Malicious hidden in /misc /recovery partition - General Questions and Answers

Hello everyone excuse me for creating a new thread but i couldnt find any info on this matter.
As a gift, my parents brought Samsung galaxy s4 from someone i dont trust who sells it. I factory reset the phone thinking its enough to clean everything.
After a while i feel unsafe because the person knows things out of nowhere and i found out many $py software are more advanced now that its installed via root and very stealth.
I read wiping the partition and flashing the rom could help. But limited to only boot, data, cache, system while other such as /misc, /recovery remain the same?
What if its hidden in there. i want to make sure just to be safe. On a side note the person is a techie and also know im careful and observant.
Whats your suggestion on this?
Can i check every files in it also find the hidden ones and make sure no suspicious file? but i dont know the original stock file lists for the partition /misc and /recovery.
Please help. Any inputs will be very much appreciated.
Thank you in advance.

To completely delete the malicious software you can re flash the stock firmware using odin

Thank you for replying
Isnt that the same as flash a stock rom like i mention?
But what i read from couple of sources it only rewrite /system
And factory reset wipes /data /cache.
But other partitions remain the same.
Or theres something i miss?

With odin you re flash all rewriting all of the partition

joe2k01 said:
With odin you re flash all rewriting all of the partition
Click to expand...
Click to collapse
Is that the Odin Nand erase all?
I tried google it abd found this
http://forum.xda-developers.com/showthread.php?t=2610757

Look for sammobile with google and look for your firmware , download it and follow the steps that the site gives you.

joe2k01 said:
Look for sammobile with google and look for your firmware , download it and follow the steps that the site gives you.
Click to expand...
Click to collapse
Hello, yes ive read about it.
However, do you think its better with the nand erase all?
The difference is the pit file right? Which it uses for repartition.
Ive read some people write tutorial.
Im wavering. Because i read for full wipe and more secure we should use the nand erase all.

If you use my method you are sure that all the malicious software will be deleted, so I suggest you my method

Related

Be careful :changes like lagfix...

