[Q] Bluetooth l2cap socket address - Android Software/Hacking General [Developers Only]

Hi developers,
Android version: 2.3.7
Kernel version: 2.6.35-14-CyanogenMod-Arco-Kalim [email protected] #1
Mod version: CyanogenMod-7.1.0.1-click
The device has been fully rooted.
I have added piece of code in my project
which takes advantage of Bluez Utils in hidd.c.
The code is the following:
<code>
if (bind(sk, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
close(sk);
return -1;
}
</code>
bind() keeps returning -1.
I added a line(DisablePlugins = input) to the bluetooth configuration in my Android device
/system/etc/bluetooth/main.conf
The information I have is:
sk:37
(struct sockaddr *) &addr=0x44597e90
sizeof(addr)=12
errno:13
Reason: Permission Denied.
Can anyone help? If you need to know in more detail, feel free to let me know.

Does anyone have clue?

Bind man page-
"
Return Value
On success, zero is returned. On error, -1 is returned, and errno is set appropriately.
"
You might consider checking errno. My first guess is your app does not have appropriate permissions to write to the socket (is the socket chowned/chmodded properly?).

Related

[Q] Get the Audio DMA buffer level (msm7k/libaudio-qsd8k) on Nexus One + Android 2.2

Hello,
I need to get the status of the Audio DMA buffer on my Nexus One.
I try to use the following command of the libaudio API :
AUDIO_GET_STATS.
I add this in libaudio (hardware/msm7k/libaudio-qsd8k/
AudioHardware.cpp) :
struct msm_audio_stats stats;
status = ioctl(mFd, AUDIO_GET_STATS, &stats);
if (status < 0) {
LOGE("Cannot read pcm_out stats");
goto Error;
}
LOGD("LVVIL: output stats: byte_count: %d, sample_count: %d ",
stats.byte_count, stats.sample_count);
When I have a look to the log, I get all the time 0.
Do I use the right command, and if yes do I use it on the right way?
If this is not the right one, do we have access to another one which
could return me the DMA buffer level?
Any idea at least to find a workaround?
Thanks in advance for your help.
Florent.

[CWM] ClockworkMod 6.0.4.0 that will NOT update your touchscreen firmware

So I have this new tablet, and knowing all the bugs surrounding the touchscreen, decided not to update it (it came as stock JSS15J). However I still want to be able to use CM on it, so I patched the kernel to never update the touchscreen fw. Here's the compiled recovery from CM-10.2 synced today (october 2th), and then the kernel patch:
https://docs.google.com/file/d/0ByHQWL5Q6bSwYXJpaE9JZ0dnbVE/edit?usp=sharing
Code:
diff --git a/drivers/input/touchscreen/ektf3k.c b/drivers/input/touchscreen/ektf3k.c
index 4b6a7e7..451bcee 100755
--- a/drivers/input/touchscreen/ektf3k.c
+++ b/drivers/input/touchscreen/ektf3k.c
@@ -392,7 +392,7 @@ static int check_fw_version(const unsigned char*firmware, unsigned int size, int
id = firmware[size - 2*FIRMWARE_PAGE_SIZE + 122] |
(firmware[size - 2*FIRMWARE_PAGE_SIZE + 123] << 8);
- touch_debug(DEBUG_INFO, "The firmware was version 0x%X and id:0x%X\n", version, id);
+ touch_debug(DEBUG_INFO, "The firmware was version 0x%X and id:0x%X, new fw_version: 0x%X\n", version, id, fw_version);
if (id == 0x3029 && BOOTCODE_VERSION >= 0x6046) {
/*if the touch firmware was empty, always update firmware*/
@@ -1318,7 +1318,10 @@ static int firmware_update_header(struct i2c_client *client, unsigned char *firm
unsigned char nb_isp_cmd[4] = {0x45, 0x49, 0x41, 0x50};
unsigned char *cursor;
struct elan_ktf3k_ts_data *ts = i2c_get_clientdata(client);
-
+
+ printk("[ektf3k]: firmware_update_header: not updating your firmware, bro\n");
+ return 0;
+
if(ts == NULL)
return -1;
I can also upload the kang if anyone needs it. Note my patch has the old/new version swapped (small bug), it says new fw_version, but it's actually the current version.
I tested it with my own device just in case someone is wondering wether it works or not.
On a slightly unrelated note, my CM 10.2 kang would not have the Wi-Fi module loading. I had this error in logcat:
Code:
E/WifiHW ( 190): Failed to write wlan fw path param (Operation not permitted)
E/WifiStateMachine( 597): Failed to reload STA firmware java.lang.IllegalStateException: command '6 softap fwreload wlan0 STA' failed with '400 6 SoftAP command has failed'
Digging a bit further led to this error in the kernel log:
Code:
<6>[ 69.311614] wlan: loading driver v3.2.2.17B
<3>[ 69.314300] wlan: [573:F :HDD] hdd_parse_config_ini: request_firmware failed -2
However the official nightly didn't have this issue. I tracked it down to the lack of a symbolic link, which I had to create manually:
Code:
mount -o remount,rw /dev/block/platform/msm_sdcc.1/by-name/system /system
cd /vendor/firmware/wlan/prima/
ln -s /data/misc/wifi/WCNSS_qcom_cfg.ini WCNSS_qcom_cfg.ini
ln -s /data/misc/wifi/WCNSS_qcom_wlan_nv.bin WCNSS_qcom_wlan_nv.bin
I hope this information will be useful to others. Still not sure why my build has this problem and the official builds don't.

