yashsingh1/xdaforums huggingface dataset:
[Connected Car] donaldta:
Okay, since the problem that we we're experiencing with MasterKey bug #8x could be caused by one of the incremental changes, I decided to provide incremental stages of the packages in hope that we can pin down which point the SCT acknowledges an invalid APK.

So, we will start with out base:

SparmaRoot-Stage0.apk: This is base which I used for the trojan Framaroot APK used in all the later stages. It will not install or function on the SCT on its own. It is really nothing more than the original Framaroot with renamed files:

lib/armeabi/libframalib.so = lib/armeabi/libspotify-jni.so

res/layout/activity_frama.xml = res/layout/list_item.xml

res/drawable-hdpi/ic_launcher.png = res/drawable-hdpi/pw_cell.png

evil-SparmaRoot-Stage1.apk: This is the result of merging SparmaRoot-Stage0.apk with the SCT's Spotify APK using the Masterkey bash script which should allow it to be installable onto the SCT. However, it will most likely result in Force Closing since all the original links are dead.

MasterKeysModded-SparmaRoot-Stage1.apk: This is the result of merging SparmaRoot-Stage0.apk with the SCT's Spotify APK using the Masterkey java project which should allow it to be installable onto the SCT. However, it will most likely result in Force Closing since all the original links are dead.

SparmaRoot-Stage2.apk: This is re-signed and reconfigured APK which alters the links to the renamed files. Although this file will not install on the SCT on its own, it should be able to be installed and run on any Android Device that allows installation from "Unknown Sources"

res/values/public.xml: "activity_frama" to "list_item"

smali/com/alephzain/framaroot/R$layout.smali: "activity_frama" to "list_item"

smali/com/alephzain/framaroot/FramaActivity.smali: "framalib" to "libspotify-jni"

smali/com/alephzain/framaroot/FramaAdbActivity.smali: "framalib" to "libspotify-jni"

smali/com/alephzain/framaroot/R$drawable.smali: "ic_launcher" to "pw_cell"

res/values/public.xml: "ic_launcher" to "pw_cell"

AndroidManifest.xml "ic_launcher" to "pw_cell"

evil-SparmaRoot-Stage3.apk: This is the result of merging SparmaRoot-Stage2.apk with the SCT's Spotify APK using the Masterkey bash script which should allow it to be installable onto the SCT. It ability to function is questionable though.

MasterKeysModded-SparmaRoot-Stage3.apk This is the result of merging SparmaRoot-Stage2.apk with the SCT's Spotify APK using the Masterkey java project which should allow it to be installable onto the SCT.It ability to function is questionable though.

I would recommend testing both versions of the stage 1 and 3 files on the SCT. Make sure to "uninstall any possible existence of Framaroot in between re-installs. It would be very helpful if we can get the logcat messages related to the install and execution of these packages.

Here are the:
[Connected Car] xadax:
Didn't look too promising...

$uname -a
Linux localhost 2.6.35.13-02961-ge12298f #1 PREEMPT Wed Aug 28 19:42:13 CEST 2013 armv7l GNU/Linux
$ cat /proc/version
Linux version 2.6.35.13-02961-ge12298f (g-beguin@FR-B-800-0057) (gcc version 4.4.3 (GCC) ) #1 PREEMPT Wed Aug 28 19:42:13 CEST 2013

File Type: apk	SparmaRoot-Stage0.apk - [Click for QR Code] (896.8 KB, 0 views)
C:\>adb install SparmaRoot-Stage0.apk
784 KB/s (918303 bytes in 1.143s)
pkg: /data/local/tmp/SparmaRoot-Stage0.apk
Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]
log1.txt

File Type: apk	evil-SparmaRoot-Stage1.apk - [Click for QR Code] (3.14 MB, 0 views)
forgot to test this one...

