yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note 4] android-DEP:
adb remount would normally do the trick prior SELINUX being enforced but due to the situation of how locked down this phone is, it is no longer possible to use adb shell to remount the system as well as its no longer possible to to run adb root to start in a root shell either. Chroot is also disabled much like every other limited command that's on Android 4.4.4. So there's no chance of running sudo anything. For su to even function at this point requires the SUID bit to be set aside from either using Chainfire's supolicy tool to explicitly grant permissions by allowing certain contexts to perform certain actions on the system or by bypassing the SELINUX security altogether by setting it's setting to run in Permissive mode instead of Enforcing by running "setprop ro.build.selinux 0" and "setenforce 0"

so mostly of what everyone is experienced with from beginner to expert in the world of unix\linux\android, cannot be applied or works like it used to with this new SELINUX policy system where these are the new rules:

● Root daemon minimization.

● Selective capabilities reduction, e.g. installd.

● Per-subsystem UIDs, e.g. radio, nfc, bluetooth, media.

● Per-app UIDs.

● Blocking privilege escalation by apps (NOSUID, CAPBSET_DROP,

NO_NEW_PRIVS).

● Read-only /system mount.

● NX/XN, ASLR, PIE, RELRO, FORTIFY_SOURCE

• Focused on protecting a set of root daemons.

– installd, netd, vold, zygote.

– Protect from misuse, contain damage from exploit.

• Prevented exploitation of a long-standing (since 2010)

local root vulnerability in Android vold, fixed in 4.4.3.

– Similar to various other Android root exploits blocked

by SELinux, see our prior papers/presentations.

• SELinux enabled and enforcing is mandatory.

– Required by Android CDD and CTS for >= 4.4.

• There is no generic unconfined domain.

– But specific domains can be marked with the

unconfineddomain attribute.

– Even such domains are not completely

unrestricted by SELinux.

Confined Domains

• 4 (out of 47) in Android 4.4.

– The previously mentioned root daemons.

• 49 (out of 61) in Android L Developer Preview.

– Including all third party apps.

• 62 (out of 65) in AOSP master.

– Everything except for kernel, init, init_shell.

• (for Nexus 5 -user build)

Protecting the Kernel

• No domain can map low memory.

• No domain can read/write /dev/kmem or

/dev/mem.

• Only init can modify proc security settings

(kptr_restrict, mmap_min_addr,

dmesg_restrict, ...).

• Only init can load/reload SELinux policy.

• No domain can switch SELinux to permissive.

• Not even unconfined domains!

Sorry to share all that negativity so early in the day, the rest can be read at http://kernsec.org/files/lss2014/lss2014_androidtcb_smalley.pdf just in case anyone wants to get a better understanding of the extent of this challenge.

Nonetheless it's an interesting challenge, it's not as simple as it may seem on the surface.
[AT&T Samsung Galaxy Note 4] munjeni:
removed
[AT&T Samsung Galaxy Note 4] just501337:
No worries, I'm just trying to help =] From that list it sticks out to me that its using initd which is fairly oldschool at this point in open source. Do you happen to know if it will be switching to systemd with lollipop? If so, I can imagine new holes in security due to systemd being bleeding edge..

E
[AT&T Samsung Galaxy Note 4] Surge1223:
Wait so what was the original reversed code you posted from?
[AT&T Samsung Galaxy Note 4] munjeni:
briefroot (main function)

I am stuck on http://xdaforums.com/showpost.php?p=58460530&postcount=1171 since can not use QSEECOM_IOCTL_SEND_MODFD_CMD_REQ since app_id is 0, not understand how to change it but it seems changed using QSEECOM_IOCTL_APP_LOADED_QUERY_REQ provided in decompiled briefroot main function!?
[AT&T Samsung Galaxy Note 4] jpfulton248:
Won't this not work until you get to system? Or are you testing on a different device?
[AT&T Samsung Galaxy Note 4] munjeni:
yes, system user require! In any way my source code not working since missing something which I not understand by now, but it can be done with help from you guys.
[AT&T Samsung Galaxy Note 4] android-DEP:
Actually, i did compile CVE-2014-4322 using Android NDK tools from retme's github which compiled into a file called msdd

