yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] b.kubica:
Current method to patch apps has many disadvantages, so I decided to find better method to "improve" our APPS> I tested it successfully on LA1. The problem with security verify fail (seen when debug mid or high) should be gone

Now is time to collect if new pattern fit all apps from wave 1-3 and if not improve it :)

taken from LA1 but works on:

S8500XXKK5

S8500PMKL2

S8500XXKL6

S8500XXLA1

S8500XXLC1

M210SKRLC2

CheckSoIntegrity - 2D E9 F3 5F 00 20 / change to 01 20 70 47 E3 4A

CheckAppIntegrity - not sure I have right to post it, time will show ;)

regards,

Bartek
[Bada Software and Hacking General] mylove90:
Can't find this new hex value in DXLD1 :O

Can you check it please ?? :)

Best Regards
[Bada Software and Hacking General] adfree:
Very cool progress.

Thanx.

:cool:

My S8500 is now ready to test... :D

@ all

Maybe we could collect few infos about *.so files ... and their "meaning"...

Like this:

FMRadio.so is part of Radio App

Admin.so contain User Codes...

Dolfin.so is part of Dolfin Browser...

And so on...

Thanx in advance...

Best Regards
[Bada Software and Hacking General] cybekteam:
@adfree:

Nice idea.

Agent.so - MTP connection support (maybe USB - pendrive-mode?), registering hidden-storage, can change to any path, like my screenshots

Clock.so - Alarm, calendar notifications, events. Can edit not to stop after 1 minut ringing alarm

Extras.so - calculator :) can change calc functions like tan, sin, etc.

QuickPanelApp.so - quick panel :D (probably) can disable notifications on this bar, can disable operator name displaying. Maybe buttons? Of their functions? Must check

IdleSvc.so MainMenu.so - PROBABLY functions for widgets, live panel, menu, etc. Must try to disable this idiot "live panel" - widget first desktop. After editing some functions, widgets don't start.

SplashUi.so - library which load applications splashes and display them.

EDIT: maybe create new thread?
[Bada Software and Hacking General] b.kubica:
its good but its not present in all fws ;)

as I said i need to find better pattern or change way how patching is done (external tool/TriX)

until then you can stay with current method ;)

@all,

less then one week and we have real so patches, kewl

another research. ShpWindow.so has table called (also hardcoded in apps!) rIDNamesTable.

It's useful when we want to localize some code related to some text displayed on the screen.

When I want to localize string, for example from Navigation.rsr:

445 IDS_LBS_POP_ACTIVATION_REQUIRED_CONTINUE_Q ~<Activation required. Continue?>~

I know string ID now i need to know file id:

rIDNamesTable:
<0x000000, aSystem> ; "System"
<0x1F0000, aAdmin> ; "Admin"
<0x020000, aBluetoothapp> ; "BluetoothApp"
<0x030000, aBrowser> ; "Browser"
<0x220000, aBookmarkviewer> ; "BookmarkViewer"
<0x050000, aCallrecords> ; "CallRecords"
<0x060000, aCamera> ; "Camera"
<0x080000, aContact> ; "Contact"
<0x090000, aExtras> ; "Extras"
<0x0A0000, aFileviewer> ; "FileViewer"
<0x0C0000, aKjava> ; "KJava"
<0x0D0000, aKjavaexplorer> ; "KJavaExplorer"
<0x0E0000, aSetting> ; "Setting"
<0x100000, aMediaexplorer> ; "MediaExplorer"
<0x110000, aMediaplayer> ; "MediaPlayer"
<0x120000, aMessenger> ; "Messenger"
<0x130000, aOrganizer> ; "Organizer"
<0x140000, aPshidle_3> ; "PshIdle"
<0x170000, aSat> ; "Sat"
<0x190000, aVideocall> ; "VideoCall"
<0x1A0000, aVoicecall> ; "VoiceCall"
<0x1B0000, aVoicememo> ; "VoiceMemo"
<0x1C0000, aWssyncml> ; "WsSyncml"
<0x200000, aApptimer> ; "AppTimer"
<0x210000, aCallcommon> ; "CallCommon"
<0x300000, aFmradio> ; "FMRadio"
<0x320000, aMusicrecognize> ; "MusicRecognizer"
<0x2D0000, aSettingclock> ; "SettingClock"
<0x340000, aImageviewer> ; "ImageViewer"
<0x450000, aPhotocontact> ; "PhotoContact"
<0x3D0000, aPshhelp> ; "PshHelp"
<0x3F0000, aDlna> ; "Dlna"
<0x410000, aWidget> ; "Widget"
<0x420000, aWlan> ; "Wlan"
<0x480000, aMyblog> ; "MyBlog"
<0x550000, aLbsapp> ; "LbsApp"
<0x560000, aNavigation> ; "Navigation"
<0x540000, aZoomviewer> ; "ZoomViewer"
<0x580000, aMediabrowser> ; "MediaBrowser"
<0x640000, aMobileap> ; "MobileAP"
<0x590000, aVoicecommand> ; "VoiceCommand"
<0x600000, aSmartsearch> ; "SmartSearch"
<0x620000, aMyaccounts> ; "MyAccounts"
<0x630000, aWidget> ; "Widget"
<0x670000, aQuickpanel> ; "QuickPanel"
<0x690000, aWinsetchnvoc> ; "WinSetChnVoc"
<0x710000, aMeastring> ; "MeaString"
<0x720000, aSeacommon> ; "SEACommon"
<0x730000, aIsraelstring> ; "IsraelString"
<0x880000, aAnycallservice> ; "AnycallServiceCenter"
<0x890000, aTdmb> ; "TDMB"
<0x8A0000, aTservice> ; "TService"
<0x8B0000, aPshsimstringko> ; "PshSIMStringKorea"
<0x8C0000, aPhoneunlock> ; "PhoneUnlock"
<0x940000, aKorcommon> ; "KorCommon"
<0x960000, aKieswifi> ; "KiesWifi"
<0x970000, aSocialhub> ; "SocialHub"
<0x980000, aHsapp> ; "HsApp"
<0x990000, aVpn> ; "VPN"
<0xFFFFFFFF, byte_26A36E> ; NULL

navigation has id 0x560000

0x560000 + 445 = 0x5601BD

and code in Navigation.so is:

.text:00017BD0 LDR R0, =0x5601BD
.text:00017BD2 BLX RsrcLoadString

:)
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=26058981&postcount=21

Short played again with OAP... and because I thought, maybe we could also reactivate *.SWF file support.

MediaExplorer.so is only 20 KB compressed. :D

Can't decompress... seems other Format... :o

Now I will move to XXLA1 or maybe I'll play with KK5...

As for XPKG5 I am at the moment to blind to find positon to disable *.so check... :o

Best Regards
[Bada Software and Hacking General] tereshenkov:
Sorry it is possible to repeat, all the same as the right to edit .so files?
[Bada Software and Hacking General] b.kubica:
S8500XPKG5 - 02 28 3D D0 06 28 ;)

and specially for that nice firmware gce2elf update (support Qram 2.2.151)

br
[Bada Software and Hacking General] adfree:
:o

Please, can someone check gce2elf.97.AD.B4.zip with XPKG5 for me.

All files are only 0 content... :confused:

XPKG5 S8500
[Plugin] - ARMulate - [STILL LOADED] - [OK]
----------------------------------------------------

Decompressing MediaExplorer.so ( Qram version 2.2.151 )...OK (29544 bytes)

----------------------------------------------------

XXLA1 S8500
[Plugin] - ARMulate - [STILL LOADED] - [OK]
----------------------------------------------------

Decompressing MediaExplorer.so ( Qram version 2.2.180 )...OK (722896 bytes)

----------------------------------------------------

S8600 XXLD1
[Plugin] - ARMulate - [STILL LOADED] - [OK]
----------------------------------------------------

Decompressing MediaExplorer.so ( Qram version 2.2.173 )...OK (62508 bytes)

----------------------------------------------------

All other files with same Plugin work. :cool:

Thanx.