File Type: apk	MasterKeysModded-SparmaRoot-Stage1.apk - [Click for QR Code] (2.68 MB, 0 views)
C:\>adb install MasterKeysModded-SparmaRoot-Stage1.apk
725 KB/s (2813372 bytes in 3.787s)
pkg: /data/local/tmp/MasterKeysModded-SparmaRoot-Stage1.apk
Failure [INSTALL_FAILED_INVALID_APK]
log2.txt

File Type: apk	SparmaRoot-Stage2.apk - [Click for QR Code] (898.7 KB, 0 views)
C:\>adb install SparmaRoot-Stage2.apk
783 KB/s (920311 bytes in 1.147s)
pkg: /data/local/tmp/SparmaRoot-Stage2.apk
Failure [INSTALL_FAILED_INVALID_APK]
log3.txt

File Type: apk	evil-SparmaRoot-Stage3.apk - [Click for QR Code] (3.14 MB, 0 views)
C:\>adb install evil-SparmaRoot-Stage3.apk
779 KB/s (3296776 bytes in 4.130s)
pkg: /data/local/tmp/evil-SparmaRoot-Stage3.apk
Failure [INSTALL_FAILED_INVALID_APK]
log4.txt

File Type: apk	MasterKeysModded-SparmaRoot-Stage3.apk - [Click for QR Code] (2.69 MB, 0 views)
C:\>adb install MasterKeysModded-SparmaRoot-Stage3.apk
777 KB/s (2821672 bytes in 3.542s)
pkg: /data/local/tmp/MasterKeysModded-SparmaRoot-Stage3.apk
Failure [INSTALL_FAILED_INVALID_APK]
log5.txt

C:\>adb install spot1.apk
672 KB/s (3260310 bytes in 4.735s)
pkg: /data/local/tmp/spot1.apk
Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]

C:\>adb install spot2.apk
737 KB/s (3248006 bytes in 4.300s)
pkg: /data/local/tmp/spot2.apk
Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]

C:\>adb install spot3.apk
738 KB/s (4926618 bytes in 6.515s)
pkg: /data/local/tmp/spot3.apk
Failure [INSTALL_FAILED_INVALID_APK]

C:\>adb install spot4.apk
703 KB/s (2812177 bytes in 3.902s)
pkg: /data/local/tmp/spot4.apk
Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]

C:\>adb install spot5.apk
736 KB/s (3256414 bytes in 4.319s)
pkg: /data/local/tmp/spot5.apk
Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]

logspot.txt

Including logcats in the attachement.

adb shell dumpsys package com.alephzain.framaroot

did not give any result (after the uninstall of the (invalid) evil spotnet.

Still nothing after reinstall of evil--Parrot-PackageInstaller.apk or MasterKeysModded-PackageInstaller.apk.

I hope it helps anyway.
[Connected Car] getiem:
To me it seems there the only one really installable at the moment:

parrot.maps original and the wikango original, but also the wikango changed version by johnny_w.

Maybe Donaldt or gekkekoe could provide a changed version of the Wikango? Sofar i can see in this topic, there is not yet a try with a Masterkeys modded or an evil-- wikango apk.

Sorry, looked back in the topic, and saw we already did this... http://xdaforums.com/showpost.php?p=46833367&postcount=88

Furthermore, the PLF file we have from the update download of parrot, does not have all the files that are on the SCT. More directories are available, as you can see in my screenshot of yesterday. Two of them may contain more usefull stuff or maybe it is rubbish. Does it make sense to Pull them from the SCT and post them here?

Its about the directorie: "dev" and "root" for example.

Another edit:

We did not test SRS root yet. I cannot download it here at work, blocked by firewall. Maybe i can try that one after the weekend. or maybe someone has time before that.
[Connected Car] donaldta:
The /dev directory contains the special device handlers for all of the Linux devices. The reason why this is not included with the SCT's PLF is because it is created during installation and while it is running. Another example is /proc which is a virtual filesystem. It does not exist on the flash storage. Instead, the kernel creates it in memory.

However, it would be interesting to see what's inside of /root. Though, I wouldn't think that you would have the correct permissions to access it.

