yashsingh1/xdaforums huggingface dataset:
[Android General] adfree:
D:\Android\adb>adb shell
freshul:/ $ su
freshul:/ # mount -vo remount,rw /
try '/dev/block/dm-0' type 'ext4' on '/'
freshul:/ # cd /sdcard
freshul:/sdcard # ls -a1l su2
-rw------- 1 u0_a117 u0_a117 154452 2023-01-22 22:17 su2
freshul:/sdcard # cp su2 /system/bin
freshul:/sdcard # cd /system/bin
freshul:/system/bin # ls -a1l su2
-rw------- 1 root root 154452 2023-01-27 04:21 su2
freshul:/system/bin # chmod 777 su2
freshul:/system/bin # ls -a1l su2
-rwxrwxrwx 1 root root 154452 2023-01-27 04:21 su2
freshul:/system/bin # reboot

D:\Android\adb>adb shell
freshul:/ $ su
freshul:/ # cd /system/bin
freshul:/system/bin # ls -a1l su2
ls: su2: No such file or directory
1|freshul:/system/bin # exit
1|freshul:/ $ exit

D:\Android\adb>adb pull /sdcard .\dump
/sdcard/: 147 files pulled, 0 skipped. 2.6 MB/s (117491085 bytes in 42.623s)

D:\Android\adb>adb shell
freshul:/ $ su
freshul:/ # cd /sdcard
freshul:/sdcard # cp su2 /cache
freshul:/sdcard # cd /cache
freshul:/cache # ls -a1l su2
-rw------- 1 root root 154452 2023-01-27 04:48 su2
freshul:/cache # chmod 777 su2
freshul:/cache # ls -a1l su2
-rwxrwxrwx 1 root root 154452 2023-01-27 04:48 su2
freshul:/cache # /cache/su2 --help
su2: applet not found

Tried short again today...

On my Magisk rooted SM-R875F...

this time only rebooted after copied su2 into /system/bin

su2 is gone...

I am now trying to check what is in Log files... To find the "self cleaning"...

Also short tried same su2 from /cache folder with same result I know...

Plan for next days... flash normal unmodified Original Stock Firmware... and check other Binaries in /cache folder with system user...

Best Regards
[Android General] adfree:
partition_tools - platform/system/extras - Git at Google

What is with lpflash...

lpflash writes a non-sparse image from lpmake to a block device. It is intended to be run on the device itself.

Usage: lpflash /dev/block/sdX /path/to/image/file

Maybe this could be usefull... to prepare modified super.img...

Maybe this bypass Combination Firmware "problem"...

I need only to bring super.img to my SM-R875F...

boot.img and recovery.img I can flash via Odin...

Best Regards
[Android General] adfree:
Friendly user from Telegram group inspired me to check litle bit GSI stuff...

No idea why... but this tool not require system or root to show it exists...

On my Android 11 SM-R875F

freshul:/ $ gsi_tool --help
Unrecognized command: --help
gsi_tool - command-line tool for installing GSI images.

Usage:
gsi_tool <disable|install|wipe|status> [options]

disable Disable the currently installed GSI.
enable [-s, --single-boot]
[-d, --dsuslot slotname]
Enable a previously disabled GSI.
install Install a new GSI. Specify the image size with
--gsi-size and the desired userdata size with
--userdata-size (the latter defaults to 8GiB)
--wipe (remove old gsi userdata first)
wipe Completely remove a GSI and its associated data
wipe-data Ensure the GSI's userdata will be formatted
cancel Cancel the installation
status Show status
64|freshul:/ $ gsi_tool status
normal

After installing Treble Check APK from Playstore...

I have to sideload the APK with ADB...

I see few interesting things... see screenshots...

After some Google Power I saw this:

Dynamic System Updates (DSU) | Platform | Android Developers

Dynamic System Updates (DSU) lets developers install a GSI side by side with the device's system image on a DSU-supported device that runs Android 10 or higher.

developer.android.com

adb shell am start-activity \
-n com.android.dynsystem/com.android.dynsystem.VerificationActivity \
-a android.os.image.action.START_INSTALL \
-d file:///storage/emulated/0/Download/system_raw.gz \
--el KEY_SYSTEM_SIZE $(du -b system_raw.img|cut -f1) \
--el KEY_USERDATA_SIZE 8589934592

This looks not impossible to try...

