Database Info

[How to] (SOLVED) Deodex MIUI apps ?

Hi there,
I am trying to deodex LatinIME.odex file from the latest MIUI and having this error :
Code:
UNEXPECTED TOP-LEVEL EXCEPTION:
org.jf.dexlib.Util.ExceptionWithContext: regCount does not match the number of a
rguments of the method
at org.jf.dexlib.Util.ExceptionWithContext.withContext(ExceptionWithCont
ext.java:54)
at org.jf.dexlib.Code.InstructionIterator.IterateInstructions(Instructio
nIterator.java:92)
at org.jf.dexlib.CodeItem.readItem(CodeItem.java:154)
at org.jf.dexlib.Item.readFrom(Item.java:76)
at org.jf.dexlib.OffsettedSection.readItems(OffsettedSection.java:48)
at org.jf.dexlib.Section.readFrom(Section.java:143)
at org.jf.dexlib.DexFile.<init>(DexFile.java:431)
at org.jf.baksmali.main.main(main.java:265)
Caused by: java.lang.RuntimeException: regCount does not match the number of arg
uments of the method
at org.jf.dexlib.Code.Format.Instruction3rc.checkItem(Instruction3rc.jav
a:129)
at org.jf.dexlib.Code.Format.Instruction3rc.<init>(Instruction3rc.java:7
9)
at org.jf.dexlib.Code.Format.Instruction3rc.<init>(Instruction3rc.java:4
4)
at org.jf.dexlib.Code.Format.Instruction3rc$Factory.makeInstruction(Inst
ruction3rc.java:145)
at org.jf.dexlib.Code.InstructionIterator.IterateInstructions(Instructio
nIterator.java:84)
... 6 more
Error occured at code address 0
code_item @0xa90c
I type this cmd line to get that :
java -jar baksmali.jar -d framework -x LatinIME.odex
In the frameworkd folder, I just put all the files found in the \system\framework folder from the ROM.
I don't understand quite well the -c option, maybe I got to play with it, but how ?
Thanks for your help

Ok, I found here that I had to specify an other API Level that de default one (14) set by the baksmali tool.
Whether I don't know what is the API Level for...
Still a newby at this

Broken Webtop

During the weekend, I was testing few things in the webtop using Debian packages and I needed to use my backup image (I did it using dd) to restore the Webtop partition (/dev/block/webtop). The first time I used my backup, everything went fine and the Webtop was restored. But then I understand my mistake in the first trial and tryed install gcc again causing another brake in webtop. After that I restored one more time, but it stopped working.
From the point of view of the Linux system, it seens the problem is that it can't mount correctly the partitions. A df give me:
Filesystem Size Used Available Use% Mounted on
rootfs 1.3G 724.6M 587.0M 55% /
tmpfs 1.3G 724.6M 587.0M 55% /dev
devpts 1.3G 724.6M 587.0M 55% /dev/pts
sysfs 1.3G 724.6M 587.0M 55% /sys
df: /acct: No such file or directory
df: /mnt/asec: No such file or directory
df: /mnt/obb: No such file or directory
df: /dev/cpuctl: No such file or directory
df: /system: No such file or directory
df: /data: No such file or directory
df: /cache: No such file or directory
/dev/block/webtop 1.3G 724.6M 587.0M 55% /
df: /pds: No such file or directory
df: /preinstall: No such file or directory
df: /sys/kernel/security: No such file or directory
df: /mnt/sdcard: No such file or directory
df: /mnt/secure/asec: No such file or directory
df: /mnt/sdcard/.android_secure: No such file or directory
df: /mnt/sdcard: No such file or directory
df: /mnt/asec/com.quoord.tapatalkxda.activity-1: No such file or directory
And when I mkdir /mnt/secure/ or /mnt/sdcard/ it automaticly mounts /dev/block/webtop on it.
I can't even see any block device inside the webtop. A ls /dev/ gives me:
agpgart kmem midi1 ram1 ram9 stdout
audio loop0 midi2 ram10 random tty
audio1 loop1 midi3 ram11 rmidi0 tty0
audio2 loop2 mixer ram12 rmidi1 tty1
audio3 loop3 mixer1 ram13 rmidi2 tty2
audioctl loop4 mixer2 ram14 rmidi3 tty3
console loop5 mixer3 ram15 sequencer tty4
core loop6 mpu401data ram16 shm tty5
dsp loop7 mpu401stat ram2 smpte0 tty6
dsp1 mem null ram3 smpte1 tty7
dsp2 midi0 port ram4 smpte2 tty8
dsp3 midi00 ptmx ram5 smpte3 tty9
fd midi01 pts ram6 sndstat urandom
full midi02 ram ram7 stderr xconsole
fuse midi03 ram0 ram8 stdin zero
And I can't mount any loop device.
In the Android part, everything looks fine.
Anyone have any idea?
Thank you very much!
Cheers,
Luis.

Well, we will need more information before we can be of much help.
1) How were you able install gcc? Did you use my webtop hack, so that you can install using synaptic?
2) Were are you installing these deb packages from?
3) Are you sure you edited ONLY parts in the webtop partition and not the android filesystem? Both of them run a form of linux, and can be confused very easily if you are in the wrong directory, such as /etc and not /osh/etc.
4) Have you tried to flash just the webtop image from the fxz?
This is a good place to start the questions, so that we can be of more help here. Once you answer the above, I will know which way to go from here, hopefully.

