yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] Lanchon:
yes, i know what the lines do. i asked...

but what happens if you also remove these lines?

write /sys/class/android_usb/android0/enable 0

restart adbd

...because i'm wondering whether usb and/or adbd are up before this code executes. if they are, commenting the last line does not cure the race condition, only shortens the window of time on which an exploit can be run.

yes, i always keep adbd enabled for that particular reason. once i was run over by a car jumping a red light and my galaxy nexus was bent 30 degrees in the middle. i was able to pull out my data via adb. but...

as i said in the first post on this thread, there must be a way to enable adbd on a password-protected TWRP without using the display. (for safety. display breaks or touchscreen dies or whatever. and then having android as your only option is definitely not cool.)

one way is to have a stripped down adbd binary ran on startup, that one adb-shells to and instead of a shell sends a password prompt. correct password entry causes the stripped adbd to die and be replaced by the real adbd. an advantage of this method is not needing extra host tools or drivers to access TWRP via adb. stripped adbd should protect against brute-forcing by enforcing exponential delays, talking to a single adb client at a time, and enforcing its delays even if the adb connection is dropped (a thing that is easy to accomplish by checking the password for correctness and logging you in only after the delay has elapsed; a first try 1 or 2 second delay wont kill anyone).

another way is through a usbtty or similar mechanism, but i wouldn't recommend that.
[Android Q&A, Help & Troubleshooting] antonio.galea:
Just found an easier way - simply let adbd run in secure mode.

In my recovery at least, /data is mounted at boot - thus the system /data/misc/adb/adb_keys (containing all the public keys of computers allowed for adb connection) are also available in recovery.

With this in mind I just changed

ro.adb.secure=1

in /default.prop, removed the two USB enable/disable commands in my /twres/portrait.xml, repacked the recovery and reflashed and... bingo, I'm root without password from authorized computers.

HTH,

Antonio
[Android Q&A, Help & Troubleshooting] lukinhasb:
Nice, thanks!
[Android Q&A, Help & Troubleshooting] gordy10:
Without password protection anyone can enter the bootloader start up and see all data

Without password protection anyone can enter the bootloader start up and access all personal data (pics etc) by going to file manger... instert an external sdcard and copy all the data onto that external sdcard... and now they have everything in your phone on thier own sdcard.

Why do people still love twrp?
[Android Q&A, Help & Troubleshooting] gordy10:
Correct me if i am wrong
[Android Q&A, Help & Troubleshooting] RomoGuit:
Hi Antonio. Thank you for adding to this thread!

I replaced my portrait.xml with yours. I edited line 742 with the password I want. But I'm unclear on the next steps. I want the phone protected from adb also.

My default.prop does not have ro.adb.secure=

Do I need to add it, or will it only work if it was already there, set to 0?

Do I still need to comment out the line in init.rc?

Edit: I went ahead and tried it with just the new portrait.xml. It flashed via Odin clean. But when I boot to recovery, the TWRP screen is all jumbled and would not accept any input. There was no vibration when I touched any part of the screen. I also tried swiping but nothing happened. This is on an S5.

I tried to compare the original portrait.xml with the password-enabled xml, but I was quickly lost trying to decipher the code.

Any advice would be appreciated. It's exciting to know it's so close to having a protected TWRP.

Edit2:

The new portrait.xml works. I made a bad copy/paste mistake, everything is fine now. Still not sure what to do about the init.rc edit, and the default.prop edit for adb protection.
[Android Q&A, Help & Troubleshooting] antonio.galea:
You're welcome.

In order to activate secure adb, you should set the property to

ro.adb.secure=1

(add the line if you don't have it).

No, but you do have to modify portrait.xml - remove the two commands that disable/enable adb, namely at lines 176 and 293:

<action function="cmd">echo 0 > /sys/class/android_usb/android0/enable</action>
....
<action function="cmd">echo 1 > /sys/class/android_usb/android0/enable</action>

Glad to know it works well also for you.

Keep in mind that physical access to your phone will allow anyone knowledgeable enough to just overwrite your recovery with a different one - my trick just protects you only from casual mistakes and basic attacks, not from a determined thief.

Antonio
[Android Q&A, Help & Troubleshooting] RomoGuit:
Yes, nothing can defeat download mode, but at least with a secured TWRP, nobody can flash malicious zips to the phone without us knowing.

