yashsingh1/xdaforums huggingface dataset:
[Android Builders Collective] Yank555:
Yep, we've been testing builds yesterday against those apps, and crazy thing is, some through as many as 30+ issues, even on factory images ... and running them repeatedly didn't give the same result (from non vulnerable to 30+).

Still no clue as the what the issue is, if AOSP is not on par, if august patch doesn't patch all that it should ... too soon to tell.

We've tested factory images on 4 different Nexus (angler, hh, flounder and flo), as well as YAOSP and Slim6 and results were absolutely unconclusive.

Just ran it again on my angler, now it says 17, yesterday it went from 0 to 42 :eek:

JP.

EDIT :

That specific vulnerability is described here :

https://www.codeaurora.org/invalid-path-check-ashmem-memory-file-cve-2016-5340

And can be fixed by this kernel commit :

https://source.codeaurora.org/quic/.../?id=06e51489061e5473b4e2035c79dcf7c27a6f75a6

It's not present in Google's Angler kernel for example. I don't know if it's needed on kernels prior to 3.10, would need to check as well as other kernels.

So I guess Google is not up to speed on this... and factory images should be impacted the same way, since GPL imposes Google to push the kernel sources they use in factory images.
[Android Builders Collective] ezio84:
edit: that security bug seems more important than i thought, see following posts in the thread.
[Android Builders Collective] ezio84:
About the above security bug:

http://www.bbc.com/news/technology-37005226
[Android Builders Collective] efan3719:
That vulnerability likely won't be fixed until the September security patch. Until then don't install sketchy apps.
[Android Builders Collective] Yank555:
It's an easy kernel fix, my angler should be about built with it.

JP.
[Android Builders Collective] efan3719:
Well nevermind then lol

Is it this stuff?
[Android Builders Collective] Yank555:
What I posted a few posts above here ;)

http://xdaforums.com/showpost.php?p=68092385&postcount=12077

Dunno what CVE the other fixes (kgsl)

JP.
[Android Builders Collective] efan3719:
I need to stay off XDA before ive had my coffee :p :good:
[Android Builders Collective] kantjer:
Thanks :good:

Cherry-picked the fix ;)

Changelog
[Android Builders Collective] Yank555:
Well just tested ... and guess what, the fix is not good enough, still considered vulnerable ?!

So Qualcomm hasn't fixed it like they said : https://www.codeaurora.org/invalid-path-check-ashmem-memory-file-cve-2016-5340

Or the fix info is incomplete.

JP.
[Android Builders Collective] kantjer:
:crying:
[Android Builders Collective] ezio84:
I wonder how that app checks the vulnerability.

Does it do a real test trying to use the security bug? Or does it just check the android build version or security patch level from Phone Info?
[Android Builders Collective] ezio84:
https://plus.google.com/+FranciscoFranco1990/posts/BR6NRSYFSrD
[Android Builders Collective] letmedanz:
Imgur Derp
[Android Builders Collective] ezio84:
Updated kernel for PN mod with CVE-2016-5340 vulnerability fix (see previous page for details):

- Hammerhead > https://www.androidfilehost.com/?w=files&flid=50100

- Angler > http://xdaforums.com/showthread.php?p=68101492

Dirty flash it with twrp (then flashing supersu again is a good idea).
[Android Builders Collective] efan3719:
I'll try to see if I can get a build for Flo with the Quadroot fixes in it tonight. If not Franco kernel has been patched so you can use that in the meantime. I suspect other kernels will follow.
[Android Builders Collective] nathanchance:
I opened the app and it said I was vulnerable to three things: CVE-2016-5340, CVE-2016-2504, and CVE-2016-2059. Now CVE-2016-2504 was patched in the August security update with this commit. Pretty sure that app is checking something bogus.