jimbridgman said:
Well, we will need more information before we can be of much help.
1) How were you able install gcc? Did you use my webtop hack, so that you can install using synaptic?
2) Were are you installing these deb packages from?
3) Are you sure you edited ONLY parts in the webtop partition and not the android filesystem? Both of them run a form of linux, and can be confused very easily if you are in the wrong directory, such as /etc and not /osh/etc.
4) Have you tried to flash just the webtop image from the fxz?
This is a good place to start the questions, so that we can be of more help here. Once you answer the above, I will know which way to go from here, hopefully.
Click to expand...
Click to collapse
Thank you very much for your repply!
So,
1) I was not abble to install gcc from the repositories (from Ubuntu Maverick one). I always get an error installing the libc6. After I tracked the error to readlink it almost worked, I was only getting a error to move a file. But then I gave up and decided to wait for my sdcard arrive.
2) From the repositories. I tried the first time using Debian Squeeze repository and, after that, using Ubuntu Maverick one. I didn't use your hack because I was trying to learn what exactly brake compability with moto's packages.
3) That's a excelent question! In first place I really thought I was changing only the /osh partition, but I saw today that the /etc/ is actualy /osh/etc even for Android. So I changed things for Android too.
But in principle, this partition was restored when I dd it back to my backup.
4) No. Actualy I was looking for a FXZ image to do this. The only one I found Online was this: InlineFlashing_edison_5.5.175.16_cfc_p3_APBP_CID285.zip in Filefactory site, but I could not Download it yet due site limitations.
Thank you very much!
Cheers,
Luis.

lfgomez said:
Thank you very much for your repply!
So,
1) I was not abble to install gcc from the repositories (from Ubuntu Maverick one). I always get an error installing the libc6. After I tracked the error to readlink it almost worked, I was only getting a error to move a file. But then I gave up and decided to wait for my sdcard arrive.
2) From the repositories. I tried the first time using Debian Squeeze repository and, after that, using Ubuntu Maverick one. I didn't use your hack because I was trying to learn what exactly brake compability with moto's packages.
3) That's a excelent question! In first place I really thought I was changing only the /osh partition, but I saw today that the /etc/ is actualy /osh/etc even for Android. So I changed things for Android too.
But in principle, this partition was restored when I dd it back to my backup.
4) No. Actualy I was looking for a FXZ image to do this. The only one I found Online was this: InlineFlashing_edison_5.5.175.16_cfc_p3_APBP_CID285.zip in Filefactory site, but I could not Download it yet due site limitations.
Thank you very much!
Cheers,
Luis.
Click to expand...
Click to collapse
Ok, there are a few issues here.
1) try to restore the webtop image from the fxz. Go and grab the correct version of the fxz from here:
http://sbf.droid-developers.org/edison/list.php
Then unzip and cd into the directory and, make sure you have the moto-fastboot command, and that adb works:
Motofastboot:
32bit for windows:
https://dl.dropbox.com/u/45576654/moto-fastboot-win32.zip
put it somwhere in your path and open a command line and cd into the directory where you unzipped the fxz and run the following, this will take a bit of time to complete, once started (about 10 min):
Code:
adb reboot bootloader
moto-fastboot flash webtop grfs.img
moto-fastboot reboot
2) Now go run my hack, once you have your SDcard, the issue you ran into is that the webtop instance had MACLs and FACLs inplace, and any changes you make to ANY files can have a BAD effect. That is why my hack exists.
My webtop hack:
http://forum.xda-developers.com/showthread.php?t=1375042

jimbridgman said:
Ok, there are a few issues here.
1) try to restore the webtop image from the fxz. Go and grab the correct version of the fxz from here:
http://sbf.droid-developers.org/edison/list.php
Then unzip and cd into the directory and, make sure you have the moto-fastboot command, and that adb works:
Motofastboot:
32bit for windows:
https://dl.dropbox.com/u/45576654/moto-fastboot-win32.zip
put it somwhere in your path and open a command line and cd into the directory where you unzipped the fxz and run the following, this will take a bit of time to complete, once started (about 10 min):
Code:
adb reboot bootloader
moto-fastboot flash webtop grfs.img
moto-fastboot reboot
2) Now go run my hack, once you have your SDcard, the issue you ran into is that the webtop instance had MACLs and FACLs inplace, and any changes you make to ANY files can have a BAD effect. That is why my hack exists.
My webtop hack:
http://forum.xda-developers.com/showthread.php?t=1375042
Click to expand...
Click to collapse
Thank you very much!
I'm downloading now the image! I will restore it using your guide.
I will wait my SDCard to play more freely with the Webtop!
Again, thank you very much!
Cheers,
Luis.

Still broken webtop
Hi,
I tried to unlock the webtop, but I broken it.
Now I try to flash back the webtop, but I get following messages:
C:\Program Files\sdk\platform-tools>moto-fastboot flash webtop grfs.img
load_file: could not allocate 1400635392 bytes
error: cannot load 'grfs.img'
Seems to me that the webtop partition is to small for grfs.img (only 1GB space)
At the moment even HDMI out from my ATRIX2 do not show any response. :crying:

florescu said:
Hi,
I tried to unlock the webtop, but I broken it.
Now I try to flash back the webtop, but I get following messages:
C:\Program Files\sdk\platform-tools>moto-fastboot flash webtop grfs.img
load_file: could not allocate 1400635392 bytes
error: cannot load 'grfs.img'
Seems to me that the webtop partition is to small for grfs.img (only 1GB space)
At the moment even HDMI out from my ATRIX2 do not show any response. :crying:
Click to expand...
Click to collapse
Are you flashing a correct image? Double check.
Sent from my MB865 using Tapatalk 2

duchski said:
Are you flashing a correct image? Double check.
Sent from my MB865 using Tapatalk 2
Click to expand...
Click to collapse
I am using 2.3.6, systemversion 55.28.37.MB865.MERetail.en.06, Build 5.5.1-EDEM-28-37, and webtob WT-1.3.0-176. It is an ATT device.
I tryed the webtop image from
InlineFlashing_edison_5.5.175.25_cfc_p3_APBP.xml.zip
and
Returntostock2.3.5script.zip (edison-user 2.3.5 5.5.1-175_EDFFW1-16 5.51.175.16)
Both with the same error:
C:\Program Files\sdk\platform-tools>moto-fastboot flash webtop "\ATRIX2\Return to stock\grfs.img"
load_file: could not allocate 1400635392 bytes
error: cannot load '\ATRIX2\Return to stock\grfs.img'
C:\Program Files\sdk\platform-tools>fastboot flash webtop "\ATRIX2\Return to stock\grfs.img"
target reported max download size of 1056964608 bytes
Invalid sparse file format at header magi
Perhaps both version should be wrong? Where can I find the right one?

