yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] nicholseric:
Yay! As su in Terminal Emulator, wm density 360 worked. The launcher didn't work until #am start -c android.intent.category.HOME -a android.intent.action.MAIN and other apps also needed to be killed before they would display at the new density like lock screen and existing notifications. There are a few issues with the status bar and nav buttons depending on what app you try to run. I assume that if you set this early enough with a hook from init.rc, (nudge nudge) say a trusted file from /data/ that there would be no problem.

LCD density set from setprop, local.prop and wm density all break SafeNet. Even worse, SafeNet now checks /sbin/ for su, requiring a mount bind to a copy of sbin without su. Next thing you know, it will check for bind mounts!

How about a build of SuperSU, su in a random directory with random names? I know, name it the hash of boot.img or the public key from the user generated keystore.

Dont read on, I fixed it , the /data/setlcd.sh 560 needed quotes around it.
[Android Software/Hacking General [Developers Only]] phhusson:
So I made a test of verified boot feature here: http://xdaforums.com/android/software-hacking/verified-boot-disk-encryption-testings-t3248161

The tl;dr is that verified boot is IMO a great feature of 5X/6P, and we have to find a way to have su enabled with this feature.

But this requires to have working OTA.
[Android Software/Hacking General [Developers Only]] nicholseric:
I have finally gotten the functionality I need with the exception of iptables which I understand you are working on adding. I am testing with shamu mra58r and the boot-su-power.img.

Here is my setup that features:

custom hosts file for browsing without advertisements

set the LCD density to tablet mode

quickly disable su and revert density when I want to use Android Pay

As root, I created a script in /data/android.sh and set the context to system via chcon u:object_r:system_file:s0 and chmod 700 here are its contents:

#!/system/bin/sh
#bind mounts transcend am restarts
#wm density transcends reboots
function lcd
{
/system/bin/wm density $density
/system/bin/sleep 3
/system/bin/am restart
}
function hosts
{
mount -o bind /data/hosts /system/etc/hosts
}
function nosu
{
/system/bin/wm density 560
cp /sbin /data/sbin -r
rm -f /data/sbin/su
mount -o bind /data/sbin /sbin
/system/bin/am restart
}
function dns
{
#not working yet in phh
iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 8.8.8.8:53
iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to 8.8.8.8:53
}
density=$2
case "$1" in
lcd) lcd ;;
hosts) hosts ;;
nosu) nosu ;;
dns) dns ;;
esac

The hosts file was copied from http://winhelp2002.mvps.org/hosts.txt and placed in /data, its context was also set chcon u:object_r:system_file:s0 and chmod 644. The local host entries were modified to match those found in /system/etc/hosts. It was important that the contents of this file were terminated on each line and with a blank line at the end.

The tricky part was creating launchers on a home screen using the Terminal Emulator Widget. It seemed that you could not just type in /sbin/su, instead you had to browse to it. Screenshot of widget config attached.

I learned a few interesting things during testing.

Using a /data/local.prop with an encrypted disk resulted in the local.prop not being read during init.

Once wm density is set, it is persistent.

Using mount -o bind gives persistent mounts if you reboot using am restart from the terminal

SafetyNet now checks for su in /sbin

SafetyNet for AndroidPay checks for LCD density regardless of setting it via local.prop (if unencrypted), setprop or wm density

This will be easy for me to reproduce across all my devices without granting persistent root to any app and without adding any app but superuser and terminal emulator.
[Android Software/Hacking General [Developers Only]] phhusson:
Thanks for your test! It's really interesting.