My idea is to use system.img from Combination firmware... super.img...

So I have to prepare few steps before I can try... extracting with imjtool under Ubuntu...

Best Regards
[Android General] algarues:
If after succesfull exploit

An app is launched from command, will it have super user privileges?

For instance, would app manager or similar be enabled to stop services, broadcasts etc?
[Android General] V0latyle:
It looks like this exploit caught the attention of the Magisk developer:
[Android General] adfree:
Few GSI related tests... on my SM-R875F Original Stock Firmware (unmodified/not rooted)

Connected over WiFi with ADB on PC...

freshul:/ $ whoami
shell
freshul:/ $ gsi_tool enable
Could not find GSI install to re-enable

Reason for stupid tests...

A

gsi_tool.cpp - platform/system/gsid - Git at Google

In Source Code I see something like this:

must be root to install a GSI

B

Short lazy me tried on my SM-A202F with Termux Shell app... from phone itself...

And gsi-tool only from root possible... otherwise not start...

So need to check few things before I try to install something... GSI related...

Edit 1.

I have only 1 working Shell APK for GW4...

No idea if restrictions from APK... not enough permissions... or from user:

u0_a111

So I have tested yet 2 user(s)

shell
u0_a111

Later I will test System exploit... then later laaaater Root...

Btw.

How to find how many user types exists?

Edit 2.

System Shell Exploit...

S/system/bin/sh: can't find tty fd: No such device or address
/system/bin/sh: warning: won't have full job control
:/ $ whoami
system
:/ $ gsi_tool enable
Could not find GSI install to re-enable
70|:/ $

Edit 3.

Some Google search about users list...

https://linuxize.com/post/how-to-list-users-in-linux/

Will try later...

btw... maybe we could add an user with "more" power then system...
[Android General] Matvei27:
Can this be used to move an app to privapp to give it system privileges?
[Android General] adfree:
No idea... maybe we can study old ideas... about Root tactics...

tiny dejavu...

https://xdaforums.com/t/root-sampwnd-n960u-wip-combo-needed.3927413/

Only as info.

Best Regards

Edit 1.

@profi_fahrer

You solved your problem meanwhile?
[Android General] subevilx:
try using dsu loader by VegaBobo on github

https://github.com/VegaBobo/DSU-Sideloader heres the link as well
[Android General] adfree:
@subevilx

Thank you very much for DSU Sideloader Link.

At the moment I have tiny problems...

A

On my SM-R875F no valid Filemanager installed... to select folder...

I have to search 1...

B

On my SM-A202F Filemanager yes... but other problems... like unsupported blabla...

So need time to find valid Filemanager APK for GW4 to proceed...

Best Regards

Edit 1.

Attached from my SM-A202F... it is Android 11... but...

I hope because not seen such warnings... my GW4 have enough space with 8 GB User parttion...

Will check if I can find "myfiles" on APK Mirror...
[Android General] xVoidx:
So a lot of this is beyond me and there is a lot to digest in this thread but my question is simple. With this exploit would it be possible to give this app "VPNHotspot" the privilege it needs to function correctly? How would I do this if its possible?

Link to the apps gihub

GitHub - Mygod/VPNHotspot: Share your VPN connection over hotspot or repeater! (root required)

Share your VPN connection over hotspot or repeater! (root required) - Mygod/VPNHotspot

github.com

My end goal here is to get the VPN hot spot app working but it needs root to tunnel traffic through an app like "AD Guard" to change the TTL of packets that go though the native hotspot.

Any advice on how to do this would be greatly appreciated.
[Android General] subevilx:
if u dont have a file manager u can download com.sec.android.app.myfiles
[Android General] adfree:
I have no luck yet... can't proceed with GSI/DSU...

On Watch no "inbuilt" Filemanager...

