yashsingh1/xdaforums huggingface dataset:
[Magisk] Serbinhio:
Let's say a photo player! But it does not matter in our issue! There is no common way to install apps and no play store ! The issue is with magisk and why it crashes on the prompt
[Magisk] TheRealModder:
A photo player?! Sorry bro, can't help.
[Magisk] chalseu:
You can install an apk within the adb by typing this command:

adb install <apk file location>
[Magisk] Serbinhio:
It cannot work, from Android 8 it has been changed and now it is in a per app setting. And even changing the settings gives an error that unknown sources not allowed
[Windows Mobile Development and Hacking General] timace:
so after an extensive search in this forum and google(ing) i still cannot find anything close to wht i was looking for...I am a lyricist at heart inspired by underground and 'real' hip-hop (Atmosphere, Living legends, Roots, Common) and currently in the process of laying some tracks in the studio and was wondering if there are any programs out there like FL Studio (fruity loops) or anything similar for our PPC devices? any help would be greatly appreciated.
[Windows Mobile Development and Hacking General] uniqueboy:
Hi timace, you could try audiobox, I don't know a lot about it but it's not free. It has a sequencer, drum machine, sampler and a couple of synths.

http://www.clickapps.com/moreinfo.htm?pid=4275&section=PPC

I think there is a free equivalent of this but a quick search yealded 0, you coud try looking here: http://www.freewarepocketpc.net/ I'm sure I saw something like that.
[Windows Mobile Development and Hacking General] timace:
thanks ive tried searching on the 'freeware' sites before i posted this thread and no luck, the first link you posted looks exactly like wht im looking for to bad its almost 50 bones...any other freeware? (key word free) haha maybe i shold just stop being so tight/cheap.
[Windows Mobile Development and Hacking General] pauldgroot:
Try out MilkyTracker, awesome programs!

It has a sampler, and you can make awesome chiptunes.

Though hard to master it's fun to try, good headphones are recomended!

found here
[Windows Mobile Development and Hacking General] robpet2:
never thought of making beats on my wing... but willing to try looking for software like that.... searching now
[Windows Mobile Development and Hacking General] robpet2:
i might have to give this one a try... looks good
[Windows Mobile Development and Hacking General] uniqueboy:
Found it:http://www.freewarepocketpc.net/ppc-download-syntrax.html I knew there was a decent free one, try this, Syntrax. Maybe.
[Windows Mobile Development and Hacking General] timace:
i found the syntrax program on the same site but read tht its not really freeware, something to do with registration problem??? Has anyone tried/downloaded this?
[Google Pixel 2 XL Guides, News, & Discussion] t2noob:
Idk if anyone has seen this yet, but this might be a possible zero day exploit that can be used for root on the vzw pixel 2 xl. https://bugs.chromium.org/p/project-zero/issues/detail?id=1942

Someone with more knowledge on root can probable exploit it.
[Google Pixel 2 XL Guides, News, & Discussion] VulguM:
I certainly hope so, it would be great news.
[Google Pixel 2 XL Guides, News, & Discussion] lil_ith:
Better hurry. It's gonna be patched on October security patch
[Google Pixel 2 XL Guides, News, & Discussion] t2noob:
The poc works on the latest security update. It just needs to be updated to elevate permissions to root or unlock bootloader. So we just need someone who knows how to code to elevate permissions using this poc :) any takers ???
[Google Pixel 2 XL Guides, News, & Discussion] petiolarissean:
This on pixel 1 xl forum
[Google Pixel 2 XL Guides, News, & Discussion] comradesven:
I'm not up to date on what Android has become, so I'm not sure how to get from temproot to OEM unlock partitions, but here's temproot for the Verizon Pixel 2 XL anyway.

The output of 'uname -a' must be:

Linux localhost 4.4.177-g83bee1dc48e8 #1 SMP PREEMPT Mon Jul 22 20:12:03 UTC 2019 aarch64

Now I, too, will wait for someone to write up the rest :D

EDIT:

Updated code and binary here: https://github.com/kangtastic/cve-2019-2215

If you're an end user who already has the .zip from here, you're good. There's no change to the rooting part, and it won't directly help with unlocking the Verizon bootloader.

