[Completed] AT&T Galaxy Alpha g850A US Variant Possible Root Exploit Found - XDA Assist

Hi Mods,
I do not have permissions to post in the development forum so I ask that you move this thread accordingly.
I have been researching the AT&T Galaxy Alpha sm-g850a variant in order to gain root access and, as you might know, have found absolutely nothing out there. All other international variants have been rooted Except the A model...which is what I am stuck with. I found a recently released CVE that states it is not patched until Lollipop 5.0 and allows a malicious intent request to take over SYSTEM permissions. I have been able to get the intent code into an app without bricking the phone and am having some NOOB java issues as I'm not a professional programmer. Any interest in helping finish this exploit would be greatly appreciated. A few code snippets below:
import android.accounts.NetworkErrorException;
import android.app.PendingIntent;
import android.accounts.AbstractAccountAuthenticator;
import android.accounts.Account;
import android.accounts.AccountAuthenticatorResponse;
import android.accounts.AccountManager;
<intent-filter>
<action android:name="android.accounts.AccountAuthenticator" />
android.content.Intent intent = new Intent();
intent.setComponent(new ComponentName("com.android.settings","com.android.settings.accounts.AddAccountSettings"));
AccountManager.get(this).addAccount(
accountType,
null, /* authTokenType */
null, /* requiredFeatures */
addAccountOptions,
null,
mCallback,
null /* handler */);
mAddAccountCalled = true;
PendingIntent test = (PendingIntent) options.getParcelable("pendingIntent");
Intent newIntent2 = new Intent("android.intent.action.REBOOT"); <---testing---> somewhere in here I need to drop the SU binary and all of that good stuff.
try {
test.send(mContext, 0, newIntent2, null, null);
} catch (PendingIntent.CanceledException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
There is more code obviously. Posting some main parts to see if anyone is interested in helping.
w/respect-PitPin

Can't forget the credit for discovering this vulnerability:
Credits: Wang,Tao(Scloud) - seclist.org

Here is my NOOB showing. Wouldn't this mean I am on the right track and my app took "system root" privileges?
7386-7386/com.pitpindesigns.modpit.pitpin E/dalvikvm﹕ >>>>> com.pitpindesigns.modpit.pitpin [ userId:0 | appId:10248 ]
Nope...1000 would be root.

Sir,
Here isn't the right place for this type of threads so please open a new one here:
xda-developers -> Android Development and Hacking -> Android General
Good luck

Related

How to load native library in Android

Can someone give advice in how to load native library and make native function calls in android application? I tried with android 1.0 and my result is below:
Result:
1. I added the following code to android application Lunarlander.java
//native method declaration
native void hello(String name);
static {
System.out.println("libhello.so loaded");
System.load("/data/app/libhello.so");
}
I added my libhellp.so to lunalander.apk and then uploaded the apk to /data/app. The application launches ok.
2. I added the following code to android application Lunarlander.java
//native method declaration
native void hello(String name);
static {
System.out.println("libhello.so loaded");
System.load("/data/app/libhello.so");
}
…
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
…
//test loading hello lib and call hello function
LunarLander myLunarLander = new LunarLander();
myLunarLander.hello("Hi there!");
…
}
I added my libhellp.so to lunalander.apk and then uploaded the apk to /data/app. The application launches was forced to close and the error message is “The application Lunar lander has stopped unexpectedly. Please try again”.
Not sure why it failed to invoke the native function.
Thanks,
SynPad
Please post Questions in the Q&A section. Dev and Hacking Section is for contributers (new programs themes ect)
I'll go ahead and have the thread moved to Q&A for you this time
Thanks for your cooperation,
Joel
Q&A Section Team
EDIT: you may also want to try the g1 section, pm me if you would like it moved there instead.
Check the samples w/ NDK
BTW, do you know how to ship the lib along the apk :
there is a "native library location:" entry on project settings in eclipse plugin
Later

