yashsingh1/xdaforums huggingface dataset:
[Motorola Milestone Android Development] scholbert:
Hi kernel hackers,

it is getting very silent recently about possible security hacks on the Milestone platform.

Today i stumbled over some kernel code located in /drivers/misc/sec.

Maybe this had been discussed already.... anyway :p

There're some interesting functions in the source code and i wonder which application is using this module to enter the secure world of OMAP.

Some of the functions are accessing registers, that are also involved in low level routines of the bootcode (e.g. mbmloader).

Some questions:

Which application in android userspace is using this module?

Could we tweak this module to get access to some of the protected OMAP registers?

Is it a signed module?

Would be nice to use a modified module and activate some of the blocked features (e.g. DAP controller for debugging).

Any comments welcome!!!

Regards,

scholbert
[Motorola Milestone Android Development] HinotoriBR:
Well, I'm not a kernel hacker, but I have an educated guess...

I believe that the radio system uses those functions to check whether the kernel is valid or not, so, we have the radio not working with a replacement kernel that is loaded using kexec...

Perhaps, if it is possible to "change" this function using a module, we could get a function always telling the kernel is valid and have kexec working on Milestone. Again, I'm not a kernel hacker, but that is my guess.
[Motorola Milestone Android Development] DannyDroid:
Hi, I'm sorry that I wont be much help but these guys might;

https://www.droid-developers.org/

irc://irc.freenode.net/#milestone-modding
[Motorola Milestone Android Development] scholbert:
Hi,

thanks for your comments so far.

To be more precisely i think this kernel driver is calling the secure monitor in some way. See here:

https://www.droid-developers.org/wiki/Secure_Monitor

There's also a structure defined in that driver. I think i'll have to compare some of the ioctl entries.

https://www.droid-developers.org/wiki/Secure_Services

I'll do some investigation on this issue and search the web for some userland source code using this driver.

Again, if someone knows more about it, your welcome :D

Cheers,

scholbert
[Motorola Milestone Android Development] SophT:
you don't have to search for the source, it's on SourceForge:

http://sourceforge.net/projects/milestone.motorola/files/
[Motorola Milestone Android Development] scholbert:
Yeah sure, i knew this :rolleyes:

Anyway, thanks for the hyperlink!

In the meantime i grepped all binaries from the latest distribution.

I found out, that two applications are using /dev/sec.

1. dbvc_atvc_property_set

2. tcmd

If someone knows which package of source code they belong to... would save some time searching.

EDIT:

O.K. Google did it for me... ;)

Seems that both binaries are proprietary code. Some early conclusions:

1. dbvc_atvc_property_set

This one is started as a service in init.mapphone_umts.rc and seems to use /dev/sec for granting rights to access OMAP secure world (e.g. read eFuse values for unique device id, IMEI etc.).

This binary contains a certificate which is not Milestone specific (XT720 uses the same).

So right now i don't know, if this certificate is needed to access /dev/sec or the application itself identifies itself as trusted application (signed app).

Would make sense, if the BP uses signed applications to access certain low level functions, e.g. read/write the eFuse bank.

2. tcmd

This one is also started as a service in init.mapphone_umts.rc to access a variety of devices. Seems to be related to data streaming or stuff.

As stated it has an entry for /dev/sec and it got no certifcate.

Would be interesting to get some more info about that.

Further comments....

P.S.: This bloody security stuff is making me sick :p

Regards,

scholbert
[Motorola Milestone Android Development] scholbert:
Hi again,

i just compared some of the defines in the kernel driver headers (/drivers/misc/sec/sec_core.h) with the ones xvilka reversed inside mbmloader.

...
#define API_HAL_KM_SOFTWAREREVISION_READ 33 // 0x21
...
#define API_HAL_NB_MAX_SVC 39 // 0x27
#define API_HAL_MOT_EFUSE (API_HAL_NB_MAX_SVC + 10) // 0x31
#define API_HAL_MOT_EFUSE_READ (API_HAL_NB_MAX_SVC + 15) // 0x36
...