List of fixes:

CVE-2016-5340: https://www.codeaurora.org/invalid-path-check-ashmem-memory-file-cve-2016-5340

CVE-2016-2504: https://www.codeaurora.org/use-afte...tions-kgsl-module-cve-2016-2504-cve-2016-2503

CVE-2016-2059: https://www.codeaurora.org/projects...r-binding-any-port-control-port-cve-2016-2059
[Android Builders Collective] letmedanz:
My OP for the ROM has not been updated.

Most of the information is available on G+

Screenshots for the included tweaks.

Thank you :)

Is this only with one theme or all themes?

Feature wise, we may not be doing too much extra at this time with N around the corner.
[Android Builders Collective] Yank555:
YAOSP-MM Changelog v1.41beta

This one's for angler only, as I've added msm_hotplug to my angler kernel, plus slightly adjusted the config for it.

Direct download link : https://www.androidfilehost.com/?fid=24671318762848500

Feedback highly appreciated, esp. on battery as well as snappiness (obviously do not change kernel for the test lol).

JP.
[Android Builders Collective] johnb380:
Qualcomm-powered Android devices plagued by four rooting flaws

http://www.computerworld.com/articl...id-devices-plagued-by-four-rooting-flaws.html
[Android Builders Collective] Garrykd:
Here's an updated angler build including the updated kernel :)

Changelog:

PureNexusMod-6.0.1-20160808

=======================

08-08-2016

=======================

* device/lge/hammerhead/

39ac339 Build custom defconfig

* frameworks/base/

566e2d7 Allow on-demand window refreshes using "om refresh"

* kernel/huawei/angler/

6312f95 ashmem: Validate ashmem memory with fops pointer

* kernel/lge/hammerhead/

c103211 Purenexus defconfig

df670cb ashmem: Validate ashmem memory with fops pointer

=======================

08-07-2016

=======================

=======================

08-06-2016

=======================

* frameworks/base/

3a1e3be OMS: fix compatibility with custom battery icons of some themes

https://www.androidfilehost.com/?a=show&w=files&flid=52030

.
[Android Builders Collective] jayjay1234:
If I flash ElementalX kernel over the latest PN-mod will I lose the security commit?

Thanks,

Jay
[Android Builders Collective] nathanchance:
Yes because EX has not merged it. To be honest, as long as you are not installing sketchy apps from the internet, you shouldn't need to worry about being affected by the vulnerability and flar2 is pretty good about staying on top of that stuff.
[Android Builders Collective] harpin14789:
I am on the latest August 5th security patch. Well the quadrooter app by checkpoint says that I am still vulnerable for 3. But there is another quadrooter checker in the play store which says I am safe and not vulnerable. I don't know what to believe anymore.

The other app is called Qualcomm quadroot scanner by trust look.

Google patched 3 of them in the August 5th update, so I don't get why quadrooter by checkpoint is still showing I am vulnerable. :confused:
[Android Builders Collective] efan3719:
the suspect the first app that says you are vulnerable is not actually checking to see if you have the patches installed. it's just doing a check against either the build date or patch date or something like that. i think even with the builds that have the patches added on here it still shows as vulnerable, which wouldnt be the case.
[Android Builders Collective] nathanchance:
On the August 5th build, you are vulnerable to CVE-2016-5340 and CVE-2016-2059 as neither of those fixes have been merged into AOSP. However, even after merging those patches into my kernel, the first app still shows I am vulnerable; I haven't tried the second. I couldn't care less about the app so I just merge the fixes and trust it is good to go.
[Android Builders Collective] harpin14789:
Thanks for clarifying that.

Are those fixes merged into all your Roms that you mention?
[Android Builders Collective] nathanchance:
No, the fixes haven't been merged into the ROMs I build for except for PN-Mod's Hammerhead and Angler kernels (I haven't built it yet, I'll do it tonight). I don't play to merge them in myself, I'll let the developers do it.
[Android Builders Collective] Mikulec:
I dont get this latest hype about vulnerabilities. In the old days you had no idea about any vulnerabilities your device had, and did something happen to you? NO. Just use your device cautiously and you have nothing to fear.
[Android Builders Collective] glehel:
Substratum support is expected in the future?
[Android Builders Collective] indian84:
He mentioned yes. Hopefully before he leaves again for work/ holidays. Or if he is not able to merge all the commits for it, then after he comes back.
[Android Builders Collective] Yank555:
Either I manage tonight (still have 3 ROMs to compile v1.41 with both CVEs fixed), or it'll be for Aug. 22nd ;)

JP.

