yashsingh1/xdaforums huggingface dataset:
[One (M8) Q&A, Help & Troubleshooting] byonykx:
Hi there.

I've got a SH Htc One M8 from someone. All that i know about the phone is that it had Android 4.4.4 version when i got it. I managed to upgrade the software to 5.1. But I read that Htc One M8 can be upgraded to 6.0 version. I couldn't do it (software is up to date message), so i went to a service and asked then to do it. After i got it back, i saw that when i start the phone, a Sprint logo is showing which was something new. After some time i found here updates to 7.1 (crdroid, aosp or aokp....) and they worked fine. (didn't notice the signal problem). But i love very much Sense Home so i wanted to get back to 6.0 stock version. I didn't knew anything about CID, MID, hboot then... After some reading, i managed to install 6.0 version with CID from Sprint. The problem is that my phone is LTE capable (should work over 4G network) but as i can see, it works only with GSM/UMTS Only (I still don't know if i got these right)... Also, I was traveling from Romania to Holland and in Holland i was able to make phone calls but i wasn't able to use mobile data as i could in Romania. Everything works fine if I insert SIM in another phone from Holland so its not the SIM/Carrier. All settings are ok in the HTC (roaming, data in roaming...) so the phone is ok. I out of ideas. I don't know the original CID and MID. The charger that came with this phone was english. Any ideas?
[One (M8) Q&A, Help & Troubleshooting] redpoint73:
So what you are saying, is that you can't get LTE (4G), but you aren't sure whether you had 4G on the custom ROMs (CRDroid, AOSP, etc.) or not?
[One (M8) Q&A, Help & Troubleshooting] byonykx:
Well, i wrote a lot of details.... The issue is that i couldnt use mobile internet in other european country. And i dont understand why i cant use LTA/CDMA network mode nowhere even if my phone is capable. Could it be the Sprint OS?
[One (M8) Q&A, Help & Troubleshooting] tonyt3rry:
I remember having a similar issue and ended up reverting back to sense os myself
[One (M8) Q&A, Help & Troubleshooting] toyvo252:
Try searching for Network Operators, and then create a new APN: T-Mobile US, fast.t-mobile.com, with APN type: default,supl,mms. I deleted and recreated the APN and my mobile data started working again. Creating new seems to work better for me than the default after reset.
[Samsung Galaxy S7 Edge Questions and Answers] shunil.scorpio01:
Guys when i press the home button it takes 1 sec then .. comes to home screen really annoying .....any solution m on stock exynos
[Samsung Galaxy S7 Edge Questions and Answers] thebiggboss180:
u can stop the effects from the developers menu or make them all to 0.5 sec
[Samsung Gear Sport] kontaxis:
Hello all,

do you know whether the 'remote connection' is only for users that have Galaxy phones?

I bought a Samsung gear sport and I'm trying to remotely connect to my phone (via wifi), but with no success. I use OnePlus 3 with the latest official ROM (Oreo).

I have tried to connect from my watch remotely to my phone many times, but it is impossible. I know that the watch connects to the wifi and gets internet access, since I downloaded a watch face from the Galaxy app store with the watch connected only to the wifi.

I was convinced that I was doing something wrong, but when I did a reset to my watch and then connected it to a friend's Galaxy S8, the watch connected remotely with no problem.

This makes me think that it is something on the OnePlus ROM that prevents the watch to connect to my OnePlus 3 remotely?

has anyone (with a non-samsung phone) managed to successfully connect remotely via wifi?

I hope this function is not only for Galaxy users
[Samsung Gear Sport] Shiota_Teito:
I was having the same problem with my One Plus 3T, so I messaged Samsung and got this response.

I didn't really feel like that would do anything for me since I thought it sounded like they thought I was using a Samsung phone.

But I later tried turning on Bluetooth on my gear sport, then I tried pairing it with my One Plus 3T like I would any other Bluetooth device. To my surprise, it was able to find the watch. Afterwards, I then went into the Samsung Gear app and tried the setup again and this time it found the watch pretty much instantly.

I don't know if this will work for you but I can only hope :)

EDIT:

Also I'm using the latest open beta version of Oxygen OS.
[Samsung Gear Sport] Mega Maniac:
By 'remote connection' do you mean the automatic connection between the watch and phone which shares notifications?

