Related
Hello all,
I am creating a universal flash to enable web/mms for android devices on alternate carriers (i.e. Cricket/Metro PCS). The issue i am having is that some of the MMS settings require the users telephone number to send properly (for authentication i believe)
My current flash file is here:
http://forum.xda-developers.com/showthread.php?t=730289
You can view the code to see what im doing so far, but this uses a generic MMSC rather than one specific to the user as it should be for cricket. I don't know if there is any reason to have it authenticate with the correct user information for cricket or metropcs but im trying to make it as authentic as possible.
I am working to try to get this done in a script ran from recovery that sets this information dynamically for each phone without any user interaction other than flashing the file.
Is it possible to obtain the MDN or the Telephone number via a script or is this something i would need to build an apk to obtain?
i found this snippet:
Code:
TelephonyManager tManager = (TelephonyManager)myActivity.getSystemService(Context.TELEPHONY_SERVICE);
String uid = tManager.getDeviceId();
but this appears to be something that would go in while building an apk. My goal is to have a simple flash that can be done, but if needed i can start work on my first apk to accomplish the goal.
Any suggestions or feedback are welcome, Thanks in advance.
Hello!
This is a development thread for those who is ready to contribute to the creation of a custom ROM for NEC Terrain.
The prior steps, which are bootloader unlock, rooting and even repartitioning have found their solutions and can be found in:
http://forum.xda-developers.com/showthread.php?t=2515602 for the discussion
https://github.com/x29a/nec_terrain_root for an apk which opens for you an ability to have the system area of the phone writeable
https://github.com/alex-kas/nec_terrain for the last ideas on how recovery and boot images should look like and the repartitioning
So, all questions regarding all the above should be asked in that thread as they are off-topic here.
For more general questions regarding the present rom, programs to disable, features and current bugs/oddities, please, see
http://forum.xda-developers.com/general/help/q-nec-terrain-discussion-t3162070
Thanks for understanding the thread aim and welcome to development!
Found this CWM recovery creator online. Apparently you can just upload the recovery img that comes with a phone and it will generate/build a recovery based on that. Worth a try?
EDIT: Here's the link. Apparently it is necessary for some phones to upload additional files to get the recovery to work properly. I'll look into it when I start to build this thing
https://builder.clockworkmod.com/
Sent from my LG-D415 using XDA Forums
alright......so ADW launcher is very very unstable with this ROM. Basically spontaneous reboot every 30min or so.
I need 5 panels, and the stock launcher can add them, but it always make the second panel default, which is very annoying.
So which launcher do you guys prefer?
Have I found?
Unfortunately this builder does not spit output ...
I got a strong impression the Terrain is reduced CasioCommando with qwerty. @MrMEEE, I suggest to investigate this direction. The later phone is reported to have both: custom roms and custom kernel. xda has developments on this.
This guess is NOT because NEC is Casio, this is because I found that both phones use for some unknown device the so called ktrc_driver.ko kernel module and the only device apart from Terrain which I could spot by google is CasioCommando. Then, of course, accounting that NEC is Casio I make this conclusion.
Also the boot of Terrain contains commands and even kernel modules references that do not exist. I have a gut feeling that devs were in rush and just were porting some system from another phone.
EDIT: I found a binary custom recovery for commando and so far it is the ONLY recovery which comes to some graphical image! I learned that graphics is device-dependent and presence of some colored points suggests that the graphics driver is correct. One just need to adjust the resolution ... This supports my theory that commando may be the prototype for the kernel.
Will try also to look into all of that.
alex-kas said:
Unfortunately this builder does not spit output ...
I got a strong impression the Terrain is reduced CasioCommando with qwerty. @MrMEEE, I suggest to investigate this direction. The later phone is reported to have both: custom roms and custom kernel. xda has developments on this.
This guess is NOT because NEC is Casio, this is because I found that both phones use for some unknown device the so called ktrc_driver.ko kernel module and the only device apart from Terrain which I could spot by google is CasioCommando. Then, of course, accounting that NEC is Casio I make this conclusion.
