yashsingh1/xdaforums huggingface dataset:
[Moto G4 Play Questions & Answers] ledothis:
Ok apparently this might work according to another amazon ad thread:

adb shell su -c "rm -rf /data/data/com.android.systemui/files/*"
adb shell su -c "sed '/com.amazon.phoenix/d' /data/data/com.android.systemui/shared_prefs/com.android.systemui"

I will try make that modification

/data/data/com.android.systemui/shared_prefs/com.android.systemui.xml

when I get home.

It is not possible to remove files, but may be able to truncate the files under /data/data/com.android.systemui/files/*

I am assuming this will stop android loading the advertising overlay, hence blocking the advertisements.
[Moto G4 Play Questions & Answers] ledothis:
OK what I posted above will work.

I'm out on vacation for two weeks but when I'm back Ill create an ad remover apk.

I'm also assuming in two weeks we will see an universal Android root, which would work for this phone.
[Moto G4 Play Questions & Answers] A.Fitz:
We don't have root access so this wouldn't work though, correct?

I have been looking into the Dirty COW exploit, and it may be possible we can use it. It has not really been figured out how to create a full root from the exploit though, because SELinux undoes all changes on a reboot. Plus we can only overwrite/delete files, no push.
[Moto G4 Play Questions & Answers] DanHutchins:
At home screen pull down the notification drawer hold the gear icon on top right for a few seconds to unlock ui tuner then go to settings scroll all the way down its in ui tuner settings. I know this post was a while ago but there was no post if it was figured out yet. Hope this helps.

Edit: OK I now see it was figured out.
[Moto G4 Play Questions & Answers] ledothis:
I haven't given up yet.

I was able to get the contents of com.android.systemui.xml and it shows the line that needs to be disabled according to this forum for other devices:

<map>
[B] <boolean name="com.amazon.phoenix.ENABLE_BUILT_IN_ANTI_AD_CIRCUMVENTION" value="true" />[/B]
<boolean name="DndTileCombinedIcon" value="true" />
<int name="searchAppWidgetId" value="7" />
<boolean name="3rd_party_lockscreen_detected" value="false" />
<string name="searchAppWidgetPackage">com.google.android.googlequicksearchbox</string>
<boolean name="DndTileVisible" value="true" />
</map>

But apparently on this forum other devices required the files under /data/data/com.android.systemui/files/* to be removed to stop the ad overlay.

Will have a go at inspecting these files tomorrow
[Moto G4 Play Questions & Answers] ledothis:
Ok I did the above! And itworks! (Momentarily)

But as soon as I unplug my phone from my computer (ie end the adb session), something resets the files/systemui, and I get ads again.
[Moto G4 Play Questions & Answers] ledothis:
Any one know why the /data/data/com.andriod.systemui gets written over?
[Moto G4 Play Questions & Answers] ledothis:
I have solved this now. I am ad free!

It was simpler than I thought. Modifying systemui was not the correct solution.

I can upload my code to github tonight.

Also I had an idea on how I could make an all-in-one app to do this on the fly without a computer.
[Moto G4 Play Questions & Answers] A.Fitz:
Awesome! Please do upload it to GitHub :D
[Moto G4 Play Questions & Answers] ledothis:
First you need ADB, then it is the following:

$ adb push run-as /data/local/tmp
$ adb push dirtycow /data/local/tmp
$ adb shell /data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as
$ adb shell /system/bin/run-as
Package com.amazon.phoenix new state: disabled
$

Here are the prebuilt run-as and dirtycow binaries:

run-as [download]

dirtycow [download]

Here is the source: github, as well.

How it works:

With dirty cow it is possible to write to files that you only have read permissions for.

In this case /system/bin/run-as

This file is chosen because it is given access to change User and Group IDs.

Hence, /system/bin/run-as can change it's user id and group id to 0. ie. root.

We haven't rooted the device here because of selinux, we have root but can't do anything useful (for most people).

