Database Info

[Q] hacking the adb connection

Hello,
I am trying to use KillingInTheNameOf (on a compatible device) to write the
service.adb.tcp.port 5555
property. Then I try to restart adbd by killing it such that it will bind to 5555.
Then, my aim is to connect to this from code running on the device itself.
1. Is this possible?
2. I manage to write the property (I know this by listing the contents of the memory area in KillingInTheNameOf itself), but getprop returns blank.
http://pastebin.com/uC9HQYe6
-Earlence

updates
update. I managed to insert the new property at the end of the list. nothing crashes. iterating thru the shared mem, lists the new property at the end, but getprop returns a blank.
This is the relevant parts of the code
void create_new_prop(char *name, char *value, struct prop_area *pa, struct prop_info *pi)
{
int namelen = strlen(name);
int valuelen = strlen(value);
int pa_count = pa->count;
while(pa_count--)
++pi;
printf("pi addr: %x\n", pi);
memcpy(pi->name, name, namelen + 1);
memcpy(pi->value, value, valuelen + 1);
pa->toc[pa->count] = (namelen << 24) | (((unsigned) pi) - ((unsigned) pa));
pa->count++;
}
-Earlence

more updates
IT seems that property_change has to be fired for any property to "take effect". (no wonder the KillingInTheNameOf exploit kills adb and restarts it).
Anyone have ideas on how to trick an execution of "property_change" ?
-Earlence

[Q] Error getting cellid

I am trying to get the cellid from a windows phone 7 program and the code I am using gives me an error when I call the RIL_Initialize function. The code it the standard c# that I have found in several places that everyone seems to be using.
When I try to run this code, I get an exception on the RIL_Initialize.
{"Attempt to access the method failed: CellInfo.RIL.RIL_Initialize(System.UInt32, CellInfo.RIL+RILRESULTCALLBACK, CellInfo.RIL+RILNOTIFYCALLBACK, System.UInt32, System.UInt32, System.IntPtr&)"}
Code:
public static string GetCellTowerInfo()
{
// initialise handles
IntPtr hRil = IntPtr.Zero;
IntPtr hRes = IntPtr.Zero;
// initialise result
celltowerinfo = "";
// initialise RIL
hRes = RIL_Initialize(1, // RIL port 1
new RILRESULTCALLBACK(rilResultCallback), // function to call with result
null, // function to call with notify
0, // classes of notification to enable
0, // RIL parameters
out hRil); // RIL handle returned
....etc.

[Q] Can someone tell me if my adb settings are wrong on phone?

