[APP][ROOT] Root Transmission - Root other devices using your phone! - Verizon Samsung Galaxy S III

Root Transmission
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Root Transmission: the ONLY app that allows you to root other phones straight from your own device!
Inspired by Kos's p2p-adb hacking toolkit (http://hak5.org/episodes/hak5-1205), this app is a pleasant, easy way to root other phones while away from your computer! Just two buttons, Root and Unroot! Connect the cable and root away! It couldn't be simpler!
Even has its own terminal window so you can see exactly what's going on while your phone does its thing!
You will need a ROOTED device capable of USB hosting (USB On The Go), a USB OTG cable and one-click root scripts for the devices you wish to root.
Scripts and their associated files should be placed in /sdcard/RootTransmission/*devicename*/*version*/, otherwise it will not be available for use. *devicename* and *version* can be whatever you want.
Note that this is an UNSTABLE version, and you use this app at your own risk. Occasional force closes are to be expected (though they will most likely not break the phone you are trying to root). Incorrectly written scripts can permanently damage or brick both devices involved, so only use trusted 3rd party root scripts and at your own risk.
Click to expand...
Click to collapse
Screenshots
Changelog
1.01unstable
fixed bug that sometimes caused crashing when user closed app
fixed bug that caused app to crash if scripts directory did not exist
Much smaller size (166k)
made it for Android 4.0 and up (accidentally had it for 3.1 and up in Play Store, will re-add Honeycomb support if I find that it works reliably with it)
1.0unstable
initial public release
Click to expand...
Click to collapse
Planned features
Downloading scripts within the app
Nicer GUI
In-app help text
??? Suggest some!
Click to expand...
Click to collapse
​Please do not mirror this apk, it is to be downloaded exclusively through the Play Store or from XDA-Developers. Failure to comply will result in the removal of this app from XDA.
I've attached a zip with the files needed to root a Verizon Galaxy S3 (SCH-I535), extract it to /sdcard/RootTransmission/ to use.
Note that since I only have one USB host-capable device (my own S3), no warranty is provided over the functionality of this zip since I am unable to fully test it. (It is a repackaged version of the DebugFS one-click root found at http://forum.xda-developers.com/showthread.php?t=1883984 and thus will only work if the device to be rooted is running ICS, which shouldn't be a problem as of yet.)
Again, this is an unstable test version. It should mostly work, but no guarantees on its functionality.

*Post reserved for future use*

*Also reserved for future use*

Awesome. I was wondering if this was possible a while ago and now it is. Good work.
Sent from my SCH-I535 using xda app-developers app

Guess its time to root the display units at verizon!!

droider137 said:
Guess its time to root the display units at verizon!!
Click to expand...
Click to collapse
+1
LOL

This is awesome.. just bought my USB on the go at Amazon.
So where can I find the One-Click-Root scripts for specific devices?
EDIT: Disregard... found them...

Very cool idea! So just to confirm this app uses DebugFS to root other devices correct? So if DebugFS does not work on the device you want to root (aka you have Jelly Bean) this app will not work as well?

Just as a note, adb sometimes fails to detect a connected phone. I would try the following steps:
- ensure USB debugging is enabled on both phones
- unplug and plug the cable on the host device
- reboot the device to be rooted
- in a terminal, run the following commands:
Code:
su
adb kill-server
adb -d wait-for-device
Then relaunch the app.
If it fails after that, then unfortunately adb is just being stupid (trying to figure out what causes this)

open1your1eyes0 said:
Very cool idea! So just to confirm this app uses DebugFS to root other devices correct? So if DebugFS does not work on the device you want to root (aka you have Jelly Bean) this app will not work as well?
Click to expand...
Click to collapse
Currently, that's the root method for a bone stock S3 (remember that the JB leaks haven't been released yet).
If the only way to acquire root is to use a proprietary program such as Odin, then this app will not be able to root. If a later one click root exploit is released, then it will work for those (and actually, I might have a universal one lying around somewhere that works up to 4.1.1).
DebugFS can be used for other devices, but it is not the only way for the app to root (for example, in the screenie I'm rooting an OG Droid using another exploit). The app's mainly a convenience/novelty way to root phones using the methods available right now. A lot of people have been asking me to root their phones (S3s included), though, and it sucks carrying around my laptop around all the time - hence why I made this app.

Is there a list of devices that this app "should" be able to root? Or a general rule to follow, such as android 4.1.1 and below should be okay to root?
Sent from my SCH-I535 using xda premium

j0hnnyn said:
Is there a list of devices that this app "should" be able to root? Or a general rule to follow, such as android 4.1.1 and below should be okay to root?
Sent from my SCH-I535 using xda premium
Click to expand...
Click to collapse
It should be able to root most devices running 4.0-4.1.1 (I have a script that does that). I can't guarantee all will work, but a large number should be able to be rooted.
Other than that, it becomes device specific - you will have to research the particular devices involved.
I'll look around for that universal script and include it in the app next release.

Cool. Really looking forward to seeing this app progress!
Sent from my SCH-I535 using xda premium

wireless adb_p2p??
Just wondering if you thought this would be possible via a adb over wifi?
I haven't had much time to look into the Hak5 kit, but one would think at least on a device with wifi-direct already present out of the box, we could achieve this root transmission without the hassle of USB OTG.
Again, I haven't had time to look over the code, so there may be USB specifics for this method, but I just thought I'd bring up the idea.
On one hand it would be cool, on the other hand it would probably be a pretty serious security hole. Actually I love security holes, so either way its win win for me.
Ta,
ALQI
-----------------
Seperate item:
How much of the original stuff from p2p-adb did you keep in this app? Cause there's some pretty naughty data stealing scripts in there... Fairly obvious in the names but still, a layman who just wanted to phreak or skiddie may get themselves into a spot of trouble playing with this in a mobile shop.
Just a word to the wise, is all.
Oh, also, um "Unlock" bootloader Transmission?? Future update maybe?? Hint hint. Wink Wink.
~alqi

Is there a website I can find some scripts? I'm a little confused.
Sent from my SCH-I535 using xda app-developers app

alquimista said:
Just wondering if you thought this would be possible via a adb over wifi?
I haven't had much time to look into the Hak5 kit, but one would think at least on a device with wifi-direct already present out of the box, we could achieve this root transmission without the hassle of USB OTG.
Again, I haven't had time to look over the code, so there may be USB specifics for this method, but I just thought I'd bring up the idea.
On one hand it would be cool, on the other hand it would probably be a pretty serious security hole. Actually I love security holes, so either way its win win for me.
Ta,
ALQI
-----------------
Seperate item:
How much of the original stuff from p2p-adb did you keep in this app? Cause there's some pretty naughty data stealing scripts in there... Fairly obvious in the names but still, a layman who just wanted to phreak or skiddie may get themselves into a spot of trouble playing with this in a mobile shop.
Just a word to the wise, is all.
Oh, also, um "Unlock" bootloader Transmission?? Future update maybe?? Hint hint. Wink Wink.
~alqi
Click to expand...
Click to collapse
Yeah, I thought about adding rooting over Wi-Fi as well. Unfortunately, in order to enable adb over Wi-Fi you have to either have root on the device (which wouldn't be the case here) or connect the phones together anyway over USB to force adb over Wi-Fi (and you'd have to do this every time the device rebooted). Unfortunately that's not practical.
I just kept the idea from p2p-adb really. There's no data stealing scripts in my app, and pretty much none of the stuff from p2p-adb was reused other than the idea of connecting two phones together to do stuff.
Unlocking bootloader... for the S3, it's a simple download from the Play Store, so it doesn't seem practical to me. Also, there's the potential that I might screw things up, wouldn't want that to happen now would I
andybfmv96 said:
Is there a website I can find some scripts? I'm a little confused.
Sent from my SCH-I535 using xda app-developers app
Click to expand...
Click to collapse
I'm working on making them downloadable within the app. Until then, you can search on xda in the forums for the devices you want to root, or just ask here and I'll upload the right ones if they exist.
A script for Verizon S3s is in the original post.