For comparison see the table here:

https://www.droid-developers.org/wiki/Secure_Services

It is obvious that /dev/sec allows to access OMAP secure world and uses the above mentioned API calls to push information to userspace apps.

The question would be, if ioctl must be certified through the API using some key ...

O.K. i see this is deep down code creeping, but maybe someone understands what i try to work out :p

See ya,

scholbert
[Motorola Milestone Android Development] mystichobo:
I think I know what you are trying to work out, but I can't think of any way to help :P

You're pretty much comparing the results of your findings with that of the mbmloader dump right?
[Motorola Milestone Android Development] puffo81:
I would like so much to fully understand what you are doing, but I can understand just a little..

btw I hope that you'll be glad to know that you have all my psychological support!
[Motorola Milestone Android Development] scholbert:
Yeah, kind of... we know for sure there's an API to access security functions on OMAP. I just digged out some parallels in kernel code and mbmloader.

If we could make use of security functions from within kernel space (by using a tweaked module) this would be a nice playground.

Perhaps, there's any bug or backdoor we could shamelessly exploit to:

a. boot custom kernel with second boot

b. tweak the security system and enable some hidden functions inside OMAP

Thanks a lot for pointing out :D

Best regards,

scholbert
[Motorola Milestone Android Development] mystichobo:
That's what I thought :)

Surprised noone has looked into it earlier really :p

Anyway good luck with it, adding my moral support too.

Cheers,

hobo
[Motorola Milestone Android Development] scholbert:
I got into contact with xvilka.

Obviously there'd been some investigations concerning this issue.

To be honest, i don't know if it's worth to digg a little deeper or if it will ever led to something useful in the end. Could be fun though :D

Perhaps it would be nice idea to tweak the driver and put some debug message in the code.

Another interesting thing to do would be a logging function.

This way it would be possible to get some insights of the API to secure monitor.

Anyway, i think it's never useless to discuss about some hacking here. At least were at xda-developers ;)

If you like to tweak some kernel code, join in!!!

Have fun!

scholbert
[HTC Sensation] sundar_amn:
I checked the below video from Androidcentral.com

http://www.youtube.com/watch?v=cMioPBv4PbI&feature=player_embedded

Looks like the EVO 3D got better handling on graphics speed. Is this because of the extra RAM? I just bought sensation and i still see some lag in overall touch and scroll experience. Its not bad but not very good either considering the beast hardware. Hope this can be solved by ROM chefs or by HTC themselves when they release a patch or something...
[HTC Sensation] tigerz0202:
It is a sexy device ,the speed is pretty good for me I really don't get lag ,the data problems could just be some peoples service area ,but overall I'm loving the phone
[HTC Sensation] jlevy73:
Yep there are a number of people experiencing this with the Sensation including me. I'm getting mine exchanged but I have a feeling this is going to be an issue until we get an OTA
[HTC Sensation] Electronic Punk:
I have no doubt that there is much performance to be gained from these devices.
[HTC Sensation] Sdobron:
The ram isn't the reason. Probably just coding, I wouldn't worry about it.
[HTC Sensation] topkop:
For those of you who are familiar with HTC, do updates usually improve the speed and smoothness of the phone? And how about battery?
[HTC Sensation] phoenx06:
Yes and yes. Normally.
[HTC Sensation] Electronic Punk:
If they don't the community here certainly will.
[HTC Sensation] Paging Dr B:
I saw that video yesterday and it gave me hope. Like many of you have said, I doubt it's the memory memory that's causing the lag. I'm sure with a few tweaks here and there they can speed up sense 3.0 on this device.
[HTC Sensation] madwolf27:
Im really very curious as to what is causing people lag. Mine is butter smooth and currently lag free
[HTC Sensation] sundar_amn:
Like the Evo 3D on the video?
[HTC Sensation] EddyOS:
Who actually cares, though? The phone flies as it is and the next OTA will only improve that. Just enjoy the phone and stop comparing it to everything else
[HTC Sensation] umd:
The difference is obvious and I haven't seen any Sensation that smooth on any video.