Luckily in our case we just need to disable the amazon ads app. (com.amazon.phoenix).

We also have to switch context because run-as is in it's own sandbox, but the shell context can run the Package Manager(pm).

Once switched to the shell context it is possible to run:

$ pm disable com.amazon.phoenix
[Moto G4 Play Questions & Answers] MrInsomniac117:
Does the same method apply to Moto G4?
[Moto G4 Play Questions & Answers] CassandraP:
[MENTION=7838117]ledothis[/MENTION] can you reupload elsewhere? Your compiled exploit was taken down from google drive.

Also, thanks for doing this :D
[Moto G4 Play Questions & Answers] ledothis:
Oh no. Hey just saw this. I'll do it when I get home in 5ish hours.

I'll use the forums attach tool.

---------- Post added at 09:40 PM ---------- Previous post was at 09:38 PM ----------

Yes it should.
[Moto G4 Play Questions & Answers] ledothis:
Here you go:
[Moto G4 Play Questions & Answers] GoldenRuff:
I'm getting an error of "permission denied" and the Amazon app is not debuggable thing. Text:

C:\Users\Danielle\AppData\Local\Android\sdk\platform-tools>adb push run-as /data

/local/tmp

[100%] /data/local/tmp/run-as

C:\Users\Danielle\AppData\Local\Android\sdk\platform-tools>adb push dirtycow /da

ta/local/tmp

[100%] /data/local/tmp/dirtycow

C:\Users\Danielle\AppData\Local\Android\sdk\platform-tools>adb shell /data/local

/tmp/dirtycow /system/bin/run-as /data/local/tmp/run-as

/system/bin/sh: /data/local/tmp/dirtycow: can't execute: Permission denied

C:\Users\Danielle\AppData\Local\Android\sdk\platform-tools>adb shell /data/local

/tmp/dirtycow

/system/bin/sh: /data/local/tmp/dirtycow: can't execute: Permission denied

C:\Users\Danielle\AppData\Local\Android\sdk\platform-tools>adb shell /system/bin

/run-as

run-as: Usage:

run-as <package-name> [--user <uid>] <command> [<args>]

C:\Users\Danielle\AppData\Local\Android\sdk\platform-tools>adb shell /system/bin

/run-as

run-as: Usage:

run-as <package-name> [--user <uid>] <command> [<args>]
[Moto G4 Play Questions & Answers] ledothis:
Run, and look at:

adb shell
$ ls -alZ /data/local/tmp/dirtycow

You may need to add permissions to run the executable

$ chmod +x /data/local/tmp/dirtycow
[Moto G4 Play Questions & Answers] stephen.george.west:
Worked for me until reboot. I compiled the source code on the phone using CCTools, then copied the two files to /data/local/tmp and chmodded and ran from there. Edit: I don't get the ads in the notification list, but I do get the full-screen lockscreen "discover your next favorite book" background. I think that is there when no ads can be found for the notification list. I noticed before that my wallpaper gets replaced by the default on reboot. I think that might be related.
[Moto G4 Play Questions & Answers] We_nie:
I'm getting access denied when I try to push run-as to data/local/tmp... Here is the code:

C:\Program Files (x86)\Minimal ADB and Fastboot>C:\Users\CPU\Desktop>adb push run-as data/local/tmp

Access denied.

So, I realized there's no "local" on data folder...

Is there any way to solve this? I've been using Moto G4 Play Amazon Prime for less than a day.
[Moto G4 Play Questions & Answers] ledothis:
Can you run

adb shell

And then

$ id

And tell me the output.

---------- Post added at 05:03 PM ---------- Previous post was at 04:55 PM ----------

I only did one restart on my phone and the ads were still gone.