I was able to flash webtop via RDS light 6.0 using following script in InlineFlashing_edison_5.5.175.25_cfc_p3_APBP.xml and ndp.xml
<?xml version="1.0" encoding="UTF-8"?>
<flashing>
<header>
<phone_model model="EDISON" />
<software_version version="edison-user 2.3.6 5.5.1-175_EDMR1.25 5.51.175.25 release-keys2011-11-16 23:52 Off.Bld LUD_EDISON_R1D7_PATCH_36_111116_2336 crh1090280_M570_PC_CARD_RAIN" />
<interfaces>
<interface name="AP" />
</interfaces>
</header>
<steps interface="AP">
<step operation="flash" partition="webtop" filename="grfs.img" MD5="0f5c9e3fae804041d9f21a32b5c4179f" />
</steps>
</flashing>
It seems flashing without any error message.
But it sill not working ... no HDMI signal ...

After all I have to use the "Returntostock2.3.5script.zip" and reinstall my "MERetail-MEARET-55.28.37.zip" ROM and all apps.
Now webtop works and I will do a backup BEFORE I will try webtop2sd again ...

Backup apps and their data from rooted phone, restore on unrooted phone

Dear everyone,
I'd like to backup all apps and their data and settings from my old phone (Android 4.0.4, have a root shell if needed) and restore them to a new phone (Android 10) which I don't want to root. I've considered the following options, but would be glad about some guidance.
1. Backup with adb backup, restore with adb restore
This would be the obvious choice, I guess. However, my old phone is an Xperia Ray with stock ROM, which cannot run adb backup.
If I try to backup an app, I get the following in adb logcat:
Code:
V/BackupManagerService( 290): Requesting full backup: apks=false shared=false all=false pkgs=[Ljava.lang.String;@2c36b0b8
I/BackupManagerService( 290): Beginning full backup...
D/BackupManagerService( 290): Starting backup confirmation UI, token=940595255
I/ActivityManager( 290): START {act=fullback flg=0x10000000 cmp=com.android.backupconfirm/.BackupRestoreConfirmation (has extras)} from pid 290
E/BackupManagerService( 290): Unable to launch full backup confirmation
D/BackupManagerService( 290): Full backup processing complete.
The "Unable to launch full backup confirmation" is because BackupRestoreConfirmation.apk is missing.
I downloaded a system image from https://dl.google.com/android/repository/sys-img/android/sysimg_armv7a-14_r02.zip, extracted the files with unyaffs, and tried installing the BackupRestoreConfirmation.apk with adb install. This fails with INSTALL_FAILED_DEXOPT because it's an odexed app.
Using a root shell, I copied the extracted BackupRestoreConfirmation.apk and BackupRestoreConfirmation.odex to /system/app and rebooted the phone. I can see that the files are there:
Code:
$ adb shell ls -l /system/app | grep -i 'backup'
-rw-r--r-- root root 88093 2011-11-24 00:00 BackupRestoreConfirmation.apk
-rw-r--r-- root root 11816 2011-11-24 00:00 BackupRestoreConfirmation.odex
-rw-r--r-- root root 84730 2012-05-08 20:51 GoogleBackupTransport.apk
However, it still does not show up among the system apps:
Code:
$ adb shell pm list packages -f | grep -i 'backup'
package:/system/app/GoogleBackupTransport.apk=com.google.android.backup
I was expecting an entry for com.android.backupconfirm.
Q: Am I missing anything to install it as a system app? Is there any configuration file it needs to be added to?
2. Backup with a modified adb backup, restore with adb restore
Since I have root access, would it be possible to replace some code on my device such that adb backup does not require a confirmation?
adb backup calls /system/bin/bu, which runs /system/framework/bu.jar. From https://android.googlesource.com/pl...fs/tags/android-4.0.4_r2.1/cmds/bu?autodive=0, it seems that this calls somewhere into https://android.googlesource.com/pl...roid-4.0.4_r2.1/core/java/android/app/backup/, but is not directly responsible for the confirmation dialog.
Going backwards instead, "Unable to launch full backup confirmation" is printed from https://android.googlesource.com/pl...android/server/BackupManagerService.java#4911, which lives in /system/framework/services.jar.
Q: How complicated is it to compile and install a modified version of services.jar/services.odex? Is this even possible in a live system?
3. Create .ab file without adb backup, restore with adb restore
Since I have root access, I can copy out all the files I want. An .ab file is a compressed .tar archive with a special 24-byte header. If I knew which files go into the .ab file, and maybe in which order, with which permissions and user ids, and how to create the 24-byte header, I could manually create the .ab files to feed to adb restore.
Q: Is there a generic recipe for creating a .ab file for an app? Or does each app decide individually which files to backup and restore?
Thank you for any hints!

May be this helps you:
Backup android app, data included, no root needed, with adb
Backup android app, data included, no root needed, with adb - android-backup-apk-and-datas.md
gist.github.com

jwoegerbauer said:
May be this helps you:
Backup android app, data included, no root needed, with adb
Backup android app, data included, no root needed, with adb - android-backup-apk-and-datas.md
gist.github.com
Click to expand...
Click to collapse
Thank you! Unfortunately, this also uses adb backup to pull the data, for which I need to find a way to install com.android.backupconfirm on my device.

