yashsingh1/xdaforums huggingface dataset:
[General Topics] Astr4y4L:
OH WOW...

this autopsy Program found approx 664 credit card numbers hidden in bin files in zone3 /system.img...

on my further investigation it appears it has found the signing keys for all app's and binaries in the ROM....

Creditcard numbers? Naaa just sha hashes that it thought were credit card numbers...

Neat stuff.

Oh and you all familiar with the file called

(recovery-from-boot.p) well it's pascal code which I'm not familiar with and the content of strings is thus

IMGDIFF2

BSDIFF404

BZh91AY&SY

BZh91AY&SY

BZh9

rE8P

BSDIFF40

BZh91AY&SY

i56FL

z2h4eC

=OSM='

3#Rz

=O(h=C

M=OF

!B`4

HMPc

(mXz

Ax%4k&

quZD

'ULY

a\jW

tx$l

ZBTp[

G"Y]i

M,Jl#qK

3OsT`

rU%0

zCyi

039(

%Vn5kb:}69

E5`q

|tKB

YQ%&@

AY<=

<}6I

e"0E

VkAYB

=>i!

gU~&k

u8&j

+;nL

:Mmx8SEf1jr

2B0Q

'8[xP

DN~_Jy

%U+

:m`S7

5sn5

^O:!

*D)/0

OS?4w

n0)_

5IiG~

H}=r

cwE;

!OWA

BBI

|OfO

|GKC&

[¥l\J

5\(p

(ñ0@

y ov

z'>;

{a\2

)S"*

YX^D

e4Ocv

*v_#Bi

y:(,7

5V\.o

33 H`;

Q-**

Df\c[

$;?S

Qq\c

<UJ~_

*[Tm

fz&8

rJo=

AN[\

8wsa

B0g5C

hQ+5)

owu#

V_d#

WZx;

b%F-

`6u~

1reaVJ

j)x=

*iZh

>zA,

uY]^

UYy$

dmZ!Z

]smA;

H +"

ei19

]Ra

):SU

|6V6g*

4?46k

*FZ[F

j`D[Dj

gtXf

zVD[Y

"(f}

j82b

9W]g{

yMGeC"g

8fwI

[3wM

^l c

uFSN

u.sJ

AV,C

ZYEl

BBiM-lBZh91AY&SYY

[him

QU@{

mc=+

6/7*R

h0J~&E?

h10)

M=OI<OAC

mO(4

2?SS

4mLF

L&i=CLCA

I$&"d

SdlR

DFLO

?Q14

:qlNe

&t_8

eFX(S

\uAq

HrR^~V

r1?Ef

rSwu

Razu

u'+Fy

4MH6m2

FULT

gVn*

Ez(R

p|P

k4]}

]ec7

DlBL

y]bL+R=Ql

Kz8i

o1b9-

H8#5

`T7}R

1}-4,

]R px

HI>xE6i

x (mt

N[\%

Gs&B

[s"4

mv)\

c#g

Jo(L

8z5|

g\TZ

26C[

.dcc

)Q8㌉

).#RA

`]uC

6n'r

8]%h

nLP,Î

Q^>.tF

uqAMl

)f]A,@pA

6pEZA

{Sd^

l=5#

Bo<'

Lf !

C>c0x

I$@

Z`f0V

w<:M

wt"9PD/C

*O{~

qfg_

ihwD,

u6P:4

ém $

yz w

/M$9iQ

zT [0

<2}K

f-2(L

m] qj

e@(gHi&V

.)#]

m7;

41E1

BD\1

S/f>

CVTI

MAT]

3CK4@

\CX+:

f)zE

\Cx@0

4;,$

nVsb

LqqE

)ñAfi

% hIN

E-zS

FG+dU

%%&V!HJ

dDQL2

c<|9.n

sacT

8v./

Jj`h@

:0.7

'sEC

zm+O

/kY$x

4zt5
[General Topics] wdthompson:
[MENTION=8236433]Astr4y4L[/MENTION]

>It's like next level stuff and even our /system is signed

No, if it was, there would be a "verify" flag in fstab,,

and there is not (this is a android 6 and 7 "feature")

They must update the cert too when there is a OTA update

>gotta cause the hash of the file to remain the same

Yes, because sbl checks it, you realize this is almost impossible?
[General Topics] Astr4y4L:
From /system/build.prop --->lge.signed_image=true

just as an experiment ... try to run your system image through drixda's android kitchen and modify ..anything... then take the output of that and convert back to an image format..[ext4_system.img]

and try to flash that to your device...

dd wont help...

