yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Sheetzie03:
Trying to figure out how to apply the patch. I have an htc one m7 running gpe 5.1.1 Not sure if I should flash the zip in recovery. Reading through and trying to figure it out, little confused tho :/

Sent from my HTC One
[Android Software/Hacking General [Developers Only]] Phk:
Zip\flash is only for Sammy Lollipop :P Don't try to flash it.

For HTC use this build.prop changes, read above
[Android Software/Hacking General [Developers Only]] Sheetzie03:
Ahhh thanks man , glad I ask first, OK I know how to edit build prop but what exactly do I add or subtract to my current buildprop? Sorry I'm confused , but I appreciate your time in trying to help me.

Sent from my HTC One
[Android Software/Hacking General [Developers Only]] Phk:
Hi there. Willing to help, but your answer is 5 posts above.

Please read the "kato" example
[Android Software/Hacking General [Developers Only]] Sheetzie03:
Absolutely going there now. I skipped all around thru the thread, in the op, but obv missed that, I do hate when ppl don't just 'READ' it drives me crazy, so shame on me for missing that.

Edit :

Just want to get confirmation.

Is this exactly what I should add?

#system props for the MM modules

media.stagefright.enable-player=false

media.stagefright.enable-http=false

media.stagefright.enable-aac=false

media.stagefright.enable-qcp=false

media.stagefright.enable-fma2dp=false

media.stagefright.enable-scan=false

mmp.enable.3g2=true

mm.enable.smoothstreaming=true

media.aac_51_output_enabled=true

If it's missing something or if it's exactly what it should be, please let me know thanks

Sent from my HTC One
[Android Software/Hacking General [Developers Only]] Phk:
Yes, only the "=false" lines :)
[Android Software/Hacking General [Developers Only]] Sheetzie03:
Thank you for your help, so much.

OK just to be clear, any where in the build prop file, add these 6 lines ONLY, exactly as it says below, and nothing more nothing less, correct?

media.stagefright.enable-player=false

media.stagefright.enable-http=false

media.stagefright.enable-aac=false

media.stagefright.enable-qcp=false

media.stagefright.enable-fma2dp=false

media.stagefright.enable-scan=false

(Sorry I just want to be sure, you prob want to kill me [emoji16] )

Sent from my HTC One
[Android Software/Hacking General [Developers Only]] Phk:
It's fine :) section-less conf-files are assorted. Drop it where you want!
[Android Software/Hacking General [Developers Only]] Sheetzie03:
Htc one 5.1.1 gpe

Made the build prop edit by adding the above lines.

The stagefright detector is still detecting exactly as it was before added the patch to the build prop.

Is this normal?

Sent from my HTC One
[Android Software/Hacking General [Developers Only]] Phk:
Sure, the bug is still there, although not reachable through MMS
[Android Software/Hacking General [Developers Only]] kato7youknow:
looks good.

#persist.cne.feature=1

#system props for the MM modules

media.stagefright.enable-player=false

media.stagefright.enable-http=false

media.stagefright.enable-aac=false

media.stagefright.enable-qcp=false

media.stagefright.enable-fma2dp=false

media.stagefright.enable-scan=false

mmp.enable.3g2=true

mm.enable.smoothstreaming=true
[Android Software/Hacking General [Developers Only]] picklu:
Im on using OnePlus One on CM - 11.0-XNPH05Q. Dont want to go in Lollypop. I am happy with 4.4.4 I checked my phone is vulnerable. How to fix my OnePlus One!!!
[Android Software/Hacking General [Developers Only]] Phk:
http://xdaforums.com/showthread.php?p=62597099

:)
[Android Software/Hacking General [Developers Only]] Sheetzie03:
I was told to only add the lines that ended in false, not the other lines included above.

So this ONLY:

media.stagefright.enable-player=false

media.stagefright.enable-http=false

media.stagefright.enable-aac=false

media.stagefright.enable-qcp=false

media.stagefright.enable-fma2dp=false

media.stagefright.enable-scan=false

Which one is it then?

Sent from my HTC One
[Android Software/Hacking General [Developers Only]] kato7youknow:
i put it like the one below. it is up to you, im not sure.

. ?????????????????
[Android Software/Hacking General [Developers Only]] kato7youknow:
i added the lines like you. added a gift link

I added the lines like you did sorry about the confusion.
[Android Software/Hacking General [Developers Only]] Sheetzie03:
Really really sorry but I'm still confused.

Not sure what that Mega link is .

