Database Info

[Q][DEV]Android Development Maps Question

I'm trying to develop (for the liveview) using an SDK and need to get a bitmap of Google Maps.
Code:
//Map Section
public class myMap extends MapActivity {
MapView mapView;
Bitmap bitmap;
boolean created = false;
/** Called when the activity is first created. */
@Override
public void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.main);
createMap();
}
public void createMap()
{
// build map and mark point
mapView = new MapView(this, "keykeykeykeykeykey");
mapView.setBuiltInZoomControls(false);
GeoPoint point = new GeoPoint(52242730,-884211);
mapView.getController().animateTo(point);
mapView.preLoad();
// copy MapView to canvas
bitmap = Bitmap.createBitmap(400, 800, Bitmap.Config.ARGB_8888);
Canvas canvas = new Canvas(bitmap);
mapView.draw(canvas);
PluginUtils.sendTextBitmap(mLiveViewAdapter, mPluginId, "Loading Map...", 128, 12);
created = true;
}
public void displayMap()
{
if (created == false)
{
createMap();
}
//Display map on device
Bitmap mybit = Bitmap.createBitmap(128, 128, Bitmap.Config.ARGB_8888);
for(int i = 0; i < 128; i++)
{
for(int j = 0; j < 128; j++)
{
mybit.setPixel(i, j, bitmap.getPixel(i, j));
}
}
//white pixel for debugging
mybit.setPixel(64, 64, Color.WHITE);
}
@Override
protected boolean isRouteDisplayed() {
// TODO Auto-generated method stub
return false;
}
}
Is what I've got so far, the code in createMap() was in onCreate() but It didn't seem to be called.
Now it just force closes.
Anyone know how to help? Is there a better place to ask development questions?
Thanks.
-=Edit=-
Oh, and here's the routine calling the map thing, every couple of seconds.
Code:
private class Timer implements Runnable {
@Override
public void run() {
// TODO Auto-generated method stub
myMap theMap = new myMap();
theMap.displayMap();
}
}

Okay, looks like you cant use google street map like this.
Anyone looking for similar solution, I used open street map and downloaded 'slipery tiles' png's. They provide java routines for finding the tile url from lat/lon.
http://wiki.openstreetmap.org/wiki/Slippy_map_tilenames

[Q] Building Nyandroid + platlogo into an app

I've been hacking away at a few java files (PlatlogoActivity.java, Nyandroid.java) extracted from AOSP ICS source in Eclipse. There were some errors that I was able to solve (some funky ones about vibration, but I just removed all code related to vibration instead) but now there is one error, that no matter what, I can't solve. In the Nyandroid.java, I keep on getting the error "Cannot cast from TimeAnimator to ValueAnimator" on the line "((ValueAnimator) mAnim).cancel();" no matter how much I try changing that line (for example to "mAnim.cancel();") based on some custom ROM sources that I've looked through, and some stackoverflow questions. The app source is attached to this post, and below you can find the Nyandroid.java if you're willing to help - please do. I want to get into app developing for Android, or atleast understanding some java. I managed to port the Gingerbread platlogo for all Android versions but it's obviously much easier to do because it's just one still image and a toast. But I really want to port the ICS Nyandroid easter egg, for some practice with java.
/*);
* Copyright (C) 2011 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.android.nyandroid;
import android.animation.AnimatorSet;
import android.animation.PropertyValuesHolder;
import android.animation.ObjectAnimator;
import android.animation.TimeAnimator;
import android.animation.ValueAnimator;
import android.app.Activity;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.graphics.drawable.AnimationDrawable;
import android.graphics.Bitmap;
import android.graphics.Canvas;
import android.graphics.Color;
import android.graphics.Matrix;
import android.graphics.Paint;
import android.graphics.Point;
import android.graphics.Rect;
import android.graphics.RectF;
import android.os.Handler;
import android.util.AttributeSet;
import android.util.DisplayMetrics;
import android.util.Pair;
import android.view.Gravity;
import android.view.MotionEvent;
import android.view.View;
import android.view.ViewGroup;
import android.view.WindowManager;
import android.widget.FrameLayout;
import android.widget.ImageView;
import java.util.HashMap;
import java.util.Random;
public class Nyandroid extends Activity {
final static boolean DEBUG = false;
public static class Board extends FrameLayout
{
public static final boolean FIXED_STARS = true;
public static final int NUM_CATS = 20;
static Random sRNG = new Random();
static float lerp(float a, float b, float f) {
return (b-a)*f + a;
}
static float randfrange(float a, float b) {
return lerp(a, b, sRNG.nextFloat());
}
static int randsign() {
return sRNG.nextBoolean() ? 1 : -1;
}
static <E> E pick(E[] array) {
if (array.length == 0) return null;
return array[sRNG.nextInt(array.length)];
}
public class FlyingCat extends ImageView {
public static final float VMAX = 1000.0f;
public static final float VMIN = 100.0f;
public float v, vr;
public float dist;
public float z;
public ComponentName component;
public FlyingCat(Context context, AttributeSet as) {
super(context, as);
setImageResource(R.drawable.nyandroid_anim); // @@@
if (DEBUG) setBackgroundColor(0x80FF0000);
}
public String toString() {
return String.format("<cat (%.1f, %.1f) (%d x %d)>",
getX(), getY(), getWidth(), getHeight());
}
public void reset() {
final float scale = lerp(0.1f,2f,z);
setScaleX(scale); setScaleY(scale);
setX(-scale*getWidth()+1);
setY(randfrange(0, Board.this.getHeight()-scale*getHeight()));
v = lerp(VMIN, VMAX, z);
dist = 0;
// android.util.Log.d("Nyandroid", "reset cat: " + this);
}
public void update(float dt) {
dist += v * dt;
setX(getX() + v * dt);
}
}
TimeAnimator mAnim;
public Board(Context context, AttributeSet as) {
super(context, as);
setLayerType(View.LAYER_TYPE_HARDWARE, null);
setSystemUiVisibility(View.SYSTEM_UI_FLAG_LOW_PROFILE | View.SYSTEM_UI_FLAG_HIDE_NAVIGATION);
setBackgroundColor(0xFF003366);
}
private void reset() {
// android.util.Log.d("Nyandroid", "board reset");
removeAllViews();
final ViewGroup.LayoutParams wrap = new ViewGroup.LayoutParams(
ViewGroup.LayoutParams.WRAP_CONTENT,
ViewGroup.LayoutParams.WRAP_CONTENT);
if (FIXED_STARS) {
for(int i=0; i<20; i++) {
ImageView fixedStar = new ImageView(getContext(), null);
if (DEBUG) fixedStar.setBackgroundColor(0x8000FF80);
fixedStar.setImageResource(R.drawable.star_anim); // @@@
addView(fixedStar, wrap);
final float scale = randfrange(0.1f, 1f);
fixedStar.setScaleX(scale); fixedStar.setScaleY(scale);
fixedStar.setX(randfrange(0, getWidth()));
fixedStar.setY(randfrange(0, getHeight()));
final AnimationDrawable anim = (AnimationDrawable) fixedStar.getDrawable();
postDelayed(new Runnable() {
public void run() {
anim.start();
}}, (int) randfrange(0, 1000));
}
}
for(int i=0; i<NUM_CATS; i++) {
FlyingCat nv = new FlyingCat(getContext(), null);
addView(nv, wrap);
nv.z = ((float)i/NUM_CATS);
nv.z *= nv.z;
nv.reset();
nv.setX(randfrange(0,Board.this.getWidth()));
final AnimationDrawable anim = (AnimationDrawable) nv.getDrawable();
postDelayed(new Runnable() {
public void run() {
anim.start();
}}, (int) randfrange(0, 1000));
}
if (mAnim != null) {
((ValueAnimator) mAnim).cancel();
}
mAnim = new TimeAnimator();
mAnim.setTimeListener(new TimeAnimator.TimeListener() {
public void onTimeUpdate(TimeAnimator animation, long totalTime, long deltaTime) {
// setRotation(totalTime * 0.01f); // not as cool as you would think
// android.util.Log.d("Nyandroid", "t=" + totalTime);
for (int i=0; i<getChildCount(); i++) {
View v = getChildAt(i);
if (!(v instanceof FlyingCat)) continue;
FlyingCat nv = (FlyingCat) v;
nv.update(deltaTime / 1000f);
final float catWidth = nv.getWidth() * nv.getScaleX();
final float catHeight = nv.getHeight() * nv.getScaleY();
if ( nv.getX() + catWidth < -2
|| nv.getX() > getWidth() + 2
|| nv.getY() + catHeight < -2
|| nv.getY() > getHeight() + 2)
{
nv.reset();
}
}
}
});
}
@Override
protected void onSizeChanged (int w, int h, int oldw, int oldh) {
super.onSizeChanged(w,h,oldw,oldh);
// android.util.Log.d("Nyandroid", "resized: " + w + "x" + h);
post(new Runnable() { public void run() {
reset();
mAnim.start();
} });
}
@Override
protected void onDetachedFromWindow() {
super.onDetachedFromWindow();
mAnim.cancel();
}
@Override
public boolean isOpaque() {
return true;
}
}
private Board mBoard;
@Override
public void onStart() {
super.onStart();
getWindow().addFlags(
WindowManager.LayoutParams.FLAG_ALLOW_LOCK_WHILE_SCREEN_ON
| WindowManager.LayoutParams.FLAG_SHOW_WHEN_LOCKED
);
}
@Override
public void onResume() {
super.onResume();
mBoard = new Board(this, null);
setContentView(mBoard);
mBoard.setOnSystemUiVisibilityChangeListener(new View.OnSystemUiVisibilityChangeListener() {
@Override
public void onSystemUiVisibilityChange(int vis) {
if (0 == (vis & View.SYSTEM_UI_FLAG_HIDE_NAVIGATION)) {
Nyandroid.this.finish();
}
}
});
}
@Override
public void onUserInteraction() {
// android.util.Log.d("Nyandroid", "finishing on user interaction");
finish();
}
}
Click to expand...
Click to collapse

