yashsingh1/xdaforums huggingface dataset:
[Sprint Samsung Galaxy Note5] Sleepycloud:
I have one. It doesnt work because a PIT file will only reset the factory image partitions. When there are additional partitions, it does not touch them. I have one extended partition after boot. Everything gets rearranged under /sys/dev/block/8:0 have you ever heard of that? Me neither. Lol I need to disect this and remove the script after a fresh flash before the first boot. Something tells me that it would be easier to deal with then. Ill post some pics from my computer here in a bit. I dont have the option on my phone
[Sprint Samsung Galaxy Note5] Sleepycloud:
Here are some pics of the new extended partition and the logical partitions within.
[Sprint Samsung Galaxy Note5] MrMike2182:
I've seen some pretty crazy partition set ups the HTC Desire for instance has over 20 partitions and all of them have close to 200MB of free space on them that you can't even use! Talk about a waste of space lol.. But /sys/dev/block/8:0?!?! The fuuu... What kind of partition is that?!

Damn, your phones using almost all the ram/memory that you have.. Are you running a lot of apps or something else that's memory intensive?
[Sprint Samsung Galaxy Note5] Sleepycloud:
So now the million dollar question is..... What is it gonna take to remove this b.s. from my phone. Removing the folders does not work. They get reinstalled upon every boot. I need to find the script(s) and where they are hidden, and delete them, then remove the partitions form the logical folder. I am tempted to just wipe the logical partition it its entirety then create a whole new partition table based on my unrooted Note 5. However, I am going to wait until I get some solid feedback from one of y'all. Who has an idea of what I need to do here. Repartitioning with a PIT file does not work. IT does not touch these extra partitions. I think they are labeled, sdb, sdc, and sdd.
[Sprint Samsung Galaxy Note5] Sleepycloud:
I'm just gonna go ahead and let the world know who the piece of crap is. Here... go take a look for yourself. Download the "stock" tar and extract it, then extract the .tar itself. You'll find the extra files there. It contains a param.bin file, a carrier.img, and a modified PIT file that will give you the crap on my phone. If I could be my hands on this dude, I would choke him until he was purple. This has been a major pain in my ass for over 3 months now. My accounts were hacked, all of them, files were deleted, and I had no privacy what so ever. Here... This is where it came from. :D http://xdaforums.com/note5/general/project-noble-firmware-pit-file-galaxy-t3179529
[Sprint Samsung Galaxy Note5] MrMike2182:
Deleting them is not going to work no matter which way you remove them they'll come right back after a reboot and the only way to stop that from happening is to flash a custom kernel/boot that's got write protection off. If you don't have that they just keep coming back no matter what.. All the apps are usually always in these 2 places /system/apps and /system/priv-apps

---------- Post added at 11:00 AM ---------- Previous post was at 10:55 AM ----------