Well I am happy for the work That is being done by the XDA 15800 forum members esp rex,sahil,sazby,gsm101 , brave buddy , addicted and others...
However I just wish to draw people's attention to actually understanding how things like lagfix works so that they dont face the problems that I faced...
http://forum.xda-developers.com/showpost.php?p=9745695&postcount=40
Just chck out the final piece of code of UN-lagfix that u run to undo i5800 lagfix:
echo "Cleaning /data"
cd /data
busybox rm -r *
echo "Removing auto boot support"
busybox mv /system/bin/playlogosnow /system/bin/playlogos
echo "All done! Rebooting device so that the EXT2 Loopback device is freed."
reboot
chck out the bold part. so what the lagfix does is create a ext2 partion in your internal memory, and whenever your device boots , it is automatically directed to that ext2 chunk.
Now if your phone is working correctly, then no problem.
However IF your phone crashes while u still have lagfix enabled... well I guess after that people will be stuck onto their boot screen staring at i5800 logo for days to come....
morever whatever firmware u flash, since the command makes changes in the mbr, it cant be resolved by usual flashing via odin.
You actually need to restore the proper boot partition which can be done via adb . But then ADB can be used only when the phone is on and in debugging mode..
more reasons why you should be careful with these fixes is
1) i5800 is a relatively new phone. We still don't have the stock kernel, stock recovery with us. For other phones like galaxy s that is available for download.
2) The odin for i5800 is meant mainly for flashing(its not yet advanced). However it lacks the repartition option that is present in galaxy s odin.
3)No clockwork mod recovery for i5800 . Nandroid backup not there.
This post is not meant to be disrespectful to others. I have immense respect for people who work hard and take risks to bring new features to our phones But still it is better to understand something before we do it.. I have learned it the hard way.
anyway for those who have an indian i5801, might want to know that only 2 firmwares out there to solve the issues. so any issues you face do keep a copy of both in your pc, esp datafs and zimage..
ddj5/ddj6
first you flash only the boot kernel, ie zimage, and then again u flash ddj6 . If you are lucky it will boot correctly.
you can backup like this
http://forum.xda-developers.com/showpost.php?p=9778992&postcount=8
what is indian i5801 stock firmware ?
be the way if you flash or stay in the boot screen
is the MULTI CSC fimrware make this bug
efs is not flash by odin,and the product code and imei is in nv_data.bin
if the stock efs only have one csc ,flash to MULTI CSC firmware
like I5801DKATGY(HONGKONG),only have one csc
flash I5800XWJH2 is ok,if flash XXJP8 JP9 JPA MULTI CSC firmware
that stay in the boot screen
==========================================
Previously Samsung used code *#272*HHMM# (HH being hour and MM minute, = current time) to access the Preconfiguration menu.
Saka911 said:
Well I am happy for the work That is being done by the XDA 15800 forum members esp rex,sahil,sazby,gsm101 , brave buddy , addicted and others...
However I just wish to draw people's attention to actually understanding how things like lagfix works so that they dont face the problems that I faced...
http://forum.xda-developers.com/showpost.php?p=9745695&postcount=40
Just chck out the final piece of code of UN-lagfix that u run to undo i5800 lagfix:
echo "Cleaning /data"
cd /data
busybox rm -r *
echo "Removing auto boot support"
busybox mv /system/bin/playlogosnow /system/bin/playlogos
echo "All done! Rebooting device so that the EXT2 Loopback device is freed."
reboot
chck out the bold part. so what the lagfix does is create a ext2 partion in your internal memory, and whenever your device boots , it is automatically directed to that ext2 chunk.
Now if your phone is working correctly, then no problem.
However IF your phone crashes while u still have lagfix enabled... well I guess after that people will be stuck onto their boot screen staring at i5800 logo for days to come....
morever whatever firmware u flash, since the command makes changes in the mbr, it cant be resolved by usual flashing via odin.
You actually need to restore the proper boot partition which can be done via adb . But then ADB can be used only when the phone is on and in debugging mode..
more reasons why you should be careful with these fixes is
1) i5800 is a relatively new phone. We still don't have the stock kernel, stock recovery with us. For other phones like galaxy s that is available for download.
2) The odin for i5800 is meant mainly for flashing(its not yet advanced). However it lacks the repartition option that is present in galaxy s odin.
3)No clockwork mod recovery for i5800 . Nandroid backup not there.
This post is not meant to be disrespectful to others. I have immense respect for people who work hard and take risks to bring new features to our phones But still it is better to understand something before we do it.. I have learned it the hard way.