[R&D|WIP] Reversing the Samsung OEM App/Bins

This is a dumper thread for collecting research and development information on reversing some (or all) of the various Samsung proprietary Applications and binaries found in their later top models running at least 4.2.2, and preferably also SELinux enabled as Enforcing.
In these devices there is an extensive amount of hidden functions, applications and behind the scenes modifications that is completely outside anything that we will ever be able to find in the AOSP repositories. In addition Samsung is spending more energy into obfuscating many of these functions and applications, which makes security vulnerability research much harder. Why? What is it that they try to hide from public scrutiny?
So if you have any insights or are particularly good at reading obtuse OEM Java code. Please join the discussion and help us out.
One of the first Apps to look at is the Samsung ServiceMode apps. There are at least three of them.
1) serviceModeApp_FB.apk
2) serviceModeApp_RIL.apk
3) Samsungservice.apk
Let's have a look at the first one: serviceModeApp_FB.apk
The first thing that hits you in the face is the LibOTPSecurity. This class is using the time zone as a mechanism for obfuscating some security mechanism using OTP (One Time Password) as a means of temporary authorization for access. (Thanks @ryanbg) The code look like this:
Code:
[SIZE=2]package LibOTPSecurity;
import ibOTPSecurity.OTPSecurit;
import java.text.DecimalFormat;
import java.util.Calendar;
import java.util.TimeZone;
public class OTPSecurity
{
private String GetDateString(int paramInt)
{
Calendar localCalendar = Calendar.getInstance(TimeZone.getTimeZone("GMT"));
localCalendar.add(12, paramInt * -1);
return new StringBuilder(String.valueOf(new StringBuilder(String.valueOf(new StringBuilder(String.valueOf(new DecimalFormat("00").format(-2000 + localCalendar.get(1)))).append(new DecimalFormat("00").format(1 + localCalendar.get(2))).toString())).append(new DecimalFormat("00").format(localCalendar.get(12))).toString())).append(new DecimalFormat("00").format(localCalendar.get(5))).toString() + new DecimalFormat("00").format(localCalendar.get(11));
}
private int MakeHashCode(String paramString)
{
int i = 0;
for (int j = 0; ; j++)
{
if (j >= paramString.length())
{
if (i < 0)
i *= -1;
return i;
}
i = i + (i << 5) + paramString.charAt(j);
}
}
public boolean CheckOTP(String paramString1, String paramString2)
{
int j;
for (int i = 5; ; i = j)
{
j = i - 1;
if (i <= -1)
return false;
if (paramString1.equalsIgnoreCase(Integer.toString(MakeHashCode(paramString2 + GetDateString(j)))))
return true;
}
}
}
[/SIZE]
This is making a "hash" out of some date strings for comparison. hopefully we'll see later what exactly these strings come from.
The GetDateString function can be reformatted as:
Code:
[SIZE=2] private String GetDateString(int paramInt) {
Calendar localCalendar = Calendar.getInstance(TimeZone.getTimeZone("GMT"));
localCalendar.add(12, paramInt * -1);
return new StringBuilder(String.valueOf(new StringBuilder(String.valueOf(new StringBuilder(String.valueOf(new DecimalFormat("00")
.format(-2000 + localCalendar.get(1))))
.append(new DecimalFormat("00")
.format(1 + localCalendar.get(2)))
.toString()))
.append(new DecimalFormat("00")
.format(localCalendar.get(12)))
.toString()))
.append(new DecimalFormat("00")
.format(localCalendar.get(5)))
.toString() + new DecimalFormat("00")
.format(localCalendar.get(11));
}[/SIZE]
I'd have been much happier if this was simplified to readable pseudo-code.
Another interesting part is the SysDump.class:
Code:
[SIZE=2] private boolean checkForNoAuthorityAndNotEngBuild()
{
this.settings = getSharedPreferences("SYSDUMPOTP", 0);
boolean bool = this.settings.getBoolean("ril.OTPAuth", false);
String str = String.valueOf(SystemProperties.get("ro.build.type"));
if ((!bool) && (str.compareToIgnoreCase("eng") != 0))
{
Log.e("SysDump", "It's user binary");
return true;
}
Log.e("SysDump", "It's eng binary");
return false;
}
[/SIZE]
This clearly (!) determines whether or not your phone is currently set as an Engineering model or User model. To allow this you probably need to set these properties:
Code:
ro.build.type=eng
ril.OTPAuth=true

It's possible that OTP = One Time Password as a means of temporary authorization for accessing service/engineering features. It could be similar to the Blackberry engineering menu that is accessed by a code generated from the Date/Time and device specific information. I'm also doing some significant work on disassembling these applications. Major developments will be posted here.

fusedlocation.apk
is this [fusedlocation.apk] a samsung thing?
disabling/removing/dummyfile all cause reboot like failing critical service.
this has been bothering me for sometime. there is literally no intelligent information
i've been able to find on this. that killing it skunks the os suggest that it's not so simple
as "oh yeah derrr that's for gps or sumthin.."
i could go on but, that's the basics of it.
do you have a list of suspect or confirmed scummy files/bin/apks?
thanks
m