Btw...

Why MediaExplorer.so in S8500 XXL++ is so huge... more then 400 KB :confused:

In S8600 ... and in bada SDK or in XPKG5 around 20 KB ... :eek: :confused:

@ cybekteam

Any progress about MediaExplorer.so or you have modified other *.so files... :confused:

Thank you.

Best Regards
[Bada Software and Hacking General] Bapps:
Sorry if this is a bit of a new question for this thread, but I searched as requested and this is the closest I could find. What I was trying to do was change the s8500 bada 2.0 camera.so file with the KK5 one for front camera. Didn't want to flash so tried using Stune, but phone just reboots with the original file each time I try to copy mod file, and now reading this thread I know why. So I do have a couple of questions.

First I saw the mod FMRadio.so file which I would also like to install, and am wondering what is the signature I should insert in the GeneralSoInfo.so.sig for it to work, or does it work anyway if I have the LA1 or LA2 firmaware.

What I'm less certain about is how to go about modifying the apps_compressed.bin so that I can disable the security check. I assume there is no way of doing this with Stune (please lte me know if there is) and would need to do so before flashing instead, but would need a bit more details (sorry if I missed a link) just how to go about it as I am a noon after all :).

Also if I do so, would I then be able to use Stune and replace the *.so files without flasing or modifying the sig file as well? I ask this because while I intend to mess around with flahing a bit now, I would like to simply be able to pick future mod files to instal without reflashing for minor changes obv.

Finally, anyone actually know why samsung disabled the front facing camera again after having it enabled in the intial bada 2.0 relrease. Seems like a real wierd move given it's one of the most common firmware mods (which intially brought me here), and also if there is any way to get back the contious (sequance) shooting mode that was in bada 1.2?
[Bada Software and Hacking General] b.kubica:
1. @Bapps,

stune won't work with that

2. I fixed gce2elf script - thanks adfree for pointing this out (I uploaded wrong code ;)

should be ok now :)

regards,

Bartek
[Bada Software and Hacking General] Bapps:
A bit confused... know it won't work now, and have to edit apps_.bin unless someone can upload a hacked one (for s8500 LA1 please :). But after that isn't the point to be able to replace files (relatively) at will without any security check reseting phone, so shouldn't I be able to replace *.so files with Stunes if I flash the modified apps file?

Can you please tell me more precisely what you did, cause as you can see from above I'm still somewhat confused. Perhaps if it's possible to make a post like you did for the Polaris Office helping people with a link to each file and the necessary steps would be welcomed by a lot of other people as well.

Would love to get rid of the operator name, but will this work on the LA1 open europe firmware? I though that was the idea, and without even altering the signature in the GeneralSoInfo.so.sig file, but rereading some of the posts makes me think I may be more confused that I initially though.

Sorry to bother all of you with such noob questions, but I hope to learn more soon enough and hopefully this will help other looking for similar aswers :D.
[Bada Software and Hacking General] larioteo:
I would need all informations form MemStatus.so and Dolfin.so.

TaskManager.so would also be interesting.

