yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Fallon:
I'm using CM 10.1 the 3/17 build (last stable SGS3 build before they went to the new kernel version, which isn't as mature & stable as the old one). So, using whatever root was baked into that. I haven't messed with root other than via your scripts since several full wipes ago.

Last night I rebooted to recovery & manually rebooted to TWRP. There I deleted 5 files, spark & the 4 scripts. I then uninstalled good & re-installed, had to remove admin permissions to do so. I couldn't wipe the data for the app for some reason, although I didn't try after I removed it's admin access. After the re-install it was showing 0 sized application data.

I got a new PIN & successfully activated it this morning. So far I have about 5 minutes of up-time & 1 reboot with the clean install of GFE. No signs of policy violations... yet.

I'll try and re-install v16 this evening or tomorrow & see if that blows up GFE. I have a sneaking suspicion it will based on my results so far. All evidence I can see points to them updating their detection to target spark or your scripts directly or they are doing some enhanced scanning which detects what spark is despite the name change.
[Android Software/Hacking General [Developers Only]] gveloce:
Just to let you know that I joined the goodpissed club since yesterday.

I use an HTC HD2 running CM10 (NexusHD2-JellyBean-4.1.2-CM10 V1.3) on NAND (scripts did not work for NativeSD)

and for a whole months the script were working flawlessly. Out of a sudden I got the compliance error and even restoring from Titanium Backup did not solve it....

I have too as Fallon the suspicion that Good guys are following our thread, If so the only stealth approach would be that we modify the install.zip script ourselves changing script names and spark name etc.... Just an idea if above proves true.

Cheers!

GV
[Android Software/Hacking General [Developers Only]] dc300m01:
No go for me.

First I tried restoring my phone to a backup i made on 4/1/13 via TWRP. It worked for about 10 seconds until I got booted.

Restored again via TWRP to the backup I made today. Uninstalled Good. Ran the enable root script. Downloaded the full unroot from this thread and installed it via TWRP. Rebooted phone, ran the disable_good script from v16 to be safe, downloaded good from the store and installed. rebooted, ran the enable_root again, then the enable_good, went through setup and got immediately booted (although as I was looking at the "root detected" screen, my emails and stuff were syncing in the background).

Not sure what else to do?

Thank you for your continued work on this! It's much appreciated.
[Android Software/Hacking General [Developers Only]] Fallon:
Assuming they are looking at this thread, renaming spark to something random & updating the script on your own to reflect the new name should hopefully work. Unless of course they are looking for the names of the scripts themselves (still solvable in the same way). The most worrisome would be if they are managing to scan file contents & tripping on recognizable parts within spark or possibly in the scripts.

It could turn into a cat & mouse game. Hackers always have the advantage there, but not necessarily the stamina to win that fight. :(

I'll validate it still blows up using v16 tonight or tomorrow, then might try re-naming & see if that cures things.
[Android Software/Hacking General [Developers Only]] ceo.mtcl:
I have great trust in OP and I'm sure he'll make things work for us again.

I will get a new code and start with a clean install tonight.
[Android Software/Hacking General [Developers Only]] calisro:
1) Way too invasive of a scan to scan all contents of /system.

2) v16 wouldn't match a 'signature' since it is a custom made SU.

3) I hughly doubt its spark because its running great for me.
[Android Software/Hacking General [Developers Only]] Fallon:
lol! Apparently you haven't seen how much anti-virus, firewall, host based intrusion detection, Data Loss Prevention, backup, VPN, forensics, etc. crap IT & security like putting on corporate laptops these days. :p I really hope that's the case though.

Unless they grabbed it from here & made a signature based on it.

I hate to be too pessimistic, but my official title at work is "Sr. Information Security Analyst", so I definitely see both sides to what GFE is trying to do for companies as well as how it sucks for users. Will play with things probably tomorrow & see what I can find out about making it fail a compliance check.

