span><span class="p">:</span><span class="mi">10</span><span class="p">;</span>
<span class="n">u32</span> <span class="nl">obj_id</span><span class="p">:</span><span class="mi">18</span><span class="p">;</span>
<span class="n">u32</span> <span class="nl">ecc</span><span class="p">:</span><span class="mi">12</span><span class="p">;</span>
<span class="n">u32</span> <span class="nl">n_bytes_msb</span><span class="p">:</span><span class="mi">2</span><span class="p">;</span>
<span class="p">};</span></code></pre></div>
<p>Let's see what we have here:</p>
<ul>
<li><p><code>obj_id</code> - That's the object identifier - this lets us know which filesystem "entity" a given chunk belongs to. I think of that numeric identifier as an <a href="http://www.linfo.org/inode.html"><em>inode number</em></a>.</p></li>
<li><p><code>chunk_id</code> - This is effectively the chunk's position in the ordered list of chunks that, together, hold the file's contents.</p></li>
<li><p><code>n_bytes_lsb</code> and <code>n_bytes_msb</code> - Together, these tell us how many bytes of <em>actual file data</em> are in the chunk. Unless a file's size happens to be a whole multiple of the chunk size, we'll need to know where to cut off the runt chunk.</p></li>
<li><p><code>ecc</code> - Just some extra redundancy bits derived from the tags themselves. This isn't very interesting to me.</p></li>
<li><p><code>serial_number</code> - Who knows?</p></li>
</ul>
<p>Interestingly, the number of bytes in a chunk is stored on 10 + 2 bits, meaning that there can be up to 4095.</p>
<h1>Exploring the dump</h1>
<p>I now have some idea of what I can expect to find in the dump. As I mentioned in the <a href="/PYaffs/2014/07/15/Hacklog%230.html">first post</a>, I am particularly interested in a file named <code>/system/xbin/tcpdump</code>. I can expect to find a YAFFS object header for this file as well as for its parent dir <code>xbin</code>.</p>
<h2>Object Headers</h2>
<p>Let's get greppin', yo!</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">647-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ for offset in $(grep -abo tcpdump ../images/system.img | cut -d':' -f1); do xxd -g4 -s ${offset} -l 16 ../images/system.img; done
510782b: 74637064 756d7000 0c0c7463 7064756d tcpdump...tcpdum
5107835: 74637064 756d7020 73746f70 000a0a70 tcpdump stop...p
5107a9b: 74637064 756d7000 0b0b7463 7064756d tcpdump...tcpdum
5107aa5: 74637064 756d705f 656e6400 0a0a7068 tcpdump_end...ph
6384cf8: 74637064 756d7000 636f6d6d 616e646c tcpdump.commandl
6384d9b: 74637064 756d7020 70696420 3d202564 tcpdump pid = %d
6384dd1: 74637064 756d7020 73657276 69636520 tcpdump service
6384df0: 74637064 756d7020 70617261 6d657465 tcpdump paramete
6385854: 74637064 756d705f 72657375 6c745f6c tcpdump_result_l
6385869: 74637064 756d702d 72657375 6c742d25 tcpdump-result-%
6385884: 74637064 756d7000 2d767600 2d733000 tcpdump.-vv.-s0.
63858c1: 74637064 756d705f 72657375 6c745f6c tcpdump_result_l
64d4b4a: 74637064 756d7000 00000000 00000000 tcpdump.........
655482c: 74637064 756d703a 20436f75 6c646e27 tcpdump: Couldn'
6554868: 74637064 756d703a 20436f75 6c646e27 tcpdump: Couldn'
6ba4412: 74637064 756d7000 73797374 656d2f62 tcpdump.system/b
</code></pre></div>
<p>I've found 16 matches for the string <code>tcpdump</code>. Looking at the bytes that follow, most of these occurrences seem to be part of longer strings (eg. the match at <code>0x6554868</code>) or to be part of a cluster of NULL-terminated strings (<code>0x5107a9b</code>).</p>
<p>One match stands out, however. The occurrence of <code>tcpdump</code> at <code>0x64d4b4a</code> is followed by a bunch of NULLs. I know from the <code>struct yaffs_obj_hdr</code> definition that a YAFFS object's name in the filesystem is stored in a fixed-length character array, therefore seeing <code>tcpdump</code> padded with several consecutive NULLs is consistent with what I would expect to find in a header.</p>
<p>Let's have a closer look at the area of the dump around <code>0x64d4b4a</code>:</p>
<div class="highlight"><pre><code class="language-objdump" data-lang="objdump"><span class="x">670-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ xxd -g4 -s $(printf '%d' 0x64d4b00) -l 3000 ../images/system.img</span>
<span class="x">64d4b00: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4b10: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4b20: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4b30: ff000000 f2aaaaeb b93e2707 919cfcff .........>'.....</span>
<span class="x">64d4b40: 01000000 26020000 ffff7463 7064756d ....&.....tcpdum</span>
<span class="x">64d4b50: 70000000 00000000 00000000 00000000 p...............</span>
<span class="x">64d4b60: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4b70: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4b80: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4b90: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4ba0: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4bb0: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4bc0: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4bd0: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4be0: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4bf0: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4c00: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4c10: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4c20: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4c30: 00000000 00000000 00000000 00000000 ................</span>
<span class="x">64d4c40: 00000000 00000000 00ffffff ed810000 ................</span>
<span class="x">64d4c50: 00000000 00000000 65cc5b51 65cc5b51 ........e.[Qe.[Q</span>
<span class="x">64d4c60: 66cc5b51 846b0900 ffffffff ffffffff f.[Q.k..........</span>
<span class="x">64d4c70: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4c80: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4c90: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4ca0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4cb0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4cc0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4cd0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4ce0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4cf0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4d00: ffffffff ffffffff ffffffff 00000000 ................</span>
<span class="x">64d4d10: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4d20: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4d30: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4d40: ff001000 00280200 8bd2822f 770cfcff .....(...../w...</span>
<span class="x">64d4d50: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4d60: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4d70: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4d80: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4d90: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4da0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4db0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4dc0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4dd0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4de0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4df0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4e00: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4e10: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4e20: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4e30: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4e40: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4e50: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4e60: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4e70: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4e80: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4e90: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4ea0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4eb0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4ec0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4ed0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4ee0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4ef0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4f00: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4f10: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4f20: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4f30: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4f40: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4f50: ff000000 0000ffff a75b4381 75a3f5ff .........[C.u...</span>
<span class="x">64d4f60: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4f70: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4f80: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4f90: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4fa0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4fb0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4fc0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4fd0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4fe0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d4ff0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5000: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5010: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5020: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5030: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5040: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5050: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5060: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5070: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5080: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5090: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d50a0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d50b0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d50c0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d50d0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d50e0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d50f0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5100: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5110: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5120: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5130: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5140: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5150: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5160: ff00000f ffffff04 cd2b0a32 9a3df9ff .........+.2.=..</span>
<span class="x">64d5170: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5180: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5190: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d51a0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d51b0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d51c0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d51d0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d51e0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d51f0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5200: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5210: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5220: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5230: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5240: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5250: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5260: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5270: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5280: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5290: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d52a0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d52b0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d52c0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d52d0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d52e0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d52f0: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5300: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5310: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5320: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5330: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5340: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5350: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5360: ffffffff ffffffff ffffffff ffffffff ................</span>
<span class="x">64d5370: ff000000 04aaaaca 53a10415 55d2f0ff ........S...U...</span>
<span class="x">64d5380: 7f454c46 01010100 00000000 00000000 .ELF............</span>
<span class="x">64d5390: 02002800 01000000 509c0000 34000000 ..(.....P...4...</span>
<span class="x">64d53a0: c4670900 00000005 34002000 07002800 .g......4. ...(.</span>
<span class="x">64d53b0: 18001700 06000000 34000000 34800000 ........4...4...</span>
<span class="x">64d53c0: 34800000 e0000000 e0000000 04000000 4...............</span>
<span class="x">64d53d0: 04000000 03000000 14010000 14810000 ................</span>
<span class="x">64d53e0: 14810000 13000000 13000000 04000000 ................</span>
<span class="x">64d53f0: 01000000 01000000 00000000 00800000 ................</span>
<span class="x">64d5400: 00800000 50990800 50990800 05000000 ....P...P.......</span>
<span class="x">64d5410: 00100000 01000000 00a00800 00200900 ............. ..</span>
<span class="x">64d5420: 00200900 9cc60000 08370d00 06000000 . .......7......</span>
<span class="x">64d5430: 00100000 02000000 d0f00800 d0700900 .............p..</span>
