yashsingh1/xdaforums huggingface dataset:
[Android General] Romeo Nickolas:
sadly doing this exploit removed it I forgot to test it using SU apps.
[Android General] Romeo Nickolas:
I'm using wired USB. Just try and try until it works.
[Android General] K0mraid3:
it may be battery optimization, did you check those are off in Settings?
[Android General] wr3cckl3ss1:
It won't work as the SU apps need to be adapted to System
[Android General] ace2nutzer:
OK I believe it was my bad why it didn't work.

So I do assume that it'll work out if I use your exploit shell.exe.

I didn't use any provided files from post #1.

I was thinking and hoping it's just enough to use "su system" from usual ADB shell ... but it can't work because su binary isn't installed by default in a stock ROM, right?

Anyway, good job! - I'm waiting for the source code. :)
[Android General] K0mraid3:
correct, this does not invoke or use the "su" binary in any way, i had only mentioned that at the beginning to give readers an idea/comparison as to what this achieves, which is the exact same result you would get from being able to do "su system"
[Android General] ace2nutzer:
Yeah that's true. btw if you faked the existence of su binary for forcing system id, then you could try to add "su" symlink to "/system/xbin/su" this should help on some CM ROM's that expects su binary in /system/xbin folder. But I'm not sure if it'll help for real SU apps.

Maybe worth to try it out.
[Android General] :
Since I am not the smartest on this...

If we can change the oem unlock allowed property does that mean that the bootloader can be ulocked regardless of the version?

Or is it still limited to specific versions using the service from afaneh92?
[Android General] ace2nutzer:
Yeah, in fact, after I've installed my custom kernel + Magisk, i was able to run "su system" lol
[Android General] wr3cckl3ss1:
OEM toggle is completely useless for Samsung US devices....it does absolutely nothing
[Android General] K0mraid3:
Well, it SHOULD, but that's not seeming to be the case on my S21 SnapD. There is likely some more work needed/ things to trigger with the Persistent Data Partition to get that to work, but its a massive step in the right direction, imho.

So is it possible NOW? Most likely not on the newer devices.

Is it possible ever? In my personal and honest opinion, Yes. But that's to be figured out.
[Android General] :
Ok that explains it a bit better for me, it just lets you toggle it. Thank you.
[Android General] Romeo Nickolas:
does this work if you want to spoof your device like to change the model of my phone?

I want to confirm it first I don't want to get bootlooped.
[Android General] Mastercodeon:
Ahhh interesting. I noticed the new button to reopen the shell now, nice addition. I reskinned the systemshell with a dark mode winforms lib just for the lolz. The update now gets me a system shell every time now. I played around with some of the intents that were posted, was cool to be seeing menus i didnt know existed
[Android General] wr3cckl3ss1:
Nice...that DARK MODE is sick

As far as the MENUs.....we are still working on more.....
[Android General] wr3cckl3ss1:
This will not spoof your device to another model. And highly not recommended..as you may brick
[Android General] Mastercodeon:
If youd like i could send you the source for deployment. Its a small make over ive been doing to winforms.

A github is very much in need for this lol
[Android General] Mastercodeon:
Idk what permissions you'd need, if UID 1000 would work for this. But i used to use a Device ID changer that would only work with root to bypass pubg bans, and as far as i know, device model info is just stored in prop files right? So in theory couldn't this be achieved with just a system shell? Maybe even just the device ID itself?

Still trying to think of ways i could take advantage of a system shell lol
[Android General] wr3cckl3ss1:
While too early to tell and my own discovery......and still exclusive to our group.....

I've got a DSU loaded....no root...no BL unlock and all thanks to the exploit
[Android General] Romeo Nickolas:
Works on termux too without pc
[Android General] wr3cckl3ss1:
Yes it does.....OP will update with that soon. We have left out quite a bit of info as we're seeing but hopefully more info will be updated with everything our group has uncovered or discussed. Please be patient as we try to get everything out in the open.

