[Q] Access to root and system directory (without rooting and plugging the smartphone) - Android Software/Hacking General [Developers Only]

Hi everyone,
First of all, sorry for my English. I am currently working on an OVAL (oval.mitre.org) project which main goal is to determine if an Android device (smartphone, PDA..) is vulnerable or not , according to its system settings and installed applications. To make it quick and simple, the OVAL application that I am working on should be able of gather all system settings by reading all configuration files of the smartphone, and then analyze this information to determine if the device is secure. Since I have not yet a smartphone, I use Android SDK and some Android X86 images with VirtualBox.
Once one emulator is started, I run adb shell so I can read all files under / . Among them, some interesting configuration files are located under /system, for example. All of them are read-only, that's not a problem since I just have to collect information. I think that some settings can change from one Android version to another, but I will treat this problem later.
Code:
[email protected]:~$ adb shell
# ls
acct
cache
config
d
data
default.prop
dev
etc
init
init.goldfish.rc
init.rc
mnt
proc
root
sbin
sdcard
sys
system
ueventd.goldfish.rc
ueventd.rc
vendor
My question is the following: suppose we now have a real smartphone, that we can't root and/or plug (USB) to a laptop: is it still possible to access to / (or to /system) to gather system information? Is there another way? Maybe by entering in recovery mode (I can't test for the moment because, as I said, I have not smartphone and it seems to be impossible with emulator) ?
Thank you for your attention and for your help !
McFarah (I know, it looks like English-speaking name, but I'm french )

Anything you can do in an ADB shell you can do in Terminal Emulator on the device also. [Android Terminal Emulator - Google Play]
It is essentially the same as an ADB shell, but running on the device itself. All the same commands will work.
There are also plenty of file browsers which I think should be able to read those files without root (I can't test as my phone it rooted, but I believe most file browsers e.g. Solid Explorer, MiFile Explorer, ES File Explorer etc. should be able to do this).
EDIT: For example:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
(screenshot of terminal emu running same command as you quoted in your post)
EDIT: Also, it looks like you are running as root in the ADB shell output you posted above. The prompt appears to be a #, which indicates root. The normal prompt is $.

Hi SifJar
Thank you for your answer. I have already used Terminal Emulator, this is a good tool, that's right. I have not really experimented with browsers yet.
I have forgotten to say that, but ideally, the application should be able to perform her task without reposing on others external applications. Maybe I would rather write an Android application dedicated to the OVAL application myself, and add some automatisms: the Android application gathers all system and installed applications settings and feeds the OVAL application with that. Do you think this is a good solution?
Thanks

Sorry, I just assumed you wanted a solution for running the same commands you could over ADB on the device itself.
Yes, I believe you can easily call any of these commands from an app as well. I don't know exactly how one would do that, I'm not a developer but I'm sure it's fairly straight forward.
From a little googling, it seems you'd use something like this in your code:
Code:
Process process = Runtime.getRuntime().exec("su");
(replacing su with whatever command you wanted to run e.g. ls)
A few links that might be helpful:
http://saurabh-nigam.blogspot.co.uk/2010/10/running-android-native-code.html
http://stackoverflow.com/questions/...-a-system-command-from-an-android-application
https://code.google.com/p/market-enabler/wiki/ShellCommands

It must be said that I have not been very clear in my previous post!
Anyway, thanks a lot fot your helpful answers and the links, I will go into that in depth, and I will post again if I experiment some troubles. By the way, xda-developers forum is a very good one.
Have a nice day,
Mc Farah

Related

Has anyone installed a modified widgetlocker.apk to nexus s?

