Database Info

[TUT][ICS] bypass Credential Storage phone lock / install certificates

Hello folks,
idk if anyone of you guys had a hard time with the same annoying 'feature' on ics roms which forces you to set a PIN/password/pattern lock when you try to install enterprise certificates into your credential storage.
As for myself I need some of these certs to log into the WLAN at my university (which is 802.1x protected). But I don't feel the need of locking my phone.
So I exploited this to go around setting a password for the secure lock screen.
-------------------------------------------------------------------------------
Prerequisites are a rooted phone, a root file browser or adb tools and apparently your certificates.
I tested this on AOKP build 38 and 39 on a rooted HTC Sensation XE and will check this on two other devices the upcoming week.
UPDATE: seems to work even easier, I made the changes inline since the previous workaround did not work in every case.
Step 1:
Download the certificates to your SD card and/or install directly via browser/email etc. Do as you are asked and set up a PIN/password/pattern lock. Remember it
Step 2:
now with your root file browser go to /data/misc/ and recursively copy the folders keychain and keystore to a save place.
These are the folders containing the certificate files.
(See [System settings > security > Trusted credentials] for installed certificates)
With adb tools you can for example do this:
Code:
adb shell
su
cp -R /data/misc/keychain /sdcard/certificates/
cp -R /data/misc/keystore /sdcard/certificates/
Step 3:
Go to [System settings > security] and click [Clear credentials] at the bottom of the menu. Now your previously installed certs are wiped and you are free to set the lock method to [none], [slide] or [face lock] again.
Step 4:
Finally fire up your root file browser again, set /system as read/write and copy the in Step 2 backed up directories back to /data/misc/. They are now installed as the before but since CertInstaller.apk does not get involved, noone forces you to lock your phone.
in adb shell:
Code:
cp -R /sdcard/certificates/* /data/misc/
Now you should be able to find your newly added certificates in the System list under [System Settings > Security > Trusted credentials] in the [User] tab and thus be able to log into your desired WLAN.
I hope this helps some people out there. When I get deeper into developing maybe I will find a 'cleaner' method for this.
have a good night,
.eXa

Thank you for sharing! I have been really looking for this kind of hack.
Sadly I can't use it as my certificate has a different structure: it seems to install 3 files in /data/misc/keystore/
The files are 1000_USRCERT_Polimi ; 1000_USRCERT_Polimi and .masterkey
I tried copying these files to the new directory and even changing the file extension but it did not work.
I don't know if this issue is rom or certificate related.. anyway I am using a stock rom on samsung galaxy s3.. perhaps samsung manages differently certificates..
Have you any clue on this? Thank you!

hey, thanks for the reply.
alright, I figured something new, maybe try the updated version of the tutorial and pls tell me if that works for you.
greetings

.eXa said:
hey, thanks for the reply.
alright, I figured something new, maybe try the updated version of the tutorial and pls tell me if that works for you.
greetings
Click to expand...
Click to collapse
You were fast! and I think you made it: I can now select the certificate in the wifi options dialog (so it's correctly installed).. but I can't test the access to the network until monday.. Anyway I am convinced that it made the trick and it was really simple, I must say.
Thank you so much , this will be useful to many people!

Your trick helped me only partially. It allowed me to install the certificates just fine. But as soon as I try to connect to any 802.1x protected Wi-Fi network, the phone bugs me again with setting the screen lock. So I need a workaround for accessing the key storage.

I tried it and sadly it does not work: it asks me a password to activate the credential storage.. only problem is that I never set a password for it so I can't insert it and use the certificate. Too bad but I think it depends on the certificate.. anyway thank you very much for the help provided!

so, back from vacation.
@grgur: in your setup it is the 802.1x wlan that forces you by corporate policy to lock your phone. i am still trying to figure this out, i will try and search the system where stored wlan access points are stored. update will come as i find a solution to this.
@grievous: which version of android are you on? try clearing your credential storage first, then set up the password and then add the certificates. after that proceed with my tutorial.
since i am in the middle of learning for my exams i have really no time to go on with my android studies... it seems like in the long haul someone has to "fix" the app that handles phone lock and device policies. i know who the bad boy is but i am lacking time right now, so hopefully i get this done by the end of august.
i'll keep you up to date with my progress.
greetings

Is there a one-click fix for this yet? Bloody annoying...

Working great on stock rooted JellyBean nexus 7. Muchos grazis!

As soon as i go back to university (politecnico di milano) i will use your suggestion! Has anyone already tried with polimi wifi network?

.eXa said:
@grievous: which version of android are you on? try clearing your credential storage first, then set up the password and then add the certificates. after that proceed with my tutorial.
Click to expand...
Click to collapse
pippodream said:
As soon as i go back to university (politecnico di milano) i will use your suggestion! Has anyone already tried with polimi wifi network?
Click to expand...
Click to collapse
I was using a samsung stock rom 4.0.4 and the tutorial worked but when trying to connect again it asked me for a credential pwd (that I never set). Now I'm on CM10 so there should be no problem. As soon as I get to Polimi I'll try

doesn't work for me (SGS2 AOKP JB)
Hi!
I've tried to apply this solution to my device (SGS2 AOKP JB), but after clearing the credentials and copying back the keystores/keychains the user credentials cannot be found (Trusted credentials > User is empty).
Could anyone please help me with this one?
Thank you in advance.

zsszabolcs said:
Hi!
I've tried to apply this solution to my device (SGS2 AOKP JB), but after clearing the credentials and copying back the keystores/keychains the user credentials cannot be found (Trusted credentials > User is empty).
Could anyone please help me with this one?
Thank you in advance.
Click to expand...
Click to collapse
I have the same problem. And unfortunately I didn't find solution for that.
Wysłane z Android 4.1.2 za pomocą Tapatalk 2

In fact i was really searching for this i will try this tomorrow !

Sadly exchange with client certificate refuses to work after trying this hack It says that it can't found the cert it needs..

I have found the permanent solution !!!
I hope this will solve everyone's problem here.
These are the steps I have done after installing Eduroam certificates from my university:
1. Obviously I have installed CA
2. I had to choose which lock screen style will I use (I only could have choose between pattern, PIN, and password), it doesn't matter which lock screen style you choose between those three.(FYI I have chosen pattern)
3. After that I have failed to swipe my lock pattern correctly 15 times
4. The "Unlock with your Google account / unlock with your PIN/password" screen appeared.
5. Choose the "Unlock with your Google account" and type in your username and password
6. After that the "Choose your lock style" screen appears. DO NOT CHOOSE ANY OF THEM, since swipe still can't be chosen
7. Just press back to exit this menu.
8. Lock your screen and unlock it ---> You have swipe unlock enabled along with the CA certificates !!!

bubr3g said:
I have found the permanent solution !!!
I hope this will solve everyone's problem here.
These are the steps I have done after installing Eduroam certificates from my university:
1. Obviously I have installed CA
2. I had to choose which lock screen style will I use (I only could have choose between pattern, PIN, and password), it doesn't matter which lock screen style you choose between those three.(FYI I have chosen pattern)
3. After that I have failed to swipe my lock pattern correctly 15 times
4. The "Unlock with your Google account / unlock with your PIN/password" screen appeared.
5. Choose the "Unlock with your Google account" and type in your username and password
6. After that the "Choose your lock style" screen appears. DO NOT CHOOSE ANY OF THEM, since swipe still can't be chosen
7. Just press back to exit this menu.
8. Lock your screen and unlock it ---> You have swipe unlock enabled along with the CA certificates !!!
Click to expand...
Click to collapse
It won't work for me. After 10 failures it says that I have to wait 30 seconds for another try. I have Samsung Galaxy SII with Omega v21 (based on Samsung-stock Android 4.2.1).

TrojanPL said:
I have the same problem. And unfortunately I didn't find solution for that.
Wysłane z Android 4.1.2 za pomocą Tapatalk 2
Click to expand...
Click to collapse
Same thing here. Although files are backup up, there is no certificate showing up on the list. It would be great if someone found a solution, this lock is driving me nuts.

Hi, this seems almost too easy, and it's more of a workaround than a solution, but it works:
Try to login to your network
Accept the request to set up the mandatory screen lock and set one up (any kind)
Connect to your network
Go into Android settings/Security and change the screen lock type to None
Your network credentials are now saved and there is no longer a screen lock.

astarothcy said:
Hi, this seems almost too easy, and it's more of a workaround than a solution, but it works:
Try to login to your network
Accept the request to set up the mandatory screen lock and set one up (any kind)
Connect to your network
Go into Android settings/Security and change the screen lock type to None
Your network credentials are now saved and there is no longer a screen lock.
Click to expand...
Click to collapse
The last time I tried this with my CyanogenMod install, removing a pattern/password/pin was not possible because of the certificates. Only after removing the certificates, the screen-lock-type could be changed to a non-pattern/pin/password type.

(Q) IOTHiddenMenu?

Does anyone know how to get the IOTHiddenMenu to work in 4.3 TW OTA? *#0* # Doesn't seem to work.
Via Solitary Confined SGS3

ATGkompressor said:
Does anyone know how to get the IOTHiddenMenu to work in 4.3 TW OTA? *#0* # Doesn't seem to work.
Via Solitary Confined SGS3
Click to expand...
Click to collapse
I believe that they took the hidden menu out 4.3 to sop people from damaging there phone.

Mtsprite said:
I believe that they took the hidden menu out 4.3 to sop people from damaging there phone.
Click to expand...
Click to collapse
I see it in all my application managers. I'ts there I just can't use it.
Via Solitary Confined SGS3

ATGkompressor said:
Does anyone know how to get the IOTHiddenMenu to work in 4.3 TW OTA? *#0* # Doesn't seem to work.
Via Solitary Confined SGS3
Click to expand...
Click to collapse
Found people reported that these may work:
Try this *#22745927 (you may see the option to enable but it may not work)
OR
use EFS pro app to access IOTHhiddenmenu. (this will work)

buhohitr said:
Found people reported that these may work:
Try this *#22745927 (you may see the option to enable but it may not work)
OR
use EFS pro app to access IOTHhiddenmenu. (this will work)
Click to expand...
Click to collapse
Can't find that app on Google play
Via Solitary Confined SGS3

ATGkompressor said:
Can't find that app on Google play
Via Solitary Confined SGS3
Click to expand...
Click to collapse
http://d-h.st/u9g

buhohitr said:
http://d-h.st/u9g
Click to expand...
Click to collapse
I figured it out. (ON MY OWN I MIGHT ADD!!) Shortly after, I found a thread here on XDA that confirms my finding that was discovered on the VZW S4.
Open your file manager (I use ES File Explorer): / > efs > carrier > Hidden Menu »» *Edit text that says "OFF" to say "ON" (without quotations) *REQUIRES ROOT ACCESS*
» Reboot
Open phone dial pad and enter *#0*# This is the code for the Main Device Hardware Test Menu. But there are others.
*NOTE: Some codes have the potential to make your device operate an undesirable manner!*
Via Solitary Confined SGS3

ATGkompressor said:
I figured it out. (ON MY OWN I MIGHT ADD!!) Shortly after, I found a thread here on XDA that confirms my finding that was discovered on the VZW S4.
Open your file manager (I use ES File Explorer): / > efs > carrier > Hidden Menu »» *Edit text that says "OFF" to say "ON" (without quotations) *REQUIRES ROOT ACCESS*
» Reboot
Open phone dial pad and enter *#0*# This is the code for the Main Device Hardware Test Menu. But there are others.
*NOTE: Some codes have the potential to make your device operate an undesirable manner!*
Via Solitary Confined SGS3
Click to expand...
Click to collapse
Thank you! Confirmed this works.

RipCity12 said:
Thank you! Confirmed this works.
Click to expand...
Click to collapse
Where is the carrier file in ES file manager. Can't seem to find it.

[Q] How to Access Phone Info to Change Network Mode?

Please help how to access phone info to change network mode?
I'm trying to change network mode from CDMA auto PRL to CDMA only. I used to change it through phone info app but after upgrading to I535VRUCML1, it is not working anymore. I have seen in the Google play a note from the developer "[email protected]" that the app is not working with Samsung 4.3.
I have also enabled the hidden menu but the code *#*#4636#*# is not working.
My device is already Rooted.
The reason why I want to change from CDMA Auto PRL to CDMA only is that in some areas in my country (in Yemen) the battery will drop very quickly if I'm not on CDMA only.

ghamdan103 said:
Please help how to access phone info to change network mode?
I'm trying to change network mode from CDMA auto PRL to CDMA only. I used to change it through phone info app but after upgrading to I535VRUCML1, it is not working anymore. I have seen in the Google play a note from the developer "[email protected]" that the app is not working with Samsung 4.3.
I have also enabled the hidden menu but the code *#*#4636#*# is not working.
My device is already Rooted.
The reason why I want to change from CDMA Auto PRL to CDMA only is that in some areas in my country (in Yemen) the battery will drop very quickly if I'm not on CDMA only.
Click to expand...
Click to collapse
Navigate to system/efs/carrier and text edit the hidden menu.
It'll say off, delete it and write on in all caps. Reboot your phone and you'll be able to access the hidden menu.
This should work, but the file might not be in that location. if it doesn't work let me know.
Sent from my SCH-I535 using Tapatalk 2

BadUsername said:
Navigate to system/efs/carrier and text edit the hidden menu.
It'll say off, delete it and write on in all caps. Reboot your phone and you'll be able to access the hidden menu.
This should work, but the file might not be in that location. if it doesn't work let me know.
Sent from my SCH-I535 using Tapatalk 2
Click to expand...
Click to collapse
I have already donethat beside adding on line "sys.hiddenmenu.enable=1" to /system/build.prop . I can access some hidden menu like enabling DM mode ##366633#, *#06#, *#1234# and some other codes but not *#*#4636#*#*.

Finally I managed to change the network mode through DFS but it would be a lot easier with phone info
Sent from my ASUS Transformer Pad TF700T using xda app-developers app

ghamdan103 said:
Finally I managed to change the network mode through DFS but it would be a lot easier with phone info
Sent from my ASUS Transformer Pad TF700T using xda app-developers app
Click to expand...
Click to collapse
You should provide step by step details here in order to help others...

How to Change Network Preferred Mode Through DFS.
buhohitr said:
You should provide step by step details here in order to help others...
Click to expand...
Click to collapse
If you are running 4.3 ROM I535VRUCML1
Enable hidden menu by Navigating to system/efs/carrier and edit the hidden menu file by writing ON instead of OFF. also add this line "sys.hiddenmenu.enable=1" to /system/build.prop and then reboot.
Enable DM mode by dialing ##366633# and choose enable DM
Now from the DFS navigate programming then NAM and in preferred setting scroll Pref Mode to choose which mode you want for example I wanted to change to CDMA Only so I chose CDMA_IS2000.
Note; If you can not connect through DFS the send 000000 SPC through CDMA workshop and then you can use DFS

My device is not rooted and I would like to use phone info app. Is there a work around? Also what is DM mode?
Sent from my SCH-I535 using XDA Premium 4 mobile app

You can use easier way by using advanced Signal Status app but you have to be rooted.
Sent from my ASUS Transformer Pad TF700T using XDA Free mobile app

ghamdan103 said:
Finally I managed to change the network mode through DFS but it would be a lot easier with phone info
Sent from my ASUS Transformer Pad TF700T using xda app-developers app
Click to expand...
Click to collapse
Thanks alot it works..

[Q] Lollipop Wifi unlock options?

Hi All,
So the biggest feature I'm missing is trusted wifi unlock. All the app makers who had apps for pre 5.0 say Android has changed something and it's no longer possible. I sincerely hope this is not so they can sell more Smartwear devices.....but thats a debate for somewhere else.
My question is, are there any available solutions yet? I see that so far their are hurdles in front of xposed etc. for Lollipop.
Am I going to have to suffer it or shell out for a Watch?

I was going to ask the same question. Someone posted this solution. I tried it but I was getting error message from Secure Settings.
I am interested if this works for others (so I can figure if it is just problem on my end), or if there are other solutions that exist.

theganguly said:
I was going to ask the same question. Someone posted this solution. I tried it but I was getting error message from Secure Settings.
I am interested if this works for others (so I can figure if it is just problem on my end), or if there are other solutions that exist.
Click to expand...
Click to collapse
Ok, i got this to work with the help of your link. I also get an error too but make sure you do the following:-
Make sure your running secure settings 1.3.5
Go System+ and enable in secure settings
In secure settings click the spanner (top right) -> Pattern unlock method -> Lock settings (This was the one that fixed it for me)
Enable device adminstrator for secure settings in System Settings -> Security
Then in a tasker task I choose Secure settings -> Root actions -> Pattern Lock -> Disable / Enable
Hope it works for you.

Hmm. I'll have to try step 3 then as secure settings hasn't been working for me.

rootSU said:
Hmm. I'll have to try step 3 then as secure settings hasn't been working for me.
Click to expand...
Click to collapse
So far working great for me. Hope it works for you.

harveyd said:
Ok, i got this to work with the help of your link. I also get an error too but make sure you do the following:-
Make sure your running secure settings 1.3.5
Go System+ and enable in secure settings
In secure settings click the spanner (top right) -> Pattern unlock method -> Lock settings (This was the one that fixed it for me)
Enable device adminstrator for secure settings in System Settings -> Security
Then in a tasker task I choose Secure settings -> Root actions -> Pattern Lock -> Disable / Enable
Hope it works for you.
Click to expand...
Click to collapse
Thanks. I tried it a couple of times and it works now. I am glad that we were able to help each other out.
---------- Post added at 01:18 PM ---------- Previous post was at 01:09 PM ----------
rootSU said:
Hmm. I'll have to try step 3 then as secure settings hasn't been working for me.
Click to expand...
Click to collapse
I don't know if you viewed the link I posted but the guy there did ask people to join the beta for Android L compatibility. Maybe because you had Secure Settings pre-installed. Have you already tried uninstalling SS, join community on g+ and join beta, and reinstalled app again?
All the relevant links are included in the one I posted in post#2.

rootSU said:
Hmm. I'll have to try step 3 then as secure settings hasn't been working for me.
Click to expand...
Click to collapse
I don't know if you viewed the link I posted but the guy there did ask people to join the beta for Android L compatibility. Maybe because you had Secure Settings pre-installed. Have you already tried uninstalling SS, join community on g+ and join beta, and reinstalled app again?
All the relevant links are included in the one I posted in post#2.

How to enter the hidden menu

To enter the hidden menu LG Flex 2 do the following:
In call dialing type 277634#*#
alternative method
1. Install shortcut master
2. Open the application in the options select "Search" and look for "hidden menu"
3. Select "com.lge.hiddenmenu.HiddenMenu" and choose favorite, you create a shortcut on the main screen of the application.
4. Play. Of course I am not responsible for anything, just inform you as you enter this menu.
Thanks to pnight.
----- original message ------
Seeking all sides as to access the hidden menu of our flex 2, after I try all the codes that I saw on the forums I found this:
message # 12 Apache Thunder
Try this method and found a "hiddenmenu" without "com.lge." *, But nothing. I have searched with ES file and run it, tried to install it but could not be installed.
Now no longer appears in ADW.
So far I've come. it is there. We just have to find a way in.
Someone who has a G3 could you tell me if you can access by the method of ADW?
Does anyone know another way to know if the bootloader is closed?
* the com.lge.hiddenmenu has a submenu SIM lock.

Hidden menu within dialer?
Are you referring to the hidden menu available through the dialer? (5689#*996# for Sprint Version)
Also, does anyone know if the Factory Reset in that menu differs from the Factory Reset within Android?

Yes. the hidden menu available through the dialer.
I tried this codes:
AT&T: 3845#*955# ; Sprint: 5689#*955# ; T-Mobile: 3845#*955# ; Verizon Wireless: ##228378 (+ send) ; International Models: 3845#*955#
My model is 955
Sorry I can not help you about the Factory Reset, this is my first LG and I regret it, a little.

Solved.
I deactivated MLT and the phone now seems to be faster.

grauone said:
To enter the hidden menu LG Flex 2 do the following:
1. Install shortcut master
2. Open the application in the options select "Search" and look for "hidden menu"
3. Select "com.lge.hiddenmenu.HiddenMenu" and choose favorite, you create a shortcut on the main screen of the application.
4. Play. Of course I am not responsible for anything, just inform you as you enter this menu.
Thanks to pnight.
----- original message ------
Seeking all sides as to access the hidden menu of our flex 2, after I try all the codes that I saw on the forums I found this:
message # 12 Apache Thunder
Try this method and found a "hiddenmenu" without "com.lge." *, But nothing. I have searched with ES file and run it, tried to install it but could not be installed.
Now no longer appears in ADW.
So far I've come. it is there. We just have to find a way in.
Someone who has a G3 could you tell me if you can access by the method of ADW?
Does anyone know another way to know if the bootloader is closed?
* the com.lge.hiddenmenu has a submenu SIM lock.
Click to expand...
Click to collapse
It seems like ShortCut Master works only with root, since i'm not rooted i cannot use it ... Damn it!

Found the code to enter the hidden menu.
Thanks to Amaya84 from htcmania.com

I create a task in tasker, using securesettings link to the hidden menu.
Sent from my LG-H950 using Tapatalk

Lg g flex 2 955
grauone said:
Found the code to enter the hidden menu.
Thanks to Amaya84 from htcmania.com
Click to expand...
Click to collapse
i look everywhere for the code can you please give it too me

latino26 said:
i look everywhere for the code can you please give it too me
Click to expand...
Click to collapse
first post,first code worked for me"H955EUR".

worked for me
1. Dial *#546368#*955#
2. Go to SVC -> LDB
3. Uncheck MLT
4. Done

Thanks magnetto it works for me