I've noticed it still syncing stuff in the background after it's failed a compliance check, which doesn't necessarily make me feel great from a security point of view in what GFE is suppose to be securing in the first place.
[Android Software/Hacking General [Developers Only]] calisro:
Corporate owned yes. sandboxed BYOD is different though and these devices would crawl if they make it too invasive...

possible but not probable. mine works so it can't have a signature yet...
[Android Software/Hacking General [Developers Only]] wc4482:
Fair enough. FWIW this is what I did:

1. Downloaded zip file. Downloaded old Version of script manager app (link in OP, don't use play store version. Also, the app is called "SManager Ads")

2. Downloaded "autostarts" (paid root app) and disabled all Good processes that would run automatically on start up.

3. Rebooted into recovery (TWRP for me) and flashed zip file from #1 above.

4. Froze "ES File Manager" as a precaution, using titanium backup

5. Opened SManager and browsed for the 2 scripts. Made them both favorites in SManager and then added a widget for each script to my homescreen. (I think you need to download a separate app for widgets. Play store link should be within the app itself)

6. Remove Good shortcut from home screen and hide app in app drawer so that I don't accidentally launch when I'm rooted (the 'enable Good, disable root' script will launch Good when complete)

Refer to OP for installation instructions. I think the above recap might be helpful for anyone having trouble, but if you would like me to remove, just say the word.
[Android Software/Hacking General [Developers Only]] Bestbaldmanever:
That's an awesome summary. When I have some spare time to go through it all, I'll probably do that. Thanks.
[Android Software/Hacking General [Developers Only]] Bestbaldmanever:
OK... so I'm going for it, having just updated my nightly build ROM of CM 10.1.

How do I save the script in system /xbin to the home screen to then run it when I want to enable / disable GfE?

Fingers crossed I can get it working!

Thanks for the help.
[Android Software/Hacking General [Developers Only]] calisro:
use script manager (in the op). make it a favorite in that app. then you can add a widget from that app for the script.
[Android Software/Hacking General [Developers Only]] Bestbaldmanever:
Gah!

Didn't work, unfortunately. Tried it twice, even tried reinstalling the CM 10.1 ROM, wiping the cache, everything.

Ah well, wasn't to be. I'll probably just fully unroot it again, and then flash it all when I need to have root to upgrade ROM etc.

Thanks for all the work; wish i was clever enough to fix it myself instead of relying on others!
[Android Software/Hacking General [Developers Only]] calisro:
what didn't work? need more info to be able to help you.
[Android Software/Hacking General [Developers Only]] Bestbaldmanever:
Well, I followed the step by step process, as outlined above. Managed to find the scripts in the version of script manager you posted the link to, made them favourites, and then widgets. Ran the one to enable Good and disable root, and that all went fine; the phone flashed up at me that root had been denied to a couple of apps that were running with it.

Then Good launched as part of the script, I went through the setup process with the newly regenerated pin, Good activated fine and then did the usual 'Good is out of compliance and has been stopped' message.

Not sure when in that process something has gone wrong (or more likely I've mis-stepped) but I've done it twice now, in between meetings, and can't get it working.

Apologies for taking your time.
[Android Software/Hacking General [Developers Only]] calisro:
ok. take a screenshot of the script manager log when you root and unroot with the scripts. Also what "root" apps do you have on your device?

don't bother reactivating good yet.
[Android Software/Hacking General [Developers Only]] Bestbaldmanever:
I've got SuperUser as the root app.

Pics attached. Screenshots seem to be an issue at the moment, hence the photo of the screen.

I'm a lost cause I tells ya!

View attachment 1649878

View attachment 1649879
[Android Software/Hacking General [Developers Only]] Bestbaldmanever:
Screenshots managed... although it was a bit flaky, hence the number.

https://www.dropbox.com/s/75pb43hebbulrwk/Screenshot_2013-01-16-13-36-50.png

https://www.dropbox.com/s/6l6jg6w6k9drlu7/Screenshot_2013-01-16-13-36-53.png

https://www.dropbox.com/s/kkmi6aot6tv9nis/Screenshot_2013-01-16-13-37-11.png

https://www.dropbox.com/s/vmuiklc6rcbk4pm/Screenshot_2013-01-16-13-37-21.png

https://www.dropbox.com/s/y266ixym780cv3r/Screenshot_2013-01-16-13-37-24.png

Apologies for being a complete dumbass.
[Android Software/Hacking General [Developers Only]] Calin:
Nice....
[Android Software/Hacking General [Developers Only]] calisro:
I bet my script is failing to find one of the supersu/superuser apks. What I need is a listing from your phone so I can add a filter for you.

