yashsingh1/xdaforums huggingface dataset:
[Connected Car] RichieB:
"install_non_market_apps" is set to 1 in the "secure" table. There is no "package_verifier_enable" in either the "system" or "secure" table.

I set ro.parrot.install.allow-all=false in build.prop and did a #reboot#, but this didn't change anything significantly in settings.db. Just 'accelerometer_rotation', 'gps_last_known_*' and 'voice_recognition_service'. It did disable all non-parrot APKs except the Google Play Store app. So the certificate that Google used to sign the com.android.vending.apk is still allowed. This makes sense because I guess more parts of Android are signed with this certificate.

An interesting setting in settings.db is "asteroid_start_player_at_first_start" in the "system" table. It was set to 0 on my SCT, but toggling to 1 didn't change anything on #reboot#.

otacerts.zip only contains testkey.x509.pem which contains (in pem format):

Certificate:
Data:
Version: 3 (0x2)
Serial Number: 17509477602984357062 (0xf2fe291c588a6cc6)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=FR, ST=Idf, L=Paris, O=Parrot, OU=OEM, CN=Parrot/emailAddress=parrot@parrot.com
Validity
Not Before: Oct 4 09:19:08 2012 GMT
Not After : Jan 15 02:50:52 1904 GMT
Subject: C=FR, ST=Idf, L=Paris, O=Parrot, OU=OEM, CN=Parrot/emailAddress=parrot@parrot.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)

There is also something interesting in /system/etc/security/parrot:

# find /system/etc/security/parrot
/system/etc/security/parrot
/system/etc/security/parrot/accepted_public_keys
/system/etc/security/parrot/accepted_public_keys/afm_fc6100_volvo.der
/system/etc/security/parrot/accepted_certificates
/system/etc/security/parrot/accepted_certificates/.ignore

afm_fc6100_volvo.der seems to be just a key (in der format), not a certificate:

$ openssl asn1parse -inform der -in afm_fc6100_volvo.der
0:d=0 hl=3 l= 157 cons: SEQUENCE
3:d=1 hl=2 l= 13 cons: SEQUENCE
5:d=2 hl=2 l= 9 prim: OBJECT :rsaEncryption
16:d=2 hl=2 l= 0 prim: NULL
18:d=1 hl=3 l= 139 prim: BIT STRING
[Connected Car] gekkekoe123:
guys....

I actually looked inside the package manager, nothing is changed, that property is still being read..

and the code to do unverified install are still in place.

So only way for it to fail is if a reboot did not happen, since the contents are read during boot.

I could not imagine that they would cripple the package manager but left the root hole open...
[Connected Car] RichieB:
[MENTION=2984707]gekkekoe123[/MENTION]: thanks. I was just going to check the same. I trust your review, since you actually know what you are doing on Android. ;)
[Connected Car] dongwenxuan:
I am trying to run strace but I think first I need to "download the lastest binary from this post , move it to /system/bin and set permissions to 755 "?

Otherwise it's showing "strace: not found"

How to achieve this step?

Thanks
[Connected Car] donaldta:
If you had used the menu.bat file there should be a script called, "remount.sh" which can be used to remount the system directory via "remount.sh system-rw". You can then copy the file into the directory however you see fit and "chmod 755 /system/xbin/strace" to change its permissions.
[Connected Car] dongwenxuan:
So should I do as followed?

bin\adb push strace /data/local/tmp/
bin\adb shell su -c 'chmod 755 /data/local/tmp/strace'
bin\adb shell su -c '/data/local/tmp/strace system-rw feedback
bin\adb shell su -c 'cp /data/local/tmp/strace /system/xbin/.
bin\adb shell su -c 'ls -l /system/xbin/strace'
bin\adb shell su -c 'rm /data/local/tmp/strace'

Then run strace?

---------- Post added at 08:05 PM ---------- Previous post was at 07:36 PM ----------

Here's what I got after running strace (maybe i didn't install strace properly?)

strace -fo /mnt/sdcard/log.txt pm install ESFileExplorer.apk

strace: exec: Exec format error
[Connected Car] donaldta:
Made a slight change above. Btw, when you applied the "ro.parrot.install.allow-all" had you rebooted the SCT since then? [MENTION=2984707]gekkekoe123[/MENTION] has pointed out that the value is still being parsed. Maybe check from within a terminal app on the SCT if "getprop ro.parrot.install.allow-all" provides a "true" response.