I use ApkExport* from Playstore on my non-rooted 10+ to backup all my loaded apps.
Have done a full restore using only the stored copies; worked perfectly. Cut down load time substantially... took Playwhore out of the loop.
*freeware, no ads, no internet connection

blackhawk said:
I use ApkExport* from Playstore on my non-rooted 10+ to backup all my loaded apps.
Click to expand...
Click to collapse
Thank you! But if I see correctly, this only copies the .apk files (basically, the /data/app directory), but does not export their settings and data to be imported to a new device.

f0k said:
Thank you! But if I see correctly, this only copies the .apk files (basically, the /data/app directory), but does not export their settings and data to be imported to a new device.
Click to expand...
Click to collapse
This is correct. Probably better this way especially if the phone was compromised by malware.
My important apps that are hard to reconfigure are backed up separately. I deliberately picked ones that allow for complete backup like Poweramp, PD MDM and ColorNote.

f0k said:
Thank you! Unfortunately, this also uses adb backup to pull the data, for which I need to find a way to install com.android.backupconfirm on my device.
Click to expand...
Click to collapse
The mentioned missing APKs you can fetch here:
Root - Stock APK's
Directory of \m830\rom\app 10/12/2012 05:21 PM 143,392 AccuweatherDaemon.apk 10/12/2012 05:21 PM 3,064,214 AccuweatherWidget.apk 10/12/2012 05:21 PM 5,808,937 AccuweatherWidget_Main.apk 10/12/2012 05:21 PM 124,220 Activation.apk 10/12/2012 05:21 PM...
androidforums.com

jwoegerbauer said:
The mentioned missing APKs you can fetch here:
Root - Stock APK's
Directory of \m830\rom\app 10/12/2012 05:21 PM 143,392 AccuweatherDaemon.apk 10/12/2012 05:21 PM 3,064,214 AccuweatherWidget.apk 10/12/2012 05:21 PM 5,808,937 AccuweatherWidget_Main.apk 10/12/2012 05:21 PM 124,220 Activation.apk 10/12/2012 05:21 PM...
androidforums.com
Click to expand...
Click to collapse
The download link does not work any more. However, as described above, I already extracted the missing .apk and .odex from an official sysimg from https://dl.google.com/android/repository/sys-img/android/sysimg_armv7a-14_r02.zip. That .apk is 88093 bytes and the .odex is 11816 bytes. The link you posted had a .apk of 15089 bytes and misses the .odex. Not sure if this is relevant.
In any case, user "animania260" in the thread you posted had the same problem as me: I copied the .apk and .odex into /system/app and rebooted, but adb backup still fails with the same error, and /system/app/BackupRestoreConfirmation.apk is not listed among the installed apps (adb shell pm list packages -f).
Is there anything else that needs to be done to get the phone to accept a new system app? Or are there any special requirements for system apps? Do they need to be signed differently than what's included in the official sysimg, for example?
Another route could be to compile https://android.googlesource.com/pl....0.4_r2.1/packages/BackupRestoreConfirmation/ into a deodexed .apk and install it as a user app, but I don't know how to do that yet, and I don't know if https://android.googlesource.com/pl...android/server/BackupManagerService.java#4988 will just happily start a user app if it happens to provide an intent of the correct name.

f0k said:
I copied the .apk and .odex into /system/app and rebooted, but adb backup still fails with the same error, and /system/app/BackupRestoreConfirmation.apk is not listed among the installed apps (adb shell pm list packages -f).
Is there anything else that needs to be done to get the phone to accept a new system app? Or are there any special requirements for system apps? Do they need to be signed differently than what's included in the official sysimg, for example?
Click to expand...
Click to collapse
IMO the APKs in question must NOT get simply 1:1 copied into /system/app but also renamed
Example:
Code:
/system/app/BackRestoreConfirmation-1.apk
and additionally given 0644 permission. Phone has to get re-booted afterwards, too, if that's not automatically done.
But I may err as always ...

jwoegerbauer said:
IMO the APKs in question must NOT get simply 1:1 copied into /system/app but also renamed
Click to expand...
Click to collapse
Renaming the package did not help, but this time I started adb logcat directly after adb reboot, and found something relevant that came up early in the boot process:
Code:
I/PackageManager( 291): /system/app/BackupRestoreConfirmation-1.apk changed; collecting certs
I/dalvikvm( 291): DexOpt: mismatch dep signature for '/system/framework/core.odex'
E/dalvikvm( 291): /system/app/BackupRestoreConfirmation-1.apk odex has stale dependencies
E/dalvikvm( 291): odex source not available -- failing
W/PackageManager( 291): StaleDexCacheError when reading apk: /system/app/BackupRestoreConfirmation-1.apk
W/PackageManager( 291): dalvik.system.StaleDexCacheError: /system/app/BackupRestoreConfirmation-1.apk
W/PackageManager( 291): at dalvik.system.DexFile.isDexOptNeeded(Native Method)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.performDexOptLI(PackageManagerService.java:3080)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.scanPackageLI(PackageManagerService.java:3634)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.scanPackageLI(PackageManagerService.java:2963)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.scanDirLI(PackageManagerService.java:2775)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.<init>(PackageManagerService.java:1066)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:837)
W/PackageManager( 291): at com.android.server.ServerThread.run(SystemServer.java:167)
D/PackageManager( 291): No files in app dir /vendor/app
So if I interpret this correctly, there really is a problem with the signatures. Just out of curiosity, I tried whether apps in /vendor/app would be treated differently. I created /vendor/app, moved the .apk and .odex there and rebooted, but get the same error just with different paths.
Some googling informs me that this is probably because the /system/framework/core.odex on my device is not the same as the framework/core.odex in the sysimg I took the odexed BackupRestoreConfirmation.apk from.
From https://android.googlesource.com/pl...roid-4.2.2_r1/vm/analysis/DexPrepare.cpp#1142, it seems it would be trivial to just go ahead and replace the signatures of all dependencies in BackupRestoreConfirmation.odex (with a hexdump, I can see there are nine dependencies). Is the .odex signed to catch such a modification, or would it pass through? And how would I obtain the SHA-1 signatures from the source DEX files? My device apparently knows them.
/edit: They're part of the .odex header, the signature is at offset 0x34 and has 20 bytes, so I could copy out the SHA-1 signatures from the dependencies on my phone and implant them in BackupRestoreConfirmation.odex. But that signature check will be there for a reason, I assume the .odex will point at specific offsets in its dependencies and crash if the dependencies are not the original ones.
So I will either have to recompile BackupRestoreConfirmation.apk from source with WITH_DEXPREOPT=0 or to deodex the compiled one, so I don't need a .odex file at all.
I'm learning a lot more about the internals of Android than I ever intended to