If you or anyone reading feels like they have found something, please feel free to share and as time goes by we can confirm or deny what your discovery is because there is lots to discover here and tons of open doors that we haven't touched on.
[Android General] DrSimpDevelopment:
Dude that's real cool! This is significant for Samsung devices for sure!
[Android General] Skorpion96:
Another question if I can ask, couldn't we do the same process with your root explorer app? It is signed with Samsung cert so should be possible to do run-as on terminal or am I wrong? I remember @wr3cckl3ss1 suggested me that on the zte I am trying to root, obliviously it didn't work but I guess that on a Samsung device would
[Android General] Skorpion96:
I want to try with root explorer signed with run-as on termux, that would be awesome
[Android General] wr3cckl3ss1:
I suggested run as cuz I needed you to see what you could be open to in terms of the data partition and stuff that you haven't seen before
[Android General] wr3cckl3ss1:
As far as root explorer I will tell you that it's pretty much dead but using it as run as you can use it as a tool to see stuff that you normally can't see
[Android General] Skorpion96:
Yes but i mean, if I invoke a shell wouldn't be the same? If I do run-as wouldn't I become system? This is my question
[Android General] wr3cckl3ss1:
As this hasn't ported to any other manufacturer you will not... But right now the only thing available is Samsung but not limited to it because it's an AOSP problem so any manufacturer that carries AOSP is and will be victim
[Android General] wr3cckl3ss1:
And for the record it might be signed system but system has its limitations and the whole idea of RSA private keys and public keys is trash.... If you don't have the actual keys for any firmware or anything that was signed when any kind of lock was made you don't have anything and you're stuck chasing an endless loop of rabbit holes
[Android General] Romeo Nickolas:
I'm trying to reinstall may secure folder and I got this error.

Did I messed up something?

Update: I remember I tested some setprop commands and I set it again to 0. Idk what command affected this.

Secure Folder now works.
[Android General] DrSimpDevelopment:
Because I have root for a new phone I got.... I'm going to attempt to test this....
[Android General] Skorpion96:
Another question, wouldn't be possible to root this way:http://vulnfactory.org/blog/2011/09/12/rooting-the-samsung-admire/

If with uid 1000 we edit /data/local.prop, since I saw in the post that adb can be set as root wouldn't we be able to root eventually? We can use magisk files from here:https://xdaforums.com/t/xperia-1-5-...cve-2020-0041-including-magisk-setup.4146103/

Note that running those scripts could work maybe with only system shell, I'm not sure.
[Android General] irshansk:
Yay, I managed to get it working.

The cidmanager thing does not launch though

am start -n com.samsung.android.cidmanager/.modules.preconfig.PreconfigActivity -a com.samsung.android.action.SECRET_CODE -d secret_code://27262826 --ei type 2

it says that Error: Activity class {com.samsung.android.cidmanager/com.samsung.android.cidmanager.modules.preconfig.PreconfigActivity} does not exist.

What I should do next to get proper visual voicemail? :)
[Android General] wr3cckl3ss1:
What phone do you have?
[Android General] irshansk:
S22+ US U1 from factory.

Everything is set to XAA\XAA\XAA through samfw. Cidmanager was disabled to avoid automatic switch.
[Android General] wr3cckl3ss1:
Don't worry about the switching and re-enable CID manager
[Android General] irshansk:
I did try, but it does not have any effect

adb shell pm enable com.samsung.android.cidmanager

Result:

Package com.samsung.android.cidmanager new state: enabled

The sim removal does not trigger change of CSC back to TMB though. Is there some other "enable" command that might help?
[Android General] wr3cckl3ss1:
Have you disabled anything other than that package or messed with anything inside the service menu?
[Android General] irshansk:
I did not disable anything else.

I did enter service menu few weeks ago to play with protocol simulation, but nothing else
[Android General] wr3cckl3ss1:
Do you have App Manager by chance? If not...install it
[Android General] wr3cckl3ss1:
With App Manager installed....show me this
[Android General] irshansk:
apparently adb shell enable command did nothing

I have this
[Android General] wr3cckl3ss1:
You need to get it enabled somehow try reinstall but I doubt it'll work but either way you need to get it enable somehow
[Android General] irshansk:
Got it back, what's next?