I'll try once more, I'f you can just tell me which one of the 2 below sets of lines it should be, I'd appreciate it...

This that you said to add?

#persist.cne.feature=1

#system props for the MM modules

media.stagefright.enable-player=false

media.stagefright.enable-http=false

media.stagefright.enable-aac=false

media.stagefright.enable-qcp=false

media.stagefright.enable-fma2dp=false

media.stagefright.enable-scan=false

mmp.enable.3g2=true

mm.enable.smoothstreaming=true

Or should it be this?

media.stagefright.enable-player=false

media.stagefright.enable-http=false

media.stagefright.enable-aac=false

media.stagefright.enable-qcp=false

media.stagefright.enable-fma2dp=false

media.stagefright.enable-scan=false

Thanks and Sorry.

Sent from my HTC One
[Android Software/Hacking General [Developers Only]] kato7youknow:
reply

############################

should be this.

media.stagefright.enable-player=false

media.stagefright.enable-http=false

media.stagefright.enable-aac=false

media.stagefright.enable-qcp=false

media.stagefright.enable-fma2dp=false

media.stagefright.enable-scan=false

Thanks and Sorry.

Sent from my SM-T210R

Hope this helps.
[Android Software/Hacking General [Developers Only]] Sheetzie03:
OK I will try this, thought I tried this the first time then ran the stagefright app and its still came up as vulnerable.

No worries on the mix up, thanks

Sent from my HTC One
[Android Software/Hacking General [Developers Only]] Phk:
Build.prop blocks system configuration, disabling calls for stagefright player.

Libs still remain there. Detector checks libs. Do the math.
[Android Software/Hacking General [Developers Only]] Sheetzie03:
Thanks for the reply.

But can you explain what this means for someone that doesn't know a whole bunch like it sounds like you do?

Are you saying that adding these build.prop lines works regardless if it's still detecting vulnerability or not?

Sent from my HTC One
[Android Software/Hacking General [Developers Only]] Phk:
Yes. Explained above.
[Android Software/Hacking General [Developers Only]] Phk:
god damn it.. Exploit is now available........

I've read it but did not have the opportunity to test it.. please note:

this exploit uses ROP for bypassing ASLR so this actually works for all unpatched android versions :eek:

this exploit produces the MP4 and opens a webserver for a vulnerable device (using old Firefox) to visit this and get exploited. :confused:

you can take this MP4 file and send it via MMS :crying:

All hell broke loose :mad:
[Android Software/Hacking General [Developers Only]] Phk:
I really wasn't expecting that an exploit capable of overcoming ASLR would come out so soon !!!
[Android Software/Hacking General [Developers Only]] Phk:
(OP updated with links)
[Android Software/Hacking General [Developers Only]] Desmanto:
Now the code is there already for almost a week. Is there any video showing us how the code can gain remote access to the victim? I don't mean the same demo video from last month which just show something that can be setup first to show possibility only.
[Android Software/Hacking General [Developers Only]] Phk:
Hi again Desmanto, the code has been tested and it is working. I have developed a Proof of Concept for a customer. AFAIK there is no "how-to" video demonstrating it. Please note that the exploit picks up a binary payloads that you must first generate, and then generates an MP4 that will execute the payload when the MP4 is played through a vulnerable stagefright player.

Cheers
[Android Software/Hacking General [Developers Only]] Desmanto:
Owww, scary. I actually don't need the "how-to", but just the proof of concept. But as I can see you really did your research about this, then it shall be true. What I need to know is the vector of attack exploited. So we can made prevention at least. I have disable the mms auto download, and tried to disable via build.prop; but still some of the lib is still not disabled.

ASLR seems also not working perfectly in android, as only 8 bit randomize. Google's own researchers challenge key Android security talking point. That's why things are getting darker now.
[Android Software/Hacking General [Developers Only]] kato7youknow:
[MENTION=1480096]Phk[/MENTION] , will your biuld prop patch stop this Android libstagefright - Integer Overflow Remote Code Execution?

---------- Post added at 01:29 PM ---------- Previous post was at 01:22 PM ----------

http://googleprojectzero.blogspot.com/2015/09/stagefrightened.html
[Android Software/Hacking General [Developers Only]] Phk:
The usage vector is anything that triggers the use of those faulty libs.. For example, this exploit runs a web server to serve the crafted MP4 file, and that is a vector (WEB) because of Firefox < v39 using Stagefright to play embedded MP4 files in HTML pages.