Interesting. I didn't think your system had a problem with installing apps from Google Play. I thought we were only checking the values at this point. But, you do bring up a good point if the values need to be changed. I think if we had to change it manually that we could provide the sqlite binary for Android and a shell script to make the manual change.

Well... considering that Texas Instrument has end of life the support for OMAP3 processors, the drivers haven't been updated. That's why the exploit still works.

Interesting, I went ahead and decompiled all the jar files from /system/framework and did notice that there wasn't any changes to the pm.jar file despite the changes to the binary according to diff. Interesting enough I did see both pm.jar and am.jar reference it via, '.field private static final SYSTEM_PROPERTY_ALLOW_ALL_PACKAGES_INSTALL:Ljava/lang/String; = "ro.parrot.install.allow-all"', in both versions.

Just in case this property is no longer a valid build.prop entry, how difficult would it be to modify the pm.jar file so that the installation proceeds regardless of the "ro.parrot.install.allow-all" setting?
[Connected Car] RichieB:
You are right, I don't have this problem, but I already know two users that upgraded and seem to have issues installing apps.

An sqlite binary with simple SQL script would indeed be the easiest, good thinking.
[Connected Car] donaldta:
What is the output of just "strace" and the output of just "pm install ESFileExplorer.apk"?

Btw, did you manage to check if you had rebooted the SCT since and the output of "getprop ro.parrot.install.allow-all"?

---------- Post added at 02:32 PM ---------- Previous post was at 01:44 PM ----------

Btw, I tested this out on my Nexus 4. Apparently, strace doesn't fully work for package manager. It does output a file but it is not in any way helpful.

root@mako:/mnt/sdcard/backups/apps # [COLOR="RoyalBlue"]strace -fo /mnt/sdcard/install.txt pm install iTPMSystem_3.3.0.apk[/COLOR]
strace: exec: Exec format error
root@mako:/mnt/sdcard/backups/apps # [COLOR="RoyalBlue"][B]cat /mnt/sdcard/install.txt[/B][/COLOR]
29674 execve("/system/bin/pm", ["pm", "install", "iTPMSystem_3.3.0.apk"], [/* 24 vars */]) = -1 ENOEXEC (Exec format error)
29674 write(2, "strace: exec: Exec format error\n", 32) = 32
29674 exit_group(1) = ?
29674 +++ exited with 1 +++
root@mako:/mnt/sdcard/backups/apps #
[Connected Car] dongwenxuan:
I did reboot.

So strace won't help us resolve this issue for now?

Any idea about our next move?
[Connected Car] donaldta:
I'm going to have to figure out why it didn't work.

Can you provide the output of "getprop ro.parrot.install.allow-all" and "grep ro.parrot.install.allow-all /system/build.prop" from a terminal on the SCT?
[Connected Car] dongwenxuan:
For now I don't have a terminal app on SCT, cause I can't install one. Any other way to get this result?
[Connected Car] donaldta:
Sure, you can also get the information from "adb shell" instead of a terminal app.
[Connected Car] donaldta:
While looking at viable alternatives, I compared the pm.jar file from the Asteroid Smart with the recent versions for the SCT. The interesting thing about this jarfile is that it decompiles exactly the same as the others for the SCT. Apparently, in my haste to accept your response as the truth, I had misread the GUI tools that I had used to index the changes. However using the command line tool, has shed a little light on the matter. As, pm.jar does not query the property of "ro.parrot.install.allow-all" at all.