Also the boot of Terrain contains commands and even kernel modules references that do not exist. I have a gut feeling that devs were in rush and just were porting some system from another phone.
EDIT: I found a binary custom recovery for commando and so far it is the ONLY recovery which comes to some graphical image! I learned that graphics is device-dependent and presence of some colored points suggests that the graphics driver is correct. One just need to adjust the resolution ... This supports my theory that commando may be the prototype for the kernel.
Will try also to look into all of that.
Click to expand...
Click to collapse
Probably explains why we have an HDMI selector in the build.prop, huh...
But wow, that's an astounding discovery! Never would have guessed NEC = Casio. I believe there are 2 Casio Commandos, I assume you are referencing the newer one?
Sent from my LG-D415 using XDA
alex-kas said:
Unfortunately this builder does not spit output ...
I got a strong impression the Terrain is reduced CasioCommando with qwerty. @MrMEEE, I suggest to investigate this direction. The later phone is reported to have both: custom roms and custom kernel. xda has developments on this.
This guess is NOT because NEC is Casio, this is because I found that both phones use for some unknown device the so called ktrc_driver.ko kernel module and the only device apart from Terrain which I could spot by google is CasioCommando. Then, of course, accounting that NEC is Casio I make this conclusion.
Also the boot of Terrain contains commands and even kernel modules references that do not exist. I have a gut feeling that devs were in rush and just were porting some system from another phone.
EDIT: I found a binary custom recovery for commando and so far it is the ONLY recovery which comes to some graphical image! I learned that graphics is device-dependent and presence of some colored points suggests that the graphics driver is correct. One just need to adjust the resolution ... This supports my theory that commando may be the prototype for the kernel.
Will try also to look into all of that.
Click to expand...
Click to collapse
If you are correct, then the kernel source is available here:
http://www.casiogzone.com/us/download/index.html
I'll look into it..
GPL or not GPL?
Citation from http://wiki.cyanogenmod.org/w/Doc:_porting_intro:
"The manufacturer or vender of any device using Android will minimally need to make the source code available for all GPL components upon request, including (and especially) the kernel. You definitely want to request a copy of the kernel source and keep it handy."
Can anyone clarify the tedious question in the subject? I mean, does running android implies gpl on kernel? Can anyone (NEC, ATT, Qualcom) hide the source and what the conditions should be then? Can they have proprietary blobs in the kernel?
Weird
alex-kas said:
Citation from http://wiki.cyanogenmod.org/w/Doc:_porting_intro:
"The manufacturer or vender of any device using Android will minimally need to make the source code available for all GPL components upon request, including (and especially) the kernel. You definitely want to request a copy of the kernel source and keep it handy."
Can anyone clarify the tedious question in the subject? I mean, does running android implies gpl on kernel? Can anyone (NEC, ATT, Qualcom) hide the source and what the conditions should be then? Can they have proprietary blobs in the kernel?
Weird
Click to expand...
Click to collapse
Android runs on a standard Linux kernel which is GPL covered. Android is really just a Java VM inside of a Linux kernel I believe. So yes, Android kernel IS Linux kernel so therefore it would be GPL covered (thanks for the explanation @Nardholio )
They understand GPL. Anything based on the Linux Kernel must have the source released, so AFAIK there is no "proprietary" in a Linux Kernel... however that is just my understanding and if I am wrong someone please correct me. If they put "proprietary" code in the kernel and try to use that as an excuse to not release it, I say "Too bad, that's not an excuse, since you understood GPL when you built the kernel but are refusing to follow it. Guess what, now you have to release the kernel AND your "proprietary" software! LOL!!!"
