yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] itsme:
is the '-20' in bytes ?

in PUBLIC/COMMON/OAK/INC/pkfuncs.h

#define PRETLS_THRDINFO -5

#define UTLS_INKMODE 0x00000001 // bit 1 set if in kmode

#define IsThrdInKMode() (UTlsPtr()[PRETLS_THRDINFO] & UTLS_INKMODE)

this must be the bit that is set when calling 'SetKmode();'
[Windows Mobile Development and Hacking General] chmckay:
Yeah, the -20 is in bytes. Here's the disassembly of what I was looking at:

00B5EC E59F6068	LDR	r6, &0000B65C

00B5F0 E59F5060	LDR	r5, &0000B658

00B5F4 E5960000	LDR	r0, [r6, #0]

00B5F8 E5101014	LDR	r1, [r0, #-20]

00B5FC E3110001	TST	r1, #1

00B600 15950000	LDRNE	r0, [r5, #0]

...

00B650 F000BF08	ANDNV	r11, r0, r8, LSL #30

00B654 01FC6758	MVNEQS	r6, r8, ASR r7

00B658 01FC6760	MVNEQS	r6, r0, ROR #14

00B65C FFFFC800	SWINV	&FFC800 <-- Points to KDataStruct

What you said makes sense, yet it seems kind of strange that this API would be looking at an offest of -20.
[Windows Mobile Development and Hacking General] itsme:
so what you are seeing, is a call to 'IsThrdInKMode()' .

there is a space of thread local storage used by the kernel, just before the publicly accessible thread local storage. - look for SIZE_PRETLS, and PRETLS_RESERVED in the wince source.

this function ( well implemented as a macro actually ) is not a very strange function to call from a system call.

btw, you should have a look at IDA from datarescue. it will give you a much more readable disassembly. the stuff in your example from 00b650-b65c will be recognised as a constant pool, and the references to it, like at 00b5ec will be disassembled as 'LDR r6, =0xffffc800'
[Windows Mobile Development and Hacking General] chmckay:
The only problem I have with IDA is that I can't afford it and their demo doesn't handle ARM processors. The generated output was done with a fairly simple program and has forced me to learn quite a bit about the underlying code in the OS. I've had to go back and forth between the disassembly and the shared source, but I've managed so far (with this exception).

I do have one other question while I have your attention. I've managed to inject a dll into all of the running processes and I've successfully managed to intercept several APIs by patching an application's IAT (and all attached modules, too) in an attempt to provide a better color handler for the system. It appears, however, that some programs, like Gwes.exe, don't use call my functions, but instead call the functions built into Coredll. For example, the GetSysColorBrush I mentioned earlier. This is what prompted me to begin reverse engineering Coredll in the first place. Do you know if the addresses are being stored somewhere? If so, that would explain why even though I've patched the IAT that the original function is still being called.
[Windows Mobile Development and Hacking General] mamaich:
contact me in PM, I can help with IDA 4.51 full
[Windows Mobile Development and Hacking General] itsme:
gwes.exe is the program implementing the API, so quite likely it either calls it's api's directly, or calls the systemcalls directly.

and maybe someprograms are linked to a statically linked version of coredll?

a while back I experimented with trapping systemcalls, by modifying the method table in an API. ( see hookapi.cpp )

I do remember that my device became very unstable. so I guess that it somewhat worked, but haven't figured out what exactly I did wrong yet.

btw, I would be quite interested to see your code to trap calls via the IAT.
[Windows Mobile Development and Hacking General] JohnSmith:
When you have a look to romimage.exe source code in platform builder you will notice that there is a special handling for coredll.dll.

All programs included in the MODULES section will directly resolve calls to coredll.dll. Only if you build a new XIP section a warning will appear "missing coredll.dll ... will late bind".

This means that a hook to coredll.dll will not be visible for in ROM programs since they will call the system functions directly (without the trap).