I'm pretty sure it's not the ram that causes lag. If it was ram Desire S Sense 3.0 port wouldn't have been so smooth like on that video.

http://www.youtube.com/watch?v=NmiQs2SIKU8
[HTC Sensation] EddyOS:
Pretty sure the 1.34.401.1 ROM runs better from what I've heard so the next OTAs to come out will prob address the issue
[HTC Sensation] Shaquiel Harris:
I'm more than sure the evo 3D is just running a updated version of sense than ours. Stop stressing people.. Sheesh.

Sent from my HTC Pyramid using the XDA Premium App.
[HTC Sensation] sundar_amn:
I think its more to do with the screen (panel) and its refreshing rate and rendering speeds. Evo 3D screen might be totally different from sensartion as its a 3D display. I could be wrong and i wish i am wrong. I am hoping for a OTA or custom Rom solve this... still sensation is a better device and i am loving it...
[HTC Sensation] _kansei_:
What bloatware does the Evo 3D have loaded onto it? At least those of us on T-Mobile US are stuck with an anti-malware engine that we can't uninstall. It can't be helping.
[HTC Sensation] Shaquiel Harris:
What app is that? ill uninstall it NOW. Yes i'm on TMOUSA.
[HTC Sensation] jrwingate6:
I don't think it's a RAM issue at all. I think it's one of two issues. Either it's all of the bloatware that starts up automatically every time you try to close it and some of which is not just running in the background. It is running in the foreground such as QIK video chat. I have never even used it before but it constantly want to run in the foreground. The other reason is that Sense 3.0 might not be fully optimized yet.

Here is why I think the bloatware is causing the issues. After I use a app that restarts everything (Fast Reboot) the system will be showing about 300mb of free memory is available. If you wait 30 minutes, the system then says less than 150mb of free memory available. I really do think that some of the bloatware is causing performance issues and memory leaks.

What is also weird is that I have had 4 Sensations with the same exact apps on them. I have noticed a difference in speed between all 4 of them. The one that I have now is the quickest and there is no stutter at all. The second one I had was lagging so bad that I just returned it for another. This tells me it's all software related.
[HTC Sensation] jlevy73:
Mine doesn't really lag but I can't get that carousel effect anymore. I've learned that if the phone works well keep it cuz you never know what kind of crappy replacement you might get :)
[HTC Sensation] jrwingate6:
QFT....I've seen what the bad Sensations look like and they do lag. I'm trying to figure out why some do and some don't. It's got to be software related.
[HTC Sensation] a4ol:
Remove all HTC widgets.

I use other 3rd party widgets instead and the speed is amazing, even with all screens loaded up on widgets I get 0 lag.

Go ahead and remove all the htc widgets and fill up the screens with android or other widgets and check for yourself.
[HTC Sensation] xl DIGITAL lx:
That's the exact thing I am doing. My sensation is doing really well, no problems I wanted to exchange it just because of one tiny problem, the slight lag at times. I don't want to risk exchanging it for another that has many more problems.
[HTC Sensation] _kansei_:
Lookout. It seems like as long as you never run it (i.e. never sign up for an account with them or sign in to an existing account) the app doesn't start up. You'd know if it was enabled, your phone would scan each and every thing it downloads :eek:

Trouble is once it's running I'm not sure you can go back.. I didn't really try though, and I had to exchange my sensation today for the touchscreen not working so I'm just not going anywhere near that app on the new one.
[HTC Sensation] sundar_amn:
I checked the EVO3D in local Sprint store. No doubt they are very responsive than the Sensation. I believe its the screen type that takes the capacitive touch and the extra RAM. Its more like iPhone touch response - atlease in the home screens. I still love my sensation though..
[HTC Sensation] endGameXIII:
considering the hardware in the phone, i have no doubt it's mainly because of the unpolished kernel and sense. my hd2 android that's running on emulation can run smoother than this, nevermind all that crap tmo loves to throw in to gurantee your experience sucks.
[Atrix 4G Android Development] michael0619:
More than 5 points is not perfect:(,but it can be identified.;)

use cwm recovery update .zip file

you can also modify the code in the file by youself

File: /system/etc/touchpad/21 and 22 directorys touchpad.cfg file

Code: line 28 change NUMTOUCH=2 to NUMTOUCH=10

Look forward to someone to make it more perfect
[Atrix 4G Android Development] stevendeb25:
nice will test it out

thanks
[Atrix 4G Android Development] NFHimself:
Very cool!

Cheers!

I used this instead:

#!/system/bin/sh

busybox mount -o rw,remount /system

cd /system/etc/touchpad/21/
sed 's/\(NUMTOUCH\)[ ]*=[ ]*[0-9]*/\1=10/' touchpad.cfg >temp
mv temp touchpad.cfg
chmod 644 touchpad.cfg

cd /system/etc/touchpad/22/
sed 's/\(NUMTOUCH\)[ ]*=[ ]*[0-9]*/\1=10/' touchpad.cfg >temp
mv temp touchpad.cfg
chmod 644 touchpad.cfg

busybox mount -o ro,remount /system

In this case you need to reboot for the changes to take effect. Tried multitouch tester and multitouch visualiser and I got more than 5 touches showing, only so many fingers can fit on the screen. :)
[Atrix 4G Android Development] OSNPA:
C'mon, that's cheating! :D

Very cool though, thanks for sharing!
[Atrix 4G Android Development] brandon15811:
Seems like 8 is the limit, even though I set it to 10
[Atrix 4G Android Development] Tikerz:
Awesome! Will try now.
[Atrix 4G Android Development] INSM Sin:
How would I edit the file to how you did? Thanks. Or can you post the file? :D
[Atrix 4G Android Development] ksekhar:
awesome, thank you
[Atrix 4G Android Development] WiredPirate:
Thank you, thank you, thank you for the .zip! :D

I edited these files myself and made a mistake, not sure what exactly I did wrong but after reboot I had NO TOUCH at all.

Thanks to the attached .zip I was able to just copy that to my sd via usb then flash in CWM. ;):D:) I now have 10 touch points.
[Atrix 4G Android Development] armonwilson888:
I've done the same thing. Edited files that I found that had the properties rebooted with no touch at all. Been trying to figure this out for a while. Thanks.
[Atrix 4G Android Development] ehvio:
I assume the long-hold multitouch spaz issue is unaffected by this? What happens with all that now?
[Atrix 4G Android Development] Tikerz:
Are there any side effects from enabling multiple touch points?
[Atrix 4G Android Development] Alejandrissimo:
Yes, the most important side effect from enabling multi-touch is that you can use more fingers at same time :D

just joking, but yes almost you get what you pay.

Thanks to motorola, the Atrix (most powerful smartphone in the world bla bla bla bla bla) will die without devs and users, I think moto only care about money and average users.
[Atrix 4G Android Development] NFHimself:
That was the file, nothing more to it. Create in /data/local/tmp, call it yourmomsunderpants.sh (this is important) make it executable and run it. Simple.