Sent from my LG-D415 using XDA
I posted this in the wrong thread. Long story short I found someone interested in helping enforce the GPL for the Terrain but I don't own one. I need someone who owns a Terrain (preferably directly bought from AT&T or NEC) and who has already requested kernel source and either received no response or a refusal (I used the feedback form on NEC's website and got a polite refusal a few days later but I don't own one)
Nardholio said:
I posted this in the wrong thread. Long story short I found someone interested in helping enforce the GPL for the Terrain but I don't own one. I need someone who owns a Terrain (preferably directly bought from AT&T or NEC) and who has already requested kernel source and either received no response or a refusal (I used the feedback form on NEC's website and got a polite refusal a few days later but I don't own one)
Click to expand...
Click to collapse
I own a Terrain, and have gotten a refusal from NEC support...
What do you have in mind???
---------- Post added at 12:21 PM ---------- Previous post was at 12:19 PM ----------
Dear Mr. Martin Juhl,
Thank you for contacting NEC.
This is in regards to your email about the kernel of the NEC Terrain phone. You may check the kernel version and build number of the device on the phone itself. We do not have the source code of the device nor release them.
Please feel free to email us at [email protected] or call our toll free Customer Service number (1-800-637-5917) if you have any additional questions.
Your reference number for this inquiry is: 150727-000011
Thank you again for taking the time to write.
Sincerely,
NEC Customer Support
MrMEEE said:
I own a Terrain, and have gotten a refusal from NEC support...
What do you have in mind???
---------- Post added at 12:21 PM ---------- Previous post was at 12:19 PM ----------
Dear Mr. Martin Juhl,
Thank you for contacting NEC.
This is in regards to your email about the kernel of the NEC Terrain phone. You may check the kernel version and build number of the device on the phone itself. We do not have the source code of the device nor release them.
Please feel free to email us at [email protected] or call our toll free Customer Service number (1-800-637-5917) if you have any additional questions.
Your reference number for this inquiry is: 150727-000011
Thank you again for taking the time to write.
Sincerely,
NEC Customer Support
Click to expand...
Click to collapse
Sweet. PM me your email address and I will hand off my communication with the SF Conservancy to you. Just saying you can go to kernel.org and download the Linux kernel is NOT a sufficient response. They need to provide full source to boot the device (including board files, device drivers, any in kernel firmware, and build scripts)
YOU WILL NOT BELIEVE!
http://nec-mobilecom.co.jp/gpl/w/list/NEC_TERRAIN.html
I pressed NEC to deliver it. Have no time to check right away the integrity. Also, I have some problem downloading from CAF (I'm in a place where git is blocked). Maybe will ask someone to help (re-download to an http store).
alex-kas said:
YOU WILL NOT BELIEVE!
http://nec-mobilecom.co.jp/gpl/w/list/NEC_TERRAIN.html
I pressed NEC to deliver it. Have no time to check right away the integrity. Also, I have some problem downloading from CAF (I'm in a place where git is blocked). Maybe will ask someone to help (re-download to an http store).
Click to expand...
Click to collapse
Well sh*t... Never thought this would happen in a bazillion years.
Yet if you read their terms and conditions, it states you aren't allowed to reversed engineer their software to a "human readable form". Is this nullified by GPL, or can we be in trouble for using their kernel source for a ROM?
EDIT: Just downloaded myself a copy of the kernel.
Sent from my SAMSUNG-SGH-I747 using XDA Free mobile app
I do not care. I asked, nec gave the source publicly. no reverse engineering. Now we all gpl. My point.
Sent on the go
I don't think they would care as long as you are not reselling it...... you aren't, right?
Sent from my SGH-I547C using XDA Free mobile app
Darn, I was gonna set up a booth in front of my house and be one of those loud, obnoxious salesmen
hey mister.... I'mer gonna take two them kernel if ye can cut me a deal....
jasonmerc said:
Darn, I was gonna set up a booth in front of my house and be one of those loud, obnoxious salesmen
"GEEEETTT'CHA KERNEL SOURCE HEEEEEEAAA! TERRAIN KERNEL SOURCE, ONLY FIIIIIVE DOLLAHS! MAKE YOURSELF A ROM! CUSTOM RECOVERY! FIIIIIIVE DOLLAHS!"
Click to expand...