[DEV]Battery fix

I'll work with battery driver. I found the device with Qualcomm PM7540 chip, which is responsible for the supply of units, indicators and other. This device is XPERIA x1.
We need the kernel source code xperia x1.
Who can get sources - put in this thread!
http://tingstenen.dk/data/
source:
http://forum.xda-developers.com/showthread.php?t=978309
good luck
thanks, and i was found git repositoty with kernel x1
when i'll complete work with kernel, i'll post new source for compilation , because i have some problems with this
ps: for other developers , i think we need to work with ./drivers/power
source : http://gitorious.org/linux-on-qualcomm-s-msm/linux-msm/archive-tarball/htc-msm-2.6.27-camera
-upd creating archive with new kernel for photon
-upd i 'll edit photon source http://www.megaupload.com/?d=TKUP9KAU compile and test this
Ok thanks, what branch you use as a source what is version? Please dont use old kernel source if is old, please use latest for msm. I think gratia 2.6.32 is best kernel source in this time for photon and need some bug fix
Here is some info http://gitorious.org/~ast/linux-on-...android-2.6.35/drivers/power/ds2746_battery.c (i dont see ds2746_battery.c in gratia kernel !!)
Another link
I have question for smem dump, how to dump smem? dd if=???
good news is here hehe http://forum.xda-developers.com/showpost.php?p=12244375&postcount=251
cardsharing said:
good news is here hehe http://forum.xda-developers.com/showpost.php?p=12244375&postcount=251
Click to expand...
Click to collapse
thanks,but where is the resource?I want a try.
Thankssssssssssssssssss.
so great!
谢谢你们。
my english is poor.
Great job !!
But everyone that feels an urge to try it asap must be warned to be patient I guess ... Power management and battery options (especially charge control) can be nasty, even the batteries can be broken so be patient and wait until the code is double checked.
cardsharing, i think problem in i2c/chips and drivers/gpio
cardsharing said:
good news is here hehe http://forum.xda-developers.com/showpost.php?p=12244375&postcount=251
Click to expand...
Click to collapse
Thank you, i used your test.rar at http://ul.to/hlssdg this rom
like this
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
removing old bcm4329 module and old zImage....
error: device not found
error: device not found
putting new modules and zImage to phone...
error: device not found
error: device not found
error: device not found
error: device not found
...If you dont see errors, you are done!!!
Press enter to quit)
and wifi is not ok
add WIFI link at deskop AND TURN ON wifi, wait some minutes,,,Power off the phone ,,and power on phone, wifi is opend, but IP isn't auto add
smart_mac said:
add WIFI link at deskop AND TURN ON wifi, wait some minutes,,,Power off the phone ,,and power on phone, wifi is opend, but IP isn't auto add
Click to expand...
Click to collapse
Ehhh.. 1st this is not a wifi thread. Ask in the right place.
and 2nd: that is a common froyo problem!
codiak said:
Ehhh.. 1st this is not a wifi thread. Ask in the right place.
and 2nd: that is a common froyo problem!
Click to expand...
Click to collapse
thanks , just find cardsharing, anywhere ,,hehe , he isnt up the battery fix ,so i want know where is update in test.rar becausee wifi is not ok,like SHCALL's 2.2 ROM
He did not released his "battry fix" so far. It needs testing.
[ 478.194549] [D:BATT][ds2746_i2c_read_u8] fail.
[ 478.194643] msm_i2c msm_i2c.0: error, status 83c8 (26)
[ 478.194739] msm_i2c msm_i2c.0: Error during data xfer (-5) (26)
[ 478.194781] [D:BATT][ds2746_i2c_read_u8] fail.
Click to expand...
Click to collapse
problem in ds2764, hmm
problem with reading param -> ds_2746_param.c
htc blackstone have too pm7540 chip, i'll found kernel source and import this file to our kernel
[ 478.195396] [D:BATT][ds2746_i2c_read_u8] fail.
int ds2746_i2c_read_u8(u8 *value, u8 reg)
{
int ret;
struct i2c_msg *msg;
struct i2c_msg xfer_msg[2];
/* [MSG1] fill the register address data */
msg = &xfer_msg[0];
msg->addr = ds2746_i2c->addr;
msg->len = 1;
msg->flags = 0; /* Read the register value */
msg->buf = ®
/* [MSG2] fill the data rx buffer */
msg = &xfer_msg[1];
msg->addr = ds2746_i2c->addr;
msg->len = 1;
msg->flags = I2C_M_RD; /* Read the register value */
msg->buf = value;
ret = i2c_transfer(ds2746_i2c->adapter, xfer_msg, 2);
if (ret <= 0){
printk(DRIVER_ZONE "[%s] fail.\n", __func__);
}
Click to expand...
Click to collapse
derefas said:
[ 478.195396] [D:BATT][ds2746_i2c_read_u8] fail.
Click to expand...
Click to collapse
hey derefas, I want to help, but which kernel are you using?
how can I retrieve source code?
I already invited derefas to the googlecode project, but he did not reply.
To all devs: please upload your sources to the googlecode page, so everyone can work with them!
Thank you very much has been developing, we know that developers tired, but we hope you can stick with it. Many people are concerned about our system, for our adnroid of mini, come on!

[Completed] [Q] how to Provide intent for cards

How to give intent for accessing card activity,its not taking usual class.
Below is code snippet im providing. can anyone provide me solution
public void onClick(View v) {
if(txtUsername.getText().toString().equals("test") &&
txtPassword.getText().toString().equals("1234")){
Toast.makeText(getApplicationContext(), "Credentials Accepted",
Toast.LENGTH_SHORT).show();
Intent i = new Intent(Login_activity.this, HelloCardActivity.class); //hellocardactivity is another card activity. and login_activity is login page
startActivity(i);
Login_activity.this.finish();
}
else{
Toast.makeText(getApplicationContext(), "Wrong Credentials",
Toast.LENGTH_SHORT).show();
}
}
pls provide a solution
thank you
abhishek1234567 said:
How to give intent for accessing card activity,its not taking usual class.
Below is code snippet im providing. can anyone provide me solution
public void onClick(View v) {
if(txtUsername.getText().toString().equals("test") &&
txtPassword.getText().toString().equals("1234")){
Toast.makeText(getApplicationContext(), "Credentials Accepted",
Toast.LENGTH_SHORT).show();
Intent i = new Intent(Login_activity.this, HelloCardActivity.class); //hellocardactivity is another card activity. and login_activity is login page
startActivity(i);
Login_activity.this.finish();
}
else{
Toast.makeText(getApplicationContext(), "Wrong Credentials",
Toast.LENGTH_SHORT).show();
}
}
pls provide a solution
thank you
Click to expand...
Click to collapse
Please ask in the Chef Central > Android forum.
Just keep in mind that you have to provide more information (abot what card, on which device for what purpose, etc.) to get a more detailed help
Thread closed and thank you.

