yashsingh1/xdaforums huggingface dataset:
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Mr Valerio Said something Super Interesting, maybe you have already done it in qemu?

In this episode he mentions using qemu, buildroot, and docker with the dumped firmware or maybe just the binaries, i have to relisten to this a few more times to remember, but anyway he says you can build an emulator based off the board in qemu.

Am I imagining things correctly, that if you gather all this data, you could recreate a one for one (almost) virtual android emulator on your pc? Like I could make an emulated shield to play with on my pc? o_O if programmed right?

For anyone who is interested in qemu and wants to learn how to use it in a very strange way. I wrote a guide with all sorts of knowledge on it so you could use in a lab https://xdaforums.com/t/how-to-inst...r-android-devices-windows-10-nox-lab.4481613/

The knowledge would mostly translate over to the stock windows or Linux version of q emu just the semantics May differ
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Spoiler content hidden.

IF ANYONE HAS TIME, CAN YOU TEST THIS UNLOCKED BOOTLOADER FOR AI FIX? I think it worked but I don't actually use my shield as intended,, so I don't know for sure. User Ajolly shared it on another thread

I put the instructions up on reddit so we can get some more eyes on it and maybe find out sooner
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Hi there I hope you had a nice Thanksgiving! Would you happen to be know if this is normal?

I know all the devices have the /dev/block section with the mmc named partitions, which are different for each device.

My question is, is it normal for a device to have another folder under "platform" or something similar with all the images again by name?

And Are these images actually stored on the device physically Twice? Or do you know how they could possibly be referencing the same file at the same time without adding space? I dd'd them and they are full images

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
No, that -> tells you that they are just symbolic links.

On some devices the "friendly names" are cryptic. On others some of them are more descriptive.

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Spoiler content hidden.

Spoiler content hidden.

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Hi @Renate! I was wondering if you have ever experienced lag in the adb shell? For instance if you are pulling a file in one window and in another you are trying to poke around in the shell. For me with command prompt, powershell, or the terminal emulator app, when running pull with a shell open, I get typing lag. This doesn't happen on my linux vm, but I wonder if you knew something I could do on windows to run adb better? I'm using the latest one from the android studio
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
No, I've found ADB to be pretty efficient when using multiple shells or adbsync.exe or adbgrab.exe

Still, Google gets no credit for an adb.exe that takes over a second to start. I guess they just put lots of delays in to work around some race condition on an i386.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Thank You for letting me bounce questions off you. Your mentioning of the i386 made me think that this is perhaps yet another cute little AMD bug and Considering all the articles with Ryzen and adb problems, I now know where to research. THANKS this is driving me crazy. I refuse to change to intel because to be honest I enjoy solving the strange problems the amd cpu creates.. especially in virtualization
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
starting a new section for notes

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Hi @Renate! I hope your day is going well!

I was wondering if you could answer a question about Magisk today?

Am I able to share with others a patched boot.img made from magisk, for the same device, on the same firmware, and would the patched image just work on the other person's device?

Like after instructing them to erase the boot partition in fastboot and reflash the mod? Gosh could it be so simple?

For Context my friend Dawn was able to teach me about Magisk Delta, and we were able to use it to root our stock fimwares on the shield. So I was able to get the two firmwares they haven't released for us on their site yet and I was wondering if I just shared a modded boot.img and easy instructions how to flash that partition and push over the magisk apk, if that would just work for others without a bootloop?

I appreciate your time as always!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Magisk and its variants just start from a stock boot image.

You can swap the modified image with friends as long as the original boot images were compatible.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Good Morning @Renate!

I have a different Problem today, maybe you have experienced it before or have a suggestion?

So the problem is I rooted a Stock firmware, but since it's stock it won't let me run adb as root.

Do you know of a magisk module or some way to fix this? I have done some research and tried some repos and will continue trying but maybe you know a fix? Every change I made in the build.prop resulted in the android man dying x.x

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
This is not clear. Are you running Magisk?

If you directly modify build.prop in /system (or in super) you will break verification with vb_meta.

Normally you don't want to modify build.prop anyway.

If you are running Magisk you can just:

C:\>adb shell
$ su
#

If you are not running Magisk and you want to directly make modifications you will need to defeat vb_meta (and possibly vb_vendor, vb_system...)

If you want ADB to be root without su (of some kind) you will need to change the build type or patch adbd,
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate thank you! Sorry I didn't make things clear! "Patch Adbd " I think is what I need to do. I found this guide https://harrisonsand.com/posts/patching-adb-root/ it actually makes sense so I am going to try it. Thank You... gosh you have helped me to do things I literally dreamed about.

