yashsingh1/xdaforums huggingface dataset:
[OnePlus 7 Pro Guides, News, & Discussion] Aphex13:
Worked like a champ on Android 10 Stable for me.

Thanks, Gmail was the only app i use that I hadn't been able to get themed dark yet.

Oh, and Play Music, but I don't think it exists as of yet...
[OnePlus 7 Pro Guides, News, & Discussion] JDROIDS:
Looks cool. Thank you! This didn't work for me though. I rebooted and it still says "true" but no option for dark mode. I'm on 9.5.11. Does this only apply to Android 10?
[OnePlus 7 Pro Guides, News, & Discussion] Aphex13:
I think it only works on 10. I tried it a while back on 9.5.something and had the same result as you.
[OnePlus 7 Pro Guides, News, & Discussion] amirage:
Hi OP (@Mike02z)

Is there any way we mere mortals (those who don't have root enabled) can do this using ADB? Please list out the steps...it'll surely be helpful..

Amit
[OnePlus 7 Pro Guides, News, & Discussion] blade35:
Easier workaround:

Install Prefrences Manager from play store. Open it and enable show system apps from the 3 dot menu. Scroll down to Gmail and open it. Swipe to FlagPrefs.xml and enable dark mode to true. Force stop gmail and if you have dark mode enabled from settings like in oos Gmail should have dark mode enabled right away. Hope this helps??
[OnePlus 7 Pro Guides, News, & Discussion] amirage:
does this work without root? nevermind..the app needs root!...

Isn't there a way to edit the xml file via adb and push it back?

---------- Post added at 09:15 AM ---------- Previous post was at 08:22 AM ----------

Out of curiosity, how do you root android 10? I searching for guides online but can't find any!
[OnePlus 7 Pro Guides, News, & Discussion] blade35:
Magisk is a fairly simple method to root android 10.
[OnePlus 7 Pro Guides, News, & Discussion] amirage:
Yes, but I'm not getting any particular guides on how to install magisk on Android 10. I need twrp for this..but the guide on TWRP says it longer is applicable for Android 10...

:confused:
[OnePlus 7 Pro Guides, News, & Discussion] Mike02z:
Sorry Guys. Should have noted this works on OOS 10 stable. Have not tried on Pie.

For those looking for easy root. There is a thread with a 10 patched boot image. Flash that via Fastboot and you should have root. You still need to be boot loader unlocked. Only flash patched boot images for version of OS you are on or you'll likely bork your phone.

If you don't want to root, just hang tight. The Gmail with the "Themes" option is coming. When you'll get it is another story.

BTW, I'm on an unlocked 7 Pro
[OnePlus 7 Pro Guides, News, & Discussion] grumpyg4:
Excellent tip ! Thank you !!!!!
[OnePlus 7 Pro Guides, News, & Discussion] Bradl79:
Not working on Pie
[OnePlus 7 Pro Guides, News, & Discussion] hallo dare:
It's for Android 10.

---------- Post added at 07:08 PM ---------- Previous post was at 07:06 PM ----------

---------- Post added at 07:09 PM ---------- Previous post was at 07:08 PM ----------

Was there a need to start another thread on this subject? It has already been discussed. https://xdaforums.com/one...-mode-t3971223
[OnePlus 7 Pro Guides, News, & Discussion] Mike02z:
Maybe because I didn't see?:rolleyes:
[OnePlus 7 Pro Guides, News, & Discussion] hallo dare:
Didn't think of checking?
[OnePlus 7 Pro Guides, News, & Discussion] saiz136:
Anything else that can be dark mode with this app?
[OnePlus 7 Pro Guides, News, & Discussion] Mike02z:
Thanks the advice. You are really contributing to the discussion. Nice work.:rolleyes:

Yea, I get it, I posted something similar to something posted before. Its not in the top page of posts I looked. You don't need to play forum cop. Mods can remove if they want. Try to help and always someone that thinks they are smarter.