<span class="x">64d5440: d0700900 d0000000 d0000000 06000000 .p..............</span>
<span class="x">64d5450: 04000000 51e57464 00000000 00000000 ....Q.td........</span>
<span class="x">64d5460: 00000000 00000000 00000000 06000000 ................</span>
<span class="x">64d5470: 00000000 01000070 c0830800 c0030900 .......p........</span>
<span class="x">64d5480: c0030900 90150000 90150000 04000000 ................</span>
<span class="x">64d5490: 04000000 2f737973 74656d2f 62696e2f ..../system/bin/</span>
<span class="x">64d54a0: 6c696e6b 65720000 83000000 8b000000 linker..........</span>
<span class="x">64d54b0: 66000000 6e000000 00000000 32000000 f...n.......2...</span>
<span class="x">64d54c0: 0f000000 22000000 00000000 89000000 ...."...........</span>
<span class="x">64d54d0: 3f000000 38000000 00000000 00000000 ?...8...........</span>
<span class="x">64d54e0: 00000000 67000000 80000000 68000000 ....g.......h...</span>
<span class="x">64d54f0: 00000000 00000000 3d000000 29000000 ........=...)...</span>
<span class="x">64d5500: 51000000 00000000 4d000000 5a000000 Q.......M...Z...</span>
<span class="x">64d5510: 5d000000 75000000 4c000000 00000000 ]...u...L.......</span>
<span class="x">64d5520: 0e000000 65000000 76000000 13000000 ....e...v.......</span>
<span class="x">64d5530: 00000000 00000000 00000000 5c000000 ............\...</span>
<span class="x">64d5540: 86000000 46000000 00000000 6c000000 ....F.......l...</span>
<span class="x">64d5550: 2a000000 00000000 00000000 36000000 *...........6...</span>
<span class="x">64d5560: 7a000000 00000000 17000000 00000000 z...............</span>
<span class="x">64d5570: 00000000 00000000 00000000 05000000 ................</span>
<span class="x">64d5580: ff001000 00280200 ce9ca2e9 ab9df1ff .....(..........</span>
<span class="x">64d5590: 00000000 52000000 47000000 00000000 ....R...G.......</span>
<span class="x">64d55a0: 00000000 64000000 43000000 00000000 ....d...C.......</span>
<span class="x">64d55b0: 00000000 00000000 85000000 00000000 ................</span>
<span class="x">64d55c0: 72000000 61000000 30000000 00000000 r...a...0.......</span>
<span class="x">64d55d0: 57000000 00000000 69000000 01000000 W.......i.......</span>
<span class="x">64d55e0: 78000000 7d000000 28000000 56000000 x...}...(...V...</span>
<span class="x">64d55f0: 77000000 00000000 84000000 00000000 w...............</span>
<span class="x">64d5600: 74000000 35000000 6d000000 00000000 t...5...m.......</span>
<span class="x">64d5610: 42000000 1f000000 00000000 5e000000 B...........^...</span>
<span class="x">64d5620: 00000000 70000000 8a000000 00000000 ....p...........</span>
<span class="x">64d5630: 88000000 5f000000 7e000000 00000000 ...._...~.......</span>
<span class="x">64d5640: 48000000 00000000 71000000 15000000 H.......q.......</span>
<span class="x">64d5650: 00000000 26000000 33000000 1d000000 ....&...3.......</span>
<span class="x">64d5660: 41000000 00000000 3a000000 6f000000 A.......:...o...</span>
<span class="x">64d5670: 6b000000 00000000 82000000 00000000 k...............</span>
<span class="x">64d5680: 49000000 2e000000 00000000 44000000 I...........D...</span>
<span class="x">64d5690: 10000000 00000000 00000000 63000000 ............c...</span>
<span class="x">64d56a0: 83000000 3e000000 87000000 81000000 ....>...........</span>
<span class="x">64d56b0: 06000000 25000000 ....%...</span></code></pre></div>
<p>My <code>tcpdump</code> is preceded by <code>0xffff</code>. That's consistent with the <code>u16 sum_no_longer_used</code> in the struct declaration - if YAFFS isn't using these 16 bits, it makes sense that it would set them to 1.</p>
<p>I expect the previous member of the struct to be <code>int parent_obj_id</code> and the value <code>0x00000226</code> sounds like a reasonable inode number for a file system of this size. To put it differently, it's less far-fetched than if it were <code>0x9c36281b</code></p>
<p>The previous member of the struct is the first one, <code>enum yaffs_obj_type type</code>. Its value here is <code>0x00000001</code> and I expect <code>tcpdump</code> to be a regular file. According to <a href="http://www.aleph1.co.uk/gitweb?p=yaffs2.git;a=blob;f=yaffs_guts.h;hb=7e5cf0fa1b694f835cdc184a8395b229fa29f9ae#l170"><code>yaffs_guts.h</code></a>, the type enumeration for <code>yaffs_obj_type</code> looks like:</p>
<div class="highlight"><pre><code class="language-c" data-lang="c"><span class="k">enum</span> <span class="n">yaffs_obj_type</span> <span class="p">{</span>
<span class="n">YAFFS_OBJECT_TYPE_UNKNOWN</span><span class="p">,</span>
<span class="n">YAFFS_OBJECT_TYPE_FILE</span><span class="p">,</span>
<span class="n">YAFFS_OBJECT_TYPE_SYMLINK</span><span class="p">,</span>
<span class="n">YAFFS_OBJECT_TYPE_DIRECTORY</span><span class="p">,</span>
<span class="n">YAFFS_OBJECT_TYPE_HARDLINK</span><span class="p">,</span>
<span class="n">YAFFS_OBJECT_TYPE_SPECIAL</span>
<span class="p">};</span></code></pre></div>
<p>The value we see is indeed consistent with <code>YAFFS_OBJECT_TYPE_FILE</code>.</p>
<p>Based on these findings, I'm fairly confident I have a bona fide YAFFS object header starting at <code>0x64d4b40</code> in my dump. That's pretty cool.</p>
<h2>Chunks</h2>
<p>I know that <code>0x64d4b40</code> is a multiple of the chunk size but I still don't know how big my dump's chunks are. In order to find out, I had to scroll down from that offset and carefully watch for patterns:</p>
<ul>
<li><p><code>0x64d4b40 - 0x64d4c5f</code> - That's the start of the object header. Lots of NULLs used to pad <code>tcpdump</code>, followed by what kinda looks like timestamps (<code>0x515bcc66</code> works out to March 13th 2013)</p></li>
<li><p><code>0x64d4c60 - 0x64d537f</code> - Mostly just <code>0xff</code>s. What's <strong><em>very interesting</em></strong> is that these are interrupted by 16-byte fragments of non-<code>0xff</code> bytes at <code>0x64d4d40</code>, <code>0x64d4f50</code>, <code>0x64d5160</code> and <code>0x64d5370</code></p></li>
<li><p><code>0x64d5380 - ...</code> - I've seen a lot of ELF headers <a href="https://github.com/mattboyer/optenum">in my time</a> and this sure looks like one!</p></li>
</ul>
<p>I don't know whether the ELF header at <code>0x64d5380</code> belongs to <code>tcpdump</code> or any other file but it looks like there's a data chunk starting at that offset. This would put the chunk size at <code>0x64d5380 - 0x64d4b40 = 2112</code> bytes.</p>
<h2>Spares</h2>
<p>2112-byte chunks, eh? That's... not an integer power of 2 and therefore not a very auspicious number. 2048 would be so much better!</p>
<p>It just so happens that 2112 is equal to 2048 + 64 and I've found four 16-byte fragments of data in the object header that stand out from the bytes that surround them. After a week of mulling over what these mystery bytes might be, it's occurred to me that they may just be the chunk's spare data. The fact that they occur like clockwork every 512 bytes suggest they were written programmatically, as opposed to being a feature of either object header of file data.</p>
<p>I tried to test that hypothesis by sweeping other areas of the dump. Since I want to prove that this pattern of 16-byte fragments is <strong><em>not</em></strong> part of the data stored on the filesystem, I decided to look for it in a large area of <em>contiguous</em>, <em>human-readable</em> data.</p>
<p>I don't know for sure what's in the phone's <code>/system</code> directory but I can make an educated guess that there might be a copy of the <a href="http://www.gnu.org/licenses/gpl-2.0.html">GPL</a> somewhere in there. Admittedly, that's stretching the definition of <em>human-readable</em> a wee bit.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">689-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ grep -iabo 'general public license' ../images/system.img | head -n 1
102164317:General Public License
702-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ echo $(( 102164317 - 102164317 % 528 ))
102164304
704-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ xxd -g4 -s 102164304 -l 2112 ../images/system.img
616e750: 73206f66 20746865 20474e55 2047656e s of the GNU Gen
616e760: 6572616c 20507562 6c696320 4c696365 eral Public Lice
616e770: 6e736520 76657273 696f6e20 322e0a0a nse version 2...
616e780: 416c7465 726e6174 6976656c 792c2074 Alternatively, t
616e790: 68697320 736f6674 77617265 206d6179 his software may
616e7a0: 20626520 64697374 72696275 74656420 be distributed
616e7b0: 756e6465 72207468 65207465 726d7320 under the terms
616e7c0: 6f662074 68650a42 5344206c 6963656e of the.BSD licen
616e7d0: 73652e20 53656520 52454144 4d452061 se. See README a
616e7e0: 6e642043 4f505949 4e472066 6f72206d nd COPYING for m
616e7f0: 6f726520 64657461 696c732e 0a005468 ore details...Th
616e800: 69732070 726f6772 616d2069 73206672 is program is fr
616e810: 65652073 6f667477 6172653b 20796f75 ee software; you
616e820: 2063616e 20726564 69737472 69627574 can redistribut
616e830: 65206974 20616e64 2f6f7220 6d6f6469 e it and/or modi
616e840: 66790a69 7420756e 64657220 74686520 fy.it under the
616e850: 7465726d 73206f66 20746865 20474e55 terms of the GNU
616e860: 2047656e 6572616c 20507562 6c696320 General Public
616e870: 4c696365 6e736520 76657273 696f6e20 License version
616e880: 32206173 0a707562 6c697368 65642062 2 as.published b
616e890: 79207468 65204672 65652053 6f667477 y the Free Softw
616e8a0: 61726520 466f756e 64617469 6f6e2e0a are Foundation..
616e8b0: 0a546869 73207072 6f677261 6d206973 .This program is
616e8c0: 20646973 74726962 75746564 20696e20 distributed in
616e8d0: 74686520 686f7065 20746861 74206974 the hope that it
616e8e0: 2077696c 6c206265 20757365 66756c2c will be useful,
616e8f0: 0a627574 20574954 484f5554 20414e59 .but WITHOUT ANY
616e900: 20574152 52414e54 593b2077 6974686f WARRANTY; witho
616e910: 75742065 76656e20 74686520 696d706c ut even the impl
616e920: 69656420 77617272 616e7479 206f660a ied warranty of.
616e930: 4d455243 48414e54 4142494c 49545920 MERCHANTABILITY
616e940: 6f722046 49544e45 53532046 4f522041 or FITNESS FOR A
616e950: ff008000 00000008 31c0f8d8 3ce1ffff ........1...<...
616e960: 20504152 54494355 4c415220 50555250 PARTICULAR PURP
616e970: 4f53452e 20205365 65207468 650a474e OSE. See the.GN
616e980: 55204765 6e657261 6c205075 626c6963 U General Public
616e990: 204c6963 656e7365 20666f72 206d6f72 License for mor
616e9a0: 65206465 7461696c 732e0a0a 00596f75 e details....You
</code></pre></div>
<p>We can see the familiar text in the dump and just when Lawrence Lessig has built up a good head of steam and starts shouting about the <strong>MERCHANTABILITY</strong> and the <strong>FITNESS FOR A PARTICULAR PURPOSE</strong>, a 16-byte fragment of data occurs at offset <code>0x616e950</code> that is definitely <em>not</em> part of the GPL.</p>
<p>At this point I'm fairly confident that these fragments are the out-of-band spare data written and read by YAFFS.</p>
<h2>Something is off</h2>
<p>In order to make things a bit clearer, I've decided to call the combined 2112-byte blob of chunk data interleaved with spare fragments a <strong>block</strong>.</p>
<p>It looks like I've got 151040 of them in my dump:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">705-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ stat ../images/system.img
File: ‘../images/system.img’
Size: 318996480 Blocks: 623040 IO Block: 4096 regular file
Device: fe01h/65025d Inode: 1066496 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ mboyer) Gid: ( 1000/ mboyer)
Access: 2014-08-11 22:08:27.409957044 +0100
Modify: 2014-06-01 03:59:00.494426437 +0100
Change: 2014-07-06 12:47:15.303356073 +0100
Birth: -
706-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ echo $(( 318996480 % 2112 ))
0
707-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ echo $(( 318996480 / 2112 ))
151040
</code></pre></div>
<p>The original YAFFS spec mentions a single 16-byte spare for every chunk. Here however, I have a grand total of 64 bytes of out-of-band data for every 2048-byte chunk. Every single 16-byte fragment begins and ends with <code>0xff</code>, so I only really have 56 bytes of meaningful data in there.</p>
<p>Still, that's a lot more than I expected and it's obvious that the 64-<em>bit</em> <code>struct yaffs_tags</code> declaration I got from the header isn't going to map directly to the dump's spare bytes.</p>
<h1>Reversing the spares</h1>
<p>Since unlike the object headers I don't <em>know</em> what the dump's spare data <em>should</em> look like, I had to find the equivalents of the <code>struct yaffs_tags</code> members in spare data the hard way.</p>
<h2>Finding the <code>obj_id</code></h2>
<p>I know that <code>tcpdump</code>'s object header has a <code>parent_obj_id</code> member with a value of <code>0x00000226</code> and I know that its parent object is a directory named <code>xbin</code>. Knowing what I know now about block sizes, I can look for that directory's object header and search the block's spare data for that number. I expect the <code>xbin</code> string to start 10 bytes from a block boundary:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">714-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ grep -abo 'xbin' ../images/system.img | awk -F':' '{ if(10==($1 % 2112)){ print $1 - 10} }'
105709824
716-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ xxd -g4 -s 105709824 -l 80 ../images/system.img
64d0100: 03000000 01000000 ffff7862 696e0000 ..........xbin..