PS: Vacation still ;)
[Android Builders Collective] ezio84:
http://www.androidauthority.com/google-verify-apps-already-blocks-quadroot-exploit-708838/

Official Google statement about the vulnerability. In a nutshell, useless hype.
[Android Builders Collective] Phazmos:
No computing device can ever be fully secure due to the 1 vulnerability than can never be patched, and that is the human using it.

Like you said, responsible use is the best defense against any vulnerability.
[Android Builders Collective] christianpeso:
It is actually good.

At least people are now becoming aware of security issues with their phone, and by extension, any other computer they use in their life. Does the hype out weigh the risk? Probably so. But it is still a good thing that users are becoming aware of security on their device that probably holds more personal info than anything else they own.

And in all honesty. how did you know if any past vulnerability affected someone? They might of had charges placed on their card that they didn't authorize and thought it was due to something else. Or it can just be a voyeuristic thing and the attacker just likes to read your messages and look at your pics, or see your location. You do not know what is in the mind of attackers if you are not one. Sometimes it is more of a power thing than, "let me exploit these people and see what I can gain monetary wise".

Keep in mind that their are vulnerabilities floating around now that no one has ever heard of and possibly being exploited by those in the know. The more people think about security, the better.
[Android Builders Collective] johnb380:
Ya but the quad rooter exploits everyone is worried about auto roots some 900 million devices. But to people on this forum XDA we are ALL already rooted so it isn't really even a factor that would affect us. Really patching it for a phone already rooted is redundant. You can't root a phone that's already rooted. So for me I could care less if my Rom or Kernel has the fix either way it's pointless to worry about these vulnerabilities as there are so many more we don't know about.
[Android Builders Collective] Alx31:
hi there

yeah im also having that bug when sms coming in...thats kinda weird since both speakers working fine everywhere else :eek: i saw some sound fixes...i'll try them; also the test branch on my kernel (wich isn't yet on aosip devices org) has sh#tload of sounds commits; to be A.R.I.S.E ready but i have to fix intelli_hotplug before releasing builds with it...anyways i'll let you know.
[Android Builders Collective] ezio84:
I recommend to flash soon this new build due to the incoming Substratum update, Nathan already built it so here's the changelog :D

PS: Garry's Angler 20160808 build has already merged the needed stuff.

PureNexus mod 6.0.1-20160809

Download for Hammerhead: https://www.androidfilehost.com/?w=files&flid=50100

Alternative: http://downloads.hostingsharedbox.com/nathanchance/ROMs/PureNexusMod/hammerhead/

Changelog:

- Update Android System WebView to 52.0.2743.98

- Allow on-demand window refreshes using "om refresh"

- Validate ashmem memory with fops pointer (fix the remaining quadrooter vulnerability)

Installation, tips, info: check the 6th post of this thread: http://xdaforums.com/showpost.php?p=55121776&postcount=6

PS: if you have problems, call A-team or clean flash.
[Android Builders Collective] Phrodini:
What's A-Team's number
[Android Builders Collective] johnb380:
Sounds good friend!
[Android Builders Collective] ezio84:
I missed it on purpose: "if you can find them" :D
[Android Builders Collective] Fastrite:
555-6162

#whiteuimustdie
[Android Builders Collective] Smallsmx3:
So on pn mod for angler and HBM doesn't work with the stock kernel. But if I switch to a custom kernel it works. Any ideas
[Android Builders Collective] NHNXDA:
Hey Yank, is there a revised 1.40 now available with WiFi fix, thanks.
[Android Builders Collective] Garrykd:
He's right :good::highfive:

What is HBM?
[Android Builders Collective] limjh16:
Isn't that the b team?
[Android Builders Collective] vsot13:
[MENTION=6842057]nathanchance[/MENTION], dude I feel like a kid in the candy store in your folder. Thank you very much for all you do for community. Is there chance to include Broken ROM in your building machine?
[Android Builders Collective] nathanchance:
I'll look and see but I think I am pretty capped in terms of space.
[Android Builders Collective] modernbummer:
Agreed. Thank you, sir.
[Android Builders Collective] adm1jtg:
He reposted an "improved/fixed" 1.40 this morning been running it all day no issues
[Android Builders Collective] setiawanjimmy:
BELTZ ROM 10/08/2016

Changelog:

+ Fix compatibility with custom battery icons of some themes

+ Navigation button transparency

+ Oms : om refresh https://plus.google.com/+NicholasChumCDT/posts/3CBXSeWwvoC

Features:

+ Up to date oms commits with masquerade built-in.

+ Dirty Unicorn's DUI ( smartbar, fling and pulse 2.0 )

+ https://docs.google.com/document/d/1uBzrsiB1WXbKQneYDACc7JT0LPGNb6ffSURHGrmLxic/edit?usp=drive_web

Download links :

Angler : https://www.androidfilehost.com/?fid=24665542585483483

Bullhead : https://www.androidfilehost.com/?fid=24665542585483484

Hammerhead : https://www.androidfilehost.com/?fid=24665542585483486

Shamu : https://www.androidfilehost.com/?fid=24665542585483485

Mako : https://www.androidfilehost.com/?fid=24591000424953471

Vendor for 5x/6p : http://downloads.aosip.xyz/misc/vendor/

How to flash : Rom, Gapps, Reboot.

Special credits to : cory collins, george g, akhil narang, srisurya95, josh fox, david wilson, nitinkumar chobhe,nathan chancellor, pure nexus, dirty unicorns.

Source : github.com/beltz﻿
[Android Builders Collective] ezio84:
After searching on Google, i guess it's the Samsung Amoled High Brightness Mode. And i didn't know it till now, interesting stuff :D

Flar (ElementalX dev) added the feature on his 6p kernel too, i'll try to add it on PN mod kernel :good:
[Android Builders Collective] indian84:
Hi [MENTION=5379942]setiawanjimmy[/MENTION]

Is it possible for you to have QuickTiles similar to one used in PN Mod or by Yank in YAOSP? I find stock implementation too basic. After all we are talking about CUSTOM ROMs here. :P

Just a request/ suggestion. I know you are busy with Substratum development. But it doesn't hurt to ask. :P
[Android Builders Collective] limjh16:
And I thought it meant high bandwith memory... (for GPU LOL)
[Android Builders Collective] setiawanjimmy:
Hi.. um.. ill think about it. Im used to have wifi and Bluetooth up there in qs.. ?
[Android Builders Collective] indian84:
I like Wifi and Data up there. If you implement Yank's QTs, you can have Wifi and BT as well as three tiles on top row if needed.

But again, you are the project owner. :)
[Android Builders Collective] ezio84:
[MENTION=2789361]Smallsmx3[/MENTION] here you go:

PureModKernelAngler1.1-with_HBM_support.zip

https://www.androidfilehost.com/?fid=24591000424953567

To toggle the High Brightness Mode, there are a lot of ways.

Two of them:

1) https://play.google.com/store/apps/details?id=flar2.hbmwidget&hl=en (also to support [MENTION=4684315]flar2[/MENTION] amazing work)

2) Tasker or Terminal emulator (with root privileges):

"echo 1 > /sys/devices/virtual/graphics/fb0/hbm" to enable
"echo 0 > /sys/devices/virtual/graphics/fb0/hbm" to disable
[Android Builders Collective] Smallsmx3:
It's built into the regular PN kernel. I just thought it was included in the PN mod kernel to and I was doing something wrong.... Thanks so much for this. In Florida the sun is brutal and it's the feature I need most. Thanks for this.