Updated Root Transmission to 1.01unstable.
Following changes were made:
-bugfix: app occasionally FC'd when closing app
-bugfix: app crashed if scripts directory did not exist
-smaller size (166k, old version was 1.62mb)
-made it available only for 4.0 and up (had it set to 3.1 and up by accident)
Available in first post or in the Play Store.
Keep sending in those bug reports, it really helps!
Also, if you have any new features you want to suggest, let me know.
I'm considering the following so far:
-Downloading scripts in-app
-Nicer GUI
-Help text

I have an Asus Transformer TF101 that I am trying to root with this tool (from my GNex). I can't find a correct script I need when I search. Is there a certain search string that will help get me this file or one for other devices?

Sweet! Thank you!
Sent from my SCH-I535 using Tapatalk 2

hairclog said:
I have an Asus Transformer TF101 that I am trying to root with this tool (from my GNex). I can't find a correct script I need when I search. Is there a certain search string that will help get me this file or one for other devices?
Click to expand...
Click to collapse
I searched "Asus Transformer TF101 one click root" and found this: http://forum.xda-developers.com/showthread.php?t=1689193
It's a Windows batch script, easy to convert into a Unix shell script (I'll go ahead and do it later this evening). I might post a tutorial on how to convert your own scripts as well at the same time, so stay tuned.

Related

[Q] currently in the middle of researching....

ok so my wife is getting frustrated with the bloatware/sense reboots on the mt4gs....(I have stressed to her the importance of backing out of apps the correct way and not task killing but I guess old habits die hard...)
At any rate I'm researching/reading through the threads on here and I've got just a few questions that I haven't seen come up yet (in the same iteration that I'm thinking of)
- How much different is this phone from the Sensation z710e? (aside from screen size & physical keyboard)
- I'd like to just root and remove the bloatware and keep the phone stock (no rom install) [ok, she would like it to stay stock, I'm leaning towards bulletproof myself] so the question is:
Is it possible to stay with factory settings after rooting (s-off)/de-bloating this phone so that she can continue to receive o.t.a updates? (odds are though that o.t.a updates may put her to s-on again, possibly)
- Is there a way to exit the internet browser and have it reset, i.e: press home screen after browsing, then go back into internet and have the home screen come up and not last viewed site?
- sorry for my long winded statement/questions I just kind of think of way too many things at once.
- FWIW, the h-boot is 1.44.0007 so I'm fairly certain I'd have no issue using alapharev and the walkthrough guide on here to s-off and root.
- titanium backup is not recommended for the bulletproof rom? that sucks, but Blue must have his/her reasons. ( I think I'm misreading this but I'm not sure yet, there are a lot of 'link-to' posts in the first post of that thread)
- anyone know if any of the following apps aren't working with the themes or the rom? (yeah I know this would be better geared towards the Bp rom thread but why make two separate posts)
+handcent mms (used in place of stock messenger service)
+beautiful widgets HD
+live wallpapers in general
Sorry for the overly noobish-ness...please be gentle
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This is my main homescreen, I made a custom shortcut on adw launcher ex. Its a bookmark to google. I use that shortcut to get to google as my homepage, and I use the browser button on my main bar to open the internet into my last open website
Sent from my RubiX ICS Infused using Tapatalk
I don't think you will receive ota updates unless u are not rooted, however there are countless apps that will let you remove anything you want once you are rooted.
I would imagine that if you delete the stock messaging app and you are only left with handcent, it will take over everything automatically and you should have no issues... However I wouldn't try that until you made a nandroid backup in clockworkmod recovery
Sent from my RubiX ICS Infused using Tapatalk
Ota updates will always be posted onto the forums. The latest one turned the phone s-on and unrooted though, so I didn't try it
Sent from my RubiX ICS Infused using Tapatalk
Shroomster said:
ok so my wife is getting frustrated with the bloatware/sense reboots on the mt4gs....(I have stressed to her the importance of backing out of apps the correct way and not task killing but I guess old habits die hard...)
Click to expand...
Click to collapse
I think on this one, the only way to solve it will be to stop using a task killer. You shouldn't be having any problems like this, certainly not to the point of being 'frustrated' with it, so it's pretty conclusive that the task killer is your issue.
The problem is that apps don't get to shut down correctly, any data in use either doesn't get cleared or becomes corrupted, and the longer this process continues the worse it gets.
I know it's hard to kill old habits, but she will continue to have a worse and worse Android experience on any device with any ROM as Android grows unless she stops using a task killer.
Shroomster said:
- I'd like to just root and remove the bloatware and keep the phone stock (no rom install) [ok, she would like it to stay stock, I'm leaning towards bulletproof myself] so the question is:
Is it possible to stay with factory settings after rooting (s-off)/de-bloating this phone so that she can continue to receive o.t.a updates? (odds are though that o.t.a updates may put her to s-on again, possibly)
...
- FWIW, the h-boot is 1.44.0007 so I'm fairly certain I'd have no issue using alapharev and the walkthrough guide on here to s-off and root.
Click to expand...
Click to collapse
Yep, you should have no issues, it's pretty straightforward. You can just run the program, flash superuser and be done with it, but I would also recommend installing Rom manager from the market and updated your clockworkmod to the official one for the device.
Might as well update superuser too, but you can then leave it alone and call it done.
Will be stock and fine until an OTA is applied, then you'll probably lose root and possibly the ability to get it back.
You can install bloater and busybox (as per the bloater thread) and be able to remove stock stuff easily with it once you get root.
Shroomster said:
- titanium backup is not recommended for the bulletproof rom? that sucks, but Blue must have his/her reasons. ( I think I'm misreading this but I'm not sure yet, there are a lot of 'link-to' posts in the first post of that thread)
- anyone know if any of the following apps aren't working with the themes or the rom? (yeah I know this would be better geared towards the Bp rom thread but why make two separate posts)
+handcent mms (used in place of stock messenger service)
+beautiful widgets HD
+live wallpapers in general
Click to expand...
Click to collapse
(he)
Some people have used titanium and it's been fine, i'm still on the fence about it.
Issue was I was changing a lot of things, and when people restored app data to things i've changed it caused problems - so the best way to handle that was to say don't use it.
I know the thread is long now for the Bulletproof ROM, but in it there are some pretty detailed instructions on how to use Titanium with the ROM that people generally agree upon. I've never tried it so can't say personally.
I'll eventually put it back in, but i'm pretty busy with work right now and getting time in my dev chair is hard - hopefully i'll get a break in my schedule so I can get some work done soon. You should be able to use it, just don't try to restore any data from another ROM or previous version of Bulletproof and you should be alright.
----
Beautiful widgets HD and live wallpapers work fine, never used handcent so can't say, but don't see why it wouldn't work.
If it ends up not working, post in the thread and i'll fix it.
That right there is what makes xda great. ^^^^^
Thank you.
On a side note, the megaupload site was taken down....so I'm daring to ask the following question: the 'how-to-root guide >>>XDA LINK<<< said to d/l other files instead of the ones from alpharev's site.....they were hosted on megaupload. Now what ? lol
Why can't the files downloaded from alpharev's site work?
I see that in the link, the Op said that it is the adb tools for the MT4GS, why wouldn't the current adb tools I have work/ones d/l from alpharev's site?
I've always used the file from the author, I got it from them when it was first available, and just recently when a friend of mine got this phone.
Always works fine for me, and I would rather use the tool from the original author anyways generally speaking.
When you run Revolutionary tool, either install clockworkmod or not at your choosing, it doesn't matter because when you're done with it all you should go to the market and download ROM Manager. Then you can use it to upgrade or install your clockworkmod to the most recent version ( 5.0.2.7 ) directly, it will find the phone, download the right version, and install it for you. Couldn't be easier.
You do have to have superuser (root) access to use ROM Manager, so make sure to root it after running the Revolutionary tool.