If I'm away from my phone, and return to it, and it is powered off, I'll boot to TWRP first to check it's integrity. If it doesn't ask for a password, or accept my password, I'll know the phone has been tampered with. At that point I'll know that I shouldn't trust the phone anymore, and that it's time to wipe everything and rebuild.

Anyone with an unsecured TWRP is vulnerable to anyone secretly flashing anything they want to the phone, whether it's encrypted or not. You closed a big security hole. Thank you.
[Android Q&A, Help & Troubleshooting] Lanchon:
very nice hack. first, we should verify what happens when somebody clears data (the keys are not available). the expectation is that no one should be able to adb. i hope this is what happens, instead of adbd going into panic and letting anyone in.

after that is verified...

this is still not a full solution if we want to mainline changes to twrp to make the official version secure. the problem is, after data wipe you loose adb. this loss of functionality would not be acceptable to TWRP maintainers or users.

an acceptable solution to this would be to start adbd in secure mode only if a TWRP password is set. this at least would not create regressions.

for an even better solution, add either one of these behaviors to the previous one:

- only after the TWRP password is manually entered and accepted, pop up an adb key request when a new client is detected. i DO NOT like this solution because 1) it writes to /data, and 2) it is very complex to implement.

- only after the TWRP password is manually entered and accepted, kill adbd and restart it in insecure mode. i very much like this one: it gives authenticated access if your screen is broken, and free access once you provide the password.

ro.adb.secure cannot be dynamically changed, or can it? any other way to control stock adbd mode or we need to hack adbd or the property system?

thanks!
[Android Q&A, Help & Troubleshooting] Lanchon:
not necessarily true. many phones can relock the bootloader and boot from unsigend boot images (boot and/or recovery) anyway, i guess others might brick if you relock with custom boot image.

once relocked with password protected TWRP, an attacker could only "fastboot oem unlock" the device.

if this works, the attacker is barred from ever touching your device without wiping it.

but it gets better. on the nexus 5 and the oneplus one for instance, which are the phones that i looked into, "fastboot oem unlock" would only actually boot recovery with a custom signal. the wiping is deferred to recovery and so is the actual unlocking, happening only after the wipe completes.

this means that, on these devices, if you relock with TWRP recovery flashed in, you loose the capability to unlock. when you "fastboot oem unlock", the boot loader simply boots TWRP and TWRP ignores the custom oem unlock signal completely. (it would not know how to oem unlock anyway; that is highly custom per-device.)

so this is exactly what we want: a locked device that can't be oem unlocked or wiped without the TWRP password.

note: for good or bad, a direct-to-SoC signed usb boot image for the oneplus one leaked, so my understanding is that a oneplus one is effectively unbrickable and can be flashed even when its bootloaders are goners. this is good for tinkering, but completely undermines any and all device security. a similar thing happened to the OMAP SoC in the galaxy nexus, where a direct-to-SoC signed usb debug image leaked that can read/write any eMMC block via usb using a TI tool on the PC.
[Android Q&A, Help & Troubleshooting] antonio.galea:
AFAIK fastboot allows you to boot a kernel with ramdisk without flashing it, with

fastboot boot <kernel> <ramdisk>

which means that it is possible to just boot a recovery without flashing it - tampering with your device and leaving no trace.

So, if you really want to be safe, your only choice is relocking the bootloader - assuming you have a device that 1) can do it and 2) won't enter into a boot loop if your image is not signed with the manufacturer's keys. My Sony can relock, for instance, but won't boot a custom ROM.

Bottom line: TWRP password is better than nothing, but not really secure in the general case.. You'd better just don't leave your phone around .

---------- Post added at 11:43 AM ---------- Previous post was at 11:19 AM ----------

I can confirm - no keys, no entry.

Seems a good idea.

What I would like is to store the password outside the XML theme files (ideally in TWRP settings file, if it is secure), and the ability to set it up from inside TWRP without tinkering with the recovery image. The same code for setting/removing the password could also change the property ro.adb.secure in /default.prop, so it will be enforced at the following boot.

I'm open to suggestions about how this could be accomplished.

Detecting the new client and reacting is not something that can be hacked out of a theme file, I fear. But maybe adding a menu item to trust the connected client, if there is one, would not be that difficult.

