yashsingh1/xdaforums huggingface dataset:
[Amazon Fire Phone] :
I'm bored so I gonna try around a bit.

qsee functions in kernel confirmed.

echo 1 > /proc/sys/kernel/kptr_restrict

grep -i qsee /proc/kallsyms

I build the shared library now .. just seeing how to use it.

254|root@kodiak:/ # /data/local/wotw

[-] Failed to load Widevine: No such file or directory

strace was my friend :)

It wanted to open the widevine files in the wrong place - I just straced for the open call and put them where they should be - no need to to anything to the code that can be worked around otherwise.

254|root@kodiak:/ # /data/local/wotw

[+] Widevine load res: 0

[+] Trying to probe 0x0D62D000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D65A000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D687000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D6B4000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D6E1000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D70E000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D73B000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D768000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D795000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D7C2000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D7EF000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D81C000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D849000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D876000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D8A3000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D8D0000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D8FD000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D92A000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D957000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D984000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D9B1000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0D9DE000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0DA0B000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0DA38000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0DA65000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0DA92000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0DABF000

[+] Crashed, jumping ahead

[+] Trying to probe 0x0DAEC000

[+] Crashed, jumping ahead

[-] Failed to find application

: No such file or directory

Now I need to get the memory region right ..

Right now I am wondering how he found the memory regions ... I am reading back his blog but it doesn't explain that.

Enough for today.

What I gathered is that we somehow need to find that memory region.

Maybe I missed something but I can't find a hint on how to do that.

Back again ...

Now I need to somehow extract the correct values for the Safe-Memory-Area.

I try to understand how he came to that specific value.
[Amazon Fire Phone] capt_planit:
So u guys are giving up on kexec? If so, I don't expect you to answer. [MENTION=4204060]Okarin[/MENTION] What is with this code in kexec.c line 1457 and 1458-- "kernel_restart_prepare(NULL); machine_shutdown();" ? A stub to make it compile (line numbers might be wrong but should be close)? We aren't using kernel_restart_prepare anymore? Or machine_shutdown? They sound important....When I uncomment reboot.h in kexec.c #includes in [MENTION=5143031]madushan1000[/MENTION] build I get unknown symbol errors. I know how to work around this but it would be great to unify the code base for (now obsolete) kexec_load.ko. [MENTION=4225567]delewer[/MENTION] [MENTION=3804724]Crabapple[/MENTION] [MENTION=4939386]Surge1223[/MENTION] [MENTION=6872094]calcpro[/MENTION]grammer and that ryan guy who talks to surge (and others who I'd like to mention--can you post additional code). [MENTION=4939386]Surge1223[/MENTION] you only built in kernel? No external module? I have modified Madushan1000's kexec.c so that the commented out includes buld (as in yours Okarin) on my gcc 4.4.3 (crusty, I know, don't ask). More code to look at would be great. For the exercise more than eventual success, I have to believe.... c_p
[Amazon Fire Phone] Surge1223:
Nah I prefer to build out of tree, makes it easier to modify and add code/files and see the results. I just use local copies of some includes, like kexec.h, etc. When I was working on this, I used a makefile similar to this

EXTRA_CFLAGS=-mno-unaligned-access
EXTRA_CFLAGS=-fno-pic
KDIR := /Users/surge/Downloads/kernel_samsung-jfltevzw-VRUGOC1-master

KVER := $(shell uname -r)

PWD := $(shell pwd)

CCPATH := /Users/surge/arm-eabi-4.8/bin
ARCH	= arm
CPPFLAGS	= -I$kernel/
EXTRA_CFLAGS += -I${KDIR}/include

obj-m += lkm_kexec.o
lkm_kexec-objs := kexec.o mmu.o sys.o core.o sleep.o \
proc-v7.o tlb-v7.o cache-v7.o pabort-v7.o abort-ev7.o copypage-v6.o \
mm_init.o entry-common.o driver_sys.o suspend.o idmap.o

obj-m += msm_kexec.o

obj-m += proc_atags.o

obj-m += atag.o
atag-objs := atags_compat.o atags.o

obj-m += arm_kexec.o
arm_kexec-objs := machine_kexec.o relocate_kernel.o

default:
$(MAKE) ARCH=arm CROSS_COMPILE=$(CCPATH)/arm-eabi- EXTRA_CFLAGS="-I${KDIR}/include/linux -fno-pic -mno-unaligned-access" -C $(KDIR) M=$(PWD) modules
cp -f `find $(PWD) -name "*.ko"` $(KDIR)/build/