If so then yea, I have a Nexus 6p and it connects fine. As the above poster noted you do have to have the bluetooth on and pair it with the watch manually during the set up.
[Fire General] DragonFire1024:
In various thread scattered around the Fire and Kindle forums here on XDA, I talked about the possibility of decompiling an Amazon system APK, modifying the contents such as settings for the framework or changing permissions in an attempt to escalate privileges to some degree, maybe even root. I ran into several issues when attempting such a thing:

1) Using a PC, I found it almost impossible to successfully recompile a modified APK. Many of the tools like APKtool are just too complicated and missing even the slightest step will cause it to fail.

2) Surprisingly, I've had the opposite outcome using two apps. Using APK Export, I was able to export an APK from the system and use APK Editor Pro to modify permissions. I have been able to, on a consistent basis, use APK Editor Pro to decompile the Android Live Wallpaper system APKs to add or remove any permission from the APKs manifest. Installing the APKs did not result in getting them into /system/priv-app on my HD 8, but all modifications held over and over. But every time the signature is ruined, and installing as a system app fails again.

Janus can help escalating permissions even further when using the above method and maybe others, to modify system APKs. The question is: Can we use Janus to modify an APK in some form, to install an update to an Amazon system app, which would on install, execute code that would install SU binaries? What about any other known exploit patched or not? Could we fake the system into thinking a one-click-root app is a system app and install it? Link to XDA article.
[Fire General] Robius:
This is a good point. I brought up something similar a few months ago in another thread.

With all the exploits discovered this year where's someone trying these exploits on this hw sw combo we have with FireOS.

Where's the fuzzer for all the system calls while trying the known exploits?

Where is the systematic approach to testing these from the pedants on the forum?

Sure you can reply with the usual comebacks, but try a different approach instead of more of the same.

With ❤️
[Fire General] DB126:
Totally agree! Those selfish tech elitists who put real life above the desires of strangers. They should dedicate themselves (without compensation) and their community resources to methodically crack this very important nut. Ya know, because exploiting a $50 entertainment gizmo should rise to the top of THEIR priority list. Sorry sweetie, daddy won't becoming to any of your soccer games this year; he has important work to do.
[Fire General] Robius:
My point exactly.

You spent enough energy to respond to this in a sarcastic manner. Thank you
[Fire General] DB126:
Time well spent; appreciate the opportunity to respond in kind.
[Fire General] Hallo32:
I have seen a bunch of hashes running through the terminal last time. Amazon may compare the hashes of the apks against a whitelist.
[Fire General] Adyatan:
All right, I am ready to take this exploit on my 5th Gen. What I have to do??
[Fire General] DragonFire1024:
I haven't sat down and looked into this too much so I'm not sure how to execute the exploit yet.

The idea I had been working on months ago was to somehow insert SU binaries into an Amazon system APK, and get it to install the modified APK as an update to an existing system app. The issue back then was the signature getting destroyed. If we can modify an Amazon system APK to contain a script to execute installation of SU binaries, the exploit might allow the APK to install as an update to an existing Amazon app and in theory install the SU binaries. Based on what little I've read, we would have to either 1) modify the existing DEX file of an Amazon system APK to contain code/script to install SU binaries or 2) create a new DEX file with the code and replace it with the original. My opinion is a better chance at the first method.

Now how to do all that using the Janus exploit? I do not yet know.
[Fire General] DragonFire1024:
"An attacker exploiting the flaw could replace a trusted application that already has high privileges, such as a system app, with one of their updates to abuse the permissions that have already been granted. This could enable the attack to access sensitive information stored in the devices or enable the attacker to seize control over the device completely."

https://www.scmagazine.com/janus-vu...-android-50-devices-and-newer/article/713449/

So how would one go about updating a DEX file to contain 1) SU binaries that install upon 'updating' the app on installation? Or 2) clone a system app and edit or change the DEX file? 3) add an exploit script to a DEX file that would gain root (then you would install SU binaries and app)?