How the hell do I tether my rooted Infuse without using an app or hot spot?

and before anyone says do a search, i've already done that and they all point to the same useless crap about downloading pdanet or some other app to tether.
i've done it before but for the life of me can't remember how it was done without having to use an app or the hot spot feature. i'm in an office and don't need everyone seeing the SSID and tethering is much faster than hot spot.
my phone is rooted so that's done and i can use the hot spot feature which works fine but when i tick the "usb tethering" checkbox to tether it doesn't work. wtf am i doing wrong? this is frustrating the hell out of me.
do i need to download some extra drivers or is there something else i need to check off or enable to make this thing work? HELP!!!
If you are already rooted all you have to do is download Titanium Backup Root from the market. Then run it, and find a program in the list called tethering manager and REMOVE it. It will be a system file and will tell you as such. Remove it anyhow and the stock tethering program will work fine.
I will be no help, but for those that can help it would be nice if you included more info
What rom are you running?
What kernel?
Or are you just stock rooted? If stock rooted froyo or gingerbread?
Provide as much info as possible, more is better than not enough. Again can't help you figure this out as I've never tried to tether...but I hope someone can help you figure this out
Sent from my SGH-I997 using XDA
MrBooMY said:
If you are already rooted all you have to do is download Titanium Backup Root from the market. Then run it, and find a program in the list called tethering manager and REMOVE it. It will be a system file and will tell you as such. Remove it anyhow and the stock tethering program will work fine.
Click to expand...
Click to collapse
I'm in it now and don't see any apps called tethering manager.
mg2195 said:
I will be no help, but for those that can help it would be nice if you included more info
What rom are you running?
What kernel?
Or are you just stock rooted? If stock rooted froyo or gingerbread?
Provide as much info as possible, more is better than not enough. Again can't help you figure this out as I've never tried to tether...but I hope someone can help you figure this out
Sent from my SGH-I997 using XDA
Click to expand...
Click to collapse
ROM: Infused V2.2.3
Kernel: 2.6.35.7-I997RUXKG3-CL366622
Not stock rooted and the Infused version I'm using is GB.
Its there... where are you looking?
I was able to find it under Backup/Restore..
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Open TB (Titanium Backup)
Click top middle tab labeled "Backup & Restore"
Find tethering manager (light switch icon)
Tap it, then tap "Backup!"
Tap "Uninstall!"
Long press your home button
Tap "Task Manager" and END anything tethering related
try to tether,enjoy
p.s.
Being rooted you should already have TB installed and have a backup...i learned the hard way
drnecropolis said:
Its there... where are you looking?
I was able to find it under Backup/Restore..
Click to expand...
Click to collapse
tripartist1 said:
Open TB (Titanium Backup)
Click top middle tab labeled "Backup & Restore"
Find tethering manager (light switch icon)
Tap it, then tap "Backup!"
Tap "Uninstall!"
Long press your home button
Tap "Task Manager" and END anything tethering related
try to tether,enjoy
p.s.
Being rooted you should already have TB installed and have a backup...i learned the hard way
Click to expand...
Click to collapse
Sorry, guys, but I just checked and there is nothing in there called "tethering manager." Am I supposed to download this or should it just come with the ROM?
The only things I have listed in the "T" section is Task Manager, Tip N Split (cause I'm a damn good tipper), Translate, TTS Service 2.3.3, TwLauncher 2.3.3 and TwWallpaperChooser 1.0.
I've even done the filter to find anything with just "teth" or "tet" but still nothing.
As a last resort, I uninstalled TB and re-installed but still nothing. This sucks major balls!
update 1:
After doing some more digging, I checked the network connections in the control panel on my laptop, and it looks like I'm connected when I check the "USB tethering" feature on my phone but there is still no internet access. What could be causing this?
I've already checked the IP settings which are set to dynamic and my firewall is disabled so that's not the issue. I'm sure it's something simple but I can't figure it out.
Here's a screen shot of what I'm showing:
If you cant find tether manager in titanium backup then maybe try a factory reset and then see if it appearsjust to let you know our infuse custom roms tether and mobile hotspot far better then stock, and tethering manager is not included in any custom roms that I've ever seen.cm7 works the best for me but many of them work great ..trust me I play MW3 on Xbox live all night sometimes with solid connection.....read the stickies and FAQs in the dev forum if you want to flash some custom roms. Your missing out on some greatness
On my phone you have to connect and wait for about a solid minute before it works. Try waiting longer.
Sent from my SAMSUNG-SGH-I997 using Tapatalk 2
In my titanium backup I have to go into "batch" then freeze Alps and when it goes to the screen where it shows all of my apparently listed I can see it when I scroll way down, just another thing you could try
Sent from my SAMSUNG-SGH-I997 using xda premium
I have been seeing a lot about TB and am wondering how useful the pro version is over the basic version for a noob that is just playing around trying to find the best ROM to do what i want while still liking the looks of it. I am using a Samsung Infuse4G that presently hasCM7 installed. I use both Google's Play and the Amazon App store for my apps. I would not even be looking past CM7 right now if it allowed my Bluetooth to work as the tethering portions of it are great. based on all of this, which Titanium would be best and why?
Thanks,
Gary
Tether Manager issue
I have also been dealing with this issue. In some custom ROMs the tethering manager does not show up in TB so you cannot remove it. In others I have removed it and yet the tethering still does not work. This does get confusing for those of us that are not developers and are just learning how to root and load custom ROMs. Is there an easy way to tell if tethering will work before one goes through the process of downloading and flashing all of these different ROMs? I like CM7 the best, but it has no BT so I am looking for something close to it in function that has both.
Thanks,
Gary
dadofsix said:
I have also been dealing with this issue. In some custom ROMs the tethering manager does not show up in TB so you cannot remove it. In others I have removed it and yet the tethering still does not work. This does get confusing for those of us that are not developers and are just learning how to root and load custom ROMs. Is there an easy way to tell if tethering will work before one goes through the process of downloading and flashing all of these different ROMs? I like CM7 the best, but it has no BT so I am looking for something close to it in function that has both.
Thanks,
Gary
Click to expand...
Click to collapse
If tetheringmanager has already been removed (which is the case for most custom firmwares), wifi tethering SHOULD work.
Tethering Manager
That is what I thought I was told, but it is not working. It still says you need a tethering plan from your carrier. Call 611 to arrange for one, or some such message. Is there something else that needs to be done as well? Also, what about USB tethering? What needs to be changed to let this work?
dadofsix said:
That is what I thought I was told, but it is not working. It still says you need a tethering plan from your carrier. Call 611 to arrange for one, or some such message. Is there something else that needs to be done as well? Also, what about USB tethering? What needs to be changed to let this work?
Click to expand...
Click to collapse
I was hunting around and found this thread and was looking for some answers?
And at the end of your question the thread just ? stops. did you ever get a answer to your problem?
Or did this thread get moved to a different folder?
I had been trying to help my SO get her recently (me) rooted infuse to tether so I got fairly familiar with how to do it. Not cause I'm an expert but cause I read the crap out of all threads.
It's on your phone and you just need to clk a couple more locations to get to it.
If your still looking to resolve it answer back in this thread.
I was able to do usb tethering on Aeon rom based on GB without 3rd party app.
1. Set phone to debug mode.
2. Settings>wireless & network> tethering and portable hotspots>check the usb tethering.
3. now i can browse the net on pc using data plan of my phone.
hope it will help.
Sent from my SAMSUNG-SGH-I997 using Tapatalk 2
Do you have the Samsung drivers installed on your computer?