why wifi not working? here there is the answer...

hello,
i open this thread to collect informations about a common problem that happens after flashing new roms
this thread has generic purpose, and is not intended for a specific board...
- suggestions on how to discover the cause of the problem
- suggestions on how to fix the problem
anyone that think to have some useful informations on this issue can insert his post
i am not an expert ( and still my wifi is not working )
but i collected some informations, and i would like to share them
The first thing is:
what happens when from the settings i click on wifi to turn it on
to see this, i opened a terminal emulator session
and i have written this:
adb logcat > 'some file name on a writable directory' (for example , i redirected the output to the external sd card)
here is what was written on the file (extracting from the file only the last part, that is the output related to my action of wifi activation):
D/WifiHW ( 368): Read wifi chip type OK ! wifi_chip_type = RK901
D/WifiHW ( 368): wifi_load_driver: DRIVER_MODULE_PATH = /system/lib/modules/rkwifi.ko, DRIVER_MODULE_ARG =
D/BluetoothAdapterService(1097373104)( 811): getState(): mAdapterProperties: [email protected] 4168aef0
D/BluetoothAdapterService(1097373104)( 811): getState(): mAdapterProperties: [email protected] 4168aef0
D/WifiService( 368): setWifiEnabled: true pid=870, uid=1000
D/AudioHardwareALSA( 109): Audio exiting sandby will open audio device
D/AudioHardwareALSA( 109): AudioStreamOutALSA::standby().....
D/WifiHW ( 368): wifi_load_driver: driver load failed
D/WifiHW ( 368): Unable to unload driver module "wlan": No such file or directory
E/WifiStateMachine( 368): Failed to load driver!
E/WifiStateMachine( 368): DriverFailedState
Searching on the web this string: "Read wifi chip type OK ! wifi_chip_type"
i found this:
https://github.com/aloksinha2001/pi****u-3.0.8-alok/blob/master/RK30_MT5931_MT6622/wifi/wifi.c
into procedure check_wifi_chip_type() i saw exactly this part:
else if (0 == strncmp(buf, "RK901", strlen("RK901")) )
{
wifi_chip_type = RK901;
ALOGD("Read wifi chip type OK ! wifi_chip_type = RK901");
}
here is compared the value of string buf with "RK901"
the string buf is read from this file: "/sys/class/rkwifi/chip"
(so i suppose that this file has been written before by some other procedure)
so, i searched the caller procedure of check_wifi_chip_type():
in the same source i find this caller:
int wifi_load_driver()
{
#ifdef WIFI_DRIVER_MODULE_PATH
char driver_status[PROPERTY_VALUE_MAX];
int count = 100; /* wait at most 20 seconds for completion */
int type;
char path[64];
if (is_wifi_driver_loaded()) {
return 0;
}
strcpy(path, DRIVER_MODULE_PATH);
type = check_wifi_chip_type();
if((type == RK901) || (type == RK903) || (type == BCM4330)) {
strcpy(path, "/system/lib/modules/rkwifi.ko");
} else if (type == RTL8188CU) {
....
this procedure as first step checks if the driver is already loaded,
if not:
the driver module path is set by default to "/system/lib/modules/wlan.ko"
Then basing on the chip type is got a more specific path:
for example, for RK901/RK903/BCM4330 the path is set to : "/system/lib/modules/rkwifi.ko"
Then, is checked if the file does exist, and if not the path is seth to the default DRIVER_MODULE_PATH,
that is "/system/lib/modules/wlan.ko"
// judge if the KO file exist, if not, insmod wlan.ko
if (access(path, F_OK) < 0) {
ALOGD("DRIVER_MODULE_PATH = %s (Not such file)...", path);
strcpy(path, DRIVER_MODULE_PATH);
}
Then,
is called insmod (insert module),
to load the driver file in 'memory' (a new module into the kernel, i suppose):
if (insmod(path, DRIVER_MODULE_ARG) < 0) {
ALOGD("%s: driver load failed", __FUNCTION__);
wifi_unload_driver();
if(retry_count-- > 0) goto retry_load_driver;
return -1;
}
Looking the logcat above,
the flow in my case stops here, with : wifi_load_driver: driver load failed
so something happened in insmod:it is not able to load the file /system/lib/modules/rkwifi.ko in memory or initialize it
(the file is found, else the process should stop before, when checking access to the file)
The insmod function does this:
allocates memory for the structure name (type utsname) :
memset(&name, 0, sizeof(name));
and load the file on this area:
module = load_file(filename_release, &size);
Then is checked if the file has been loaded
if (!module)
return -1;
and finally
the module is 'initialized':
ret = init_module(module, size, args);
One of this two events went wrong, because insmod returned -1
My investigation stops here... i am not able to proceed more...
but i am open to all suggestions and hints
Thank you!!
Vicolodo said:
The first thing is:
what happens when from the settings i click on wifi to turn it on
to see this, i opened a terminal emulator session
and i have written this:
