yashsingh1/xdaforums huggingface dataset:
[G3 Original Android Development] vmancini3:
You don't even have to be connected to any sort of network when you run the app! If you're really that concerned, download the apk, put your phone in airplane mode, install the app, root the phone, uninstall the app, finished!
[G3 Original Android Development] Enddo:
so? what is to stop them from installing something else before this apk is uninstalled?

Look, I'm all for the developers needing to keep the methods used from the tools they release a secret. But I agree with the person above, the way that developer avoided answering direct questions is incredibly incredibly fishy and should raise a red flag to anyone concerned about who and what has access to their smartphone
[G3 Original Android Development] TylerDurdenK:
So check running processes, or install a new ROM.
[G3 Original Android Development] tschmid:
Ok, but if you uninstal the apk and do a factory reset there arent downloaded apk's anymore. Im happy thecubed and others put their energy in this to give us root and custom recoveries.

Its up to you if would use this method or stay away. Just my opinion

Gesendet von meinem LG-D855 mit Tapatalk
[G3 Original Android Development] Enddo:
Don't get me wrong. I'm not saying the work they did is any less appreciated. That entire team has done a lot to advance community development for the LG G3 and I appreciate that immensely. No matter how much I appreciate it though, that doesn't make it ok to avoid answering questions like the ones that were presented.

If the reasons are to protect the ip address of their server then that should be explained. If there are reasons why they need access to Google now(which I assume gives them access to search queries) then that should be explained. Even if it is done vaguely to protect their closed source information

I'm not saying that I demand they remove these permission and I'm not saying that they should give all their secrets away. I just think the way that question was answered is very, very suspicious.
[G3 Original Android Development] :
I can't has Stump root?
[G3 Original Android Development] jsamuels:
Successful on D855 v10h-EUR
[G3 Original Android Development] jcase:
I was always told to keep my mouth shut if i didn't know what I was talking about. I don't always do it, but I try. Sometimes it saves me from looking foolish.

Its a root exploit, it gains root without needing a su binary. IT CAN ADD PERMISSIONS AT RUN TIME, AND DO THINGS ABOVE AND BEYOND ANY STANDARD ANDROID API.

This goes for anything running as root. Its root, it needs no freaking permissions, it was a courtesy of being upfront and open by adding them into the manifest. Anyone freaking out about permissions a root app uses, doesn't even know in the slightest what they are talking about. Sure it could be doing something bad, but if i was hiding something bad, why would I declare the permissions when I don't need to?

Would you rather me build it with no permissions, and then add them at run time without letting you know? I mean, its an app that can gain root without su/superuser, and thats only like an extra 10 lines of code to add all those permissions at run time, without you ever knowing. I could be disabling signature checks to trustzone, and installing a rootkitted trustzone, I could be spying on you at a level far below and out of reach of Android. You might want to burn that phone, cause I mean I'm American, and a hacker. Americans == NSA, hacker == spy.

If you want to hint that im being suspicious or doing something bad, put it on the table, show me and tell me what I'm doing, other wise you are the suspicious one. Either you have no idea what you are talking about, or you are trying to smear me. So which is it?
[G3 Original Android Development] jcase:
I never discussed why I added the permissions to iomoster/thecubed or anyone. I added them. ME ME ME ME ME. Not thecubed, not autoprime, not anyone. Me. I added them. Don't blame him, bring the bIame to me. I didn't discuss the reasoning behind it with anyone. It's none of your business, if you don't like it, dont use it. Why did I add them? Because I can, it consumes time trying to figure out why I added them (ie time of LG trying to fix it, extending how long stump lasts). The negative side effect, is that it brings out the conspiracy theories, and those that don't have a clue what they are talking about. If you want to smear me like this, I expect you to show me where this malicious code is.

This kind of bull is why I hate working with the LG crowd. You people have pulled all the fun from these kinds of projects. I can't wait until Purple Drake and Stump are patched.

