yashsingh1/xdaforums huggingface dataset:
[X Style (Pure) Q&A, Help & Troubleshooting] gigawatt:
so no problem, what wipe should I do before the flash of the rom, cache, dalvik, and data? Also, does the rooted deodexed use a different baseband or modem, and is there any advantage to deodexing in this day and time, I heard that most of these roms these days were actually not odexed anyway, just asking and learning
[X Style (Pure) Q&A, Help & Troubleshooting] orvon.freeman:
Do not do not use fastboot to wipe anything. Download the regular from the link above and the rooted and put on SD card. Flash recovery in fastboot use bootloader to get into recovery(otherwise phone will overwrite) wipe everything accept external in recovery and flash the ROM with February security patch

https://www.androidfilehost.com/fid=24459283995299100

Then after it flashes completely flash https://www.androidfilehost.com/fid=24459283995302251

Then let reboot. I did this with no issues.
[Samsung Galaxy Core.] Raj Dangi:
Thinks requierd

Apktool ( to decompile and recompile )

Ninepacth-editor (for editing 9.png)

1)Decompi framework-res.apk

2Go toframework-res/res/drawable-hdpi-v4

3) edit the color of following to which you want

A)scrubber_secondary_holo.9.png

B)scrubber_primary_holo.9.png

C)tw_progress_primary_holo_dark.png

E))tw_progress_primary_holo_light.png

4) recompile framework-res

5)push it in to System/framework

And enjoy
[Samsung Galaxy Core.] itsmedRb:
Provide the link to download Apktool pls
[Samsung Galaxy Core.] Raj Dangi:
http://ibotpeaches.github.io/Apktool/ Hit thanks if i help you
[Samsung Galaxy Core.] Raj Dangi:
You Can also Download My moded Framework for Samsung G355H

https://www.zipshare.com/download/eyJhcmNoaXZlSWQiOiIxNzIwMjE5Ny00MDcyLTQ5YmMtODI5Zi1lMTYxNjBmNWJiZTEifQ==
[K3 Note Q&A, Help & Troubleshooting] fumeline:
Hello I had used Lenovo K3 Note Manager by Princ3v to root my device. It had also installed TWRP recovery then.

Now to get OTA update to Android M, I flashed back STOCK recovery using the same tool.

Then I downloaded 1.65GB OTA update in 5 hours.

Now I tapped on reboot to get the update done but I got the message Update Failed. :confused:

Please tell me how can I get back to everything stock so that I could update it.

I have Indian version of it as I am from India.

Thanks a lot.:rolleyes:
[K3 Note Q&A, Help & Troubleshooting] darkslayer01:
you gotta install stock recovery and then try to update your phone
[K3 Note Q&A, Help & Troubleshooting] amrenov20:
can you tell me what exactly the logs says, when the update fails?? this info might help. plz try once again and do let me know
[K3 Note Q&A, Help & Troubleshooting] seking:
you need to install stock indian firmware starting with s205 using flash tool. After that put the downloaded update in the root of your internal storage. You rename this to update.zip if it is not so named. Boot into recovery and update.
[K3 Note Q&A, Help & Troubleshooting] amrenov20:
hello Seking,

can you please post a link to the indian firmware starting with s205, if its not much trouble to you...
[K3 Note Q&A, Help & Troubleshooting] seking:
https://cloud.mail.ru/public/6KND/LZ33UTgbA
[K3 Note Q&A, Help & Troubleshooting] sundeepnanda:
I faced the same issue so got it resolved by downloading original rom from the following link and following the instructions stated.

http://www.needrom.com/download/official-stock-s322/

I was able to install it thru CWM recovery but I guess TWRP shud also work
[K3 Note Q&A, Help & Troubleshooting] jonmyers:
If you use cuoco92s modded/rooted MM ROM for the k3 note, you can flash it directly from TWRP, just be sure to wipe before and after installation.
[K3 Note Q&A, Help & Troubleshooting] ombhangale:
Hey can i keep the update.zip in sd card nd run in lenovo recovery? Will it update or not! I tried but it gets start normally then on coming 49% message pop ups install failed.!! Help me plzz my phone is stucked on soft brick it only gets on when i plug usb cable to charge.!
[Android Q&A, Help & Troubleshooting] CipherSec:
Let's assume we have an Android device with:

Unlocked bootloader

Full Device Encryption

Password lockscreen

Of course, if it's rooted and with custom recovery, you can't lock the bootloader or you'll brick the device; so will Android security measures (FDE and password lock) still be able to prevent data exfiltration from physical possession of the device?
[Android Q&A, Help & Troubleshooting] Wakamatsu:
Say what?
[Android Q&A, Help & Troubleshooting] CipherSec:
I wish you can tell me I'm wrong. If this is wrong, it'll solve all of my concerns. I've read this exact info while rooting my Nexus.
[Honor 5X Questions & Answers] sabi95190:
Hello i want to ask if can i connect a dualshock 3 with otg ? without flashing the kernel ?
[Honor 5X Questions & Answers] Jammo2k5:
No, there isn't a way with OTG with no kernal. You can write you phones Mac address to the DS3 using a PC and DS3 pair tool and connect directly through Bluetooth.

I have flashed a kernal on my KIW-L21 and have not noticed any decrease in battery or performance and OTG works like it should.
[Honor 5X Questions & Answers] sabi95190:
ok so i will buy grand prime thanks !
[Honor 5X Questions & Answers] sabi95190:
Which is the best P8 Lite or Honor 5X ?
[Honor 5X Questions & Answers] cyrusalmighty:
Grand prime over this? I'm happy with this Honor phone. I get tired of Touchwiz fast.
[Honor 5X Questions & Answers] sabi95190:
So Honor 5X is best than Grand prime ? and it is laggy in emui ?
[Xperia Z5 General] Flummi.FFM:
Hello to everybody!

::::: A FEW WORDS BEFORE YOU ASK 100 TIMES THE SAME ;-P :::::

It has been told widely in these forums that permanent root on LB is impossible due to Verified Boot process implemented by Sony (and now by other vendors. Future for LB devices seems to be "Live root" approach). What we would like to achieve is temporary root privileges using some exploit in order to backup the TA partion, for warranty purposes and for complete stock DRM restore.

THIS ARTICLE IS A WONDERFUL ENTRY POINT IF YOU WANT MORE INFORMATION[/B]

Guys, i am very proud that we could win user zxz0O0 for trying out abilities to use the CVE-2015-1805 security vulnerability to get temporary privileges for i. e. backup of TA Partition of our Xperia Z5/Z5C/Z5P.....

For those who want to know a little bit more of what about we are discussing/ testing here:

Android Security Advisory — 2016-03-18: https://source.android.com/security/advisory/2016-03-18.html

CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1805

German article from t3n.de: http://t3n.de/news/google-android-sicherheitsluecke-691418/

CURRENT STATUS:

- ZXZ0O0 HAS FINISHED HIS WORK +++ Release for Z5/ Z5C/ Z5P coming soon!

You will need to flash build 32.0.A.6.200 kernel or lower!

LET US THANK:

- ZXZ0O0 FOR HIS AMAZING EFFORTS AND HIS PASSION INTO THIS

- IDLER1984 FOR HIS TESTCODE

- FOR TESTING ZXZ0O0's BUILDS: NINESTARKOKO, RIMMEDA, NILEZON AND ALL OTHERS IF I FORGOT SOMEONE

Greets and Cheers, Your Flummi.FFM
[Xperia Z5 General] ali112:
Well, we got Linux Kernel 3.10, which is affected by this exploit. This could make root possible, but we have to know how the root app is called ?
[Xperia Z5 General] Flummi.FFM:
i will look as soon as i have time here ;)
[Xperia Z5 General] daveyp187:
Lurking
[Xperia Z5 General] frostmore:
old news mate.

http://xdaforums.com/xperia-z5/general/root-using-vulnerabilities-snapdragon-t3338173

another forummer already pinted this out.

unless you know how to roll back old linux kernel and over come SElinux
[Xperia Z5 General] Tommy-Geenexus:
Sony released MM firmware with this CVE already being fixed.
[Xperia Z5 General] Flummi.FFM:
In the other thread they Talk about CVE-2016-0819 and CVE-2016-0805 which affects specially snapdragon soc's......