Cheers!
[Atrix 4G Android Development] LayzeeEyez:
Awesome thx, rebooting now
[Atrix 4G Android Development] Dav5049915:
while it does see 10 fingers, i find it to be glitchy with anything over 4 fingers.

the multitouch tester app goes crazy if i put 5 or more on the screen at once.
[Atrix 4G Android Development] rjohnstone:
This is perfect. :D

Set mine to 4 as I can't see the use for more than that at the moment.
[Atrix 4G Android Development] hosmsdos:
long hold is still the same screen will freeze after 12-14 sec
[Atrix 4G Android Development] garekinokami:
Thanks for the mod! My God, I was hoping for this for a long time, man. All that's left is that annoying screen freeze nonsense and the phone will be usable in almost all scenarios.
[Atrix 4G Android Development] Ronaldo_9:
good job, thanks .

hopefully we can disable the waterdrop feature crap that disables touch for few secs
[Atrix 4G Android Development] xabierd:
I wrote 5 instead of 10 and I los touch. Flashing back my sbf
[Atrix 4G Android Development] stvmac11:
something I learned that I thought was cool (cause I'm a noob) if you touch the bottom of the screen and move down to the 4 touch keys, it still tracks your finger. I thought the screen and the touch keys were separate tech :p
[Atrix 4G Android Development] :
No need to flash sbf if you have cwm. Transfer the .zip via usb, power off, plug to wall, power on, flash.:D
[Atrix 4G Android Development] :
Thats the third person to lose touch input while doing the manual edit..?:eek::confused: OP you may want to just take that part off the instructions or edit it to tell us what we are doing wrong if you know..
[Atrix 4G Android Development] amwbt:
Forgive my noobness, but why do we need to have 4-point multitouch?
[Atrix 4G Android Development] LayzeeEyez:
Why not? Neat little extra imo.
[Atrix 4G Android Development] xabierd:
Playing 2 players in the same screen, there is a tegra game about guerrilla (dont remember the name)

i cant, my phone was set up in charge mode.
[Atrix 4G Android Development] MXIIA:
Ok, I tried to flash this via the Recovery and the screen seems to be stuck like this...

the loading bar at the bottom is entirely blank...

What do I do ?!
[Atrix 4G Android Development] theraizen:
Same here eheheh!

But with 6 worked O_O

Ahemmm.. Got a little problem here..

How can i boot into custom recovery, if i can't use the touchpad :D ?

(i've tenfar custom)
[Atrix 4G Android Development] kennethpenn:
This is a huge win. Good job to the original creator!
[Atrix 4G Android Development] xabierd:
Maybe it only works with pair numbers.

I had to reflash my phone, it failed several times till I could go on with /system partition flashed and /data intact.

Now i flashed the zip from cwm and I hope it works
[Atrix 4G Android Development] minooch:
uh,

ADB PULL

ADB PUSH

That will work!!
[Atrix 4G Android Development] minooch:
Haven't done this yet,

ALTHOUGH

looking in the touchpad.zip he actually makes the change in 3 places

/system/etc/touchpad/20, 21 & 22

EDIT: My /system/etc/touchpad/20/touchpad.cfg already = 10
[Atrix 4G Android Development] theraizen:
/System permission denied .. is read. Only

any. Step by Step guide?
[Atrix 4G Android Development] minooch:
forgot that the atrix doesn't appear to allow adb remount

EDIT:

This might work

adb push touchpad.cfg /sdcard/touchpad.cfg

adb shell

su

mount -t rfs -o remount,rw /dev/stl5 /system

cp /sdcard/touchpad.cfg /system/etc/touchpad/20 *3 (20 21 22)

EDIT2: I TAKE NO RESPONSIBILITY i copied it from here & edited it

EDIT3: SuperUser might block it unless you "touch" accept - Sorry
[Atrix 4G Android Development] franciscojavierleon:
i did the text change in root explorer and rebooted. downloaded multitouch tester and have only 1 touch :-S
[Atrix 4G Android Development] Tennis11:
Could somebody post up a small tutorial on how to do this for the less tech savvy people? I've rooted and flashed before but I'd just like some clarification for this.

