yashsingh1/xdaforums huggingface dataset:
[Android General] CDotNightHawk:
View attachment 5990605I feel stupid, waisted my time when this was already patch
[Android General] CDotNightHawk:
View attachment 5990735I just don't know
[Android General] CDotNightHawk:
View attachment 5991289

Yay, thank you!!
[Android General] CDotNightHawk:
I told to keep things on the low, but I sure hated Knox
[Android General] Sysop_PNW:
Glad one worked 👍🏼 I'll have to try later. No doubt
[Android General] CDotNightHawk:
Is there a way to downgrade with system, I tried going though galaxy store, best I got was a popup with update on it. I would like to downgrade SMT still, sense it supports reverse shell and such.
[Android General] Frax3r:
I had the same thought so i tried to replace smt's base.apk in its own /data/app folder with the vulnerable one but this shell is less capable so it doesnt work

mv -f /sdcard/Download/com.samsung.SMT_v3.0.02.2.apk /data/app/~~jkb4LArnENe7zvxQ9gBAVQ==/com.samsung.SMT-lblZfgxKshzN9be8UCrQbQ==/base.apk

I also tried

pm install -d -i com.sec.android.preloadinstaller /sdcard/Download/com.samsung.SMT_v3.0.02.2.apk

from this new system shell

Both failed... if anyone has any clever ideas please feel free to share
[Android General] CDotNightHawk:
You know how to reverse shell for FTL btw?
[Android General] bitten2up:
i take it i need to rebloat to do it? or was it about the debugging command cve
[Android General] CDotNightHawk:
You don't need to go complex. Apps by samsung can request Knox License, and that gives the app a lot of power. Maybe see about what apps can take advanage of Knox.
[Android General] CDotNightHawk:
I just had a thought, how can I use sh with system. Would I be able to open /storage/emulated/0/Android/data/moe.shizuku.privileged.api/start.sh with system ID
[Android General] Aú4elio:
We can but..

We need a modified start.sh and /path 😉

But i managed to use this exploit to run some root app or adb

View attachment 5992221
[Android General] Aú4elio:
Check it i msg you
[Android General] Frax3r:
I'd like to know as well if you don't mind, i tried few usual stuff but to no avail. Is it related to shizuku?
[Android General] Aú4elio:
Oops
[Android General] Aú4elio:
Im just gonna private msg you
[Android General] anthonykb:
So you installed app manager from fdroid in place of FTL instead...
[Android General] dvx2550:
I would like to thank @Aú4elio , he helped me a lot.

thanx @Aú4elio

thanx @wr3cckl3ss1

thanx @BLuFeNiX
[Android General] meraz9000:
I dmed you
[Android General] mfarazshakir:
can you please share how you did it or IM pls ?
[Android General] Aú4elio:
Here:

Edit: use the shell script instead
[Android General] Aú4elio:
FOR SYSTEM3 only

Use Netcat/Reverse Shell

Shell Scipt
[Android General] anthonykb:
View attachment 6001239
[Android General] CDotNightHawk:
Sorry I been gone, but I am looking around at times to see how things are.
[Android General] Aú4elio:
Edited: Unproven
[Android General] Aú4elio:
RIP PERSONAL FILES :(
[Android General] Aú4elio:
The context is

uid=0(root) gid=0(root) groups=0(root) ..... context=u:r: kernel : s0
[Android General] CDotNightHawk:
I am just now getting back to respond. Amazing to see you got root, hopefully Knox didn't triggered. I wonder if your phone reset not by Samsungs design, but I am sorry for the lost of files. I wonder if you can find something in modified firmware of what caused the factory reset, and try to disable it within the time frame.
[Android General] CDotNightHawk:
or maybe make a user if possible with elevated perms, and then reboot in shell before it gets the chance
[Android General] CDotNightHawk:
I am tried of ftl crashing, is there a way to keep it from crashing during reverse shell, like phantom processes do anything?
[Android General] anthonykb:
View attachment 6003327
[Android General] anthonykb:
There's a carrier partition I created a build.prop and default.prop and they stick on reboot. Can you configure props like a /product partition?
[Android General] anthonykb:
This is on ATT/AIRVOICE/AIRTALK Galaxy S8+ snapdragon with last official XAA firmware release
[Android General] anthonykb:
View attachment 6003335
[Android General] anthonykb:
View attachment 6003337

Oh so it does stick but is missing something? ro.oem_unlock_supported <<
[Android General] Aú4elio:
Yes

That sucks

All my shell script for adding feautures to system shell is gone.

300 mb shell script btw

Luckyly knox is not angry
[Android General] CDotNightHawk:
300 mb.. at least you learned Knox doesn't get mad
[Android General] Aú4elio:
Maybe try

View attachment 6005761

( all information about build.prop and context )
[Android General] Aú4elio:
Can somebody use system3 and "cd /dev"

All drivers.

This is the only one I went last time
[Android General] Aú4elio:
Eh.. not working for me. But theres another method which is opening the component of android system.

View attachment 6005765

Edit : try this if the build.prop not sticking on reboot
[Android General] sidihidi:
maybe you can try recover with a recovery files program or something, if you get a real root for one minute i think is alot time to put files in root system or try allow unlock bootloader in qualcomm devices or get root without tip knox and you remeber what command execute?
[Android General] CDotNightHawk:
One of the methods seems to be down, but still many other ways. I am focusing on another project in the meantime, so sorry for lack of responses.
[Android General] KGRemover+:
Can u help me how to get this on July August and April patch?
[Android General] KGRemover+:
Can u help me how to get this
[Android General] universelight:
Many thanks to @Aú4elio for the prompt help!
[Android General] universelight:
Hi,

Once you get to system3, is it possible to give permanent system privilege to any more convinient shell or sshd?

FTL is regularly crashing especially with reverse shell and there's "Non-responding message" every few seconds.

Anybody succeeded downgrading SMT on UI 5.1?
[Android General] universelight:
What paths system3 has access?

Sorry I'm not good with permissions.

"ls /" doesn't show anything.
[Android General] Aú4elio:
/data /efs /carrier /data/system and many more...
[Android General] universelight:
Anybody knows how to give permanent system privilege to any more convinient shell or sshd?

What permission we need to be able to remount /system as RW?

Doesn't seem to be very easy.
[Android General] Sarcasm1806:
I installed ftl but I couldn't find a way to start activity shell.

Can someone help me?

One UI 5.1.1 August patch.
[Android General] en11gma:
I have sm-g981u1 on v1 bootloader XAA firmware. i can run android 11 with one ui 3.1 or go all the way back to original ship firmware with android 10 and one ui 2.1

i do the guide and have no problems but my whoami and id -u always report im shell or 2000

what am i doing wrong?

i dont have the power saving features / modes.

x1q:/ $ dumpsys package com.samsung.SMT | grep versionName

versionName=3.0.02.2

versionName=3.1.02.4

how do i know which version of the app is opening since there are two versions when i send the command 'adb shell am start -n com.samsung.SMT/.gui.DownloadList' in terminal 3?
[Android General] wr3cckl3ss1:
Do you have a screenshot showing this?
[Android General] en11gma:
Here is a picture of all the firmwares i can install. which i bounce around all the time

I also added a picture of my 3 terminals and the commands i did.
[Android General] wr3cckl3ss1:
Screenhot showing your uid is 2000.

Also...do you have FTL installed?
[Android General] en11gma:
added the pics to post above yours and what is FTL?

when i run the helper app "lang.poc" it just opens up and shows "lang.poc" on a black screen.

ohh i think i been running the old app.

trying something new now.
[Android General] wr3cckl3ss1:
Sorry about that. I got mixed up with exploits. Forgot ppl still use the old way for things. I suggest stopping use on SMT for now and look around to other newer things. #system3
[Android General] en11gma:
no i like this one. i was following a cheat sheet of commands i made from the orignal guide thinking this was the same one.

i think the only thing i need is the reverse command instead of this command '

adb shell am start -n com.samsung.SMT/.gui.DownloadList'

what do i change it to for reverse shell.

im probably going to have it hooked up to my pc most of the time through usb adb.

i have a cracked screen on my S20 and the top 33% of screen dont work with touch.
[Android General] en11gma:
with the phone connected to computer over usb with usb debugging enabled.

SMT Shell v2.01 is installed

i then give the command from computer 'adb install -d com.samsung.SMT_v3.0.02.2.apk'.

that goes fine.

i then open the SMT Shell app on phone by touching the icon.

i hit exploit

i click on "Launch System Shell" and it opens.

i do "id" and it says im 1000

i do:

'cd efs' and it changes to that directory.

'ls' = permission denied.

i have no "shizuku" installed.

shouldnt it list the folders and files?
[Android General] en11gma:
i keep getting:

PS C:\adb> adb shell nc -l -p 9999

/system/bin/sh: can't find tty fd: No such device or address

/system/bin/sh: warning: won't have full job control

:/ $

PS C:\adb>

NM

its working :)

nc -l -p = system :)

good job guys!!!

wow this is cool

why cant i write in /system if i am "system" though?

can i oem unlock as i really want custom roms and root access.
[Android General] Kiwi_in_oz:
Hey All...Well this might be a long shot but I am trying to run "am broadcast -a com.samsung.android.action.SECRET_CODE -d android_secret_code://27663368378 -n com.sec.android.RilServiceModeApp/.SecKeyStringBroadcastReceiver" on non-rooted Galaxy Flip 5 running One Ui 5.1.1 ver. on Android 13. I get the following error in ADB:

View attachment 6040404

Is there a way to run this broadcast command without having root?
[Android General] en11gma:
anyway to stop forced update to android 14 on s21 ultra sm-g998u when you are not rooted and dont want to factory reset?

i figure i would ask because its a little more than 24hrs away.

i know i made a similar post in another thread but its getting close and i dont want to break the FTL thing which kind of works already.
[Android General] Sysop_PNW:
To disable packages (USE THESE):

pm disable-user --user 0 com.sec.android.soagent

pm disable-user --user 0 com.wssyncmldm
[Android General] en11gma:
that works even after a restart? the android 14 update i think is already downloaded to phone and in developer options i have checked off install updates on restart i think its called.

does wifi matter?

i need to do this to two s21 ultras (both sm-g998u) on android 13 and both have the android 14 already downloaded i believe
[Android General] Sysop_PNW:
Yes just use that for now, there's other methods also but this one works to disable updates.

You can run those commands from adb shell.. or direct from FTL
[Android General] en11gma:
please check post above your reply. i added more info
[Android General] Sysop_PNW:
I seen it, run the commands it works!
[Android General] Sysop_PNW:
After that you can

pm clear com.wssyncmldm
[Android General] en11gma:
man thanks alot!

damn. went to get her phone to do the same thing and she already updated!

grrrrr

thanks again. thought i was going to have to factory reset and keep it off wifi at the minimum.

you should make a sticky called "how to disable forced firmware updates" or something.
[Android General] Sysop_PNW:
You bet!

Ahh well that's probably a pretty common occurrence 😂

That would have worked but.. would have downloaded again. This way it will stay disabled until you want to enable it again an update.

I've seen something similar on here before. Maybe later I'll do that!
[Android General] Gardnadzent200:
HOW DO I Downgrade samsung SMT
[Android General] bessel.func:
Hi Gardnadaent200, Use com.samsung.SMT_v3.0.02.2.apk. I down loaded the app from https://xdaforums.com/attachments/com-samsung-smt_v3-0-02-2-apk.5854895/. Look at page 1 of this forum and scroll down to the link. Merry Xmas Bessel..
[Android General] The_BaldGuy:
Hi, i'm just sharing this script to install "FactoryTestLauncher" aka FTL...

Note : pls.. create "Exploit" folder to /sdcard :)

Hope this help. Happy New Year 😉

Edit : i use shizuku shell terminal
[Android General] bessel.func:
My testing results:

Please note their maybe operator error involved :)

Using adb uid=2000 only, cannot execute in id 1000 shell due to unknown directory for execution of sh

xcoverpro:/ $ pm uninstall --user 0 com.samsung.android.FactoryTestLauncher

Failure [not installed for 0]

xcoverpro:/data/local/tmp $ pm install -i com.sec.android.preloadinstaller ftl.apk

Failure [-3001: INSTALL_FAILED_REJECTED_BY_BUILDTYPE]

Happy New Year to you too...
[Android General] The_BaldGuy:
View attachment 6049152View attachment 6049153
[Android General] bessel.func:
Hello The_BaldGuy,

Works as you said, execution of test using the sh command is the key.

thanks

Bessel
[Android General] ryjun:
Hi,all

I successfully installed ftl launcher

I can't install Samsung SMT. I get an error that I can't downgrade the app

Can anyone help me install Samsung SMT? ThanksView attachment 6051808
[Android General] bioslax:
How to install android 14
[Android General] h2olove:
Galaxy Diagnostics Setup
[Android General] bioslax:
Not working
[Android General] mind _spacer:
Hey,

Can we able to take a full backup of the android device using this system shell? Anybody?
[Android General] UDG87:
Good evening everyone, I apologize if my question is in the wrong section. I have a Samsung S20 5G rooted to the latest stock fw and security patch as of December 1, 2023. I would like to have the possibility via Samsung Band Selection to disable and or enable VoLTE as needed. I have already tried using the "more network setting" function but every time I restart the function reactivates itself. So I wanted to try to use shell v2 to downgrade the Samsung SMT and be able to use the Samsung toolkit, but it gives me a downgrade error. How can I solve it?. Thank you all
[Android General] bessel.func:
Hello Mind_spacer,

I am going out on a limb here and say no. System shell has some unique features but we need to get to the root of the problem. :)

Waiting for some smart person in the Ether to obtain the holy grail but so far no cigar. I keep watching and waiting for an event that may never happen. Bessel... PS. I should bound my statement... Verizon, Att locked bootloaders...
[Android General] wr3cckl3ss1:
Guess it's been awhile since I came to these parts....

As many of you know... about my project.

This thread is for the SMT Shell exploit....not #system3.

I kindly ask that you respect the post and it's author. As per XDA rule,

This thread is for his project and anything related to it. And with that said. I will not open up a separate thread for this on XDA but I'll think about opening up a chat on a different platform. As it was already mentioned by @V0latyle that only one thread about a system shell can be made and as per XDA rule.

I will follow all protocol here and respect XDA's wishes.

Futhermore If it's possible and with permission with the moderators here. If and when I do make this chat, would it be possible to link an outside link pointing to it, in case someone comes along to find support. If it's not allowed on this thread. I do HAVE one option, which i think will be better suited for the mods here. Since it will not go against what the moderators have here and that's by again using XDA rule,

I would have posted the ONE link to TG rule but as of this writing. But I have failed to find where it's located. Unless something was changed as of recently and I'm not aware of it. But I will take a look at the FORUM RULES and read thru again, as it was edited on Jan 31st 2023 @4:12pm which was roughly 5 hours ago.

If this rule still stands and is allowed. I believe my ONE link to TG hasn't been used. And I do have one thread that is open as of today. And unless I'm mistaken and from my recollection, the one link to TG doesn't have a specific location of where it needs to be. I could be wrong but would need more clarification on this once I find a direct reference about the TG rule. And given that in my ONE thread that is open, I have posted screenshots of #system3 and were not flagged for breaking XDA rule,

Then it would only be a matter of going in my thread and updating one the posts to include a link pointing to the chat....

Above all it's about respecting the rules set in place. We might not agree with them but rules are rules. And I'm ALL for them. So I ask that those here speaking on my project to either wait PENDING MY APPROVAL to possibly open something somewhere else and also of the moderators and ask that the integrity of this thread be kept and respected. Thank you for your time and I hope to see some of you guys very very soon.

@V0latyle

@Oswald Boelcke

@Badger50
[Android General] wr3cckl3ss1:
You're way too late in the game, if your using things like the now defunct *Samsung Toolkit* , which came to an end even way before the One UI 5.1 patch back in FEB 2023. And given that you did provide details of your device bearing a Dec 1, 2023 security patch. You also fall short on anymore system shells including what I may have and that has semi support up until Nov 2023, pursuit that you can downgrade your software. But I'll take a swing here and say...you probably updated your BL at least ONE TIME and that right there eliminates you completely from ever seeing a system shell. I won't say Band Selection because there's things that could be done.

*DONT ASK EITHER*

Use this opportunity to search for yourself and learn things.
[Android General] UDG87:
Thank you all the same.
[Android General] universelight:
Hi, whats "assistant" property doing in the line below?

settings put secure assistant "com.samsung.android.FactoryTestLauncher/.addons.Shell.ShellActivity"
[Android General] peedsllaBoG:
I'm slowly making my way there. I can "su -c" which does nothing or course but still feels good to do it. Doing a lot of reading to try to install the binary somehow. There HAS to be a way. Thinking mixplorer might help along with system shell, adb and termux.

View attachment 6070924View attachment 6070923Ciao
[Android General] Aú4elio:
Long time...
[Android General] peedsllaBoG:
Well this makes me all sorts of interested! Root privileges in app manager?
[Android General] Aú4elio:
System only, that script is updated now
[Android General] peedsllaBoG:
That's not really making sense to me. The Readme is hard to understand and when I go to running services there's nothing there that's says priv:0. Plus it kicks me out of adb and doesn't go to root. I haven't used the script because none of this is functional at the moment, for me anyways

EDIT~ Tried running the script t after doing everything I could and I got denied. Now what?

EDIT 2~ Well this has accomplished absolutely nothing other than not doing what it's supposed to, no apps show up in the menu, no services for anything appear and after adb finally connects a nice black screen and a ton of crashes. Thanks for saying nothing at all. Good luck to the rest of you
[Android General] matkali:
for who doesn't have nc (netcat) in PATH, must use toybox (toolkit like busybox)

toybox nc -l -p 9999
[Android General] universelight:
Is there a shell command or code to output the list of supported bands?

S21 FE.

Have SYSTEM, no ROOT.
[Android General] ryjun:
I'm using it
[Android General] universelight:
Thank you for your response.

FTL is currently crashing on most options in the list for me. Probably I messed up smth on the phone.

There is about a hundred commands in IOTHiddenMenu - com.sec.hiddenmenu.txt, some might change settings I'm not even aware of.

Which command should I use to list supported frequencies?

Do you believe Galaxy Diagnostics can show list supported frequencies?
[Android General] ryjun:
Your phone is Exynos ? Qualcomm?
[Android General] universelight:
snapdragon 888. G990U2.

Checked every options in your factory_ftl_default.xml - there doesn't seem to be anything relevant to bands. FTL is crashing on half of them though.

Can run SYSTEM3 of course.

Its pretty cool anyway, so many functions!
[Android General] ryjun:
I forget my phone is N9750 .Have you checked the apps to see if there is an IOTHidden menu app?

Try code with shell ? Or dum packages view command
[Android General] universelight:
Not sure which app you mean? Haven't seen IOTHidden menu in any of FTL options.

Will do the rest of your post a bit later. Thank you for your help.
[Android General] Adhamalghooly:
Do u have newer Verizon of it can u share it with me
[Android General] universelight:
Anybody has GalaxyDiagnostics that works with S21 FE (G990U2)?

I tried 2.5.0.6 - give the error below during installation (doesn't install):

Performing Streamed Install

adb: failed to install GalaxyDiagnostics.2.5.0.6.apk: Failure [-3000: INSTALL_FA

ILED_REJECTED_BY_DATE]

Also tried 2.0.5.5 - this installs, but cannot click any button on the screen.

Is there's more appropriate thread, please let me know. Search didn't find any.
[Android General] h2olove:
open galaxy diagnostics.

Swipe the status bar to select settings.

press home. Open the FTL app and select the FUCN tab
[Android General] h2olove:
Using shellView attachment 6101121View attachment 6101122
[Android General] universelight:
This I can open in shell, but there's no band list or specific band choice anywhere in this menu. The only relevant is "LTE mode menu", but as far as I remember its for smth like global region choice.
[Android General] universelight:
Highly appreciate the video and watched it and tried what you described. I just don't understand whats the relevance of galaxy diagnostics to FTL?

One can open the FTL app and select the FUCN tab without galaxy diagnostics app, right?

Does galaxy diagnostics add any new options to FUNC tab?
[Android General] ryjun:
maybe

Find activity =) using Quick editor add to factory_ftl_default.xml
[Android General] ryjun:
Download IOTHiddenMenu APKs for Android - APKMirror

Download IOTHiddenMenu APKs for Android - APKMirror Free and safe Android APK downloads

www.apkmirror.com

If your phone doesn't have this app.

Choose the version that integrates with Android on your phone.

Download it and install it on your phone.

The installation method is the same as FTL
[Android General] JuãonZin:
How to download FTL on Android 14?
[Android General] babaric-dev:
This is patched in Android 14 (One UI 6.1). Am I right?
[Android General] pascua28:
Yes
[Android General] wr3cckl3ss1:
With this, you don't need the Toolkit anymore all you would need is the commands to open the same activities that Toolkit carries. Sooner or later i can share some of those commands but for now here's two.

am start -n com.samsung.android.app.telephonyui/.hiddennetworksetting.MainActivity

am start -n com.sec.hiddenmenu/.ServiceModeApp -e 7267864872 72678647376477466
[Android General] dubblecup:
Bro honestly I don't know how to use this. Is there a thread on how to use? Not needing to use the toolkit is awesome. Just need to figure out how to use these commands etc.
[Android General] wr3cckl3ss1:
Oh I see. Do you know how to get a regular shell using Termux and Shizuku only? See pic attached.
[Android General] dubblecup:
Thats an app in the playstore? If it is i can dload and figure it out with your help of course. I saw a video on the tube just now where some apps actually have the option of using shizuku.
[Android General] dubblecup:
Like SAI and System Tuner.
[Android General] wr3cckl3ss1:
Termux user to be in the playstore but now it's not. Search it up on Google and you'll find the apk for it.
[Android General] dubblecup:
Ok doing that now
[Android General] dubblecup:
Installed.
[Android General] ketopili81:
Hi , thank you for your work, reply and help me.

I'll do what you suggested.

Regards
[Android General] ketopili81:
Hi, thank you for reply.

I have the device since the beggining of 2021.

Current stock version of SMT is : 3.1.01.19

Regards
[Android General] BLuFeNiX:
I just took a look at this. Samsung Toolkit packages its own version of the exploit, and the developer of Samsung Toolkit would have to change some things to be compatible with SMT Shell.