Installed from Store 5 or 6... but DSU Sideloader APK not detect these...

com.sec.android.app.myfiles... Maybe meanwhile 10 tried... without success...

Downloaded from APKMirror...

In Combination Firmware from Watch... I saw Pics from MyFile Lite or something like this...

But I am not able to detect where it is...

...

Edit 1.

Found via Google... as not solved... my FileExplorer problem...

https://xdaforums.com/t/close-dual-...d11-with-vegabobo-dsu-sideloader-v-2.4515225/
[Android General] wr3cckl3ss1:
Fingers crossed. Something comes out of it or if John Wu might take it an implement it for use in Magisk.
[Android General] V0latyle:
Eh, I don't think he would. That's partly why Magisk moved away from MagiskHide, because he's not interested in defeating Android security measures, but rather using Zygisk to work around them. At least that's my impression. He stated as much in his State of Magisk announcement a couple years ago, that Magisk would no longer intercept and modify system security signals.

I would definitely like to see this exploit used to unlock bootloaders on otherwise locked devices, but given what @wr3cckl3ss1 and @K0mraid3 found earlier, this might not be possible
[Android General] wr3cckl3ss1:
Still exploring this option at the moment. As development continues on....more doors that the team has not explored are becoming open. Maybe one day...this can lead to something great.
[Android General] V0latyle:
Right on, that's part of why I'm following this thread.

This is only Samsung, yes? Has anyone tried this exploit on any other OEM builds or AOSP?
[Android General] wr3cckl3ss1:
At the moment. I'm trying to get it ported over to the P7P... specifically the VZW. Since it's the mecca of NO BL unlock and no root. In a couple of weeks, I hope to nail down some time to accomplish this, as all the time right now is with Samsung and getting support out where it's needed. As Samsung said themselves, they replicated System Shell on a Pixel 6 Pro. So I imagine the P7P isn't too far behind.
[Android General] subevilx:
What is KernelSU? | KernelSU

A kernel-based root solution for Android GKI devices.

kernelsu.org

this looks promising but I cant get this working can someone help me

im not liable to any damage this does to your device so please if u understand this then proceed
[Android General] V0latyle:
Well, you don't necessarily have to have a Pixel device to try this. Just use the AOSP 13 GSI Releases on any GSI-capable device; these are identical to the corresponding Pixel builds
[Android General] xdagee:
From the look of things in this thread, I think the end goal is to be able to install custom rom without BL unlocked, at least a new way to install custom roms, if that's the case then i will glad be available for testing, I have got s10+ SD variant.
[Android General] V0latyle:
That is unfortunately not possible. Android Verified Boot prevents custom images from starting when bootloader is locked, and the only way around this would be to sign the images using the manufacturer's secret key.
[Android General] mohitgalaxy3:
I was exploring what's inside imei folder and viewed prodcode.dat is having my device model no.

Was wondering if i can change it and if I can will it help to enable cross flashing or will it brick.

:/efs/imei $ cat /efs/imei/prodcode.dat

SM-G998NZSEKOO:

Someone has done similar thing on watch 2, but I am not sure this will work on phones. After changing efs info if cross flash doesn't work then device will get bricked for sure.

15. sdb root on

16. sdb shell

17. backup active-customer.info: sdb pull /csa/csc/csc-active-customer.inf

18. backup prodcode.dat: sdb pull /csa/imei/prodcode.dat

19. edit /csa/csc/csc-active-customer.inf and replace csc code (I used vim and the XAR for the US version, https://www.geeksforgeeks.org/vi-editor-unix/ )

20. edit /csa/imei/prodcode.dat and replace last three characters to csc code you want (don't enter the csc selection after this it will reset it to the factory region)

21. reboot the device into recovery (i used /usr/bin/csc-util --reboot customer_change but i'm not sure it's necessary)

22. run netodin again and select AP, BL and CSC to flash stock

23. enjoy samsung pay if you have a US credit card (seems like you no longer need to install samsung pay apks on non samsung phone it's part of the wearables app)
[Android General] xdagee:
Oh wow, how heartbreaking. 😢What exactly can be achieved with this exploit, and what are the possibilities of the outcome of the research?
[Android General] lividhen:
@adfree Having trouble doing this on a galaxy watch 4. Just hangs forever with the latest exe, manual method, and zt64's method. Is there a way to disable battery optimizations on wear os? Not sure if that is the problem i though id ask.
[Android General] adfree:
@oakieville

@K0mraid3

Dear oakieville.

