yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy S22 Ultra] android14help:
Well yes and no. I'm doing it because my Google account had multiple users, some from Linux computers and also 4 devices logged in. None of which were mine.Then I started losing access to my system and things were being modified.

And then I looked at the recovery after reset and it showed a file that was being pointed at which is a known exploit from 2019 that was a memory overflow exploit.

Then I looked at the memory in recovery and it had data written to it as non-contiguous or something like that. Can't remember the exact word. So I looked it up and it meant data that is written outside of normal range or something like that.

So logical thing to assume is it is a buffer overflow exploit used to gain root access to my device

I can cite the exploit if you would like
[Samsung Galaxy S22 Ultra] Richk98:
Just look for a video on how to unlock the bootloader on your device. If you can't solve the problem, search for a solution to the bootloader unlocking problem. Then you can unlock the bootloader, download the stock rom. You have deleted everything and installed the stock rom and that's it.

If you have a Trojan horse in your personal files or in your external memory (if you have one), there is no point in making a backup because if it is hosted there it will be reinstalled again.
[Samsung Galaxy S22 Ultra] android14help:
No my bootloader doesn't give that warning. I can only get to recovery and then Custom OS download.

Which according to Samsung, if it goes into custom OS download then it means it has been rooted. I spoke with then today

Sorry for being so stubborn and I really do appreciate your help. I'm ignorant to a lot but I'd really like to resolve this issue with my phone.
[Samsung Galaxy S22 Ultra] android14help:
Thank you, I am already getting a new phone but I'd like to see if I can somehow do analysis on the device to see how they got in and maybe who it is.

I won't be carrying over any accounts or data to the new device and it's gonna be isolated from network access
[Samsung Galaxy S22 Ultra] Richk98:
Some companies usually say that so that people do not change the ROM and/or modify the system.

what things friend :/

The other alternative is that you take the equipment to a good technician and he can give a good wipe to all the partitions, leave your phone blank and reinstall the same system or a custom rom (as they said there, OS lineage and pixel experience are good the truth)

Don't worry, we are here to support you.
[Samsung Galaxy S22 Ultra] android14help:
I appreciate you saying that. I am looking into hiring a developer to look at the phone but I will be learning more about android from now on. I heard lineageOS isn't compatible with s22 Ultra? Not sure if that is correct but I'm thinking I'll just get a Note 20 again. That was my favorite phone
[Samsung Galaxy S22 Ultra] android14help:
I understand your frustration with me but Im Pretty sure it is a virus/malware RAT so other people can gain access to my device.

I found the virus name within the system files but I can't access system files anymore.

One hacker installed the rat on my computer and it spread to my phone.

My storage went from 498GB free to 379GB free overnight so If you think that is normal then I guess I'll just consider myself toast
[Samsung Galaxy S22 Ultra] V0latyle:
The bootloader would have to be unlocked for the firmware to be modified. Part of what the bootloader does is ensure that (when locked) the firmware on the device matches the AVB key. If there is a mismatch, the device will either display a warning or fail to boot. So, in your case, since you do not see the warning, the firmware matches the OEM key it was signed with and does not show evidence of tampering or modification.

Incorrect, download mode can be entered at any time even if bootloader is locked. Little secret about customer service reps from most tech companies: They are idiots with absolutely no technical knowledge whatsoever. They just use a script and make generally incorrect guesses as to what you're asking about.

Well, my friend, you're in luck because there is no issue with your phone. Everything is fine and as it should be. You're running factory firmware and the bootloader is locked, so it is not possible for the firmware to be tampered with. I think you just got worried about things you don't understand and thought something was wrong. I don't really know how to put your mind at ease but I assure you there is nothing wrong with your phone, nothing has been hacked, you have nothing to worry about. :)
[Samsung Galaxy S22 Ultra] android14help:
Ok one last thing. My filesystem went from 498GB free to 389GB free overnight.

How would that happen if there wasn't malicious code being executed and written. It was on airplane mode the entire time as well....
[Samsung Galaxy S22 Ultra] V0latyle:
Just a fair warning, you'll probably see the same stuff on the new phone because there's nothing wrong with your S22 to begin with.

There's no need to hire a developer, you're already on the factory firmware.

Yes, the S22 can run LineageOS. If there isn't a build specifically for the S22, then it can still run a GSI. I ran a LOS 20.0 GSI on my Tab 8.0 for a while; now I'm just using the AOSP build with GMS.

There is no virus or RAT, at least not on your phone.

On your S22? Or your PC?

Is your phone connected to WiFi? Did you download anything to your phone, like music or movies?

There can't be malicious code because the bootloader is locked.
[Samsung Galaxy S22 Ultra] android14help:
On my s22. I went to bed and turned on airplane mode after I did a factory reset and my file system said 498gb of 512GB Free then I woke up and it said 389gb free.

I wasn't connected to wifi. Haven't been for a week and I "forgot the network" before I factory reset.

I understand what you're saying about the bootloader but this is what I'm dealing with. It may sound crazy but I'm seeing these kinds of things happen and nobody has an answer. I'm extremely stressed but I'm not imagining this stuff.

Sorry and no I wasn't downloading anything as you can see from the screenshot of my files
[Samsung Galaxy S22 Ultra] Dayuser:
Samsung OS system eats lot of storage. Maybe it's that.
[Samsung Galaxy S22 Ultra] android14help:
100GB? Overnight? I mean im no expert but i know that is 100% not normal.

Stock samsung is like 16GB or 20GB from manufacturer....

Also now my storage shows only 468GB TOTAL. And I had a 512GB phone.

Where is the other 44GB storage?

I only have 2 apps downloaded and a couple pictures....

The screenshot below will show the root and my storage. After I saw the 100GB issue I did like 5 more factory resets and it didn't happen again so that's why my file system shows 455GB
[Samsung Galaxy S22 Ultra] V0latyle:
Only thing I can think of is the system is "unpacking" itself following the factory reset. Samsung does some weird things. Since this is a Verizon phone there's a bunch of preloaded software and apps that have to get reinstalled following a factory reset. These are contained in a compressed archive that the system extracts.

No need to be stressed. You just don't understand what you're looking at and that's OK. Like...if you bought a diesel car and thought there was something wrong with the engine because it makes a clattering noise, or didn't know it had lane assist and was surprised when it tried to steer for you. Had that happen to me in a rental.

Well, I'm still convinced there's nothing wrong with your phone. Here's why:

As I mentioned already, the firmware is signed with the OEM key, which is installed in the hardware keystore and is used by the bootloader to verify the authenticity of the firmware.

Because a factory reset wipes /data, this means that any persistent rootkit or virus would have to inhabit the system partition. Problem with this is, the virus simply being there would change the firmware signature, meaning the firmware would no longer match the key it was signed with, so at the very least you would get this warning:

View attachment 6043254

Or, the device would simply fail to boot. This is the most likely scenario with a Samsung device; it would reboot into a warning screen with big red letters that say SECURE BOOT FAIL: BOOT.IMG or SYSTEM.IMG

Since you haven't seen either of these, there is simply no possible way a virus could stay on your device.
[Samsung Galaxy S22 Ultra] android14help:
My friend, I have never had a Samsung device(which I've owned about 5 over the last 10 years) that went over 100GB storage used. Not only that but why would it do that only once if it is just a Samsung thing? If we applied your logic, then that would imply that I would regularly see this "unpacking" happen for every factory data reset. Which it doesnt...I've reset this phone 20 times at least and only saw it once.

You sound confident in your answer but, but that makes no sense. I'm not sure you can understand the level of sophistication that this malware or virus is. Or your blowing smoke...idk but 100gb is ridiculously large for any system.

S23s are 60GB stock...and that's the newest flagship. But I guess they have more unpacking to do 👌
[Samsung Galaxy S22 Ultra] android14help:
How did you know I have a Verizon phone? I never mentioned that and none of my pictures included Verizon in the screenshots
[Samsung Galaxy S22 Ultra] V0latyle:
At this point I'm not sure there's any value in trying to convince you that you're mistaken. Sure, a sophisticated virus, that somehow manages to survive a data wipe, without modifying protected partitions and thereby passing Verified Boot checks, has taken up residence on your phone.

Even though this means that:

the virus would have to have Samsung's firmware verification key

the virus would have to survive a data wipe, which means that it would have to inhabit a protected partition

it somehow manages to install itself to a protected partition without changing the image hash, which is impossible

Occam's razor, my friend. The most likely explanation is the simplest one. I made a wild guess on the overnight storage usage, I honestly don't know.