AFAIK, ro.adb.secure is readonly. However, you might change /default.prop, then reboot with unsafe adb enabled - and maybe get a visual indication that your recovery is very insecure.

---------- Post added at 12:12 PM ---------- Previous post was at 11:43 AM ----------

Yes, I'm aware of it: unluckily, it does not work for all bootloaders. Mine, for instance, will only allow signed boot images when relocked - or go into a boot loop (I admit that I did not actually try, just read it up here in another thread).

It would be great to have an idea of which devices do work this way - ideally, before buying one :)
[Android Q&A, Help & Troubleshooting] ale5000:
Isn't there any TWRP fork that add password protection and that it is kept in sync with main TWRP code?
[Android Q&A, Help & Troubleshooting] antonio.galea:
Created one:

https://github.com/ant9000/android_bootable_recovery

I haven't got a tablet for testing landscape.xml - the password locking check is in place, but the appearance need revisiting. Anyone volunteers?
[Android Q&A, Help & Troubleshooting] antonio.galea:
If you have a recovery image that you want to protect, I've created a simple script to automate the process:

https://github.com/ant9000/TWRP-protect

Linux is needed.
[Android Q&A, Help & Troubleshooting] JaggedPill:
Can you please elaborate the process? How to use it to protect.
[Android Q&A, Help & Troubleshooting] antonio.galea:
The script applies my password protection patch to an existing TWRP image. You launch it from the command line, with

./protect.sh <recovery.img>

It will ask you for a password to apply to TWRP, download AIK and use it to unpack the image (will require root rights for that).

Once unpacked, the script inserts your password in my version of the theme XML files and saves it as twres/portrait.xml or twres/landscape.xml, changes adb mode to secure and then repacks the image.

In the end, you will obtain a new password protected image in the current directory, named recovery.img.protected.
[Android Q&A, Help & Troubleshooting] JaggedPill:
Great :good:
[Android Q&A, Help & Troubleshooting] JaggedPill:
What's the command line on windows [MENTION=7384409]antonio.galea[/MENTION]
[Android Q&A, Help & Troubleshooting] antonio.galea:
Windows command line is not really well suited for this kind of work - it's kludgy at best.

The bulk of the work is done by Android Image Kitchen, which is universally available: so if you are interested, I could rewrite the script in Python, in order to give it a GUI and make it multiplatform (Lin/Win/Mac).

Next few weeks will be packed full, though - so don't hold your breath.
[Android Q&A, Help & Troubleshooting] JaggedPill:
Sure that would be awesome :D I have AIK installed but don't have Linux on my system ( windows8.0 not much diskspace ). Thanks a ton :svetius:
[Android Q&A, Help & Troubleshooting] antonio.galea:
I've rewitten the script in Python3, still command line only. Python3 is required, obviously - comes bundled in any Linux distro, and is very easy to install on Windows (from here).

On Linux the script is on par with the bash version, and the code for letting it run on Windows is already in place (it will likely require a few test-fix cycles, though). As soon as I understand how to work with AIK for Mac, I'll add that too.

If you want to try it on Windows and report any issue, please do!

https://github.com/ant9000/TWRP-protect
[Android Q&A, Help & Troubleshooting] JaggedPill:
Oh Thank you! Will surely try it out this weekend & let you know;)
[Android Q&A, Help & Troubleshooting] Aerocap:
OMG, that seems to be an essential topic! First of all I'm horrified reading about such security gaping holes

Would you mind to specify what TWRP version you were running and the path that lead you to this result? Please..
[Android Q&A, Help & Troubleshooting] go vegan:
Just go into /data/system/, and remove or rename these two files: gatekeeper.pattern.key, gatekeeper.password.key

Then reboot. You may still need a password to decrypt the phone on startup, but you won't need a password to get past the lock-screen and reset the password/pattern.

People are worried about data loss... Anyone with your phone and a heavy rock can cause data loss; that can be mitigated only with data backups. This is a real security hole.
[Android Q&A, Help & Troubleshooting] Aerocap:
I find this security breach quite scary to say the least!

https://twrp.me/faq/securetwrp.html If your device has fallen into someone else's hands, your best case scenario should be that you hope that they don't get your personal data. If you don't want someone getting your personal data, use Android's device encryption and a good lockscreen.

