yashsingh1/xdaforums huggingface dataset:
[General Topics] c0rnholio:
Some clarifications

Well, I received my brand new raphael two weeks ago and guess what, the values set by HTC by default are even more worse.

They set 4108 (0x100c) to 0x840

and set 4109 (0x100d) to 0x40

These means in detail:

Accept WAP Push Service Load Messages orgination from authenticated and trusted PPGs (Push Proxy Getways) AND any.

Accept WAP Push Service Indication Messages origination from any.

Hell, I informed HTC a long while ago about these issues, I wrote them several mails but all I got was some standard response like "Thank you, we will look into it".

However some may say:"Hey that's not that worse, I have opera set as my default browser and opera asks me each time what I want to do with this automagically downloaded file, so I'm safe as I always click on drop or simply close my opera window."

Well, since this is fine for people who "know what they are doing", but is is not for or these other people around there taht are using these devices and even don't have clue about what WAP Push is or what a security policy is or simply don't mind on clicking "accept" each time a message pops up ( and trust me when I say there are more people like this out there as you may guess).

Imagine the following scenario:

A malicious freak sets up a domain which is called www.htcupdateservice.com and hosts dangerous files on that domain. Now he sends out WAP Push SL messages to normal users of Windows Mobile phones with these faulty settings with the text:"HTC has to inform you about a critical security update. Download it at http://www.htcupdateservice.com/Update3.6.9.exe"

What do you guess what enough people out there will do? Do you really think that most people that are not trained about security won't click on execute or download in their opera browser?

And what about people that dont have opera set as their default browser? You guessed right, the file will be downloaded and executed without user interaction. BOOM...

Here's another scenario:

Imagine a security vunlerability in opera mobile is discovered that can be exploited if the user visits a malicious webpages. You can guess how someone can force the user to visit this infectious webpage, can't you? ;-)

Or, let's say a malicious freak on the net sets up a webpages that utilizes CSRF attacks, or XSS, or whatever web based attack you may know. Using WAP Push SL messages he can force your browser to become the attacker and the victim with only one message.

It's up to you to care about this or not since HTC doesn't seem to care.

Cheers
[General Topics] Desigen:
Hi,

It seems that the value 0x40 for 0x100d working well for me I received notification and the message stored in the inbox, any idea !!

But I don't know who changed the both value to be 0x480 & 0xc00

Something to mention, two weeks ago I received my first WAP-Push but it was sent from unauthorized source !
[General Topics] c0rnholio:
It seems you misunderstood me, or I'm simply not getting your point here.

Yes, with a value of 0x40 for 0x100d you can receive WAP Push SI messages from anyone. This might become a risk. The secure setting for this policy is 0xc00. This will save you from unwanted SI messages but may block your providers ringtone messages.

The default values you had where set from HTC (or whatever ROM you migth have installed) with the delivery of the ROM that is installed on the device. That's the final point of the advisory. The ROM manufacturer has left the device open for these kind of attacks.

However a final word in our little discussion:

If you want to be able to receive WAP Push messages from an untrusted and unauthenticated source then leave the settings as they were at the beginning. Be warned as this may be a security risk.

If you don't want to receive WAP Push messages from untrusted and unsauthenticated origins, then change the values as described in the first post.

As a rule of thumb: If you want to receive these messages, even if they come from untrusted and unauthenticated sources, but only want this temporary (for example if you know that your provider will send you a ringtone in the next minutes) then set the values to 0x40 each and after you received what you want reset them to the recommended values on the first post.

I'm out...

cheers
[General Topics] Desigen:
Thanks for sharing this usfull information with us.
[General Topics] benjimen:
I don't understand the value '0xc00' -- does that mean just change it to zero's? That's what I did using the registry editor... there were both 'hex' and 'dec' settings, with the 'hex' dword value appearing to be the one that needed fixing -- so I changed 0000100c to 800 and 100d to 0 -- is this right, or have I inadvertently instructed orbiting alien spacecraft to open fire upon earth? :eek:

Maybe screenshots, or a little more explanation on exactly what registry changes need to be made, I'm not used to ones with both hex and dec entries...
[General Topics] c0rnholio:
Sorry for beeing not that clear.

In the mentioned registry key HKLM\Security\Policies\Policies there are several DWORDs. You have to look for the dword 0000100c and 0000100d. These are the dwords which value have to be changed, not the dwords themselves.

So the dword 0000100c has a default value of maybe hex 0x840 (=2112 decimal). This value needs to be changed from hex 0x840 (or decimal 2112) to hex 0x800 (or decimal 2048).

