Related
Kali NetHunter for the Galaxy Note 3 (3.1.0)
Welcome to the thread on Kali NetHunter for the Samsung Galaxy Note 3.
If you don't know what Kali NetHunter is, well, it's the entire Kali Linux operating system in a chroot on your phone, plus a bunch of awesome apps for executing exploits, fixing things, doing cool things. It goes on, I suppose.
I'm gonna be honest guys, I'm not a security person. When it comes to security, I'm more of a Paul Blart.
What I do know though, is that there is apt-get, and apt-get is life.
Find much more information here: https://github.com/offensive-security/kali-nethunter/wiki
The answer to all your questions, generally the answer is YES, IT CAN DO THAT.
Most AOSP based ROMs should be supported!
The updater zip will add a few files to your /system partition, and install all of the NetHunter apps to your /data partition.
The chroot is located in /data/local, so you don't have to worry about your system partition being full. It's full read/write capable.
Understand that the zip will replace your current kernel with a completely different one.
This is necessary because most stock or custom kernels don't provide the drivers needed to operate most of Kali NetHunter's features.
DOWNLOAD
Current version: 3.15.3 (stable, 2016-12-17)
Please be careful to download the right version based on this table:
N9005: hlteeur
N900W8 & N900T: hltecan
N900P: hltespr
N900K, N900L, & N900S: hltekor
SC-01F: hltedcm
SCL22: hltekdi
CyanogenMod 12.1 & SlimRom 5.1: lollipop
CyanogenMod 13.0 & SlimRom 6.0: marshmallow
Nightly TWRP flashable zips are located at: https://build.nethunter.com/nightly/
BEFORE INSTALLING
Please make sure your phone boots fine and runs fine before flashing NetHunter. It's confusing when people report bugs that exist in CyanogenMod by itself.
The Kali chroot and apps are installed on your data partition (in /data/local for chroot). To initialize the chroot and install Kali Linux, you need to start the Kali NetHunter app.
The NetHunter installer will automatically install SuperSU in system mode, which I consider to be more stable. Since NetHunter already modifies your system partition, there is no need to use systemless SuperSU anyways.
FULL FRESH INSTALL STEPS
Optional: Flash CyanogenMod/SlimRom installer zip
Optional: Flash Gapps if you want them (preferably OpenGapps pico)
Boot into device
Complete setup wizard
Reboot into recovery
Flash kernel-nethunter-hlte* and nethunter-generic-armhf-kalifs-full-rolling zips in any order.
Boot into device
Open the NetHunter app
Use the Kali Chroot Manager to finish the installation
You're done!
UPDATING TO A NEWER BUILD
Going from 3.0.0 and up, all you have to do is flash the new build in recovery and wipe dalvik cache.
UPDATING YOUR ROM
To get all your NetHunter and SuperSU functions back after flashing a new ROM, just flash the ~60 MB update-nethunter-* zip again.
RUNNING WIFI PENETRATION TESTS
The internal WiFi chipset of the Galaxy Note 3 is not capable of running services which use monitor mode such as Wifite. For this, you will need to use a monitor mode capable WiFi adapter through a microUSB OTG adapter.
As for compatible adapters, I highly recommend the Alfa Networks AWUS036NEH (eBay) which uses the Ralink RT3070 chipset. There are currently no monitor mode supported Wireless-AC adapters available.
Once plugged in, you can run the command from Kali terminal to turn on your adapter:
[email protected]:~# ip link set wlan1 up
RAN INTO AN ISSUE OR BUG?
In order for me to help you, you have to at minimum reply with:
The link to the exact zip you downloaded
Your device model (hlte, hltecan, hltesovietrussia, etc.)
The name of the ROM you're flashing it on
The version and build date of the ROM you're flashing it on
A complete description of your problem
Optional: An audio recording of you reading this entire post
If your issue is with a specific app, it might be better to contact the developer of that app.
If your issue is during the installation (ex. flashing the NetHunter zip), then please collect a TWRP recovery.log for me.
If you found a problem and were able to fix it, and no one's mentioned it in the thread already, it would be kind to state the issue and your fix for others to make use of as well.
You can join me and the other NetHunter developers on IRC at the #nethunter room on freenode to more handily diagnose problems together.
I apologize, but I can't do house calls at this time.
You may be able to fix some bugs by updating to the latest bootloader and modem for your device.
See: (Direct Download) Latest Bootloaders & Modems
KNOWN ISSUES
USB Keyboard & VNC - Google Keyboard, AOSP Keyboard, CM Keyboard do not work due to a depth bug, use Hacker's Keyboard as a workaround.
Terminal App - Full screen programs like nano or vi are unusable unless you use the resize command. (always type resize when opening a new terminal window)
SCREENSHOTS
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
DEVELOPMENT
For the kernel included in NetHunter for the Samsung Galaxy Note 3, you can find the sources here: https://github.com/jcadduono/idleKernel-note3
See the Kali NetHunter installer source here: https://github.com/offensive-security/kali-nethunter
See the Kali NetHunter app source here: https://github.com/offensive-security/nethunter-app
It is powered by idleKernel, however none of the idleKernel scripts (ikconfig, usb control, kernel tweaks) are available by default. I recommend installing idleKernel zip (non-NetHunter) from the idleKernel thread and then flashing the NetHunter updater or kernel installer over idleKernel. You will then have all of idleKernel and Kali NetHunter's features at your disposal.
DISCLAIMER
I am not affiliated with Offensive Security. They seem like cool guys though.
I'm not even a novice when it comes to security and penetration. I'm just a simple system administrator with a passion for breaking Android.
Please restrain yourselves from asking me security related questions.
NOT SO MUCH AS SEEN ON MR. ROBOT, BUT PROBABLY EVEN BETTER
XDA:DevDB Information
Kali NetHunter for the Galaxy Note 3, Device Specific App for the Samsung Galaxy Note 3
Contributors
jcadduono, the Kali NetHunter team
Source Code: https://github.com/jcadduono/kali-nethunter
Version Information
Status: Stable
Current Stable Version: 3.15.3
Stable Release Date: 2016-12-17
Created 2016-01-07
Last Updated 2016-12-21
Reserved
first
great cant wait to try it out
What solution are you offering for Wifi devices, Are you going to compile kernel for compatable devices?