:rolleyes::rolleyes::rolleyes::rolleyes::rolleyes::rolleyes:
[OnePlus 7 Pro Guides, News, & Discussion] hallo dare:
I have helped before, who said i wasn't. Just don't see why you felt the need to start yet another thread.
[OnePlus 7 Pro Guides, News, & Discussion] Mike02z:
Let's see if this penetrates....I did not see the post you are referring to. I looked through 2 pages. I was just trying to help others since I did not see the other thread. What's the big deal? Why did you feel you had to point it out then continue to ask why I didn't look? Again, your posts in *this* thread helped no one. Are you a mod? No? Then report the thread as a dup or move on....
[OnePlus 7 Pro Guides, News, & Discussion] hallo dare:
Couldn't be bothered. Very easy to use the search box. Just don't understand why the need was there to create another thread. O well
[OnePlus 7 Pro Guides, News, & Discussion] Bodo_1:
Works fine thank you
[OnePlus 7 Pro Guides, News, & Discussion] jaseman:
He did it so people like you can complain about something unimportant! Are the servers that host this stuff running out of disk space? :silly:
[OnePlus 7 Pro Guides, News, & Discussion] hallo dare:
Who asked you?
[OnePlus 7 Pro Guides, News, & Discussion] yodainascoda:
Such a pointless post but as im on final warning i cant say what i want for speaking my mind you really must have no life to basically try flame him i for one thank him
[OnePlus 7 Pro Guides, News, & Discussion] hallo dare:
Yawn
[OnePlus 7 Pro Guides, News, & Discussion] rafik25:
hello works on Pixel Experience thx a lot
[Android General] Mr_Moo:
Hi all,

I've been trying to find an app that does this for a while, but I can't find one or find much information about an app that does this or if there is a feature I can switch off.

There used to be an app years ago that worked on a Sony or Samsung phone I had and I could turn it off on another.

I have the Huawei P20 Pro. Funnily enough, my phone got stolen a few days ago and they turned it off immediately. If they couldn't, I could have found it again.
[ASUS ZenFone 6 (2019) Questions & Answers] cdudeman:
Does anyone know the command to relock bootloader? I flashed the raw firmware but every command I tried to relock failed. I need to make a warranty claim but can't until the bootloader is relocked.

Commands I have tried but failed:

fastboot oem lock

fastboot oem asus-csc_lk ( taken from ROG Phone 2 forums)
[ASUS ZenFone 6 (2019) Questions & Answers] aleksander002:
fastboot oem asus-back
fastboot reboot (if it doesn't reboot on it's own)
[ASUS ZenFone 6 (2019) Questions & Answers] cdudeman:
Thank you! Worked perfectly. You rock!
[ASUS ZenFone 6 (2019) Questions & Answers] aleksander002:
Nice to hear it ;)

Just remember you won't get FOTAs anymore because Asus is blacklisting unlocked phone's IMEI.
[ASUS ZenFone 6 (2019) Questions & Answers] misquia:
I wonder if there's a way to fake-send the IMEI to Asus when doing the unlocking process.
[ASUS ZenFone 6 (2019) Questions & Answers] aleksander002:
I don't know how exactly the bootloader is being unlocked but something tells me the unlock code is generated with the use of IMEI/SN. Wrong phone IDs = wrong key, however this is only my speculation.
[ASUS ZenFone 6 (2019) Questions & Answers] amgreenhawk:
I did the above command and now it says the deivce is corrupt and can't be trusted and will not boot. No press start to continue message. Can you please help me or guide me to unbrick this phone? Thank you.

P.S. I guess following the guide-unbricking-zs630kl can help? Thank you.

Edit: Nevermind. Followed that guide and unbricked it myself.
[ASUS ZenFone 6 (2019) Questions & Answers] niwdle:
Were you able to claim the warranty? Did you do the official(Download from ASUS site) or unofficial bootloader unlock?

