yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] nip_miniw:
Following my prevoius post...

In DisableBadaIntegrity.trx, I changed search pattern for Wave 3 from "F0 B5 0F 46 49 F2 DC 32 4F F2" to "F0 B5 0F 46 49 F2 A4 42 4F F2".

Here is the result tested on S8600XXLL3:

QMD header found at 0x00080000
CheckSoIntegrity found at 0x019A17F8
Code hacked successfully at 0x00EE770C

CheckPreloadedAppIntegrity found at 0x019BA3A8
Code hacked successfully at 0x00EF743C

CheckExPreloadedAppIntegrity found at 0x019C095A
Code hacked successfully at 0x00EFD9DA

CheckAppSecurity found at 0x019A0D64
Code hacked successfully at 0x00EE715C

CheckAppIntegrity found at 0x019A1158
Code hacked successfully at 0x00EE7550

SecCrVerify found at 0x0186936A
Code hacked successfully at 0x00E2A5EE

Tested on hardware -> .so signature check disabled and spoofing available.
[Bada Software and Hacking General] adfree:
S8600BOMA1_S8600TMZMA1_TMZ

Short compared with XXLD1 *.so files...

Over 73 differences in Shp folder... In Osp for instance Dolfin... Browser...

Best Regards

Edit 1.

S8600FRMA2_S8600LPMMA2_LPM

More then 60 difference between BOMA1...

Other 70 compared with XXLD1...

Will next decompress and check deeper...
[Bada Software and Hacking General] adfree:
My fault... compared BOMA1 with S8600BOKK6_S8600TMZKK6_TMZ.zip

So in Osp = ZERO changes...

In Shp 7... :rolleyes:

Amazing, after 1 year...

No idea if something is improved or fixed...

Best Regards
[Bada Software and Hacking General] hero355:
One guy reported that new options available on S8600XXLL3

Menu - Settings - Display

Automatic- Brigtness ,Keypad light and AUTO_ADJUST_SCREEN_POWER
[Bada Software and Hacking General] nip_miniw:
Nothing new...

These options were available even in S8600XXKJC or S8600JPKL1...
[Bada Software and Hacking General] Wave3.3:
On my forum UNLOCKED firmware S8600_FRMA2/LPMMA2 and modified to make it flashable on base firmware XXKJC. Now it is no brand.

New changelog:

Improved general performance

Improved wi-fi signal

And other graphical changes.
[Bada Software and Hacking General] rafaelvasconcelos:
u can edit it for wave y? here letters is black, i need in white.

i need this to make keybord black by rc1.

here 2 files: http://www.mediafire.com/download/qyncd54cb0ww7jb/Shp.rar

I would greatly appreciate it :D
[Bada Software and Hacking General] rafaelvasconcelos:
Hey dudes, i change any files *.so from wave m(china firmware) to my wave y, work any files:D

I know that wave m shows the battery percentage correct 99%,98%,97%........., but the wave y shows 100%,80%60%40%......

I was wondering if anyone knows what this file is "setup". Anyone know.
[Bada Software and Hacking General] adfree:
Doing some stupid test with admin.so...

First I removed completly...

Result:

Type : Unofficial Version
Number : 806
Builder : Administrator
Host : S1-AGENT08
Date : 2011/07/19
Time : 17:23:23
Size : 39323004 bytes
CheckSum : 0xe09410e7
View :
S/W version:S8500+XP+KG5
Modem:Q6270B-KPRBL-1.5.45T
SHP:VPP R5 2.1.1
Build Host:S1-AGENT08
BuildAt:2011/07/19 17:23:23

App Debug Level : 0
ASSERTION_REQUIRE:FALSE failed
. (file DynamicLoader.c, line
1187)
dependent lib(/Osp/Application
/SysExt/SystemLibrary/Admin.so
) file does not exist, load fa
iled at [B]all 4 search paths[/B], ps
zParentLibName (/SystemFS/Osp/
MediaPlayer.so)
<Callstack information>
PC = 4000C7DF OemDumpRegister
LR = 4000C7E3 OemDumpRegister
<Mocha Task Callstack>
_SysAssertReport
__DynLoaderLoadDependentLibs
DynLoaderMemMapNCallEntryPoint
xmlXPathCompOpEvalPositionalPr
edica

:confused:

4 search paths ???

