yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] adfree:
Stupid clicking around...

:eek: :confused:

signing <private-key> <passwd> <output-file> <input-file>+

GenCert.exe [options] <infile >outfi
le
where options are
-gen_root create root CA privatekey and certificate.
-csr a request file.
-casign a x509 structure root CA-signed cert.
-sign a x509 structure CA-signed cert.
-selfsign a x509 structure self-signed cert.
-keyin outkey imported private key file
-keyout outkey file to send the private key to
-passwordin pw a password for importing Private Key.
-passwordout pw a password to generate private key.
-subject dn set or modify request subject
-issuer dn set issuer name
-set_serial sn serial number to use for a certificate
-days number of days a certificate.
-file outfile output file
useage
1) Create a CSR file & a prikey.
gen_cert -csr -keyfile prkey.pem -password 1111 -subject /C=KR/O=Samsung/OU=MS
C/CN=Fasoo -file out.csr
2) Create a Self-signed Certificate file & a private key.
gen_cert -selfsign -keyfile prkey.pem -password 2222 -subject /C=KR/O=Samsung/
OU=MSC/CN=Fasoo -file out.cer
3) Create a Root CA Certificate file & a Root CA private key.
gen_cert -gen_root -passwordout 3333 -subject /C=KR/O=Samsung/OU=MSC/CN=Samsun
gCA
4) Create a CA Certificate file and a private key.
gen_cert -casign -passwordin 3333 -passwordout 4444 -issuer /C=KR/O=Samsung/OU
=MSC/CN=SamsungCA -subject /C=KR/O=Samsung/OU=MSC/CN=CA
5) Create a Certificate file and a private key.
gen_cert -sign -passwordin 4444 -passwordout 5555 -issuer /C=KR/O=Samsung/OU=M
SC/CN=CA -subject /C=KR/O=Samsung/OU=MSC/CN=[B]Fasoo[/B] -keyout prikey.pem -file fasoo
.cer

Fasoo I can remember this...

GT-S8500_SVCM_final_Anyservice_100429.pdf

GT-S8500_SVCM_final_Anyservice_100707.pdf

GT-S8530_SVCM_final_Anyservice_101111.pdf

:( :o

But maybe for pem... maybe conf.ini helpfull...

Best Regards
[Bada Software and Hacking General] adfree:
Little progress...

I can sign now my own exe...

Best Regards
[Bada Software and Hacking General] adfree:
:confused:

Maybe first success or only luck...

Signed "self" MiniDiary and installed on my poor XXJL2...

MiniDiary starts... :)

Need few more tests... and later will try on bada 2... :D

Best Regards
[Bada Software and Hacking General] adfree:
Today I have not much time yet...

Maybe tomo...

Package include only Binary (exe) from MiniDiary...

You have to add files/folder from jnh2vwwny6...

Taken from XXJL2 Firmware and installed on my naked Test FW:

http://xdaforums.com/showpost.php?p=22372474&postcount=210

NOT tested with other Apps.

NOT tested if bada 2 can handle this...

Signing seems easy... by replace *.exe before press "Make package" in SDK...

manifest.xml + application.xml ... not tested complete... maybe little bit harder...

I have used SDK 1.0.0b3...

Best Regards
[Bada Software and Hacking General] adfree:
:confused:

Taken from FactoryFs_M210S_Korea_SKT bada 2...

Best Regards
[Bada Software and Hacking General] hero355:
in Korean And Chines Fw 's So Different ours :(
[Bada Software and Hacking General] adfree:
Little progress...

I had heavy problems under XP to replace *.exe in folders:

.Target-Debug

.Target-Release

But under Win 7 I have access to *.exe for replace... :)

Best Regards
[Bada Software and Hacking General] adfree:
Little tiny step forward...

I am back on S8500XPKG5...

This seems only Firmware at the moment... where you can install oap from handset... Dev signed apps...

After install Cert rootCACert.cer I can install Sample App...

http://xdaforums.com/showthread.php?t=1482885

For internal Apps (Samsung signed Apps from Firmware) for instance...