Is there anything specific I should do to get the VM back?
[Android General] wr3cckl3ss1:
8n system shell....try preconfig command again
[Android General] irshansk:
it works, but what's the point of setting it to XAR for everything? I could do it via SamFW and it did not enable voicemail for me.
[Android General] wr3cckl3ss1:
So....find a CSC that does and then we can proceed
[Android General] irshansk:
XAA did have visual voicemail app in the menu, but it did not work. The app's UI did think that I have a different carrier or something and for all app settings it referred to Google FI app that I don't have because it is T-Mobile.
[Android General] wr3cckl3ss1:
Show me the app for VM with XAA and open it
[Android General] irshansk:
Here is the VM settings screen, the VM main screen, about phone screen and app drawer screen cropped.
[Android General] wr3cckl3ss1:
Find a CSC where your voicemail app looks like this....mine is dark because it's on dark mode
[Android General] irshansk:
There is no single one. I did try all available csc codes in the samfw app that are available for u1 including xar, xaa etc. The app is either completely missing or it just never opens at all
[Android General] wr3cckl3ss1:
Try in preconfig to set those
[Android General] K0mraid3:
Thats awesome! I like th dark skin (UI Theming is one of my fav things to do)
[Android General] K0mraid3:
What really got me intrested, and what could probably work for you, is trying to port the POC to work with "GOOGLE Text-to-speech, i believe a similar vuln exists with it.
[Android General] oakieville:
please try this version if my other exe is giving problems

note: this one doesnt require static ip ip doesnt matter
[Android General] tsilva30:
Hello guys. Is it possible to change the AID with this method? I heard that was only posible with root... I want to change my CSC to EUX and that's easy with Sam Fw tool but if the AID remains the same it cuts off OTA updates.

I must get EUX/EUX to get OTA's.

Thanks
[Android General] oakieville:
that one the last csc you can not change like that that is RFBYCODE it is done by AT command and requires akssedno/msl auth and if newer device then s9/n9 it requires new imei cert as it will fail cert and get no signal
[Android General] tsilva30:
basically I can forget about this right? too complex and root is needed...
[Android General] oakieville:
Actually root trips knox which blicks msk auth if root you cant change it changing it requires imei repair which is rootless but requires emtoken
[Android General] jatin21:
Hi, sorry if this sounds like a noob question. Can this be somehow used to unlock all the network bands that the device hardware has?

Like I have F711U1 and using the #*73* service menu, was able to unlock some more bands. However, my country needs 28 band which is supported by this device international version.
[Android General] wr3cckl3ss1:
No. Refer my guide or @peacey8 guide for BAND & NETWORK info
[Android General] DrSimpDevelopment:
Have you tried to reboot the device during any of this...?
[Android General] K0mraid3:
IOTHidden Menu could possible help here.
[Android General] rayw_xda:
Confirmed working on US Unlocked Z Flip4 fully patched (OneUI 5 @ Jan 2023 security patch level).

Had to try it multiple times to get it working though (reboot phone like 3 times).

I suppose this could also be used to unlock LTE / 5G bands on international phones since the Secret Code Unlocker doesn't work on international phones for getting into RF Test mode on those phones.

#EDIT:

While the included .EXE tool worked, I was not able to get the manual steps working - think it might be missing something, but the first ADB shell just stays listening and doesn't get anything outside of that after launching the DownloadList activity in the second shell.

Also, the .EXE is picked up by various AV's as malicious including Windows Defender: https://www.virustotal.com/gui/file...d3043f3e908cf282aa7081fd8b685226636?nocache=1

I ran it in a Virtual Machine to be safe.
[Android General] jatin21:
@wr3cckl3ss1 I have already followed @peaceyguide for unlocking the bands. However, like I said, I jave been able to unlock a few bands like 78 but the one I really need is 28. So wanted to confirm about it.
[Android General] rayw_xda:
If you tried forcing GCF CSC and also followed all the steps in the guide to remove NR whitelist, etc and you still don't see the band you need, then unfortunately the hardware just doesn't support it.

However, I do see band 28 NR-SA-NSA on my phone as well as LTE 28. I did the GCF + first method together on my phone.
[Android General] K0mraid3:
I need to go back over those first bits, likely a modification in the POC is causing this.

For the IOT, i do have an alt code i used, but its easy enough to throw iot in jadx and check out the codes i suppose, if you really need in.

Ill try to refine the "How it works?" section sometime today or this evening.
[Android General] rayw_xda:
Understood. Great work on this exploit and PoC, a shame that both Google and Samsung snubbed you on rewards.
[Android General] Killuminati91:
Thanks for your work guys! This could be pretty interesting for Vivo as well, as its possible to get UID1000 too. Just gotta find the secret menus for them.
[Android General] BlackMesa123:
I'm giving it a look and seems like AID is stored in TrustZone with the VaultKeeper service. The CIDManager app actually has the code to change it in place, so it's just a matter of finding how to actually change it from our side.
[Android General] K0mraid3:
ive been messing with this too, im open to helping on this.
[Android General] BlackMesa123:
I've made some interesting findings:

- To retrieve a VaultKeeperManager instance the app must be installed as a system app with the necessary permissions granted, otherwise servicemanager will return a null instance with this error: "getService has failed, permission denied."