If you're a developer thinking about touching other affected phones/kernels, then I hope you find my work useful :)
[Google Pixel 2 XL Guides, News, & Discussion] kancrutt:
what does this mean?
[Google Pixel 2 XL Guides, News, & Discussion] Hexlay:
As far as i see, it is just a temporary solution to "root", to be more concrete this screen shows that SELinux has been set to passive, which ofc open lot of possibilities. However this particular method here will not unlock bootloader. Now let's hope someone actually comes up with some idea to unlock it.

P.S Huge thanks to comradesven for making this !
[Google Pixel 2 XL Guides, News, & Discussion] petiolarissean:
Here is POC zip if this any help,someone built it on s8 forum.Picture conversation so up to date on zip.sean
[Google Pixel 2 XL Guides, News, & Discussion] t2noob:
I can confirm the temp root works
[Google Pixel 2 XL Guides, News, & Discussion] logan2611:
Before I try to work out a method to unlock the bootloader, once I run this, will I be able to reboot my phone before I unlock the bootloader?

EDIT: I've been working with the temproot for a few hours. If progress stays steady, I'll have an unlock method before the end of the night.
[Google Pixel 2 XL Guides, News, & Discussion] cammykool:
Mine worked too!
[Google Pixel 2 XL Guides, News, & Discussion] Hexlay:
It does work, however, it does not grant access to everything. SElinux is permissive tho, so, i hope all of this will be enough for unlocking bootloader
[Google Pixel 2 XL Guides, News, & Discussion] logan2611:
Weird, I am able to access build.prop

https://imgur.com/a/68vvUNx
[Google Pixel 2 XL Guides, News, & Discussion] Hexlay:
Hmm... now i'm sad. Did you reboot device after this or how it's different?
[Google Pixel 2 XL Guides, News, & Discussion] logan2611:
I have not rebooted. Also as far as I know the root does not persist.
[Google Pixel 2 XL Guides, News, & Discussion] Hexlay:
Ye i guess so... Well, very strange, i did everything, my selinux is set to permissive, how i have a half of permissions

P.S repeated process and now i have full access, very strange, however at least repeating works

P.S 2 ah, so killing terminal emulator and getting back gives same result, so once you run it, you should not close terminal or you will lose access
[Google Pixel 2 XL Guides, News, & Discussion] kancrutt:
fingers crossed!

damn I just install Oct security patch :/
[Google Pixel 2 XL Guides, News, & Discussion] t2noob:
Does anyone know what eomlock-bridge-client do? I see an option for device_lock 0
[Google Pixel 2 XL Guides, News, & Discussion] lginxl:
How are you guys getting the file to even copy? Every time I attempt to copy it I get "cp: ./taimen: Read-only file system"
[Google Pixel 2 XL Guides, News, & Discussion] t2noob:
Think you can make the source available?
[Google Pixel 2 XL Guides, News, & Discussion] logan2611:
Update: I've gotten the OEM unlock switch to toggle, but something in fastboot is holding me up :/

https://imgur.com/a/6Nv8z4i
[Google Pixel 2 XL Guides, News, & Discussion] LetsHaveSomeAndroidFun:
What is happening in fastboot that's holding you up? Also, how did you get the switch to toggle?
[Google Pixel 2 XL Guides, News, & Discussion] Hexlay:
https://xdaforums.com/showpost.php?p=75674018&postcount=517

this might help, it's very theorical, but back in days there was no indication of root or whatsoever
[Google Pixel 2 XL Guides, News, & Discussion] Rumold:
Toggling the OEM switch changed the sys.oem_unlock_allowed and ro.boot.cid properties? As someone suggested in this post (https://xdaforums.com/showpost.php?p=80225800&postcount=198), that might be the step required and ro.boot.cid 11111111 might imply that is a google version and not a verizon one.
[Google Pixel 2 XL Guides, News, & Discussion] Hexlay:
https://xdaforums.com/showpost.php?p=67172888&postcount=2

well, idk if it helps, but...
[Google Pixel 2 XL Guides, News, & Discussion] Rumold:
BTW, I don't know if it is related, but I've found a "sys.oem_unlock_allowed" string reference in system/framework/services.jar (in classes.dex file). I've decompiled it and I've found a class called PersistentDataBlockService (which is related with my previous post). Unfortunately, I can't read the code (the tool just shows an //INTERNAL ERROR// message) but the method's and variables' name describe pretty much everything. Maybe someone with more knowledge can decompile it and use some of those methods to change the Persistent Data Block.

