yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] Surge1223:
Well back when I typed that the get_user/put_user exploit was the only exploit we had that could overwrite kernel memory. Now that we have towelroot its also theoretically possible to re-implement bypasslkm on NC5 depending on how they mightve patched it.

I tried doing this but since not many cared or even tried to make use of bypasslkm the first time around I didnt post my findings, nonetheless this info might be useful to future individuals trying to do the same. I really hope someone makes use of what im about to type.

So the first time around jeboo had an error log and was able to find the address to patch since we had kernel source and he probably decompressed the zimage and found the relevent lkmauth address.

There is another way to enable insecure module loading (using the same approach and address as bypasslkm) by using objdump on the vmlinux produced from compiling the kernel from source, then finding the following

1a000002 bne <copy_and_check.isra.22+xxx>

then by doing some math, and guess checking you can use devmem2 to write 0x0 to whatever address returned the ARM opcode 1a000002, for mk2 this address is 0x802c9d58 (may seem familiar if you have looked at bypasslkm.c)

I confirmed by manually writing writing 0x0 at 0x802c9d58 = modules verified and returning the value to 0x1a000002 = modules modified.

I tried to find <copy_and_check.isra.22+xxx> in NC5 kernel source however it is non-existant. I have not yet tried to decompress the zimage and search for the relevant lkmauth messages to see if bypasslkm is still able to be implemented or to see how it may have/may not have been patched. This is probably the first step I should have done, so anyone starting now should start with that step, decompressing the zimage and searching for the lkmauth messages and see how the check is implemented.
[Verizon Samsung Galaxy S 4] pwned3:
I lack the knowledge to even attempt this but I do hope another tries at least. I miss aosp. I'm coming from a HTC with s-off and I'm not used to the restrictions placed on such a locked down phone. I do hope that some work around for running an unsecured kernel will be found at least. Thanks for the information and hopefully it will be put to good use

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] npjohnson:
I though about TowelRoots ability to do the same as get_put, but understanding exactly how it (TR) works is tough due to llvm-obfuscator. After reading a theoretical writeup of TR, I found this:

Source: http://tinyhack.com/2014/07/07/exploiting-the-futex-bug-and-uncovering-towelroot/

I thought that due ti the nature of the Futex bug that our best bet was a 4.3 downgrade... though what you are saying makes sense... So, your saying that the memory address to be written to 0x0 has merely changed location? (Im probably misunderstanding you...) I thought that they they had moved that flag out of memory to prevent writing...

How are you decompressing zimage? I tried using instructions like these https://github.com/xiaolu/galaxys2_kernel_repack (obviously changed for our model), but I am having some issues..
[Verizon Samsung Galaxy S 4] Surge1223:
Do you have the kernel compiled?
[Verizon Samsung Galaxy S 4] npjohnson:
I am doing what you were talking about first to learn... Im doing it from an MK2 JB device. So I have the kernel compiled for that one. But I haven't begun on my NC5 KK device yet. We don't have kernel source for NC5 yet, do we?
[Verizon Samsung Galaxy S 4] Surge1223:
http://opensource.samsung.com/reception/receptionSub.do?method=search&searchValue=SCH-I545
[Verizon Samsung Galaxy S 4] sokrboot:
I've been reading articles on kexec being used for Linux fast reboots, which sounds a lot like our Fastboot. BUT, I have a Fast Reboot option on my phone. Can someone ELI5 the difference bw Linux Fast Reboot, Android Fastboot, and Android Fast Reboot?

FYI, I *know* the S4 doesn't support Fastboot that's why I'm asking about fast reboot and if it is different.
[Verizon Samsung Galaxy S 4] RuggedHunter:
I'll let someone more experienced explain any relevance, if there is any, but as far as the "fast reboot" or "hot reboot" option in your power menu... its a method of rebooting that only restarts the GUI.