- If you manage to get an instance of VaultKeeperManager, the trusted app will also check which app/service is creating the request: each Vault has a limited list of "allowed" apps/services. AID one for example is limited to the following apps/services:

/vendor/bin/hw/rild

com.android.phone

com.samsung.android.cidmanager

/system/bin/scs

com.samsung.android.app.mobiledoctor.ve

With this in mind I managed to get and try to write a new AID flag via this code:

VaultKeeperManager vk = VaultKeeperManager.getInstance("AID");
final int ret = vk.write(1, "ITV".getBytes(StandardCharsets.UTF_8));
if (ret != 0) {
Log.e("VK_TEST", "FAILED: error " + ret);
}

However it fails due to a "write protection", I'm wondering if the AID flag in vaultkeeper is read-only or if I still have to adjust something in my code, here's the log:

01-19 23:36:36.572 1291 5610 I VaultKeeperService: write
01-19 23:36:36.572 1291 5610 I VaultKeeperService: Get service instance by (17197/1001)
01-19 23:36:36.572 1291 1291 I VaultKeeperService: wakelock is acquired!!
01-19 23:36:36.572 1291 5610 I VaultKeeperService: Client info : com.samsung.android.cidmanager
01-19 23:36:36.574 1291 5610 I Vaultkeeper_MGR_system: Got instance of VaultKeeperManager
01-19 23:36:36.576 1291 5610 I Vaultkeeper_MGR_system: Got service of ISehVaultKeeper
01-19 23:36:36.576 703 703 I VaultKeeper_HIDL_Service: System client (//1000/1291)
01-19 23:36:36.576 702 702 I VaultKeeper_COMMON: VK 4.4.1 [Client] com.samsung.android.cidmanager. => [Vault] AID. [CMD NO.] 8916
01-19 23:36:36.576 702 702 I VaultKeeper_COMMON: [CMD:CHECK_CLIENT_REGISTERED]
01-19 23:36:36.576 702 702 I vaultkeeper: runCommand Success.(TA ret = 0)
01-19 23:36:36.577 702 702 I VaultKeeper_COMMON: VK 4.4.1 [Client] com.samsung.android.cidmanager. => [Vault] AID. [CMD NO.] 3465
01-19 23:36:36.577 702 702 I VaultKeeper_COMMON: [CMD:WRITE_UNSHELTERED]
01-19 23:36:36.658 702 702 E VaultKeeper_COMMON: Occured Error into TA side(-10004/com.samsung.android.cidmanager/AID)
01-19 23:36:36.658 702 702 E VaultKeeper_COMMON: Failed cmdProcessing(-10004)
01-19 23:36:36.658 702 702 E vaultkeeper: runCommand error.(-10004)
01-19 23:36:36.679 702 702 D vaultkeeper: data log : -10004,USER,A528BXXU1DWA4,20042F6D4D344311,1,com.samsung.android.cidmanager,AID,VaultKeeper :: write_unsheltered_data: Not allow to write. Enable write protection,N (164)
01-19 23:36:36.693 702 702 I vaultkeeper: Successfully delivered to DSMS.
01-19 23:36:36.693 702 17249 I vaultkeeper: Collecting log...
01-19 23:36:36.693 703 703 E VaultKeeper_MGR: checkResponseMsg : Occured Error into TA side(-10004)
01-19 23:36:36.693 703 703 E VaultKeeper_HIDL_Service: vaultkeeper hidl server write Failed! (-4)
01-19 23:36:36.693 1291 5610 E Vaultkeeper_MGR_system: An error occurs from HAL server(-4)
01-19 23:36:36.693 1291 5610 I Vaultkeeper_MGR_system: ~VaultKeeperManager
[Android General] xVoidx:
Would I be able to change the default TTL for my hot spot with this??? I have an unrootable US Unlocked Zfold 4?

Using the terminal command

"cat /proc/sys/net/ipv4/ip_default_ttl 65"

?
[Android General] BlackMesa123:
Probably not, you need a custom kernel with CONFIG_NETFILTER_XT_TARGET_HL enabled.
[Android General] xVoidx:
So a custom Kernel would absolutely be required to make this change even if I had root? Would this "root" method allow me to change the TTL any other way?
[Android General] BlackMesa123:
I might be wrong but I don’t think it can be done without a custom kernel with TTL target enabled in config
[Android General] tsilva30:
Thanks a lot for your effort.