adb logcat > 'some file name on a writable directory' (for example , i redirected the output to the external sd card)
here is what was written on the file (extracting from the file only the last part, that is the output related to my action of wifi activation):
D/WifiHW ( 368): Read wifi chip type OK ! wifi_chip_type = RK901
D/WifiHW ( 368): wifi_load_driver: DRIVER_MODULE_PATH = /system/lib/modules/rkwifi.ko, DRIVER_MODULE_ARG =
D/BluetoothAdapterService(1097373104)( 811): getState(): mAdapterProperties: [email protected] 4168aef0
D/BluetoothAdapterService(1097373104)( 811): getState(): mAdapterProperties: [email protected] 4168aef0
D/WifiService( 368): setWifiEnabled: true pid=870, uid=1000
D/AudioHardwareALSA( 109): Audio exiting sandby will open audio device
D/AudioHardwareALSA( 109): AudioStreamOutALSA::standby().....
D/WifiHW ( 368): wifi_load_driver: driver load failed
D/WifiHW ( 368): Unable to unload driver module "wlan": No such file or directory
E/WifiStateMachine( 368): Failed to load driver!
E/WifiStateMachine( 368): DriverFailedState
Searching on the web this string: "Read wifi chip type OK ! wifi_chip_type"
i found this:
https://github.com/aloksinha2001/pi****u-3.0.8-alok/blob/master/RK30_MT5931_MT6622/wifi/wifi.c
into procedure check_wifi_chip_type() i saw exactly this part:
else if (0 == strncmp(buf, "RK901", strlen("RK901")) )
{
wifi_chip_type = RK901;
ALOGD("Read wifi chip type OK ! wifi_chip_type = RK901");
}
here is compared the value of string buf with "RK901"
the string buf is read from this file: "/sys/class/rkwifi/chip"
(so i suppose that this file has been written before by some other procedure)
so, i searched the caller procedure of check_wifi_chip_type():
in the same source i find this caller:
int wifi_load_driver()
{
#ifdef WIFI_DRIVER_MODULE_PATH
char driver_status[PROPERTY_VALUE_MAX];
int count = 100; /* wait at most 20 seconds for completion */
int type;
char path[64];
if (is_wifi_driver_loaded()) {
return 0;
}
strcpy(path, DRIVER_MODULE_PATH);
type = check_wifi_chip_type();
if((type == RK901) || (type == RK903) || (type == BCM4330)) {
strcpy(path, "/system/lib/modules/rkwifi.ko");
} else if (type == RTL8188CU) {
....
this procedure as first step checks if the driver is already loaded,
if not:
the driver module path is set by default to "/system/lib/modules/wlan.ko"
Then basing on the chip type is got a more specific path:
for example, for RK901/RK903/BCM4330 the path is set to : "/system/lib/modules/rkwifi.ko"
Then, is checked if the file does exist, and if not the path is seth to the default DRIVER_MODULE_PATH,
that is "/system/lib/modules/wlan.ko"
// judge if the KO file exist, if not, insmod wlan.ko
if (access(path, F_OK) < 0) {
ALOGD("DRIVER_MODULE_PATH = %s (Not such file)...", path);
strcpy(path, DRIVER_MODULE_PATH);
}
Then,
is called insmod (insert module),
to load the driver file in 'memory' (a new module into the kernel, i suppose):
if (insmod(path, DRIVER_MODULE_ARG) < 0) {
ALOGD("%s: driver load failed", __FUNCTION__);
wifi_unload_driver();
if(retry_count-- > 0) goto retry_load_driver;
return -1;
}
Looking the logcat above,
the flow in my case stops here, with : wifi_load_driver: driver load failed
so something happened in insmod:it is not able to load the file /system/lib/modules/rkwifi.ko in memory or initialize it
(the file is found, else the process should stop before, when checking access to the file)
The insmod function does this:
allocates memory for the structure name (type utsname) :
memset(&name, 0, sizeof(name));
and load the file on this area:
module = load_file(filename_release, &size);
Then is checked if the file has been loaded
if (!module)
return -1;
and finally
the module is 'initialized':
ret = init_module(module, size, args);
One of this two events went wrong, because insmod returned -1
My investigation stops here... i am not able to proceed more...
but i am open to all suggestions and hints
Thank you!!
Click to expand...
Click to collapse
Interesting... Yesterday i was trying to solve this problem caused by a cwm recovery flashing during about 8 hours with my mk809ii. I let my pc downloading about 10 different roms from other similar devices, and this morning i stay to try one by one. Finally i found "mk808B bob finless 2.1 room (jb4.2.2) with wifi APxxxx" (APxxxx is my wifi chip, i can't remember the xxxx just now) fix both wifi and bluetooth.
You did a good research, i will save your post on case i get the error again, but i think the best thing to do is to search for a compatible rom and try, with same both cpu and wifi chipset. Also now after read your post i am going to save a backup of system /lib and system /etc directories, maybe changing the wifi library files fix the error without needing of flash and reflash...
Thanks, i liked your post!
Enviado desde mi GT-P7510 usando Tapatalk 2

