yashsingh1/xdaforums huggingface dataset:
[Android General] BLuFeNiX:
If we can collect a list of these commands, I might add a custom command execution feature, so you can all share them with each other (and that way I don't have to keep adding them to the app). Something like a text file you can import. I'm not sure exactly how that will work yet.
[Android General] wr3cckl3ss1:
Of course. I'll compile a list for you.
[Android General] dubblecup:
Wow leaps and bounds.
[Android General] dubblecup:
You guys are making it happen. Thanks in advance.
[Android General] wr3cckl3ss1:
Did you ever get yourself squared away with getting a shell in Termux and Shizuku?
[Android General] dubblecup:
No. Still don't know what to do. But I hues uiu were busy. I understand.
[Android General] dubblecup:
I have termux installed
[Android General] wr3cckl3ss1:
Message me.
[Android General] wr3cckl3ss1:
*COMMANDS FOR SYSTEM AND/OR ROOT USE ONLY*

**WARNING**

Do your research and find out what something does before you aimlessly execute the commands and mess something up. This is your only warning.

IOTHiddenMenu.apk

am start -n com.sec.hiddenmenu/.KOREA_Mode -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.KoreaMode_Prevail -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.SerialPort -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.ItsOnMenu -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.ServiceModeApp -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.Test -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.PhoneUtil -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.OTATest -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.LTE -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.FIELDTESTMODE -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.HiddenMenuEnable -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.GlobalHiddenMenuEnable -e 7267864872 72678647376477466

Change your CSC thru Preconfiguration. (Exclusive to primarily US devices)

am start -n com.samsung.android.cidmanager/.modules.preconfig.PreconfigActivity -a com.samsung.android.action.SECRET_CODE -d secret_code://27262826 --ei type 2

Option #2 for Possible CSC change on devices not from US.

am start -n com.samsung.android.cidmanager/.preconfig.PreconfigActivity -a android.provider.Telephony.SECRET_CODE -d secret_code://272837883 --ei type 3

Service Menu

am broadcast -a com.samsung.android.action.SECRET_CODE -d android_secret_code://27663368378 -n com.sec.android.RilServiceModeApp/.SecKeyStringBroadcastReceiver

Hidden Network Band Selection

am start -n com.samsung.android.app.telephonyui/.hiddennetworksetting.MainActivity

Use with CAUTION***

am start -n com.wssyncmldm/com.idm.fotaagent.enabler.ui.admin.feature.AdminFeatureAndActionActivity

am start -n com.wssyncmldm/com.samsung.android.fotaagent.common.feature.FeatureInjectionActivity

am start -n com.sec.android.app.factorykeystring/com.sec.android.app.shutdown.ShutdownPreference

am start -n com.samsung.android.sdm.config/.ui.DevConfigActivity

am start -n com.sec.android.sdhms/.debugger.ui.ThermalLimitSettingActivity

am start -n com.sec.usbsettings/.USBSettings

am start -n com.android.settings/.development.DSULoader

am start -n com.sec.android.app.servicemodeapp/com.sec.android.app.modemui.activities.PhoneUtil

am start -n com.sec.android.app.myfiles/.external.ui.developer.DeveloperSettingActivity

am start -n com.sec.android.app.factorykeystring/com.sec.android.app.phoneutil.UsbLogging

am start -n com.samsung.sdm/com.samsung.sdm.logic.DMApp

Have fun...

--wr3cckl3ss1
[Android General] BLuFeNiX:
Version 2.0 released! See OP for details.
[Android General] ser8210:
Hi.

Amazing work.

Galaxy note 10+ exynos (SM-N975F) in less than 30 seconds.

View attachment 5872299 View attachment 5872301 View attachment 5872303

Salu2
[Android General] wr3cckl3ss1:
Watch 4...S22 Ultra....S23 Ultra. Need i say more.

Good work @BLuFeNiX

Keep it coming bro.
[Android General] BLuFeNiX:
Thanks for testing it! Glad to see it's working for you.

Thanks! Also, I fixed the keyboard issue you were having.
[Android General] danicadanicadanica:
So clearly it could run like rooted but how to grant it ?
[Android General] danicadanicadanica:
Ok i understood now i could use -rm to debloat
[Android General] Dante63:
Hello,

I hope you're fine,

I'd love to assist in making layouts for the WearOS watches, that way the tool would be easy to use on samsung watches...

Do let me know if it's ok to do so...
[Android General] milojoseph:
So out of curiosity can I access Ims settings via https://xdaforums.com/t/guide-activate-native-video-calling-over-lte-rcs-other-features.4178819/

Trying to activate native video calling
[Android General] Dante63:
I should've tagged you, @BLuFeNiX ...
[Android General] milojoseph:
View attachment 5875007
[Android General] wr3cckl3ss1:
Who wants to know?
[Android General] wr3cckl3ss1:
If it's failing, you're either on One UI 5.1 or a device too old.
[Android General] milojoseph:
I am unfortunately the link doesn't work for 5.1 and my apologies, I read your post wrong. It said some versions of 5.1 like my 23.

Haha I guess I'll wait for a way to change settings in the ims; need video calling
[Android General] wr3cckl3ss1:
What S23, do you have? Also, while yes it's nice having a system shell to be able to call a lot of system level activities you don't need a system shelf to open those activities... I have two elevated apps that do this and it's all without a system shell .
[Android General] milojoseph:
Can you share those two apps.

View attachment 5875371
[Android General] wr3cckl3ss1:
Just downgrade your firmware to this

Download Galaxy S23 Ultra SM-S918U (USC) S918USQU1AVKT in Samfw - Samsung firmware download

Galaxy S23 Ultra SM-S918U (USC - United States) S918USQU1AVKT T(Android 13) samsung firmware download all model, lastest, fast update, completely free and fast speed in Samfw.com ✅

samfw.com

And you'll have system shell access. Follow the OP. (Heads up moderators, i know i posted this link once before and i know the rules about links, etc. Don't want to get penalized.)
[Android General] redhatperl:
I am sorry but could you please share the names of those two apps? Or PM me the links, please?

I have two elevated apps that do this and it's all without a system shell .
[Android General] milojoseph:
Yeah same was trying to avoid downgrading or modifying. If you can DM apps
[Android General] badmaan:
I have S918B/DS, could you share those apps in DM? I need to use Service Menu, I can't downgrade to Verizon firmware. Thank you.
[Android General] wr3cckl3ss1:
I guess the days of doing research and exploring for yourself are long gone. Here you are gentlemen. As per you requests, I'll kindly point you all to ONE of those apps. What you do with it, is all on you and please refrain from asking "Why", "Where" or "How".

https://xdaforums.com/t/guide-kg-state-locked-bypass.4072581/post-88334115
[Android General] wr3cckl3ss1:
Because I can't see comments that were removed or deleted. I will respond to what i did catch before it was deleted or removed. I'm all about transparency here and the reason I didn't give notice about the other app in question was because 1. It's a app that is paid. 2. I'm sure the devs don't need all the heat. And 3. Its not really difficult to do a search on here or on Google. The community is here for everyone to discover and find things out for themselves. I understand it's not what it used to be years ago and it really sucks. But that's my personal opinion and I'll leave it at that. The other app where you can call upon SOME of those elevated activities is called Alliance Shield X. I won't link it but it shouldn't be hard to find as they have multiple places where they can be reached. Thank you for your understanding.
[Android General] milojoseph:
Alliance shield x won't work unless they provide knox support for all then the activities can be opened
[Android General] wr3cckl3ss1:
Is there something specific your looking for?
[Android General] milojoseph:
I dm'd you.
[Android General] curtislin:
Amazing work, thanks. S22 with ui5.0 sussesfully got system shell.

In system shell I got read only file system. I cant access any folder almost.

Can someone help to make a writable folder , so i can put excutable file in and run it. Thank you so much in advance.
[Android General] wr3cckl3ss1:
There are plenty of folders that are writable and owned by system...the problem is looking for one where it allows you to execute a binary. I've been playing with system shell since October of last year and I have yet to find a folder that allows me to execute a binary that's owned by system. But what I can say is start looking at the symbolic links ..there's some weird ones that take you into different directories and interestingly you can be surprised at where some lead to.
[Android General] curtislin:
If folder is owned by system, you can write any file or create folder. Why cant we chmod to binary file and ran it？
[Android General] wr3cckl3ss1:
Sounds easy but there's alot of security mechanisms in place that prevent this. Selinux, RKP for example.
[Android General] BLuFeNiX:
Just replied to your PM. Yes, please feel free!
[Android General] Dante63:
Forked and done the required changes:

GitHub - ITDev93/SMTShell-ForSamsungWatches: Project forked and tweaked to work on Samsung watches nicely - Run commands as system (uid 1000) on Samsung watches! Includes API for privileged access!

Project forked and tweaked to work on Samsung watches nicely - Run commands as system (uid 1000) on Samsung watches! Includes API for privileged access! - ITDev93/SMTShell-ForSamsungWatches

github.com

Ensured proper crediting to your project and source code and explained my role as layout tweaker...
[Android General] Boomdada:
Is their anyway it could work for Android 8.1 the only problem is the exploited version of SMT app it's API level is 29 and 8.1 is 28 maybe changing the API level to 28 and signing it with same signature may work?

But shows this error even though I deleted the orignal system app via adb:

Shizuku installer error:

Device: samsung SM-G610F | Not MIUI | Android 8.1.0 | Using FilterApkSource ApkSource implementation | SAI 4.5

Unknown error

Command: pm install-commit 114600979

Exit code: 5

Out:

=============

Err:

Failure [INSTALL_FAILED_UPDATE_INCOMPATIBLE: Package com.samsung.SMT signatures do not match the previously installed version; ignoring!]
[Android General] BLuFeNiX:
If you have an older vulnerable version of SMT, then maybe. Can you post the SMT APK from your device?
[Android General] randomuser321:
I have a Google pixel device with Samsung galaxy watch 4 classic. Is it possible to use smt on watch to get root only on watch or is a Samsung phone always needed?
[Android General] alecxs:
if the exploit could be used to achieve root, it wouldn't called SYSTEM SHELL Exploit, don't you think?
[Android General] randomuser321:
Lol my bad. Makes sense
[Android General] Dante63:
It would work for any Samsung device (phone or watch) that has the vulnerable smt...

OP has put links for phone app and watch app...
[Android General] Boomdada:
Sure the apk orignally in my device is the version 3.0.00.97 this is a bit older version from the exploited version but it still can't be used for exploiting. Is there any older vulnerable version cause the only one i can think of is 3.0.02.2 .
[Android General] Boomdada:
I manually tried removing the system pre-installed smt app via adb on both users (secure folder) then tried install the exploited app but i changed the manifest version so it can be installed on Android 8.1 but it's still says: INSTALL_FAILED_UPDATE_INCOMPATIBLE: Package com.samsung.SMT signatures do not match the previously installed version; ignoring!

Is their a way to forge the app's signature to the exploited and manifested app to bypass this error or use an older exploited verison?
[Android General] alecxs:
Android OEM key leak means sideloaded "updates" could be hiding serious malware

Samsung, LG, and MediaTek are among the companies affected.

www.xda-developers.com
[Android General] randomuser321:
I downgraded the SMT version using adb and once I click exploit option in the watch, it shows a toast, "Exploit Triggered" but then nothing happens, it gets stuck there.
[Android General] Dante63:
Oh it takes a lot of time, not stuck, I also thought it got stuck but it's a looooong task
[Android General] randomuser321:
Oh, is it. Let me try and wait. Thanks
[Android General] randomuser321:
I waited for more than an hour. Nothing happened. Is it supposed to take that long?
[Android General] Dante63:
No, not that long, for me it took no more than 5~10 mins...

Using watch version...?

I used Shizuku method, I didn't go manual...
[Android General] randomuser321:
How did you start shizuku on watch? I tried it but wasn't able to start shizuku. Not so familiar with wear os.

Btw I'm using galaxy watch 4 classic.
[Android General] Dante63:
Phone version or watch version of the smt exploit?

You'll sideload Shizuku phone app on your watch, you'll need to run adb command to change density (only once to allow app permission always then you can revert back)

After that start it on 5555, if first time, you will see a pop-up message then after allowing a script running and hangs (after 1 minute, if it doesn't change go back and run it again)...

On second time you run it, the script successfully run and autoclose by itself stating Shizuku is running, now you leave the app and open smt exploit...
[Android General] randomuser321:
Thanks for the tips, I'm using the watch version of SMT exploit. I had already tried these steps yesterday to start shizuku on watch. But was unable to start it using the ADB command in the shizuku app, it shows permission denied. Am I missing something here?
[Android General] Dante63:
If I have time, I will try to make a video...
[Android General] randomuser321:
Yes, please do. Will be of great help. Will wait till then.
[Android General] Dante63:
First, I would like to apologize.

I posted the wrong APK to GitHub, so re-download the APK again, and things should work fine...