I get again Error 0108...

So Certs are missing...

BUT Samsung_RootCA.crt nor SamsungSBRootCA.cer are not installable again... Wave shows infos instead...

I have tried to rename files... but no...

BUT with stupid simple Trick... :rolleyes:

I can force Wave to install those Certs "again"...

No luck with other Apps, but I have more ideas... :D

I saw also these Codes for Certs...

Or

:D

Number shows me 2...

Now I will see what I can find out...

Best Regards
[Bada Software and Hacking General] adfree:
Okay, for XPKG5 I have managed 1 goal with 3 unmodified Certs... :D

http://xdaforums.com/showpost.php?p=24913373&postcount=9

Maybe now I can understand, where I have to insert rootCACert.cer.

To install Samples in Firmware files... or to remove funny 1 App Limitation...

Best Regards

P.S.:

I think in 3 days or maybe earlier I could upload "Example" for Education.
[Bada Software and Hacking General] adfree:
:) :D :cool:

I know now how to install all kind of signed Apps...

This is so stupid easy... :o

Tested now on XXLC1...

Not all details, but in generall...

1.

Install 3 Certs...

Hint... Certs named in this Thread... :p

2.

If Shp_Feature blabla... then easy copy complete folder via Explorer

3.

Now you have to send Command to init Database... :D

Best Regards
[Bada Software and Hacking General] hero355:
Woww Great Work :) Waiting Your Elaborated Method :)
[Bada Software and Hacking General] adfree:
Maybe deeper info...

1.

Install 3 Certs from SD Card for instance... I've created folder:

Others/Cert

Insert files and click them... :)

SamsungSBRootCA.cer
Samsung_RootCA.crt
rootCACert.cer

2.

Copy app as folder to correct path...

REMEMBER...

NO DCF files...

3.

AppPkgInstall /Osp/Applications/b2m6s542q9

b2m6s542q9 is for instance app ID/folder name...

No more infos...

If no luck, not my fault...

Best Regards
[Bada Software and Hacking General] hero355:
I don't have Cert files.Can you give me it or where i can download or extract ?
[Bada Software and Hacking General] adfree:
Please Caution!

At the moment not 100 % tested... as install also check such things like Precondition etc...

Maybe few more Commands necessary to install more then 1 app...

Only for Educational Purposes... ;)

Best Regards

Edit 1.

At the moment it seems Limitation like samples with rootCACert.cer...

Only 1 ...

Anyway. For me it is an step forward. :D
[Bada Software and Hacking General] mylove90:
Yes that limit is still in there :D

But it is really a huge step forward :)

Thank you and keep the good work :)

Best Regards
[Bada Software and Hacking General] adfree:
In XPKG5

Security\WRTCerts

WAC Application Services Ltd TEST.cer
WAC Application Services Ltd.cer

No idea... I'm not using Widgets...

But maybe more interesting Certs floating around... I saw some new Certs in new S8600 Firmware ...

At the moment I have no idea where Certs are stored in new Firmwares... as Security folder in FFS is empty... :confused:

Best Regards
[Bada Software and Hacking General] adfree:
XPKG5 seems really interesting (for me) for research... :cool:

In this Firmware it is possible to remove all Apps from OSP folder... :cool:

In other Firmware ever 1 App is mandatory... otherwise Wave not start...

Now I have clean OSP folder... So Cert RSA1024 SamsungSBRootCA.cer should be "obsolete" ready to kick off... :)

But now I'm facing same problem like in newer Firmware...

Where are SamsungSBRootCA.cer and Samsung_RootCA.crt now stored? :confused:

In FFS I have removed ALL Certs from Security folder...

Both Certs 2 times installed... See Screenshot...

Now I need to check all Firmwarefiles... maybe in apps_compressed...