The dword 0000100d has a default value of maybe hex 0xc40 (= 3136 decimal). This value needs to be changed from hex 0xc40 (or decimal 3136) to hex 0xc00 (or decimal 3072).

It may be the the default values are set to other, for example the default value for the dword 0000100d is set to hex 0x40 (decimal 64) on my raphael. It really doesn't matter what default values you have, you should det the to the above values. Under no circumstances you should change the dwords themself, say changing 0000100d to c00. You ONLY have to edit the values of the dwords.

I hope that was clear now.

Cheers
[General Topics] benjimen:
Right... I knew not to change the dword itself. The 2nd one is confusing though, though I got it with those instructions you just provided, thanks!
[General Topics] Desigen:
Hi,

I want to mention something. I can't receive WAP-Push message. my problem still excist. When I receive WAP-Push my mobile do some send/receive process, flash but doesn't give me any aleart about the WAP-Push, this happen to me HTC Kaiser Windows 6.1. my friend same device but Windows 6. My other friend, Imate K-Jam Windows 5.

Can you help me solving the problem.

Regards,
[General Topics] mnemonic83:
I've made a cab file that fixes the problem.

I've made an easily distributable cab-file that sets these keys to the microsoft recommended settings.

security.cab

Sourcecode
[General Topics] HBEAR:
I can't even to begin to fathom the smallest portion of what seems to be a passion with you. I am pleased though, that your wish to use your powers for good and not evil young Jedi.

Will standard mobile firewall programs address these issues?
[General Topics] kautilya:
In my HTC P3300, the value of both DWORDs is 64 (decimal) which is 0x40. What does that mean? Do I need to change that?
[General Topics] c0rnholio:
Thanks for providing the cab. I didn't even thought about that. This will help a lot of novice users to establish proper security. Great job!
[General Topics] c0rnholio:
...the dark site of the force is strong, but there is still light at the end of the tunnel :-)

I don't think that standard firewalls will be a lot of help here because they don't operate at this level. It should however be easy to intercept these messages at the RIL layer and stop/drop them before they reach the associated client, which is siclnt.exe. Maybe I can write something up like this when I find the time to do so, or someone else will come up with a similiar solution.
[General Topics] c0rnholio:
That means you are fully vulnerable (do you mind to give me your mobile number? :D ).

I encourage you to change these values.
[General Topics] kautilya:
Thanks for the info, changed them!
[General Topics] Desigen:
Hi,

Is there any suggestion for my problem. When I receive WAP-Push my cell flash but doesn't display any message about receiving an new message. I test this on many devices it seems that this is a problem with Windows.

Thanks
[General Topics] Iamgarion:
I really can't thank you enough @c0rnholio for the advice contained in this topic. For months I was receiving obscene texts from 'unidentified sender' with a link to download what one would assume was an equally obscene video and I was at my wits end trying to stop them - no call or sms blocker could stop them. in the course of desperately searching for a solution I came across this thread and since implementing the registry changes the messages have stopped, and I signed up here primarily to say a really big Thank You but hope I'll also be able to contribute in other ways.
[General Topics] lixo:
question about psuhing a .cab installation file

thanks for your hard work c0rnholio.

I have a question? What if instead of a .exe we attempt to push a .cab file?

Will it install it also?

Thanks again
[General Topics] c0rnholio:
No, this won't work.
[General Topics] southie:
Well gonna try out these settings. I want to stop wap push message completely. I simply don't want them. Thanks in advance (before even trying these settings) for your kind effort.
[General Topics] pers001:
From where are you getting these alerts, MSDN? I'd like to get in on receiving them
[General Topics] southie:
Still getting wap push messages. I changed registry settings to microsoft default but no joy. I am still receiving wap push messages. My telecom customer care is totally crap and jack**s. They are suggesting me to do settings which don't even exist in my set [HTC HD2 (LEO)] but Nokia has those settings in their sets and that settings is info service message setting (atleast what I think after talking to my telecom customer care).

Is there any other method to completely stop these bulls**t wap messages. I desperately waiting for the settings for my set as these messages are quite annoying and I am getting 2 messages per day.
[Xiaomi Redmi 5A Guides, News, & Discussion] pyumredkar:
Hello dear modders,

making gcam work in miui 10 global is somehow a challege to us.

Enabling camera2api from the build.prop file does not work.

but as a developer danzblue in the miui forums have gave us the magisk module to enable the gcam support in our redmi 5a oem miui 10.

till the previous nougat base it was working but now in oreo base his mod also does not work....(or alone!).