Run in an

adb shell

Can you tell me the output:

pm list packages -d
[Moto G4 Play Questions & Answers] We_nie:
This is the output.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell

shell@harpia:/ $ id

uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0

shell@harpia:/ $
[Moto G4 Play Questions & Answers] ledothis:
Yeh interesting. My phone has been in airplane mode for a while since I did a factory reset. Maybe I don't have those ad image cache that you do.

I'll check this out later when I get home.

---------- Post added at 08:49 PM ---------- Previous post was at 08:47 PM ----------

Yeh this looks good, can you change directory to /data/local/tmp now?

It should exist.
[Moto G4 Play Questions & Answers] ledothis:
Yes you are right. This just happened to me when I restarted my phone.

I have an idea, that it has to do with the systemui that I was working with originally.

I will give that a shot and see what happens
[Moto G4 Play Questions & Answers] ledothis:
Ok I fixed it, and removed the wallpaper ads.

Only problem is the way I did it is not very clean and is a convoluted process, so I need to do some touch ups to it before post it here.
[Moto G4 Play Questions & Answers] ledothis:
Mucked around yesterday trying to get this to work without adb shell.

Should have just uploaded the solution. Now I am away for the weekend. Ill upload the solution Monday when I'm back. Thanks for waiting.
[Moto G4 Play Questions & Answers] mrDmola:
you all have my sword.
[Moto G4 Play Questions & Answers] gompka:
watching
[Moto G4 Play Questions & Answers] ledothis:
Ran into a few speed bumps will have something to share tomorrow or Wednesday
[Moto G4 Play Questions & Answers] ledothis:
Ok I got stuck making this process better, so I just detail below what works. I still plan on improving the process.

This is just for removing the wallpapers. The previous posts still apply to remove the ad notifications.

# = comment, $ = shell command, > = run-as shell

# unzip the files attached
# then push them to your device using adb
$ adb push /data/local/tmp dirtycow
$ adb push /data/local/tmp shell
$ adb push /data/local/tmp appfix
# hop into a shell on the device
$ adb shell

The rest of the steps will be run inside the "adb shell"

# firstly we need to sneak a shell into run-as, so we can remove two files created by amazon to have wallpaper ads
$ cd /data/local/tmp
$ ./dirtycow /system/bin/run-as ./shell
# once that is done we need to make a backup of /system/bin/app_process32
$ cp /system/bin/app_process32 ./app_process32_bk
# now we need to push appfix to /system/bin/app_process32, this will modify the permissions of the two files we need to remove
# your screen should go black or show the motorolla boot image during the next step, do not be alarmed, this is expected
$ ./dirtycow /system/bin/app_process32 ./appfix
# now we should be able to remove the files, we will use the shell we created in the first step
$ run-as
# list the files
> ls -al /data/data/com.android.systemui/files
.... boot.ad
..... boot.ad.image
# if that doesn't work then we failed, if you see the files then good!
> rm /data/data/com.android.systemui/files/boot.ad
> rm /data/data/com.android.systemui/files/boot.ad.image
> ls -al /data/data/com.android.systemui/files
> exit
# now restore app_process32 and the screen should return to the lock screen (or reboot the device )
$ ./dirtycow /system/bin/app_process32 ./app_process32_bk
[Moto G4 Play Questions & Answers] gompka:
Process seems to be working, i found some errors in the post though. Also had to chmod dirtycow as you stated earlier or I would get permission errors.

# unzip the files attached
# then push them to your device using adb
$ adb push /data/local/tmp dirtycow
$ adb push /data/local/tmp shell
$ adb push /data/local/tmp appfix
# hop into a shell on the device
$ adb shell

Problem above is the source and destination is backwards in your post.

Another i guess bug i had was when i ran

# now we need to push appfix to /system/bin/app_process32, this will modify the permissions of the two files we need to remove
# your screen should go black or show the motorolla boot image during the next step, do not be alarmed, this is expected
$ ./dirtycow /system/bin/app_process32 ./appfix
# now we should be able to remove the files, we will use the shell we created in the first step
$ run-as
# list the files
> ls -al /data/data/com.android.systemui/files
.... boot.ad
..... boot.ad.image
# if that doesn't work then we failed, if you see the files then good!