[2012.12.18] Why Exynos exploit patches may not work as expected + demo app

So I'm sure we've all heard about the ExynosAbuse exploit. If not, the original thread is here. The only proper solution is a kernel fix. This thread is only about app-based fixes.
There are various fixes available at the time of this writing, including my own. I don't mind some competition, that is not the problem. What is a problem is that some of these other app-based solutions out there have been mentioned and pushed a lot in the media (tech as well as non-tech) while they are seriously flawed (the only true solution is a kernel fix that simply removes the exploitable memory device, but that requires a non-universal device update, so we focus only on app-based fixes here that users may run immediately).
What I mean by flawed is that while they offer protection most of the time, they may leave a big gaping hole during boot that can be exploitable (as I will demonstrate) - and serious malware authors will of course include this attack vector in any serious malware - as will they include an attack vector to exploit temporary enabling of the exploit so you can use your camera (on devices where the fix breaks camera use).
Serious malware needs only a tiny hole to squeeze through once, and will attempt to leave it's own backdoor in case the hole they squeezed through is closed. Disabling the fix to use your camera only for a second with a malicious app running in the background running the exploit in a loop, and game over. I'm not even going to demo that, that flaw should be clear.
Due to unreliable fixes being mentioned by the media, a lot of people who have read online (or even print) news about this exploit may be using a fix they believe will work, but actual malware will easily bypass. Maybe some noise needs to be made about this ?
We're going to talk about three solutions here:
RyanZA's ExynosMemFix
Supercurio's Voodoo Anti ExynosMemAbuse v0.6
Chainfire's ExynosAbuse APK
The demo
What I am going to demo is running the exploit at boot, even though a fix that runs at boot is installed, on an exploitable device. After reading the rest of this article, find attached the ExynosExploitDemo APK. After installation, open the app, reboot your device, unlock your device (enter PIN, pattern, etc) and watch the screen like a hawk. Within a minute, a toast (bottom of the screen) notification will popup telling you whether the exploit worked. If it didn't work the first time, please try it at least 3 times. Once you are satisfied with the results, you should uninstall it again as it slows down the boot process.
Test setup
For each test I have completely factory reset the devices, and installed the "protection" APK before installing the exploit demo. Tests have been run on both Galaxy S3 as well as Galaxy Note 2, with and without SIMs installed. Tests were performed on December 18, 2012 with the most recent versions at that time.
BOOT_COMPLETED
Both RyanZA's as well as Supercurio's solution depend on Android launching the apps at boot (using the BOOT_COMPLETED mechanism), so they can plug the hole. This is a standard Android practise, The problem is, there is no guaranteed order in which apps are started at startup. A malicious app could also register to be started at boot (as the demo app does), and it would be a race whether the malicious exploit is run first, or the protection code. Luckily, you are more likely to have installed one of the patches before the malware, and the app that is installed first also has a better change of being run first - but is something that you cannot and should not rely on, nor does it guarantee the protection app will win the race, as explained below. The number of apps installed (and their package names, and what exactly they do at launch) may further influence which package "wins". What I'm trying to demonstrate here is that depending on this method of patching is unreliable at best.
The demo vs RyanZA's ExynosMemFix
RyanZA's is probably the least advertised/mentioned solution, which I expect is least used as well. The solution relies on BOOT_COMPLETED and "su" availability (like being rooted with SuperSU or Superuser), but does not rely on the exploit itself.
The reliance on "su" availability makes it vulnerable, it runs "su" to get the required access level to plug the hole. Even if installed before the malware and the system launches its startup code before the malware, the "su" call is an expensive one that can take an arbitrary amount of time to complete, regardless of the app having been granted permission before or not.
In my tests, even with ExynosMemFix installed before the demo, and having verified it's code launched first, it would always lose against the demo (and thus the exploit succeeds) if the root management app installed is Superuser. Due to the way the Superuser app is designed, it takes a longer time acknowledging the "su" request, giving the demo time to run the exploit. I have also seen ExynosMemFix generate an ANR error during testing a number of times, indicating that it may be calling "su" from the actual broadcast receiver (instead of a background thread), with all the problems that may cause.
When SuperSU is used, ExynosMemFix would always win against the demo in my tests (and thus the exploit fails), due to SuperSU responding much faster as it does not rely on the Android framework as Superuser does.
This solution can be somewhat secure, but even if used in combination with SuperSU, it cannot be guaranteed the malware does not launch first (I've seen it happen, but have not found the key to reproducing it yet). In combination with Superuser instead of SuperSU, the patch leaves a major hole.
The demo vs Supercurio's Voodoo Anti ExynosMemAbuse v0.6
Supercurio's is probably the most advertised/mentioned solution in general by media outlets. The solution relies on BOOT_COMPLETED and the exploit itself (but no "su" required).
The reliance on the exploit makes it vulnerable. The exploit may need to run a couple of times before it succeeds during boot, and it takes quite a few milliseconds to run. It runs the exploit to get the required access level to plug the hole. The exploit does however take some time to run, and both exploit as well as the hole-plugging-command must be completed before the malware starts, to effective block it.
In my tests, even with Voodoo Anti ExynosMemAbuse installed before the demo, and having verified it's code launched first, it would always lose against the demo (and thus the exploit succeeds). The protection code would launch before the demo code, but it would not complete (and fix the hole) before the malware was started, thus failing to block it.
Note that this specific case is probably especially sensitive to the number of apps you have installed - it may be the case that the more apps you have installed after this solution and before actual malware, the better the chance the protection will succeed before the malware is triggered. You can't possibly rely on this, though.
This solution is the least secure solution of all available options - it will leave a big hole open, you might as well not run any patch at all.
The demo vs Chainfire's ExynosAbuse APK
Mine is probably the second most advertised/mentioned solution. The solution relies on modifying /system and the exploit itself, with parts relying on "su".
This solution can root the device and install SuperSU as management app itself, though it also works with a pre-installed Superuser. It requires this to install the on-boot fix. After that patch is applied, you can unroot again (inside SuperSU: Settings --> Full unroot) - the patch will keep working. The patch itself does however modify /system, to make sure the fix is applied before any normal Android app is started with BOOT_COMPLETED, completely preventing the hole the demo app (and malware) would use to run the exploit. As such, the exploit always fails.
This solution is the most secure solution of the available options in this regard, topped only by actually fixing the exploit in the kernel.
Virus/malware/etc scanners
I have also noticed that various virus and malware scanners have updated their definitions in the past few days, and they will now detect the original ExynosAbuse exploit. Be warned however, that this specific hole can be exploited in many different ways and the example code provided by alephzain is just that: an example. I am not at all convinced that all different exploits based on this hole can even theoretically be reliably detected by these scanners - including Google's - unless every app is actually tested against in a sandbox environment (and even then ...). They may protect against those using the exploit as-is, though.