Finally got around continuing this quest, and it worked! I deodexed the BackupRestoreConfirmation.apk, resigned it, installed it as a system app, and can now run adb backup on my Xperia Ray, Android 4.0.4 ICS.
For posterity, I am documenting all required steps (assuming a Linux machine).
1. Download and extract a stock system image
Download a system image for Android 4.0.4: https://dl.google.com/android/repository/sys-img/android/sysimg_armv7a-14_r02.zip
Unzip it.
Extract the image with unyaffs (can be installed with apt install unyaffs in Ubuntu):
Code:
mkdir /tmp/sysimg
unyaffs armeabi-v7a/system.img /tmp/sysimg
It will say Warning: Can't restore owner/group attribute, run unyaffs as root, that can be safely ignored, we do not need files to be owned by root.
2. Deodex BackupRestoreConfirmation.apk
Download smali and baksmali (https://github.com/JesusFreke/smali, find download link in the README), put the two .jar files somewhere (I assume /tmp)
Extract the .odex file. java -jar /tmp/baksmali*.jar x --help is pretty self-explanatory. I did:
Code:
mkdir /tmp/backuprestore
java -jar /tmp/baksmali*.jar x -a 14 -d /tmp/sysimg/framework -o /tmp/backuprestore/out /tmp/sysimg/app/BackupRestoreConfirmation.odex
Assemble the smali files into a .dex file. Again, java -jar /tmp/smali*.jar a --help is pretty self-explanatory. I did:
Code:
java -jar /tmp/smali*.jar a -a 14 -o /tmp/backuprestore/classes.dex /tmp/backuprestore/out
Add the .dex file to the .apk file. We will copy the .apk to be sure.
Code:
cp /tmp/sysimg/app/BackupRestoreConfirmation.apk /tmp/backuprestore
cd /tmp/backuprestore
zip BackupRestoreConfirmation.apk classes.dex
It is not needed to do a new zipalign. If you're curious, you can install it (in Ubuntu, sudo apt install zipalign) and run zipalign -c 4 BackupRestoreConfirmation.apk && echo aligned || echo not aligned to check it.
If you try to install the file with adb install BackupRestoreConfirmation.apk now, it will say: Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES], because it is not correctly signed any longer. We need to resign it.
Install signapk (in Ubuntu, sudo apt install signapk. If you want, you can first verify that it is indeed not signed:
Code:
jarsigner -verify BackupRestoreConfirmation.apk
It should say jarsigner: java.lang.SecurityException: SHA1 digest error for classes.dex.
The original .apk is signed correctly; with
Code:
jarsigner -verify -verbose -certs /tmp/sysimg/app/BackupRestoreConfirmation.apk
you will see that it was signed by "[email protected], CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US" with a 2048-bit key.
Create a key for signing. This can be done with keytool, but this will set up a keystore that will be left behind. Instead, I followed a guide from https://sites.google.com/site/delocatedsystems/android/howto/create-cert-signapk, using 2048 instead of 1024 bits:
Code:
openssl genrsa -out key.pem 2048
openssl req -new -key key.pem -out request.pem # this will ask for some data, make up something
openssl x509 -req -days 9999 -in request.pem -signkey key.pem -out certificate.pem
openssl pkcs8 -topk8 -outform DER -in key.pem -inform PEM -out key.pk8 -nocrypt
Finally, we can sign the .apk:
Code:
signapk certificate.pem key.pk8 BackupRestoreConfirmation.apk BackupRestoreConfirmation_signed.apk
mv BackupRestoreConfirmation{,_unsigned}.apk
mv BackupRestoreConfirmation{_signed,}.apk
And optionally verify it with jarsigner -verify BackupRestoreConfirmation.apk -certs -verbose.
3. Install BackupRestoreConfirmation.apk
If you just install it with adb install BackupRestoreConfirmation.apk, it will be installed as user app. If you then run adb backup, the confirmation dialog will appear as intended. But if you confirm it, you will get:
Code:
D/BackupManagerService( 292): acknowledgeFullBackupOrRestore : token=1892071259 allow=true
D/AndroidRuntime( 8310): Shutting down VM
W/dalvikvm( 8310): threadid=1: thread exiting with uncaught exception (group=0x2b542210)
E/AndroidRuntime( 8310): FATAL EXCEPTION: main
E/AndroidRuntime( 8310): java.lang.SecurityException: acknowledgeFullBackupOrRestore: User 10104 does not have android.permission.BACKUP.
(Uninstall again with adb shell pm uninstall com.android.backupconfirm if needed.) So the .apk must be installed as a system app to have the android.permission.BACKUP permission.
To do so, copy the .apk file to your device:
Code:
adb push BackupRestoreConfirmation.apk /data/local/tmp
Now open a root shell on the device. This can be done via an exploit I explained in another post. Assuming you are in a root shell on the device, do:
Code:
remount -o rw,remount /system
cat /data/local/tmp/BackupRestoreConfirmation.apk > /system/app/BackupRestoreConfirmation.apk
chmod 644 /system/app/BackupRestoreConfirmation.apk
remount -o ro,remount /system
exit
In my case, the app was picked up directly, without having to reboot the phone. Verify with:
Code:
adb shell pm list packages -f | grep -F backup
If it worked, the list will contain:
Code:
package:/system/app/BackupRestoreConfirmation.apk=com.android.backupconfirm
Otherwise you may need to reboot your phone with adb reboot.
When you now try to backup an app with adb backup -f theappname.ab -apk com.theappname (where com.theappname is taken from the list of user apps produced with adb shell pm list packages -3), you may find that instead of a 0-byte file that you get with a missing BackupRestoreConfirmation.apk, you get a 41-byte file, which is only a moderate improvement. In adb logcat, you may find:
Code:
V/BackupManagerService( 811): Requesting full backup: apks=false shared=false all=false pkgs=[Ljava.lang.String;@4181ffc8
W/BackupManagerService( 811): Unknown package '-apk' 'com.theappname', skipping
It may not be apparent at first, but the quotes around -apk and com.theappname in the error message are not put there by BackupManagerService, they are introduced by recent versions of adb to safeguard against a shell injection. This is why -apk is not detected as a flag, and the package name is not recognized as a package. The solution is to downgrade to an earlier version of adb, as explained in more detail on https://android.stackexchange.com/a/132921.
To check the version of adb on your computer, run:
Code:
adb version
To check the version of adb on the phone, run:
Code:
adb shell adb version
In my case, the phone is running 1.0.29, but downgrading adb to 1.0.31 was enough. Precompiled versions are available for Linux, Mac, Windows.
Finally, you can backup apps with adb backup (at least those apps which support it). Phew!
(PS: If you want to run adb backup -shared, you will need to deodex and install SharedStorageBackup.apk. Didn't try.)

