yashsingh1/xdaforums huggingface dataset:
[Android General] maliczech:
There are myriads of downgrade bugs like this introduced by Android Q rollbacks. Not deemed as high priority because you can force rollback only from adb, not something a malicious app could really do.

Google is playing a bit of "teehee, let's do a little bit of trolling" with vendors here, because (t)rollbacking google packages rarely leads to system compromise, whereas vendor cruft, overwhelmingly so.

Nice to see people trying to bring this wide class of low-priv-esc to the masses, though I'm skeptical of its utility.

For those curious how the bug actually works (bringing it back from the grave due to new rollbacks aside), see https://blog.flanker017.me/text-to-speech-speaks-pwned/
[Android General] KittySparkles:
Would this method allow activating native call recording on SM-S908U1?
[Android General] Renate:
Although I consider myself (somewhat) well versed in BB code, I was confused by the first post. I would like to point out that the first post is not intentionally blurred by moderators.

This is hidden text with [hide]

I was hidden, but now I'm visible.

This is a spoiler with [spoiler="My topic"]. (Which has mouse-over information, "Click to reveal or hide spoiler".)

Spoiler content hidden.

This is an I-spoiler with [ispoiler]. (Which has no mouse-over information.)

Spoiler content hidden.

I prefer spoiler with optional title as it's the most clear what is going on.

The I-spoiler is confusing. Hidden doesn't take a title.
[Android General] gaelikitten:
It's kinda funny actually. I had a hell of a time trying to build the apk provided by OP. Eventually beating my head against the wall until I found this blog post. The POC in it I had no issue compiling, installing, and exploiting.

Nearly unedited and it still works. I am honestly not sure what OP's changes are for, some of them look a little suspect.
[Android General] K0mraid3:
i am curious....
[Android General] K0mraid3:
Oh wow i never thought about people thinking that, i just did it to make it easier to read!
[Android General] K0mraid3:
feel free to go through source, before making unbased statements. its openly available lmfao.

And yes this was tweaked, but this is intended to work with managers and like Magisk or Su as well as provide us (the devs) resources as we work with this...
[Android General] K0mraid3:
Top John Wu already made a comment on Twitter, Entire android framework is pwnd. Thats utility enough.
[Android General] K0mraid3:
Let me look a bit more into this, ive noticed quite a bit of people asking about tthis
[Android General] K0mraid3:
Very nice work!!!!
[Android General] maliczech:
That technical convos occur on twitter rather than normal internet pains me greatly. Oh well, guess I'll have to make a twitter account. If there's enough will to turn magisk into generic framework injection framework (ugh), there's definitely some potential for low tier system mods of xposed variety as others mentioned earlier.

UID=1000 is immense class of bugs, far more common than root privescs.

But it means redoing a lot of stuff for things to work from framework ventage point, compared to how things were normally done. I personally deem anything less than control over selinux policy and mount points of dubious utility, but if limited xposed is the thing most people want, things could get certainly interesting.
[Android General] Aarif goku:
Very interesting,

Can we patch/replace files in /system/framework/

Or have a working lsposed to try out few modules system wide?.

Basically looking for patch mock location like smali patcher by @fOmey does.
[Android General] adfree:
am start -n com.wssyncmldm/com.idm.fotaagent.enabler.ui.admin.main.AdminMainActivity

This is working for me... better then reboot fota...

As additional steps required as it seems...

This calls the FOTA Admin menu... and I can select proper update.zip...

App copies to /data/fota and execute proper...

This is FOTA Delta aka update.zip related...

Tested on my SM-R875F AUGF.

Best Regards
[Android General] wr3cckl3ss1:
:/ $ setprop sys.get_unlock_ability 1

:/ $ setprop persist.sys.get_unlock_ability 1

:/ $ setprop persist.sys.oem_unlock_allowed 1

:/ $ getprop persist.sys.oem_unlock_allowed

1

:/ $ setprop persist.ro.oem_unlock_supported 1

Failed to set property 'persist.ro.oem_unlock_supported' to '1'.

See dmesg for error reason.

1|:/ $ setprop persist.sys.oem_unlock_allowed 1

:/ $ setprop persist.sys.get_unlock_ability 1

:/ $ getprop ro.frp.pst

/dev/block/persistent

:/ $ getprop ro.boot.other.locked

1

:/ $ getprop knox.kg.state

Completed

:/ $ getprop ro.boot.kg.bit

00

:/ $

My biggest issue is "ro.boot.other.locked" as it's 1 but everything else looks about right.
[Android General] wr3cckl3ss1:
To answer your previous post. I use adb connect/pair to GW4. Then connect to SystemShell.
[Android General] ezdiy:
You can't really touch most framework apks as those are on read only partition. Most of it (not necessarily everything, though) lives as ART compiled binaries in /data/dalvik-cache system can write to though, so you patch it as that.

Dealing with normal apps (ie to get injection in /data/apps where system UID itself *can't* write to) seems to be more awkward than xposed of android system apps here (hook into installer and "spread" via new installs and such). It's all definitely doable, but seems like a lot of hoops.
[Android General] BlackMesa123:
Post #230
[Android General] wr3cckl3ss1:
Use Samsung's native menu to Uninstall Updates then try again.
[Android General] wr3cckl3ss1:
Definitely still worth the hassle. I believe like minded and high skilled individuals will break it all down and make it usable for the day to day user. Any hope is better than none especially on today's Samsung devices. We look forward to what the community brings out of this before SAMSUNG and/or GOOGLE patches it all away. That's why i RECOMMENDED that any further updates be out on hold. (*Disclaimer...USE AT YOUR OWN RISK)
[Android General] wr3cckl3ss1:
setprop security.ADP.policy_version 00000000

setprop security.ADP.version 0.0

setprop security.ASKS.expiration_date 00000000

setprop security.ASKS.policy_version 00000000

setprop security.ASKS.rufs_enable false

setprop security.ASKS.time_value 00000000

setprop security.ASKS.version 0.0

[security.ADP.policy_version]: [20191001]

[security.ADP.version]: [3.0]

[security.ASKS.expiration_date]: [20221223]

[security.ASKS.policy_version]: [20221027]

[security.ASKS.rufs_enable]: [true]

[security.ASKS.time_value]: [20230120]

[security.ASKS.version]: [5.8]
[Android General] wr3cckl3ss1:
I will add...upon reboot....it all reverts back
[Android General] Romeo Nickolas:
I tried the new updated files and it doesn't work manually. Even the app doesn't work.

Tried on 2 phones note 10 US and note 20 ultra US.

Can I get the old apk before the new update?

The one with using the ip address.

edit: sorry I just didn't wait long enough it's working now using the app
[Android General] wr3cckl3ss1:
Sorry for the small text but it's better than copying and pasting. Also notice the service call i used. I sent a basic one to cause the error shown, which is what in was looking for.
[Android General] kunglao1:
Tried to install this on my old S6 Active for fun, the latest Android version for that device is 7 (Nougat) and as far as I know the bootloader on this thing can't be unlocked, seems this device is too old for this exploit though as when I try step 4, it doesn't work as it complains about unknown arguments, and if I remove them (leaving only the single-letter arguments, like adb shell pm install -r -d -f -g /data/local/tmp/samsungTTSVULN2.apk), it still can't install because the APK is built for a newer SDK version (APK's SDK version is 28, my phone's SDK version is 24). Can this in theory still work for these older Samsung phones, or am I out of luck?
[Android General] Unreal_Hawkzz:
also facing version downgrade issues after manually uninstalling updates of samsung tts
[Android General] wr3cckl3ss1:
Restart your phone and screenshot the version number or provide it here after reboot.
[Android General] v3r@:
I totally agree with your considerations, downgrade '"attack"" are only possible with adb, an app with install permission cannot downgrade another app. Is not a security problem, I think exploit old bugs is fun and a way to learn but I agree with Samsung and google to not address this kind of stuff. However I'm happy to see people doing this and releasing their exploit (as long that it is not considered more than what it actually is, i.e. an implementation of an N-day exploit, perhaps useful for modding)
[Android General] Unreal_Hawkzz:
3.0.08.18
[Android General] Unreal_Hawkzz:
also facing this

Exception occurred while executing:
java.lang.IllegalArgumentException: Unknown option --install-reason
at com.android.server.pm.PackageManagerShellCommand.makeInstallParams(PackageManagerShellCommand.java:2230)
at com.android.server.pm.PackageManagerShellCommand.runInstall(PackageManagerShellCommand.java:903)
at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:158)
at android.os.ShellCommand.exec(ShellCommand.java:103)
at com.android.server.pm.PackageManagerService.onShellCommand(PackageManagerService.java:26036)
at android.os.Binder.shellCommand(Binder.java:642)
at android.os.Binder.onTransact(Binder.java:540)
at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:3145)
at com.android.server.pm.PackageManagerService.onTransact(PackageManagerService.java:4772)
at android.os.Binder.execTransact(Binder.java:739)
[Android General] Unreal_Hawkzz:
tried both from PC and termux
[Android General] Unreal_Hawkzz:
It seems pm does not support this flag (--install-reason) in my phone?

list of install flags

install [-lrtsfdg] [-i PACKAGE] [--user USER_ID|all|current]
[-p INHERIT_PACKAGE] [--install-location 0/1/2]
[--originating-uri URI] [---referrer URI]
[--abi ABI_NAME] [--force-sdk]
[--preload] [--instantapp] [--full] [--dont-kill]
[--force-uuid internal|UUID] [--pkg PACKAGE] [-S BYTES] [PATH|-]
Install an application. Must provide the apk data to install, either as a
file path or '-' to read from stdin. Options are:
-l: forward lock application
-R: disallow replacement of existing application
-t: allow test packages
-i: specify package name of installer owning the app
-s: install application on sdcard
-f: install application on internal flash
-d: allow version code downgrade (debuggable packages only)
-p: partial application install (new split on top of existing pkg)
-g: grant all runtime permissions
-S: size in bytes of package, required for stdin
--user: install under the given user.
--dont-kill: installing a new feature split, don't kill running app
--originating-uri: set URI where app was downloaded from
--referrer: set URI that instigated the install of the app
--pkg: specify expected package name of app being installed
--abi: override the default ABI of the platform
--instantapp: cause the app to be installed as an ephemeral install app
--full: cause the app to be installed as a non-ephemeral full app
--install-location: force the install location:
0=auto, 1=internal only, 2=prefer external
--force-uuid: force install on to disk volume with given UUID
--force-sdk: allow install even when existing app targets platform
codename but new one targets a final API level

install-create [-lrtsfdg] [-i PACKAGE] [--user USER_ID|all|current]
[-p INHERIT_PACKAGE] [--install-location 0/1/2]
[--originating-uri URI] [---referrer URI]
[--abi ABI_NAME] [--force-sdk]
[--preload] [--instantapp] [--full] [--dont-kill]
[--force-uuid internal|UUID] [--pkg PACKAGE] [-S BYTES]
Like "install", but starts an install session. Use "install-write"
to push data into the session, and "install-commit" to finish.

install-write [-S BYTES] SESSION_ID SPLIT_NAME [PATH|-]
Write an apk into the given install session. If the path is '-', data
will be read from stdin. Options are:
-S: size in bytes of package, required for stdin

install-commit SESSION_ID
Commit the given active install session, installing the app.

install-abandon SESSION_ID
Delete the given active install session.
[Android General] Unreal_Hawkzz:
Same with the flag (--enable-rollback)

Exception occurred while executing:
java.lang.IllegalArgumentException: Unknown option --enable-rollback
at com.android.server.pm.PackageManagerShellCommand.makeInstallParams(PackageManagerShellCommand.java:2230)
at com.android.server.pm.PackageManagerShellCommand.runInstall(PackageManagerShellCommand.java:903)
at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:158)
at android.os.ShellCommand.exec(ShellCommand.java:103)
at com.android.server.pm.PackageManagerService.onShellCommand(PackageManagerService.java:26036)
at android.os.Binder.shellCommand(Binder.java:642)
at android.os.Binder.onTransact(Binder.java:540)
at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:3145)
at com.android.server.pm.PackageManagerService.onTransact(PackageManagerService.java:4772)
at android.os.Binder.execTransact(Binder.java:739)
[Android General] Unreal_Hawkzz:
Without these two flags i am getting

C:\Users\ACER>adb shell pm install -r -d -f -g --full /data/local/tmp/samsungTTSVULN2.apk
Failure [INSTALL_FAILED_VERSION_DOWNGRADE]
[Android General] adfree:
Please don't kill me... :alien:

A

Please maybe other Colors possible?

Because I am blind old man and this makes Augenkrebs because unreadable without mark text...

B

It is possible to "Double Click"... then EXE performs double Commands = crash...

Maybe it is possible to program only 1 click

Thanx in advance.

And thank you very much for sharing this cool trick.

At the moment I can perform this trick with "latest" GVK6 Firmware for SM-R875F

No idea when Samsung will fix this...

Best Regards
[Android General] adfree:
1 more stupid Question...

We have several Threads and/or posts where users wrote about temporary root... by execute SU Binary from temp folder with chmod blabla...

Somebody tried?

Maybe powerfull enough to use dd or something like this to dump partitions or maybe have write access or...

I will later try on SM-R875F... need su Binary...

More then this ugly Watch explode...

:)

Also stupid idea to start few apps from bin folders... like:

verity related...

Or shell scripts *.sh

Or...

Only dream.

Best Regards
[Android General] K0mraid3:
yeah, check on github, i put both up there, its the ALT variant.
[Android General] K0mraid3:
We will sort this! I do apologize about the colors, i hadn't considered your situation!
[Android General] K0mraid3:
Hey All, Thanks for bringing this up! It seems we need to take a look at some of the much old devices as they actually do not have some of the same tools and utilities that newer devices do. We will see if we can find a workaround for this!
[Android General] Unreal_Hawkzz:
The pleasure is ours!
[Android General] wr3cckl3ss1:
WATCH 4 CLASSIC SM-R895U
[Android General] Mr NI:
would it be possible to root a samsung device with this exploit?
[Android General] Pervokur:
you can use near the same steps and start sshd from uid1000, so you will have termux environment with uid1000. Just setup ssh in termux and in the script remove kill-on-exit and add sshd startup

reddit.com/r/termux/comments/10h2bmn/how_to_run_termux_environment_through_proot_from/
[Android General] G935F:
Can we use this with AFWall+?
[Android General] do1z:
Same. I am trying this on my G950u1.

Trying to remove the app package doesn't seem to work.

$ adb shell pm uninstall -k --user 0 com.samsung.SMT
Success
$ adb shell pm install -r -d -f -g --full /data/local/tmp/samsungTTSVULN2.apk
Failure [INSTALL_FAILED_VERSION_DOWNGRADE]

Even after a reboot, I'm still getting the same error.
[Android General] maliczech:
Only Android 10 and later allow rollbacks to buggy (lower than system image) versions.
[Android General] subevilx:
Can someone help me I want to run com.android.app.telephonyui.carrierui.iccnetwork.view.IccNetworkLockDialogActivity on my s22 but am start does not work

my device is network locked btw
[Android General] Unreal_Hawkzz:
Stuck on android pie in s8+ scv35 :( odin flashing doesn't work otherwise would have android 12 in this slick device
[Android General] wr3cckl3ss1:
This will not get you carrier unlock...as carrier unlock is Server/API/RSA based depending on what carrier your on.
[Android General] wr3cckl3ss1:
Isn't your device already rootable and/or have the ability to flash custom roms?
[Android General] wr3cckl3ss1:
USE AT OWN RISK....

What worked for me...might not for you....

How to load up a "DSU" on your device using System Shell and NO BL unlock.

(See pics as needed)

For me on my S22 Ultra S908U1. What i did was....execute both activities in STEP 1 AND 2. Then when it said it was ready. I hit restart in the notification. And presto.....now i loaded a replica DSU of my existing firmware. So yes, while it's not a GSI or DSU of your choosing....you still have a DSU. The main focus is that NOTIFICATION....it's what takes you to and from your regular firmware and that DSU. As long you don't DISCARD IT.....it should come back thru reboots. This goes for the DSU as well. Word of warning....the DSU i did get loaded up...was pretty much packed with a ton of stuff. And locked up all the space i had. 8GB. I ended up removing pretty much all packages. Except Play Services....Play Store....and a few other packages. Another warning....the one downside to all of this is IF YOU do this and want the benefits of this...going back and forth.... YOUR FACE AND FINGERPRINT will always end up being corrupted.

In SYSTEM SHELL execute and then follow prompts

Step 1: am start -n com.android.dynsystem/.VerificationActivity

Step 2: am start -n com.android.settings/.development.DSULoader
[Android General] K0mraid3:
do you happen to have a link to this commit/request on AOSP
[Android General] maliczech:
services/core/java/com/android/server/rollback - platform/frameworks/base - Git at Google
[Android General] adfree:
Found the Thread about old idea of temporary root...

https://xdaforums.com/t/how-do-i-te...-without-twrp-recovery.4421255/#post-86653487

Ehm... I would try again. But I have tiny problems with my tiny brain...

In old Tizen days I have simple taken su Binary from Combination Firmware...

Ehm... as Rooting with Magisk 24.3 and 25.2 work for GW4...

Where Magisk stores the su Binary?

In RAMDISK of boot.img?

Thanx in advance.

Best Regards

Edit 1.

GW4 is armeabi-v7a and Android 11...
[Android General] rayw_xda:
Works exactly as advertised, and exactly this simple.

It loads up a completely isolated copy of the OS
[Android General] wr3cckl3ss1:
Extremely easy....and for me....a big screw up on Samsung and Google...more on Google because it's their source. With this...now comes how to hijack where it's downloading from and embed what you want. Seems like a long shot but they...not many can say they're the first to get a "DSU" on a BL LOCKED device from Samsung. I'll definitely hold that title for a long time 😁🤣😁🤣😁🤣
[Android General] rayw_xda:
I also tried out using the official method for loading an AOSP GSI image and got it to load to the point where it asks to restart phone to boot the image, but I guess it gets stuck in a bootloop (most likely due to bootloader incompatibility with Google signed AOSP GSI images). After that it boots back into the original OS.

Dynamic System Updates (DSU) | Platform | Android Developers

Dynamic System Updates (DSU) lets developers install a GSI side by side with the device's system image on a DSU-supported device that runs Android 10 or higher.

developer.android.com

Probably because Samsung wasn't one of the OEMs that approved booting Google signed images.
[Android General] wr3cckl3ss1:
Yes..i have tried this and have failed. I even reached out to @phhusson in hopes of maybe finding out more but as he is already fully booked and short on time with his stuff...i can only do so much....but i welcome any other DEVs that do work in this area to chime in and see where we can get this thing cracked.
[Android General] adfree:
Hmmm... no idea why.

On my SM-R875F ... this seems not installed...

com.sec.hiddenmenu

But in Combination Firmware I see this... HiddenMenu.apk

Need to check later with open eyes...

Best Regards

Edit 1.

Hmmm... solution for this would be nice...

adb install com.sec.hiddenmenuapkmirror1.apk
Performing Streamed Install
adb: failed to install com.sec.hiddenmenuapkmirror1.apk: Failure [-3001: INSTALL_FAILED_REJECTED_BY_BUILDTYPE]

Edit 2.

Maybe found su for stupid tests...

D:\Android\adbLEAK>adb push su /data/local/tmp
su: 1 file pushed, 0 skipped. 36.8 MB/s (222928 bytes in 0.006s)

D:\Android\adb>adb shell
freshul:/ $ cd /data/local/tmp
freshul:/data/local/tmp $ ls -a1l
total 15826
drwxrwx--x 2 shell shell 3452 2023-01-22 06:17 .
drwxr-x--x 4 root root 3452 2023-01-20 09:30 ..
-rw-rw-rw- 1 shell shell 15955101 2023-01-18 18:08 samsungTTSVULN2.apk
-rw-rw-rw- 1 shell shell 222928 2023-01-22 05:52 su
[Android General] rayw_xda:
Sounds like it's never going to be solvable without an unlocked bootloader on anything other than Pixel phones: https://www.xda-developers.com/android-12-beta-best-way-to-install-dsu/
[Android General] ezdiy:
Works fine with a lot of vendors (Xiaomi, Oneplus..). Missing DSU is peculiar to Samsung (by hostile design) and some cheaper chinese vendors (by lazyness).
[Android General] rayw_xda:
Does it work on those OEM devices with a locked bootloader?
[Android General] ezdiy:
Yes. With unlocked bootloader, there's not much point to DSU, coz you'd want to have root at that point, too.
[Android General] wr3cckl3ss1:
I'm wondering if Shizuku with SystemShell could be implemented to work with DSU Side-Loader. But that's something someone would have to ask VegaBobo about, as it's his APK. Then the other issue of asking Rikka for Shizuku comes about. I have personally witnessed Shizuku running System Shell myself and it truly is a nice little app. The sky is the limit.
[Android General] mohitgalaxy3:
Thank you so much @wr3cckl3ss1, I was waiting for this guide since the time you shared preconfig menu in s22 group.

I need your help to access IOT menu, my device is SM-G998N (Korean variant).
[Android General] wr3cckl3ss1:
Can you pull the APK and upload here?
[Android General] mohitgalaxy3:
Sure, is the apk name IOTHiddenMenu ?
[Android General] rayw_xda:
I've confirmed that IOTHiddenMenu ONLY exists on US/Canada firmware phones.

But, there is a way to use System Shell to access the relevant menu directly,

am broadcast -a com.samsung.android.action.SECRET_CODE -d android_secret_code://27663368378 -n com.sec.android.RilServiceModeApp/.SecKeyStringBroadcastReceiver

A helpful tester on Reddit verified for me that this also works on an International S22 Ultra.

I found this by digging into the Service Mode RIL APK in the system which is where the actual menu logic is being executed.
[Android General] mohitgalaxy3:
I managed to change csc from KTC to KOO but 4G+ LTE+ is gone. Only getting LTE now, is there anyway to get LTE+ unlocked and enable 5G.
[Android General] rayw_xda:
According to the XDA article, the ONLY phone that DSU works on with locked bootloader is Pixel phones while other phones they had to unlock the bootloader before it started booting.
[Android General] rayw_xda:
Caution: do NOT try to factory reset the system while booted into the DSU image. It will reset your real image!

Luckily I did this all on a test phone not my main phone. Be warned.