It seems the editing of the DEX file itself doesn't damage the signature and that's the nature of the exploit?
[Fire General] Asadullah:
Hey is it possible to modify the permissions ota updater and remove the internet permissions so it can't update

I just found this https://github.com/odensc/janus don't have a computer anymore or would try it
[Fire General] DragonFire1024:
I cannot recall if I've ever tried with that APK. I have tried with others, unsuccessfully. Either the APK will fail to recompile into a proper installation file, or it would 'install', but with none of the modifications holding.
[Fire General] DragonFire1024:
Android Flaw Lets Hackers Inject Malware Into Apps Without Altering Signatures

So we would need to write a script or other code that would be placed into a Amazon System APK. Now would we be able to add SU binaries to an APK? What about a root script like DirtyCow. Although DC is patched, would that be different if the exploit was installed into the /system-priv-app and then executed? I really don't want to sound dumb here so please help me pout guys. Any feedback, negative or not is appreciated.
[Fire General] Robius:
Maybe this tool can help https://xdaforums.com/android/software/tool-dex-manager-v1-0-designed-to-play-t2988532
[Fire General] DragonFire1024:
I can't find a working download link. Apparently it has been discontinued and i was directed to this: Uret Android Reverser Toolkit v1.6. I downloaded it.

I did find the other one but it says it's for a Galaxy Note. Not sure if that's really the case though.
[Fire General] Asadullah:
It's beyond my knowledge but if you were to maybe add a script to the dex giving it the permisions I gotta look more into this

---------- Post added at 04:13 PM ---------- Previous post was at 03:54 PM ----------

here's smali baksmali for editing dex files https://github.com/JesusFreke/smali I havent used it in a while but used to work good
[Fire General] DragonFire1024:
Editing DEX is pretty much out of my league too. I wouldn't know where to start. I don't even know how to install or use the tool you posted.
[Fire General] Asadullah:
https://github.com/JesusFreke/smali/wiki/DeodexInstructions

It's really pretty simple used to use it take out the ads from angry birds and what not when it first came out. But it's easier said than done. If you do try first thing I would suggest is that you decompile then recompile to see if it works right the dependencies sometimes will get you or we can try and beg another developer to make us a modified apk..... Please pretty please with sugar on topwe'll like all your posts???
[Fire General] Robius:
Check this thread for root possibility:

https://xdaforums.com/hd8-hd10/general/complete-guide-root-hd7-8-106th-gen-t3545411
[Fire General] DB126:
FYI - nothing new in that thread. Same familiar tools/techniques targeting a different gen/suite of Amazon devices. Similar outcomes too. Vulnerability patched in FireOS 5.3.2.x as so far proven impenetrable by generic rooting tools of common origin (KingRoot, KingORoot, etc).
[Fire General] Dan_firehd:
Not sure if the following report is true: (HD10 7th Gen on 5.6.0.0)

https://xdaforums.com/hd8-hd10/general/rooted-fire-hd-10-7th-generation-t3718629
[Fire General] DragonFire1024:
I might have to reset my HD 8 and let it update to 5.6 to try.
[Fire General] t3chwizard:
Maybe we can get a bootloader unlock from this? Is that what you're saying?
[Fire General] DragonFire1024:
No idea. That's putting the carriage before the horse. We haven't even gotten an APK modified and you're talking about the bootloader already lol.

First if anyone who knows about this stuff could chime in. [MENTION=4267571]sd_shadow[/MENTION] maybe? Is inserting SU binaries and or the script to execute them even possible via DEX modification or other modifications? I've decompiled a lot of APKs, but the one thing I never touched was the DEX.

When I was attempting to install stock Android live wallpapers into my HD 8, I noticed the permissions XML file to allow live wallpapers was already present in the tablet. But Amazon chose system over signature so I couldn't get it there. I was able to successfully add and remove permissions from the live wallpapers APKs and install them with the modifications holding, just not in /system. Perhaps editing the DEX of one of those APKs might allow it. Given the ease of the ability to edit these APKs, that's where I'd start
[Fire General] Asadullah:
I might be misunderstanding things but it's four in the morning? Your trying to take live wallpapers from a different device and install it into system? My move if I had one right now would be to take the fire launcher apk for instance ( it is universal across devices) from system run the janus python exploit on it to create an apk with no modifications to see if it installs normally. It won't go to back into system obviously but it will retain its permissions.

If that works go from there.