Please share the adb Commands inside your EXE.

I spent so much time to find alternate steps but fail with Galaxy Watch.

Thanx in advance.

Best Regards

Edit 1.

Files I have downloaded...

Komraids System Shell V4.5.zip
Komraids System Shell V4.4.zip
K0mraids_Shell (2).zip

A

I have realized. APK inside EXE is NOT the same inside ZIP...

Example.... Komraid3s_POC_V1.6.apk is NOT what EXE push to device...

B

For me working EXE shows this... bad visible because Colors... only if I mark text...

samsungTTSVULN2.apk: 1 file pushed, 0 skipped. 1.2 MB/s (15955101 bytes in 12.473s)
Performing Streamed InstallSuccess
Success
start shell
Starting: Intent { cmp=com.samsung.SMT/.gui.DownloadList }

Starting: Intent { cmp=com.samsung.SMT/.gui.DownloadList }
Starting: Intent { cmp=com.samsung.SMT.lang.poc/.MainActivity }

Starting: Intent { cmp=com.samsung.SMT.lang.poc/.MainActivity }

I see 2 lines twice/double...

First I thought is Error... as it is possible to double click so also file pushed double...

C

On non tested working EXE I can see better... but...

ROLLBACK COMPLETE
STARTING SYSTEM SHELL PLEASE WAIT
IF SYSTEM SHELL DID NOT START
PLEASE REBOOT THE DEVICE AND RETRY

And the other NOT working EXE shows this for me:

samsungTTSVULN2.apk: 1 file pushed, 0 skipped. 1.1 MB/s (15955101 bytes in 14.209s)
Performing Streamed InstallSuccess
Success
start shell
Starting: Intent { cmp=com.samsung.SMT/.gui.DownloadList }

Starting: Intent { cmp=com.samsung.SMT/.gui.DownloadList }
Starting: Intent { cmp=com.samsung.SMT.lang_en_us_m00/.MainActivity }

Starting: Intent { cmp=com.samsung.SMT.lang_en_us_m00/.MainActivity }

com.samsung.SMT.lang_en_us_m00/.MainActivity

With my old blind eyes I can see differences...

D

Conclusion for me...

POC APK differ in EXE...

And also Commands differ...

And I can see some experiments with Port...

Edit 2.

I need this for Galaxy Watch 4 like SM-R860 SM-R870 SM-R875F

EXE work only from this ZIP

Komraids System Shell V4.5.zip

MD5 9961198CE20CDCB3AF4049DEC4404D4E

Edit 3.

Working APK inside working EXE can be found in:

Komraids System Shell V4.4.zip

komraids_POC_V1.5.apk

MD5 2A40F3443260DC955CE100FE0E84962E

Edit 4.

samsungTTSVULN2.apk

MD5 F1244F782A0F16850629ECC90E85D1CE

Edit 5.

"EXE" in both Zips same:

Komraids System Shell V4.4.zip
Komraids System Shell V4.5.zip

MD5 07DFC1042F08965AA7A6C4A282BF48A3

systemshell-v1.3.exe

This is the working 1 for me...
[Android General] adfree:
After Win 7 ... I can now also confirm Win 10 for this "EXE":

systemshell-v1.3.exe

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-33#post-88085277

I have AVIRA Antivir on both... so folder adb is set to ignore Virus alert...

No idea if I manage this year to check my Windows 11 with other Antivir crap...

Procedure work for Galaxy Watch 4 and Watch 5...

Firmware Version GWA3 /AWA3...