I am now closer to play with *.so files... :D

Best Regards
[Bada Software and Hacking General] adfree:
[CAppPkgSvcIntegrityMgr::CheckBinaryHash] exe hash value
-----------------------------------------------------------------------------------

C6 2E F5 B6 13 82 E2 37 56 AB FC 96 C9 A2 16 2F 79 F9 5E 99 .......7V....../y.^.
-----------------------------------------------------------------------------------

[CAppPkgSvcIntegrityMgr::CheckSoIntegrity] success for (/SystemFS/Osp/WidgetAppControl.so)
------------------------- SO INTEGRITY -------------------------
[__AppPkgSvcStartSoIntegrity] 'so' checking ok !!!!
------------------------- SO INTEGRITY -------------------------

Looks like SHA1...

Taken from BOJE7 ... old bada 1.

Maybe later I can identify body which is signed...

----------------------------------------------------------------------

Now I am back on bada 1...

Found S8500XXJEB... :cool:

Here it is possible to remove all Apps from OSP and I hope I can make now more progress with *.so files...

Best Regards
[Bada Software and Hacking General] adfree:
Security/OSPCritical2Certs

And only 1 Cert left. :p

The RSA1024 Cert is the only mandatory Cert in XXJEB for *.so files:

SamsungSBRootCA.cer

Now I have an Base for Research deeper... :D

Best Regards
[Bada Software and Hacking General] adfree:
:)

Nice PC Program available... somewhere...

To sign apps self with rootCACert.cer, better with Private Key in rootCAPriKey.pem

Funny, it seems only Signature.xml is mandatory... ;)

So theory...

If Limitation is 1 app each Cert... :D

The Question is, how many Certs you can use... ;)

If not able to create own Cert... then check again:

http://xdaforums.com/showpost.php?p=22338490&postcount=9

:) :D ;)

Not tested deeper...

I'll concentrate now more on *.so files...

Best Regards
[Bada Software and Hacking General] adfree:
Btw... self signing...

Maybe this increase chance to modify *.exe of Apps... :)

Not tested yet...

Maybe later...

Best Regards
[Bada Software and Hacking General] adfree:
Back to *.so files...

XXJEB (bada 1)

[CAppPkgSvcIntegrityMgr::CheckBinaryHash] hashTableEntry value.
-----------------------------------------------------------------------------------
CC 5F FC D0 B1 AD C7 5A CD DB 0A 38 AF 1F 4F 05 F1 57 0C 0C ._.....Z...8..O..W..
-----------------------------------------------------------------------------------
[CAppPkgSvcIntegrityMgr::CheckBinaryHash] exe hash value.
-----------------------------------------------------------------------------------
CC 5F FC D0 B1 AD C7 5A CD DB 0A 38 AF 1F 4F 05 F1 57 0C 0C ._.....Z...8..O..W..
-----------------------------------------------------------------------------------
[CAppPkgSvcIntegrityMgr::CheckSoIntegrity] success for (/SystemFS/Osp/AppControl.so).

AppControl.so from XXJEB is attached...

Please help to find out, what is signed...

SHA1 for COMPLETE file:

494089BB0C4449C1ED61A20E9C20FC6BBABE313C

Without Header ELF ... 4 Byte:

4BDB4CD88876F9ECF4153C26954DE8A88BA573AC

:confused:

Best Regards
[Bada Software and Hacking General] adfree:
Oh...

key.pem in XadaXppsXignature.exe is badaDevPriKey.pem

Not rootCAPriKey.pem

Sorry, my fault.

Best Regards
[Bada Software and Hacking General] mijoma:
The log shows checking the integrity of the file by comparing to htb file.

The file with htb extension is a hashtable. After the header it has entries of hashes for 4kB chunks of the checked file.

The quoted hash is the SHA-1 digest for first 4096 bytes of the file.

Best Regards,

mijoma
[Bada Software and Hacking General] adfree:
@ mijoma

Thank you very much.

This is very helpfull.

Best Regards
[Bada Software and Hacking General] adfree:
:D

On XXJEB it is easy to modify *.so...

Simple after 4 KB... :D

But I want check out, if I could replace also last Cert...

I need few more steps...

Now I'll check *.htb files :o

To create new Fake Cert with Private Key should be no big problem...

But to rebuild sig and htb files... :eek:

Anyway...

