yashsingh1/xdaforums huggingface dataset:
[HTC U12+ Guides, News, & Discussion] szlevi:
Well, pics are here: https://www.facebook.com/events/449804178806883/

My impression so far is great, the more I use the phone I'm more and more glad I didn't procrastinate at all but jumped into it at this early chance... such an awesome phone! :)

Screen is great including *direct* sunlight, I've migrated over around more than 35,000 messages (80% SMS, rest are MMS), ~8,000 contatcs, a 500+ call history and so on - and it's still lightning fast no matter what I throw at it. :cool:

The squeezing thing is something I have yet to configure, turning up and down the volume with the 'fake' buttons is a bit unusual for me but it's probably because my old phone's buttons were so beaten I had to barely touch to activate them. Same thing with turning off screen, it's slightly more effort compared to my old beaten one's button so I just added a "screen off" fourth button to the primary bottom Android buttons.

Sound is *very-very* good, the included headphones are *awesome*, very good noise cancelling etc - this easily compensates for not having a dedicated jack anymore.

When using built-in speakers there is a very pronounced difference between *Music* and *Theater* - latter is very good for movies, really lifts out the dialogs.

The included charger is QC 3.0 which means you get to charged from almost zero to two-third in 30 minutes (official blurb is 80% in 35 minutes.)

However U12+ itself support QC 4.0 which suppose to give you 50% charge in 5 minutes so my first investment will be a strong (60W and up) QC 4.0 charger like this one: https://www.amazon.com/Charger-Tenker-Adapter-Macbook-Nintendo/dp/B0789F6FNG

I'll add more later, during the weekend I will have more time to test the camera etc.
[Galaxy S3 Neo Q&A, Help & Troubleshooting] migasbr:
Hello Everyone!

I have an S3 I9300 and I'm having some problems charging it. Looks like the USB port is damaged or broken in the inside.

In the meantime, a friend gave an S3 Neo I9301I and I would like to know if I can restore a Nandroid backup of the S3 to the S3 Neo.

Will it work or I might brick the S3 Neo?..
[Galaxy S3 Neo Q&A, Help & Troubleshooting] danieldeak70:
No, because it's different the specifications.(I mean processor, sensors, etc...)

But if you only talking the apps(so the backup only contains apps and files(music,videos,pictures, etc.)) maybe work(a big maybe)

If you just want to the apps try this: I "ported" the Helium Backup to PC

https://mega.nz/#!KU9XxAJR!4rtruDD4Wd-DNIl9PPDcX55pEDMqwhP6feueIi2BsYI

If I wrong please somebody indicate.(Thanks)
[Galaxy S3 Neo Q&A, Help & Troubleshooting] migasbr:
Thanks for the reply Daniel! I believe that apps and stuff should work. I'll do it with Helium or Titanium. But first I have to find a nice ROM for Neo... That's what I trying to avoid... :)
[Galaxy S3 Neo Q&A, Help & Troubleshooting] danieldeak70:
Oh and more thing(if you want try my Helium Backup program)...

If you use Backup(ALL_APPS) you can backup your all apps with one .ab file. So if you have 30 apps and you use Backup(ALL_APPS) it makes ONE .ab file (instead of 30... so the mobile version creates 30 folders... ) which it contains all your 30 apps. So shortly 30 apps in one file. :D
[Galaxy S3 Neo Q&A, Help & Troubleshooting] migasbr:
Hey! That's quite cool!! I've found a nice ROM for S3 Neo and will install this weekend. I'll give it a try with Helium! :)
[Upgrading, Modifying and Unlocking] Jaformhals:
I have gained all that I can from the internet regarding the bootloader, and fastboot mode. I successfully installed the drivers for the phone as per the computer recognizes it. But when in the command shell, after entering the command adb devices nothing is listed. The command adb devices is one of the few I know, I know little of commands for rooting the phone. Any help would be greatly appreciated.