The big joke
The funny thing is, all the fixes that can actually work void warranty: mine requires modifying /system, RyanZA's requires root as well, and a proper fix requires a custom kernel.
In other words, right now you can't really protect yourself against this abuse without voiding your warranty. If there ever was a case for having laws against limitations of warranty, this is it. On a related note, any warranty denied because your system status is "modified" is also completely bogus, as a successful exploit might (outside of your knowledge) probably try to install their own backdoor in /system ... which might trigger "modified" status.
Also, if you're thinking this is complicated code, malware authors are not smart enough, etc - think again. Serious malware authors live and breathe this stuff, and the relevant code for this attack is rather trivial and only about 30 lines, including whitespace and actually showing you the exploit result.
Another joke is that I seriously doubt any major news outlet will post a correction, but hey at least I tried
Different test results
Let us please not make this thread about your test results being different. If you have read and understood all the text above, you would know that there are various factors that may throw the test outcome one way or the other. Unless your sure your different result is significant in being different, please do not clutter the thread with it.
Download
If you have a decent and updated virus scanner, it will likely scream at you for trying to download this. It is after all an exploit. You may need to turn it off if you want to test this for yourself.
2012.12.19 Update
I have a new (private, yeah) version of the demo that now beats both Supercurio's (v0.9) as well RyanZA's solution 100% of the time
--- also reserved ---
Thanks for this thread. It's so fun !
But, I have solve the problem (I think) after flashing my phone with my kernel (exynos_mem files modified).
lelinuxien52 said:
Thanks for this thread. It's so fun !
But, I have solve the problem (I think) after flashing my phone with my kernel (exynos_mem files modified).
Click to expand...
Click to collapse
Yes, as stated, the best solution is a fixed kernel
My app clearly states the limitations of the approach (inside the app itself, leaves no doubt)
But it should not loose every time against the demo exploit at boot, so I'll change for a more aggressive way to start.
Thanks Chainfire for taking the time to test.
Chains, it's not much but have an Export 33 on me mate: 8BH470706S240353D :good:
Well said.
Chainfire said:
Yes, as stated, the best solution is a fixed kernel
Click to expand...
Click to collapse
So when do you think Samsung+carriers will plausibly get around to officially fixing it?
Sounds more precarious to not try your workaround & there is reasonable deniability even if there is a warranty issue..?
Tomorrow I'd like to install the official T-Mobile SGH-T889 multi-window update followed by ExynosAbuse-v1.30.apk , anyone expect issues as this recently discovered exynos exploit is not listed as addressed in this likely tested for weeks update?:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
So is ExynosAbuse-v1.30.apk now regarded as the best-easiest-fastest-safest reversible root method for stock ROM compatible devices (as it also offers a reversible exynos exploit work-around with full unroot)?
-Thanks
Tried demo app this way:
- 2 times under WiFi and I get "Exploit FAIL" and the toast shows the directory that is something like "[!] ... /exynos-...."
- 1 time under 3G regular data connection and I still get "Exploit FAIL" but in the toast I don't see any more the directory but only the message
I use Chainfire's exploit app.
Am I secure???
Sent from my GT-i9300 using TapaTalk2
Chainfire, guys, please give a try to the v0.7 version of my app, same place.
Chainfire, it would have been nice to be informed while you were preparing the article (on your early conclusions)
Just wondering, when Samsung DOES release a fix, I think it'd kinda be a catch 22 because those rooted or modified won't be able to update - or those infected won't be able to update. So Samsung will have to be lax with that rule. Or is that even possible? But regardless, I'm sure you guys will be able to get us the Samsung fix when and if they come out for us modified folks.
ThaiM said:
Just wondering, when Samsung DOES release a fix, I think it'd kinda be a catch 22 because those rooted or modified won't be able to update - or those infected won't be able to update. So Samsung will have to be lax with that rule. Or is that even possible? But regardless, I'm sure you guys will be able to get us the Samsung fix when and if they come out for us modified folks.
Click to expand...
Click to collapse
Yes, that's good thinking.
And also why I tried to provide something (even an imperfect workaround) that doesn't alter system.
I have 2 questions tho and I'll verify to get an answer to the first one.
- Is my app really not triggering the "modified" status
- If Chainfire un-do all the modifications applied by his tools, will the device return to its "un-modified" status
Or maybe the "un-modified" status can be faked, restoring the proper function of OTA updates.
maybe note worthy thing to here, in EU you dont lose your warrantly for applying fixes like this in fact you can install kernels/roms as many times as you want and you still got your warrantly. what comes to my own experience from this, my phone have been repaired 2 times because micro-usb didnt want to co-operate with me first time i had miui installed, second time had cm10 when i sent my phone to get fixed, both times got it fixed free of charge.
source: https://fsfe.org/freesoftware/legal/flashingdevices.en.html
tl;dr
if flashing original firmware dont fix issues you had on your phone, then you must have the damage covered free of charge(ie. micro-usb port goes crazy)
Chainfire, thanks for your elaborate demo.
I tested the exploit demo thrice with mobile security apps disabled; once with your app, and twice with the two "disable exploit" boxes from your app unticked. The first time, the exploit failed.
The kernel I have installed (link in my sig) seems to have fixed the problem. It uses the fix by AndreiLux that was successfully implemented by Entropy512 from the original thread.
Both times I rebooted, the exploit failed (see screenshot). I guess this is expected, but both times after boot, the checkbox "disable exploit" was enabled again without touching it.
Seems like a success story to me.
Thanks again!
SGS2 // RootBox 3.2 // Dorimanx 7.33
The 0.9 update of my app is strong now on boot (or less weak), but this is not very satisfying.
Frustrating as there's no "perfect" fix for regular users I'm thinking about right now.
I'm not really a fan of waiting, are you ?
@supercurio I was wondering the exact same thing on how may the "un-modified" status can be faked. Then again, as another user pointed out, though warranty rules and regulations maybe the same across all regions - it is their comprehension and application which is ambiguous.
I for one can attest that at my place they will simply replace the internals of your phone as long as the purchase bill you produce confirms that your device is still covered by the manufacturer warranty.
Props on the great research Chainfire, I agree with it all 100%
Personally though, malware authors target the easy and low hanging fruit - in this case, 99% of phone users who have not used any kind of fix. (99% is a very low estimate). They have no real reason to try and 'out race' mine or supercurios fix in practice, as (mine in particular) has very few users. Why bother creating a special exploit that only runs on boot, when you can just target 99%+ of all unfixed devices by just running the exploit when the app is started?
I've seen 4 malicious uses of the exploit in the wild so far, and all of them run on app start, which is blocked by all 3 'unsecure'/non-kernel fixes. Users are still VERY heavily encouraged to use any of the fixes as they currently stop all uses of the exploit in the wild. Supercurios is still the best one as it does not require root, and should definitely be advertised by the media as much as possible as it stops a real world and current threat to user security as best as it can.
Gotta say great research chainfire need of the hour indeed :thumbup:
Chainfire said:
The big joke
The funny thing is, all the fixes that can actually work void warranty: mine requires modifying /system, RyanZA's requires root as well, and a proper fix requires a custom kernel.
Click to expand...
Click to collapse
so if i understood correctly. custom kernel solves issue. :good:
i don't care about warranty