1 seems this:

/Osp/Application/SysExt/SystemLibrary/Admin.so

Best Regards
[Bada Software and Hacking General] rafaelvasconcelos:
activating more codes(in dial)

it is simple, first convert admin.so to ELF file;

2° open file with XVI32 search for *#

change all bytes 05 to 03 or 04(i dont know how is for all codes, but if 05 the code DONT WORK)

exemple:

05 2A 23 mean |*#12..... need:

03 2A 23 mean ʳ*#12.....

if any other code no have in final the # you can add to work code.

after rename to .so again, and use wave remaker to add in folder \SystemFS\Shp\

and use multiloader to flash.

I know that I can not explain, but I tried.:cyclops:
[Bada Software and Hacking General] adfree:
:good:

Short tested... on S8500.

Then these Codes are activated too.

*#0031#	NV Backup
*#0032# NV Erase

*#0032#	test...
*#0041# Vibra test
*#0843#	DVBH
*#0844#	WiFi
*#0845#	WiFi uupsi

I have changed 28 Codes... most of them are "shortcuts" to Admin menu....

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=44932304&postcount=2

*.so files can be open also with IDA Demo for investigation...

Expect no wonder, but maybe for eductional purposes...

I have started with decompressed small files...

Later I will attach some Screenshots or maybe I have some infos...

Best Regards

Edit 1.

For instance it is easier to see which additional *.so files are involved...

; File Name : C:\IDA\soELF\[B]AdminSetting.so[/B]
; Format : ELF for ARM (Shared object)
; Shared Name 'AdminSetting.so'
[B]; Needed Library 'StubDynCast.so'
; Needed Library 'ShpWindow.so'
; Needed Library 'ShpGraphics.so'[/B]
;
; EABI version: 5
;

; Processor : ARM
; ARM architecture: ARMv6
; Target assembler: Generic assembler for ARM
; Byte sex : Little endian
[Bada Software and Hacking General] PJ@y-Z:
Can I use it for S8500? How to apply it on FMRadio.so? :confused:

If I select FMRadio.so as input, it reports: Decompress the file first

I tried to decompress in Wave Remaker but it extracted nothing
[Bada Software and Hacking General] saisaran:
Can we edit .so files in netvreflector?
[Bada Software and Hacking General] adfree:
Thank you very much.

One idea is, maybe to modifying Media...so.

I have forgotten which one. To see all folders in "my files" like sTune would show...

Best Regards
[Bada Software and Hacking General] b.kubica:
MediaExplorer...

yes, i was thinking about that but almost no one is interested in :/
[Bada Software and Hacking General] Shoorik29:
in the folder ShpApp/SystemFS/Shp/data there is a file with the name GeneralSoInfo.so.sig .

Laid out the signature of the file for your FMRadio.sо

thank you
[Bada Software and Hacking General] adfree:
:o :(

I know what you mean... Its very hard.

One reason is also. Not enough knowledge/skills about *.so...

Also your Value not in every apps_compressed.bin to disable *.so check...

I know this from XXKK5... someone told me about XXLD1...

Also not easy... Tests on device...

Flashing, Backup, Backup forgotten... etc...

Maybe we could improve our test scenario. If we manage to work with Emulator from bada SDK.

http://xdaforums.com/showthread.php?t=1276254

FactoryFs_Emul_Wave.img is at the moment my KO...

As I know it has write access... but I am tooo stupid to find way...

@ b.kubica

Please, if you have time. Can you please take an look into FactoryFs_Emul_Wave.img

Other idea is to activate COM Ports in Emulator to use with sTune or something similar...

Thanx for reading.

Best Regards

---------- Post added at 12:45 PM ---------- Previous post was at 12:40 PM ----------

@ Shoorik29

b.kubica found way to disable Sig Check... please read Thread...

@ all

Maybe we should make compatibilty list... for apps_compressed.bin

Where you can find this:

http://xdaforums.com/showpost.php?p=25314141&postcount=17

Lets start.

XXCL1 tested by me. :cool:

Best Regards
[Bada Software and Hacking General] _Aurex_:
I don't understand if I find this code in apps_compressed.bin. I'm sorry :D
[Bada Software and Hacking General] b.kubica:
ok I will try write script to disable security in every apps_compressed ;)

2nd thing - I use pfs to test modified so - no backup needed :)
[Bada Software and Hacking General] _Aurex_:
Thanks! :D I understand now!
[Bada Software and Hacking General] mylove90:
I do just like you

Waiting for your script :)

Thank you for all your hard work :)

Best Regards
[Bada Software and Hacking General] adfree:
MediaExplorer.so I meant...