https://imgur.com/a/F3PKhLv

I've found more stuff in this file which is related with the HAL device and with the OemUnlockService. I can't upload the code and I don't want to spam with images and messages, let me know if there is another way to upload it and I'll try. I've added a new image that shows more functions in the same link provided.
[Google Pixel 2 XL Guides, News, & Discussion] Hexlay:
So oemlock package determines and calls PersistantDataBlockService and this guy is who writes permission to pst partition... Well, i think editing PersistantDataBlockService would be bad idea, but however editing oemlock classes to send false positive? still idk.. i have never looked so deep in android
[Google Pixel 2 XL Guides, News, & Discussion] Rumold:
Me neither, I've never programmed in java so I'm relying in others skills and habilities, but I think you got the concept right. We can try to fake what PersistanDataBlockService writes in the pst partition, modifying this file, building a new jar file with the faked calls or whatever.

BTW If anyone wants to decompile, you just have to do this:

adb pull /system/framework/services.jar (not a command per se) (give right permissions) ROOT NEEDED (you can copy the file to /sdcard, then adb)

extract the package, then use dex-tools-2.1-SNAPSHOT (2.0 version will throw an error), execute script d2j-dex2jar.sh on classes.dex (or d2j-dex2jar.bat if you are on windows)

decompile it with Java-Decompiler

https://github.com/pxb1988/dex2jar/releases

https://java-decompiler.github.io/

P.S: Sorry for the spam guys, but I'm very excited about this after almost 2 years
[Google Pixel 2 XL Guides, News, & Discussion] logan2611:
Please exercise caution when dealing with the /system partition. Because our bootloaders are still locked, any changes to /system will effectively brick our phones due to Android's Verified Boot process.

I was able to get the toggle working through a couple of different methods, but the one that seemed most interesting was the ./oemlock-bridge-client method. The program has 3 different modes, "device_lock", "status", "unlock". I believe that on Google Pixels this in combination with oemlock-bridge is what enables the OEM unlocking flag. oemlock_provisioning appears to be the process responsible for phoning home as everytime I run it the status on the client changed to "provisioned" and resets all of the flags. An unlock may be possible if someone can decipher what exactly needs to be inputted into "oemlock-bridge-client unlock". It takes a version number in hex, a nonce (might be all 0s), and a 256 byte token.

Edit: I got the toggle switch working by changing have_id to 00, and by also running the command with unlock and zeroing everything. I have tried toggling OEM unlocking on and off to see if it would take, but fastboot always says "Flashing is not allowed on this device."
[Google Pixel 2 XL Guides, News, & Discussion] Some1CP:
I can't wait for this to come out. My pixel 2 xl automatically updated to the October patch but I haven't rebooted yet just so that I can unlock the bootloader when something comes out of this. Is it possible to cancel an update after it has been applied? Like reversing the active A/B partition?
[Google Pixel 2 XL Guides, News, & Discussion] slogar25:
I think version refers to the bootloader version. But another user and I are thinking the bootloader generates the token itself. So that might be an issue. If you guys look in

/vendor/bin/hw there is another binary called android.hardware.oemlock@1.0-service. This has a major roll as well. Found it a long while back while scrubbing through source of the persistent data block on android git. But I get this when I try to run it....
[Google Pixel 2 XL Guides, News, & Discussion] logan2611:
I just remembered that another thing I found was that the ro.oem_unlock.pst partition points to "/dev/block/bootdevice/by-name/misc"

EDIT: Here's the hex dump of that partition

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000c90 44 69 53 61 00 00 00 00 00 00 00 00 00 00 00 00 |DiSa............|
00000ca0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001800 4f 45 4d 4c 00 00 00 00 00 01 01 01 00 00 00 00 |OEML............|
00001810 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00100000
[Google Pixel 2 XL Guides, News, & Discussion] Rumold:
Welp this confirms my suspect, running /vendor/bin/oemlock-bridge-client unlock might change that block (/dev/block/sda5) because my dump looks like this after executing the following:

taimen:/ # /vendor/bin/oemlock-bridge-client unlock 544d5a333068 11111111 000000000000000000000000029418
Device lock: 0
Last message:
command: unlock (1)
version: 114556229274964
nonce: 286331153
token: 00000000000000000000290041800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Storing message:
version: 114556229274964
nonce: 286331153
token: 00000000000000000000000002941800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Stored.