[App][Root][6.0+] Kernel Profiler

Please Note: Due to personnel reasons, I'm not updating this thread anymore. For those who wish to stay updated with the development of this project are requested to reach us on GitHub or Telegram. Thank you very much for the understanding.
​/* Introduction */
Kernel Profiler is a free and open-sourced profile based kernel management utility, which helps kernel developers to provide predefined profiles to their users.
/* DISCLAIMER */
Code:
Please use this app at your own risk.
I am not responsible for any damage to your device.
Everything you are doing on your device is at your own risk.
/* Requirements */
ROOT ACCESS
Support from Kernel Developer (if your favorite kernel developer is not willing to support this app, please do not bother to install).
/* Features */
Switch between profiles (no limit) provided by the kernel developer in one click (for users).
Apply default profile, pre-defined by the developer or assigned by the user, on boot.
Completely (almost) customize the interface of app in accordance with the kernel (for developers).
Easily create profiles and necessary configuration file within the app (for developers).
/* Downloads */
/* How to add support in kernel */
Kernel Profiler expects a configuration file (kernelprofiler.json) and one or more profiles (basically shell scripts) in certain specific structure placed inside "/data/kernel_profiler".
/* Structure of kernelprofiler.json */
"kernelprofiler.json" necessarily contains a title string as well as a number of optional strings to properly identify a specific kernel. An example "kernelprofiler.json" can be found here.
"title": "Title of your kernel". The "title" should be a string from your kernel's "uname -a". It will be later matched on your user's devices, and also be displayed as app's main title. Please note that it is the only way of app to distinguish a supported kernel and should be done carefully.
"description": "A short description (in one line) about your kernel". Please note that the "description" string will be also displayed in app along with the main title.
"default": "The exact name of the default profile including ".sh" extension".
"developer": "The identity (name, pet name or anything similar) of the developer". Please note that the "developer" string will be displayed in app along with a © symbol (bottom part of app).
"support": "A link to the discussion page or a support group of your kernel". Please note that the "support" string will be linked to the app's settings menu.
"donations": "A link to send donations to the developer". Please note that the "donations" string will also be linked to the app's settings menu.
/* Structure of profiles */
Kernel Profiler considers any properly formatted shell script as a profile. Optionally, the developer may add a line starting with "# Description=" somewhere in the profile so that the app will recognize and display it as the profile description. An example profile can be found here.
/* How to integrate into an Anykernel zip */
Adding the following lines into anykernel.sh after placing all the support files, such as a properly formatted kernelprofiler.json and one or more profile scripts, into ramdisk/kernel_profiler, allow you to inject Kernel Profiler support upon kernel installation.
Code:
if [ -e $ramdisk/kernel_profiler ]; then
# Inject Kernel Profiler support
if [ -e /data/kernel_profiler ]; then
# Remove old files
rm -rf /data/kernel_profiler/*
mv $ramdisk/kernel_profiler/* /data/kernel_profiler/
else
mv ramdisk/kernel_profiler/ /data/
fi
fi
The following commit shall be used for further reference
AnyKernel: Introduce Kernel Profiler support
/* Translations */
Please help me to translate this app. The original english string of this app is available at
https://github.com/SmartPack/KernelProfiler/blob/master/app/src/main/res/values/strings.xml
/* Support */
/* Feature Requests */
I am generally open to feature requests as long as you provide enough information. Please make sure to provide all the relevant information, either in this thread or in the GitHub page. If you are a developer, please consider contributing to this app by sending pull requests.
/* Note to other developers */
You are allowed to include this app on any of your works. Giving proper credits to the original developers (including me, if you considered me as one among them) are, however, highly appreciated. Feel free to contact me, if you need any assistance from my side.
/* Donations */
If you like to appreciate my work, please consider donating to me (by either via PayPal, Ko-fi, or by purchasing the donation app from playstore) as it is helpful to continue my projects more active, although it is not at all necessary.
XDA:DevDB Information
Kernel Profiler, App for all devices (see above for details)
Contributors
sunilpaulmathew
Source Code: https://github.com/SmartPack/KernelProfiler
Version Information
Status: Beta
Created 2020-06-10
Last Updated 2020-08-14
Change-logs
Latest version
Old versions
v0.5
- Improved developer tools.
- Preparations for play-store release.
beta-v0.4
- Improved developer tools.
- Remove custom banner option.
- Updated build tools to latest.
- Updated change-log view.
- Miscellaneous changes.
beta-v0.3
- Removed a bunch of unnecessary code from the developer tools (improved coding quality).
- Added Portuguese (Brazilian) translations.
- Added a title check button on create config activity.
- Added option to edit the current configuration file.
- Introduced a Developer Mode, which is disabled by default.
- Miscellaneous changes.
beta-v0.2
- Improved kernel support check status before applying custom details.
- Simplified profile structure requirements.
- Fixed title on profile creation menu.
- Overall improvements.
beta-v0.1
- Initial (pre) release for public testing.
Reserved

Profile Owner..