My screen was off and I couldn't read see the files until i pressed the power button and the screen turned on, then the screen went black not "blank" and then i was able to remove the files.
[Moto G4 Play Questions & Answers] ledothis:
Thanks dude for cleaning up the errors.

The app_process part can be fiddly, as we have to wait for Android itself to execute app_process, to get the permissions we need to make the files removable.

At least it is +1 person for the above process.
[Moto G4 Play Questions & Answers] ledothis:
Here are the fixed steps

# unzip the files attached
# then push them to your device using adb
[B]$ adb push dirtycow /data/local/tmp
$ adb push shell /data/local/tmp
$ adb push appfix /data/local/tmp
$ adb shell chmod +x /data/local/tmp/dirtycow[/B]
# hop into a shell on the device
$ adb shell

Run the following from adb shell:

# now we need to push appfix to /system/bin/app_process32, this will modify the permissions of the two files we need to remove
# your screen should go black or show the motorolla boot image during the next step, do not be alarmed, this is expected
$ ./dirtycow /system/bin/app_process32 ./appfix
# now we should be able to remove the files, we will use the shell we created in the first step
$ run-as
# list the files
> ls -al /data/data/com.android.systemui/files
.... boot.ad
..... boot.ad.image
[B]# if there are no files listed or you get permission denied: you may need to tap the sleep/power button as described above [/B]
# if that doesn't work then we failed, if you see the files then good!
[Moto G4 Play Questions & Answers] danieljohnsalt:
Hi All

Are you going to post simple step by step instructions for us non technies please!
[Moto G4 Play Questions & Answers] ledothis:
Yeh dude, I am working on a one click version from your phone.
[Moto G4 Play Questions & Answers] insanedrunk:
thank you sir, because simply pressing the thanks buttons doesn't express my gratitude enough!
[Moto G4 Play Questions & Answers] Vest1:
I am also extremely interested and looking forward to your results
[Moto G4 Play Questions & Answers] ledothis:
Ok here is the app to try. Run all the following steps from your phone.

Download the APK on your phone (Attached to this post).

Run the download by tapping on it

You should get a warning, tap the button to go to the Settings

Scroll down to "Unknown Sources" and click allow

Go back to the web browser, redownload the file

Run the file again, this time selecting to install the application

Open up the app called "Amazon Ad Removal"

Press the button called "Run Step 1"

Wait 5-10 minutes for the first step to complete (This is the slowest step)

Once the first button says "Done Step 1" go to the next step

Run Step 2: The phone should flash black and restart to the lock screen

Reopen the app and run Step 3.

Run Step 3: The phone should flash black and restart to the lock screen

The process is complete

Go back to the settings and uncheck "Unknown Sources" option
[Moto G4 Play Questions & Answers] Vest1:
Step 2 keeps giving me the error "Unfortunately, Amazon Ad Remover has stopped."

I rerun the app and it says step 1 is done but when I try to run step 2 it repeats the same error

I removed and reinstalled it but no joy, same issue
[Moto G4 Play Questions & Answers] pietro_spina:
what phone do you have? G4 or G4 Play? build number? etc..
[Moto G4 Play Questions & Answers] Vest1:
G4 Play

Build: MP124.241-2.35-1

Android: 6.0.1

Android Security Patch Level: July 1, 2016
[Moto G4 Play Questions & Answers] ledothis:
Yeh those specs are good.

Uninstall the app. Then reinstall it.

This will put it back into the state where you can run step 1 again. (Takes 8 mins, keep the app open or in the background).

Step 2 will crash the app if Step 1 failed (even though it says complete).