[Completed] Runtime exec not behaving like adb exec

I've built a native Android app with NDK toolcahain.
I've first tested the app using the adb tool and got the following output:
Code:
generic:/ $ run-as cardservice.hr.cardservice
generic:/data/data/cardservice.hr.cardservice $ cd card/
generic:/data/data/cardservice.hr.cardservice/card/ $ ./cardService
2016-11-30 20:36:06,245 INFO [default] Starting CardService
App continues to run
But problem starts when I try to do the same thing from a Android application.
The following code:
Code:
private void exec_command() throws IOException, InterruptedException {
String command = "./data/data/cardservice.hr.cardservice/card/cardService"
Process check_card_service = Runtime.getRuntime().exec(command);
BufferedReader in = new BufferedReader(new InputStreamReader(check_card_service.getInputStream()));
String line;
String content = "";
while ((line = in.readLine()) != null) {
System.out.println(line);
content = content + line;
}
check_card_service.waitFor();
};
It starts the application but the application fails, and stops working.
Code:
2016-11-30 19:25:11,417 INFO [default] Starting CardService
2016-11-30 19:25:11,447 INFO [default] Underlying Transport Error, Code: websocketpp.transport.asio:3
So my question is what is different in my approaches, what changes if i run it from my app or from the adb shell?
The application does not need root access.
Do you need any extra information?
Muha12 said:
I've built a native Android app with NDK toolcahain.
I've first tested the app using the adb tool and got the following output:
Code:
generic:/ $ run-as cardservice.hr.cardservice
generic:/data/data/cardservice.hr.cardservice $ cd card/
generic:/data/data/cardservice.hr.cardservice/card/ $ ./cardService
2016-11-30 20:36:06,245 INFO [default] Starting CardService
App continues to run
But problem starts when I try to do the same thing from a Android application.
The following code:
Code:
private void exec_command() throws IOException, InterruptedException {
String command = "./data/data/cardservice.hr.cardservice/card/cardService"
Process check_card_service = Runtime.getRuntime().exec(command);
BufferedReader in = new BufferedReader(new InputStreamReader(check_card_service.getInputStream()));
String line;
String content = "";
while ((line = in.readLine()) != null) {
System.out.println(line);
content = content + line;
}
check_card_service.waitFor();
};
It starts the application but the application fails, and stops working.
Code:
2016-11-30 19:25:11,417 INFO [default] Starting CardService
2016-11-30 19:25:11,447 INFO [default] Underlying Transport Error, Code: websocketpp.transport.asio:3
So my question is what is different in my approaches, what changes if i run it from my app or from the adb shell?
The application does not need root access.
Do you need any extra information?
Click to expand...
Click to collapse
Hello,
Please post your query here App Development Forum with all relevant details, the experts there maybe able to assist you.
Regards
Vatsal,
Forum Moderator.
Thank you very much.