Hello together
since more than 4 Days i stuck on my current app project with the message: "admin componentinfo does not own the profile".
I tried many things - Added an Work Profile programmaticaly - Gave Profile Owner via adb and i dont find the result.
Someone have an Idea, what im doing wrong?
Code to add managed profile:
Java:
private void provisionManagedProfile()
{
Activity activity = this;
if (null == activity) {
return;
}
Intent intent = new Intent(DevicePolicyManager.ACTION_PROVISION_MANAGED_PROFILE);
if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
intent.putExtra(
DevicePolicyManager.EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME,
activity.getApplicationContext().getPackageName()
);
} else {
final ComponentName component = new ComponentName(activity,
DeviceAdmin.class.getName());
intent.putExtra(
DevicePolicyManager.EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME,
component
);
}
if (intent.resolveActivity(activity.getPackageManager()) != null) {
startActivityForResult(intent, 1);
Toast.makeText(activity, "Already used!",
Toast.LENGTH_SHORT).show();
activity.finish();
} else {
Toast.makeText(activity, "Device provisioning is not enabled. Stopping.",
Toast.LENGTH_SHORT).show();
}
}
Code to use:
Java:
DevicePolicyManager dpm = (DevicePolicyManager) getApplicationContext().getSystemService(Context.DEVICE_POLICY_SERVICE);
dpm.setProfileEnabled(compName);
compName is:
Java:
compName = new ComponentName(this, DeviceAdmin.class);
#Edit
If i start the manged Profile, its crashed after the end before the "next" button showing.
But if i take an look on my settings its showing that this profile was created.
Greetings
tpoeschl said:
Hello together
since more than 4 Days i stuck on my current app project with the message: "admin componentinfo does not own the profile".
I tried many things - Added an Work Profile programmaticaly - Gave Profile Owner via adb and i dont find the result.
Someone have an Idea, what im doing wrong?
Code to add managed profile:
Java:
private void provisionManagedProfile()
{
Activity activity = this;
if (null == activity) {
return;
}
Intent intent = new Intent(DevicePolicyManager.ACTION_PROVISION_MANAGED_PROFILE);
if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
intent.putExtra(
DevicePolicyManager.EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME,
activity.getApplicationContext().getPackageName()
);
} else {
final ComponentName component = new ComponentName(activity,
DeviceAdmin.class.getName());
intent.putExtra(
DevicePolicyManager.EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME,
component
);
}
if (intent.resolveActivity(activity.getPackageManager()) != null) {
startActivityForResult(intent, 1);
Toast.makeText(activity, "Already used!",
Toast.LENGTH_SHORT).show();
activity.finish();
} else {
Toast.makeText(activity, "Device provisioning is not enabled. Stopping.",
Toast.LENGTH_SHORT).show();
}
}
Code to use:
Java:
DevicePolicyManager dpm = (DevicePolicyManager) getApplicationContext().getSystemService(Context.DEVICE_POLICY_SERVICE);
dpm.setProfileEnabled(compName);
compName is:
Java:
compName = new ComponentName(this, DeviceAdmin.class);
#Edit
If i start the manged Profile, its crashed after the end before the "next" button showing.
But if i take an look on my settings its showing that this profile was created.
Greetings
Click to expand...
Click to collapse
Technical discussion of Android development and hacking. No noobs, please. Device-specific releases should go under the appropriate device forum.
Note: Questions go in Q&A Forum
If you are posting a Question Thread post it in the Q&A forum. Technical discussion of Android development and hacking. No noobs, please. Device-specific releases should go under the appropriate device forum...
forum.xda-developers.com

Categories

Resources