Only as info... (for me)

Best Regards
[Android General] ForestCat:
Is there any possible way to get this type of exploit to work on a device w/ 6.0.1/Marshmallow? It shows version 201503021 as the installed Samsung-text-to-speech engine. From what I can tell, the vulnerable version requires Android 9+ ?? I need to pull the last OTA download (in /cache, I think) off of this bone-stock SM-N910T device, can't do that without root(or can I?), can't root without obliterating the stored OTA update, then I won't be able to get the OTA again? Needed for VoLTE on this device.
[Android General] adfree:
Tested successfully EXE with nice Colors on Win 7 Win 10 and Win 11...

With my Galaxy Watch 4... SM-R875F

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-33#post-88095269

No idea if normal that EXE close under Win 11...

No idea if I will test second time...

Only as info... tiny summary for Galaxy Watch 4 and Galaxy Watch 5 user(s).

Best Regards
[Android General] adfree:
After many failSSS... tiny progress with Combination Firmware WITHOUT eToken.

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-33#post-88100625

Galaxy Watch 4... Rooted SM-R875F...

Only as info... maybe for me...

Best Regards
[Android General] omaralwardian:
Starting: Intent { cmp=com.samsung.SMT/.gui.DownloadList }

Error: Activity not started, unknown error code -101

??

Samsung Snapdragon S21 Ultra Canada (you mentioned most Samsungs should work)
[Android General] adfree:
@omaralwardian​

Maybe if you give more details... what you tried and where you fail.

Example...

Windows User? You play with the "EXE" or you tried the manually way or you on Linux or you...

Then maybe also helpfull... to give more infos about your S21...

Firmware Details...

I am for instance from Germany... so I have no device from Canada...

Best Regards
[Android General] omaralwardian:
Yes, my friend, sorry about that.

So, two different methods I have tried so far. Details:

Product—S21 Ultra 512 GB, 16 GB RAM

MODEL—SM-G998W

Processor—SD 888

CSC - XAC

Windows 10

Android security patch level

January 1, 2023

1.) I downloaded your .zip file from GitHub, and followed those directions, your app opens up, I click on start new shell, the dialogue begins in your app window, eventually the APK opens on my phone (lang.pac) and the shell opens on my PC. The black shell window opens but does not fill with any text. I tried to type something in and nothing happens. Same with your app after the start download command is given, nothing happens. Eventually, the shell window closes, and I cannot open it again without rebooting my phone. The restart shell button basically doesn't work whatsoever. It says fail, reboot the phone almost every time.

2.) I went through the manual process of opening my shell, and pushing your APK, installing the provided APK on my device, after I got to step 5 where I put the download command in which is listed in the steps, that is the message I got and I cannot get any further.
[Android General] omaralwardian:
Edit: duplicate. Deleted.
[Android General] adfree:
No panic. Nothing here is my....

I know it is not easy.

Sorry I have no modern Phone like S21...

You have seen this forked Github?

GitHub - zt64/tts-system-shell: Exploit for gaining system shell access using a vulnerability in Samsung TTS

Exploit for gaining system shell access using a vulnerability in Samsung TTS - zt64/tts-system-shell

github.com

Maybe this is easier to handle with your S21.

Hopefully somebody with S21 can help you.

Best Regards
[Android General] omaralwardian:
Hi,

Is there any way you can update your EXE? I think the SMT package you have on the script might be off.

Here is what I have:

Samsung Text-to-Speech

com.samsung.SMT

Actives close which are present in that package:

com.samsung.SMT.gui.DownloadList

com.samsung.SMT.gui.DownloadListEx
[Android General] arsfr:
Can we use this to get bootloader unlock option on the A205U?
[Android General] omaralwardian:
@adfree
[Android General] sunil_suny:
I am getting this error

adb shell pm install -r -d -f -g --full --install-reason 3 --enable-rollback /data/local/tmp/samsungTTSVULN2.apk

Failure [-3005: INSTALL_FAILED_ADP_VERSION_LOCKED]

Samsung F23 5G, India model.
[Android General] adfree:
@omaralwardian

Sorry. I wasted my time... successfully... only with the EXE file and my Galaxy Watch 4... SM-R875F

Under Windows 7 and Windows 10 and Windows 11 with Avira Antivir...