Show me the potential for it to open a VPN and "query the search", it is all java, it disassembles and decompiles cleanly. Put it on the table. I wrote the damn code, I know damn well that code doesn't exist. At this point you are just smearing me and the others, probably jealous of the fact that some of us can do this kind of work, when you lake the skill set.

Next LG exploit I write will be $25, no matter how simple it is, or how quick it is made. If I have to listen to people who have not one clue what they speak of, I should at least get paid enough to be drunk through it.

Elvis is alive, its all a KGB conspiracy.
[G3 Original Android Development] thecubed:
^ What this man said.

Basically, if you don't want to trust us, that's fine. Don't use the app if you think we're shady. However, we'd appreciate it if you'd keep those opinions to yourself. Nobody is forcing you to run this apk, and there's no need to create panic within the community.

If I sat here and explained how Stump and Bump worked LG would patch them in a heartbeat. We're *sure* they've been reverse engineered by now, but the thing is by being obtuse about it we're also protecting it from malicious people.

Imagine this: if we can do it with an APK that is *meant* to root your phone, what's stoping that latest FREE GAMEXORS app you just downloaded from some Chinese dev on the market from rooting your phone and mining bitcoin on it when you're asleep?

Look at our past history here - have we ever done anything close to shady with anyone's phone? No. We root them for you, and we leave your phone alone.

Respect of other people's property (your phones) is all of our utmost priority.

Don't want to trust us, fine. Just please don't go alarming the public over absolutely nothing.

Thanks.

Can we get a mod in here to clean some of this BS up? I'm fine if my posts have to go too just to calm this thread down.
[G3 Original Android Development] :
I would like to back away from my earlier post and apologize first. I fully concede I am a nobody. I don't write code. I don't develop. I'm simply your above average android user that wanted to look into rooting a phone. I suppose I could go back and edit my original post, but its quoted for all to see so I'll leave it there.

This whole situation seems to be getting out of hand because of the great divide between a developer, and a regular guy like me. Clearly we aren't on the same page... To help, I'd like to share our perspective on android apps, data mining, and app permissions... (While I say I speak for most, I may just be speaking for me)

Some points on what fuels our questions about the permissions:

* Your basic android user is being conditioned to view permissions as the way to tell if an app is malicious or not. Maybe this is not always the case, you know better than I. But like it or not this is currently the dumbed down way for us to think we can know if an app is ok or not. Is it right? Probably not as I've seen devs have to hop on reddit to defend and explain permission that the put in their app.

* Clearly we don't understand the difference between a root app and your regular run of the mill app. This seems to be the perfect chance to educate us.

* Our data, search preferences, phone usage, etc now have monetary value. Right or wrong, the permissions could lead your average user to believe their personal data was being targeted.

* I have had personal experiences that have led me to believe that nothing in this world is free. I know the devs take donations, but sometimes I wonder why they put so much time and effort into something that has little return. the tinfoil wearing conspiracy theorist in me reasoned that if the devs don't even want to entertain a question about permissions, maybe they had something to hide or to gain from us using the app.

With all that out there, some of us need to back away from the fear mongering. I concede that I did not know what I was talking about, my suspicion was aroused at the response from the cubed's response to the original query for an explanation of the permissions. I hope you can see that because he never even entertained the question, it came off as dodging the question. That fueled the fire from there.
[G3 Original Android Development] jsamuels:
Thanks for the great work. I feel your frustration. Trust that not all of us share the conspiracy theories, etc. I just moved to LG and am surprised at how some users react. I hope it's an anomaly as I like the phone and have been greatly impressed and thankful for your efforts.
[G3 Original Android Development] jcase:
* I've never seen anything telling a user to view permissions to determine if an app is malicious or not, thats an incredibly bad way to determine such a thing. Anyone recommending that, shouldn't be speaking.

* Educating people is not something I often have time to do. When I do, it runs about $1500 a day, and lasts 2-5 days. Last training session I was involved in was in Las Vegas in August, I don't expect another one until March, possibly in Singapore or Seattle.