clean:
rm -f *.o.d *.o *.ko *.mod.c Module.symvers Module.markers modules.order \.*.o.cmd	\.*.ko.cmd \.*.o.drm -rf \.tmp_versions

lkm_kexec.ko ends up being pretty large (~800kb)

in order for me to test kexec using these modules, I have to load them in the following order:

insmod msm_kexec.ko

insmod lkm_kexec.ko

insmod proc_atags.ko

insmod arm_kexec.ko

usually ends up getting to soft_restart and freezes when switching to the static identity mapping to continue with reset.

EDIT: if you're wondering why I dont just combine msm_kexec.ko, lkm_kexec.ko and arm_kexec.ko, its because I intentionally want kexec.c and machine_kexec.c code to be housed in different modules, also for some testing, I want the driver for char device registration to occur without initializing some of the machine_kexec and relocation info. A side benefit of this is that it also becomes very easy to see if the failure is kexec.c (and by extension, kexec-tools) related, or arch specific kexec implementation errors (machine_kexec, relocate_kernel, atags, etc)
[Amazon Fire Phone] capt_planit:
[MENTION=4939386]Surge1223[/MENTION] Thanks but I think I'm missing one or more of your files (that is why I asked about out-of-tree builds). I've got all the stuff you included with this kernel from github: kernel_samsung-jfltevzw-VRUFNC5-master. I believe I would need (at a minumum) atags_compat.c. I guess I could just grab one from some (roughly) compatible source tree but I'd like to replicate your work as much as possible. After all, who wouldn't want 4 modules instead of just 2 :)
[Amazon Fire Phone] Surge1223:
Oh I haven't updated those sources in forever, I'm not even sure I have uploaded any of the out of tree source anywhere yet, and they are significantly different from what's on that git. I'll upload them to git in a bit.

Also I don't usually load the atag.o module, because I coded it in an attempt to make it dump atags on the next reboot, but currently it panics so I never attempted to fix it and I instead opted to have someone on an unlocked bootloader flash a kernel i made that dumps atags out and had them send it to me.

The proc_atags.ko just creates /proc/atags entry for convenience as that's how kexec-tools checks for atags
[Amazon Fire Phone] capt_planit:
[MENTION=4939386]Surge1223[/MENTION] Oh, thanks for the reply. I just grabbed the atags_compat.c from Torvald's git. I also had to get file.h because the one in my kernel tree doesn't have fdget. Unfortunately kexec.c has references to purgatory which I haven't messed with since I built my kexec tools (both from delewer's thread and now here from okarin). Here is the first of those errors: "s4zoom/kexec-surge/kexec.c:643: error: 'struct kimage' has no member named 'purgatory_info". I was wondering about that /proc/atags entry created when we load the procfs_rw module. I thought maybe we were supposed to write something to it, but it has pretty strict permissions. If you get a chance to upload a snapshot of your out-of-tree module build that would be great.
[Amazon Fire Phone] Surge1223:
You have to add this to the struct kimage in kexec.h

struct purgatory_info purgatory_info;

The /proc/atags doesn't have to be read if you provide a atags file pointer instead, but unfortunately some early code in kexec-tools has the ability to be able to use atags (regardless of whether or not you provide atags as a file) dependent on if it detects /proc/atags existing. The good news is that the atags segment it actually will use is whatever the file pointer you provide is (i.e., --atags-FILE=./atags).

For a lot of this to compile out of tree a few includes need to be changed and a few things commented out. You'll see what I mean when I get a chance to upload.
[Amazon Fire Phone] madushan1000:
I'm not really working on any of these right now. I keep hoping to take a look at qsee stuff when I get a free time.
[Amazon Fire Phone] madushan1000:
I guess we have to load the library in the mediaserver process. I'm not sure how to do that though.
[Amazon Fire Phone] :
machine_shutdown - is in machine_kexec.c

kernel_restart_prepare - is in sys.c

Both functions are delivered with the module and do some basic setup.