Looks like this:

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-31#post-88030481

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-33#post-88085277

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-33#post-88095269

I have NO solution for me working without EXE... but I have only GW4 for tests...

Maybe somebody with modern phone can help...

Same for you.

@sunil_suny

I am not 100 % sure if this is "impossible" now on S23...

I read something on telegram group...

Better somebody with S23 can confirm.

I hope somebody will answer.

Best Regards
[Android General] joenamcoutinho:
I am also in the same boat. Im wondering if I can somehow root my S22 ultra (KG blocked, KG state: LOCKED) or atleast a way to get the bootloader unlocker. If someone could please help me
[Android General] sunil_suny:
How to downgrade SMT ?
[Android General] franzzzV6:
Not work on my s23 europe
[Android General] franzzzV6:
samsungTTSVULN2.apk: 1 file pushed, 0 skipped. 62.5 MB/s (15955101 bytes in 0.243s)

Performing Streamed InstallSuccess

Failure [-3005: INSTALL_FAILED_ADP_VERSION_LOCKED]

ROLLBACK FAILED
[Android General] adfree:
System Shell Exploit still working on Galaxy Watch 4 with February Firmware Update GWB1...

Tested with SM-R860:

Notify Update

Looks Security Patch is same like in older GWA3... January...

I have NO idea nor read real feedback if Firmware Update kills System Shell Exploit...

Something like BEFORE it runs... now after Firmware Update XYZ not.

Oh forgotten. GW4 is still Android 11 crap...

Best Regards
[Android General] dwkindig:
Any idea why the easy mode EXE would be complaining it can't find AdbWinApi.dll? I've got the platform-tools files copied into the same folder as the EXE, but it seems like the EXE is not looking in its own directory for the DLL. Is there a specific place it is trying to look? (Windows 11 Insider, btw.)
[Android General] adfree:
@dwkindig​

If you follow @oakieville post here and/or on Telegram Group...

Because he creates these wonderfull colored EXEs...

A

Last ehm latest EXE is all in 1 package...

ALL files inside EXE...

Means both APKs AND ADB Files...

B

He packed and crypted and packed and crypted... so Antivirus Programs detect """something""" inside this magic EXE...

B.1

"he" wrote IMHO he unpack temporary ADB Files and/or all files into """temp""" folder...

So it could be your Antivirus let you execute the "EXE" but kills/block/stop or whatever doing with the temporary extracted files...

I NEVER found what he meant with temp...

I have tested successfully under Win 7 and Win 10 and Win 11...

With Avira Antivir... by disable adb folder for Virus Scanning...

I have NEVER seen this missing DLL Bug ehm Feature...

I have only successfully tested with Avira...

McAfee for instance no idea... I have uninstalled this ... and replaced with Avira...

I posted few times my summary...

Maybe IMHO it makes sense to give more details... maybe you can "replace" EXE with other solution posted here...

For me only the EXE work... but I am playing only with Watch.

Best Regards

Edit 1.

Here how it looks on my Windows 11 Notebook...

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-33#post-88095269

Few posts earlier Win 10... and Win 7...

So it is no matter of Windows Version... It depends on your Antivirus "Settings"...
[Android General] darenfy:
I've successfully run and gotten a system shell on the device, thanks a lot.

What makes me very curious is how you got your SamsungTTSVULN2.apk.

I also try to get one available. There are no historical versions of apps in the Samsung App Store; installations of historical versions of apps from third-party app markets return INSTALL_FAILED_REJECTED_BY_BUILDTYPE.

I even manually extract the old version SamsungTTS.apk on ancient Samsung phones and install on new Samsung phones, but it still returns INSTALL_FAILED_REJECTED_BY_BUILDTYPE, which confuses me
[Android General] Sgtoster:
So I just want to be able to overclock my CPU and GPU. Will this allow me to do that?
[Android General] imatary:
This Exploit Posted in 2019, Did you mentioned the developer who publish it 3 years ago??

At least change the classes names !!!!!!!! (: