yashsingh1/xdaforums huggingface dataset:
[Introductions] Britt6617:
Same here!! Uh yeah need help.. someone has hacked my phone and put a custom rom or img so when it starts it starts from that, idk how go undo it qithout a computer.. they can remotely hack my phone and record all the data and change stuff around.. it says my phone isn't rooted when infact it is.. helpp as far as I know they only bad another andriod phone and tablet.. I only have this phone that's hacked what can I doo..
[Introductions] sd_shadow:
Without a PC you are not going to fix it.

What model do you have?
[Introductions] Britt6617:
That's what I thought but for now I just need it or them to stop being able to remotely see, record, and even remotely control the phone.. I found the dirty object image or whatever.. it's a SM-A516U..
[Introductions] Britt6617:
Like I said I dunno anything about this but is this the normal amount of installed pkgs??
[Introductions] caroline!:
Hey, I have an old China phone that's more a paperweight than a phone because every time I connect it to the internet (via a safe network) it begins downloading viruses and weird apps that try to display apps, and if I happen to uninstall them, the phone simply bricks again and doesn't works unless I do a factory reset. Know if there's any way to fix it? I can't seem to be able to root it, let alone install a custom ROM.

It's got Android 5 I believe, a friend gave it to me because it can't be used for anything because of the viruses.

I'd make a thread but I don't even know where it is right now and I think on top of all the USB port is busted.
[Introductions] sd_shadow:
See the A51 forum

Samsung Galaxy A51 Questions & Answers

Ask your questions about the Samsung Galaxy A51 and get answers from the community! Please be as specific as possible when posting.

xdaforums.com

and I would remove/black out the imei in your screenshots.
[Introductions] wugga3:
Yeah and the phone number to black out also... Not a good idea to display either information in a public forum...
[Xiaomi Poco X3 Pro] Raikoben:
Hello! I have poco x3 pro 6gb 128gb 12.5.3.0 RJUEUXM TWRP and rooted with magisk (also I have modified kernel settings with smartpack following a guide in this forum) and I wanted to flash a custom rom but I am really scared about breaking the phone, what custom rom can I flash? also whitch one is the best? I usually do normal usage like gaming/youtube/facebook/some photo, i see alot of stutter with miui mostly in google discovery, so im looking for a butter smooth experience and high battery duration! many thanks :D
[Xiaomi Poco X3 Pro] borisku:
I love AICP 16 with a lot of setting opportunities and weekly updates... i love it since discovered it (AICP11 for ZTE Axon 7)
[Touch Diamond, MDA Compact IV General] J4CKY:
German see Below

ENG:

Hi,

I have a quastion for my XDA Diamond.

When I write a SMS I see only 2 rows from my written text and many many rows of old text messages.

is is possible to configurate my diamond to see 4 rows of the SMS that i'm writing?

if my question is not understandable, writes me a message

GER:

Hi Leute,

wenn ich ne SMS schreibe würde ich gerne anstatt der 2 angezeigen eingabezeilen 4 oder mehr sehen.
[Touch Diamond, MDA Compact IV General] Herr_Knigge:
there is a solution (a cab file) somewhere on this forum, i just don't know where:confused:

GER: Also, es gibt hier ne cab-Datei, hab die bei mir drauf, find sie aber nicht mehr...

EDIT: okay, found it http://xdaforums.com/showthread.php?t=404396&highlight=sms+reply
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
If you still use oppo f1s in 2021 or 2022+ go throw it away RIGHT NOW . your phone is fully spying on you and somebody inside or outside of oppo is fully viewing your actions andde things u perform on your device here is why

First after using the phone for 4 years i found out that it has a spyware built into the system that allow a person to fully see every action you perform on the android os

My oppo phone had android 6 with no malware or ADB enabled . And what happened to me is so crazy

One day i booted into my computer with a usb stick that had manjaro linux . So i booted into live persistence mode then i connected my computer to my wifi then when i turned my oppo f1s phone

and after the phone connected to the same wifi as my computer

Somebody hacked the linux os and started writing words on my screen then targeted a company from the USA by writing its name on a wifi login interface

So the person who control the spyware tried to say that the name of the company he wrote is responsible on the hack while it is actually not

The good thing is that i took a picture ofof the words this person wrote on my screen as you can see on the attachements

so after i wiped the data of my phone . Somebody played the google ring sound on the phone when the phone had no google accounts connected on it .

On that time i realised that the phone had a built in spyware used by oppo in order to monitor user activites and it has full access to the system and camera and microphone and your process list does not display it and u can not toggle its permissions or even detect it or remove it .