Another interesting thing to look at is the available commands in /system/(bin sbin xbin) that Volvo has left for you. The following commands should create text files in your current computer's working directory that contain the long list directory format for each directory.

adb shell "ls -l /system/bin" > bin.txt

adb shell "ls -l /system/sbin" > sbin.txt

adb shell "ls -l /system/xbin" > xbin.txt

You're right it doesn't look too promising. It seems that this starts of from the point that we manipulate Framaroot. But to know exactly for sure, I'll need to be able and read the respective logcat messages.

Btw, do you happen to know if these was the case for both 2.3.7 and 2.3.3 of the package installer? You can check which one is currently running using "adb shell dumpsys package com" then checking for "versionName=2.3.3" or "versionName=2.3.7" of your you'll need to use "adb uninstall" and "adb install -r" appropriately to get the correct version running.

The logcats would have been super helpful. However, it seems that you may have forgotten to select the individual messages or use [CTRL]+[A] within the pane of the messages to select all of them. The issue is that the logcat's disk icon facilitates "Export Selected Items to Text File..". So, if you click on it without selecting any messages then you'll end up with a blank text file, like the ones inside of your zip attachment.

Would you be able to try it again and make sure to include the APK that you had forgotten earlier?

You are forgetting about the two replacement APKs that I created to back rev the Package Installer from 2.3.7 to 2.3.3. Xadax has proven that they will install the other day.

The important thing to find out exactly at which point in manipulating the files that SCT finds them file invalid. I'm going to take a few more steps back and start with an unmanipulated Framaroot. I am almost beginning to think that the SCT is testing signatures a second time. Quite possibly when it attempts to place *.so files into the native directory. Even though I re-signed the APK, my signature is from a temporary developer key which the SCT might not find appropriate since it is a production device.
[Connected Car] getiem:
I found myself a readable article on what you are actually doing :)

https://securityledger.com/2013/07/exploit-code-released-for-android-security-hole/

Interesting to see there are many different scripts pocs.

https://gist.github.com/poliva/36b0795ab79ad6f14fd8

https://github.com/poliva/random-scripts/blob/master/android/masterkey-apk-inject.sh

Found also an old python project:

http://stackoverflow.com/questions/5829424/injecting-code-into-apk

You r right, I forgot to mention that one.

Will do monday lunch.
[Connected Car] donaldta:
Alright going back to square one:

AlphaSparma0.apk: This is the unmodified base of the SCT Spotify app to which will be the "Trojan Horse" that will conceal the varied differences of the Framaroot.apk.

evil-AlphaSparma1.apk: Merged with an unmodified Framaroot-1.6.1.apk

evil-AlphaSparma2.apk: Merged with the res/drawable-*dpi/ic_launcher.png files & directories deleted from Framaroot-1.6.1.apk

evil-AlphaSparma3.apk: Merged with the res/drawable-*dpi/ic_launcher.png and res/layout/activity_frama.xml file & directories deleted from Framaroot-1.6.1.apk

evil-AlphaSparma4.apk: Merged with the res/drawable-*dpi/ic_launcher.png, res/layout/activity_frama.xml and lib/armeabi/libclibpurple.so files & directories deleted from Framaroot-1.6.1.apk

evil-AlphaSparma5.apk: Merged with the res/drawable-*dpi/ic_launcher.png, res/layout/activity_frama.xml, lib/armeabi/libclibpurple.so, and META-INF/* files & directories deleted from Framaroot-1.6.1.apk

Please install and provide logcat messages respectively. You may need to use "adb uninstall" and/or "adb install -r" as necessary.
[Connected Car] donaldta:
Yep, that's a pretty good layman's overview.

Those two are written by the same person, Pau Oliva. His Linux bash scripts are made to exploit bug #8219321 which allows duplicate files to be injected into the APK. The caveat about this bug is that the injected APK cannot have any files or directories that isn't present in the concealing APK. The last link is the latest version which I am using and sometimes refer to it as a variation of Masterkey Bash Script. The files created with this are prefixed with "evil".

I am also using the ZipArbitage java project which I often refer to as a variation of the Masterkey Java Project. This version is written in Java 7, so it can be run on many more platforms. It has a lot more finesse in how it creates the modified APKs but it is also more finicky. The files created with this is prefixed with "MasterkeyModded".