Here is the video.

The process took me no more than 5 minutes...
[Android General] randomuser321:
Thanks, that worked.
[Android General] corelua10:
wish this could oem unlock, at least i removed facebook
[Android General] DaanNL:
Everyone seems to be convinced that OEM unlocking is not possible.... but i think it's still possible we have multiple options but it seems nobody is interested in looking into it.... i cannot focus a.t.m. because of medication but the OEM signing keys might be in the samsung leaked files.... then we can downgrade and unlock the bootloader or root the phone.

Mod edit: Reference to the "Samsung Hack: removed.
[Android General] Badger50:
Please stop posting references to the "Samsung Hack" as this is the official XDA stance on this matter as seen here.

Thank you: Badger50
[Android General] corelua10:
cope
[Android General] bitten2up:
works on sm-a426u running on verizon
[Android General] wr3cckl3ss1:
I see that you're a new member. Welcome. Welcome to the land of overage misfits and disgruntled ex tech employees. Always remember to use that search button up at the top and always be respectful because someone here will always have something to say. Is your device on One UI 5.0 or 5.1? If on 5.0, SMT Shell works as is. If on 5.1, then this will not work but using that search option can direct you to bypassing Samsung's bandaids up until May 2023.
[Android General] bitten2up:
thank you, I have been looking around the forms for a couple years now, just never really bothered to make an account until now,

device is on 5.1 I misinterpreted the downgrade comment as talking about the 5.1 bypass and that it only worked on as I did see in that thread some people couldn't get it to run on the april security patch, I was just confirming that the bypass does indeed work on the phone
[Android General] wr3cckl3ss1:
GitHub - wr3cckl3ss/system_shell_2: SMT Shell with a twist! Fully updated and upgraded.

SMT Shell with a twist! Fully updated and upgraded. - wr3cckl3ss/system_shell_2

github.com
[Android General] ser8210:
Hi.

Thank you very much for keeping the project alive. My april upgraded galaxy note 10+ exynos (SM-N975F) feels very happy again.

View attachment 5921973

View attachment 5921975View attachment 5921977View attachment 5921979

Salu2
[Android General] 1nikola1:
Kinda about 2 things,

Is it possible to give other apps uid1000 permissions?

And if this coulde be used to install the root version of ReVanced apps through the command line or manager?
[Android General] icecool217:
Hi @Dante63

Thanks for the video. This helped a lot.

Managed to get Shizuku running but have trouble with the SMT Shell.

This is for Watch 4 classic R890X, Nov 2022 patch, exploit triggered. But when I tried to click on the other menu options in SMT Shell such as Change CSC, there is no response.

Any ideas?
[Android General] Dante63:
I'm afraid I'm not the person that can help with this, I have only made the app watch friendly, I'm not the maker of smt exploit nor have i used it, even with that, you're using phone version on watch and not the version that I made...
[Android General] icecool217:
Ooh now I see!

Will retry this with the watch version. Thank you!
[Android General] Dante63:
It would be the same results, you should ask OP or someone else who changed CSC...
[Android General] bitten2up:
wait... what if the way to get root is by downgrading another app that was vulnerable, im currently looking for one, as we got a downgrade exploit rn
[Android General] wr3cckl3ss1:
The changing of CSCs on Watches is something, I'm still looking at. Everything is there but just missing one piece of information that will see this thru.
[Android General] wr3cckl3ss1:
There is a "method" that sort of changes this and could be done within SMT Shell but it's very risky and not for the average user as it requires entry into a particular partition. And that partition holds info like IMEI...NVRAM....etc..etc. So definitely NOT for the average end user.
[Android General] wr3cckl3ss1:
Sounds good. But highly unlikely as the newer the device is....the more it will NOT let any app from before touch or even come close. Samsung's RKP and Defex are their sudo bodyguards. Best thing you can do, is start from today. Look for apps, that are currently pwning Samsung at the moment. If you find one, research the hell out of it. Why it was put on notice in the first place and decomp it. And looking at the list right now, i can see at least 4 to 5 SAMSUNG apps that are currently giving them a headache.

*cough*

core

*cough*

galaxy store

*cough*cough*

blockchain....tips...

*cough*

......themes

Excuse me....my allergies....Good luck.
[Android General] icecool217:
Thank you @wr3cckl3ss1 for your work!

For my watch (R890X XAC, running VK4 UI4.5 with Nov 2022 patch, no response to *#272*719434266344#).

Checked that my preferred CSC is available from checking on server.

http://fota-cloud-dn.ospserver.net/firmware/TGY/SM-R890/version.xml

Just summarizing what I have done to change CSC.

Started with looking at @adfree post, I used K0mraid3 shell exploit (with a pocc.lang installed) and managed to get into system with UID=1000. Ran into permission issue at the /efs/imei/ level at pulling mps_code.dat even after copying to /sdcard.

Next, I installed com.Samsung.SMT v.3.0.02, SMT Shell v2 + Shizuku 13.3 all via advice command (adb install -d). Followed @Dante63 video. Note that Dante63 reminded that the SMT Shell I installed wasn't for watch and possibly why I couldn't go exact route in video:

- Shizuku or SMT Shell couldn't run until pocc.lang uninstalled

- Shizuku couldn't change to authorized 1 until I attempted unpair and then keep fumbling with settings

- After Shizuku worked, no downgrade option. Just exploit button which I was able to trigger exploit. Again, after fumbling around, then downgrade was available. Clicked.

Was able to use adb from the menu and shows system with uid=1000. Other buttons non responsive.

Couldn't find @Dante63 watch version so I went back to using K0mraids shell (which reinstalled pocc.lang). Download mps_code.dat from @adfree. Changed the CSC in the file. Pushed it to /efs/imei (confirmed by reading the .dat file directly.

After resetting watch and choosing language, the region menu showed and I changed it.

Not sure if any of the info can help but really thankful for all the time and work you guys put in (@wr3cckl3ss1, @adfree, @Dante63 - no particular order).
[Android General] wr3cckl3ss1:
You hit it right on the head with the specific partition. I was talking about. And I'll answer some things that you laid out here. Dialer method for changing CSC has been dead for awhile. So that's out of the window. You mentioned buttons not working with SMT Shell. Well the issue there is, you have a Watch that's international. The reason the buttons don't work for you is because you don't have IOTHiddenMenu.apk on your device. Korean, Indian and many International devices don't carry this specific APK. But many North American devices do. Tablets, Watches, Phones. Now, I'll tell you this first and this is the first time I'm saying this in general. Even though you don't have that specific APK, doesn't mean you don't have a form of this APK on your device. It's just named completely different. And that's something im also looking at as well. I have a "list of commands" ready for testing but do not want any testers for this and will test for myself very thoroughly. I understand that this is something very very wanted and do realize what can happen once any of that information that I release goes out so before I have a million and one people screaming at me...crying...whatever. I would like to test things out myself and eliminate any possibility of backlash. Lastly while you were moving that file in and out of that partition it really isn't needed to do that. And any changes could be done within that directory. No copying is needed no moving is needed and it's just a matter of writing a certain command to change what you need. But I will not discuss that here because it is very sensitive in this aspect.
[Android General] icecool217:
Thank you for the thorough explanation!

This confirms my suspicion. Since the server listed that I have the CSC I wanted, I just moved on. Worse case is editing the mps_code.dat and not having any effect (from prior experience with Tizen S3 gear and watch 3).

That is possibly true it may be under a different name. Just the thought of running two different sets of "IOTHiddenMenu is bizarre (time consuming and costly).

Can't wait to see what you have when available to release. People shouldn't be backlashing and be more appreciative.

You are right about the moving documents in and out. I wasn't sure what other coding was in the file so I wanted to extract what was in the watch. Definitely learning from the experience and hoping one day can help to provide a small contribution.
[Android General] nguyenlucky:
is it EFS partition?

I'd like to enable the second sim slot on my S23U S918B lol. Based on an older device, it's in factory.prop, but not sure for S23U

https://xdaforums.com/t/singlesim-to-dualsim-test.3735784/

I tried ls -l the efs partition and copying it to /sdcard, using the included shell in the smt shell app, but got denied permission. Nothing works.

Currently got OTA disabled by adb so no chance of updating to the June patch with bit 2.
[Android General] wr3cckl3ss1:
You can DM me if you like.
[Android General] wr3cckl3ss1:
DM me if you like.
[Android General] wr3cckl3ss1:
@icecool217 dm me
[Android General] bitten2up:
thank you, just googling "samsung core app exploit" and clicking on the first link, i found CVE-2021-25393 which allows you to read and write files as the system user, i can tell this is going to be intresting