yashsingh1/xdaforums huggingface dataset:
[Hardware Hacking General] Renate:
/custdata/nv/user/USB_COMP_STR.0 needs to be changed from CHRG_ONLY to DEBUG_MODE to enable ADB. (Thanks, Rick!)

Since it's null-padded to 16 bytes we might as well keep it that way just to be neat.

# echo -e -n "\\x44\\x45\\x42\\x55\\x47\\x5f\\x4d\\x4f\\x44\\x45\\x00\\x00\\x00\\x00\\x00\\x00" > /custdata/nv/user/USB_COMP_STR.0
[Hardware Hacking General] rich hathaway:
USB_COMP_STR.0 resides in netgear_dat if you are looking at that partition by itself and with the spare it resides at D1F038 without the spare it will be at DF0F38 or in ubi form its located at 306C18

if you are looking at it from a full (0-7ff) nand dump, with the spare you will find it at 11130F38 or in bin form without the spare it will be at

108E9A68 you can also get all ports working by just corrupting that string, such as change it from 55 to 00 or 55 to FF

or in txt change USB_COMP_STR.0 to

xSB_COMP_STR.0

glad you found it also :)
[Hardware Hacking General] Renate:
There's a ton of duplicated code all over for configuration of the USB:

case ${USB_COMP} in
*CHRG_ONLY* )
# use charge only when OTA NV is ready
run_charge_only &
;;
*68E2* )
run_68E2 &
;;
* )
run_9607 &
;;
esac
[Hardware Hacking General] rich hathaway:
I tried to call up PID=68E2 which is what is used on most Sierra devices to enable the real ports but it does not work on this one because of the Quectel modem, I am sure there is a proprietary cmd for it, prob an AT cmd or qmi cmd.

but always best to make your changes at the place of residence and not elsewhere where coding gets copied to or it can cause problems and conflicts that can tie up the processor with chasing its tail and slow the device.
[Hardware Hacking General] Renate:
The 192.168.5.1/api/wwanadv.json gives us most of what we want in a small package.:

"wwanadv": {
"curBand":"LTE B4",
"radioQuality":38,
"country":"USA",
"RAC":0,
"LAC":1234,
"MCC":"311",
"MNC":"480",
"MNCFmt":3,
"cellId":12345678,
"chanId":2100,
"primScode":-1,
"plmnSrvErrBitMask":0,
"chanIdUl":20100,
"txLevel":-50,
"rxLevel":-116,
"end":""
}

But... you have to be logged in and it does a bunch of redirections/session ids.
[Hardware Hacking General] rich hathaway:
Can you edit any of that from there and does the device respect it if you do?

You can change most all of that in the nv via dm commands.
[Hardware Hacking General] Renate:
No, I haven't gotten that far.

The HTML and JSON come out of templates in /custapp/usr/hdata

The templates (.tmpl) use goofy control characters as markup.

I haven't parsed it out yet.

However, here is a URL that tells you everything (390 variables), so you can figure out what you want to make into your own .tmpl or variables names if we can work around the templates to generate it simpler.

http://192.168.5.1/Introspection.html
[Hardware Hacking General] Renate:
I can put files in /custapp/usr/hdata and recall them with web.

I can't get programs to cgi execute there, but I can run them manually.

/custapp/usr/hdata # whoami <= stock software
root
/custapp/usr/hdata # ./whoami.cgi <= my own shell/cgi software
User: 0 root
Groups: 0 root

whoami.cgi is compiled under RPi but the loader patched from /lib/ld-linux-armhf.so.3 to /lib/ld-linux.so.3
[Hardware Hacking General] Renate:
So I have a proof of concept here. It enables access for some of the variables, specifically the "wwanadv".

You can see what you get with http://192.168.5.1/api/wwanadv.json

Except that you normally have to be logged in on the main website to get it.

Try when you're not logged in and you'll get nothing.

Warnings: This is PoC. Save a backup copy of NetgearWebApp. This requires common sense to execute, don't follow the instructions literally. Don't do this if your NetgearWebApp is a different size. Stop and restore if it says "wrong place". There will be a nicer version later. I'll be making a custom template later. Those are struct addresses, not the specific location. There's no guarantee that this data is totally inaccessible from the networks side.

C:\>adb push ngwa /custapp/usr/bin
C:\>adb shell
# cd /custapp/usr/bin
/custapp/usr/bin # ls -l NetgearWebApp
-rwxr-xr-x 1 1000 1000 628504 Jun 3 15:40 NetgearWebApp
/custapp/usr/bin # chmod 755 ngwa
/custapp/usr/bin # ps |grep Netgear
1622 root 0:00 {restartNetgearW} /bin/busybox /bin/sh /custapp/usr/sbin/restartNetgearWebApp
1635 root 0:05 /custapp/usr/bin/NetgearWebApp
14988 root 0:00 {grep} /bin/busybox /bin/grep Netgear
/custapp/usr/bin # kill -9 1622
/custapp/usr/bin # kill -9 1635
/custapp/usr/bin # ./ngwa
97644 2200 => 2222
9765c 2200 => 2222
97674 2200 => 2222
9768c 2200 => 2222
976a4 2200 => 2222
976bc 2200 => 2222
976d4 2200 => 2222
976ec 2200 => 2222
97704 2200 => 2222
9771c 2200 => 2222
97734 2200 => 2222
9774c 2200 => 2222
97764 2200 => 2222
9777c 2200 => 2222
97794 2200 => 2222
977ac 2200 => 2222
Ok
/custapp/usr/bin # reboot

Sigh. Netgear is so stupid. I don't like JSON but at least I don't violate it:

These are all (separately) valid JSON: 0, {x: 1, y: 2, z: 3}

This is not valid JSON: x: 0, "wwanadv": { whatever...

Edit: Attachment deleted. There will be a new version soon.
[Hardware Hacking General] Renate:
OMG, this project is turning into a blockbuster! Just look how many downloads there are on ngwa.bin

Eh, it's ok. I do this to amuse myself. I'm very happy with the useful Android app.

Edit: The utility of this is proving itself on the road. Obviously in a fixed location there's not a lot of interest to see.

Still, the arbitrariness of which band it picks make me scratch my head.

95+% of the time it picks B4, often when my cell phone has picked B2, B5 or B13.

A minute ago I had a great signal -100 dBm and "quality" of 69 on B13.

Then it just switched all by itself to -117 dBm and Q of 34 on B4!
[Hardware Hacking General] danleeper80:
I know this may be a little rude however reviving this thread I own 2 lm1200's and would like to utilize adb/root specifically to run an ipsec VPN (strongswan/openswan) from my lm1200 to my firewall / server I have in a datacenter. Unfortunately other methods of VPN haven't worked out well for me to run a lan to lan tunnel. Has any further progress been made where this device can be modified?

Thanks
[Hardware Hacking General] Renate:
The only things that I've done were:

Installed a connector for UART.

Installed a magnetic reed switch to get to EDL easily.

Resetting the UART root console password to "root" using EDL and hacking the raw UBI.

Changing permissions in ngwa.bin so JSON items can be accessed without logging in.

Making custom JSON templates so that I can query the signal through an Android app.

I really know nothing about VPNs.

If you want to figure out the stock root password the encrypted MD5 string is listed back in this thread.
[Hardware Hacking General] danleeper80:
Thanks for the update/summary regarding your progress. For the UART I'm guessing a PL2303 USB to 2 wire serial rx/tx that I've used for my headless raspberry pi's gpio console won't work I believe its 3.3v I think it was mentioned somewhere the levels are 1.8v. Do you have any specific device/adapter you recommend to interface with the UART?

Some other questions come to mind...since you've got some access to the device.

How much storage is available on the NAND? I need enough room for the ipsec kernel module which I'll likely use my Pi to cross compile along with the start-up/shutdown scripts and binary that id install either in /opt or /usr/local. I'd estimate around 4mb would be needed for an arm cpu (hard float or soft) based upon what I see precompiled versions in Debian/Ununtu for the Pi.

Hopefully I don't run into a situation where I'm asking the Lm1200 to do more than it has resources for...it handles my 300/15 cable connection from Spectrum without issue and I use a AT&T FirstNet SIM for when Spectrum goes down this was an upgrade from the LB1120 which doesn't support FirstNet's Band 14 plus the failover capabilities. I chose it because it was the most affordable Ethernet capable device that supports FirstNet's band although FirstNet doesn't officially support it I had to give them a different IMEI to activate.

Thanks

Dan
[Hardware Hacking General] Renate:
Right, the RPi is 3.3V. All debug consoles coming directly out of Qualcomm SoCs are 1.8V.

I threw some transistors together for a 1.8V to 3.3V level shifter. :p

How about this https://www.amazon.com/DSD-TECH-SH-U09C5-Converter-Support/dp/B07WX2DSVB/

I kind of prefer FTDI over Prolific, but it's not a big deal.

It's got 512 MB flash, but it seems like a lot is empty.

Is that LM1300 any different, any better?
[Hardware Hacking General] danleeper80:
It's an Lm1200 but anyways, do you have a bom/schematic for your circuit? I have a small collection of common transistors ie 2n3904/3906/2222's off the top of my head as well as a few low power mosfets that I could throw together in a breadboard in a few minutes to start tinkering with it.

Thanks,

Dan
[Hardware Hacking General] Renate:
No, I was just wondering about the LM1300.

Erm, I don't have a schematic for what I did.

The TX fom 3.3V just goes to a resistor divider, I think I have 2.2k over 4.7k which divides a bit high, but make sure it drives it.

The RX from 1.8V goes to two cascaded common emitter NPNs,

The first is fed 2.2k over 10k to the base.

The second has the same?

Collector resistors 2.2k (I seem to have had a lot of those) to the 5V UART supply.

You could always use a MOSFET for the second one, it's easier.

I don't know why I didn't.
[Hardware Hacking General] Renate:
Hmm, Rich has a way to enable the various USB interfaces. I did it a different way and I'm struggling to remember how.

I was hoping that somebody would take the password string that I posted and crack it, see https://xdaforums.com/t/netgear-lm1200-lte-modem.4573931/post-88497391

That way you could just log in through the UART and modify things.

So here's where I did mine https://xdaforums.com/t/netgear-lm1200-lte-modem.4573931/post-88593685

First, you use EDL to copy the entire 512 MB NAND.

There is the Pyhthon EDL and there is the streaming protocol, but I'm only talking about my edl.exe and its handling of NAND.

C:\>edl.exe /n /r /s0 /c0 lm1200.img

Then you scan through the 512 MB looking for the password string, "$1$uH6tuGYf$bjaX370zwmzgNHP/YhrAQ/".

It appears six times. If I remember, the one I modded was the 4th.

If your binary version is the same as mine than https://xdaforums.com/t/netgear-lm1200-lte-modem.4573931/post-88596099 should work.

All the tools are found in my Android page, or up and down in my Windows page.
[Hardware Hacking General] roirraW "edor" ehT:
Hi @Renate. It looks to me like maybe you meant to tag @the-wondersmith, but the tag part of your quote of his post got broken, so thought I'd tag them here. :)

(and tagging after editing a post doesn't notify the user)
[Hardware Hacking General] the-wondersmith:
Any idea what the hashing algorithm is for that password string? I thought it was MD5, but I'd also swear up and down that MD5 hashes should be 32 characters long, and the hash you posted is 34 🤔
[Hardware Hacking General] rich hathaway:
@the-wondersmith

I'm... very much at a loss as to how to get adb / shell access to the device when it's booted into EDL mode. Could I ask for some more details on what I missed?

------------------------------------------------------------------------------------------------------------

You cannot use or enable adb while in edl (9008) as a matter of fact, you cannot enable or use anything other than 9008 port while the device is in this mode, this is true of all of these type of devices, if you need to use the shell then boot back to normal "on" or user end mode and follow the postings in this thread to enable the ports including the adb port so you can use the shell.
[Hardware Hacking General] rich hathaway:
It is md5crypt
[Hardware Hacking General] Renate:
root:$1$uH6tuGYf$bjaX370zwmzgNHP/YhrAQ/:0 Original password, unknown
root:$1$abcdefgh$rV6RhG4no19bGJfmub3Ui1:0 Hacked password, "root"
^ ^ ^ ^ ^
| | | | |
| | | | UID
| | | |
| | | 22 chars base64 = 16 bytes hash
| | |
| | salt data
| |
| This is MD5crypt
|
User

Well, yeah, you can't be doing 9008 at the same time that you're doing ADB.

But you can do things with EDL that will enable ADB when it boots.

Just to clarify one point that's we've never resolved.

You've said before that you don't use Firehose but also that you do use ENPRG9607p.bin

I do use Firehose and I use https://github.com/bkerler/Loaders/blob/main/unknown/0000000000000000_06513b56f7f06be9_fhprg.bin.

Are they the same file?
[Hardware Hacking General] rich hathaway:
No not the same My loader is 95KB and is not a firehose loader looks like that one is 129KB.

the one I use is just a patched loader.
[Hardware Hacking General] rich hathaway:
Yes I just realized what I said was wrong in that you can load a file to enable adb upon next boot from 9008 mode, I should have just said you cannot use adb in 9008 mode
[Hardware Hacking General] Renate:
Well, could you share that with me so that I can figure out what's going on?

If it's your own patch and you don't want to share that can you give me the original, unpatched?
[Hardware Hacking General] rich hathaway:
Ill pm you
[Hardware Hacking General] Renate:
So @rich hathaway , you're right.

This is a loader, an XBL replacement, but it's not using the Firehose protocol (which is XML based).

It's using something else, probably more binary oriented.

In any case, I won't dive too deep into this as the Firehose loader that I'm using does the job nicely for me.
[Hardware Hacking General] the-wondersmith:
@Renate I wasn't paying enough attention and it turns out my unit is an LM1300. The UART and EDL testpoint mods still work exactly as advertised though, which is... something? Using your edl utility, the device is recognized, but as soon as the utility goes to do anything with it I get a "bad xml" message. The utility refuses to explain what it's mad about even with the /v flag applied, so... all I can think is that there is some actual difference between hardware? Or... something?

If either you or @rich hathaway have an interest in mucking about with it, I'm more than happy to facilitate however I can. I've also fired up a hashcat run against that has you posted using a ~16GB wordlist. If that yields any fruit I'll post it. 😅
[Hardware Hacking General] Renate:
I think that the LM1300 is some software tweak or something of the LM1200.

I can't get any details on their differences.

I probably should make it clearer what "bad XML" means.

I never run into that because I always remember to first load a loader.

There's Sahara (a binary protocol) and Firehose (an XML-based protocol).

The loader is what "upgrades" the protocol from Sahara to Firehose.

So if you give a Firehose command to a device in Sahara mode it will get a mouthful of binary nonsense.

At that point you've confused everyone and you (usually) have to reset your device and start again with a loader.

Thanks!
[Hardware Hacking General] the-wondersmith:
Might be a silly question, but do you know offhand if these hashes are already unshadowed?

----

edit: in case anyone comes across this in the far-flung future - explanation of unshadowing
[Hardware Hacking General] Renate:
Erm, I've heard of shadowing, but I forget what it is.

I think it's where they don't include the hashes in the passwd file or something?

I believe that I generated that abcdefgh-root password online.

I just redid it here and it came out the same.

The proof is in the pudding; when I replaced the stock with my string I could login with the password "root".

Salt is, of course, arbitrary. By making it "abcdefgh" it reminds me that this is a fake password.

I guess that I could have set the string to "$1$pwd=root$Rvu19tkCA5DJNeedmBAjQ0". :p
[Hardware Hacking General] Renate:
Hey gurus! @rich hathaway

My LM1200 was reporting amount of data used both on the web "control panel" and on the JSON correctly.

Now it's showing zero although I'm 10 days through the billing cycle.

These stats are collected locally, correct?

Edit: Sigh. I reset the darn thing and now it's started counting.

And we still have that damn "SMS Memory Full".

And no updates since 2020? And why does it not show the software version anywhere?

Oh, you can see it in http://192.168.5.1/api/general.json

I've got "appVersion":"NTG9X07C_20.06.09.00" which apparently is the latest.

I've updated my little Modem.apk

I've put in a little database of local towers so that it can tell me which tower and which sector I'm on.

I can see that I'm on the south beam of B66 from the tower in ****

I could make it so that it queries a remote database, but outside of this local area it's all the same to me.

This area is a bit rugged and I know which towers have congested backhauls.
[Hardware Hacking General] rich hathaway:
I am not sure if the data is collected locally on this one, I never fooled with the data counter on it, it is not collected locally on other devices, I recall seeing the url for data counter and server logins for dl of it on some inseego devices.

What you want for the counter and for the sms is likely located in custdata

you are using an apk on this device?
[Hardware Hacking General] Renate:
I'm using my apk which is just querying JSON on the LM1200.

I can see the JSON in a browser too.

My custom templates and permission changes only affect when and how you can see the stuff.

The superset of everything is http://192.168.5.1/api/model.json

Netgear has acknowledged that there is nothing built into their code to delete SMSes.

My old phone couldn't do any operations on SIM stored SMSes.
[Hardware Hacking General] rich hathaway:
sms delivered by traditional means is generally turned off on these devices so they can only get them from the carrier. They are prob stored in the nv on these type of devices with a max of 128 bytes each.

You can prob just remove the sim and see if the sms still shows up on the device to prove or disprove where they are stored, or at least the ones from the carrier.

did android on this device unpack/install your apk or you added it unpacked ?
[Hardware Hacking General] Renate:
Huh? I installed the apk on my phones (not the LM1200) with adb install modem.apk
[Hardware Hacking General] rich hathaway:
I misunderstood you I thought you meant you were running it on the lm1200
[Hardware Hacking General] rich hathaway:
The powers that be here will swing the ban hammer if such things are discussed or services are offered, I sent you a pm stating the same.
[Hardware Hacking General] V0latyle:
IMEI repair is OK, as long as it is only restoring the original IMEI to the device.

IMEI change is not, as it is prohibited in many countries and there is no legitimate reason to change it.
[Google Pixel 6 Pro] AgentMyrie47:
Hello morning this is my first time ever flashing a pixel 6 pro and i don't want to make too many mistakes and completely brick the device. can anyone tell me the right steps to take before flashing a gsi and to get root access. also, I would like to know if the gsi Corvus os 4.1 (12L) can work or any other gsi that works best for the pixel 6 pro. thank you
[Google Pixel 6 Pro] w_tapper:
i dont have much experience with gsis but the experience that i have had has been very bad, i would recommend flashing a rom like evo x, ricedroid or lineageos, just follow the install guides carefully and youll be ok
[Xiaomi Mi 11i / 11X Pro / Redmi K40 Pro+] Dekaohtoura:
Hello everybody,

As the title states, I'm still stuck on the latest 13 MIUI version (13.0.9.0 SKKEUVF) although the XM rom is available for about 2 months and I've found a lot of posts from users in Brazil, Germany (other European countries as well) that they've received the VF rom.

I live in Greece, I've changed country settings to Brazil, Germany, Switzerland, Bulgaria etc, rebooted, waited 1-2 days each time, but nothing happened.

I'm not very keen on wiping everything in order to flash the XM rom, but at some point I'd like to be up to date with the latest security updates (stuck on January).

Is there any offline source for the VF rom or something else that I could try to force the update?

TY!
[Xiaomi Mi 11i / 11X Pro / Redmi K40 Pro+] Dekaohtoura:
Soooo...it seems that Vodafone decided to push the updated 14 ROM (security patch as of April 13!), at last.

I'm downloading it eight now, and hope that everything will go smoothly.
[Samsung Galaxy S22] Ben117:
On my Galaxy S22 phone (running Android 13), when I tap the Recents button on the navigation bar, it shows "# active in background" at the top of the screen if I have # apps active in the background (assuming # > 0). If I then click on "# active in background", a window will pop up labeled "Check background activity", and I am able to force stop any of my apps that are running in the background from that screen. I use an "app blocker" app called AppLock Fingerprint (from the Google Play store, developer SpSoft), and I can easily force stop AppLock Fingerprint by doing this, which defeats the purpose of having it. Is there any way to disable the "# active in background" button, the "Check background activity" window, or the Recents button on the navigation bar itself?
[Google Pixel 6a] Spengoe:
Hey, It's been for quite some time that I have tried to use google pay with magisk installed but failed miserably. I decided to install lineage on my Google Pixel 6a so that I could do a little more trick with that but still didn't work. What I don't get is that I passed multiple times SafetyNet but when I try to add my card It refuses to add it and then goes back to failed CTS. It's starting to get a little frustrating as I love my Pixel 6a and know that I can do cool stuff with it but the only thing that separates me from rooting and using custom firmwares is that I can't use Google Pay/Wallet (and maybe Netflix but I think there is some workarounds for that). So if anybody knows a way to actually fix that it would mean the world to me.

Thank you.

View attachment 5884533
[Google Pixel 6a] Lada333:
Do you have the required SafetyNet fix module installed and have you added the required apps to Magisk denylist?
[Google Pixel 6a] Spengoe:
I have installed Safetynet fix as well as putting the needed apps on deny list. I even tried Magiskhide Props config to change my fingerprint and also used Shamiko but it still didn't work.
[Google Pixel 6a] Lada333:
Interesting. Have you cleared application data on the apps you've put on the denylist?

Also, which version of SafetynetFix have you installed? I think the most recent one doesn't work properly all the time.
[Google Pixel 6a] Spengoe:
I did in fact cleared the app data of the apps needed, and also used the latest version of SafetyNet. But an interesting fact is that I have passed SafetyNet times to times but when for example I am trying to add a card, cts just fails randomly. I don't know if it's a common issue or not though..
[Google Pixel 6a] Spartacus500:
Install this app from Google Play & test

Play Integrity API Checker - Apps on Google Play

Get info about your Device Integrity through the Play Intergrity API

play.google.com
[Google Pixel 6a] Spengoe:
1. Clean LineageOS with MindTheGapps Installed. (Non root)

2. LineageOS with Magisk Installed (Root without fix)

3. LineageOS with Magisk Installed (Root with Fix and SafetyNet Fix)View attachment 5885471View attachment 5885473View attachment 5885475
[Google Pixel 6a] Spartacus500:
@Spengoe

3. LineageOS with Magisk Installed (Root with Fix and SafetyNet Fix)

Try install module

safetynet-fix-v2.4.0-MOD_1.2 by Displax
[Google Pixel 6a] Spengoe:
Thank you so much. Now everything works fine and I even added my card rn! I hope you have a great day and thank you for your time.