yashsingh1/xdaforums huggingface dataset:
[Android General] gaelikitten:
Someone pointed this out in the telegram channel for this and they just deleted it. Would be nice if credit was given where it was due.

You can see this very clearly if you take a look at the binary libmstring.so that is distributed with the POC, it still has the quirky comments in it from flanker017's write-up of this exploit. It isn't much to ask for a simple thanks to him as well, as clearly without this look at this CVE we wouldn't be talking about this issue.

It's all still there. And yet, not a mention of his work. I know plagiarism isn't really something people care about online, but if I were a security researcher I would want to make sure that those who worked on this are given their just attribution.

There are shoutouts on the first post in this thread, and not a single person on that list should be any higher than flanker017. It would be one thing if you had based your exploit on his work, but considering it launched as a repackaging of his work, he should be given credit.

It's awesome what people are managing to figure out with this exploit. It's great. But without the foundation laid out by flanker017 we wouldn't be posting in this thread today.
[Android General] wr3cckl3ss1:
Be rest assured that credit will be formally made. As many of us..have busy lives and things have got a bit busier. Things get missed and we're only human. But I'll make sure the right information is posted and also make sure...to give credit where it's needed. I'll pass the world on to k0mraid3. Thanks.....
[Android General] adeelraj230:
Waiting for your FleetKey(aka S22 Snapdragon root) any update?
[Android General] Mem_0:
can u share the steps after starting the shell exploit?
[Android General] Mem_0:
Me too, a huge thanks <3
[Android General] mohitgalaxy3:
Looks like you have already changed csc. Good.
[Android General] adfree:
New day, new attempt to "replace" 1 day in 2023 the EXE for my Galaxy Watch 4...

The "new" idea in my tiny brain is to split Batch Files instead wholeIn1...

First attempt... then I will check "second" Button in beautiful colored EXE...

D:\Android\adbLEAK>A_install_AND_push_2APKs_v1.bat

D:\Android\adbLEAK>adb push .\apk4exploit\samsungTTSVULN2.apk /data/local/tmp
.\apk4exploit\samsungTTSVULN2.apk: 1 file pushed, 0 skipped. 3.3 MB/s (15955101 bytes in 4.605s)

D:\Android\adbLEAK>adb install .\apk4exploit\komraids_POC_V1.5.apk
Performing Streamed Install
Success

D:\Android\adbLEAK>pause
Drücken Sie eine beliebige Taste . . .

Later if something successfull I can upload...

For now only for my tiny brain and Windows...

Interesting 1...

/data/local/tmp

This tmp folder is not self cleaning... so you can safe for looong time...

Because over this s hitty WiFi in Galaxy Watch 4... to prevent to transfer "huge" files tooo often...

Edit 1.

Could be the Rollback Command not included in second EXE Button...

Edit 2.

Memo to me... EXE 2Button with my Batch A not success...

Will create second Batch with Rollback and chmod... maybe mandatory... who knows...

freshbs:/ $ cd /data/local/tmp
freshbs:/data/local/tmp $ ls -a1l
total 15606
drwxrwx--x 2 shell shell 3452 2023-02-17 06:00 .
drwxr-x--x 4 root root 3452 2023-01-29 05:09 ..
-rw-rw-rw- 1 shell shell 15955101 2023-01-18 19:11 samsungTTSVULN2.apk
freshbs:/data/local/tmp $ chmod 777 samsungTTSVULN2.apk
freshbs:/data/local/tmp $ ls -a1l
total 15606
drwxrwx--x 2 shell shell 3452 2023-02-17 06:00 .
drwxr-x--x 4 root root 3452 2023-01-29 05:09 ..
-rwxrwxrwx 1 shell shell 15955101 2023-01-18 19:11 samsungTTSVULN2.apk

Edit 3.

Batch 2...

D:\Android\adbLEAK>adb shell chmod 777 /data/local/tmp/samsungTTSVULN2.apk

D:\Android\adbLEAK>adb shell pm install -r -d -f -g --full --install-reason 3 --enable-rollback /data/local/tmp/samsungTTSVULN2.apk
Success

D:\Android\adbLEAK>pause
Drücken Sie eine beliebige Taste . . .

Edit 4.

chmod seems not mandatory...

Still no success...
[Android General] omaralwardian:
After installing 2.0.3 and providing permission to the escalation app and running the app, everything runs fine except for when I go to the custom command option and type in the provisions to set the camera2API which require SAF.

This is what it says.