We have some progress. :cool:

Thanx.

Best Regards

Edit 1.

First test with *.htb failed... so it seems this file is also mandatory in XXJEB... :o
[Bada Software and Hacking General] adfree:
Clicking around...

If I enter:

gencert -gen_root -passwordout 3333 -subject /C=KR/O=1amxung/OU=MSC/CN=2amxungCA

Output is:

I got new rootCAPriKey.pem and rootCACert.cer

------------------------------------------------------------------

Will test the other examples...

Examples are not 100 % for copy and paste...

gen_cert

Best Regards
[Bada Software and Hacking General] adfree:
Its long long time ago...

I have many things forgotten... :o

gencert -gen_root -passwordout 3333 -subject /C=KR/O=1234567890123456789/OU=12345678901234567890123456789/CN=123456789012345678

:D

Then convert into DER... result is something... like SamsungSBRootCA.cer... :D

In size and position...

You can see Signature... Public Key... if you compare...

128 Byte because it is RSA 1024...

128 Byte Signature and 128 Byte Private Key...

Later I will write more...

Need to find my memories about openssl and "body to sign" etc...

Last time I did this for Brew... 2008... :eek:

Best Regards
[Bada Software and Hacking General] adfree:
SHA1 from "body to be signed"... Theory.

30635187C601B11CB9B18F56295CCCFE367F472D

Public Key (128 Byte (RSA 1024))

B9B2A7E9B7980EF1E37269B0AC7EA1BBBDC21A826523D452CDECFACC6B7B38DBBB215096D0FAD1853C5E2171F1A6B6B5A29C0C4D92DAFD8D6EAD6B0599135E2CCBF01EEC7206936FCB0E01100AE6D899CA273A22E168E10F856B34E99D9FF
1768BF077C4F60E4F348552E61363F79FA121BFCDF90508BF8002AB7EAF1E022B49

Signature (128 Byte (RSA 1024))

1E8015BC1E77542486EEBFE4AFC2177A06672557A4EF5D0A2B5D9211FF60CD5993924A99B601EE0BE373358FE976FF38AEE89423554F35F1A92735FEA0EB50247CA10F08534093DB4DC4F7C854AABE66DBFECC9B91951909A55A286956BDE
60C082752783DECC15777E16809D5A1144754664D63297B9B8750A8FAE5DE0F84C6

Now I can decrypt with Public Key the Signature and check if my SHA1 is Bull... :)

Best Regards
[Bada Software and Hacking General] adfree:
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF003021300906052B0E03021A05000414[B]30635187C601B11CB9B18F56295CCCFE367F472D[/B]

Forgotten... Exponent is HEX:

010001

;)

Now I can replace Public Key and Signature by simple sign/encrypt SHA1 Value:

30635187C601B11CB9B18F56295CCCFE367F472D

Then I have an valid Fake Cert... + Private Key... to play with *.so files in XXJEB...

For study... :cool:

No idea if this Cert is secured by other things... or I can really replace it with my Fake Cert...

But now I can try. :D

Best Regards
[Bada Software and Hacking General] matheo1010:
Hello,

I am very interested in this subject (although I did not understand everything) and I wanted to know what software you use to encrypt / decrypt the RSA?

Thank you (sorry for the mistakes of writing I am French)
[Bada Software and Hacking General] hero355:
Let's i think.If it works.In this case we can use Example wave 3 Desk clock ? yeah ?
[Bada Software and Hacking General] Rebellos:
Are you able to replace .so files without violating SHP integrity check already? If yes - you can probably also add new .so libraries, code of these is executed with "root" access which let you to do anything with bada kernel in them.
[Bada Software and Hacking General] adfree:
@ matheo1010

http://psas.revskills.de/

@ Rebellos

You saw this?

http://xdaforums.com/showpost.php?p=25314141&postcount=17

Need more time for research about *.so...

My brain is very small. :o

Only idea is...

Maybe someone could now write Filemanager with full access like sTune, but on S8500... :D

I will check if maybe chance to make some other folders visible... with "my files" app... not sure yet if *.so included...

