yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] domineus:
working for me

testing on my touch pro. It is very fast. One problem the slider doesn't load for me...with munrus version I can get my slider as well
[Windows Mobile Development and Hacking General] arcanehacker:
It may 'work' but you are missing all the bottom part.. thats where you navigate/flow between tabs. Some pages like in contacts flo page are cut off at the bottom, some functions are unavaliable.

Its a good try. We just need someone edit all the pages to fit to VGA.
[Windows Mobile Development and Hacking General] sbrmonkey:
anyone try this on samsung epix 6.1 pro?
[Windows Mobile Development and Hacking General] mun_rus:
Wht is the aim of this thread?

I made a beta version already some times ago!

http://xdaforums.com/showthread.php?t=443777
[Windows Mobile Development and Hacking General] leoiden:
hey mun rus

what is your beef bro last time i remember we have been testing your beta for a while know with no update so what if other members take a try at it and make it better thats what this forum is about!:mad:
[Windows Mobile Development and Hacking General] mun_rus:
ahh ok.

and wht he actually did? Just dumped HD manila?!

ps. i wrote the reasons why i can't make an update..
[Windows Mobile Development and Hacking General] Kraize:
Lol. Chill bro. If you had payed attention to the thread, mun_rus had a little operation on his right hand and he can't work with one :P So either be considerate to the developers or go away because if you're not, you won't have any apps developed for you. :)

Kraize
[Windows Mobile Development and Hacking General] domineus:
why don't you guys...

work together? seriously? might be a good idea considering mun won't be able to code much for a while...and m seems to be anxious with the project...
[Windows Mobile Development and Hacking General] slypher:
I second that, no need to reinvent the wheel. Maybe together they can come to a 100% compatible touch HD Manilla that will work on all VGA devices without weird work arounds.

-s
[Windows Mobile Development and Hacking General] syncronox:
hello i need help, i have a dell axim x50v, it is vga, 600 mhz, pretty fast, 3d grapchis, will touchflo 3d work on it?
[Windows Mobile Development and Hacking General] Kraize:
Yes. If you have all the necessary HTC components for it such as the HTC Audio manager, the audio booster, and some other apps I don't remember.
[Windows Mobile Development and Hacking General] mr-free:
will this work on the HTC xv6800 QVGA ?
[Windows Mobile Development and Hacking General] mr-free:
all i need is this !!
[Android General] K0mraid3:
***MODERATOR ANNOUNCEMENT: THREAD CLOSED***

@K0mraid3 you are hereby required to provide proper credit in your OP as follows:

Link the assigned CVE for this exploit as it mentions the author's blog and GitHub, OR

Link the original research repo as provided by @flanker017

Further, while you may provide a means for donation, this project must remain free without condition of payment.

Lastly, as you've been previously warned, you may not promote your Telegram channel on XDA. You may have ONE link to your TG channel in the OP.

You must meet these conditions to continue to use XDA to share this project.

As you have ignored my PM and previous warning, this thread is now CLOSED to further discussion. All download links relating to this project have been removed. This thread will remain closed until such time that @K0mraid3 is willing to comply with the above conditions.
[Android General] K0mraid3:
IoT Menu.

View attachment 5815371
[Android General] wr3cckl3ss1:
I'll be going dark....

I'll be using the 56k Modem I got at Radio Shack yesterday

#FleetKey
[Android General] Skorpion96:
Beautiful, thank you. Unfortunately I live in Europe so I don't need it but I guess that USA people are freaking out this moment
[Android General] sielhadi:
I'm sorry but i don't get you. can i root my device with this method
[Android General] oakieville:
its a system shell uid 1000 it is not root
[Android General] Skorpion96:
I wonder if is possible to setenforce 0
[Android General] wr3cckl3ss1:
No
[Android General] K0mraid3:
Not on any current devices, at least yet that I've found, but I'm not going to say its impossible yet.
[Android General] ezdiy:
If you can write to /data/dalvik-cache/arm64/system@framework@boot*.{art,oat,vdex} with it, xposed is feasible.
[Android General] no111one:
Well, this is fun enough.