To me what is said by TWRP is really not reassuring and the advice is even pointless as there is full access anyway. As already said, the phones fall into the wrong hands mostly for the devices themselves, and of poeple that will not bother too far to open them. But when it's just that simple what will they do with the personal stuff? It would be good to have a layer that requires at least to flash something..

I would like to try that! But I'm confused about how to use that kitchen tool, please may I ask you help?
[Android Q&A, Help & Troubleshooting] antonio.galea:
I wrote a Python script to simplify the process. I only tested it on Linux, I would appreciate if you can confirm me that is runs correctly on Windows too:

https://github.com/ant9000/TWRP-protect

Antonio
[Android Q&A, Help & Troubleshooting] JaggedPill:
Tried but couldn't do it. Unpacked thru AIK. Unsure about nxt step. Afraid if I bungled up somewhere I would be left with a dead device. Could u please explain in detail. Thanks.

---------- Post added at 03:04 PM ---------- Previous post was at 02:37 PM ----------

"In order to activate password protection:

- unpack your recovery image with AIK

- put the new portrait.xml in twres/portrait.xml and change line 742 from

<action function="set">tw_unlock_pass=0</action>

to something like

<action function="set">tw_unlock_pass=MyUnguessableNewPassword</action>

- repack recovery and flash it back to your phone."

Unpacked my recovery image but couldn't find the line. Missing.

---------- Post added at 03:18 PM ---------- Previous post was at 03:04 PM ----------

Where do i add that line?
[Android Q&A, Help & Troubleshooting] JaggedPill:
Badly need to lock recovery and secure adb as my work protocol requires to surrender phone daily to security personnel. Please help.
[Android Q&A, Help & Troubleshooting] antonio.galea:
I've installed my script on a Window10 64bit machine - and discovered that AIK has been updated, so the download links were not correct any more.

Now I've updated them and made a few minor edits - I can confirm you that on Windows it works.

Step by step guide:

- install Python3 from here: https://www.python.org/ftp/python/3.7.0/python-3.7.0.exe

- during install, make sure that you "add Python.exe to PATH"; if you forgot, launch the installer again, click on "edit" and check the box

- download my script from here: https://raw.githubusercontent.com/ant9000/TWRP-protect/master/protect.py and put it in the same directory of the image you want to password-protect

- open a cmd prompt and cd to that directory

- launch it with

python protect.py <put the name of your twrp.img here>

Antonio
[Android Q&A, Help & Troubleshooting] JaggedPill:
Much thanks brother! Will try it and report back tomorrow.

---------- Post added at 07:41 PM ---------- Previous post was at 06:59 PM ----------

I've tried it right now. Windows 8.0. Installed everything as you instructed. Got an error (python.exe-System error) which states "The program can't start becos api-ms-win-crt-runtime-l1-1-0.dll is missing from ur computer. Try reinstalling to fix this problem. Tried but all the same. How can I install this missing file.

---------- Post added at 08:15 PM ---------- Previous post was at 07:41 PM ----------

Used regsvr cmd to reregister dll file but got error "make sure the binary is stored at the specified path or debug it to check for problems with the binary or dependent .DLL files.

The specified module couldn't be found"

Also tried reinstalling the c++ 2015 package. No result. How do I proceed further?
[Android Q&A, Help & Troubleshooting] JaggedPill:
Downloaded regdll view utility. Will try later tonight.
[Android Q&A, Help & Troubleshooting] JaggedPill:
I've tried my best antonio but the dll file refuses to register. Can u please suggest an alternative method. No matter how messed up it is I'm willing to try. But I must confess I am a noob at these things, just have an operating knowledge, nothing more.

---------- Post added at 06:50 PM ---------- Previous post was at 06:47 PM ----------

Everything was perfect but for the .dll file.

---------- Post added at 06:53 PM ---------- Previous post was at 06:50 PM ----------

I know I can always reflash the recovery should something go wrong. Not a problem.
[Android Q&A, Help & Troubleshooting] JaggedPill:
Today trying for upgrading to 8.1 and starting afresh.
[Android Q&A, Help & Troubleshooting] berrytaylor56:
Some interesting and well-researched information on cameras. I'll put a link to this site on my blog. Thank you!
[Android Q&A, Help & Troubleshooting] JaggedPill:
Upgrade to Win8.1 didn't help at all. Win10 has all compnents inbuilt. But sadly I can't afford it:(
[Android Q&A, Help & Troubleshooting] antonio.galea:
You report errors in too a generic way for giving you any help.

