yashsingh1/xdaforums huggingface dataset:
[Asus Transformer TF700] ostar2:
FernFlower Decompiler Uploaded

Hello again, I have uploaded the decompiler in its binary form as well its decompiled and deobfsucated state.

Link: http://xdaforums.com/showthread.php?t=2029842
[Asus Transformer TF700] harpik3d:
I've been a bit short of time, but have analyzed the decompiled s.class and i think the partition used to store the boot parameters is /dev/block/mmcblk0p3 because the modifications there are common for all devices (what seems logical because the structure for the stored parameters in the partition should be the same)

This is the decompiled class, what do you think?:

// Decompiled by DJ v3.12.12.96 Copyright 2011 Atanas Neshkov Date: 07/12/2012 9:09:09
// Home Page: http://members.fortunecity.com/neshkov/dj.html http://www.neshkov.com/dj.html - Check often for new version!
// Decompiler options: packimports(3)

package com.asus.unlock;

import android.content.Context;
import android.os.PowerManager;
import android.util.Log;
import java.io.*;
import java.math.BigInteger;

public class s
{

public s(Context context)
{
e = 500;
o = "";
mContext = context;
}

public static byte[] a(String s1)
{
return (new BigInteger(s1, 16)).toByteArray();
}

private void d(String s1)
{
byte abyte0[];
byte abyte1[];
FileOutputStream fileoutputstream;
int i = 0;
abyte0 = new byte[1088];
abyte1 = a(s1);
byte abyte2[] = new byte[11];
abyte2[0] = 98;
abyte2[1] = 111;
abyte2[2] = 111;
abyte2[3] = 116;
abyte2[4] = 45;
abyte2[5] = 117;
abyte2[6] = 110;
abyte2[7] = 108;
abyte2[8] = 111;
abyte2[9] = 99;
abyte2[10] = 107;
byte abyte3[] = new byte[9];
abyte3[0] = 114;
abyte3[1] = 101;
abyte3[2] = 99;
abyte3[3] = 111;
abyte3[4] = 118;
abyte3[5] = 101;
abyte3[6] = 114;
abyte3[7] = 121;
abyte3[8] = 10;
for(int j = 0; j < abyte2.length; j++)
abyte0[j] = 0;

for(int k = 0; k < abyte2.length; k++)
abyte0[k + 0] = abyte2[k];

for(; i < abyte3.length; i++)
abyte0[i + 64] = abyte3[i];

fileoutputstream = null;
FileOutputStream fileoutputstream1 = new FileOutputStream("/dev/block/mmcblk0p3");
fileoutputstream1.write(abyte0);
fileoutputstream = new FileOutputStream("/dev/block/mmcblk0p4");
fileoutputstream.write(abyte1);
Log.d("UnLockFlagAndReboot", "============= writeRecoveryCmd success =======================");
if(fileoutputstream != null)
fileoutputstream.close();
_L1:
return;
FileNotFoundException filenotfoundexception;
filenotfoundexception;
_L5:
filenotfoundexception.printStackTrace();
if(fileoutputstream != null)
fileoutputstream.close();
goto _L1
IOException ioexception;
ioexception;
_L4:
ioexception.printStackTrace();
if(fileoutputstream != null)
fileoutputstream.close();
goto _L1
Exception exception;
exception;
_L3:
if(fileoutputstream != null)
fileoutputstream.close();
throw exception;
exception;
fileoutputstream = fileoutputstream1;
if(true) goto _L3; else goto _L2
_L2:
ioexception;
fileoutputstream = fileoutputstream1;
goto _L4
filenotfoundexception;
fileoutputstream = fileoutputstream1;
goto _L5
}

public void c(String s1)
{
d(s1);
_L1:
return;
IOException ioexception;
ioexception;
ioexception.printStackTrace();
goto _L1
}

public void reboot()
{
((PowerManager)mContext.getSystemService("power")).reboot(null);
}

private int e;
private Context mContext;
private String o;
}
[Asus Transformer TF700] ostar2:
That seems quite useful, it certainly helps decode the unlock process.
[Asus Transformer TF700] chenxiaolong:
EDIT: Nevermind.
[Asus Transformer TF700] ostar2:
I guess were lucky that ASUS wrote this app in java instead of C/C++. :fingers-crossed:
[Asus Transformer TF700] jupppo:
That fact is known for quite some time. It was already discovered in a TF201 thread.
[Asus Transformer TF700] rightonred:
The code harpik3d posted is the class that writes the unlock command to the device.

mmcblk0p3 is the partition that sends commands to the bootloader such as boot into recovery or fastboot, unlock, etc.

