yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] Renate:
You need to first load payload (i.e. uncompressed kernel) into Ghidra as raw binary, AARCH64, little, v8a

I've never tried a whole kernel in Ghidra, it's red-lining my poor CPU.

I don't think that it can figure out kallsyms all by itself. But I don't know, it's still grinding.

Ghidra is too much FUN. Everything is FUN. Jeez.

I don't know, it looks like Ghidra can only import Windows .pdb files?

I can't even set the load address. They say it's in options, I can't find it. It must only be settable while opening.

The last time I tried Ghidra on a lib.so it flaked out on a jump table so I went back to my own stuff.

You want some kind of script from the "Script Manager".

Without setting the load address it will be a mess.

Oh, I forgot that kallsyms.exe takes /l0 (ell-zero) for load address

You need a Python script to import:

from ghidra.program.model.symbol.SourceType import *
import string

functionManager = currentProgram.getFunctionManager()

f = askFile("Select file", "Import")

for line in file(f.absolutePath):
pieces = line.split()

address = toAddr(pieces[0])
type = pieces[1]
name = pieces[2]

func = functionManager.getFunctionAt(address)
if func is not None:
func.setName(name, USER_DEFINED)
print("Renamed {} at {}".format(name, address))
else:
createFunction(address, name)
print("Created {} at {}".format(name, address))

That works. I ran it on my Poke3 kernel, I forget where I put yours.
[Android Q&A, Help & Troubleshooting] bigwigs:
This doesn't work, in the sense, nothing happens. Attached screenshot
[Android Q&A, Help & Troubleshooting] bigwigs:
i can attach payload and kernel.sym if you want.

About above python script, which files should i select?
[Android Q&A, Help & Troubleshooting] bigwigs:
i can load kernel.sym genereted using ur tool and loading in ghidra as PE Executable- AARCH64.

Have decent CPU and ram, so it is analyzing.

Attached screenshot of ongoing analysis.
[Android Q&A, Help & Troubleshooting] Renate:
I found it on page 36 here. I had already downloaded latest-boot.img

Use kallsyms.exe like here, but add the slash-ell-zero https://xdaforums.com/t/hisense-a9-root-reward-offered-snapdragon-662.4495809/post-89336696

Oops, my bad, you didn't need the /l0 (but it does no harm).

The kernel I was working on had absolute addresses. This has relative zero anyway.

You should probably import symbols before "analyzing", it's easier.

It also will allow the generic symbols to be marked as data if they are.

Go to Window > Script Manager, select *any* script, select "basic edit", select all, delete, paste the copied Python, hit the save.

It will say, "You can't overwrite a read-only, what name do you want?" I say "Kallsyms.py".

Then double click it in the list...

Well, at least I learned something.

I'm not waiting for this to grind through. It's getting there. For me, it's "book & bed" time.

**************************************************************
* FUNCTION *
**************************************************************
undefined epd_panel_sysfs_init()
undefined w0:1 <RETURN>
epd_panel_sysfs_init XREF[1]: dsi_display_dev_probe:00e80248(c
00e9ddc0 fd 7b be a9 stp x29,x30,[sp, #-0x20]!
[Android Q&A, Help & Troubleshooting] bigwigs:
im getting below error:-

type = pieces[1]

IndexError: index out of range: 1

kallsyms.py> Finished!

Below are the steps , i did looking at ur posts:-

1) Imported kernel.sym from ur tool into Ghidra

2) Created following python script in Script Manager as per ur instructions-

******************************

from ghidra.program.model.symbol.SourceType import *

import string

functionManager = currentProgram.getFunctionManager()

f = askFile("Select file", "Import")

for line in file(f.absolutePath):

pieces = line.split()

address = toAddr(pieces[0])

type = pieces[1]

name = pieces[2]

func = functionManager.getFunctionAt(address)

if func is not None:

func.setName(name, USER_DEFINED)

print("Renamed {} at {}".format(name, address))

else:

createFunction(address, name)

print("Created {} at {}".format(name, address))

******************************

3) Executed the script via script manager

4) Select payload file when script manager asked for the file.