You can do this in either adb or connectbot. connectbot is probably easiest but its up to you. Run these and post the logs. su to root before running them. it will just list the apps and binaries on your phone.

su

ls /system/app >> /sdcard/sysout.txt

ls /data/app >> /sdcard/datout.txt

ls /system/bin >> /sdcard/binout.txt

ls /system/xbin >> /sdcard/xbinout.txt

then post those 4 logs and I'll see what it missed.
[Android Software/Hacking General [Developers Only]] Bestbaldmanever:
Ok... done that. How do I find the logs once I've put those lines into Connectbot?

Sorry... told you i was a complete noob.
[Android Software/Hacking General [Developers Only]] calisro:
its okay. use es explorer or similar and they'll be on your internal sd card.
[Android Software/Hacking General [Developers Only]] Bestbaldmanever:
View attachment 1650222

View attachment 1650223

View attachment 1650224

View attachment 1650225
[Android Software/Hacking General [Developers Only]] calisro:
Few things to try after doing them, make sure root is enabled with my scripts, reboot, once it comes up run the 'disable root' script and once good comes up, you can clear data on the Good app and then reenter that PIN you got. The same PIN typically works over and over again.

1) This may be the issue. unprotect root with OTA keeper and uninstall it. I am not sure but I believe that Good looks for the backed up su left over from OTA root keeper.

org.projectvoodoo.otarootkeeper-1.apk

2) Are you using the newest version of script manager from the market or are you using the one from my op? The newer versions seem to trigger compliance issues so you should use the one in the OP. Also you do NOT need the smwidgets addon to script manager to create script widgets. You should uninstall that just in case.

3) You mentioned that you are using superuser for the root apk. If so, remove supersu to keep it simple. If you are using supersu then no worries.
[Android Software/Hacking General [Developers Only]] khaled_ksa_511:
Nice
[Android Software/Hacking General [Developers Only]] Bestbaldmanever:
OK, here's the bizarre thing. The reason I started going through all this is because this morning when I woke up my GfE, which had been working perfectly on my week old nightly build of CM 10.1 which i had unrooted to make GfE work, had stopped working. So I figured I'd take the chance to install the latest nightly and try this fix.

Clearly I couldn't get the fix to work, for whatever reason as yet (and thanks for your help), but I had to go to a few meetings and needed email access so I completely unrooted the phone again, rebooted and then tried to get Good going. Still no dice. So now it won't work on an unrooted phone! I'll obviously keep on trying over the next couple of days, but it seems that it's picking something up, both in the former unrooted build that it's suddenly picked up, and in this unrooted build.

Massively frustrating!
[Android Software/Hacking General [Developers Only]] wc4482:
Did you do an SD Swap? I wonder if there was a file somewhere that is on the internal sdcard (now labeled external sd card)

I'm not good with trouble shooting but as a last resort, you might try backing up all your SDCard files (external and internal) to your computer and then formatting your sdcard, wiping internal memory and wiping data. Followed by a clean flash of CM and then try the GFE workaround.
[Android Software/Hacking General [Developers Only]] calisro:
did you try my suggestions though? remove those apps and see.

it will detect hidden root from ota rootkeeper as well and newer smanager can trigger it too. report back
[Android Software/Hacking General [Developers Only]] Noname-2013:
Logfiles

Hi,

just in case you need it.

After the lockout i did the following (after ordering a new pin):

(After making a complete scan with avast and seeing to that the Avast error was gone)

1. Disable GFE....

2. Deleted GFE data

3. Reboot via Titanium

4. Disable GFE...

5. Enable GFE...

6. Started GFE with new pin

7. Got busted....

8. Forgot to create and save log files.... :(

Got another pin....

1. Disable GFE

2. Deinstalled GFE

3. Deinstalled Avast antivirus

4. Rebooted via Titanium

5. Installed Avast antivirus

6. Installed GFE

7. Deleted GFE data

8. Rebooted via Titanium

9. Disable GFE....

10. Enable GFE....

11. Started GFE....

12. Entered new pin

13. Got busted..

Attached you'll find my latest logfiles.

Thank you guys for staying on it! :good::good::good::good:
[Android Software/Hacking General [Developers Only]] gveloce:
I tried V16 and was screwed again. Does anybody know how to modify the V16 ZIP file to change some things and try again (like spark name, scripts names etc..)?

thx

GV
[Android Software/Hacking General [Developers Only]] Fallon:
GFE was fine

Rebooted to recovery

Installed v16

Rebooted

Opened GFE

Rooted compliance failure within a couple seconds

Never even had the chance to run the enable or disable scripts.