Short checked...

06283FD00728 HEX Value I can find also in S8530 XXLA1

I can find in:

S8500 XXKK7

:D

Btw. FMRadio.so is same file on S8500 and S8530...

So it is identical.

Btw 2.

Nice... ELF instead compressed GCE :cool:

Thank you b.kubica

I will try to patch my S8530 and report...

Best Regards

---------- Post added at 12:59 AM ---------- Previous post was at 12:20 AM ----------

:cool:

Tested with S8530 and XXLA1 and I can confirm FMRadio.so .

Maybe we could investigate Dolfin.so ...

Be sure to DEcompress with Trix before... To play with ELF.

I have more ideas... but my brain... :o

Best Regards
[Bada Software and Hacking General] adfree:
I have short tested to replace FMRadio.so with content of VoiceMemo.so...

Reboot... not logged with WinComm

I'll try to play with MediaExplorer.so...

Best Regards

Edit 1.

Short tested to replace folder... in MediaExplorer.so

Media/Images

with

SystemFS/Osp

Seems no effect...

Edit 2.

Aha. Debug Level not set to Mid or High...

SecCrVerify::Verify Fail 3
SecCrVerify:: result -15306
SpkiCmVerifySignature:: Signature Verification Failed
SpkiCmVerifySignature: Signature verification failed
SecLogStoreData : SEC_LOG_TYPE_EXCEPTION
FmQuotaWriteFile: __FmQuotaDiffSet failed hQuota(40) iDiffQuotaSet(4096) path(/User/CertMgr/[2012-05-06 23h54m 44.983s] SpkiCmVerifySignature611.pSignerCert)
FmWriteFile : Writing file "/User/CertMgr/[2012-05-06 23h54m 44.983s] SpkiCmVerifySignature611.pSignerCert"(0x000610fb)(buffer size: 611l) Failed! Last Error is "QUOTA MAX EXCEEDED ERROR"(0x1d0003)
[Bada Software and Hacking General] ferrloz:
Hello, is after FMRadio.so adds the telephone it is restarted and even it detects the modification in .so. Probably for that firmware original it does not bring this file?:mad:
[Bada Software and Hacking General] _Aurex_:
You can use it only on LA1 FW and only after change apps compressed (thanks b.kubika).
[Bada Software and Hacking General] adfree:
Sorry. Read WHOLE Thread.

*.so files are secured.

But b.kubica found way to DISABLE in apps_compressd.bin

So first step is to DISABLE Security check... in apps_compressed.bin.

I can confirm this is working in S8500 AND S8530.

Tested and confirmed Firmware by me:

XXLA1 + XXLC1 for S8500
XXLA1 for S8530

Summary:

REMOVE first Security Check in apps_compressed.bin.

Best Regards
[Bada Software and Hacking General] hero355:
Sorry For Stupid Question.If We Disabled Security Check In apps_Compressed In this case Can we change Wave 3 .so files ? :confused:
[Bada Software and Hacking General] b.kubica:
yes, it should work on wave 3 too

i dont have any wave 3 firmware (my hdd crashed) and I m not sure if gce2elf works with wave 3 so libraries too (different GCE version?).
[Bada Software and Hacking General] hero355:
Sorry my Fault: I Would like to know If this works In this case Can we change Wave 3 so files with S8500/S8530 So files ? Example I DeskClock ? On SHP folder its name DeskCradle.so ?
[Bada Software and Hacking General] b.kubica:
depends

as i said - if GCE version the same yes we can (use gce2elf to decompress). If other version - i have no time to write decompression routine. Post that file so we can check that
[Bada Software and Hacking General] adfree:
The problem is.

*.so files are NOT standalone ...

Minimum is apps_compressed.bin

So sometimes other files involved... like more *.so files...

This is really complex stuff... :o

We need more research and in this case. :D

If bada SDK Emulator... FactoryFs_Emul_Wave.img

So we could learn more on PC... :D

Also good idea to understand how handset work, is to log with WinComm:

http://xdaforums.com/showthread.php?t=928170

Then you can see, when *.so files are loaded or unloaded... which files involved etc...