Well I am having problems doing the magisk boot tools like he says in the guide so I think I could use your imgutil to do the same? Going to try now
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Ha, ha, I've never seen that but I've been doing exactly that for years.

I just jump over all that minijail stuff.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Miss @Renate I am a dumb dumb and I have never even heard of a mini jail until today x.x It's fascinating you have been doing it so long. Do you have any guidance how I can just "jump over" the jail? This is the boot.img I am working with. I really really am trying to understand and not just have things done x.x but I don't know what to do. I mean I played with your tools again, extracted the kernel and payload, and played with modfile to try to skip but I wasn't successful
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Well, it's very nice, but being ramdisk-less there's no adbd in it.

It's probably in /system/bin
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Ooohh so I know it is, and I tried taking the adbd from the rooted firmware and installing it in stock, this resulted in adb refusing connections entirely. So could I just take the stock adbd and modify it somehow?

I guess for context when I say "rooted" firmware, I mean the read write developer images nvidia shared as opposed to their stock images

adbd

drive.google.com

I found the mini jail now but would I start with a .minijail or minijail without the period and does it end with or without one?
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Nope. You found the text string "minijail_changing_gid".

If you changed that it would only change the text printed in the log.

You want to find where that string is being used.

For that you need to disassemble.

2110:	f0ffffe0	adrp	x0, 1000 ; "ADB_EXTERNAL_STORAGE"
2114:	91204000	add	x0, x0, #0x810
2118:	940004e6	bl	34b0 ; getenv()@plt
211c:	b40000e0	cbz	x0, 2138
2120:	aa0003e1	mov	x1, x0
2124:	f0ffffe0	adrp	x0, 1000 ; "EXTERNAL_STORAGE"
2128:	911cf000	add	x0, x0, #0x73c
212c:	320003e2	orr	w2, wzr, #0x1
2130:	940004e4	bl	34c0 ; setenv()@plt
2134:	14000005	b	2148
2138:	f0000008	adrp	x8, 5000 ; 00005000
213c:	f9418d08	ldr	x8, [x8,#792]
2140:	39400108	ldrb	w8, [x8]
2144:	37004908	tbnz	w8, #0, 2a64
2148:	140000e1	b	24cc

Yours will, of course, be different.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate how do I disassemble it? Is there a tool in hxd? Sorry I really am brand new. and Thank You as always.

--EDIT I remembered a video I watched on youtube that showed me how to load the binary files in ghidra I forgot it tries to load it as elf if you drop it in the batch, that is why it didn't work for me

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
You're on the right track.

There's many different kinds of disassemblers.

Some just look at individual instructions and say what they do. (like objdump).

Others try to figure out what's going on (like IDA or Ghidra).

Like the first two lines of my example above shows:

Load the x0 register with 0x1000
Add 0x800 to the x0 register

You need a bit of insight to say, "hey after the second instruction we've got 0x1800 in the x0 register!"

But why would you need 0x1800?

Normally you don't use the adrp unless you want to get something relative in memory.

So you look in the image for what's at 0x1800 (relative to the loading address).

It could be the first 1000 digits of pi, but wait, it kind of looks like a string for a human. What is it?

It's "ADB_EXTERNAL_STORAGE".

Now, especially if we have a pretty close version of the source code to look at we can compare where that string is used.

Of course, things can get more complicated. If the source reads:

static void calculate_fuzz(int lint)
{
printf("Lint value is %u", lint);
}

void process(void)
{
calculate_fuzz(314);
calculate_fuzz(42);
}

You'll see that there is never actually a subroutine called "calculate_fuzz".

It ends up being:

void process(void)
{
printf("Lint value is %u", 314);
printf("Lint value is %u", 42);
}

Finally, there are binary files that just have instructions and data all mixed up and nothing telling you what's what.

There are loadable files (like ELF, adbd being one of those) and there are different sections, some headers,

like the 0x7f, E, L, F your program is trying to interpret as instructions.

You need to tell your program, this is an ELF file, behave yourself. Only disassemble the disassemblerable parts!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate thank you so much for taking the time. I will read and re-read every thing you have said now and again tomorrow after some sleep. Just Thank You Thank You you've saved me days of banging my head against the wall and really provided a clear path forward. Haha and I love the humor you add in these teachings. "It could be the first 1000 digits of pi" hahaha "Behave yourself!" !
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Hi @Renate! I am reading about objdump now and it talks a lot about "displaying information" and "dissembly to view", but is it able to make edits? Is this the program You use? Or which decompiler do You prefer to make patches or mods with? I would like to focus on learning the tools you know because you know all the things I want to know!