Now imagine you pick the crafted MP4 file and send it to a friend using Telegram\Whatsapp. They will NOT be played using stagefright libs, but instead opened inside the embedded players or calling the default system app to handle media files.

Now imagine you send the file through MMS? The "Messages.apk" used in all androids as a service, which has auto-fetch of MMS content enabled, will use stagefright libs, which will then crash, and then execute the embedded payload.

So yeah, vectors are the same, more can be found (people are always very creative on security vulns), but the best thing you can do is switch to an updated system ROM and test it with Zimperium's detector (see the OP, i've updated links).

I use a Galaxy S5 (G900F) and I've tested latest ****BOI3 official Samsung roms and they are PATCHED, and right now i'm using CM12.1 which is also PATCHED. That's probably the most secure move you should do now :)

Well, ASLR is a progress, and i'm not a Linux expert, but having big randomization bitlength would affect every function call in every app, that's a lot of CPU cycles missed as overhead in everything that moves thousand of times per second in your mobile. Also, on the attacking purpose, head spraying and ROP would still be achievable, instead of a loop of 50 tries, the code could try 1000 times. And the result would almost be the same.

About that "things are getting darker now" quote, imagine the crap you probably have on iOS source code that isn't known since its closed-source. That's the big old fake security by obscurity, which is a false notion of safeness.

Who's in the dark now? :)
[Android Software/Hacking General [Developers Only]] Phk:
AFAIK it will stop the usage of MMS as an attack vector
[Android Software/Hacking General [Developers Only]] Desmanto:
So, as long as we disable the vector known till now (firefox < v39 and MMS), we are at least a bit safer? I know there are still possibility out there, but at least i want more secure a bit than those who don't do any prevention at all. My phone is outdated and will never received update any more.:( (it is mediatek phone, you know). And it is dark for those phones. So at least I can take some prevention, not being sitting duck.
[Android Software/Hacking General [Developers Only]] Phk:
Have you tried cyanogen for your phone? I bet there is a port.

Apart from a patched system, yes, try to fix as many vectors as you know of.

1. Updated FF

2. Build.prop modifications

3. Use custom MMS app

Cheers
[Android Software/Hacking General [Developers Only]] Desmanto:
First round not yet finished. Second round is coming. :eek:

http://arstechnica.com/security/201...hones-are-vulnerable-to-new-stagefright-bugs/

https://blog.zimperium.com/zimperiu...me-new-vulnerability-processing-mp3mp4-media/
[Android Software/Hacking General [Developers Only]] Phk:
Well.. At least this still uses stagefright vulnerability to perform RCE.
[Android Software/Hacking General [Developers Only]] Miss Montage:
... if you are running Lollipop.
[Android Software/Hacking General [Developers Only]] chrcol:
I have disabled stagefright in my boot.prop for many weeks now and nothing is broken, although I dont know if this also mitigates staefright 2.0, I think it does as I disabled music stagefright libs as well.
[Android Software/Hacking General [Developers Only]] Phk:
Sure, AFAIK if you disable\patch stagefright 1.0, the MPx\Stagefright 2.0 would not have RCE.
[Android Software/Hacking General [Developers Only]] RuffBuster:
I've disabled all mentions of stage fright in my build prop so should I still be protected against v2? I also use textra messaging app with security fixes and latest chrome which I hope is patched up.
[Android Software/Hacking General [Developers Only]] nefescalanadam:
Here the big question
[Android Software/Hacking General [Developers Only]] Phk:
As far as the gen pop knows, you will not be exploited by stagefright.

But you are vulnerable to many other exploits which nor u or I are aware of.
[Android Software/Hacking General [Developers Only]] lebaneseboy:
can someone please compile a patch for MT6592(m)processor [mlais m9 4.4 smartphone]? i could provide the needed files from the stock rom...would be very grateful...a detailed tut would be ok too if it's noob proof :D
[Android Software/Hacking General [Developers Only]] edzamber:
Hi evreybody,

Stagefright v2 CVE 6602 since 1/10/15...

No fix yet...

Until a new Fix, you can flash my patch via Custom Recovery to modify build.prop by replacing all Stagefright values "true" into "false"

http://www.mediafire.com/?gi4113dll3g98l6

* Check with Stagefright Viewer that your build.prop isn't corrected

http://www.mediafire.com/?4xb85ixigvind9e

* Flash my patch

* Check again with Stagefright viewer that build.prop is now corrected

Before

After
[Android Software/Hacking General [Developers Only]] nefescalanadam:
CVE-2015-6602 fix waiting..

but for now [MENTION=4507636]edzamber[/MENTION] s fix usable
[Android Software/Hacking General [Developers Only]] kato7youknow:
thank you.