Best Regards
[Bada Software and Hacking General] adfree:
http://bogpeople.com/networking/CertDecoder/

Base64 :D

Now I can read more...

For instance from Signature.xml or AppControl.so.sig

Best Regards
[Bada Software and Hacking General] adfree:
Aha... more Certs... :cool:

You can "create" Certs, simple by cut them and add correct header and end of file...

So again they are attached/included...

:D

Best Regards
[Bada Software and Hacking General] adfree:
Apps with *.exe ...

"Type A" (bada 2)

Apps from Firmware (Kona.exe) for instance contain 2 Certs in Signature.xml:

1. ([B]RSA 2048[/B]) - Samsung bada SB Signer
2. ([B]RSA 2048[/B]) - Samsung bada SB CA

After Install you can find first Cert as signerCert.sys.cer in Info folder...

"Type B" (bada 1 and 2)

Apps from bada SDK or self signed.

2 Certs in Signature.xml:

1. (RSA 1024) - bada developers
2. (RSA 1024) - Samsung bada Certificate Authority

"Type C" (bada ?)

Apps from Store :D

2 Certs in Signature.xml:

1. (RSA 1024) - bada developers
2. ([B]RSA 2048[/B]) - Samsung Certificate Authority

"Type D"

*.so ... from XXJEB bada 1.x

2 Certs in AppControl.so.sig:

1. (RSA 1024) - bada SB Signer
2. (RSA 1024) - Samsung bada SB Certificate Authority

... later I will write more... :)

Best Regards
[Bada Software and Hacking General] adfree:
Chain from bada SDK... all Private Keys we have :D :rolleyes:

Samsung Test Root CA--->Samsung bada Certificate Authority--->bada developers

Filenames in SDK...

rootCACert.cer--->badaCA.cer--->badaDev.cer

All 3 are RSA 1024...

! :confused:

No idea, why this warning message...

Best Regards
[Bada Software and Hacking General] matheo1010:
Hello, and thank you for your work.

Would it be possible to have a small tutorial that would explain how to generate a new certificate rootCACert.cer with a new key?

Thank you. ;)
[Bada Software and Hacking General] adfree:
@ matheo1010

This is all I have now...

http://xdaforums.com/showpost.php?p=25336847&postcount=50

@ all

I have forgotten to check bada Version...

In bada generally more RSA 1024 is used... in bada 2 Samsung increase Security... to RSA 2048...

This is the reason why it is nonsense to increase key bit length if you share Private Key or Fullcert... :rolleyes:

Thanx Sxmsxnx. :cool:

If you move in next bada SDK to RSA 4096 or much much higher... not forget again *.pem files... again.

Also good choice... back to hash check only for 4 KB... its faster. :p

Best Regards
[Bada Software and Hacking General] matheo1010:
Thank you very much for your answers.

Is there a way to create a new BadaDev.cer and a new key badaDevPriKey.pem ?

thank you
[Bada Software and Hacking General] adfree:
In theory yes. But I have no real idea what you expect at the moment...

For me I can only say... My knowledge about Certs is very small.

First and last time I have started in 2006 for BREW handset... this takes looong time for me... to find Certs and Certchain and ...

Then around 4 years nearly nothing... I have all forgotten about openssl and so on... :o

Now for bada ... I am not fast... It is very hard for me. To find Security holes or to understand few things.

So I have started nearly from Scratch... :( :o

Look... bada SDK have since 2 years folder Tools :rolleyes:

With ALL needed Fullcerts for signing at home... with Tools included for creation.

You see how many users support me here in Thread to find basics... :(

Now in bada 2 Samsung has increased little bit few things and moved to RSA 2048.

Also they hide 2 Certs... in Firmware...

I have no idea where they are now... :(

Maybe you try to describe what you want to do...

Maybe then I'll try to investigate more time to support you.

The Question is how many Certs are needed. What is where signed... :confused:

XadaXppsXignature.exe signes with badaDevPriKey.pem...

BUT you need also Public Key from rootCACert.cer

So Samples need 2 Certs in this Chain...

