yashsingh1/xdaforums huggingface dataset:
[Paid Software Announcement and Discussion] vidmabal:
Security questions

I have obtained license a month and two days ago.. But software seemed to be useless (version 1.15 or so). No settings were kept after soft reset, and even I was not able to restore saved configuration - even directly after saving it.

Today I have installed 1.18a. It seems to be working on x7501. But before starting test process (and of course before trying to burn it into ROM) I have some security related questions:

1. SMS message format "#KEY#COMMAND1#COMMAND2…" assumes real unlock key in plain text. Imagine situation, that thief inserts own card into stolen phone. Phone is "locked" or other vice "not fully functional". Of course I have SMS with phone number received. Thief removes SIM and reinstalls back to his phone. When I'm sending SMS - unlock key is received in plain text by intruder.

Maybe it's possible to have two configured keys: one for unlock, and other, if specified (does not broke old approach) for SMS messages?

2. It's too easy to remove CLS0: (clocksvc.dll) form services. You have done some work to keep it working, but next scenario works:

a) Opening HKLM/Services/CLOCKSVC branch with RESCO registry editor

b) Rename Dll entry from "clocksvc.dll" to "clocksvc1.dll"

c) Do Menu/Edit/Refresh - if you see clocksvc1.dll - do soft reset by PRESING RESET KEY.

There is some time delay you are restoring key. Intruder can fit into it. Maybe some "callback" on registry change can be used?

3. Alternately you can go with Resco Explorer into /Windows folder and rename clocksvc.dll to say clocksvc_.dll. And do soft reset. If you are not using "Resco" - "Total Commander" will do the same. In this case you can even not use "hard software reset button": simple restart will do. More: front-page CrimstonLock application will not start here: "fatal.. reinstall..." (in case 2 it had fixed registry and restarted service).

I think cases 2 and 3 can be done with even blocked original SIM card.

There are some more issues that I could mention (but the letter is allready too long...)
[Paid Software Announcement and Discussion] TrashKalmar:
vidmabal, thanks for your considerations!

Good idea, I'll think about this.

Already working on more solid protection.

OK, write your long letter to my e-mail: support@pocketimps.com.
[Paid Software Announcement and Discussion] TrashKalmar:
Update to 1.19

OK, let me open the secret. Now, there is a new feature in the program. If you do not flash it into ROM, you can export the package to your storage card. When you reinsert the card, this package autoruns and place Crimson Lock with your settings to device. So, if the thief performs a hardreset, and then reinserts card, the program should return...

Thanx to vidmabal's remarks, the self-protection was extremely improved. Try to expel the program!
[Paid Software Announcement and Discussion] bernabap:
TrashKalmar could you help me?

I installed the new version v1.19 and only added my other cell phone as a trusted number and register my sim card. Done that, I switched my mobile off and swapped for another sim card that was not registered and then I saw that your application was missing from my cellphone, I thought it was something planned by you, since this sim card was not registered should not even see your application! But after returning to my sim card registered also can not see your application!

Maybe I've done something wrong? :confused: You know what might be happening?

Thanks man
[Paid Software Announcement and Discussion] TrashKalmar:
Yes, this is planned. The isolation was invoked (scenario "Enemy SIM found" has run): actually, the program is working now, but the settings shell was removed. Run setup cab again and it will return the settings program. Then check Scripts page in the program.

Please, let me know, if this helps.
[Paid Software Announcement and Discussion] bernabap:
I tried it but I can not install again. I get this message:

"PocktImps CrimsonLock" can not be installed.

thanks for help

EDIT: managed to install again after removing the clocksvc.dll from services. So I tried to do this with the sim card that was not registered and locked my task manager! I returned with my registered sim card and again had to remove the clockvc.dll from services and this time my task manager has almost hang, took a while to come back.

It's normal I always have to remove the clockvc.dll to install again?
[Paid Software Announcement and Discussion] TrashKalmar:
Try to do softreset before install.
[Paid Software Announcement and Discussion] bernabap:
I just edited my previous post, please take a look!
[Paid Software Announcement and Discussion] TrashKalmar:
bernabap, you can remove "isolation" item in Scripts page at "Unknown SIM card inserted" event. Then the settings will not be removed, when you insert enemy SIM.

Why don't you remove Crimson Lock with system uninstaller?
[Paid Software Announcement and Discussion] bernabap:
I do not think you understand me! :(

What I want is to test your application, and all functions that you say it works!

So I started with the basics: just registering my "Own SIM card and registering my other phone as" Trusted phone number. "

From what I understand, once you do that by putting a SIM card not registered Crimson Lock should activate the event "Unknown SIM card inserted" and perform the actions:

1-Isolate

2-Enable control program

3-Send SMS about this event

4-Show information about owner

1-Isolate: should delete the user interface of the Crimson Lock, but on my device only deletes the icon of the Crimson Lock if is inside "Programs" folder, if is in a subdirectory is not deleted! However it is not possible to open it.

2-Enable program control: as I have not added any programs did nothing.

3-Send SMS about this event:

I did not receive any messages!

4-Show information about owner:

I got nothing too!

After checking this, I tried to send some commands from my "Trusted phone number" to see if at least the controls were working. I tested the following:

#0000#help#status -> OK, I received two messages, one with basic commands and another with status. It worked.

#0000#lock -> received a message: "Registration required". Your pdf does not say that!

After that I decided to test the commands from my sister phone, who was NOT listed as "Trusted phone number" and to my surprise the commands worked!?!? Clearly something is wrong!

I sent a softreset from my sisters phone:

#0000#softreset

after restart my phone I received two messages on my other phone that was registered as "Trusted phone number" saying the following:

1a "CL@E05: Registration required"

2a "CL@A04: SIM-card: IMEI: xxxxxxxxxxxxx, IMSI: XXXXXXXXXXXXXXXXX, ICCID: XXXXXXXXXXXXXXXXX. (The x is just to hide my information)

restarted my phone again (second time) and just received one message in my "Trusted phone number":

"CL@A04: SIM-card: ...." (As above)

from the second softreset always get this same message in my "Trusted phone number" with information from the "Unknown SIM card.

NOTE: After doing all this, I uninstalled Crimson Lock with SKtools, removed everything and installed again! Repeat ALL the steps and got EXACTLY the same results.

CONCLUSION:

* I never get the number of "Unknown SIM card" inserted. If I do not know the number how I will send the commands?

* Also did not get none of the owner information!

* After the "Isolation" was activated the only way to recover CrimsonLock's icon and settings is removing clockcv.dll from services and installing again.

I did not understand why you asked me:

"Why do not you remove Crimson Lock with system uninstaller?

What I wanted was to recover the icon of the Crimson Lock and open it. Why would I use the system uninstaller? And after the "Isolation" was activated Crimson Lock does not appear in the system uninstaller, even with my "Owner SIM card" inserted, so I do not understand why you asked that!

As you can see I spent a while trying to test your application, if you can help me get to work I'll be here!
[Paid Software Announcement and Discussion] TrashKalmar:
bernabap, thanx for tests! OK, let me comment your letter.

1-Isolate: should delete the user interface of the Crimson Lock, but on my device only deletes the icon of the Crimson Lock if is inside "Programs" folder, if is in a subdirectory is not deleted! However it is not possible to open it.

Yes, icon from top-level folder is removed only.

3-Send SMS about this event:

I did not receive any messages!

CL@A04: SIM-card: IMEI... - here is message.

4-Show information about owner:

I got nothing too!

It requires registration. And this is stated in PDF.

#0000#lock -> received a message: "Registration required". Your pdf does not say that!

OK, my miss about PDF.

after restart my phone I received two messages on my other phone that was registered as "Trusted phone number" saying the following:

1a "CL@E05: Registration required"

2a "CL@A04: SIM-card: IMEI: xxxxxxxxxxxxx, IMSI: XXXXXXXXXXXXXXXXX, ICCID: XXXXXXXXXXXXXXXXX. (The x is just to hide my information)

All right. This is a reaction on softreset, that by default is to show an embedded data (which is locked in unlicensed copy). The second message is a result of "Unknown SIM card inserted" event.

I never get the number of "Unknown SIM card" inserted. If I do not know the number how I will send the commands?