http://www.xda-developers.com/windows-mobile/reboot-the-shell-only-with-hot-reboot-for-android/
[Verizon Samsung Galaxy S 4] rebel1699:
Fastboot and fast reboot are in no way related, or even similar.
[Verizon Samsung Galaxy S 4] sokrboot:
[MENTION=5020814]RuggedHunter[/MENTION] thanks for replying with helpful information, I appreciate it.
[Verizon Samsung Galaxy S 4] npjohnson:
Kernel Compiled (:
[Verizon Samsung Galaxy S 4] Surge1223:
Jeboo and I both tried to find the lkmauth module verification function in the decompressed zimage binary and we were unable to find it. Though jeboo did point out that the strings were still present in source. I dont know where that leaves us, but thought id let you guys know.
[Verizon Samsung Galaxy S 4] F1a5hP01ntX:
[MENTION=4939386]Surge1223[/MENTION] i saw in the other kexec thread that bypasslkm appeared to be working on mi1, though it didn't look like the poster tried to load any modules. Is there a kexec module that may work with mi1 already floating around? I'm willing to do some testing as I'm still there, but I've only messed with modules and kexec a little bit to multiboot on my nexus 7... wasn't sure if there was already something you guys had in the works. Let me know what i would need to do and I'll give it a shot.
[Verizon Samsung Galaxy S 4] Surge1223:
That post is misleading because though it appears that bypasslkm was working for that individual, in reality it was not. If you look at the source for bypasslkm you can see how it determines which address to patch etc. The address that it patched for that individual was the att MK2 address, so if he would have tried loading an insecure module it would have failed.
[Verizon Samsung Galaxy S 4] F1a5hP01ntX:
Ah.. Makes sense. How would i go about finding the address for mi1?
[Verizon Samsung Galaxy S 4] Hashbang173:
This may help you guys a bit: https://github.com/Hashcode/android_kernel_samsung-jf-common/commits/oss-jfltevzw-mj7

Edit: According to Hashcode you will need to be on 4.3 for kexec to work. You can downgrade by flashing this in odin (Correct me if I'm wrong) And in theory you can create a mini-kernel with only some serial output commands.
[Verizon Samsung Galaxy S 4] Jraider44:
So did Hashcode get Kexec working?? I thought he ran into a roadblock and never finished support...

Could you explain this a little further please?
[Verizon Samsung Galaxy S 4] Hashbang173:
Kind of, you can ask him on the freenode irc network, #safestrap

---------- Post added at 05:11 PM ---------- Previous post was at 04:45 PM ----------

Heres a log from Hashcode trying to get kexec working: http://pastebin.com/raw.php?i=s6KzVEZz
[Verizon Samsung Galaxy S 4] Surge1223:
The entire point of all my posts in this thread were to help others to try to implement bypasslkm in 4.4.2 NC5...so that kexec could be reattempted on 4.4.2. Obviously if you're on 4.3 then you're already set up to try testing kexec.
[Verizon Samsung Galaxy S 4] Hashbang173:
Cant people on nc5 just downgrade to mj7/mk2?
[Verizon Samsung Galaxy S 4] Raymondlikesroot:
Woah woah. This is good news for people with mk2 bootloader right? Like with some further testing, we could get aosp on s4 mk2?
[Verizon Samsung Galaxy S 4] joshm.1219:
If they used his method to upgrade before towel root became available. If their boot loader is nc5 it can't be downgraded.
[Verizon Samsung Galaxy S 4] Hashbang173:
But they can downgrade the system, cache, boot.IMG, etc everything except bootloaders. Right?
[Verizon Samsung Galaxy S 4] joshm.1219:
Most of the partitions can downgrade, boot.img maybe, I think there was a couple partitions Surge modified to make them downgradeable or something. I never had to use it myself.
[Verizon Samsung Galaxy S 4] Surge1223:
They can downgrade partially, enough to use mk2/mj7 system and kernel yes.

Depends. Bypasslkm has been around for awhile, and ive only seen a handful of people make use of it. Further testing requires further development and there's a decreasing amount of those that can develop at that level.
[Verizon Samsung Galaxy S 4] twizzlejr:
So did this stop already?
[Verizon Samsung Galaxy S 4] MrGooglesFirst:
I know right?
[Verizon Samsung Galaxy S 4] joshm.1219:
Did it ever start? There's a very limited amount of people who know about this stuff and the main guy stops support tomorrow. And most of those who do know about this stuff have moved on to newer devices or more Dev friendly carriers.
[Verizon Samsung Galaxy S 4] twizzlejr:
I guess it might have been another one of those it sounds good on paper ideas I'm not trying to bag on anybody because there's probably ppl still out there behind the scenes working on this and just waiting for some real news to tell us
[Verizon Samsung Galaxy S 4] camparks:
Thought I'd post just in case there were some following this thread and not Surge's. He's started to delve into kexec and could use some support:

http://xdaforums.com/showthread.php?t=2500826
[Verizon Samsung Galaxy S 4] bamige1:
So if I'm reading this correctly, and this let's us use custom kernels, does that mean cyanogenmod would be possible with kexec?
[Verizon Samsung Galaxy S 4] joshm.1219:
Yeah that's the whole goal
[Nexus 4 Q&A, Help & Troubleshooting] yashar.amd:
Could you please explain how can I flash or install “Nexus 4 Binaries” ?

https://developers.google.com/android/nexus/drivers#makoktu84p
[Nexus 4 Q&A, Help & Troubleshooting] CalculatedRisk:
Why do you need to install these binaries? These are the same as what you have on your device currently. Are you facing any issues?
[Nexus 4 Q&A, Help & Troubleshooting] opssemnik:
these are for building roms
[Nexus 4 Q&A, Help & Troubleshooting] simms22:
if you didnt have them already, your phone would never work without them.
[Nexus 4 Q&A, Help & Troubleshooting] yashar.amd:
Ok, thank you all...

