yashsingh1/xdaforums huggingface dataset:
[ZTE Axon 7 Guides, News, & Discussion] Galaxo60:
You need to put in on a SD card, not on the internal memory of the phone. These are 2 different things.

;)
[ZTE Axon 7 Guides, News, & Discussion] aivilon:
hahahaha :laugh:

should't work so much... i'm so retarded....

Thanks dude :D
[ZTE Axon 7 Guides, News, & Discussion] story:
Does it fix the low light camera?
[ZTE Axon 7 Guides, News, & Discussion] Galaxo60:
I made some tests and quality is slightly improved, but what I can notice immediately is the quicker autofocus, which was improved a lot.

:)
[ZTE Axon 7 Guides, News, & Discussion] Casperwinde:
Anyone experiencing this? The quick charging seems lk no function even using the original charger?
[ZTE Axon 7 Guides, News, & Discussion] Looloup:
One thing that I did notice that this release has fixed is the persistence of accessibility switches (LastPass and Energy Bar both use these to keep functioning correctly) and Live Wallpapers over locking/unlocking phone.
[ZTE Axon 7 Guides, News, & Discussion] RedWave31:
And I've lost content-aware volume rocker.

- Before (B08) : music/film is playing, volume buttons change the song's/film's volume

- After (B10) : volume buttons won't change ANYTHING but call volume while I listen to MUSIC you damn phone

Edit : Strike that, a second reboot fixed it. Guess we'll be on Nougat next week anyway.

I've yet to see any more changes or bugs, but haven't tested them extensively.
[ZTE Axon 7 Guides, News, & Discussion] ALeX850:
wow, can anybody else confirm this? I still haven't received B10 OTA update so I can't test it but if it were for real, it seems like a very big deal... you can't increase/decrease a media volume when watching/listening to a media? that's beyond incompetence at this point. It's like, I have an issue with dolby always resetting to music preset when playing a new media (changing song for example) and I can't seem to resolve it. Other people did point at this issue too but not that much actually for what is a very annoying issue... so we never know, for mine and your issue, whether it's isolated cases dependent on user's manipulations or mainstream bugs. In any case I guess you should post on the "european" community forum
[ZTE Axon 7 Guides, News, & Discussion] SebStatiq:
It's working fine for me on B10.
[ZTE Axon 7 Guides, News, & Discussion] Ranny99:
Same here
[ZTE Axon 7 Guides, News, & Discussion] BritSwedeGuy:
Users in the USA are starting to receive Nougat - how long before we do....
[ZTE Axon 7 Guides, News, & Discussion] obladi64:
It happened with me twice but reboot solved the problem. I could not identify the root cause. Probably one internet media player caused it or older youtube player.
[ZTE Axon 7 Guides, News, & Discussion] paatha13:
I guess within 3-4 weeks we will get it.
[ZTE Axon 7 Guides, News, & Discussion] 0Kajuna0:
Hi [MENTION=7558918]rikin93[/MENTION] , you were right about B10. Any insight on when we are getting Nougat? Is it the same build as the US version but with the European radios? Thanks
[ZTE Axon 7 Guides, News, & Discussion] MrMD69:
True he was right about B10 but I still do not magic B10 update (yet). I think that G software will be closer to USA nougat because of few lacks in MM (eg. Sound volume) that wish perfectly calibrated on U software.
[ZTE Axon 7 Guides, News, & Discussion] golvin:
I'm from Malaysia and I received my update today.
[ZTE Axon 7 Guides, News, & Discussion] rikin93:
Full ROM image added to main post all can update now
[ZTE Axon 7 Guides, News, & Discussion] 0Kajuna0:
Right. So I guess they are actually treated like different devices. Let's just hope our version goes straight to 7.1.1 and has less bugs.

LOS is becoming more and more appealing, if only audio was fixed and the stock camera app could be ported correctly...
[ZTE Axon 7 Guides, News, & Discussion] protosx28:
update

Did you manage to update your Axon 7? I'm on three as well but I don't get any OTA updates. Have you?
[ZTE Axon 7 Guides, News, & Discussion] DanekAxon7:
Mine did this for first few days, can confirm is extremely annoying. Seems to have gone now?