Iv'e tried as many solutions to my problem, as I can find, but still have no adb interface. I have a huawei ascend M860(I know it's old), It's rooted, rom'ed with Playfulgod's CM7.2 rom, and the dalvik was moved to the sdcard. Before I installed this rom, I replaced ADW launcher, with GoLauncher(winzip). I like his rom, except for one thing, since I replaced it from cm6, my adb isn't working. I changed the rom back to cm6, and it started working again, put cm7 back, same problem. Today, I looked into my adbd file, and found alot of errors, and my block file, said I had so many bad blocks, I lost count! This is the end of my adbd file:
ro.debuggable service.adb.root Local port disabled
service.adb.tcp.port persist.adb.tcp.port %d /dev/android_adb OK
failed to allocate an apacket Calling send_connect
host %s:: Calling send_ready
Calling send_close
handle_packet() %d
Enqueue the socket
handle_packet: what is %08x?!
all adb sockets packets rwx usb sync sysdeps transport jdwp %s: select missing fde for fd %d
fd out of range (%d)
fd_table out of sync fde %p not created by fdevent_create()
bogus negative fd (%d)
bogus huuuuge fd (%d)
could not expand fd_table to %d entries
check_header(): invalid magic
check_header(): %d > MAX_PAYLOAD
unknown run_transport_disconnects: %p (%s)
%02x writex: %d %p %d: writex: %d %d %s
writex: %d ok
transport_write_action: on fd %d, error %d: %s
write_packet: %d [%08x %s] %08x %08x (%d) write_packet: %d error %d %d
readx: %d %p %d
readx: %d %d %s
readx: %d ok: transport_read_action: on fd %d, error %d: %s
read_packet: %d error %d %d
read_packet: %d ok: [%08x %s] %08x %08x (%d) transport: %p registered
cannot write transport registration socket
transport: %p init'ing for usb_handle %p (sn='%s')
transport: %p removed
transport: %p R- (ref=%d)
transport: %p kicking and closing
Transport is null Transport is null
cannot enqueue packet on transport socket transport: %p init'ing for socket %d, on port %d
device not found insufficient permissions for device more than one device more than one emulator more than one device and emulator device offline invalid device state cannot open transport registration socketpair cannot read transport registration socket transport: %p removing and free'ing %d
cannot open transport socketpair transport: %p (%d,%d) starting
transport: %p install %d
cannot create input thread cannot create output thread from_remote: starting thread for transport %p, on fd %d
from_remote: transport %p SYNC online (%d)
from_remote: failed to write SYNC apacket to transport %p from_remote: data pump for transport %p
from_remote: received remote packet, sending to transport %p
from_remote: failed to write apacket to transport %p from_remote: remote read failed for transport %p
from_remote: SYNC offline for transport %p
from_remote: thread is exiting for transport %p
to_remote: starting input_thread for %p, reading from fd %d
to_remote: failed to read apacket from transport %p on fd %d
to_remote: transport %p SYNC offline
to_remote: transport %p SYNC online
to_remote: trandport %p ignoring SYNC %d != %d
to_remote: transport %p got packet, sending to remote
to_remote: transport %p ignoring packet while offline
to_remote: thread is exiting for transport %p, fd %d
failed to read packet from transport socket on fd %d
remote local: write terminated
remote local: read terminated (message)
bad header: terminated (data)
remote local: terminated (data)
bad data: terminated (data)
server client transport: local %s init
cannot create local socket %s thread transport: server_socket_thread() starting
server: cannot bind socket yet
server: trying to get new connection from %d
server: new connection on fd %d
host client: connected on remote on fd %d
%s%d emulator- transport: usb
remote usb: 1 - write terminated
remote usb: 2 - write terminated
remote usb: read terminated (message)
remote usb: check_header failed
remote usb: terminated (data)
remote usb: check_data failed
Creating smart socket
cannot allocate socket SS(%d): created %p
Connecting to smart socket
SS(%d): ready
SS(%d): closed
LS(%d): discarding %d bytes
LS(%d): closed
LS(%d): closing
OKAY Connect_to_remote call
destination oversized LS(%d): connect('%s')
Calling remote_socket_ready
Calling remote_socket_enqueue
RS(%d): created
remote_socket_disconnect RS(%d)
Calling remote_socket_close
RS(%d): closed
LS(%d): created (fd=%d)
jdwp track-jdwp LS(%d): bound to '%s'
LS(%d): enqueue %d
LS(%d): not ready, errno=%d: %s
FAIL%04x SS(%d): enqueue %d
SS(%d): overflow
SS(%d): bad size (%d)
SS(%d): len is %d
SS(%d): waiting for %d more bytes
SS(%d): '%s'
unknown failure device offline (x) closed cannot create service socket pair cannot allocate stinfo cannot create service thread service thread started, %d:%d
invalid port
%d service.adb.tcp.port restarting in TCP mode port: %d
EXTERNAL_STORAGE /system/bin/vdc volume unmount force reboot failed: %s
0 restarting in USB mode
/tmp/update FAIL /tmp/update.begin OKAY adbd is already running as root
ro.debuggable 1 adbd cannot run as root in production builds
service.adb.root restarting adbd as root
/dev/ptmx [ cannot open /dev/ptmx - %s ]
[ trouble with /dev/ptmx - %s ]
- fork failed: %s -
- exec '%s' failed: %s (%d) -
/proc/%d/oom_adj adb: unable to open %s
tcp: local: localreserved: localabstract: localfilesystem: dev: framebuffer: recover: jdwp: log: shell: /sbin/sh -c /system/bin/sh - sync: remount: reboot: root: tcpip: usb: sync: failure: %s
mkdir("%s") -> %s
invalid data message: expected ID_DATA oversize data message invalid data message: expected ID_DONE invalid data message sync: waiting for command
command read failure invalid namelen filename read failure sync: '%s' '%s'
unknown command sync: done
not enough memory to create new JDWP process
could not create fdevent for new JDWP process
oops, the JDWP process died really quick
weird accept() failed on jdwp control socket: %s
%d
%04x looking for pid %d in JDWP process list
search failed !!
%s: too many pending JDWP connection for pid %d
%s: socket pair creation failed: %s
weird unknown JDWP process failure: %s
weird end-of-stream from unknown JDWP process
could not decode JDWP %p PID number: '%s'
Adding pid %d to jdwp process list
terminating JDWP %d connection: %s
ignoring unexpected JDWP %d control socket activity (%d bytes)
remove pid %d to jdwp process list
trying to write to JDWP pid controli (count=%d first=%d) %d
sending new file descriptor to JDWP %d failed: %s
sent file descriptor %d to JDWP process %d
could not create vm debug control socket. %d: %s
could not bind vm debug control socket: %d: %s
listen failed in jdwp control socket: %d: %s
could not create fdevent for jdwp control socket
jdwp control socket started (%d)
/dev/graphics/fb0 /proc/mounts %255s %255s %*s %*s %d %d
/system none remount succeeded
remount failed: %s
usb_kick
[ usb_thread - opening device ]
/dev/android_adb /dev/android [ opening device succeeded ]
[ usb_thread - registering device ]
[ read %d ]
ERROR: n = %d, errno = %d (%s)
[ write %d ]
[ done ]
/dev/android_adb_enable failed to open /dev/android_adb_enable
[ usb_init - starting thread ]
cannot create usb thread /dev/log/ /dev/socket/ property_service :
/dev/pts/%u 0123456789ABCDEF Inf 0123456789abcdef (null) NaN 0 . Infinity inf inity nan Unknown error: Operation not permitted No such file or directory No such process Interrupted system call I/O error No such device or address Argument list too long Exec format error Bad file number No child processes Try again Out of memory Permission denied Bad address Block device required Device or resource busy File exists Cross-device link No such device Not a directory Is a directory Invalid argument File table overflow Too many open files Not a typewriter Text file busy File too large No space left on device Illegal seek Read-only file system Too many links Broken pipe Math argument out of domain of func Math result not representable Resource deadlock would occur File name too long No record locks available Function not implemented Directory not empty Too many symbolic links encountered No message of desired type Identifier removed Channel number out of range Level 2 not synchronized Level 3 halted Level 3 reset Link number out of range Protocol driver not attached No CSI structure available Level 2 halted Invalid exchange Invalid request descriptor Exchange full No anode Invalid request code Invalid slot Bad font file format Device not a stream No data available Timer expired Out of streams resources Machine is not on the network Package not installed Object is remote Link has been severed Advertise error Srmount error Communication error on send Protocol error Multihop attempted RFS specific error Not a data message Value too large for defined data type Name not unique on network File descriptor in bad state Remote address changed Can not access a needed shared library Accessing a corrupted shared library .lib section in a.out corrupted Attempting to link in too many shared libraries Cannot exec a shared library directly Illegal byte sequence Interrupted system call should be restarted Streams pipe error Too many users Socket operation on non-socket Destination address required Message too long Protocol wrong type for socket Protocol not available Protocol not supported Socket type not supported Operation not supported on transport endpoint Protocol family not supported Address family not supported by protocol Address already in use Cannot assign requested address Network is down Network is unreachable Network dropped connection because of reset Software caused connection abort Connection reset by peer No buffer space available Transport endpoint is already connected Transport endpoint is not connected Cannot send after transport endpoint shutdown Too many references: cannot splice Connection timed out Connection refused Host is down No route to host Operation already in progress Operation now in progress Stale NFS file handle Structure needs cleaning Not a XENIX named type file No XENIX semaphores available Is a named type file Remote I/O error Quota exceeded No medium found Wrong medium type Operation Canceled Required key not available Key has expired Key has been revoked Key was rejected by service Owner died State not recoverable Stupid C library hack !! abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 :+-._ Local time zone must be set--see zic manual page posixrules ,M4.1.0,M10.5.0 localtime /system/usr/share/zoneinfo / /system/usr/share/zoneinfo/zoneinfo.idx /system/usr/share/zoneinfo/zoneinfo.dat TZ persist.sys.timezone -0 %d %2d %H:%M:%S %e-%b-%Y + - %4d %04d %c Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec January February March April June July August September October November December Sun Mon Tue Wed Thu Fri Sat Sunday Monday Tuesday Wednesday Thursday Friday Saturday %a %b %e %T %Y AM PM %a %b %e %H:%M:%S %Z %Y /acct/uid/%d/tasks w+ <unknown> /proc/self/exe /dev/urandom ANDROID_PROPERTY_WORKSPACE HTC_RIL /dev/log/main /dev/log/radio /proc/cpuinfo processor /proc/stat cpu /proc/meminfo MemTotal:
Is there a problem that's rom related, and why does my adb interface only show in device mgr, when my phone's in cwm recovery?