Like this:

http://xdaforums.com/showpost.php?p=23595636&postcount=11

Maybe we can play with Camera.so... or Navigation.so... or ... :p

Best Regards

---------- Post added at 06:34 PM ---------- Previous post was at 06:28 PM ----------

Easiest start for *.so tweak is Admin.so

Here we can replace Codes... :D

As now confirmed ELF working... we can use complete decompressed file. :cool:

http://xdaforums.com/showthread.php?t=1154945&page=6

Best Regards
[Bada Software and Hacking General] b.kubica:
ok, i have no time to made single click tool

another way - list all apps which can be "fixed" with this method. From me (default 06 28 3F D0 07 28):

S8500:

XXKK5 - 02 28 3C D0 06 28

PMKL2

XXKL6 - 02 28 3C D0 06 28

XXLA1

XXLC1

DDLC2

ZCLC2

thanks mylove90:

DXLD1 - 02 28 3C D0 06 28

ZCLB4 - 02 28 3C D0 06 28

XXKK7

CXLB1

S8530:

thanks adfree:

XXLA1

S8600:

XXLC3 - 06 28 4F F0 00 08
[Bada Software and Hacking General] freddy5:
you guys are so amazing. great job until now! :cool:

with best regards
[Bada Software and Hacking General] mylove90:
S8500

DXLD1 - 02 28 3C D0 06 28

ZCLB4 - 02 28 3C D0 06 28

XXKK7 - Default

CXLB1 - Default

Thank you for your help :)

Best Regards
[Bada Software and Hacking General] adfree:
I can find this String in XXLD1 from S8600

Please.

Need search Value for S8500 XPKG5...

I will try by my self... but... :o

About S8600. We need some Tester. :D

@ freddy5

Wie siehts aus. Soll ich mal ne XXLD1 für S8600 hochladen?

Problem ist ja nach wie vor die weiteren Schrittchen...

Könnten ja trotzdem mal mit der apps_compressed anfangen...

Ich komme in absehbarer Zeit nicht zu einem S8600... als Testgerät...

Kann also nicht selbst probieren.

Best Regards

---------- Post added 8th May 2012 at 12:00 AM ---------- Previous post was 7th May 2012 at 11:02 PM ----------

http://xdaforums.com/showpost.php?p=25805215&postcount=16

I am playing again with bada SDK Emulator and FactoryFs_Emul_Wave.img.

I have extracted MediaExplorer.so...

Now I could play with it...

I will try few things, lets see what happens. :D

Best Regards
[Bada Software and Hacking General] adfree:
Maybe not mandatory to log with WinComm...

Maybe also not mandatory to decompress for FULL file... ELF...

Attached is DeskCradle.so

Search for .so

Result you can find...

Osp.so
AFC.so
ShpGraphics.so
SndowDynCast.so

:(

This means MORE *.so files involved + apps_compressed.bin

Theory. If apps_compessed is not prepared for *.so files, it is nearly impossible to include simple by copy and paste...

But we have enough *.so file for research and I think there are few funny things possible. :D

Need only more brain... ehm time... ehm both... brain + time... :o

Best Regards
[Bada Software and Hacking General] adfree:
:eek:

Played with *.so files from Osp folder...

Yes also possible.

No idea if accident, because my S8530 is damaged bought... but uiui...

My Display did funny things... :eek:

So I removed fast my battery...

My changes in mbase.so:

1own... no good idea, seems depend on filepathinfo.ini

Bootcycle...

But 2own... in mbaseio.so "works"...

WARNING!

All tests at your own Risk!

You play with Systemfiles if you modify *.so ...

Backup your own data before...

Otherwise maybe not possible to fix mistake via PFS...

I will do more theory now. :o

Best Regards
[Bada Software and Hacking General] gabiju:
Hello

May i help you?

I have W3 :D
[Bada Software and Hacking General] adfree:
:o

Thank you.

After my little accident with Display of my Wave 2...

I am not sure if good idea...

It could be risky... dangerous...

Maybe not for Hardware but S8600 users at the moment have no full control of Firmwarefiles...

You could loose Data...

Remember hero355 is our first and only user who was able to create Custom Firmware.

And not all files modified and confirmed...

Minimum requirement is to know Backup and Restore and full handle with Multiloader...