I am trying to play with Ghidra now

I feel like i am not looking at the right view haha! but I am trying! I have watched so many videos on this I want to be able to do it so bad x.x disassembly has just never "clicked" for me yet

What I am watching now

Spoiler content hidden.

John shows how to open the defined strings window in that video

OHH and Renate! Should I be using arm for the decompiler or should I be using x86? Like is it asking for the file I am using or the computer I am using??
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
You have an ELF file. The disassembler should know already that it's AARCH64.

You should be looking at "Disassembled view".

Maybe you can click on "ADB_EXTERNAL_STORAGE" and select "where referenced" or some such thing.

Your disassembler program might have the ability of assembling single instructions and modifying.

If not you have to use an online assembler to come up with the codes.

Fortunately, most of the instructions you'd want to do are simple, load zero into this register, nop or branch.

When you know the offset and what you want to write you can use any hex editor.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Gosh, thanks Renate! I had no idea there was Online Assemblers as well, goodness you are opening up a new world here! I finally found a very good beginner video by a man with a very pleasantly calm voice

So maybe I can stop trying to fly before I have took lessons >.> Thank you so much for helping me. I Will figure out what you mean by this Today

" load zero into this register, nop or branch." without having to ask! Haha!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
It helps to know what all the instructions do.

This is a pretty good step-by-step: https://developer.arm.com/documentation/102374/latest/

When you want to manually assemble instructions yourself you need to know what all the bits do: https://developer.arm.com/documentation/ddi0596/latest
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
I'm so happy I'm crying haha THANK YOU RENATE!!!! This, This is what I needed!!! Oh goodness! Idk why it never occurred to me to look up anything on the arm architecture specifically x.x that makes so much sense to do in hind sight. I made it to the register bits and yeah, the lights are starting to come on. YAYYYY.

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
I was able to figure out how to search for the local port disabled string, but it doesn't seem to pull up any functions like the example here did https://harrisonsand.com/posts/patching-adb-root/ the minijails do though
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Let's start with the basics. How big is your adbd file?

adbd used to be static linked and was around 1MB.

Later Google made it use a fistful of libs and it was less than 50kB.

In any case look for where "ADB_EXTERNAL_STORAGE" is used.

That's the start of where you want to modify.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Hi @Renate thank you for the guidance! I had put that up so I could try to read it more while I was out. This is the size of my adbd!

This is what came up when I searched for " "ADB_EXTERNAL_STORAGE"

Renate, how did you know to go to the external storage? Is this because you have done this many times or something? I am blown away how you know everything!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
You can look at your disassembler side-by-side with the Andoid source code.

You have to find the correct version, but things change slowly.

Also Google restructures the source code tree all the time and it's hard to find stuff.

Here's adbd daemon/main.cpp for Android 10: https://android.googlesource.com/platform/system/core/+/refs/heads/android10-dev/adb/daemon/main.cpp

It looks like we just want to eliminate line #230, drop_privileges(server_port)

BUT... drop_privileges() is actually a static function.

That means it's like all the code in drop_privileges() is copy/pasted into adbd_main().

There is no "bl" (branch and link) instruction going to an actual drop_privileges().
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Brilliant! THANK YOU for linking the Source Code! I have heard these guys talking about loading the source code separately while they are in ghidra (i listen to this stuff at work) and in my mind I always pictured they were reading it from HxD. Which is silly now that I think about it. I've probably watched it too but it's easier to understand when you are working on something yourself.

Now to the Questions!!

So the version of android I am working with is android 9, with this adbd, does that matter? Interestingly, for this device Nvidia Skipped android 10 and went straight to 11 lol. No idea why!

I tried searching for any strings related to this

"It looks like we just want to eliminate line #230, drop_privileges(server_port)"

but got no results.

I am super sorry, but what specifically do you all mean when you say to look at the disassembler side by side with the source code? Like now I understand the source code part, and can look for the 9 version if that matters, but, when I start adbd in ghidra, should I be looking at the listing window or should I be looking at some other view? I really apologize for the Im sure super basic questions to you, but I really appreciate you helping me to understand
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
An ELF file has many sections. What your last screenshot is showing is just the blah-blah-blah of every ELF file.

Line #230 is in that link to main.cpp from above.

Compare it to what you were showing in the last screenshot here
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
OHHHH thank You sorry I think too much some times!! I will do that now /facepalm

this window . and reviewing now!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Okay @Renate so I was able to look at some of the Source codes for android 9 and none of them are matching up with what I have got going on. Like this one for instance: https://android.googlesource.com/pl...fs/tags/android-9.0.0_r61/adb/daemon/main.cpp

I will continue reading mine and I will link it here in case you have any idea if I did the right thing or not. I do see where there is talk of the minijail! Looking for drop_privledge now

Spoiler content hidden.