ZTE Source (n9511) Rooted W/CWM Recovery!

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Hello xda community, this thread is for the ZTE Source (n9511)
Device info:
CODE NAME: hera
Type Smartphone
Form Factor Candy Bar
Height 5.31" Width 2.64" Depth 0.40" Weight 5.0 oz
Display Physical Size 4.5"
Resolution: Width 480 Resolution: Height 854
Technology FWVGA (218ppi) TFT Capacitive 5-point Multi-Touch
Platform OS Android 4.1 (Jelly Bean)
Camera Main Resolution 5.0 MP Features Auto-Focus, LED Flash, Backside Illuminated Sensor Video Capture 720p HD Front-Facing Resolution 1 MP with Backside Illuminated Sensor Fixed-Focus
Processor CPU 1.2 GHz Dual-Core Qualcomm SnapDragon™ MSM8930
Battery Capacity 2070 mAh
Memory Internal 1GB RAM + 4GB ROM (Approx 2GB available to end user) Expandable MicroSD, up to 32GB
Networks Frequencies CDMA 1x EVDO rev. A - Cell (800), PCS (1900), AWS (1700/2100) LTE -- Band Class 2/4/25
Connectivity Bluetooth 4.0 Wi-Fi 802.11 b/g/n Mobile Hotspot Yes GPS GPS, Assisted GPS (aGPS,) Simultaneous GPS (sGPS) USB Yes Headset Jack 3.5mm
Audio & Video Audio Format MP3, AMR-NB(3gp), OGG, AAC, AAC+, eAAC+, MIDI, SP-MIDI, WAV, M4A Video Format MP4, H.263, H.264 Sound Technology SRS Enhanced Sound
Messaging Features SMS, MMS, Swype Predictive Text
Accessory Compatibility Hearing Aid Compliance M4/T4 Text Telephone (TTY) Compatibility Yes -
Click to expand...
Click to collapse
Root using the method found here or use Framaroot !
(Framaroot method requires manual install of supersu, help can be provided if needed)
Video help found here
Online user manual found here
DaemeonZane said:
To get to recovery: Either restart the device and hold Volume Up, or completely power it down and start with the volume up.
Factory Test Mode: Same thing as recovery, except you use Volume Down.
Click to expand...
Click to collapse
Thanks:
DaemeonZane for probing and finding FTM & Recovery!
Junkie2100 for porting cwm!
cooldudezach for the OC Kernel!
SuperR for the stock/deodexed Roms.
Anyone else who helped with this device, big or small!
News:
*****WE HAVE FASTBOOT!!!***** Thanks DaemeonZane!!!
Code:
[B]To enter fastboot see [URL="http://forum.xda-developers.com/showpost.php?p=48295134&postcount=23"]this[/URL] post!
For recovery files to build custom recovery, see [URL="http://forum.xda-developers.com/showpost.php?p=48319535&postcount=29"]this[/URL] post![/B]
*****WE HAVE CWM!!!***** BIG THANKS TO Junkie2100 and DaemeonZane for their hard work!!! And strykerhandy for being the brave one to test it first!
Code:
[B]To install CWM Custom recovery see [URL="http://forum.xda-developers.com/showthread.php?p=48374851"]this[/URL] post![/B]
*****Download the Stock Rom Pre-rooted / Deodexed (Courtesy of SuperR)*****
Code:
[B]Download Rom [URL="http://androidforums.com/showthread.php?t=816616"] Here[/URL] [/B]
*****Beta OC cdz Kernel for the ZTE Source (courtesy of cooldudezach)*****
click here.
USB switch test
Code:
[SIZE=3]On the phone go to Dialer and enter *983*87274#[/SIZE]
To App or Not To App...
Here is a list of apps I successfully disabed/froze using RootAppDelete:
Frozen:
Cricket Navigator
Cricket 411
Data Connect
My Backup
Disabled:
Black Hole
Browser
Bubbles
Camera
Chrome
com.android.wallpaper.holospiral
Cricket Ignite
Email
Face Unlock
File Manager
Gallery
Google Play Books
Google Play Games
Google Play Magazines
Google Play Movies
Google Play Music
Google+
Hangouts
Magic Smoke Wallpapers
Music
Music Visualization Wallpapers
News & Weather
Phase Beam
Shop
Swipe
Task Manager
Twitter
Video Player
World Time
ZTE FOTA
USERS MUST HAVE ROOT ACCESS TO FREEZE/DISABLE APPS WITH RootAppDelete!!!
..........................................................................................................................................................................
Check out my YouTube video https://www.youtube.com/watch?v=CMcWjfknZ1E&feature=youtube_gdata_player
Sent from my JellyBeer Fire HD
Screenshots:
Sent from my ZTE_N9511 using xda premium
Cricket Ignite
I just got my ZTE N9511 on Black Friday. Last night they stopped me from using PowerAmp Pro that I got from torrent downloads. Today I uninstalled it, installed Titanium Backup Pro and deleted Cricket Ignite off my phone... I am still wet behind the ears with all of this, will my phone be okay, and is there anything else I should take off my phone as far as system apps go?
@JOEP702
So far I have froze/disabled a few system apps.. Click here to see.
Sent from my ZTE_N9511 using xda premium
custom rom for zte source ?
Anyone knows about A custom rom for the zte source?
@2012crazymexican
From what I have heard, there is no fastboot for the Source... which means ... well I don't know for sure but I believe you need fastboot in order to flash a custom ROM. I am far from a Dev, and have little experience beyond simple adb commands and a few fastboot commands. There IS a way to put software on this device, though I doubt ZTE is going to give out its secrets. If this phone becomes more popular then hopefully we will get some smart devs, like Hashcode for example, who can work on this phone. Until then, I will be doing whatever I can to unlock this device as best as I can.
Sent from my ZTE_N9511 using xda premium
So I'm a dumbass
The title says it all. Apparently I either deleted the wrong thing, or something, but I just got my Source this afternoon and did the root on it, and then installed Titanium Backup.... I did a backup of all the apps, but when I try to restore, I get multiple failures. Not sure what happened and frankly don't care, (the phone still works great minus the Ignite crap by the way) but I've found factory test mode and the recovery module...
Using this method I'd like some of you rooted folks to try and do a ROM dump. Try it from Factory Test Mode AND the Recovery Mode.
To get to recovery: Either restart the device and hold Volume Up, or completely power it down and start with the volume up.
Factory Test Mode: Same thing as recovery, except you use Volume Down.