Forget about my script, which should only have been a shortcut but apparently isn't. Let's start afresh with the basics, and check where the process fails:

download AIK and extract it somewhere on you PC

get a working TWRP image for you phone and put it in AIK folder (just for convenience)

open a Windows command prompt and cd to the AIK folder

unpack the image with unpackimg.bat TWRP.img (sustitute your actual TWRP image name)

repack the image with repackimg.bat

Try this process until il completes correctly, and then you know how to unpack and repack a TWRP image - congrats :D

If anything fails, it's likely something that I've not explained clearly enough - so just write again, and please provide the context.
[Android Q&A, Help & Troubleshooting] JaggedPill:
I have successfully unpacked and repacked twrp images using AIK earlier also. So that's not a problem at all. Problem is where do I install your script. Can it be done without python.

---------- Post added at 12:30 PM ---------- Previous post was at 12:28 PM ----------

Can you please clearly explain what's exactly to be run in cmd window after I put recovery omg and Aik together.

---------- Post added at 12:33 PM ---------- Previous post was at 12:30 PM ----------

Where should I insert password after opening xml file in twres. That line which you mention is missing in the original xml file.

---------- Post added at 12:35 PM ---------- Previous post was at 12:33 PM ----------

Where should I insert password after opening xml file in twres. That line which you mention is missing in the original xml file.

---------- Post added at 12:35 PM ---------- Previous post was at 12:35 PM ----------

Sorry for double post
[Android Q&A, Help & Troubleshooting] antonio.galea:
Good to know - you might have spared us both some time by stating it clearly before (maybe you did and I missed the point).

Of course: the original theme file is lacking password support - that was my addition.

Assuming your TWRP is version 3.2.1 and unthemed, you can just overwrite portrait.xml with my version (use landscape.xml on a tablet).

If that's not the case, you need to compare the changes I've introduced and adjust your theme accordingly.
[Android Q&A, Help & Troubleshooting] JaggedPill:
Twrp 3.2.3.0 got more lines than 3.2.1.0 Was quickly lost between.

But managed to change that line where u mentioned in green ink, changed the password from 0 to a value of my choice. Repacked the image and flashed but Twrp booted without the password :) :laugh:

---------- Post added at 01:26 PM ---------- Previous post was at 01:18 PM ----------

Any tool to compare? Did it using np+
[Android Q&A, Help & Troubleshooting] antonio.galea:
I've updated my repo with the latest TWRP commits, now portrait.xml should be correct.

Remember to also change default.prop, replacing

ro.adb.secure=0

with

ro.adb.secure=1

Are you sure you flashed the correct image? When repacking, the original file is not overwritten; the output image is called image-new.img.

Antonio
[Android Q&A, Help & Troubleshooting] JaggedPill:
Yes output came as you stated. Will try again. Thanks a lot:o

Yes default prop also will change.

---------- Post added at 09:54 AM ---------- Previous post was at 09:52 AM ----------

Is it copy binary function in np+
[Android Q&A, Help & Troubleshooting] JaggedPill:
Wooohooo!!!!! Finally did it:D Many thanks [MENTION=4694699]antonio.[/MENTION]

You're my savior:angel::highfive:
[Android Q&A, Help & Troubleshooting] KaMyKaSii:
[MENTION=7384409]antonio.galea[/MENTION] unfortunately your password screen is "ignored" when I install a custom theme, is there anything you can do about it?
[Android Q&A, Help & Troubleshooting] zzcool:
since we are talking about making a phone more secure heres my suggestions (found this thread by googling to see if theres a way to password protect a recover)

1.no usb Connection at all, wifi interaction only through an encrypted Connection, any commands are downloaded to the phone and then executed and no sd card access

2.encrypt recovery and require google account to unlock

3.if recovery is entered instantly hook on to whatever open network is available and transmit all locationdata to set google account or twrp account if twrp were to use logins for the recovery in which case it could be used for both encryption and interaction (end to end encryption to transfer files or commands)

this means you would not be able to do anything with a locked device you couldn't enter recovery as you needed an online password you couldn't interact as Everything would be done through wifi which can only be turned on once the recovery is unlocked (with an exception for the password interaction), the only way then is to open up the phone, and this is where the whole thing becomes a whole lot profitable for thiefs