Otherwise we can't help you to restore your S8600 if something goes wrong...

Best Regards
[Bada Software and Hacking General] gabiju:
backup restore and mulitiloader are not probleme for me...

Just tell me what i have to do

i'm working today,so i can speak but i can't test before 07PM (topic time)
[Bada Software and Hacking General] hero355:
Succesfully worked and without dataloss.Test FmRadio.so and Front Camera :)

Thank You B.Kubica for Your Method and Thank you Adfree for Cleared me :)
[Bada Software and Hacking General] adfree:
I could upload modified XXLC3 and/or XXLD1 for S8600...

But again. Be sure you will do this...

You can check before with Wave_Remaker to check my changes...

Best Regards
[Bada Software and Hacking General] gabiju:
I can not brick my wave ,i think, i've tried so much things into my first 8500 :confused:

Actually i'm on S8600XXLC3.S8600OXALC2.XEF by multiloader but official on Kies.

Just tell me exactly what we do, and what i have to check.
[Bada Software and Hacking General] adfree:
I will upload only apps_compressed.bin...

You need then only 1 file flash with Multiloader...

apps_compressed.bin :D

Thats in main all.

Later I will upload...

Best Regards
[Bada Software and Hacking General] gabiju:
ok thanks :D

I m waiting

best regards
[Bada Software and Hacking General] adfree:
http://www.mediafire.com/?5nan4kidu7sd3bk

This is my modified S8600 apps_c...

I have taken XXLD1...

This should be no big problem.. if you are on XXLC3.

Caution!

Only flash 1 file... only apps_compressed_test1MD5.bin

Untested.

At your own risk.

I have used Wave_Remaker_NEW_2_0_7_1.exe

Best Regards
[Bada Software and Hacking General] gabiju:
ok I will try during the lunch

I will make backup before...we don't know

thanks
[Bada Software and Hacking General] adfree:
Yes. Backup if you need something is an good idea.

Safety is first.

Thank you for trying. :cool:

Best Regards
[Bada Software and Hacking General] gabiju:
No data loss

but it seem's the sensitive touchscreen is less...:(

but i didn't see any change :confused::confused::confused:

may i flash (back) my own(original) appsCompressed?

tell me if i have to see or make something else.

best regards
[Bada Software and Hacking General] adfree:
No its perfect. :D

Other S8600 user told about check with funny Mod of...

So now *.so check is disable. Also on S8600.

And confirmed. :cool:

Thanx.

Now you could play in theory with some *.so files... but.

1.

Caution... Systemfiles...

2.

Only short tested, but it seems S8600 have some different QMDC Algo ?

Not sure, I were not able to extract them via TriX...

So you could only play now in compressed GCE instead ELF... uncompressed...

3.

I have checked again apps_c by decompress and decrypt...

Its really only 1 Byte, you can check...

4.

Somebody could check if S8600 have same FMRadio.so ...

I have only short compared XXLA1 S8500 and XXLD1 S8600 they are different...

But maybe compare 2 files of same group...

XXLx1

Best Regards
[Bada Software and Hacking General] _Aurex_:
Hi guys!

I want to tell you something about my test: I wanted to put european language to ZDLB4 firmware (not replacing english with another one). So I disabled security check in apps compressed (thanks kubika) and I changed .srs file in string (CSC) and then I put OpEuro.so and OpEuroSetting.so in SHP (ShpApp > SecurityFS > SHP) and changed code in GeneralSoInfo.so.sig.

After flash Wave reboot. It doesn't work, maybe because adfree has right:

:(
[Bada Software and Hacking General] adfree:
No panic...

With these *.so files we can do enough funny things. ;)

We need only to improve our knowledge...

Once again... WinComm shows you, which files are active used...

Best Regards
[Bada Software and Hacking General] gabiju:
probleme with touchscreen

ex when open screen with home button=impossible to unlock

scrolling is very hard=it open during you are scrolling...etc

i flashed original one.

thanks for your work

if you need me,ask me,pleasure for me to help 8600's users for custom.
[Bada Software and Hacking General] _Aurex_:
Thanks! :D No panic, because I've got 2 Samsung Wave S8500! One is tester, one is my smartphone, lol!
[Bada Software and Hacking General] hero355:
FmRadio.so is different Between Wave 3 and Wave/Wave II :(
[Bada Software and Hacking General] adfree:
Ah. Maybe you are right... :o

I was wondering on my modified S8530 about long time for start of DevBrowser...