I thought I should flash them after upgrading...
[Nexus 4 Q&A, Help & Troubleshooting] CalculatedRisk:
It's okay, there's no need :)
[Moto X Q&A] Charlie.igg:
Hello Folks!

So I've had this weird bug for a few months now (can't remember when it started).

Everytime the keyboard pops up for a writing field, it stays open, even when I exit the field, or the app itself where the process was called. The only way to make it hide again is to press the back button, or to press home twice. This is really really really annoying!!

Anyone else has had this bug? Have you been able to fix this?

FYI: I'm running a stock-based ROM 4.4.2 with XPOSED/Gravitybox installed; I already tried disabling modules; I already did a new clean install; This bug happens with any keyboard (Swype, Swiftkey, Flesky, Google)

Please Help!
[Moto X Q&A] samwathegreat:
Can you provide more details? You say "stock-based" ROM, so I'm not sure if you are using safestrap or have an unlocked bootloader. Also, you don't mention if you used RSD Lite/manual fastboot method, OR TWRP to do your "clean install".

These additional details will help with troubleshooting....

And no, I'm not experiencing these issues.
[Moto X Q&A] Charlie.igg:
Thanks for the swift reply!

I'm on the KangKat ROM (See here: http://goo.gl/sp1ciz), and my bootloader is unlocked.

When I said clean install, I meant doing a full data/system/dalvik wipe, then flashing ROM via TWRP. Also, in case it matters, I'm on Dalvik and have never tried ART Runtime.
[Moto X Q&A] samwathegreat:
Ok, I do indeed have a suggestion for you.

Please consider doing a 100% complete return to stock by following the instructions in the "Return to 100% stock" thread - located in the General Sub-forum.

Be sure to flash the SAME EXACT (or newer) version that your are currently running (DO NOT Downgrade), and also be sure to use the correct firmware for YOUR variant.

Afterwards, you can flash TWRP back on, and re-install KangKat rom. Additionally, according to the installation instructions for that ROM, you are not supposed to WIPE /system before installing it. So once you have followed the return-to-stock guide, and re-flashed TWRP back on, be sure to install the KangKat rom without first wiping /system.

Links to all of the tools, drivers, and firmware files themselves are located in the Return to stock thread -- everything you need.

Please follow my advice, which will give you a *truely clean install*, and post back as to whether or not it worked for you.

The process is actually pretty quick. If you already have the necessary tools and drivers, it should take you less than 20 minutes to complete the ENTIRE procedure, including re-flashing the KangKat ROM.

Good Luck :good:
[8525, TyTN, MDA Vario II, JasJam General] rsolomon:
Has anyone found the trick to enabling the Network Selection tab on a Cingular 8525 ROM 1.34?

TIA,

Richard
[8525, TyTN, MDA Vario II, JasJam General] eagle 1:
See the following thread for reg setting needed to show the network band tab

http://xdaforums.com/showthread.php?t=283797
[8525, TyTN, MDA Vario II, JasJam General] rsolomon:
Thanks eagle1, I wasn't specific enough - I'm looking for something that will show me that e.g. Cingular and T-mobile Networks are present and ask which I want to register on. The UMTS/GSM Band Selection Tab is working great now that I made the registry change noted, but on my Networks tab I only see "Current network: Cingular" listed and a "Find Network" button which only re-registers me on Cingular. I thought other carrier ROMs allowed seeing/selecting from a list of available networks....

Richard
[8525, TyTN, MDA Vario II, JasJam General] princeasi:
i've tried the hack already, it'll show u the 2 cingular selections after you click on "find network" but it will not let u register to the 2nd selection, only the 1st one! so my question is, can someone figure how to hack that problem?
[8525, TyTN, MDA Vario II, JasJam General] rsolomon:
Which hack? The one Eagle1 linked to is the \HKLM\Software\OEM\PhoneSetting\ShowUMTSBandPage setting, right? I have that on my production 8525 running 1.34 and it changes nothing for me on the Network tab, it gives me a new tab Band Selection.