[APP][PATCH] SnoopSnitch OnePlus Compatibility Patch

After some trial and error, I have identified the reason why snoopsnitch isn't working.
The issue is related to the DIAG initialization code in the diag-helper binary.
I'm attaching a working patch and a compiled APK (PM me for the link or maybe a mod. can attach it. I have 10 post link restriction) for your convenience.
PS: the code specifically look for OnePlus manufacturer but it may work on other devices too (with the appropriate changes)
Code:
diff --git a/contrib/diag_helper/jni/diag-helper.c b/contrib/diag_helper/jni/diag-helper.c
index ddb7fcb1..c1b00a33 100644
--- a/contrib/diag_helper/jni/diag-helper.c
+++ b/contrib/diag_helper/jni/diag-helper.c
@@ -3,6 +3,7 @@
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/un.h>
+#include <sys/system_properties.h>
#include <android/log.h>
@@ -13,6 +14,7 @@
#include <stdlib.h>
#include <unistd.h>
#include <arpa/inet.h>
+#include <string.h>
#define BUF_SIZE 1000000
@@ -62,9 +64,15 @@ open_diag_dev(void)
int diag_fd = -1;
int rv = -1;
int olderrno;
+ bool op = false;
+ char man[PROP_VALUE_MAX + 1];
+
+ __system_property_get("ro.product.manufacturer", man);
logmsg(ANDROID_LOG_DEBUG, "opening diag device");
+ if (strcasecmp("oneplus", man) == 0) op = true;
+
diag_fd = open("/dev/diag", O_RDWR|O_CLOEXEC);
if (diag_fd < 0) {
logmsg(ANDROID_LOG_FATAL, "error opening diag device: %m");
@@ -74,6 +82,7 @@ open_diag_dev(void)
const unsigned long DIAG_IOCTL_SWITCH_LOGGING = 7;
const int MEMORY_DEVICE_MODE = 2;
+ const int mode_param[] = { MEMORY_DEVICE_MODE, -1, 0 };
struct diag_logging_mode_param_t stMode = {
MEMORY_DEVICE_MODE, 0, 1
};
@@ -84,7 +93,10 @@ open_diag_dev(void)
rv = ioctl(diag_fd, DIAG_IOCTL_SWITCH_LOGGING, MEMORY_DEVICE_MODE);
if (rv < 0) {
olderrno = errno;
- rv = ioctl(diag_fd, DIAG_IOCTL_SWITCH_LOGGING, (void *)&stMode);
+ if(op)
+ rv = ioctl(diag_fd, DIAG_IOCTL_SWITCH_LOGGING, (void *)&mode_param, sizeof(mode_param));
+ else
+ rv = ioctl(diag_fd, DIAG_IOCTL_SWITCH_LOGGING, (void *)&stMode);
}
if (rv < 0) {
Credits: SRLabs, original author repository: https://opensource.srlabs.de/projects/snoopsnitch
{Mod edit: Added apk on request of OP @h3ph4est7s}
thanks
I've been looking for this for a while, I sent you a pm
it works perfectly thanks
Hi,
Thanks for the apk! It's great to see it again running (especially initializing) on my device, love it! As I already wrote in another posting in another thread (sorry for the double post, but in this specific case it's OK I think), there are two things that need to be mentioned:
- the patch level checks do not work on my device, maybe this depends in the ROM I'm using (I'm on Havoc 3.8 / Android 10) - I'll have to check if it maybe works with another ROM.
- I currently cannot say if the detection of silent SMS and IMSI Catchers really is working since I've havent't had such events till now. Silent SMSes should appear from time to time IMO. IMSI catcher events are extremely rare in my experience, I used Snoop Snitch for about one year two or three years ago and got two of those events in the whole year: one in Germany, one in Canada.
Cheers
Zap