John
[Windows Mobile Development and Hacking General] chmckay:
Unfortunately, I'm not at the computer where I have the code, so I'll have to upload it to you tomorrow. However, it involves extracting the IAT from the PPROCESS structure of a given program, then enumerating through the entries until I find the API I'm looking for. It's actually pretty straight forward. Give me your email address and I'll send it to you as soon as I can.

I don't have the full source code, only what's available in the shared source, so I'm not sure what modules would be affected. However, I'm really only interested in a few of the Gwes APIs. I know it's possible at least at some point to hook into those as I've seen it done, though the individual who did it is under an NDA and can't tell me how he did it.

Itsme's process looks to be about the best so far, assuming I can get it to work. The only thing is that I need to find a way to translate the physical address to a virtual adress (and vice-versa) for MIPS, SH3 and the emulator, not just the ARM/XScale processors. If I could do that, then I might be able to get things to work.

Thanks for all of your help so far. I appreciate the time you have spent in explaining a few things to me.
[Windows Mobile Development and Hacking General] itsme:
itsme@xs4all.nl

for translating physical to virtual you would need to find the translation tables for each process, which I assume must exist somewhere, but have not found them yet. - my guess is it may be the 'pPTBL' entry from the process struct, but have not verified this yet.

( you know that virtual addresses can not uniquely be translated back to physical without knowing what process they are for? for instance the virtual address 0x11000 is visable in each process, and mapped to a different physical address each time. )
[Windows Mobile Development and Hacking General] chmckay:
Fortunately, I've written an OS before, so I know what you mean about address mapping. If the pTBL does contain the page mappings, that would make sense. I found it easier in my OS to keep the TLB entries with the process they belonged to. That way the OS wouldn't have to search through its memory chain looking for the process's mappings.

Also, if the pTBL does contain the TLB entries, then it should be relatively easy to decode the addresses. After reading your code, itsme, I determined that the CINFO structure holds a pServer field which points to the process which contains the APIs. So, for example, the GDI and USER API sets are being held in Gwes.exe (at least, according to the pServer field). The ppfnMethods field is a VA referring to the pServer. If pServer is NULL, then the ppfnMethods field seems to be a PA. So, what I could do is check for pServer. If it is NULL, I could use the current process's pTBL structure to map the PA to a VA. If the pServer field is non-NULL, then I could try the pServer's pTBL field to do the mapping and then do the replacement that way.

If this works, I owe you big!
[Windows Mobile Development and Hacking General] itsme:
here is another experimental program, that investigates all the handles present in the system.

I used it to generate this overview of handles.
[Windows Mobile Development and Hacking General] chmckay:
Progress So Far

I just thought I'd post an update on my progress so far. It appears that I can overwrite the API table pretty easily. Instead of taking a physical address, the table takes a pointer to a function in virtual memory. You just need to map it to slot 0 using MapPtrToProcess.

I've come across two issues in doing this. The first thing is that I can't call the original function address. For example, I store the original address contained in ppfMethods[x] and then attempt to typecast it to the proper function type, passing the incoming variables.

The other issue is that it appears that the API table is NOT refreshed upon a soft-reset. Fortunately, I was playing around with it on the emulator. Had I not, I would have been forced to hard-reset my device.

Does anyone have ideas on either of these issues?

Thanks again for your help so far!
[Windows Mobile Development and Hacking General] itsme:
a thing that just occurred to me, is that if you duplicate the apiset struct, the memory pointed to by ppfnMethods should be readable from the process specified in pServer.

so you should allocate the memory in the address space of pServer.

or set pServer to yourself, and add some hook code which does not modify the stack, so you can just pass most calls directly to the original server.

to call the original function address, you have to somehow switch process context, and then call it.
[Windows Mobile Development and Hacking General] chmckay:
Well, in the case that I tested, I replaced the QueryAPISetID API which exists in Wn32 and therefore has no pServer. It appears that if there is no pServer, then there is no context switch needed. I've been able to verify that the API will execute my code and the generated assembly does not modify the stack in any way.