Just get another phone because the oppo f1s is not safe at all as i saw somebody gained access to my computer through the phone itself

While the phone had no running services at the start except of google services and messenger and facebook . And for messenger and facebook they were installed from the playstore

And the phone had no malware detections at all .

it has something unormal built into it

So if you still own a oppo f1s you better throw it away and switch away to another phone

This is not the complet story of the phone still more
[Oppo F1s Guides, News, & Discussion] blackhawk:
Malware on Chinese phones?

X-helper may be present...

Reflash with a clean rom.
[Oppo F1s Guides, News, & Discussion] mlgmxyysd:
So why do you think hacker attacks are related to mobile phones?
[Oppo F1s Guides, News, & Discussion] blackhawk:
Some of these phones were preloaded with malware apparently.
[Oppo F1s Guides, News, & Discussion] mlgmxyysd:
it's impossible
[Oppo F1s Guides, News, & Discussion] blackhawk:
Stop that you...
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
The fact is that the only running processes on the phone were system processes , messenger , facebook , and google services .

So after i wiped the data and after all installed apps were removed i did not enter my google account on the phone so the ring audio appeared and happened when the phone had no google accounts connected and no installed applications at all . Means that somebody played the google ring sound on the oppo phone after i wiped the data

So how somebody can ring your phone when your phone has nothing on it . And has no google accounts connected to it . So the spyware take part of the system

and for changing the rom or getting Twrp on it is a very hard mission . even when i tried flashing it with a pc and following most tutorials it, failed .

So oppo actually did something unormal with this phone . Also its a phone that was released on august 2016 so imagine what may happened with phone made on 2022 and 2021
[Oppo F1s Guides, News, & Discussion] x3r0.13urn:
This is quite serious accusation.

How did your Manjaro Linux get hacked while your phone was connected to the same wifi? I find it very strange to see Linux operating system can be easily hacked. From your screenshot, it even showed the X Windows hacked similar to remote desktop.
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
Yeah I was surprised too. I was running it on live persistence mode directly from the usb . So it was not installed on the hard drive also it had the default kernel and the default installation environment

So I did not install it and

I ran a command to install an application then the person who gained access to the linux os Canceled the installation and wrote ";6OR" then pasted "The Global broadband Speed test " on a wifi login interface .

He actually tried to target ookla speedtest company while ookla is fully out of the situation .

Even the ookla speedtest app that I had was installed from the playstore and was not running on the background and had no permissions at all

Just the person saw me running ookla on my oppo device did something smart and wrote it on my computer's screen after 4 years of spying as a way to hide or to cover what he did

Thats kinda weird

So malware also allow the attacker to gain remote access to other connected devices while having full access on the device . And the applications manager does not display it or even allow the user to modify its permission .

So the user will notice nothing at all
[Oppo F1s Guides, News, & Discussion] blackhawk:
Android is a modified Linux platform. I feel safer running Windows on the PC to backup an Android. As a further safeguard the PC can't be connected to wifi or the internet.

A Android to PC infection could get very ugly if it was able breach the backup data drives. It's one of the reasons I have many backup data hdds that are time staggered up to years apart and physically isolated from each other and the PC.

XDA gets delusional people here weekly that think they been hacked. Sadly it's their own brain that's been hacked by biology or skewed thinking.

That doesn't mean that real infections and hacking don't happen. Documenting them is tedious and the last thing I care about doing when faced with an active infection or tainted file. My only concern is damage control and repairing the damage already done.

I really don't care if someone doesn't believe me when I tell them about a malware jpeg that damaged files in my download folder. I found that jpeg, successfully deleted it and repaired the damage... that's all that matters to me. That's the worst I've seen in 2 years running on Pie. Took about an hour to clean up, whatever.

I downloaded that jpeg, my bad. Fortunately I discovered it in the download folder by opening it there and seeing the changes made in that folder immediately afterwards. That's the second tainted jpeg I've encountered in over a decade.

If it had been a preloaded infected apk (or one I inadvertently installed) with full Administrator privileges the outcome would have been much worse.

This OP may actually have software issue not a soft tissue issue... just saying🧐
[Oppo F1s Guides, News, & Discussion] namitutonka:
:ROFLMAO:
[Oppo F1s Guides, News, & Discussion] evilhawk00:
I was shocked by the title so I clicked in.....

Ummm,

Isn't all the firmware packages are downloadable? Where is the malware file located in the firmware exactly? Where is the related payload file?

Isn't it necessary to provide the malware file from the firmware to point out the malware was made by the vendor? How can you be so sure you're not hacked by somewhere else?

This story looks really like this: I think he or she is having an affair with one's wife or husband. Where's the proof? Sorry, I don't have proof, I simply think it happened.

Well, looks like no problem at all...
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
if I can find a way to get TWRP flashed on the phone I ll be able to take a backup ZIP file and send it here

so anyone here will be able to even try the infected OS on a test phone

by flashing the backup zip file on the "restore" feature of TWRP

And this is not the complet story ,

because when I got that phone for the first time on 2017 and when I was a kid , I was recording the sea on a boat then a girl came up and told me to take a look on her phone , then she showed me that the same video I was recording is present on a adult website and because of my age that time I did not understand what she wanted to say and that the video was getting streamed from my oppo f1s phone's camera and until this day I did not find myself even on the that website , and from 2017 until 2021 I keept using the phone which was the biggest mistake ever of my life until I realized that it was it was not only infecting my devices , it was also streaming me without my permission to an adult website while nothing on the phone is having camera permission

And the process used or I can confirm as the tool used by oppo is the "Android OS" itself because it has already full permissions and access on the phone that the user can not even toggle

Also I did never use the phone on a wifi having somebody connected with a Pc with such tools so I can confirm that it nobody has the ability to try hacking it ,

and for that story upside still more.... more..... like one time I went into a livestream video on youtube then the person that I started watching said

"Omg he is watching this video" and "Dude your ISP is spying on you and your whole country wont tell you and yeah they are streaming on P###hub and everyone think that they are making fun of you while they are actually not they are actually spying on you"

then the guy next to this streamer told him "Dude its not ISP basically nobody know why"

And there is another youtuber who showed the same reaction on one of his livestream videos

but the problem is that when I keept searching for the stream , they were deleted , I spent like months searching dor myself on the internet and I found nothing
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
A process called "Android OS" the one that the process bar display as system app ,
[Oppo F1s Guides, News, & Discussion] evilhawk00:
This is nonsense. You don't need TWRP to get the infected file. If it is made by vendor just like you said, simply download the official firmware from oppo and point out which file it is. Then analysis the file with rever engineering, this is how you can proof it is made by oppo

Anything grabbed from your phone can't proof anything. Anyone can insert malware into your phone. Even a local reseller can do that. The bootloader is not locked, even an APK that uses exploit to get root access can replace the system file of your phone. Your system might have been modified by some malicious APKs.

For example, if you use KingRoot, they insert su.kud file into your /system partition. Any malware that has the ability to root the phone can do that. Since the firmware is outdated without getting any security patch, any malware with ability to root the phone can insert dirty things into your phone. I think this may be the case on your phone.
[Oppo F1s Guides, News, & Discussion] rootinhoppo:
Why would a hacker do that? It's silly. A hacker would use your wifi connection without advertising its presence like that.

Yes I saw that attachment but you know it doesn't prove anything.

Look :

"Oh no! XDA is infected! I was trying to enter my password when the spy started to write this words before me. Please, delete all your accounts!"

(Disclaimer: it's a joke, don't take it seriously).

Mm, yeah ok. It totally happened.

Seems legit.

Guys, let's help him to clean up his infected Oppo!

I suggest we put on our red dresses and dance in circle singing the "Consummatum est. Diabolo fuge. Diabolo fuge!" incantation.
[Oppo F1s Guides, News, & Discussion] evilhawk00:
Factory reset is not enough to remove malware inserted into your firmware via root. Factory reset doesn't reset to factory state in your case because factory reset doesn't really rewrite /system partition, it just deletes /data partition. So any modification in /system partition still remains. If you run SafetyNet check on your device you will find out it fails to pass SafetyNet. How to find out? You can use YASNAC to check it. If your phone fails to pass Safetynet, that means your device doesn't have the same software as the stock one. And that means you need to use another method to reset your device.

You need to reinstall stock firmware with recovery or use DownloadTool to reset your device.