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000c90 44 69 53 61 00 00 00 00 00 00 00 00 00 00 00 00 |DiSa............|
00000ca0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001800 4f 45 4d 4c 02 00 00 00 54 4d 5a 33 30 68 00 00 |OEML....TMZ30h..|
00001810 11 11 11 11 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001820 00 00 00 00 02 94 18 00 00 00 00 00 00 00 00 00 |................|
00001830 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001920 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001930 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00100000

Would be nice if someone makes a dump before any change
[Google Pixel 2 XL Guides, News, & Discussion] logan2611:
I believe my dump was made before I tinkered with the oemlock-bridge-client. Interestingly, here is my misc partition after running the unlock command, going into fastboot, failing and then rebooting.

0000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800 74 68 65 6d 65 2d 64 61 72 6b 00 00 00 00 00 00 |theme-dark......|
00000810 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000c90 44 69 53 61 00 00 00 00 00 00 00 00 00 00 00 00 |DiSa............|
00000ca0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001800 4f 45 4d 4c 00 00 00 00 00 01 02 02 01 00 00 00 |OEML............|
00001810 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001920 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001930 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00100000

There now appears to be a 01 at 0x1920, which wasn't there before.
[Google Pixel 2 XL Guides, News, & Discussion] Rumold:
Could this be just modifying the toggle itself and not writing in the PST? Could be that dark mode just the force dark mode toggle in developers option?
[Google Pixel 2 XL Guides, News, & Discussion] logan2611:
I know that the theme-dark stuff is from me enabling dark theme, beyond that I don't have the slightest clue right now. I'll get back after I try a few things, since I know that modifying this partition is normal behavior.

EDIT:

hexdump post unlock command, OEM switch on:

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800 74 68 65 6d 65 2d 64 61 72 6b 00 00 00 00 00 00 |theme-dark......|
00000810 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000c90 44 69 53 61 00 00 00 00 00 00 00 00 00 00 00 00 |DiSa............|
00000ca0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001800 4f 45 4d 4c 02 00 00 00 54 4d 5a 33 30 68 00 00 |OEML....TMZ30h..|
00001810 11 11 11 11 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001820 00 00 00 00 02 94 18 00 00 00 00 00 00 00 00 00 |................|
00001830 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001920 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001930 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00100000

hexdump post unlock, OEM slider off:

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800 74 68 65 6d 65 2d 64 61 72 6b 00 00 00 00 00 00 |theme-dark......|
00000810 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000c90 44 69 53 61 00 00 00 00 00 00 00 00 00 00 00 00 |DiSa............|
00000ca0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001800 4f 45 4d 4c 02 00 00 00 54 4d 5a 33 30 68 00 00 |OEML....TMZ30h..|
00001810 11 11 11 11 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001820 00 00 00 00 02 94 18 00 00 00 00 00 00 00 00 00 |................|
00001830 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00100000

It seems the 01 at 0x1920 stores the postition of the OEM Unlocking switch.
[Google Pixel 2 XL Guides, News, & Discussion] elliwigy:
yes.. if you run "getprop | grep pst" you will see the bit is stored at offset 6144 on misc partition...

the switch when toggled on sets the bit to 01..

you still need to go into fastboot and run the oem unlock commands..

if it still doesnt allow it then further digging is needed..

ive had a group open since p2xl launched for unlock discussion on tgram..

i no longer have a p2xl however.. if anyone has one and wants to test then pm me for a link.. i did a lot of testing back then so maybe we can get it going sooner rather than later
[Google Pixel 2 XL Guides, News, & Discussion] logan2611:
I believe I have tried this already, but I will try it again just to be sure.

EDIT: 6144 offset is the letter O in OEML.