If you manage to change AID with this exploit that would be another huge step. It means a totally carrier unlocked phone without rooting but perhaps it's only possible with the method reported at post #141 and #143 as it messes up with IMEI.

Anyway looking forward for this 👍
[Android General] K0mraid3:
Really? huh, ok we will look at this @oakieville put together the exe for this project, maybe he can shed some light on that. We are happy to share the source for the .exe for transparency sake and will make sure to add that on the github project (still trying to get it all setup)
[Android General] K0mraid3:
I can feel myself slipping into the rabbit hole on this.... lol
[Android General] adfree:
@wr3cckl3ss1

Please. I see something about GW4.

Can you or somebody else confirm this working?

I do some stupid tests on my SM-R875F... GVK6 Firmware...

With low success...

freshul:/ # am start -n com.samsung.android.cidmanager/.modules.preconfig.PreconfigActivity -a com.samsung.android.action.SECRET_CODE -d secret_code://27262826 --ei type 2
Starting: Intent { act=com.samsung.android.action.SECRET_CODE dat=secret_code://27262826 cmp=com.samsung.android.cidmanager/.modules.preconfig.PreconfigActivity (has extras) }
Error type 3
Error: Activity class {com.samsung.android.cidmanager/com.samsung.android.cidmanager.modules.preconfig.PreconfigActivity} does not exist.

Copy and Paste from more stupid old test with Root...

Second attempt not more success...

Yeah I know I made few things not or wrong...

But maybe somebody smarter and faster can confirm luck on GW4 and/or GW5...

Thanx in advance.

Best Regards
[Android General] wr3cckl3ss1:
Works on GW4....confirmed and tested by me
[Android General] wr3cckl3ss1:
I see what your doing....trying to call Preconfig..... because as you are aware...that's a BIG thing those guys are looking for.....rest assured....I'll have a guide coming soon....
[Android General] adfree:
Okidoki...

Will try to unroot my SM-R875F and start from scratch on AUGF Firmware...

Best Regards
[Android General] oakieville:
Av wont like it as its packed it has the adb.exe and and both adb dll's and both apks embedded in it
[Android General] rayw_xda:
Does not work on Galaxy S8 US Unlocked on latest update (OneUI 1.0, Android 9)

Probably because "nc" doesn't exist on it,

dreamqlteue:/ $ nc -lp 9997
/system/bin/sh: nc: not found
[Android General] 73sydney:
9 pages and not one post where anyone points out what exact use this is....
[Android General] rayw_xda:
It's a huge stepping stone into more possibilities, such as potentially being a root exploit.

The first post gave concrete examples of what it can CURRENTLY do as-is: launching Hidden Menu (such as for unlocking LTE/5G NR bands, CA combos, etc), CSC Changer, DM Mode changer (all of these usually require SYSTEM app privileges)

The OP's group also showed the exploits potential in booting GSIs via the DSU feature in the past (i.e. being able to boot AOSP on your US Samsung phone with locked bootloader).
[Android General] wr3cckl3ss1:
It's redacted for the time being....hence the blurred images in OP but I'll help you out here and tell you....

No...it's not ROOT.....NO BL unlock YET.....

ACCESS TO

SYSTEM OWNED DIRECTORIES

/data

/cache

Knox Directories

FOTA

And various other things

If you're an active DEV and know the ins and outs then having access should be a treat as this kind of unprecedented access hasn't happened in years on US Samsung Devices...

ENTER THE DRAGON

AND

ENJOY
[Android General] K0mraid3:
"Error: Activity class {com.samsung.android.cidmanager/com.samsung.android.cidmanager.modules.preconfig.PreconfigActivity} does not exist."

try pm enable com.samsung.android.cidmanager/com.samsung.android.cidmanager.modules.preconfig.PreconfigActivity
[Android General] K0mraid3:
lol, 9 pages and a whole article describing EXACTLY what this is...... If you cant figure it out, you don't need it. RIP>
[Android General] adfree:
IMHO 73sydney is not total noob...

But sometimes I have feelings he like to make trouble instead help...

@73sydney

You are here to help?

Best Regards
[Android General] K0mraid3:
wtf no way?! def didn't expect this to be an issue! do you maybe have netcat? boy.. Let me thing about this one
[Android General] Sands207:
I appreciate this tool. This will definitely open the doors of opportunity for my current development on the A32 5G. Thank you!