Database Info

Exploiting Android systems locally (without a computer)

A call to ROM modders:
As you all know, there is a known method for exploiting Android devices and gain root privilges within the application itself without the use of a computer. This is a major security risk as any application can gain root and control the device without the users' knowledge.
To make your ROM/MOD protected, make sure you replace the adbd binary in your initramfs using the latest adbd from google sources. Thats it.
More details can be found here: www.androidsec.net

galaxys
Hi. I got galaxy s with voodoo kernel 5.3 but after install app close. Any idea?
Thanks
Also force close.

I installed the immunizer.apk from your website, but get a FC when trying to start it.
Galaxy S
Speedmod Kernel (all partitions ext4)

FC here as well.
Samsung Captivate running Perception 10.2/Firebird2-v05 #54.

I'd appreciate if you can look at the logcat to watch for any error.
By next week I should be able to test Immunizer on some more Android devices so I hope to be able to debug most of the problems. I'll post updates soon.

Fails to do anything:
Code:
W/ActivityManager( 3008): Process ProcessRecord{4879e6906820:androidsec.net/10159} failed to attach
*NOTE: Running KA7 voodoo injected kernel and KA7 modem on a Vibrant.
I installed v1.1 from the site.

Isn't this the same exploit used in Visionary? To get Temp Root access on the G2 and MyTouch 4G and such

if we were to be watching logcat, what should be looking for?

Version 1.3 starts without FC. If I press immunize and then press yes when it asks whether it should immunize and reboot, it waits for about 10 seconds, then I get a black screen, and finally it returns to the app list and nothing happened (if I reboot manually and start immunizer it still says the system is vulnerable).

dasunsrule32 said:
Fails to do anything:
Code:
W/ActivityManager( 3008): Process ProcessRecord{4879e6906820:androidsec.net/10159} failed to attach
*NOTE: Running KA7 voodoo injected kernel and KA7 modem on a Vibrant.
I installed v1.1 from the site.
Click to expand...
Click to collapse
kasper_h said:
Version 1.3 starts without FC. If I press immunize and then press yes when it asks whether it should immunize and reboot, it waits for about 10 seconds, then I get a black screen, and finally it returns to the app list and nothing happened (if I reboot manually and start immunizer it still says the system is vulnerable).
Click to expand...
Click to collapse
Same issue...

kasper_h said:
Version 1.3 starts without FC. If I press immunize and then press yes when it asks whether it should immunize and reboot, it waits for about 10 seconds, then I get a black screen, and finally it returns to the app list and nothing happened (if I reboot manually and start immunizer it still says the system is vulnerable).
Click to expand...
Click to collapse
Same here... :\

Please try latest version (1.4) and post results.
Also, if Immunizer failes, please provide output of the following commands (using 'adb shell' or similar):
Code:
ls -l /sbin/adbd
getprop ro.build.version.release
getprop ro.build.version.sdk

1.4 caused system to FC on reboot. Thank god for CWM advanced restore.
I'm not near a computer I can use to pull logs, sorry.
Thanks for your efforts, but I'm done with this project until it's stable.
Sent from my SGH-I897 using XDA App

I installed 1.4 over voodoo 5.3 kernel. I run it then ask me for aplly and reboot. I select apply and reboot and freeze on this screen. As soom as possible i'll paste adb logcat.
Regards
Sent from my Galaxy S. Darkyy Rom xxjpy with voodoo 5.3 (supercurio), voodoo app, bln!!!

Immunizer 1.4 -web- (galaxy i9000 +voodoo 5.03)
Code:
getprop ro.build.version.release 2.2.1
getprop ro.build.version.sdk 8
(Start & freeze after applying)
Code:
Start proc androidsec.net:remote for broadcast androidsec.net/.ExploitedAlarmReceiver: pid=8699 uid=10155 gids={3003, 1015}
I/Zygote ( 8699): Zygote: pid 8699 has INTERNET permission, then set capability for CAP_NET_RAW
D/dalvikvm( 8699): Trying to load lib /data/data/androidsec.net/lib/libandroidterm.so 0x489224e8
D/dalvikvm( 8699): Added shared lib /data/data/androidsec.net/lib/libandroidterm.so 0x489224e8
I/Exec ( 8699): JNI_OnLoad
I/ActivityManager( 2943): No longer want com.android.settings (pid 7028): hidden #16
D/dalvikvm( 2943): GC_FOR_MALLOC freed 29465 objects / 1138576 bytes in 358ms
D/dalvikvm( 2943): GC_FOR_MALLOC freed 43742 objects / 1823120 bytes in 218ms
D/dalvikvm( 6970): GC_EXPLICIT freed 4946 objects / 398088 bytes in 374ms
D/NativeCrypto( 6970): Freeing OpenSSL session
D/NativeCrypto( 6970): Freeing OpenSSL session
after apply
Code:
ls -l /sbin/adbd
lrwxrwxrwx root root 2011-01-27 23:35 adbd -> ../voodoo/root/sbin/adb

I'll be following this thread with great interest. Greetings. Dan

very interesting

[Tutorial] How To Logcat

Here's how to use logcat:
There are two main ways to do a logcat, within android, and through adb.
Logcat within android can be done one of two ways, through a Logcat app:
Here are two good examples are either: aLogcat or Catlog
I prefer catlog, because in my opinion it has a little bit nicer UI. Both of these programs can dump their logs to a txt file, which is very useful for debugging. Or, you can do it in terminal emulator (same rules as running through adb(see below))
From Moscow Desire:
Moscow Desire said:
Just a little more info when doing logcat.
Remember, Logcat will run till you end the session. And it won't always create the file till you do so. It's possible you may not see the logfile for a minute or so.
Edit: For phones/tablets with internal storage & external sd:
(note that the location naming convention may be different depending on device)
Open your terminal app;
Type: logcat > /sdcard/logcat.txt (this should create it in internal memory on the tablet)
To send to ext sd card: logcat > /mnt/external_sd/logcat.txt
I use a tablet for example Phones may have a different naming convention.
MD
Click to expand...
Click to collapse
On the other hand, using adb to run logcat, in my opinion is much more useful, because you can start using it when android boots (i.e. once the boot animation appears.)
The code for logcat to output to a file is
Code:
adb logcat > name of problem.txt
you can also do
Code:
adb logcat -f name of problem.txt
how I prefer to do it is this way:
Code:
adb logcat -v long > name of problem.txt
with the -v flag & the long argument, it changes output to long style, which means every line of logcat will be on its own line (makes it a little neater, imo)
Note: When outputting to a file, you will see a newline, but nothing printed, this is normal. To stop logcat from writting to a file, you need to press ctrl+c.
Here's where using logcat (via adb makes life really easy)
Lets say you find a problem you're having after looking at a logcat.
For example:
When I was trying to use a different ramdisk, wifi wouldn't work so I got a logcat that's almost 1300 lines long (a lot of stuff happens in the background)
So if you are searching for an error in the logcat file (it's always e/ for error, f/ for fatal. Those are the two main things that will break a system.)
Code:
D/dalvikvm( 871): GC_CONCURRENT freed 472K, 6% free 10224K/10823K, paused 1ms+6ms
V/AmazonAppstore.DiskInspectorServiceImpl( 871): Available blocks: 21981, Block size: 4096, Free: 90034176, Threshold: 5242880, withinThreshold? true
D/AmazonAppstore.UpdateService( 871): Received action: null from intent: Intent { cmp=com.amazon.venezia/com.amazon.mas.client.framework.UpdateService }
W/AmazonAppstore.UpdateService( 871): Confused about why I'm running with this intent action: null from intent: Intent { cmp=com.amazon.venezia/com.amazon.mas.client.framework.UpdateService }
D/dalvikvm( 890): GC_CONCURRENT freed 175K, 4% free 9375K/9671K, paused 2ms+3ms
V/AmazonAppstore.ReferenceCounter( 871): Reference (MASLoggerDB) count has gone to 0. Closing referenced object.
E/WifiStateMachine( 203): Failed to reload STA firmware java.lang.IllegalStateException: Error communicating to native daemon
V/AmazonAppstore.UpdateService( 871): runUpdateCommand doInBackground started.
V/AmazonAppstore.UpdateService( 871): Running UpdateCommand: digitalLocker
V/AmazonAppstore.UpdateCommand( 871): Not updating key: digitalLocker from: 1334228488057
V/AmazonAppstore.UpdateService( 871): Finished UpdateCommand: digitalLocker
V/AmazonAppstore.UpdateService( 871): Running UpdateCommand: serviceConfig
V/AmazonAppstore.MASLoggerDB( 871): performLogMetric: Metric logged: ResponseTimeMetric [fullName=com.amazon.venezia.VeneziaApplication_onCreate, build=release-2.3, date=Wed Apr 11 13:10:55 CDT 2012, count=1, value=1601.0]
V/AmazonAppstore.MASLoggerDB( 871): onBackgroundTaskSucceeded: Metric logged: ResponseTimeMetric [fullName=com.amazon.venezia.VeneziaApplication_onCreate, build=release-2.3, date=Wed Apr 11 13:10:55 CDT 2012, count=1, value=1601.0]
W/CommandListener( 118): Failed to retrieve HW addr for eth0 (No such device)
D/CommandListener( 118): Setting iface cfg
D/NetworkManagementService( 203): rsp
D/NetworkManagementService( 203): flags
E/WifiStateMachine( 203): Unable to change interface settings: java.lang.IllegalStateException: Unable to communicate with native daemon to interface setcfg - com.android.server.NativeDaemonConnectorException: Cmd {interface setcfg eth0 0.0.0.0 0 [down]} failed with code 400 : {Failed to set address (No such device)}
W/PackageParser( 203): Unknown element under : supports-screen at /mnt/asec/com.android.aldiko-1/pkg.apk Binary XML file line #16
D/wpa_supplicant( 930): wpa_supplicant v0.8.x
D/wpa_supplicant( 930): random: Trying to read entropy from /dev/random
D/wpa_supplicant( 930): Initializing interface 'eth0' conf '/data/misc/wifi/wpa_supplicant.conf' driver 'wext' ctrl_interface 'N/A' bridge 'N/A'
D/wpa_supplicant( 930): Configuration file '/data/misc/wifi/wpa_supplicant.conf' -> '/data/misc/wifi/wpa_supplicant.conf'
D/wpa_supplicant( 930): Reading configuration file '/data/misc/wifi/wpa_supplicant.conf'
D/wpa_supplicant( 930): ctrl_interface='eth0'
D/wpa_supplicant( 930): update_config=1
D/wpa_supplicant( 930): Line: 4 - start of a new network block
D/wpa_supplicant( 930): key_mgmt: 0x4
(mind you, that's 29 lines out of 1300ish, just for example)
I then could do the following with logcat:
Code:
adb logcat WifiStateMachine:E *:S -v long > name of problem.txt
and this will only print out any errors associated with WifiStateMachine, and anything which is fatal, which makes it about a million times easier to figure out what's going on!
In WifiStateMachine:E, the :E = to look for Errors, the full list of options is as follows:
V — Verbose (lowest priority)
D — Debug
I — Info (default priority)
W — Warning
E — Error
F — Fatal
S — Silent (highest priority, on which nothing is ever printed)
You can replace the :E with any other letter from above to get more info.
In order to filter out anything other than what you are looking for (in this case, WifiStateMachine) you must put a *:S after your last command (i.e. WifiStateMachine:E ThemeChoose:V ... ... AndroidRuntime:E *:S)
Sources: http://developer.android.com/tools/help/logcat.html
http://developer.android.com/tools/help/adb.html
Update for windows users:
Thank go to FuzzyMeep Two, Here's what he's posted for windows
FuzzyMeep Two said:
I have made a tool to simplify this for people. I will send you the .bat version, to see the validity of the file, and post the .exe for everyone else.
http://logcat-tool.googlecode.com/files/logcatHELPER.exe
I made this in about a half hour, so if you fnd any issues let me know. I believe i worked out all functionality issues, and do plan on expanding functionality in the future.
Click to expand...
Click to collapse
(If you used his tool, here's his post, thank him for his work!)

Very nicely done, now i have something i can refer people to

Perfect tutorial. Well done. ... I'll translate your tutorial into my language to share it other people.

pRo_lama said:
Perfect tutorial. Well done. ... I'll translate your tutorial into my language to share it other people.
Click to expand...
Click to collapse
Thank you! And thanks for taking your time to translate it!
If you need me to clarify anything shoot me a PM, and I'll help! (Same goes for anybody else interested in porting to their language)
Pax

Very nice, but I do have a question (and I started programming for Android recently): What do you do when the system reboots while debugging (in my case musb_hdrc.ko)? I tried catlog, but the logs are empty... Is there another way to do that?
Thank you in advance

Krain said:
Very nice, but I do have a question (and I started programming for Android recently): What do you do when the system reboots while debugging (in my case musb_hdrc.ko)? I tried catlog, but the logs are empty... Is there another way to do that?
Thank you in advance
Click to expand...
Click to collapse
Use adb instead of an in-android method to capture the logs, you can start when the boot animation starts (note: Not when the kernel splash screen appears) and when it reboots, it'll automatically end. (i.e. run the following in command prompt:
Code:
adb logcat *:E > oh_nos_it_crashed.txt
)
If you're not getting to the boot animation (keeps cycling on the Kernel splash screen) then you have kernel issues, and you need a kernel that has integrated last_kmsg (a whole different ball of wax that I'm still learning about) to figure out what's going on. (kmesg's are direct kernel output)
Maybe if someone like AdamOutler (or any other Dev who has a much better handle on them than myself) were to explain them, it'd help
Pax

Hey man regarding your guide .
I was testing a built of cm9 from my htc one v and it wasnt booting so the dev told me to do a logcat for it .
Just wondering what the process and commands would be?
Thanks.

Just a little more info when doing logcat.
Remember, Logcat will run till you end the session. And it won't always create the file till you do so. It's possible you may not see the logfile for a minute or so.
But what if you can't connect ADB to your device? You can do this
(note that the location naming convention may be different depending on device)
Open your terminal app;
Type: logcat > /sdcard/logcat.txt (this should create it in internal memory on the tablet)
To send to ext sd card: logcat > /mnt/external_sd/logcat.txt
I use a tablet for example Phones may have a different naming convention.
Nice definition of the display terminology
MD

tranceph0rmer said:
Hey man regarding your guide .
I was testing a built of cm9 from my htc one v and it wasnt booting so the dev told me to do a logcat for it .
Just wondering what the process and commands would be?
Thanks.
Click to expand...
Click to collapse
What you'll wanna do is run the following,
Code:
adb logcat *:E > crash.txt
And look at the output file specifically for lines that say 0x0deadbaad (if you see that, that means there's a problem with the Java libraries it references above it) otherwise look for other F/ lines, that'll point you in the right direction.
If you're having issues where and is not accessible for to buy having USB debugging turned off because of doing a /data wipe (factory data reset) first install a similar Rom (in your case, a prior, stable CM9, boot into it, turn on usb debugging, reboot into recovery & only write /cache & dalvik cache before installing the offending Rom & getting your logcat (sorry if I rambled, just got done working a double )
Pax
Sent from my R800x using Tapatalk 2

Moscow Desire said:
Just a little more info when doing logcat.
Remember, Logcat will run till you end the session. And it won't always create the file till you do so. It's possible you may not see the logfile for a minute or so.
But what if you can't connect ADB to your device? You can do this
(note that the location naming convention may be different depending on device)
Open your terminal app;
Type: logcat > /sdcard/logcat.txt (this should create it in internal memory on the tablet)
To send to ext sd card: logcat > /mnt/external_sd/logcat.txt
I use a tablet for example Phones may have a different naming convention.
Nice definition of the display terminology
MD
Click to expand...
Click to collapse
Thanks, MD!
The problem is when you can't access terminal (bootloops, fc'ing like it's going out of style, etc.) that adb is really useful. Sometimes to trick the system into working, you can (esp with AOSP based roms) install a same version of android (I.e. 4.0.4) & not wipe /data (after turning on usb debugging) & still have an access (I learned this after spending about 2-3 months crack flashing my own builds & getting tired of titanium restoring all my apps)
Pax
Sent from my R800x using Tapatalk 2

Great guide, thanks! Found it through the portal. I just added to my sig so maybe it will help stop some of those questions.

paxChristos said:
What you'll wanna do is run the following,
Code:
adb logcat *:E > crash.txt
And look at the output file specifically for lines that say 0x0deadbaad (if you see that, that means there's a problem with the Java libraries it references above it) otherwise look for other F/ lines, that'll point you in the right direction.
If you're having issues where and is not accessible for to buy having USB debugging turned off because of doing a /data wipe (factory data reset) first install a similar Rom (in your case, a prior, stable CM9, boot into it, turn on usb debugging, reboot into recovery & only write /cache & dalvik cache before installing the offending Rom & getting your logcat (sorry if I rambled, just got done working a double )
Pax
Sent from my R800x using Tapatalk 2
Click to expand...
Click to collapse
Thanks for the info.
Will do that the next time i get stuck at the boot animation

can anyone tell me how to clear / reset logcat?
Thanks in advance

riteshbendre said:
can anyone tell me how to clear / reset logcat?
Thanks in advance
Click to expand...
Click to collapse
Why would you want to do that?
To my knowledge, the only way logcat is reset is if you reboot your phone.
That's why filtering your results is very helpful, because no matter how long it's been running, you can get the info that you want without extraneous information
Pax

Thanks for the clarifications

Man thank you so much for the awesome guide!
Now I can actually filter out my logcat results instead of searching through the entire log.
Sent using Tapatalk

Helpful Tool
paxChristos said:
Here's how to use logcat.....
Click to expand...
Click to collapse
I have made a tool to simplify this for people. I will send you the .bat version, to see the validity of the file, and post the .exe for everyone else.
FIXED HUGE ISSUE CAUSING EMPTY FILES
DOWNLOAD
PM or post here if you run into any issues. They WILL be addressed.
I have made a tool to simplify Logcat creation for people. The creation of this tool was inspired, and guided, by the thread started HERE by paxChristos.
UPDATE 4.1
Corrected an issue causing empty files.
apparently, if the process id contained a space ( 1234) the file would parse correctly, but if the numbers came up to the parenthesis (12345) it would output an empty file named ACTIVITY(12345) with no extension.
This was a huge issue, and i apologize for not seeing it sooner. It has been corrected, and the logcat tool works better than ever. I just ran through a 20,000 line logcat without any empty files appearing.
a couple more things to help with stability.
Underscores (_) will be replaced by dashes (-)
Brackets ([]) and arrows (<>) will be replaced with paranthesis(())
-------------------------------------------------------------------------------------------------------------
HUGE UPDATE
Added the ability to "SUPER PARSE" Files, which separates files into folders by log level and creates a TXT file for each activity
Super parse DOES NOT Work with LONG format Logs.
SUPER PARSE is in its infancy I do expect errors, please let me know if you run into anything.
OLD STUFF
EDIT V3.6 DONE
Added ability to filter logcats by activity name. (logcat -s "FILTER")
Fixed Log Level Setting
EDIT V3.5 DONE
NOW PROPERLY PARSES "LONG" FORMAT LOGCATS.
Thank you to Senior Member jes0411 for pointing out the issues that lead me to create V3.4 and 3.5. If any of you have an issue please let me know. It could be hours before i get to it or weeks, but i will get to fixing it.
EDIT V3.4 DONE
Changed the way the date variable was handled to hopefully fix issues experienced by users of non-English versions of windows.
EDIT V3.3 DONE
EDIT V 3.2 Finished
Google code won't allow any new uploads, so i uploaded the new update to XDA in a ZIP file.
Fixed ADB Location settings, some users were having trouble if they input the ADB folder with any quotation marks in the path name, it will now automatically remove quotation marks to ensure correct syntax.
Fixed issue with ADB Location setting not exiting to previous menu.
Fixed issue with Log Level setting not exiting to previous menu.
Capitalized some stuff
Added a feature that will automatically create the selected folder if no output folder exists and the user attempts to run a log.
Added a check when selecting an output folder that will ask if you want the folder created if it does not exist
EDIT V3.1 DONE
FIXED OPTIONS 7 & 8, URLS WERE MISSING A "?"
CHANGELOG EDITS
SAVES AND PARSES FILES IN TO DIFFERENT OUPUT FILES BASED ON LOG LEVEL (E , I , D , W , ETC)
LOGCAT TOOL v1.1 by FuzzyMeep TWO
I made this in about a half hour, so if you fnd any issues let me know. I believe i worked out all functionality issues, and do plan on expanding functionality in the future.
reposted HERE
Edit: source here.
Batch Source
EDIT: UPDATED TO V1.1
added the framework to add filtering to your logcat, it is in the exe, but not utilized yet (still bugy). i have also worked out a few minor bugs in this release.

Very nice tut. Will try

thanks a ton for the in depth guide. I was always fairly confused on how to approach this, so now I'll have something to refer to in order to help all of the awesome devs here.

mcmb03 said:
thanks a ton for the in depth guide. I was always fairly confused on how to approach this, so now I'll have something to refer to in order to help all of the awesome devs here.
Click to expand...
Click to collapse
+1

100% WiFi Monitor Mode using Samsung Galaxy S2 (GT-I9100) Step by Step

Hi xda-mates. In this post I'm gonna show you, How to get wifi monitor mode on your device without external wifi adapter. If you don't know what is "wifi mode" goto wikipedia. The package consist from drivers, some wifi tools and aircrack.
Monitor Mode getting steps:
1. You have to root your device.
2. Flash CM 9.1.0.
3. Check out, your using originally cwm kernel included in the firmware you flashed.
4. Download my package(the password is my nickname).
5. Extract it to your sd.
6. Open up the terminal.
7. Type
Code:
su
cd pathToYourSd
sh install.sh
it will simply install all stuff to your system.
8. Type 'wmon on' in the terminal to activate monitor mode (type 'wmon off' to activate managed mode).
That's all. You have installed all that you needed, activated monitor mode and now you can use aircrack.
Troubleshooting:
Problem:
Code:
cannot find wireless tools, exiting!
Solution:
a) You must execute wifi tools (aircrack also) from root directory!
Code:
cd /
b) Check out of iwconfig, iwmulticall, iwpriv existance in /data/local/bin/.
Problem:
Code:
insmod: can't insert 'dhd.ko': invalid module format
error: SIOCGIFFLAGS (No such device)
Solution:
a) Make sure you are in supported rom and kernel.
b) Check out the file existance in /data/wmon/ (3 file).
Credits:
Aspartame21
Omri Ildis
Ruby Feinstein
Yuval Ofir
MemoryController

Could this possibly work on the Sprint Galaxy S2?
Sent from my SPH-D710 using xda premium

Mattix724 said:
Could this possibly work on the Sprint Galaxy S2?
Sent from my SPH-D710 using xda premium
Click to expand...
Click to collapse
May be but I don't know exactly. Try to istall it. I'll help you.

GREAT!
Thanks man! i was waiting for someone to go into this much detail, but does the wmon siyah mean that i can dualboot CM 9 and w/e rom ( in my case alliance) and get this to work? my problem with this before is that nothing would happen after my wifi is disabled and module is "loaded", also what do you mean run aircrack from the root dir? like root of the sd?
P.S. Testing now on the Galaxy S2 LTE version ( Rogers)

tutchthesky7 said:
Thanks man! i was waiting for someone to go into this much detail, but does the wmon siyah mean that i can dualboot CM 9 and w/e rom ( in my case alliance) and get this to work? my problem with this before is that nothing would happen after my wifi is disabled and module is "loaded", also what do you mean run aircrack from the root dir? like root of the sd?
P.S. Testing now on the Galaxy S2 LTE version ( Rogers)
Click to expand...
Click to collapse
I get suck after airmon-ng wlan0
says cannot find wireless tools, exiting!
Some help please and thanks?

tutchthesky7 said:
I get suck after airmon-ng wlan0
says cannot find wireless tools, exiting!
Some help please and thanks?
Click to expand...
Click to collapse
Use iwconfig wlan0 instead of airmon-ng wlan0. And make sure that you are in the root directory.
Code:
su
cd /
wmon on
iwconfig wlan0

iwconfig wlan0
aspartame21 said:
Use iwconfig wlan0 instead of airmon-ng wlan0. And make sure that you are in the root directory.
Code:
su
cd /
wmon on
iwconfig wlan0
Click to expand...
Click to collapse
OK thank you!, i'll give that a shot and post back!

Nada
aspartame21 said:
Use iwconfig wlan0 instead of airmon-ng wlan0. And make sure that you are in the root directory.
Code:
su
cd /
wmon on
iwconfig wlan0
Click to expand...
Click to collapse
# wmon on
Original module loaded. disabling wifi
LOADING MODULE
insmod: cant insrt dhd.ko : file exists error : SI0CIFFLAGS (no such device)
then i tried iwconfig wlan0
wlan0 No such device
so i checked iwconfig to see whats up
and my Wlan0 isn't there.. hmmm
Edit: I typed in wmon on and it responded with LOADING MODULE, then i did iwconfig wlan0 and it showed it in manage mode, what next?

tutchthesky7 said:
# wmon on
Original module loaded. disabling wifi
LOADING MODULE
insmod: cant insrt dhd.ko : file exists error : SI0CIFFLAGS (no such device)
then i tried iwconfig wlan0
wlan0 No such device
so i checked iwconfig to see whats up
and my Wlan0 isn't there.. hmmm
Edit: I typed in wmon on and it responded with LOADING MODULE, then i did iwconfig wlan0 and it showed it in manage mode, what next?
Click to expand...
Click to collapse
Don't pay attention to "managed mode" lettering, you are in monitor mode. To test monitor mode working type 'airodump-ng wlan0' and you will see that everything works perfect.

errrm.. not QUIIITEE, it says cannot find wireless tools, exiting. then it deletes all the files i extracted

IT IS WORK! one little question
THIS WORK, first, and ofc, THX man
I had a sgs2(official), rooted in gingerbread, and then i flashed ICS with CM 9.1, then i folllow yours steps, y putted my sgs2 in mode monitor and i checked.
Just one question, i searched in google, and ask in IRC, but i don't find the answer:
¿Do can i use the same steps to get WPA as Ubuntu or Backtrack? else... ¿do you know some link where a tutorial get wpa via sgs2?
I want complete the last step, thx for your time, and sry for my english

Clitoris Errante said:
THIS WORK, first, and ofc, THX man
I had a sgs2(official), rooted in gingerbread, and then i flashed ICS with CM 9.1, then i folllow yours steps, y putted my sgs2 in mode monitor and i checked.
Just one question, i searched in google, and ask in IRC, but i don't find the answer:
¿Do can i use the same steps to get WPA as Ubuntu or Backtrack? else... ¿do you know some link where a tutorial get wpa via sgs2?
I want complete the last step, thx for your time, and sry for my english
Click to expand...
Click to collapse
You can use all stuff like in ubuntu/bt.

Mode inyecction?
Thx for answer me, i did decide install another time backtrack in my sgs2(i removed ), but i want crack wpa without brute force or diccionaries, because it is imposible.
¿Is there some way to crack a wpa without brute force or diccionaries? ¿Do i could implement rainbow tables in sgs2, or is there some way to hashing with aircrack?
Thx for your time,

Clitoris Errante said:
Thx for answer me, i did decide install another time backtrack in my sgs2(i removed ), but i want crack wpa without brute force or diccionaries, because it is imposible.
¿Is there some way to crack a wpa without brute force or diccionaries? ¿Do i could implement rainbow tables in sgs2, or is there some way to hashing with aircrack?
Thx for your time,
Click to expand...
Click to collapse
Aircrack-ng is included to the package you installed. Just type aircrack-ng after switching wifi monitor mode

from a day to other, i can't use this
i didn't use somedays, and now i can't use, it is appears as delete, or simplely, not work. I did install applications in my sgs2.
But now i can't run it. I tried reinstall, but always put in the output:
"wmon on" not found
"wmod on" not found
"wmod monitor" not found
i did that in /, and i executed the install.sh in sdcard as you said in your post.
In internet i not found nothing, and i know programming bash a little, i tried solved gave wmon bit executable but is useless, i follow all steps rights as you said. The only one thing interesant when i execute install that is the output:
Installing Driver...
OK
Installing Utils...
OK
Creating Symlink...
link failed FIle exists
link failed File exists
//I think here is the fail of my steps, i think that make reference to /data/wmon, but i am not sure, i checked that files, but i can't solved
OK
Fixing Permissions...
OK
Temporary FIles Cleaning...
OK
Installation COmpleted! To start WiFi monitor mode just type : "wmod monitor"
I am sry if i am heavy, thx for your time.

This is pretty cool, I managed to make some progress, however got error at authorization stage at line:
aireplay-ng -1 0 -a MAC wlan0
Waiting for beacon frame (BSSID: .......) on channel -1
Couldn't determine current channel for wlan0, you should either force the operation with --ignore-negative-one or apply kernel patch
same error with injection
I'm pretty new to linux stuff, is there any way to bypass this?
Another thing is that I can't use wi-fi after using monitor mode, even if i shut it down (wmon off) until phone restart, is that alright?
Thanks in advance, and keep doing the great job!

Clitoris Errante said:
i didn't use somedays, and now i can't use, it is appears as delete, or simplely, not work. I did install applications in my sgs2.
But now i can't run it. I tried reinstall, but always put in the output:
"wmon on" not found
"wmod on" not found
"wmod monitor" not found
i did that in /, and i executed the install.sh in sdcard as you said in your post.
In internet i not found nothing, and i know programming bash a little, i tried solved gave wmon bit executable but is useless, i follow all steps rights as you said. The only one thing interesant when i execute install that is the output:
Installing Driver...
OK
Installing Utils...
OK
Creating Symlink...
link failed FIle exists
link failed File exists
//I think here is the fail of my steps, i think that make reference to /data/wmon, but i am not sure, i checked that files, but i can't solved
OK
Fixing Permissions...
OK
Temporary FIles Cleaning...
OK
Installation COmpleted! To start WiFi monitor mode just type : "wmod monitor"
I am sry if i am heavy, thx for your time.
Click to expand...
Click to collapse
I've to correct my scripts, but don't wait for it. Just type "export PATH=/data/local/bin:$PATH". You can also add this to your terminal emulator as launch commands or create a script in autostart folder:
Code:
su
cd /system/etc/init.d/
touch 17env
echo "#!/system/bin/sh\nexport PATH=/data/local/bin:$PATH\nexit 0" > 21env