I'm gonna do a DD on this and download the full SDK, see what I can figure out, but I am so not a Dev, dudes and dudettes, so it'll be up to the ZTE lovers out there to make it happen. I'm also looking to see about Link2SD support and EXT4 support, though with all the storage, it'll be awhile before I fill mine...
Still, this is a brand new phone, pretty much, and I'm gonna love messing around with it with you folks, but I've been around dev's and fankids before: androidforums Admire and Evo 4G threads, to name two. I sincerely hope that we can all work together to pimp this darn thing instead of fighting like a bunch of kids :highfive: I'll post my DD dumps and whatnot as I get them, and try on your devices as well. The more people we have working on this the better.
@DaemeonZane
Thanks for the info! Added to OP.
Have you managed to get the driver installed for FTM?
Recovery is crap... No zip install... no backup.... but a must have regardless.
ALL THE MORE REASON WHY WE NEED SOME SMART DEVS HELPING!!
CWM or TWRP would be great! Custom Roms would be great!
Hey Gus.
.
Hey guys I too am a noob and don't know anything hardly about Modding the android system but I am totally techale and willing to try almost anything. I got this phone to learn on but I am finding out tbat there isn't much soft ware writtien for this model so I get to work with you guys on some real development instead of just flashing and recovering...
I really want to k kW if anyone has had any luck finding and flashing any costoms at all... if so could you post the link with instructions. Thanks guys
Sent from my ZTE_N9511 using XDA Premium 4 mobile app
Krsmqn said:
@DaemeonZane
Thanks for the info! Added to OP.
Have you managed to get the driver installed for FTM?
Recovery is crap... No zip install... no backup.... but a must have regardless.
ALL THE MORE REASON WHY WE NEED SOME SMART DEVS HELPING!!
CWM or TWRP would be great! Custom Roms would be great!
Click to expand...
Click to collapse
I got it to register just by having Windows Update look for dirvers. Picked a good ADB driver right off the bat.... Right now I've got root and am attempting to use an adb shell and rkdump to get a good image.... but under /dev/block I can't identify what's recovery, what's system, etc.; all I get is the following:
It's kind of a pain in my ass, because I'm not quite sure what's what, but if any of you have used ZTE devices before, you'd have a better idea of their naming conventions than I would... tell me what to dump and I've got you, just keep in mind I'm no longer stock (i.e., I've deleted a lot of the bloatware from the system)
@DaemeonZane
Excellent work! I will try the windows update idea. The driver for FTM is the only driver I couldn't find. I have ZTE_Android USB_Driver_For_Microsoft_PC and ZTE Handset USB Driver 5.2066.1.8 But neither of those provide the FTM driver. You are making good strides towards unlocking the potential for this phone. We do need someone helping who is a linux wiz or ZTE wiz.
Have you had any success with googling those listed items (like mmcblk0p1)?
#GREAT WORK! :good:
@strykerhandy
Welcome to the thread!
I'm excited to have as many ZTE Source owners working on this device as we can. Any help you can provide is appreciated. As far as any questions you might have, ... what you read here is it! Lol! This device is so new that there isn't anything else written about it outside of specs and reviews. As far as I know, this is the only thread out there ... here on xda, or anywhere for that matter.
@DaemeonZane
I'll do some research and see what I can find.
Possible useful links:
http://androidforums.com/vital-all-things-root/786172-extract-zte-vital-stock-rom-dump.html
http://forum.xda-developers.com/showthread.php?t=1771347
Code:
[COLOR="Red"][SIZE="3"]The clear goal here is getting fastboot for this device....if possible.[/SIZE][/COLOR]
Krsmqn said:
As far as I know, this is the only thread out there ... here on xda, or anywhere for that matter.
Click to expand...
Click to collapse
You are correct. cricketusers.com/cricket-zte-source/ has a couple basic threads discussing specs, but that's about it. AndroidForums doesn't even have a whole lot on it... So we're it.
As far as googling the partitions, and whatnot, not so much, but it is what it is. I'm currently at work (Buffalo Americas) but when I get to the house tonight I'll be able to dig up a bit more. I'm a Linux enthusiast, but my main bag is actually networking and security... lol Still working on getting that dump, but if anyone figures it out and can make it happen, post it for the world to see... I've never had an Android in my hands that wasn't rooted and customized to some degree, and I'm not giving up on this one just yet... lol
Not a bad benchmark...
I'm having an issue attaching a screenshot right now. Benchmark was 14434. I'll get a picture up later.
Also, I managed to create a gz file... might help someone.
https://www.dropbox.com/s/l2ayo4insgwnptb/system.info.gz
Sent from my ZTE_N9511 using xda premium
So i have rooted and already had to fix the "cannot establish reliable data connection to server" problem.... thats how i bricked my last phone but using titanium backup and wifi its a for sure fix.... anyway so i am not well read about the basics of the platform and i dont know if this an option or not but jas anyone tried the Cwm recovery builder? I got on there and read up on it but its to.advanced for me right now... also i cant figure out why basic flashing wont work from romtoolbox pro. I have tried frlashing some. BOot animations and i did some.fonts but the animations stop half way through and screen goes black till the.phone boots. Any advice is welcomed and appreciated..
Sent from my ZTE_N9511 using XDA Premium 4 mobile app
I will look into the cwm builder... As for the boot animations, perhaps you need to resize them. Not all are designed for our layouts. Just a thought.
*Edit* Using ROM toolbox pro I was able to change my boot animation. So it does work.
Sent from my JellyBeer Fire HD
thanks hit me up if u guys make a custom rom
Just hit me up if u guys create a custom rom