Be aware of the freaking watchDog - one wrong step and it barks and the whole SoC resets itself.
[Amazon Fire Phone] capt_planit:
Thanks for the answer [MENTION=4204060]Okarin[/MENTION]. I saw the commented sea of code around machine_shutdown and kernel_restart_prepare and thought you had done it. I went back to Delewer's V11 and realize it has been like that since at least then. I'm interested because I get symbol errors from these 2 in two build trees but not the other three (with the code near identical). Just grasping at straws. Have you considered running a chron job to kill the watchdog? Maybe through init.d script or something? I'm still stuck at "function not found" with one module, no memory hole with another and machine_kexec_prepare---- kexec_load - result : '0' with Delewer's V10 so it will be some time until I encounter the dog, if at all.
[Amazon Fire Phone] madushan1000:
so I asked gal how to find secapp region start address, It's printed into dmesg at boot

I tried running the exploit with these values but no luck yet. We might have to follow gals complete procedure and find the correct symbols for the fire phone ourselves.

And apparently we can run the exploit as root, without loading it into the mediaserver.
[Amazon Fire Phone] Awesomeslayerg:
Don't know if this will help

https://mobile.twitter.com/laginimaineb/status/737051964857561093
[Amazon Fire Phone] ferolac:
i saw your post on r/android and directly jumped here only to found out that you have already commented your success :highfive:. I hope that now we can have MM or atleast lollipop.
[Amazon Fire Phone] Awesomeslayerg:
It's none of my work it's some other guys
[Amazon Fire Phone] ferolac:
oh, my bad
[Amazon Fire Phone] blackroseblade:
This looks SERIOUSLY promising.

I'm dare not be that hopeful yet, but please forgive me for asking (I hope I'm not violating any rules with this):

Can someone explain to me how much closer are we with this? The KeyMaster keys must mean that effectively we are able to completely blitz through the bootloader lock now and sign our own roms and boot them, right? Thus moving on to latest kernels and android versions, 6.0.1 or even Android N, yes?

This means we can also decrypt the HAL and enable full fledged hardware interaction, perhaps?
[Amazon Fire Phone] capt_planit:
I believe Mad's module is from hashcode's implementation. I base this on the fact that it creates a /dev/kexec entry and some of hash's commits implement this design. It is also why I've had trouble debugging it from delewer's kexec tools, which uses /dev/kexec_driver. Additional. If I load Okarin's module, run kexec (errors out) unload module and load Mad's module I can trigger a spontaneous reboot by evoking kexec again...woot!
[Amazon Fire Phone] madushan1000:
not really, keymaster keys are only valid for the secure storage android uses to store secret keys like vpn passwords. By having the keymaster keys you can decrypt them but not the bootloader stuff AFAIK. But we can certainly try to do that. If Amazon was dumb enough to use the same key for signing kernels we will be in luck.

But the other ways is much more promising, hot swapping the kernel trough tz exploit. Or maybe unlocking the bootloder by overwriting the key verification segments in the SBL or something.
[Amazon Fire Phone] Awesomeslayerg:
I just received a fire phone with update 3.5.0 on it. Ill keep it like this until the tz vuln is ready.
[Amazon Fire Phone] Awesomeslayerg:
[MENTION=5143031]madushan1000[/MENTION]

http://bits-please.blogspot.com/2016/06/trustzone-kernel-privilege-escalation.html?m=1

http://retme.net/index.php/2016/06/12/CVE-2016-2468.html
[Amazon Fire Phone] v6ser:
bump
[Amazon Fire Phone] :
I tried around and couldn't get it to work.

None of the exploits. Sorry folks I am dropping out.

Maybe I'll try the kexec-approach again. That one was the most promising I could find.
[Amazon Fire Phone] capt_planit:
[MENTION=4204060]Okarin[/MENTION] why not try hashcode's kexec-tools coupled with your take on madushan's module? I'm currently lost in debugging hell with this implementation "c0 BUG: sleeping function called from invalid context at kernel/rwsem.c:21". Also, surge1223 posted his sources and you could try those as well. All are designed to use /dev/kexec instead of delewar's /dev/kexec_driver. I never got the /dev/kexec_driver to communicate properly. I will get back to it later. Good luck. c_p
[Amazon Fire Phone] capt_planit:
[MENTION=4204060]Okarin[/MENTION] Minor note. I need to add the following to your sys.c to get around the above error

enum umh_disable_depth

{

UMH_ENABLED = 0,

UMH_FREEZING,

UMH_DISABLED,

};

I have to find a way for kernel_restart_prepare and device_shutdown to return. Additional--how portable do you think your code in core.c is for shutting down the watchdog? Think it works on a Samsung S4 Zoom? How to test? Just look for the pid of running watchdog?
[Amazon Fire Phone] :
It's sure been a while.