Seeing how you fix your phone, I think you really lack basic knowledge of Android or even cyber security. I suggest you remove this ridiculous thread because your accusation is actually based on nothing, but only with personal experience which was actually caused by misconception due to the lack of basic Android knowledge.
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
I know that a factory reset or even doing it billion of times can not solve the problem

I was just explaining that the whole thing going on here is not caused by user interaction , it means that I did not M I s t a k e l y end up here by doing a mistake like getting something to run on the os and giving it wide access on the device

And this is not the way I fix any phone , im not like the smart guy who says "hey go format your device and everything will be fine"

I know it will change nothing on this case
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
it passes safetynet, and all these problems keep going on , the problen is not caused by an app that had root access on the device

its caused by the stock firmware itself
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
I tried it a long time ago and it fails with an error even while ADB drivers are installed on windows

I just tried it to flash a twrp.img file as recovery that time
[Oppo F1s Guides, News, & Discussion] evilhawk00:
Having the Safetynet pass doesn't mean it has the exact same software as stock because the google play service doesn't check every file of the system. Magisk hide also has the ability to pass SafetyNet. These things are all open source, it can be copied by malware coders to include these technics in their malware. But not passing Safetynet 100% guarantee the system has been modified. If you haven't reinstalled the software via downloadtool or recovery. You can not say it is caused by stock firmware itself, as your stock firmware may not be stock.
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
in addition to that , when I got the phone box was really closed and and there was a tape that confirms that nobody opened it before ,

Which was similar to old unboxing videos of the oppo phone back to 2016 and 2017

I know its kinda weird , but lets say u have my phone between ur hands one time , I'll be sure that u'll get extremely confused because I did not mess up with it at all , and u'll see that unormal things keep going on ,

just if u boot the phone directly and even if u run all these checks on it it will pass them successfully or even if u use any tool on it it will detect nothing ,

Anyway thanks for the informations given
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
Alright thanks for sure nothing is secure by 100% or at least by 99% and every system in this world can be hacked

But mostly i've been experiencing all these problems since the time I got the phone out of the box , and back to the start there was almost nothing that tries kernel exploits for gaining root access on phone

And thanks alot for every reply u posted before , of course I dont have all the knowledge on me , as everyone here sometimes we need help when things get extremely confusing for us ,

and the biggest question here is ,

how a malware keep running from 2017 until 2021 , as I know a malware always need a server to be capable of receiving commands and sending stolen data and replys back to the attacker

on this case the attacker's server was up for more than 4 years ... as I know a malware that is made by a script kiddie would last for at least 3 months until the ip forwarding and many things change

so the attacker on my case was really prepared or not even spying on one perosn but millions , so yeah

And thanks of course for ur replys u made my day today
[Oppo F1s Guides, News, & Discussion] evilhawk00:
Even nobody has opened your phone, that doesn't mean your phone can't get infected via any sideloaded APKs. I'm an Android developer but also interested in malware research, I have lots of experience cracking or modifying APKs with Smali and inserting my own code into others' APKs. I can tell it is easy to run exploit code to get root access and place ELF malware binary into /system. You don't need to mess up anything, all you need is to install the malware payload APK and run it for the first time , and now the apk gets the root access via exploit and copy ELF binary or .so file to your /system partition. Even after that, you remove the apk but the malware doesn't get removed. What checks have you made? Checking with Antivirus? Antivirus 99% won't detect these things because most of the Android Antivirus simply checks the hash of the apk but doesn't have the ability to check malware in firmware.

The easiest way to find out this kind of malwares is to set up a transparent proxy on a laptop with a Wi-Fi hotspot and connect the phone to that hotspot. So you can see all the connections go through the mobile. I've been developing android apps on my old oppo F1s for a while a couple of times ago, but I've never seen any suspicious connections come out from my F1s.

And malwares are not made by "script kiddies". Script kiddies don't know how to make malware, they only use malware sold by hackers. For what you think about malware requiring a remote IP it is wrong. It can be a domain, or even a dropbox file, or a Pastebin file, hacker can update that file every day. The remote destination can always be updated and the backdoor in your phone can always be updated too. As long as the malware is not widely spread and it is not noticed by a security researcher, it can operate for many years with no problem for sure. Usually, this kind of case happens when the victims are being targeted.

All the checks you made mean nothing unless you really rewrite your /system partition to make sure it is stock.

You can take a look about some examples that patches your system file : https://securelist.com/dvmap-the-first-android-malware-with-code-injection/78648/
[Oppo F1s Guides, News, & Discussion] CESTRayCRYSTAL:
so android 6.0 is vulnerable to this kind of exploit right? , on 2021 I tried mtk easy for getting a temporary root access on that oppo phone and getting magisk installed through mtkeasy so it uses the same exploit right? , and which android versions or kernels are not vulnerable to this exploit

u teached me alot right there .. but if u use this kind of exploit or the exploit u mentioned against the android 6.0 on that oppo f1s then files made on that root partition will be not deleted after a reboot or something ? ,

sure? , so the attacker can receive a connexion back to the device as long as the malicious file is present on that root partition ? and a reboot for 6.0 changes nothing? for android 6.0 things added to system will stay there forever ?

And what are the android versions that are not vulnerable?