This one is really weird. Thanks for the suggestions.
[Windows Mobile Development and Hacking General] michar:
Hi,

Just wondring if you could post/PM/email me the code that lets you replace the API call. This is for the purpose of hooking a different DLL to do my own thing, or see here:

http://xdaforums.com/viewtopic.php?p=131857#131857
[Windows Mobile Development and Hacking General] chmckay:
I just sent you a PM with the information you requested.
[Windows Mobile Development and Hacking General] deus:
Replacing API function call

Hi,

Can you pleaese please send me via PM or mail the source code which proivde replaceing an API function call.

I'm trying for several days hooking specified DLL...

It can help me a lot.

Thanks,

Eric.
[Micromax A110] dealoflove:
If you have installed Custom ROM but want Micromax A110 stock boot logo/ boot Animation / Shutdown Animation back. Download the zip file and use CWM to install ;)

Cooked, Tried & Tested by me

Hit thanks if you used it

http://ge.tt/31JLFKb/v/0?c?c

If you get error

Extract bootanimation.zip file.

Replace this bootanimation.zip file in system/media using some root explorer

and set the permissions to rw r r
[Micromax A110] Megathelance:
Cant install

Gesendet von meinem Blade A110 mit Tapatalk 2
[Micromax A110] Megathelance:
Pls help

Gesendet von meinem Blade A110 mit Tapatalk 2
[Micromax A110] Akashn:
screenshot please :confused:
[Micromax A110] udyansh5338:
nothing is happening....it is aborted
[Micromax A110] Megathelance:
Youre right...

Gesendet von meinem Blade A110 mit Tapatalk 2
[Micromax A110] dealoflove:
If you get error

Extract bootanimation.zip file.

Replace this bootanimation.zip file in system/media using some root explorer

and set the permissions to rw r r
[Nexus 7 Themes and Apps] bearclaw7380:
https://play.google.com/store/apps/details?id=com.buzzpia.aqua.launcher&hl=en

New launcher is fantastic. I'm using it and its great for people who want a "HUB"-like experience without doing all the work on their N7. So far I'd rank it above next launcher and nova as it combines a lot of features and also hosts quite a bit of other interfaces that are available in the buzz store, which has other people's ideas and designs.

Just thought I'd share this good find with the community.

At least I put this topic in the right section :)
[Nexus 7 Themes and Apps] khaytsus:
eh, tried it for giggles. Maybe with some work it could be useful but it's mostly just eyecandy and fluff.

And I tried a few homescreens from the Home Buzz or whatever in the app.. Every one I tried you had to set up random stuff to make it work, weather widgets seem to be stuck with a static C or F marker, etc..
[Nexus 7 Themes and Apps] bearclaw7380:
Im surprised no one else has chimed in. People usually swarm over newly found launchers lol
[Nexus 7 Themes and Apps] Osiris19:
It's not really functional. More of just "oh this looks cool" kind of thing right now.
[Nexus 7 Themes and Apps] chiikko561:
Does not look the greatest stick with golauncher hd
[Nexus 7 Themes and Apps] bearclaw7380:
Yea, I realize that now. Jumped the gun a little bit. Went back to apex launcher. Either hit or miss.
[Nexus 7 Themes and Apps] jazzespresso:
i played around a bit on my N7 (they were not supported 7' tablets, but looks like they start supporting 7 inch tablets). like bearclaw7380 said, it is either hit or miss. It also using more memory than other launchers too, and sometimes it gets really really slow, unresponsive.

Nevertheless, it is cool idea and has good potential, but probably need a lot work to make mainstream launcher.
[One (M7) Q&A, Help & Troubleshooting] mwatson:
I've tried disabling location reporting in Google maps, I've frozen the HTC weather app. Turned off locations in facebook messenger and facebook app.

I still can't get rid of this dam battery draining wake lock. Any ideas?
[One (M7) Q&A, Help & Troubleshooting] biffsmash:
Hi. This wakelock won't amount to much over the course of a full charge. I wouldn't worry about it.

If you're absolutely paranoid about it, is it possible you have location turned on in camera?
[One (M7) Q&A, Help & Troubleshooting] mwatson:
over an entire day it does amount to around 10-15% battery loss.