Mods, Customization - Snapdragon 835

Hi all, I would like to inquire if it is possible to be able to root the Quest and introduce mods, launchers, optimizations and customization especially that it runs snapdragon 835 ?
Hi!
I found the security patch level of Quest is a bit old.
2017-10-05
Maybe we can use existing vulnerabilty to get root.
Hehe, i like whre this is heading.
rurie said:
Hi!
I found the security patch level of Quest is a bit old.
2017-10-05
Maybe we can use existing vulnerabilty to get root.
Click to expand...
Click to collapse
rurie said:
Hi!
I found the security patch level of Quest is a bit old.
2017-10-05
Maybe we can use existing vulnerabilty to get root.
Click to expand...
Click to collapse
With Android 7.1.1, would any of the methods here work? Has anyone tried yet?
I tried waterdrop (CVE-2019-2025), but no luck.
info:
http://blogs.360.cn/post/Binder_Kernel_Vul_EN.html
https://www.exploit-db.com/exploits/46503
$ /data/local/tmp/poc
/data/local/tmp/poc: binder_become_context_manager: Device or resource busy
We need kernel hacker. Can anyone help?
---------- Post added at 08:26 ---------- Previous post was at 08:19 ----------
In addition, I found Quest have Qualcomm's EDL mode. By pressing vul-up,down and power will boot in EDL mode.
And Quest supports fastboot on USB Update Mode. but "fastboot oem unlock" needs unlock code.
I tried the dirtycow methods but I think that was patched out before this build, no success.
I also tried just running the usual commands to bring up USB Tethering, but that seems to need root as well. All I want is better ALVR streaming
fyi Oculus is unwilling to provide bootloader unlock codes citing section 4.1 of their Terms of Service, as being in conflict with the request.
I found this to be interesting.
I've began a support request to get the boot loader unlock codes and explicitly began requesting the GPL code (parts of Android and their Linux kernel source). This should give me a few options.
They may or may not decline giving me the boot loader codes. Not the end of the world.
They are legally obligated to give me certain source code for what's running on this device. Such as the linux kernel with the modifications they've made. If they don't provide this source in it's entirety, then there's some legal implications involved there. The first response from their support was pretty ignorant. They linked me to some download section of their website that only had developer SDKs, not the sources I was requiring of them.
Anyway, once I have the kernel source, if no bootloader codes are provided, I can begin scouring it for ways to elevate to root at least.
sync.demon said:
Anyway, once I have the kernel source.
Click to expand...
Click to collapse
I believe the kernel for the oculus go is here:
https://github.com/facebookincubator/oculus-go-kernel
I can't see any published quest kernel, perhaps it's the same?
reclaimyoursenses said:
perhaps it's the same?
Click to expand...
Click to collapse
It's quite possible for the kernel to be the same. I'm going to await confirmation directly from Oculus. If it goes well, I get to unlock my bootloader on top of having the correct source. If it goes poorly, who knows. I might get to see what the legal side of the GNU GPL looks like.
I really want to audit the support for this device and software I own.
Not the same. The posted kernel for Go is Linux 3 while Quest is using Linux 4.4.21. They've built on Android, which means they're starting with a stock Linux kernel, I don't think getting their sources is going to clue us into anything that can't be known already; they'll just upload that same vanilla Linux 4 kernel source. The drivers they will use for practically everything are almost certainly closed-source. They don't have to provide their kernel configuration either.
Best of luck on getting the bootloader, though, that's the holy grail at the moment
Well, the dudes that I'm talking with finally provided kernel source:
https://github.com/facebookincubator/oculus-linux-kernel
It's the Quest Branch of the Oculus Linux Kernel. So we have something to search through for vulnerabilities.
I'm still talking with them about flashing the hardware. I'm not convinced that it's locked, because they seemed a bit confused what I was talking about. Having not touched phone boot loaders in years, I'm still doing my research into the bootloading stuff, since I'm only guessing that it involves a signature check at the moment.
Waiting for mine to be delivered, where does it store the downloaded game files?
deconfrost said:
Waiting for mine to be delivered, where does it store the downloaded game files?
Click to expand...
Click to collapse
The game files, if you mean the apk-files are generally stored on the internal sdcard and are available as movable USB storage. I don't think you even need to set it in developer mode to access the apk files. Anyway, if you set the device in the supplied developer mode it works fine. So there is no problem to load your own applications or backup downloaded games. SideQuest is a great application that simplifies this for semi-advanced users.
You can also use adb quite extensively and for example use scrcpy to dump the full screen output to a computer. Over all the Quest allows you to do most things you need.
But... The "problem" is that the Quest Android OS is locked and some things, mainly Ethernet over USB, have been disabled. You can stream video to the Quest via Wifi and play Oculus or SteamVR games that run on your computer fairly decent as it is now (using AVLR), but if Ethernet over USB was activated it could more or less replace a Oculus Rift or other wired unit completely. Oculus would likely not be happy with this since it would threaten their business/ market strategies, their segmentation of devices and the Oculus Store. But, that is why rooting the device would be interesting.
I've been finding holes to install the USB ethernet driver, but with no luck. Hope somebody will root the device so i can use either USB Tethering or a USB Ethernet device. Will even pay the person that can crack the device haha.
If I enter this CMD:
adb shell am start -a android.intent.action.VIEW -d com.oculus.tv -e uri com.android.settings/.DevelopmentSettings com.oculus.vrshell/.MainActivity
I can't even enable RNDIS manually, but that is logic since they just only added the WLAN drivers to the device.
Yesl
I just want to check that you've definitely tried plugging in a USB-C ethernet adapter? If you haven't I'm going to order one, plug in to the Quest and do lsusb.
cicada said:
I tried the dirtycow methods but I think that was patched out before this build, no success.
I also tried just running the usual commands to bring up USB Tethering, but that seems to need root as well. All I want is better ALVR streaming
Click to expand...
Click to collapse
JohanTEA said:
The game files, if you mean the apk-files are generally stored on the internal sdcard and are available as movable USB storage. I don't think you even need to set it in developer mode to access the apk files. Anyway, if you set the device in the supplied developer mode it works fine. So there is no problem to load your own applications or backup downloaded games. SideQuest is a great application that simplifies this for semi-advanced users.
You can also use adb quite extensively and for example use scrcpy to dump the full screen output to a computer. Over all the Quest allows you to do most things you need.
But... The "problem" is that the Quest Android OS is locked and some things, mainly Ethernet over USB, have been disabled. You can stream video to the Quest via Wifi and play Oculus or SteamVR games that run on your computer fairly decent as it is now (using AVLR), but if Ethernet over USB was activated it could more or less replace a Oculus Rift or other wired unit completely. Oculus would likely not be happy with this since it would threaten their business/ market strategies, their segmentation of devices and the Oculus Store. But, that is why rooting the device would be interesting.
Click to expand...
Click to collapse
Pfreaker said:
I've been finding holes to install the USB ethernet driver, but with no luck. Hope somebody will root the device so i can use either USB Tethering or a USB Ethernet device. Will even pay the person that can crack the device haha.
If I enter this CMD:
adb shell am start -a android.intent.action.VIEW -d com.oculus.tv -e uri com.android.settings/.DevelopmentSettings com.oculus.vrshell/.MainActivity
I can't even enable RNDIS manually, but that is logic since they just only added the WLAN drivers to the device.
Click to expand...
Click to collapse
guys if you use 5ghz wifi you get speeds way faster than you need anyway - I dont know why you so need to enable ethernet?
the quest has a better screen res than the rift as well. Games come up mint using ALVR
I use moonlight to stream normal non-vr games as well - also works flawlessly
however - one thing that doesnt work too well - if i am using ALVR to stream a VR game that uses a gamepad and not the controlers, i pair my XBOX gamepad via bluetooth and ALVR crashes every time.
When i use moonlight and the bluetooth gamepad it does not crash.
This means i can only play VR games which require a gamepad if i am in proximity to the PC itself and not anywhere in the house which is what i would like.
Has anyone found a solution to this "ALVR crashes with Bluetooth Gamepad connected" issue yet?
Quest Root - 90Hz possibility
With the quest link coming up and the fact that the Quest's OLED displays apparently can support up to 90Hz (Though they won't change it due to needing to verify it with the FCC), I'm hoping that that could be a reason for people to start trying to go for root! Especially with PCVR, a Rooted Quest running at 90Hz would possibly be better than the Oculus Rift S!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
one click root???
has anyone tried (one click root) to get root access
https://www.xda-developers.com/best-one-click-root-2018/
maybe the root master works or something else because android 7 was annouced in August 22, 2016 and rootmaster got last update 2017.
sry bad english.

Categories

Resources