Lgup wont touch it...

your right they must somehow resign the image ON-DEVICE after as a part of the OTA...

I really don't understand all of the Mech.'s involved in their Updates...

I ROOT ANDROID so I ALWAYS disable updates .. ;)

I do... :crying:

But reading about it in reverse engineering androids application bootloader [Android internals]

and examining the file extensively in various hex editors and debug software I know that the end of the file contains a lot of dead space [ 00 ] Zero's ... and wonder if we can somehow modify our values in the functions and then hash that to see what our value is and then we can maybe use the known value [what it is now before touching the file ] and some how then calculate a way to remove some Zero's to cause the [Code-Size ] to be the same as before which then would result in a matching sha value...

Might take Years or may be simple computation with the correct formula... I Honestly don't know if it can be done. But We've been trying :0

I Myself think we may be able to just swap the Damn Binary with another signed one from Lg software...

It will Either Boot or NO

But WE DO KNOW the Vzw Zone3 doesn't have those [e-fuses] set for roll-back protection etc.

that's why we are able to downgrade and attain root and thus is how we got to where we are...

It's a Damn Turky-chase...

But bro some genius out there is probably reading this and has the damn answer but won't speak up...

Grrr

---> Frustrations

Astr4y4L

---------- Post added at 01:27 PM ---------- Previous post was at 01:16 PM ----------

$$Comma-separated list - PCO/ISIM/CONF

SIP Features - gruu(0x1), rport(0x2), keep(0x4), multiple_reg(0x8), pan_info_in_initial_reg(0x10000), p_preferred_id_in_reg_sub(0x20000), auth_algorithm(0x01000000), ua_set_by_context(0x02000000), user_agent(0x04000000), display_name_dquot(0x08000000), contact_in_all_1xx(0x10000000)

Session timer related headers - none(0x00), session_expires(0x01), minse(0x02), require(0x04,timer in 200 OK), check_session_expires(0x10), all(0xFF)

May just have found what i have been chasing now I gotta go back to Mom's fone's case file and compare the values that are located in the same place in her rom...

I fully expect them to be different values and her fone is on the Cricket ATT network...

back in a bit I really want to win this $500 wager.

:fingers-crossed:
[General Topics] MotoJunkie01:
Wow mate. I've got a lot of reading to catch up on here. Looks like you've been knee-deep in this device as usual. Your ceaseless hard work never fails to amaze me. Anyway, I'll catch up on your recent finding and progress. I've been on this all day. Finally got this tabled decrypted and compiled a stock ROM for TWRP installation.

https://xdaforums.com/android/general/rom-lenovo-tab-3-8-tb3-850f-t3617594/page7
[General Topics] Astr4y4L:
Still haven't found the values to plug into the settings...

hmmm... lenovo tabs seem pretty neat , looks as though your out rescuing some poor guys that can't get stock firmware's again, :good:

I am in touch with [MENTION=5182519]phonecapone[/MENTION] and were communicating about both the K3 and that Rebel that he has...

I think he's been trying to use that Croot.apk or what ever and like him I NEVER had success with the little apk.

now the adb- command-line version I Have success with exploiting many devices using the Race-condition.

Have you had any news on the K3 front?

I just right now bricked a zone3 pretty good.

got 2 in qcom Qdloader9008 mode now...

that leaves the one that thinks he is a K4 but lost download-mode on it...

and the one I use as a phone.....

UGGGG.... stupid boot-stack issues because I cant help messing with things...

;)

Oh well stuff happens there sometimes but if I don't do it and nobody else tries it we never find the good stuff...

got someone I'm talking to about becoming a tester on the 2017 K4 the marshmallow version...

and as I can't get firmware from tracfone or streight-talk or aio or att ...