And I can remember, that if Debug Level is high, I got this Bluescreen:

http://xdaforums.com/showpost.php?p=25766627&postcount=30

So only bypass of Security Check...

Maybe my Value is to high... :o

I have changed 06 into FF...

Maybe this slow down...

Sorry.

Will try other Value.

Best Regards
[Bada Software and Hacking General] b.kubica:
no no that value has nothing to do with it

it's something like that:

if ( value == 6 )
check_integrity();

every value grater than 7 is ok

ok, now I get it, my mistake ;)

for S8600 - 06 28 4F F0 00 08
[Bada Software and Hacking General] _Aurex_:
Thanks b.kubika! :D And..do you know LD1 Thailand code?

EDIT: Sorry!

DXLD1 - 02 28 3C D0 06 28
[Bada Software and Hacking General] freddy5:
okay here I am :D

LD1 is good but not XX rather ZC (I am currently on S8600ZCLD1/S8600OZCLD1)

fantastic fw but without DBT/OXA CSC tricky^^

in the next days I have some more time to test..

maybe i flash back to XXLD1 or XXLC3

best regards
[Bada Software and Hacking General] hero355:
This also same that DXLD1 and ZCLB4

S8500JVLC2 - 02 28 3C D0 06 28

Still Waiting for you For this :)
[Bada Software and Hacking General] b.kubica:
06 28 4f f0 00 08
[Bada Software and Hacking General] hero355:
Founded Right Value.It worked ;)

Default= 02 28 3C D0 06 28

Changed and Disabled :)

JVLC2 - 02 28 3C D0 FF 28

DXLD1 - 02 28 3C D0 FF 28

ZCLB4 - 02 28 3C D0 FF 28
[Bada Software and Hacking General] adfree:
@ gabiju

I got feedback from other S8600 user.

He has no problem with Touch...

He used XXLD1 as based Firmware...

:o

Maybe I was wrong and sometimes not all apps_compressed.bin can be mixed.

But for short tests. :D

Maybe today or tomorrow I will upload XXLC3 for S8600.

Best Regards
[Bada Software and Hacking General] gabiju:
ok I'll try :D

interesting to know...
[Bada Software and Hacking General] b.kubica:
time for real s8600 tests ;)

after 3 hours struggle with VFP instruction set (TriX has built in armv4t emulator with no coprocessor) gce2elf supports now Qram version 0xAD used in s8600 (maybe others too, i didn't check)

best regards,

Bartek
[Bada Software and Hacking General] mylove90:
YaaaaaaaaaaaaaY

Finally we can play with S8600's .so files :D

Thank you so much :)

Best Regards
[Bada Software and Hacking General] b.kubica:
Wave 723 too ;)

S723EXXLB3 - 00 24 06 28 07 28

S5380DCXKL1 - 00 24 06 28 07 28

S7250DXXKK1 - 00 24 06 28 06 D0

M210SKRLC2 - 02 28 3C D0 06 28
[Bada Software and Hacking General] hero355:
Can you also change Desk Clock (Cradle.so) for Wave I/II ?
[Bada Software and Hacking General] freddy5:
http://badablog.ru/samsung-wave-fm-radio-bez-antennyi/

with best regards
[Bada Software and Hacking General] cybekteam:
I've modified alarm to don't stop after 1 minute ringing :)

And I've deleted this stupid "operator name" from notification bar. (You know, for example "Play" or "Orange")

See attachment, it's for JVLC2 soft.
[Bada Software and Hacking General] cybekteam:
I'm able to "create" my custom hidden storage.

But only "root" files are visible. But this files are readable :)

Attached screenshots:

EDIT: few nice commands:

Working: FmCreateDir /Mount/cybek

Not working: FmCreateSymLink /User/HidVol/IntSys/Debug/Media /Media

Tested in QuB

EDIT2: when changed mounting "/" partition to "/SystemFS" I'm able to view all files in subdirs. Will try to access all folders.

EDIT3: only root files and folders (no subdirs files) visible on phone, attached
[Bada Software and Hacking General] mylove90:
How about taking a look into AppInstaller.so ?? :D :D

Good to see more skilled users right here

I got no time these days due to exams but i'll keep watching this thread ;)

Keep up the good work

Best Regards