SELinux Issue? Modifying System CACERTS On Nougat Emulator

I'm trying to modify the cacerts file on the system partition of a non-Google Play emulator to avoid annoying messages during development / Pen Testing on Nougat, related to an app I'm working with and I'm running into some issues. Even though I successfully copy the file to the /etc/security/cacerts/ directory and have confirmed the certificate is in the same format, its not showing as a Trusted Credential and gives a permission denied error when utilizing ls -al as a regular user (but displays fine as root). Permissions and file ownership are the same on all certificates, including mine; but my certificate shows up as "unlabeled" when I do an ls -aZl, verses all the working certificates show a label of "system_file". As a result, I'm assuming this is due to SELinux on the emulator, but I'm new to SELinux and I can't figure out what is setting that label. I utilized the following tool to convert file_contexts.bin, but nothing in there appears to reference cacerts. I'm not quite sure where to poke next.
In case it matters, and from a techniques standpoint in case anyone wants to get as far as I have in this:
I utilized Arsenal Image Mounter to mount the system.img file as writeable that was found in the following location:
%USERPROFILE%\AppData\Local\Android\Sdk\system-images\android-25\default\x86_64
Utilizing that I copied my certificate to /etc/security/cacerts/9a5ba575.0 (A copy of this cert is attached as 9a5ba575.0.txt ) . (I did this both as a copy & paste of the local file in Windows, and by duplicating an existing working certificate file utilizing a cygwin bash, and replacing the file contents. Neither method made a difference)
I then built an Android Virtual Device (AVD) and booted it up.
The command ' adb shell "ls -aZl 9a*" as non-root yields (First result is my cert, 2nd is another cert):
Code:
ls: /etc/security/cacerts/9a5ba575.0: Permission denied
-rw-r--r-- 1 root root u:object_r:system_file:s0 7537 2018-08-03 14:57 /etc/security/cacerts/9ab62355.0
The same command run as root yields:
Code:
-rw-r--r-- 1 root root u:object_r:unlabeled:s0 4246 2022-07-06 10:50 /etc/security/cacerts/9a5ba575.0
-rw-r--r-- 1 root root u:object_r:system_file:s0 7537 2018-08-03 14:57 /etc/security/cacerts/9ab62355.0
This shows my certificate is being loaded properly, but has "permission" issues. As you can tell from the ls -aZL output though, the only difference is the security label.
Thanks for your help!

Question Samsung galaxy watch 4 remove icon

Hey , I been browsing a way to find the solution to this problem seems like nobody has a solution, so hoping to figure it out here. So, my galaxy watch 4 has this small icon which means that the bluetooth has been disconnected from my phone. And the icon just stays at the screen which is annoying, I want this removed. I was thinking of sifting through the watches icon location and just replacing the icon to a transparent one. But the thing is I cannot seem to find the location to where all the icons are stored on the watch so if someone could point me to the right direction I appreciate it. Or if someone has a different way of removing this icon that would be nice. I have attached a picture below to see what I'm talking about.

If somebody can identify. Where this Icon is inside...
?
Here are 2 older Full Firmware packages.
Firmware and Combination Firmware and FOTA Delta and CSC change and...
Looks like it could be harder since Tizen... A Stock Firmware for netOdin/Odin not available yet... B Combination Firmware not available yet C FOTA Delta File for study I have...
forum.xda-developers.com
No idea if inside Watch Face... or deeper inside Android 11...
But I agree.
Ugly.
Best Regards

Icon is most likely located in the SystemUI for watch ....would need to be rooted to be able to replace though.