[GUIDE] Marshalling data in Compact Framework

Author: Apriorit (Device Team)
Permanent link: apriorit(dot)com/our-company/dev-blog/62-marshalling-data-in-cf
In many situations when we create applications for different embedded systems or mobile platforms we can’t develop all parts of the product using managed code only.
For example we need several modules written in native language which perform some low level operations or we already have these libraries written on C++. So we have to use more than one programming language in our product and also use data marshaling in it.
In this article we will review some aspects of using data types and ways of using them during marshalling data to and from unmanaged code.
Making your interop calls more efficient
Marshaling is the act of taking data from one environment to another. In the context of .NET marshalling refers to transferring data from the app-domain you are in to somewhere else, outside.
You should remember that such Platform Invoke calls are slower than direct native calls and than regular managed calls. The speed depends on types marshaled between managed and native code, but nevertheless you should avoid using Platform Invoke calls if you have a chance to do this. Also it is recommended to use calls with some amount of transferred data than several “small” Platform Invoke calls.
Bitable types
It is recommended to use simple data types (int, byte, boolean, characters and strings). It makes the call more efficient and helps to avoid any convertions and copying. These blittable types have identical representation in both managed and unmanaged memory. But you should remember that in Compact Framework during marshaling boolean type is represented as 1-byte integer value (instead of 4-byte integer value in the full .NET Framework), character type (char) is always represented as 2-bytes Unicode character and String type is always treated as a Unicode array (in full .NET Framework it may be treated as a Unicode or ANSI array, or a BSTR).
Method Inlining
The JIT compiler can inline some methods in order to make the calls more efficient. You can not force a method to be inlined by the compiler, but you can make it NOT to be inlined. In order to avoid inlining you can:
• make the method virtual;
• add branching to the method’s body;
• define local variables in the method;
• use 2-bit floating point arguments (or return value).
Disabling method inlining can help to detect a problem during Platform Invoke calls.
Sequential layout
In the Compact Framework all structures and classes always have sequential layout (the managed value type has the same memory layout as the unmanaged structure). This behavior can be specified by setting attribute LayoutKind.Sequential. You don’t need to specify this attribute in Compact Framework, but if you use these pieces of code in both full .NET Framework and Compact Framework you have to set it to avoid different behavior on two platforms.
The following sample shows how to send some pointers from C# code for storing them in the native module.
Code C#:
Code:
[StructLayout(LayoutKind.Sequential)]
public class BasePointers // you can use the struct too
{
public IntPtr pointer1;
public IntPtr pointer2;
}
[DllImport("NativeDLL.dll", CallingConvention = CallingConvention.Winapi)]
// Cdecl
public static extern int TransferStruct(BasePointers pointers);
Code C++:
Code:
struct BasePointers
{
unsigned int pointer1;
unsigned int pointer2;
}
extern "C" __declspec(dllexport) int CDECL TransferArray(BasePointers*
pointers);
One Calling Convention
The Calling Convention determines the order in which parameters are passed to the function, and who is responsible for the stack cleaning. The .NET Compact Framework supports only the Winapi value (Cdecl on this platform) of Calling Convention. It defines the calling convention for C and C++ (instead of the full .NET Framework which supports three different calling conventions). To avoid crashes of your application you should make sure that your calling conventions in both managed and native declarations are same.
If you specify the attribute to preserve signature of functions ([PreserveSig]) then the returned value will contain 32-bit HRESULT value that will give you more data to analyze errors during the native function execution. The Calling Convention can be specified by adding the attribute CallingConvention to the declaration of your function. As it was mentioned the .NET Compact Framework supports only “Winapi” Calling Convention that corresponds to Cdecl:
Code C#:
Code:
[UnmanagedFunctionPointer(CallingConvention.Winapi)]
public delegate int ProgressEventHandler(int progressValue);
Code C++:
Code:
typedef void (CDECL *ProgressEventHandler)(int progressValue);
Data Alignment
In some situations we need to transfer data between the managed and unmanaged code in the structures. As it’s written above all structures have sequential layout in the Compact Framework, but you should remember about representation of structs in the managed in unmanaged code. The way of packing structures depends on a platform and on a way how the members of structure are aligned. On ARM platform this value for alignment is four (all values in structures are aligned to 4 bytes).