---------- Post added at 03:38 PM ---------- Previous post was at 03:24 PM ----------

Works like a dream!
[Android Builders Collective] Aayushya:
Hi guys, I've always wanted to post here, here goes!

I just got PureNexus booting on moto G 2013, using the amazing hardwork of Hashbang173. All credits to him for porting it to caf devices. [See Here] [And here]

Everything works, except for WiFi. When I tap on the toggle for wifi, it greys out, and the progress bar keeps moving under the toggle (hope you guys got it). I have logs, I used

adb logcat WifiStateMachine:E *:S -v long > pn_wifi.log

And I get this: https://dl.dropboxusercontent.com/u/58434411/pn_wifi.log

Full log with error flag: https://dl.dropboxusercontent.com/u/58434411/logcat_pn_wifi.log

dmesg: https://dl.dropboxusercontent.com/u/58434411/dmesg.log

I am not sure how to fix this, any help will be really appreciated!

Edit: added logs as attachments.
[Android Builders Collective] johnb380:
Try flashing a known working custom caf kernel that's built from before the ROM was built if your device has one. That should clear up the wifi issue for you until the ROM dev figures out and fixes the issue.

Good luck.

Take it or leave it I'm just trying to help!
[Android Builders Collective] Aayushya:
Hey,

I did try using a different kernel, that didn't work out.

P.S.: I am the ROM dev for Falcon, Hashbang made it for clark :P
[Android Builders Collective] johnb380:
Ok well then you might want to check your kernel commits for July and Aug security patches then because WiFi issues are usually from something to do with the kernel in most cases. Maybe there is one or two missing commits that are needed to fix your issue. I'd try to consult with a developer that knows his stuff and that can look through your source and find what's up.

Take it or Leave it, I'm just trying to HELP!
[Android Builders Collective] indian84:
[MENTION=2033478]Yank555[/MENTION]

Hey JP,

YAOSP 1.41 is running beautifully on 6P. Amazing battery life and very smooth. I have micro Sutter's sometimes. But nothing bothering. Must say great work on the kernel.

Loving it so far. Great work as always.
[Android Builders Collective] Aayushya:
Okay, I got it fixed! Used hardware/qcom/wlan from CM, and added in wlan-caf from SlimRoms. :)
[Android Builders Collective] johnb380:
I knew it had to be something missing in your code. Glad you got it worked out.

Take it or Leave it, I'm just trying to HELP!
[Android Builders Collective] amphi66:
Great news! Do you have a link to your PNMod for the MotoG 2013?
[Android Builders Collective] Aayushya:
Well, I haven't made a PNMod for Moto G, the actual ROM is just out. You can check it out here:

http://xdaforums.com/moto-g/development/rom-aosp-pure-nexus-moto-g-2013-t3436826

I'd be interested to make PNMods, but I have no clue of it, never used a Nexus before, so don't know how stuff works here. :(
[Android Builders Collective] Yank555:
There's that and a 1.41 ;)

JP.

PS: Except for flounder, wifi still broken, and I won't have time to look into that until I'm back, leaving again tomorrow.

---------- Post added at 22:07 ---------- Previous post was at 22:03 ----------

While I tend to agree, I'm compiling a version without the hotplug cause I had 2 random reboots today, so 2 in less than a day vs. 0 in ~10 months ...

I'll dig into it when I'm back, as I like it esp. because it keeps the device a lot cooler, but for now I need a reliable phone while traveling ;)

Note the stuttering likely are because my config for hotplug is probably a tad too conservative ... need to play some more with it.

JP.

PS: I'll post it an AFH, so you cn choose in case you run into some issues.