Regards

P. S. I do have OEM unlocked and debugging mode enabled.
[Upgrading, Modifying and Unlocking] Ibuprophen:
I don't have this device but, the following threads may be helpful for what you are looking to do and don't be afraid to ask for some member guidance within one of them too.

https://xdaforums.com/showthread.php?t=3753185

https://xdaforums.com/showthread.php?t=3764914

https://xdaforums.com/showthread.php?t=3619426

Good Luck!

~~~~~~~~~~~~~~~

I DO NOT provide support via PM unless asked/requested by myself. PLEASE keep it in the threads where everyone can share.
[Upgrading, Modifying and Unlocking] Jaformhals:
Error in power Shell

Okay so it is now giving me an error code. the sequence went as follows: PS C:\adb> adb devices

List of devices attached

* daemon not running. starting it now on port 5037 *

* daemon started successfully *

CQ30009SND unauthorized

Again, any help will be greatly appreciated.
[Upgrading, Modifying and Unlocking] stuccamelo:
same here ... found solution?

need unlock bootloader on?
[Upgrading, Modifying and Unlocking] tesking:
I'm trying to flash my M800 bought in Italy with Country Code ITA (on booting screen is VER A42 ITA 040 0264 - 2008/01/15 15:59) with a new ROM from ETEN-Users forum with WM 6.1 cooked for M800. The new ROM is WWE edition. When I try to flash it (in bootloader mode or in soft bootloader mode) according to the procedure, I receive the error "OS Image is NOT compatible wit" (and I think "...with your hardware" as seen on other threads).

********************

USB Downloader 0024

Flash Capacity=256MB

USB Downloader Ready.

SD Card In

Find SDMMC Card.

File= TEMP BIN

Program Image from SDMMC

update OS Image

Please Waiting.

OS Image is NOT compatible wit

USB host is not connected yet.

*************

And it stops until soft reset. How I can workaround the CID check (Country ID unlock)? When I succeded on Himalaya a lot of years ago, I edited in HEX the ROM file... can u tell me how to edit and where, to let my WWE OS Image could be accepted by my ITA M800? Or can I use a different bootlader that wouldn't do the Country ID check?

thank's

Cristian
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] notaz:
It doesn't trigger because the exploit itself is broken:

@@ -280,7 +280,7 @@ void *callrename( void *ptr )
char enter = 0;
char origname[1024];
char longname[1024];
- char next_ptr[8] = "\x30\xff\xff\x31\xff\xff\xff\xff";
+ char next_ptr[9] = "\x30\xff\xff\x31\xff\xff\xff\xff";
char prev_ptr[8] = "";
// This value will overwrite the next (struct fsnotify_event)event->list.next

With that it should work (not tested though).

Elevating through heap/slab overflow is not going to be straightforward though. As the redhat description states, we could redirect the free list pointer to userspace and provoke the kernel to put some function pointers there for us to modify, but as soon as a context switch happens the system will crash and burn. I guess easiest way would be to combine this with some older heap overflow exploit, assuming such thing exists (haven't looked)...
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Thanks, your change really made it working:

G8441:/data/local/tmp $ ./exploit
Listening for events.
Listening for events.
alloc_len : 50
longname="test_dir/bbbb32103210321032100��1����"
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
...
handle_events() event->name : b, event->len : 16
Detected overwrite!!!
alloc_len : 50
callrename done.

So this could be a way after all even though not easy.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
It has been done already, oreo root exploit is existing and it uses the CVE-2017-7533 (race between inotify and rename) as a starting point. Unfortunately the exploit itself is not released yet.

There are slides explaining basics about the exploit available:

asia-18-WANG-KSMA-Breaking-Android-kernel-isolation-and-Rooting-with-ARM-MMU-features.pdf

It continues even with a lot more interesting second stage exploit which mirrors kernel space memory for user space access using forgotten/overlooked feature of arm page table (address translation) setup.

Not sure when the exploit may be released - they are probably holding it back intentionally.

I guess that it will not be released for a long time because the Kernel Space Mirroring Attack is a totally new vulnerability (probably even without CVE yet). So they wait first for CVE assignment and then wait for google to release a fix and wait even more to allow vendors to deploy it to customers.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Yurienu:
There are patches to KSMA being discussed on LKML since May 29th so things are moving on.

There's also a demo of the exploit here: https://youtube.com/watch?v=2zGTEv-iUOY