The nice thing about the java project is that in addition to exploiting bug #8219321, it can be used to exploit bug# 9695860 by adding "-b" to the command line arguments. Bug# 9695860 does a similar technique of injecting another APK but its method involves using binary fragments of the other APK. This allows APKs with completely different file and directory structures to be snuck in. Unfortunately, the Masterkey exploits for bug# 9695860 do not seem to work with the SCT. And I haven't got much feedback in the way of logcat messages to see if there are any workarounds.

Hmm... seems interesting. I don't know if we can use it but I'll look into it later.
[Connected Car] xadax:
Second try.,,

C:\>adb shell id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009
(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)

C:\>adb shell "ls -l -d /data"
drwxrwx--x system system 2013-11-01 18:35 data

C:\>adb install -r evil-com.parrot.spotify.apk
765 KB/s (4989941 bytes in 6.364s)
pkg: /data/local/tmp/evil-com.parrot.spotify.apk
Failure [INSTALL_FAILED_INVALID_APK]

C:\>adb install -r SparmaRoot-Stage0.apk
773 KB/s (918303 bytes in 1.159s)
pkg: /data/local/tmp/SparmaRoot-Stage0.apk
Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]

C:\>adb install -r evil-SparmaRoot-Stage1.apk
797 KB/s (3295652 bytes in 4.035s)
pkg: /data/local/tmp/evil-SparmaRoot-Stage1.apk
Failure [INSTALL_FAILED_INVALID_APK]

C:\>adb install -r MasterKeysModded-SparmaRoot-Stage1.apk
808 KB/s (2813372 bytes in 3.400s)
pkg: /data/local/tmp/MasterKeysModded-SparmaRoot-Stage1.apk
Failure [INSTALL_FAILED_INVALID_APK]

C:\>adb install -r SparmaRoot-Stage2.apk
766 KB/s (920311 bytes in 1.172s)
pkg: /data/local/tmp/SparmaRoot-Stage2.apk
Failure [INSTALL_FAILED_INVALID_APK]

C:\>adb install -r evil-SparmaRoot-Stage3.apk
798 KB/s (3296776 bytes in 4.034s)
pkg: /data/local/tmp/evil-SparmaRoot-Stage3.apk
Failure [INSTALL_FAILED_INVALID_APK]

C:\>adb install -r MasterKeysModded-SparmaRoot-Stage3.apk
758 KB/s (2821672 bytes in 3.635s)
pkg: /data/local/tmp/MasterKeysModded-SparmaRoot-Stage3.apk
Failure [INSTALL_FAILED_INVALID_APK]

see logcat1.txt

C:\>adb shell dumpsys package com

see dumpsys.txt

C:\>adb install AlphaSparma0.apk
797 KB/s (1897501 bytes in 2.323s)
pkg: /data/local/tmp/AlphaSparma0.apk
Failure [INSTALL_FAILED_ALREADY_EXISTS]

C:\>adb install -r AlphaSparma0.apk
805 KB/s (1897501 bytes in 2.299s)
pkg: /data/local/tmp/AlphaSparma0.apk
Success

C:\>adb install -r evil-AlphaSparma1.apk
777 KB/s (3269861 bytes in 4.108s)
pkg: /data/local/tmp/evil-AlphaSparma1.apk
Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]

C:\>adb install -r evil-AlphaSparma2.apk
733 KB/s (3253691 bytes in 4.329s)
pkg: /data/local/tmp/evil-AlphaSparma2.apk
Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]

C:\>adb install -r evil-AlphaSparma3.apk
800 KB/s (3253061 bytes in 3.966s)
pkg: /data/local/tmp/evil-AlphaSparma3.apk
Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]

C:\>adb install -r evil-AlphaSparma4.apk
736 KB/s (2358856 bytes in 3.129s)
pkg: /data/local/tmp/evil-AlphaSparma4.apk
Failure [INSTALL_FAILED_INVALID_APK]

C:\>adb install -r evil-AlphaSparma5.apk
788 KB/s (2331785 bytes in 2.888s)
pkg: /data/local/tmp/evil-AlphaSparma5.apk
Failure [INSTALL_FAILED_INVALID_APK]

see logcat2.txt
[Connected Car] gekkekoe123:
Ok since we know which kernel it runs, there should be a lot of easier way to root this stuff.