In this case, the raw text "boot-unlock" is written to the first few bytes of this partition, and another set of data (which is the unlock code) is written to mmcblk0p4.

edit: the string "recovery\lf" (\lf is the line feed character) is also written starting at byte 64 on this partition. Im not sure why, perhaps to delete the DRM keys in stock recovery?

After this the device reboots, and the bootloader checks mmcblk0p3, sees the unlock command, and flashes the unlock code from mmcblk0p4 to another partition. (I think)

s.class creates the main unlock function with the input variable being a string which is the unlock code.

this function is executed by unlock activity, which gets the unlock code from f.class

f.class gets the tegra chipid from another class, and sends that id to, and recieves the unlock code from dmclient.

If you wanted to trace the unlock code back to the source you would have to pull and decompile dmclient.

Most likely the unlock code is downloaded from asus server since it is, I'm assuming, a the digital signature for the device's tegra chipid which must be signed by asus's secret signing key. There is no way to generate this signature without that key. There is also no known way to change the chipid to match a known signature (if someone found a way to do that, we could have a non-asus bootloader unlock). The bootloader should only contain the public key used to verify the unlock code (which it does on every boot before booting an unsigned custom firmware), and the private key can't be computed from the publc key without a mathematical breakthrough in integer factorization.

At this point, it we would want to find another way to unlock the tablet, we would have to disassemble the bootloader code and check for weaknesses.
[Asus Transformer TF700] oroo708:
I would like to do it, but I am no programmer. :(
[Asus Transformer TF700] harpik3d:
i think that the signature is taken from an url constructed in h.class, and it seems to be something like:

https://mdm.asus.com/DMServer/DeviceState?id=<DEVID>&AUTH=<AUTHKEY>&ACTION=get

where

<DEVID>
String var1 = ((TelephonyManager)this.mContext.getSystemService("phone")).getDeviceId();
if(var1 == null) {
var1 = ((WifiManager)this.mContext.getSystemService("wifi")).getConnectionInfo().getMacAddress().replace(":", "").toUpperCase();
}

<AUTHKEY>
md5 <DEVID> + <device.class>.a() + <device.class>.getKey() + "dm_server" + "nEEd_query_STATe"
replace("+", "m").replace("/", "f");
if(var5.endsWith("==")) {
var5 = var5.substring(0, -2 + var5.length());
return var5;
}

if(!var5.endsWith("=")) {
return var5;
}
[Asus Transformer TF700] ostar2:
Well, I found out that you do not even need a gmail account to unlock the device. I did not enter the password or username of my email. It still unlocked the bootloader.
[Asus Transformer TF700] wildstang83:
Now that is too funny. Good to know though :)
[Asus Transformer TF700] flyhighx:
Does this give any hope to those of us who can't unlock? For example I keep getting the failed to unlock, please try again later message and I've been trying for weeks.
[Asus Transformer TF700] _that:
No. It just helps understand what unlocking does - the important part is getting your CPU serial number cryptographically signed by Asus, and there is no way around that.
[Asus Transformer TF700] harpik3d:
I've been thinking in another approach:

Correct me if I'm wrong, but how i understand the boot process, the init executable loads the system properties (from wherever it stores them), then it starts running the init*.rc scripts where the initial system is set-up and the main hardware is initialized (including the fastboot behavior)

-I've found in my padfone that the fastboot is enabled(or not) in the init.asus.usb.rc depending on the value of property:sys.usb.fastboot