I did find this https://spflashtool.com/ I know they started to support the mt8127 CPU in 2017 models but don't know if it works on Amazon devices or not
[Fire General] DragonFire1024:
Yes I was, though it wasn't that late where I live lol. The purpose of doing that was a half successful attempt to at least successfully alter a system APK, but not being able to execute it in system. Proof of concept that even beyond the DEX, a copy or clone of a system APK can be altered quite significantly without destroying all aspects of identification through the System. Some parts when altered, destroy that and other code inside the APK. Live Wallpapers were easy to start with. They contain a lot less things we can damage beyond repair. Now we just need to successfully complete the last half.
[Fire General] Adyatan:
How can the last half be completed and did the live wallpaper worked?
[Fire General] DragonFire1024:
Android live wallpapers have a permissions file in system (I forget exact path) that specifies whether or not the live wallpapers need verification through 'signature or system.' 98% of devices these days have a permission XML which specify the wallpapers be installed into the system as opposed to just verifying signatures because of exactly the type of thing I've done to APK permissions. An attacker would essentially insert malicious code into the live wallpapers APK in an attempt to hijack certain parts of you device and information etc.

Again my wallpaper project inadvertently proved certain parts of an APK outside of the DEX can be drastically changed without affecting the signature. Now we just need to find a way to append code and script and whatever else to the DEX of an Amazon system app/APK successfully so we can reinstall it as and update to the existing one and get root access.

EDIT: live wallpapers did not work. However I was able to get two or three to sorta run as screensavers.
[Fire General] Asadullah:
My bad I'll keep my big mouth shut I was always terrible at chess and shutting the he'll up. ???
[Fire General] Adyatan:
Everything has to be done as fast as possible, I'm afraid that Amazon might release a patch for this in few days!
[Fire General] DB126:
Yep - they should respond quickly if it's an exploitable vulnerability (as appears to be on the HD 10).
[Fire General] razers7t8:
I have a 2017 HD 10 and I want root and exploits etc... Ideally I want to install a custom room on here that completely gets rid of everything Amazon... Lol. If there's an exploit, what do I need to do to ensure it's not patched on my device?
[Fire General] DragonFire1024:
In theory, wouldn't the Kingoroot cloud attempt to learn from this? Try to adapt the apps root process for other 5.6 devices?
[Fire General] DragonFire1024:
We need to find out what was exploited and how before we can write a script or modify an APK.
[Fire General] Robius:
As the rooting attempts are done on device, one can save the files that are copied over before cleanup occurs
[Fire General] DB126:
I suppose; depends if they see a revenue opportunity which would be driven (in part) by the expected population of exploitable devices. I personally don't believe the KingRoot "cloud" is an AI platform. More likely a simple repository of known vulnerabilities and associated exploits that is updated by a small team with nefarious intentions.
[Fire General] Asadullah:
[IMG="madden!!"]https://media.giphy.com/media/J5jmQF8IwNS6Y/giphy.gif[/IMG]
[Fire General] Adyatan:
Any updates, I'm excited cause I don't have a PC right now!!
[Fire General] DragonFire1024:
So far I've noting new to report. This weekend I will have some time to sit down for some hours and really look over stuff. With FireOS 5.6.0.0 being rootable at least on the HD 10, I'm definitely much more optimistic than I was a week ago about root on other tablets.
[Fire General] Adyatan:
Had anyone tried the method to root for HD10 on 5th/7th gen?

Janus may have the power to remove fire launcher as default launcher, have you tried that?
[Fire General] DragonFire1024:
There is, at least from what I read, no executable exploit to go with this vulnerability as of yet.
[Fire General] gabosius:
Just spent some time trying to root 7th gen fire 7 using the HD10 method. The findings are a bit interesting I suppose.

5.4.0.0 - root failed on multiple attempts (from KingoRoot PC app).

5.6.0.0 - (updated from 5.4.0.0 fully set up with google services and applications w/o factory restore) at first it froze at 3% for few minutes, then slowly it went up to 37% there it froze for 15mins, so I disconnected the tablet and closed the app. After that tried to run few apps which require root access - all of them reported no root access, root checker basic - no root access, advanced root checker - root access found (false positive I suggest, but still pointing somewhere). And afterwards had setting toggling issues which were solved after factory restore.

