Skip to main content

Posts

Featured

init Says Yes to Anything

> init Says Yes to Anything: Wildcard Property Triggers Honeywell CT47 init.rc services fire on on property:...=* — any value, no validation, root context frankSx · frankhacks.blogspot.com · severity: MEDIUM In Android, on property:name=value triggers exist so init can react to state changes. The value is supposed to be a sentinel — a specific string that means "do the thing." Honeywell's logger stack declared four of them with a wildcard: on property:persist.vendor.hsm.kerdynalog.requestcmd=* → hxlogger_kerdynalog (user root) on property:persist.vendor.hsm.ramoops.requestcmd=* → ramoops dump service (root) on property:persist.vendor.hsm.logdumpd.filepath=* → hxlogger_logdumpd (root) on property:persist.vendor.hsm.bootloader.filepath=* → bootloader log copy (root) What a wildcard trigger means * doesn't mean "any value is fine." It means there is no check at all — init will run the service for any proper...

Latest posts

TCPDump Flag Injection on the CT47

Root From a World-Writable XML

The Dialer Code That Opens a Rogue-BTS Toolkit

Cracking Honeywell's Front Door With a 32-Bit Hash

Blind SSRF via Aliyun OSS Image Processing + Content-Type Upload Bypass

The AI Software Engineer That Read Us /etc/shadow

Facebook Comet Prelude : The Observation Deck: Facebook's Error, Telemetry, and Instrumentation Stack.

Facebook Comet Prelude: ServerJS and the data-sjs Pipeline: How Facebook Streams Its UI

Facebook Comet Prelude: Facebook's Custom URL Scheme Allowlist: A 150-Entry Attack Surface Inventory

Facebook Comet Prelude: The __d Machine: Facebook's Bootloader and Haste Module System

root@franksx:~$ fx:-/-