I have made the mod work in my redmi 5a in latest miui 10 oreo base.

just follow my steps below:

1) first of all you must be on the oreo base miui 10 latest global OCKMIXM

2) now reboot to fastboot mode:

power off device. now hold the volume down button, turn on the power and don't release volume button until fastboot is shown on display

3) flash or boot the twrp recovery

https://xdaforums.com/xiaomi-redmi-5a/development/twrp-3-2-3-2-riva-oreo-t3892510

4) flash latest magisk - https://github.com/topjohnwu/Magisk/releases

5) install magisk module from this link - http://en.miui.com/thread-4817920-1-1.html

6) reboot after installation complete, now your device might be in bootloop

7) restart to twrp recovery

8) perform factory data wipe, don't restart now

9) now goto twrp advanced - tools - enable camera2api- flash

10) restart and now you have gcam support enabled in your device along with miui 10 built in camera.

11) download gcam from this site https://www.celsoazevedo.com/files/android/google-camera/dev-suggested/

in my experience, gcam 6, only this version supported on our device https://f.celsoazevedo.com/file/gcamera/MGC_6.1.021_RazerPhone2_V2a.apk

but whenever I clicked the photo, app was force closed. (as my phone is 2gb ram variant I don't know the result of 3gb ram)

later I tried gcam 5 this worked fine for me https://f.celsoazevedo.com/file/gcamera/GCam-5.1.018-Pixel2Mod-Arnova8G2-V8.3b1.apk

you can test other versions and let me know

for further I will update this post for working list of gcam in our device.
[Xiaomi Redmi 5A Guides, News, & Discussion] sjcbank:
Working on EU-ROM 9.8.1 (xiaomi.eu)

1) Goto twrp advanced - tools - enable camera2api

2) Restart and installation MGC_6.1.021_RazerPhone2_V2a.apk

3) Enjoy
[Xiaomi Redmi 5A Guides, News, & Discussion] PLV10:
Hello, I'm a new user here :)

Thanks for the guide, but I have some questions about it:

1. Does this process establish root access?

2. Is it necessary to unlock the bootloader?

3. Will I loose all data in the phone?

Thank you very much.
[Xiaomi Redmi 5A Guides, News, & Discussion] elemefaaoo:
1. No

2. Yes

3. Unlocking bootloader requires wiping of data so :)
[Xiaomi Redmi 5A Guides, News, & Discussion] PLV10:
Ok, thank you for the information.

Today, I'm not sure what to do, beacuse I have the phone since april 2018, so it has a lot of data and apps :eek: I'm thinking about the possibility of istalling a custom ROM too!

Best regards.
[Xiaomi Redmi 5A Guides, News, & Discussion] elemefaaoo:
Whatever you want to do, installing custom rom or gcam you require to unlock bootloader, unlocking bootloader involves wiping your data, so backup the stuff you need to a PC or another phone or the cloud.

Even if you are trying to bypass bootloader lock it also involves wiping your data so :)

Backup
[Xiaomi Redmi 5A Guides, News, & Discussion] PLV10:
Yes, I can backup, but not ALL the information, let alone APP's settings. So, at this moment, I'n thinking... :confused: > I'll ask here at XDA if I have any doubt when I have made a decision.

Thanks. Best regards ;)
[Xiaomi Redmi 5A Guides, News, & Discussion] GetGankNow:
the night mode doesn't works.
[Xiaomi Redmi 5A Guides, News, & Discussion] Hitrock:
Does this method still works on miui 11?

If so what are the chances of getting stuck in bootloop while enabling camera2api? I have already rooted my phone with magisk
[Xiaomi Redmi 5A Guides, News, & Discussion] elemefaaoo:
Zero
[Xiaomi Redmi 5A Guides, News, & Discussion] Bhavesh_07:
Hello,i am a new user here ?

I have some questions about this :confused:

Can i download the gcam without any flash process ?

It requires flashing process before downloading the app?

Which version is required of gcam for redmi 5a?
[Google Pixel 3 XL Questions & Answers] GROOVYJOSHCLARK:
Probably NOT the right forum or location for this post but IDK where it should go so I am putting here (mods move if its in the wrong spot). I am a long time developer and user on XDA so I figured I would help someone who needs a case and offer it to the first person that responds. I have the following otterbox case for anyone who wants it, just pay the buck shipping, or whatever it comes to (I am in NJ/NYC). I bought 2 of them in a rush to protect my new Pixel so of course the less expensive one came first and I like it better (slim 8 buck - ESR Essential Zero Compatible for The Pixel 3 XL Case) on Amazon. I like this one better as it fits perfectly in my butt pocket and the otterbox version is way to chunky for my taste (but is excellent for absolute total device protection) otterboxes are fantastic for protection, its just to much for me.