-I've also seen how in init.rc the script /system/etc/flash_recovery.sh is called to re-create the recovery partition if it has been modified

could it be possible to modify the flash_recovery.sh so it sets the property:sys.usb.fastboot to 1 every time during boot process bypassing the signature check??

what do you think? :confused:
[Asus Transformer TF700] _that:
The fastboot protocol support is in the bootloader, before init starts or even before the Android partition is read. At least on the TF700, I don't know details about the Padfone - it has a different SOC and OS. The only common thing is that it runs Android and it's made by Asus. :)

The property sys.usb.fastboot and etc/flash_recovery.sh don't exist on the Infinity.
[Asus Transformer TF700] ostar2:
Yeah, the OS does not matter nor does the SOC. What matters is that the bootloader executes before the OS as the OS would not be able to flash its self. Also, I am still angry at ASUS. They know that allot of people are going to use this tool and they take advantage of that. They do this by voiding your warranty and stealing your private information.
[Asus Transformer TF700] _that:
That does not matter. Any PC OS can update itself without special support from the bootloader - Linux can even overwrite the executable files of running programs.

What private information is stolen? Do you have anything to back that claim?
[Asus Transformer TF700] ostar2:
Remember how ASUS tracks you with cmclient and dmclient. Also, they transmit your Google account credentials that you give the unlock tool as an unencrypted string. They watch your every move.
[Asus Transformer TF700] ostar2:
Also, when I said the "OS" I meant embedded systems that cannot be opened up with special tools or be reprogrammed external without special equipment and software.
[Asus Transformer TF700] _that:
I remember a thread about these, but I don't know what information they send - I also don't really care, my current ROM doesn't have them anyway. :)

You claimed that already once in this thread and I asked you to point to the code that sends this info - you didn't answer that question. Prove it, otherwise you are spreading FUD.
[Asus Transformer TF700] Zeklandia:
It does not report to Asus that you unlocked it, it stops reporting that it is locked.
[Asus Transformer TF700] _that:
I don't know what you mean. From the info in this thread we already know that the unlock tool sends the MAC address to Asus, and their server sends back your cpuid signed with their private key, which gets written to the staging partition, from where the bootloader writes it to the CER partition.

I just asked ostar2 to post the code fragment, network packet trace, or whatever, where the Google account info is sent unencrypted to Asus - because that would be a security issue.
[Asus Transformer TF700] Zeklandia:
That's when it gets the device's specific ID, all unlocking tools do that, even HTC.
[Asus Transformer TF700] ostar2:
There are a few lines that show ASUS asking for the password and username. It then use the google.com authentication server. But all the information is merged into one string.
[Asus Transformer TF700] jhannah01:
It seems to me this is how ASUS is maintaining a list of unlocked devices, which they do state clearly (that your warranty is void once unlocked). I think the real question is, what does on gain by unlocking their bootloader not using this tool other than a higher risk of a pricey paperweight. The bottom line is, once the bootloader is unlocked, via any means, I don't even think APX blobs could get it back to a 'factory' state if one were trying to avoid this dissolution of the warranty agreement. Or am I totally missing the point here?
[Asus Transformer TF700] _that:
If we could unlock without the Asus tool, we could keep our warranty. I don't see any higher risk. We know how unlocking works, but it's impossible without the Asus private key.

Why? With nvflash you can read and write every bit of the internal eMMC. It's even possible without nvflash to re-lock an unlocked device, but of course that doesn't change any information on Asus' server which still knows your warranty is void since you used their unlock tool.
[Asus Transformer TF700] jhannah01:
That's sort of the catch-22 I'm seeing as well.. I suppose I should first ask if restoring from nvflash blobs actually 're-lock' the bootloader which that does make sense. I also see what you're saying about using nvflash; I would trust APX over poorly obfuscated Java code anyday.

I apologize if I came off as dismissive, I was one of the lame who upgraded past the .30 bootloader shortly before pulling in the driveway the night I got mine :( and that didn't even occur to me.

That being said, I can see a purpose and I think the logical next step would be to investigate the mechanism that actually receives the key- post 'authentication and invalidation' from the ASUS server. IIRC, this is in dmclient right? I'll take a look around and see what I can find that might be interesting but what first comes to mind beyond mucking with SSL certificates and capturing traffic would be to hook the functionality it uses to make the connection and transfer the crucial data. If not on the dmclient side, perhaps on the framework-side-- depending on what it actually uses for HTTPS communication.

Lastly, a disclaimer: I feel this all falls well within the rights afforded to us as owners of this product under the DMCA to reverse engineer these rather secret applications some of which have proven to have quite nefarious capability.

Does that seem to scan with your understand?

---------- Post added at 05:59 PM ---------- Previous post was at 05:29 PM ----------

Reading a bit further, it seems the server probably spits back the signed version of the Tegra ID which seems to be used to actually do the unlocking. I guess the bootloader is the next logical target .. or the SBK itself since that, albeit quite deeply, is stored within the Tegra 3 chip.

Hm, what an obscure solution to a pretty simple problem ASUS.

At this point going after a means to sign the device ID and 'produce' a valid unlock code, if you will, would probably involve hijacking the process of the bootloader signing staging but I don't see how that could end in anything but a very VERY long and complicated (like 1.2E5 years - being quite generous) differential cryptographical attack against AES-128 and if you're up for that, you might as well go for the $100,000 prize out there for it.

Any thoughts now that I feel a bit more caught up to speed :\
[Asus Transformer TF700] ostar2:
Annoying ASUS reps

Asus knows nothing about their own utility. It is actually quite pathetic.
[Asus Transformer TF700] b4316207:
unable to unlock using asus unlock tool

Hello there seems like you guys know what is going on with this asus unlock tool and maybe you can help me and others

I have tf700 running 4.2.1 I registered with asus , can get my tablet to be tracked with asus device tracker , but when i look inside about tablet at s/n says "unknown" have trying everything installed asus unlock tool v7 when I run it get error unable to connect to network try again later

I think it has something to do with tablet not showing s/n question

1) is there another way to unlock this tablet

2) is there a way to put the s/n into tablet that is show up in about tablet

3) is there a different place I should post this to get help Q&A section no one can get answer

thanks for any help
[Asus Transformer TF700] atamig:
I think there is no way to unlocked the bootloader without the Asus tool. I has the same problem and send my tablet back to amazon and refund my money. This was my Last Asus Tablet.....

Gesendet von meinem A700 mit Tapatalk 2
[Galaxy S III Q&A, Help & Troubleshooting] nfsmw_gr:
Hey guys...

I switched over from a sammy based rom to a cm10 based one and the only thing that bugs me(very very much!) is that the speaker volume is very low compared to my previous rom.

On sammy based roms there was a file named default_gain.conf in /etc directory where you could modify output sound.

On cm10 i see there's a file named m0 under /etc/sound directory which is similar to default_gain.conf.

When i changed values in m0 file and rebooted,like i did with default_gain.conf before,sound got a litle higher volume but only just a litle bit...it's still very low for me...:(

Anybody knows how to make this thing louder please??(without equalizer software and other things like that,i want to keep my phone light)

EDIT:I managed to get it to play as loud as sammy based roms but the bass is terrible....:(

It's overpowering and makes the speaker boom no matter how low i set it...too bad....

I'll switch back to my previous rom now.
[Galaxy S III Q&A, Help & Troubleshooting] jnr21:
Flash siyah kernel, it comes with nice sound tweaks.
[Galaxy S III Q&A, Help & Troubleshooting] nfsmw_gr:
Thanks for the suuggestion.

I know this though,i flashed it but it still doesn't sound as good as sammy based...

Plus i don't want to use siyah as my daily driver.
[Galaxy S III Q&A, Help & Troubleshooting] kp.nikhil:
did u try acid v5 sound mod? or megabassbeats?
[Galaxy S III Q&A, Help & Troubleshooting] nfsmw_gr:
I tried acid....it's very good in general.

But it spoils the natural sound for me,which i like to have plus no effect on speaker output...(i'm kinda of an audiophile and have a very sensitive ear).