Welp, there's no point in lying to you now that you've figured it out...I'm from the government, we've installed a sophisticated wiretap on your phone, and the birds outside your window are surveillance drones.

Or...I just know where to look

View attachment 6043266
[Samsung Galaxy S22 Ultra] SetOfAllSets:
the "emulated sd" is just internal storage, it's kept at /sdcard to keep compatability with apps that used to store stuff on sdcards in an age where many phones don't have sdcard slots anymore. This is the default behavour for a whole lot of (if not all) modern ROMs. That includes stock ROMs.

EDIT: didn't see I was only on the first page, thought that was your last post, sorry, I'm a new user
[Samsung Galaxy S22 Ultra] SetOfAllSets:
Please do cite the exploit, I'd like to see what you think it is. If your google account has logged in devices other than your own, kick them out and change your password. Your android has nothing to do with this, I have written many linux applications in C and I'll tell you that writing outside a buffer on accident is a common error, it does not indicate a hack. Do you think you're important enough to these supposed hackers that they would use a magical exploit that goes against everything people know about android (a FOSS project) on you? If you think so, you probably have someone who gets paid to help you, who will tell you what you've been told in this thread thus far. Your android phone is behaving as usual, the VM is not an entire different operating system, /sdcard is a compatibility thing, and your phone isn't hacked. You can have apps installed remotely if you have the play store and your account is hacked, but you would get a notification and the apps must be on the play store.
[Samsung Galaxy S22 Ultra] AndroidSnowCone:
This is still going on?!
[Samsung Galaxy S22 Ultra] android14help:
Here is the exploit-

NVD - CVE-2019-5188

nvd.nist.gov

This is an instance of using e2fsck 1.45.4 to flash an emulated sd-

iMX8M plus : Androind 11 userdata partition is reformated always after SD card is flashed

It seems the userdata is not accepted by the Android OS and it's formatted on first boot with SD card. I could see some security and partition signature related errors in bootloader, but could not find the root cause. I have attached the Boot log file. If you check like 55 to 65 of the...

community.nxp.com

The picture I uploaded shows the file execution of e2fsck

From what I read e2fsck Is not normally run on android unless using it to boot an OS to sd. Which another user said was "impossible" I believe.

Now this doesn't PROVE anything. But I cant find any literature on android using this file
[Samsung Galaxy S22 Ultra] SetOfAllSets:
e2fsck is a linux (and android) utility that is used to check ext2, ext3, and ext4 partitions for corruption. Seeing it run should not be too concerning.

EDIT: sources:

https://en.wikipedia.org/wiki/fsck

https://linux.die.net/man/8/e2fsck
[Samsung Galaxy S22 Ultra] android14help:
Can you please show me that file in your /system/bin?

It would ease my mind. Assuming you have an android phone lol
[Samsung Galaxy S22 Ultra] android14help:
Like I said I just haven't found literature of android using it outside of custom mods like booting android on sd card
[Samsung Galaxy S22 Ultra] TheMystic:
Can you post a screenshot of the Software Information section under 'About Device' in Settings?

1. Where did you buy your phone from?

2. Was it brand new or a demo unit?

As with the location of your files, they are perfectly normal as others have stated.

As with storage use, your screenshot shows a file manager which isn't default. So have you installed apps and downloaded files after factory reset?

In OneUI 5.x, Samsung Files app was showing usage under 'System' as a mathematical difference of total storage less storage attributed to other categories. This led to plenty of confusion among users. They have corrected that in OneUI 6. See the System usage on my phone in the attached screenshots.

That said, a factory reset phone with no additional installations/ downloads should have a free space of well over 450 GB in a 512 GB device, irrespective of whether it is a carrier locked phone or not (free space will be relatively less in a carrier locked phone as they will bundle their own apps and services). So not sure how your device managed to use so much space. But do note that system apps may be able to override user settings and turn WiFi back ON for their background activities. This is bad implementation, but a reality. So it is not necessarily a malware, although this is typical behaviour of a malware.
[Samsung Galaxy S22 Ultra] V0latyle:
View attachment 6043415

This is on my Pixel 5. Pixels run lightly modified firmware built straight from AOSP.
[Samsung Galaxy S22 Ultra] winxuser:
how about you stop arguing with people that know waht they are talking about and post screenshots of the things you think are wrong and your About device settings. if you bootloader is locked then there would be no way you would have a virus and or been hacked, as even if they have injecting something there would of been warnings show up when restarting the phone

1. when you wipe the device, the /emulated/0 will be empty, as soon as you boot your phone up android will fill it with files and folders like Alarms, Android, DCIM, Documents, Downloads etc. yes the android folder also has files and folders in it data, media, obb, and if you look on any other android phone they will have the same, these can hold some data and cache of system files (just like a save game for a game). basiclly what your most likely seeing in the logs which makes you think its booting from emulated device, is that it is initializing the user data (emulated/0).

2. when you factory reset without a sim in it the date and time wont be set to your location, and sometimes even with a sim in it it doesnt set it properly, it needs internet data to do that, everytime i have to factory reset my devices i have to manually set date and time.

3. boot into download mode and tell us what knows status is saying

​

forum moderators arent noobs and moderating just for the fun of it they have had experience in the android world and 9 times out of 10 they know what they are talking about, please listen to people that are trying to tell you things.
[OPPO Find X5 Pro Questions & Answers] Jowe79:
Hi yesterday i saw that my widevine has changed to l1 to l3!!! I have European oppo find x5 pro with last update color os 13.1.0.600 (ex1) and never from the buy of my device always shows L1....Any way for fix or downlaod L1 certificate??? Please help!!! Any tool or tip???

Thanks.
[OPPO Find X5 Pro Questions & Answers] asmarcz:
Hello, I can confirm my X5 Pro also only has L3 at this moment. Running on CPH230513.1.0.600(EX01).
[OPPO Find X5 Pro Questions & Answers] kofe:
I have the same firmware and also have L3.
[OPPO Find X5 Pro Questions & Answers] Jowe79:
Any solution??? Why we have L3 in x5 pro owners??? Any fix for revert this issue?
[OPPO Find X5 Pro Questions & Answers] Jowe79:
Please!!! Any fix for this issue??? There are something happen every time I restart the phone, the DRM WIDEVINE magically turns to L1, but after several hours using or not using the phone if i recheck DRM info, again turns to L3.... very strange....i have european device oppo find x5 pro with latest update....why??? Its a software update bug??? more people here with this issue???
[OPPO Find X5 Pro Questions & Answers] kofe:
Chill dude. We already replied that we also have your issue. Just contact oppo support and tell them about the problem if it bothers you that much. Submit a bug report from your phone.

Only they can fix the issue.
[OPPO Find X5 Pro Questions & Answers] Jowe79:
How i can send to oppo a error inform? Thanks
[OPPO Find X5 Pro Questions & Answers] kofe:
Use Google search. Google is your friend.
[OPPO Find X5 Pro Questions & Answers] Jowe79:
Sorry? No google is not my friend, i suppose which forum is for help other users of you own devices....not make you "the funny man" to me...

👎👎👎
[OPPO Find X5 Pro Questions & Answers] shorty1483:
What do you expect? The device is not even rootable. There is no user triggered possibility to change your WV level. Live with it or report it to Oppo support, the Mail address is a simple Google search "oppo support mail", dunno your origin country.
[OPPO Find X5 Pro Questions & Answers] asmarcz:
Back to L1 with CPH2305_14.0.0.301(EX01).
[Android Q&A, Help & Troubleshooting] Misadique:
I tried the usual adb reboot bootloader, then fastboot flashing unlock. It didn't recognize it. I tried fastboot OEM unlock, and it just failed.

Then, I tried fastboot reboot fastboot which lead me to the actual fastbootd page... but it still won't work. Any help?

View attachment 6043140
[Android Q&A, Help & Troubleshooting] Misadique:
View attachment 6043143

In the "fake" fastboot.
[Android Q&A, Help & Troubleshooting] mvikrant97:
Can you connect the device in Diag mode?

Like shown below.

View attachment 6043146
[Android Q&A, Help & Troubleshooting] Misadique:
I'm not sure what you mean by this, I'm sorry.
[Android Q&A, Help & Troubleshooting] mvikrant97:
This is low level flashing mode for devices with Unisoc chipset based phones.

Can you access this mode on your device?

To enter Diag mode follow the steps below

Download the Drivers from here

DRIVERS

Your phone must be powered off!

Now press and hold the volume-down button of your phone, and while keeping the vol-down button pressed, connect it to USB.

You will see your device as follows in device manager

View attachment 6043153
[Android Q&A, Help & Troubleshooting] Misadique:
I was able to do it. What now?

I was able to do it. What now?

View attachment 6043156
[Android Q&A, Help & Troubleshooting] mvikrant97:
Your phone has Unisoc T606 and its bootloader can be unlocked using the software called Unlock Tool.

I have license to use the tool and I help users on XDA remotely with their devices.

However I cannot login into the software because it has login limit on the usage per day. If you can allow me for a

remote session then I can help you tomorrow to Unlock bootloader on your device.

View attachment 6043159
[Android Q&A, Help & Troubleshooting] Misadique:
I found credentials online and logged in. What do I need to do now?
[Android Q&A, Help & Troubleshooting] mvikrant97:
Can you share the screenshot of the tool?
[Android Q&A, Help & Troubleshooting] Misadique:
View attachment 6043171
[Android Q&A, Help & Troubleshooting] mvikrant97:
Click on Boot device and see if you can read and backup the phone partitions first.

Very important.
[Android Q&A, Help & Troubleshooting] Misadique:
I can't, because I would need to select my phone's model first, which is not available in the tool. There only is Power 7 S and Power 7 Max.
[Android Q&A, Help & Troubleshooting] mvikrant97:
See if you can use the Generic one.

I warn you to backup the firmware first or you will brick the device.
[Android Q&A, Help & Troubleshooting] Misadique:
View attachment 6043203View attachment 6043207I tried both the normal and V2 versions and the handshake failed.
[Android Q&A, Help & Troubleshooting] mvikrant97:
Can you Right click on any of the Partition list like FDL, FDL2 and see if you readback and store files somewhere on your PC?

Or else see if you can readback firmware using SPD Research Tool
[Android Q&A, Help & Troubleshooting] mvikrant97:
I think you used the two of the below loaders, isn't it?

View attachment 6043209
[Android Q&A, Help & Troubleshooting] Misadique:
Those are from the firmware file I already have, I downloaded from UMIDIGI's website
[Android Q&A, Help & Troubleshooting] mvikrant97:
Umidigi Power 7 Firmware

GLOBAL

EEA
[Android Q&A, Help & Troubleshooting] Misadique:
I tried both, yeah
[Android Q&A, Help & Troubleshooting] mvikrant97:
Okay try to backup all of your phone's partitions using the SPD Research Tool First.
[Android Q&A, Help & Troubleshooting] Misadique:
It's stuck on downloading. I'm gonna try the global pac.
[Android Q&A, Help & Troubleshooting] mvikrant97:
Use this version of >> SPD Flash Tool
[Android Q&A, Help & Troubleshooting] Misadique:
Thanks for all the help, but I'm gonna give up on unlock my phone's bootloader. It seems like it just doesn't want to.
[Xiaomi Poco F4 (Munch) / Redmi K40S] LittleChest:
PixelReloaded for POCO F4/Redmi K40S [munch]​

What is this?

PixelReloaded is a CLO based ROM, with Google apps included and all Pixel goodies (launcher, wallpapers, icons, fonts, boot animation)

Based on PixelExperience

Whats working?

Wi-Fi

RIL

Mobile data

GPS

Camera

Flashlight

Camcorder

Bluetooth

FM radio

Fingerprint reader

Face unlock

NFC

Lights

Sound/vibration

Known issues

Offline charging images are lost

You tell me

DON'T FLASH GAPPS, THEY'RE ALREADY INCLUDED

Download

Donate

Patreon

Afdian(爱发电)

Stay tuned

My Telegram group​

Android OS version: 13

Security patch level: November 2023

Build author/Device maintainer: LittleChest

Source code: https://github.com/OctopusROM

Kernel source: Oxygen+ 4.19.301

Original PixelReloaded developer: Swamoy

PixelExperience developer: jhenrique09
[Xiaomi Poco F4 (Munch) / Redmi K40S] LittleChest:
December Update!

• Change the kernel to Oxygen+ 4.19.301

• Add back 90Hz refresh rate

• Update CLO version

• Other detail changes