Code:
typedef struct OurStruct
{
unsigned char valueChar;
usingned int valueInt;
} ourStruct_;
This structure could be perfectly acceptable in desktop code, but if you use such structure on the Windows Mobile platform then you might receive valueInt at the offset 4. If you use such structures in both desktop and device's side code you have to use them carefully during marshaling.
During marshaling data you might receive such errors as “Datatype misalignment” (0x80000002) or “Access violation” (0x80000005). It indicates that you are using wrong pointers or try to access to the wrong offset of data. For example, you transfer array of bytes from C# code to the native module and define you functions as:
C# code:
Code:
[DllImport("NativeDLL.dll", CallingConvention = CallingConvention.Winapi)]
// Cdecl
public static extern int TransferArray(IntPtr src, int srcSize);
C++ Native Module code:
extern "C" __declspec(dllexport) int CDECL TransferArray(byte* srcArr,
int srcSize);
If you try to use the pointer “srcArr” as the pointer on integer (int*) and then try to use the corresponding value you will receive an error :
Code:
int value = *(int*)srcArr; // Datatype misalignment
The simple way to avoid this problem is to change declaration of C++ function and change the pointer on array of bytes to the pointer on array of integer and use it without any problems:
Code:
extern "C" __declspec(dllexport) int CDECL TransferArray(int* srcArr,
int srcSize);
Marshal class
You can use methods in the class Marshal to manually convert managed objects and perform conversions between IntPtrs. These methods are PtrToStructure, GetComInterfaceForObject, PtrToStringBSTR, GetFunctionPointerForDelegate and others. It allows you to control marshaling. These methods are also useful for debugging issues with marshaling parameters where the runtime is not able to convert a particular argument.
You cannot pass delegate directly to the native module as parameter of you function because the .NET Compact Framework does not support marshaling of delegates. Instead you should use method Marshal.GetFunctionPointerForDelegate for getting function pointer which you can pass to the native code and call it.
Code:
Code:
class MainClass
{
[UnmanagedFunctionPointer(CallingConvention.Winapi)]
public delegate int ProgressEventHandler(int progressValue);
...
void OnProgressChanged(int progressValue)
{
...
}
…
…
[DllImport("NativeDLL.dll", CallingConvention = CallingConvention.Winapi)]
// Cdecl
public static extern int SetCallbackFunction(IntPtr functionPointer);
}
// Passing function pointer
Delegate d = new ProgressEventHandler(OnProgressChanged);
IntPtr progressChanged = Marshal.GetFunctionPointerForDelegate(d);
int result = SetCallbackFunction(progressChanged);
But you should be aware of Garbage Collector (GC) in such situation. The GC might collect you delegates and your function pointers will become invalid. It may happen when you passed the function pointer to the native code as callback method in order to call it later - GC might think that there are no references to it in the managed code. To avoid this situation you should keep reference to this delegate. For example, you can store it in the classes variable or create some delegates pool, in which you can keep references to the several delegates.
GCHandle
Since we're passing a pointer to some data we need to allocate memory for that data and make sure that the GC will not remove that memory. One of the possible ways to manage this situation is to use GCHandle.
If you want to pass some class (or array of bytes) to the unmanaged code and you need to pin memory for the proper work with it in the unmanaged code you can write:
Code:
class SampleClass
{
...
}
SampleClass classSample = new SampleClass();
GCHandle classHandle = GCHandle.Alloc(classSample, GCHandleType.Pinned);
IntPtr ptrToClass = classHandle.AddrOfPinnedObject();
int result = PassPtrToUnmanagedCode(ptrToClass); // our function
You can also make an instance of GCHandle as a member of the class to avoid deleting them by GC. Also you should remember that the structure is value-type. And pinning it to the memory will cause a problem, because structure will be copied and GCHandle will handle a reference to created “boxed” copy of the object. It will be hard to find such problem in the future.
Conclusion
During marshaling data you may face with the problems described above. Very often you may get “NotSupportedException” and other exceptions. To find a problem you can enable logging of setting the registry keys. One of the logging components is “Interop ”. The log provides information about Platform Invoke calls and marshaling. You can read MSDN for more information about Creating Log Files.
With the .NET Compact Framework 2.0 you can use Platform Invoke calls in managed application, even though there are a few limitations. You should remember all differences and limitations between full .NET Framework and the Compact Framework to avoid problems in your applications.