anyway for those who have an indian i5801, might want to know that only 2 firmwares out there to solve the issues. so any issues you face do keep a copy of both in your pc, esp datafs and zimage..
ddj5/ddj6
first you flash only the boot kernel, ie zimage, and then again u flash ddj6 . If you are lucky it will boot correctly.
Click to expand...
Click to collapse
Quite an interesting post these things are surely of importance and we people will have to start from scratch and either make other work tweaked for our purpose or have to build new one.
I will be looking into the details and first thing of importance is to have a backup plan when things go wrong because ppl who buy this phone buy it mostly because they cant afford more expansive ones or 2 phone so safety should be the first and foremost concern here.....
Happy coding...
god_md5 said:
you can backup like this
http://forum.xda-developers.com/showpost.php?p=9778992&postcount=8
what is indian i5801 stock firmware ?
be the way if you flash or stay in the boot screen
is the MULTI CSC fimrware make this bug
efs is not flash by odin,and the product code and imei is in nv_data.bin
if the stock efs only have one csc ,flash to MULTI CSC firmware
like I5801DKATGY(HONGKONG),only have one csc
flash I5800XWJH2 is ok,if flash XXJP8 JP9 JPA MULTI CSC firmware
that stay in the boot screen
==========================================
Previously Samsung used code *#272*HHMM# (HH being hour and MM minute, = current time) to access the Preconfiguration menu.
Click to expand...
Click to collapse
well the default firmware for Indian i5801 is
july ddj5
august ddj6
and yeah it is a multi-csc firmware( csc corresponds to area and apns)
but the problem is that the version of ddj5 and ddj6 hosted on sam firmware are leaked builds...
the original build should be ddj2/3 (4 is unlucky in korean)
p.s. If any indianforum member who is reading this has an untouched(never rooted,never flashed) new i5801, then we can try and extract stock kernel , bootloader , ziimage and boot.bin from there so that we have a safety net in future.
regards,
aka.
addicted2088 here.. The two threads that I've started don't mess with the system files at all. Nothing can go wrong because of them..
Just letting people know that any bricked phones are not because of my instructions, but can be because of the work done by the other members named above. But since the work they're doing is good, we all gotta take some risks. I know I do..
No disrespect to those whose names have been mentioned in this thread. Appreciate the great work that you guys are doing..
I have the indian ddjg6 version of galaxy 3...but i rooted the device by z4root but nothing else is done like flashing...and all...
-Devilgod (United Devils)
Hello ..
So, in theory, the lagfix i had ported doesn't change at all the partition scheme of the i5800, since it's a LOOPBACK device in the /data partition: If you prefer, a partition in the partition. So, it can't, at all, brick your phone, since you ALWAYS can flash again with Odin (As i said before, you should remove the battery while not in USB/AC).
And you HAVE TO flash a datafs.rfs if something went wrong. I say it again.
Gsam101 said:
Hello ..
So, in theory, the lagfix i had ported doesn't change at all the partition scheme of the i5800, since it's a LOOPBACK device in the /data partition: If you prefer, a partition in the partition. So, it can't, at all, brick your phone, since you ALWAYS can flash again with Odin (As i said before, you should remove the battery while not in USB/AC).
And you HAVE TO flash a datafs.rfs if something went wrong. I say it again.
Click to expand...
Click to collapse
hello, Thanks for the feedback...
I just created the thread so that we can make a repository of the stock kernel, boot etc. so that in future it will be useful when we go for nandroid backup or kies update
so does this lagfix work??? after all????
or not?
i have seen someone brick his phone....
Saka911 said:
hello, Thanks for the feedback...
I just created the thread so that we can make a repository of the stock kernel, boot etc. so that in future it will be useful when we go for nandroid backup or kies update
Click to expand...
Click to collapse
this makes absolutely no sense to me... in that case you´d need to change the thread title and also content of first post, which makes all other posts obsolete what again makes the whole thread obsolete.
however, this lagfix is confirmed working multiple times but it surely needs some work to be done, and in my opinion is not really needed. my girlfriends G3 opens contacts even faster than my SGS (this however could have to do with her having 120 contacts versus me having 800+) despite my SGS runs on custom kernel with ext4 for data partition. Also Lagfixes though a loop device are always a little risky to loose data when doing an unpropper shutdown.
But what the op stated is just untrue, the lagfix does not resist a firmware flash if that firmware contains a datafs.rfs file.

[Q] samsung galaxy player 50

My sister have a Galaxy Player 50 with eclair...this PMP seems to be the same as the galaxy 3 (same resolution...and some other things) so can I flash lestatious or other rom on it ?
This hardware is not a phone...but maybe ?
Maybe I can try to flash...but if the pmp become soft bricked...it's over since i can't found an galaxy's 50 firmware...
Darius, I'm stuck with a brick galaxy player. I can try to flash with a galaxy 3 firmware if you want
Do you know how to make a dump of your device so you can share with me the original firmware?
http://forum.xda-developers.com/showthread.php?p=14493414
I don't know...but I'll try to find
Thanks!
I tried the firmware of galaxy 3, but didn't work
I dont think that its possible, first of all, despite being an android device, it doesnt have radio features, gsm 3g etc, only wifi, there are features that our phone does not support
Anyone found a solution for this yet? Not being able to test this device to it's full potential is really frustrating. Games are laggy and apps just do not run smooth on this one.
Has anyone tried z4root on this? I did and it freezes at "acquiring root shell".
@fedeff: how did you brick it?
Darius_AWS said:
My sister have a Galaxy Player 50 with eclair...this PMP seems to be the same as the galaxy 3 (same resolution...and some other things) so can I flash lestatious or other rom on it ?
This hardware is not a phone...but maybe ?
Maybe I can try to flash...but if the pmp become soft bricked...it's over since i can't found an galaxy's 50 firmware...
Click to expand...
Click to collapse
First root using One click root.
Give these commands in Terminal emulator
su
mount
Check for system partition.Suppose it is stlx (x=6,7,8 etc depending on system partition)
give this command to dump system...
dd if=/dev/block/stlx of=/sdcard/factoryfs.rfs
Copy it from sdcard and upload. I need to check it then i can help u out.
arunmcops said:
First root using One click root.
Give these commands in Terminal emulator
su
mount
Check for system partition.Suppose it is stlx (x=6,7,8 etc depending on system partition)
give this command to dump system...
dd if=/dev/block/stlx of=/sdcard/factoryfs.rfs
Copy it from sdcard and upload. I need to check it then i can help u out.
Click to expand...
Click to collapse
I'd gladly try it as long as Samsung gives me firmware, don't want to end up with a nice looking little brick here.
Is there any way that that an installer/firmware file could be saved in the device for backup purposes or something?
anon3524 said:
I'd gladly try it as long as Samsung gives me firmware, don't want to end up with a nice looking little brick here.
Is there any way that that an installer/firmware file could be saved in the device for backup purposes or something?
Click to expand...
Click to collapse
factoryfs.rfs is ur firmware backup....
@arunmcops: Thanks for the instructions. If someone try this and upload it'd be great for me.
@anon3524: I accidentally reseted the device to factory, trying to fix a problem with wifi (it suddenly stopped working one day).
arunmcops said:
factoryfs.rfs is ur firmware backup....
Click to expand...
Click to collapse
Ok, I am down to do this process you just explained as long as you or anyone explains to me how to recover the device with this "factoryfs.rfs" in case it gets bricked. You'd have to explain with detail how to grab this file and what to do with it etc. Also, if you could give further details on the initial process, that'd be great since a few things are unclear (to a brave noob like me).
Other than that, I am willing to try it to see the results.
BRING IT OON! *warface*
@arunmcops - I've got one of these, so have uploaded the file you wanted here - sorry, not allowed to post links yet:
dl.dropbox.com/u/6491656/Samsung/factoryfs.tar.gz (please don't flash this, its not a full rom)
I haven't made any changes to the base firmware other than renaming a couple of the phone.apk's to .old (cell standby was eating battery, and this device doesn't have a sim).
For fun, i've also uploaded a dmesg log
dl.dropbox.com/u/6491656/Samsung/dmesg.log
One other thing, i think the partition layout might be slightly different on this (might be wrong, don't have the phone) in that the internal sd card is mounted as /sdcard and the external one is /sdcard/sd.
Hope this helps!
Chris
@ctaylr Thanks for uploading the file.
I tried to load it using Odin, but it get stuck while uploading the file. The device is detected, but I think it's not transfering anything.
Is it possible to restore it form sd card?
fedeff said:
@ctaylr Thanks for uploading the file.
I tried to load it using Odin, but it get stuck while uploading the file. The device is detected, but I think it's not transfering anything.
Is it possible to restore it form sd card?
Click to expand...
Click to collapse
Hi...thats probably because it isn't intended as a flashable rom. Its just a dump of the stock firmware so that arunmcops asked to see to see if it had any resemblance of the galaxy 3 f/w, to see what we'd have to do to get a working custom ROM on this device..
Please don't attack it with any kind of Norse God ...especially until there is a confirmed route back to stock. All thats contained in the files is what you have on your device already - so there is also absolutely no point (for now).
If your having trouble with your device now, you could try doing a factory reset or playing about in Kies - i've fixed my device once after I got curious and flashed a custom ROM on here (which fyi completely messed it up - something like E:multi_csc: error: open /efs/imei/mps_code.dat because we dont have an IMEI code on this device) and then got it back working again - unfortunately i can't remember exactly what I did. Otherwise if this doesn't work I'll see if i can make a working stock package for Odin.
@ctaylr, yes I'm having problems with my device. It got soft bricked. I couldn't make it work using Kies. The only thing I can do is to start it in Download mode. If you can make a working package for oding that'd be great
This might help
http://forum.xda-developers.com/showpost.php?p=9515709&postcount=14
Thanks!
@fedeff Ok. i'll have a look over the weekend and see if i can make something that flashes.
Quick questions
1) do you have the 8gb or 16gb version?
2) have you tried going into recovery utils and doing a "wipe data/factory reset?" - you can do this by holding down home, volume down and volume up while turning the unit on - i seem to remember this fixed it for me, but it probably depends on how far Odin got while flashing. If your unit is already bricked, i can't see it doing much further harm
Thks
ctaylr said:
@fedeff Ok. i'll have a look over the weekend and see if i can make something that flashes.
Quick questions
1) do you have the 8gb or 16gb version?
2) have you tried going into recovery utils and doing a "wipe data/factory reset?" - you can do this by holding down home, volume down and volume up while turning the unit on - i seem to remember this fixed it for me, but it probably depends on how far Odin got while flashing. If your unit is already bricked, i can't see it doing much further harm
Thks
Click to expand...
Click to collapse
1) I have the 8gb version
2) By doing "wipe data/factory reset" is how I got it soft bricked. (the device wifi suddenly stopped working, and I thought that would help) After that it kept entering in the recovery mode. Then I tried to flash it with odin, now the only thing I can do is enter the download mode
Thanks again for helping me!
News?
Hi! I also like the others I am interested because my Galaxy player has 50 brick and I need someone to do dump the firmware so I can flash through odin! Please would you be my salvation and many other who have this player and would like to fix without waiting for the assistance of a month
Waiting for an answer I greet and thank all users who want to help me
sorry if English is not correct, but I'm using google translator (I'm Italian)
EDIT:
listen to me: http://forum.xda-developers.com/showthread.php?t=726673 This is the guide on how to get the dump of your fimrware if someone kindly did this process with its galaxy player 50 and then upload the file . tar obtained would help all
I don't think it is as simple as that.
If you fully read that topic above, it tells you. That will ONLY tarball the files in the /system folder. It doesn't dump the the bootloaders, efs or produce the initrd, which is also part of the firmware.
In fact that backup is exactly what i linked to earlier here, and doesn't flash properly through Odin. I don't know Odin very well (i use a ZTE Blade and clockworkmod normally ) but i'm going to take an educated guess it needs all of this information to successfully flash the player, and trying to flash without all of that probably won't work so well.
If i'm wrong, please let me know and i'll do what i can to help.
ctaylr said:
I don't think it is as simple as that.
If you fully read that topic above, it tells you. That will ONLY tarball the files in the /system folder. It doesn't dump the the bootloaders, efs or produce the initrd, which is also part of the firmware.
In fact that backup is exactly what i linked to earlier here, and doesn't flash properly through Odin. I don't know Odin very well (i use a ZTE Blade and clockworkmod normally ) but i'm going to take an educated guess it needs all of this information to successfully flash the player, and trying to flash without all of that probably won't work so well.
If i'm wrong, please let me know and i'll do what i can to help.
Click to expand...
Click to collapse
ok then I'm sorry I read the topic in a hurry and did not realize that you can not do what I say but re-reading now I understand!
ctaylr what do you advise me to do then? wanted to try an get into recovery and restore but I think the 3 keys are disabled enters only download ..
Google traductor sorry

[Completed] Note II (N7100) partitioning issue

Greetings all,
I am currently in possession of a note II which has never been rooted or unlocked. At the moment it is soft bricked and cannot get past the Samsung bootloader logo into the ROM.
In recovery mode, it cannot mount to any of the internal partitions (system, cache, data, efs etc). As a result, I cannot flash any stock or custom firmware onto the device via Odin whether that be v3.0.9, v3.0.7 or v1.83. The procedure fails after attempting to write to the NAND. When flashing a new PIT file on, the procedure freezes at "get PIT for mapping" so I presume the PIT in the system is corrupted.
I cannot connect to any partition, not even in GParted. As a result, it is essentially bricked. I cannot access it via adb (since there's no partition for it to write over) or fastboot. Factory reset fails too. The recovery on the system is the very limited stock recovery.
The firmware it is running is: KOT.49H.N7100XXUFNE1
Except from resetting via JTAG, any suggestions would be greatly appriciated.
Many Thanks
Bump
Hi, thank you for issued XDA Assist. It sounds like you know what you're doing and have tried everything. But take a look at this,http://forum.xda-developers.com/showthread.php?t=2154890. There may be some help there. If not JTAG may be you're only option
jd1639 said:
Hi, thank you for issued XDA Assist. It sounds like you know what you're doing and have tried everything. But take a look at this,http://forum.xda-developers.com/showthread.php?t=2154890. There may be some help there. If not JTAG may be you're only option
Click to expand...
Click to collapse
Hmm, thanks for the reply, though that guide assumes the phone can find the partitions for remapping which is the stage I'm stuck on. It then suggests to reflash the bootloader which failed on me as well so not really getting anywhere..
Thread closed.

[Completed] Need to confirm a few things about ODIN

I'm some kind of experienced with ODIN, but I'm not sure with some things, I'll be very grateful if you can answer my questions.
Will flashing a stock ROM *touch* the /data partition ? There is nothing related with data in my Rom package, and NAND Erase All is not enabled. I have some important data to be recovered so I can't let it be touched.
Also, what software do you recommend when I am trying to recover deleted data on a Android device? Either an Android app or a PC app is okay.
Thanks a lot.
kavinzhao said:
I'm some kind of experienced with ODIN, but I'm not sure with some things, I'll be very grateful if you can answer my questions.
Will flashing a stock ROM *touch* the /data partition ? There is nothing related with data in my Rom package, and NAND Erase All is not enabled. I have some important data to be recovered so I can't let it be touched.
Also, what software do you recommend when I am trying to recover deleted data on a Android device? Either an Android app or a PC app is okay.
Thanks a lot.
Click to expand...
Click to collapse
Greetings and welcome to assist. Unfortunately assist is for guiding new members around the boards only, try asking your question here
http://forum.xda-developers.com/android/help
Thanks for understanding
Sawdoctor

ODIN question with re-partition/nand erase all + PIT

Hi folks, so i want to do a clean install with latest firmware,
When i had Galaxy s6 what i did was use a ROM with 4 files plus .PIT, tick re-partition and nand erase all and i had a perfect installation very very clean and smooth
but i'm a bit afraid to do it with this new phone,my phone is NOT rooted so i dont have a backup of my EFS folder/partition.
So my question is if someone has checked that this that i mention is safe to do with this phone too! .
Thanks in advice.
How important is it to you that you have a completely clean install just for a simple update? Sounds like you're apprehensive about it so why bother messing around with something that's unlikely to yield any significant result?
My advice, dont mess with the partitions. Just install the update OTA or flash the FW with Odin like a normal person and don't make it more convoluted than it needs to be. That's just my 2c though, its your phone and you gotta live with it if/when you irrecoverably brick it.

Categories

Resources