Database Info

HardSPL CDMA Whitelist Code

Guys,
A buddy of mine modified Fenny's code from IMEI Whitelist GSM Hardspl to work with CDMA. I just need someone to compile code and test.
Code:
Random random = new Random();
string imei = textBox1.Text;
string mid = (random.Next().ToString("X8") + random.Next().ToString("X8")).ToLower();
string hid = random.Next().ToString("X8").ToLower();
System.Text.UTF8Encoding encoding = new System.Text.UTF8Encoding();
System.Security.Cryptography.SHA256 hasher = System.Security.Cryptography.SHA256.Create();
string hex = BitConverter.ToString(hasher.ComputeHash(encoding.GetBytes(((mid + hid + imei + "6BRSDB*(LNsa;JN5)"))))).Replace("-", "").ToLower(); ;
string request = ("mid=" + mid + "&hid=" + hid + "&imei=" + imei + "&auth=" + hex + "&v=" + 110);
System.Net.ServicePointManager.Expect100Continue = false;
System.Net.HttpWebRequest webRequest = (System.Net.HttpWebRequest)System.Net.HttpWebRequest.Create("http://www.htc-unlocks.com/rhodiumw.php");
webRequest.Headers.Clear();
webRequest.KeepAlive = true;
webRequest.Method = "POST";
webRequest.ContentType = "application/x-www-form-urlencoded";
webRequest.UserAgent = "WinHTTP Example/1.0";
System.IO.Stream webResponse = webRequest.GetRequestStream();
System.IO.StreamWriter webResponseSender = new System.IO.StreamWriter(webResponse);
webResponseSender.Write(request);
webResponseSender.Close();
System.Net.HttpWebResponse didI = (System.Net.HttpWebResponse)webRequest.GetResponse();
System.IO.BinaryReader binaryReader = new System.IO.BinaryReader(didI.GetResponseStream());
byte[] buffered = binaryReader.ReadBytes(512);
if (encoding.GetString(buffered) == "reject")
label2.Text = "Failed";
else
{
System.IO.File.WriteAllBytes(imei+".txt", buffered);
label2.Text = "Success";
}

OK, I have the code compiled.
run the exe file.
enter your IMEI number (do not include last 01)
you shoud get success and it will create a <IMEI_NUMBER>.txt file
rename <IMEI_NUMBER>.txt to chk.txt and copy to windows folders on your phone
now run hardSPL and enjoy.
note if you get a failed message you either enter the last 01, or enter incorrect IMEI or your phone is already blacklisted and it's to late.
My phone is blacklisted so I can not fully test. please post results.
I also want to thank Fenny for his hard work with his GSM version of the whitelister.
With out his code my buddy would have never been able to rewrite to work for CDMA TP2

hopefully you don't mind, i posted this @ geeks....test should come back soon, i linked this thread .

mr8820 said:
hopefully you don't mind, i posted this @ geeks....test should come back soon, i linked this thread .
Click to expand...
Click to collapse
no not at all post in all related sites are fine.

[dev] real MAC wifi reading

Hi devs, I have idea for MAC reading. First, I know real MAC is located in SPL (I know this becouse I'm tried), I'm tried to read MAC from kernel side but problem is reading SPL becouse board-photon.h have defined:
Code:
#define MSM_MEM1_BASE 0x00000000
#define MSM_LINUX_BASE_OFFSET 0x00200000
#define MSM_PHOTON_LINUX1_BASE (MSM_MEM1_BASE + MSM_LINUX_BASE_OFFSET) /* 2MB alignment */
#define MSM_PHOTON_LINUX1_SIZE (MSM_MEM1_SIZE - MSM_LINUX_BASE_OFFSET)
SPL have size of 0x80000 and we skipped it. My idea is:
- patch haret to copy some SPL addreses (addrese where is wifi nvs ram) to another memory location
- read these location from kernel side
or
- edit kernel code to read this location or edit kernel to copy SPL to an memory location
What you think? Maybe you have idea how to read SPL?

i think there is solutions easier than SPL to get MAC addr

real mac == winMo?

i have an idea, but not tested yet:
simply remove "macaddr=00:11:22:33:44:55\n" from htc_wifi_nvs.c
recompile
it should work now
(my guess is the driver already read the good address, but we overwrite it with bad value)

No, I'm tried without static nvs! Only sense I think is reading these nvs from memory, but if we want to read this we must have access to first 0x80000 bytes (SPL), or maybe adding kernel code (command line parameter), or maybe DEX call (I dont know if is possible)
See picture, you will see where is nvs in spl, also you will see we have defined static_nvs diferent than nvs in spl!

you're totaly right.
and htc_wifi_nvs.c for liberty is extracting the NVS from bootloader.
i think the address we have is wrong:
This is the address for Liberty:
#define ATAG_MSM_WIFI 0x57494649 /* MSM WiFi */
Click to expand...
Click to collapse
For our bootloader, it must be different. i'll investigate.

