yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy S22 Ultra] iceepyon:
That is strange... my Fold 3 is running on OneUI6 with all the latest patches and app updates install. While the Samsung email app is slot to show notifications for incoming emails, I have always gotten email notifications sent to my inbox.
[Samsung Galaxy S22 Ultra] bts3:
Yes really strange. Hope that will see some improvement in near future.
[Samsung Galaxy S22 Ultra] bts3:
Finally waiting for UI 6.1
[Samsung Galaxy S22 Ultra] bts3:
Just updated (in Europe) the Samsung email app to version 6.1.91.13.

I am testing it. In a few days I will post here about it.
[Samsung Galaxy S22 Ultra] bts3:
Until now it is working properly. Probably they fix it for Android 14, as of the picture below

The previous version was up to Android 13 as for the picture below
[Samsung Galaxy S22 Ultra] bts3:
Still working flawlessly.
[Android Q&A, Help & Troubleshooting] prosto1995:
IF YOU HELP ME GETTITG IT DONE I WILL PAY YOU 10 POUMD ON 21.03.2024 AS I GOT MY

Hi guys I hope to get help with mine HUAWAY L6 Model ATU-l11

1. I wish it would be mod ROM ,

the lightest . and possibly not trackceble.

Im ready to Pay if You fix all above.

I got Money Help Me fix and ill send 10 pound

2. It says Sim service provider

. SERIAL NUMBER
[Touch HD General] willwmj:
Good day, i could not search any guide or linkage about SD Config Tool.

i want to use it, would anyone pls give me a hand?

thanks much and happy new year.
[Touch HD General] 2unique:
do you mean this

http://xdaforums.com/showthread.php?t=418151

?
[Touch HD General] willwmj:
i think no..

the tool that has the SDConfig.txt on microSD card and and auto install the CAB files into PPC or storage card.
[Touch HD General] papimuzo:
Perhaps you could have a look at

http://xdaforums.com/showthread.php?t=366337

which describe the principe of use memory card to tune the flashing of a ROM.

HTH. Happy new Year.
[Google Camera Mods] Dayuser:
SGCAM_8.5.300.XX.10_STABLE_V9​

Changelog:​

What's new!

- Added ability to save and load all types of files *except saving photos in sd card*. Option is available on advance options settings.

- Added aux buttons visibility, zoom values, buttons name individually for front and back. Enable "camera.advance_lens_detector_front" from developer settings for getting auto lens detection for the front cam. I disabled it by default to avoid an uncertain crash of a few devices.

- Shortcut to *INDIVIDUAL* lens profiles (for both rear and front) updated. By *Press and Holding* AUX, you will go to *Individual* Settings of the Lens item (for both rear and front).

- Custom Noise Model upload for individual AUX, and populating NM Values added. When you load the Custom Noise model, and select it, and restart the app, you will see NM Values populated as per the Noise Model. The same noise model Values will get saved in XML. No need to share Custom Noise models anymore.

- Added .cube lut file support. Cube file parsing codes taken from agc toolkit. Thanks @bigkaka.

- Added zoom value with shortcut preference screen's name.

- Fixed previously reported many bugs.

Notes:

- Clean installation is better than dirty installation.

Shamim: SGCAM_8.5.300.XX.10_STABLE_V9

Download SGCAM_8.5.300.XX.10_STABLE_V9 by Shamim.

www.celsoazevedo.com
[Google Camera Mods] Dayuser:
SGCAM_8.5.300.XX.10_STABLE_V10​

Changelog:​

What's new!

- Now stabilization will work as sgcam 8.4.400. Now no black vf on video mode if you enable focus tracking.

- Added default zoom value.

- Fixed portrait default zoom.

- Added new icons for all preferences.

- Optimized curve settings.

Notes:

- It's probably the final version based on gcam 8.5.300 if I don't notice any minor bugs. If anybody faces any issues with installation, just do clean installation.

Shamim: SGCAM_8.5.300.XX.10_STABLE_V10

Download SGCAM_8.5.300.XX.10_STABLE_V10 by Shamim.

www.celsoazevedo.com
[Google Camera Mods] Dayuser:
SGCAM_8.5.300.XX.10_STABLE_V11​

Changelog:​

What's new!

- Fixed xml can't load with enabling skip lens info switch.

- Fixed iso limit of libpatcher.

- Fixed logical lens error.