Or is this something the user is going to have to do.
I only mention this, as i have a Working version of Nethunter and have for over a year, But i refused to post release information due to the support required to get various wifi devices to work.
I did not want to get involved so the release never happened, Am happy compliling my own kernel for supported drivers, But i dont see your average joe doing this.
Also another snag i found was you can only have the one wifi device enabled at one time, so disabling the onboard to enable the external.
All issues by commands, but am just questioning if you have considered this or have support for this?
dave7802 said:
What solution are you offering for Wifi devices, Are you going to compile kernel for compatable devices?
Or is this something the user is going to have to do.
I only mention this, as i have a Working version of Nethunter and have for over a year, But i refused to post release information due to the support required to get various wifi devices to work.
I did not want to get involved so the release never happened, Am happy compliling my own kernel for supported drivers, But i dont see your average joe doing this.
Also another snag i found was you can only have the one wifi device enabled at one time, so disabling the onboard to enable the external.
All issues by commands, but am just questioning if you have considered this or have support for this?
Click to expand...
Click to collapse
I suppose multiple WiFi devices would be in the realm of Kali rather than the kernel. I can't imagine it being harder than using a powered USB hub to connect multiple radios and configure each of them using one of the network managers available in the Kali repository, while leaving your native Broadcom WiFi to Android to handle. All the popular / mac80211 injection capable WiFi drivers are compiled right into the kernel and enabled - not as modules. The Nethunter installer takes care of installing all the necessary firmware binaries to your system partition as well.
The compatible USB WiFi dongles should just be plug and play at this point.
I'm still waiting on my TP TL-WN822N to arrive from Amazon for testing.
Btw have you tried the Nethunter 3.0 app? It really is designed to make everything quick and easy, 1 step for whatever you're trying to do.
Considering swinging by the #nethunter room on freenode to ask questions and/or suggest ideas to make things easier.
I have not tried 3.0
Am still talking about 2.0 seems like they have added some additional support like network manager.
This was not present in my build so i just use a few bash scripts to enable and disable.
But ill give this version 3.0 a try thanks
dave7802 said:
I have not tried 3.0
Am still talking about 2.0 seems like they have added some additional support like network manager.
This was not present in my build so i just use a few bash scripts to enable and disable.
But ill give this version 3.0 a try thanks
Click to expand...
Click to collapse
Not a network manager in nethunter app, I mean install one in Kali chroot the same way you would on a Debian server.
Version 3.0.1 is now up and the changes are:
Tell SuperSU to install in system mode (not systemless)
Update SuperSU to version 2.66
Use SuperSU's supolicy binary to patch the sepolicy during install (fixes Marshmallow/CM13.0 unable to boot)
Inject init.superuser.rc into the ramdisk if it's not there already
SuperSU should no longer be broken with non-gzip compressed ramdisks
Find commits here: https://github.com/jcadduono/kali-nethunter/commits/master
Please note that it is still Kali Nethunter 3.0, and the .1 is just an update that improves flashing compatibility.
Y'know, I really thought you guys would be eating this stuff right up. <_<
please include flashing instructions - do we need to also flash gapps...which ones should we use. Thank you.
comptonhubbard said:
please include flashing instructions - do we need to also flash gapps...which ones should we use. Thank you.
Click to expand...
Click to collapse
It's not a ROM, it's an app, kernel, and environment. You have to flash it on an already set up CyanogenMod ROM from TWRP.
jcadduono said:
It's not a ROM, it's an app, kernel, and environment. You have to flash it on an already set up CyanogenMod ROM from TWRP.
Click to expand...
Click to collapse
After IdleKernel 6.6.5?
Gandicela said:
After IdleKernel 6.6.5?
Click to expand...
Click to collapse
Doesn't matter. If you flash idleKernel after, make sure it's the -kali version though. The only thing flashing idleKernel does is add ikconfig, /sbin/usb, and a few small kernel tweaks in the ramdisk.
jcadduono said:
Doesn't matter. If you flash idleKernel after, make sure it's the -kali version though. The only thing flashing idleKernel does is add ikconfig, /sbin/usb, and a few small kernel tweaks in the ramdisk.
Click to expand...
Click to collapse
I see. It's therefore like this: Running CM>>Kali Hunter>>Kali Hunter Kernel. Cheers, Mate!
I need to format SD-card?
amazing work.
tnx
Mx WaR HaBiB said:
I need to format SD-card?
amazing work.
tnx
Click to expand...
Click to collapse
No you dont have to format it
Sent from my SM-N9005 using Tapatalk
Gandicela said:
I see. It's therefore like this: Running CM>>Kali Hunter>>Kali Hunter Kernel. Cheers, Mate!
Click to expand...
Click to collapse
So, do we need to use version for CM 12.1 for OnePlus from here?
https://www.offensive-security.com/kali-linux-nethunter-download/
Ps
It works
First install kali kernel, after download Kali for oneplusone, reboot into recovery, install kali zip, and aftet again idle kali kernel.
I am on CM 12.1 nightly...
eseregin said:
So, do we need to use version for CM 12.1 for OnePlus from here?
https://www.offensive-security.com/kali-linux-nethunter-download/
Ps
It works
First install kali kernel, after download Kali for oneplusone, reboot into recovery, install kali zip, and aftet again idle kali kernel.
I am on CM 12.1 nightly...
Click to expand...
Click to collapse
Why are you doing this!!! You're bound to end up breaking something.
All you do is flash this after completing CM setup wizard and you're done. There's absolutely no reason to download any other Kali installer. This is the full version 3.0! Nethunter app now sets up your chroot for you.
Full steps:
Flash CyanogenMod installer zip
Flash Gapps (preferably opengapps pico)
Boot into device
Complete setup wizard
Reboot into recovery
Flash the Galaxy Note 3 Kali Nethunter installer zip from this thread
Boot into device
You're done!
If you absolutely need ikconfig or /sbin/usb, then you can install idleKernel-kali zip from the idleKernel thread later.
3.0.1_2016_01_10 build uploaded. Just a bug fix for Nethunter app.
Installation query
I have CM13 set up with superSU 2.46 and idleKernel 6.5.5 installed.
Do I have to install CM all over again? And follow your steps, or is there a way for me to keep my data and just flash it as is?