Is the MAC in startup.txt used by Android?
If that is the case, may it is more easy to write a WinMo app that adjusts the startup.txt with the MAC know by WinMo.
Or is that to easy?

-r0bin- said:
you're totaly right.
and htc_wifi_nvs.c for liberty is extracting the NVS from bootloader.
Click to expand...
Click to collapse
I think is not from bootloader becouse liberty bootloader start at 0x0 and is size < 1M, but ok, good thing is - you understand me, and I thk you for it!
We need to read:
- start at 0x65720
- read 0x239 bute

munjeni said:
I think is not from bootloader becouse liberty bootloader start at 0x0 and is size of 1M, but ok, good thing is - you understand me, and I thk you for it!
We need to read:
- start at 0x65720
- read 0x239 bute
Click to expand...
Click to collapse
thanks, but what address do you dump? (0x65720 is only the offset)
how do you create this memory dump?

I showed you how I do it, but you're not ...attention to my post. I'll tell you, unlike you who is hiding information
see this link how I dump memmory.
Code:
976 // cardsharing smem dump
977 /*int i;
978 int x[1000];
979 printk("Battery hex smem dump: ");
980 for (i=0; i<1000; i++)
981 {
982 x[i] = readl(MSM_SHARED_RAM_BASE + 0xfc000 + i) & 0x000000ff;
983 printk("%02x", x[i]);
984 }
985 printk("\n");*/
Problem is: we not have access to spl!

Maybe from this way:
msm_nand_read: 65720 239
Code:
msm_nand_read(struct mtd_info *mtd, loff_t from, size_t len,
size_t *retlen, u_char *buf)
{
int ret;
struct mtd_oob_ops ops;
/* printk("msm_nand_read %llx %x\n", from, len); */
ops.mode = MTD_OOB_PLACE;
ops.len = len;
ops.retlen = 0;
ops.ooblen = 0;
ops.datbuf = buf;
ops.oobbuf = NULL;
ret = msm_nand_read_oob(mtd, from, &ops);
*retlen = ops.retlen;
return ret;
}
return wifi_nvs;
What you think?

munjeni said:
but if we want to read this we must have access to first 0x80000 bytes (SPL)
Click to expand...
Click to collapse
first 0x80000 bytes of what? memory?
munjeni said:
See picture, you will see where is nvs in spl, also you will see we have defined static_nvs diferent than nvs in spl!
Click to expand...
Click to collapse
how did you generated this picture?
i mean, what address did you used?

yes, of memory
haret: pwf spl.dump 0x0 0x80000
Program used to read spl.dump is: X&D hex editor
Program used to screen capture is: FastStone Capture
From kernel side I'm tried to dump android memory (spl from 0x0 len 0x80000), but without success, I think is not possible in this time, we need modifications to do that!

oook i got it!
physical address = 0x65720
thats sounds easy!
and you cannot dump memory like this under Linux, it uses virtual address!!!

ok, good if is easy! Please report here if you got it and how you got it, I need that knownledge for my future development, ok?

munjeni said:
ok, good if is easy! Please report here if you got it and how you got it, I need that knownledge for my future development, ok?
Click to expand...
Click to collapse
under android, when i use this func: "phys_to_virt(0x65720)" it gives me this virtual address: 0xbfe65720
unfortunately system crash when i try to access it.
there must be another way...

maybe is empty virtual (or we not have permisions to read) becouse we skipped first 0x100000 (board_photon.h) from psychical, hmm I not understand why crashed? I'm also tried and also with crashing. If I'm right MSM_SHARED_RAM_BASE is psychical and other defined in board_photon.h is also psychical?

found by schlund:
https://gitorious.org/linux-on-winc...ter/arch/arm/mach-msm/board-htcleo-wifi-nvs.c
on HTC Leo, they read SMEM and can retrieve MAC addr, it is encrypted by CRC32

good! But maybe we also need to change hardcoded_nvs bassed on picture. Are you got mac from smem after crc decode? I've not tried to read

actually it's not the real MAC addr, its a random one
regarding the real NVS data from hardware:
- either the bootloader memory has a special protection
- either we are using the wrong RAM virtual address
- either we dont have the good access method

broodROM RC5 UsbSettings force close

Hi to everyone,
I would like to reply to this post about a force close entering the UsbSettings in broodRom RC5 rev 1 & 2(prerelease).
Specifically the exception is this: java.lang.RuntimeException: Unable to start activity ComponentInfo{com.android.settings/com.android.settings.UsbSettings}: java.lang.NumberFormatException: unable to parse '' as integer
Unfortunately I'm not able to post there since I've just registered my accout; I hope this is the best section to post and that someone will notice it anyway.
After a couple of hours of serious digging I found that the problem depends on the fact that build prop lacks:
Code:
persist.service.usb.setting=0
which sets the default mode (kies) for usb.
that value is requested by com.android.settings.UsbSettings.onCreate of Settings.apk
Code:
protected void onCreate(Bundle paramBundle)
{
super.onCreate(paramBundle);
int i = Integer.parseInt(SystemProperties.get("persist.service.usb.setting"));
this.mUSB_mode = i;
---cut---
restoring the above line in build prop fixes the issue!