This is so much fun!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Well, the details are different, but the drift is the same.

Get ADB_EXTERNAL_STORAGE, decide if you want to do anything, Set EXTERNAL_STORAGE.

Then you see minijail_new(), that's what you wnt to avoid.

So you want to replace that instruction (easier to see in disassembler view) with a branch to past all the minijail stuff.

Scroll down until you see the access() call.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Now that I have had some sleep... Time to play more!

Spoiler content hidden.

Very helpful

More helpful
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Hi @Renate! Can we bypass the minijail by changing the arrows in the graph to just run somehow? I feel like I seen some videos of people doing that in IDA on other things, but I don't know

I am really trying to find what you say here

"Scroll down until you see the access() call."

but I am struggling.

I think I found it>?

How to get dark theme on ghidra

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
405130 is your destination. That is the setup for the access() call

So you want to replace your minijail_new() with a jump to 405130

You can calculate it or else try values and play with it until the b(ranch) is in the right place.

I can't tell where the minijail_new() is because you're looking in C mode.

It's easier in assembler mode (like your last screen print).

Arrows and graphs are just visualization tools. I'm not sure that you can modify anything from them.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Hi @Renate Thank you again for your answers! Maybe I can make enough sense to gather one last clue before I go to bed. Haha.

"So you want to replace your minijail_new() with a jump to 405130" Erm >.> How would I attempt to try this? So close!!!

I brought it up in two different views because I am dense and idk which is the C one to avoid it. Is the C one the one that says LAB_ blah blah?
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
We want addresses, so don't bother with anything unless it say 00123456 on the left.

I think 404fc8 is the address we want to modify, but you're confusing me by jumping all over the place.

Just show a small chunk (+/- 5 lines) around 404fc8.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Good Morning and Sorry about that! Thank you for your patience with me. Here are the addresses!!

Maybe this one Renate?

Could we change that to not branch to the mini jail? Like I see the adb external storage gives the option to branch to LAB_00404fb8 or the minijail address, so maybe make them both point to LAB_00404fb8 somehow? or is that not what we are looking for? Or would we maybe use a different address? Sorry I am just trying to imagine what to do.. Or maybe that LAB_004057b4? would we replace the bl minijail_new with that maybe?
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
No, we want to bypass a lot of stuff. I gave you the start and the end address of all that.

So, let's do this in an educational way (i.e not the most efficient).

You know that you want to modify "404fc8" but that address is not the file offset.

Your disassembler is using some load address.

So, make a copy of adbd. Find 5a 84 01 94 (I presume that they mean 0x9401845a).

If it finds more than one then search for 5a 84 01 94 28 08 00 f0 (and so on)

Now you know the file offset. It should probably end in fc8 like 0x123fc8

Then you want to try to change the instruction (as 32 bit) at that offset to 0x14000010, i.e. 10 00 00 14

We see from your last line of the previous post that a branch is 0x14000005, which is skipping 5 instructions.

I'm using 0x14000010 which skips 16 instructions.

Now, disassemble the modified file and you will see that minijail_new is now a branch.

Undoubtedly it falls short of 405xxx (whatever I said).

You can count how want instructions it falls short and add that number (in hexadecimal) to your original 0x14000010.

Then disassemble that. Were you right? No, adjust it.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Hi @Renate Thank you for taking the time to Teach me!

So I think you want me to point to "access" specifically?

What I am having trouble with, is this step:

change the instruction (as 32 bit) at that offset to 0x14000010, i.e. 10 00 00 14

Which I think is a teachable moment to get me to play to get to access?

However... I cannot seem to see these instructions: " 0x123fc8" "0x14000005" I understand they are examples, but I cannot understand how to get to this view to be able to play or modify anything.

What I can do is right click, and "patch instruction"

Like in the case of the minijail_new

when I highlight 5a 84 01 94 that lets me see this

can I replace it with this address here from access?

Oh and I did make a copy of adbd!

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Use your hex debug tool, not the disassembler to find out where those instructions are in the file.

The addresses that you are looking at in the disassembler use some offset it picked out of the coconut trees.

No, no, no!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Whelp it only took me half an hour to figure it out, but bytes mode is apparently the hex debugger in ghidra. Thank You, Renate! I have to pause here for the day but I promise tomorrow I will write back that I did it, all thanks to you!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
If your disassembler can modify, you can modify there.

If not, you have to translate the 404fc8 to the file location and modify the file using your normal hex editor.