5.6.0.0 stock (with factory restore) - tries to do something, but freezes at 0-3%.

Update:

5.6.0.0 of both flavours (October & November) fails at 0-3%.

Tried to repeat the experiment which seemed promising using same/similar config - no success.
[Fire General] razers7t8:
How do you root a 2017 fire HD 10? I have one. Please tell me.
[Fire General] DragonFire1024:
KingoRoot for PC.
[Fire General] Dan_firehd:
How to root HD10 (7th Gen) with Fire OS 5.6.0.0

Follow this thread:

https://xdaforums.com/hd8-hd10/general/rooted-fire-hd-10-7th-generation-t3718629
[Fire General] laharl_22:
It work for fire 7 2017?
[Fire General] DB126:
No.
[Fire General] t3chwizard:
Luckily some of us are on the early BL where we can boot recoveries in fastboot
[Fire General] DB126:
Preemptive response to anticipated questions:

- the BL referenced above (5.0.x) is only available on early build 5th gen Fire devices

- not available on later 5th, 6th, 7th gen devices including Fire, Fire 7, HD 8 or HD 10

- there is *NO* path (rollback) to the 5.0.x bootloader if running FireOS 5.1.1 or above
[Fire General] t3chwizard:
lol Noob insurance right there
[Fire General] DragonFire1024:
There is a python script that creates an APK that's able to exploit this vulnerability. I don't know anything about python so if anyone can explain how this works that would be appreciated :)
[Fire General] t3chwizard:
Where's the script? I'm decent with Python
[Fire General] DragonFire1024:
I thought I linked it

https://github.com/odensc/janus
[Fire General] DB126:
You did but sometimes in-line links aren't obvious depending on the client used to access XDA content.
[Fire General] Adyatan:
Got an idea, what about creating a classes.dex file which does nothing and replacing it with Amazon apps. It would probably won't start them. So, it would be like a semi-disable. I tried with an empty dex file but got some error! May be you guys can do it!!
[Fire General] DragonFire1024:
Only a small bit of code can be added. Nothing significant. My idea would be to somehow modify the package installer in a way it would disable signature verification. I believe this can be done in a classes.dex or samli of the package installer. If it can be decompiled, modified and recompiled correctly, the code should be easy to insert...if one writes it. I would suggest and older version of the package installer, if there is one. Maybe a different one from a different amazon device. This is all speculation of course.
[Fire General] Adyatan:
All we need is a classes.dex file of package installer with the code regarding signature verification removed, right? By the way what does lucky patcher do? Doesn't it modify the classes.dex file?
[Fire General] DragonFire1024:
We can't talk about that app here. Im not sure what it does to dex files. That sounds just about right. I have no clue if it will work. Would need to be a package installer from an Amazon tablet. If at all possible, a little bit if an older version.
[Fire General] DB126:
Reinforcing point. While the tool has legitimate uses it can be (and often is) used to rip-off developers and perform other legally questionable actions. Mods carry a bigger stick if references to become part of the conversation. This isn't about censorship; it's upholding a reasonable standard and a condition of XDA membership (of course we all read the EULA [cough] when signing up...).
[Fire General] DragonFire1024:
BTW I have tested downgrading low level system APKs. I was able to downgrade Fire Launcher by using an older version of the APK. I can't find the post where I talk about it. So i know we can at least replace some system APKs. Now if we can just modify the package installer to the effect of not destroying the signature, we might have something.
[Fire General] Robius:
So we just need a patch written for a package of choice with the magic payload...and root
[Fire General] bibikalka:
Have we identified which system apks are the most promising?

We need something that has the most useful permissions. I nominate "DeviceSoftwareOTA.apk" - since it is able to put the update files onto the device, and re-launch it into recovery. That's pretty good overall.

Since enabling back DeviceSoftwareOTA can cause an unwanted OTA if one is not careful (:D), the genuine OTA updates can be disabled via the build number :

http://www.aftvnews.com/how-to-bloc...k-by-setting-a-custom-fire-os-version-number/
[Fire General] BeeWall:
Can you post DeviceSoftwareOTA.apk? My Fire broke so I can't use it, but I'd still like to help.