I just redownloaded the gitrepo I set up and found that it was all still working.

Let's see what happens.

First things first.

If you have the proper compiler as specified in my build.sh you shouldn't have a problem.

Just google for it and you'll find it.

Prepare the Kernel-Sources at the place specified in build.sh

and finally run the script with your fire-phone in debug mode and everything should be setup correctly.

I am doing some experiments on this now - have some trouble reconstructing all the steps to get a proper extracted kernel out of my device (it's been to long).

There shouldn't be any need to change the code at this point.

The modules and everything should load just fine.

Yes the watching - I remember it being a *****.

Currently I have trouble extracting the boot image :(

Okay I am back to where I left off.

Devices goes dark and that's it.

Updating the repo with better instructions though.
[Amazon Fire Phone] :
Maybe there is better solution now.

I will try to see what I can do over the weekend.

Still this watchdog always restarting the machine - even petting doesn't help
[Amazon Fire Phone] mifl:
Please, in order for us to know the state of your work, write a summary of the changes you have made so far.

If you need help with the kernel, I can collaborate by creating a repository in Github with a new build.sh file, and implementing the changes for kexecboot.

Greetings.
[Amazon Fire Phone] :
So far I just changed the README an added how to get the boot.img

The code in the repo hasn't changed:

https://github.com/Kogorou42/firephone-kexec

The device still freezes after "disabling" the watchdog.

I would like to try something else.

This all looks promising but it doesn't really work :(
[Amazon Fire Phone] capt_planit:
My issue appears to be with control_code_page, unless kexec.c and machine_kexec.c are supposed to use to different ones? This line (in machine_kexec.c): reboot_code_buffer = page_address(image->control_code_page); causes a kernel oops. Just before this oops I have inserted a printk that says: c0 control code page @eb9ec000 while a similar debugging line in kexec.c says: c0 control_code_page [MENTION=6558468]00001[/MENTION]000. I'm really at a loss here. Any help appreciated. [MENTION=4204060]Okarin[/MENTION] I think kexec soft_reboot may never work but it also seems like the best hope for older phones with locked bootloaders. I thank you for your help and time and encourage you not to quit. I'd guess that the reboot buffer might be your problem but since I haven't gotten there yet it would just be a guess. c_p
[Amazon Fire Phone] capt_planit:
Do you just shutdown/black screen?

I've meant to mention this before. When I fold something really naughty into my module I get the phone to just go to black screen. No Oops, no mention in last_kmsg nothing--it just turns off. I only think of it now because it is doing it again, and since I've been working on my kexec binary I forget what I did to make it do so, but (previously) this specific line added to machine_kexec.c used to trigger this behavior "reboot_code_buffer = 0xed640000;" Naturally, I don't think you have something like this in there, but I would definitely check over the code for real errors before giving up.
[Amazon Fire Phone] jmak117:
Just a quick check,

Did someone already tried this exploit?

github.com/laginimaineb/MSM8974_exploit
[Moto X Q&A] droodski:
What part should I look for if I think wifi hardware is broken? Is it the lower antenna? Or upper.. or ?

( can't toggle wifi on at all no matter after flashing stock firmware back etec )
[Galaxy S III Q&A, Help & Troubleshooting] aidenh37:
I just noticed the description on the S3 i9300 device page says it has wireless charging - does it secretly pack this feature?
[Galaxy S III Q&A, Help & Troubleshooting] Flo0fy:
Nope. It doesn't have this feature only if you add it yourself. https://www.youtube.com/watch?v=CyC37pHCVgE
[Galaxy S III Q&A, Help & Troubleshooting] aidenh37:
I thought so! Maybe the description should be updated.
[Galaxy S III Q&A, Help & Troubleshooting] Itzjosh:
In some stores around the UK and us they sold back covers for the s3 with wireless charging
[Galaxy S III Q&A, Help & Troubleshooting] mpadhu:
You need to purchase a Qi wireless charging receiver which needs to be placed at the back of the battery. It will be thin enough to fit between your battery and back cover.

Now if you placed the phone on a wireless charging pad the phone starts charging wirelessly.