You must be the first user of something other than eng :P

iptables does work for me (in adb shell). Looking back, it should have been fixed by https://github.com/phhusson/super-bootimg/commit/31d3a635eea4fe66071346e05913acfb00d60144

That made me realize that if I don't do releases, I still need to know what users are using, so I added /super-bootimg which contains the git version of super-bootimg repo

For local.prop I'm happy to see you don't need it. I really feel like user shouldn't be allowed to change it (but I'm thinking only about some properties which are in /default.prop so it can't be overriden. perhaps local.prop is safe enough)

am restart is not a reboot, so it's normal mount bind stays

I think you could just mount bind an empty folder to /sbin. The only risks are if adbd/ueventd/watchdogd/healthd restarts, but they shouldn't
[Android Software/Hacking General [Developers Only]] nicholseric:
Any idea why busybox nslookup is not working?

root@shamu:/data # ls -Z nslookup busybox-android.bin

lrwxrwxrwx root root u:object_r:system_data_file:s0 nslookup -> busybox-android.bin

-rwxr-xr-x root shell u:object_r:system_file:s0 busybox-android.bin

root@shamu:/data # ./nslookup superuser.phh.me 8.8.8.8

Server: 8.8.8.8

Address 1: 8.8.8.8

nslookup: can't resolve 'superuser.phh.me'

1|root@shamu:/data # dmesg

[39764.686702] healthd: battery l=91 v=4144 t=28.1 h=2 st=3 c=-439 chg=

root@shamu:/data #
[Android Software/Hacking General [Developers Only]] phhusson:
I haven't seen a single proper use of it, and I'll probably disable(ignore) this feature.
[Android Software/Hacking General [Developers Only]] MikeRL100:
In that case, I'm going through with other developers and get their applications up with the program. I already got the 3C Toolbix Pro developer to make his app behave properly with other root apps. Now I'm doing the same with the Leandroid developer.
[Android Software/Hacking General [Developers Only]] phhusson:
It supports 32bits, you just have to run make install in super-bootimg/jni/ folder to rebuild it
[Android Software/Hacking General [Developers Only]] 3c:
If you disable it, you'll break many things that root alone cannot overcome. As pointe out by Chainfire, runcon is unreliable and actually run things without root and permissions, so apps can only rely those --context (or -cn) option to change security context. Maybe runcon from busybox solves this, however by looking at its implementation it's very doubtful.

Here are some readings about this (search for runcon in first link):

https://su.chainfire.eu/

https://github.com/Chainfire/libsup...user/src/eu/chainfire/libsuperuser/Shell.java

That's where you're wrong. Your test case are obviously flawed or incomplete. A lot of things can't be done without using a different security context. Likely you tested on ROMs which have modified the policies so that root can access those, which is exactly what you're saying: su context should be adapted to use cases, and policies should not be modified to enable root access.

Feel free to try on a stock-rooted 6.0 ROM to disable or uninstall or install an app and you'll get an error message saying 'can't access Package Manager, is the system running?'.

As of now, I can only direct my users to use SuperSU, the only app that supports SELinux consistently and reliably on all versions of Android.
[Android Software/Hacking General [Developers Only]] phhusson:
Would you bother trying yourself?

With my root, this DOES work WITHOUT changing context on a STOCK CAF 6.0 ROM.
[Android Software/Hacking General [Developers Only]] 3c:
Do you really think I never tried? Instead of being so condescending and testing on a policy-modified un-secure ROM, you might want to try a true stock-rooted Android ROM...

2 facts for you:

1) I'll stop wasting my time trying to help you with information that everybody knows, since Android 4.3 now!

2) I'll stick with SuperSU from Chainfire, the only proper SU implementation, and tell my users to stick with it to avoid issues.
[Android Software/Hacking General [Developers Only]] phhusson:
I DID test on an UNMODIFIED SECURE ROM. Including hammerhead

Unless you consider hammerhead stock ROM to be "modified unsecure"

Edit:

I just checked again. On a stock google/hammerhead/hammerhead:6.0/MRA58N/2289998:user/release-keys, freshly factory-reseted

Downloaded http://superuser.phh.me/nexus/hammerhead/MRA58N/boot-hammerhead-MRA58N-su-eng-r142.img

fastboot flash boot it, adb install Superuser.apk;

% adb -s 03440c03828ec6f2 shell
shell@hammerhead:/ $ su
Permission denied
1|shell@hammerhead:/ $ su

root@hammerhead:/data/data # pm uninstall me.phh.superuser
Success
root@hammerhead:/data/data #
[Android Software/Hacking General [Developers Only]] phhusson:
So I'm testing your app. It turns out it is calling /system/xbin/su instead of /sbin/su, this shouldn't happen. But that's ok since I've already bulleted-proofed that for other apps.