What registry change are you talking about? Sounds like you've gotten it to show the networks, but still have the SIM naming override going on... in theory that's the ONSDisplayRule setting, but I've not been successful with that one either. (My ONSDisplayRule is set to "4" which value I've not found documented anywhere!)

Richard
[8525, TyTN, MDA Vario II, JasJam General] princeasi:
I did the same hack for the 8125 on the 8525, and i noticed that there was a line missing in the registry of the 8525, but was there in the 8125, so i guess cingular remove this line to keep users from registering with the 2nd selection. do a search on here for "enable manual network selection 8125" and select HTC 8125...... next select the 2nd page, and look there!
[8525, TyTN, MDA Vario II, JasJam General] rsolomon:
Are you talking about

HKLM\Security\Phone\ManualDisable=0

and

HKLM\Security\Phone\PreferredDisable=0

???? (No offense, but why not just say so??)

Setting ManualDisable to 0 gives me the desired Network Selection stuff but won't let me register on EITHER Cingular or T-mobile. I'd expect it not to work on T-mo, but am surprised about the Cingular side....

Folks in the thread you referenced: http://xdaforums.com/showthread.php?t=266794 say these settings won't stick across a soft boot...that'd be inconvenient to say the least. Yep, I just confirmed that the setting is reset on soft boot....

It would seem like there should be some way to stop WM5 from updating its settings based on the SIM card, but maybe not. At least this hack will let me temporarily see what networks are around when I'm travelling outside Cingular's coverage area.

Richard
[8525, TyTN, MDA Vario II, JasJam General] princeasi:
sorry i didnt know the hack right off, so i directed you. but actually i dont know if many people knew this but when i did the hack with the 8125, after soft rebooting the phone, the enable manual network selection would be removed but i would still be conncted to the t mobile tower!!! i confirmed this buy doing a sound test believe it or not. whenever im on cingy,s tower i can hear interference whenever im close to an active speaker or if im on my lan line, but on tmobile tower it doesnt generate that interence at all and that how i confirmed that i was still on that tower even after i did a soft reboot! the only way it would switch me back to the cingy tower is when i pushed find network! i guess some folks caught onto that so this time they wont let us register on the tower at all with the 8525's. but it would be nice if someone can find out how to enable this feature again!
[8525, TyTN, MDA Vario II, JasJam General] olga1234:
any news Manual phone network selection
[8525, TyTN, MDA Vario II, JasJam General] Pawlisko:
Guys - it is problem with Cingular card not phone.

On normal (non Cingular) branded phone Cingular cards disables manual network sellection and preferred network list.

Checked on TyTN and Motorola SVLR. Any other card has this access.

This is intentional from Cingular and it is embedded on their SIMcard.
[8525, TyTN, MDA Vario II, JasJam General] rsolomon:
Yes, and on the SLVR and other Motos, one can configure the phone to IGNORE that SIM directive - many of us would like to find this feature on the Hermes as well....

Richard
[8525, TyTN, MDA Vario II, JasJam General] marka2k:
Agreed with my ATT Blue SIM (old) I can manually select networks with no issue, pop in my daughters Cingular SIM (same phone) and I lose the feature until I swap back. One of the many reasons I won't give up my old SIM
[8525, TyTN, MDA Vario II, JasJam General] ggerman28:
"Problem with Cingular Simcard but not phones?" I dun really think so.

I have this 3G sim, on Nokia N70, I could manually select between Cingular and ATT signals. However, when it is on my 8525, it just simply cant...

How would this support your conclusion here?

Anyone come up with any solution here? I need ATT signal in my apartment, but not that crappy, call dropping, auto-selected Cingular signal.

Please advise.
[8525, TyTN, MDA Vario II, JasJam General] rsolomon:
Simple. It's a well known fact that the SIM card can (and Cingular ones do) supply a directive to the phone to prohibit network selection. Some phones ignore this or can be told to ignore this. Apparently your N70 ignores it. Again, it's a well known fact that the 8525 does NOT ignore this directive. Some folks have been able to get Cingular to do an OTA to their SIM card to enable network identification, but I've never heard of anyone getting the network selection turned on....

Richard
[8525, TyTN, MDA Vario II, JasJam General] princeasi:
its definitely not dependent on the sim card, because once again, I pulled out the 3g sim and placed it into an 8125 and I was able to select the second tower and register on it, so its something with the 8525's that's blocking this!
[8525, TyTN, MDA Vario II, JasJam General] rsolomon:
LOL! Read my response above.
[8525, TyTN, MDA Vario II, JasJam General] ggerman28:
Then if like what you said, it doesnt matter if the SIM blocks the network selection or not, if the phone can ignore the prohibition on network selection, then it should be all right to selection other networks, right?