$ [B][COLOR="RoyalBlue"]grep -r ro.parrot.install.allow-all *[/COLOR][/B]
services.147/com/android/server/PackageManagerService.smali:.field private static final SYSTEM_PROPERTY_ALLOW_ALL_PACKAGES_INSTALL:Ljava/lang/String; = "ro.parrot.install.allow-all"
services.147/com/android/server/PackageManagerService.smali: const-string v5, "ro.parrot.install.allow-all"
services.149/com/android/server/PackageManagerService.smali:.field private static final SYSTEM_PROPERTY_ALLOW_ALL_PACKAGES_INSTALL:Ljava/lang/String; = "ro.parrot.install.allow-all"
services.149/com/android/server/PackageManagerService.smali: const-string v5, "ro.parrot.install.allow-all"
$

It turns out the PackageManagerService.smali from within the services.jar parses it or at least appear to.

I'm not at all good at reading or altering Dalvik code. So, perhaps either you or [MENTION=798814]RichieB[/MENTION] can alter the "SCT/v1.49.34/FileSystem/system/framework/services.jar:/com/android/server/PackageManagerService.smali" class so that "ro.parrot.install.allow-all" is always interpreted as "true" as opposed to the actual settings.
[Connected Car] RichieB:
It helps to look at the decompiled java code:

this.mAllowUnverifiedPackageInstall = true;
if (!SystemProperties.getBoolean("ro.parrot.install.allow-all", true))
this.mAllowUnverifiedPackageInstall = false;

This suggests that the default value (if the property ro.parrot.install.allow-all cannot be found) is true. Are we sure this is the problem? Anyway in the smali changing this line

if-nez v5, |cond_15e

to

goto |cond_15e

should jump over "this.mAllowUnverifiedPackageInstall = false" every time.
[Connected Car] RichieB:
The new SCT firmware is announced with an icon in the taskbar. This annoys me. Logcat shows me the URL checked:

I/OTAChecker( 2352): try number:0 execute:http://download.parrot.com/Asteroid_Series_soft_update/update.php?getversion&product=ACU+Volvo&zone=EU&serialNo=xxxxxx&version=1.47.88

So I think this will fix it:

echo "127.0.0.1 download.parrot.com" >> /system/etc/hosts

It might break some other stuff, but if it does I don't think I'll care.
[Connected Car] donaldta:
I'm not sure actually, [MENTION=2873230]dongwenxuan[/MENTION] has yet to come back with the results of my last question.

Have you "re"compiled a copy and tested it yet? Or is this theoretical based on a previous version? Maybe you can provide a copy for someone to test it.

I've include an unmodified copy of the service.jar file from 1.49.34 for you. Not sure if you had managed to recompile [MENTION=5191839]loveshackdave[/MENTION]'s plftool for any of the computers that you have access to.
[Connected Car] RichieB:
I have had a pm conversation with a second user that confirms he cannot install APKs with the latest firmware. I asked him to provide the output of the getprop and grep commands..

I just made the change to the services.jar from 1.49.34 and recompiled it. Didn't test it yet though.

I used Windows 7 in VMWare.. seemed easier than to mess with C# on OS X.
[Connected Car] dongwenxuan:
If this is what you asked?

$ su
su
# getprop ro.parrot.install.allow-all
getprop ro.parrot.install.allow-all
false
# grep ro.parrot.install.allow-all /system/build.prop
grep ro.parrot.install.allow-all /system/build.prop
ro.parrot.install.allow-all=true
[Connected Car] RichieB:
Yes, thanks. It seems the property is no longer read from build.prop. [MENTION=2984707]gekkekoe123[/MENTION]: can you figure out where it is set now?

My modified services.jar should fix this though. Copy it to /system/framework/ and reboot. With any luck that should do it.

A little warning though: I didn't (can't really) test this jar. It might break stuff.
[Connected Car] donaldta:
Yes, that is exactly what I was looking for. Provided you had restarted the SCT since that entry in the /system/build.prop file was added, it seems that this entry is either being ignored or is reset after it is set by that file. I'm not sure if there is a /data/local.prop file but can you try adding "ro.parrot.install.allow-all=true" to it?

You should be able to use the following method, similar as you've done above. If the file does not exist, these commands will create it with only the one line.