View attachment 4800753

Its a 50$ case so the first user that responds they want it, its theirs (assuming they pay shipping), I am not losing more money to ship out a free case that already cost me 50$s. I cannot return it because I opened it so anyone that wants it, its yours (no strings attached, this is not a trick), I just help when I can!

https://www.otterbox.com/en-us/google-pixel-3-xl/symmetry-series-case/ggl28-pixel-3-xl.html
[Google Pixel 3 XL Questions & Answers] moxdaniel:
I'll take it
[Google Pixel 3 XL Questions & Answers] boe323:
Ill take it if the other dude doesnt want to pay shipping, depending on the shipping cost to UK
[Google Pixel 3 XL Questions & Answers] fury683:
I'll go third in line :)
[Google Pixel 3 XL Questions & Answers] GROOVYJOSHCLARK:
PM me
[Google Pixel 3 XL Questions & Answers] GROOVYJOSHCLARK:
I'm checking with the first guy, if it doesn't work out then you
[Google Pixel 3 XL Questions & Answers] NippleSauce:
If all else fails, I'll take it and use it while I work since I'm always climbing through ceilings. I'm also in NY, btw.

Anyway, just PM me if everyone else backs out! And thanks for being generous and giving away the extra.
[Google Pixel 3 XL Questions & Answers] GROOVYJOSHCLARK:
last time I ever do anything nice for anyone like this ever again. not only was I burned on the shipping but also for the case, I was giving it out for free but I lost on both ends, the guy either dicked me or it was truly stolen from his mailbox, either way, this will be the last time ever! I escalated to USPS as theft and police but nothing will come from it, its been over a month since opening it :(
[Google Pixel 3 XL Questions & Answers] wangdaning:
That is unfortunate, don't let it lose all hope though. I did something similar and sent a several hundred Euros to a young dev in Romania to get a new device. He bough said device so he could keep developing (I had the same device). I could see how your situation is discouraging though.
[Google Pixel 3 XL Questions & Answers] GROOVYJOSHCLARK:
Thank you for this reply, it helps.

I will also say, that my faith in humanity has been restored. A (stranger) XDA user who was following this forum and I have never met, "gifted" me enough dollars to cover the shipping and what was lost. She didnt have to do this and was out of the good of her heart just to restore humanity!

Thank you for the one who gifted me the money, I wont mention your name unless you want me to!
[Google Pixel 3 XL Questions & Answers] wangdaning:
The lord works in mysterious ways would be how my mom put it. I would just say keep being a nice person and thanks to the anonymous person. :highfive:
[Fire TV General] maybeme2:
Best Buy has the basic Fire TV stick on sale for $14.99.
[Moto X4 Questions & Answers] glenb77:
i am using rooted phone on fi version. i see a recent rom on mirrors.lolinet for this update. the file has 'no erase modem' in its title. does this mean that the lines 'erase modemst1' and erase modemst2 should be removed from the flash-all.sh script ? if anyone knows. i am getting the annoying update attempts that will fail on the rooted phone. thanks.
[Moto X4 Questions & Answers] johnjingle:
The quick way to get rid of that message is using Titanium Backup's Freeze! option and freezing the Motorola Update Services app (I think that's what it's called. I do this when I don't have time update right away.

Otherwise, you can leave the flash script the same.
[Moto X4 Questions & Answers] glenb77:
thanks for reply. i took a look at the flashfile.xml inside the zip and there is no modem file there. so i think probably its best to remove the erase modemst lines from the bat/sh file to flash with. this is in fact different from the previous contents of the flashfile.xml in previous releases. i'll get to it over the weekend and report back how it goes.
[Moto X4 Questions & Answers] Viva La Android R.I.P.:
There is a modem file included in the firmware package. It's called NON-HLOS.bin and is flashed to the modem partition:

fastboot flash modem NON-HLOS.bin

You are correct that modemst1 and modemst2 should not be erased during installation.
[Moto X4 Questions & Answers] glenb77:
i did the update over the weekend and commented out the lines to erase modemst as above and phone seems fine. it's great to have an image up on the mirror so quickly, thanks to all responsible for that. in the past i flashed backed to earlier images and went through the ota update process which takes a long time.
[Moto X4 Questions & Answers] jhedfors:
I used the same flash-all script that I always used which I had commented out the data wipe. I DIDN'T comment out there modem wipe lines, and it worked without any issues. ?