UnbracedTundra said:
I have CM13 set up with superSU 2.46 and idleKernel 6.5.5 installed.
Do I have to install CM all over again? And follow your steps, or is there a way for me to keep my data and just flash it as is?
Click to expand...
Click to collapse
Make a full backup in twrp first.
Wipe /system and dalvik and /cache. Install latest CM13 (or CM12.1 if thats what you meant) zip and gapps, then boot into system. Once boot is complete, reboot into recovery and flash nethunter then boot and you should be good to go without deleting your data.
jcadduono said:
Why are you doing this!!! You're bound to end up breaking something.
All you do is flash this after completing CM setup wizard and you're done. There's absolutely no reason to download any other Kali installer. This is the full version 3.0! Nethunter app now sets up your chroot for you.
Full steps:
Flash CyanogenMod installer zip
Flash Gapps (preferably opengapps pico)
Boot into device
Complete setup wizard
Reboot into recovery
Flash the Galaxy Note 3 Kali Nethunter installer zip from this thread
Boot into device
You're done!
If you absolutely need ikconfig or /sbin/usb, then you can install idleKernel-kali zip from the idleKernel thread later.
3.0.1_2016_01_10 build uploaded. Just a bug fix for Nethunter app.
Click to expand...
Click to collapse
Wow...
I am idiot!
Completely ignored the main link I needed -
https://idlekernel.com/nethunter/cm12.1
Now I understand that went dangerous way, lucky still with working phone
Tbh, most all utilities in Kali for now behind my knowlage of Linux so far
PS
I can see some scripts somehow survived even with full wipe, now my recovery provide some red lines doing job, something path missing in /data/...something/something
Though do the job.
I thought nothing can survive after full wipe...
Kali NET-HUNTER
This is the kali nethunter for the htc one m7 running on the latest android version (6.0 and 7.0 /NOUGAT/Marshmallow)
SCREENSHOTS
http://imgur.com/a/JEL0l
Steps To Install
1.-Download the latest cm 13,14 or LOS 13,14 and nethunter and the Gapps ( Just to obatin Google Playstore )
2.-Flash cm 13 or LOS 14 and Gapps/
3.-Now reboot and load cm 13,14 or LOS rom ( wait until the boot completes )
4.-Go back to recovery and install the nethunter zip
5.-Now reboot
5.-success !
Downloads
cm 13 = https://androidfilehost.com/?w=files&flid=23169
Net-Hunter = https://www.androidfilehost.com/?fid=24651430732236171
Net-Hunter for nougat =https://www.androidfilehost.com/?fid=745425885120725928
Update Big Thanks to @michael8t6 for making the kernel
androidhost are taking forever to approve my dev account so I've had to upload it to my G drive for now. This is the standard cm13 rom running on android 6.0, nothing has changed, I've just replaced the kernel with a patched one. You can download it here: https://drive.google.com/file/d/0B43...ew?usp=sharing
steps to install
Copy the zip and Gapps to your phone.
Reboot into recovery mode.
Wipe data, cache, dalvik.
Flash rom, then flash Gapps
If you're S-OFF then simply reboot and follow ZpanicZ instructions for installing net hunter.
If you're S-ON then reboot back into bootloader.
Extract boot.im from the zip onto your computer and into your fastboot directory.
Plug your phone into your computer and run the following command:
Code:
Code:
fastboot flash boot boot.img
Reboot and enjoy.
On the first reboot after flashing the rom, it can take up to ten mins for the phone to boot completely. Just be patient.
After you've finished installing nethunter, install the Xposed framework if you want to, not before, I fount this caused the phone to hang on the boot screen.
Once you've finished installing everything, run the nethunter app and grant it root permissions.
Close the app and re open the app, if you don't see any HID devices showing under the HID devices section. Open a new kali terminal and run the following command:
Code:
Code:
ls /dev/hidg*
You should see two HID devices come up, if you don't then post in this thread and I'll try to help you.
If you do see the devices, then nethunter isn't looking in root but the HID attacks should still work.
Lastly, if rubber ducky isn't working for you, then enable debugging mode via the developer options under settings and also connect your phone to your computer via MTP mode.
Known issues
▼BADUSB MITM isn't working, this isn't due to the kernel but is related to the nethunter install. I've been researching into this and need to look into the way it assigns the interfaces more.
▼I'm not sure if monitor mode is working for external wireless adapters. So basically, when building the kernel, I have to enable the relevant options to support the chipset drivers. The three main ones are obviously athros, ralink and realtek. When I was compiling, I hit an error regarding the realtek drivers, so for now I've not bothered enabling any support for wireless cards as compiling takes ages on my computer (she's a dinosaur). Once I'm not sick of staring at my monitor any more, I'm going to be looking into this feature as my first priority. That being said, if anyone does manage to enable monitor mode on a wireless adapter, please let me know in this thread, there's no point enabling athros drivers if they already work, it'll just make the kernel bulkier and slow down the phone overall.
▼You tell me.
Credits:
@9Lukas5 for allowing me to use his kernel source.
@ZpanicZ for creating the nethunter app and giving me the motivation to learn about compiling kernels. You may want to add all this to the OP buddy. Done
Click to expand...
Click to collapse
any screenshots?
nandhul30 said:
any screenshots?
Click to expand...
Click to collapse
i will upload some screenshots in a bit
Seem cool...... What features does it incl.?
-leo- said:
Seem cool...... What deatures does it incl.?
Click to expand...
Click to collapse
Here are some of the features from kali linux site https://www.kali.org/kali-linux-nethunter/
you can do a lot of things with nethunter because it includes all kali linux OS features .
What i found is the best of this rom is the vnc (virtual network computing), it's kali linux v 1.0 on a phone !
works zip on GPE?
Seems nice, how is the battery life in this?
nikola360 said:
works zip on GPE?
Click to expand...
Click to collapse
yes it should work in gpe as well
kala123 said:
Seems nice, how is the battery life in this?
Click to expand...
Click to collapse
Exactly the same as having cm 13, which is pretty standard
thx, it's fantastic!
Can i usw a cm 13 based Rom?