So I installed widgetlocked from the market and it all runs lovely. However, I wanted to use the Ultralinx mods for it.
I tried a few different ways, extracting it with root explorer. Copying the .apk to my desktop and modding the files there and signing them with signapk, but the modified .apk will not install no matter what I try. It always comes up with 'Application not installed'.
I am a bit newb at this I admit but have installed other apks just fine.
Any help appreciated
Figured it out. HAD to use adb. No other method would I tried would work, but that did first time!
I was trying to PM you, but they weren't going through...
Anyway, is there any chance you could tell me how you did this? I've tried every other method and nothing has happened. Whether it's because I own a Nexus S or a Mac, I don't know, but it's pretty hard (though I am new to this).
Regards,
Jon.
I usually use WidgetLocker, would you mind explaining what the modded one is? Thanks
The modded version I mention is UltraLinx's lovely unlock slider mod as in these pics.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Both available from here: http://www.theultralinx.com
As I mentioned the only method I could get to work was using ADB and Ultralinx actually has a youtube video on his site about how to do it, but I will list it here anyway.
Your phone needs to be rooted to do any of this...
Install WL as normal from market.
Copy the file com.teslacoilsw.widgetlocker-1.apk from data/app to /sdcard somewhere using astro or rootexplorer etc.
Then move that file to your computer desktop into the /sdk/tools dir where adb.exe is.
Add the WL modded files from Ultralinx to that .apk in the /res/drawable-hdpi/ directory using winrar or whatever program you use to open/mod .apk files. Make sure it has overwritten the original files!
Fire up a command promt and change dir to where adb.exe is sdk/tools or whatever.
type these next couple of lines and enter after each one;
abd shell mount /system
adb push com.teslacoilsw.widgetlocker-1.apk /system/app
Then reboot your phone and that should be it done. You can select the new slider from WL options (it modded the iphone slider so select that).
As I say, this is the only way I could get the thing to work.
Coming from windows mobile this whole abd thing of modding stuff seemed a right pain in the arse but I guess like anything once you have done it once you know it for next time and I think this mod is worth it.
Hi,
thanks for the instructions!
I've encountered an issue and would appreciate if you could help. So i follow your steps, however i get the following issue after the push command:
failed to copy 'com.teslacoilsw.widgetlocker-1.apk' to '/system/app/com.teslacoilsw.widgetlocker-1.apk': Read-only file system
I'll really appreciate if you could help, thanks!
Update: So i managed to push it successfully. Problem was I needed to enter the command adb remount beforehand in order for it to let me write.
sage: mount [-r] [-w] [-o options] [-t type] device directory
Red-Teams-MacBook-Prolatform-tools cloakroom$ adb push com.teslacoilsw.widgetlocker-1.apk /system/app
3158 KB/s (1202848 bytes in 0.371s)
However, even after rebooting the phone I am still stuck with the old iphone slider and not the one made by ultralinx. Any thoughts as to why this is?
Do i have to uninstall widgetlocker from my phone before i pushed the modded apk?

Android Studio Stuck on Loading Project

I was working in Android Studio and accidentally locked my Android Folder containing the Sdk, I re gave myself the permissions and unlocked it but when I try to reopen my android project it stays stuck on loading project.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I have tried restarting my computer(linux) and running ./studio.sh but it is still not loading.
I am also seeing in the terminal:
2021-03-19 12:48:57,346 [ 56749] WARN - Container.ComponentManagerImpl - Do not use constructor injection (requestorClass=com.android.tools.idea.apk.issues.SetupIssueReporter)
first, glad to see you use programming on linux, i encourage you continue using it and learn it
that "WARN", is normal when starting studio from command line.
check in ~/HOME/AndroidStudioProjects directory, (if you allowed android studio to install location for projects in ~/HOME/AndroidStudioProjects, and in ~/HOME directory check if you have "Android" directory, there is located Sdk tools.
check permissions for directories, just check this website , cd (open directory, terminal command) to ~/HOME/AndroidStudioProjects;
Code:
~/HOME/AndroidStudioProjects
, and check permissions via
Code:
ls -l
, or
Code:
cd AndroidStudioProjects
to get deeper into, to list project directories you have, and check their permissions, they need to have write, and read permissions for owner at least
And replace ~/HOME, with your name you use in linux, if command don't work, so not to get confused there
indestructible master said:
first, glad to see you use programming on linux, i encourage you continue using it and learn it
that "WARN", is normal when starting studio from command line.
check in ~/HOME/AndroidStudioProjects directory, (if you allowed android studio to install location for projects in ~/HOME/AndroidStudioProjects, and in ~/HOME directory check if you have "Android" directory, there is located Sdk tools.
check permissions for directories, just check this website , cd (open directory, terminal command) to ~/HOME/AndroidStudioProjects;
Code:
~/HOME/AndroidStudioProjects
, and check permissions via
Code:
ls -l
, or
Code:
cd AndroidStudioProjects
to get deeper into, to list project directories you have, and check their permissions, they need to have write, and read permissions for owner at least
And replace ~/HOME, with your name you use in linux, if command don't work, so not to get confused there
Click to expand...
Click to collapse
Thanks so much for you help and encouragement for programming with linux!
I checked the permissions of the folder and am seeing:
Code:
drwxrwxr-x
Which I think means that I have permissions for this folder.
yjay18 said:
I was working in Android Studio and accidentally locked my Android Folder containing the Sdk, I re gave myself the permissions and unlocked it but when I try to reopen my android project it stays stuck on loading project.
View attachment 5254367
I have tried restarting my computer(linux) and running ./studio.sh but it is still not loading.
I am also seeing in the terminal:
2021-03-19 12:48:57,346 [ 56749] WARN - Container.ComponentManagerImpl - Do not use constructor injection (requestorClass=com.android.tools.idea.apk.issues.SetupIssueReporter)
Click to expand...
Click to collapse
I keep reading a lot of posts when I first get into trouble. This is how I once reached this website ( https://kodlogs.net/329/android-studio-stuck-on-installing-apk ) and got the desired solution. You can read this post as well as visit here. I think it will be very useful for you