What useful stuff do we actually get?
[Android General] Skorpion96:
@K0mraid3 i just tried on Samsung Galaxy A51 EUR model latest patch and i can't install poc apk. Another thing 2nd method zip link is not a link actually
[Android General] irshansk:
Can it help me to get native voicemail on US T-mobile? Like change config or something
[Android General] wr3cckl3ss1:
This can but again...this is my specialty...that i will hammer out a guide to give you access. But in order to gain that exclusive access....this exploit is 100 percent needed.
[Android General] Romeo Nickolas:
So when I do this, it can now open the IOTHiddenmenu using any activity launcher?
[Android General] wr3cckl3ss1:
No as it requires further more input....I'm working to bring everything altogether.....including preconfig so that it makes it possible. But this is still something under review as.....when this gets released...on my behalf or the team.....it will open the big doors for Samsung in general and while there's no timeframe for a patch to this exploit. We want to mitigate the exposure until the next level of privilege is attained. But, don't worry. The capabilities are being worked on as we speak.
[Android General] wr3cckl3ss1:
Try it out and let us know...
[Android General] K0mraid3:
with a bit of craft work, or you can use this command once in a system shell am start -n com.sec.hiddenmenu/.IOTHiddenMenu -e 7267864872 72678647376477466
[Android General] K0mraid3:
I added a few quick commands for fun stuff to the main post.
[Android General] wr3cckl3ss1:
Preconfig available now
[Android General] rayw_xda:
From what I gathered from the OP it appears the key to this working is somehow being able to revert to a vulnerable version of TTS.
[Android General] K0mraid3:
yes it is, but also this same thing live in Google Text to speech, confirmed by Samsung themselves in november -- what it is, is a vuln receiver in TTS apks that blindly accept lang packs
[Android General] K0mraid3:
will need to look more into this
[Android General] K0mraid3:
your running preconfig in system context
[Android General] K0mraid3:
most likely for now, but id keep exploring with the system shell, you may find something.
[Android General] K0mraid3:
This is a good example of what the manual/hard way looks like, when done correctly.
[Android General] Romeo Nickolas:
Yes just try and try and google if you don't know what command to type lol
[Android General] K0mraid3:
Yes! But it has definably taken some tweaking to get this working right. and even now, still having a few issues. (As mentioned in the "Why this works bit" it was meant to be patched, but as we can all see, that ""patch"" wasn't quite up to par.
[Android General] K0mraid3:
How this slipped unnoticed for 3+ years is beyond me.
[Android General] Phil_123:
This could be useful for Galaxy S8 Active (SM-G892A) users to grab the final OTA update from AT&T servers from outside the USA without an AT&T SIM card.
[Android General] wr3cckl3ss1:
Yes as with this access....you can pull from /data/fota
[Android General] 73sydney:
Devils advocate but you dont think posting this will get the door slammed shut quicker than a fridges on a summer day?

Why get people excited about things that will probably get pulled from under them?

Also i couldnt boot GSI even on my bootloader unlocked S20+, so hows having a locked bootloader and this an advantage...DSU is removed on most Samsungs, no? Certainly not present on S20+

I dont really get why you would want faux root, when we have a root solution already (magisk), yes it sucks b@lls on Samsungs -yes you void warranty, but really im not ever owning an Android phone that im not rooting, so - especially if you also own one of their wearables and rooting consistently breaks Samsung Health (which i had to keep finding ways around, and Samsung Pay if you actually use that) but otherwise root (magisk) is fine. I dealt with it for 2 years (and ultimately went back to Pixel because lifes easier, especially if you own like i say, a Samsung wearable <- which is what drove me to depart Samsung phones)

No, im making a valid point, make it more easily digestible to what the point is

just quoting access to "this" and "that" makes little sense to most people.....plus theres a level of overhyping
[Android General] wr3cckl3ss1:
While you're partially correct. Samsung has been aware of this since October and now are back to being fully aware. Go check Mishaal Rahman's Twitter. As not only John Wu but Sergey Toshin have chimed on the exploit; 2 very well known and respected individuals in the community. This was truly a loss on Samsung's part. As more comes out, be sure to not update anything on your device going forward, to lessen the odds of Samsung pushing something thru OTA that will negate System Shell. As far as over hyping, let's go back and see whens the last time anyone has any direct effect on US Samsung devices. Last time I checked it's been a while so this is big for the community and a big shame on Samsung. So overhyping I wouldn't call it that but giving people an opportunity to learn more about the operating system and how it works and finding those holes to get to the next level of privilege is something many in the community are not going to pass. And as far as DSU, I'll point you to my personal Twitter post that I directed to three individuals.

https://twitter.com/i/web/status/1616361719252635652
[Android General] 73sydney:
Telling people not to update their phones to block an OTA that is likely to not only block this, but will likely also be included in further updates with updates to block potentially more harmful exploits is just the very WORST advice ever given perhaps on XDA...to the point of advocating negligence. Its ONE thing to suggest people stop an app from being updated, but to suggest the same for the OS is a no go in my opinion. Not something id want my name attached to.