I'm going to suggest that [MENTION=5182519]phonecapone[/MENTION] uses my mod-tools and gets a non-root dump of the whole Rebel...

then we can finally get after that one...

who knows might be next incarnation Frankin_Mod material.

got to remember how I got out of the QDLoader mod last time...

found a sure-fire way to get devices into that state if we ever find a use for that... LMAO

But yes sir we have been busy on zone3 again.

and it's good to hear from you brother
[General Topics] MotoJunkie01:
Tell me this: do you have an option for Reverse Tunneling and, if so, what is it set to? On the K3, I'm definitely going to be sending you one. I'll be traveling to Louisville, Kentucky this weekend where the mall has a Best Buy Mobile. They have had their Boost and Virgin Mobile varians of the LG K3 (LG LS450) on sale for $19.99. Walmart in the area I live no longer carries the K3, so I will pick you one up this weekend. If you get lucky and end up getting one with an early firmware build, you can root it with iRoot or KingoRoot with the PC version one-click root exploit. I'm guessing you will figure out how to downgrade the device even if it is a more recent build which is not vulnerable to one-click root exploits. DirtyCow should also be feasible on builds prior to 12/01/2016. I'll keep you updated on the status of your K3.
[General Topics] Astr4y4L:
Great news thanks Bro.

If you buy one brand new in the box... look at the software version usually near imie info printed by barcode on box.

Usually they let me do that when I am in the market place.

They won't usually all be the same.

Kinda bunt on the zone3 at the moment.

Putting him on the back burner and playing with the Bass again... driving everyone nutz lol.:rolleyes:

But anyway. I need a dump from A 2017 k4 m151 I believe it is.

I want to take a crack at that also.

And I killed a zone 3 yesterday. Gotta work out an unbrick

For these. In that state. Qdloader-9008

Edit --> didn't find anything in the device about reverse tunnels.

Now if you need a reverse tunnel setup somewhere. Holler at me bro. We can pipe you through the lab server. No big deal
[General Topics] Astr4y4L:
RE aboot

http://newandroidbook.com/Articles/aboot.html
[General Topics] wdthompson:
Thanks to Astr4y4L his software and help,, my K121 (10f)is rooted

Only a little painfull, and we caught a couple bugs so it will be better

I am no expert on win, as usual win seems to need more than 1 boot

to get it all together, fairly smooth once it was sorted,, 9/10

The mod to LGup is quite impressive

Oh, camera still works, I gather 10b and 10c, kingroot loses camera

thanks Astr4y4L
[General Topics] MotoJunkie01:
As always [MENTION=8236433]Astr4y4L[/MENTION], impressive work and incredible development. Do you ever rest or sleep? Lol
[General Topics] Astr4y4L:
Yea we have a Global botnet of android monkeys working 24/7 to bring everyone the greatest new Mods we can come up with.

Working on K3 stuff right now and repo -syncing the needed Asop stuff to build these open-source lg software kits from lg's dev site.

I cant sign the image but may be able to build and swap guts if ya know what I mean.

Anyways yea also any-one with a (LG FRP-Bricked) regardless of make and model may have new options for a frp unlock remote service Team_Astr4y4L is putting together.

So big Stuff going on ;)
[General Topics] suchristo1776@yahoo.com:
Someone is remotely accessing my cellphone.

Need to stop government spying on my cellphone. Seeing. Chinese writing in background.

content://media/external/file/4310
[General Topics] Astr4y4L:
WTF ?

WOW !!!

so you think the Gov. is spying on you?

HMMM,

they can surly do that but i wouldn't think the Government would need to exploit a device to spy on you ,

Hell THEY OWN THE INTERNET,

THEY OWN THE AIRWAVES AND WATCH ALL TRAFFIC.

SO what device do you have and What contry are you in?

Have you tried Kingroot, King of root, Iroot or any other Krap on the device thats in question?

If so , Then thats probably it.. the apps you download ask for permissions on your device and we grant them to have the app.

So I would Recomend first DELETE EVERYTHING.

YOUR PRIVATE FILES PICTURES EVERYTHING.

THEN FACTORY RESET THE DEVICE.

THEN FLASH THE LATEST STOCK FIRMWARE FOR YOUR DEVICE

THEN BOOT TO RECOVERY AND FACTORY RESET YOUR DEVICE AGAIN AFTER YOU FLASHED STOCK FIRMWARE..

This will prevent anything other than the devices Stock firmware from being on the device.