Did you do the official(Download from ASUS site) or unofficial bootloader unlock?
[ASUS ZenFone 6 (2019) Questions & Answers] amgreenhawk:
I did it officially, downloaded from ASUS website for unlocking.
[ASUS ZenFone 6 (2019) Questions & Answers] titilate:
After you unbricked the phone, was the bootloader re-locked? Also, were you able to successfully file a warranty claim or return the phone? tnx
[ASUS ZenFone 6 (2019) Questions & Answers] aleksander002:
He has bricked it while locking the bootloader, so yeah, it will be locked. Warranty will depend on where you live. If you'll have faulty motherboard, they'll probably replace it for free but technically this is mandatory action only in the EU because just unlocking can't be considered as warranty void. Of course until they prove you that you bricked it.
[Android Q&A, Help & Troubleshooting] juicer52:
Don't know where else to post this so please reassign if out of place.

I had a LG SP320 unlocked via software from ebay seller.

Initially had problems wherein the IMEI changed. Once that was changed back, all seemed OK but now I realize that I cannot receive sms messages. I can send sms, make and receive calls and browse internet.

Is it possible that the service actually involves flashing another rom and in so doing screwed up something?? Or is this not related?
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
Exploit is here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7

On my S9 Plus the exploit never completes(see attached screenshot). I'm running the Sept 2019 patch that is supposed to be exploitable.

Also attached is the exploit compiled for arm64 using the Linux version of Google's Android NDK: https://developer.android.com/ndk/downloads/index.html

Made the arm64 toolchain with: ./android-ndk-r20/build/tools/make_standalone_toolchain.py --arch arm64 --install-dir ./arm64

It compiled properly then I copied it to /data/data/jackpal.androidterm, "chmod -x poc" to make it executable from Terminal Emulator: https://play.google.com/store/apps/details?id=jackpal.androidterm&hl=en_US

My guess is that the S9 Plus is not vulnerable or I did something wrong in the above steps.
[Samsung Galaxy S9+ Guides, News, & Discussion] ilikenwf:
I tried your build on my Pixel XL on Android P, and it locks the phone up a while, system UI crashes, and then the phone dies...I may need to build myself with a different NDK version?

If it were to work I could root and/or write a bit to a certain partition to allow OEM unlock.
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
Can you post a screenshot of the output before it dies. If not, can you post what output you get before it crashes?
[Samsung Galaxy S9+ Guides, News, & Discussion] elliwigy:
i get same output on my g975u and n976v on stock firmware. I believe it means wont work for us lol
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
The exploit writers said that these phones are vulnerable:

1) Pixel 2 with Android 9 and Android 10 preview

2) Huawei P20

3) Xiaomi Redmi 5A

4) Xiaomi Redmi Note 5

5) Xiaomi A1

6) Oppo A3

7) Moto Z3

8) Oreo LG phones (run same kernel according to website)

9) Samsung S7, S8, S9

I was hoping my S9 Plus was vulnerable but I guess with your output being the same as mine.....we both will not get root :(

For ****s and giggles I tried for a few hours to hack the code to get it to continue the exploit without success.
[Samsung Galaxy S9+ Guides, News, & Discussion] arpruss:
I got the same 0x1000 (instead of correct 0x2000) output on my LG V20. I played around and changed WAITQUEUE_OFFSET to 0x90 (which isn't correct, but I was just experimenting), ran it, and then it forced a reboot of the system. That's some progress, since an unprivileged app shouldn't be able to force a reboot, so there may still be a vulnerability there to be exploited.
[Samsung Galaxy S9+ Guides, News, & Discussion] chompie1337:
i think you're on the right track. you're probably causing a kernel panic which is causing the shut down. offsets have to be updated to be kernel specific so that's why you're crashing. can you post the output you saw before the crash? crash dump if you have one?
[Samsung Galaxy S9+ Guides, News, & Discussion] arpruss:
What does

uname -a

show on your device? The poc depends on the size of struct binder_thread, and as far as I can tell digging through kernel source, at some point that size was changed. So if the S9 uses a different version of the kernel, the exploit may need modifications.
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
Any suggestions will be helpful. Attached is a screenshot of the current kernel version as of the Sept 2019 update. I can easily compile the exploit with any changes to the buffer.
[Samsung Galaxy S9+ Guides, News, & Discussion] denkazzzget:
Got same 0x1000 on Samsung Oreo 8.0, arm64, kernel 3.18.14-13712092-*, august security patch 2019.
[Samsung Galaxy S9+ Guides, News, & Discussion] djcal1985:
error Lge q710al
[Samsung Galaxy S9+ Guides, News, & Discussion] Phantisy:
Has anyone tried this on the SM-G965U yet?

Update:

I tried and same results as the OP.
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
From: https://github.com/marcinguy/CVE-2019-2215/

If writev is returning 0x1000 it means the timing is off, the wait queue offset is off, the kmalloc allocation in the writev function isn't the same as the freed binder_thread, or your kernel isn't vulnerable.
[Samsung Galaxy S9+ Guides, News, & Discussion] f41lbl0g:
How would we go about finding these offsets? I think it may be possible to use this exploit for our device, except that the poc may need to be tuned to samsung kernel and its offsets.
[Samsung Galaxy S9+ Guides, News, & Discussion] Phantisy:
According to Samsung, it is vulnerable. Guess we just need to figure out what is causing it not to work.
[Samsung Galaxy S9+ Guides, News, & Discussion] elliwigy:
link to the site where it is said to be confirmed? i want to double check before i waste any time
[Samsung Galaxy S9+ Guides, News, & Discussion] f41lbl0g:
According to the project zero post of the cve, s7, 8 and 9 are listed under the vulnerable devices.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1942
[Samsung Galaxy S9+ Guides, News, & Discussion] elliwigy:
yea, i saw s9 but not n9 tho lol who knows
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
Something different!

From: https://github.com/arpruss/cve2019-2215-3.18

I compiled poc98-overwrite-pipe.c which gave me the 0x1000 failure but poc98.c succeeded in overflowing the kernel buffer on my S9+(see attached screenshot).

I'm not a kernel hacker so that's as far as I can get. Seems really close to being able to su to root. I attached poc98 compiled for arm64 so others can test it.

Edit: After reading the code, the actual exploit function is commented out so I'm going to take a crack at editing it but maybe someone with some kernel experience can take a look. I doubt I can make it work...I'm just a lowly PERL hacker!

Edit2: https://github.com/arpruss/cve2019-2215-3.18 seems to be a work in progress. New code was just uploaded. I think we have to make the exploit work on our kernel version.

Edit3: I re-added clobber_addr_limit(); to poc98.c and recompiled. Running it doesn't get an exploited kernel probably because it's written for a different kernel. That's about the extent of my kernel knowledge so we need a kernel hacker to get root.
[Samsung Galaxy S9+ Guides, News, & Discussion] f41lbl0g:
could you attach the latest version of your poc? (edit 3)
[Samsung Galaxy S9+ Guides, News, & Discussion] rudialex:
i think the Samsung Knox version is decisive. This document states, RKP only protects kernel data structures on selected devices: (search for Real-time Kernel Protection (RKP))

In the 2018 version this comment is missing, indicating newer Knox versions protect kernel data structures on all devices: (Search for Knox Deep Dive: Real-time Kernel Protection (RKP))