Let me know if the above steps are incorrect. Below is screenshot.

thanks!
[Android Q&A, Help & Troubleshooting] Renate:
You've got things a little backwards.

Have you looked at (text edit) kernel.sym?

It's just a 112,041 line text file with 3 columns (and no header).

Start Ghidra

File > Import, select "payload", raw binary, AARCH64, v8a, little

"payload has not been analyzed. Do you want to analyze it now?" Answer NO

Window > Script manager, double click previously created script, select "kernel.sym", Import

Analyze > Automatic, Go

Go to your kitchen and make eggs benedict, eat 'em

Peruse listing
[Android Q&A, Help & Troubleshooting] dferreira:
So I've been reverse engineering the EpdManagerService. It has plenty of hooks to the stock OS. I used JADX on the whole com.android.server folder so that I can get the build to finish. I'll then trim the EpdManagerService to only keep what interfaces with the hardware and leave everything else out.

Also looking at EpdManager app, I see it's looking for build.prop properties to determine what it can or cannot do. So I'll see what the stock rom has, since we have root, and bring them in.

EDIT: looking at /vendor/build.prop on the stock ROM, these keys do not exist... I'm thinking it this is for some other device and they just recycle the binaries...

EDIT2: was looking at the wrong place. These are in /system/build.prop!
[Android Q&A, Help & Troubleshooting] dferreira:
Look what I found in /system/build.prop @bigwigs

You could try to set the network mode to enable more bands! Let me know what you enable with the stock rom for which you have root and I'll add this to this Lineage build.

There are these too:

# add by zyl for network control

persist.radio.primarycard=true

ro.hmct.operatorswitch=1

persist.sys.hmct.sig_optimize=l5d

persist.sys.hmct.nw_optimize=enable

ro.hmct.volte.enabled=1

ro.hmct.volte.dual=1

ro.hmct.volte.operator=cmcc+ct+cu

persist.sys.hmct.unlock_pin=disable
[Android Q&A, Help & Troubleshooting] bigwigs:
im getting same error-

Traceback (most recent call last):

File "/home/xxxxx/ghidra_11.0.1_PUBLIC_20240130/ghidra_11.0.1_PUBLIC/Ghidra/Features/BSim/ghidra_scripts/kallsyms.py", line 14, in <module>

type = pieces[1]

IndexError: index out of range: 1

kallsyms.py> Finished!
[Android Q&A, Help & Troubleshooting] bigwigs:
Good find. This is not the issue though. The network mode can be modified using one of the dialer codes.

The issue is enabling additional LTE Bands. After researching for last couple of weeks, looking at phones with same processor, it seems that LTE bands are blocked at modem programming level.

This could either be due to need of additional amplifier chip (not added to limit the costs) or limit the cost by limiting bands. (both reasons have been mentioned across various posts).

Few things, i have found while playing around:-

1) Dialer codes are controlled by FTMode app. Only out of box phone app can access it. Google phone app is not able to use dialer codes. I get error -" No calling accounts set up for this functionality"

2) WIFI Calling can be enabled using google phone app. By going into settings, then calling accounts and then enabling it. If you have dual sim, then this cannot be done. So, one has to use one sim at time and enable the same by switching sim1 and sim2. Then both can have wifi calling enabled but the capability could be limited due to DSDS.

For now, focus is on kernel disassembly.
[Android Q&A, Help & Troubleshooting] Renate:
Sounds logical, but isn't that all in the (signed ELF) modem partition?
[Android Q&A, Help & Troubleshooting] bigwigs:
Check out ClassyShark3xodus app (available on F-Droid store). It will tell u which apps have trackers. There is app called Netguard (Fdroid) then help you clamp down ur even more. The challenge is to spend time and enable each and every interaction :)
[Android Q&A, Help & Troubleshooting] bigwigs:
[/QUOTE]

The file NON-HLOS_001360E1.bin is used to setup modemst1 and modemst2 partitions. Would need to open it and see how to change the programming.
[Android Q&A, Help & Troubleshooting] bigwigs:
Weird. This is working on Windows but not on Fedora .
[Android Q&A, Help & Troubleshooting] Renate:
What file are you selecting? It only takes text files of 3 columns.