If after that the " Who-ever " is still messing with you then they probably have your accounts info's,

suggest sign out of ALL devices and then change Passwords for ALL acounts

If that doesn't fix it then someone who has physical access to your device is messing with you,

Also

KEEP BLUETOOTH OFF

%90 percent of android is affected by a bluetooth vulnerability

SO Avoid that

Hope We Have Helped...

Astr4y4L

Team_Astr4y4L
[General Topics] Astr4y4L:
Hey everybody theres a new service coming out for FRP bypass on LG devices

It is A paid service BUT,

right now it's going into Beta-Test Phase so you can get in absolutely free,

So if that kind of thing will be helpful to anyone heres a link to the thread.

https://xdaforums.com/general/general/frp-bypass-teamastr4y4l-looking-beta-t3701935
[General Topics] Astr4y4L:
Removed post
[General Topics] Astr4y4L:
ok update: and it's building all kinds of goodies for k3...

will any of it work ----> Maaaybe

but it's building eng/test-keys boot image which may be handy for rooting the K3

we'll see what happens, i'm trying not to be too optamistic as of yet...

from /root/default.prop

#

# ADDITIONAL_DEFAULT_PROPERTIES

#

ro.secure=0

ro.allow.mock.location=1

ro.debuggable=1

ro.zygote=zygote32

dalvik.vm.image-dex2oat-Xms=64m

dalvik.vm.image-dex2oat-Xmx=64m

dalvik.vm.dex2oat-Xms=64m

dalvik.vm.dex2oat-Xmx=512m

ro.dalvik.vm.native.bridge=0

debug.atrace.tags.enableflags=0

#

# BOOTIMAGE_BUILD_PROPERTIES

#

ro.bootimage.build.date=Fri Nov 10 09:32:06 CST 2017

ro.bootimage.build.date.utc=1510327926

ro.bootimage.build.fingerprint=Android/aosp_arm/generic:6.0.1/MXB48T/astr4y4l11100803:eng/test-keys

persist.sys.usb.config=adb
[General Topics] MotoJunkie01:
Ah, the old dreaded dm-verity. Damn I hate I bricked my K3. By exploring which exploit the one-click method utilized in rooting my device, you could have compiled a root package directly from dumps of my device. But, not to fret, I've found you a new device to keep and develop on. PM sent.
[General Topics] Astr4y4L:
Still possibly ,possible

if we can ever get it to connect to your pc in download mode we could still dump the /system...

if we can just get an image from it I can remove the busybox. from /system/xbin and make sure it isn't in /system/bin either and flash it back to your device...

that would probably de-brick him too..

but alas no download mode and not booting...

have you tried to force it into serial mode and connect it with lg_flash tool thats how i come back from UNKNOWN MODEL issues in LGuP

Oh well , Guess we'll be hacking and cracking on a brand new device soon, I hope we get one with old firmware and only turn it on with no network access and immediately dump the whole device...

before any type of auto-update patches the holes in earlier firmware..

hmmmmm
[General Topics] Astr4y4L:
@MotoJunkie01

check out this little tid-bit of info i just uncovered in an att lg rom file..

<DMCDescription>

Default packet configuration mask for device testing. ||This configuration covers single SIM for any radio technology (1X, HDR, LTE, GSM, WCDMA, TDSCDMA).

</DMCDescription>

and it go's on so this may be of importance in unlocking gsm, file also mentions

<QXDMProfessional>

<Persistence>

<MultiInstance>0</MultiInstance>

<FixedFontSize>0</FixedFontSize>

<DynamicParsersPath>C:\Users\Public\Documents\Qualcomm\QXDM\Parsers\</DynamicParsersPath>