Hence assuming step 1 failed because step 2 crashed.
[Moto G4 Play Questions & Answers] pietro_spina:
Does this App clean up after itself? or does it leave dirtycow etc in /data/local/tmp

And I'm guessing this would likely be undone by an OTA update. Correct?
[Moto G4 Play Questions & Answers] ledothis:
I'll release the source soon, it is not very legible. I didn't worry about that because I figured this could all be for nothing when we get the next OTA.

Uninstalling the app will clean up after itself. Also a reboot would clean out /system/bin/tc.

It puts dirtycow under /data/data/com.marto.example.myapplication/dirtycow plus a few other files. But this folder is removed when you uninstall the application.

Because we are in the context of an APP now I couldn't put (write) files in /data/local/tmp so there will be no files added there.

Did the app work for you?
[Moto G4 Play Questions & Answers] chamala2000:
I tried your app and its not letting me do the step 2. same error "Amazon Ad Remover has stopped" I will try again and let you know.

Update: same error. crashes on step 2.
[Moto G4 Play Questions & Answers] ledothis:
Ok I will have to have a look into it later on, looks like the current app is a no go.
[Moto G4 Play Questions & Answers] pietro_spina:
I didn't try it since it since it didn't seem like a longish term solution.
[Moto G4 Play Questions & Answers] insanedrunk:
I would like to also add my experience, the was was able to finish step one, it could not start step two. The second I pressed on step two, the app force closed.

Thank you for your efforts :) this phone is for a gift to my father, I fear he would tap on every ad lb the lockesreen as he is an old fart and technology is new to him. I will continue to help test if/when possible. Again, thank you sir!
[Moto G4 Play Questions & Answers] ledothis:
Ok found out what I did wrong that made it crash.

Before installing the new version you need to uninstall the old version on your phone. (This step is important)

Then install the attached version. Follow the steps posted previously. (Make sure to do step 1 again)
[Moto G4 Play Questions & Answers] chamala2000:
I want to bow to you for making this app. Ads are gone.
[Moto G4 Play Questions & Answers] insanedrunk:
Second app waa successful at removing ads! I'm currently rebooting to see if they return after reboot. (Waiting for reboot to finish)[this won't matter when I post it lol]

Success!
[Moto G4 Play Questions & Answers] ledothis:
I don't really know how OTA's work.

But there is a very small chance that newer OTA update will not re-enable the com.amazon.phoenix apk but just update it.

---------- Post added at 05:45 AM ---------- Previous post was at 05:44 AM ----------

Awesome!

---------- Post added at 05:53 AM ---------- Previous post was at 05:45 AM ----------

:good:
[Moto G4 Play Questions & Answers] Vest1:
I removed and re-downloaded and reinstalled

Step 1 completed but didn't say it failed. Step 2 gives the same error as before

:crying:
[Moto G4 Play Questions & Answers] insanedrunk:
You have to uninstall the first version of the app, I would reboot just to be safe, install the second version of the app and run through the steps. Once finished, keep the app installed. I believe if you uninstall it, it undoes the changes it made? I'll test that later when I'm home from work.
[Moto G4 Play Questions & Answers] ledothis:
Uninstalling the app is OK after you have have disabled the ads.
[Moto G4 Play Questions & Answers] insanedrunk:
Thank you again sir
[Moto G4 Play Questions & Answers] Vest1:
Rock on!! You are the man! No Ads and a normal splash screen!

3 Cheers!
[Moto G4 Play Questions & Answers] luggophone:
Perfect! It worked! Thank you very much! Now, when can we unlock the bootloader and be able to do our device's ROOT? Pleaseee!
[Moto G4 Play Questions & Answers] iamrico00:
IM getting an issue with no ads 2 apk.

It does step 1 and step 2 - reflashes back and when I go to the app for step 3 - it still highlights step 2 and doesnt allow me to go step 3.