I watched your video, and i'll still ask, wheres DSU on a stock Samsung ROM on an S20+?
[Android General] wr3cckl3ss1:
Hey...take the info as-is....my name is not attached as the author of this exploit. You should know what to do and not. I'm not anyone's babysitter here. I made a recommendation, use at your own risk. And as far as DSU for you.. Make sure to follow me and subscribe to my guide when it comes out in the near future. Thanks.
[Android General] yesca213:
Alright getting a bit off topic.... If you don't like what's posted don't read it or reply to it. That simple. I for one, would like to see this thread continue, to learn more about gaining access to these kinds of things. Thank you guys for your work
[Android General] V0latyle:
***Moderator Announcement***

Flaming and disrespect will absolutely not be tolerated. Repeated violations may result in account bans. Compliance with all XDA Forum Rules and Policies is MANDATORY for all members. While you're free to discuss the technical details and merits of this exploit, as well as the wisdom in deferring updates, you WILL treat each other with respect and dignity, and those who fail to do so will no longer be permitted to participate on XDA.

In addition, keep your posts ON TOPIC.

If you feel someone's posts violate the Forum Rules, use the Report button and let the moderator staff handle it before it becomes an issue.

Don't make us get involved again.
[Android General] K0mraid3:
Source has been added to the "How it works?" bit, don't hesitate to ask question or give ideas, we are very excited to expand this!

***Link removed by moderator***
[Android General] V0latyle:
So I'm honestly curious about this. You said it's equivalent to having SU permissions in shell, and from the OP it seems like you can change props?

If this is true, I highly suggest trying to change these props in order to unlock the bootloader:

ro.oem_unlock_supported Determines whether OEM Unlocking toggle should be visible

sys.oem_unlock_allowed Determines whether OEM Unlocking toggle can be changed

sys.get_unlock_ability Corresponds to the OEM Unlocking toggle state - off is 0, on is 1

Theory: Set all values to 1, then immediately attempt to unlock bootloader.
[Android General] wr3cckl3ss1:
I can somewhat answer this by pointing you to my Twitter post

https://twitter.com/i/web/status/1616374692671262721
[Android General] V0latyle:
What exactl

What exactly is persis.dat.blk?
[Android General] wr3cckl3ss1:
:/ $ getprop ro.oem_unlock_supported

1

:/ $ getprop sys.get_unlock_ability

:/ $ getprop sys.oem_unlock_allowed

0

:/ $ setprop sys.oem_unlock_allowed 1

:/ $ getprop sys.oem_unlock_allowed

1

:/ $ getprop sys.get_unlock_ability

:/ $ setprop sys.get_unlock_ability 1

:/ $ getprop sys.get_unlock_ability

1

:/ $

Still nowhere in sight.
[Android General] wr3cckl3ss1:
persistent.data.block

Which we have found thru sending service calls...is the only package that can read OEM.
[Android General] V0latyle:
If get_unlock_ability is 1, the bootloader should be unlockable, because that's the property that the bootloader checks upon a request to unlock.

Ich verstehe nur Bahnhof. I have no idea what that means
[Android General] BlackMesa123:
You should check the KnoxGuard status in Download mode to make sure it isn't set to Prenormal.
[Android General] wr3cckl3ss1:
So looking thru source....in any shell...type in cmd -l

You will be brought up with said services running. Two of which are

oem_lock

persistent.data.block

Examining OEM lock first looking through the source you send service calls in any shell for example "service call oem_lock 2 i32 1"

I don't have the source in front of me but there's a set of numbers. 2 to 7. And i forget which one exactly gives you the error and specifies the next java applet which is persistent.data.block.
[Android General] wr3cckl3ss1:
Funny you mention this....
[Android General] wr3cckl3ss1:
I will add....as you see that KG is COMPLETED....i also have Device Servcies completely uninstalled. But as i have been messing with Knox lately....i cannot tell if this ability to have status as COMPLETED and have the ability to remove Device Services completely was because of something i did messing with KNOX or by something else.
[Android General] wr3cckl3ss1:
Our source guy @oakieville can elaborate more on this....
[Android General] BlackMesa123:
If you give a look at the source code of the Settings app, the OEM Unlock toggle is shown only if all these requirements are met:

- ro.oem_unlock_supported prop must be "1"

- ro.frp.pst prop has the persistent block path set (usually it's "/dev/block/persistent")

- ro.boot.other.locked must NOT be "1"

- KnoxGuard status must NOT be "Prenormal", "Active" or "Locked" (Settings app checks for the knox.kg.state prop)

- ro.boot.kg.bit must NOT be "01" (OTP_BIT_KG_ENABLED)
[Android General] wr3cckl3ss1:
This is what i was referring to in regards to persistent data block
[Android General] BlackMesa123:
You mean the KnoxGuard app (com.samsung.android.kgclient)? You can't uninstall this app if KnoxGuardService is still enabled in frameworks or the OS will lock itself until the app is reinstalled
[Android General] wr3cckl3ss1:
Completely uninstalled.
[Android General] K0mraid3:
Maybe i should have worded that better, i was trying to give a good representation as to what this all does in the form of a comparison. It doesn't invoke or use the actual "su" binary or any kind of "Switch-user" type code. But it does, in the end, switch your shell user to 1000. I sometimes have issues wording things in such a way, my apologies.

But yes, some of those props are settable, however it seems something in AOSP was modified in term of bootloader unlock (FIVE?) and setting this prop essentially does nothing discernable. Maybe this has to do with something Qualcomm is doing?
[Android General] wr3cckl3ss1:
To add on more of this.... the group has found that by editing the lock screen database or removing it completely renders that persistent Device Services notification that says you do not have permission to disable this or uninstall it... but we haven't thoroughly worked on that specific issue but it's worth noting that you could change what it says in that database to whatever you want. Samsung calls this "3".... I believe. Excuse the language in the picture as when we uncovered this...we were having fun.
[Android General] BlackMesa123:
This prop isn’t checked at all like you can see in Post #212
[Android General] Arealhooman:
What’s iot hidden menu
[Android General] Arealhooman:
Can’t you access service menu always? What dm mode?
[Android General] K0mraid3:
IoT refers to the Internet of Things. IoT Hidden Menu is meant to MNO/MNVOs and engineers. This is what it looks like. DM Mode is part of IoT Suite.
[Android General] Arealhooman:
And this usually can’t be accessed without root?
[Android General] kountry83:
Could you please share this vm apk with me please. Trying to get mine working as well on tmobile. Thank you
[Android General] wr3cckl3ss1:
I'll upload but first let me ask you this...what phone do you have?
[Android General] adfree:
@wr3cckl3ss1​

Please. I have tiny problem with GW4...

I prepared my SM-R875F with flashing Firmware AUGF... Original not modifed/not rooted...

I have now tiny problem with 2 shells open...

A

Idea 1 not work...

I have installed additonal APK with some Terminal App...

adb install ShellTerm112.apk

But this shows many Errors... if I perform this Command:

am start -n com.samsung.SMT/.gui.DownloadList

B

2 x adb.exe from different folders...

Here nothing happens...

D:\Android\ADB>adb shell
freshul:/ $ nc -lp 9997

This works as it open the app on SM-R875F

D:\Android\adb2>adb shell
freshul:/ $ am start -n com.samsung.SMT/.gui.DownloadList
Starting: Intent { cmp=com.samsung.SMT/.gui.DownloadList }

C

My Avira was so "nice" to remove EXE from Komraids System Shell V4.5.zip

So not tested yet the systemshell.exe...

Please, what you use for Shell 1 with your GW4?

And what is Shell 2 which is working with your GW4?

Thanx in advance.

Best Regards
[Android General] kountry83:
Thank you very much bud
[Android General] Tigger31337:
> ro.boot.other.locked must NOT be "1"

That's our sticky point, right there.
[Android General] K0mraid3:
yup, goes back to the age old issue, How do manipulate that prop? SEM Factory app has something called GRDM, that mentions bootloader, I really want to see if there's anything worth while in there too.

If you know how, throw SEM Factory app in JADX, you'll see what i mean.
[Android General] Tigger31337:
This is still EXCELLENT work, btw. Thank you kindly. :-)
[Android General] BlackMesa123:
This prop is parsed by init at boot from /proc/cmdline, so it is set by the bootloader itself:

#if defined(CONFIG_SECURE_DEVELOPER_MODE)
add_cmdline("androidboot.other.locked=%d", 1);
#endif

Even if you guys find a way to spoof the prop (the only possible way imo is via resetprop) and show the OEM Unlock toggle, it must be assured that the bootloader itself also supports OEM Unlocking, newer Samsung devices with SVB also require to unlock the bootloader via Download Mode since the OEM Lock flag is now stored in RPMB. I don't have much knowledge about USA variants so take my suggestions with a grain of salt
[Android General] alecxs:
not to mention that toogling props during runtime simply does nothing.. they are processed by init.rc during boot.

thought there should be any settings put secure cmd, but no...
[Android General] Tigger31337:
That's what I was playing with.