Will try renaming spark & trying again tomorrow. Looks like GFE is detecting this for now.

Avoid this for the time being if you have a hard time getting a PIN. Hopefully we get this figured out and fixed soon.
[Android Software/Hacking General [Developers Only]] RichMD:
I assume if I was to use the "full unroot" option in SuperSu and remove spark and the scripts that Good would not have a compliance violation even though the kernel has root access and I have TWRP. I only ask since the PIN I have (not used yet - only get 1 shot) will expire on Tuesday. I'd rather that than a compliance violation. However, if I could get Good working and do a nandroid backup, then i could at least try other ROMs, etc.
[Android Software/Hacking General [Developers Only]] dc300m01:
Have tried a few other ways, still no good. I'm stick using iNotes in the Opera browser now, since that is the only browser that let's me reply to emails.

I like it better than good too! I can stay logged in all day... Just no notifications.
[Android Software/Hacking General [Developers Only]] Fallon:
Not that this appears to fix the new checking, but here's how to update the .zip:

Open up the .zip

Go find .zip\system\xbin\spark & rename it to something else

Open .zip\META-INF\com\google\android\updater-script in a text editor & change "spark" to whatever you renamed the spark file to

Open .zip\system\xbin\disable_good_enable_root.sh in a text editor & change "spark" to whatever you renamed the spark file to

Open .zip\system\xbin\enable_good_disable_root.sh in a text editor & change "spark" to whatever you renamed the spark file to

On the phone: Delete

\system\xbin\spark

\system\xbin\disable_good_enable_root.sh

\system\xbin\r_disable_good_enable_root.sh

\system\xbin\enable_good_disable_root.sh

\system\xbin\r_enable_good_disable_root.sh

Copy the updated .zip to your phone

Flash the update.zip

Test the enable & disable scripts to make sure they run as expected.

Enable GFE

Disable administrator access for GFE (if needed, was already disabled when I checked)

Delete app data & cache for GFE

Activate GFE

And it all goes to hell again:

GFE ran find for a couple minutes

Ran script to root my phone

Verified root with Titanium Backup

Reboot

Re-enable GFE via script

Root compliance failure :crying:

---------- Post added at 12:54 PM ---------- Previous post was at 12:23 PM ----------

Deleted:

\system\xbin\spark (at least what I renamed it to)

\system\xbin\disable_good_enable_root.sh

\system\xbin\r_disable_good_enable_root.sh

\system\xbin\enable_good_disable_root.sh

\system\xbin\r_enable_good_disable_root.sh

Rebooted

Cleaned GFE data

Reactivated GFE

Rebooted

Still seems to be working fine

Sounds to me like they are detecting the script files themselves, or doing something more invasive & hunting down spark (or whatever you rename it to). Ran out of motivation to dig further today. Next step will be to rename the scripts & see if that fixes things. My procedures for renaming spark should more or less work, just need to update the scripts themselves to reflect the updated script names. Will try it later unless somebody else gets motivated before I do.
[Android Software/Hacking General [Developers Only]] calisro:
I still have not had it fail. I think it something else. My suspicion is supersu.

I think they forced a reactivation to download new policies for anyone who had compliance issues in the past.

From what I see, all the people who can't activate has supersu. supersu has a hidden su file I think is getting flagged. that's why I wanted someone to do a full unroot using the zip I provided and then use superuser to test an activation.... read some posts back.....
[Android Software/Hacking General [Developers Only]] dc300m01:
I installed carbon ROM that has superuser baked in. Before I flashed I did a factory reset + system wipe, so it was a clean install. I even used a new micro SD card.

Downloaded the full unroot zip and followed the instructions and it failed.
[Android Software/Hacking General [Developers Only]] RichMD:
So, superuser is not the complete answer at the very least. I've never seen the policies that IT admins can apply for Good. I know that you can choose to check for root or not. However, are there possibly other settings that are not applied in the policy used by Calisro so his Good isn't complaining while others do a more thorough search? I'm just wondering if it is two variables causing the confusion.

1) Something changed for a lot of people that have full detection policies

2) Calisro and some others have policies that are not that invasive so it is easier to defeat.