Rico
[Moto G4 Play Questions & Answers] rocksolid99987:
I'm stuck on step 2 as well.
[Moto G4 Play Questions & Answers] Danielfer30:
Thanks

Thanks so much for help, it's worked
[Moto G4 Play Questions & Answers] pietro_spina:
I have successfully used this on a Moto G4 (not a Play variant) still working after reboot

I used the second apk from post 96 I had not previously tried the first apk.

thanks ledothis!
[Moto G4 Play Questions & Answers] neyurt:
Hi, I've tried this an it works. Question is does it loose OTA updates? If OTA still works and after the next udpate, can I just re-run the no_ads2.apk again to remove ads?

Thanks in advance.
[Moto G4 Play Questions & Answers] pietro_spina:
I think we will just have to wait and see...
[Moto G4 Play Questions & Answers] UAlex:
I confirm that it works perfectly good, nomore ads! Thanks a lot!
[Moto G4 Play Questions & Answers] jerpd3rp:
Try and reinstall the v2 apk over itself, i did after having your problem and it allowed me to run step 3
[Moto G4 Play Questions & Answers] ledothis:
You won't lose OTA updates.

However the next OTA will patch the "loop hole" that this app uses to disable the ads.

You don't have ads currently because the amazon app that runs the ads has been disabled (not removed).

There is a small chance that the OTA won't re-enable the app that runs the ads.

They could read this post though :P
[Moto G4 Play Questions & Answers] revtek:
Thank you for this. I was able to remove the lock-screen ads. I did use the 2nd file but had to remove the battery after it hung up after step 2. It got hung up during step 3 again so I removed the battery and tried step 3 again and it worked. I was scared there for a second.. :)
[Moto G4 Play Questions & Answers] ksdst1:
Works

I want to confirm that this process, using the updated file, worked flawlessly for my XT1625. Thanks for the work done!!
[Moto G4 Play Questions & Answers] jayjr1105:
Anyone have it work on a XT1607?
[Moto G4 Play Questions & Answers] chamala2000:
they should completely remove the adds, same price for:

99$ for Moto G Play (4th gen.) - Black - 16 GB - Unlocked - Prime Exclusive - with Lockscreen Offers & Ads

99$ for Moto G Play (4th gen.) - Black - 16 GB - Unlocked
[Moto G4 Play Questions & Answers] loociddreemr:
Any new information on using this for a full root exploit?
[Moto G4 Play Questions & Answers] ledothis:
It is not possible.

The only way to achieve it is to get into the Kernel Space.

But Moto G now signs kernel modules, so you can't insert custom module into the Kernel.

However there maybe future exploits that cause the kernel to execute code without inserting a custom module.
[Moto G4 Play Questions & Answers] chamala2000:
I did, works.
[Moto G4 Play Questions & Answers] :
Worked well, thanks. Would feel safer with source code thought... Is the drirtycow referring to the exploit? So you are using the exploit to do this?
[Moto G4 Play Questions & Answers] Gab0s:
Thanks a lot, that's was usefull for me. XT1625
[Moto G4 Play Questions & Answers] :
In case you were curious the author published the source code at github.com/m-mullins/amazon_disable_ads
[Moto G4 Play Questions & Answers] iamrico00:
No, I tried reinstalling the app over itself, when I run it, it still says Step 2 - I dont have the option to go to step 3.

RIco
[Moto G4 Play Questions & Answers] jerpd3rp:
and of course restart your phone
[Moto G4 Play Questions & Answers] glebonator:
Used the app from post#96 and things worked great, thank you!

I did not step 3, in fact after rebooting in step 2, if I came back into the app the ads re-appeared. No ads though, and the author did initially say step3 is optional so whatever...

Question - is there a way to now disable updates? Motorola Update Service has the 'disable' option greyed out and I can't seem to freeze apps using "SD Maid" without getting root...

EDIT: Apparently SD Maid allowed me to completely uninstall Motorola Update Service.... which I decided to do, because what could go wrong lol? This phone is for a relative and they can live without updates as long as ads don't come back... Perhaps this will be useful to others.