ZpanicZ said:
Kali NET-HUNTER
This is the kali nethunter for the htc one m7 running on the latest android version (6.0 Marshmallow)
SCREENSHOTS
http://imgur.com/a/JEL0l
Steps To Install
1.-Download the latest cm 13 and nethunter and the Gapps ( Just to obatin Google Playstore )
2.-Flash cm 13 and Gapps/
3.-Now reboot and load cm 13 rom ( wait until the boot completes )
4.-Go back to recovery and install the nethunter zip
5.-Now reboot
5.-success !
Downloads
cm 13 = https://androidfilehost.com/?w=files&flid=23169
Net-Hunter = https://www.androidfilehost.com/?fid=24651430732236171
Click to expand...
Click to collapse
Hi. Can use it in htc one m7 sprint ? Now I am using GSM in VietNam
Wlkchnbndgr said:
Can i usw a cm 13 based Rom?
Click to expand...
Click to collapse
Well it's 99% it will work without problems, ( but i do not recommend installing modified cm roms )
takaru said:
Hi. Can use it in htc one m7 sprint ? Now I am using GSM in VietNam
Click to expand...
Click to collapse
If the cm 13 rom supports sprint then yes it will work perfectly
Works on Aicp. :good: But i think i must flash it again, when i do update my rom once a week, right?
Wlkchnbndgr said:
Works on Aicp. :good: But i think i must flash it again, when i do update my rom once a week, right?
Click to expand...
Click to collapse
Most likely , yes
Whoa ... No way
ZpanicZ said:
Kali NET-HUNTER
This is the kali nethunter for the htc one m7 running on the latest android version (6.0 Marshmallow)
SCREENSHOTS
http://imgur.com/a/JEL0l
Steps To Install
1.-Download the latest cm 13 and nethunter and the Gapps ( Just to obatin Google Playstore )
2.-Flash cm 13 and Gapps/
3.-Now reboot and load cm 13 rom ( wait until the boot completes )
4.-Go back to recovery and install the nethunter zip
5.-Now reboot
5.-success !
Downloads
cm 13 = https://androidfilehost.com/?w=files&flid=23169
Net-Hunter = https://www.androidfilehost.com/?fid=24651430732236171
Click to expand...
Click to collapse
I never saw this coming!
Just lately I had decided to hop onto my old HTC One M7 phone to see what all I had left on it. ...
Then I figured, hey, perhaps there's something newer that I could flash onto it seeing as how is been well over a year since I'd used it at all.
WoW! ... and then I found this on here and my mind was blown!
I've been wanting to try Kali NET-HUNTER out for years now and this this is just awesome, thank you for sharing this with us.
?
starovdarkness said:
I never saw this coming!
Just lately I had decided to hop onto my old HTC One M7 phone to see what all I had left on it. ...
Then I figured, hey, perhaps there's something newer that I could flash onto it seeing as how is been well over a year since I'd used it at all.
WoW! ... and then I found this on here and my mind was blown!
I've been wanting to try Kali NET-HUNTER out for years now and this this is just awesome, thank you for sharing this with us.
��
Click to expand...
Click to collapse
Glad i wasn't the only one :b , i was kind of suprise there was no kali nethunter for this phone.
installation went smoothly..which is the preferred wireless card?
Sent from my MI NOTE LTE using Tapatalk
damn66 said:
installation went smoothly..which is the preferred wireless card?
Sent from my MI NOTE LTE using Tapatalk
Click to expand...
Click to collapse
well there are several cards that works perfectly, you may want to google that, also search for wireless cards that can do packet injection without problems.
So, last year I have installed the default nethunter rom for the oneplusone (CM12.0 + Kernel + Etc) but I got random reboot and all sort of bug.
The last bug I got change my mind and I decided to install the last LineageOS (14.0) Installed gapps and rooted the phone by following this tutorial Link. Next I have installed the nethunter chroot / apps following this tutorial Link.
But now the main function I use nethunter is hid attacks and deauth attacks. Unfortunaly they doesn't work, I'm nearly sure that the hid doesn't work because of not having correct kernel and the same for the wifi card(which doesn't even show up by running
Code:
iw list
in the chroot.
Is there a way to make all of this working ?
Hello everyone.
First of all, please take into account that English is not my native language, but I will do my best.
Yesterday, I wanted to install Lineage Os (v16.0-20200122) on my oneplus 7 pro. I had no problem accessing the bootloader, then TWRP (vt3.3.1-4). I then installed and configured Lineage Os on my phone, at that time the Wifi works properly.
Then comes the step of installing Magisk (v20.3 zip file) via twrp, the installation is done correctly, but from that moment, the wifi no longer works. When I activate it, it deactivates immediately.
Here's what I tried:
- Several versions of Lineage OS
- Several versions of TWRP
- Install TWRP before any operation
- To search the internet for similar cases, (I found this one on this forum) but I either did not understand, or it didn't work for me.
I'm a bit lost because I bought this phone for compatibility with Lineage Os and this problem completely blocks me
I am deleting this guide since M12 will soon recieve an unofficial build of LineageOS 19.1. Don't ask when, as I'm not the lead developer but I helped with it
Update 1: I figured out how to make script run on boot. Instructions revised. If you followed earlier check them again
Update 2: Magisk 24.1 is now stable. Instructions revised.
Update 3: I contacted phh and he implemented the script inside his trebleapp. Instructions revised and modified trebleapp is attached. NOTE: GSIs newer than 7/Feb/2022 will include this workaround by default.
Update 4: This guide is now unnecessary now that unofficial LineageOS is very close to release
Achievement unlocked: flashed GSI with FBE enabled!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
In short, I've successfully done flashing of @phhusson's latest version of Android 12 GSI (which is v402 as of today). To do this, I needed to modify the multidisabler script so it won't disable FBE, format the userdata using the stock recovery, flash TWRP, resize tmpfs to proper size, push GSI image into tmpfs and flash it using TWRP. I used the securized image with vndklite variant, since there was no securized images for regular vndk releases (but it seemed that vndk was working better for me, at least I have no USB connection anymore where with VNDK I was able to have USB debugging). Maybe I'll try re-flashing it once I'll patch the regular images and securize them (since I'm on *nix, I can just mount them and modify their contents) and take an approach of finding how Samsung ROMs are working OK. For now, I need to take a break from all bootloops I had in the process of FBE flashing .
Anyway, the goal of this experiment was to use GSI ROMs as a daily driver and having FBE disabled could otherwise cause a serious problem on device loss.
So, onto the list what's been tested (that wasn't noted before):
Screen locking – it seems that the workaround for the screen is not applied before unlocking the phone, probably because the app is not running yet. This might work with the script used as postfs module.
EDIT: I've found some notes in the Magisk documentation that both post-fs data and late_start services are run after data is decrypted, which basically means applying this workaround using Magisk seems to be pointless for now (maybe not after PPH app will stop providing the workaround)... Probably the best option would be patching the ROM itself, either with flashable ZIPs or directly before flashing it (most GSIs can be mounted under Linux and tweaked).
Adaptive brightness – not working, since all virtual sensors are not working for now. Might be easy to fix through as I've found some stuff in the official ROM that I had an idea to experiment with putting them into GSIs (as a Magisk module, to avoid a breakage).
USB – as I said, a data transfer via USB is not working for me for some reason. It worked for me once I had VNDK Android 12 GSI installed (same version).
Booting with stock kernel – I had some successful attempts doing that, but it further was a cause of a bootloop, at least once I had installed Magisk. Therefore, I'll recommend patching the Magisk the way as in tutorial (after patching the kernel) to have everything working for now.
For people who wants to play with stock images but don't know how: you can use simg2img, lpunpack and Linux to extract and mount the official ROM image in approach of finding there some tips like in initrc services why some stuff is working fine on Samsung while it doesn't on GSIs. Maybe I would tinker with it a bit, trying to export a few services and libraries in an approach to create a Magisk module with all stuff needed to have a fully functional GSI, but I'm tired of modding for now, especially when this is my first Samsung phone I had to deal with.
Edit: Typo fixes, added additional text formatting.
Amazing work. If you need testers feel free to PM me. As a sidenote, poking in sysfs led me to believe that android is sending the info needed to read the proximity but the kernel is sending garbage which gets interpreted as the sensor not being triggered. Also phh should have added the workaround into his trebleapp starting from phh AOSP 12 v401, so aside from installing magisk no post install workarounds should be needed.
Attached is a photo of what cmd_result reads when a whatsapp voice message is played which reads proximity to play the message in the earpiece and turn screen off when proximity is triggered
ap4ss3rby said:
Also phh should have added the workaround into his trebleapp starting from phh AOSP 12 v401, so aside from installing magisk no post install workarounds should be needed.
Click to expand...
Click to collapse
Unfortunately, the commit was reverted as of master branch, so we should prepare for it to stop to work unless phh will work on it before releasing an another version. Also I wrote that the workaround didn't seem to apply itself before unlocking the phone (FBE encrypted) the first time and therefore decrypting sensitive data after boot. For now this makes it an requirement when using PHH app to unlock the phone before it sleeps so the touch is going to be responsive.
Anyway, it seems that even Magisk (v24.1) is not capable of running the services before data is decrypted, so now I have no idea how to bypass that in other way than patching the ROM itself and creating the `initrc` service... Anyway, this is also a hint that what samsung is doing starts before basically everything, so no APK file nor script is going to really fix it since they are meant to start after data is decrypted...
SB3P said:
Unfortunately, the commit was reverted as of master repo, so we should prepare for it to stop to work unless phh will work on it before releasing an another version. Also I wrote that the workaround didn't seem to apply itself before unlocking the phone (FBE encrypted) the first time and therefore decrypting sensitive data after boot. For now this makes it an requirement when using PHH app to unlock the phone before it sleeps so the touch is going to be responsive.
Anyway, it seems that even Magisk (v24.1) is not capable of running the services before data is decrypted, so now I have no idea how to bypass that in other way than patching the ROM itself and creating the `initrc` service... Anyway, this is also a hint that what samsung is doing starts before basically everything, so no APK file nor script is going to really fix it since they are meant to start after data is decrypted...
Click to expand...
Click to collapse
I guess for now we have two options:
A: Build custom kernel/vendor specifically for GSIs that correctly reports sensors as GSIs expect them to
B: Fix GSI issues through Magisk services implementing various workarounds in scripts. (an example is the touchscreen sleep/wake issue)
ap4ss3rby said:
Attached is a photo of what cmd_result reads when a whatsapp voice message is played which reads proximity to play the message in the earpiece and turn screen off when proximity is triggered
Click to expand...
Click to collapse
Also that's interesting those virtual sensors are still present, I personally thought that Samsung made it the way there's an virtual device create as on Linux and there's their proprietary software running somewhere in the system that uses the camera as an input and calculates it to provide the data... On the other hand, when I think about that logic, even some (if not all) virtual devices on Linux (e.g. v4l2loopback) needs to have their module loaded with the kernel to work. I'm glad at least there's no need to reinvent the wheel and no one really needs to recreate the entire algorithm for it if it's going to be in the kernel sources...
ap4ss3rby said:
I guess for now we have two options (...)
Click to expand...
Click to collapse
I feel like the B option is worse than patching the GSI ROMs, either via flashable ZIPs or on your own... This is because I couldn't find anything in docs that would let me run services before /data is going to be decrypted... Personally, I've made myself a such service using the statically-compiled Linux ARM binary (non-NDK, using GNU libs – yes, it is still runnable on Android as well) – it applies the workaround for now both when screen is turned on and off (I had no idea on which event it should really run, so I made it to run on both just to be safe) by watching the file changes based on (AFAIK) filesystem events – so it has a major advantage over your script, as it won't run in endless loop, yet watch the file responsible for brightness to change and then do its job. But even with that, TSP doesn't seem to make touch available immediately and it is still expected to be revived after 1-2 seconds.
Also, as of the methods of applying these workarounds, the other way could be modifying the ramdisk (maybe with the help of Magisk, which I believe has documented how it's actually doing it itself and how others could modify the root and init as Magisk does to load files before the OS will properly initalize itself. Yet I don't like an idea of messing myself with the boot partition, at least for now...
Debug info: I tried flashing stock to grab logs from the touchscreen driver. The logs attached here do not appear at all on an unpatched GSI (I.E flashing the GSI as is without any touch workaround).
ap4ss3rby said:
Hi, I installed LineageOS 18.1 GSI on my M127F. I want to share my guide to installing this GSI.