* If I wanted your data, I would have it without you knowing. I could easily slurp it all up in any exploit I write, without adding any permissions. If I was being malicious, the average or even above average user would never catch me, it would probably take the experienced developers quite a bit of time to prove it, or figure it out.

thecubed helped develop the exploit, as far as technical information. He is responsible for identifying the vulnerability, but as the credit says I wrote the code (which was the easy part, he provided the GOODs in this case, I just packaged them). I'm quite sure he understands why I did what I did, as it is quite obvious, and any developer worth his salt would realize why. Still, I never told him why, he isn't going to speak for me, and the question was never brought directly to my attention by anyone.
[G3 Original Android Development] tschmid:
Its allways the same, kids are whining -> devs are gone. Sad?

Gesendet von meinem LG-D855 mit Tapatalk
[G3 Original Android Development] thunderwagn:
Hopefully you guys do know how much your efforts and accomplishments are appreciated by most of us here. Please don't let a few bad apples get you down, or bring down the rest of us.
[G3 Original Android Development] thecubed:
Now this is a well worded question. I'm perfectly happy to answer these to the best of my ability, but keep in mind I can't go into full depth as to why we'd require individual permissions.

1. Under normal circumstances, yes, an app that requests ALL permissions on your phone should be avoided. That's good logic there.

2. A root app is designed to *break* the security of your phone, and convert your phone's security from being managed by your carrier via OTA updates and builtin permissions to *you* being the one in charge of security.

Once your phone is rooted, it is a GIANT security hole, and there are many ways for other apps that now list only one permission or two to actually gain ALL of them and full persistent control of your device.

That'd sound like fearmongering on my part if I didn't follow it up with the fact that once rooted, the XDA community has done their best to ensure that the applications that you use to gain root access (SuperSU/etc) are secure. This means that any time something wants to gain elevated permissions (thereby bypassing the android permissions system) you should get a nice little popup saying "Hey, this app wants to do something as superuser (root) on your phone. Is that okay?" just like Windows does with UAC.

There are ways around that, and there have been examples of malware attacking rooted phones before. It's just a game of cat and mouse.

3. Indeed, a phone does have monetary value outside of just the physical hardware. However, selling that data without your consent would go against our ethos. We respect your devices, we respect your data, and largely we respect you too. We value being part of the community, and doing something that violates our ethos would be a surefire way to get banned from any mobile phone circle ever. We definitely don't want to do that.

This application needs *certain* permissions for it to run in general. Once it's running, it uses holes in the android operating system (at least the parts LG has put together) to modify your phone at a fairly low level. Permissions, as stated above, are practically irrelevant after that. However, we do at least say to uninstall the app to ease any fears that the app itself is doing anything malicious.

If you're worried about the security of your android phone, I'd recommend not rooting your phone at all. I'm not being inflammatory, but rooting your phone now takes the knowledge and experience out of the hands of your carrier - who usually has more experience than the average user at securing a phone - and puts that control into your hands. You are now responsible for managing your phone inside and out.

Some people like me enjoy that, for other people it's not for them. It's up to you to make an informed choice if you want to.

Thank you for rewording your comment and allowing for a much more productive discussion.

If it seems like we jumped on you for your comment, I'm sorry, it's just like being called out in a crowd - your first reaction is to respond as quickly as possible to prevent panic.
[G3 Original Android Development] tschmid:
Yes thats true The King is alive (he's living in switzerland)

Gesendet von meinem LG-D855 mit Tapatalk
[G3 Original Android Development] chuckwago88:
First of all, thank you for your work, and also for this response. I tried asking this without accusing anyone of anything, just wanted to know if anyone knew why. We do appreciate everything you guys do, and most don't know nearly as much as you do. I am sorry if my question was uncalled for or fueled the fire.
[G3 Original Android Development] PlayfulGod:
OMG!!!!

all I can say for the last several pages I've just read is LOL. Some of you should just be ashamed of yourselves. To think jcase, IOMonster, autoprime, or myself or any others than may have been involved would do anything other than what we stated the apk does...