I have tested your app as much as possible.

Firewall that I think needs special SELinux policy changes works.

Disabling startup/events doesn't work, because you assume that environment variables are transmitted through su, which is totally wrong.

Namely, when you call pm with app_process line, you expect BOOTCLASS and base variables to be transmitted through su

Good news, in this precise case, you're calling su from su itself, so transmitting environment is easy, and not dangerous.

So I added changes when su is called from su:

- I ignore the --context option

- I don't go again through su daemon, and directly execve, so that

Now disabling startup/events does work.

I've been through most of features and it seems to be working. I couldn't test everything because I have a true read-only /system (ie squashfs).

I've made a new release, r143 / 0e3b103 including this change.

If you or one user find another problem, JUST tell me.

[MENTION=4698234]MikeRL100[/MENTION] have you noticed some other problems?

NB: As for environment transmission, on a standard Debian:

root@phh-station:~# toto=tata
root@phh-station:~# su
root@phh-station:~# echo $toto

root@phh-station:~# exit
root@phh-station:~# echo $toto
tata
root@phh-station:~#
[Android Software/Hacking General [Developers Only]] ]grimm[:
Custom hosts file

[/COLOR]

I apologize if I missed this somewhere in the thread although I tried searching, but is it correct that we still have to manually deal with a custom hosts file? I noticed that superuser.zip has a script in the 'havealoha' folder that adds a function to init.rc that bind mounts /data/hosts to /system/etc/hosts and also adds an LCD density change to default.prop, but I didn't actually see the script being called anywhere.
[Android Software/Hacking General [Developers Only]] phhusson:
This is correct. The implementation of su --bind is ongoing. I hope I'll have a PoC by the end of the week.
[Android Software/Hacking General [Developers Only]] phhusson:
Nexus' january security update generated.
[Android Software/Hacking General [Developers Only]] Haul:
Is it useful to hear feedback like "the new r146 eng build worked 4 me on angler MMB29P" (it did), or would you prefer if we left that kind of stuff out of your thread?
[Android Software/Hacking General [Developers Only]] phhusson:
I'd say that for the moment, yes it is useful.
[Android Software/Hacking General [Developers Only]] toonlight:
Tried updating today, but flashing superuser.zip in TWRP fails with error message "Error executing updater binary in zip '/sdcard/superuser.zip'

Just updated my Nexus 5 to MMB29S.
[Android Software/Hacking General [Developers Only]] Lrs121:
Usually means a bad download.
[Android Software/Hacking General [Developers Only]] phhusson:
Erf I think I broke it...

Thanks for the report.
[Android Software/Hacking General [Developers Only]] phhusson:
Can someone test again superuser.zip? And if it doesn't work, give me the /tmp/recovery.log ? (I have no TWRP device ATM...)

If it works, can someone test it on MultiROM? This should be fixed as well.

Edit: Ok, I found the problem. It's now fixed. Though I still couldn't test MultiROM

Edit2: Ok, [MENTION=388504]captaint[/MENTION]hrowback tested for me on MultiROM. It works
[Android Software/Hacking General [Developers Only]] ddimple4:
Many thanks for the hard work.