Code:
DISCLAIMER:
By following this guide you accept that you
may do irreversible damage to your phone.
If something breaks the responsibility is
yours only. If you want stable software that
is guaranteed to work 100% don't follow
this guide.
I assume you are running a fully stock system and and locked bootloader and firmware U3/U4.
Installing TWRP and custom kernel
Enable Developer Options by tapping on software information > build number 7 times
Enter developer options then toggle OEM Unlocking on.
Power off your phone.
Hold Vol Up + Vol Down then plug in your phone to enter download mode
THIS WILL ERASE ALL YOUR DATA AND VOID YOUR WARRANTY. Follow on screen instructions to unlock your bootloader. THIS WILL ERASE ALL YOUR DATA AND VOID YOUR WARRANTY
After this you want to download and install attached Orangefox recovery using odin. After odin is done flashing enter recovery
Format data (not wipe) in recovery
Enter terminal and type multidisabler twice
Reboot to system and verify that under security encryption is disabled
Download TWRP and custom kernel for your phone
Reboot into recovery and locate the downloaded twrp image
Select recovery.
Reboot into recovery
Install kernel, then wipe cache and reboot. You should now see that it is complaining about some internal issue. This is normal.
Installing the GSI
Download your favorite ROM from the list provided below. You want to install an arm64 a/b image.
Extract the image file
Reboot to recovery.
Select install then install image
Locate the GSI image
Select install system
After that is done return to recovery and select factory reset.
Reboot then do setup (if applicable) then download attached magisk and phh trebleapp. If your phone is stuck on bootanimation check under to fix it.
IMPORTANT: DO NOT LET THE SCREEN TURN OFF OR YOU WILL HAVE TO REBOOT TO MAKE TOUCH WORK AGAIN.
Install attached magisk
Open magisk and click on install then direct install
Download and install the attached phh-treble app apk.
Touch should now work. Enjoy your GSI.
Extras
Magisk 24.1
Open Magisk
Go to settings
Update Magisk Manager app to version 24.1
Relaunch Magisk then install magisk
Choose direct instal
Migrating to patched trebleapp
Download and install attached trebleapp
Open your root file manager
go to /data/adb/service.d
Delete the script you added earlier
Tips in case things don't work
In case after rebooting to the GSI the phone bootloops:
Download stock image from wherever you download your firmware (I use a python program called samloader)
Extract the AP of the downloaded firmware
Find userdata.img.lz4 and create a .tar archive only containing this file
Reboot to download mode
In odin select AP then locate the newly created .tar archive Then click on flash
Reboot
Continue from step 7 under the "Installing the GSI" portion of the guide
To revive the touchscreen using ADB:
In case you didn't grant adb root access but installed magisk, run adb shell then su. A root access for the app shell will appear. Grant root permission
Plug in phone to a computer with ADB
adb shell
su
cat /sys/class/sec/tsp/cmd_result
echo check_connection > /sys/class/sec/tsp/cmd
What works:
Boots
RIL
Fingerprint
Main rear camera
Front camera
Sleep/Wake (workaround in steps above, may need to sleep wake several times before it works)
WiFi
Flashlight
Rotation
Magisk 24
90Hz (M12 only. A12 doesn't have 90Hz refresh rate)
LineageOS 18.1
LineageOS 19
CAOS (GApps variant available)
phh AOSP 11 v313
phh AOSP 12 v400h
Untested
GPS
Flashing GApps. (I use fdroid and aurora store on LineageOS and CAOS has built in GApps)
USB-OTG
A127F
M127G
If I didn't list it under broken or working I didn't try it or forgot to test it.
Broken
Double tap to wake. Touchscreen turns off and I have no idea how to keep it alive while lcd is off
MTP
Virtual Proximity. Screen will stay on in phone calls and WhatsApp will always play voice messages through speaker
Flashlight brightness. Flashlight will always stay on weakest brightness with no way to adjust.
Adaptive refresh. The framerate you set in phh addons is what you get. Be prepared for slightly reduced battery.
You tell me (even though I probably don't have the solution)
Bugs
You may need to wait a little bit before touchscreen responds or sleep/wake several times before screen responds after turning the screen off
Credits
@physwizz for kernel, TWRP and orangefox
@phhusson for implementing workaround in trebleapp as well as GSI list
me for touch workaround
Links
Kernels and recoveries: https://t.me/a127f_res/113
GSIs: https://github.com/phhusson/treble_experimentations/wiki/Generic-System-Image-(GSI)-list
Click to expand...
Click to collapse
Great guide.
Well done
Thanks for the great guide. Unfortunately, I don't know how to resize tmpfs. Can anybody tell me how to do that? I only have 4 GB or less on my Samsung Galaxy A12 with 64 GB of Storage (it should have, it only shows something like 3 or 4 gigabytes like I mentioned)
matahbeyz said:
Thanks for the great guide. Unfortunately, I don't know how to resize tmpfs. Can anybody tell me how to do that? I only have 4 GB or less on my Samsung Galaxy A12 with 64 GB of Storage (it should have, it only shows something like 3 or 4 gigabytes like I mentioned)
Click to expand...
Click to collapse
You don't have to resize TMPFS if you don't want to have FBE encryption or have the external SD card (you can use microSD for flashing, which might be a better choice if you need to flash a larger devices). Also you can't resize TMPFS to 64 GB, it uses your RAM to store regular data instead of storage (this is basically the concept of TMPFS). What I was mentioning is that /data won't work under FBE and custom recoveries for now, so you need to use your RAM instead if you don't have any external storage device to save images somewhere via ADB.
As of resizing the TMPFS, you should be able to find some Linux tutorial how to do that, on Android this is works basically the same (even on both Linux and Android you have /tmp directory with TMPFS by default).
Anyway, I've decided to share some stuff that you may need for that. Here's the multidisabler script I was using for flashing GSIs with FBE encryption preserved. I was also working on the native binary that would work as the workaround for the touchscreen so it can be used instead of the script. The advantages are that it actually listens to filesystem events and therefore does not need to read file in loop in order to get the information if brightness has changed. Maybe I'll share it with you once I find it to be ready, right now I'll just share my multidisabler script with patches.