You may as well wait for the Nougat update.
[Xiaomi Redmi Note 3 Questions & Answers] landster:
Is the apk for the stock calculator available? I really like the unit conversions, I looked on the play store and couldn't see it
[Xiaomi Redmi Note 3 Questions & Answers] bozarjoska:
here it is
[Lava Iris X8 Guides, News, & Discussion] Natalia Bai:
To solve this issue, you can try:

Method 1:

clear data

clear cache of google play store & google service framework

Method 2:

remove your gmail account

reboot

Re-add account

For solutions of more error codes, please check https://xdaforums.com/showthread.php?t=2733038
[OnePlus 3T Questions & Answers] Eggstones:
I'm having issues with several apps not triggering at specific times/notifications. Tried to whitelist Duolingo and that worked for two days and then it stopped. Podcast addict is doing the same thing. It should update every 4 hours but nothing happens. Tried to whitelist it but didn't work. The developer thinks it is the phone that kills the wake-up trigger/alarm. Anything else that I can try as it is rather annoying that various apps only work if I actually open the.

Running nougat and 4.0.2
[OnePlus 3T Questions & Answers] TweaknFreak:
Disable Doze Mode from Settings->Developer options. Reboot to wipe caches and check if problem is solved.
[OnePlus 3T Questions & Answers] Eggstones:
I'll test that. Didn't know the reboot did that.
[OnePlus 3T Questions & Answers] TweaknFreak:
What I meant by reboot was to boot into recovery mode and wipe caches.
[OnePlus 3T Questions & Answers] Eggstones:
Sorry not sure how to do that. Just going into memory clearing it from there doesn't do the trick?
[OnePlus 3T Questions & Answers] TweaknFreak:
Press the POWER+VOLUME DOWN keys simultaneously until the device restarts and oneplus splash screen appears. Then recovery mode will start and language selection menu will appear. Wipe caches from there. Be careful not to wipe anything else. Then restart your device. Most issues albeit small ones get resolved by doing this.
[OnePlus 3T Questions & Answers] Eggstones:
Seems like doze kills the check. If I switch doze off, podcast addict runs the check for new episodes. With it on it doesn't, even if I whitelist the app. It also seems like when it runs the new episode check , the phone kills the app as it showed up under power hungry apps. I'll see if the cache clean dies anything.
[BlackBerry Priv] natkobaby:
hello

my devices is model STV100-4

now my imei is gone

what shoud i do?
[General Questions and Answers] harak84:
Hi,

My boss wanted me to find a configuration for Windows CE 6.5, where when it logoff/sleep mode it able to end task all the application and when it wake up it able to launch default web browser with a link...please help since the audit keep bother me about this...

:crying::crying:
[Android Q&A, Help & Troubleshooting] bazaraa0903:
Hi guys! I've 1 problem. that's proper root for my Device. SHV-E270K. Please help me. :confused: :) :) :o :fingers-crossed:
[Android Q&A, Help & Troubleshooting] Mian Danish:
I have Lenovo tab 2 A7-30HC . When i do unlocked it shows black screen. i can access settings through notifications and also gettings apps notifications. but i can not see any app icon nor i can access them. In other words i can not go to home screen and main window where apps display. I think I have to install rom. But I don't know how to do and where to Download? Plz help
[Android Q&A, Help & Troubleshooting] Ashwinrg:
Download stock rom from below link. Flash tool and flashing process also given in the zip.

http://firmwarefile.com/lenovo-a7-30hc
[Android Q&A, Help & Troubleshooting] es0tericcha0s:
You might just be able to sideload a launcher apk via adb.
[Android Q&A, Help & Troubleshooting] milkyway3:
Instead of flashing rom,

First try to install any launcher from playstore since you can open settings

Set it as default launcher from settings itself after installing

If the problem still exists then you can go for flashing rom

Also press the thanks button if I helped

Regards milkyway3
[Android Q&A, Help & Troubleshooting] Quidagis:
I can tell this thread is more than a year old, but... I want to ask you: How did you unlock the Lenovo A7-30HC?

TIA.
[X Play Q&A, Help & Troubleshooting] hrizuwan:
I am using moto x play indian version xt1562. I am facing problems like screen Partitioning and frequently rebooting with the stock rom. I have tried full factory reset but nothing changed. When I'm using custom roms like cm13 the problem disappeares but with stock it happens. Do help me.

Thank you
[LG G5 Guides, News, & Discussion] LupineDream:
LG G5 VERIZON VS987

Unofficial bootloader unlock

In-Progress

This is a project to disassemble and rebuild an unlocked aboot that passes the sbl loader test, thus allowing installation of custom kernels, read/write access to system, TWRP recovery, and custom ROMs. You can follow the progress or ask questions about it here, or offer your help to make my life a little easier. Donations help, too, especially to maintain the machine these VMs and tools run on.