If I flash a new kernel, would I need to reflash the superuser.zip?
[Android Software/Hacking General [Developers Only]] phhusson:
Yes
[Android Software/Hacking General [Developers Only]] toonlight:
Working for my Nexus 5 on the latest update now :)
[Android Software/Hacking General [Developers Only]] yochananmarqos:
Titanium is able to acquire root access on my end.
[Android Software/Hacking General [Developers Only]] Primokorn:
No issue with TiBu either. Provide logs.
[Android Software/Hacking General [Developers Only]] ruchern:
The Magisk suhide doesn't work on Android 5 right?
[Android Software/Hacking General [Developers Only]] Captain_Throwback:
There is no "Magisk suhide" and this isn't the Magisk thread.
[Android Software/Hacking General [Developers Only]] ruchern:
Sorry. I meant the phhsuperuser one.

I know r266 has some hide functionality
[Android Software/Hacking General [Developers Only]] android404:
Hi. I hope there's a simple answer to my knowledge-free question. I'm on a rooted (supersu) moto g4 plus running stock and want to flash an aosp custom rom. Inside the zip there's a folder with a supersu.zip file. Is there an easy way to replace superSU with phh superuser before even flashing the rom? Is unrooting through superSU itself and rooting with this one afterwards clean and safe enough? Thanks in advance.
[Android Software/Hacking General [Developers Only]] adrman:
I'm assuming you're posting in the phh superuser thread because you want to replace SuperSU with phh's SuperUser. You could try just deleting the SuperSU zip from the custom rom zip and repacking it. The flash script might error out though, so have a backup just in case. Failing that, the only way around would be to use the full unroot option from the SuperSU app, then flash phh.

Edit: Apologies, I missed the part where you said you wanted to replace SuperSU. Also, what are you currently using for root on stock?
[Android Software/Hacking General [Developers Only]] OmegaBlaze:
I would take that file out.

Flash the ROM (hopefully it flashes ).

Flash the appropriate Phhusson's superuser zip or image.

Done.
[Android Software/Hacking General [Developers Only]] android404:
Deleting supersu before the flash worked. Up and running.
[Android Software/Hacking General [Developers Only]] Beast84:
I keep getting an error flashing on 7.1.1. Anyone else? I've tried re-downloading. Tried updating twrp. Just keeps failing
[Android Software/Hacking General [Developers Only]] androcraze:
I wonder if Flashify might work?
[Android Software/Hacking General [Developers Only]] Beast84:
Isn't flashify for rooted devices?
[Android Software/Hacking General [Developers Only]] androcraze:
Yep. Chick-Egg, Face-Palm.

Sounds like 7.1.1 might create some more fun for all.
[Android Software/Hacking General [Developers Only]] garrettsessions:
I have a Nexus 6P on 7.1.1. Used PHH 2.66 and it works great. Flashed through TWRP.
[Android Software/Hacking General [Developers Only]] Beast84:
That's the same setup I'm getting. It keeps failing in twrp. I've re-downloaded from my device, from my computer, my Chromebook. Updated twrp through twrp, and fastboot. Just keeps failing. I'm gonna try supersu when I get off work. See if that gets the job done
[Android Software/Hacking General [Developers Only]] Captain_Throwback:
Where's the recovery log? How can anyone help without a log?
[Android Software/Hacking General [Developers Only]] Beast84:
Is there a way to pull the log on the device? I don't have my computer with me at work
[Android Software/Hacking General [Developers Only]] Captain_Throwback:
In TWRP, it's Advanced -> Copy Log. The console output will tell you where it copied.
[Android Software/Hacking General [Developers Only]] androcraze:
TWRP -> Advanced -> Copy Log
[Android Software/Hacking General [Developers Only]] Beast84:
Here's the log
[Android Software/Hacking General [Developers Only]] loserskater:
Try flashing stock boot.img
[Android Software/Hacking General [Developers Only]] mrxtc89117:
How do you do a full unroot or uninstall of phh superuser? Do I do that thru the Magisk Manager? Thank you.
[Android Software/Hacking General [Developers Only]] Beast84:
I was trying to avoid that so I could stay unencrypted. I'll try it later. Thanks
[Android Software/Hacking General [Developers Only]] adrman:
If you're using Magisk phh, ask in this thread. If not, just restore your stock boot image or dirty flash your rom.
[Android Software/Hacking General [Developers Only]] mitchdickson:
Use the link below for 7.1.1 for the 6p. It's the stock boot.img with force encrypt disabled.