makslll said:
This is pretty cool, I managed to make some progress, however got error at authorization stage at line:
aireplay-ng -1 0 -a MAC wlan0
Waiting for beacon frame (BSSID: .......) on channel -1
Couldn't determine current channel for wlan0, you should either force the operation with --ignore-negative-one or apply kernel patch
same error with injection
I'm pretty new to linux stuff, is there any way to bypass this?
Another thing is that I can't use wi-fi after using monitor mode, even if i shut it down (wmon off) until phone restart, is that alright?
Thanks in advance, and keep doing the great job!
Click to expand...
Click to collapse
I use "aireplay-ng -2 -b VICTIM -h FAKEDMAC wlan0"

aspartame21 said:
I've to correct my scripts, but don't wait for it. Just type "export PATH=/data/local/bin:$PATH". You can also add this to your terminal emulator as launch commands or create a script in autostart folder:
Code:
su
cd /system/etc/init.d/
touch 17env
echo "#!/system/bin/sh\nexport PATH=/data/local/bin:$PATH\nexit 0" > 21env
Click to expand...
Click to collapse
Where is this Terminal autostart folder? Also, I tried executing the first command and it gave me nothing but a "> " line. What should I do?

Hi guy,
first of all, thanks for your great job.
I've seen as you have uploaded a wmon_siyah4.5.1 version... does it work with that siyah version?
I have that kernel (and that version), and I get the error:
Code:
insmod: can't insert 'dhd.ko': invalid module format
error: SIOCGIFFLAGS (No such device)
just after run 'wmon on'.
Can you help me, please?
thanks

[Q] " System UIDs Inconsistent" Error ???? Now what?

Woke up this morning turned on my slide with the wonderful KKDS 1.3 from Emmanuel U, dont think this is a rom issue at all as have been using this rom for a very long while.
Anyhow so i get this "
System UIDs Inconsistent" Error popup that reads :
-------------------------
System UIDs Inconsistent
UIDs on the System are Inconsistent you need to wipe the Data partition or your device will be unstable
<im feeling lucky button>
----------------------------------
so whats the exact cause of the issue, if i re flash my twrp backup will this fix my problem? why does this issue arise & is there any other way to fix?

steve_77 said:
Woke up this morning turned on my slide with the wonderful KKDS 1.3 from Emmanuel U, dont think this is a rom issue at all as have been using this rom for a very long while.
Anyhow so i get this "
System UIDs Inconsistent" Error popup that reads :
-------------------------
System UIDs Inconsistent
UIDs on the System are Inconsistent you need to wipe the Data partition or your device will be unstable
<im feeling lucky button>
----------------------------------
so whats the exact cause of the issue, if i re flash my twrp backup will this fix my problem? why does this issue arise & is there any other way to fix?
Click to expand...
Click to collapse
I wonder if it is talking about different owners of files in /data...
...unless UID means something different than User Identification. I just opened a terminal emulator (on TBalden's 10.1) and did:
ls -l /data
ls -l /data/data
This shows all the folders and files in the respective directories with the assigned UID and GID (Group Identification). There was no consistent pattern. Even in /data/data, it looks like there was a different user assigned to every folder.
Which unfortunately means the easy way, 'chown -R root:root /data' is out.

Probably the cleanest solution HERE

I need help in bulding SHRP for the op 7 pro

I get this and some other errors like this when doing repo sync
I tried checking out there files and there weren't any at this location.
Code:
error: device/oneplus/oneplus7pro/: Cannot checkout android_device_oneplus_oneplus7pro due to missing network sync; Run `repo sync -n android_device_oneplus_oneplus7pro` first.
Error: [('/mnt/d/build/SHRP/.repo/project-objects/android_device_oneplus_oneplus7pro.git/branches', '/mnt/d/build/SHRP/.repo/projects/device/oneplus/oneplus7pro.git/branches', "[Errno 13] Permission denied: '/mnt/d/build/SHRP/.repo/projects/device/oneplus/oneplus7pro.git/branches'")]
How do I fix this?
Edit: I fixed the problem by rebooting initializing again from a non root user syncing for a sec then aborting with Ctrl+C and syncing normally from root. But you can still leave some tips for building here
I am also a beginner at building android/roms/recoverys so any tips would be appreciated

They don't even have an Android 10 branch.....