Thursday, November 13, 2008

Debian ported to G1


Over the weekend, a major G1 bug came to light. So what do you suppose happened when you typed Linux commands into any Android program under firmware 1.0 TC-RC29? According to Ed Burnette over at ZDNet, youexecuted them. Every keystroke was echoed to a root-authorized command shell. Typing telnetd started the telnet daemon. Typing reboot meant that, well, you needed to wait for a few seconds while your phone rebooted.

On the one hand, this was pretty hideously awful news for Google who went to work to push out a patched update. On the other, it was great news for the jailbreak crowd who used it to enable the telnet shell and sneak their way into the G1's innards. With that in mind, Jay "saurik" Freeman took the G1's shell to the next level. He got Debian Linux running on his G1 under RC29. Debian takes you past what Freeman calls "Google's overly simplistic busybox replacement, toolbox" and into real Unix-land.

Freeman posted complete instructions for building and installing the Debian image. Once installed on the G1, you can set up OpenSSH and start pulling down real software. If you're interested in getting your hands dirty and playing with Debian-on-G1, Freeman has set up aG1-Hackers mailing list, where you can find like-minded individuals to chat with.

As for that bug? It's been fixed and the patch has been pushed out in the RC30 build. That patch kills the Android jailbreak. Or at least it does for anyone who allows it to be installed.

For those who installed the jailbreak and could patch their systems to deny the update, RC30 has already been "defeated". Given root access, hackers figured out how to changethe accepted signatures and reject the RC30 update. Then Fnorder, a G1 hacker, made amodified version of RC30 with a setuid shell in it. Later, Jesus Freke created a full RC30 replacement version with even more features; it has become the customized update of choice. So if you take pre-emptive action from a pre-RC30 G1, you can work around the patch. If you own an RC30 G1, you're out of luck for the moment.

Resource - ArsTechnica

No comments: