yashsingh1/xdaforums huggingface dataset:
[One (M8) Original Android Development] furboom1240:
Hello, [MENTION=4684315]flar2[/MENTION] I tried your kernel fix for GPE based ROMs. But the link reports that the file was deleted. Can you please re-post the link if possible? Thank you.

By the way, I need a 4.4.4 kernel. Running cm11 m12.
[One (M8) Original Android Development] hopeshadow:
I tried to insmod the module but I got error:

can'tinsert '/system/lib/modules/wp+mod.ko" : invalid module format1.

In dmesg, I can see wp_mod: disagrees about version of symbol module_layout.

any idea?
[One (M8) Original Android Development] Captain_Throwback:
Hex edit it to match the stock modules from your ROM.
[One (M8) Original Android Development] hopeshadow:
Thanks for the reply. I'll appreciate if you can help me to know what I must change in the module.
[One (M8) Original Android Development] Captain_Throwback:
http://xdaforums.com/showthread.php?p=56202807
[One (M8) Original Android Development] hopeshadow:
Thanks for your help. I attached the M8 Dual SIM updated module.
[One (M8) Original Android Development] youniqueg33k:
Sorry for that, wasn't thinking when I said it.
[One (M8) Original Android Development] furboom1240:
Hello again. I tried the wp_mod posted recently on the OP, but when I try to execute the script, it stalls. Is there a line I can add in the build.prop that would disable system write protection? I'm using ROM Toolbox Pro so instructions that'd work best with that app would be valuable.

Of course, my intent is to have the ability to modify the file system to my liking on my rooted m8 running CM11 M12.

Thanks.
[One (M8) Original Android Development] scoot0073:
I gave up trying to get the module to load. I just converted my at&t M8 to Developer Edition and now no more issue trying to write too system.
[One (M8) Original Android Development] furboom1240:
If I remember correctly, that requires SuperCID, right? I have a GPE device, so my CID is default according to fastboot. Any advice on how to achieve SuperCID for my device?
[One (M8) Original Android Development] scoot0073:
I used thus method to convert my M8 to Developer Edition

http://xdaforums.com/showthread.php?t=2884777
[One (M8) Original Android Development] chrisnz1947:
wp_mod and Lolipop

would you expect the procedure to still work with android 5?

I recently received OTA 4.16.1504.8 and android 5.0.1 on my M8 developer and after rooting it I cannot get wp_mod to work.
[One (M8) Original Android Development] scoot0073:
On my AT&T M8 I changed my CID to 11111111 as I was going back and forth from GPe to DE and it's still super cid. I don't know if the method applies to all M8's but I booted into fastboot and typed fastboot oem rewrite cid 11111111. And that's all I did.
[One (M8) Original Android Development] JEANRIVERA:
does this work? or is it planned to make it work on Lollipop kernel?
[One (M8) Original Android Development] flar2:
It works, I think some of the custom Roms have working versions

I have no time myself to do it
[One (M8) Original Android Development] JEANRIVERA:
thanks for the quick response!!!!!!!!!!
[One (M8) Original Android Development] migascalp:
You can try wp_mod_3.4.0-gac2f39a.zip
[One (M8) Original Android Development] tiunilohmu:
you have wp kernel for att 3.42.502.1?
[One (M8) Original Android Development] Keioboy:
It doesn't work on stock Android L.
[One (M8) Original Android Development] chiman:
Will there be a Lollipop version of this tool?
[One (M8) Original Android Development] flar2:
Basically, I do the initial work to disable the write protection and leave the method here for other devs to use. The problem with HTC is they have many different kernels floating around and I can't possibly create the module for all of them.

Best thing to do is check for a custom Rom that uses the same kernel version and get a copy of wp_mod.ko from there, as nearly all custom Sense Roms use this module.
[One (M8) Original Android Development] Captain_Throwback:
For example: http://xdaforums.com/showthread.php?p=59082003
[One (M8) Original Android Development] dekkyy:
Can anyone please share wp_mod.ko for 4.4.4 GPE?

The link in OP doesn't work.
[One (M8) Original Android Development] anand96999:
all links are dead

i want to write protect disable my htc m8 831c sprint on 4.4.2 stock rom
[One (M8) Original Android Development] doublehp:
http://dl.free.fr/bRUMFqqK7

Very old version, I downloaded june 20th 2014. Personnal backup. File will be available 30 days.
[One (M8) Original Android Development] flar2:
wp_mod for GPE Marshmallow 6.0 can be found here:

http://xdaforums.com/htc-one-m8/general/root-root-marshmallow-gpe-supersu-t3242210
[One (M8) Original Android Development] kevin mitnick:
how about lollipop?

have you create ones for lollipop?
[One (M8) Original Android Development] pohlipit:
Still no luck on a Lollipop version of this?
[One (M8) Original Android Development] heppojo:
How to install and enable it?
[One (M8) Original Android Development] DeeZZ_NuuZZ:
You Need eyes, a brain AND READ THE DAMN OP. all is written there!
[One (M8) Original Android Development] musti35:
Hi friends;

I have HTC M8 Marshmallow with Sense 7.

I rooted my device with SuperSU 2.65.

I want to disable system write protection.

Can I do this with "m8-mmgpe-wp_mod.zip"?

"m8-mmgpe-wp_mod.zip" is for HTC M8 GPE edition.
[One (M8) Original Android Development] mc_365:
Bump Im in the same position running vzw stock sense 7 on marshmallow.

S-Off

Unlocked

Rooted

Hoping somebody would just post a tut on removing the write protection from a stock rom.
[One (M8) Original Android Development] blackbolt22:
how do i get this on the 5.0.2 android version. I am on stock rom, rooted, custom recovery.

Anyone? I see everything listed but 5.0.2

my build # is 4.28.502.2, kernel version is 3.4.0-..... htc sense 6.0
[One (M8) Original Android Development] hellobbn:
[MENTION=4684315]flar2[/MENTION] Sorry to trouble you. But I want to ask :

I 've known that wp_mod.c should me compiled with the kernel source . But I don't exactly understand how. Is putting the folder I cloned wherever in the source code folder fine?
[One (M8) Original Android Development] Dandaivin:
SO is this module a replacement for s-off by using this will I be able to flash the config.dat file to sim unnnlock my htc one m8 or will this not work?
[One (M8) Original Android Development] MUNISH MONGA:
[NEED HELP]wp_mod for HTC Desire 826

Hello Sir,

I'm trying to disable S-ON system write protection on HTC Desire 826 (3.10.49-perf-gca7b0f1), In this device also, HTC uses MMC_MUST_PREVENT_WP_VIOLATION for /system write protection (commit: b75b4f2).

(bootloader) version: 0.5
(bootloader) version-bootloader: 3.19.0.0000
(bootloader) version-baseband: 1.0.U20410.1@60201
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main:
(bootloader) version-misc: PVT SHIP S-ON
(bootloader) serialno: CC55EYG01638
(bootloader) imei:
(bootloader) imei2:
(bootloader) meid: 00000000000000
(bootloader) product: a52_dtul
(bootloader) platform: hTCBmsm8939
(bootloader) modelid: 0PHC10000
(bootloader) cidnum: HTC__038
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: on
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: 7b3f8116
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) mfg-name: 1001
all: Done!
finished. total time: 0.109s

With reference to your quoted post. . .

https://xdaforums.com/showpost.php?p=54577811&postcount=124

I've hexedited the module to match the CRC checks for my device kernel-3.10.49-perf-gca7b0f1 but it doesn't seems to work. . .

insmod: init_module 'system/lib/modules/wp_mod.ko' failed (Exec format error)

I've attached the module I'm using (wp_mod.ko) and the reference module (mmc_test.ko) to match module_layout

With reference to your quoted post. . .

https://xdaforums.com/showpost.php?p=51586322&postcount=25

and this commit: b75b4f2

This can be done by changing. . .

might_sleep();

#ifdef CONFIG_MMC_MUST_PREVENT_WP_VIOLATION
sprintf(wp_ptn, "mmcblk0p%d", get_partition_num_by_name("system"));

if (!strcmp(bdevname(bio->bi_bdev, b), wp_ptn) && !board_mfg_mode() &&
(get_tamper_sf() == 1) && (get_atsdebug() != 1) && (bio->bi_rw & WRITE)) {
pr_info("blk-core: Attempt to write protected partition %s block %Lu \n",

to

might_sleep();

#ifdef CONFIG_MMC_MUST_PREVENT_WP_VIOLATION
sprintf(wp_ptn, "mmcblk0p%d", get_partition_num_by_name("xxxxxx"));
if (!strcmp(bdevname(bio->bi_bdev, b), wp_ptn) && !board_mfg_mode() &&
(get_tamper_sf() == 1) && (get_atsdebug() != 1) && (bio->bi_rw & WRITE)) {
pr_info("blk-core: Attempt to write protected partition %s block %Lu \n",

Now that I'm a bit new to modifying kernel through this kernel source, I need your help Sir!

What I'm trying to do here is remove this /system write protection by any means: modifiying the kernel or by using wp_mod.ko

I've also attached the stock boot.img for my device for your reference.

Thank You
[One (M8) Original Android Development] The5thSurvivor:
Will ths work on the AT&T, Sprint, and T-Mobile variants running Android 6.0? Or is it strictlyfor the GPE variant only?
[One (M8) Original Android Development] graffixnyc:
I didn't use a zip.. I did make a guide though..

I made a guide for people on stock roms or roms that don't have init.d support that will enable r/w on boot without running the command every time you boot.

http://xdaforums.com/showthread.php?p=51560810
[One (M8) Original Android Development] Captain_Throwback:
This is working for me on the Sprint variant as well. Thank you very much for this!
[One (M8) Original Android Development] MassStash:
Same here, both this and s2w mod are working great on m8whl! I added this to lib/modules as s2w is, and then added correlating insmod lines to intall-revocery.sh, and they load perfectly each boot

Edit: Ah nice tut, that's exactly what I figured out this morning haha. Now that I can change dpi tho, need to edit prism grid size....

~m8whl modded stock

2.265 Max ¦ 300 Min

ondemand

row
[One (M8) Original Android Development] m03sizlak:
AWESOME work flar2.

After examining the source, it is indeed *much* more complicated than it has been in the past. Just curious, if you have the kernel source, what is to stop you from just rewriting the hooked functions instead of hijacking them with this code, which appears to be proof of concept code for ARM rootkits?

Second question, the very informative page you linked to, and based this on, says this about ARM instruction caching:

http://poppopret.org/2013/01/07/suterusu-rootkit-inline-kernel-function-hooking-on-x86-and-arm/#arm

Any reason why you do not use this approach in your module?

Last and possibly most important question. The page also says this:

The code uses this approach only to avoid detection by rootkit detectors, something that we should have zero concerns about. Why not use the other approach, system call hooking by swapping out function pointers in the system call table?

THANK YOU.
[One (M8) Original Android Development] flar2:
I did rewrite the function. Remember, we have to do this in the running kernel. Whenever the original function is called, it jumps to my new function instead. Hooking/hijacking are the same thing. That site also shows how to hide the module and a bunch of other stealth stuff, but none of that was necessary for this.

It's extremely easy to disable write protection if you compile your own kernel, you just turn off MMC_MUST_PREVENT_WP_VIOLATION.

Previously, the wp_mod hack was dead simple. All we had to do was call an existing kernel function to change the number of the partition that write protection applied to. In the new source (below), HTC got rid of all this extraneous code and just hardcoded it to apply the write protection to /system. This happens in block/blk-core.c as you can see below. We need to skip over the quoted code.

static noinline_for_stack bool
generic_make_request_checks(struct bio *bio)
{

......

#ifdef CONFIG_MMC_MUST_PREVENT_WP_VIOLATION
sprintf(wp_ptn, "mmcblk0p%d", get_partition_num_by_name("system")); //hardcoded to look for system partition
if (!strcmp(bdevname(bio->bi_bdev, b), wp_ptn) && !board_mfg_mode() && //wp_ptn == mmcblk0p45 (/system)
(get_tamper_sf() == 1) && (bio->bi_rw & WRITE)) {
pr_info("blk-core: Attempt to write protected partition %s block %Lu \n",
bdevname(bio->bi_bdev, b), (unsigned long long)bio->bi_sector);
err = 0;
goto wp_end_io;
} else if (atomic_read(&emmc_reboot) && (bio->bi_rw & WRITE)) {
pr_info("%s: Attempt to write eMMC, %s block %Lu \n", current->comm,
bdevname(bio->bi_bdev, b), (unsigned long long)bio->bi_sector);
err = -EROFS;
goto wp_end_io;
}
#endif

..............

}

It's a *bad idea* to replace a big complicated important function like static noinline_for_stack bool

generic_make_request_checks() so I decided to modify a simpler function within it, get_partition_num_by_name(). I changed get_partition_num_by_name() to return a different partition number when name == system. I didn't see any code in the kernel source where it would cause a problem to return the wrong partition number for system. After loading wp_mod.ko, write protection is applied to a non-existent partition instead of /system. The end result is exactly the same as my old wp_mod that has proven to work on many devices.

Why didn't I just change the address in the system call table? I don't think that is so easy on contemporary kernels. I found the function hooking method simpler and more foolproof.

EDIT: in my haste while answering this at work, I quoted the wrong function containing the write protection code. It's static noinline_for_stack bool

generic_make_request_checks not bio_check_eod (which is the function right above it in blk-core.c)
[One (M8) Original Android Development] flar2:
Further to your concerns about instruction caching and potential corruption, this commit addresses our situation, where CONFIG_STRICT_MEMORY_RWX is enabled: https://github.com/mncoppola/suterusu/commit/26f1361e3aa97bdf254ec8ee37efb5e58e941b80

mem_text_write_kernel_word() handles the cache flush.

I know a couple people have experience data corruption, but it is unclear if it is due to the module or not. If this happens, I would appreciate /proc/last_kmsg.

One thing I know causes corruption is attempting to make a change to /system before loading the module. This has always been so, it happened to me the when I first made the module back on the HTC One XL. I didn't try it here, just assume that it would happen.
[One (M8) Original Android Development] m03sizlak:
flar2, thanks for the explanation. You have mostly assuaged my concerns. If neither bio_check_eod() nor get_partition_num_by_name() is a syscall, which I assume is true, then there would be no way to hook them cleanly via the system call table.

I also see what you mean about mem_text_write_kernel_word() handling the cache flush.

I guess my only remaining concern would be that you are returning this meaningless number when get_partition_num_by_name is called on the "system" partition. I'm not sure how easy it would be to determine exactly what kind of unintended consequences this could have. I assume you have searched all the other kernel code for places this is called, but still.

I would suggest trying to use a similar method to patch the existing bio_check_eod() function.

#ifdef CONFIG_MMC_MUST_PREVENT_WP_VIOLATION
sprintf(wp_ptn, "mmcblk0p%d", get_partition_num_by_name("system")); //hardcoded to look for system partition
if (!strcmp(bdevname(bio->bi_bdev, b), wp_ptn) && !board_mfg_mode() && //wp_ptn == mmcblk0p45 (/system)
(get_tamper_sf() == 1) && (bio->bi_rw & WRITE)) {
pr_info("blk-core: Attempt to write protected partition %s block %Lu \n",
bdevname(bio->bi_bdev, b), (unsigned long long)bio->bi_sector);
err = 0;
goto wp_end_io;
} else if (atomic_read(&emmc_reboot) && (bio->bi_rw & WRITE)) {
pr_info("%s: Attempt to write eMMC, %s block %Lu \n", current->comm,
bdevname(bio->bi_bdev, b), (unsigned long long)bio->bi_sector);
err = -EROFS;
goto wp_end_io;
}
#endif

You could try to replace that entire first if-block with NOP's (0x00000000). Or if you can find where the "mmcblk0p%d" string literal is allocated and replace it with "mXXXXk0p%d" or something.

Or as a last resort you could modify your replacement get_partition_num_by_name() function to only return the meaningless 666 value for 'system' if the calling function is bio_check_eod()?
[One (M8) Original Android Development] flar2:
I think finding the exact location of the if statement or string would be tough, given that this has to work on multiple kernel versions. We have to stick to addresses that can be found with kallsysms_lookup_name.

I was already thinking about doing your second suggestion. I've searched through the code and I don't think there are any circumstances that would call get_partition_num_by_name("system"), but future kernel changes and other devices may be different. For now, this seems to be the only situation that will return 666 and the only consequence will be that the if statement fails, as intended.

BTW, thanks for your feedback, it's important that people review stuff like this. All too often on XDA we just come up with something "that works" and everyone starts using it without thinking about what it actually does.
[One (M8) Original Android Development] eric00716:
Flar is there anyway to disable dt2w and s2w already built in to the kernel because my m8 wakes itself in my shirt pocket about 10 times a day. Thanks in advance
[One (M8) Original Android Development] ahecht:
Settings -> Display, Gestures, and Buttons -> Motion Launch Gestures -> uncheck "Motion Launch gestures"
[One (M8) Original Android Development] eric00716:
Don't know how I missed that I feel like a noob. Thanks for the info
[One (M8) Original Android Development] b0gd4n:
ooooh, can't wait!!!
[One (M8) Original Android Development] flar2:
I've updated the module a bit to make it easier to port to future kernels and other devices that use this form of write protection. All that needs to be done is to edit the CRC value for module_layout. I've also made it so the module can't be unloaded, we don't want to do that. In the process, I was able to reduce the module's overhead. Also, as per [MENTION=2698029]m03sizlak[/MENTION]'s suggestion, I made it so it will only return the non-existent partition if the calling function is generic_make_request_checks.

The first version works, but we should start testing this version.

Download:

wp_mod.ko

(downloads not showing up for some reason, hold on)

Changes:

-only return non-existing partition number if called by generic_make_request_checks

-remove exit from module (we don't want to be able to unload it)

-clean up code
[One (M8) Original Android Development] Wonders_Never_Cease:
attach it here then...just a thought...since not showing on goo.im
[One (M8) Original Android Development] flar2:
It'll be there soon, sometimes it takes a while for files to show up on goo.
[One (M8) Original Android Development] MassStash:
HTC Posts One M8 Kernel Source For Verizon, AT&T, Sprint, And Optus Variants

http://www.androidpolice.com/2014/0...ce-for-verizon-att-sprint-and-optus-variants/

~m8whl modded stock

2.265 Max ¦ 300 Min

ondemand

row
[One (M8) Original Android Development] djkinetic:
apparently goo.im doesnt want us to have the new module lol.
[One (M8) Original Android Development] Electronic Punk:
Downloaded ok here, testing shortly :)

Edit: works great here ;)
[One (M8) Original Android Development] clarkson63:
4.1

4.1 working here too.

Great work [MENTION=4684315]flar2[/MENTION]
[One (M8) Original Android Development] MistaJae:
I used this guide on the stock UK ROM and it works perfectly!
[One (M8) Original Android Development] Root-Maniac:
[MENTION=4684315]flar2[/MENTION] kernel source is out http://www.xda-developers.com/andro...ource-and-framework-files-for-the-htc-one-m8/
[One (M8) Original Android Development] mwilky:
Hey mate!

I was running your 4.0 mod and was modding sysui and somehow seemed to corrupt my /system.

Had to run a e2fsck to get it back up and running.

If it happens again i'll grab some logs for you!
[One (M8) Original Android Development] flar2:
Please grab the log if it happens again and describe all that you were doing at the time, and a bit before. Best to get /proc/last_kmsg so I can see the whole history since boot.

I've been trying various scenarios of copying and deleting files but I haven't been able to cause an error.

Always be careful not to make any change to /system before the module is loaded.
[One (M8) Original Android Development] MassStash:
Need to get an init.d enabled boot.img in the OP maybe. That way people can flash that, use your mod as init script, and eliminate possibility of module not being loaded prior to anyone making changes

~m8whl modded stock

2.265 Max ¦ 300 Min

ondemand

row
[One (M8) Original Android Development] gjlowe:
I also appreciate the code discussion [MENTION=4684315]flar2[/MENTION] and [MENTION=2698029]m03sizlak[/MENTION]. I am not an experienced coder, but I used to write a little bit of web stuff and I find it fascinating to hear the discussion, even if I don't understand it all. I can follow the underlying logic, and just to hear how you analyze it is a great bit if learning. So thanks!
[One (M8) Original Android Development] djkinetic:
just a heads up Flar2 got a exec format error while trying to insmod on the GPe system/boot nandroid floating around.
[One (M8) Original Android Development] flar2:
It has to be compiled against that kernel or hexedit the module.
[One (M8) Original Android Development] fix-this!:
FYI im hearing we will need a new r/w module for GE based roms. the sense one isn't cross compatible. :(
[One (M8) Original Android Development] djkinetic:
Not to be an ass but I already pointed that out to flar2 and he already responded as what needs to be done, no need for extraneous posts lol. Till we get a new module boot into recovery and make system changes via TWRP file manager or adb.
[One (M8) Original Android Development] flar2:
wp_mod for Google Play Edition:

http://goo.im/devs/flar2/One_m8/wp_mod/GPE//wp_mod.ko
[One (M8) Original Android Development] MassStash:
You're a beast man

~m8whl modded stock

2.265 Max ¦ 300 Min

ondemand

row
[One (M8) Original Android Development] HolyAngel:
Thank you sir! You rock!!
[One (M8) Original Android Development] fix-this!:
i dunno if its just me but the new GPE r/w mod isnt working. i delete apps with root explorer and they are right back after reboot. i used your method in the first post to install with terminal emulator.
[One (M8) Original Android Development] rivlez:
I can't get it to work either. I've tried multiple times.
[One (M8) Original Android Development] Tikerz:
You have to run the command each time unless you set the command to run in init.d or install.sh.

Or just saw someone else compiled the stock GPe kernel with R/W protection off. I haven't tried it though.

http://xdaforums.com/showthread.php?p=51677747
[One (M8) Original Android Development] HolyAngel:
Works perfectly for me on my GPE ROM! Just gotta stick it in system/etc in recovery/aromafm or use adb push for my rom and reboot and enjoy!

Working on building it in to v1.2 soon.

Thanks again flar!
[One (M8) Original Android Development] flar2:
I've also tested on GPE, and it works.
[One (M8) Original Android Development] jonata:
little request :

a flashable zip for 4.1 mod sense ?

tks bros