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] albmanzi:
I'm sorry I can't help because I lack the skills to, but I will sure pay the amount I pledged in the DRM key backup/restore bounty thread, if you manage to pull it off and allow also non developers to do it!
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Here an advise: anybody who likes to keep a possibility to backup drm keys should disable all updates so that the fw version stays at the one which a phone was bought with.

It is possible that Sony would disable downgrades since particular version - that is after all a google's recommendation for vendors:

google-urges-smartphone-partners-support-android-oreos-rollback-protection

And download the oldest fw version available (do not care about customization not matching your phone original) to have it handy in case Sony pulls the fw off.

It would be useful if anybody who already upgraded to the latest fw version tried if it is still possible to downgrade for example to the 47.1.A.2.281 discussed here and report the result.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] moofesr:
[MENTION=4418980]j4nn[/MENTION]: Are all your observations so far specific to the XZ1C? As the exploit itself isn't inherent to the XZ1C, might it be worthwhile to crosspost this to the XZ1 and XZ1 Premium forums? The more eyeballs you can get on this idea, the better.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
right, it may be useful - the mentioned vulnerabilities are not hardware dependent. In case of xz1 and xz1p, the same kernel source branch is shared differing only in kernel defconfig, changing hw dependent options.

Basically any oreo device which could be flashed with fw containing the mentioned CVEs could possibly use them to get temp root.

But I have only xz1c, this is what I can test with, so that's why it is posted here.

Feel free to link to this thread to get possibly some devs who might help to implement the exploit(s).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
An interesting find: the kernel from 47.1.A.2.281 fw has following option in it's config:

CONFIG_CC_STACKPROTECTOR_REGULAR=y

It seems that this is changed to STRONG variant since 47.1.A.3.xxx firmwares.

That means stack based kernel exploits could still be possible with the 2.281 fw - for comparison in linux kernel:

- regular: 1015 of 36110 functions are stack-protected (2.81%)

- strong: 7401 of 36110 functions are stack-protected (20.5%)

Just for reference - following options are enabled:

- CONFIG_ARM64_SW_TTBR0_PAN: Privileged Access Never (PAN) sw emulation

- CONFIG_DEBUG_RODATA: Make kernel text and rodata read-only (Post-init read-only memory)

- CONFIG_RANDOMIZE_BASE: Randomize the address of the kernel image (KASLR)

- CONFIG_HARDENED_USERCOPY

- Privileged Execute Never (PXN) is obviously integrated by default (preventing user code execution with privilege mode)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SilverGamer_YT:
When you talk about xz1p is the Sony Xperia XZ Premium , no?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
Yes, same Yoshino platform (even though maybe it would be a tad easier to work on Premium, due to it having nougat too)
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] SilverGamer_YT:
If we have already unlocked bootloader we cannot backup our drmkeys
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=7306291]SilverGamer_YT[/MENTION], obviously no way if already lost by official unlock

that's right, but on the other hand, useful only for that device.

I am wondering - there is no temp root yet for the Premium if it had nougat?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] mirhl:
Lowest patch level I could find is April (compared to August of XZ1)... Which a pretty hard target still.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4900593]mirhl[/MENTION]: it's strange that temp root is still not available for xz premium, considering it has nougat fw available.

The kernel is v4.4.21 in that fw and it does not have hardened usercopy, does not have privileged access never and also uses only regular stack protector. So it really would be easier, but it would not help devices that have only oreo fw (and only newer kernel with more mitigations integrated).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
I feel we may be able to get temp root.

But what about that TA/drm keys backup?

Is here anybody who knows for sure that having temp root is enough?

Would not we be faced then with another security feature like trust zone / trusted execution environment from which it would not be possible to extract the keys?

I mean exploiting linux kernel is one thing, but exploiting TEE would probably be lot harder (if not impossible).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Raz0Rfail:
As far as I know the system partition is signed and as soon as files or permissions are changed there you can't boot the phone without reflashing the files, because the boot process checks if the partition is signed correctly.

Furthermore you cannot make kernel modifications with the closed bootloader, which are essential for Magisk.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] notaz:
FWIW I have 47.1.A.12.145 1310-4373_R6B (Customized DE) here, locked and with all keys intact, can try things but I'm a bit reluctant to do anything destructive.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
I guess you are currently the best candidate to test if downgrade to 47.1.A.8.49 fw version would remove the Android Attest Key or not.

You have CE1 version on the phone and the fw to be downgraded is available easily only for CE1.

So the probability that the key is kept is the highest in your case. The other two guys offering to test the downgrade have both DE customization (so we could not tell in case key is lost if it had been due to downgrade or due to switched customization).

In any case, I am afraid all those 3 keys would be erased with sony unlock (just my guess, I do not know that).

That means even if it was not lost with the downgrade, we could save it only if it would be stored in the TA partition - we would have the chance to check if it was in TA or not. Currently that is unknown.

But it seems that SOMC FIDO Key and SOMC Attest Key were both not stored in the TA as restore of the partition did not recover them (unless they are only disabled via 'unlocked' flag and would still be present in the phone).

The best variant would be if there is anybody still running 47.1.A.8.49 or older fw (and have not ever downgraded or simply has all those 3 keys provisioned).

That would provide the best chance to find if we can backup them or not.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
I just noticed that my paypal account received a first donation ever.

I need to say: thank you, you know who you are - you are the first one and the only so far.

A first donation to me in my life - I guess that's a reason to get a drink ; -)

It is not that I am hunting donations, my motivation to implement this was just personal frustration of losing camera if unlocked. And the challenge to implement my own first exploit.

It certainly is warm feeling to see some appreciation.

Thanks to the first one and to all that follow.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] tramtrist:
I'd like to report in real quick on what's working.

After following [MENTION=4418980]j4nn[/MENTION] very clear instructions and backing up/restoring my TA keys I was left with the NOT PROVISIONED messages he mentioned earlier. However this seems to be no problem as after TA-restore my camera works as it did before. I'm also able to use WIDEVINE sites which require that key as well.

After restoring TA I went ahead and flashed the latest UK customized firmware

I then flashed TWRP latest version 3.2.3

I wanted to have root so I flashed Magisk 1.73 and safety net worked without me having to do anything special.

Google Pay could be set up and seems to be using my credit cards just fine.

I didn't flash any custom kernel as stock is just fine for me.

Adaway is working with root without issue.

All-in-all if you follow [MENTION=4418980]j4nn[/MENTION] instructions when he's ready to fully release them to the public then I'd say you will be in good shape.

I'd like to thank [MENTION=4418980]j4nn[/MENTION] for giving me the chance to finally contribute something concrete to this community. If you're gonna use this you should drop him some cash.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Wyzco:
You deserve it and more [emoji1474]
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Thank you very much for all the testings.

Particularly that you have exposed your phone to risk of loosing drm if it did not work, that deserves a special thanks!

Guys, please be patient, I will need some time to implement support for the other phone models, like the big XZ1 and possibly also XZ Premium - as mentioned, it is not trivial task (involves reverse engineering work of target kernel binary which is different for each phone model).

Then I would release it.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] rsk_kelkar:
Great job [MENTION=4418980]j4nn[/MENTION]. Appreciate the effort. For those who have already unlocked their bootloader, can there be a hack to restore somebody else's TA backup and appear like bootloader was never unlocked?

I ask because I remember we had such a thing for an older phone I owned. Can't recollect which one
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Almar033:
Thank-you for your great work.