I've switched off all location dependant apps like facebook messenger, camera, twitter, weather and anything else i can think of. After doing a bit of searching it seems to be a JB problem that affects Nexus devices too:

http://www.droidforums.net/forum/ga...ps-battery-drain-post-jellybean-settings.html

https://code.google.com/p/android/issues/detail?id=34458

only way round is to totally disable location reporting in settings
[Sprint Samsung Galaxy S 4 Android Development] Unknownforce:
Thanks:

crawrj - scripts, hotspot mod, others

dsixda - kitchen

calkulin - simply an inspiration, used to follow him on PPCGeeks with my old WinMo devices ;)

reverepats - Great themes and putting up with my non-sense :)

shabbypenguin - Recovery and others

agrabren - helped me out with so much I couldn't possibly list it all here

sextape - Always getting the goods for us! (leaks, links, roms, etc.)

wwjoshdew - Great guy, lots of things to thank him for, this time... it's the sweet video :)

digiblur - Guide for Official Status

anyone else I'm forgetting
[Sprint Samsung Galaxy S 4 Android Development] Unknownforce:
A Few screenshots:
[Sprint Samsung Galaxy S 4 Android Development] rawintellect:
Very cool :) I scored a lil higher with my tweaks to stock though :) But I'm glad we're getting some ROMs for this device :victory:
[Sprint Samsung Galaxy S 4 Android Development] kyhassen:
Sweet! I may give it a test run later today.
[Sprint Samsung Galaxy S 4 Android Development] guitardoc64:
It's about time! JK, Great to see you stepping out with a ROM!
[Sprint Samsung Galaxy S 4 Android Development] Unknownforce:
Finally done uploading! Lol... Boy, releasing new versions is gonna suck... I hate my connection. :(

Please let me know how it goes.

Also, If anyone wants to mirror it, I don't mind at all, toss a link up and I'll add it to the main post.
[Sprint Samsung Galaxy S 4 Android Development] Shadow_God:
Hey OP....this might help in the future...here is a list of apps safe to remove (minus the sprint crap)....just pick and choose

http://xdaforums.com/showthread.php?p=40911004
[Sprint Samsung Galaxy S 4 Android Development] Unknownforce:
Lol, I ended up going through manually and removing them based on either their name or I used APK Analyzer to determine exactly what they are.

This list helps though. Thanks.

I wish there was a list like this for the library files... Could save some more space by eliminating the libraries that aren't needed anymore as well.
[Sprint Samsung Galaxy S 4 Android Development] wwjoshdew:
NICE to see you on these Forums unknownforce! You did incredible work on the Evo 3D. I still have another week, I gotta wait until Friday to get my S4.
[Sprint Samsung Galaxy S 4 Android Development] Unknownforce:
Likewise bud. :good:
[Sprint Samsung Galaxy S 4 Android Development] Muledeer:
Loaded

I've loaded the rom. Seems fine so far -- Minimalistic - Love it

No more sprint bloat

Thanks again - will keep you updated on progress

Unknown....You done good...

Mule
[Sprint Samsung Galaxy S 4 Android Development] opz187:
Everything running smooth over here dude. Not missing all of that bloat!
[Sprint Samsung Galaxy S 4 Android Development] CHUUZE:
Would it be possible for you to post a list of removed apps/bloat?
[Sprint Samsung Galaxy S 4 Android Development] Unknownforce:
Thanks ;)

Sure:

AllShareCastPlayer.apk
AllshareControlShare.apk
AllshareFileShare.apk
AllshareFileShareClient.apk
AllshareFileShareServer.apk
AllshareMediaServer.apk
AllshareMediaShare.apk
AllSharePlay15.apk
AutomationTest_FB.apk
Blurb.apk
Books.apk
ClockPackage.apk
CloudAgent.apk
Com2usPoker_ASGC.apk
Dropbox.apk
DropboxOOBE.apk
Episodes.apk
Flipboard.apk
GroupPlay_20.apk
HealthContentProvider.apk
InteractiveTutorial.apk
KNOXAgent.apk
Magazines.apk
Match3VS.apk
MDMApp.apk
MobilePrintSvc_CUPS.apk
MobilePrintSvc_CUPS_Backend.apk
PageBuddyNotiSvc2.apk
Peel.apk
PolarisOffice5.apk
qcrilmsgtunnel.apk
SamsungAppsUNA3.apk
SamsungApps_J_Only.apk
SamsungBooks.apk
SamsungGames.apk
SamsungHub.apk
SamsungHubUpdater.apk
SamsungMusic.apk
SamsungOCR2.apk
Samsungservice.apk
SamsungVideo.apk
SamsungWatchON.apk
SamsungWidget_ProgramMonitor.apk
sCloudBackupApp.apk
sCloudBackupProvider.apk
sCloudDataRelay.apk
sCloudDataSync.apk
sCloudQuotaApp.apk
sCloudSyncCalendar.apk
sCloudSyncContacts.apk
sCloudSyncSBrowserBookmark.apk
sCloudSyncSBrowserTabs.apk
sCloudSyncSNote.apk
SHealth2.apk
SkyfireToolbar.apk
SmartBriefing4x2.apk
SMemo2.apk
SNoteProvider.apk
SphericalMosaic.apk
SPlannerAppWidget_NAmerica.apk
SprintAndroidExtension.apk
SprintWorldwide.apk
Sprint_Installer.apk
StoryAlbumWidget.apk
S_Translator_CSLi.apk
TravelService.apk
TravelWidget.apk
TripAdvisor.apk
YahoonewsPhone2013.apk
YahoostockPhone2013.apk
Zone.apk
[Sprint Samsung Galaxy S 4 Android Development] Unknownforce:
Small update, got the 4-in-1 reboot menu to work, thanks to kahvitahra's help and guide.

Download here and flash via recovery. This will cause cache to reset, so it will rebuild that after you flash.

Added to main post and integrated into ROM for next update as well.
[Sprint Samsung Galaxy S 4 Android Development] guitardoc64:
Nice work! I think I'm going to try this one first.
[Sprint Samsung Galaxy S 4 Android Development] CCallahan:
Nice work. :good:
[Sprint Samsung Galaxy S 4 Android Development] ACoolGuy:
Not trying to be a d1ck by not running your rom yet and asking this, but do you suppose this would work on stock rooted? I see its just the android policy jar so figured id ask. Thanks.
[Sprint Samsung Galaxy S 4 Android Development] Unknownforce:
No worries.

This version will only work if the the system has been de-odex'd. So you would have needed to flash the deodexed stock rom

It will not work on pure stock with just root added in.
[HTC Amaze 4G] lamortcroix:
https://www.youtube.com/watch?v=9vlrgCteDac&feature=youtube_gdata_player
[HTC Amaze 4G] lamortcroix:
Hmm it seems the PA team has open sources halo to be incorporated into any ROM. Or am I late on this news?
[HTC Amaze 4G] EclipzeRemix:
nope your not late, they made it public yesterday
[HTC Amaze 4G] lamortcroix:
Well hey Eclipse. You guys in the newer models must be happy to hear that.
[HTC Amaze 4G] vmartinez39:
Well holy crap. That halo is like so convenient. It multitasks and does everything notification wise.

I have a Nexus 4 and use PA as my main driver. Its the only redeeming quality of having a Nexus device, full support. I hang on shred of hope G2X can get Radio working on CM10.1 and Amaze get all it's bugs ironed out from HTC sources release. I don't know why they couldn't do what was done with HTC Sensation, that device has support up to the sky.

I love my old devices. Nostalgia. I bought a Sensation and going to unlock boot, flash, S=OFF, and all that good stuff then I will give it to my cousins who's been asking for an Adroid phone. Still on the fence if to part ways with the Sensation or the Amaze.
[HTC Amaze 4G] EclipzeRemix:
yea a couple of roms over on the HTC One forums have it, have not tested it out yet
[HTC Amaze 4G] sportsstar89:
We literally have the same development as the sensation except for less ROMs we actually have a more complete cm
[HTC Amaze 4G] theematt:
Try floating notifications in the play store. I did some alpha and beta testing for rob and he is a great dev and it is an awesome app.