PHASE 1 - RAMDISK EXTRACTION: DONE

(Attachment 2 & 3): I have extracted the ramdisks from the KDZ bin data. I have the ramdisks and accompneying kernel files in tar files.

View attachment 4016279

View attachment 4016280

PHASE 2 - TARGET DISASSEMBLY: DONE

(Attachment 1): I have disassembled the ELF binaries. objdump is sloppy, but I was able to get to the branch instructions and find my offsets for each subroutine. I also located the factory signature data for verification by sbl.

View attachment 4016278

PHASE 3 - CERTIFICATE EXTRACTION: IN-PROGRESS

Extracting and parsing the PCS data. It's needed for verification by the sbl to avoid security fail when booting a modified aboot.

PHASE 4 - UNLOCKING NEEDS DONE

Re-coding aboot to accept a bootloader unlock, and access to fastboot.

PHASE 5 - RECOMPILATION AND TESTING (ABOOT)NEEDS DONE

Re-building the aboot binary and testing it.

PHASE 5 - LITTLEKERNEL AND SYSTEM ACCESS (BOOT)NEEDS DONE

Puling apart stock kernel, grabbing needed modules, disabling SELinux and dmverify.

Analysing system image, removing boot-time LG security checks, applying root.

PHASE 6 - TWRP BUILD (RECOVERY) NEEDS DONE

Building user-friendly recovery image.

PHASE 7 - BUILD TOT FILE NEEDS DONE

Package it all into an LGUp Flashable TOT and release.

If you would like to help with this project, please make yourself known.

If you would like to donate to show thanks, the button is underneath my name or in my profile.

If you have a comment or can leave documentation or advice, do so below :)​
[LG G5 Guides, News, & Discussion] akki7636:
Nice.. Hoping for the best
[LG G5 Guides, News, & Discussion] nalf3in:
Nice to know there is people working on an unofficial bootloader unlock for the lg g5 :) good job !

I would also like to ask a question if you don't mind : once done, does this variant of the g5 is similar enough to some variants to be able to "port" the unlock or the approach is too specific to the variant ?
[LG G5 Guides, News, & Discussion] LupineDream:
Im currently grabbing a more android build-friendly release of Xenial. Google does not support building from a x86 OS. When I tried to git the "official" google toolchain in consideration of doing things 100% correct in a VM, I ran into the dreaded "x86 build host unsupported" problem. The VM host I am grabbing is here: https://xdaforums.com/chef-central/android/guide-how-to-setup-ubuntu-16-04-lts-t3363669 I am going to need the google build source for the kernel, plus the makefiles for the generic arm v7a neon arcitecture. Best do it all the right way instead of having to re-do it all later.

In the meantime, I am cramming some thumb-2 tutorials. La la la~
[LG G5 Guides, News, & Discussion] LupineDream:
I'd have to check the aboot and boot / kernel to see if there's any major differences. Since this is a direct aboot disassembly, it's varient specific, but I will surely be checking if the approach can be applied to different varients' booters via scripting or some such thing. It would mean coding of a patchfile and a TOT builder, adding an entire extra level of complexity, but I'll get to your answer as soon as I have finished with this model.
[LG G5 Guides, News, & Discussion] thecubed:
Howdy there,

Looks like you're attempting to modify an element in the Qualcomm Secure Boot chain (aboot in this case) - unfortunately what you're trying to do won't work.

I don't want to rain on your parade here, or discourage you from learning something for the sake of learning it but simply modifying a component of the boot stack by recompiling it and slapping the same signatures on it isn't possible.

I'd recommend you take a look at any of the awesome posts on XDA about how the Secure Boot 3 (is there a newer version?) process works as you'll see that each step in the boot process (pbl -> xbl -> {tz, rpm} -> aboot) is verified using RSA public/private key signatures.

You won't be able to simply extract the certificate chain from the old aboot (LK) image and append it to your source-built LK, as the hash embedded in the certificate chain won't match the computed hash of the LK application.

Your next thought would be "what if I could find where the validation function is called and replace it?", but you'll find that each step in the boot process calls TrustZone's secureboot verification functions which rely on data stored in qFuses.

Even then, the function TrustZone itself calls is actually provided by PBL and is burned into the chip itself.

Essentially, the path you're trying to take is one that Qualcomm has thoroughly hardened the boot process to protect against.

I'm not trying to discourage you from learning, since doing this sort of reverse engineering is very fascinating and a fun learning exercise - I just want to let you know that if you try to flash a modified aboot image that you'll end up with a brick (and no way that I'm aware of to recover short of soldering up some UFS lines and reflashing like that since iirc even JTAG is disabled now and we lack signed programmers for USB recovery).

Check out one of the Secure Boot PDFs that are available on Google/XDA and you should see what I mean.

Best of luck to you, and happy learning!
[LG G5 Guides, News, & Discussion] Honestly Annoying:
Like thecubed said, by flashing a modified aboot you'll brick the device, but the fact that you figured out how to extract the aboot image is EXTREMELY impressive! If you wouldn't mind it would be very helpful if you make a guide on how you did that or if you could post your extracted aboot files that would be much much appreciated :D An insight on how aboot for the G5 works would be something very nice to have
[LG G5 Guides, News, & Discussion] LupineDream:
Thank you for the inspiration. The task has been a thorough crash-course in arm v7a NEON Cortex technology and thumb-2 assembler. I was concerned when I saw the TrustZone documentation from ARM and the ACEP (Arbitrary Code Execution Prevention) stack. Your mention of qfuse brings back memories of the Samsung "Golden Routines" folly.

Unfortunetly I wasn't a backer of the Raspberry PI, but there are other PCBs with GPIO pins. My reason for mention this is the JTAG connundrum you mentioned. It is null and void to a soldering gun, a few resisters ($2-$3, and the on-chip ARM debugging interface included in most integrated ARM chipsets. PCBs that run Linux with a GPIO pin array are the cheapest and most flexable solution to an expensive piece of lab / R & D equipment (JTAG), and the impact on the bank account is a fraction of what it would cost the end-consumer.

Hash collisions and backprop neural nets. What? OK, I'll explain. Most reverse engineering begins with monitoring the usual operation of the device as you are aware. Approach 1 involves training a backpropping neural network to recognize (within a reasonably less amount of computation) a hash collision. Of course, you aren't going to be getting to these pre-coded hashes without breaking the RSA chain (thats 100 zeros O__O ) , this is fixed by monitoring the debug interface we both mentioned earlier, at power-on. ARM processors work such that they cannot do DMAC (direct memory access computation), so the values need to be pushed into registers and acted on as plain byte, then pushed back to memory. Sniff, find out what's coming to/from the qfuse memory bus area into registers, dump the data, and you'll have your root CA with luck. You'll be looking for the in operand, that is, the one that is to be acted on in the cipher that is incoming from qfuse. Cycle-timing to ignore the rest of the computations for this byte, you're basically waiting until qfuse pushes the next byte of its keys into a register and grabbing it in the same cycle the instruction is working on it.

That said, with a $100 and a soldering gun and a laptop, you have your RSA key direct from CPU memory via the debug interface. After you've got your root CA, would it be feasable to start decrypting the intermediate CA chain for each component of boot until you get the hash? In theory this should work without brute-force, but a lot of time in a code window and with an oscilliscope. Once you've had the decrypted hash, you can begin to look for a hash collision. There are open source tools that will find hash collisions in an hour or less using neural nets. Write an aboot that complies to this hash collision, flash it, and qfuse will not be able to tell the difference.

Thats my theory on exploiting the fact ARM needs to do its computations in an area that is accessable to the debug interface. Of course my theory falls apart if the TrustZone chipset has its own processor.

I'd be okay with writing such guide as long as it followed community guidelines. I should not be posting disassembled code and analysis if it's against the rules to do so. If a mod could clear this for me....
[LG G5 Guides, News, & Discussion] LupineDream:
After searching around I located the true specs for the G5. It's a Snapdragon 820 SoC. It runs the new ARM v8A instruction set.

More detailed information here -> http://www.tomshardware.com/reviews/snapdragon-820-performance-preview,4389-2.html.

More specifically, it's on the msm8996 platform: http://system-on-a-chip.specout.com/l/1170/Qualcomm-Snapdragon-820-MSM8996

Phones with this arcitechture: https://www.kimovil.com/en/list-smartphones-by-processor/qualcomm-snapdragon-820-msm8996

Xiaomi Mi5 has official bootloader unlock via a tool (reverse engineer to work with our platform?)

HTC 10 bootloader on certain models can be oem-unlocked.