$ [B][COLOR="RoyalBlue"]su[/COLOR][/B]
# [COLOR="RoyalBlue"][B]echo "ro.parrot.install.allow-all=true" >> /data/local.prop[/B][/COLOR]
# [B][COLOR="RoyalBlue"]cat /data/local.prop[/COLOR][/B] [COLOR="Silver"]# to make sure it has been added[/COLOR]
[COLOR="Silver"]{some output}[/COLOR]
# [COLOR="RoyalBlue"][B]reboot[/B][/COLOR] [COLOR="Silver"]# to allow the changes to apply[/COLOR]

The /data/default.prop is the last .prop file for the system properties to get parsed. So, hopefully, adding it here will allow the settings to remain. Otherwise if it doesn't, there's another process out there that's changing it. To check it, please do the "getprop ro.parrot.install.allow-all" again after it completes the reboot process.

If the aforementioned getprop command doesn't show the setting had kept "true" after the reboot then perhaps try the following commands.

$ [COLOR="RoyalBlue"][B]su[/B][/COLOR]
# [B][COLOR="RoyalBlue"]setprop ro.parrot.install.allow-all true[/COLOR][/B]
# [B][COLOR="RoyalBlue"]getprop ro.parrot.install.allow-all[/COLOR][/B] [COLOR="Silver"]# to check the change[/COLOR]
true[COLOR="Silver"][B]{false?}[/B][/COLOR]
# [B][COLOR="RoyalBlue"]pm install[/COLOR][/B] [COLOR="Silver"][B]{apk.name}[/B][/COLOR] [COLOR="Silver"]# to test the change
Success [COLOR="Silver"][B]{hopefully?}[/B][/COLOR][/COLOR]

If it does work then you might want to try [MENTION=798814]RichieB[/MENTION]'s replacement service.jar file so that you don't have to repeat it because the "setprop" is only temporary.
[Connected Car] mushroom62:
How to root SCT plf 1.49.34

Hi there all, today I tried to root my SCT using the tools at the beginning of this tread. I managed to get Google play store on it. However nothing seems to be installable after that. Unfortunatly I updated to 1.49.34 before rooting. Are these last messages in this thread meant to deal with this issue? I'am new to this by the way.
[Connected Car] RichieB:
Yes, absolutely. Try these suggestions of [MENTION=5389783]donaldta[/MENTION], and let us know the results. If everything [MENTION=5389783]donaldta[/MENTION] suggested fails, you can try to replace services.jar with the one I posted here, after doing a "adb shell":

su
remount.sh system-rw
mv /system/framework/services.jar /system/framework/services.jar.bak
cp /mnt/sdcard/services.jar /system/framework/
chmod 755 /system/framework/services.jar
reboot

This assumes my version of services.jar is on the sdcard, but you can also place it on the SCT using "adb push".
[Connected Car] gekkekoe123:
I did check that the property is used, so they are reading the files somewhere else. I didn't check for that.

It's nicer to find where they are hiding the prop file.

adjusting framework/services.jar is also easy, just disable the test for property. It's true by default, so disable it to be set after read.

but finding the prop is the way to go. Strace the command: getprop ro.parrot.install.allow-all
[Connected Car] RichieB:
Yup, I already did that.

I thought the properties were read only once during boot. So I guess "getprop" will just retrieve it from where it is stored temporarily? Where are the build.prop and local.prop usually read in the Android code? Did they have to modify the normal place to make it not read ro.parrot.install.allow-all from build.prop?
[Connected Car] gekkekoe123:
I made a slightly safer version ;)

It always write true, regardless of the tests. But your solution should work as well. Use mines if RichieB's doesnt work.

Mines does something like this:

this.mAllowUnverifiedPackageInstall = true;
if (!SystemProperties.getBoolean("ro.parrot.install.allow-all", true)) {
this.mAllowUnverifiedPackageInstall = true;
}