The articles which i found are talking about CVE-2015-1805......

I dont think that we are talking about the same. CVE-2015-1805 affects possibly every Kernel Version 3.4, 3.10 and 3.14.....

If Sony already has fixed the 2015-1805 even while Google itself "forgot", could you tell me where i can find Information about a fix By Sony?
[Xperia Z5 General] Tommy-Geenexus:
Simple: I just tried to patch the kernel, and found it has already included the fix.

The patch exists since mid-2015, it's just that devices were recently exploitet using this regression, and Google reacted.
[Xperia Z5 General] Flummi.FFM:
Thx then for your reply......
[Xperia Z5 General] Flummi.FFM:
I found out that in the source of Release 32.0.a.4.11 the issue IS NOT fixed.......

Maybe a Base for a root solution after downgrade?
[Xperia Z5 General] uripiruli:
Hi man!!

How did you see it?

I asked about it. Maybe zxz0o0 a dev of z3 will help us. I hope he see it

Crossfingers

Enviado desde mi E6653 mediante Tapatalk
[Xperia Z5 General] Flummi.FFM:
I downloaded the source Code of the 32.0.a.4.11 build and compared the pipe.c File with the fix commit and the fixed version in the 32.1.a.1.163 build.

The result was that the older Version is Not fixed.

I also thought one hour ago of asking zxz000 Team.....

If we can win them it would be great!!!
[Xperia Z5 General] Flummi.FFM:
I asked few minutes ago in two z3 threads for help.....

I hope so much that someone will be able to make something finally.....
[Xperia Z5 General] anno2070:
How about dm-verity? How can you pass this?
[Xperia Z5 General] zxz0O0:
You can probably get "root" using this exploit but it will only be temporarily and you can't write /system because of dm-verity. So the only usecase I see is to backup TA partition.
[Xperia Z5 General] Flummi.FFM:
Unfortunally i dont have the knowledge to make something by myself.....

In my opinion ta Backup is more than nothing for the Moment.....

Maybe if all of you professionals like Tobias.waldvogel and monx and you of the z3 community are working and thinking together about it then it will happen one Day?

You see i spend all my free time on searching for abilities and holes to use......

But due to my very basically knowledge of programming i am not able to implement something on my own.

Edit: my idea was to achieve root By this hole, then get a prerooted and DM verity disabled kernel before Reboot..... Isnt that possible?
[Xperia Z5 General] Wolfbreak:
You cant flash any other Kernel beside Sony Original Kernel on Locked Bootloader and with dm-verity enabled its nothing you can do to root LB Z5. The only possible way is to unlock your Bootloader but with locked Bootloader you have no Chance as you cant flash any modified Kernel. We only archieved Root on Z3 because it has dm-verity disabled in Original Sony Kernel.
[Xperia Z5 General] uripiruli:
Thanks for your answer.

If we rooted our Phone with a temporaly root with this xploit, then we do ta backup. Finally unlock de bootloader, root with the actually tools that we have... And then restore our ta backup with our Sony features. Is this possible??? Or i am dreamming????[emoji16]

Enviado desde mi E6653 mediante Tapatalk
[Xperia Z5 General] juanpirulo:
you cant restore your ta backup on unlocked bootloader. So you are in the start point. Unless you get something to disable dm-verity you can not get root on lock bootloader
[Xperia Z5 General] FakeSmile:
You can "restore" drm keys on unlocked bootloader now. I dont get it why do you want to backup them so much? You can have all drm features working on UB.
[Xperia Z5 General] ninestarkoko:
Yes, it has been told widely in these forums that permanent root on LB is impossible due to Verified Boot process implemented by Sony (and now by other vendors. Future for LB devices seems to be "Live root" approach). What we would like to achieve is temporary root priviledges using some exploit in order to backup the TA partion, for warranty purposes and for complete stock DRM restore.

There's also a bounty that would be fulfilled by this achievement

In theory it should work, but untill we have a working exploit noone can say for certain
[Xperia Z5 General] zippy01:
Because they are not completely restored and with that restore you send your phone off on a warranty claim you may have to pay. Backing them up properly you have the chance to restore them completely if you change your mind
[Xperia Z5 General] uripiruli:
I can't explain better than you bro!! Thanx a lot.

Enviado desde mi E6653 mediante Tapatalk

---------- Post added at 11:12 PM ---------- Previous post was at 10:55 PM ----------

And this xploit dont work for our thinkings????

Enviado desde mi E6653 mediante Tapatalk
[Xperia Z5 General] ninestarkoko:
If earlier 2015 firmwares aren't patched against this exploit, then there should be good news from the developer of Pingpongroot. I got in contact with him in another thread and he left this contribution to the subject

http://xdaforums.com/z5-compact/gen...oot-locked-t3242226/post66024147#post66024147
[Xperia Z5 General] Flummi.FFM:
Very nice to see.....

The question is if somebody is able to use it for our Device....

Or Maybe someone is at least able to give a "guide" what to do with the Code?
[Xperia Z5 General] Flummi.FFM:
Is there no Chance to inject a "deamon" somewhere in a modified Kernel that gives the hashes to the verity Check on Boot that verity Check needs to Start?

[MENTION=357342]tobias.waldvogel[/MENTION] for example was successful for example in implementing a solution what "emulates" the existence of drm keys in ta partition even if they are wiped after unlocking a Bootloader.....

My idea is to follow the same way. Dont the verity Check just need to get "what it wants" to let Boot the modified System Image?

I JUST CANT STOP TO THINK ABOUT THE WHOLE ROOT THING ON A LOUSY EASTER FRIDAY ;) :P
[Xperia Z5 General] uripiruli:
Someone knows who could help us???
[Xperia Z5 General] ninestarkoko:
Look here the technical aspects https://source.android.com/security/verifiedboot/verified-boot.html

and the article here about T-Mobile Galaxy S7 Locked bootloader with dm-verity, with a possble solution explained from the developer jcadduono

http://www.xda-developers.com/galaxy-s7-bootloader-lock-explained-you-might-not-get-aosp-after-all/

Locked Bootloader will simply neither flash (obviously) nor load any modded not-OEM-signed kernel and /system partition. This is a real problem for devices with non-unlockable bootloaders (like T-mobile GS7) but fortunately Sony has a different approach.

Now the only desirable thing for us is TA partition backup. We don't need anything else (and can't have, as no "live root" solution exists yet for any device).

The code provided by idler1984 would need to be modified by someone that knows what to do and then compiled.

Thank You for rising the interest on this subject during these Easter "holidays".
[Xperia Z5 General] frostmore:
backing up TA for now is better than nothing for z5.

at the very least,there is a way to back up and restore TA for warranty purposes.
[Xperia Z5 General] uripiruli:
Not only for warranty.... If we could restore ta partition we could have custom roms like cm, aosp, etc... Within lost Sony features and miracast, noise cancelling etc... Isnt it??

Enviado desde mi E6653 mediante Tapatalk
[Xperia Z5 General] Elfeno:
If we can backup ta we can root with locked bootloader no ? I mean , you live root , backup ta , unlock ,flash custom kernel to gain root , flash stock kernel with zip file, without reboot flash something that takes out dm verity like on z3 and Relock + ta restore. I am right ?
[Xperia Z5 General] juanpirulo:
No you arent, if you can get temporary root you Will be able to get ta backup in order to get drm Keys back when you locked again your bootloader. You cant get a custom rom on locked bootloader with dm verity.

