Mediatek Wifi/BT/FM/GPS combo chips, hidden capabilities [MT6620, MT6628, MT6630] - Android Software/Hacking General [Developers Only]

Hi everyone! This is a deep dev-related question, but I don't have permission to post into dev forums.
My goals are - implement Wifi monitor mode and enable FM Transmission capability. Since they are both related to one chip, I decided to put them into one post (sorry if this decision was wrong).
What do we have now:
The chip - general info
Is an ARM7-based SoC, combining features of it's ancestors: WLAN (MT5921), Bluetooth/FM (MT6616) and GPS (MT3326).
I've found the drivers for it in this repo: https://github.com/bq/aquaris-E5, wlan path: mediatek/kernel/drivers/combo/drv_wlan, fm path: mediatek/kernel/drivers/fmradio/mt6620.
There is an NVRAM map here: http://www.datasheet-pdf.com/datasheet-download.php?id=955336
And it's description (with pinout, block chart, but no specific details about it's ARM core): http://www.bluetooth.org/tpg/RefNotes/MT6620_RIN_Product_Brief_20101110.docx
Added: Found out that we cannot trust /system/build.prop for checking out a chip id. Drivers (lsmod) are not good indication either. You can use a built-in ioctl utility to issue a request directly to the chip like this:
Code:
ioctl -l 4 /dev/fm -1073416950
It doesn't parse a proper hex representation of the ioctl (0xС004f519) correctly, so I had to use this signed notation.
Turned out that Philips S388 has MT6627, which doesn't even have an FM Tx block in hardware: http://www.cnping.com/wp-content/uploads/2015/12/MT6627_Data_Sheet_v03a.pdf
Unluckily, my another device (PAP4044 Duo) has an MT6628 chip, which also doesn't support Tx: https://github.com/luckasfb/Develop...s/MT6628/MT6628T_external_datasheet_v1.2b.pdf
But curiously, it doesn't even have FM_IOCTL_TX_SUPPORT ioctl implemented, while S388 responds fine to it. You can check it for your device like this:
Code:
ioctl -l 4 /dev/fm -1073416935
If you get a "01 00 00 00" response, it would mean really good news - that your device supports TX and it is not disabled by the driver!
Wlan - low level packet reading/writing
libhardware_legacy.so on my Philips S388 enables wifi by calling "wifi_change_fw_path", which loads one of the 3 firmware (driver?) flavors: "STA", "STA+P2P" or "AP".
Firmware is located at /etc/firmware/WIFI_RAM_CODE, I attached it to the post.
According to "firmware_download" function, firmwares can be single-chunked (like this one) or have the header described by these structs:
Code:
typedef struct _FWDL_SECTION_INFO_T
{
UINT_32 u4Offset;
UINT_32 u4Reserved;
UINT_32 u4Length;
UINT_32 u4DestAddr;
} FWDL_SECTION_INFO_T;
typedef struct _FIRMWARE_DIVIDED_DOWNLOAD_T
{
UINT_32 u4Signature;
UINT_32 u4CRC; /* CRC calculated without first 8 bytes included */
UINT_32 u4NumOfEntries;
UINT_32 u4Reserved;
FWDL_SECTION_INFO_T arSection[];
} FIRMWARE_DIVIDED_DOWNLOAD_T;
u4Signature is "MTKW" for multi-chunk files. I've attached one of these multi-chunk firmwares also for you to see how they look like.
The chunks themselves look packed/encrypted, no visible headers. Doesn't look like a proper ARM code either.
And this part of code suggests some on-chip encryption (WTF?! It's not a smart-card or crypto chip):
Code:
prInitCmdDownloadBuf->u4DataMode = 0 | 0x1; // enable encryption
Added: Now I'm sure the stuff is encrypted. I've tried to figure out the cipher's specs and think it is either 8-byte block cipher or streaming cipher. Analyzing some datasheets and background info on Mediatek I've narrowed down possible candidates to RC4, DES, 3DES or some makeshift repeating key xor cipher.
I've seen some weird patterns in data like these, enforcing the latter idea:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
But xor'ing different parts together does not break data uniformity. Also a Hamming distance analysis doesn't apply here - it gives a key length of 36 bytes, which doesn't make sense.
If someone's good with crypto, I desperately need your advice.
Added2: I've effectively excluded RC4 as it doesn't produce repeating patterns and 95% sure it is 3DES in EDE mode like this:
Code:
openssl des -e -nosalt -des-ede3 -in plaintext -out 3des.cyp
Also using test mode MCR (MCU Register?) functions, I've managed to dump around 4 megs of something (attached as "something.zip"), which, according to the driver sources, could contain the decrypted firmware at offset 0x60000. And it does, judging by the size of the block and location of some characteristic zero-gaps, but despite of being non-packed and non-crypted, still doesn't make sense as an ARM code.
FM Transmission
Driver contains ioctls for TX mode:
Code:
#define FM_IOCTL_TX_SUPPORT _IOWR(FM_IOC_MAGIC, 25, int32_t*)
#define FM_IOCTL_RDSTX_SUPPORT _IOWR(FM_IOC_MAGIC, 26, int32_t*)
#define FM_IOCTL_RDSTX_ENABLE _IOWR(FM_IOC_MAGIC, 27, int32_t*)
#define FM_IOCTL_TX_SCAN _IOWR(FM_IOC_MAGIC, 28, struct fm_tx_scan_parm*)
And their implementation:
Code:
/*****tx function****/
ops->bi.tx_support = mt6620_Tx_Support;
ops->bi.pwrupseq_tx = mt6620_PowerUpTx;
ops->bi.tune_tx = MT6620_SetFreq_Tx;
ops->bi.pwrdownseq_tx = mt6620_PowerDownTx;
ops->bi.tx_scan = mt6620_TxScan;
Don't worry about TX_SUPPORT, the support availability seems to be out of the question:
Code:
static fm_s32 mt6620_Tx_Support(fm_s32 *sup)
{
*sup=1;
return 0;
}
However, I cannot guarantee the TX is not disabled by firmware (see above). Didn't dig well into this, since this feature is my 2-nd priority.
This is a tough stuff to pull off alone, so I'm looking for those who's interested and willing to join the effort.