Shamim: SGCAM_8.5.300.XX.10_STABLE_V11

Download SGCAM_8.5.300.XX.10_STABLE_V11 by Shamim.

www.celsoazevedo.com
[Google Camera Mods] Dayuser:
SGCAM_8.5.300.XX.10_STABLE_V12​

Changelog:​

What's new!

- Fixed auto lens id detection after loading xml with skip lens switch.

- Fixed video related problem.

Shamim: SGCAM_8.5.300.XX.10_STABLE_V12

Download SGCAM_8.5.300.XX.10_STABLE_V12 by Shamim.

www.celsoazevedo.com
[LineageOS Questions & Answers] AE0S:
Hi Guys!

I installed Lineage OS 20 on my SM-T500 (Samsung Galaxy Tab A7 Wi-Fi).

I wanted to connect my USB Camera, but the application gives me an error message.

I uploaded the error in a photo.

Does anyone know how to fix It?
[Samsung Galaxy A40 Questions & Answers] J0ni:
my a40 has gone into a bootloop after doing nothing for a week, if i plug in the charger, it gets stuck on the powered by android logo and reboots eternally, none of the button combos work and it doesnt turn on without the charger plugged in, any ideas?
[Samsung Galaxy A40 Questions & Answers] bilatche:
In the order :

- First, I would try tu make a wipe via recovery (if the phone can reboot in recovery mode)

- Then, I would try to reflash the last rom via ODIN (if the phone can be started in DL mode)

- After, if it's a hardawre issue, it could be a component so...
[Android Software/Hacking General [Developers Only]] chiteroman:
Post about hacking TEE on Android devices.

I will post here some useful resources:

GitHub - chiteroman/Reprogram-TEE-on-Qualcomm-devices: Guide to reprogram the TEE on Qualcomm devices to fix lost attestation keys

Guide to reprogram the TEE on Qualcomm devices to fix lost attestation keys - chiteroman/Reprogram-TEE-on-Qualcomm-devices

github.com

GitHub - chiteroman/FrameworkPatch: Modify framework.jar to build on system level a valid certificate chain

Modify framework.jar to build on system level a valid certificate chain - chiteroman/FrameworkPatch

github.com

And leaked keyboxes.

Python/Python/keybox at master · zybpp/Python

Python learn. Contribute to zybpp/Python development by creating an account on GitHub.

github.com

Feel free to discuss here anything about bypassing Strong, build valid certificate chains and spoof a locked bootloader.

NOTE: Do not post your device model and NEVER show serial number of certificates.

Banned certificates go here: https://android.googleapis.com/attestation/status
[Android Software/Hacking General [Developers Only]] Renate:
In the old days, I simply resigned an entire system with my own keys.

There's a bunch of stuff here that I don't know, never looked into. Hacking framework.jar is easy, it's not signed. I even patch framework.jar without unzipping or baksmali.

That's very interesting. Are any of these certificates root certificates for Qualcomm Secure Boot? I have the SHA256 and SHA384 of many of these, but that listing is by MD5.

Edit: And by 20 hexit hash??? I guess that they chop off a leading zero? Here's the data, sorted by length and value:

Spoiler content hidden.
[Android Software/Hacking General [Developers Only]] chiteroman:
Wait, that means you can lock bootloader with custom boot.img because you can sign it with official keys ?

Key Attestation Demo use these to check it:

KeyAttestation/app/src/main/java/io/github/vvb2060/keyattestation/attestation/CertificateInfo.java at f11f4cc477e57bdb06b3a3e24362da6462d63696 · vvb2060/KeyAttestation

Contribute to vvb2060/KeyAttestation development by creating an account on GitHub.

github.com

KeyAttestation/app/src/main/java/io/github/vvb2060/keyattestation/attestation/RevocationList.java at f11f4cc477e57bdb06b3a3e24362da6462d63696 · vvb2060/KeyAttestation

Contribute to vvb2060/KeyAttestation development by creating an account on GitHub.

github.com
[Android Software/Hacking General [Developers Only]] Renate:
No, no, no! I wish.

I just mean that I have hashed all the root certificates of all the Firehose loaders that I can get my hands on.
[Android Software/Hacking General [Developers Only]] hex3l:
Just to post it here and maybe get some feedback, I am currently trying to obtain the same results without reprogramming the TEE. Therefore I am injecting the complete chain of trust and the leaf cert in a similar way as @chiteroman bootloader spoofer but directly in the framework.

I am aware that this may not completely work since "the guard" interacts also with other methods under the keystore class that with a not functioning tee may result in exceptions (a problem for later I suppose).

Also I have some doubts about correctly spoofing the leaf cert itself in the correct way as some entries under Authorization List may be checked against real values used by the real device/tee. I may be just overthinking since chiteroman managed to just reprogram the tee and obtain a valid result without modifying that list too much.

I would like some feedback in order to not completely fry a keybox later on :oops:
[Android Software/Hacking General [Developers Only]] Renate:
I haven't really looked into any of this stuff.

If cert chains are being checked in Java you can obviously defeat them there.

Android tells us in that link which certs have been compromised, but it doesn't tell us the private key or anything.

Also, it's hard to identify which certs they mean.

Certs can be used for many things. My main interest is those used for Qualcomm Secure Boot.
[Android Software/Hacking General [Developers Only]] Vision:
To following the FrameworkPatch method, must first to have followed the Reprogram-TEE-on-Qualcomm-devices ?

I think lot of us not try at first and little confused, the first step in guide to mod framework.jar to pass 3/3.

Because the other guide Reprogram-TEE-on-Qualcomm-devices say if give any error, and if is normal NOT follow this guide and my phone is all normal in Key Atte. app

With short words, must first we broke our TEE to continue the FrameworkPatch method ?
[Android Software/Hacking General [Developers Only]] Renate:
To mod framework.jar just requires root.

To mod framework-res.apk might require breaking APK signing checking or system resigning.
[Android Software/Hacking General [Developers Only]] hex3l:
The framework patch requires you to have the (EC / RSA) private keys of the keybox currently in your TEE in order to spoof the bootloader status within the leaf certificate. Without those I don't think that having a working tee makes any difference
[Android Software/Hacking General [Developers Only]] Vision:
Yeah i get your point, and if anyone have the (EC / RSA) private keys of the keybox but not from the same device and follow the method with FrameworkPatch and write it like the instructions say, only this is need it ? Because the first step say if we have a valid keybox and write it.

That mean reprogrammed TEE ?

TEE must be reprogrammed with a valid keybox.
[Android Software/Hacking General [Developers Only]] hex3l:
The framework patch is actually modifying the leaf certificate and signing it again from scratch with the private keys that you provide. Those private keys are actually backed by the TEE chain of trust.

Spoiler content hidden.

Therefore if you sign the leaf with keys that are not in chain, the whole chain of trust falls apart because you have signed it with something outside of that chain, therefore it would reveal tampering. As of my understanding, at least with the framework patch created by chiteroman, if you are not able to retrieve your current tee private keys (advanced stuff) the only way of making it work is reprogramming the TEE with a keybox that provides everything to you.

Anyway I did not create that patch and my explanation could be wrong 👍🏻
[Android Software/Hacking General [Developers Only]] Vision:
Thanks for the info, very usefull. I appreciate

Now all us waiting until someone do all the step and pass 3/3 and tell to everybody 😂🤣
[Android Software/Hacking General [Developers Only]] thubble:
Has anyone looked into how OnePlus (and possibly other) devices "break" TEE? There was some discussion in various issues in the GitHub repo (https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices), but unfortunately now that issues are disabled in that repo, all existing issue comments are now inaccessible.

If I recall correctly, the speculation was that when a OnePlus bootloader is unlocked, it doesn't delete the original attestation keys or return an "unlocked" response like some other devices. Instead, it returns some sort of error which causes a KeyStoreException with code "-10003" in the Key Attestation demo.

If true, this would mean that even if we replaced the key on a OnePlus device with a valid leaked one, it would still throw the same "-10003" error. So the only way to "fix" this would be to replace the keystore implementation, or somehow spoof the bootloader unlocked status to keystore/trustzone itself, which I assume would be difficult/impossible since there must be some sort of signing and verification.

EDIT: Looks like the github issues are viewable again. Discussion starts here: https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices/issues/1#issuecomment-1878476943
[Android Software/Hacking General [Developers Only]] Vision:
If this could happens with only a module and somehow only we must have a keybox.xml and add it in the folder module, like the PIF have now and read the pif.json
[Android Software/Hacking General [Developers Only]] Vision:
1 try stuck at MIUI logo 😂🤣

EDIT: Maybe i do it something wrong 😂🤣

if we have screenshot like this i add, very helpful to see exactly the steps

View attachment 6082401View attachment 6082402

View attachment 6082403View attachment 6082404View attachment 6082405
[Android Software/Hacking General [Developers Only]] Vision:
As i understand until now this with Framework.jar patch, we need first follow this guide https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices and broke our TEE and after this with framework.