The exploit source within his cve201479xx POC source code was using a different file called msmattack which I swapped out with the compiled msdd and then recompiled his cve20147911 app....

now im able to get logcat to show

TAG PID MESSAGE

cve 27039 43491000

cve 27039 400ef000

cve 27039 401b7000

cve 27039 exploiting..... static address 0x44492000

cve 27039 exploiting..... gadget buffer 0x444aa2a0

cve 27039 exploiting..... gadget buffer offset 0x182a0

cve 27039 spraying.... 0

cve 27039 spraying.... 100

cve 27039 spraying.... 200

cve 27039 spraying.... 300

cve 27039 spraying.... 400

cve 27039 spraying.... 500

cve 27039 spraying.... 600

cve 27039 spraying.... 700

cve 27039 spraying.... 800

cve 27039 spraying.... 900

cve 27039 spraying.... 1000

cve 27039 spraying.... 1100

cve 27039 spraying.... 1200

cve 27039 spraying.... 1300

cve 27039 spraying.... 1400

cve 27039 spraying.... 1500

cve 27039 spraying.... 1600

cve 27039 spraying.... 1700

cve 27039 spraying.... 1800

cve 27039 spraying.... 1900

unfortuneatly though, this exploit is supposed to create a file named file.txt on the /system partition before rebooting the phone, it reboots but after dozens of attempts, it doesn't create that file
[AT&T Samsung Galaxy Note 4] jpfulton248:
Has anyone tried reaching out to retme to see if he is willing to help? His contact info is readily available through github. Not sure if he's on xda.
[AT&T Samsung Galaxy Note 4] android-DEP:
according to the github page for CVE-2014-4322_poc, retme states on the first page

how to build

ndk-build

usage

Kitkat:

run exploit as system privilege

Lolipop:

run exploit as system privilege,with SELinux context such as "keystore","vold","drmserver","mediaserver","surfaceflinger"

If exploit successed,you will gain root privilege and "kernel" SELinux context

---------------------------------------------------------------------------------------------------------------------

following his instructions, i attached the output file it created using ndk-build

on top of Android SDK, you have to download the Android NDK tools as well to build this module which includes the kernel header

i'll attach the working directory as well with the module compiled inside of it
[AT&T Samsung Galaxy Note 4] munjeni:
Thats for an old qseecom driver and it will not work if your kernel have newer qseecom! For example to be sure look into line 3144 from here -> https://github.com/syhost/android_kernel_zte_nx503a/blob/kk-4.4-rb4/drivers/misc/qseecom.c

If you see data->client.app_id in your phone kernel source, exploit from retme7 have no chance to get work on your kernel! Also no one version of exploit will work if your kernel have patched vulneability:

https://www.codeaurora.org/cgit/qui.../?id=b9470692c228608ef0ec60747ac2732ad7ffedf0

https://www.codeaurora.org/cgit/qui.../?id=e909d95e6bded328e388d5b8d123297bbbb70728
[AT&T Samsung Galaxy Note 4] FiniteTime:
Great work munjeni! As long as you're successfully using CVE-2014-7911 (ObjectInputStream) for SYSTEM then we should be really close.

That's a good idea.

[MENTION=3975929]zxz0O0[/MENTION] as the author of giefroot (being used by munjeni), would you be willing to help [MENTION=3975929]zxz0O0[/MENTION] ?

---------- Post added at 10:05 AM ---------- Previous post was at 10:02 AM ----------

[MENTION=4558078]ZPaul2Fresh8[/MENTION] confirmed that CVE-2014-4322 (qseecom) is fixed in N910AUCU1BNK3 but it might not be in N910AUCU1ANIE.