BTW, I've tested LineageOS GSIs (both 11 and 12) and noticed they behave completely different, no matter of variant (the USB actually uses some driver, which is not fully compatible with M12 but close enough to provide basic communication through ADB). I guess pphusson just changed something and now these drivers aren't applied by default, yet I think I've noticed the issues with Bluetooth's HSP/HFP profiles which as I remember was not the case with latest stable pphusson's vanilla Android 12 GSIs. Now I just hope these problems are going to be resolved in the next builds of Android's GSIs with phhusson's patches and with the knowledge that MTP just worked fine on TWRP I used, there's a little hope that we will gain the proper combination of drivers/firmware to have both USB and Bluetooth functional at the same time someday.
I've also approached patching the kernel under newer kernel base 4.19.112, yet I gave up on properly resolving its conflicts. I may work on that as well in order to patch some vulnerabilities, with a hope that I'll succeed updating kernel as closest to the latest patch as possible. The 4.19.112 is going to be just a test if Samsung is capable of actually booting from it and if I may be able to use git with common human logic and my limited programming skills to actually patch it the way it would do so (without much understanding about the code itself, yet basic knowledge about C syntax). For now I've only succeed reproducing the upstream Linux kernel commit structure from 4.19.111, with a single additional commit for Samsung changes and another one for physwizz ones.
can anyone guide me how to unlock bootloader on Samsung Galaxy M12G ?
@SB3P Thanks so much. Sorry for my late reply, but thank you!
SB3P said:
Achievement unlocked: flashed GSI with FBE enabled! View attachment 5533799In short, I've successfully done flashing of @phhusson's latest version of Android 12 GSI (which is v402 as of today). To do this, I needed to modify the multidisabler script so it won't disable FBE, format the userdata using the stock recovery, flash TWRP, resize tmpfs to proper size, push GSI image into tmpfs and flash it using TWRP. I used the securized image with vndklite variant, since there was no securized images for regular vndk releases (but it seemed that vndk was working better for me, at least I have no USB connection anymore where with VNDK I was able to have USB debugging). Maybe I'll try re-flashing it once I'll patch the regular images and securize them (since I'm on *nix, I can just mount them and modify their contents) and take an approach of finding how Samsung ROMs are working OK. For now, I need to take a break from all bootloops I had in the process of FBE flashing .
Anyway, the goal of this experiment was to use GSI ROMs as a daily driver and having FBE disabled could otherwise cause a serious problem on device loss.
So, onto the list what's been tested (that wasn't noted before):
Screen locking – it seems that the workaround for the screen is not applied before unlocking the phone, probably because the app is not running yet. This might work with the script used as postfs module.
EDIT: I've found some notes in the Magisk documentation that both post-fs data and late_start services are run after data is decrypted, which basically means applying this workaround using Magisk seems to be pointless for now (maybe not after PPH app will stop providing the workaround)... Probably the best option would be patching the ROM itself, either with flashable ZIPs or directly before flashing it (most GSIs can be mounted under Linux and tweaked).
Adaptive brightness – not working, since all virtual sensors are not working for now. Might be easy to fix through as I've found some stuff in the official ROM that I had an idea to experiment with putting them into GSIs (as a Magisk module, to avoid a breakage).
USB – as I said, a data transfer via USB is not working for me for some reason. It worked for me once I had VNDK Android 12 GSI installed (same version).
Booting with stock kernel – I had some successful attempts doing that, but it further was a cause of a bootloop, at least once I had installed Magisk. Therefore, I'll recommend patching the Magisk the way as in tutorial (after patching the kernel) to have everything working for now.
For people who wants to play with stock images but don't know how: you can use simg2img, lpunpack and Linux to extract and mount the official ROM image in approach of finding there some tips like in initrc services why some stuff is working fine on Samsung while it doesn't on GSIs. Maybe I would tinker with it a bit, trying to export a few services and libraries in an approach to create a Magisk module with all stuff needed to have a fully functional GSI, but I'm tired of modding for now, especially when this is my first Samsung phone I had to deal with.
Edit: Typo fixes, added additional text formatting.
Click to expand...
Click to collapse
Could you explain how you done this.... i mean please explain step by step... i am using Galaxy M12G Varient....thanks in advance
milindbhaliwade said:
Could you explain how you done this.... i mean please explain step by step... i am using Galaxy M12G Varient....thanks in advance
Click to expand...
Click to collapse
If you would see the *untested* section at the initial post of this thread, it is unknown whetever this works or not for M127G phones (if it bootloops it might not work at all). Anyway, here's how I did it on M127F (at least how I remember this):
1. I did steps from 1-6, I believe I skipped 7 since I was aware it will mess something up with the data partition.
2. I modified the multidisabler script and pushed it to my phone via the ADB (to TMPFS). You can find this script pushed as xz compressed file. Before executing multidisabler script I have done a backup of the recovery and system partitions (using dd tool) which I am going to reflash later.
3. I rebooted to download mode and flashed TWRP image.
4. After TWRP ended flashing, I booted into the recovery. I flashed the physwizz kernel and then my own GSI image as it was described in the instructions at the initial post. Just remember that /data partition is not functional with FBE and TWRP so you need to push your images somewhere else like microSD card or TMPFS partition. OTG might work here as well, this is something I haven't tested yet through...
5. Once you are done with flashing you need to restore the original recovery partition via the download mode. TWRP won't boot the GSIs with FBE encryption enabled actually it does boot now for me, yet I still recommend switching to stock recovery if your phone bootloops or you need to format/wipe userdata partition. You can then safely format your /data partition with the stock recovery.
ap4ss3rby said:
Hi, I installed LineageOS 18.1 GSI on my M127F. I want to share my guide to installing this GSI.
Code:
DISCLAIMER:
By following this guide you accept that you
may do irreversible damage to your phone.
If something breaks the responsibility is
yours only. If you want stable software that
is guaranteed to work 100% don't follow
this guide.
I assume you are running a fully stock system and and locked bootloader and firmware U3/U4.
Installing TWRP and custom kernel
Enable Developer Options by tapping on software information > build number 7 times
Enter developer options then toggle OEM Unlocking on.
Power off your phone.