Enviado desde mi C6903 mediante Tapatalk
[Xperia Z5 General] ninestarkoko:
Moderation needed

Not to be harsh, but please STOP repeating and asking over and over the same things, things that have been said by developers for months in various threads and can be found just one page back in this thread. Please, focus on the topic CVE-2015-1805 & Xperia Z5

(and avoid answering those questions)

Happy Easter!
[Xperia Z5 General] zxz0O0:
Looks like 32.0.A.6.200 is also not fixed. I compiled some binary based on idler1984's poc. Can someone test it on 32.0.A.6.200 stock kernel?

The expected outcome is a crash. If that happens, upload the file /proc/last_kmsg.

Note this is not root, just testing if the exploit works. JOP chain will also be hard to implement since I don't have any 64bit device myself.

Unzip file
adb push test /data/local/tmp/test
adb shell
chmod 777 /data/local/tmp/test
/data/local/tmp/test
[Xperia Z5 General] Flummi.FFM:
I will test it as soon as possible because i am not at home at the Moment.

I thought it is already fixed as the patch commit mentioned in the CVE was already pasted into the pipe.c File of the 32.1.a.1.163 build.

Anyway thank you very much! If it will not work i will upload the 32.0.a.4.11 build for those who are willing to flash it to be able to test.......
[Xperia Z5 General] zippy01:
Sorry realised was for .200 build please delete post
[Xperia Z5 General] zxz0O0:
It's not patched in the sources. Though Sony kernel sources are not always updated correctly so I checked the kernel directly. Seems .200 is not patched.
[Xperia Z5 General] Flummi.FFM:
? same mistake from my side.....

That means we need someone who has actually the .200 build on his Device......

Before tuesday i dont have any ability to downgrade for testings....
[Xperia Z5 General] zippy01:
It's catch22 without nandroid I'd be hesitant to downgrade but without this we wouldn't be able to test root possibilities lol I'll have a think about decent backup opportunities tonight
[Xperia Z5 General] ninestarkoko:
No problem, running LP .200 completely stock here.

Thank you for the test code provided

Tested code on a Z5 compact:

/data/local/tmp/test
[+] Changing fd limit from 1024 to 4096
[+] Changing process priority to highest
[+] Getting pipes
[+] Allocating memory
[+] Start map/unmap thread
[+] Start write thread
[+] Spraying kernel heap
[+] Start read thread
[+] Done

Code executed correctly (?) the first time and could not find last_kmsg in /proc. I waited some minutes but after "Done" the executable seemed not to close and didn't release the adb shell.

I managed to execute the file again in the same command window (Windows adb) and now the outcome was different: phone crashing and rebooting. Unfortunatelyi still cannot find last_kmsg in /proc after reboot (used Es file explorer to navigate)

shell@E5823:/ $ /data/local/tmp/test
/data/local/tmp/test
[+] Changing fd limit from 1024 to 4096
[+] Changing process priority to highest
[+] Getting pipes
[+] Allocating memory
[+] Start map/unmap thread
[+] Start write thread
[+] Spraying kernel heap
[+] Start read thread
[Xperia Z5 General] zxz0O0:
Well I compiled it for Z5, not Z5C so that's why it's not working.

It should actually crash after "[+] Done". So first time exploit was succesful (but didn't crash because I compiled for Z5) and second time exploit was not succesful (unwanted crash). Anyway that's good news, thanks for testing :)

Could you upload Z5C kernel.sin so I can recompile the file? This way we can get some more useful information from /proc/last_kmsg.

Next task would be to create a JOP chain because 64bit devices have PXN protection.
[Xperia Z5 General] ninestarkoko:
Didn't remember we are in Z5 forums here!

I am downloading now my country's Z5C .200 firmware (1,9 gb), so it will take some minutes. Sorry but i don't have any tft file to extract kernel.sin now on the harddisk.