....would need to be rooted to be able to replace though.
Click to expand...
Click to collapse
Done.
I have rooted SM-R870 GVH2.
Again.
Where exactly is this Icon?
If I have time I will Google little bit. Because this Android s hi t...
Samsung have 1000000000000000000000000000000000000000000000000000 similar s h it...
Maybe Resources inside framework.apk...
?
Maybe somebody can deliver full anwser...
Thanx in advance.
Best Regards

adfree said:
Done.
I have rooted SM-R870 GVH2.
Again.
Where exactly is this Icon?
If I have time I will Google little bit. Because this Android s hi t...
Samsung have 1000000000000000000000000000000000000000000000000000 similar s h it...
Maybe Resources inside framework.apk...
?
Maybe somebody can deliver full anwser...
Thanx in advance.
Best Regards
Click to expand...
Click to collapse
You may be right that it is located in the framework apk.....been a while since I've played around with the system icons so unfortunately i can't add any solutions at this point

Attempt 1... to find this Pic... Icon...
Decompiled framework-res.apk
Code:
19.09.2022 21:47:27
Decompiling APK file...
/c "java -Xmx1024m -jar "D:\Android\apkSignMe\easy\Apktool\apktool-2.4.1-b05f19-11.20.2019.jar" d -f -o "D:\Android\apkSignMe\easy\1-Decompiled APKs\framework-res" "D:\Android\apkSignMe\2022\September\framework-res.apk""
I: Using Apktool 2.4.1-b05f19-SNAPSHOT on framework-res.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
------------------------------------------
Used older APK Easy Tool.
Now I need to click around...

adfree said:
Attempt 1... to find this Pic... Icon...
Decompiled framework-res.apk
Code:
19.09.2022 21:47:27
Decompiling APK file...
/c "java -Xmx1024m -jar "D:\Android\apkSignMe\easy\Apktool\apktool-2.4.1-b05f19-11.20.2019.jar" d -f -o "D:\Android\apkSignMe\easy\1-Decompiled APKs\framework-res" "D:\Android\apkSignMe\2022\September\framework-res.apk""
I: Using Apktool 2.4.1-b05f19-SNAPSHOT on framework-res.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
------------------------------------------
Used older APK Easy Tool.
Now I need to click around...
Click to expand...
Click to collapse
I have decompiled this apk and went through each file but to no luck could not find the icon I was looking for maybe its in another apk? If someone knows...

john1122233 said:
I have decompiled this apk and went through each file but to no luck could not find the icon I was looking for maybe its in another apk? If someone knows...
Click to expand...
Click to collapse
Check the SystemUI apk, in the "drawable" folder

louforgiveno said:
Check the SystemUI apk, in the "drawable" folder
Click to expand...
Click to collapse
Yep seems to be there just need to reinstall the apk thanks!

SecClockworkSystemUI.apk
Code:
basic_clock_comp_indi_disconnected.webp
Okidoki... Need some time for test...
Thanx for help in finding this ugly thing.
Best Regards

Tiny hint...
If I search with Total Commander for this text string through files from system...
Then I get 2 hits...
1 file we know allready...
Second:
Code:
\priv-app\SecClockworkSysUi\SecClockworkSysUi.apk
Best Regards

Few things prepared... few things not yet...
As only Browser installed for webp Pics... I have updated my old IrfanView with Plugins to search better through Pics...
Our Pic/Icon seems 52 x 52 Pixel...
Now I pull both APKs from my SM-R870... to have latest GVH2 crap...
As I have only looked into old FVD4 or EVA8...
Edit 1.
Now I have both APKs from SM-R870 GVH2...
Code:
D:\Android\ADB>adb pull /system/priv-app/SecClockworkSysUi/SecClockworkSysUi.apk
/system/priv-app/SecClockworkSysUi/SecClockworkSysUi.apk: 1 file pulled. 1.2 MB/s (20740955 bytes in 16.553s)
D:\Android\ADB>adb pull /system/priv-app/SecClockworkSystemUI/SecClockworkSystemUI.apk
/system/priv-app/SecClockworkSystemUI/SecClockworkSystemUI.apk: 1 file pulled. 1.3 MB/s (40685449 bytes in 29.148s)
Will decompile both and look...
Edit 2.
Hmmmm...
basic_clock_comp_indi_disconnected.webp is 1:1 same in both APKs:
Code:
SecClockworkSysUi.apk
SecClockworkSystemUI.apk
1 idea is to replace both APKs at once...
And inside file basic_clock_comp_indi_disconnected.webp 2 different Pics...
So IMHO easier to identify which APK really creates this ugly Icon...
Edit 3.
First problem... I can not compile...
Code:
W: fakeLogOpen(/dev/log_stats) failed
W: Failed to generate resource table for split ''
W: D:\Android\apkSignMe\easy\1-Decompiled APKs\SecClockworkSystemUI_GVH2\res\values\styles.xml:1660: error: Error: Color types not allowed (at 'android:disableChildrenWhenDisabled' with value '#8cfafafa').
W:
brut.androlib.AndrolibException: brut.common.BrutException: could not exec (exit code = 1): [E:\Temp\brut_util_Jar_
SecClockworkSystemUI.apk
So first attempt with the other APK only...
Code:
D:\Android\ADB>adb push 8keyme8.zip /sdcard/Download
8keyme8.zip: 1 file pushed. 1.7 MB/s (8125270 bytes in 4.677s)
I am using Magisk Module to replace APK inside priv-app folder...
Edit 4.
Okidoki... first result...
Code:
D:\Android\ADB>adb shell screenrecord /sdcard/video.mp4
^C
D:\Android\ADB>adb pull /sdcard/video.mp4
/sdcard/video.mp4: 1 file pulled. 0.0 MB/s (361916 bytes in 8.996s)

Tiny progress...
A
Yes, basic_clock_comp_indi_disconnected.webp is correct file for this ugly Icon...
B
Because inside 2 APKs... and I have trouble with 1 APK to recompile...
Anyway. The recompiled APK is correct...
Code:
SecClockworkSysUi.apk
Just for fun replaced with:
basic_clock_comp_indi_donotdisturb.webp
Because same size 52 x 52 Pixel...
C
I have only replaced APK not the other crap... inside:
Code:
/system/priv-app/SecClockworkSysUi/
No idea if crash because this or because other problem like wrong Signature...
D
Result looks like this on my Screen... Look at attached Video...
Seems it craches... ever and ever again...
I am too lazy to check Logfiles for now...
Will do some checks if we can disable this APK for stupid test... or GW4 explode...
Best Regards