[TOOL][ADB]][Windows] A 100% Safe Non-systemless Root Tool - No Soft-bricked Adroid Guaranteed

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Grant Root Privileges to Regular Users Using Devices With Android 6 and up by Simply Upgrading Android's Multi-command Applet Toybox.
Preface:
THIS TOOL MAKES USE OF ADB COMMANDS, SO IF YOU DO NOT HAVE USB DEBUGGING TURNED ON AND ADB IS NOT INSTALLED ON YOUR WINDOWS COMPUTER, THEN IT WILL NOT BE OF ANY USE.
What does it do?
THIS TOOL MODIFIES ANDROID'S MULTI-COMMAND APPLET TOYBOX BY REPLACING IT BY ITS FULL VERSION - MEANS BY ITS VERSION THAT HAS SU COMMAND INCORPORATED.
Screenshot:
Download:
Usage:
Unpack the downloaded ZIP to any location on your Windows computer, run the script named Toybox-Updater.bat located therein.
Disclaimer:
This program is offered AS IS.
I do not warrant the functions in the program will meet your requirements or that the operation of the program will be uninterrupted or error-free.
In no event I am liable to you for any damages, including any lost data or other incidental or consequential damage.
Please don’t hesitate to report here any issues you may have with this tool! Thanks & enjoy!
In Linux, what Android is based on, the su (read: switch user) command is used to run a command as a different user, means the su command is used to run an OS function as a different user. It is the easiest way to switch or change to the administrative account in the current logged in session.
So using su to temporarily act as a root user - a root account is a master administrator account with full access and permissions in the system - allows you to bypass any default user-restrictions and perform different tasks with full permissions.
Because most Android versions by defaut use limited user accounts for normal use - making the system more secure - what restricts the user from running specific OS commands, the tool provided herewith adds su command to Android, what allows the currently logged in user to temporarily act as a root user - take note that a root account is a master administrator account with full access and permissions in the system.
su Command Syntax
To use the su command, enter it into a Windows command-line as follows:
Code:
adb shell "toybox su -c '[options] [username [arguments]]'"
Take note that if [username] is omitted su defaults to the superuser (in Linux term: root).
Hi, I came across this from another post where the user was trying to get su in his a022f. I have the same device and would like to achieve the same result. Unfortunately, I can't seem to find the zip file (there's no link to dl), or is it still being worked on, hence the absence of a link?

ADB File Explorer (python: application, cross-platform)