Xiaomi firmware has multiple backdoors

So I've basically got myself in this sh*t because lack of care.. Until it pop'd and hit the highlights.
And now straight to the point. It doesn't f*ckin matters if you had a fw or not. As the backdoors are embedded in ROOT system processes.
And those where obviously white-listed as i didn't think of a nasty Chinese guy sitting in it calling back home. My friend who got the same phone found the article as i was having my vacation for a bit, so when i found out i did a bit a research of course on my device. After finding all this i e-mail'd him it and he posted it on the Xiaomi European forums. Guess what happened, it got deleted. So they know damn good what they're doing.
When you purchase Xiaomi products or services, we’ll collect relevant personal information, including but not limited: delivery information, bank account, credit card information, bill address, credit check and other financial information, contact or communication records.
Click to expand...
Click to collapse
OP said:
XMPP connection (always connected when network available)
54.255.185.236
hostname: ec2-54-255-185-236.ap-southeast-1.compute.amazonaws.com
(Seems not to have a domain) The IP address was also not found in any system modules in plain or unicode text. Assuming it is encoded / encrypted somewhere in a native application, system module, or not in a native app but in a dalvik compiled image.
Other connections
54.254.212.222
Hostname: ec2-54-254-212-222.ap-southeast-1.compute.amazonaws.com
Domains:
bbs.miui.com
reader.browser.miui.com
update.miui.com
www . miui.cn
www . miui.com
zhuomian.xiaomi.com
112.90.17.54
Domains:
pgv.m.xunlei.com
www . inewsgr.com
122.143.5.59
Hostname: 59.5.143.122.adsl-pool.jlccptt.net.cn
(Seems to be a adsl connection with no domain)
223.202.68.93
Hostname: out68-93.mxzwb3.hichina.com
Domains:
app.mi.com
dev.xiaomi.com
m.app.mi.com
mitunes.app.xiaomi.com
Music app(?) connects to:
202.173.255.152
2012-12-01 lrc.aspxp.net
2012-12-01 lrc.feiyes.net
2012-12-01 w.w.w.616hk.com
2012-12-01 w.w.w.hk238.com
2012-12-01 w.w.w.lrc123.com
123.125.114.145
2013-11-27 tinglog.baidu.com
1/53 2014-07-02 12:51:01 hxxp://tinglog.baidu.com
Latest detected files that communicate with this IP address
Latest files submitted to VirusTotal that are detected by one or more antivirus solutions and communicate with the IP address provided when executed in a sandboxed environment.
3/43 2014-07-08 07:39:24 facb146de47229b56bdc4481ce22fb5ec9e702dfbd7e70e82e4e4316ac1e7cbd
47/51 2014-04-28 09:25:27 091457f59fc87f5ca230c6d955407303fb5f5ba364508401a7564fb32d9a24fa
24/47 2014-01-08 08:19:43 3cf0a98570e522af692cb5f19b43085c706aa7d2f63d05469b6ac8db5c20cdcd
21/48 2013-12-02 15:15:45 7e34cb88fc82b69322f7935157922cdb17cb6c69d868a889468e297257ee9072
19/48 2013-12-01 20:02:32 bce4bd44d3373b2670a7d68e058c7ce0fa510912275d452d363777f640aa4c70
Latest URLs hosted in this IP address detected by at least one URL scanner or malicious URL dataset.
1/53 2014-07-02 12:47:57 hxxp://dev.baidu.com/
Android-system ANT HAL Service(Framework_ext.apk/jar) connect to:
42.62.48.207
VirusTotal's passive DNS only stores address records. The following domains resolved to the given IP address.
2014-04-28 app.migc.wali.com
2014-07-12 app.migc.xiaomi.com
2014-05-30 gamevip.wali.com
2014-05-30 log.wlimg.cn
2014-04-21 mitunes.game.xiaomi.com
2014-04-30 oss.wali.com
2014-05-17 p.tongji.wali.com
2014-07-13 policy.app.xiaomi.com
Latest detected URLs
Latest URLs hosted in this IP address detected by at least one URL scanner or malicious URL dataset.
1/58 2014-08-13 07:10:49 hxxp://policy.app.xiaomi.com/cms/interface/v1/checkpackages.php
1/58 2014-08-10 00:46:35 hxxp://policy.app.xiaomi.com/
1/53 2014-07-02 12:49:59 hxxtp://oss.wali.com
Messages(Mms.apk) connect to (it literary calls back home)
54.179.146.166
2014-08-12 api.account.xiaomi.com
2014-07-26 w.w.w.asani.com.pk
What it does? It sends phone numbers you call to, send messages to, add etc to a Resin/4.0.13 java application running on a nginx webserver to collect data. Checkpackages, embedded system process/app posts all installed apps to a Tengine a/k/a nginx webserver cms.
URL: hxxtp://api.account.xiaomi.com:81/pass/v3
Server: sgpaws-ac-web01.mias
Software: Tengine/2.0.1 | Resin/4.0.13
URL: hxxp://policy.app.xiaomi.com:8080/cms/interface/v1/
Server: lg-g-com-ngx02.bj
Software: Tengine | Resin
Bottom line
They don't give a single damn about your data.. All sent in plain text.
For messages APK (Mms.apk)
I don't believe it needs those permissions for normal functionalities, this is only for the extra feature let's call it bug.
android.permission.SEND_SMS_NO_CONFIRMATION
android.permission.GET_ACCOUNTS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.INTERNET
miui.permission.SHELL
android.permission.GET_TASKS
android.permission.CAMERA
Click to expand...
Click to collapse
Some code ... i also attached java classes and smali dalvik jvm bytecode..
Code:
#<externalId = outgoing callerid>#
package com.xiaomi.mms.net;
import android.net.Uri;
import android.net.Uri.Builder;
import android.telephony.TelephonyManager;
import android.text.TextUtils;
import com.xiaomi.mms.utils.EasyMap;
import java.util.Iterator;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Set;
import miui.net.CloudManager;
public class b
{
public static final String qa = CloudManager.URL_ACCOUNT_BASE;
public static final String qb = CloudManager.URL_ACCOUNT_API_V2_BASE;
public static final String qc = CloudManager.URL_ACCOUNT_API_V3_BASE;
public static final String qd = qa + "/serviceLogin";
public static final String qe = qc + "/[email protected]";
protected static String a(String paramString, Map paramMap)
{
if ((paramMap != null) && (!paramMap.isEmpty()))
{
Uri.Builder localBuilder = Uri.parse(paramString).buildUpon();
Iterator localIterator = paramMap.entrySet().iterator();
while (localIterator.hasNext())
{
Map.Entry localEntry = (Map.Entry)localIterator.next();
localBuilder.appendQueryParameter((String)localEntry.getKey(), (String)localEntry.getValue());
}
paramString = localBuilder.build().toString();
}
return paramString;
}
public static c al(String paramString)
{
EasyMap localEasyMap = new EasyMap("type", "MXPH").a("externalId", paramString);
d locald = new d(a(qe, localEasyMap));
String str = TelephonyManager.getDefault().getDeviceId();
if (!TextUtils.isEmpty(str))
locald.l("deviceId", str);
return locald;
}
}
===========================================================
public static Header a(Account paramAccount, ExtendedAuthToken paramExtendedAuthToken)
{
StringBuilder localStringBuilder = new StringBuilder();
localStringBuilder.append("serviceToken=");
localStringBuilder.append(paramExtendedAuthToken.authToken);
localStringBuilder.append("; userId=");
localStringBuilder.append(paramAccount.name);
return new BasicHeader("Cookie", localStringBuilder.toString());
}
===========================================================
public void gT()
{
if (ai("http://api.comm.miui.com/miuisms/res/version").getLong("data") == PreferenceManager.getDefaultSharedPreferences(this.mContext).getLong("festival_message_version", 0L))
return;
Object[] arrayOfObject = new Object[1];
arrayOfObject[0] = Integer.valueOf(this.mScreenWidth);
a(ai(String.format("http://api.comm.miui.com/miuisms/res/categories?width=%s", arrayOfObject)).getJSONArray("data"));
}
public void m(long paramLong)
{
Cursor localCursor = this.mq.rawQuery("SELECT MIN(message_id) FROM messages WHERE category_id=" + paramLong, null);
if (localCursor == null)
throw new FestivalUpdater.DatabaseContentException(null);
try
{
if (localCursor.moveToFirst())
{
long l = localCursor.getLong(0);
Object[] arrayOfObject = new Object[3];
arrayOfObject[0] = Long.valueOf(paramLong);
arrayOfObject[1] = Long.valueOf(l);
arrayOfObject[2] = Integer.valueOf(pd);
a(ai(String.format("http://api.comm.miui.com/miuisms/res/messages?cat=%s&marker=%s&count=%s", arrayOfObject)).getJSONObject("data").getJSONArray("entries"), paramLong);
}
return;
}
finally
{
localCursor.close();
}
}
===========================================================
package miui.util;
import android.content.Context;
import android.provider.Settings.Secure;
import android.util.Log;
import org.json.JSONArray;
import org.json.JSONObject;
final class BaseNotificationFilterHelper$2
implements Runnable
{
BaseNotificationFilterHelper$2(Context paramContext)
{
}
public void run()
{
try
{
JSONObject localJSONObject1 = Network.doHttpPostWithResponseStatus(this.val$context, "http://policy.app.xiaomi.com/cms/interface/v1/checkpackages.php", BaseNotificationFilterHelper.access$000(this.val$context));
if ((localJSONObject1.has("RESPONSE_CODE")) && (localJSONObject1.getInt("RESPONSE_CODE") == 200))
{
JSONObject localJSONObject2 = new JSONObject(localJSONObject1.getString("RESPONSE_BODY"));
int i = localJSONObject2.getInt("errCode");
if (i == 200)
{
JSONArray localJSONArray = localJSONObject2.getJSONArray("packages");
StringBuilder localStringBuilder = new StringBuilder();
for (int j = 0; j < localJSONArray.length(); j++)
{
localStringBuilder.append(localJSONArray.get(j).toString().trim());
localStringBuilder.append(" ");
}
Settings.Secure.putString(this.val$context.getContentResolver(), "status_bar_expanded_notification_black_list", localStringBuilder.toString());
BaseNotificationFilterHelper.access$102(null);
return;
}
if (i == 202)
{
Log.d("NotificationFilterHelper", "blacklist is empty ");
Settings.Secure.putString(this.val$context.getContentResolver(), "status_bar_expanded_notification_black_list", "");
BaseNotificationFilterHelper.access$102(null);
return;
}
if (i == 201)
Log.d("NotificationFilterHelper", "request param empty");
}
else
{
Log.d("NotificationFilterHelper", "access network anomalies");
}
return;
}
catch (Exception localException)
{
}
}
}
===========================================================
package miui.util;
import android.app.INotificationManager;
import android.app.INotificationManager.Stub;
import android.content.ContentResolver;
import android.content.Context;
import android.content.SharedPreferences;
import android.content.SharedPreferences.Editor;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageInfo;
import android.content.pm.PackageItemInfo;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.content.res.Resources;
import android.database.ContentObserver;
import android.os.ServiceManager;
import android.provider.Settings.Secure;
import android.provider.Settings.System;
import android.text.TextUtils;
import android.util.Log;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import miui.os.Build;
import miui.provider.CloudAppControll;
import miui.provider.CloudAppControll.TAG;
import org.json.JSONArray;
import org.json.JSONException;
import org.json.JSONObject;
public class BaseNotificationFilterHelper
{
protected static final String APP_NOTIFICATION = "app_notification";
protected static final int CODE_REQUEST_PARAM_EMPTY = 201;
protected static final int CODE_RESPONSE_EMPTY = 202;
protected static final int CODE_SUCCESS = 200;
public static final int DEFAULT = 0;
public static final int DISABLE_ALL = 3;
public static final int DISABLE_ICON = 1;
public static final int ENABLE = 2;
protected static final String EXPANDED_BLACK_LIST_CODE = "errCode";
protected static final String EXPANDED_BLACK_LIST_PACKAGES = "packages";
public static final int NONE = 0;
protected static final String SYSTEMUI_PACKAGE_NAME = "com.android.systemui";
protected static final String TAG = "NotificationFilterHelper";
protected static final String URL = "http://policy.app.xiaomi.com/cms/interface/v1/checkpackages.php";
private static HashSet<String> mBlacklist;
protected static INotificationManager nm;
protected static HashSet<String> sFilterList = new HashSet();
protected static HashMap<String, Integer> sFilterMap = new HashMap();
private static HashMap<String, Boolean> sIsSystemApp;
protected static HashMap<String, Integer> sUidMap = new HashMap();
static
{
if (Build.IS_INTERNATIONAL_BUILD);
for (int i = 2; ; i = 1)
{
DEFAULT = i;
nm = INotificationManager.Stub.asInterface(ServiceManager.getService("notification"));
mBlacklist = null;
sIsSystemApp = new HashMap();
return;
}
}
protected static void enableStatusIcon(Context paramContext, String paramString, int paramInt)
{
getSharedPreferences(paramContext).edit().putInt(paramString, paramInt).commit();
}
public static void enableStatusIcon(Context paramContext, String paramString, boolean paramBoolean)
{
if (paramBoolean);
for (int i = 2; ; i = 1)
{
enableStatusIcon(paramContext, paramString, i);
return;
}
}
public static String getAppNotificationText(Context paramContext, String paramString)
{
int i = 101450315;
switch (NotificationFilterHelper.getInstance().getAppFlag(paramContext, paramString, true))
{
default:
case 3:
case 1:
case 2:
}
while (true)
{
return paramContext.getResources().getString(i);
i = 101450314;
continue;
i = 101450315;
continue;
i = 101450313;
}
}
public static int getAppUid(Context paramContext, String paramString)
{
int i = 0;
if (sUidMap.containsKey(paramString))
return ((Integer)sUidMap.get(paramString)).intValue();
try
{
i = paramContext.getPackageManager().getApplicationInfo(paramString, 0).uid;
sUidMap.put(paramString, Integer.valueOf(i));
return i;
}
catch (PackageManager.NameNotFoundException localNameNotFoundException)
{
}
return i;
}
protected static int getDefaultFlag(Context paramContext, String paramString)
{
initFilterList(paramContext);
if (sFilterList.contains(paramString))
return 2;
return 0;
}
protected static int getGameCenterFlag(Context paramContext, String paramString)
{
readBlacklist(paramContext);
if (mBlacklist.contains(paramString))
return 3;
return 0;
}
private static String getInstalledAppsJson(Context paramContext)
{
JSONObject localJSONObject = new JSONObject();
JSONArray localJSONArray = new JSONArray();
Iterator localIterator = paramContext.getPackageManager().getInstalledPackages(0).iterator();
while (localIterator.hasNext())
{
PackageInfo localPackageInfo = (PackageInfo)localIterator.next();
if ((0x1 & localPackageInfo.applicationInfo.flags) == 0)
localJSONArray.put(localPackageInfo.packageName + "/" + localPackageInfo.versionCode);
}
try
{
localJSONObject.put("packages", localJSONArray);
return localJSONObject.toString();
}
catch (JSONException localJSONException)
{
}
return "";
}
protected static int getNetDefaultFlag(Context paramContext, String paramString)
{
if (sFilterMap.containsKey(paramString))
return ((Integer)sFilterMap.get(paramString)).intValue();
return loadAppNetFlagByPkg(paramContext, paramString);
}
public static SharedPreferences getSharedPreferences(Context paramContext)
{
if (!paramContext.getPackageName().equals("com.android.systemui"));
try
{
Context localContext = paramContext.createPackageContext("com.android.systemui", 2);
paramContext = localContext;
return paramContext.getSharedPreferences("app_notification", 4);
}
catch (PackageManager.NameNotFoundException localNameNotFoundException)
{
while (true)
localNameNotFoundException.printStackTrace();
}
}
protected static void initFilterList(Context paramContext)
{
if (sFilterList.size() == 0)
{
String str = Settings.System.getString(paramContext.getContentResolver(), "status_bar_notification_filter_white_list");
if (!TextUtils.isEmpty(str))
{
String[] arrayOfString = str.split(" ");
for (int i = 0; i < arrayOfString.length; i++)
sFilterList.add(arrayOfString[i]);
}
sFilterList.add("cn.com.fetion");
sFilterList.add("com.google.android.talk");
sFilterList.add("com.tencent.mm");
sFilterList.add("com.tencent.qq");
sFilterList.add("com.tencent.mobileqq");
sFilterList.add("com.xiaomi.channel");
}
}
public static boolean isNotificationForcedFor(Context paramContext, String paramString)
{
int i = getAppUid(paramContext, paramString);
return ("android".equals(paramString)) || (i == 1000) || (i == 1001) || (i == 0);
}
public static boolean isSystemApp(String paramString, PackageManager paramPackageManager)
{
Boolean localBoolean = (Boolean)sIsSystemApp.get(paramString);
if (localBoolean == null);
try
{
ApplicationInfo localApplicationInfo2 = paramPackageManager.getApplicationInfo(paramString, 0);
localApplicationInfo1 = localApplicationInfo2;
boolean bool = false;
if (localApplicationInfo1 != null)
{
int i = 0x1 & localApplicationInfo1.flags;
bool = false;
if (i != 0)
bool = true;
}
localBoolean = Boolean.valueOf(bool);
sIsSystemApp.put(paramString, localBoolean);
return localBoolean.booleanValue();
}
catch (PackageManager.NameNotFoundException localNameNotFoundException)
{
while (true)
ApplicationInfo localApplicationInfo1 = null;
}
}
protected static boolean isUserSetttingInited(Context paramContext, String paramString)
{
int i = getSharedPreferences(paramContext).getInt(paramString, 0);
boolean bool = false;
if (i != 0)
bool = true;
return bool;
}
public static void loadAppNetFlag(Context paramContext)
{
new Thread(new Runnable()
{
public void run()
{
BaseNotificationFilterHelper.sFilterMap.clear();
Iterator localIterator = this.val$context.getPackageManager().getInstalledPackages(0).iterator();
while (localIterator.hasNext())
{
PackageInfo localPackageInfo = (PackageInfo)localIterator.next();
if ((0x1 & localPackageInfo.applicationInfo.flags) == 0)
{
String str = localPackageInfo.applicationInfo.packageName;
BaseNotificationFilterHelper.loadAppNetFlagByPkg(this.val$context, str);
}
}
}
}).start();
}
public static int loadAppNetFlagByPkg(Context paramContext, String paramString)
{
int i = CloudAppControll.get(paramContext, CloudAppControll.TAG.TAG_NOTIFICATION_BLACKLIST, paramString);
if (i == -1)
return 0;
sFilterMap.put(paramString, Integer.valueOf(i));
return i;
}
public static void observeSettingChanged(ContentResolver paramContentResolver, ContentObserver paramContentObserver)
{
paramContentResolver.registerContentObserver(Settings.System.getUriFor("status_bar_notification_filter_white_list"), false, paramContentObserver);
}
private static void readBlacklist(Context paramContext)
{
if (mBlacklist == null)
{
mBlacklist = new HashSet();
String str = Settings.Secure.getString(paramContext.getContentResolver(), "status_bar_expanded_notification_black_list");
if (!TextUtils.isEmpty(str))
{
String[] arrayOfString = str.split(" ");
for (int i = 0; i < arrayOfString.length; i++)
mBlacklist.add(arrayOfString[i]);
}
}
}
public static void requestBlacklist(Context paramContext)
{
new Thread(new Runnable()
{
public void run()
{
try
{
JSONObject localJSONObject1 = Network.doHttpPostWithResponseStatus(this.val$context, "http://policy.app.xiaomi.com/cms/interface/v1/checkpackages.php", BaseNotificationFilterHelper.getInstalledAppsJson(this.val$context));
if ((localJSONObject1.has("RESPONSE_CODE")) && (localJSONObject1.getInt("RESPONSE_CODE") == 200))
{
JSONObject localJSONObject2 = new JSONObject(localJSONObject1.getString("RESPONSE_BODY"));
int i = localJSONObject2.getInt("errCode");
if (i == 200)
{
JSONArray localJSONArray = localJSONObject2.getJSONArray("packages");
StringBuilder localStringBuilder = new StringBuilder();
for (int j = 0; j < localJSONArray.length(); j++)
{
localStringBuilder.append(localJSONArray.get(j).toString().trim());
localStringBuilder.append(" ");
}
Settings.Secure.putString(this.val$context.getContentResolver(), "status_bar_expanded_notification_black_list", localStringBuilder.toString());
BaseNotificationFilterHelper.access$102(null);
return;
}
if (i == 202)
{
Log.d("NotificationFilterHelper", "blacklist is empty ");
Settings.Secure.putString(this.val$context.getContentResolver(), "status_bar_expanded_notification_black_list", "");
BaseNotificationFilterHelper.access$102(null);
return;
}
if (i == 201)
Log.d("NotificationFilterHelper", "request param empty");
}
else
{
Log.d("NotificationFilterHelper", "access network anomalies");
}
return;
}
catch (Exception localException)
{
}
}
}).start();
}
protected boolean areNotificationsEnabled(Context paramContext, String paramString)
{
return false;
}
public boolean canSendNotifications(Context paramContext, String paramString)
{
return getAppFlag(paramContext, paramString, true) != 3;
}
public void enableAppNotification(Context paramContext, String paramString, boolean paramBoolean)
{
}
public void enableNotifications(Context paramContext, String paramString, boolean paramBoolean)
{
enableAppNotification(paramContext, paramString, paramBoolean);
}
public int getAppFlag(Context paramContext, String paramString, boolean paramBoolean)
{
if (paramBoolean);
for (boolean bool = areNotificationsEnabled(paramContext, paramString); bool; bool = true)
{
int i = getSharedPreferences(paramContext).getInt(paramString, 0);
if ((i == 0) && (isSystemApp(paramString, paramContext.getPackageManager())))
i = 2;
if (i == 0)
i = getNetDefaultFlag(paramContext, paramString);
if (i == 0)
i = getDefaultFlag(paramContext, paramString);
if (i == 0)
i = getGameCenterFlag(paramContext, paramString);
if (i == 0)
i = DEFAULT;
return i;
}
return 3;
}
public void initUserSetting(Context paramContext, String paramString)
{
if (!isUserSetttingInited(paramContext, paramString))
{
if (isSystemApp(paramString, paramContext.getPackageManager()))
enableStatusIcon(paramContext, paramString, true);
}
else
return;
int i = getAppFlag(paramContext, paramString, false);
if (i == 3)
{
enableAppNotification(paramContext, paramString, false);
enableStatusIcon(paramContext, paramString, false);
return;
}
enableStatusIcon(paramContext, paramString, i);
}
}
RELATED
http://apkscan.nviso.be/report/show/48b5666fa2bcbe738c0b623da712918f
http://lists.clean-mx.com/pipermail/viruswatch/20130714/072661.html
OTHER SOURCES
http://www.newmobilelife.com/2014/08/12/xiaomi-china-server/
http://www.htcmania.com/showthread.php?p=14730859

Removing the backdoors.
Root your device & install
- System app remover (ROOT)
- Root browser
- Android terminal emulator
- Droidwall
Remove apps using System app remover:
* AntHalService
* XiaomiServiceFramework
* Cleanmaster
* com.xiaomi.gamecenter.adk.service
* com.duokan.airkan.phone
# MAKE BACKUP OF YOUR PHONE IN CASE OF FAILURE! #
Download XVI32 or use your favorite hex editor.
Copy framework_ext.odex from /system/framework/ to your sd card with root browser and then connect your phone to your pc and copy the file to you pc.
Open it in XVI32 or another hex editor and search for "http://" (without quotes) now replace all "http://www.example.com" or "http://example.com" with "http://localhost/leavealltheotherstuff.here.com" Don't removed lines or other stuff or it will f*ck up the dalvik bytecode.
Save the file as "framework_ext_.odex" and place it on your phone's internal memory.
Now open Root browser copy the patched file to /system/framework/ rename it to "framework_ext.odex" and overwrite the old system file with the patch (make sure you have a backup of your phone just in case!). Now open Terminal emulator on your phone and do the following,
Code:
su
now give the emulator root access
Code:
cd /system/framework
chmod 644 framework_ext.odex
chown root:root framework_ext.odex
ls -la framework_ext.odex
Verify this, if it looks fine
Code:
reboot
Now open Droidwall enable it and only select apps you trust, don't select any from Xiaomi. Even the music app sends data. So simply drop all of them.
HELP MY DEVICE IS BRICKED
No worries bro.
Get system.img for your version of miui and start the phone in fastboot (vol- + pwr)
Recovery.bat
Code:
@echo off
title Recovery
echo flashing system.img on device... please wait !
fastboot fastboot flash system system.img
fastboot erase cache
fastboot reboot
echo Done, rebooting
pause >nul
Use Droidwall to block ID 0(root system processes) and ID kernel. If you don't do this it will sent info about the apps you open to umeng.com.
Anyways that's it for so far. I hope this helps you.

That is seriously messed up and illegal in most European Countries! It seem that they are begging for a Class Action Lawsuit! Let them have it!
Thank you for your important and detailed work!
Perhaps @BSDgeek_Jake would consider to add all those servers to his MoaAB hosts file?

E:V:A said:
That is seriously messed up and illegal in most European Countries! It seem that they are begging for a Class Action Lawsuit! Let them have it!
Thank you for your important and detailed work!
Perhaps @BSDgeek_Jake would consider to add all those servers to his MoaAB hosts file?
Click to expand...
Click to collapse
They deserve a lawsuit, not only for cloning Apple's iOS but also for the backdoors and crapware that connects to the internet and does stuff. Such a big company as this can't just walk away if nothing has ever happaned. They have sold over 14 million phones. 14 MILLION!
Host file doesn't work as the other spyware is in system processes that runs as ID0 simply ignores the host file somehow. I tested it several times and it just ignores the host file?
A rom update/fix has pop'd up.
http://www.needrom.com/download/redmi-1s-wcdma-global-multi-4-3-no-spywarebloatware
It's MIUI v5 with nova in the pics you see (the rom appears to come just like stock but with no backdoor etc) thanks to whoever made it.

Hi,
Can you give way to clean rom for Mi2S because applications are not the same as in your description

I have posted this and a link to this thread in the proper forums. Thanks for the info. I have also copied this thread link to google plus asking Hugo to explain it. Of course he never will but I wanted to give him a chance.

Wait so... this means XDA discovered that MIUI OS connects to the internet?
And you want to send Hugo a small fragment of mms app code with Cloud messaging - which is standard and optional MIUI feature?
Is that your proof? Congrats. Much ado about nothing...
GameSDKService? Of course because this is the stock chinese app with games (usually pirated), but the app is only in chinese original roms.
Every port, every multilang rom doesnt have those apps.
Also Duokan service provide online content to Music and Video apps. This is standard MIUI feature from beginning.
Please note that Global versions of the MIUI roms (so outside china mainland) doesnt have online features.
All stuff presented above IS not a proof!
If I were Hugo I would lough down this after reading.

Accidd said:
Wait so... this means XDA discovered that MIUI OS connects to the internet?
And you want to send Hugo a small fragment of mms app code with Cloud messaging - which is standard and optional MIUI feature?
Is that your proof? Congrats. Much ado about nothing...
GameSDKService? Of course because this is the stock chinese app with games (usually pirated), but the app is only in chinese original roms.
Every port, every multilang rom doesnt have those apps.
Also Duokan service provide online content to Music and Video apps. This is standard MIUI feature from beginning.
Please note that Global versions of the MIUI roms (so outside china mainland) doesnt have online features.
All stuff presented above IS not a proof!
If I were Hugo I would lough down this after reading.
Click to expand...
Click to collapse
First off XDA didn't find it a user did. It was just posted and asked for clarification.
Second off after the last privacy issue this OEM had you can expect people to be Leary of them.
Third. If a OEM is going to blatantly disregard copyright laws as well as the gpl you have to understand why people will not trust them. They need to very transparent with things like this. Mainly if they plain to ever make a world wide release.

I agree. But also take into account that not every piece of code presented by some user containing words "online", "sync" or ip tracing to chinese server is already a backdoor as the op presented to us. Which without proof is just a normal accusations.
As I said. In global versions of MIUI most of online Xiaomi services are disabled.
Wysłane z MI4 W

Accidd said:
I agree. But also take into account that not every piece of code presented by some user containing words "online", "sync" or ip tracing to chinese server is already a backdoor as the op presented to us. Which without proof is just a normal accusations.
As I said. In global versions of MIUI most of online Xiaomi services are disabled.
Wysłane z MI4 W
Click to expand...
Click to collapse
Are you are working for Xiaomi? Marketing maybe?

Nope.
I'm working with MIUI roms for 4 years now. And also been using MI2, MI3, Redmi, MiPad and now MI4 devices.
I also translate MIUI to my own language and run Xiaomi.eu multilang project.
We do multilang roms there every week for many devices.
I do not have access to MIUI source code - as only xiaomi does that, but I'm digging in MIUI apps all the time.
Decoding, fixing MIUI bugs, recompile, build. Everything.
Take a look into this thread:
http://forum.xda-developers.com/showpost.php?p=55283079&postcount=8
where I explained some facts.

Accidd said:
Nope.
I'm working with MIUI roms for 4 years now. And also been using MI2, MI3, Redmi, MiPad and now MI4 devices.
I also translate MIUI to my own language and run Xiaomi.eu multilang project.
We do multilang roms there every week for many devices.
I do not have access to MIUI source code - as only xiaomi does that, but I'm digging in MIUI apps all the time.
Decoding, fixing MIUI bugs, recompile, build. Everything.
Take a look into this thread:
http://forum.xda-developers.com/showpost.php?p=55283079&postcount=8
where I explained some facts.
Click to expand...
Click to collapse
I can understand your point, and frankly, I have not a Xiaomi phone, but I am using a MIUI Rom on my Lenovo. I love the rom, quick, smooth, great performance and fully of features and themes, simply beautiful, but I can also understand the concern raised in this thread. In these days, people (most of) accept things as they are, not as they should be. That way the "agencies" and all the other "followers" (software devs, manufacturers, and so on) are using their chances to mislead the masses, with the intent to control every single bit of information about our lives (from sensitive, to marketing purposes infos)! That said, I think that no one manufacturer is not misusing their power, and hope that one day, a solution will be found (even if I doubt it) to let us have our privacy as human being! I fully support this thread and would love to see more thread like this one, exactly because the aforementioned.