Is there any so with AppManager? It is possible to launch every App with LaunchApplication(AppID) when we can get ids than an custom Launcher maybe also would be possible.
[Bada Software and Hacking General] mylove90:
We need to analyze these files

Here is a link to decompressed files (ELF Libraries)from DXLD1 : http://dl.dropbox.com/u/12819503/Browser%2C%20RAM%20%26%20AppMgr%20Related%20Stuff.rar

Please Any help would be really appreciated

Best Regards
[Bada Software and Hacking General] b.kubica:
hi,

some files

unsec_apps_S8600XXLC3.zip.html

FMRadio S8600XXLC3

unsec_apps_S8500XXLA1.zip.html - fixed with new method :)

FMRadio S8500XXLA1

QuickPanelApp S8500XXLA1 - no operator name

unsec_apps_S8500ZCLB4.zip.html

FMRadio S8500ZCLB4

As you know first you need to flash fixed apps to phone. Then your phone is unlocked :)

Now you have to upload some modified files to phone. You can't replace so files with stunes because they're stored in SystemFS folder - read only from stune

we can of course modify some *.so files to fix that permanently (access via mass storage would be nice) but now one did that

For now the easiest way to test *.so files is to create small PFS file and upload it via multi loader. If files are corrupted you can restore original with corresponding pfs
[Bada Software and Hacking General] Bapps:
Thanks, really appreciate your help... so I'll ask for some more :D. Did a search but did not find a link as to how to make my own pfs files so couled you please point me to some instructions.

Now I also have a couple of other quick questions for you (or anyone else) regarding flashing these files. I assume I can just load the modified apps.bin file and then insert the radio and pannel mods by decompiling and reconpiling the SHPAPP file in wave remaker and do a single flash for everything. And can I now also do the same with the KK5 camera.so without modifying the GSI.so.sig file?

As far as I can tell that should work but I am a noob and don't want to brick my phone right away... though if I understand the process trying this wouldn't actually brick it anyway right? I only ask because I see you linked different files for different firmwares for the same phone, which I imagine might be because of regional differences in radio bands, but mods from different firmwares in same region should be interchangable...

Edit:

Really don't know if this is the appropriate place, but the differences in frequencies made me think of the people in north america that flashed with EU firmware, and had the (useless) EU 3G bands while losing the north american ones. Does anyone know of any such phone then worked properly in the EU, because if so it would be quite an interesting mod to try and implement quad band support for the phone, and I think it may be possible because if I'm not mistake the australian version actually uses a mix 850/2100 so it could well be the phone is capable of reciving all spectrums with the limit coming from firmware. I appolagize If I haven derailed this topic, and regardless can someone please tell me the appropriate place to ask for specific mods and/or apps (I would really like BTmono/audio for bada)...
[Bada Software and Hacking General] adfree:
@ b.kubica

Thank you.

Now XPKG5 *.so files work. :cool:

gce2elf.97.AD.B4_fixed.zip

I have now time to test few things and report later...

Best Regards
[Bada Software and Hacking General] cybekteam:
Unfortunately no progress. I won't have free time until Tuesday, so I can't modify any files. I will return to it after Tuesday, be careful :)
[Bada Software and Hacking General] poubapub:
gce2elf

Hello,

I'm sorry to arrive here with a real noob question:

I'm fighting with trix since 2 hours, and can't get gce2elf.97.AD.B4_fixed to work on FMradio.so of my Wave 2.

Where can I find the trix plug-in I should use to decompress *.so files on a Wave 2 ?

Could you provide a small tutorial explaining the steps ?

Thank you in advance
[Bada Software and Hacking General] b.kubica:
load script only, no input/output file. Then hit Start and type path to folder with *.so files you want to process. Thats all
[Bada Software and Hacking General] hero355:
:confused::confused:

[Script] 'D:/gce2elf.97.AD.B4_fixed/gce2elf.trx'
Script is not signed correctly.
[Plugin] - ARMada - [STILL LOADED] - [OK]

Edit : My Fault.Reserved
[Bada Software and Hacking General] b.kubica:
DisableSoIntegrity

hi,

new TriX script has arrive ;)

Still I don't have my hdd back including new TriX sources with decrypt/encrypt/decompress support so we need external tool to patch apps.

Prepare 2 files with Wave Remaker - decrypted files and second decompressed one.

Select decrypted as input file, select output file and load script to TriX

Hit Start button and script will ask you for decompressed apps - type path to it

He need that to find CheckSoIntegrity address. After that he decompress appropriate QMD chunk and change some bytes.