For next stupid test I need this Thread:
Watch4 ADB Commands - Disable/Enable/Uninstall/Restore system app, Install/pull Apps
Hello Everyone, I hope you all are good, So I see some on you wondering about how to uninstall, reinstall, install, pull, enable and disable apps for the watch, so I decided to make this thread to address these different scenarios, this is based...
forum.xda-developers.com
I will focus on SecClockworkSysUi.apk
Edit 1.
Code:
freshbl:/ $ pm path com.samsung.android.wearable.sysui
package:/system/priv-app/SecClockworkSysUi/SecClockworkSysUi.apk
freshbl:/ $ cd /system/priv-app/SecClockworkSysUi/
freshbl:/system/priv-app/SecClockworkSysUi $ ls -a1l
total 18164
drwxr-xr-x 3 root root 80 2022-09-21 03:13 .
drwxr-xr-x 112 root root 2240 2022-09-21 03:13 ..
-rw-r--r-- 1 root root 18574323 2022-09-21 03:12 SecClockworkSysUi.apk
drwxr-xr-x 3 root root 4096 2008-12-31 16:00 oat
freshbl:/system/priv-app/SecClockworkSysUi $ cd oat
freshbl:/system/priv-app/SecClockworkSysUi/oat $ ls -a1l
total 8
drwxr-xr-x 3 root root 4096 2008-12-31 16:00 .
drwxr-xr-x 3 root root 80 2022-09-21 03:13 ..
drwxr-xr-x 2 root root 4096 2008-12-31 16:00 arm
freshbl:/system/priv-app/SecClockworkSysUi/oat $ cd arm
freshbl:/system/priv-app/SecClockworkSysUi/oat/arm $ ls -a1l
total 25392
drwxr-xr-x 2 root root 4096 2008-12-31 16:00 .
drwxr-xr-x 3 root root 4096 2008-12-31 16:00 ..
-rw-r--r-- 1 root root 25933248 2008-12-31 16:00 SecClockworkSysUi.odex
-rw-r--r-- 1 root root 56086 2008-12-31 16:00 SecClockworkSysUi.vdex
freshbl:/system/priv-app/SecClockworkSysUi/oat/arm $
Edit 2.
Stupid Test...
OWN Risk!
Code:
freshbl:/system/priv-app/SecClockworkSysUi/oat/arm $ pm disable-user --user 0 com.samsung.android.wearable.sysui
Package com.samsung.android.wearable.sysui new state: disabled-user
Edit 3.
NOT try this.
Watch hangs on Samsung Logo and no WiFi to play with ADB...
So I have to go to Recovery... Fac Reset...

In second attempt I put all files into Magisk Module...
Same result...
This time I looked little bit into Log...
Code:
09-27 00:53:57.407 1000 539 2079 W system_server: Can't mmap dex file /system/priv-app/SecClockworkSysUi/SecClockworkSysUi.apk!classes.dex directly; please zipalign to 4 bytes. Falling back to extracting file.
09-27 00:53:57.551 1000 539 2079 E system_server: Dex checksum does not match for dex: /system/priv-app/SecClockworkSysUi/SecClockworkSysUi.apk.Expected: 2603995429, actual: 4161829172
Need some time to study... find solution how to modify correct System APKs...
Best Regards
Edit 1.
Tried with no decode classes.dex and resources.arsc...
But used 0 Byte file for:
Code:
basic_clock_comp_indi_disconnected.webp
Result is hang on Logo... so maybe not good idea...
Need FAC Reset via Recovery...

Maybe other way without Root...
Code:
settings put global setting_without_phone_connection_mode_on 1
settings put global setting_phone_connection_activation_state 1
settings put secure screensaver_enabled 0
Check:
Code:
settings list system
settings list secure
settings list global
Not fully tested... I am on Standalone Mode... DUK1...

adfree said:
Maybe other way without Root...
Code:
settings put global setting_without_phone_connection_mode_on 1
settings put global setting_phone_connection_activation_state 1
settings put secure screensaver_enabled 0
Check:
Code:
settings list system
settings list secure
settings list global
Not fully tested... I am on Standalone Mode... DUK1...
Click to expand...
Click to collapse
Not working...

I will try to spend some time again with GVI3...
Step 1 done...
Code:
D:\Android\ADBnew>adb pull /system/priv-app/SecClockworkSysUi/ .\gvi3
/system/priv-app/SecClockworkSysUi/: 3 files pulled, 0 skipped. 2.3 MB/s (46789130 bytes in 19.592s)

Maybe somebody can help me to find answer what is vdex and odex...
?
And how to modify if necessary in Android 11?
Code:
-rw-r--r-- 1 root root 18574323 2022-09-21 03:12 SecClockworkSysUi.apk
drwxr-xr-x 3 root root 4096 2008-12-31 16:00 oat
freshbl:/system/priv-app/SecClockworkSysUi $ cd oat
freshbl:/system/priv-app/SecClockworkSysUi/oat $ ls -a1l
total 8
drwxr-xr-x 3 root root 4096 2008-12-31 16:00 .
drwxr-xr-x 3 root root 80 2022-09-21 03:13 ..
drwxr-xr-x 2 root root 4096 2008-12-31 16:00 arm
freshbl:/system/priv-app/SecClockworkSysUi/oat $ cd arm
freshbl:/system/priv-app/SecClockworkSysUi/oat/arm $ ls -a1l
total 25392
drwxr-xr-x 2 root root 4096 2008-12-31 16:00 .
drwxr-xr-x 3 root root 4096 2008-12-31 16:00 ..
-rw-r--r-- 1 root root 25933248 2008-12-31 16:00 SecClockworkSysUi.odex
-rw-r--r-- 1 root root 56086 2008-12-31 16:00 SecClockworkSysUi.vdex
Thanx in advance.
Best Regards