I have used this on my phone.
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] Joakim_Aronsson:
Hello. It seems like my phone kills swiftkey from time to time. And that makes my phone seem slow when it has to reload it. Any way to keep it in memory? Have to use Samsung keyboard for now... :/
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] linusniaocun:
same situation:o
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] ralmeidao:
just torn off emoji prediction!! it's a bug from swift keyboard
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] Joakim_Aronsson:
Thanks but that was already off unfortunately.
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] ralmeidao:
mm works for me
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] ezaechiel:
I don't have this kind of problem but I never used emoji prediction. In which language do you use it ? Maybe related to the language?
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] eFCiKay:
same here with Swype keyboard [MENTION=334113]Sgs[/MENTION]6

It really seems that it gets kicked off from memory after some time. Is there any way to force it kept in memory?
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] apurva.giri:
I don't use emoji prediction either. And I do not have any lags on the keyboard at all!
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] Dovern:
I'm using UK English, i face randomly shut down swiftkey and other third party keyboard too. I used to owned S6, after upgraded to 5.1.1, problem started to occur... now having same problem with S6 Edge Plus. Sad...
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] tommo123:
same here (only with swiftkey) on sony z ultra on 412 (cane be bothered updating yet).

emoji etc off. only happened a few updates ago. typing away and keyboard randomly closes. after waiting 30 seconds and repeatedly clicking in text area the keyboard pops back up and works for a while. reboot and same behaviour, same if wipe data etc.

might try wiping data and unlinking from my acc. if not that IMO has to be the app as OS hasn't changed (rooted and no OTA updates).
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] Riardon:
I ditched Swiftkey because it seems laggy and slow for me. With other keyboards I have no problems.
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] Aequilibrium:
It's a bug of SwiftKey since 5.4. I have reported it several times with explinations, screencasts etc. They simply refuse to aknowledge they screwed up the app. So I'm using samsung keyboard, which, by the way, uses Swiftkey SDK.
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] ced0072:
Did you look at the App Optimization system? I have disabled Swiftkey there, to avoid having the system closing it after a certain time, and everything seems to be ok for now.
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] irajames1176:
I noticed it lags a lot on the Edge Plus too which is ridiculous because of how fast the phone is, I have been trying out other keyboards and one that came close to swiftkey for me was Minuum Keyboard it has some really good prediction even for really sloppy fast typing.
[Galaxy S6 Edge+ Q&A, Help & Troubleshooting] denNorske:
I have read on a another topic that this is caused by the Samsung firmware itself. It detects SwiftKey as low priority and kills it whenever possible, even when you are using it (which is kind of ridiculous?)

I've read that if you disable spcm in build.prop (requires root) the issue will be fixed. I hope that Samsung does something with it soon as the same problem has been on touchwiz since the start..

So not only the edge+ that has the issue, I got the International S6 (920F) and I need to live with that issue... Almost considered rooting and voiding my warranty because of this and the terrible ram management.

Source: http://xdaforums.com/galaxy-s6/general/tip-fix-constant-swiftkey-reloading-lag-t3210027

EDIT: (found a working workaround:)

Try this; it might help you along the way:

Sent fra min SM-G920F via Tapatalk
[T-Mobile Samsung Galaxy S6] HT32:
I've recently installed Adaway and then decided I didn't want it anymore so once I've Uninstalled it for some reason Netflix and Hulu would be stuck at the loading screen. I've restored the hosts file before Uninstalling Adaway, and I've wiped my cache, dalvik, and data and it still hasn't solved the problem. What is wrong?
[ONE Q&A, Help & Troubleshooting] xdaat:
Guys i am not able to take any screenshort on my phone after updating to cos 12.1. When i try to take a screen short it says ( can't take screen short due to limited storage space, or its not allowed by the app or the organization) pls help and how to take screen short.

Thanks
[ONE Q&A, Help & Troubleshooting] reinipic:
hi mate, here a few solutions for you:

after updating you should wipe cache.

You can make a screenshot by holding volume down and power button at the same time.

Otherwise you can add the screenshot menue to the power menue:

go to settings, buttons, power menue and check screenshot. So you can take a screenshot with your power menue. Don't forget to make a reboot, done :fingers-crossed:

Greets, reinipic
[ONE Q&A, Help & Troubleshooting] xdaat:
No success, did all the steps same issue and tye error displaying