Well sometimes I don't get one thing. People are worried about using Chinese brands but they use Apple, or Google phones in USA that can give all your stuff to NSA in 5 minutes if they want so. If you prefere not to share your emails or photos with governments (USA or China) then don't use your smartphone. Use Nokia 3210.
Wysłane z MI4 W

Accidd said:
Well sometimes I don't get one thing. People are worried about using Chinese brands but they use Apple, or Google phones in USA that can give all your stuff to NSA in 5 minutes if they want so. If you prefere not to share your emails or photos with governments (USA or China) then don't use your smartphone. Use Nokia 3210.
Wysłane z MI4 W
Click to expand...
Click to collapse
There are laws here that protect people. The laws in China are very different. And China's own actions are the cause people dont trust them. I mean come on. They respect no ones rights at all. The are known for pirating apps, breaking copyright laws and flat out ignoring the laws that dictate what they need to do. Not to mention ripping off the work of others and claiming it as their own.

zelendel said:
There are laws here that protect people. The laws in China are very different. And China's own actions are the cause people dont trust them. I mean come on. They respect no ones rights at all. The are known for pirating apps, breaking copyright laws and flat out ignoring the laws that dictate what they need to do. Not to mention ripping off the work of others and claiming it as their own.
Click to expand...
Click to collapse
Thats true and I agree. But Chinese also protect their identities. All syncing services in MIUI seems to be encrypted.
If some random guy claims different they let him prove it if his SMS is sent plain text and then other can read them.
And also users have choice. Again. You can use MIUI OS without syncing with Mi Cloud if you dont want to.
Pirating apps, breaking copyright laws is true for China. And you are right.
But the privacy, for some brands (maybe not all) can still be protected.
Thats why I make multilang roms over xiaomi.eu. We tend to cut lot of chinese apps that EU user wont need or it will not work for them. Mentioned GameServiceSDK or some Duokan services are just app features, that give users chinese content but not steal any data (as presented in first post). This can also be removed from rom as we do that.
So also this is not that we or I accept all chinese stuff in stock rom and use it. We try to minimase the chinese influence in rom to end user.

Not to say I support china or what, but privacy issue? Apple cloud server got hacked and all the celeb personal picture got expose (tot apple claim it was not from them). Nobody was complaining this much when apple and google sync every little personal data into their server but complain about xiomi taking user data secretly? So it should be done openly? lol

Accidd said:
Well sometimes I don't get one thing. People are worried about using Chinese brands but they use Apple, or Google phones in USA that can give all your stuff to NSA in 5 minutes if they want so. If you prefere not to share your emails or photos with governments (USA or China) then don't use your smartphone. Use Nokia 3210.
Wysłane z MI4 W
Click to expand...
Click to collapse
Yes you are right about that, but would be nice if there would be some way to protect ourselves.
zelendel said:
There are laws here that protect people. The laws in China are very different. And China's own actions are the cause people dont trust them. I mean come on. They respect no ones rights at all. The are known for pirating apps, breaking copyright laws and flat out ignoring the laws that dictate what they need to do. Not to mention ripping off the work of others and claiming it as their own.
Click to expand...
Click to collapse
You are right about piracy and copyright, but it seems only things related to copyright concerns us (eg. multi million law suits). The strongest privacy laws are in Europe, not USA. In the USA we have no rights, since we are living in a drive-by-money country, not drive-by-laws! Sad thing is the fact that our "best" companies exploit Chinese people (eg. Apple pays $1,36 per iPhone for the labor force to the little Chinese people - and they sell them to us for $600), and we are concerned about our privacy, but actually we use a Chinese man made product (fact!!!). The point here is not to blame the manufacturer, or the retailer, but to find a way, by ourselves (because no "big guys" is gonna help you) to protect our privacy, both online or offline!
adkz said:
Not to say I support china or what, but privacy issue? Apple cloud server got hacked and all the celeb personal picture got expose (tot apple claim it was not from them). Nobody was complaining this much when apple and google sync every little personal data into their server but complain about xiomi taking user data secretly? So it should be done openly? lol
Click to expand...
Click to collapse
You are 100% right!

setmov said:
Yes you are right about that, but would be nice if there would be some way to protect ourselves.
You are right about piracy and copyright, but it seems only things related to copyright concerns us (eg. multi million law suits). The strongest privacy laws are in Europe, not USA. In the USA we have no rights, since we are living in a drive-by-money country, not drive-by-laws! Sad thing is the fact that our "best" companies exploit Chinese people (eg. Apple pays $1,36 per iPhone for the labor force to the little Chinese people - and they sell them to us for $600), and we are concerned about our privacy, but actually we use a Chinese man made product (fact!!!). The point here is not to blame the manufacturer, or the retailer, but to find a way, by ourselves (because no "big guys" is gonna help you) to protect our privacy, both online or offline!
You are 100% right!
Click to expand...
Click to collapse
What Apple does in China is one of the reasons Ill never touch an apple product. The companies you stated tell you what they collect. The main issue here is they are not disclosing what they are collecting.
No if you think it is right or wrong is not important. What is important is finding a way to make them be very clear about what they are doing and how to stop it.
Now one user posted how to shut it off. IF it works good. IF not then we need to start ripping apart the system and remove the coding and all access to their services.
Might not be a matter here soon as there are teams already working on ripping MIUI apart and making it open source. It will take time but I am sure it will happen.

zelendel said:
Might not be a matter here soon as there are teams already working on ripping MIUI apart and making it open source. It will take time but I am sure it will happen.
Click to expand...
Click to collapse
That's a wonderful News you have given... :good:

are those backdoors the same thing that Xiaomi was saying that data was sent only because of their cloud messaging app?; they said they will provide option to disable in the next release?