@adfree @K0mraid3

Edit:

All the other functions work fine however.
[Android General] subevilx:
where di u download this from?
[Android General] kienns1996:
Samsung Toolkit - Unlock more. - Apps on Google Play

Provides advanced tools to unlock your Samsung phone's full potential.

play.google.com
[Android General] kiranambati:
@K0mraid3 @adfree

Can you please help me with the issue I am facing?

Device : Galaxy watch 5 pro

I have tried all the steps given in manual way. but not able to get to the shell. it is stuck at

nc -lp 9999

Here is the screenshot

As mentioned I ran am start -n com.samsung.SMT/.gui.DownloadList in another shell

am start -n com.samsung.SMT/.gui.DownloadList

Which opened language installation screen on my watch

Can you please guide me where is the mistake?

I want to change CSC code of the watch.

please let me know if you need anymore details

TIA
[Android General] Sands207:
You do know you can change the csc without this tool right?
[Android General] kiranambati:
Can you please let me know how ? I have searched a lot but couldn't find a solution.

Dial *#272*719434266344#

This is not working for me BTW.

Are there any other ways ?
[Android General] adfree:
@kiranambati​

Please check my older posts here and also here as example:

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-33#post-88095269

I am ONLY able to use the EXE... NO other way successeded with my tiny brain and limited skills.

But I can confirm this EXE work in Windows 7 and Windows 10 and Windows 11...

@Sands207

If you know he is talking about Galaxy Watch...

And maybe he is not from India or nor CSC INU...

Btw. seems Samsung stopped this hole since AWB1... GWB1 as it seems...

Then please how?

Best Regards
[Android General] Romeo Nickolas:
I hope someone will discover on how to edit LTE anchor band of 5G networks using this tweak.

So 5G signal can now use anywhere using any variant of samsung.
[Android General] GSM CHEN:
@oakieville cool
[Android General] Ronnie McNutt:
can it load prerooted system (dsu) with locked bl?
[Android General] mohitgalaxy3:
So I had S21 Ultra earlier with One UI 5.0 and command (adb shell pm install -r -d -f -g --full --install-reason 3 --enable-rollback /data/local/tmp/samsungTTSVULN2.apk) used to work.

I am trying on S22+ with One UI 5.1 and getting error with the same command INSTALL_FAILED_ADP_VERSION_LOCKED. Is it patched with 5.1 ?
[Android General] adfree:
INSTALL_FAILED_ADP_VERSION_LOCKED

According to what I read in Telegram group etc.

Seems yes. Fixed by Samsung...

I have no idea if something found to bypass this problem...

Best Regards
[Android General] Sands207:
I realize now that he was referring to a watch. I thought wireless adb may be an option but my over caffeinated brain was incorrect. My apologies
[Android General] XS-IV:
Thanks
[Android General] wr3cckl3ss1:
Does not work on 5.1.
[Android General] wr3cckl3ss1:
BL unlock is not possible.
[Android General] wr3cckl3ss1:
This app is not supported. Although it does carry the same methods in a way. It's still different. Refer to the telegram chat for more information and support.
[Android General] wr3cckl3ss1:
Want to thank everyone for the exposure here and many thanks to @K0mraid3 and @oakieville for the big roles they have played to bring this exploit to life. Also want to thank the original authors for the work they have put. I would tag them but I'm unsure of their names. With that said, they current exploit does not work on One UI 5.1. If you want to enjoy the exploit and what all you can uncover, you need to be on firmware for 5.0. If your firmware did not go up in BL (Rev), you can flash back to 5.0 to enjoy SystemShell.
[Android General] adfree:
I leaved again Telegram group... Meanwhile few times.

All new I can see... is you can now pay in Bitc ETH ...

Why?

Few days ago I found this Thread...

https://xdaforums.com/t/closed-bootloader-unlock-coming-soon-po.4413123/

For me it looks like "normal"...

...

my own opinion...

Best Regards
[Android General] wr3cckl3ss1:
I am unaware of this thread. I'll look into this. The exploit is free. The post made by @K0mraid3 is for those who would like to donate. No money will be asked of anyone.
[Android General] adfree:
But it is really strange... silence since weeks and then the famous idea to collect money...

So for me I can not refer anymore... look into T group... "better support"...

Again.

My personal opinion...

Thanx for this nice Exploit.

But this remember me also like S.msung acting:

Friss oder stirb... and "Coming soooooooooon"

Best Regards
[Android General] wr3cckl3ss1:
I cannot speak for @K0mraid3 but development is ongoing and work is being done everyday. We carry a different chat, that is not available to the public where we discuss various things past and present. I try to help in the chat, when time permits. With the various devices and various members asking for support, it can seem like we are silent but rest assured, someone is always watching the thread on XDA and on TG. We can only do our best, to fill the need of others. Thank you for your enduring support on the Watch frontline.
[Android General] omaralwardian:
Someone send me the TGRAM link. ☺️
[Android General] Oswald Boelcke:
Moderator Announcement

This is NOT a development thread and therefore I've sanitised it from all links to Telegram! Regarding social media links please observe that as an exemption from the last bullet of rule no. 5 of the XDA Forum Rules, we grant only developers the privilege to share references to their social media in their own development threads and if thorough support is provided in the thread. Additional information is also available here:

Telegram Chat Channels - Way Forward

WhatsApp/Telegram Groups and Channels - Going Forward Hello XDA family! Just notifying all members that posting certain links to Telegram and other sites like WhatsApp is now allowed on XDA. What does that mean? We will allow links to messages...

xdaforums.com

Please refrain for sharing of social media references unless within your own development threads! @wr3cckl3ss1 I've deleted a few of your posts and I'd appreciate if you comply with my guidance in future. Thanks to everybody for your future cooperation.

Regards

Oswald Boelcke

Senior Moderator

CC: @V0latyle
[Android General] K0mraid3:
theres a great many ways to change CSC, i believe samfw has a tool for it now

THIS is interesting!

Did you ever get it to work on your watch?

OH, so you did get it working? or? im a bit confused?
[Android General] wr3cckl3ss1:
Should be successful....as even the latest firmware produces a system shell
[Android General] BLuFeNiX:
I've been quietly watching this for a while and I agree. I also find it unsettling that admins have removed the post discussing this issue.
[Android General] V0latyle:
Last warning: If you can't keep your bickering to PM and can't treat each other with respect, this thread will be locked. We don't want to do that, as with keeping in the "hacker" spirit of XDA, threads like this are the bread and butter of what we do.

That's why we've been removing posts.

It's not that the questions shouldn't be asked, it's that they shouldn't be asked here. I'm going to start a PM thread involving a few of you so that we can get this straightened out.

Now, more to the point: If you've used anyone else's source as a basis for your work, you MUST give them credit:

While this might not be considered development under our criteria, Rule 13 still applies as well:

So. Knock it off with the squabbling. Keep this thread on topic. If you have issues with sources or credits or whatever, bring it up to us. If your comment doesn't have directly to do with facilitating this exploit or reporting your progress in your own efforts, keep it out of this thread.
[Android General] parkerlreed:
Note 10 Plus

SP1A.210812.016.N975U1UES7HVJ3

SM-N975U1

Installed the GitHub apk and ran the script.

First TTS downgrade works but never get a shell

(1)(deck@fp-arch assets)$ ./exploit.sh
* daemon not running; starting now at tcp:5037
* daemon started successfully
Performing Streamed Install
Success
Starting service: Intent { cmp=com.samsung.SMT/.SamsungTTSService }

EDIT: This is using zt's fork. Didn't realize this was a separate codebase.
[Android General] Kgstate:
I downgraded and opened the activity from adb but app opened normally and nothing happened.
[Android General] Kgstate:
K0mraids system shell v1.5 was working for me can someone post the old 1.5 version?
[Android General] V0latyle:
@K0mraid3 Please check your PMs and respond to the conversation you're a part of.

Thanks.
[Android General] adfree:
@Kgstate​

You mean this?

Komraid3s_POC_V1.6.apk

komraids_POC_V1.5.apk

Best Regards
[Android General] Kgstate:
No thanks, i fixed it by opening lang.poc then guidownloadlist
[Android General] Ronnie McNutt:
Wont work on OneUI 5.1
[Android General] flanker017:
Hi:

I'm the original author of the SMT research (https://github.com/flankerhqd/vendor-android-cves/tree/master/SMT-CVE-2019-16253) and I have been notified about this thread. My original purpose to share my research is to help the community to better utilize and protect their devices, and to help the vendors to improve device security, and to help other researchers for technical insights. I'm always glad to see this research is given a new life, and helped someone else, and further development are welcome - but it should be legal, non-profit, with proper attribution, and in good faith. Sorry to hear about that the original research has not been properly given credit.

To prove it's indeed me - same announcement as above can be found on the Github repo's README file.

Thanks!
[Android General] adfree:
@flanker017

Can you please add your Github repo... you mentioned?

So it is easier for me to look at your work... instead Google or other search.

Thanx in advance.

Best Regards

Edit 1.

If I use this Link:

Text-To-Speech speaks pwned

Text-To-Speech engine is a default enabled module in all Android phones, and exists up to Android 1.5 HTC era, even acting as a selling point at that time. But various vendor implementations may le…

blog.flanker017.me

And look for Github... then I can find this:

GitHub - flankerhqd/vendor-android-cves: Collections of my POCs for android vendor CVEs

Collections of my POCs for android vendor CVEs. Contribute to flankerhqd/vendor-android-cves development by creating an account on GitHub.

github.com
[Android General] flanker017:
Yes, that's correct. I've update the original post.
[Android General] V0latyle:
***MODERATOR ANNOUNCEMENT: THREAD CLOSED***

@K0mraid3 you are hereby required to provide proper credit in your OP as follows:

Link the assigned CVE for this exploit as it mentions the author's blog and GitHub, OR

Link the original research repo as provided by @flanker017

Further, while you may provide a means for donation, this project must remain free without condition of payment.

Lastly, as you've been previously warned, you may not promote your Telegram channel on XDA. You may have ONE link to your TG channel in the OP.

You must meet these conditions to continue to use XDA to share this project.

As you have ignored my PM and previous warning, this thread is now CLOSED to further discussion. All download links relating to this project have been removed.

This thread will remain closed until such time that @K0mraid3 is willing to comply with the above conditions.
[Android General] V0latyle:
Additional note: If someone wants to continue this work and is willing to provide credit where credit is due, see this post and contact the moderator staff.
[Android General] wr3cckl3ss1:
It is what it is....no hard feelings. But it will be funny and interesting watching those players....try to claim success as anything Samsung that's US based hasn't been cracked in years and for them to now come out the woodworks will be funny.
[Android General] K0mraid3:
Try this:

FIRST: Go to your WIFI settings, go to your current network, tap advanced, change the networks IP Mode from DHCP to STATIC

THEN: Still in wifi advanced settings, below where you changed "DHCP -> STATIC" find your devices IP (should be somethings like 192.168.x.xxx) -> change this to "192.168.2.225", save and reboot device.

Then try "systemshell.exe"
[Android General] Mastercodeon:
Indeed, we're about to see a lot of wild claims pop from this I'd image. If it is possible, it's going to take some work. Cause knox will probably be a obstacle to overcome before true root and bl unlock are achieved.
[Android General] wr3cckl3ss1:
Funny you mentioned this...as this was something talked about recently
[Android General] ace2nutzer:
Not working on Galaxy S8 ??

dreamlte:/ $ su system
/system/bin/sh: su: not found

But seems to work on Galaxy Ace 2 (ancient phone)

shell@codina:/ $ su system
system@codina:/ $
[Android General] K0mraid3:
Do not use "su" on this, first, check the id command in the shell for the s8, it should tell you, you are already system. This works by hijacking into system and giving you a shell thats already system
[Android General] K0mraid3:
Knox, FIVE, FIPS, to name a few.. yeah, we have a few obstacles to figure out, no doubt.
[Android General] Abish:
Funny thing I should ask what was 9997 for ?

On my device could be PC or Tab itself shell runs and crashes even intent runs but no rollback or downgrade for SMT but it can be done manually.

I reset my device usb debugging was disabled so used wireless debugging to still same but now I'll try OP instructions.

BTW thanks everyone
[Android General] K0mraid3:
what do you mean 9997? You should be netcat'ing into port 9999
[Android General] ace2nutzer:
OK flashed now the stock kernel and still the same issue:

dreamlte:/ $ id root
uid=0(root) gid=0(root) groups=0(root), context=u:r:shell:s0
dreamlte:/ $
dreamlte:/ $ id system
uid=1000(system) gid=1000(system) groups=1000(system), context=u:r:shell:s0
dreamlte:/ $
dreamlte:/ $ su system
/system/bin/sh: su: not found
127|dreamlte:/ $
127|dreamlte:/ $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0
dreamlte:/ $

What should I do to get system uid without the need to flash magisk?
[Android General] Romeo Nickolas:
Tried it using meth 1 and 2 but cmd shoes blank on both.

Restart, disable/enabled usb debugging but still nothing shows.

And before I do this I checked my adb information on samfw tool and it shows SHELL SU : YES and after doing this the SHELL SU turns to NO.
[Android General] Mastercodeon:
Tried the systemshell.exe method, and the cmd window comes up and its just blank. It pops the device onto a page for installing the TTS voices, anything im missing? Made sure to do Step 3 with the wifi, before my attempt as well
[Android General] K0mraid3:
Can you double check what version of Samsung Text-to-speech is on your device?

Also, try to manually get into the shell, from a normal adb shell, do nc -lp 9999 and execute it, then,

open a second ADB shell, call Samsung Text-to-speech with am start -n com.samsung.SMT/.gui.DownloadList It SHOULD pop up a mostly blank screen for that download page you saw. just swipe up to task changer, leave that activity active in the background and go back home. Look back at first shell you did "nc -lp 9999" in. Did it change to ":/$" ? if so, try to run "id" command
[Android General] wr3cckl3ss1:
Can you DM me and we can take it thru TG or any other chat outlet? Not that I'm trying to hide any info from the public but easier to chat on TG or Discord and get instant answers.
[Android General] Mastercodeon:
Its version 3.0.02.2

So could i try getting into th e shell manually after ive ran the system shell while the cmd window is blank?
[Android General] wr3cckl3ss1:
Hold for new .zip
[Android General] irshansk:
Have an issue doing method 2, same blank cmd as for user Romeo Nickolas. Trying to do something about this.

My device is U1 variant from factory. It has XAR in the list of CSC in samfw firmware and I did try to set everything to XAR back then
[Android General] K0mraid3:
yes, i edited my above comment to guide you through doing it manually.
[Android General] Mastercodeon:
Alrighty
[Android General] K0mraid3:
Also, is the device screen on and device unlocked?
[Android General] K0mraid3:
Ok, for now, try using the Manual method. We will fix the easy method over this evening.
[Android General] Mastercodeon:
Trying to get the shell manually, but still hangs when i put that into an adb shell.

And yes my screen on and device unlocked
[Android General] Mastercodeon:
Awesome
[Android General] Mastercodeon:
is this a success? I followed the whoe process the manual way instead of using the easy exe, and now ive go this
[Android General] wr3cckl3ss1:
Welcome to SystemShell
[Android General] wr3cckl3ss1:
Type

id......1000

whoami....aystem
[Android General] Mastercodeon:
I actually did this...

Im guessing 0 is good?? I'm not the best with adb shells, so dont really understand how to check the UID
[Android General] wr3cckl3ss1:
Just type

"id"

No quotation marks
[Android General] K0mraid3:
1/18/2023 9:14PM CST -- Uploaded Alternative POC APK and systemshell.exe, please give things another run, Thank you for your patience as we refine the "Easy Method"
[Android General] Mastercodeon:
Lol yall beat me to it, i figured the previous easy systemshell just needed to spawn both the last 2 shell on separate thread, and i see that's exactly what the new version is. Was about to go do the same with the first version lol

I noticed one of the lang.poc commands in there brings up the lang.poc window.

Like this one:

shell am force-stop com.samsung.SMT.lang.poc

Whats these for?
[Android General] irshansk:
I did try manual and did try the updated method - I'm just getting the blank cmd and that's it. If I open adb shell in a different window - id command returns 2000

UPD: in case of manual attempt - the shell with nc -lp 9999 just stays there with no changes after starting activity on a second adb shell window. Forcing Id command returns 2000
[Android General] Mastercodeon:
I was able to get past this for me by forcing the device to use the wifi connection, even tho there isnt any internet because of the IP settings. I turned my mobile data off, then reconnected to my wifi.
[Android General] Romeo Nickolas:
manual works now I should need to turn on wireless debugging after restart coz it turns off autmatically. Thank you!

May I ask something coz I'm getting SHELL SU : YES on SAMFW TOOL before doing this.

Does it mean I am rooted or it just a bug?
[Android General] irshansk:
Mine works with the settings because the phone gets both modified ip (.225) on ipv4 and normal ipv6 address - therefore internet through wifi partially works on device with static ip for me. Also I did disable mobile network beforehand too. Still stuck with either method 1 and 2.
[Android General] K0mraid3:
Your IN!
[Android General] K0mraid3:
You may be seeing how the process goes about killing the shell in the event it needs too.
[Android General] Romeo Nickolas:
use method 1

after setting the ip address reboot after reboot turn on wireless debugging coz it will disabled after restart then do last step.
[Android General] K0mraid3:
I will see about making this run on "localhost" so we wont have these issues down the road.
[Android General] irshansk:
I did try method 1 too - it leads to the same result - the shell does not change after starting activity in another window. Also I'm aware about reboot causing wifi debugging to be toggled off. I did try to adb over wifi just to check if my laptop connects to phone without cable - it just timeouts.
[Android General] K0mraid3:
it may be seeing the system shell, and thinking you are rooted, but i cant say for sure, im curious to how this affects devices running "system-as-root"
[Android General] irshansk:
Yeah, it seems like wifi-debugging is the issue. I just can't successfully adb connect to the phone, it always timeouts.