64d0110: 00000000 00000000 00000000 00000000 ................
64d0120: 00000000 00000000 00000000 00000000 ................
64d0130: 00000000 00000000 00000000 00000000 ................
64d0140: 00000000 00000000 00000000 00000000 ................
</code></pre></div>
<p><code>0x00000003</code> is consistent with the enumerated type for a directory, my header is looking pretty groovy.</p>
<p>Let's put together the 4 16-byte fragments we've got around that chunk and see what we can see.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">725-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I=R=]$ for frag_offset in 512 1040 1568 2096; do xxd -g4 -s $(( 105709824 + frag_offset)) -l 16 ../images/system.img ; done
64d0300: ff001000 00260200 d98ba090 4fd6feff .....&......O...
64d0510: ff000000 0000ffff a75b4381 75a3f5ff .........[C.u...
64d0720: ff00001a ffffff00 2059caf5 ed0bfbff ........ Y......
64d0930: ff000000 ffaaaa2e 03a502ea 410bffff ............A...
</code></pre></div>
<p>The only <code>0x26</code> byte in there is found at spare offset <code>0x05</code> and it is followed by a <code>0x02</code>. That sounds promising. I repeated this process using other files I knew the path of and was able to determine that the <code>obj_id</code>-equivalent is stored as a little-endian unsigned integer starting on the 40th bit of the spare. The YAFFS1 <code>struct yaffs_tags</code> declaration points to a length of 18 bits although there could be more here.</p>
<h2>Finding the <code>chunk_id</code></h2>
<p>According to the YAFFS spec, object header chunks have a <code>chunk_id</code> value of zero whereas file data chunks have a positive integer <code>chunk_id</code> that indicates the chunk's position in the file. There are several contiguous runs of <code>0x00</code> bytes in the <code>tcpdump</code> object header spare above. Which one's the <code>chunk_id</code>?</p>
<p>To find out, I had to find at least two consecutive chunks of file data and get compare their spares. I headed back to the GPL. I knew there was a 16-byte spare fragment at <code>0x616e950</code>.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">747-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ echo $(( 102164304 % 2112 ))
528
748-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ echo $(( 102164304 - 528 ))
102163776
750-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ for frag_offset in 512 1040 1568 2096; do xxd -g4 -s $(( 102163776 + frag_offset)) -l 16 ../images/system.img ; done
616e740: ff001000 00c80100 b1d3e86c 3218f9ff ...........l2...
616e950: ff008000 00000008 31c0f8d8 3ce1ffff ........1...<...
616eb60: ff000019 ffffff05 68afaa7c 4a4cfcff ........h..|JL..
616ed70: ff000000 faaaaa48 d1334c8c 70d3f0ff .......H.3L.p...
751-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ echo $(( 102163776 + 2112 ))
102165888
752-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ for frag_offset in 512 1040 1568 2096; do xxd -g4 -s $(( 102165888 + frag_offset)) -l 16 ../images/system.img ; done
616ef80: ff001000 00c80100 c5a1ae9d 713af0ff ............q:..
616f190: ff008100 00000008 39565abc 5b40f3ff ........9VZ.[@..
616f3a0: ff00000c ffffff0d a8b75e90 ba0bf8ff ..........^.....
616f5b0: ff000000 0daaaaa3 25a947e4 f8affcff ........%.G.....
</code></pre></div>
<p>The only bytes that seem to have incremented from the first chunk's spar to the next's are at spare offset <code>0x12</code>. This is consistent with what we got from the <code>tcpdump</code> object header's spare where we have <code>0x00000000</code> at that offset. I tested that hypothesis on other files' chunks and was able to confirm that the only location in the spare where a chunkid could be found is at <code>0x12</code>. The length for that field is set to 20 bits in the YAFFS1 tags structure and could be up to 32 bits based on what I have seen.</p>
<h2>Finding the chunk's byte count</h2>
<p>The last piece of information I need to successfully extract file data from my dump is the number of file data bytes in a given chunk. I know that my chunks are 2048 bytes in length, so I expect to find that value in mid-file chunks' spares. The last chunk in a given file, that is to say with a certain <code>obj_id</code>, should have a length field with a value equal to the file's length taken from the object's header modulo 2048.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">767-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ printf '%x\n' 2048
800
</code></pre></div>
<p>There's a <code>0x0008</code> in both of my GPL spares, starting at spare offset <code>0x16</code>. The object header's spare has <code>0xffff</code> there, which makes sense since the headers don't include any file data. I set out to find <code>tcpdump</code>'s last data chunk to test that hypothesis.</p>
<p>I can tell from the object header above that the file's size is <code>0x00096b84</code> which is reasonable for a binary. <code>0x00096b84 % 2048 == 900</code> so I'll expect the runt chunk to have a byte count of 900. The last file chunk for <code>tcpdump</code> is in block #50363.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">790-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ echo $(( 50363 * 2112 ))
106366656
791-mboyer@marylou:~/Hacks/Nam-Phone_G40C/PYaffs [HL4:I±R=]$ for frag_offset in 512 1040 1568 2096; do xxd -g4 -s $(( 106366656 + frag_offset)) -l 16 ../images/system.img ; done
65708c0: ff001000 00280200 f5453b63 c5b5ffff .....(...E;c....
6570ad0: ff002e01 00008403 324fc629 baa2f8ff ........2O.)....
6570ce0: ff000019 ffffff0d 7f1bae87 9e88faff ................
6570ef0: ff000000 f2aaaa8b 70b3f52b 746dfbff ........p..+tm..
</code></pre></div>
<p><code>0x0384</code> is indeed 900. I'm now quite satisfied that the chunk's byte count is stored at spare offset <code>0x16</code>.</p>
<h1>Conclusion</h1>
<p>I've now reverse-engineered enough information about the layout of the <code>/system</code> dump to write a tool that will programmatically extract the contents and metadata of the filesystem. This tool is called <a href="https://github.com/mattboyer/PYaffs">PYaffs</a> and I first uploaded it to GitHub about 6 weeks ago.</p>
<p>This is very exciting news to me because it means this blog, which is really just a side-project, has now caught up with the main event and future hacklogs will detail new developments instead of rehashing weeks-old stuff. It's nice when you break even.</p>
<p>Since I've now partially achieved one of the <a href="/PYaffs/2014/07/15/Hacklog%230.html">goals</a> I set for myself when I began, and in doing so enabled the other two, I think I should conclude with this other quote from Jurassic Park.</p>
<blockquote>
<p>It's a UNIX system, I know this!</p>
</blockquote>
<p><img src="http://i.stack.imgur.com/VSkCU.jpg" alt=""It's a UNIX system""></p>
Hacklog #3: Dumping the Flash ROM
2014-07-31T00:00:00+01:00
/2014/07/31/Hacklog#3
<h1>Down(load)in' in the dumps</h1>
<p>This one's a big post. Getting the dumps was a process of trial and error the first time around and I made the mistake of not documenting what worked and what didn't, meaning I had to go through all that pain a second time to write this post.</p>
<p>There's a lesson in there, kids. Always log when you hack.</p>
<h2>Tools</h2>
<p>I mentioned in the first post that tools exist that can be used to write/read flash for this family of devices. The most legit-looking one I found is called <em>Smart Phone Flash Tool</em> (or SPFlashTool in some filenames) and is available from <a href="http://mtk2000.ucoz.ru/">this Russian-language site</a>. The site looks a bit dodgy in a back-alley phone repair shop kinda way, but it also looks like it has some kind of legit affiliation to MediaTek. Anyway, I also grabbed a zip archive containing drivers for MediaTek SoC's in the 65xx series from the site.</p>
<p>This is what SPFlashTool looks like:</p>
<p><img src="/PYaffs/images/SP_Flash_1.png" alt=""SPFlashTool main GUI window""></p>
<p><img src="/PYaffs/images/SP_Flash_2.png" alt=""SPFlashTool about dialog""></p>
<p>The tool's "Download" tab is concerned with getting flash images <em>into the phone</em> whereas getting flash dumps <em>out</em> is achieved through the "Read back" tab.</p>
<h2>Connectivity with the phone</h2>
<p>When the phone is up and running Android, it reports itself as a <code>HTC (High Tech Computer Corp.) Android Phone</code> with the USB Vendor/Product ID pair <code>0bb4:0c03</code>. This is the USB device that the Android SDK tools talk to.</p>
<p>Getting the dumps is done through a different process that involves a good deal of messing around with USB devices.</p>
<p>If the phone is connected while it is powered off, then a USB device with the VID/PID pair <code>0e8d:2000</code> and the description string <code>MediaTek Inc. MT65xx Preloader</code> appears on the USB root hub. This device is transient and is seen for a period time shorter than 3 seconds. It's a blink-and-you-miss-it deal:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">364-mboyer@marylou:~ [master:I±R=]$ lsusb | grep -i mediatek
Bus 001 Device 002: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader
</code></pre></div>
<p>If, on the other hand, the phone is connected while it is powered off <em>and the Volume Down key is held down</em>, then a device with VID/PID <code>0e8d:0003</code> (<code>MediaTek Inc. MT6227 phone</code>) is seen on the USB root hub and remains active as long as the phone is plugged in and therefore can actually be used to get something to/from the phone:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">365-mboyer@marylou:~ [master:I±R=]$ lsusb | grep -i mediatek
Bus 001 Device 003: ID 0e8d:0003 MediaTek Inc. MT6227 phone
</code></pre></div>
<p>Let's see what the INF files in the driver archive have that would match that device:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">376-mboyer@marylou:~/tmp/Win_Stuff/drivers/6513&6573&6575 [master:I±R=]$ find . -type f -name '*.inf' -exec egrep -qi '0e8d.*0003' {} \; -print
./SP_Flash_Tool_v2.1134.00/SP_Flash_Tool_v2.1134.00/new usb driver/2K_XP_COM/usb2ser_2kXP.inf
./Driver_USB/Driver - USB Tethering Driver (binary)/usbser/Win7/usb2ser_Win764.inf
./Driver_USB/Driver - USB Tethering Driver (binary)/usbser/Win7/usb2ser_Win7.inf
./Driver_USB/Driver - USB Tethering Driver (binary)/usbser/2K_XP_COM/usb2ser_XP64.inf
./Driver_USB/Driver - USB Tethering Driver (binary)/usbser/2K_XP_COM/usb2ser_2kXP.inf
./Driver_USB/Driver - USB Tethering Driver (binary)/usbser/Vista/usb2ser_Vista.inf
./Driver_USB/Driver - USB Tethering Driver (binary)/usbser/Vista/usb2ser_Vista64.inf
./Driver_USB/Driver - USB Cable Driver (binary)/MS_USB_Driver_exe_v1.1032.1/USB_Driver_exe_v1.1032.1/v1.1032.1/Win7/usb2ser_Win764.inf
./Driver_USB/Driver - USB Cable Driver (binary)/MS_USB_Driver_exe_v1.1032.1/USB_Driver_exe_v1.1032.1/v1.1032.1/Win7/usb2ser_Win7.inf
./Driver_USB/Driver - USB Cable Driver (binary)/MS_USB_Driver_exe_v1.1032.1/USB_Driver_exe_v1.1032.1/v1.1032.1/2K_XP_COM/usb2ser_XP64.inf
./Driver_USB/Driver - USB Cable Driver (binary)/MS_USB_Driver_exe_v1.1032.1/USB_Driver_exe_v1.1032.1/v1.1032.1/2K_XP_COM/usb2ser_2kXP.inf
./Driver_USB/Driver - USB Cable Driver (binary)/MS_USB_Driver_exe_v1.1032.1/USB_Driver_exe_v1.1032.1/v1.1032.1/Vista/usb2ser_Vista.inf
./Driver_USB/Driver - USB Cable Driver (binary)/MS_USB_Driver_exe_v1.1032.1/USB_Driver_exe_v1.1032.1/v1.1032.1/Vista/usb2ser_Vista64.inf
./Driver_USB/Driver - USB Cable Driver (binary)/v1.1121.0/ModemPortDriver/WinXP_Driver/modem_xp.inf
./Driver_USB/Driver - USB Cable Driver (binary)/v1.1121.0/ModemPortDriver/Vista64_Driver/modem_v64.inf
./Driver_USB/Driver - USB Cable Driver (binary)/v1.1121.0/ModemPortDriver/Win732_Driver/modem_w732.inf
./Driver_USB/Driver - USB Cable Driver (binary)/v1.1121.0/ModemPortDriver/Vista32_Driver/modem_v32.inf
./Driver_USB/Driver - USB Cable Driver (binary)/v1.1121.0/ModemPortDriver/Win764_Driver/modem_w764.inf
./Driver_USB/Driver - USB Cable Driver (binary)/v1.1121.0/ComPortDriver/WinXP_Driver/usb2ser_xp.inf
./Driver_USB/Driver - USB Cable Driver (binary)/v1.1121.0/ComPortDriver/Vista64_Driver/usb2ser_V64.inf
./Driver_USB/Driver - USB Cable Driver (binary)/v1.1121.0/ComPortDriver/Win732_Driver/usb2ser_Win732.inf
./Driver_USB/Driver - USB Cable Driver (binary)/v1.1121.0/ComPortDriver/Vista32_Driver/usb2ser_V32.inf
./Driver_USB/Driver - USB Cable Driver (binary)/v1.1121.0/ComPortDriver/Win764_Driver/usb2ser_Win764.inf
./Driver_USB/Driver - USB VCOM Driver (binary)/mtk_sp_usb2ser.inf
</code></pre></div>
<p>That's a lot of INF files! I arbitrarily chose to have a look at what's inside the last one:</p>
<div class="highlight"><pre><code class="language-ini" data-lang="ini"><span class="k">[Version]</span>
<span class="na">Signature</span><span class="o">=</span><span class="s">"$Windows NT$"</span>
<span class="na">Class</span><span class="o">=</span><span class="s">Ports</span>
<span class="na">ClassGuid</span><span class="o">=</span><span class="s">{4D36E978-E325-11CE-BFC1-08002BE10318}</span>
<span class="na">Provider</span><span class="o">=</span><span class="s">%MEDIATEK%</span>
<span class="na">DriverVer</span><span class="o">=</span><span class="s">04/29/2011,2.0.1118.0</span>
<span class="k">[Manufacturer]</span>
<span class="na">%MEDIATEK%</span><span class="o">=</span><span class="s">DeviceList, NTamd64</span>
<span class="k">[DestinationDirs]</span>
<span class="na">DefaultDestDir</span><span class="o">=</span><span class="s">12</span>
<span class="c1">;------------------------------------------------------------------------------</span>
<span class="c1">; Vista/Win7-64bit Sections</span>
<span class="c1">;------------------------------------------------------------------------------</span>
<span class="k">[DriverInstall.NTamd64]</span>
<span class="na">include</span><span class="o">=</span><span class="s">mdmcpq.inf</span>
<span class="na">CopyFiles</span><span class="o">=</span><span class="s">DriverCopyFiles.NTamd64</span>
<span class="na">AddReg</span><span class="o">=</span><span class="s">DriverInstall.NTamd64.AddReg</span>
<span class="k">[DriverCopyFiles.NTamd64]</span>
<span class="err">USBSER.sys,,,0x20</span>
<span class="k">[DriverInstall.NTamd64.AddReg]</span>
<span class="err">HKR,,DevLoader,,*ntkern</span>
<span class="err">HKR,,NTMPDriver,,USBSER.sys</span>
<span class="err">HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider"</span>
<span class="k">[DriverInstall.NTamd64.Services]</span>
<span class="na">AddService</span><span class="o">=</span><span class="s">usbser, 0x00000002, DriverService.NTamd64</span>
<span class="k">[DriverService.NTamd64]</span>
<span class="na">DisplayName</span><span class="o">=</span><span class="s">%SERVICE%</span>
<span class="na">ServiceType</span><span class="o">=</span><span class="s">1</span>
<span class="na">StartType</span><span class="o">=</span><span class="s">3</span>
<span class="na">ErrorControl</span><span class="o">=</span><span class="s">1</span>
<span class="na">ServiceBinary</span><span class="o">=</span><span class="s">%12%\USBSER.sys</span>
<span class="c1">;------------------------------------------------------------------------------</span>
<span class="c1">; Vendor and Product ID Definitions</span>
<span class="c1">;------------------------------------------------------------------------------</span>
<span class="k">[DeviceList]</span>
<span class="na">%GADGET%</span><span class="o">=</span><span class="s">DriverInstall, USB\VID_0BB4&PID_0005&MI_02</span>
<span class="c1">; BootRom & Preloader VCOM</span>
<span class="na">%VCOM_BOOTROM%</span><span class="o">=</span><span class="s">DriverInstall, USB\Vid_0e8d&Pid_0003</span>
<span class="na">%VCOM_PRELOADER%</span><span class="o">=</span><span class="s">DriverInstall, USB\Vid_0e8d&Pid_2000</span>
<span class="k">[DeviceList.NTamd64]</span>
<span class="na">%GADGET%</span><span class="o">=</span><span class="s">DriverInstall, USB\VID_0BB4&PID_0005&MI_02</span>
<span class="c1">; BootRom & Preloader VCOM</span>
<span class="na">%VCOM_BOOTROM%</span><span class="o">=</span><span class="s">DriverInstall, USB\Vid_0e8d&Pid_0003</span>
<span class="na">%VCOM_PRELOADER%</span><span class="o">=</span><span class="s">DriverInstall, USB\Vid_0e8d&Pid_2000</span>
<span class="c1">;------------------------------------------------------------------------------</span>
<span class="c1">; String Definitions</span>
<span class="c1">;------------------------------------------------------------------------------</span>
<span class="k">[Strings]</span>
<span class="na">MEDIATEK</span> <span class="o">=</span> <span class="s">"MediaTek Inc."</span>
<span class="na">GADGET</span> <span class="o">=</span> <span class="s">"Gadget Serial"</span>
<span class="na">SERVICE</span> <span class="o">=</span> <span class="s">"USB RS-232 Emulation Driver"</span>
<span class="na">VCOM_BOOTROM</span> <span class="o">=</span> <span class="s">"MediaTek USB Port"</span>
<span class="na">VCOM_PRELOADER</span> <span class="o">=</span> <span class="s">"MediaTek PreLoader USB VCOM (Android)"</span></code></pre></div>
<p>We can infer from the contents of that file that both devices act as serial ports, the former (<code>0e8d:2000</code>) being exposed by the preloader - presumably a piece of software involved in the very early stages of the boot process - and the latter (<code>0e8d:0003</code>) by the "Boot ROM", which <em>might</em> be the software that implements the offline behaviour of the phone (ie. display the battery gauge when the phone is charging, listen for events on the power button and the USB port). These are educated guesses, of course, and nothing more.</p>
<h2>Connecting the phone to the VM</h2>
<p>I wanted to connect the phone to my <a href="/PYaffs/2014/07/16/Hacklog%231.html">work VM</a> as the <code>0e8d:0003</code> USB device. Since this is a transient device (it appears only when I physically connect the phone), I'll need to simulate attaching the device to the VM using QEmu and libvirt's support for hot-plugging pass-through devices. I prepared a XML description of the device:</p>
<div class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt"><hostdev</span> <span class="na">mode=</span><span class="s">'subsystem'</span> <span class="na">type=</span><span class="s">'usb'</span> <span class="na">managed=</span><span class="s">'yes'</span><span class="nt">></span>
<span class="nt"><source></span>
<span class="nt"><vendor</span> <span class="na">id=</span><span class="s">'0x0e8d'</span><span class="nt">/></span>
<span class="nt"><product</span> <span class="na">id=</span><span class="s">'0x0003'</span><span class="nt">/></span>
<span class="nt"></source></span>
<span class="nt"><address</span> <span class="na">type=</span><span class="s">'usb'</span> <span class="na">bus=</span><span class="s">'0'</span> <span class="na">port=</span><span class="s">'1'</span><span class="nt">/></span>
<span class="nt"></hostdev></span></code></pre></div>
<p>The trick here is to mandate the USB port on which the device will appear on the guest, else Windows XP's driver detection routine will kick in every time the device is attached. That device can be dynamically attached to a running VM with:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">364-mboyer@marylou:~ [master:I±R=]$ virsh
Welcome to virsh, the virtualization interactive terminal.
Type: 'help' for help with commands
'quit' to quit
virsh # attach-device qemu_test_domain /home/mboyer/03_dev.xml --current
</code></pre></div>
<p>And hey presto! it shows up in the output of usbview on the guest:</p>
<p><img src="/PYaffs/images/03_device_usbview.png" alt=""Boot ROM device seen in usbview""></p>
<p>I installed the driver described in the above INF file for that device:</p>
<p><img src="/PYaffs/images/03_device_driver.png" alt=""Boot ROM device driver installation""></p>
<h1>Dumping hack flash (<em>it's a gas gas gas!</em>)</h1>
<p>Since I've finally established some sort of serial-based connectivity between my VM and the Nam-Phone's pre-Android software, it's time to try out the <em>Smart Phone Flash Tool</em>.</p>
<p>The "Read back" tab of the GUI presents the user with a grid-like widget where every row represents a segment of Flash ROM to upload from the phone. There are four parameter for each dump: name of the output file, read flags, start offset and dump size.</p>
<p>And I just happen to have these last two pieces of information from the <a href="/PYaffs/2014/07/21/Hacklog%232.html">last post</a>! Pretty convenient, huh?</p>
<p><img src="/PYaffs/images/read_back_tab.png" alt=""SPFlashTool \"Read back\" GUI""></p>
<p><img src="/PYaffs/images/read_back_dialog.png" alt=""SPFlashTool \"Read back\" dialog""></p>
<p>Time to click the "Read back" icon and let the magic happen, eh?</p>
<p><img src="/PYaffs/images/scatter.png" alt=""Oh crap""></p>
<h2>Well, shit.</h2>
<p>After a fair amount of head-scratching, I figured out that this "scatter file" is really a text-based map of the Flash partitions (how and where they are <em>scattered</em> across the Flash, as it were).</p>
<p>Now, I've no idea why we need to import that information from a file considering we're manually entering the start offset and length of the dump to download from the phone, but the tool was stubborn. The format for these "scatter files" isn't documented anywhere I could find either, so I had to hunt for examples.</p>
<p>Starting from a sample "scatter file" I found attached to a forum post, I managed to craft a minimal "scatter file" that would placate SPFlashTool without introducing any extraneous data in the process. Here it is:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">411-mboyer@marylou:~/Hacks/Nam-Phone_G40C [master:I±R=]$ cat min_scatter.txt
PRELOADER 0x0
{
}
412-mboyer@marylou:~/Hacks/Nam-Phone_G40C [master:I±R=]$ xxd -g1 min_scatter.txt
0000000: 50 52 45 4c 4f 41 44 45 52 20 30 78 30 0a 7b 0a PRELOADER 0x0.{.