Anyway i switched back to sammy rom and now everything's fine...:)
[Samsung Galaxy Nexus] Amoc_ns0:
Hi there,

I just updated my GNex to 4.2 and loose root and cwm. I really dont like 4.2 and want to switch back to 4.1.2 or CM10. Is there any chance to get back to 4.1.2 without the Toolkit? The latest version for 4.2 isn't public yet and I really dont want to wait until it gets released.

I have to say, I dont want to sit here for hours and read tons of tutorials to get 4.2 back - I want it as easy as possible^^.

I hope you can help me,

Thanks guys.
[Samsung Galaxy Nexus] beekay201:
wrong forum
[Samsung Galaxy Nexus] EddyOS:
What I did...

1. Make sure you back up everything on your SD card you want to keep to your PC as you're going to wipe the phone

2. Flash the stock 4.1.2 image using the factory image files provided by Google

3. Boot the phone to make sure it's working

4. Flash CWM and restore your SD card files

5. Restore your Nandroid (if you have one from your previous 4.1.2 build)
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
UHi xda's fellas :)

credits:

Raubkatze for some pngs thanks man:D

Giuros77 for friendly ship:)

Rupianh for the dump

LET'S MOD:D:D

Status bar transparent stock themed extrabuttons

http://db.tt/t6a0WsfS

STATUS BAR TRANSPARENT-TRANSPARENT BLUE THEMED-NEW BUTTONS-CIRCLE BATTERY 1%

https://www.dropbox.com/s/x4v39f66suo329g/darboc_full_trans_blue_newButt_LSA.zip

STATUS BAR TRANSPARENT-TRANSPARENT BLUE THEMED- 3 NEW BUTTONS-CIRCLE BATTERY 1%

All buttons have a long feature too:D

http://db.tt/vZnbNjUT

CENTER CLOCK BLUE TRANSPARENT BUTTONS

FLASH BLUE MOD FIRST, THEN THIS

https://www.dropbox.com/s/fsqe76dtng8zrtl/darboc_center_clock_button_blue_LSA.zip

CENTER CLOCK BLUE

http://db.tt/v2HtamkH

BATTERY METERS 1% MOD

It can Be flashed over EVERY JB battery 1% mod:)

http://db.tt/tKZkbGbD

CENTER CLOCK GREEN

FLASH GREEN MOD FIRST, THEN THIS

http://db.tt/3L8nZCYb

STATUS BAR TRANSPARENT-TRANSPARENT GREEN THEMED-NEW BUTTONS-CIRCLE BATTERY 1%

https://www.dropbox.com/s/o8rqfdxhrv9vlng/darboc_full_trans_green_newButtons3_LSA.zip

STATUS BAR TRANSPARENT-TRANSPARENT WHITE THEMED- 3 NEW BUTTONS-CIRCLE BATTERY 1%

http://db.tt/nIq7Zgnz

CENTER CLOCK WHITE

FLASH WHITE MOD FIRST, THEN THIS

http://db.tt/hnQuwgel

CENTER CLOCK WHITE NO STATUS BAR BUTTONS

FLASH WHITE MOD FIRST, THEN THIS

https://www.dropbox.com/s/emsgo6grgv8dxq9/darboc_center_clock_white_LSA.zip

CENTER CLOCK WHITE 50%TRANSPARENT STATUS BAR BUTTONS

FLASH WHITE MOD FIRST, THEN THIS

https://www.dropbox.com/s/4098itm9mjpn0zr/darboc_50trans_centerclock_buttons_white_LSA.zip

STOCK CENTER CLOCK NEW BUTTONS

http://db.tt/XDZ1Pxb7

STOCK NEW BUTTONS

http://db.tt/yBBZu8JX

SCREENSHOOT...COMING...UP

ENJOY:D:D:D
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
Reserved.......
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
Reserved....:D
[Galaxy Note GT-N7000 Themes and Apps] zooq:
Thanks ur fast!Any 2 button clickable blue full trans coming up?
[Galaxy Note GT-N7000 Themes and Apps] LordManhattan:
Screenshots?
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
Soon....:D
[Galaxy Note GT-N7000 Themes and Apps] sharkteef:
thanks. any chance of u doing a modded circular battery with center clock + blue theme + multiple toggles like your previous version of ls7 ?
[Galaxy Note GT-N7000 Themes and Apps] ferryaryan:
This is that i find to...