That just saddens me, especially since they are and have been other root apps that raise alarms on even the crappiest of AV, by dev unknown, unheard of, and hosted on some of the worse sites I ever seen, yet they are all still praised, used, and defended by the community that uses them.

These guys worked long and hard on Stump, thought it out well, put alot of thought in how to distribute it, make it easy to use, and even updated it to work on more than its initial intended use (the g3).

You all wonder why devs stop doing things altogether, or start charging for their time, well here you have it, prime example number ONE!!!.

For all of you that have appreciated, supported or even defended us, thank you all, you are the ones we aim to help and make this hobby fun, enjoyable, and worth the time we put into it.

For all the na sayers, accusers and those who think they are entitled, go buy a iphone, then you will really have something to complain about. ;)
[G3 Original Android Development] deathsquad737:
Look for any one who thinks that these guys are thiefs is a freaking idiot and I will sponsor and lead a a petition to have you slapped in the face with my girlfriend B.O.B!These kats ain't Rom builders and kernel tweAker or thread trollers these guys are f n big brainers!if only your brain was as big as there's you might one day be able to show someone besides your lil brother your big brain!?lol.,... Ps to All others I apologize for this rant!

WHATSAMATTA U ALUMNI
[G3 Original Android Development] HAvoktek:
Cot damn wtf is going on doesn't anyone read anymore???!!! Are we all a bunch of babies with our hand out??? Damn people if you not down with educating yourself or learning about what android is and how its done the get you an I device....You can't start and argument about something you don't understand but want to use it....tired of this crap.
[G3 Original Android Development] mgbotoe:
You know what they say, can't satisfy anyone lol
[G3 Original Android Development] MarimoMusicHead:
Say, I've been downloading an OTA update (318.38MB), for 5 hours now... I got decent download speed(5Mbit/s), it's a bit slow, but that's not the point here tho, I seem to have read that some of you lost root when OTA'd...?

What do you suggest, to go through with it or ignore it and do the kdz flash of the latest firmware?

Edit: Yup, bricked it. System didn't boot, all I got was recovery, was expected tho...

Kdz'd to v10L this morning, rooted with Drake, all is well in the land of the free.
[G3 Original Android Development] hwong96:
For all those people who are not well versed in the art of rooting- no one is forcing you to use a particular method of rooting your phone. It is your choice to root or not. You could always write your own rooting code, but chances are you don't know beans about programming. Manufacturers have trade secrets, so do programmers. Rooting is not for the timid. You risk bricking your device as evidenced by the myriad thread screaming "HELP! I bricked my phone!" if you do not know what you are doing. All responsibility falls on the user. These developers take great pains to supply us with a viable solution to help us gain the freedom our devices so deserve. They do not owe us anything. So, for you skeptics, keep your phone stock and enjoy it the way LG wants you to use it. For those who want to free our phones to push its capabilities to the limit, enjoy!
[G3 Original Android Development] OffDatGoGo:
Very well said! [emoji106]
[G3 Original Android Development] supermarioarv:
one question :

i have the g2 d855 (european) and i rooted my phone running v10h whith stump root , everything went well.

i checked over the air updates yesterday and gave me message that v10L is uvailable for download.

can i make the update withuot messing up the phone?

will i have any problems (brick my phone or any other) if i make over the air update while im rooted with stump root?
[G3 Original Android Development] RandomPooka:
Exploiting a vulnerability is a lot like standing on one foot during the right phase of the moon, setting a Hawthorne branch on fire, and reciting the second verse of Yellow Submarine backwards. In Greek.

You've got to make certain things happen in a certain way, and pounce on the opportunity that arises when all the said conditions have been met. If the exploitable situation is from a weakness in the vpn code, then.. Do the math.