In the mean time, if it can help, here http://xdaforums.com/z5-compact/orig-development/kernel-zombie-t3224735 is Zombie kernel for Z5C and also github sources (they shold be updated to .200 revision)

Do you have human-understandable terms to describe what is a JOP chain? Searched but could only find a root guide from blackhat.c0m about exploiting CVE-2015-3636

EDIT: kernel.sin uploaded here

https://mega.nz/#!aNFUGArS!6JsjyOOMGBVemzAHgBhJ_BUpWHem8dLQuAiXm0Qe8_Q

and here http://www62.zippyshare.com/v/b2S7uYnN/file.html
[Xperia Z5 General] zippy01:
So what's the difference between 200 3.10.49 to 163 3.10.84 security patch February will that what you posted definitely not work?
[Xperia Z5 General] Flummi.FFM:
The difference is that in the 163 build there is included one commit what affects a file called pipe.c

Here you have a link to the original commit:

https://github.com/torvalds/linux/commit/637b58c2887e5e57850865839cc75f59184b23d1

In the 200 build it is not included so we have a huge security vulnerability.

You will find more Information about it in the OP......
[Xperia Z5 General] zippy01:
Thanks I actually posted the same as your op a week ago in a different thread. But thanks for the info it definitely helps ?? I'm looking at backup options so I can test any probable vunribilities.
[Xperia Z5 General] pattmyn:
I'm on deck to help with my Z5P. I don't have much better to do since a few of my contracts are on hold and I don't mind nuking my phone a few times if it means we can finally get root on LB.
[Xperia Z5 General] zxz0O0:
For 32bit devices we can just make the kernel return to userspace, where we allocated our own code and we're done. PXN protection on 64bit prevents kernel from executing code in userspace. Our only option is ROP (return oriented programming) or JOP (jump oriented programming). For that we need to find multiple small code blocks in the kernel and then make some kind of chain where we return / jump from one to the next.

Attached a test version for Z5C, please upload /proc/last_kmsg if crash occurs. Somewhere at the end of this file should be this line

Unable to handle kernel NULL pointer dereference at virtual address 00000004
[Xperia Z5 General] ninestarkoko:
Thank you for the explanation.

Tested the new code, phone crashes (red flashing light) and reboots after "Start read thread"

Still no last_kmsg file in /proc (just kmsg which, however, seems restricted).

If it is a kernel crash, last_kmsg should be created...shouldn't it? The phone's led flashes red light and the device reboots completely (Sony logo + android animation)
[Xperia Z5 General] langeveld024:
These warranty rules may apply in some specific countries but at least in European countries Unlocking bootloader and losing drm keys do not affect warranty.

The only case in which Unlocking the bootloader could affect warranty is (for example) if the device won't boot because of modifications you have made (which u can fix yourself, since u made them too..)

Hardware failure (for example) broken screen, camera module etc, is all completely covered under warranty on unlocked bootloader.

You can download the warranty disclaimer for your country if it didn't came with the device in the box and read it up. You'll be happy I guess :)
[Xperia Z5 General] zippy01:
Hence saying "may" have to pay. It's is Sony's discretion to pay out on warranty usually they will but I'd not rather take the risk. On that note even if I wanted to I couldn't unlock my bootloader. People pay for the features and I wouldn't unlock even if I could. Anyway please stay on topic this is about vulnerability and potential root for locked bootloader nothing to do with unlocked bootloader and the post you quoted was from 4 days ago
[Xperia Z5 General] zxz0O0:
Here is a new test file. Please post the ouput. After running you should reboot your phone manually otherwise it may randomly crash.
[Xperia Z5 General] Flummi.FFM:
One question. How can i get the last_kmsg? Via adb pull command?

The correct command should be then

adb pull /proc/last_kmsg last_kmsg

right?
[Xperia Z5 General] zippy01:
You would pull to a location. So would it not be

adb pull /proc/last_kmsg /Desktop/

Correct me if I'm wrong
[Xperia Z5 General] Flummi.FFM:
You are almost right. I searched for the correct Syntax.

The correct command is:

adb pull /proc/last_kmsg C:/Users/[YourUsername]/Desktop

I just worry if the command will work without superuser rights..... But i will see tomorrow.

Sometimes its hard to remember when you need some commands one time per year.... ;) please excuse me

Edit: Sometimes i feel like a total noob so please be patient with me
[Xperia Z5 General] zippy01:
Sorry should have said I use Linux