There is for Global and System, but I get java exceptions when I try Secure.. Screenshot soon.
[Android General] Tigger31337:
Scratch that. I was going by memory (since it was one of the first things I tried). Even the "put" for System fails for me. Likely due to insufficient perms:

"Get" works for System and Global, but not Secure.
[Android General] K0mraid3:
Heres a bypass, as system, cd to /data/system/users/0 and do "ls -al" copy one of those settings files out using abx2xml PATH/TO/FILE/ /sdcard/FILENAME_BLAH.xml.HUMAN

Most all of the XML files in /data/system are encrypted in ABX format, so abx2xml and xml2abx binaries can help here.

We need to manually edit these files, then, after edit xml2abx /sdcard/FILE back to /data/system/users/0
[Android General] alecxs:
is there xml2abx too?
[Android General] K0mraid3:
its should already come shipped/w/device in your /bin
[Android General] subevilx:
Can someone help me with this what these values mean in network locked and im intrested in the first is_user_unlocked vlu
[Android General] Abish:
Could someone confirm having similar issue?

Failure [INSTALL_FAILED_BLOCKED_CROSS_DOWN: INSTALL_FAILED_BLOCKED_CROSS_DOWN]
ROLLBACK FAILED

I tried manually installing SMT recommended version but after adb uninstall and uninstalling updates and resetting it doesn't work when I try to manually install it throws an error, though after few moments get voice data menu and as far as I get is lang.poc after nothing else also
[Android General] irshansk:
Does anyone know if it is possible to do something with this VM app using this system shell to get it working on Tmob?

Apparently the app is unified for all carriers - app manager shows many "activities" within for many carriers including T-Mobile. Problem is - it does not call proper one on XAA CSC, it thinks that it is under Google Fi carrier. Using TMB CSC the app is not visible in a system at all.
[Android General] ezdiy:
That's normal, that folder is owned (and listable) only by root. Precompiled ART binaries of all system APKs live there, with uid system owner and are writable on normal android - unless samsung does some crazy with their Knox garbage again.

That's how one can turn this sort of thing into a poor man's xposed - you still need to fiddle with on-disk apks, but the kicker is that you can do so for all system apps now.
[Android General] adfree:
Thank you very much.

After fighting with my dam. Avira on my old lame Notebook... with 1 or 2 GB RAM...

I was able to perform the connection via your EXE...

S/system/bin/sh: can't find tty fd: No such device or address
/system/bin/sh: warning: won't have full job control
:/ $ whoami
system
:/ $ ls -a1l
ls: .: Permission denied
1|:/ $ cd /
:/ $ ls -a1l
ls: .: Permission denied
1|:/ $ ls
ls: .: Permission denied
1|:/ $ cd /
:/ $ cd /data/fota
:/data/fota $ ls
:/data/fota $ cd /
:/ $ ls -a1l
ls: .: Permission denied
1|:/ $ cd /sdcard
:/sdcard $ ls
Alarms
Android
Audiobooks
DCIM
Documents
Download
Movies
Music
Notifications
Pictures
Podcasts
Ringtones
mps_code.dat
update.zip
:/sdcard $ cp update.zip /data/fota
:/sdcard $ cp mps_code.dat /efs/imei
:/sdcard $ cd /efs/imei
:/efs/imei $ cat mps_code.dat
TGY:/efs/imei $ cd /data/fota
:/data/fota $ ls
update.zip
:/data/fota $

So CSC change is easy possible by cp mps_code.dat

I have before prepared 1 GB update.zip aka FOTA Delta... to perform OTA update local...

Need to charge my Battery... then I hope:

reboot fota

Tested on Windows 7...

EXE can also perform double install and crash... because my touchpad is old and I am too...

Tested device is SM-R875F on old Firmware AUGF... OLB Region...

Btw. the only leaked F Firmware...

Only as info.

Best Regards

Edit 1.

reboot fota leads to Recovery menu...

Need to check what is wrong... with me...