Actually, [MENTION=3975929]zxz0O0[/MENTION] do you still need kallsyms or anything from a Verizon dev phone that you haven't gotten?
[AT&T Samsung Galaxy Note 4] munjeni:
I will be happy to get this working without his help.
[AT&T Samsung Galaxy Note 4] zxz0O0:
I'm not sure what munjeni is trying to do? Trying to reverse my exploit? For what purpose?

PS: My code is not based on retme's work, I have created the exploit one week before he released his POC on exploit-db.

[MENTION=6122418]FiniteTime[/MENTION] no, I've figured out how to get kallsyms from kernel image, thanks to info from Surge1223
[AT&T Samsung Galaxy Note 4] munjeni:
Learning purpose. You can search in kallsyms for ptmx_fops address with help of the function MyCred, I have idea but I am unable to solve by now app_id
[AT&T Samsung Galaxy Note 4] FiniteTime:
Oh ok, please ask for anything else you need. Many eager testers around here.

[MENTION=4120742]munjeni[/MENTION]

I downloaded the source for N910AUCU1ANIE and N910AUCU1BNK3, here is the qseecom.c from each:

NIE_qseecom.c

https://gist.github.com/anonymous/e5249b72ca31407eb82a

NK3_qseecom.c

https://gist.github.com/anonymous/88cb986a577530ae59d7
[AT&T Samsung Galaxy Note 4] munjeni:
Probably retme7 exploit with work on your kernel since I can not see app_id check!
[AT&T Samsung Galaxy Note 4] Surge1223:
Im going to convert this into an NDK compatible build, whereas you and I may be able to solve unknown references and fix up the files to build, im afraid others might not find it so easy (I had to fix a few references in kernel includes for it to compile). This will also make it easier for others in here to compile.
[AT&T Samsung Galaxy Note 4] zxz0O0:
We need to clarify if system exploit works. We don't need to talk about kernel exploit since it's useless without system (or drmrpc) permission.
[AT&T Samsung Galaxy Note 4] munjeni:
Which error you have?
[AT&T Samsung Galaxy Note 4] FiniteTime:
Hm well its looking good on the kernel front since at least NIE should be vulnerable to CVE-2014-4322 (qseecom).

Besides that exploit apk, is there a way to look in source or do something to a phone (dev or retail) to check if it is vulnerable to CVE-2014-7911 (ObjectInputStream)?
[AT&T Samsung Galaxy Note 4] Surge1223:
None really I meant I just had to define my kernel dir. Ah nvm we'll just keep it the way you have it, I'll just post the Makefile instead for people.
[AT&T Samsung Galaxy Note 4] munjeni:
For all who want to test if system exploit is working, run do_exploit.bat and look into /data/local/tmp folder for root.log, open root.log it must contain "system" string or if not or if no file its maybe not working on your device! ALLOW_MOCK_LOCATION must be enabled in development submenu on your phone and also addroid debuging enabled before test!
[AT&T Samsung Galaxy Note 4] FiniteTime:
Any testers, please say your Baseband and if it worked!

As in NIE or NK3 for AT&T and NI1 or NJ5 for Verizon.

[MENTION=3647977]jpfulton248[/MENTION] [MENTION=6139444]jorgasm209[/MENTION] [MENTION=6091642]davbay1[/MENTION] [MENTION=3302422]howellcp[/MENTION] [MENTION=6174941]iRashawn229[/MENTION] [MENTION=5300329]K-alz[/MENTION] [MENTION=6157272]DroidHelp101[/MENTION] [MENTION=2310748]stvn1337[/MENTION] [MENTION=6109195]Simsron1[/MENTION] [MENTION=3198335]allenjthomsen[/MENTION] [MENTION=2228874]hnic32[/MENTION] [MENTION=5062308]Techinstein[/MENTION] [MENTION=806582]pr0cl1v1ty[/MENTION] [MENTION=5633210]dabl198327[/MENTION]

Test here:

http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post58464146#post58464146

EDIT: Waiting on an updated test rar.
[AT&T Samsung Galaxy Note 4] jorgasm209:
No for NJ5 ... but pretty sure it has confirmed that this is patched in this Firmware. Someone with NI1 needs to test please :)
[AT&T Samsung Galaxy Note 4] :
No luck on NI1.

Edit: My NI1 is strait out of the box. I never took a OTA.
[AT&T Samsung Galaxy Note 4] pr0cl1v1ty:
Ok, so no go for verizon so far, still looking for both AT&T builds.
[AT&T Samsung Galaxy Note 4] fromeo85:
No luck on NK3
[AT&T Samsung Galaxy Note 4] DroidHelp101:
When i run it on At&t NIE, it just hangs at the screen sowing the device is not vulnarable. I have been able to make it past that, but when i check inside of the "data" folder, its empty, Anyone want to team viewer in, feel free. Let me know
[AT&T Samsung Galaxy Note 4] DroidHelp101:
Edit, pics added
[AT&T Samsung Galaxy Note 4] K-alz:
I apologize if I offended you, but this is the world of trolls as you may know, my brother. So, I just wanted to make sure the guys here check it out because what you stated sounded interesting. Any help is very much appreciated. :)
[AT&T Samsung Galaxy Note 4] munjeni:
If somebody see empty root.log its maybe a working system exploit! Since I used command "whoami" which is part of the busybox, command will not write to the root.log if you have no awailable whoami command, so you need to replace "whoami" with "id" in file caled "a" provided in my attachment! If you modify "a" file, make sure save file in unix format because it will not work on android if file is in dos format, use an text editor like notepad+ or pspad if you realy need to modify file "a"! If no root.log in tmp than definitely its not working!
[AT&T Samsung Galaxy Note 4] DroidHelp101:
Same result. Maybe I'm doing something wrong?
[AT&T Samsung Galaxy Note 4] DroidHelp101:
Edit
[AT&T Samsung Galaxy Note 4] FiniteTime:
[MENTION=4120742]munjeni[/MENTION] would it be possible for you to update the rar on your post to use "id" instead of "whoami"?

You have a good reputation on xda so anyone modifying your test and reuploading it might look dangerous, unless they also have a good reputation like Surge1223.

---------- Post added at 11:30 AM ---------- Previous post was at 11:27 AM ----------

@jorgasm209 [MENTION=5601139]Misterxtc[/MENTION] [MENTION=806582]pr0cl1v1ty[/MENTION] [MENTION=467786]fromeo85[/MENTION] [MENTION=6157272]DroidHelp101[/MENTION]

Thanks for testing! If it works then there should be a file /data/local/tmp/root.log that might contain the word "system" somewhere, or be blank. If you don't see that then please try an updated test rar when we get one.
[AT&T Samsung Galaxy Note 4] jorgasm209:
Are we able to read /data/local/tmp without root? Mine is empty as well. No root.log file.
[AT&T Samsung Galaxy Note 4] DroidHelp101:
Same here, "Data" is empty, i tried a different file explorer as well.
[AT&T Samsung Galaxy Note 4] jpfulton248:
I'm on Verizon NI1 and I'm having the same result as everyone else... hangs at "Your device seems not vulnerable". I do want to clarify that I can't even locate the local directory much less the root.log file. Maybe the directory is supposed to be created during the process or maybe I'm looking in the wrong spot. Either way, no beans.
[AT&T Samsung Galaxy Note 4] iRashawn229:
For NI1 vzw
[AT&T Samsung Galaxy Note 4] FiniteTime:
Two commands to try:

adb shell ls -l /data/local/tmp/

adb shell cat /data/local/tmp/root.log

Will either error saying something about no such file, give output, or not error but not have output.
[AT&T Samsung Galaxy Note 4] munjeni:
If you see "your device seems not vurneable" it mean that your device is not vurneable to system exploit!
[AT&T Samsung Galaxy Note 4] DroidHelp101:
C:\ADB>adb shell ls -l /data/local/tmp/

-rwxrwxrwx shell shell 0 2015-01-27 11:13 boot_success

-rw------- u0_a240 u0_a240 3704 2015-01-27 11:14 glsl_shader_log.txt

C:\ADB>adb shell cat /data/local/tmp/root.log

/system/bin/sh: cat: /data/local/tmp/root.log: No such file or directory

C:\ADB>
[AT&T Samsung Galaxy Note 4] munjeni:
adb shell cat /data/local/tmp/glsl_shader_log.txt

??
[AT&T Samsung Galaxy Note 4] DroidHelp101:
I have no idea my friend, Just posting the results you asked for. if i can do anything else, Please let me know :)
[AT&T Samsung Galaxy Note 4] iRashawn229:
My device seems offline give me a sec.
[AT&T Samsung Galaxy Note 4] jorgasm209:
Permission Denied for glsl_shader_log.txt
[AT&T Samsung Galaxy Note 4] :
I get the same on NI2.

View attachment 3136927
[AT&T Samsung Galaxy Note 4] DroidHelp101:
Looks like there is shell access on "Boot_Success"

C:\ADB>adb shell ls -l /data/local/tmp/

-rwxrwxrwx shell shell 0 2015-01-27 11:53 boot_success
[AT&T Samsung Galaxy Note 4] jpfulton248:
C:\Users\jpfulton\Desktop\test_system_explot>adb shell cat /data/local/tmp/glsl_
shader_log.txt

################################################################################
##
# Cached Shader Miss
# Shader Cache Key = 789C758FC16AC3300C867BF653E8D88E1DDACCA7869D5A761E74F7E1266
AF0882D23CB6163ECDD67E38D24870A0412BF7EE9D305038086667FD0077D7CD247AD37394C4911B
6D7240813761A02452B967CAB564203829F2722EE63AB92B7376207CE4836307D60572D2B41D8F85
8DA564D86BFAC1FEA224AF236EF5213D93E1BACDF966A07DF0A722C87E07979BCA8C3F8FEFAC799C
599001EE6ABB99E7FF9516A13183B1BCB94C3DE2617E036929182701FEFFFA3685C18919B335C4DC
44BEDEED267BE1736C38946E24A2F89B1396F17E6C7D5A55D65FC0509E58EF8
# Cache Hit Count = 0
# Cache Miss Count = 1
# Cache Hit Ratio = 0.000000

################################################################################
##
# Cached Shader Miss
# Shader Cache Key = 789C7590C16AC3300C867BF653E8D88E31D6CCA7869D5A761E74F7E1266
A7089AD20CBA163ECDD67371B4E0E351824FFD2AF4F3EE200A0A17ADEEAADDEBDE89DD6AB744CBE2
26C4F5110466C340C14AC58F2B55A0815085EF744DC865A456FCFC40E9C91D4C074C1666A5908C2C
6879CD66A34FC657D371951948FE2A546B26D6AB07E9DA30D7C2B48675E04AFF3E159EDFACFF73FC
E241602782853535C76F9516A35303636E42A87AD8D6E80734F4632C27DBCFF8D6E7FD3504F5CDE8
271438F5C1DE064021EA7ECEE4689F98D4DB7CF1E09FAE69579F12A91B13AAC67268F0B8ACD93993
6F80592C59926
# Cache Hit Count = 0
# Cache Miss Count = 2
# Cache Hit Ratio = 0.000000

################################################################################
##
# Cached Shader Miss
# Shader Cache Key = 789C758FC16AC3300C867BF653E8D88E1DDACCA7869D5A761E74F7E1266
AF0882D23CB6163ECDD67E38D24870A0412BF7EE9D305038086667FD0077D7CD247AD37394C4911B
6D7240813761A02452B967CAB564203829F2722EE63AB92B7376207CE4836307D60572D2B41D8F85
8DA564D86BFAC1FEA224AF236EF5213D93E1BACDF966A07DF0A722C87E07979BCA8C3F8FEFAC799C
599001EE6ABB99E7FF9516A13183B1BCB94C3DE2617E036929182701FEFFFA3685C18919B335C4DC
44BEDEED267BE1736C38946E24A2F89B1396F17E6C7D5A55D65FC0509E58EF8
# Cache Hit Count = 0
# Cache Miss Count = 1
# Cache Hit Ratio = 0.000000

################################################################################
##
# Cached Shader Miss
# Shader Cache Key = 789C7590C16AC3300C867BF653E8D88E31D6CCA7869D5A761E74F7E1266
A7089AD20CBA163ECDD67371B4E0E351824FFD2AF4F3EE200A0A17ADEEAADDEBDE89DD6AB744CBE2
26C4F5110466C340C14AC58F2B55A0815085EF744DC865A456FCFC40E9C91D4C074C1666A5908C2C
6879CD66A34FC657D371951948FE2A546B26D6AB07E9DA30D7C2B48675E04AFF3E159EDFACFF73FC
E241602782853535C76F9516A35303636E42A87AD8D6E80734F4632C27DBCFF8D6E7FD3504F5CDE8
271438F5C1DE064021EA7ECEE4689F98D4DB7CF1E09FAE69579F12A91B13AAC67268F0B8ACD93993
6F80592C59926
# Cache Hit Count = 0
# Cache Miss Count = 2
# Cache Hit Ratio = 0.000000
[AT&T Samsung Galaxy Note 4] jorgasm209:
How did you get yours to run? Can you post results of "adb shell ls -l /data/local/tmp/"
[AT&T Samsung Galaxy Note 4] FiniteTime:
For reference, an easy way to get a list of CVEs for 4.4.4:

https://web.nvd.nist.gov/view/vuln/...es=on&cpe_version=cpe:/o:google:android:4.4.4

Won't be necessary if CVE-2014-4322 (qseecom) works but just in case, kernel exploits:

https://web.nvd.nist.gov/view/vuln/...=cpe:/o:linux:linux_kernel:3.10.0::~~~~arm64~
[AT&T Samsung Galaxy Note 4] zxz0O0:
We confirmed on page 54 that system level exploit is patched.
[AT&T Samsung Galaxy Note 4] FiniteTime:
I figured it would be worth making extra sure on all four versions. Which it seems to be. :-/

In your opinion would CVE-2014-8609 (BroadAnywhere) work to get to SYSTEM?
[AT&T Samsung Galaxy Note 4] jorgasm209:
Wait... [MENTION=3975929]zxz0O0[/MENTION] I thought it was only confirmed the OTA firmwares were patched? The original firmware does not contain "checkAndGetTcObjectClass()". Doesn't that mean it is infact vulnerable to CVE-2014-7911?
[AT&T Samsung Galaxy Note 4] jpfulton248:
That was my understanding as well. I did not think the consensus was that it is patched in the pre-OTA versions.

---------- Post added at 03:33 PM ---------- Previous post was at 03:32 PM ----------

C:\Users\jpfulton\Desktop\test_system_explot>adb shell ls -l /data/local/tmp/
-rwxr-xr-x shell shell 51 2015-01-27 19:33 a
-rw------- shell shell 2636 2015-01-05 18:20 glsl_shader_log.txt
-rwxrwxrwx shell shell 60799 2015-01-07 06:40 main
-rwxr-xr-x shell shell 169 2015-01-08 11:08 runroot.sh
[AT&T Samsung Galaxy Note 4] dabl198327:
I acquired a note edge (att) after following this forum religiously with my note 4 and I'm still hoping for root. Being that I recently acquired this phone I'm not sure if my build (nk2) is factory or an ota update but I'm thinking I might just try the exploit anyways when I get home. Think I should give it a go?
[AT&T Samsung Galaxy Note 4] jorgasm209:
Thats odd... I have the same permissions... but no shell access.
[AT&T Samsung Galaxy Note 4] turbofirefox:
[MENTION=286515]jpfulton248 [/MENTION]and [MENTION=6139444]jorgasm209[/MENTION], I think that [MENTION=5601139]Misterxtc[/MENTION] posted that it does not work on a non-OTA version... he edited his post to say his NI1 was "straight out of the box".

[MENTION=5601139]Misterxtc[/MENTION], on the NI1, did you enable USB debugging, Mock locations, and Install from unknown sources? (if he did, then I think that means NI1 - straight out of the box, is patched)
[AT&T Samsung Galaxy Note 4] davbay1:
I have a question this is far fetched and most likely really wrong but has anyone thought about faking a Ota update by spoofing a server using a program such as Charles proxy, and instead of installing an update install a root or something, would that bypass any security checks? Just a thought, since i used that method to hack a online game once.
[AT&T Samsung Galaxy Note 4] FiniteTime:
To be clear, anyone that took the OTA update can downgrade with Odin and the older tar md5 on both AT&T and Verizon. Just remember to back up data that you don't want to lose.
[AT&T Samsung Galaxy Note 4] jpfulton248:
Re: Patch for 7911, I refer to this link by [MENTION=4558078]ZPaul2Fresh8[/MENTION] http://xdaforums.com/showpost.php?p=58448957&postcount=609

I don't think anyone in this thread was able to find the patch in the pre-OTA versions. Is it possible there is something else in the 7911 apk exploit that is causing it to fail (besides a patch for the exploit)... Stupid question: Has anyone tried testing for the 7911 exploit without using Liang chen/Keen team's apk?
[AT&T Samsung Galaxy Note 4] jorgasm209:
I dont think it is that CVE-2014-7911 has been patched in NI1 or any of the "out of the box" firmwares from September. Something is wrong with the exploit apk... and supposedly the apk checks for "checkAndGetTcObjectClass()" and if it finds it then throws the "device not vulnerable" message in the apk. "checkAndGetTcObjectClass()" is present in newer versions of firmware but absent in the original firmware so we are trying to figure out why the apk isn't working.
[AT&T Samsung Galaxy Note 4] zxz0O0:
Any proof that the original firmware does not contain this method?
[AT&T Samsung Galaxy Note 4] turbofirefox:
Cool... maybe we could ask [MENTION=4939386]Surge1223[/MENTION] or [MENTION=3975929]zxz0O0[/MENTION] to take a look at the APK?
[AT&T Samsung Galaxy Note 4] jorgasm209:
See here... http://xdaforums.com/showpost.php?p=58449134&postcount=610
[AT&T Samsung Galaxy Note 4] jpfulton248:
Not sure if this was in relation to CVE-2014-4322 or CVE-2014-7911:

http://xdaforums.com/showpost.php?p=58448957&postcount=609
[AT&T Samsung Galaxy Note 4] jorgasm209:
That is the Kernel Exploit... which is also unpatched.
[AT&T Samsung Galaxy Note 4] FiniteTime:
Yeah, that's in reference to CVE-2014-4322 (qseecom). CVE-2014-7911 (ObjectInputStream) gets to SYSTEM.

---------- Post added at 01:18 PM ---------- Previous post was at 01:15 PM ----------

Wondering about both of these questions myself. checkAndGetTcObjectClass() I'm almost certain was confirmed not present earlier in the thread.
[AT&T Samsung Galaxy Note 4] :
Yes, I had all those on plus I tried it in airplane mode.
[AT&T Samsung Galaxy Note 4] FiniteTime:
This was right under the post about the kernel exploit. ;)

This also may be relevant:

http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post58318449#post58318449