In this way is pointless for noobs and for the users with 1 device.

If this could happens with only a module and somehow only we must have a valid keybox.xml and add it in the folder module, like the PIF have now and read the pif.json
[Android Software/Hacking General [Developers Only]] Vision:
Any news ? anyone found a super easy ways for all this ?

After study the excellent guide by @chiteroman
[Android Software/Hacking General [Developers Only]] Max-P:
By all means that code dump seems to be very experimental and a demonstration of how strong can be achieved rather than providing a complete module. This is the bare minimum to make it work and is known to work on a specific device.

It still needs research to emulate the keybox entirely in software before any work towards noob-friendliness. This would be trivial with LSPosed, probably not too hard in just Zygisk either since the changes are relatively small.

The problem is we need a good supply of keyboxes that aren't banned and you don't want noobs start wrecking their TEE without understanding what they're doing like so many are doing just throwing fingerprints at PIF without even understanding what they're doing, or what it does. And this implementation of it is probably fairly easy to detect with basic Java reflection, potentially feeding Google a list of private leaked keyboxes.

If you reprogram your TEE to try this, now even going back to stock and relocking bootloader won't give you strong, probably not even basic. You don't want anyone doing this at this stage unless they're 100% willing to risk permanently locking themselves out of Play Integrity at minimum.

There's no point trying this at this time unless you're researching how to make this work at larger scale.
[Android Software/Hacking General [Developers Only]] Vision:
Yeah exatcly, if all this can be done with only a module like PIF or via LSPosed, and somehow read the valid keybox from there and pass 3/3.

Then the only disadvantage would be to we have a valid keybox.xml
[Android Software/Hacking General [Developers Only]] adfree:
Hi.

I need help with Samsung... EM Token...

Older Firmwares of SM-A505.. contain DEVeloper Certificate...

EngineeringMode

Maybe also somewhere the Private Key...

But I am not smart enough...

Please, maybe someone could help.

Thanx in advance.

Best Regards
[Android Software/Hacking General [Developers Only]] Vision:
As I see, yes but still little confused me the update guide.

Especially this part with classesX, because above say different, compile all

View attachment 6107865
[Android Software/Hacking General [Developers Only]] Techno_Physics:
Is there any new keybox.xml which isn't banned yet?
[Android Software/Hacking General [Developers Only]] changhuapeng:
I've created a magisk module that implements FrameworkPatch. The module takes over all the decompiling, patching and recompiling, so all you have to do is to provide it with the classes.dex file that you've built from chiteroman's FrameworkPatch project using Android Studio.

The module zip does not contain the required classes.dex file. Please provide the file yourself!

This module is a little rough since I've initially written it for use myself but then decided to release it publicly:

GitHub - changhuapeng/FrameworkPatcherGO: A Magisk/KernelSU/APatch module to modify framework.jar directly on the phone, to build a valid system-level certificate chain.

A Magisk/KernelSU/APatch module to modify framework.jar directly on the phone, to build a valid system-level certificate chain. - changhuapeng/FrameworkPatcherGO

github.com
[Android Software/Hacking General [Developers Only]] Techno_Physics:
So we don't need fresh unbanned keybox.xml?
[Android Software/Hacking General [Developers Only]] Techno_Physics:
How does it works?
[Android Software/Hacking General [Developers Only]] Vision:
Still we need it, because say provide your classes.dex, this mean the keybox is inside in this classes.dex
[Android Software/Hacking General [Developers Only]] dekefake:
As Oneplus devices do not erase keys when bootloader gets unlocked, is there a way to retrieve the keybox from a rooted device, in order to forge the framework patch using the legitimate devices keys ? Does it at least makes sense ?
[Android Software/Hacking General [Developers Only]] Vision:
Short answer no, and in other devices the keys not erase, if you locked again the BL can pass.

View attachment 6108207
[Android Software/Hacking General [Developers Only]] Techno_Physics:
Bro how to find keybox.xml unbanned one?
[Android Software/Hacking General [Developers Only]] Vision:
Unfortunately, just you must be lucky to find a valid keybox, and like the PIF with FP, is most difficult to find it and rare.
[Android Software/Hacking General [Developers Only]] Techno_Physics:
I didn't get, it's not like you find it in any website or place there has to some which is still unknown? Help me out with that.??
[Android Software/Hacking General [Developers Only]] Vision:
Is possible on internet, but must know where to find it, and need luck, and to know users who will be able to help you.
[Android Software/Hacking General [Developers Only]] Techno_Physics:
Bruhh help me out.

With a little specific way where do I get it?

I don't where to find or goo?
[Android Software/Hacking General [Developers Only]] Techno_Physics:
Can u tell me details on dm?
[Android Software/Hacking General [Developers Only]] Techno_Physics:
Bro help me out tg @@Mechanic_AT
[Android Software/Hacking General [Developers Only]] Vision:
Me to, I don't know, only can Google it and if you lucky and found any, or users shared with you one.

EDIT: Please consider using the multi-quote function when responding to many posts in this thread.
[Android Software/Hacking General [Developers Only]] Vision:
Perfect.

All patch, expect the last part and give me error.

I checked inside and have this hasSystemFeature method, now why can't patch I don't know.

One question about this part, I don't know why can patch, but even and if can, can skip this part? Because @chiteroman say is optional.

View attachment 6108283View attachment 6108284

EDIT: After you fix it, if you can add a option like, if you want the patch for ApplicationPackageManager.smali press the Volume+ if not press Volume-
[Android Software/Hacking General [Developers Only]] Captain_Throwback:
I already opened an issue about this: https://github.com/changhuapeng/FrameworkPatcherGO/issues/1
[Android Software/Hacking General [Developers Only]] Vision:
Good to know.

Thanks.

I fix it for myself, by deleted all the line about ApplicationPackageManager.smali, from inside in the META-INF/com/google/android/magisk/customize.sh
[Android Software/Hacking General [Developers Only]] Captain_Throwback:
And is the patched framework working?
[Android Software/Hacking General [Developers Only]] Vision:
A11.

Yeah, i just checked it and say in Key attestation, BL is locked.

But still can't pass

Pass 0/3.

You pass? At least 2/3?
[Android Software/Hacking General [Developers Only]] Captain_Throwback:
Just got it working, but only have a revoked key, so just passing BASIC.

The only reason I would use this is so I wouldn't have to keep updating my wife's device when fingerprints die, but it seems that without a valid keybox, passing DEVICE is no longer possible. I was hoping to have a longer-term solution but it seems despite @changhuapeng making it much easier to patch the device framework, finding a valid leaked keybox will still be the main difficulty with using this solution.
[Android Software/Hacking General [Developers Only]] Captain_Throwback:
For the record, I'm not using the Sailfish stuff in the framework patch, because I was hoping to be able to pass DEVICE integrity with the actual device props from the target device. I will try a fresh installation using the Sailfish print with the revoked keybox and see if that (somehow) passes Device Integrity, just to know for sure.
[Android Software/Hacking General [Developers Only]] Vision:
That is good 👍

Oh yeah understand, I hope you find and keep up, without worrying if when with PIF a FP die.

Yeah this solution is amazing, only from the device, and android studio write the keybox.xml
[Android Software/Hacking General [Developers Only]] Vision:
Yeah, when you try it, tell me, because I use this.

If you can PM me now, to tell you something.

View attachment 6108350
[Android Software/Hacking General [Developers Only]] Vision:
I found a huge bug.

A11.

Kitsune Mask latest Stable.

Every apps I have in MagiskHide, crash with this method via Magisk module, but when remove it start normal but say about root.

Anyone else can confirm that?

EDIT: This bug is when dummy the boot-framework.art via Magisk module on A11.
[Android Software/Hacking General [Developers Only]] Captain_Throwback:
Only passes Basic with the Sailfish print and revoked keybox. Now to search for one of those elusive keyboxes...
[Android Software/Hacking General [Developers Only]] Vision:
Oh understand.

With the inside keybox.xml have already in frameworkpatch, what you get?
[Android Software/Hacking General [Developers Only]] Captain_Throwback:
That is the revoked keybox that I'm currently using.
[Android Software/Hacking General [Developers Only]] Vision:
Oh really? With this I can't pass.

And before some days, I checked and say keybox is valid.

Thanks for info.

EDIT: With the latest frameworkpatch and inside keybox.xml

View attachment 6108469
[Android Software/Hacking General [Developers Only]] Captain_Throwback:
@chiteroman I have some questions for you.

FrameworkPatch is currently set up to use a keybox with 2 certificates. What changes would be needed to accommodate one with 3 certificates? Would the smali edits be the same, and only the Android class would need to be updated to allow for a 3rd certificate?

If using a Strongbox keybox, would the Application PackageManager hook then be required?