Edit :

Angler v1.41 with hotplugging : https://www.androidfilehost.com/?fid=24671318762848532

Angler v1.41 without hotplugging : https://www.androidfilehost.com/?fid=24671318762848726
[Android Builders Collective] fracman:
Thank you Nathan for this absolutely amazing experience on my 6p
[Android Builders Collective] nathanchance:
Please, it's all [MENTION=2095315]ezio84[/MENTION] and [MENTION=4395895]BeansTown106[/MENTION], I am just a build bot :silly: thank you though, glad you enjoy it!
[Android Builders Collective] indian84:
Well no reboots for me. Guess my usage is not as heavy as yours. Thanks for the backup build though.. Have a good holiday.
[Android Builders Collective] ezio84:
Some info about the incoming Substratum beta update:

https://plus.google.com/+SykoPompos/posts/acZ6gcByXRR

Don't trust this karnt, guys :rolleyes: :D

If PN mod is good, it's also thanks to all ABC guys here, Nathan included. On Hangouts i break their balls a lot of times, to take suggestions, help about the code, and so on :angel:
[Android Builders Collective] limjh16:
You can see what modifications were made to pure nexus, and apply the same commits to the respective repo for PNmods. There will most definitely be some bugs after that, but that should be sufficient to get it to boot. (Well for me the rom even booting takes like 5 different trial and error builds so expectations differ)

In other news, I may leech off you and take the CAF pure nexus repos haha thanks for your work anywayd!
[Android Builders Collective] kantjer:
Uploaded today's PN mod build for Angler.

Starting this build I now use [MENTION=6842057]nathanchance[/MENTION] new Ninja kernel, for me it's stable and blazing fast.

As most of you probably know, most themes require TBO ThemeReady apps for most Google apps to be themed properly.

Depending on the GApps package used there will be an overlap between GApps and TBO ThemReady making it necessary to flash them in the correct order and also to flash both zip's when updating GApps.

To overcome this I made a TBO ready Dynamic GApps package (arm and arm64 only) based on Banks Dynamic GApps.

I removed all apps that are in TBO from the GApss package and also remove all x86 apps from GApps reducing the size of the GApps to under 130MB

You will still need to flash both GApps and TBO ThermeReady but because all overlap is removed the package size is greatly reduced and you can update them independent of each other.

pure_nexus_angler-mod-6.0.1-20160811

Download TBO ready GApps
[Android Builders Collective] Aayushya:
I'm building straight from ezio's github. Let's hope it builds, and boots! :D

I'll probably just continue with one of them, so I'll just test both and see :)

The CAF repos are not maintained by me, they're by Hashbang. You can see his work here: github.com/purenexus-clark

I just used his repos and made trees for my device. :)
[Android Builders Collective] limjh16:
Ahh okay

Well, thanks to HashBang then :)
[Android Builders Collective] Donric13:
Hi. Really like this thread and appreciate the work you all are doing. It's a great benefit of the nexus devices having so much rom and mods to rom. So big thanks to you. I am also a big fan of having the possibility to have a dark and bright mode and to change it automatically (rom implemented or tasker). I more like dark mode but through the bright day you can't really read things in dark mode. So i use bright (or light theme) through the day. Actually it seems that dark mode has dropped in nougat.... So that's why i ask if it is possible to implement dark and light mode in the mods (especially in pm mod)? Maybe someone has also an idea how to implement this with tasker and substratum. Bit i am not so experienced with tasker....

Gesendet von meinem Nexus 6P mit Tapatalk
[Android Builders Collective] MarcoG::
[MENTION=3306843]kantjer[/MENTION],your new PNMod build with the new Ninja Kernel [MENTION=6842057]nathanchance[/MENTION] is buttery smooth,fast and stable

Gesendet von meinem Nexus 6P mit Tapatalk
[Android Builders Collective] Smallsmx3:
Any one have issues with not getting notifications? Seems like my G+, XDA, and a few other apps work for a bit on a fresh install but either stop or have a long delay after awhile. I don't notice I miss them until I go into the app... Then I get notified. Latest PN mod