Unzip the attached zip file. find a writeable folder ( /data /tmp I assume /data/local in this case)

adb push run_root_shell /data/local
adb shell chmod 777 /data/local/run_root_shell
adb shell /data/local/run_root_shell

If you're getting a shell, type

id

and verify that we have root. Download copy of su ( http://cache.saurik.com/android/glass/su ) and put them on the device.

in new window copy su to device:
adb push su /data/local/su

in the root shell:
mount -o remount,rw /system
cp /data/local/su /system/xbin/.
chmod 6755 /system/xbin/su

next time you simply can do su from the command line to get root.

If it doesn't work, we can try different exploit. Also we can use libframa.so and invoke the exploit methods directy.

Much easier than crafting this frustrating apk.
[Connected Car] gekkekoe123:
Thanks for trying ! ok easy mode failed ;)

let me find another suitable exploit.

Try this one ? http://xdaforums.com/showthread.php?t=2333566

I might have done something wrong when compiling.

I need to extract the adresses from the zimage file. So I assuming you're using the official SCT firmware linked on the first page.

perf_event_open exploit does not work if the kernel version is prior to 2.6.38.

damn, we're running an to old version of the kernel ...

Need to find another exploit.

[edit]

Ok found one that should work on 2.6.35

try one the attached binary. Same commands, replace run_root_shell with the new executable.
[Connected Car] xadax:
Attempt fb mem exploit...
[1] Segmentation fault (core dumped) ./break_setresuid

core file attached.

Also tried

DooMLoRD_Easy-Rooting-Toolkit_v17_perf-event-exploit

and

DooMLoRD_v4_ROOT-zergRush-busybox-su

Went both through the works (after replacing ADB), no success (see logs).

SuperOneClickv2.3.3 also (after ADB replacement), no luck, hangs in step #7.
[Connected Car] xadax:
I am using the 'Europe - 1.47.88' version.
[Connected Car] gekkekoe123:
Attempt fb mem exploit...

[1] Segmentation fault (core dumped) ./break_setresuid

is it possible to post the core file ?

We probably need to find the adresses in the zimage. That's something that will take time.

hang on :)

you could also try to do it yourself with help of : https://github.com/android-rooting-tools/helper_tools
[Connected Car] UlfO:
Wifi hotspot

Hi, im looking for a way to always have the hotspot enabled. can this be done and how?

Regards UO
[Connected Car] RichieB:
The hotspot can be turned on in the SCT settings menu. I searched for shortcut apps to do it with one click but none of them worked.
[Connected Car] psylosg:
I've put the sensus connected touch. Generally do not experience a problem . I want to ask if you can increase the internal storage?? .

Thanks in advance for the help and a big thank you for the total effort.
[Connected Car] RichieB:
No, there is no way to increase the internal SCT storage.
[Connected Car] psylosg:
thasnks, There are other ways to download apps when the memory is full
[Connected Car] RichieB:
Move some apps to the SD card.
[Connected Car] Sanjaskom:
about EU or non_EU editions

Hi guys!

FIY:

no difference between EU or NON_EU versions (31414605 vs 31414606)!

I checked it myself, I got the South American version of the kit (31414606), installed and flashed it.

Everything works cool and there are no differences! :good:

(maybe there are differences in applications but I'm not interested, I'm going to put other programs)

Thanks to the creators of this theme and support :cool:
[Connected Car] tamernbl:
Drive safety screen

After I installed one program the drive safety black screen appeared then I pressed rewhitelist.sh script once nothing happened so I pressed it another time after I rebooted the black screen appears with every appliction I tried many steps without success

1 press the rewhitelist.sh script and reboot

2 lock file appear in system etc folder so I deleted it via ex file explorer then pressed rewhitelist.sh and reboot without success