I am also facing the same DIAG_CHAR initializing issue. I used your snoopsnitch apk to test on my Oneplus 5, LOS16. The app started, but closed immediately. The backend service keep on restarted. My logcat shows as below.
12-11 13:16:12.186 9407 9407 E [email protected]: Could not get passthrough implementation for [email protected]::ICameraProvider/legacy/0.
12-11 13:16:12.198 9417 9417 I diag-helper: starting
12-11 13:16:12.198 9417 9417 I diag-helper: test mode invoked
12-11 13:16:12.198 9417 9417 D diag-helper: opening diag device
12-11 13:16:12.198 9417 9417 F diag-helper: error setting diag device logging mode: Bad address/Invalid argument
12-11 13:16:12.199 9417 9417 E diag-helper: error opening DIAG device
12-11 13:16:12.200 9261 9261 E msd-service: Terminating MsdService after shutting down due to an unexpected error
12-11 13:16:12.202 9261 9261 I opSnitchServic: System.exit called, status: 1
12-11 13:16:12.202 9261 9261 I AndroidRuntime: VM exiting with result code 1, cleanup skipped.
12-11 13:16:12.215 1359 9176 I ActivityManager: Process .SnoopSnitchService (pid 9261) has died: fore SVC
12-11 13:16:12.215 1359 9176 W ActivityManager: Scheduling restart of crashed service de.srlabs.snoopsnitch/.qdmon.MsdService in 1000ms
12-11 13:16:12.215 1359 1405 W libprocessgroup: kill(-9261, 9) failed: No such process
12-11 13:16:12.215 1359 1405 I libprocessgroup: Successfully killed process cgroup uid 10092 pid 9261 in 0ms
Click to expand...
Click to collapse
Any kind of help is appreciated.
Installed this Mod on my OP7T Pro, but it crashes at start. The unmodified version starts flawless, but did mit recognize root privileges (message at the bottom "snoopsnitch require root access..."). On clicking the start network test button it tells me "could not initialize the diag interface". I checked diag_char in system and it is enabled. No Idea whats wrong. Using Android 10 with latest stabile stock OS.
EinsteinXXL said:
Installed this Mod on my OP7T Pro, but it crashes at start. The unmodified version starts flawless, but did mit recognize root privileges (message at the bottom "snoopsnitch require root access..."). On clicking the start network test button it tells me "could not initialize the diag interface". I checked diag_char in system and it is enabled. No Idea whats wrong. Using Android 10 with latest stabile stock OS.
Click to expand...
Click to collapse
Same here with Oxygen OS 11 beta. The modded app crashes on start and the original app can't "initilize diag driver."
On my OP3T with Android 11 (Arrow OS) it works. Same again as before: Starting and initializing perfectly, but the patch level checks do not work.
The Problem seems to be device-/SOC - specific.
Hello and thank you so very much for this. I had been wanting to use it for s long time and finally came across your workaround. Unfortunately it didn't work for me. I originally installed through nethunter store but I uninstalled that and installed yours. I am running Jaguar OS on OP8T rooted with magisk. I created a logcat hoping that you'll be able to hero me get it going. I am attaching it here. Thank you!

Categories

Resources