Lenovo ZUK Z2 bootloader can be oem-unlocked

LG V20 bootloader can be oem-unlocked, and is the closest in hardware to our G5!

Perhaps stealing a kernel and boot from a similar varient that allows it, signing it with our key, hash-matching it? It all runs on the same platform with the same instruction set. Most of these phones have unlockable bootloaders.

I'd say the best target would be that unlock tool by Xaoimi. Its usually the third party vendor's tools you can find the biggest security holes in. xD From their documentation, it isn't an "enable OEM unlock" switch in Developer Options used to enable the unlock, the tool itself actually works on the bootloader. Perhaps the tool uses a feature of the MSM8996 we aren't aware of. It's worth looking into.
[LG G5 Guides, News, & Discussion] thecubed:
Hello again!

Regarding your points:

JTAG is disabled on most production devices, as in 100% inoperable. No amount of soldering will enable it. I'm sure there are some exceptions to the rule, but in this case I'm fairly confident in saying that the JTAG interface on the G5 is unusable.

...even if JTAG was enabled, the Qualcomm Secure Boot stack is designed to protect itself from the exact type of attack you're describing here. The component of TrustZone that is doing the verification of boot images is not running in anything that is JTAG-accessible, and to my understanding it's not even running in the main ARM core.

Re: hash collisions and neural nets... What you're describing sounds neat in theory, but in application (again, to my knowledge) won't work. I suggest you read up on how RSA works.

RSA is public/private key cryptography - in this case, the certificates contained on the phone are the public component, and LG/Qualcomm are the only ones with the private component. "Extracting the CA" will yield the public portion that is only useful for verifying signatures, not signing them.

The only way you'd be able to sign anything and have the phone trust it is to either a) replace the CA on the phone (not possible, it's burned into qFuses) or b) obtain the private component of the CA or any of it's subsidiaries (also burned into qFuses)

CA chains aren't encrypted, they're just a list of things that the device will accept a signature for. In our case it's Qualcomm as the Root CA, then LG as an intermediate (and possibly a few other intermediates to allow OTA updates to come from differing builders/engineering teams within LG). Again, extracting the 'hash' of a CA will do no good here, as there's no meaningful collisions that can be generated and still be a valid boot image. I'm not the best person to explain RSA in depth, so I'd really recommend doing some further research on it.

Bootloaders for other phones will not work on our phone, as of course it'll fail the Secure Boot check.

Bootloader unlock tools for other phones will not work because they're relying on manufacturer specific unlock code that's compiled into aboot (LK). Qualcomm's CAF version of LK doesn't include any unlock code checking functionality, so most manufacturers add that themselves.

LG, in this case, is not even including the code for a bootloader unlock in the US model bootloaders. If you're familiar with C, essentially LG has `#ifdef`'d the entire section of code out (including fastboot).

The V20 bootloader does indeed contain oem-unlock code, but Secure Boot will prevent you from flashing the V20's bootloader (even if it magically was code-compatible with the G5) because Secure Boot checks the hardware ID that's burned into qFuses.

This means, to add a bootloader unlock, you'd have to modify aboot, which can't be done because of Secure Boot. Secure Boot components can't be modified because of RSA, and the RSA verification can't be altered because the keys are burned into qFuses.
[LG G5 Guides, News, & Discussion] LupineDream:
So in this case, what would be the next image in the stack that would allow any kind of modifications? Should I be looking at boot.img instead? Would there be a method of tricking the signed and secure boot chain into believing what it sees isn't executing as root?

had been looking through some old methods of root, like causing a boot error by zeroing laf or flashing over it, causing the bootloader to drop you into fastboot, booted securely from there you could call a kcal perameter of the stock kernel that allowed a sort of debugging mode with systemwide root. That exploit was in the G2 era, and how that device obtained root.

I've seen a method that causes Knox to lock up on some Samsung devices by overloading its memory addresses or repeatedly zeroing certain bits of RAM.

I'd really need to find out what method works. If you can't make any modification, maybe there's a workaround to make it THINK everything is legit beyond the boot chain.
[LG G5 Guides, News, & Discussion] alphawolves:
aboot decription

Ok I have been working on an lg g5 vs987 myself and I got to the recoding the aboot part and was totally lost its all encrypted and I have no idea where to start to even see what the code is really saying I am new to this website and I am also new to coding on android if you can guide me in the right direction I might be able to help. I have always dreamed of being a part of a development like this and now I might have a shot. Thank you so much for your work and I hope to hear from you soon! :D