3 I force stop rewhitelist.sh and deleted its data from application manager and pressed t the application script without and rebooted without sucsess

4 I deleted all whitelist.XML files in etc system folder and pressed the script and open the whitelist file ensured that it contain all my applications and rebooted but still no success

5 via terminal emulator after su then rewhitelist.sh give invalid file header

So any solution?
[Connected Car] tamernbl:
How to return packages.XML to its original place

I tried to install astroid parrot media player so I edited the package.XML file in data/system after copying original to root of SD card also I renamed it in data/system to package.XML.back then transfered edit file to data/system but it seems to be corrupted from editing so after reboot no luncher or any application is available and every proccess has stopped unexpectedly however I can connect via same network by PC started menu4 connected successfully tried to install adw luncher again by putting apk in app folder without spaces in its name but installation fail giving message failure same application exist so any way to return original packages.XML file from root of SD card to data/system folder to overwrite the present corrupted file
[Connected Car] RichieB:
I don't understand your question. Just copy the file using the adb shell. If it doesn't work, what error messages are you seeing exactly?
[Connected Car] hayatesan:
Do you guys keep using your SCT ? I haven't been using it the past few months (after a re-install). Being limited to Android 2.3 is quite a *****, I mostly wanted to use Waze on it, but running the latest versions is impossible and the user experience using my phone is far superior... I can run old versions of Waze on it, but after a few days/weeks it gets buggy and I have to reinstall it. Spotify's interface is lacking so many features, the only app that works well is TuneIn, but I mostly lisent to podcasts now...

So I'm wondering, am I the only one who completely stopped using his SCT ? I paid 1.800€ or so for the upgrade when I got my Volvo (including 200€ or so for iGo, what a joke... :mad: ), I'm quite regretting this decision, I only used it a couple of months before giving up on it.
[Connected Car] RichieB:
I never had a multimedia system in my car that could play MP3 including album covers, Spotify, TuneIn and TomTom. So I am still very pleased with it. I'm using it only for Tomtom now though. For music I switched to my phone over Bleutooth mainly because Spotify on the SCT can't remember to start playing where I left off last time.
[Connected Car] UlfO:
No sound at all

Hi all.

i have for some reason no sound when using my rooted SCT. It has been working perfectly but now no sound, i tested spotify, tunnel and waze and quiet.

the last think i put in my SCT was some ap the remap keys, because the steering whel keys (left and right) stopped working. That app is deleted and in some way all keys now are working but no sound.

what to check you think?

Regarsds UO
[Connected Car] nfshp253:
Hi, my Google Play Store has suddenly stopped working. At first it was just quitting by itself every time I launched the app, but I went ahead to reinstall it. After that, now it just opens to a server error page. I tried clearing cache and data for Google Market, Google Framework, Google Play Services and even the Download Manager but to no avail. I reinstalled Google Play Services and the Market but still the same error. I tried to use Market Helper to verify that I have all the settings as stock but it gives me a 'Android ID not found' error. Does anyone have a fix for this?
[Connected Car] UlfO:
Factory Reset

Hi.

i have this no audio on my rooted SCT and thought i would do a reset of system, I put in the USB with the orginal software but this did not result in a factory reset. all my login, and searches i have done is still there, How to do a total reset of the SCT?

Regards UO
[Connected Car] RichieB:
Downgrading to a lower firmware version erases everything. There might also be a factory reset option somewhere.
[Connected Car] im_humble:
Well, im realy disapointet on SCT. Did expect more from Volvo. Hardly no apps. Im just googleling to find out what happened to Spotify, i cant search anymore. I havent rooted or anything. Think i dont have enough knowledge to to that.
[Connected Car] im_humble:
I have now rooted my SCT,, It was very easy thats to the "how to" at the first post - realy thanks!

But,, i have search in the search field and havnt found the answer. I cant get market to work, it only comes a text "com.android.vending has stopped",, i have download new apk for google play but its still market and doesnt work.

I seach the web and found that i should delite the data folder for vending. But its still the same.

Any suggestions? Thanks on behalf :)

ps installed Waze throu my pc, works like a charm!! :D