Did you see the sender of this message? This is needed number :)

* Also did not get none of the owner information!

As I've said, this is allowed in licensed copy only (stated in PDF). You might see a notice on "Embedded info" page.

* After the "Isolation" was activated the only way to recover CrimsonLock's icon and settings is removing clockcv.dll from services and installing again.

The right way is to run CAB again to restore it without uninstall.
[Paid Software Announcement and Discussion] bernabap:
Thanks for the answers!

I did some more tests today:

Added a few programs in the list of applications and have two considerations to make it:

First Loudtalks (http://xdaforums.com/showthread.php?t=480708), instead of open and close like all other applications I tested it crashes my phone and I have to reset. This always happens when I try to open it. Actually is not a problem, after all the "thief" will not be able to open it.

I noticed that has a delay to Crimson Lock close a program that is controlled from the application list. It takes from 2 to 3 seconds to close the application. In every application I tested this delay does not hurt anything, in fact the applications even have time to open! But I use the "Haret" to start my Android installed on my SDcard and Haret starts very fast. In less than half a second, leaving about 2 seconds for the "thief" click "RUN" and start my Android, silencing your application completely!

Doubts:

* I can not format my Storage Card, I tried the following:

#0000#hwid -> to get Aplication Code

#0000#formatstg:12345adcbe -> put here the code received by the previous command (hwid), is that right? It did not work, I tried to send this command two times and also checked the code to see if it was correct. I do not know if have something to do but my SD card is partitioned, it may be influencing the error?

* Could not format my sd card but let's say I had succeeded, the "Package for Storage card" it would be erased too?

Some suggestions:

* An option to include the command and receive confirmation only for those commands. Because if I enable the advanced settings the option to send the confirmation to all commands, probably the "thief" will quickly run out of money to send new messages. If you can add this option will help a lot, just receive confirmation when we want!

Example:

#0000#confirm#command

* Someone has already suggested to you the option to receive the contacts, but you said that the contact list of would be too large for one message only. You could do in a way that the contacts were broken.

Exemple:

#0000#contactsAD -> sends message to all contacts from A to D

#0000#contacsEH -> from E to F

and so on ...

I think the option to receive the contacts of the "thief" is essential.

Thanks man for patience!
[Paid Software Announcement and Discussion] drellisdee:
Is this app cdma compatible? I tried it on my whitestone which is a cdma/gsm hybrid but only use it in cdma mode. The commands worked but the sms out would get caught as a send error and won't send out the response.
[Paid Software Announcement and Discussion] TrashKalmar:
Loudtalks, instead of open and close like all other applications I tested it crashes my phone and I have to reset.

There are may be many reasons to crash, including touching some critical system resources, and because of violation, it may lead to crash. I'm agree, its not a problem on device loss :)

I noticed that has a delay to Crimson Lock close a program that is controlled from the application list. It takes from 2 to 3 seconds to close the application.

If it would be shorter timeout, it'll be too CPU/power consuming. I guess, that if you terminate Haret on the middle, it crash your phone.

* I can not format my Storage Card, I tried the following:

#0000#hwid -> to get Aplication Code

#0000#formatstg:12345adcbe -> put here the code received by the previous command (hwid), is that right?

Right. I think, partitioning might be the problem.

* Could not format my sd card but let's say I had succeeded, the "Package for Storage card" it would be erased too?

Of course. There is undocumented yet command that forces placing autorun on SD card. I'll say it later, because now it is untested enough.

#0000#confirm#command

#0000#contactsAD -> sends message to all contacts from A to D

#0000#contacsEH -> from E to F

Good ideas, thank you!

drellisdee

There were tests on CDMA devices, and it has worked. Please, describe your problem more detailed.
[Paid Software Announcement and Discussion] martinezlivan:
start setup

I installed the app and asked to select sim... didn't setup an unlock key before that and now its asking for one when i go back into the app. any default password it may have assigned so i can go back into the app? please help... thanks.
[Paid Software Announcement and Discussion] Phrak:
The 1st post states: "Default unlock key: 0000"
[Paid Software Announcement and Discussion] Spl4tt:
used "dont steal my phone" till now.. but crimson lock looks amazing, will try this now =D
[Paid Software Announcement and Discussion] sovereignty:
I did a search in this thread and didn't see anyone mention this, so I thought I would bring it up.

One flaw of this program is it will not work if the "Enemy" SIM card inserted has sms disabled in it's associated mobile plan. I just installed Crimson Lock for the first time, and remember just afterwards that I had put a block on messaging a couple months back due to spammers. I just now called and got the block taken off so I can test the app.

Think about the scenario: Thief inserts their sim card. Thief's mobile plan has messaging blocked. The device locks so the thief can not use it, BUT, the phone's owner will not be able to interact with the phone via SMS.

Here's what I suggest, but I don't know if it is possible (maybe it has already been thought of, but I don't know): Include some voice recognition drivers that would allow one to call the phone and say some key words to perform the functions. Also, there would need to be an option to force answering the call from a trusted number. This may not be possible at all. I don't know if one can access the voice data before it makes it to the speaker. But if it can be accessed this would be a solution for the problem...

I admit, this may be overkill, because the likelihood of the thief having messaging blocked is slim. But, if he/she is familiar with this type of anti-theft system, he/she could call their carrier, block sms before inserting their sim card, and render Crimson Lock only partially functional.

Regards
[Paid Software Announcement and Discussion] sovereignty:
Ooooh Boy :confused:

I just test gpsget from my google voice account. It worked and I got a message back with the coordinates. But...a few seconds later my phone received that same message from a number that I do not know. What in the world is that? Kind of scary. I don't know if somebody else got my cell phone number along with the gps coordinate also!

EDIT: Just tested again and the same number sent the message back to my phone again, so it's not random.
[Paid Software Announcement and Discussion] TrashKalmar:
sovereignty, thanks for your considerations. The thief blocks SMS for his plan? OK, lets call him, and Crimson Lock will accept the call from trusted number (if configured). Thief blocks calls? So, what does he need this PDA for?

I do know nobody, who blocks his SMS ability, this is unpopular, mey be in Russia only :)

Voice recognition is too much for PDA. I think, it would be interesting to set tap points on the picture in order to unlock the phone. This is for future releases.

About alien number. Crimson Lock does not send messages to anybody except trusted numbers or as a response from another number (send by you or anybody else, who knows your CrimsonLock's key).
[Paid Software Announcement and Discussion] sovereignty:
1) Voice recognition is already available in many PPC/Smartphone apps. I have experience coding voice recognition. With the small amount of commands that the spoken words needs to be compared, there would be very little load on the cpu. The problem resides in how to tap into the data being sent to the speaker in order to analyze. Like I said, it is probably too much work to enable a feature like this.

2) Tap points is a good idea so long as the user selects a good pattern. Probably there should be a minimum number of tap points the user has to select to have good security.

3) It may have something to do with google voice, but the number that the message came from is completely from a different area code than my google voice number. I tested by sending myself a gpsget message from the same phone as crimson lock is installed and I did not get that weird number sending a text back.

Where is it located in the application to tell it to send gps coordinated with a link to google maps? Right now I am only getting coordinates. Is that only available with a licensed version? I want to be able to thoroughly test this app.
[Paid Software Announcement and Discussion] sovereignty:
Please update your download link on the first page of this thread. I downloaded that one first, but I now noticed that it gave me 1.19 instead of 1.19a.

I downloaded 1.19a from your website and will try that one now...
[Paid Software Announcement and Discussion] sovereignty:
Possible bug found...I am running a Tilt 2 (Rhodium) with the latest Energy ROM (May 28) with CHT. I don't believe it has anything to do with the custom ROM. When I try to send the command #0000#call:phonenumber from another phone, my phone receives the command, but something happens and the phone beeps as if the cell phone towers are busy or the call can not be completed. The call never goes through. I'm assuming that you have coded to mask the number and show "Unknown" in the call history because that is all I see in the call history. The phone screen comes up with the keypad, but the call can not go through.

FYI, if you don't see on my recent post, I am running 1.19a
[Paid Software Announcement and Discussion] EgoMaximus:
Is there any way to check what version I am running? Can't find about window.
[Paid Software Announcement and Discussion] sovereignty:
go to menu>about
[Paid Software Announcement and Discussion] tsgan86:
lets say someone stole the phone and put in a new sim card, if there a way to know the new sim card number? we can track the thief name with the number.
[Paid Software Announcement and Discussion] TrashKalmar:
There is a script in the program, that runs when `enemy` SIM inserted. In this script you can add a command to send info about this SIM card. Alone with phone number (SMS sender's number) you'll obtain IMSI and ICCID of new SIM card.
[Paid Software Announcement and Discussion] loaferkan:
Okay, I have HD2, and I live in the States, I have blocked my SMS first I don't want SMS and 2nd it's too expensive.....How do I flash this into a RoM?
[Paid Software Announcement and Discussion] dentalguru:
Problem Help

hi

I am novice to the PPC world and installed the application without sending a sms and now i get a white screen or the windows will not start up beyond the start up screen, NO harware button is working...??

Using HTC touch diamond CDMA,

MIK ROM- Windows 6.5

THANKING IN ANTICIPATION

DENTALGURU
[Paid Software Announcement and Discussion] TrashKalmar:
For now you can interact with PDA with Crimson Lock via SMS. In future I'll add e-mail ability.

Please, check your e-mail. I've sent an answer.
[Paid Software Announcement and Discussion] §venn:
I've locked my phone for a test. Now when i'm trying to unlock it, i give te code "0000" and press unlock. At that point the phone doesn't react anymore. Any solution?

I'm using the newest version 1.19

Edit: It does react, but the lockscreen stays active. I can only see the screen where i have to unlock the device.
[Paid Software Announcement and Discussion] §venn:
I was able to fix it by sending a SMS from my Friends phone with the text "#0000#unlock".

Or am I not able to unlock the device through the code on the device itself?
[Paid Software Announcement and Discussion] chrisnz1947:
I have been testing this and attempted to install 1.19a (already have 1.18 installed)

get a message that ' Fatal Error incompatable version of protection module was found use appropriate installation package'

using Crimsonlock.en.cab.

I am intersted in purchasing this product but obviously need to be able to install new versions without errors.
[Paid Software Announcement and Discussion] sovereignty:
i had this problem. Did you download via the link in the first post of tbis thread or his website? I'm on my mobile so I didn't check it again, but last week the link to download in this thread was still pointing to 1.19 instead of 1.19a. 1.19 is known to freeze at many points. Go to menu-about and check your version. Try downloading from the website instead. I put in a request last week for him to update the first thread, but I don't know if it has been done.

EDIT: And you probably will have to pull your battery to soft-reset
[Paid Software Announcement and Discussion] sovereignty:
Hoping to get a response about these... If you haven't figured out the bug in my last quote, at least say you are looking into it. This app has a lot of potential, but we need some faster answers if you want this to be a paid-for app :)
[Paid Software Announcement and Discussion] TrashKalmar:
Sorry for delay.

§venn, I confirm the problem. Please, try 1.19a from of.site. Now, I looking for the solution. When it'd be solved, I immediately update the program.

First uninstall old version via system uninstaller. Then install new one.

Sorry, I was busy a little. Already working on described problems.
[Paid Software Announcement and Discussion] sovereignty:
Quote from first post: "(*) Four formats of coordinates, including URL to Google Maps."

Could you please tell me what I need to do to get the gpsget function to send a link to google maps instead of just the coordinates?
[Paid Software Announcement and Discussion] TrashKalmar:
In Advanced Settings in "GPS setup" group set "Data format" option to "Google Maps link". And you'll receive URL instead of just coordinates.
[Paid Software Announcement and Discussion] sovereignty:
Ok, found it. I had to change "Connection" setting to "custom" before it would allow me to edit the data format. Then I changed it back to "System setting". Will test now...

Thanks

UPDATE: Google maps link works. Now that is just freakin' cool
[Paid Software Announcement and Discussion] TrashKalmar:
Update to 1.19c

Crimson Lock was updated to version 1.19c.

Main change: fixed crash on unlocking the device. Please, update, if you experience such trouble.