yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] zhelan:
And this is what I found in the system/etc/prop.default file of system.img

If anyone knows how this can help :)

#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.actionable_compatible_property.enabled=true
ro.postinstall.fstab.prefix=/system
ro.secure=1
security.perf_harden=1
ro.adb.secure=1
ro.allow.mock.location=0
ro.debuggable=0
debug.atrace.tags.enableflags=0
dalvik.vm.image-dex2oat-Xms=64m
dalvik.vm.image-dex2oat-Xmx=64m
dalvik.vm.dex2oat-Xms=64m
dalvik.vm.dex2oat-Xmx=512m
dalvik.vm.usejit=true
dalvik.vm.usejitprofiles=true
dalvik.vm.dexopt.secondary=true
dalvik.vm.appimageformat=lz4
ro.dalvik.vm.native.bridge=0
pm.dexopt.first-boot=quicken
pm.dexopt.boot=verify
pm.dexopt.install=speed-profile
pm.dexopt.bg-dexopt=speed-profile
pm.dexopt.ab-ota=speed-profile
pm.dexopt.inactive=verify
pm.dexopt.shared=speed
dalvik.vm.dex2oat-resolve-startup-strings=true
dalvik.vm.dex2oat-max-image-block-size=524288
dalvik.vm.minidebuginfo=true
dalvik.vm.dex2oat-minidebuginfo=true
ro.iorapd.enable=false
ro.diag.partition=/dev/block/mmcblk0p2
persist.sys.usb.config=none
[Android Q&A, Help & Troubleshooting] timo.helfer:
Hey guys, unfortunately I didnt have any time to look deeper in to this. But thanks to @zhelan for publishing the sources. Maybe in the next weeks I can find some time to look into this. Hopefully there are others trying to root this device!
[Android Q&A, Help & Troubleshooting] timo.helfer:
Probably found the file which prevents us from running Google Apps on user level like in the workaround from booksebook.it

Its located here /system/etc/blackAppList.xml

<?xml version="1.0" encoding="utf-8"?>
<app_list>
<packageItem>
<pkg_name>com.pp.assistant</pkg_name>
</packageItem>
<packageItem>
<pkg_name>com.google.android.gms</pkg_name>
</packageItem>
<packageItem>
<pkg_name>com.android.vending</pkg_name>
</packageItem>
</app_list>
[Android Q&A, Help & Troubleshooting] sniperiusz:
How to delete this?
[Android Q&A, Help & Troubleshooting] TerminaMorte:
You'd need root to remount rw (and edit the file)

-rw-r--r-- 1 root root u:object_r:system_file:s0 272 2008-12-31 18:00 /system/etc/blackAppList.xml
[Android Q&A, Help & Troubleshooting] Fluegerlibueb:
Guys, I fear I cannot help, but I just registered to cheer you up and tell you that many of us are waiting for this to happen! So, thank you very much for the efforts!

Looking forward to a solution hopefully :)
[Android Q&A, Help & Troubleshooting] xKekistanx:
Seems Hisense just released an update a few days ago and now some of the google apps work, Youtube works without a bypassing app and Google search too. Just play store still doesnt.

EDIT: Seems to stop working as soon as you login though.

EDIT 2: After looking around more, it seems as long as you dont install Google Services Framework AT ALL apps like Google Search, Youtube and Playstore will open and work, but you won't be able to sign in. The fact that com.google.android.gms is still in the blacklist hasn't changed with the update.
[Android Q&A, Help & Troubleshooting] flynttt:
Root getting closer and closer​

Root sempre più vicino – booksebook

www.booksebook.it
[Android Q&A, Help & Troubleshooting] timo.helfer:
Bisch nid elei! :D Weiss aber nid, ob mer überhaupt mol Root für das Grät bechöme...

I think my knowledge is to little in this field to really gain something here. But still I like investigating. Or give someone with more knowledge a hint which results in root access later.
[Android Q&A, Help & Troubleshooting] timo.helfer:
This was already communicated on reddit some weeks ago. I have the new CM2SPD version with the license dongle but could not do anything with it. I assume we are missing the FDL files here. Or maybe I did something wrong.

Edit: What I really like about this device is the community here which craves for its root access :D Stay strong!
[Android Q&A, Help & Troubleshooting] Fluegerlibueb:
lol unglaublich... Schwizer und Gleitschirmpilot? 🙃

Sorry guys that was swiss german. Apparently Timo and I are here for similar intents - we want to use it for paragliding.

However, root access is not needed for that, you can install the pg-software (mainly XCTrack) without problems through sideloading I guess...
[Android Q&A, Help & Troubleshooting] TerminaMorte:
Out of curiosity, could you at least backup your phone with it? Or was it not recognized at all.
[Android Q&A, Help & Troubleshooting] zhelan:
The person from hovatek, says that it cannot extract the firmware content. This is what we need, to extract these fdl files and then patch the rom and upload it!
[Android Q&A, Help & Troubleshooting] Fluegerlibueb:
I will soon receive my A7 CC. Any hints what and how I can remove the bloatware that comes pre-installed? Still looking forward for an eventual root, but just removing **** that comes preinstalled would help a lot. I am an iOS-user so far so bear with me please :-)
[Android Q&A, Help & Troubleshooting] Fluegerlibueb:
I have my A7 CC. It's great for what I need it most (XCTrack paragliding app), but everything else is a pain due to EN/CN-restricted Android.

Any news on the root-front?
[Android Q&A, Help & Troubleshooting] Markismus:
After the latest firmware update and de-installation of Google services everything I throw at it works. I use Aurora with anonymous login --working with LuckyPatcher and Aurora seems better anyway-- and my banking app, hearing aid app, fitness apps, mail app. No pain here with A5 Pro cc.

Everything but google calendar integration works. Still have to get that calendar&contacts server up and running at the NAS.
[Android Q&A, Help & Troubleshooting] plcanonica:
Ali Express seems to have a global version with Google Play... I wonder if it's true?

https://www.aliexpress.com/item/1005001568910063.html?spm=a2g0o.detail.100009.3.90d137ecsCJgOw&gps-id=pcDetailLeftTopSell&scm=1007.13482.95643.0&scm_id=1007.13482.95643.0&scm-url=1007.13482.95643.0&pvid=e1810848-75bb-4e72-9a36-621a530e19dd&_t=gps-id:pcDetailLeftTopSell,scm-url:1007.13482.95643.0,pvid:e1810848-75bb-4e72-9a36-621a530e19dd,tpp_buckets:668%230%23131923%2399_668%230%23131923%2399_668%23888%233325%238_668%23888%233325%238_668%232846%238108%231977_668%235811%2327180%2343_668%232717%237563%23503_668%231000022185%231000066059%230_668%233480%2315683%23113_668%232846%238108%231977_668%235811%2327180%2343_668%232717%237563%23503_668%233164%239976%23995_668%233480%2315683%23113
[Android Q&A, Help & Troubleshooting] zhelan:
It is not true
[Android Q&A, Help & Troubleshooting] zhelan:
A new tablet, for the turkish market. General Mobile e-tab 20 has the same T610 Unisoc chip in it. The thing is that there is a way to download the pac file of this tablet. I was wondering, do you guys and girls think, it would be a good idea to use the fdl files from this tablet to my a5 pro cc or Q5, in order to root it?
[Android Q&A, Help & Troubleshooting] Xakiru:
The phone is pretty useless without push notifications, firebase(which is in most of apps), and other google products. I hope there will be a root soon, otherwise this phone is just trash for me.
[Android Q&A, Help & Troubleshooting] metacoma:
hey folks, any updates?
[Android Q&A, Help & Troubleshooting] timo.helfer:
Unfortunately not..
[Android Q&A, Help & Troubleshooting] heyhey5:
Anyone with a CM2-dongle still interested in rooting this device?

I already posted in the hovatek forum that there are new phones released with the Unisoc Tiger 610:

See also:

Hisense A5 Pro/Pro CC Bootloader Unlock/Private Key Thread

(14-08-2021, 11:41 AM)ahmouse Okay here's the script and a small readme, took me about 8 hours of reading avbtool.py to figure out the key formatting, so I hope someone else here needs it lol. I only

forum.hovatek.com
[Android Q&A, Help & Troubleshooting] etatoby:
I just got my A5 Pro CC and I'm quite happy with it. The screen is not 100% perfect, but for my personal use (outdoors) it's already far better than regular LCDs. My only issue is that no GSF and no root means I cannot install some of my favorite apps, such as AllTrails.

I have added the microG repository to FDroid and installed a bunch of its modules, but it still says signature spoofing is not supported and AllTrails says it "won't run without Google Play Services, which are not supported by your device."

Honestly I'm not sure if I could install Xposed and enable signature spoofing without bricking the device, even if I had root, and I don't know if that app would run if the phone had signature spoofing, but not having root sure limits my options.

Is this correct? Am I missing some steps that I could take to fix the issue?

I have seen dax's posts on booksebook.it on how to install Gapps on this phone, but they all point to a VERY shady copy of Gapps from who knows where, so I'm very reluctant to install those.

IMHO microG > Google spyware >>> cracked stuff from random Mega folders.
[Android Q&A, Help & Troubleshooting] heyhey5:
Edit: nevermind
[Android Q&A, Help & Troubleshooting] KoboldDeekin:
Hello everyone, it's nice to meet ya all.

Are there any updates in this topic? I was wondering if I should buy the A5 Pro CC since I love the idea of an e-ink phone but this rooting problem and not being able to use some really basic apps is a real pain in the ..s if I could say that.
[Android Q&A, Help & Troubleshooting] hrurg:
Good any time of the day!

In your case, I can only advise so far only A5 \ A5C for which there are already alternative firmware.

Or we are waiting)))
[Android Q&A, Help & Troubleshooting] hrurg:
Suggest to anyone with the technical skill to consider a few questions:

1. What is responsible for checking the signature in the update, the integrity of the update?

2. Where is this part of the program located and on which section of the android?

3. Can this section be deleted via Unisoc COM4?

4. Will Unisoc COM4 work after the luck in step 3?

It seems to me that in the absence of verification from the android SPD_Research_Tool will be able to write any ROM.

For my part, I can offer testing on my device.
[Android Q&A, Help & Troubleshooting] Markismus:
I googled Unisoc COM4 but didn't get any hits. @hrurg Could you explain it with more detail, please.
[Android Q&A, Help & Troubleshooting] ahmouse:
I have some (possibly) great news for everyone! I found a public exploit that likely works on this phone and would essentially allow full RW access to the ram, including kernel space. It is possible, according to the author of the exploit, to get temp root with this, so I'll post an update once I get a working demo (hopefully in a week or two, but no promises). I don't wanna post specifics publically just yet, in case a patch is pushed out or someone takes the idea and charges for it or does something malicious with it, but if you have knowledge about OpenCL and/or the Linux kernel please message me.

It probably won't allow unlocking the bootloader, but hopefully it can be a springboard to things such as installing Google Play, uninstalling bloatware, and especially gathering more info to get a permanent root solution.

I posted here so I can get as much help as possible from developers with OpenCL or Linux kernel experience, so again please let me know if you do have experience with those
[Android Q&A, Help & Troubleshooting] drshaggh:
Hi, are you making any progress here? I have very limited Linux kernel experience but happy to provide what assistance I can
[Android Q&A, Help & Troubleshooting] ahmouse:
I think so, but I'll have to do some testing first before I know for sure. As for how to help, this is gonna be the next step: lets say we have full R/W access to ram, including kernel memory, do you know where and what code to inject into kernel memory so that the kernel executes it for us?
[Android Q&A, Help & Troubleshooting] ferlanero:
Is there any updates regarding A5Pro CC rooting? I am following this process with great interest :)
[Android Q&A, Help & Troubleshooting] ahmouse:
TL;DR I've tried a few different methods, slowly getting closer to root by process of elimination.

Also, if anyone wants to help, go to the Android Security Bulletin and check for any vulnerabilities with "High" severity, and a type of "EoP" that were posted later than June 5, 2020. If it doesn't say EoP, copy the vulnerability name ("CVE-XXXX-XXXXX") and search for it online. If it mentions privilege escalation, memory access, use-after-free, arbitrary code execution, or something similar, post it here

So far, not much. However I'll write about exactly what I'm trying to use to achieve root so more people can help. Firstly, the latest update for the phone that I know about uses the Android security patch for June 5, 2020. So, I've been looking for any privilege escalation exploits in the Android Security Bulletin that were posted later than that, meaning they're not patched on our phones.

After some research, I stumbled upon CVE-2021-28663, a security vulnerability on Mali GPUs that allows for full read-write memory access. The problem though is that the memory is read-only from the CPU, so only programs running on the GPU have full write access. There is a proof-of-concept script here, which seems to work on this phone, telling me that the phone is in fact vulnerable. A translation of the original white paper that describes the vulnerability (originally in Chinese) can be found here, and it has tons of useful information, especially the fact that the author said he gained root privileges using the exploit. The hard part is having a program execute on the GPU.

The author used OpenCL, however it turns out that the Hisense A5 Pro does not support it, and while looking for alternatives I found OpenGL and Vulkan. OpenGL doesn't have any way to write arbitrarily to memory, so I looked at Vulkan instead, which turned out to have an extension, VK_EXT_buffer_device_address, that let's us do just that. To my dismay, after spending many hours trying to get a Vulkan program to exploit this vulnerability, I learned that our phone doesn't support the VK_EXT_buffer_device_address extension, and thus Vulkan wouldn't work.

Now I'm trying to find another way to have our code execute on the GPU, and I've been reading through the Mali driver source code (available here) to find a way to do so. I plan to try to message the author of the original exploit, as well as some developers here on XDA that have successfully gained root via similar exploits.

In the mean time, if you can help with the programming and kernel-related stuff that would be awesome, otherwise, if you can find, or know of any other exploits that can be used, please let me know. The best way is to go to the Android Security Bulletin and check for any vulnerabilities with "High" severity, and a type of "EoP" that were posted later than June 5, 2020. If it doesn't say EoP, copy the vulnerability name ("CVE-XXXX-XXXXX") and search for it online. If it mentions privilege escalation, memory access, use-after-free, arbitrary code execution, or something similar, post it here!
[Android Q&A, Help & Troubleshooting] Limio:
Thanks for the update :)

Are you sure about the Hisense A5 Pro not supporting OpenCL? I found the lib under: /system/vendor/lib/egl/libGLES_mali.so

Edit: there is also another OpenCL-lib here: /system/vendor/lib64/libGLES_mali.so

So when you check the OpenCL library, make sure you also check the corresponding lib64 folder (if you prefer arm64-v8a as the first ABI for your app, you may want to first check lib64 folder).

See also:

Does Android support OpenCL?

Recently I want to develop the parallel computing application on android use OpenCL. As far as I know, Android system does not include "libopencl.so",but there are still some webs or blogs show Ope...

stackoverflow.com
[Android Q&A, Help & Troubleshooting] ahmouse:
You are correct. I didn't check the 32-bit library, however the 64 lib didn't have any symbols related to opencl after checking withstrings, objdump, and readelf. Also, I tried a few OpenCL testing apps, and none worked, but who knows how reliable they are. I'll double check the 32 bit library, though, just in case
[Android Q&A, Help & Troubleshooting] Limio:
I guess the 32-bit library didn't include something promising regarding to opencl-support?

By the way, I found a russian forum which also is pretty active related to this phone...

They actually uploaded all the older firmware versions for the phone:

hisense

Посмотреть и скачать с Яндекс Диска

disk.yandex.ru

Of course all those are also .bin files and not .pac (unfortunately).

However, my guess would be that older versions of the firmware would be more vulnerable to exploits.
[Android Q&A, Help & Troubleshooting] hodgsonw:
Hi,

I want to say best of luck, I'm also cheering for you ahmouse.

Checking the Android Security Bulletin there seem to be many High Severity EoP CVEs in the System, Framework, and Kernel categories since 2020.

I found a few High severity Unisoc CVEs in case a hardware specific approach to rooting is preferred.

Here I list them with their effected component.

The most promising two vulnerabilities look to be

a) CVE-2021-0635

which involves an error when extracting incorrectly formatted FLV files

and

b) CVE-2021-39658

which seems to involve an sms service that doesn't check permissions of a caller entity.

It says 3rd party apps could exploit this to modify system properties.

I hope this helps, I'd love to see these phones rooted.
[Android Q&A, Help & Troubleshooting] benathan:
Just stumbled on CVE-2021-33909. It affects many Linux distrubution but requires at least 5GB memory for exploitation. I haven't figured out how to port it to Android yet.

Exp: Here

Details: Here and Here
[Android Q&A, Help & Troubleshooting] ahmouse:
I've made a useful bit of progress thanks to @hodgsonw

Scroll to the bottom to see how to modify your system properties, equivalent to using setprop but works on more properties ofc

@Limio

No it didn't, though it was a long shot.

Thanks for linking the forum and firmware, those may come in handy in the future. I'm glad to know there's enough people interested in rooting this phone that there's 4 or 5 forums dedicated to it

@hodgsonw

Thank you for posting your findings!

I briefly glanced over those CVEs before, but after looking more closely I realized they could be more useful than I thought. In fact, thanks to your post, I not only looked into CVE-2021-39658, but was able to successfully use it! It took a few days, but I'm now able to modify most system properties, however, the exploit wasn't able to change the important ones such as ro.secure and ro.adb.secure. I'm not sure if this will be of much use without those two, but if someone knows any other useful system properties please be sure to post it

@benathan Interesting find, I have a 6gb model so thankfully I can try to test it. I managed to compile it for the phone, however it didn't run properly since I didn't link the required libraries properly, so I'll look into that when I can.

Please be careful when modifying system properties!

In order to modify a property, run

adb shell service call ismsEx 6 i32 0 s16 "prop.to.change" s16 "value"

Also, this should work on any Unisoc/Spreadtrum based phone, not just Hisense

If it says something like "Not a data message" it means it failed, usually because the property is protected

Looking forward to finding more things like this!
[Android Q&A, Help & Troubleshooting] timo.helfer:
Awesome! Gonna try some stuff when I have time. Have you checked my post #52 if it could help to gain temp root?
[Android Q&A, Help & Troubleshooting] ahmouse:
Great!

I have, it seems to only check the system property via the corresponding get function to whats shown below, rather than setting it. I found that in the same class db.class, is another function which allows setting properties arbitrarily. It looks like this:

public static void g(String paramString1, String paramString2) {
try {
Method method = Class.forName("android.os.SystemProperties").getMethod("set", new Class[] { String.class, String.class });
method.setAccessible(true);
method.invoke(null, new Object[] { paramString1, paramString2 });
} catch (Exception exception) {
exception.printStackTrace();
}
}

It's referenced a lot for setting various factory test related props, including ctl.start, which is used to have init start a service post-boot, and if the app can set that it can probably also change something like ro.secure. I don't even know if ro.secure can be changed while the system is running, but if we find a way to slip our own props in there may be a chance
[Android Q&A, Help & Troubleshooting] benathan:
Just found out that we have a limited escalated shell (system(uid=1000)). To access it, go to EngineerMode -> DEBUG&LOG -> Adb shell.
[Android Q&A, Help & Troubleshooting] ahmouse:
Ty! I saw that shell but didn't even think to check its privileges, though it seems commands such as setprop are blocked. Some system services have functions that require certain permissions, so this shell probably has the permissions to run them, and I've confirmed the service call command isn't blocked. Using the shell and a service might provide us with even more options on the road to root

In more news, and I'm quite proud of myself for this new discovery: a way to read almost every system file.

Thanks to yet another system service that doesn't check permissions, I was able to read partitions such as boot and recovery, as well as build.prop and other files.

Unfortunately I wasn't able to read from init.rc and its related files. The deleting and writing functions don't seem to work, which is probably a good thing, and I couldn't find parameters that worked for them. I posted them anyways so everyone knows not to run those commands, just in case.

WARNING: Do not attempt to write to or delete any system files. Doing so will trip dm-verity and brick your device.

Like the previous service command, this should work on all unisoc phones. If you wanna test it on another phone, run

service list | grep factory_test

to see if your phone has the service installed.

Now, the command(s) you've been waiting for:

Replace /my/file/ with the path to the file you want to read from

Replace OFFSET with how many characters to skip in the beginning of the file

Replace LENGTH with how many characters to read, must be <= size of the file or the command won't return anything

If you want to read the whole file, run ls -l /my/file/, and replace LENGTH with the number that comes right before the date

service call factory_test 3 s16 "/my/file/" i32 OFFSET i32 LENGTH

Spoiler content hidden.

Using this I was able to read from the partitions in /dev/block/by-name/, meaning we can take a full backup of the entire ROM, including some partitions that weren't even in the leaked firmware package

I'll keep on the hunt for any other services that expose very convenient functions like these last two
[Android Q&A, Help & Troubleshooting] mirkovidovic13:
Hi guys, Im also waiting eagerly for this root. Maybe to speed up the process and give some motivation to developers I thought let's award the first one who cracks it. I will donate 20$ to the one who manages to root the phone. Reply to this post with how much money You PROMISE You will donate to the first developer who manages to root it. (there is also one other guy who promises 125$ for this root in another post).

Developer, after You post fully functioning root, You are getting Your hard earned money via PayPal (or other way you choose).

Cmon people, let's do this!
[Android Q&A, Help & Troubleshooting] mirkovidovic13:
P. S. Careful, If You wait too long for more money to sum up, some other developer might come up as the first one while You wait. So don't wait but get to work
[Android Q&A, Help & Troubleshooting] Limio:
Does that mean that you are already able to extract and upload the entire unencrypted ROM or do you still need read access to init.rc to do so?
[Android Q&A, Help & Troubleshooting] formeriphoneuser:
Just curious, how similar is the Hisense Touch to the A5 models? And is there or will there likely be root for this?