yashsingh1/xdaforums huggingface dataset:
[Security Discussion] cernekee:
Thanks for the pointer. It led me to this commit.

However, there is a difference between my platform (Nexus 7 2012) and their platform: they implement struct wifi_platform_data->get_mac_addr(). On the N7, dhd_custom_get_mac_address() returns -EOPNOTSUPP, so it goes off and queries the hardware for the MAC address:

#ifdef GET_CUSTOM_MAC_ENABLE
ret = dhd_custom_get_mac_address(ea_addr.octet);
if (!ret) {
memset(buf, 0, sizeof(buf));
bcm_mkiovar("cur_etheraddr", (void *)&ea_addr, ETHER_ADDR_LEN, buf, sizeof(buf));
ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
if (ret < 0) {
DHD_ERROR(("%s: can't set custom MAC address , error=%d\n", __FUNCTION__, ret));
return BCME_NOTUP;
}
memcpy(dhd->mac.octet, ea_addr.octet, ETHER_ADDR_LEN);
} else {
#endif /* GET_CUSTOM_MAC_ENABLE */
/* Get the default device MAC address directly from firmware */
memset(buf, 0, sizeof(buf));
bcm_mkiovar("cur_etheraddr", 0, 0, buf, sizeof(buf));
if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf),
FALSE, 0)) < 0) {
DHD_ERROR(("%s: can't get MAC address , error=%d\n", __FUNCTION__, ret));
return BCME_NOTUP;
}
/* Update public MAC address after reading from Firmware */
[b]memcpy(dhd->mac.octet, buf, ETHER_ADDR_LEN);[/b]
#ifdef GET_CUSTOM_MAC_ENABLE
}
#endif /* GET_CUSTOM_MAC_ENABLE */

Adding printk()s to debug, the first time I see my real hardware address is at the memcpy(). Maybe this is set by the bootloader, or stored in an EEPROM, or something. Unfortunately I didn't see "cur_etheraddr" anywhere else in AOSP.

Another complicating factor: this function (dhd_preinit_ioctls()) runs every time the wlan0 device is opened. wpa_supplicant does the equivalent of an "ifconfig wlan0 up" when it starts. bcmdhd will accept a new MAC address when the interface is already up, but if you change the address while the interface is down, it will be reset back to the original address when it comes back up again. This is the opposite of most standard Linux network drivers.

A consequence of this quirk is that if the user does not check "Scanning always available", which keeps wpa_supplicant running in the background even when wifi is disabled, there is a race between Pry-Fi and wpa_supplicant. wpa_supplicant usually wins the race, leaking the device's true MAC address once before Pry-Fi kicks in.

I suspect that leaving the interface up all of the time will have a noticeable effect on battery life. And while users probably do not disable/enable wifi by hand too often, they might run other utilities that do so, expanding the window of vulnerability.

A more effective technique could involve hooking something like wpa_driver_nl80211_init() in wpa_supplicant so that it tries changing the MAC address before and after bringing up the interface (to cover both types of drivers).

Edit:

Setting wl->active_scan to false doesn't affect the result, nor does invoking "wldev_ioctl(dev, WLC_SET_PASSIVE_SCAN, &ps, sizeof(ps), 1)" with ps = 1 from wl_android.c.

wl_iw.c doesn't even get compiled into the kernel, so those ioctls probably won't help either.
[Security Discussion] kenshin33:
custom_get_mac_address doesnt'seem to do much

from grouper's :

int
dhd_custom_get_mac_address(unsigned char *buf)
{
int ret = 0;

WL_TRACE(("%s Enter\n", __FUNCTION__));
if (!buf)
return -EINVAL;

/* Customer access to MAC address stored outside of DHD driver */
#if defined(CUSTOMER_HW2) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
ret = wifi_get_mac_addr(buf);
#endif

#ifdef EXAMPLE_GET_MAC
/* EXAMPLE code */
{
struct ether_addr ea_example = {{0x00, 0x11, 0x22, 0x33, 0x44, 0xFF}};
bcopy((char *)&ea_example, buf, sizeof(struct ether_addr));
}
#endif /* EXAMPLE_GET_MAC */

return ret;
}

wifi_get_mac_addr(buf);

si an external function defined in wl_android.c

#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
int wifi_get_mac_addr(unsigned char *buf)
{
DHD_ERROR(("%s\n", __FUNCTION__));
if (!buf)
return -EINVAL;
if (wifi_control_data && wifi_control_data->get_mac_addr) {
return wifi_control_data->get_mac_addr(buf);
}
return -EOPNOTSUPP;
}
#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)) */

as you can see it puts something in buf and returns -EOPNOTSUPP; no matter what.

the actual changing if possible is done with what''s inside the if

without recompiling the kernel try it ou with dhdutil

int
_dhd_set_mac_address(dhd_info_t *dhd, int ifidx, struct ether_addr *addr)
{
char buf[32];
wl_ioctl_t ioc;
int ret;

if (!bcm_mkiovar("cur_etheraddr", (char*)addr, ETHER_ADDR_LEN, buf, 32)) {
DHD_ERROR(("%s: mkiovar failed for cur_etheraddr\n", dhd_ifname(&dhd->pub, ifidx)));
return -1;
}
memset(&ioc, 0, sizeof(ioc));
ioc.cmd = WLC_SET_VAR;
ioc.buf = buf;
ioc.len = 32;
ioc.set = TRUE;

ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
if (ret < 0) {
DHD_ERROR(("%s: set cur_etheraddr failed\n", dhd_ifname(&dhd->pub, ifidx)));
} else {
memcpy(dhd->iflist[ifidx]->net->dev_addr, addr, ETHER_ADDR_LEN);
memcpy(dhd->pub.mac.octet, addr, ETHER_ADDR_LEN);
}

return ret;
}

that's from dhd_linux.c (under hardware/broadcom/ .... )

may be there's a way to do so with dhdutil (don't remeber all the possible things and both phone and tablet are far away )

EDIT : no dhdutil doesn't seem to have that !

the ioctl seems to end up here :

int

dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len)

in dhd_cdc.c
[Security Discussion] cernekee:
On tuna this should set the random (or not-so-random) MAC from rand_mac, then return 0:

https://github.com/CyanogenMod/andr...7e/arch/arm/mach-omap2/board-tuna-wifi.c#L288

But Tegra doesn't implement the get_mac_addr() callback, so bcmdhd will fall through to the -EOPNOTSUPP case and then query the firmware:

https://android.googlesource.com/ke...mr2/arch/arm/mach-tegra/board-grouper-sdhci.c
[Security Discussion] kenshin33:
you can may be copy it ?

(it doesn;t seem to do much except filling a buffer with data)

(as does the one from LGE msm for hammerhead, but reads from a file in /persiste/wifi/)
[Security Discussion] Chainfire:
The background scan intervals are determined by these security settings (http://androidxref.com/4.4.2_r1/xref/frameworks/base/core/java/android/provider/Settings.java):

wifi_supplicant_scan_interval_ms

wifi_framework_scan_interval_ms

which in turn are sourced from these config values:

config_wifi_supplicant_scan_interval (15000 in AOSP)

config_wifi_framework_scan_interval (300000 in AOSP)

Inside the settings activity, it is determined by the WIFI_RESCAN_INTERVAL_MS field which is 10000 by default in AOSP (http://androidxref.com/4.4.2_r1/xre...ifi/WifiSettings.java#WIFI_RESCAN_INTERVAL_MS)

I didn't see you mention this anywhere else, but the above doesn't appear to be entirely true, or is incomplete. On my test devices, there aren't any networks at all with scan_ssid=1, yet my MBA running Wireshark 24/7 (finally a use for a Mac) regularly intercepts the list of SSIDs (if Pry-Fi is not enabled). Certainly not as often as normal scans, but they're definitely still broadcast.

If you could quickly re-hash why there is no extra security in disabling SSID broadcasts, without having to review the entire Vivek video series, that'd be great.

It's not a security app, it's a privacy app, and you can't do this on a non-custom firmware without root, so I don't really see the point about complaining that its a security app that runs as root - most apps that do anything significant security or privacy wise do (requiring a framework/system modification and then not requesting root access is not an excuse, you still need root access for this at some point).

As for strange interactions, as documented, this is caused by the app having to change Wi-Fi states to let the MAC changes work. If it works as (currently) intended all you'd see is Wi-Fi going off/on again rapidly once or twice, and only if you are watching the settings->wifi screen. If anything else weird is going on, feel free to elaborate.

Have you actually reviewed this (and solutions like this) ? Do they even turn Wi-Fi fully off, including the background scanning ? AFAIK that's not possible without leveraging some form of root or system modification. And if it does uses that, it should be listed as a con because its a "security" app that runs as root. If it's a con for one app...

Also I would like to list as an additional con that this (fairly dramatically) reduces location determination speed and accuracy for location-based apps, which may or may not be an issue for the user.
[Security Discussion] Chainfire:
FYI, I feel releasing source at this point is premature. I'm not really trying to hide anything here. If you really want the source right now I'll even give it to you (cernekee)

However, a lot of devices work in a slightly different way, and I wanted to get it out there to see how it would work out. After a lot of feedback, test versions, releases, etc (even though its only been 3 days) I feel a part of the core logic may need to be redesigned to incorporate the new knowledge (some even from this thread) to make it work better.

What I specifically don't want is a dozen or so source happy OSS zealots jumping on it, declaring which parts are ****, doing a dozen forks that aren't compatible with each-other, fixing one device and breaking another, the whole circus. I'd rather it's at least semi-stable before everybody goes running off with it. And I don't need everybody looking over my shoulder or explaining/debating every line of code thrice while re-doing half the core.

Patience... also because now its no longer weekend and I have contract work to do aside from this.

Also, if one were to incorporate this into a custom firmware, I would use a very different methods than I did in Pry-Fi. I might actually be committing those changes to Omni, but I can't do everything at once.
[Security Discussion] banderos101:
i think the main concern with many folks, as you just pointed out, is the idea of a root app and no way to review code, but thats not to pick on anyone in particular, its anyone and everyone, even cadilacs amongst men such as youself chainfire:) ....... its just a general thinking, sometimes folks like myself will sacrafice that concern if app/author usability outweighs that concern, so something like open source would alleviate that somewhat.......

im glad to hear the reason and your thoughts on this, happy to see where you are hoping to take it
[Security Discussion] kenshin33:
http://www.howtogeek.com/howto/2865...hiding-your-wireless-ssid-really-more-secure/

I use LLAMA to disable wifi when not home or at the university b/c of battery and also I don;t really trust wifi hotspots out there, if there's a malicious one out there you PNL and mac address are the least of your concernes (especially the "OK/CONTINUE" trigger happy users).

GPS locks fairly quicly most of the time, if not I enable wifi at that point just to get a fix quicker, (the only time I really need it is for bus schedules, -- any other extended --navigation-- use will need very high acuracy and GPS should be on, so no need to drain the battry more with wifi), but that's just me.

As for a solution, finding a way to enable passive scan mode would be great, and sould solve the leak, no root not fiddeling needed (passive mode don;t send beacons, just listen to beacons sent out by AP, and for the life of me I don;t understand why would a client sned a beacon while the AP is expected to?)

Random : see what cm did with tuna kernel (random but not so random)

just my 2 cents

Also there's ap_scan variable in wpa_supplicant, not sure what it does but it have some influance.
[Security Discussion] cernekee:
I could copy the code that populates the MAC address, and omit the parts that calculate it from the OMAP chip ID. But that doesn't tell me where my unique N7 WLAN-firmware-supplied MAC address actually came from.

I'll have to do some more research here...

Are you seeing any of these messages in logcat: "Scan SSID", "Starting AP scan for specific SSID:", or "Include wildcard SSID in the scan request"?

Are there real AP names in the request, or just P2P names?

The code in wpa_supplicant_scan() which writes out the list of SSIDs to pass to the driver via params.ssids is:

while (ssid) {
if (!wpas_network_disabled(wpa_s, ssid) [b]&&[/b]
[b]ssid->scan_ssid[/b]) {
wpa_hexdump_ascii(MSG_DEBUG, "Scan SSID",
ssid->ssid, ssid->ssid_len);
params.ssids[params.num_ssids].ssid =
ssid->ssid;
params.ssids[params.num_ssids].ssid_len =
ssid->ssid_len;
params.num_ssids++;
if (params.num_ssids + 1 >= max_ssids)
break;
}
ssid = ssid->next;
if (ssid == start)
break;
if (ssid == NULL && max_ssids > 1 &&
start != wpa_s->conf->ssid)
ssid = wpa_s->conf->ssid;
}

In my tests, the logic did work as expected. Some factors that may account for variations could include:

Android version and/or wpa_supplicant version: 4.2.2 and wpa_supplicant_8 v2.0-devel-4.2.2

OS: CM/AOSP, no Samsung

Drivers: bcmdhd in the kernel, and nl80211 in wpa_supplicant

Observation time (not 24/7 here), and on-demand scans vs. scheduled scans

While disabling SSID broadcasts takes the string out of the beacon, it still appears in the association requests. So there are two easy ways to expose the SSID of a hidden network:

Run airodump-ng, or the equivalent point-and-click GUI tool, and just passively wait around for a client to (re)associate. Then the name will pop up on the screen.

Use "aireplay-ng --deauth" to kick one STA (unicast) or all STAs (broadcast) off the network. Most will reassociate, leaking the SSID name.

Also, from what I've seen, hiding the SSID doesn't consistently turn off the beacons; it just sends an empty SSID field. So the AP is still broadcasting its presence + BSSID.

I ran into the "forget network" caveat earlier. It would be nice to make this more seamless.

Agreed - that is one reason I started a separate thread to discuss options.

Personally I don't mind hacking my ROM if it results in a cleaner, but less generic, solution.

banderos101 pretty much covered this. No issue with running as root, as long as it's easy to see (and change) how it all works.

Security- and privacy- conscious individuals tend to get a little control-freaky about what they're running on their systems:

In security/privacy/crypto circles, that is usually a feature not a bug. ;)
[Security Discussion] kenshin33:
The function as it is just populates the mac in a buffer, if it has to fail it will fail later , while "setting it", Unfortunatly I can't test it out (my grouper has a broken screen, flo/hammerhead should, so no point in testing).
[Security Discussion] Chainfire:
I'll see if I can correlate the timings of the logcat messages with the scans

FWIW, I've done the main testing on a stock+root Nexus 5 @ 4.4.2. This is the one broadcasting all the SSIDs. I think I recall seeing it on my Samsung test devices as well, but I'd have to test again to be 100%.

Ah this is a misscommunication then. I thought we were talking about the added security of not broadcasting every SSID your device has ever heard of, not of the practise of making an AP hidden.

Hence the manage networks option inside the app (which still also doesn't work half the time) ... This definitely needs some work.

Agreed. That's not my own primary aim though. The stock+root crowd is factors larger than the custom ROM crowd, so they come first to me.

For Pry-Fi itself I think a large chunk of weirdness can be covered by moving a part of code to use wpa_cli commands instead. But first I have to test how well that even works cross-OEM. That alone will take a few days, even before implementing anything. So many devices - and at least Samsung modifies wpa_supplicant.

I know, but passive aggressive statements and generally being more naggish than a pack of wild Jehovah's Witnesses got tiring a few decades ago - I can't possibly reward that behavior.

You are undoubtedly used to working with a different class of coders than I am. If I had a dollar for every pages-long criticism based on not actually reading the code, or vague assumptions made without actually reading the code, or trivial questions that could be answered simply by reading the code, or in-depth discussions about code clearly marked as 'should be replaced by something less half-assed' ... it just ruins my productivity as well as all will to code. After a chunk of code is complete is a different matter, of course, I just don't like being annoyed during my code time.

You can say it sucks when the painting is finished, not before.
[Security Discussion] banderos101:
Ah, maaan, but im so good at passive aggresive statements, wheres the love :(

Joking aside, i see your point, to be honest im surprised your still with us, but glad you still are, otherwise, no pry-fi, and many other great apps, and contributions

so, sorry, and i hate you :angel::mad:.........passive aggressive, got it licked

Disclaimer:

i dont hate you
[Security Discussion] Chainfire:
I'm not sure the reason why, but it seems the wpa_cli I compiled from AOSP does does not play nice with the stock wpa_supplicant on my Nexus 5 (potentially killing a lot of Pry-Fi improvements).

Bot claim to be "v2.1-devel-4.4.2" though.

I can't get any of the commands you have listed to do anything useful. For example, "scan" just throws "unknown command" at me.

All I really see coming out at this time is "IFNAME=wlan0 <3>CTRL-EVENT-SCAN-RESULTS"

EDIT My bad, I had the wrong paramters for wpa_cli, re-checking now

EDIT#2 "Starting AP scan for specific SSID:" happens just before the full-list broadcast, but before a broadcast without the full list of SSID names as well. I don't really see any difference between the scans based on logcat.

EDIT#3 A full SSID-listing scan appears to happen at 120 second intervals
[Security Discussion] kenshin33:
I'm trying the same thing, how did you go arround the UNKNOWN COMMAND?

line 748 of scan.c (wpa_supplicant)

somehow max_ssid is set to 1. Why is the question? (ap_scan == 2 might be the answer, but it is not set in wpa_Supplicant.conf AFAI can tell)

The comment seem to indicate that this is done out of convinience (wpa_supplicant can be rebuilt to avoit this behaviour)
[Galaxy S 4 Q&A, Help & Troubleshooting] simon7997:
U can go check in settings -> more -> storage -> misc and see there can b thumbnail files with 100s mb of size u can delete that. Its not going to harm your real photos. Plus if u hv a backup there like Titanium or nandroid u can delete that too to increase space

If none works

Thn there is always external SD ;)
[Galaxy S 4 Q&A, Help & Troubleshooting] TheBeast:
Yea that's weird. I9505 here with the same exact problem, Echoe rom.

It says 9 GB available, 5 GB used, 800 MB free. :S
[Galaxy S 4 Q&A, Help & Troubleshooting] EIAIZ:
Same Problem

I have same problem. I calculate and all files 4 GB Capacity 8.9 GB it means around 5 GB free space. But it shows 200 MB free space. I could not understand why.
[Galaxy S 4 Q&A, Help & Troubleshooting] TheBeast:
Did you guys solve this?

Anyone know how to fix this?

I was on custom rom, I had this problem. Now i'm back to stock but still 2 GB missing.
[Galaxy S 4 Q&A, Help & Troubleshooting] TheBeast:
Solution

Alright finally fixed it. With ES file explorer I went to mnt > shell > 0 > Android > obb. Apparently, there were 2 game files that should've been deleted but for some reason they were there.

So yeah whatever it is, it can be found with root file explorers and can be deleted, you just gotta search. :)
[Galaxy S 4 Q&A, Help & Troubleshooting] Rakcoon:
Worth noting: if you've ever made a backup via recovery (cwm), it will eat up a good 3-4gb.
[Galaxy S 4 Q&A, Help & Troubleshooting] TheBeast:
Yes but it would be seen in the storage info under miscellaneous category. The problem here was that some of the memory was missing without any info as to what's using it.
[Galaxy S 4 Q&A, Help & Troubleshooting] Rakcoon:
No, it doesn't show up on misc. Titanium backup will be listed, but not if you backed up using recovery. The back up I'm referring to is of the phone in its entirety which can be between 3-6gb.
[General Questions and Answers] dazza_84:
Hi, i hope this is the right section as it is a question.

Anyways my iphone broke, and im in the market for another phone, i dont have alot of money at the moment and was just wondering if there were any phones around the £100 mark that are of good quality? No lag, stuff like that?

Im in the u.k

I hope i get some answers cos im using a laggy old galaxy ace at the moment.

Thanks alot
[General Questions and Answers] amirTor:
This is the most powerful-budget-friendly smartphone right now: http://www.amazon.co.uk/gp/aw/d/B00ECBREB6/ref=mp_s_a_1_1?qid=1391376560&sr=8-1&pi=AC_SX110_SY165 (and there is also 8GB version available for 120)

If you don't mind a chinease device, I strongly suggest: http://www.amazon.co.uk/gp/aw/d/B00E92JTZM/ref=mp_s_a_1_1?qid=1391376881&sr=8-1&pi=AC_SX110_SY165

Or the cheaper model: http://www.amazon.co.uk/gp/aw/d/B00CU8MQ7K/ref=mp_s_a_1_1?qid=1391376927&sr=8-1&pi=AC_SX110_SY165
[Verizon Samsung Galaxy Note II] dlw1146:
Used Odin to reinstall I605 VRAMC3... all went well.

However, after boot there is a black dialogue box that come up with all sorts of info on it.

See attached.

How to get rid of it?

dlw
[Verizon Samsung Galaxy Note II] Curtis Craig:
have you pulles the battery and rebooted?
[Verizon Samsung Galaxy Note II] dlw1146:
Thanks you.

That worked.

dlw
[Verizon Samsung Galaxy Note II] smart_ask:
i had the same issue but followed another more difficult method. I wished I would have found this post earlier.
[Verizon Samsung Galaxy Note II] kimdoocheol:
nm delete
[Verizon Samsung Galaxy Note II] dlw1146:
What method did you use?

dlw
[Verizon Samsung Galaxy Note II] smart_ask:
Factory reset and reinstalled the ROM. Didn't help. So working from memory but I ended up DLing a root browser from the play store and going to efs/factoryapp/factorymode and opening factorymode with a text editor and changing "OFF" to "ON". save the changes and it was gone. I read this somewhere but can't remember where now.
[Huawei Ascend P6, Mate] jokosher:
Can I repair Huawei bootloader without using Box?I erased bootloader from fastboot,then reboot.Now completely dead! How can I fix it? Pls help.
[Huawei Ascend P6, Mate] surdu_petru:
What command you used for erase bootloader ?
[Huawei Ascend P6, Mate] jokosher:
fastboot erase bootloader,thank u for reply.
[Huawei Ascend P6, Mate] surdu_petru:
Ok, can I ask you, why did you run this command ?
[Huawei Ascend P6, Mate] tauio111:
This is slightly comical, but I believe he wanted to delete the old bootloader and then flash a new one. Don't think this can be fixed without a box. ODIN maybe?
[Huawei Ascend P6, Mate] jokosher:
Yeap bro,bcoz I can't install firmware normal way.So I flashed all partition from fastboot.Main process was to repair imei null.
[Huawei Ascend P6, Mate] tauio111:
Why did you restart after erasing bootloader?
[Huawei Ascend P6, Mate] surdu_petru:
Ok, but only if the device respond to command ( using USB cable ) , because I think there will be also driver issue ! If your PC cannot recognize the device, than the device is dead !
[Huawei Ascend P6, Mate] jokosher:
Right,my mistake was reboot command.That should be after reflashed bootloader.
[Huawei Ascend P6, Mate] tauio111:
Yes, thats what im thinking. Without bootloader, nothing starts and no usb drivers are loaded. Bricked :(.

How long ago did you buy the phone? If it was under 14 days ago then take it back as fast as possible.
[Huawei Ascend P6, Mate] surdu_petru:
Yes, you are right , but is too late !

You should make an backup before, and flash backup bootloader before : fastboot reboot !

If you still have warranty , maybe they can change it ( not sure for free .. )
[Huawei Ascend P6, Mate] jokosher:
I used a tool for similar dead Samsung without box.So I asked some help for Huawei :(
[Huawei Ascend P6, Mate] surdu_petru:
Yes, I know this tool, I also used for my Samsung Google Nexus S - but is not the same case for Huawei ! Unfortunately we have not an unbreakable tools !
[Huawei Ascend P6, Mate] ZuperStyler:
Maybe we should create one.
[Huawei Ascend P6, Mate] richish:
Maybe some one can make backup of bootloader from working P6 and upload it ? I not really know what kind of info is in bootloder..