After that whole apps QMD image is rebuilt (nearly half of image) and file is saved. Encrypt it and sign with Wave Remaker and CheckSoIntegrity is off :)

no more hex patching needed and debug level mid or high says everything is ok ;)
[Bada Software and Hacking General] poubapub:
Many Thanks !!
[Bada Software and Hacking General] b.kubica:
change 1 byte in Navigation and debug is ON :)

in fact some Debug.txt file should be placed in SamsungLBS directory and log will be on but easier for me was hack the code ;)

in LbsSvc

4F F0 01 09 4F F0 00 09 28 A8 C8 F3 BC EC B9 F1 change to 01
[Bada Software and Hacking General] hero355:
Where and which file must be edited ?

Edit : Thanks ;)
[Bada Software and Hacking General] b.kubica:
sorry, I forgot to write it. Check the previous post ;)

fixed pattern (should works on most devices)

59 40 58 40 08 43 14 BF 4F F0 01 09 4F F0 00 09
[Bada Software and Hacking General] hero355:
Now it works ;) Thanks :)
[Bada Software and Hacking General] b.kubica:
ok, I was to lazy to test the right way to enable gps log/debug

No *.so modification needed :)

create 2 files: Debug.txt to enable Trace.html debug log and TrackGPS.txt to enable advanced gps logging via GpsLog_...txt files

make that files non zero length (write something ;) and copy to <card>/SamsungLBS directory.

Logs will show in the same dir

br
[Bada Software and Hacking General] b.kubica:
change calculator default giCalcSetTrigonometric

after I realized built in calc operate on degrees instead of radians it was too much for me.

That version works on radians by default - sine pi is 0 again :D

br,

Bartek
[Bada Software and Hacking General] b.kubica:
gce2elf v0.31

hi,

small update to gce2elf script. I fixed small bug, now all *.so libraries are processed (some of them like*.so.1 etc. was omitted)

2nd thing - as parameter put SystemFS directory path - from ShpApp of course ;)

Shp and Osp subdirs will be parsed automatically

br,

Bartek
[Bada Software and Hacking General] josephpatrick:
decompressing .so file

When I use trix 1.2 and the script "gcve2elf" i get the following error.

[Plugin] - ARMada - [STILL LOADED] - [OK]

[TriX] Error during compilation:

gce2elf.trx v0.31(1123) Error :Unable to include internal `trix_armulate'

In line:

Any ideas?
[Bada Software and Hacking General] b.kubica:
how did you load ARMada plugin? ...

more info please - which script did you load

and what the hell is trix 1.2?
[Bada Software and Hacking General] hero355:
:D :D :D
[Bada Software and Hacking General] b.kubica:
RadioWithoutEarphones_v0.10

hi,

i prepared small script which patch FmRadio from any firmware we want

Select decompressed FmRadio file as input, then select output file and run script. That's all :)

later I will upload other scripts - for QuickPanel etc.
[Bada Software and Hacking General] pawlakpl:
QuickPanel with Data On/Off option ? :)
[Bada Software and Hacking General] b.kubica:
only removing operator name

i'm not interested in data on/off button - i have fixed plan and don't need to worry about the costs ;)

for now is to much work to do that and i working on something else now

br

ps. sorry for grammar/spelling but im writing with one hand now ;)
[Bada Software and Hacking General] hero355:
Man Please don't stop your work about packet/data button :(
[Bada Software and Hacking General] b.kubica:
3 scripts

CalcSetTrigonometricRadians - set radians by default in Calculator (Extras.so)

EndlessAlarm - don't stop alarm after 1 minute (thanks for cybekteam for idea and working solution)

RemoveOperatorName - remove operator name ;) (again, thanks for cybekteam for idea and working solution)

br,

Bartek
[Bada Software and Hacking General] josephpatrick:
I get the following error for wave 5750 fmradio.so. Am I doing something wrong?