<DroppedMessages>0</DroppedMessages>

<ParsingPreference>5</ParsingPreference>

<EmptyHexadecimalPane>1</EmptyHexadecimalPane>

<DIAGRequestTimeout>500</DIAGRequestTimeout>

<ScriptCommandTimeout>15000</ScriptCommandTimeout>

<TargetCOMPort>Disconnect</TargetCOMPort>

<GPSCOMPort>Disconnect</GPSCOMPort>

<TrackNMEA>0</TrackNMEA>

<OSCoreDump>1</OSCoreDump>

<MessagesView>

<Appearance>

<ShowDate>0</ShowDate>

<ShowMilliseconds>1</ShowMilliseconds>

<TypeSpecificTime>1</TypeSpecificTime>

<UseLegacyFormat>0</UseLegacyFormat>

<IncludeHeader>0</IncludeHeader>

<Order>0,1,2,3</Order>

<Columns>0/80,1/80,2/240,3/120,4/400,5/400,6/120,7/80,8/80</Columns>

</Appearance>

<ISVConfig>

<Items>5</Items>

<AcceptUnknowns>1</AcceptUnknowns>

<DelayedSubsysOnly>0</DelayedSubsysOnly>

<LogCodes>

0x157A,

0x157B,

0x157E,

0x157F

---->QXDMProfessional i believe is for programing radio firmware..

also found a an exe file i presumed for windows but it won't run on my windows

im attaching the file in a zip and if anyone knows what it is or can figure out what it is it may be important..

Thanks

Astr4y4L
[General Topics] wdthompson:
I have no idea what 'PCAP' is,, maybe you do

file RIDLClient.exe

RIDLClient.exe: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked (uses shared libs), BuildID[md5/uuid]=5c1681b385999c424c9ee0fc3a28af29, stripped

----------------------

#############################################################################

# QSHRINK Hash File

#############################################################################

# GENERAL DESCRIPTION

# Copyright (c)

Qualcomm Technologies, Incorporated. All Rights Reserved.

# Export of this technology or software is regulated by the U.S. Government.

# Diversion contrary to U.S. law prohibited.

</version>

vendor/qcom/proprietary/RIDL/PCAPGenerator/System/ZLibFile.cpp(77) :

decompress

: Throwing Lang::Exception("Could not decompress data")

Could not decompress data

vendor/qcom/proprietary/RIDL/PCAPGenerator/System/ZLibFile.cpp(109) :

vendor/qcom/proprietary/RIDL/PCAPGenerator/System/ZLibFile.cpp(121) :

: Throwing Lang::Exception("Did not write all bytes")

Did not write all bytes

vendor/qcom/proprietary/RIDL/PCAPGenerator/System/Lz4File.cpp(58) :

: Throwing Lang::Exception("Error decompressing LZ4 data")

Error decompressing LZ4 data

--------------

vendor/qcom/proprietary/RIDL/RIDLClient/RIDLMD5.cpp

--windowsize=

--droptolerance=

Invalid Command Line option

libPCAPGenerator

vendor/qcom/proprietary/RIDL/PCAPGenerator/PCAPGenerator.cpp

Invalid Command Line option:

More than one Wireshark/tethereal call:

Unsupported Wireshark/tethereal option:

Too Many Parameters

[input_file] [output_path] [-option]

where options may include any of the following flags in any order:

-v display version information

-d to force parsing .dlf file. (default is .isf)

-l suppress output for legacy PPP packet.

-u suppress output for UM PPP packet.

-r suppress output for RM PPP packet.

-a suppress output for AN PPP packet.

-t run Wireshark on the output file.

-tR<filter> Wireshark option: set filter.

-tV Wireshark option: set output file format to be verbose.

-tt r|a|ad|d Wireshark option: set timestamp format.

--windowsize=n set the log window size ( max # of sequence numbers

to skip for a given log point MUST BE at least>= 32

--droptolerance=n set the max number of packets dropped in row

before assuming the phone has reset

Example: -lura to suppress output for all legacy PPP packets.

Note: You can invoke the file browser by not supplying any

argument (recommended for novice user).
[General Topics] Astr4y4L:
Oh wow !!!

the qcom version of wireshark! ;)

and PCAP = packet capture, it's used in monitoring network traffic...

and thanks for that [MENTION=7101763]wdthompson[/MENTION]

I didn't have time to fool with it

so I'm now guessing this file isn't to be installed but called from another process...

another step toward progress.

thanks guys

Astr4y4l
[General Topics] Astr4y4L:
Ok so I just sent this to Qualcomm in a reply to an email they sent me detailing an ndk update. .. Email follows...

Greetings,

I and our team are developing on a board using the msm8909 Soc,

Recently we've had an issue with some modifications in our build.prop causing the device to enter the QD Loader 9008

And we require the file called firehose for the msm8909 to be able to reload firmware in this state using the firmware loader tool

Qfil.