Editing the stock MTC Manager

Hey guys, I have a xtrons px5 mtcd head unit and I am trying to figure out without flashing to a custom ROM, how to edit what apps launch at wake, or do not turn off with the unit when it goes to sleep.
I believe it is the MTCManager that is doing these actions, and I have found two interesting parts of the decomplied code.
The first file is android/microntek/a.java
HTML:
package android.microntek;
import android.app.ActivityManager;
import android.app.ActivityManager.MemoryInfo;
import android.app.ActivityManager.RunningAppProcessInfo;
import android.app.ActivityManager.RunningServiceInfo;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.content.pm.ResolveInfo;
import android.microntek.service.R;
import android.text.TextUtils;
import android.text.format.Formatter;
import android.view.inputmethod.InputMethodInfo;
import android.view.inputmethod.InputMethodManager;
import android.widget.Toast;
import java.util.ArrayList;
public class a {
static String cp;
private static boolean cq = false;
static Context cr;
private static int cs = -1;
static Toast ct;
private static final String[] cu = new String[]{"android.microntek.", "com.murtas.", "com.microntek.", "com.goodocom.gocsdk", "android.rockchip.update.service", "com.android.systemui", "com.hct.obd.OBDActivity", "com.unisound", "com.dpadnavi.assist", "com.intel.thermal", "cn.manstep.phonemirror", "com.hiworld.", "com.carboy.launch", "com.android.bluetooth", "net.easyconn", "com.android.launcher", "com.google.android", "com.vayosoft.carsystem"};
static Object cv = new Object();
static a cw;
private static final String[] cx = new String[]{"android.microntek.", "com.murtas.", "com.microntek.", "com.goodocom.gocsdk", "android.rockchip.update.service", "com.android.systemui", "com.hct.obdservice.OBDService", "com.unisound", "com.intel.thermal", "com.dpadnavi.assist", "cn.manstep.phonemirror", "com.android.bluetooth", "com.hiworld.", "net.easyconn", "android.cn.ecar.cds.process.CoreService", "com.google.android", "com.vayosoft.carsystem"};
private a(Context context) {
cr = context;
}
private int ex(Context context) {
int i = 0;
Iterable<e> arrayList = new ArrayList();
ActivityManager activityManager = (ActivityManager) context.getSystemService("activity");
for (RunningAppProcessInfo runningAppProcessInfo : activityManager.getRunningAppProcesses()) {
int i2 = runningAppProcessInfo.pid;
int i3 = runningAppProcessInfo.uid;
String str = runningAppProcessInfo.processName;
int i4 = activityManager.getProcessMemoryInfo(new int[]{i2})[0].dalvikPrivateDirty;
e eVar = new e();
eVar.fy(i2);
eVar.fz(i3);
eVar.ga(i4);
eVar.gb(str);
eVar.dk = runningAppProcessInfo.pkgList;
arrayList.add(eVar);
String[] strArr = runningAppProcessInfo.pkgList;
}
for (e eVar2 : arrayList) {
int i5;
if (eVar2.gc() < 10000) {
i5 = i;
} else {
String gd = eVar2.gd();
if (gd.indexOf(".") == -1) {
i5 = i;
} else if (fe(gd) || ff(context, gd) || fg(context, gd)) {
i5 = i;
} else if (cs != 0 || fd(gd)) {
try {
activityManager.killBackgroundProcesses(gd);
i5 = i + 1;
} catch (Exception e) {
System.out.println(" deny the permission");
i5 = i;
}
} else {
ez(gd);
i5 = i + 1;
}
}
i = i5;
}
return i;
}
private void ey(Context context) {
Iterable<RunningServiceInfo> runningServices = ((ActivityManager) context.getSystemService("activity")).getRunningServices(100);
System.out.println(runningServices.size());
Iterable<b> arrayList = new ArrayList();
for (RunningServiceInfo runningServiceInfo : runningServices) {
int i = runningServiceInfo.pid;
int i2 = runningServiceInfo.uid;
String str = runningServiceInfo.process;
long j = runningServiceInfo.activeSince;
int i3 = runningServiceInfo.clientCount;
ComponentName componentName = runningServiceInfo.service;
String shortClassName = componentName.getShortClassName();
String packageName = componentName.getPackageName();
PackageManager packageManager = context.getPackageManager();
try {
ApplicationInfo applicationInfo = packageManager.getApplicationInfo(packageName, 0);
b bVar = new b();
bVar.fh(applicationInfo.loadIcon(packageManager));
bVar.fi(applicationInfo.loadLabel(packageManager).toString());
bVar.fj(shortClassName);
bVar.fk(packageName);
Intent intent = new Intent();
intent.setComponent(componentName);
bVar.fl(intent);
bVar.fm(i);
bVar.fn(i2);
bVar.fo(str);
arrayList.add(bVar);
} catch (NameNotFoundException e) {
e.printStackTrace();
}
}
for (b bVar2 : arrayList) {
if (bVar2.fp() >= 10000) {
String fq = bVar2.fq();
if (!(fd(fq) || ff(context, fq) || fg(context, fq))) {
if (cs != 0 || fe(fq)) {
try {
context.stopService(bVar2.fr());
} catch (SecurityException e2) {
System.out.println(" deny the permission");
}
} else {
ez(fq);
}
}
}
}
}
private long fa(Context context) {
ActivityManager activityManager = (ActivityManager) context.getSystemService("activity");
MemoryInfo memoryInfo = new MemoryInfo();
activityManager.getMemoryInfo(memoryInfo);
return memoryInfo.availMem;
}
public static a fc(Context context) {
a aVar;
synchronized (cv) {
if (cw == null) {
cw = new a(context);
}
cs = -1;
aVar = cw;
}
return aVar;
}
private boolean fd(String str) {
for (String startsWith : cx) {
if (str.startsWith(startsWith)) {
return true;
}
}
return cp != null && str.equals(cp);
}
private boolean fe(String str) {
for (String startsWith : cu) {
if (str.startsWith(startsWith)) {
return true;
}
}
return cp != null && str.equals(cp);
}
private boolean ff(Context context, String str) {
if (context == null || TextUtils.isEmpty(str)) {
return false;
}
for (InputMethodInfo packageName : ((InputMethodManager) context.getSystemService("input_method")).getInputMethodList()) {
if (str.equalsIgnoreCase(packageName.getPackageName())) {
return true;
}
}
return false;
}
private boolean fg(Context context, String str) {
try {
for (ResolveInfo resolveInfo : context.getPackageManager().queryIntentServices(new Intent("android.service.wallpaper.WallpaperService"), 128)) {
if (str.equalsIgnoreCase(resolveInfo.serviceInfo.packageName)) {
return true;
}
}
} catch (Exception e) {
e.printStackTrace();
}
return false;
}
public void ew(int i, String str) {
cs = i;
cq = true;
cp = str;
long fa = fa(cr);
ey(cr);
int ex = ex(cr);
long fa2 = fa(cr);
if (i == 1) {
fa = Math.abs(fa2 - fa);
CharSequence string = cr.getString(R.string.clear_message, new Object[]{Integer.valueOf(ex), Formatter.formatFileSize(cr, fa)});
if (ct == null) {
ct = Toast.makeText(cr, string, 0);
} else {
ct.cancel();
ct = Toast.makeText(cr, string, 1);
}
ct.show();
}
cq = false;
}
public void ez(String str) {
if (str != null && str.length() != 0) {
try {
((ActivityManager) cr.getSystemService("activity")).forceStopPackage(str);
} catch (SecurityException e) {
System.out.println(" deny the permission");
}
}
}
public boolean fb() {
return cq;
}
}
it appears as though it is listing which apps either stay awake on sleep, or launch at boot. Can anybody confirm this?
And in this file, it looks like it might be controlling the apps in the apploop, maybe...
file is android/microntek/c.java
HTML:
package android.microntek;
import android.microntek.service.R;
public class c {
public static final String[] dg = new String[]{"com.microntek.avin", "com.microntek.dvr", "com.microntek.dvd", "com.microntek.tv", "com.microntek.media", "com.microntek.music", "com.microntek.radio", "com.microntek.ipod", "com.microntek.btMusic", "com.microntek.bluetooth", "com.microntek.civxusb", "com.microntek.tv", "com.microntek.dvr"};
public static final String[] dh = new String[]{"com.microntek.avin", "com.microntek.dvr", "com.microntek.dvd", "com.microntek.tv", "com.microntek.media", "com.microntek.music", "com.microntek.radio", "com.microntek.ipod", "com.microntek.btMusic", "com.microntek.dvr"};
public static final String[] di = new String[]{"com.microntek.radio", "com.microntek.dvd", "com.microntek.music", "com.microntek.media", "com.microntek.ipod", "com.microntek.avin"};
public static final int[] dj = new int[]{R.string.music_style0, R.string.music_style1, R.string.music_style2, R.string.music_style3, R.string.music_style4, R.string.music_style5, R.string.music_style6};
}
Let me know what you guys think.

You are absolutely correct. Check out the thread on the Malaysk ROM for the PX5. A member, Nico84, is working with the same files. You guys may want to join forces on this.
Johan

Thanks for that, does that work on the Stock firmware, or only on Malaysk's Custom ROM?

Not sure, but I believe it will work on stock. Needs to be rooted I suppose. Contact Nico84 for details, I am not an experienced Android developer.

I did, thanks for the lead on that, exactly what I was looking for. It looks like it should work on stock firmware so ill probably give it a try

So I took Nico84's MTCManager and tried to decompile and add spotify and accuweather to it, and recompile it. But then the actualy MTCManager did not work, so not sure what I did wrong.

semaj4712 said:
So I took Nico84's MTCManager and tried to decompile and add spotify and accuweather to it, and recompile it. But then the actualy MTCManager did not work, so not sure what I did wrong.
Click to expand...
Click to collapse
You have to compile it with original signature, not testkeys. You can use "tickle my android"

Bummer, tickle my android does not seem to work on mac which is all I have, is there any other way to compile with original signature with apktools? Or would it be possible to make me a version that allows spotify and accuweather to remain open, that would be great.

Ok so I found the documentation on signatures for the APKtool, but it still didnt work. Just to be clear I started this command
Code:
apktool d MTCManager.apk
then I made the changes to the smali.d file, and then recompiled with this command
Code:
apktool b MTCManager/ -c
Is there something I am doing wrong? (The location of files is not exact, bare in mind I am doing this on a mac via terminal so I simply drag and drop the file which returns the path it needs.)

On second try I was able to get this to work. The above commands worked perfectly, my guess is I messed something up the first time around.

For PX3:
when the unit comes back from sleep it sends Intent com.cayboy.action.ACC_ON
when it goes to sleep it sends com.cayboy.action.ACC_OFF