If it depends on the phone also, shouldnt it be a way to tweak the setting or OS or watever to make this thing working? (I bet it is not a hardware restriction, isn't it?)
[8525, TyTN, MDA Vario II, JasJam General] rsolomon:
Well sure, *IF* you can figure out how to tell the phone to ignore it. Obviously the carrier does NOT want you to do this, or they would have provisioned the SIM to allow selection. So the definition of "all right" varies ;)

Agreed, but as far as I know no one has found how to do that on the 8525.

Richard
[8525, TyTN, MDA Vario II, JasJam General] princeasi:
lol, i humble myself to thy post above my initial response!!!!
[8525, TyTN, MDA Vario II, JasJam General] DJ C-Zer:
Preferred Networks.

Just curious for those in the USA. When you select the Preferred Networks option are you getting networks in the list from Europe? I'm wondering if this is what's causing my phone to appear as "roaming". The triangle keeps showing up and I don't understand why. Is it because my sim card is for T-Mobile (US) even though it's an unlocked and unbranded software of Cingular's 8525?
[8525, TyTN, MDA Vario II, JasJam General] BobbyK:
has anyone got this to work yet??
[8525, TyTN, MDA Vario II, JasJam General] galaxys:
Yes I'm getting the Euro list, but not the roaming icon after switching ROMS. See my posts here: http://xdaforums.com/showthread.php?t=295871&page=3&highlight=roaming
[One (M8) Q&A, Help & Troubleshooting] WinterApocalypse:
Hey XDA. I can't seem to use any mobile payment apps while running GPE. Every single GPE rom I've tried, as well as full conversion, has this issue. The phone will not see that I have an NFC Simcard. Is anyone else having this problem?
[One (M8) Q&A, Help & Troubleshooting] EternalAndroid:
Same here, I'm thinking of converting back to sense.
[One (M8) Q&A, Help & Troubleshooting] FaceMelter:
Did you update the CID when you converted to GPE ROM ?
[One (M8) Q&A, Help & Troubleshooting] WinterApocalypse:
Yeah, I'm super CID, S-Off, all the good stuff. I'm still able to convert back to Sense and my apps will recognize the SIM once again. It's only while running a GPE rom (both straight flash, and full conversion) that I have the issue.
[One (M8) Q&A, Help & Troubleshooting] FaceMelter:
Just a thought... Maybe try GOOG0001 CID

This is what I have... Google wallet is setup and working
[One (M8) Q&A, Help & Troubleshooting] WinterApocalypse:
I'm in Canada so I cannot use Google Wallet. I'm using my bank's app (TD Canada), which requires an NFC-Sim to function. The app sees it when I'm running a Sense rom, but not a GPE rom.
[General Questions and Answers] Mondop:
Hi all.

I want to ask, if i can uninstall app called "photos" without uninstalling Google+

I don't mean default photos app. I mean that one that is installed with Google+

i don't want have 2x same app in phone

thx guys for help
[General Questions and Answers] bweN diorD:
im sure you "could" uninstall it, but i would be afraid of some crashing in the g+ app because they are linked together.

try freezing it first to see what happens, then if you have a problem it is easy to put back.
[General Questions and Answers] firedoge:
Try this in terminal

su
pm disable com.google.android.apps.plus/com.google.android.plus.phone.PhotosIntroActivity

Best of luck, :)
[General Questions and Answers] Mondop:
Did you mean Terminal Emulator that should i download from google play store? if yes, i tried this and nothing happend

i tried write this: pm disable com.google.android.apps.plus/com.google.android.plus.phone.PhotosIntroActivity

should i add "su" infront of all those words?
[General Questions and Answers] firedoge:
No, first opening the terminal, enter only su

Then terminal emulator is granted root access, thEn type the rest of the command.

**your device needs to bee ROOTED in first place**
[General Questions and Answers] Mondop:
So thats exactly what have i done... :/ not working
[General Questions and Answers] firedoge:
So what is the message you are getting in terminal when you enter those codes??
[General Questions and Answers] Mondop:
exactly what you want from me...

i installed terminal

opened it

wrote: su

allowed su acces

wrote : pm disable com.google.android.apps.plus/com.google.android.plus.phone.PhotosIntroActivity

terminal wrote something with word : killed

then i go to apps

clicked on photos and photos worked....
[General Questions and Answers] firedoge:
Okay, install Rom Toolbox Pro, then open the app, grant root access, open app manager in it, locate

Google+

, click on it, swipe to left and select

advance freeze

, and freeze the activities with the

Google+ photos

icon in it. Done!!
[General Questions and Answers] Mondop:
Ok thanks, it works:)