He is still working on adding even more features but Try the tail version out to get a feel for it.
[Sprint Samsung Galaxy S III] mewikime:
I've figured out that if I use Nova Launcher and have scrolling wallpaper, it needs to be 1280x1280.

But to use Multi Picture Live Wallpaper and have a different background on each homescreen, what size image is needed so that it isn't squashed, stretched or otherwise distorted?

Thanks
[Sprint Samsung Galaxy Note II] mbtmbt:
Hi everybody,

I want to change Note 2 email mainmenu background color. I have rooted device. Is there any way to change email background? İf anybody changes apk background, I can send my secemail.apk and secexchange.apk. could you help me?
[Sprint Samsung Galaxy Note II] LMMT:
You can change it from dark to light, or vice versa, by following this:

http://xdaforums.com/showthread.php?p=35178641
[Sprint Samsung Galaxy Note II] mbtmbt:
thank you to answer my questions. I visited page that you suggested me, but I cant find feature.xml under /system/csc. can you help me about this?
[Sprint Samsung Galaxy Note II] chrischoi:
Download ES File Explorer. Change the Root Options to R/W. Hit the / at the top. Find system > csc then feature.xml.

Maybe try YouTubing feature.xml, I'm sure someone will walk you through it.
[Sprint Samsung Galaxy Note II] mbtmbt:
I solved my problem in this link.

http://xdaforums.com/showthread.php?t=2033894

while some note 2 have a feature.xml under /system/csc, others have an others.xml under /system/csc. and my note 2 has second option.

thank everybody to help me..
[Sprint Samsung Galaxy Note II] -EViL-KoNCEPTz-:
You must be in the wrong forums then cuz sprints all have feature.xml

☆SoA: Son's of Android™☆

I like to break stuff! :D
[Sprint Samsung Galaxy Note II] budde2:
Hey Evil have You ever Worked or thought about working for sprint or any Company like sprint. You have atot of knowledge. You have help Me and many others I'm sure I speak for all of use when I Say thanks You are much appreciated and a assiate to the Note 2 for sprint forum.
[Sprint Samsung Galaxy Note II] -EViL-KoNCEPTz-:
Lol. Might have been nice when I was about 17 or 18 but my job pays too good for the hours I work, plus I mostly work from home unless I have to go do inspections.

☆SoA: Son's of Android™☆

I like to break stuff! :D
[Sprint Samsung Galaxy Note II] klbjr:
How bout go here and just download the already inverted Gmail app. Just uninstall the stock one, reboot and install the inverted one like a regular apk.
[Sprint Samsung Galaxy Note II] lawdawg45238:
How woukd I uninstall gmail app ? Application manager affers a disable option. I am stock rooted on 4.1.2. Ma7 build

Thank you in advance for help
[Sprint Samsung Galaxy Note II] klbjr:
I used Titanium Backup to uninstall it or you could use Root Explorer or another file explorer app and delete the Gmail.apk from system/app folder. Then reboot and install the inverted Gmail like a regular apk.
[Sprint Samsung Galaxy Note II] lawdawg45238:
I did it thru TB... worked perfectly. Thanks !!!!
[Sprint Samsung Galaxy Note II] klbjr:
No problem. Glad to be of service!
[Galaxy S 4 Q&A, Help & Troubleshooting] ashcraft:
Quick question/issue guys. I unlocked my S4 and attempted to flash MDM through odin. It got to the system write and then failed and now I can't access anything but download mode. I tried reflashing again but still no dice so I fell back to my S3 for now. Anyone have an idea as to how I can fix this? Thanks!
[Galaxy S 4 Q&A, Help & Troubleshooting] okty2k:
flash again with odin, choosing the file as pda.

go into main download mode (volume down, home and power - cable disconnected, then connect cable). it should work...