Hold Vol Up + Vol Down then plug in your phone to enter download mode
THIS WILL ERASE ALL YOUR DATA AND VOID YOUR WARRANTY. Follow on screen instructions to unlock your bootloader. THIS WILL ERASE ALL YOUR DATA AND VOID YOUR WARRANTY
After this you want to download and install attached Orangefox recovery using odin. After odin is done flashing enter recovery
Format data (not wipe) in recovery
Enter terminal and type multidisabler twice
Reboot to system and verify that under security encryption is disabled
Download TWRP and custom kernel for your phone
Reboot into recovery and locate the downloaded twrp image
Select recovery.
Reboot into recovery
Install kernel, then wipe cache and reboot. You should now see that it is complaining about some internal issue. This is normal.
Installing the GSI
Download your favorite ROM from the list provided below. You want to install an arm64 a/b image.
Extract the image file
Reboot to recovery.
Select install then install image
Locate the GSI image
Select install system
After that is done return to recovery and select factory reset.
Reboot then do setup (if applicable) then download attached magisk and phh trebleapp. If your phone is stuck on bootanimation check under to fix it.
IMPORTANT: DO NOT LET THE SCREEN TURN OFF OR YOU WILL HAVE TO REBOOT TO MAKE TOUCH WORK AGAIN.
Install attached magisk
Open magisk and click on install then direct install
Download and install the attached phh-treble app apk.
Touch should now work. Enjoy your GSI.
Extras
Magisk 24.1
Open Magisk
Go to settings
Update Magisk Manager app to version 24.1
Relaunch Magisk then install magisk
Choose direct instal
Migrating to patched trebleapp
Download and install attached trebleapp
Open your root file manager
go to /data/adb/service.d
Delete the script you added earlier
Tips in case things don't work
In case after rebooting to the GSI the phone bootloops:
Download stock image from wherever you download your firmware (I use a python program called samloader)
Extract the AP of the downloaded firmware
Find userdata.img.lz4 and create a .tar archive only containing this file
Reboot to download mode
In odin select AP then locate the newly created .tar archive Then click on flash
Reboot
Continue from step 7 under the "Installing the GSI" portion of the guide
To revive the touchscreen using ADB:
In case you didn't grant adb root access but installed magisk, run adb shell then su. A root access for the app shell will appear. Grant root permission
Plug in phone to a computer with ADB
adb shell
su
cat /sys/class/sec/tsp/cmd_result
echo check_connection > /sys/class/sec/tsp/cmd
What works:
Boots
RIL
Fingerprint
Main rear camera
Front camera
Sleep/Wake (workaround in steps above, may need to sleep wake several times before it works)
WiFi
Flashlight
Rotation
Magisk 24
90Hz (M12 only. A12 doesn't have 90Hz refresh rate)
LineageOS 18.1
LineageOS 19
CAOS (GApps variant available)
phh AOSP 11 v313
phh AOSP 12 v400h
Untested
GPS
Flashing GApps. (I use fdroid and aurora store on LineageOS and CAOS has built in GApps)
USB-OTG
A127F
M127G
If I didn't list it under broken or working I didn't try it or forgot to test it.
Broken
Double tap to wake. Touchscreen turns off and I have no idea how to keep it alive while lcd is off
MTP
Virtual Proximity. Screen will stay on in phone calls and WhatsApp will always play voice messages through speaker
Flashlight brightness. Flashlight will always stay on weakest brightness with no way to adjust.
Adaptive refresh. The framerate you set in phh addons is what you get. Be prepared for slightly reduced battery.
You tell me (even though I probably don't have the solution)
Bugs
You may need to wait a little bit before touchscreen responds or sleep/wake several times before screen responds after turning the screen off
Credits
@physwizz for kernel, TWRP and orangefox
@phhusson for implementing workaround in trebleapp as well as GSI list
me for touch workaround
Links
Kernels and recoveries: https://t.me/a127f_res/113
GSIs: https://github.com/phhusson/treble_experimentations/wiki/Generic-System-Image-(GSI)-list
Click to expand...
Click to collapse
try to install @phhusson (system-squeak-arm64-ab-vndklite-gapps-secure.img) GSI using above method on Samsung Galaxy M12G (SM-M127G) BUT failed to boot up
facing following issue:
1) unable to boot in OrangeFox Recovery
2) boot in TWRP Recovery but not detected MicroSD Card
3) samehow manage to push Kernal.zip, SystemGSI.img by adb push file_name_with_extension /sdcard BUT not flash properly as TWRP reboot again and again in 2-3 minutes
so friends, don't try this method on Samsung Galaxy M12G (SM-M127G) unless Senior member come up with this specific model
For anyone who has starred this thread, I and other devs have released a proper build of LineageOS with /vendor. Aside from VoLTE (which I don't think worked in GSIs anyways) everything should work. Moderators, please close this thread
ap4ss3rby said:
For anyone who has starred this thread, I and other devs have released a proper build of LineageOS with /vendor. Aside from VoLTE (which I don't think worked in GSIs anyways) everything should work. Moderators, please close this thread
Click to expand...
Click to collapse
LineageOS is not only GSI available, I think someone might still find it useful if they want to flash another ROMs. Also Phhuson's GSI also contains some features that unofficial GSI release don't have (i.e. flashlight control in Phhusson's app), so they still might be useful for someone.
This is why I think it is better to not close this thread and maybe revive original guide.
SB3P said:
LineageOS is not only GSI available, I think someone might still find it useful if they want to flash another ROMs. Also Phhuson's GSI also contains some features that unofficial GSI release don't have (i.e. flashlight control in Phhusson's app), so they still might be useful for someone.
This is why I think it is better to not close this thread and maybe revive original guide.
Click to expand...
Click to collapse
Our rom is built completely from source, not a GSI, and it is more or less a complete replacement of stock firmware. If you want you can use a GSI over that instead, and it should function much better than just replacing stock firmware
ap4ss3rby said:
Our rom is built completely from source, not a GSI, and it is more or less a complete replacement of stock firmware. If you want you can use a GSI over that instead, and it should function much better than just replacing stock firmware
Click to expand...
Click to collapse
I haven't said GSI are better, I personally use this unofficial LineageOS build. But what I've said, GSI brings much more variety of picking the OS you can install. Even Linux can be installed on phones nowadays using GSI with only Halium-patched kernel as an requirement. This is why I think leaving this tutorial archived (no updates, interest on fixing bugs etc.) is better than removing it.