So maybe if you replace 1 public key, so chain failed...

So maybe you need to play with 2 Certs?

My brain is small...

I can not try all things at same time... :(

At the moment is my priority NOT to hack limitation of 1 app for 1 Cert...

Best Regards
[Bada Software and Hacking General] matheo1010:
I understand you and support you in this project.

If it interests you, I just decompiler XadaXppsXignature.exe (it is coding in C#).

I continue my research and I'll keep you posted.

Thank you.
[Bada Software and Hacking General] adfree:
:D

First test... after complete Flash and change modified apps_compressed...

XPKG5 now runs without Certs.

:D

Second test, I will remove all Certs before flashing...

Best Regards
[Bada Software and Hacking General] luongdk:
@adfree

That mean we can completely spoof apps?

Sorry if I've asked a stupid question
[Bada Software and Hacking General] b.kubica:
hmm, i've installed Polaris Office on memory card without any problem.

Not sure it's a big deal but afair i didn't try that before ;)

edit

now Gtalk on sd card too :]

ok, even oap packages from store but with some issues (hmm maybe bad app i choose, for 1.0)
[Bada Software and Hacking General] adfree:
If bada 1.x App, then maybe "other" Certs used.

I saw they increase Security by using RSA 2048 Cert instead RSA 1024...

Best Regards
[Bada Software and Hacking General] b.kubica:
you're were right :D

I tried with navigon and it installed flawlessly ;)

all that tricks without any sp**f tool or the other, of course - apps were instaled using original bada Developers :D
[Samsung Galaxy Nexus] thereddog:
Can this be done?
[Samsung Galaxy Nexus] EP2008:
Can you explain a bit more? The screen remains off until you turn it on.
[Samsung Galaxy Nexus] RogerPodacter:
I noticed this too. Unplug your phone and the screen turns on. Never happened on my previous android phones.
[Samsung Galaxy Nexus] thereddog:
Yep, this is what I'm talking about.

I did the Touchstone mod, and while at work I always grab my phone and go right into my pocket. I'd like to keep the screen off so I don't hit anything on the screen.
[Samsung Galaxy Nexus] EP2008:
Hmmm, this happens on EVERY phone or tablet I've used... Even my iOS devices do this. Same when plugging in... The screen will turn on.
[Samsung Galaxy Nexus] Teqonix:
I've wondered this myself. I'll attempt to make a tasker profile that shuts off the screen after a delay of a second or so after it detects being unplugged from the charger. I'll post if I have any luck with it.
[Samsung Galaxy Nexus] nt1001:
I had a D2G and it would turn the screen on when plugged in, but not when unplugged.
[Samsung Galaxy Nexus] Teqonix:
I've created some tasker profiles that will turn the screen off after a three-second delay when plugged into (or unplugged from) USB or AC power. These rules are ignored when the phone has been unlocked and is currently in use.

I haven't tested them extensively so there could certainly be some bugs, but they've worked for me the past hour or so.
[Samsung Galaxy Nexus] adrynalyne:
Just need a dev to do it.

<!-- If this is true, the screen will come on when you unplug usb/power/whatever. -->

<bool name="config_unplugTurnsOnScreen">false</bool>

frameworks/base/core/res/res/values/config.xml
[Samsung Galaxy Nexus] thereddog:
This interests me more than a Tasker profile....
[Samsung Galaxy Nexus] gravis86:
Could we just do the edit ourselves using something like Root Explorer?
[Samsung Galaxy Nexus] adrynalyne:
No. It is compiled into resource.asrc.
[Samsung Galaxy Nexus] RogerPodacter:
All someone has to do is change that line and recompile that individual package. Easy for anyone already setup to compile and is synced to the repo.

Btw ard is on top of things for posting that so quick. He prob has every line of code memorized!
[Samsung Galaxy Nexus] io53:
I've compiled AOKP with

<!-- If this is true, the screen will come on when you unplug usb/power/whatever. -->

<bool name="config_unplugTurnsOnScreen">false</bool>

I can upload it if anyone is interested