I have searched our sources locally and on the net and yet can't find that one single file.

As I understand its a binary, and without the source code I can't compile it, my team wants to try to reverse-engineer the program and the firehose we do have to see if it can be modified to work with our particular device, and since its proprietary software I don't believe we should be reverse engineering it.

So as a Qualcomm developer I'm reaching out to your team for support.

If you can help us with this it will save us months of downtime and our projects can be completed, so that we can move on to the next.

Our board has the

Snapdragon 210 msm8909 SoC

If you all can send me anything to expedite the development on this project we would be Most Greatful.

Thanks.

So they immediately so not me the automatic reply able it them reviewing our issue and request for support.

So we'll see what they say...

Wouldn't it be great to have the whole kit for that snapdragon 210 boards?

Well I don't expect it to work but never know

---------- Post added at 01:39 AM ---------- Previous post was at 01:30 AM ----------

Ha got sort of an answer fast...

Dear customer,

Please open case with “Wireless Device Support” case record type for getting proper technical support.

Thank you,

Qualcomm Support

--------------- Original Message ---------------

From. My name removed [email removed ]

Sent: 11/14/2017 11:19 PM

To: qctsfdc-prd@qualcomm.com

Subject: Development msm8909

Greetings,

I and our team are developing on a board using the msm8909 Soc,

Recently we've had an issue with some modifications in our build.prop causing the device to enter the QD Loader 9008

And we require the file called firehose for the msm8909 to be able to reload firmware in this state using the firmware loader tool

Qfil.

I have searched our sources locally and on the net and yet can't find that one single file.

As I understand its a binary, and without the source code I can't compile it, my team wants to try to reverse-engineer the program and the firehose we do have to see if it can be modified to work with our particular device, and since its proprietary software I don't believe we should be reverse engineering it.

So as a Qualcomm developer I'm reaching out to your team for support.

If you can help us with this it will save us months of downtime and our projects can be completed, so that we can move on to the next.

Our board has the

Snapdragon 210 msm8909 SoC

If you all can send me anything to expedite the development on this project we would be Most Greatful.

Thanks.

ref:_removednumber:ref
[General Topics] ehacker22:
Quick question did you ever get the GSM portion of the zone 3 to work?
[General Topics] Astr4y4L:
Almost

Removed post
[General Topics] Astr4y4L:
A new ADB/FASTBOOT Installer

Removed post
[General Topics] phonecapone:
=] Yeah but we are a-ok now. Would be cool to eventually add a gui like qtADB.
[General Topics] PHug:
Can't get into PP2 without zebra screen

Re-posting this here since I got redirected here... the copy paste didn't come out right.

Quote:

Originally Posted by Astr4y4L

now you must downgrade your device software to pp2 version{VS425PP2}

---------------------------------------------------------------------------

NOTE:** If your device has pp5 software version you have an extra step, you must flash to pp8 or pp7... let it get to the red verizon screen and soon as it go's to android optimizing apps pull battery re-enter download mode and then flash pp2

---------------------------------------------------------------------------

Ok so that went well but now right after flashing pp2 you will have bootloops. It will bootloop for a few minutes then eventually it will boot to verizons red screen.

( This is because of the modem firmware )

after it finishes booting you must connect to wifi and finish or skip through the Setup wizard, once you've done that and you are looking at the home screen go to settings

My Zone 3 came with pp8 installed

I've tried several times to " let it get to the red verizon screen and soon as it go's to android optimizing apps pull battery re-enter download mode and then flash pp2"

but every time I finish downgrading to PP2 all I get is a white screen with various black patterns...

Does this mean that my phone can not be rooted?

oh and btw...

Model# VS425PP

Software version # VS425PP8

Build # LMY47V
[General Topics] Astr4y4L:
Krappy...

Removed post
[General Topics] pvineeth97:
I don't understand this. Why do you want to waste time on a phone which isn't that capable to run heavy apps, has less RAM and LG already seized it's development on it's side! Buy a good phone with all the features you want. I already been through all this Custom ROM stuff with LG K10 and none of them gave me a satisfactory experience other than the stock rom. It is just my advice to not waste time on things which will not work well as I wasted 6-7 months on it.

If you really that interested in Android development, make apps and explore stuff on Operating Systems.