Catching unix signals in an Android Application

In my Android application, most of the code and logic is in C++. The C++ code is built as a dynamic library. My Application class loads this native library. In the native library, I want to catch different unix signals that are raised by the OS. I have tried, but unable to trap them.
In the native library, I have done the following :
C++:
void SignalHandler (int signal)
{
__android_log_print(ANDROID_LOG_INFO, TAG, "SignalHandler");
__android_log_print(ANDROID_LOG_INFO, TAG, "signal = %d", signal);
// Do something
}
// Will be called from MainActivity.onCreate()
void NativeFunction (JNIEnv* env, jobject obj) (
JNIEnv* env,
jobject /* this */) {
__android_log_print(ANDROID_LOG_INFO, TAG,"NativeFunction ");
__android_log_print(ANDROID_LOG_INFO, TAG, "Registering for signals...");
if (signal(SIGTERM, SignalHandler) == SIG_ERR)
__android_log_print(ANDROID_LOG_INFO, TAG, "Registering for SIGTERM failed!");
if (signal(SIGINT, SignalHandler) == SIG_ERR)
__android_log_print(ANDROID_LOG_INFO, TAG, "Registering for SIGINT failed!");
__android_log_print(ANDROID_LOG_INFO, TAG, "Successfully registered for signals!");
}
I swiped up from the recents screen or closed the Activity by pressing the Back button, but didn't get any termination signals (lifecycle callbacks of the Activity were called - as expected).
The question is, should I be writing signal handlers to handle these (SIGINT and SIGBREAK) signals? I have only tested these two ways (swipe up and back button press), but there are many ways for Android to terminate an app. Will I ever get SIGTERM, SIGINT or other signals (which expects the application to exit) in the Android environment? I haven't found anything (so far) in the docs.