I'm waiting for full blue transparant with button and center clock. For now, i used this best mod first until you releasw the full blue transparant.

Great job mate...
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
don't care my friends:D

I'll make all mods as LS7 version and others:laugh:

ciao
[Galaxy Note GT-N7000 Themes and Apps] Shnur:
Hi !

Cool, but you can blue :confused:
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
DONE.....IT:cyclops:
[Galaxy Note GT-N7000 Themes and Apps] Shnur:
Very well, thank you!:good:
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
Another one:D
[Galaxy Note GT-N7000 Themes and Apps] arek113:
hello!green full theme pleace
[Galaxy Note GT-N7000 Themes and Apps] here is johnny:
Can i use the center clock mod on stock statusbar?
[Galaxy Note GT-N7000 Themes and Apps] nokiamodeln91:
stock look no transparency

center clock

lock and recent buttons
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
Yes it does..

But you'll get a blue center clock and status bar buttons too;)
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
Yes I'll make it surely...

It's my favorite too:D

Tomorrow it will be a green day:p
[Galaxy Note GT-N7000 Themes and Apps] and2:
hi, please green, circle bat, only statusbar transparent + 2 buttons. would be nice. thx...
[Galaxy Note GT-N7000 Themes and Apps] iLee:
Hi thanks for the mods i like m could you mayby make a white mod?
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
Yes , it will be my next release;)
[Galaxy Note GT-N7000 Themes and Apps] dsmas:
After flashing blue toggle, I got a white square on the screen on some applications such as play store. Rom ultimate v5.
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
Yes ..it must happen, because I was changed some black background to white ..i changed the wallpaper and lockscreen too...

Do you like its?

but I'll restore all tomorrow....;)
[Galaxy Note GT-N7000 Themes and Apps] zai89:
realy love you mod..but I have some request, can you make center clock status bar with no trnsparent and extra button??blue and green colour..:)
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
See OP:D
[Galaxy Note GT-N7000 Themes and Apps] dsmas:
Yes, I do like it. just now flashed blue theme 3 buttons, beautiful, no issues, thanks.
[Galaxy Note GT-N7000 Themes and Apps] santoshhh:
Hi ofeliax thanx for the mod.

Just want to know before flashing, would this change the transparency of status bar and add extra buttons?

Im looking only for center clock.

I think its 100% opaque currently and likeing it.

Pls advice.
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
Yes it change just the clock layout and color, any extra buttons, any transparency:)

You'd can flash it to every LSA/LS7 Rom;)
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
WHITE MOD ADDED:cool:

SEE OP:rolleyes:

Ciao
[Galaxy Note GT-N7000 Themes and Apps] el5arsawi:
thanks for the mod but can you make the status bar less transparent ? like 50% ? with center clock ? : )
[Galaxy Note GT-N7000 Themes and Apps] santoshhh:
It worked

Thanks a lot mate...:)
[Galaxy Note GT-N7000 Themes and Apps] Ofeliax:
Surely.....:D

Which color do you like?
[Galaxy Note GT-N7000 Themes and Apps] el5arsawi:
the white one please :D can i ask for few more mods ? i wish the AM/PM to be smaller than the clock and the status bar to be 50% transparent if it is 0k :D

سينت فروم اان ايجيبشن جلاكسي نوت جي تي 7000
[Galaxy Note GT-N7000 Themes and Apps] vuidoi:
I need your help :D

When i decompile and recompile your systemui.apk and add code xml for battery (and some) is noproblem. But when i decompile systemui.apk from stock deodex(eybee version) noproblem but add code xml and recompile is abort.

How can i recompile stock file after add xml code Ofeliax? Thank so much