yota73 said:
Hi to everyone,
I would like to reply to this post about a force close entering the UsbSettings in broodRom RC5 rev 1 & 2(prerelease).
Specifically the exception is this: java.lang.RuntimeException: Unable to start activity ComponentInfo{com.android.settings/com.android.settings.UsbSettings}: java.lang.NumberFormatException: unable to parse '' as integer
Unfortunately I'm not able to post there since I've just registered my accout; I hope this is the best section to post and that someone will notice it anyway.
After a couple of hours of serious digging I found that the problem depends on the fact that build prop lacks:
Code:
persist.service.usb.setting=0
which sets the default mode (kies) for usb.
that value is requested by com.android.settings.UsbSettings.onCreate of Settings.apk
Code:
protected void onCreate(Bundle paramBundle)
{
super.onCreate(paramBundle);
int i = Integer.parseInt(SystemProperties.get("persist.service.usb.setting"));
this.mUSB_mode = i;
---cut---
restoring the above line in build prop fixes the issue!
Click to expand...
Click to collapse
Thanks! , I saw it before but didn't knew if this was the right fix^^

thanks for the solution..im sorry but im newbie but where to locate that in the script manager?im still learning about this android..thanks

The file is /system/build.prop, you need to be root to edit it and to mount /system read write.
Both things are enabled by default in broodrom, and any detail can be easily found by searching the forum.
Please note that this has nothing to do with scriptmanager and is best achieved though ADB.
If you have not the android SDK installed, maybe it would be better if you just wait Rev 2, which hopefully will integrate the fix

Colors fixes
Hi brood,
still posting here until I (if ever) reach 10 posts.
I've managed to fix color-issue (at least for most colors) in your rom by editing the twframework-res.apk.
It seems that samsung apps are using it instead of framework-res.apk.
The quickest way to improve the situation is modify .xmls that are using tw_color002 to use tw_color001 instead.
As you can see in /res/values/colors.xml tw_color002 is black while tw_color001 is white.
Obviously there is not one unique solution, but is more a matter of choosing the right palette to fit with the dark theme, either by changing color reference in each xml or by changing them all at once in /res/values/colors.xml
I hope this can help!

[Q] There is error with batteryStats.computeBatteryRealtime on Androi

There is error when we obtain time with batteryStats.computeBatteryRealtime on Android platform.
In our code, we want to get the time with the method batteryStats.computeBatteryRealtime , shown as following:
import android.os.BatteryStats;
void update() {
int statsType = BatteryStats.STATS_SINCE_CHARGED;
...
long realTime = SystemClock.elapsedRealtime();
long uSecTime = batteryStats.computeBatteryRealtime(realTime * 1000, statsType);
...
}
the update method will be invoked every 20 seconds, but, the uSecTime never changed while realTime changing, Why, who can help me ?
thank you very much!
our platform:
--------------------------------------------------------------------
1) Android 2.3
2) Juno Service Release 2
3) Windows 8 64 bit

batteryStats.getBatteryRealtime(realTime) has the same problem
the method batteryStats.getBatteryRealtime(realTime) has the same problem, why?

Bricked Huawei Y300-0100 / only dload and pinkscreen

Hi Guys
I think my Huawei Y300-0100 is bricked, but perhaps anybody of you can help me, cause hope dies last. So, what have I done?
I unlocked bootloader, rooted my phone and installed TWRP and cyanogenmod. All right. Now I want encrease the RAM with Swapper 2. But after installing and starting Swapper 2 I got a bluescreen
Now I have only bluescreen, pinkscreen or update-mode via dload. But I can´t update with dload, cause the update stop at second step. I tried 6 different sd-cards but no one works. I tried whole Stock ROM I could download in the internet. I tried the update with and without battery.
The sd_update.log says:
filename = /mmc1/dload/update.app
call RCV_MODULE_END_EVENT failed,module = CRC
CMD=0xf,moduleaddr = 0xe8000000, len_tmp=0x216
filename = /mmc1/dload/update.app
call RCV_MODULE_END_EVENT failed,module = CRC
CMD=0xf,moduleaddr = 0xe8000000, len_tmp=0x216
filename = /mmc1/dload/update.app
filename = /mmc1/dload/update.app
call RCV_MODULE_END_EVENT failed,module = CRC
CMD=0xf,moduleaddr = 0xe8000000, len_tmp=0x216
I can´t see the phone in ADB, but when I start the phone with pinkscreen, the driver will be installed in Windows devicemanager.
Can anybody say me, what the sd_update.log means?!? Is it possible to format internal memory via dload? I think the internal memory is the problem.
Sorry for my bad english and thank you for your help.
Best regards