---------- Post added at 06:40 PM ---------- Previous post was at 06:36 PM ----------

@jcase and [MENTION=1157052]thecubed[/MENTION] - thank you, and everyone else for figuring out which song needs recited backwards and what phase of the moon is required. There are very many incredibly grateful users out here.
[G3 Original Android Development] HAvoktek:
Well said again! Here, here!
[G3 Original Android Development] meyerweb:
Certainly not ALL of the LG crowd. I think the vast majority of us have great respect, and gratitude, for what you do, and have no qualms about your tools. I certainly feel that way.

Thank you again!
[G3 Original Android Development] bunchies:
Hell yeah!, if people cant respect the free work they do to allow us to make our devices into what we want them to be, Than they can just go get an iPhone
[G3 Original Android Development] sudhir3127:
Not working on my international D855. Version V10j
[G3 Original Android Development] otcd:
Not working on my international D855. Version V10L
[G3 Original Android Development] ahmed534:
it is working like a charm for me . just heard that for those who got V10L, only PurpleDrake can gave root access
[G3 Original Android Development] otcd:
This is what i meant, that Stump Root doesnt work on V10L
[G3 Original Android Development] ahmed534:
you were talking about v10j mate :D
[G3 Original Android Development] mickfitz:
I'm unsure why jcase quoted me.

The app doesn't work for my d858 and my numerous posts willing to donate for root access shows I'm not expecting anything for free.

If you aren't going to update a new version then it's no use to me sitting in my phone.

Support the d858 and 25 bucks to each developer involved.

Sent from my LG-D858
[G3 Original Android Development] Slmii92:
Not working on my V10L either. Have the D855 version. Worked on the H, great app!
[G3 Original Android Development] tschmid:
Just try purple drake

Gesendet von meinem LG-D855 mit Tapatalk
[G3 Original Android Development] htcgr:
...maybe stump root needs update..??!?!??!:rolleyes:
[G3 Original Android Development] hluu0111:
WORKed with my phone D855 V10i-AUS-XX KVT49L.A1408602401

Thanks.
[G3 Original Android Development] ChongoDroid:
Don't think that's how exploits work.

But if any one can do it, its jcase
[G3 Original Android Development] justibasa:
All I have to say is everything you guys do is definitely appreciated by most of us. I just personally want to say thank you for all you have done for this community. You guys are amazing and deserve better than you are getting. Once again thank you for your work. We should be humbled by what work you have put in to make our phones better.
[G3 Original Android Development] :
If that's how you feel then just don't use the app. Plenty of people have downloaded the app and ran it with no problems at all. They probably don't want to say how its done, because then LG would probably patch the exploit up and release a patch. Just be greatful that these guys took the time to write this program. They could have just saved it all for themselves and not released it to any of us.
[G3 Original Android Development] istinet:
I totally agree with you, but I have bad news. The exploit have been patched in the v10l version.
[G3 Original Android Development] gwolfu:
yeah though so... on my test LG G3 got the same
[G3 Original Android Development] fgcchevy:
You people think He's gonna update after the last few pages of people accusing the team of putting malicious malware on to out phones? I'm sad reading the last 7 or so pages of this thread. We will all b lucky if they release anything further for our devices.
[G3 Original Android Development] macdofco:
LG Vista? Is anyone working on Stump Root for this phone?
[G3 Original Android Development] mickfitz:
One person asked about permissions and the questions were never addressed by jcase, he chose to get defensive and tell us how much money he makes. Nobody else accused them of anything.

If they don't want release a new 1.3 version due to a query/feedback then thats petulant.

The sycophantic nature of these replies for the developer is laughable.

Sent from my LG-D858
[G3 Original Android Development] Will32:
I, for one, am satisfied with the answer jcase gave about the permissions issue. He basically said that permissions aren't even required in the manifest because the app runs at root. He could have (and probably should have) not even included those permissions to avoid this. Call me crazy, but I trust the info on my phone with the devs in question. I don't bank from my phone anyway. Jcase probably knows that LG folks read this stuff and if he can keep an running in circles while trying to patch by adding permissions, more power to him.