Click to collapse
First experiments
Results for the moment are like this:
1. The kernel does compile with the modified files with no compilation issues at all.
2. The kernel is smaller then the stock one.
3. The recovery.img produced by full caf build does boot but halts at the android image with the red triangle. Or perhaps does not halt but I did not come with a key combination to proceed.
PROS: graphics works
4. The kernel being stuffed into original boot image does boot, shows boot animation WITHOUT boot sound and then not surprisingly goes to a bootloop flashing the home screen
CONS: seems that sound is not here yet
5. The bootloop was broken using
adb reboot recovery
which means that adb does function
6. I did not try to flash the whole image to check whether bootloops are due to somewhat above the kernel (aka this kernel doesn't work with the stock soft).
Overall, we have a messy kernel source which however at least boots to init, communicates with adb and has graphics.
I'm free for a team project: who is in?
Technically, to make this particular caf manifest I had to install a virtual ubuntu 10.04 x64. My native machine failed to compile. I have gcc 4.9. Even the downgrade to 4.4.7 did not do the job. And for some reason I failed to compile gcc 4.4.3 for my machine. ubuntu 10.04 has gcc 4.4.3. But there you need to install some stuff and update the present there python (it is just 6.5 there but still some update exists still inside 6.5 and it fixes somewhat causing a peculiar error during the build). Also, be aware: you cannot compile on a virtualbox share: mmap does not work for security reasons. You must arrange ALL inside the virtual machine. After the build it is about 53GiB. So, the vm-drive should be at least 60 giga.
alex-kas said:
Results for the moment are like this:
1. The kernel does compile with the modified files with no compilation issues at all.
2. The kernel is smaller then the stock one.
3. The recovery.img produced by full caf build does boot but halts at the android image with the red triangle. Or perhaps does not halt but I did not come with a key combination to proceed.
PROS: graphics works
4. The kernel being stuffed into original boot image does boot, shows boot animation WITHOUT boot sound and then not surprisingly goes to a bootloop flashing the home screen
CONS: seems that sound is not here yet
5. The bootloop was broken using
adb reboot recovery
which means that adb does function
6. I did not try to flash the whole image to check whether bootloops are due to somewhat above the kernel (aka this kernel doesn't work with the stock soft).
Overall, we have a messy kernel source which however at least boots to init, communicates with adb and has graphics.
I'm free for a team project: who is in?
Technically, to make this particular caf manifest I had to install a virtual ubuntu 10.04 x64. My native machine failed to compile. I have gcc 4.9. Even the downgrade to 4.4.7 did not do the job. And for some reason I failed to compile gcc 4.4.3 for my machine. ubuntu 10.04 has gcc 4.4.3. But there you need to install some stuff and update the present there python (it is just 6.5 there but still some update exists still inside 6.5 and it fixes somewhat causing a peculiar error during the build). Also, be aware: you cannot compile on a virtualbox share: mmap does not work for security reasons. You must arrange ALL inside the virtual machine. After the build it is about 53GiB. So, the vm-drive should be at least 60 giga.
Click to expand...
Click to collapse
I haven't code in years, but I want to help out. I am ok with scripting and also able to load stuff to my terrain for testing. Let me know.
Progress Inquiry
Happy New Year!
Just wondering if any progress has been made for this particular device. I understand we all have lives and things get in the way, or interests wither away, its just an inquiry. I'd love to see an update to this device, even up to kitkat if that was possible. Any suggestions on how to recruit developers whom may be interested in the challenge of custom rom development for this device?
We currently need to override navigation_bar_height value from the framework-res.apk package. Based on Android documentation, this can be done by placing an apk in the system/vendor/overlay folder that will only contain the values that we wish to override. Once the system restarts, it will read the new values and use them to load the operating system.
We have found a sample project that we have followed, but haven’t been able to make it work. Please see the link below, it also has instructions on the page, and a lot of information can be found on the web for this override method.
Sample project: //github.com/ReinhardStrauch/framework-res-overlay-sample
Requirements:
• Android 5.0 (Lollipop) or higher - Rooted.