I'd report this to one of the moderators if I was you so they can check it out and remove it if it's harmful to people's devices I don't think xda would be happy hosting that type of ****!
[Sprint Samsung Galaxy Note5] Sleepycloud:
I hava already tried that. These are add on scripts. They work on any kernel. I have to delete the partions themselves but I'm not exactly sure which ones or how to do it without bricking my phone. I'm gonna move slow on this one until I am sure that II have the right solution. I'm certain it is the sda, sdb, sdc, and sdd partitions that need to be deleted. First I need to know if this partition table is still valid for Marshmallow. http://xdaforums.com/note5/general/sprint-galaxy-note-5-sm-n920p-partition-t3190326 Once I know that, I can proceed. Is this PIT still the same in marshmallow?
[Sprint Samsung Galaxy Note5] MrMike2182:
Yeah that PIT is fine but if I were you I'd try to flash a different kernel because I had the same problems with apps returning after a reboot and the only way to stop that from happening again was to flash the custom kernel. That stopped them from coming back. <----This was on an HTC device so maybe Samsung is different?
[Sprint Samsung Galaxy Note5] Sleepycloud:
This b.s. has my ADB disabled somehow. Even when I open the IOT Menu and switch from MTP to MTP+ADB it still does not work. It does work upon a fresh flash if I let the stock recovery update the system image then immediately go back into download mode before it boots up. After that, I have no ADB capabilities. Would that be a build.prop issue?
[Sprint Samsung Galaxy Note5] djhulk2:
So was my advice useless oo?
[Sprint Samsung Galaxy Note5] Sleepycloud:
No. It was pretty good, but I already have a good Note 5. I'm trying to learn more about Android bro. I wanna fix this one, not replace it. Give me some more solid ideas!!! I'm open to suggestion. Thank you.
[Sprint Samsung Galaxy Note5] Sleepycloud:
I just went back and read your comment again. I have tried the EFS erase. There are 6 extra partitions that do not get touched on ODIN or Smart Switch. I'll post a pic now here is a second.
[Sprint Samsung Galaxy Note5] Sleepycloud:
You can clearly see that I have 6 extra partitions here. I know a lot about Android, but I do not know about this. It is brand new territory for me. I need some guidance here. If you can outline the removal procedure, or give me a solid link so that I can educate myself here, I would be grateful. Thank you.
[Sprint Samsung Galaxy Note5] droseofc:
Have you tried contacting the user who posted this? I've been keeping up on this topic praying I hadnt flashed the same thing, which I havent, but if anyone had flashed anything from that user should they be concerned? Not helpful to your situation but if what you say is certain something definitely needs done and done good so that it does not happen again. Like death row or something :) but seriously even with the general warning this has to be breaking laws with what was involved. How does that work?
[Sprint Samsung Galaxy Note5] djhulk2:
I'm also learning oo. Never seen what you posted... I thought that when you erase the nand it's like formating the phone erasing everything and Odin flash installs the operating system
[Sprint Samsung Galaxy Note5] Sleepycloud:
Yeah, that is how it is supposed to work. Not this hack. It stays no matter what I do. Normally ODIN fixes everything, so does SmartSwith, but not this. This is something crazy that will have to be removed manually. I'm not getting any help either. Lol I can't find any good information on removing partitions either. Sucks. I don't wanna pay a $200 co-pay for a new phone.
[Sprint Samsung Galaxy Note5] Sleepycloud:
Okay. I reported the bogus .tar and I got an email back saying that it has been resolved. They took down the download links. I'm gonna go one step further. http://samfirm.net/ is owned by that same idiot. Don't use any firmware from that site. You will get hacked. So...Now what? Is there anybody who can guide me on removing these partitions?
[Sprint Samsung Galaxy Note5] MrMike2182:
Just a thought but have you tried using adb/fastboot commands to try and delete it? You know how you can fastboot erase boot and such? Maybe try fastboot erase partition-name
[Sprint Samsung Galaxy Note5] Sleepycloud:
Yes I do. I have about $200 worth of paid apps. Mostly all tools that I've collected and used over the last 6 years. I also have ADB set up and ready to go. I am familiar with basic commands, but not anything to do with removing or resizing partitions. So... what can I do with the emulator?
[Sprint Samsung Galaxy Note5] MrMike2182:
I rephrased my other question in the other post above.
[Sprint Samsung Galaxy Note5] Sleepycloud:
I am very familiar with fastboot commands! I learned a bunch of neat stuff when I was using the HTC M8. I didn't know fastboot would work on Samsung devices. I thought that was an HTC thing. If so, how do I push the fastboot commands? In recovery?
[Sprint Samsung Galaxy Note5] MrMike2182:
Fastboot only works when the phone is in bootloader mode and I have yet to find a way to get into that on Samsung... But.. Using emulator while on the device why don't you use su and then ls to list directories and such and then cd to the particular partition and then use rm -r "whatever folders and files you find" that way it's just an empty partition that's not able to cause any problems.
[Sprint Samsung Galaxy Note5] Sleepycloud:
Here is where the problems is . I can pull a list of partitions on the emulator and ADB, but I can't pull anything beyond that. I don't know the commands to do so and I can't find any relevant information. Those partitions are not mounted because they are only used during boot, so I should be able to modify them.... If I knew the proper commands to list those 6 folders. Once I am able to do that, I Plan to delete the contents and leave them unmounted in hopes that a nand erase and repartition will overwrite and set everything back to normal.
[Sprint Samsung Galaxy Note5] MrMike2182:
That's where the "cd" command comes into play say for instance I want to delete the folder called apps from my system I would do cd system/etc and enter then when you do ls you'll see the folder called apps and remove it or you can just do rm -r system/etc/apps but with your issue only being used at boot maybe you need to mount the partitions first?
[Sprint Samsung Galaxy Note5] Sleepycloud:
I know those commands. I don't know the commands to pull up partitions. I don't think they are going to be a cd command. something more like this, "cat /proc/partitions/sdc" Maybe? I don't know. I've tried a bunch of random stuff. Nothing successful yet.
[Sprint Samsung Galaxy Note5] MrMike2182:
Everything and anything you can try at this point is worth a shot lol.
[Sprint Samsung Galaxy Note5] droseofc:
Not sure if this is even a little bit close to helpful or part of the same issue but would using twrp features of formatting or repairing or changing the file system be of any use? Or software such as easeus partition master or paragon partition manager? Or wondershare?