The main point is to find out if anyone has seen what a local IT admin can set since it can be different per company?
[Android Software/Hacking General [Developers Only]] Fallon:
No access to GFE admin stuff here.

As I can get PINs pretty trivially I'm planning on adding the components of v16 back in one at a time and seeing if/when it blows.

Think you are right about various people getting hit with different policies (or even just patch/update levels on the server).
[Android Software/Hacking General [Developers Only]] calisro:
I agree it odd. Unfortunately, its hard to fix something that I can't recreate. We need to narrow this down.... If we know what it is, its fixable.
[Android Software/Hacking General [Developers Only]] calisro:
Did you disable anything in autostarts or permission denied?
[Android Software/Hacking General [Developers Only]] dc300m01:
I didn't do the permission denied since im on JB 4.2.2 and i did disable Good from autostarting.
[Android Software/Hacking General [Developers Only]] calisro:
did you disable device admin? jw.
[Android Software/Hacking General [Developers Only]] dc300m01:
No I did not. How do you do that?
[Android Software/Hacking General [Developers Only]] Fallon:
Under CM 10.1 at least:

System Settings > Security > Device Administrators

Just uncheck it there to disable admin (needed to clear data & uninstall GFE)

Whenever I've done it, it breaks GFE. No compliance issues or anything, GFE just whines about not having admin & prompts to re-enable it's admin access. Can't use it until you re-enable it's admin access.
[Android Software/Hacking General [Developers Only]] gveloce:
Tried to rename files in ZIP and create my custom but being novice in this task I think i did smthng wrong.

When trying to run my custom ZIP from recovery I get an error "installation aborted" (without ANY status code).

BTW avoided using Windows Notepad and used Notepad++ to avoid rubish added to the scripts....

I am thinking to find a VI equivalent for Windoz and do it again.

Any hints??

Also any progress on this issue with GFE?

Thx

G
[Android Software/Hacking General [Developers Only]] calisro:
attached.

as far as progress, mine still works so its hard to troubleshoot. I wanted someone to do the full unroot with my script a number of posts back but no one did. I wanted that someone to have a basic install of superuser instead by flashing from that provided url.
[Android Software/Hacking General [Developers Only]] gveloce:
Thanks Callisro.

What I asked was the WAY to change your script to play with not to make you work for creating it.

Anyway as I sense some dissapointment from your side I can only speak for myself and explain that the reason i did notrun your unroot script was my worry not to render my device unusable after that as I have a CM10 (NexusHD2-JellyBean-CM10 V1.3a on NAND + data on EXT) 4.1.2 installation that most probably has the supersu built in.

But I have a spate HD2 and if someone could give me a way to copy/clone my installation to it I could do a lot of tests wthout the fear to ruin my 'productive' phone.

cheers

GV
[Android Software/Hacking General [Developers Only]] auslander1138:
I was also one of those that was 'bitten' by the Compliance check last Tuesday now.

I am currently able to run GFE now after carrying out the following:

Clean flashed JamieD81's "Unofficial" CM10.1 for my Galaxy Note I717 (Preview 13 specifically)

Configured the ROM and additional options to my liking

Carried out a full app/system backup with TiBu

Used your "Full Root Removal" script through recovery

Installed the abomination known as GFE and proceeded to go through the activation

I have been running GFE successfully now since last night without incident

I will probably dabble with the additional scripts this week, but it's been pretty nutty lately so I'm not sure what time I will have to dedicate to this.

My intent is that I will do 'dirty flashes' throughout the process after 'suspending' GFE, either through TiBu or the scripts in the OP. I forgot to mention that I didn't do anything at all with the device administrator settings.

Thanks to everyone for keeping this effort alive! I can now confirm, based on my experience, that the 'full removal of root' script will enable full GFE without root compliance failure.

Cheers!

aus
[Android Software/Hacking General [Developers Only]] Fallon:
If you dirty flash CM (or most ROMs) it will probably put all of the root binaries back in place. Make sure you stop GFE from auto-starting and do the root removal script before letting GFE start after flashing (clean or dirty).

I don't mess with GFE's admin privliges (anymore) unless I need to deactivate it to wipe GFE data or uninstall it. There is no benefit to doing that, although it's only a minor annoyance at worst to fix if you do, no worries about PINs.