Thanks.
[Atrix 4G Android Development] franciscojavierleon:
i just used the .zip from cwm and now i have 10 touch.

my guess is that using root explorer messes somehow with the cr/lf line terminating character making the system not understand it.

so it should be done either by a shell or by cwm
[Atrix 4G Android Development] minooch:
1. copy touchpad.zip to either the internal storage (sdcard) or micro sd card (sdcard-ext)

2. reboot to cwm

3. make a backup (nandroid)

4. flash touchpad.zip

5. reboot

6. install MultiTouchTester

7. play
[Atrix 4G Android Development] tonywalker:
I just unzipped the folder "touchpad", from touchpad.zip file, and replace the original folder (/system/etc/touchpad) using Root Explorer.

It works. I have 8 touch points now. :D
[Atrix 4G Android Development] stratax:
-_- i did this.. and now my screen wont respond... i think the other thread of this was right, to edit the file in folder 20 as well?

edit: just flashed through cmw. was too lazy to mount my phone but i had to ha...
[Atrix 4G Android Development] nexxusty:
Works well, thanks for posting this.
[Atrix 4G Android Development] Tennis11:
I did this but its still 2. Did you do something with the configs?
[Atrix 4G Android Development] karl0ss:
how comes both the files on my phone in these folders are blank? they are there, but 1.9kb and contain no text?
[Atrix 4G Android Development] Ronaldo_9:
any one done 4 touches only? if so any chance of uploading the files so i can flash with cwm or tell me which fields to change.

cheers
[Atrix 4G Android Development] WIIstpM:
Multi-touch Hack.... For Defy???

Hay can someone make a hack to increase multitouch input from 2 to 5 for defy???

The Defy is soo much like a small brother of the A4G! PLEASE!!
[Atrix 4G Android Development] NFHimself:
Hi,

Don't use this, the filesystem is wrong and the device is wrong.

Cheers!
[Atrix 4G Android Development] crnkoj:
hey thanks for sharing, i did the hack manually, it registers more touches, but its rather buggy it seems. ive looked into the files a bit and found this "NUMGEST=2" one could try to change it to 4 or more and than try if its less buggy, i dont have the time to try it right now myself.
[Atrix 4G Android Development] FabricioGS:
Tested and working perfect, thanks!

I don't see much uso for more than 5 points but I left my config file as default (10).

What apps can use the multitouch properly?
[Atrix 4G Android Development] Ronaldo_9:
There are axis issues with mod even with 4 points, if you cross 5 points they lap and swap points also you see 8 touches even when its set to 4 if you overcross them with addition fingers on screen.
[Atrix 4G Android Development] mrmamon:
numtouch=8 then I can't touch lol

how can I backup my sms without touch it?
[Atrix 4G Android Development] fernandodistinto:
Hi, I installed the file through CWM and had no issues. It reads with no problem 4 touches, when I put a 5th finger on the screen, it starts glitching... anw, 4 touches are more than enough...
[Atrix 4G Android Development] theraizen:
Maybe someone should post a guide if the touchscreen comes to not work!

I'm trying different methods ATM :P
[Atrix 4G Android Development] Ronaldo_9:
there is glitch even with 4 axis crossing. I have mine set to 4. might try 3 lol
[Atrix 4G Android Development] alistair3149:
My maximum is 9...I can't put one more finger on the screen XD
[Atrix 4G Android Development] tonywalker:
Nop! Just copy.
[Atrix 4G Android Development] fernandodistinto:
how did you get 9 points? do you have glitches or anything? I used the zip file attached on the first post. Which method did u used?
[Atrix 4G Android Development] mrmamon:
Finally I can enter recovery menu from not working touch screen and in charge mode!

use this command

adb shell

then you can control your phone with this command

input keyevent 82 -> Menu

input keyevent 3 -> home

input keyevent 23 -> enter

input keyevent 19 -> up

input keyevent 20 -> down

input keyevent 21 -> left

input keyevent 22 -> right

and you can do anything!

I change my atrix to recovery mode and install touchpad.zip file from the first page then it work fine.