---------- Post added at 09:30 PM ---------- Previous post was at 09:16 PM ----------

Or a long shot but reaching out to the user believed to posting this and requesting how to fix this? The worst thing that could happen is denial or no reply but if your steps are detailed down to without a doubt them being the cause of this maybe theyd produce a fix vs other scenarios that could follow if not. If it were me I would be sure to prove without a doubt the source of the bug, research any legal information related to any information and data the "hack" was able to collect and inform the accused user what the next steps could be that were gathered from legal research and id bet, with the idea the research was thorough and existence of laws for this, that the user would have no choice but to fix the problem or face whatever repercussions you have found. Id imagine itd be easier to find and provide supportive evidence then coming up with a fix on your own. Youd think the accused user would be anything but silent with such allegations.
[Sprint Samsung Galaxy Note5] Sleepycloud:
I have looked at the PIT file. It is legit. The included carrier.img and param.bin files are giving me problems. I've looked at them with a hex editor, but I am running into problems decrypting the information into a readable format. He locked them with a password. Lol I am 100% certain that the said source a few posts back is the culprit. If someone was providing a stock .tar image, why would they include extra files? I haven't contacted him. On the upside, I have successfully removed two of the 6 extra partitions. The last four are real problems for me. ADB and the shell emulator in TWRP 3.0.0-1 are giving me unusual responses. One of them says "Unknown MTP" I have disablesd most everything though, by removing the malicious add-on scripts that work with legit .apk's. However, when I reboot, they get reinstalled every time. Can someone tell me how to remove /sys/block/sda and (sdb, sdc, and sdd) Those are the remaining partitions that I need to remove. I can post screenshots or provide logs if anyonne wants to give me some pointers and tips. If not, that's fine. I will eventually figure it out. That said, I do have a pretty good knowledge of the normal Android OS. I am going to build a ROM for our Note 5 pretty soon. I have made 4 or 5 pretty decent Jelly Bean ROM's for the HTC Evo 4G back when that was the cool thing, but it has been awhile. I'm still pretty good at it though. Some of my contributions to the Android community can be seen here. http://android.aokforums.com/roms-vf3.html
[Sprint Samsung Galaxy Note5] ChevTek:
Hello all I am a VERY novice tinkerer. I cannot post my screen shots as I dont have enough posts yet, but here goes. I have root and MOAR rom. I stumbled across Sleepyclouds post and began looking into my phone and I believe I am a victim as well. I know that their is a disclaimer at the beginning of each app, rom, kernel, add-on or theme. I just "assumed" that if it was posted here that it would be safe to install and not malicious, WRONG!

so its not that I flashed something improperly, its that the software was malicious that I flashed. Please be nice as I am only trying to supply info to get to the bottom of this, so here is what I know.

I use root explorer and upon looking in my "storage" folder I as did Sleepycloud have several additional partitions noted.

Also as was mentioned if these are deleted, again I use root explorer, these partitions are reinstalled at boot.

I ran the command cat /proc/partitions, making sure to put the space between cat and / and have the aforementioned sdb, sdc, and sdd partitions.

One other thing noted as Sleepycloud confirmed my Google drive appears to have been hacked I found a file named Manh_IT S6 rom port stored on my drive. I have never downloaded anything from this individual, and almost NEVER use the drive but it appears he is on my Google drive storing things. I just deleted the folder and as of 2 hrs. later it has not reappeared.

Thanks for every ones input and help, in the future how could one know if an app, rom, kernel, add-on or theme is malicious??

Would it need to be decompiled to look for password protected things?

Thanks
[Sprint Samsung Galaxy Note5] Sleepycloud:
I'm posting these screenshots for the new guy because he doesn't have enough posts yet. He has the same problem as I do, and he found a file in his google drive by the same guy that I spoke of in the link. Mahn_IT (a "pen name") is pretty swift with his hacks... to say the least, and he is VERY skilled. Hey [MENTION=5177721]ChevTek[/MENTION] can you post a screenshot of the file you found in your Google drive with the Mahn_IT signature? That would be very nice if you can do that.
[Sprint Samsung Galaxy Note5] Sleepycloud:
If there are any doubters here are some more pics of files that you might also find in your google drive. You better check! This guy is busy!
[Sprint Samsung Galaxy Note5] droseofc:
Not to sound as if I assumed you were possibly thinking I was doubting you in your post, I just wanted to clarify that I was not doubting you, and intended to be helpful with ideas that I would seek out if in the situation, not to say you may have already done it before anything else who knows. Im just, like, glued to this to see the outcome as it is interesting and infuriating. Some of the images posted seem familiar to me as I have seen myself such as the additional partitions but not sure how or what app I used or how to recreate or if its even related. What would be some surebet steps and things to look for if somebody wanted to verify if they had this? I just looked on root explorer and got into the sys/block folder and figured I had better ask somebody before I did a beenverified search as I realize Im not sure whats supposed to be or not be but if not be is there I may not be on a not so friendly hunt down of who what where and why it came from.
[Sprint Samsung Galaxy Note5] Sleepycloud:
Find your .dropbox file (it is there even if you don't have dropbox installed) and pull all the logs. Then extract them. Go through it and look for unfamiliar code and google it. You'll find a bunch of it listed on GitHub. You'll find all sorts of proprietary code from these "recognized developers" here on XDA. Man... a bunch of these dudes are nothing more than hackers setting up the stage to take over your device and use whatever they can get for profit. I pulled all my logs and posted the results. Next thing I know, my computer was wiped of all of those logs. Lol I know a few things, and I'm going to broadcast whatever bull**** I come across. Mahn_IT is a "pen name" for another well recognized developer. If you are paying attention and reading my posts, you'll know exactly who it is. They will always set up multiple accounts so if one gets burned out, they have a few more to work with. One of my old associates has more than six accounts here. I'm not gonna get into that because I don't like the nuisance involved when you piss one of them off. As of now, the guy behind all of my problems is sending underlying threats about being a supporter of the Islamic State. (Which is fine. Go **** with somebody else's phone... I could care less what you support.) This dude obviously doesn't support integrity or honor. Be careful what you flash. Very few of these guys are honorable developers. I"m learned the hard way to extract everything and look at the code before I flash. That is the only way to ensure that you won't crap out your device. Once you get some of this stuff it is virtually impossible to get rid out without a paying for a Jtag service.
[Sprint Samsung Galaxy Note5] droseofc:
Im about to check now. I just dont understand how this type of thing is even considered to be a decent idea nowadays with the audience for this "hobby" has grown, Id imagine, and where it may have been something as easy as picking on the computer nerds in school everyday only because nobodys given a reason not to, I can only hope it is very well displayed that uploading malicious files in the disguise of being something useful is not something anyone would even consider doing.

Youd think the obvious risk of it being tracked back to whoever uploaded it would be enough or the fact that the users on the site are above average in the technical and informational categories vs average joe whos identity gets stolen. Maybe its just my beliefs or my attitude or mindset but I am absolutely dumbfounded as to why in the world anybody would upload a file to hack someones stuff all the while having it wide open as to where and who its going to.

I deff am not "Taken" this to a "Taken" level ;) but, me, I will find you, resources nowadays will likely pinpoint where someone was on a saturday at 8am and what they ate for breakfast. Besides vigilante style, are there laws governing this? Theres got to be some kind of something that was created way back when internet connected countries and people together that once were not.