Deliverable:
• The sample project working in both Lollipop and Marshmallow
I am willing to pay a bounty of $1500 to make this sample project work, and another $500 if you have a simpler method. FYI, just changing the value is not acceptable. Although you will need a rooted device to be able to test, the final version we will be preloading on a non rooted device.
PM me if you want to take a shot at it.
EDIT: We already have this project completed.
Introduction
Hello, everyone. For a long time have I been lurking around XDA, and plenty of knowledge have I gathered. I feel that it's now my turn to thank the community for all this, and I've chosen to do so by publishing a project that I kept for personal use: Nemris, my Python 3.5+ APK extractor.
License
Nemris is licensed under the WTFPL license, so you're free to do WTF you want to it and its source. Don't even bother asking.
Disclaimer
By using this piece of software, you agree that I, the original author, am not to be considered liable of any damage to your data, phone or dog. Using it is your choice; I'm not forcing you to do so.
Requirements
Nemris is to be ran on a rooted phone. It does need Python 3.5 or greater to run, and has been tested on CM12.1 (Lollipop), CM13 (Marshmallow) and AICP12.1 (Nougat). To make things easier, install Python from within the Termux app (available on F-Droid - I'm not affiliated with it) and run Nemris from there. It also needs aapt or aopt to be installed in /system/bin. To summarize:
Root permissions (systemless root is not supported);
aapt or aopt in /system/bin;
Python 3.5+.
Overview of the features
This tool's scope is to be freely customizable on the fly, which is allowed by its Python nature.
It leverages root permissions in order to read from the /data/system/packages.xml file, in order to create an index of paths corresponding to the installed apps, which is way faster than using pm path. Root permissions are also used in case you want to store your extracted APKs on the external SD, but your Android version is equal or greater than 6.0, by exploiting the privileged nature of the system shell.
Furthermore, Nemris is able to discern between user, system and disabled apps, and to ignore Substratum overlays and Arcus theme variants.
In the end, thanks to a MD5 checksums dictionary, it can avoid making unneccessary extractions by comparing the MD5 of the inspected app to said dictionary.
Fantastic, but how do I run the thing?
You run it by using python /path/to/the/script.py. Actually, running it without arguments returns a short usage message, but running it with argument -h will give you a clear outline of the allowed arguments.
Can I exclude/extract only specific apps?
Not at the moment, and it's not something I'm interested to include. You can extract only apps pertaining to a specified group, though. The allowed groups are User, System, Disabled and All apps.
But I want to extract my Substratum overlays/Arcus variants!
That's what the arguments --keep-substratum and --keep-arcus are for.
I want to change my destination directory, but there's no setting to do so!
To save time and spare you from entering yard-long arguments, Nemris asks for the chosen destination directory exactly once, at the first run. It then saves this preference, along with the MD5 dictionary and other info inside a file called nemris_config.pkl, which is in a binary format you can't edit. You can make Nemris delete this file by using the -r argument, though, and make the tool run as if in its first launch.
I want feature X to be included!
You're free to contribute to Nemris' development and add the feature yourself. I'm kind of lazy, so asking me wouldn't probably help you.
I would like a detailed explanation of the arguments!
Head over to the project's source and read the README.md, which should be clearer than this post.
Nemris doesn't delete old APKs!
This is done under the assumption that you might need them. So, no, it won't delete them.
Have fun with my tool!
XDA:DevDB Information
Nemris, Tool/Utility for all devices (see above for details)
Contributors
Death Mask Salesman
Source Code: https://github.com/DMSalesman/Nemris
Version Information
Status: Testing
Beta Release Date: 2017-02-09
Created 2017-02-17
Last Updated 2017-02-17
Devices & Linux Versions I or other Testers have Successfully Gained Root on:
(Likely All) MTK CPU Based Android devices UP TO 11 (Maybe 12? I haven't tested) (I.e LG, Sony, Select Samsung devices)
Android Devices with LINUX KERNEL VERSIONS - 5.8 - 4.14 - Maybe More? (Needs Testing)
-THIS GUIDE IS NOT BEGINNER FRIENDLY - BASIC UNDERSTANDING OF PYTHON, UNIX/LINUX ETC WILL BE REQUIRED!-
If you have been holding off updating your device, well here's some good news, your device may still be vulnerable to a method to gain root access (and subsequently, possibly the ability to edit Build.prop and therefore allow the ability for OEM unlocking on USA based devices.) <- correct me if I'm wrong, but this should be possible, and once done, should persist across updates, correct?
As of the time of writing this, there is not currently a simplified APK method, but, still this process is relatively straight forward.
Alot of the methods used HAVE been patched from what I understand, but there have got to be plenty of devices out there still which are not updated. This project aims to compile all current, former and future Root methods into an APK that will do all the leg-work. If its able to find a working method, the GUI will pop a root shell for the end user. This SHOULD work, regardless of the setting of the "OEM UNLOCK" option in the dev options. A bypass, essentially.
Regardless, The project linked below uses a myriad of known exploits & vulnerabilities and looks to find one that will work.
Methods used are:
Nearly all of GTFOBins
Writeable docker.sock
CVE-2022-0847 (Dirty pipe)
CVE-2021-4034 (pwnkit)
CVE-2021-3560
It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock, or the recent dirty pipe (CVE-2022-0847). More methods to root will be added over time too.
There is also an alternative (Dirty Pipe) injection method the uses @topjohnwu 's Magisk , this should be implemented into the apk. See this Github repo, Here.
I would imagine this could be implented in a way to target devices that have stopped being supported for updates, aswell, that do not have TWRP, such as the SM-T307U.
One big note - I am betting there are still ALOT of devices that are in inventory at retailers that remain on the vulnerable OS. So keeping that in mind, I'd say this is worth building.
What needs to be done:
TESTING!
Build APK - HELP NEEDED WITH THIS!
Deploy
Main Goals:
Get bootloader unlock ability for devices normally not unlockable (I.e North American Samsung Galaxy S22, Etc)
Above can be achieved by getting temp root via methods detailed here or otherwise, then editing build.prop, altering the below settings (The settings may be worded differently or simply not present at all, depending on device and Firmware version):
sys.oem_unlocking_allowed to 1
ro.oem_unlock_supported to 1 (most devices are set to 1 by default.)
ro.boot.flash.locked to 0
ro.secure to 0
ro.debuggable to 1
I think there may be one or two more that pretaint to Flash.locked. I.e flash.locked.other--or something very close.
Locally, gain temp root (System preferred, but any root will do.) on as many device types as possible.
Give device control back to end user.
Stay up-to-date on new exploits for root access & update apk accordingly.
STAY ETHICAL!!!! This is, in the end, a research project. Meaning all work preformed in the context of this project could result in a damaged or bricked device. By participating in this project you acknoledge these risks and accept them, and agree to not hold me, XDA, or anyone else responsible if you do some dumb ****. - k0mraid3
Github Project link: HERE for my fork & HERE for the original project.
My fork will incorporate the original project, as well as other found root access methods, such as the magisk injection method mentioned above - my repo is mainly used as a hub for the APK's dev - i don't have enough time to work on it at the moment but all are welcome to help.
July 15th 2022 (UPDATE) (SAMSUNG DEVICES ONLY): A new Escalation method has been found via the Galaxy app store (Versions BEFORE Galaxy Store 4.5.41.8). No details known yet, but it is said to be very easy. See CVE-2022-33708 (July132022). Unknown if downgrading the app to 4.5.0.0 will enable the method again or not.
Cred: liamg
One method to run Traitor on device - Thanks @DevinDking for sharing this.
Steps to get script on phone.
//
#!/bin/sh
set -e
dir=/data/local/tmp
adb=${adb:-"adb"}
$adb push traitor ${dir} //This puts file on phone make sure to run the terminal where its located
$adb shell chmod 755 ${dir}/traitor"
//
Now to run script start a new terminal
//
adb shell
#!/bin/sh
set -e
dir=/data/local/tmp
adb=${adb:-"adb"}
${dir}/traitor //script opens
//
But I assume this wouldn't work right, and isn't right.
Idk trying my best here xD
Click to expand...
Click to collapse
Tools & References:
Linux (and Android, FTMP) Privilege Escalation Techniques
Dirty Pipe - Magisk Injection
Traitor - Main Repo
GTFOBins
CVE Database (Public Database for exploits, vulnerabilities, etc.)
Windows Subsystem For Linux (Great for Dev)
ADB App Control - Cred @Cyber.Cat
Leaked Samsung Source Code ***Mod Edit: Link Removed***
Crontab Root Template script (File Attached - you still must edit crontab with "crontab -e" and point it to this file, see comments for guide, I will add one to post later)
Android Image Kitchen Used to create custom image's etc.
MTK Client
MTK Meta Utility (Source-???)
Will add more as time goes on and more found.
Interesting Attack vectors -
GFX Componets of a system.
Issues with Linux itself (i.e Dirty Pipe)
Privilage escalation via any means (I.e GTFOBins)
unprotected system process - Hijack them if possible (i.e RILService Mode, and a wide range of other OEM apps left on devices after ship)
7/24/22 - Samsung, LG & Other OEM's obfuscating (Intentionally Hiding) Fastboot and ADB Bootloader interfaces on PC
So over the last week or so i dived head first into USB Dev - ill save you the time and sum it up.
Vendors and OEM's are actively obfuscating the USB connection between your smartphone and the PC to keep you from Rooting. As far as im aware, there is no Universal way to fix this as each OEM screws with the USB drivers differently. THIS needs to be a point of focus for the rooting community. However, i have found a few tools for Dev if you wish to screw with this. (I'll upload them tonight)
7/24/22 - MTK (MediaTek) based Exploits
I Will try to compile a few methods for FORCING Bootloader Unlock on MTK based Devices as well as a way for manipulating said devices. I will attach two tools to this thread, these tools are EXTREMELY POWERFUL and can completely **** up your device. When i say REALLY F*CK UP your device, I mean to the point you cant even access recovery, Download OR bootloader mode. I'm Talking a blank DEAD device. So use with caution.
With that said, lets talk about the tools. You will need a basic understanding of Python to make use of MTK Client
First up, we have MTK Meta Utility (Currently Version 44) (Download Below)
Next we have MTK Client (Github Link)
So what can you do? Well, you can crash the Preloader to Brom with MTK Meta Utility while at the same time using MTK Client to send any payload you like to the device via Fastboot.
I know, vague right now, but ill add detail over the coming days.
I will continue to update the below list as new methods are discovered.
If you find Guides, tutorials or new exploits, please link them in the comments so I can include them in future development!
Telegram Channel: Here.
Information on Vulnerabilities, exploits & methods - CVE-2022-0847 (Jfrog) - The Story Of "Dirty Pipe" - XDA - Dirty Pipe - PWNKIT (CVE--2021-4034) - CVE-2021-3560 - Docker Breakout / Privilege Escalation - CVE-2022-33708 (July132022) - CVE-2022-33701 (July122022) - CVE-2022-22268 (Unlock Knox Guard with DEX) (JAN2022) - MTK Client -
Dev Team & credit to -
@topjohnwu - LiamG - @wr3cckl3ss1 - bkerler -
UPDATED - 7/29/22
There is also a new vulnerability exploit by Zhenpeng Lin that allows for privilege escalation on Pixel 6 and and Galaxy S22 devices running 5.10 kernel.
Don't update... destroyer of worlds
I feel like I'm missing something because wouldn't their normally be a million responses of hype, hope and nay-saying going on here? Has this been shot down already?
olivehue512 said:
I feel like I'm missing something because wouldn't their normally be a million responses of hype, hope and nay-saying going on here? Has this been shot down already?
Click to expand...
Click to collapse
Lol, everybody already updated the patch
blackhawk said:
Lol, everybody already updated the patch
Click to expand...