0000010: 7d 0a
</code></pre></div>
<p>It's worth noting that SPFlashTool borks if the newlines in the scatter file follow the DOS convention (ie. <code>0D 0A</code> instead of just <code>0A</code>)</p>
<h2>Here we go again</h2>
<p>With the "scatter file" loaded, I can finally trigger the download of the <code>system</code> partition dump. SPFlashTool handles this as a two-part process:</p>
<ul>
<li>First, a red progress bar is shown and ~120Kb of data are downloaded into the phone</li>
</ul>
<p><img src="/PYaffs/images/DA_download.png" alt=""Boot ROM device driver installation""></p>
<p>I believe that these 120Kb of data are what the tool refers to as the "DA" or Download Agent. Based on the name and size, it's likely to be a bit of code loaded into the RAM that allows access to the Flash device and handles serial communication with SPFlashTool.</p>
<ul>
<li>Then the actual download begins. Transfer rates shown by SPFlashTool seem to hover around ~180Kbps for me using the 'Full Speed' option, ie. connecting to the phone's <code>0e8d:0003</code> device over USB1.1.</li>
</ul>
<p><img src="/PYaffs/images/full_speed_dump_download.png" alt=""Flash ROM dump download""></p>
<p>At long last, I have a dump of the <code>system</code> partition!</p>
<p><img src="/PYaffs/images/full_speed_dump_download_successful.png" alt=""Flash ROM dump successful""></p>
<div class="highlight"><pre><code class="language-text" data-lang="text">358-mboyer@marylou:~ [master:I±R=]$ stat system.img
File: ‘system.img’
Size: 318996480 Blocks: 623048 IO Block: 4096 regular file
Device: fe01h/65025d Inode: 793895 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ mboyer) Gid: ( 1000/ mboyer)
Access: 2014-07-30 00:32:08.793372357 +0100
Modify: 2014-07-30 00:32:02.013372488 +0100
Change: 2014-07-30 00:32:02.013372488 +0100
Birth: -
</code></pre></div>
<p>Yay!</p>
<h1>Further considerations</h1>
<ul>
<li><p>As I alluded to above, there is a config option in SPFlashTool that lets the user select whether they want communication between the tool and the phone's DA to occur over USB 1.1 or USB2 ("High speed" mode). When this latter option is selected, the <code>0e8d:0003</code> device disappears from the host's (and therefore also the guest's) USB root hub after the Download Agent has been loaded and is replaced by yet another USB device, this time with VID/PID <code>0e8d:2001</code>:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">289-mboyer@marylou:~ [master:I±R=]$ lsusb | grep -i mediatek
Bus 003 Device 013: ID 0e8d:2001 MediaTek Inc.
</code></pre></div>
<p>I've tried to configure QEmu pass-through to detach <code>0e8d:0003</code> from the guest and connect the new <code>0e8d:2001</code> device when it appears. I had to hack the INF file above to let Windows on the VM know that it should treat this device in a similar fashion to the other devices in the INF.</p>
<p>That actually <em>did work</em>, however transfers were very unreliable: SPFlashTool would frequently abort the dump transfer for no clear reason. Slow and steady does it, sometimes.</p></li>
<li><p>One of the cool things with using USB pass-through, and part of the reason I went through all this pain to get a dump I already had, is that one can use <a href="http://www.wireshark.org/docs/man-pages/tshark.html"><code>tshark(1)</code></a> and Linux's <a href="https://www.kernel.org/doc/Documentation/usb/usbmon.txt"><code>usbmon</code></a> module to capture USB traffic to and from the guest. This is of great interest to me, since I would ideally like to replicate SPFlashTool's functionality in a native Linux tool.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">420-mboyer@marylou:~ [master:I±R=]$ sudo tshark -i usbmon1 -w /tmp/SPFlashTool.pcap
tshark: Lua: Error during loading:
[string "/usr/share/wireshark/init.lua"]:46: dofile has been disabled due to running Wireshark as superuser. See http://wiki.wireshark.org/CaptureSetup/CapturePrivileges for help in running Wireshark as an unprivileged user.
Running as user "root" and group "root". This could be dangerous.
Capturing on 'usbmon1'
137637 ^C
</code></pre></div></li>
</ul>
<p>In the next post, I'll present my findings regarding the internal structure of the Flash dumps and the <a href="https://github.com/mattboyer/PYaffs">tool</a> I wrote to extract them. By that point, I will have caught up with the current state of the project and should hopefully be breaking new ground in subsequent hacklogs.</p>
Hacklog #2: Filesystem fun
2014-07-21T00:00:00+01:00
/2014/07/21/Hacklog#2
<h1>The Virtual Filesystem</h1>
<p>As of the <a href="/PYaffs/2014/07/16/Hacklog%231.html">last post</a>, I have the means to open an interactive shell on the phone and move around the filesystem to the extent allowed by the permissions granted to this user:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ id
id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
$ ls -l /
ls -l /
dr-x------ root root 2014-07-15 20:38 config
drwxrwx--- system cache 2014-07-15 20:38 cache
lrwxrwxrwx root root 2014-07-15 20:38 sdcard -> /mnt/sdcard
drwxr-xr-x root root 2014-07-15 20:38 acct
drwxrwxr-x root system 2014-07-15 20:38 mnt
lrwxrwxrwx root root 2014-07-15 20:38 vendor -> /system/vendor
lrwxrwxrwx root root 2014-07-15 20:38 d -> /sys/kernel/debug
lrwxrwxrwx root root 2014-07-15 20:38 etc -> /system/etc
-rw-r--r-- root root 4494 1970-01-01 01:00 ueventd.rc
-rw-r--r-- root root 0 1970-01-01 01:00 ueventd.goldfish.rc
drwxr-xr-x root root 2012-06-01 01:00 system
drwxr-xr-x root root 2014-07-15 20:38 sys
drwxr-x--- root root 1970-01-01 01:00 sbin
lrwxrwxrwx root root 1970-01-01 01:00 res -> /system/res
dr-xr-xr-x root root 1970-01-01 01:00 proc
-rw-r--r-- root root 7451 1970-01-01 01:00 meta_init.rc
-rwxr-x--- root root 27852 1970-01-01 01:00 init.rc
-rwxr-x--- root root 1677 1970-01-01 01:00 init.goldfish.rc
-rwxr-x--- root root 12110 1970-01-01 01:00 init.factory.rc
-rwxr-x--- root root 134 1970-01-01 01:00 init.aee.customer.rc
-rwxr-x--- root root 98396 1970-01-01 01:00 init
-rw-r--r-- root root 141 1970-01-01 01:00 default.prop
drwxrwx--x system system 2014-07-15 20:38 data
-rw-r--r-- root root 26646 1970-01-01 01:00 advanced_meta_init.rc
drwx------ root root 2013-04-03 07:17 root
drwxr-xr-x root root 2014-07-15 20:38 dev
</code></pre></div>
<p>I'd very much like to inspect the contents of <code>init.goldfish.rc</code> for instance since it has an unusual name, but the user I'm logged in as is neither <code>root</code> nor a member of group <code>root</code>, so I'm SOL.</p>
<p>As I mentioned in the <a href="/PYaffs/2014/07/15/Hacklog%230.html">first post</a>, two of my objectives are to access the full filesystem and to obtain superuser privileges on the phone. If I can achieve the latter then I get the former "for free". Unfortunately, I'll need to know a lot about the software running on the phone to become <code>root</code> and there are areas of the filesystem I can't access using <code>adb shell</code>. It follows that I need another way to access the filesystem, unconstrained by permissions.</p>
<p>From messing around with portable electronics over the last ten years, I'm aware that modern phones typically have the capability to receive firmware updates <em>independently</em> of the operating system. This is usually implemented by a standalone program accessed through a key combo early in the boot process - that program would talk over USB to a specialised piece of software running on a Windows PC and read/write a ROM image from/to the onboard flash storage. If you're really lucky, you might even get some basic debug output on the screen.</p>
<p>I dug around and found that such tools do indeed exist for that family of MediaTek systems, so I decided to spend some time investigating the storage configuration on this device.</p>
<h1>Storage configuration</h1>
<p>Let's have a look at what's mounted where:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mtdblock11 /system yaffs2 ro,noatime 0 0
/dev/block/mtdblock13 /data yaffs2 rw,nosuid,nodev,relatime 0 0
/dev/block/mtdblock12 /cache yaffs2 rw,nosuid,nodev,relatime 0 0
/dev/block/mtdblock7 /system/secro yaffs2 ro,relatime 0 0
</code></pre></div>
<ul>
<li><p><a href="https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt"><code>tmpfs</code></a> is a volatile FS backed by memory, so it's not really relevant to my interests here.</p></li>
<li><p><a href="https://www.kernel.org/doc/Documentation/filesystems/ramfs-rootfs-initramfs.txt"><code>rootfs</code></a> is also backed by memory, but unlike <code>tmpfs</code> it's populated at boot time from the contents of an archive passed to the kernel by the bootloader.</p></li>
</ul>
<p>That archive probably lives alongsides the kernel image in an area of flash ROM accessible to the bootloader. This may or may not be available once Linux is up and running on the phone. Anyway, that's something else to investigate.</p>
<ul>
<li><p><a href="https://www.kernel.org/doc/Documentation/filesystems/devpts.txt"><code>devpts</code></a>, <a href="https://www.kernel.org/doc/Documentation/filesystems/proc.txt"><code>proc</code></a>, <a href="https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt"><code>sysfs</code></a> and <a href="https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt"><code>cgroup</code></a> are artifacts of the kernel and not used for actual data storage.</p></li>
<li><p>This leaves us with 4 <a href="http://www.yaffs.net/"><code>yaffs2</code></a> filesystems backed by what looks like good, honest block devices.</p></li>
</ul>
<h2>MTD block devices</h2>
<p>Let's find out more about these block devices.</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ ls -l /dev/block
ls -l /dev/block
drwxr-xr-x root root 2014-07-19 22:26 vold
brw------- root root 31, 13 2014-07-19 22:26 mtdblock13
brw------- root root 31, 12 2014-07-19 22:26 mtdblock12
brw------- root root 31, 11 2014-07-19 22:26 mtdblock11
brw------- root root 31, 10 2014-07-19 22:26 mtdblock10
brw------- root root 31, 9 2014-07-19 22:26 mtdblock9
brw------- root root 31, 8 2014-07-19 22:26 mtdblock8
brw------- root root 31, 7 2014-07-19 22:26 mtdblock7
brw------- root root 31, 6 2014-07-19 22:26 mtdblock6
brw------- root root 31, 5 2014-07-19 22:26 mtdblock5
brw------- root root 31, 4 2014-07-19 22:26 mtdblock4
brw------- root root 31, 3 2014-07-19 22:26 mtdblock3
brw------- root root 31, 2 2014-07-19 22:26 mtdblock2
brw------- root root 31, 1 2014-07-19 22:26 mtdblock1
brw------- root root 31, 0 2014-07-19 22:26 mtdblock0
brw------- root root 7, 7 2014-07-19 22:26 loop7
brw------- root root 7, 6 2014-07-19 22:26 loop6
brw------- root root 7, 5 2014-07-19 22:26 loop5
brw------- root root 7, 4 2014-07-19 22:26 loop4
brw------- root root 7, 3 2014-07-19 22:26 loop3
brw------- root root 7, 2 2014-07-19 22:26 loop2
brw------- root root 7, 1 2014-07-19 22:26 loop1
brw------- root root 7, 0 2014-07-19 22:26 loop0
</code></pre></div>
<p>The filesystems that are used for persistent data storage on the phone are backed by <a href="http://www.linux-mtd.infradead.org/faq/general.html">Memory Technology Devices</a>. The FAQ I just linked to points out that MTD are neither character nor block devices, yet for the purpose of data storage they are accessed <em>as</em> block devices.</p>
<p>We can see that there's a grand total of 14 MTD block devices in <code>/dev/block</code>, of which only four are used for mounted filesystems. Major device number <code>31</code> is indeed claimed by the <code>mtdblock</code> driver:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ cat /proc/devices
cat /proc/devices
Character devices:
1 mem
2 pty
3 ttyp
4 /dev/vc/0
4 tty
5 /dev/tty
5 /dev/console
5 /dev/ptmx
7 vcs
10 misc
13 input
29 fb
90 mtd
108 ppp
128 ptm
136 pts
160 MT6575_VCodec
169 ttyC
176 drvb
178 ccci_fs
179 ccci_fs_util
180 usb
182 sec
183 CCCI_IPC_DEV
184 ccci
188 M4U_device
189 usb_device
190 mtk_stp_wmt
191 mtk_stp_GPS_chrdev
192 mtk_stp_BT_chrdev
193 fm
204 ttyMT
231 mtkbc
232 pvrsrvkm
233 ttyGS
234 Res_Mgr
235 DumChar
236 mt6575-SYSRAM
237 mt6575-eis
238 mt6575-isp
239 kd_camera_hw
240 mt6575-MDP
241 MTK_MAU
242 dummy_eeprom
243 kd_camera_flashlight
244 btn
245 mem_dummy
246 spc
247 MT_pmic_adc_cali
248 mt6575_jpeg
249 accdet
250 watchdog
251 mtk-adc-cali
252 BOOT
253 mt6575-fdvt
254 rtc
Block devices:
259 blkext
7 loop
8 sd
31 mtdblock
65 sd
66 sd
67 sd
68 sd
69 sd
70 sd
71 sd
128 sd
129 sd
130 sd
131 sd
132 sd
133 sd
134 sd
135 sd
179 mmc
254 device-mapper
</code></pre></div>
<p>The kernel has a <code>mtdblock</code> driver which exposes allows access to these MTD as if they were rgular block devices, but it also has a <code>mtd</code> driver used for character devices.</p>
<h2>The <code>mtdblock</code> driver</h2>
<p>The phone is running version <code>2.6.35.7</code> (Yokohama) of the kernel...</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ cat /proc/version
cat /proc/version
Linux version 2.6.35.7 (android@ubuntu) (gcc version 4.4.3 (GCC) ) #1 PREEMPT Wed Apr 3 14:18:40 CST 2013
</code></pre></div>
<p>...so let's have a look at the <code>mtd</code> driver's <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/drivers/mtd?id=ea8a52f9f4bcc3420c38ae07f8378a2f18443970">source</a> for <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tag/?id=v2.6.35.7">that version</a> of the kernel. Of course, I don't know what patches may or may not have been applied at build-time but it's a good place to start.</p>
<p>After a bit of digging around, it emerges that:</p>
<ul>
<li><p><code>mtdblock</code> exposes a <code>/proc/mtd</code> file <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/drivers/mtd/mtdcore.c?id=ea8a52f9f4bcc3420c38ae07f8378a2f18443970#n639">through procfs</a>:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ cat /proc/mtd
cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "preloader"
mtd1: 000c0000 00020000 "dsp_bl"
mtd2: 00300000 00020000 "nvram"
mtd3: 00020000 00020000 "seccnfg"
mtd4: 00060000 00020000 "uboot"
mtd5: 00500000 00020000 "boot"
mtd6: 00500000 00020000 "recovery"
mtd7: 00120000 00020000 "secstatic"
mtd8: 00060000 00020000 "misc"
mtd9: 00300000 00020000 "logo"
mtd10: 000a0000 00020000 "expdb"
mtd11: 12700000 00020000 "system"
mtd12: 03c00000 00020000 "cache"
mtd13: 07f20000 00020000 "userdata"
</code></pre></div></li>
<li><p><code>mtdblock</code> can <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/drivers/mtd/mtdpart.c?id=ea8a52f9f4bcc3420c38ae07f8378a2f18443970#n330">partition</a> a MTD into smaller block devices</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ cat /proc/partitions
cat /proc/partitions
major minor #blocks name
31 0 256 mtdblock0
31 1 768 mtdblock1
31 2 3072 mtdblock2
31 3 128 mtdblock3
31 4 384 mtdblock4
31 5 5120 mtdblock5
31 6 5120 mtdblock6
31 7 1152 mtdblock7
31 8 384 mtdblock8
31 9 3072 mtdblock9
31 10 640 mtdblock10
31 11 302080 mtdblock11
31 12 61440 mtdblock12
31 13 130176 mtdblock13
</code></pre></div></li>
<li><p><code>mtdblock</code>can read partitioning information from the kernel's <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/drivers/mtd/cmdlinepart.c?id=ea8a52f9f4bcc3420c38ae07f8378a2f18443970">command line arguments</a>. Too bad I can't see what arguments were given:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ ls -l /proc/cmdline
ls -l /proc/cmdline
-r--r----- root radio 0 2014-07-20 10:11 cmdline
</code></pre></div></li>
</ul>
<h1>Where we at</h1>
<p>At this point, I know that the files I'm interested in live on YAFFS filesystems (more on those in a later post) backed by various partitions of presumably a single Flash ROM device. Furthermore, I know how big each partition is. If we assume that there are no gaps between partitions on the MTD, we can infer the start offsets of each partition in the 'raw' MTD:</p>
<table><thead>
<tr>
<th>MTD Partition</th>
<th>Name</th>
<th>Start Offset</th>
<th>Size</th>
<th>Mountpoint</th>
</tr>
</thead><tbody>
<tr>
<td>mtd0</td>
<td>preloader</td>
<td>0x00000000</td>
<td>0x00040000</td>
<td>N/A</td>
</tr>
<tr>
<td>mtd1</td>
<td>dsp_bl</td>
<td>0x00040000</td>
<td>0x000c0000</td>
<td>N/A</td>
</tr>
<tr>
<td>mtd2</td>
<td>nvram</td>
<td>0x00100000</td>
<td>0x00300000</td>
<td>N/A</td>
</tr>
<tr>
<td>mtd3</td>
<td>seccnfg</td>
<td>0x00400000</td>
<td>0x00020000</td>
<td>N/A</td>
</tr>
<tr>
<td>mtd4</td>
<td>uboot</td>
<td>0x00420000</td>
<td>0x00060000</td>
<td>N/A</td>
</tr>
<tr>
<td>mtd5</td>
<td>boot</td>
<td>0x00480000</td>
<td>0x00500000</td>
<td>N/A</td>
</tr>
<tr>
<td>mtd6</td>
<td>recovery</td>
<td>0x00980000</td>
<td>0x00500000</td>
<td>N/A</td>
</tr>
<tr>
<td>mtd7</td>
<td>secstatic</td>
<td>0x00e80000</td>
<td>0x00120000</td>
<td><code>/system/secro</code></td>
</tr>
<tr>
<td>mtd8</td>
<td>misc</td>
<td>0x00fa0000</td>
<td>0x00060000</td>
<td>N/A</td>
</tr>
<tr>
<td>mtd9</td>
<td>logo</td>
<td>0x01000000</td>
<td>0x00300000</td>
<td>N/A</td>
</tr>
<tr>
<td>mtd10</td>
<td>expdb</td>
<td>0x01300000</td>
<td>0x000a0000</td>
<td>N/A</td>
</tr>
<tr>
<td>mtd11</td>
<td>system</td>
<td>0x013a0000</td>
<td>0x12700000</td>
<td><code>/system</code></td>
</tr>
<tr>
<td>mtd12</td>
<td>cache</td>
<td>0x13aa0000</td>
<td>0x03c00000</td>
<td><code>/cache</code></td>
</tr>
<tr>
<td>mtd13</td>
<td>userdata</td>
<td>0x176a0000</td>
<td>0x07f20000</td>
<td><code>/data</code></td>
</tr>
</tbody></table>
<p>I used this information to dump the relevant sections of the flash ROM - I'll cover that in a future post.</p>
Hacklog #1: Preparing a work VM
2014-07-16T00:00:00+01:00
/2014/07/16/Hacklog#1
<h1>A Confession</h1>
<p>In the <a href="/PYaffs/2014/07/15/Hacklog%230.html">last post</a>, I said I'd had this phone since April, which is true. What is definitely not true is that I'm writing these blog posts as the project progresses - that's just a narrative conceit to try and keep things consistent.</p>
<p>In actual fact, I did most of the early investigative work in May using a laptop I've since retired, then lost interest for several months. I used a native (as in, on-the-metal) install of Microsoft Windows on that laptop as a platform for the various tools I used to get data out of the phone. I no longer have access to that laptop and some of these tools were a little skeevy, so this is basically the story of me getting a VM up and running to achieve parity with the environment I used the first time around.</p>
<p>Something something unreliable narrator something.</p>
<h1>Tell me what you want, what you really really want</h1>
<p>During that first wave of investigative work back in May, the following findings were established:</p>
<ul>
<li><p>There are <strong>many</strong> tools out there that can be used to read or write flash data from/to Android phones</p></li>
<li><p>Almost all of these tools are written for Windows</p></li>
<li><p>Many of these tools are of questionable provenance. That is to say, their source code is unavalailable and they are distributed as binary archives dropped on file sharing sites</p></li>
<li><p>Many of these tools have some sort of a dependency against the Android SDK, especially against <code>adb</code> (the <a href="http://developer.android.com/tools/help/adb.html">Android Debug Bridge</a>) and the USB drivers used by <code>adb</code> to talk to the device over a USB connection</p></li>
</ul>
<p>Based on these findings, I'm going to need a Windows environment on which I can run potential malware in a safe fashion and which can connect to the phone over USB. A VM is a perfect match for that.</p>
<h1>Defining a work VM</h1>
<p>While I do have a bare-metal install of Windows on my current laptop, I spend >95% of my time on Linux. I have used VirtualBox to run VMs on a Linux host in the past and while I have nothing bad to say about VBox, I see it as a very heavy software package and I've found <code>VBoxManage</code> difficult to work with for scripting purposes.</p>
<p>I decided to use a <a href="http://wiki.qemu.org/Main_Page">QEMU</a> VM instead, managed through <a href="http://libvirt.org/index.html">libvirt</a>. In order to achieve higher performance, I'll be using <a href="http://www.linux-kvm.org/page/Main_Page">KVM</a> to leverage the virtualisation extensions built into my CPU (a AMD A8-5550M). Lastly, because I'm a heinous neckbeard I defined this VM using libvirt's XML interface.</p>
<h2>The full domain</h2>
<p>libvirt calls VMs <em>domains</em> and serialises domain configuration as XML using a format documented <a href="http://libvirt.org/formatdomain.html">here</a>. Here's a dump of the domain I created:</p>
<div class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt"><domain</span> <span class="na">type=</span><span class="s">'kvm'</span><span class="nt">></span>
<span class="nt"><name></span>NamPhone_VM<span class="nt"></name></span>
<span class="nt"><memory</span> <span class="na">unit=</span><span class="s">'KiB'</span><span class="nt">></span>786432<span class="nt"></memory></span>
<span class="nt"><os></span>
<span class="nt"><type</span> <span class="na">arch=</span><span class="s">'x86_64'</span> <span class="na">machine=</span><span class="s">'pc-i440fx-2.0'</span><span class="nt">></span>hvm<span class="nt"></type></span>
<span class="nt"><bootmenu</span> <span class="na">enable=</span><span class="s">'yes'</span><span class="nt">/></span>
<span class="nt"></os></span>
<span class="nt"><features></span>
<span class="nt"><acpi/></span>
<span class="nt"><apic/></span>
<span class="nt"></features></span>
<span class="nt"><clock</span> <span class="na">offset=</span><span class="s">'utc'</span><span class="nt">/></span>
<span class="nt"><on_poweroff></span>destroy<span class="nt"></on_poweroff></span>
<span class="nt"><on_reboot></span>restart<span class="nt"></on_reboot></span>
<span class="nt"><on_crash></span>destroy<span class="nt"></on_crash></span>
<span class="nt"><devices></span>
<span class="nt"><disk</span> <span class="na">type=</span><span class="s">'dir'</span> <span class="na">device=</span><span class="s">'floppy'</span><span class="nt">></span>
<span class="nt"><driver</span> <span class="na">name=</span><span class="s">'qemu'</span><span class="nt">/></span>
<span class="nt"><source</span> <span class="na">dir=</span><span class="s">'/home/mboyer/tmp/Win_Stuff/SATA_Driver_floppy'</span><span class="nt">/></span>
<span class="nt"><target</span> <span class="na">dev=</span><span class="s">'fd0'</span> <span class="na">bus=</span><span class="s">'fdc'</span><span class="nt">/></span>
<span class="nt"><readonly/></span>
<span class="nt"></disk></span>
<span class="nt"><disk</span> <span class="na">type=</span><span class="s">'file'</span> <span class="na">device=</span><span class="s">'cdrom'</span><span class="nt">></span>
<span class="nt"><driver</span> <span class="na">name=</span><span class="s">'qemu'</span> <span class="na">type=</span><span class="s">'raw'</span><span class="nt">/></span>
<span class="nt"><source</span> <span class="na">file=</span><span class="s">'/mnt/v12n/ISOs/virtio-win-0.1-81.iso'</span><span class="nt">/></span>
<span class="nt"><target</span> <span class="na">dev=</span><span class="s">'hda'</span> <span class="na">bus=</span><span class="s">'ide'</span><span class="nt">/></span>
<span class="nt"><readonly/></span>
<span class="nt"></disk></span>
<span class="nt"><disk</span> <span class="na">type=</span><span class="s">'file'</span> <span class="na">device=</span><span class="s">'disk'</span><span class="nt">></span>
<span class="nt"><driver</span> <span class="na">name=</span><span class="s">'qemu'</span> <span class="na">type=</span><span class="s">'raw'</span><span class="nt">/></span>
<span class="nt"><source</span> <span class="na">file=</span><span class="s">'/mnt/v12n/images/winxp.img'</span><span class="nt">/></span>
<span class="nt"><target</span> <span class="na">dev=</span><span class="s">'sda'</span> <span class="na">bus=</span><span class="s">'sata'</span><span class="nt">/></span>
<span class="nt"><boot</span> <span class="na">order=</span><span class="s">'2'</span><span class="nt">/></span>
<span class="nt"></disk></span>
<span class="nt"><controller</span> <span class="na">type=</span><span class="s">'usb'</span> <span class="na">index=</span><span class="s">'0'</span> <span class="na">model=</span><span class="s">'ehci'</span><span class="nt">></span>
<span class="nt"></controller></span>
<span class="nt"><interface</span> <span class="na">type=</span><span class="s">'network'</span><span class="nt">></span>
<span class="nt"><source</span> <span class="na">network=</span><span class="s">'Guests_to_host_private'</span><span class="nt">/></span>
<span class="nt"><model</span> <span class="na">type=</span><span class="s">'rtl8139'</span><span class="nt">/></span>
<span class="nt"></interface></span>
<span class="nt"><input</span> <span class="na">type=</span><span class="s">'mouse'</span> <span class="na">bus=</span><span class="s">'ps2'</span><span class="nt">/></span>
<span class="nt"><input</span> <span class="na">type=</span><span class="s">'keyboard'</span> <span class="na">bus=</span><span class="s">'ps2'</span><span class="nt">/></span>
<span class="nt"><graphics</span> <span class="na">type=</span><span class="s">'spice'</span> <span class="na">autoport=</span><span class="s">'yes'</span><span class="nt">/></span>
<span class="nt"><hostdev</span> <span class="na">mode=</span><span class="s">'subsystem'</span> <span class="na">type=</span><span class="s">'usb'</span> <span class="na">managed=</span><span class="s">'no'</span><span class="nt">></span>
<span class="nt"><source</span> <span class="na">startupPolicy=</span><span class="s">'mandatory'</span><span class="nt">></span>
<span class="nt"><vendor</span> <span class="na">id=</span><span class="s">'0x0bb4'</span><span class="nt">/></span>
<span class="nt"><product</span> <span class="na">id=</span><span class="s">'0x0c03'</span><span class="nt">/></span>
<span class="nt"></source></span>
<span class="nt"></hostdev></span>
<span class="nt"></devices></span>
<span class="nt"></domain></span></code></pre></div>
<h2>Highlights</h2>
<p>That was a big blob of XML. The really relevant bits are as follows:</p>
<h3>Domain config</h3>
<p>QEMU can be used for cross-platform emulation, which is definitely <em>not</em> what I want here. Therefore, to make use of hardware-assisted virtualisation the domain is defined with:</p>
<div class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt"><domain</span> <span class="na">type=</span><span class="s">'kvm'</span><span class="nt">></span>
<span class="nt"><name></span>NamPhone_VM<span class="nt"></name></span>
<span class="nt"><memory</span> <span class="na">unit=</span><span class="s">'KiB'</span><span class="nt">></span>786432<span class="nt"></memory></span>
<span class="nt"><os></span>
<span class="nt"><type</span> <span class="na">arch=</span><span class="s">'x86_64'</span> <span class="na">machine=</span><span class="s">'pc-i440fx-2.0'</span><span class="nt">></span>hvm<span class="nt"></type></span>
<span class="nt"><bootmenu</span> <span class="na">enable=</span><span class="s">'yes'</span><span class="nt">/></span>
<span class="nt"></os></span>
<span class="nt"><features></span>
<span class="nt"><acpi/></span>
<span class="nt"><apic/></span>
<span class="nt"></features></span></code></pre></div>
<p>This is enough to let libvirt know to use the right emulator, viz. <code>/usr/sbin/qemu-system-x86_64</code>. The <code><features></code> element and its children actually need to be defined in order to allow the Windows XP 64bit installer to execute.</p>
<h3>Storage Devices</h3>
<p>From past experience using VirtualBox VMs, I've noticed that using a virtual SATA controller to handle I/O with the (virtual) disk on a VM yields better performance than using a IDE/PATA controller. I don't know whether that is true for QEMU/KVM domains as well, but I gave in to my cargo cult tendencies and defined the following storage devices on the domain:</p>
<div class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt"><domain</span> <span class="na">type=</span><span class="s">'kvm'</span><span class="nt">></span>
<span class="nt"><devices></span>
<span class="nt"><disk</span> <span class="na">type=</span><span class="s">'file'</span> <span class="na">device=</span><span class="s">'cdrom'</span><span class="nt">></span>
<span class="nt"><driver</span> <span class="na">name=</span><span class="s">'qemu'</span> <span class="na">type=</span><span class="s">'raw'</span><span class="nt">/></span>
<span class="nt"><source</span> <span class="na">file=</span><span class="s">'/mnt/v12n/ISOs/virtio-win-0.1-81.iso'</span><span class="nt">/></span>
<span class="nt"><target</span> <span class="na">dev=</span><span class="s">'hda'</span> <span class="na">bus=</span><span class="s">'ide'</span><span class="nt">/></span>
<span class="nt"><readonly/></span>
<span class="nt"></disk></span>
<span class="nt"><disk</span> <span class="na">type=</span><span class="s">'file'</span> <span class="na">device=</span><span class="s">'disk'</span><span class="nt">></span>
<span class="nt"><driver</span> <span class="na">name=</span><span class="s">'qemu'</span> <span class="na">type=</span><span class="s">'raw'</span><span class="nt">/></span>
<span class="nt"><source</span> <span class="na">file=</span><span class="s">'/mnt/v12n/images/winxp.img'</span><span class="nt">/></span>
<span class="nt"><target</span> <span class="na">dev=</span><span class="s">'sda'</span> <span class="na">bus=</span><span class="s">'sata'</span><span class="nt">/></span>
<span class="nt"><boot</span> <span class="na">order=</span><span class="s">'2'</span><span class="nt">/></span>
<span class="nt"></disk></span></code></pre></div>
<p>I'm using a raw disk image for storage. Again, this is a mostly irrational decision based on poor experiences with <code>qcow2</code> images in the past. Using a raw image means I cannot easily snapshot the domain, something I will probably need.</p>
<p>I used an old license of Windows XP for this VM. Windows XP has outlived many generations of hardware and an unfortunate side effect of this is that the drivers present in its install environment may not work with more modern hardware, such as the virtual SATA controller in the domain. To work around this, I've defined a virtual floppy drive using libvirt's <code>dir</code> disk type to point its content to a directory on the host in which I've extracted the contents of the driver archive for the Intel ICH9R/DO/DH SATA AHCI Controller, the default (?) SATA controller type emulated by QEMU:</p>
<div class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt"><domain</span> <span class="na">type=</span><span class="s">'kvm'</span><span class="nt">></span>
<span class="nt"><devices></span>
<span class="nt"><disk</span> <span class="na">type=</span><span class="s">'dir'</span> <span class="na">device=</span><span class="s">'floppy'</span><span class="nt">></span>
<span class="nt"><driver</span> <span class="na">name=</span><span class="s">'qemu'</span><span class="nt">/></span>
<span class="nt"><source</span> <span class="na">dir=</span><span class="s">'/home/mboyer/tmp/Win_Stuff/SATA_Driver_floppy'</span><span class="nt">/></span>
<span class="nt"><target</span> <span class="na">dev=</span><span class="s">'fd0'</span> <span class="na">bus=</span><span class="s">'fdc'</span><span class="nt">/></span>
<span class="nt"><readonly/></span>
<span class="nt"></disk></span></code></pre></div>
<p>Note that libvirt will automatically create the floppy, IDE and SATA controllers.</p>
<h3>USB Pass-through</h3>
<p>As mentioned above, the VM needs to be able to talk to the phone over a USB connection. QEMU has a USB pass-through feature that provides exactly that functionality. The domain will therefore need two things:</p>
<ul>
<li>A USB controller. I chose the <code>ehci</code> model after the default model crashed the guest OS several times:</li>
</ul>
<div class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt"><domain</span> <span class="na">type=</span><span class="s">'kvm'</span><span class="nt">></span>
<span class="nt"><devices></span>
<span class="nt"><controller</span> <span class="na">type=</span><span class="s">'usb'</span> <span class="na">index=</span><span class="s">'0'</span> <span class="na">model=</span><span class="s">'ehci'</span><span class="nt">></span>
<span class="nt"></controller></span></code></pre></div>
<ul>
<li><p>And a <code>hostdev</code> that will instruct QEMU what device on to pass through from the host to the guest. For USB devices, we can define the device in terms of a vendor id/product it pair. Here's what the host, ie. my laptop, sees:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ lsusb
Bus 008 Device 003: ID 04f2:b2ea Chicony Electronics Co., Ltd Integrated Camera [ThinkPad]
Bus 008 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 006 Device 002: ID 04ca:2007 Lite-On Technology Corp.