EDIT2: It appears to be safe to write to the misc partition, for the most part.
[Google Pixel 2 XL Guides, News, & Discussion] elliwigy:
pm me.. we can chat on tgram n test some stuff out
[Google Pixel 2 XL Guides, News, & Discussion] Rumold:
Wouldn't be nice if we let people know we are currently trying to actively unlock the bootloader (indicate it somewhere in the post title or even a new post) so people can join at least to test things or to understand how the code works or suggest new ideas. We can add at the beginning of the post some kind of information, for example what we know, what we don't, what is currently being tested or has been tested, tools to use to develop, to disassemble, etc (even upload some of them or suggest them). I think that if we organize well, we can make it done sooner than later.
[Google Pixel 2 XL Guides, News, & Discussion] petiolarissean:
since there is exploit and been active since fall of 2018 or later I'm going to try Kingo root & kingroot to see if root pixel 2 that arrived yesterday.Its Verizon model locked down but my security patch Oct 2018 so maybe it will work and if break phone just send it back,sean
[Google Pixel 2 XL Guides, News, & Discussion] lucky_strike33:
Is this something new??

https://twitter.com/Digital_Cold/status/1182098907096125441

If this is not good, then please delete....

Its only temporary root, nevermind.....
[Google Pixel 2 XL Guides, News, & Discussion] petiolarissean:
check this out devs,sean
[Google Pixel 2 XL Guides, News, & Discussion] elliwigy:
theres already a poc to set permissive n temp root.. now need to figure out bl unlock
[Google Pixel 2 XL Guides, News, & Discussion] elliwigy:
not good to install root in the way he does especially on a locked bl withsecure boot enabled.. u could potentially brick..

safer to install systemlessly in daemon mode imo
[Google Pixel 2 XL Guides, News, & Discussion] lucky_strike33:
Thanks man! Dont want to ruin a good phone.

Now go teach that guy lol!
[Google Pixel 2 XL Guides, News, & Discussion] petiolarissean:
Kingo root

kingroot

no go
[Google Pixel 2 XL Guides, News, & Discussion] 1404zone:
Would it be safe to alter directories that are not /system ? and is there any way to launch another app from the terminal with elevated permissions?
[Google Pixel 2 XL Guides, News, & Discussion] logan2611:
Moved: https://xdaforums.com/pixel-2-xl/how-to/temporary-magisk-root-vzw-pixel-2-xl-xl-t3981423
[Google Pixel 2 XL Guides, News, & Discussion] Hexlay:
Is this systemless?

edit: sadly it does not work
[Google Pixel 2 XL Guides, News, & Discussion] elliwigy:
o god.. id stay away from thos lmao
[Google Pixel 2 XL Guides, News, & Discussion] elliwigy:
just install systemless root in daemon mode.. easy as that
[Google Pixel 2 XL Guides, News, & Discussion] elliwigy:
it does work lol.. im sure more testers will confirm.. posting a screenshot then saying it doesnt work doesnt help us help u in figuring out whats goin on with ur attempt..

yes, it is systemless.. until vzw users find a way to unlock the BL i highly recommend not modifying system or other partitions that are verified on boot bcuz u could hard brick/bootloop and with locked bl end up with no way to revive it.

Basically mostly inspired by tjw github as theres a small section that talks about installing root in daemon only mode.

This means the magiskinit file is pushed to a folder created on data partition. To have minimal impact he uses the odm partition since theres not much use for it by the system and odm/bin is in the path.

magiskinit64 binary is used to create magiskpolicy and magisk binaries. Magiskpolicy patches sepolicy for magisk. Magisk binary is used to start the magisk daemon. su and resetprop are linked to the magisk binary so that when an app calls su it can be granted root. The magiskmanager needs to b installed as it is the root manager, without it if u try to call su the request will b denied.

the folder with the files is on data partition which is bind mounted over /odm.

This creates a "systemless" approach. Only the dir on data is ever modified. Even if u pushed say some binaries to /odm/bin they are actually being written to data..

this is a very basic method.. magisk obviously does a lot more when installed properly but due to the locked bl root can only b installed in daemon mode for now. This means no modules or other stuff. It is basically using the temproot to get a magisk temp root so u can use root apps and not b limited to using a terminal or adb only for root stuff.

We tried installing root in other directories such as /system/bin but of course this causes instability in its current state. odm was the easiest least evasive place we tested to push magisk for now.

its a start.