The user did set property to true, and rebooted. so it seems that they are hiding their **** elsewhere.
[Connected Car] RichieB:
To safe some people time, it looks like you just flipped the false to true in the conditional statement:

this.mAllowUnverifiedPackageInstall = true;
if (!SystemProperties.getBoolean("ro.parrot.install.allow-all", true))
this.mAllowUnverifiedPackageInstall = true;

or in smali:

const-string v5, "ro.parrot.install.allow-all"
const/4 v6, 0x1
invoke-static {v5, v6}, Landroid/os/SystemProperties;->getBoolean(Ljava/lang/String;Z)Z
move-result v5
if-nez v5, :cond_15e
.line 776
const/4 v5, 0x1
move v0, v5
move-object/from16 v1, p0
iput-boolean v0, v1, Lcom/android/server/PackageManagerService;->mAllowUnverifiedPackageInstall:Z

The const/4 v5 was 0x0 before (meaning false). Now it is 0x1 (meaning true). Nice job. I really should work on my smali (and assembly), this is a much better tweak.

Btw, your jar is missing the META-INF/MANIFEST.MF file. Will it still work without one?
[Connected Car] gekkekoe123:
oh yeah forgot that. put my classes.dex in the org services.jar using 7zip or winzip (compression to normal)

or use attached jar

I still interested in the strace of the getprop to see where they are hiding stuff
[Connected Car] donaldta:
Please be

extra

careful about the files you distribute for SCT. Remember not everyone whom reads XDA posts knows what they're doing. Also, the services.jar file is a core Android file which could cause bootloops if not altered appropriately. And since there is no known way to access the recovery bootloader to re-write the system image with a stock copy, this can result in a bricked system; requiring the unit to be swapped at the dealer and may not be covered under warranty.

I may not have the same level of knowledge of Android as gekkekoe123, whom by your admission "actually know what he's doing on Android". But, I can tell you that Android's system properties are initially set during init. By default, four files are parsed;

/default.prop

/system/build.prop

/system/default.prop

/data/local.prop

The /default.prop (if exists) is re-written from the boot partition to the root-fs ramdisk while the kernel loads. Each property from the four files are written into a shared memory block known as the "system properties store" and is made accessible through a unix domain socket serve named, "/dev/socket/property_service".

I suspect that they may moved the "ro.parrot.install.allow-all" property from /system/build.prop to /default.prop or that they have another process to alter the setting. But, what do I know? I don't have a SCT and apparently don't know what I am doing on Android. :p

Yes, it is. Maybe you, [MENTION=2873230]dongwenxuan[/MENTION] or anyone else with the 1.49.34 update installed can indulge me with a little assistance. I've included a copy of sqlite3 command for Android. Can you unzip the file and copy it into the directory of the adb command on your computer? I am assuming it is in wherever you unzipped the cmd-frama-menu.zip file. I'd like to verify the setting of "install_non_market_apps" in the settings database for this version. According to [MENTION=798814]RichieB[/MENTION] in Post #1249 they have this in the secure table, so if someone can be so kind to use the following commands.

C:\[COLOR="Silver"]{path\to\cmd-frama-menu\}[/COLOR]bin\> [B][COLOR="RoyalBlue"]adb push sqlite3 /data/local/tmp/[/COLOR][/B]
C:\[COLOR="Silver"]{path\to\cmd-frama-menu\}[/COLOR]bin\> [B][COLOR="RoyalBlue"]adb shell[/COLOR][/B]
$ [B][COLOR="RoyalBlue"]su[/COLOR][/B]
# [COLOR="RoyalBlue"][B]chmod 755 /data/local/tmp/sqlite3[/B][/COLOR]
# [COLOR="RoyalBlue"][B]/system/xbin/remount.sh system-rw[/B][/COLOR]
# [COLOR="RoyalBlue"][B]cp /data/local/tmp/sqlite3 /system/xbin/[/B][/COLOR]
# [COLOR="RoyalBlue"][B]ls -l /system/xbin/sqlite3[/B][/COLOR]
-rwxr-xr-x root root 376468 [COLOR="Silver"]{date} {time}[/COLOR] sqlite3
# [COLOR="RoyalBlue"][B]rm /data/local/tmp/sqlite3[/B][/COLOR]
# [B][COLOR="RoyalBlue"]sqlite3 /data/data/com.android.providers.settings/databases/settings.db "[/COLOR][COLOR="Red"]SELECT * FROM secure WHERE name = 'install_non_market_apps'[/COLOR][COLOR="RoyalBlue"]"[/B][/COLOR]
[COLOR="Silver"]{copy output into post}[/COLOR]
[Connected Car] dongwenxuan:
I've tried both ways you provided above. Here's the result:

$ su
su
# echo "ro.parrot.install.allow-all=true" >> /data/local.prop
echo "ro.parrot.install.allow-all=true" >> /data/local.prop
# cat /data/local.prop
cat /data/local.prop
ro.parrot.install.allow-all=true
# reboot
reboot

$ su
su
# getprop ro.parrot.install.allow-all
getprop ro.parrot.install.allow-all
false
# setprop ro.parrot.install.allow-all true
setprop ro.parrot.install.allow-all true
# getprop ro.parrot.install.allow-all
getprop ro.parrot.install.allow-all
false

I guess this doesn't work... I'll see if I can try the other way out.

---------- Post added at 04:25 AM ---------- Previous post was at 04:17 AM ----------

Here's the result:

3|install_non_market_apps|1
[Connected Car] donaldta:
:good: Excellent. Thanks for checking it for me. The output is separated by "|', where the first number is the "id", second value "name" and third is the "value". It is boolean output, so "install_non_market_apps" equals "yes" and this is the third pair in the secure tablespace. At least that is one less setting that needs to be modified.

Well, shoot. It was worth a try. I had pretty low expectations since the value was prefixed with "ro." which stands for read-only but you never know what sort of changes manufacturers do the Android distribution. Let's hope the replacement one of service.jar files that either [MENTION=798814]RichieB[/MENTION] or [MENTION=2984707]gekkekoe123[/MENTION] will bypass this roadblock.

P.s., for the sake of minimizing forum page space, can you please edit quotes to just the section that you're replying to? There's no need to quote an entire post if you're only replying to a small section of it. This forum has a method of merging subsequent posts from the same author if they are posted within a short period of time of each other.
[Connected Car] dongwenxuan:
I'll try service.jar file tomorrow.

Thanks
[Connected Car] gekkekoe123:
Donald is right. Be careful with system files. But since these are in the android layer, it should still boot and you still should be able to adb. But no guarantee. So be careful

The safest path is to find a way where we can set the property.

Btw did anyone tried to downgrade the firmware using usb? Because that might even be easier
[Connected Car] RichieB:
I know you know I never said or implied that. ;) I was comparing [MENTION=2984707]gekkekoe123[/MENTION] to myself, not you. Before I started modifying my SCT I only had some basic Android experience using my wife's phone. You know a lot more about Android than I do, and I continue to learn from your posts. Thanks!
[Connected Car] gekkekoe123:
Ok I found it. I did some reading on property file and handling. The first property file to be parsed is on the ramdisk.

So I unpacked the ramdisk and extracted the initrd. They added ro.parrot.install.allow-all=false to the default.prop file on the ramdisk.

Apparently there's an hierarchy, and we are not allowed to override this property with .prop lower in the hierarchy. Or the ro properties are readonly and cannot be overridden.

So we can mount the ramdisk and edit default.prop that should solve it. (you need to create a initrd and replace the initrd on the ramdisk. be VERY CAREFUL this WILL f*ck up the system if done incorrectly)

Since we have root we can override ro properties. here's a utility that does it already :)

http://xdaforums.com/showthread.php?t=1201657

I have another idea if this does not work, but that's kind of a hassle. I think we should concentrate on mounting the ramdisk as RW and edit the default.prop (either remove it so that you can override it with your build.prop or set it to true.)

Since we're root, we can also patch this memory region if we cannot modify default.prop but I think that should not be the problem.

Replacing the jar files will also probably work as last resort.
[Connected Car] RichieB:
Excellent, thanks!

I suppose the ramdisk is the same for every SCT? So can't you create a patched ramdisk and write instructions on how to install it? Or tell me where the ramdisk is on the SCT (and plf) and I'll have a look myself.

Screwing with the ramdisk sounds more dangerous to me than replacing services.jar. As you said yourself: screw up the ramdisk, and you probably brick your SCT. Screw up services.jar and you will probably still be able to fix it using adb.