In this case the PoC of Hernandez will not work.
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
I think maybe rudialex is right and Knox is stopping the exploit but here it is.
[Samsung Galaxy S9+ Guides, News, & Discussion] antintin:
Nice will this work on devices other than Samsung if it is the Samsung real time protection preventing it? I currently have a LG g8 on September patch and came across this. Is it worth it to not update or is it likely that pixel 2 is one of the only vulnerable devices anyway?
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
The exploit is written for kernel version 3.18 but the actual exploit code is not yet coded to work with that kernel version. You can run it but I doubt it will work on any phone.
[Samsung Galaxy S9+ Guides, News, & Discussion] arpruss:
I'm the guy behind poc98. The exploit itself in it is commented out as it is for a different kernel and is guaranteed NOT to work on devices on which poc98 works. If poc98 gives you a big hexdump of memory, that means you have a vulnerable device AND the right waitqueue offset for my version of the poc. You can use poc98 to leak kernel memory, but that's all. But it's pretty stable at that. It won't get you root, though.

I've just got poc98-test.c working on my LG V20 in the morning before heading out for work: it successfully (but not reliably: sometimes I run it and it does nothing) enables read/write access to all kernel memory and quits. I don't recommend doing anything with it, as the code is absolutely terrible. It's just work in progress.

Temp root should be not too far behind, but will likely require customization for different devices.
[Samsung Galaxy S9+ Guides, News, & Discussion] chompie1337:
If you have access to the kernel code to your device, you can check to see if you are vulnerable by looking at the binder.c file, where the BINDER_THREAD_EXIT ioctl is handled and the binder_thread is freed. If the EPOLL structure isn't freed, then your device is vulnerable.

ex vuln kernel: https://github.com/djb77/samsung-kernel/blob/G95XX-TW8/drivers/android/binder.c#L4757

ex not vuln kernel: https://android.googlesource.com/ke...45c17cc52741/drivers/staging/android/binder.c

Easiest way to tell is just to ctrl + f POLLFREE on the file.

As [MENTION=2714177]arpruss[/MENTION] said, it requires per device modification as some structures and I/O implementation change across devices/kernel. Alot of devices are vulnerable though.
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
Thanks for your work on this. Attached is a screenshot of your modified exploit running on my s9+. It probably verifies that Samsung Knox is protecting kernel data structures by not allowing arbitrary writing to them.
[Samsung Galaxy S9+ Guides, News, & Discussion] arpruss:
I don't think Knox is the issue.
[Samsung Galaxy S9+ Guides, News, & Discussion] antintin:
If people who are working on this think it's possible to develop it for lg v50, there's a bounty for root over there you could theoretically collect if you create a method. If you manage to do it for lg v20 and the v50 is also vulnerable it should be possible right?
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
For anyone hoping this leads to root for the S9+, the real action is happening here: https://xdaforums.com/v20/help/root-cve-2019-2215-t3979341

The kernel version on our S9+ is 4.9.112-16578910 so the exploit arpruss is working on probably will not work unmodified on our phone. I am trying to follow that thread to learn how this kernel hack works but we probably need Linus Torvalds to help us make it work!

October security patch for the S9+ is supposed to patch this vulnerability so I'm not applying it.

Edit: Here is code that has an escalate to root function after a successful exploit: https://github.com/grant-h/qu1ckr00t/blob/master/native/poc.c

We will need it to get root but before that we need to get the clobber function to work on our kernel.

Edit2: I looked at binder.c in our kernel source and it looks to have the patch that prevents this exploit. I'm giving up for now on this.
[Samsung Galaxy S9+ Guides, News, & Discussion] arpruss:
I don't have a v50.

And v20 works!
[Samsung Galaxy S9+ Guides, News, & Discussion] chompie1337:
where are you seeing that? your kernel is vulnerable as you are getting a kernel data leak. samsung hasn't patched this yet or if they did it was very recent

---------- Post added at 05:17 PM ---------- Previous post was at 05:14 PM ----------

This looks like memory padding, a symptom of CONFIG_SLUB_DEBUG. can you post your kernel build? trying to figure out if my S8 is vulnerable as well. the later builds seem to have been built with CONFIG_ARM64_UAO which hinders the exploitation technique
[Samsung Galaxy S9+ Guides, News, & Discussion] f41lbl0g:
I am on the s8 as well (snapdragon) and it seems like it is patched on pie. On oreo the patch is not applied so it may work on there.
[Samsung Galaxy S9+ Guides, News, & Discussion] bads3ctor:
I looked through several newer kernel versions at binder.c for several versions of the S9+.

Kernel source is here: https://opensource.samsung.com/uploadSearch?searchValue=G965U

binder.c contains POLLFREE patch so this verifies that our kernel is not vulnerable:

/*
* If this thread used poll, make sure we remove the waitqueue
* from any epoll data structures holding it with POLLFREE.
* waitqueue_active() is safe to use here because we're holding
* the inner lock.
*/
if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&
waitqueue_active(&thread->wait)) {
wake_up_poll(&thread->wait, POLLHUP | POLLFREE);
}
[Samsung Galaxy S9+ Guides, News, & Discussion] chompie1337:
I have the exploit working on S8 Active. Some devices need an additional fix to trigger the exploit (not offset related). The vuln is patched on Pie but should work on Oreo.
[Samsung Galaxy S9+ Guides, News, & Discussion] beatbreakee:
Hey any chance you can look into the kernel for G965USQS4CSC8 ... That kernel isn't listed on that site, and it may be vuln, due to it being back from March 26th. Or can u explain how I can pull and search for the POLLFREE patch myself? Ian (aka Ian beer , Google project zero) says that the Samsung devices listed as vulnerable include the Plus variants of the S7 S8 S9 ...
[Samsung Galaxy S9+ Guides, News, & Discussion] chompie1337:
If you have a link to the firmware I can look at it in a disassembler to see if it’s vulnerable
[Samsung Galaxy S9+ Guides, News, & Discussion] beatbreakee:
---------- Post added at 10:37 AM ---------- Previous post was at 10:35 AM ----------

[/COLOR]And i apologize if this isnt allowed but i thought since its a stock TMB unmodified firmware it would be ok to post a link. If not plz lemme know and illl happily remove

*** sorry edit, i also just found on samfirn and updato.com which is wayyyyy faster ... removing 1st link. Heres direct.***

https://updato.com/firmware-archive-select-model/?record=3DFA3214646411E9BE8CFA163EE8F90B

If direct link changes its still "Updato.com"

2nd page , Tmobile April 2019 Version CSC8
[Samsung Galaxy S9+ Guides, News, & Discussion] nikamura:
how fix do I need?

my device is Japan model sc-04j nougat.
[Samsung Galaxy S9+ Guides, News, & Discussion] chompie1337:
I'm downloading but it's pretty slow. I think the vuln is patched on Pie just FYI but I will check anyways.
[Samsung Galaxy S9+ Guides, News, & Discussion] elliwigy:
what do u check in the firm to see if its vuln? maybe would b easier to just upload the imgs u need vs. u dling the entire firm..

but yea, i kno usa s10 n up on pie uses 4.14 kernels.. which they say was patched in 2017 lol..

curious tho wat u find.. if works on s9+ then would potentially work on n9 also
[Samsung Galaxy S9+ Guides, News, & Discussion] elliwigy:
nicee.. wat kernel version u got?

i wonder if running on combo boot which is a bit more lax as far as security would make adifference or not
[Samsung Galaxy S9+ Guides, News, & Discussion] chompie1337:
disassemble the kernel to see if binder_thread_release calls __wake_up. i just need boot.img
[Samsung Galaxy S9+ Guides, News, & Discussion] elliwigy:
got a cheap v20 last night.. runnin ur su98 poc in the v20 forum fails for me fyi.. i mean it gets far but doesnt end in a root shell. I am curious tho n getting it to work as i prefer not to bother with twrp or magisk
[Samsung Galaxy S9+ Guides, News, & Discussion] arpruss:
Can you send me a screenshot from the latest su98 version?

What's your kernel version and patch version? And which v20 model do you have?