Could you post that NON-HLOS_001360E1.bin, please?
[Android Q&A, Help & Troubleshooting] bigwigs:
kernel.sym- same file on both OS.

Followed the steps below:-

Start Ghidra

File > Import, select "payload", raw binary, AARCH64, v8a, little, visual studio(another option is default)

"payload has not been analyzed. Do you want to analyze it now?" Answer NO

Window > Script manager, double click previously created script, select "kernel.sym", Import

Analyze > Automatic, Go

Attached log. It was quick within 1-2 mins.
[Android Q&A, Help & Troubleshooting] Renate:
Yes, it looks all good.

I don't understand the jabber or why it was trying to load more than 6 LUNs.

For my edl.exe you need to add /u in all commands (although not necessary when only doing /l).
[Android Q&A, Help & Troubleshooting] dferreira:
I was able to make a backup of boot_a and boot_b before flashing the modified boot.img from Magisk but now the device is stuck on fastboot mode. Will have to restore backup before trying something else. But hey, WE HAVE A SIGNED .ELF and can now talk with this puppy!!!
[Android Q&A, Help & Troubleshooting] Renate:
Yup, all good stuff.

But where did that "modified boot.img" come from? Did you Magisk what you just pulled off your device? Or was it something that you had from before?

You can restore your original boot.img, run Magisk app and mod what just came off your device then flash that.
[Android Q&A, Help & Troubleshooting] dferreira:
will do and report back!
[Android Q&A, Help & Troubleshooting] dferreira:
Interesting... I can't seem to be able to get out of fastboot 🙈 looks like I'm screwed. Fastboot doesn't allow me to boot from a boot.img either.
[Android Q&A, Help & Troubleshooting] dferreira:
Is there a way to get fastboot to boot to edl? For the best of me, can't get it to even go to recovery.
[Android Q&A, Help & Troubleshooting] dferreira:
This was my mistake, I had used a boot.img (can't remember from where) with Magisk, instead of using the one that I just backed up 😭
[Android Q&A, Help & Troubleshooting] Renate:
You can use fastboot to flash your original boot.img (providing you unlocked fastboot).

If not, you should probably try an "EDL cable", it's easy to make.

If not, you'll have to find the EDL test points on the PCB.

If not, you'll have to defeat the UFS.
[Android Q&A, Help & Troubleshooting] dferreira:
Going to make my own EDL cable 👀 seems simple enough (connect green & black temporarily). Once I'm back and running will try this with the actual backed up boot.img 😅
[Android Q&A, Help & Troubleshooting] Renate:
The tricky thing with an EDL cable is that you don't know if it worked until you open the short.

And if the device is wedged you can't be sure if a long power press will reset it or if a USB plug in will wake it (was it powered down?).

Of course, as always, an external current monitor will always give you great insight into booting processes.

But some people don't even have an external current monitor. Shocking, yes?
[Android Q&A, Help & Troubleshooting] dferreira:
Back in business! So I made my own EDL cable. You need to press and hold vol up + down with the EDL cable plugged in, and it will reboot into EDL mode.
[Android Q&A, Help & Troubleshooting] dferreira:
hum.. spoke too soon. Now I only get the phone into this: "qualcomm Hs-usb Diagnostics 900e" which edl automatically dumps from memory but doesn't respond to any other command... anyone seen this?
[Android Q&A, Help & Troubleshooting] dferreira:
Got it now! Now the issue is that even after flashing back boot_a and boot_b, still stuck on fastboot...
[Android Q&A, Help & Troubleshooting] dferreira:
Would need someone to share their boot.img so I can restore my phone :( you can use this .edl to get a backup copy from your phone. Thanks!
[Android Q&A, Help & Troubleshooting] Renate:
Did you try reboot in fastboot?

Maybe it tried to flip slots on you? Try getvar all in fastboot to see what slot you are on now.

You used to be on slot A. (You can see from the GPT listing.)

Does set_active a then reboot in fastboot work?
[Android Q&A, Help & Troubleshooting] dferreira:
current-slot: a

tried set_active b and says slot change is not allowed in Lock State :(

reboot and it goes back to fastboot directly...

can't fastboot boot anything either :-/ looks like I'm stuck until I'm able to restore the original firmware...
[Android Q&A, Help & Troubleshooting] Renate:
Yes, but didn't you have the orignal boot_a and boot_b saved and restored to the correct partitions?

Go to edl, pull the "misc" partition and post it here.
[Android Q&A, Help & Troubleshooting] dferreira:
That's the thing... i'm not sure about the order in which I did the backup 🙈
[Android Q&A, Help & Troubleshooting] dferreira:
The seller has a backup of a previous version. I'm restoring using qfil. Hope it works!
[Android Q&A, Help & Troubleshooting] Renate:
Symbol import is quick. The analyzing is SLOW. Did you do that?

If you're getting errors on import it has to be the file.

kallsyms.exe (even under Windows) generates Unix line endings.

Thanks for the non-hlos, still downloading.... Downloaded!

That's a mass of mcfg_sw.bin

It's mostly XML and a bit of values.

Attached is the cleaned-up text of na-verizon-cdmaless

But, this is all signed with the same Hisense signature as the Firehose, 56d3f3c74a52172b...

So I think you will have a hard time getting a modified version to load.
[Android Q&A, Help & Troubleshooting] dferreira:
Bootloader is unlocked, should work with EDL?
[Android Q&A, Help & Troubleshooting] Renate:
You mean writing the mcfg to a partition?

It will work, but the modem will probably refuse to load it if it's modified.

Just make sure you have a backup and try it.
[Android Q&A, Help & Troubleshooting] bigwigs:
Yeah. I did analyze also, but doing it again with all options selected.

This is just APN programming i.e. setting up carrier profiles when sim is inserted. Usually there is carrier services.apk installed on US phones, which sync these carrier settings.

Would need to look for something related Bands. LTE Bands - B1:2100, B2:1800 etc

GSM- DCS 1800, GSM 900 Extended

WCDMA - B1 IMT 2100, B5 CLR 850

something with above values. Maybe then bin file is used to program modem.
[Android Q&A, Help & Troubleshooting] bigwigs:
which tool are u using to unpack bin file?
[Android Q&A, Help & Troubleshooting] Renate:
On the mcfg stuff?

I use my elfview.exe to check ELFishness and programs/sections/etc.

I use my qcomview.exe to look at certs/hashes/pkhash/etc.

Making the synopis I just used Notepad++ and deleted the illegible bits.
[Android Q&A, Help & Troubleshooting] bigwigs:
ok , i was using binxml and binres but getting error.
[Android Q&A, Help & Troubleshooting] Renate:
No, binxml is only for Android compressed XML, You can look at AndroidManifest.xml (or other res) without unzipping.

binres can only dump Android resources.arsc after unzipping.
[Android Q&A, Help & Troubleshooting] bigwigs:
weird, i'm unable to mount as rw.

getting following error- '/dev/block/dm-0' is read-only
[Android Q&A, Help & Troubleshooting] Renate:
Huh? What are you trying to change?

For now you'll probably have to use a Magisk module to override whatever it is.

If it works you can build it into a system later.
[Android Q&A, Help & Troubleshooting] bigwigs:
I was trying to follow steps mentioned to upload hosts file.

nvm, i'm just going to use nextdns and block the sites by putting them in denylist instead of modifying hosts file to point to local address.
[Android Q&A, Help & Troubleshooting] Renate:
Just put the hosts file in a Magisk module.

Magisk modules for yourself (not distribution) are trivial.

That's two files (and a few directories), /data/adb/modules/BigWigs/module.prop and /data/adb/modules/BigWigs/system/etc/hosts

See: https://topjohnwu.github.io/Magisk/guides.html

id=BigWigs
name=BigWigs
version=1
versionCode=1
author=BigWigs
description=BigWigs

C'mon, jump in!
[Android Q&A, Help & Troubleshooting] kuk4s:
That is strange, I tried it again and for me it works. Can you post the output of `mount` command?
[Android Q&A, Help & Troubleshooting] bigwigs:
It is r- '/dev/block/dm-0' is read-only
[Android Q&A, Help & Troubleshooting] bigwigs:
Where did u find this class? I mean which apk or jar?
[Android Q&A, Help & Troubleshooting] kuk4s:
Ah, sorry, I meant running `mount` without any arguments. It should list all mounted filesystems
[Android Q&A, Help & Troubleshooting] Renate:
I don't think that this has anything to do with the A9.

I have no idea what a "T1000" is, but it's probably another model.

A9 has four I²C and 70400000 is not one of them.

i2c@4a80000
i2c@4a84000
i2c@4a88000
i2c@4a94000

Still no idea: randomsite/lineage/hisense-xolo-t1000-us9230e1/
[Android Q&A, Help & Troubleshooting] dferreira:
Yeah I think it’s some trash on A9 for a different device. I got it on services.jar under com.android.server and it’s referred in EpdManagerService.java
[Android Q&A, Help & Troubleshooting] zxczxc4:
Output of the latest version of Renate's tool:

HLTE556N:/data/local/tmp # ./i2cscan_v3
/dev/i2c-0, /soc/i2c@4a80000, dead, 107
0f W0R0 In use tc358767 tc358767 Toshiba display interface bridge 16
35 In use ktd3137 ktd3137-bl-4 Kinetic Technologies LED controller 107
36 W0R0 In use aw99703-bl-2 aw99703-bl-2 Awinc LED controller 16
48 W0R0 In use fp9929a fp9929a FitiPower Eink power controller 16
5a W0R0 In use haptic_hv haptic_hv 16
/dev/i2c-1, /soc/i2c@4a84000, dead, 107
0c W0R0 In use qcom,smb1355 i2c_pmic Qualcomm battery controller 16
35 In use ktd3137 ktd3137-bl-3 Kinetic Technologies LED controller 107
36 W0R0 In use aw99703-bl-1 aw99703-bl-1 Awinc LED controller 16
42 In use fsa4480 fsa4480-driver Onsemi USB Type C multiplexor 107
48 In use hifi-es9218 HiFi-dev 107
58 In use aw87xxx_pa_58 aw87xxx_pa Awinc audio codec 107
/dev/i2c-2, /soc/i2c@4a88000, nozero, 12
10 elan Elan touch controller 107
38 focaltech FocalTech touch controller 107
4b W1R1 In use atmel_mxt_ts_336u atmel_mxt_ts Atmel MaxTouch 16
[Android Q&A, Help & Troubleshooting] Renate:
Hmm, does dmesg | grep fsa4480 show anything useful?

I mean, when somebody tried video out the USB, there is a difference between DisplayPort mode and HDMI mode...

https://arstechnica.com/gadgets/202...-axed-as-displayport-alt-mode-reigns-supreme/
[Android Q&A, Help & Troubleshooting] zxczxc4:
No matches / results for me.
[Android Q&A, Help & Troubleshooting] Renate:
Magisk do like them mounts.

(For comparison, do that on a non-Magisk system.)

Don't get me wrong, Magisk is really clever. Just given my choice, I'd really rather root without Magisk.
[Android Q&A, Help & Troubleshooting] bigwigs:
same for me.
[Android Q&A, Help & Troubleshooting] bigwigs:
i'm going dns route. managing hosts file is pain and it also impacts browsing too. using free dns like nextdns is good option as it provides denylist along with all the calls in website instead of using multiple tools.
[Android Q&A, Help & Troubleshooting] Renate:
I think from the lack of fsa4480 in the dmesg that there just isn't one.

Which means that video over USB is just not there?

C'mon, somebody take a hammer to their A9 and do a real teardown!

Maybe I should buy one of these?

I can guarantee that I'd take a screwdriver to it before booting up.
[Android Q&A, Help & Troubleshooting] bigwigs:
@dferreira - two apks from System directory.
[Android Q&A, Help & Troubleshooting] Renate:
Oops, my bad. I didn't read deep enough.

The Onsemi FSA4480 is a multiplexor for USB Type C connectors, but:

It only is for USB 2 HS, not USB 3. Therefore the A9 is only USB 2.

It's an audio multiplexor. Therefore the A9 supports headphones through a passive adapter. (As well as digital.)

And the bad news: No, the A9 doesn't have any video over Type C options.

The FSA4480 can more precisely be called "Onsemi USB 2 audio multiplexor".

Edit: I hate always correcting myself, but this could still be USB 3.

If somebody wants to try my UsbMode.apk (in the sig) with something OTG plugged in and hit "View USB".

Do you see: one controller (USB 2) or two controllers (USB 3)?

Or you could use https://www.uwe-sieber.de/usbtreeview_e.html#download. a much improved version of the old MS UsbView.exe
[Android Q&A, Help & Troubleshooting] zxczxc4:
Plugged in a usb c to to usb a adapter with a mouse connected.

I guess this means two controllers?:
[Android Q&A, Help & Troubleshooting] Renate:
Yup, so it is USB 3.x

We can't rule out that this could do DisplayPort over Type C.
[Android Q&A, Help & Troubleshooting] bigwigs:
Would devicetree file help in confirming ? Or u also need driver confirmation too?

Maybe u can buy my a9 and open it with screwdriver 😉
[Android Q&A, Help & Troubleshooting] Renate:
No, I've learned that they put lots of junk in the DTB that doesn't exist.

Also, I have the DTB and the Config.

No, but if somebody has one with a broken screen that they don't want to/can't fix then I'll buy it off them cheap.
[Android Q&A, Help & Troubleshooting] bigwigs:
Interesting lines in build.prop in /system folder:-

#add by hh for mobile_safe

persist.sys.hmct.safe.enable=true

ro.grantperm.enable=false

persist.sys.safenotify.enable=true

#add by hh for privacy data protect

persist.sys.privacyprotect.enable=true
[Android Q&A, Help & Troubleshooting] bigwigs:
FM radio app

Can anyone pls see they can try and install this app - https://github.com/vladislav805/RFM-Radio/blob/dev/README.md

and see if it works? this apparently on qualcomm processors - Real hardware radio for Android smartphones based on Qualcomm Snapdragon 2xx, 4xx and 6xx processors (up to 625 and 650).

there fmradio jar files on the phone.

I cannot install it as Advanced Protection with google play store doesn't allow me install any non playstore app.

thanks!

if not, i will have factory reset my phone again.
[Android Q&A, Help & Troubleshooting] zxczxc4:
Unfortunately not working for me.

In the github issues, there's someone else on Android 11 who's getting the same issue I'm seeing - stuck on "Launching..."

The way the author replies, it sounds like it could just be some changes in Android 11 that need to be accommodated. I'm not sure if that's correct, or if it's an issue with our device (and the device of the person who made the ticket).

If the hardware in the A9 can definitely do it, that's great, but not sure who's going to get this working!

At least it's open source...

I didn't realize offline/"real" FM radio apps were uncommon / not standard for all devices, that's a shame.
[Android Q&A, Help & Troubleshooting] bigwigs:
Are u getting same error as GitHub issue?

i got message following message when I tried using nextradio app -
[Android Q&A, Help & Troubleshooting] zxczxc4:
Yes I'm getting the same error as that issue I linked - mine's stuck on "Launching...".

Maybe looking at the logs could help but it doesn't seem like the most simple of apps :)

I've always taken the fm radios on my phones for granted, never really used them - but nice to have of course. My Jelly 2 has one.
[Android Q&A, Help & Troubleshooting] zxczxc4:
There is an FM radio app included in LineageOS (for supported devices), so maybe we can try that one day.
[Android Q&A, Help & Troubleshooting] bigwigs:
@dferreira - Can LineageOS GSI be installed on Android 11 eink tablet?

Just got one and wanted to know what were options :)