Bus 006 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 007 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 003: ID 045e:0737 Microsoft Corp. Compact Optical Mouse 500
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 007: ID 0bb4:0c03 HTC (High Tech Computer Corp.) Android Phone [Fairphone First Edition (FP1)]
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
</code></pre></div></li>
</ul>
<p>There's only one Android phone connected to my laptop so it's gotta be <code>0bb4:0c03</code>. It's certainly interesting that the phone reports itself as an HTC device. Anyway, I used this information to configure pass-through:</p>
<div class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt"><domain</span> <span class="na">type=</span><span class="s">'kvm'</span><span class="nt">></span>
<span class="nt"><devices></span>
<span class="nt"><hostdev</span> <span class="na">mode=</span><span class="s">'subsystem'</span> <span class="na">type=</span><span class="s">'usb'</span> <span class="na">managed=</span><span class="s">'no'</span><span class="nt">></span>
<span class="nt"><source</span> <span class="na">startupPolicy=</span><span class="s">'mandatory'</span><span class="nt">></span>
<span class="nt"><vendor</span> <span class="na">id=</span><span class="s">'0x0bb4'</span><span class="nt">/></span>
<span class="nt"><product</span> <span class="na">id=</span><span class="s">'0x0c03'</span><span class="nt">/></span>
<span class="nt"></source></span>
<span class="nt"></hostdev></span></code></pre></div>
<h3>Networking</h3>
<p>Lastly, I'll need network connectivity on the VM to perform some tasks, such as installing the Android SDK. There are many networking options available in libvirt and the documentation doesn't really focus on their use-cases. I defined a libvirt network with the following configuration:</p>
<div class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt"><network></span>
<span class="nt"><name></span>Guests_to_host_private<span class="nt"></name></span>
<span class="nt"><forward</span> <span class="na">mode=</span><span class="s">'nat'</span><span class="nt">/></span>
<span class="nt"><bridge</span> <span class="na">name=</span><span class="s">'vm_bridge'</span> <span class="na">stp=</span><span class="s">'on'</span> <span class="na">delay=</span><span class="s">'0'</span><span class="nt">/></span>
<span class="nt"><ip</span> <span class="na">address=</span><span class="s">'172.16.16.1'</span> <span class="na">netmask=</span><span class="s">'255.255.255.0'</span><span class="nt">></span>
<span class="nt"></ip></span>
<span class="nt"></network></span></code></pre></div>
<p>...and added a NIC to the domain's collection of virtual devices:</p>
<div class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt"><domain</span> <span class="na">type=</span><span class="s">'kvm'</span><span class="nt">></span>
<span class="nt"><devices></span>
<span class="nt"><interface</span> <span class="na">type=</span><span class="s">'network'</span><span class="nt">></span>
<span class="nt"><source</span> <span class="na">network=</span><span class="s">'Guests_to_host_private'</span><span class="nt">/></span>
<span class="nt"><model</span> <span class="na">type=</span><span class="s">'rtl8139'</span><span class="nt">/></span>
<span class="nt"></interface></span></code></pre></div>
<h1>Preparing the VM environment</h1>
<p>I installed the OS on the VM and then copied the following tools over:</p>
<ul>
<li><a href="http://msdn.microsoft.com/en-us/library/windows/hardware/ff560019%28v=vs.85%29.aspx">USBView</a></li>
</ul>
<p>This tool lets one visualise the USB bus tree as well as device properties, much like <a href="http://linux.die.net/man/8/lsusb"><code>lsusb(1)</code></a></p>
<ul>
<li><a href="http://developer.android.com/sdk/index.html">The Android SDK</a></li>
</ul>
<p>This includes <code>adb</code> as well as DMMS which I use for phone screenshots</p>
<ul>
<li><a href="http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html">The Java JDK</a></li>
</ul>
<p>This is a dependency of the Android SDK. I might have gotten away with just installing a JRE.</p>
<ul>
<li><a href="http://ge.tt/2yL21VT/v/2">This USB driver for Mediatek phones</a></li>
</ul>
<p>I found this archive through <a href="http://forum.xda-developers.com/showthread.php?t=2160490">a post</a> on xda-developers.com. The driver is unsigned but it worked for me.</p>
<p>With all that in place, we can confirm that the VM "sees" the phone:</p>
<p><img src="/PYaffs/images/USBView.png" alt=""USBView""></p>
<p>We can also use <code>adb</code> to open a UNIX shell on the phone, albeit as an unprivileged user:</p>
<p><img src="/PYaffs/images/adb_shell.png" alt=""adb shell""></p>
Hacklog #0: The Beginning
2014-07-15T00:00:00+01:00
/2014/07/15/Hacklog#0
<p>Hi, I'm Matt. Nice to meet you.</p>
<p>This is an attempt at documenting a little project I've been working on, on and off, for the last while. I hope to have enough material and enough momentum for a few posts. </p>
<h1>Background</h1>
<p>I came into possession of an Android phone this April. I say <em>came into possession</em> because the manner in which I got this phone is a bit unusual. I didn't buy it, I didn't steal it, I didn't find it and it wasn't given to me.</p>
<p>I won this phone at a claw machine.</p>
<p>Well, not really a claw machine but a twist on the same concept where you have to position then trigger a linear actuator so that the rod that extends goes through a narrow-ish keyhole. The machine looked like <a href="http://soe-web-arcade2-pub.s3.amazonaws.com/sharedfiles/styles/game_image_large/public/Key%20Master%20Cabinet_1.jpg">this</a> and before you ask, I got the phone on my eighth try.</p>
<h1>The Nam-Phone G40C</h1>
<p>So what about that phone? The IMEI sticker beneath the battery claims it's a <strong>Nam-Phone G40C</strong> while the serigraphy on the backplate informs us that it is a <strong>Nam-Gear</strong> product, designed by Namco and made in China. Since Namco is a well-known maker of coin-op games, it makes sense that they'd be involved in the production of prizes for their games.</p>
<p><img src="/PYaffs/images/Nam-Phone_G40C.png" alt=""The Nam-Phone G40C""></p>
<p>I unboxed the phone, turned it on and proceeded to play with it. Here are my first impressions, in order:</p>
<ul>
<li>It actually works!</li>
<li>...but it's <em>really</em> slow!</li>
<li>The display isn't very good</li>
<li>That UI is all over the place</li>
</ul>
<p>I realised at that point that this wasn't a device I wanted to use in earnest, or at least not with the firmware it had out of the box. My next thought was to try and find out whether I could use a build of CyanogenMod or some other trusted community build of Android that would work on this device.</p>
<p>First, of course, I'd have to learn more about the device. I used a spare Google account to access the <a href="https://play.google.com">Google Play</a> market and downloaded two essential system info apps: <a href="https://play.google.com/store/apps/details?id=aws.apps.underthehood">Under the Hood</a> and <a href="https://play.google.com/store/apps/details?id=com.cpuid.cpu_z&hl=en">CPU-Z</a>.</p>
<h2>Specs</h2>
<p>Here's a summary of the phone's specs, taken from CPU-Z:</p>
<h3>System On Chip specs</h3>
<p><img src="/PYaffs/images/CPU-Z_SoC.png" alt=""Phone specs""></p>
<h3>System specs</h3>
<p><img src="/PYaffs/images/CPU-Z_System_1.png" alt=""Phone specs""></p>
<p><img src="/PYaffs/images/CPU-Z_System_2.png" alt=""Phone specs""></p>
<h1>On Rooting</h1>
<p>Android apps can request <em>root</em> privileges from <a href="http://androidsu.com/superuser/">Superuser</a> on a phone that has been rooted, that is to say on which an implementation of <a href="http://linux.die.net/man/1/su"><code>su(1)</code></a> has been installed. The Superuser app acts as an authorization broker, but it is the underlying <code>su(1)</code> executable that performs the actual privilege escalation since the <code>setuid</code> bit in its permission mode means it is executed with the privileges of its owner, viz. <code>root</code>. <a href="http://en.wikipedia.org/wiki/Setuid">Wikipedia</a> has a good primer on setuid and there's more <a href="http://wpollock.com/AUnix1/FilePermissions.htm">here</a>.</p>
<p>At any rate, rooting a phone is a big deal for Android power-users precisely because <code>su(1)</code> is typically not found in the firmware of a phone when it leaves the factory.</p>
<p>Now let's look at the last line from that screenshot again:</p>
<p><img src="/PYaffs/images/wut.png" alt=""Wait, what?""></p>
<p>Could it be that this phone has <code>su(1)</code> in its factory firmware? I installed <a href="https://play.google.com/store/apps/details?id=jackpal.androidterm&hl=en">Android Terminal Emulator</a> on the phone to have a quick look around the filesystem:</p>
<div class="highlight"><pre><code class="language-text" data-lang="text">$ ls -l /system/xbin
ls -l /system/xbin
-rwxr-xr-x root shell 60276 2013-04-03 07:29 dexdump
-rwsr-sr-x root root 9820 2013-04-03 07:30 su
-rwxr-xr-x root shell 31508 2013-04-03 07:29 iwlist
-rwxr-xr-x root shell 17924 2013-04-03 07:29 iwspy
-rwxr-xr-x root shell 31176 2013-04-03 07:29 iwconfig
-rwxr-xr-x root shell 18024 2013-04-03 07:29 iwpriv
-rwxr-xr-x root shell 18360 2013-04-03 07:29 iwevent
-rwxr-xr-x root root 617348 2013-04-03 07:29 tcpdump
-rwxr-xr-x root shell 14280 2013-04-03 07:29 iwgetid
</code></pre></div>
<p><code>su(1)</code> is definitely there. What's more, there's a file named <code>tcpdump</code> in <code>/system/xbin</code> belonging to group <code>root</code> where all others files there belong to <code>shell</code>. That's... interesting.</p>
<p><a href="http://www.tcpdump.org/manpages/tcpdump.1.html"><code>tcpdump(1)</code></a> is a packet capture tool. Its sole purpose is to record network traffic to a file for future analysis. As a network-y kinda guy, I'm a huge fan but it's a bit alarming to find it preloaded on a customer device. I couldn't find any mention of it in the UI, so I must conclude that it isn't there to be used interactively by the user. Which raises the question: why does this phone ship with privilege escalation and packet capture tools? Something's fishy here.</p>
<h1>Matt's Forensic Adventure</h1>
<p>This was the starting point for this project. I have a device with something that looks a bit like malware on it. I have the time, the inclination and hopefully the skills to find out more.</p>
<p>In future posts, I aim to achieve the following goals:</p>
<ul>
<li>Access the full filesystem</li>
<li>Investigate the presence of <code>su(1)</code>, <code>tcpdump(1)</code>. What are they doing here? What are they used for?</li>
<li>Gain superuser privileges</li>
</ul>