[ifile #0: C:/TriXcomplete1_2/FMRadio.rbm ]

----------------------------------------------------

File type not supported!

Returncode: -1

----------------------------------------------------

[ofile #0: C:/TriXcomplete1_2/FMRadio-mod.rbm ]
[Bada Software and Hacking General] josephpatrick:
I presume I first need to de-compress the original fmradio.so file but I am unable to do that with Trix.
[Bada Software and Hacking General] b.kubica:
try to work on executable files(*.so) not graphic files(*.rbm)

2nd thing, im not sure gce2elf support wave 5750, I need to check it first

but the script ought to show the message with useful infos too
[Bada Software and Hacking General] b.kubica:
I tested - wave 5750 has Quram version 0xAD which is supported by script. I was able to decompress all *.so libs also so i don't know what are you doing wrong

where did you find TriX package?

which version of gce2elf are you using?

more info, please
[Bada Software and Hacking General] b.kubica:
DisableBadaIntegrity v0.20

another example how to decompress apps to work on device

That script is successor of DisableSoIntegrity - it bypass more functions

CheckSoIntegrity

CheckPreloadedAppIntegrity

CheckExPreloadedAppIntegrity

CheckAppSecurity

CheckAppIntegrity

after flashing patched apps, we could for example modify samsung apps/BDAgent and other builtin apps.

btw, it is NOT another sp**fing method! It's illegal.

I just want to have more opportunity to control files on my devices ;)

best regards,

Bartek

PS. for example we can bypass deleting temporary *.oap package from DownloadedAppPackages :)
[Bada Software and Hacking General] josephpatrick:
Thank you testing for 5750. If it works for you, then i am definitely doing something wrong. Firstly I was playing around with fmradio.rbm instead of fmradio.so. Thank you for the correction. I don't know the version of Trix I got it from some forumand is named "TriXcomplete1_2". The version of gce2elf script is 0.31 as per post 109.

http://xdaforums.com/showpost.php?p=26812734&postcount=109

The steps I am following are as follows:

1) in Trix, selecting "fmradio.so" as input file and output file as "fmradio-mod.so"

2) under script, browse and add (gce2elf) script which was placed inside 'scripts\bada' folder

3) click on start and that is when I get the below error :(

[ifile #0: C:/Pat/Desktop Dump/Samsung/TriXcomplete1_2/FMRadio.so ]

[Plugin] - ARMada - [STILL LOADED] - [OK]

[TriX] Error during compilation:

gce2elf.trx v0.31(1123) Error :Unable to include internal `trix_armulate'

In line:

[ofile #0: C:/Pat/Desktop Dump/Samsung/TriXcomplete1_2/FMRadio_mod.so ]
[Bada Software and Hacking General] b.kubica:
download TriX from link in my signature. To use gce2elf you do not need to select input/output files - that script works in other way

Run script and when he asks about SystemFS path, put it in edit dialog at the bottom and press enter - that's all
[Bada Software and Hacking General] hero355:
@josephpatrick This also were to me.

1.Delete Trix

2.Download again Here : http://nokix.sourceforge.net/trix/

3.Try again to decompress radio.so

4.All using by Trix Must be English i tested it myself

@b.kubica

Can I ask How to use this script

Edit Found...But...
[Bada Software and Hacking General] josephpatrick:
Trix

Please ignore my earlier comment which I edited and removed. Progressing further.
[Bada Software and Hacking General] b.kubica:
no, it means script didn't find files in Shp and Osp subfloders. Wrong path?

hero355, output looks fine. And no, no install option. To install ap you need valid package for now (using broker etc). That script doesn't bypass signature/manifest checking for now. After app is installed it allowed you to modify app binaries (/Bin/*exe), for example to fix a bug ;)
[Bada Software and Hacking General] hero355:
F**K yeah Thank you very much it worked Now I installed For example one game

Thank you very much for your great work :)