Apologies for the length, I just cant believe this is really something going on like ya dame dummies what made it sound like a good idea to so comfortably try to hack me or anybody on here. I would have to say, from my viewpoint, youd be safer robbing a bank, I have heard most first time offenders do not get caught and that same first time getaway does not exist when it comes to the me bank or the me anything. Hopefully the reason why agent 47 hasnt been sent to eliminate is because there are no laws or repercussions for this type of thing which is the reason why partitions have been top on the list rather then pitchforks and bounties. Looking now for anything you mentioned and hope the rest of my night is NOT going to be detective psycho tracking down scumbag and anything close to scumbag possible or reading countless laws related as it really is something I dread even thinking of having to do.
[Sprint Samsung Galaxy Note5] ChevTek:
Please forgive me if I am making the water muddy, just trying to help if I can. I recently upgraded to the Note 5 Sprint, and just for investigative purposes I looked at my rooted retired Note 3 and it is infected as well.

I am not sure of the ramifications of this bug or if there is any at this point.

My concern is that of my identity and financial security.

Also is their any way for this infection to cross over to a Windows based computer where several storage and email accounts have been compromised?

I am willing to send my Note 3 to someone for examination purposes if they want to PM me we can iron out the details.

Again I am very novice (auto-mechanic) but willing to help to get to the bottom of this if I can.

Thanks for your knowledge, it is mind-boggling!
[Sprint Samsung Galaxy Note5] Sleepycloud:
Yeah, if you log into that computer with the same emails, and you used it to flash your phones with then id say yeah, there is a good possibility that it could be compromised. When i wiped mine with gparted, i found an embedded copy of VirtualBox on my hard drive, and it was connected to somebody's computer. It took me a minute to figure out how to break the connection so i could fully wipe the drive and reinstall Windows 10. Since then, i have not had any problems. Ive been checking by booting gparted and having a look. Im assuming it came from the same jackass that is f**king with everybody's phones since it was linux based, just like the sda, sdb, sdc, and sdd partitions. My computer doesnt have a mind of its own any more. Im still working on remiving those four partitions. I havent figured it out yet, but im close. I can read the info in the partitions using Ubuntu. But i dont know how to structure the commands to get rid of them yet. I am close though. Shouldnt be much longer and i will share detailed instructions for the removal procedure.
[Sprint Samsung Galaxy Note5] Sleepycloud:
I've done all of that. Even when I use the MOAR ROM those extra USB partitions are present. I finally got rid of it by flashing stock image, letting it update in recovery, then booting back into download mode and flashing TWRP before the phone boots and sets all the files into place. What I did once I got into recovery and flashed SuperSU 2.71 in systemless mode was to go into /dev/block/platform and erase 15400000.usb which contains a folder with this file; 1540000.dwc3 I don't know what exactly it is but I know it does not belong. It adds about 6 extra USB storage folders that I can not access. It is a Knox hack, via MDM servers. So now I have gotten rid of the hack, but it is only a band-aid approach. I deleted all knox files and samsung pay files. They are perfect for hacks because they have full permissions and MDM capabilities. As you know, once we root, those are broke forever. So they are perfect for manipulations and exploits because we arent' expecting anything from them and never open them. I also deleted universalMDMclient.apk and a few other enterprise related apps just to be sure. Now my device is super fast again, and the granularity issues are cleared up because the extra RAM is not being used for those bull**it exploits that got installed when I flashed the bogus "stock" firmware presented by Mahn_IT. Al this said, the problem still exists. Nothing makes it go away. If I flash a new kernel, new image, new CSC and nand erase and repartition, it is still present. ADB picks up something but returns an error saying "Unknown MTP" Not even SmartSwitch fixes it. This is some really skilled code. Somebody help me figure this out please. I want to enjoy my rooted phone again. I"m not returning it or making a claim. I'm learning from this mess, and I'm going to eventually post the real fix once I uncover it. Can anyone tell me how this file could possibly stay present. Any ideas are welcome. Thank you for reading about my problem and participating.