https://drive.google.com/file/d/0BzeTyysBgL5cUHRHd0RlVXhMWGc/view?usp=drivesdk
[Android Software/Hacking General [Developers Only]] Beast84:
Any chance of a different link? I can't download this. It just keeps trying to open it in drive
[Android Software/Hacking General [Developers Only]] mitchdickson:
Yep. https://www.dropbox.com/s/0qlgif8qolnw9ry/boot_npf10c_noforce.img?dl=0
[Android Software/Hacking General [Developers Only]] Zwulf:
It's there a way to manually add an app to superuser permissions? Using Nitrogen OS with OMS, but Masquerade does not gain root (doesn't even request it). I try to figure out why Substratum does not work and I think that might be the cause. Just want to find out if it is, may it be by excluding that possible cause. Would be nice if someone could help.
[Android Software/Hacking General [Developers Only]] Pkt_Lnt:
Try setting your kernel Permissive temporarily. That worked some weeks back, and then I provided a log and PHH fixed the problem.
[Android Software/Hacking General [Developers Only]] Zwulf:
Sadly didn't work. Thanks anyway. :)
[Android Software/Hacking General [Developers Only]] b8842dc0:
Can somebody help me understand what I'm doing wrong. I'm trying to compile the su binary. Following the instructions in the readme here: https://github.com/phhusson/Superuser. I have android-sdk and android-ndk installed and in my path. When I cd Superuser/Superuser and run "ndk-build", I get the following errors:

root@iridonia:/usr/local/android/Superuser/Superuser# ndk-build
[x86] Compile : su <= su.c
In file included from jni/su/su.c:45:
jni/su/binds.h:17:9: warning: 'BINDSH' is used as a header guard here, followed by #define of a different macro [-Wheader-guard]
#ifndef BINDSH
^~~~~~
jni/su/binds.h:18:9: note: 'BINDS_H' is defined here; did you mean 'BINDSH'?
#define BINDS_H
^~~~~~~
BINDSH
1 warning generated.
[x86] Compile : su <= daemon.c
In file included from jni/su/daemon.c:50:
jni/su/binds.h:17:9: warning: 'BINDSH' is used as a header guard here, followed by #define of a different macro [-Wheader-guard]
#ifndef BINDSH
^~~~~~
jni/su/binds.h:18:9: note: 'BINDS_H' is defined here; did you mean 'BINDSH'?
#define BINDS_H
^~~~~~~
BINDSH
jni/su/daemon.c:464:6: warning: comparison of unsigned expression < 0 is always false [-Wtautological-compare]
if(s<0)
~^~
jni/su/daemon.c:506:69: error: function definition is not allowed here
auto void cb(void *arg, int uid, const char *src, const char *dst) {
^
jni/su/daemon.c:545:15: error: use of undeclared identifier 'cb'
bind_foreach(cb, NULL);
^
jni/su/daemon.c:549:53: error: function definition is not allowed here
auto void cb(void *arg, int uid, const char *path) {
^
jni/su/daemon.c:566:15: error: use of undeclared identifier 'cb'
init_foreach(cb, NULL);
^
2 warnings and 4 errors generated.
/usr/local/bin/android-ndk-r13/build/core/build-binary.mk:497: recipe for target 'obj/local/x86/objs/su/su/daemon.o' failed
make: *** [obj/local/x86/objs/su/su/daemon.o] Error 1
root@iridonia:/usr/local/android/Superuser/Superuser#