Thank you all green OK.:good:
[Android Software/Hacking General [Developers Only]] c1bear:
Flash patch didn't work on note3
[Android Software/Hacking General [Developers Only]] bulldog74ts:
Fix Stagefright 2.0 for samsung

Fix Stagefright 2.0 tested for samsung s6 - s6 edge - note 5 - s6 edge + :D:D:D:D

[MENTION=1480096]Phk[/MENTION]
[Android Software/Hacking General [Developers Only]] dima202:
Is there a patch for Note 2 4.1.2?
[Android Software/Hacking General [Developers Only]] edzamber:
For all I9505 and i337M users,

Stagefright fix v2 done :)

http://xdaforums.com/showthread.php?p=62688466
[Android Software/Hacking General [Developers Only]] Phk:
Thanks Guys.......

OP updated

Cheers
[Android Software/Hacking General [Developers Only]] sebastiandg7:
I am actually developing a cm12.1 based custom rom, how can i use this patches to recompile my ROM with stagefright fixed? (Updating the cm12.1 version is not an option due to porting reasons).

Do I need to disable stagefright in build.prop? What are the consecuences disabling it?

Is there a way to fix stagefright without disabling it?

Thanks a lot for your help!!!

Edit: What if I take stagefright libs from a new cm12.1 (wich is already fixed) and replace them in my old cm12.1 based ROM?

Enviado desde mi Moto G mediante Tapatalk
[Android Software/Hacking General [Developers Only]] Phk:
Have you confirmed with the Stagefright Detector, that your build is actually vulnerable?
[Android Software/Hacking General [Developers Only]] sebastiandg7:
Yes, it was vulnerable... but I succesfully fixed it. Solution:

1- I downloaded a recent cm12.1 build (with Stagefright fixed).

2- Copied all libstagefright_****_****.so, libstagefright.so and libutils.so from /system/lib

3- Replaced them in my cm12.1 based rom in /system/lib

4- Reboot.

EDIT: Clearlly don't needed to disable Stagefright in build.prop.

Thanks for all the info about this issue.

Enviado desde mi Moto G mediante Tapatalk
[Android Software/Hacking General [Developers Only]] Phk:
Disabling in build.prop is only for situations where you can't fix the root cause (the .so dynamic libs)

Good to know ur ok. Good luck with the new ROM :)
[Android Software/Hacking General [Developers Only]] swapyworld:
Tried replacing the same from CM12.1 for hltespr to deodexed LP 5.0 rom

fixed permissions to rw-r-r and rebooted, gets stuck at sprint logo
[Android Software/Hacking General [Developers Only]] sebastiandg7:
It worked for me because I used cm12.1 files in a cm12.1 rom.
[Android Software/Hacking General [Developers Only]] swapyworld:
tried both with and without libutils.so

don't know what happened but i guess new rom is out by sprint N900PVPUEOK2 and it's finally patched but can't use because then i lose xposed and in turn greenify.

Greenify isn't effective anymore on LP without xposed :eek:
[Android Software/Hacking General [Developers Only]] Bakuryu42:
So I edited my build.prop to change the stagefright settings to false, am I safe or what?
[Android Software/Hacking General [Developers Only]] swapyworld:
yes you are, it's the other way around.
[Android Software/Hacking General [Developers Only]] Bakuryu42:
I'm confused you said I am safe, but then say it's the other way around meaning?
[Android Software/Hacking General [Developers Only]] swapyworld:
you can flash the latest rom from sammobile for sprint note 3 for being completely patched.

if you dont want to do that, this is the other way as in this, files arent patched, you are just not letting any app invoke stagefreight libs.
[Android Software/Hacking General [Developers Only]] Bakuryu42:
On on a Verizon S5 and I'm reluctant to upgrade to Lollipop if I don't have to. I just want to be in a stage where I can enable MMS again.
[Android Software/Hacking General [Developers Only]] swapyworld:
With this i don't think MMS will work.

For MMS to work and stagefright patch, u better upgrade to LP

sorry for the too delayed reply..hope someone helped you in the meanwhile
[Android Software/Hacking General [Developers Only]] Bakuryu42:
Sadly no one did. I disabled stage fright in the build.prop and enabled MMS and its working right now, I just don't know if its safe.
[Android Software/Hacking General [Developers Only]] pcwizzy37:
Wow, this is dangerous, I need to patch my CM10 and CM10.1 devices.