I agree, it is great that I didn't have to bother with the OTA part!
[Moto X4 Questions & Answers] JustDJ_From_Da_Swamp:
Ouch, wish I would've seen this before the flash. Lol. I may have service still. Now I can't figure out how to get it back
[Xiaomi Poco F1 Questions & Answers] GuestK00218:
Hello

I would like to have custom Rom without playstore and google spy apps without browser and e-mail app.

where I install my own apps on apk I need ...... very pure image with a long battery life ....

any one suggestion?

Regards
[Xiaomi Poco F1 Questions & Answers] jegogo99:
You can install líneage without installing gapps

Enviado desde mi POCO F1 mediante Tapatalk
[Xiaomi Poco F1 Questions & Answers] AsusZenFone3Deluxe:
Use Super Kitchen and make your rom or after rom installing delete apps with solid file explorer
[Xiaomi Poco F1 Questions & Answers] YasuHamed:
flash LinageOS without GAPPS or any ROM based on LOS (such as CrDroid/Havoc / MOKEE etc)

just don't flash GAPPS or magisk!

you will have simple pure rom. later you can flash APKPURE etc to download your own sets of clean android apps
[Xiaomi Poco F1 Questions & Answers] GuestK00218:
Hello Sir

with solid file explorer i cant delite system apps..................i need Root????

regards
[Xiaomi Poco F1 Questions & Answers] TNSMANI:
Without root, system apps can't be deleted.
[Device Reviews and Information] Kashjan:
FiiO M11 Pro -Android Music Player AK4497 X2 | THX AAA | Exynos7872 | 5.15"18:9TFT |

FiiO M11 Pro Android-based Lossless portable Music Player​

​

Highlights of FiiO M11 Pro​

* Copious amounts of RAM and storage (3GB RAM + 64GB ROM)

* Supports up to PCM 384 kHz + Native DSD256

* Supports All to DSD

* Two-way Bluetooth with LDAC

* Asynchronous USB DAC supporting up to 384 kHz/32 bit

* 2.4/5GHz dual-band Wi-Fi

* 5.15 inch 1440*720 touch screen

* Get a quick surge of power with QC2.0 and Media Tek Pump

* Supports FiiO Link, DLNA, AirPlay and USB Audio

* Simply transfer music directly through Wi-Fi

* All-New dynamic EQ featuring 8 presets

* Full-Screen Gesture Operation

* 4370mAh high voltage quick charge Lithium-Ion Polymer battery

* Only 220g​

Official FiiO M11 Pro Website

Stay tuned for more news and information.​
[Device Reviews and Information] Twitch007:
I believe in Fiio's quality.
[Device Reviews and Information] Pumped.:
Now this bad boy *m11 pro* will be available soon ! :D I will please the team to have it in mind and put some info in the future how to root and install the best of all , viper4android. :D
[Device Reviews and Information] vectron:
I hope it will sound better than original M11 - lots of features, but just an average mid-fi sound. Though, when you are using Neutron MP, sound quality goes up. I just reviewed Hiby R5, it's cheaper, smaller, as fast as R6pro and N6ii, has fully open android and google play store, and sounds the same as M11, except R5 has less hissing with sensitive low impedance IEMs.

[IMG="Hiby R5"]https://twister6com.files.wordpress.com/2019/09/hiby-r5-07.jpg[/IMG]

twister6
[Device Reviews and Information] KhanSW:
Anyone working on a custom firmware that adds google store support and viper4android?
[Device Reviews and Information] AndroidClone:
fiio does not even have the firmware listed online... smh poor support and poor customer service.:mad:
[Device Reviews and Information] bgm92:
If anyone is interested in trying fun stuff, Samsung Odin mode can be enabled with POWER+PLAY/PAUSE, the Fastboot mode can be enabled by POWER+REWIND (<<), and Recovery with POWER+FORWARD(>>).

I guess Fastboot is the most interesting one, as you can flash a custom recovery, and from there you can make backups or flash root packages and so on.

I also attached the stock recovery (flashable via Fastboot). For Fastboot, you will need to manually install the driver. I attached an archive - you can manually install the "Android ADB Interface" one.

One thing would be porting the TWRP recovery, for example, that could then be flashable via Fastboot. I already tried installing a TWRP from a similar device (same SoC and resolution) but the recovery was not starting, and I restored the stock one from the attached archive and everything was fine again.

Good luck!

https://drive.google.com/file/d/1kMZNHM5baPeZwgNTrGngBvkZJMC4Wdjt/view?usp=sharing