Python ADB File Explorer​Simple File Explorer for adb devices. Uses python library adb-shell or command-line tool adb.​Features:
List of adb devices
Connect via IP (TCP)
Listing / Pulling / Pushing files
Renaming and Deleting files
GitHub Repository​Latest build for win-x64:​ADB File Explorer v1.2.0
Download
Here some screenshots:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Just tried today, worked great! Windows 10 transfer to Pixel 6 Pro - 150gb in 15 minutes, much faster than MTP!
No errors or issues in Window 10, the window did read as non-responsive during the transfer but I assumed it was doing its thing and left it alone.
Only suggestion would be some sort of progress indicator, maybe that would stop the program from being "unresponsive"?
Thanks for your work, very easy to use!
kykyzachariah said:
Just tried today, worked great! Windows 10 transfer to Pixel 6 Pro - 150gb in 15 minutes, much faster than MTP!
No errors or issues in Window 10, the window did read as non-responsive during the transfer but I assumed it was doing its thing and left it alone.
Only suggestion would be some sort of progress indicator, maybe that would stop the program from being "unresponsive"?
Thanks for your work, very easy to use!View attachment 5459243
Click to expand...
Click to collapse
Thank you for your reply!
Ok, I will try to fix it.
!UPDATED!​to version v1.0
GitHub Repository
how about adb over wlan?
Latest build for win-x64:​ADB File Explorer v1.2.0
Download
Hi!
Is root adb server planned to be implemented?
I was just looking for a quick way to copy a folder from adb TWRP but when I tried to use this app there is the phone icon with a red cross (see picture) and nothing happens by clicking.
Through CLI instead I was able to copy the desired folder.
antoniu200 said:
Hi!
Is root adb server planned to be implemented?
Click to expand...
Click to collapse
root needed
Very cool stuff! I submitted a PR for supporting multiple file selection and download/delete on your repo. Please check it
Werve said:
I was just looking for a quick way to copy a folder from adb TWRP but when I tried to use this app there is the phone icon with a red cross (see picture) and nothing happens by clicking.
Through CLI instead I was able to copy the desired folder.
View attachment 5623663
Click to expand...
Click to collapse
I also found the same error for Samsung Galaxy M20 and unable to access files
@Azata
I hope this message finds you. First of all, thank you for developing this program! It has been immensely helpful for me in copying files to and from my device. I find that transfers via ADB are much faster and more reliable than using MTP protocol.
One thing I would like to suggest, I think it would be much better if the file picker interface could remember location of the last folder, as it always defaults to the application folder root where ADBFileExplorer.exe is located.
Also, it would be helpful if we could select multiple folders to copy at the same time. Currently, the file picker interface only lets you choose one folder at a time, and holding Ctrl whilst left-clicking does not select multiple folders.
Would it be possible to implement root? It does not trigger the root-prompt and simply says "permission denied"..
Could someone please post a step by step tutorial on how to use this?
I'm trying to run on a mac with m1 but having issues with PyQt5 installation. Does anyone have a workaround for this?
On Windows 7 X64
Tried installing/re-installing Python, but it's still not working.

Tried modifying contents of a dev file in root condition, yet failed!

Hello guys, iam trying to control the brightness of camera LED in my Letv Le X509 phone (Android 6 Marshmellow version), and it is rooted. I used adb shell to interact with my device in "su"(root) mode. within the sys/class/leds folder there is no led_torch folder, only the folders blue,green,red which are notifcation leds folders . I tried searching for the led_torch folder and i only got a flashlightdrv folder, so thought this must be it, but within it these are the contents,
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
no brightness file found where i can modify the brightness level, i tried modifying the dev file and this is the result i got! permission denied, when iam accessing as root
What am i missing? My ultimate aim is to write a pwm script to control the torch_led, plzz help me if you can and help me figure out what is that stuff that is blocking me out
you forgot the android framework. whatever you are trying to do on linux runtime kernel parameters - android can do, too. android is on top of linux, so it will override you sooner or later.
regarding permissions, you're learning it the hard way like me... uid 0 (root) doesn't mean you have actually root access. android kitkat introduced (NSA) SELinux which was enforced with lollipop. besides this android uses fancy stuff like separated mount namespaces and launches every app with its own uid in a sandboxed virtual machine forked from zygote.
so if you're going to mess with permissions you have to do it from own init.rc service and exec with proper seclabel (u:r:magisk:s0, u:r:supersu:s0 or whatever)
https://forum.xda-developers.com/t/dev-guide-2016-12-22-how-to-su.1962550
Oh , weird! iam just a novice in this android field , iam just using it for a project to blink my smartphone LED at a particular frequency(using android studio), problem is above 40 Hz is not achievable, so my requirement is to access the torchLED driver through Kernel and control it so that i can achieve a higher frequency and i need to root to access that.
The Weird thing is root checker indicated me that the root is properly installed on this device and i was able to control the notification LEDs like green , blue and red(under sys/class/leds) properly through my so called "root" access. Iam just taken aback why iam not able to modify that kernel file..
I will go through your posted link and find some way to get through it! Thanks !
Oh i think i get it, the SE Linux is acting as the security layer that is preventing my root to modify the contents of the driver file of torchLED, but iam suprised on why it did allow me to modify the contents of notification leds? (under sys/class/leds)
look for avc denied in dmesg/logcat
https://gist.github.com/msfjarvis/sepolicy.md
Will do ! Thanks!
you can shortcut if kernel allows permissive
Code:
setenforce 0
getenforce
there is also an app for (v11 on github.com)
[APP][Root][4.2+]SELinuxModeChanger v10.0 :: [24.07.2017]
Now opensourced under gplv3! GITHUB Get it in f-droid F-DROID page (v10 probably won't be there until release of stable gradle 4.0 and buildtools 26) Now available on the XDA Labs! XDA Labs page (UPD: somebody released a fork without changing...
forum.xda-developers.com

Categories

Resources