Any help would be appreciated! Thanks!
[Android Software/Hacking General [Developers Only]] Lrs121:
Try using the exact version of ndk listed in the readme
[Android Software/Hacking General [Developers Only]] b8842dc0:
Thanks for the reply. I'm using android-ndk-r9b now. Getting different errors:

root@iridonia:/usr/local/android/Superuser/Superuser# ndk-build
[x86] Compile : su <= su.c
cc1: error: unrecognized command line option '-std=gnu11'
make: *** [obj/local/x86/objs/su/su/su.o] Error 1

Tried to get past that, by editing jni/Android.mk and changing "-std=gnu11" to "-std=gnu99". But this just resulted in another error:

root@iridonia:/usr/local/android/Superuser/Superuser# ndk-build
[x86] Compile : su <= su.c
jni/su/su.c:41:22: fatal error: sys/auxv.h: No such file or directory
compilation terminated.
make: *** [obj/local/x86/objs/su/su/su.o] Error 1

But I've got both /usr/include/sys/auxv.h and /usr/include/x86_64-linux-gnu/sys/auxv.h on my system. Not sure where to proceed from here. (By the way, I've tried with both the android-ndk-r9b-linux-x86.tar.bz2 package and android-ndk-r9b-linux-x86_64.tar.bz2. Getting the same error with both.

Thanks,

Bryan
[Android Software/Hacking General [Developers Only]] Lrs121:
That's about the extent of what I know. Perhaps phh is using a different version for his than what is listed or there are some issues with some flags that need to be set.
[Android Software/Hacking General [Developers Only]] b8842dc0:
Thanks for your help! Hopefully I'll get some ideas from Phh.
[Android Software/Hacking General [Developers Only]] rob_z11:
Any support for Dualboot patcher? I am running Note 7 port for Note4 using dual boot as the primary ROM, and nougat as secondary ROM. Trying to use this zip as dualboot patcher, and it is failing. Just wondering if dualboot patch is supported?
[Android Software/Hacking General [Developers Only]] DJRobBlaze:
Lmao,

What is chick-egg, face-palm mean

? Sent from ? DjRobBlaze's LG V20 (VS995) ? using Tapatalk ? ®
[Android Software/Hacking General [Developers Only]] Drops77:
Any chance we can get the ARISE Soundsytem Worthing with phh? I tried and when getting root it fail. Some people had success with setting it to permissive, but I liked to stay enforcing. I really want to stay with phh but only superSu is working .
[Android Software/Hacking General [Developers Only]] deadcatsrule:
Set it to permissive just to install then set back to enforcing
[Android Software/Hacking General [Developers Only]] craigacgomez:
https://github.com/phhusson/Superuser/issues/60
[Android Software/Hacking General [Developers Only]] androcraze:
It was a "which comes first, the chicken or the egg" dilemma; he couldn't install TWRP to get root, and I recommended installing Flashify to install TWRP, which of course needs root.

Thus the "burying my face in my palm".

A very dumb thing to say, but I laughed when I got called on it in a later post with "don't I need root to use Flashify?"
[Android Software/Hacking General [Developers Only]] DJRobBlaze:
I thought that's what it meant.

I laughed out loud, picturing a chicken egg in your hand and smacking it to your forehead. Lol

Doh! ...Egg on your face.

? Sent from ? DjRobBlaze's LG V20 (VS995) ? using Tapatalk ? ®
[Android Software/Hacking General [Developers Only]] Drops77:
Did not work.i uninstall old root, I dirty flash same rom on top of rom to clean up the viper files and settings. Twrp->kernel->pHh->boot home set to permissive. Boot twrp->installed zip. When back in os FX only work with seLinux set permissive. I did try manually installing driver via app with permissive and I get an I/o error.

Only way is to disable enforcing to get the app/FX working.

Did this because of new sound system released today, but have tried in the past And always same issue.

Using pure Nexus with Franco kernel.

I really wish I can just phh,zip Soundsytem and not having to set permissive just to use at every boot.