---------- Post added at 04:40 PM ---------- Previous post was at 04:18 PM ----------

Why are you trying to patch a non-existing file? you are supposed to be patching build.prop. or you can enter "touch build.prop.patched" and then do the patch.

---------- Post added at 04:48 PM ---------- Previous post was at 04:40 PM ----------

True, You never know if it is malicious.
[Android Software/Hacking General [Developers Only]] ocd_amp:
I don't want to do a TL:DR here so I'll keep it simple. Stagefright does not depend on MMS. It is a buffer Overflow vulnerability one of many and that's just 1 problem. It resides in Libraries in Android. There is no fixing it unless Google releases the source which is patched and then compiled into the libraries everyone can use.

There is no need to be pre occupied with this, as your Carrier will likely scan and block exploits before it gets into your phone via data. The most likely it can get into anyone's phone is through an unsecure Wifi connection. Surfing shady websites, or downloading Cracked apps. However, that said, the amount of effort a hacker will need to get into your phone will mean that you will need to be someone who is worth exploiting in the first place. I stopped worrying about this long time ago and am happily using older Roms for basic Calling/Texting. Stagefright is blown out of proportion and when it comes to Technology, nothing is 100% secure. A few years from now, every single software we use now that is "patched" will have thousands of exploitable bugs. As long as you use the internet, you can be hacked. So with that peace of mind, don't worry yourselves.

Build prop is not a method that will prevent anything, all it will do is cause a problem whenever you want to play back any audio or video. It will force close the app which is something I wouldn't advise as most people are just trying to get things done with their devices. Every single device we use, is data mined, we are already hacked. We just like to think we aren't. Mostly its not an issue and its used for things that ultimately won't affect a single person, but an entire population.

Just my 2cents. :P.
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] LVgamer98:
Hello, my phone won't start i think it is hard bricked by odin i was only trying to downgrade my phone because the lollipop update drains my battery life. I want the kitkat version back i have download it from sammobile. the perfect version but after it finished it won't boot up and i can't get in bootloader or recovery &, has no root. Can anyone say how to fix this or can say of this is under warranty the phone is still no 1 month old
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] bernardwu:
Does it show that it's charging when you plug in the USB charger?
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] tirimoti:
bricked A3

Well, I have the same problem. Recovery boot and hard reset are not working. Not visible on Pc while connected via USB. Nothing happens. I used the official ROM from sammobile to downgrade the phone.
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] LVgamer98:
it do nothing anymore it won't charge at all, and i can't get in recovery or bootloader
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] LVgamer98:
warranty

but my question is if i go back to the store have i warranty on this it is not rooted or anything used only official roms from sammbobile
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] Praveen125:
Yes it will have warranty if it is not rooted.
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] LVgamer98:
thanks man

Thanks this was the answer i was looking for i hoped it was under warranty because the phone is not even a month old!
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] Intel777chanel:
Before downgrading you MUST flash custom recovery and make wipe data, system, then reboot into bootloader and only after that you can downgrade.
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] heikoell:
hello the same happend to me after downgrading back to kitkat.i had a full brick.i got my phone back yesterday.so yes it goes after warranty.
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] tirimoti:
ok thanks for the answers, then i'll have to contact service.
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] hannez_r:
I've had exactly the same problem. Took the phone to carrier shop for repair. Main board were replaced under warranty.
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] anas07:
Please don't forget to wipe data and cache before u downgrade, it is the main reason that u having soft bricks and bootloops
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] droidqwerty:
Strange! Because I also once downgraded A3 to kitkat without a wipe (of course I was ignorant of the fact that it bricks your phone), and as expected, I got soft brick, but phone was still alive. But your case is expectional, as your device died completely. Maybe I was very lucky.

There is also an A5 user who reported this with his phone. He downgraded without wipe and his A5 died completely.

He even tried to get into download mode using USB jig (OP might want to give a try) but it didn't work for him sadly.
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] gggg:
A5 Hard Brick

I still cant believe that not wiping leads to a hard brick ... but it also happened to me.

!!!! Can anyone please explain why this happens !!!

http://xdaforums.com/galaxy-alpha/help/sm-a500fu-maybe-bricked-please-help-t3167400
[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] LVgamer98:
next time you must wiping everything before you flash another firmware version is this true?