FYI I checked my xz Premium, never downgraded nor unlocked, and saw only two keys: SOMC FIDO and SOMC attest key, no Android security key
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=5628266]Almar033[/MENTION]:

Interesting. I guess that XZP does not have Android Attest Key because that's something google introduced with oreo?

And xzp started to sell with nougat?

In my opinion not possible. There seems to be lot of things stored elsewhere than TA and tied to IMEI.

But it's just an opinion. I do not know it. Certainly it may be a very dangerous test with possibility to get a not recoverable brick.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] wyt18:
Thanks for the update, great hope for all of us :)

Were you able to install xposed?

What would the process be to update future stock rom releases?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] notaz:
So I've been an idiot done some experiments flashing between 47.1.A.7.1 and 47.1.A.12.145, both of 1310-4373_R6B (Customized DE) localization. The former was downloaded from somewhere and the later saved by myself using XperiFirm when it was current. Starting point was 47.1.A.12.145 1310-4373 updated over OTA on the day I bought the phone (foolish, I know).

flash only kernel and fotakernel .sin from 47.1.A.7.1 -> Sony logo reboot loop

flash the above from 47.1.A.12.145 -> system back to normal, all keys intact

flash kernel, system, oem, vendor from 47.1.A.7.1 -> Sony logo reboot loop

flash the above from 47.1.A.12.145 -> system almost back to normal. After booting and working for a minute or so there was a sudden reboot. After that it booted normally, but it asked if I trust my PC for adb again, so something definitely changed. However service menu still showed all keys intact.

flash all 47.1.A.7.1 .sin except boot, partitions, userdata and appslog (naive attempt to retain user data) -> Sony logo reboot loop

additionally flash userdata and appslog -> factory reset behavior, shows 47.1.A.7.1 version, attest key not provisioned

flash 47.1.A.12.145 except boot and partitions -> factory reset behavior, attest key not provisioned

flash 47.1.A.7.1 again and do OTA to 47.1.A.8.49 -> attest key not provisioned

My guess is the attest key lives in some partition, userdata perhaps, and factory reset knows not to touch it. Clearly the change of customization is not the main cause as I'm sure I avoided that. I wish I had flashed back to 47.1.A.12.145 after experiment 5, but I was getting impatient. Ohwell, hope this will be useful for somebody.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Thanks for this test, I guess that seems loosing attest key is connected to any downgrade and most probably not connected with change of customization.

That narrows the testing only to someone who did not accept over the air upgrades and stayed on 47.1.A.8.49 firmware or any older one, still having the Android Attest Key PROVISIONED (and still has the phone locked).

Is here anybody like that please?

It would be interesting to test, if we can backup that key and possibly try to restore it for other devices, that already lost it (it might not be tied to device/imei/sn/..., but I do not know that).
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Shahnewaz:
Just to be clear, the only way you get that key back is if you full-flash to the latest firmware?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
I am afraid not. Most likely you can't get it back any standard way.

Only chance might be if we managed to retrieve it from a device with exploitable fw but even in such case it depends if the key is universal or if it is tied to device.

That is why I am asking if there is anybody here with still present Android Attest Key and running the 47.1.A.8.49 fw (or any older).

Anybody please?
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] thefelineofaveb:
I changed the region of my XZ1C as soon as I got it, never performed a downgrade, always updated via OTA and my attest key is not provisioned, so I guess it is somehow connected with customization, too.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] t020608:
Same thing happened to me:(. My phone's firmware region was originally Customized TW. I flashed Customized DE and now I have "Android Attest Key NOT PROVISIONED". OTA system updates have been coming regularly though.
[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Meloferz:
Link above is the information that I found about Fido key and android attest key (about SOMC attest key I suposed that is the same as the Android attest key, but the difference could be that is certified but Sony and not Google)

https://developer.android.com/training/articles/security-key-attestation

https://www.yubico.com/solutions/fido-u2f/

Hope it helps