Click to collapse
This is just sad panda. I'm gonna skip next update anyways unless it comes with an actual other phone that is BL unlocked. I feel like everyone wants this so bad it can't be that far out before it happens.
Does the Magisk injection method work after July patch? I was reading through the work they did to get it done. Props to those guys.
sierratango88 said:
There is also a new vulnerability exploit by Zhenpeng Lin that allows for privilege escalation on Pixel 6 and and Galaxy S22 devices running 5.10 kernel.
Click to expand...
Click to collapse
Has it got a fancy number yet?! Eager to try this!!!! Maybe it can be put in with the others.
olivehue512 said:
I feel like I'm missing something because wouldn't their normally be a million responses of hype, hope and nay-saying going on here? Has this been shot down already?
Click to expand...
Click to collapse
Well, because they are known and accepted vulnerabilities and exploits. A very few have even been marked as "WONTFIX" such as the TTY method.
olivehue512 said:
This is just sad panda. I'm gonna skip next update anyways unless it comes with an actual other phone that is BL unlocked. I feel like everyone wants this so bad it can't be that far out before it happens.
Does the Magisk injection method work after July patch? I was reading through the work they did to get it done. Props to those guys.
Click to expand...
Click to collapse
Honestly, it's worth a shot but I doubt it.
One of the goals behind building the APK compilation of all these different tactics is to enable the end user to "give it a shot" easily on different devices, without having to know how to run all of this manually. Basically imagine an apk that just tries all the above methods and if ones successful the gui will pop a root shell open. From there, the possibilities are endless. Edit Build.prop, SELinux, Verity, Etc.
FYI even you applied the July update, seems like the Kernel version is still from June 21st, is still 5.10xxxx so we could still benefit from this exploit. Very interested in how we can get root here in the US.
K0mraid3 said:
Has it got a fancy number yet?! Eager to try this!!!! Maybe it can be put in with the others.
Click to expand...
Click to collapse
There hasn't been a CVE assigned to it yet that I am aware of.
xgerryx said:
FYI even you applied the July update, seems like the Kernel version is still from June 21st, is still 5.10xxxx so we could still benefit from this exploit. Very interested in how we can get root here in the US.
Click to expand...
Click to collapse
Go to the Github linked and try the different methods, see if you can pop a root and nano build.prop to allow OEM unlocking?
sierratango88 said:
There hasn't been a CVE assigned to it yet that I am aware of.
Click to expand...
Click to collapse
GREAT news for us! LEts get this temp root! lol
Looks like another new one! CVE-2022-33708
Another Samsung Exclusive - CVE-2022-33701
So, ive just spent my entire friday and friday night MANUALLY testing all the GTFOBins & reproducing some of the newer CVE's on Samsung Galaxy S7 Edge (Android 9) -Galaxy tab A 8.4, (Android 11), Galaxy S21 & S22 (Android 12) --- A little bit of progress made. Again, ill need someone with better working knowledge on APKs & Java to really move forward. All i can say so far, is this all must be awk for sammie, because cronie is looking promising
"crontab -e"
interesting find. not "New" but still new-ish enough some may be able to use. CVE-2022-22268 (Unlock Knox Guard with DEX)
New to this all but not rooting. Anyone recommend a way tutorial on how to try these methods on Win 11?
I don't have a deep understanding of Linux, I have tried, debian and unbuntu. I get traitor to run but it's detecting the Linux kernel and not my phones. How can I get the program to search for vulnerability on my phone not my Linux. I would love a more in depth guide and I'd love to give feedback on methods.
DevinDking said:
I don't have a deep understanding of Linux, I have tried, debian and unbuntu. I get traitor to run but it's detecting the Linux kernel and not my phones. How can I get the program to search for vulnerability on my phone not my Linux. I would love a more in depth guide and I'd love to give feedback on methods.
Click to expand...
Click to collapse
i had the same issue but cant remember how i worked that out. let me see if i can find out what i did on win11