ogurets said:
Hi everyone! This is a deep dev-related question, but I don't have permission to post into dev forums.
My goals are - implement Wifi monitor mode and enable FM Transmission capability. Since they are both related to one chip, I decided to put them into one post (sorry if this decision was wrong).
What do we have now:
The chip
Is an ARM7-based SoC, combining features of it's ancestors: WLAN (MT5921), Bluetooth/FM (MT6616) and GPS (MT3326).
I've found the drivers for it in this repo: github.com /bq/aquaris-E5, wlan path: mediatek/kernel/drivers/combo/drv_wlan, fm path: mediatek/kernel/drivers/fmradio/mt6620.
There is an NVRAM map here: datasheet-pdf.com /datasheet-download.php?id=955336
And it's description (with pinout, block chart, but no specific details about it's ARM core): bluetooth.org /tpg/RefNotes/MT6620_RIN_Product_Brief_20101110.docx
Wlan
libhardware_legacy.so on my Philips S388 enables wifi by calling "wifi_change_fw_path", which loads one of the 3 firmware (driver?) flavors: "STA", "STA+P2P" or "AP".
Firmware is located at /etc/firmware/WIFI_RAM_CODE, I attached it to the post.
According to "firmware_download" function, firmwares can be single-chunked (like this one) or have the header described by these structs:
Code:
typedef struct _FWDL_SECTION_INFO_T
{
UINT_32 u4Offset;
UINT_32 u4Reserved;
UINT_32 u4Length;
UINT_32 u4DestAddr;
} FWDL_SECTION_INFO_T;
typedef struct _FIRMWARE_DIVIDED_DOWNLOAD_T
{
UINT_32 u4Signature;
UINT_32 u4CRC; /* CRC calculated without first 8 bytes included */
UINT_32 u4NumOfEntries;
UINT_32 u4Reserved;
FWDL_SECTION_INFO_T arSection[];
} FIRMWARE_DIVIDED_DOWNLOAD_T;
u4Signature is "MTKW" for multi-chunk files. I've attached one of these multi-chunk firmwares also for you to see how they look like.
The chunks themselves look packed/encrypted, no visible headers. Doesn't look like a proper ARM code either.
And this part of code suggests some on-chip encryption (WTF?! It's not a smart-card or crypto chip):
Code:
prInitCmdDownloadBuf->u4DataMode = 0 | 0x1; // enable encryption
FM
Driver contains ioctls for TX mode:
Code:
#define FM_IOCTL_TX_SUPPORT _IOWR(FM_IOC_MAGIC, 25, int32_t*)
#define FM_IOCTL_RDSTX_SUPPORT _IOWR(FM_IOC_MAGIC, 26, int32_t*)
#define FM_IOCTL_RDSTX_ENABLE _IOWR(FM_IOC_MAGIC, 27, int32_t*)
#define FM_IOCTL_TX_SCAN _IOWR(FM_IOC_MAGIC, 28, struct fm_tx_scan_parm*)
And their implementation:
Code:
/*****tx function****/
ops->bi.tx_support = mt6620_Tx_Support;
ops->bi.pwrupseq_tx = mt6620_PowerUpTx;
ops->bi.tune_tx = MT6620_SetFreq_Tx;
ops->bi.pwrdownseq_tx = mt6620_PowerDownTx;
ops->bi.tx_scan = mt6620_TxScan;
Don't worry about TX_SUPPORT, the support availability seems to be out of the question:
Code:
static fm_s32 mt6620_Tx_Support(fm_s32 *sup)
{
*sup=1;
return 0;
}
However, I cannot guarantee the TX is not disabled by firmware (see above). Didn't dig well into this, since this feature is my 2-nd priority.
This is a tough stuff to pull off alone, so I'm looking for those who's interested and willing to join the effort.
Click to expand...
Click to collapse
I'll move it to android development for you unless you'd prefer it to stay in general
Regards
Sawdoctor

Found an interesting test mode in the driver and built a utility from the sources found in public repos around (source code for S388 attached).
It actually sends packets! I were able to capture them with another wifi card, so it's not some internal emulation, it is real.
The capture file is with the sources attached (forum does not allow me to upload .pcap file directly). Contents seem random, but if there is a way to specify a payload, there would be no need to decipher the firmware.
This is how an attached dump were made (used speed setting to confirm those are really my packets, not just random neighborhood traffic):
Code:
# ./wifitesttool -t 0 -s 0 -R 11
(success) Set central channel number to 1
(success) Set Rx default antenna to main
(success) Set bandwidth to BW20
(success) Set Tx power gain to 10 dBm
(success) Set Tx payload to 1024 bytes..
(success) Set frame interval to 20 TU
(success) Set frame count to 10
(success) Set SHORT preamble
(success) Set Tx mode to 11a/b/g, tx rate RATE_48MBPS
no cw mode configuration.
(success) TX test started..
Tx test is running! wait for 10s...
[0] Tx total/good count: 0/0
[1] Tx total/good count: 10/10
[2] Tx total/good count: 10/10
[3] Tx total/good count: 10/10
[4] Tx total/good count: 10/10
[5] Tx total/good count: 10/10
[6] Tx total/good count: 10/10
[7] Tx total/good count: 10/10
[8] Tx total/good count: 10/10
[9] Tx total/good count: 10/10
[10] Tx total/good count: 10/10
Stop Tx test!
Added: This AT command looks promising for setting a payload: RF_AT_FUNCID_PKTCONTENT

Nice

What you are trying to do?
I saw WIFI_RAM_CODE on my mediatek device it's not encrypted
Strings are still in plain text

[email protected] said:
What you are trying to do?
I saw WIFI_RAM_CODE on my mediatek device it's not encrypted
Strings are still in plain text
Click to expand...
Click to collapse
I'm trying to implement a non-associated wireless protocol using the widely available consumer hardware.
Could you post your WIFI_RAM_CODE file and the model of your Wifi chip or device?

Do you mean enabling monitor mode?(or something like that?)
My device has mt6755 WiFi chipset

ogurets said:
I'm trying to implement a non-associated wireless protocol using the widely available consumer hardware.
Could you post your WIFI_RAM_CODE file and the model of your Wifi chip or device?
Click to expand...
Click to collapse
So, can we inject packets?

Can you upload wifitest binary for mt6628?

Is there a way to read fm audio data from mt6627?

Related

[Contacts.apk] [DONE] Contacts List with Photo in Donut

Updated:
Credits must go to Geesun for his patch to show Contacts Photo.
backup first...
the files in attachments are to be used in UPDATE on RECOVERY MODE.
cyanogen_update.zip -> Contacts.apk with 2.0 icons + Photo on Contact list
geesun_update.zip -> Contacts.apk with Photo on Contact list and much more (warning this is for chinese mod and there is some chinese text)
IF YOU WANT ONLY THE Contacts.apk just unzip the file and check inside App
Feature only in the Geesun Mod
from the Chinese site (translated):
Contacts to strengthen amended as follows
1. Intelligent IP dial-up, according to city contacts dial 17951 (can be set)
2. Display to / go to Electric City
3. According to contact numbers, display contact city,
4. Show a missed call city.
5. For international calls, you can display the name of the country
6. For fixed-line telephone, +86 and so on, can handle
7. For used phones, you can also display, such as 138001380000,10086,95528, etc.
8. The first time required to set up your own IP dial-up number and their phone numbers, default is 17951 / Shanghai
9. Database is small, query speed.
10. The database updated to 2009.5, all data come from the Internet, without encryption, you can free to use.
11. To contact data will not be damaged.
12. Have joined the contact picture.
Thanks
Xenio
SCREENSHOT FROM GEESUN MOD (Cyanogen mod have only Photos in Contacts)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
direct link to Contacts.apk from Cyanogen
http://n0rp.chemlab.org/android/apps/Contacts.apk
Geesun Patch.
Code:
diff --git a/src/com/android/contacts/ContactsListActivity.java b/src/com/android/contacts/ContactsListActivity.java
index 2b74410..d0b6b94 100755
--- a/src/com/android/contacts/ContactsListActivity.java
+++ b/src/com/android/contacts/ContactsListActivity.java
@@ -178,8 +178,8 @@ public final class ContactsListActivity extends ListActivity
static final int MODE_QUERY = 60 | MODE_MASK_NO_FILTER;
/** Run a search query in PICK mode, but that still launches to VIEW */
static final int MODE_QUERY_PICK_TO_VIEW = 65 | MODE_MASK_NO_FILTER | MODE_MASK_PICKER;
-
- static final int DEFAULT_MODE = MODE_ALL_CONTACTS;
+ //Geesun
+ static final int DEFAULT_MODE = MODE_ALL_CONTACTS|MODE_MASK_SHOW_PHOTOS;
/**
* The type of data to display in the main contacts list.
@@ -1973,6 +1973,13 @@ public final class ContactsListActivity extends ListActivity
photo = BitmapFactory.decodeByteArray(photoData, 0,
photoData.length);
mBitmapCache.put(pos, new SoftReference<Bitmap>(photo));
+ //Geesun
+ if(photo == null){
+ int id = cursor.getInt(ID_COLUMN_INDEX);
+ Uri uri = ContentUris.withAppendedId(People.CONTENT_URI, id);
+ photo = People.loadContactPhoto(context, uri, R.drawable.ic_contact_list_picture, null);
+
+ }
} catch (OutOfMemoryError e) {
// Not enough memory for the photo, use the default one instead
photo = null;
--------------------------------------------------------------------
OLD OP.
I am trying to modify the Contacts.apk source to get the Photo's
contact in the Contacts tab, (In Eclair this is already implemented, I
would like to have it in Donuts too).
In the Favorites tab the photos are already there, so tweak it must be simple.
This is what I get until now:
Contacts.apk source file ContactsListActivity.java
ORIGINAL
1653 private boolean mDisplayPhotos = false;
1654 private SparseArray<SoftReference<Bitmap>> mBitmapCache = null;
...
1658 super(context, R.layout.contacts_list_item, null, false);
CHANGED BY ME
1653 private boolean mDisplayPhotos = true;
1654 private SparseArray<SoftReference<Bitmap>> mBitmapCache = new SparseArray<SoftReference<Bitmap>>();
...
1658 super(context, R.layout.contacts_list_item_photo, null, false);
After this I get a GENERIC ICON with the droid on the left of the
contacts name.
That is all I get, I am not good in Java Programming...
If you want to get involved this is the code...
http://android.git.kernel.org/?p=pl...70d24e7686305a7570d1300e738744e980384;hb=HEAD
Any help?
Xenio
Hi,
I've tried to set this another way using:
132 static final int MODE_ALL_CONTACTS = 10 | MODE_MASK_SHOW_PHOTOS;
133 /** Show all contacts with phone numbers, sorted alphabetically */
Same effect. I'll take a look on that Interesting subject
logcat shows:
D/skia ( 669): --- SkImageDecoder::Factory returned null
xenio2000 said:
CHANGED BY ME
1653 private boolean mDisplayPhotos = true;
1654 private SparseArray<SoftReference<Bitmap>> mBitmapCache = new SparseArray<SoftReference<Bitmap>>();
...
1658 super(context, R.layout.contacts_list_item_photo, null, false);
Click to expand...
Click to collapse
So, at line 1654 you created an new instance so that it's not null...
But I'm not sure what 1658 does?
Since it already shows the pics in the Favorites tab, there should be a line that pulls the pic correctly...maybe you can look there for inspiration? I don't have a build environment or I'd probably look at helping with this.
**EDIT**
I misunderstood the orignal post
1Way
1wayjonny said:
**EDIT**
I misunderstood the orignal post
1Way
Click to expand...
Click to collapse
They are talking about the main contacts tab in the donut builds. there is no picture displayed, until you select the contact.
TemporalShadows said:
So, at line 1654 you created an new instance so that it's not null...
But I'm not sure what 1658 does?
Since it already shows the pics in the Favorites tab, there should be a line that pulls the pic correctly...maybe you can look there for inspiration? I don't have a build environment or I'd probably look at helping with this.
Click to expand...
Click to collapse
I'm pretty sure that problem is with database query.
For those that haven't a build enviroment... you can take a look at the java source here:
http://android.git.kernel.org/?p=pl...70d24e7686305a7570d1300e738744e980384;hb=HEAD
I hope you can help us.
Thanks,
Xenio
@Akirah
I think you are right check from lines 187 to 217
Code:
187 static final String[] CONTACTS_PROJECTION = new String[] {
188 People._ID, // 0
189 NAME_COLUMN, // 1
190 People.NUMBER, // 2
191 People.TYPE, // 3
192 People.LABEL, // 4
193 People.STARRED, // 5
194 People.PRIMARY_PHONE_ID, // 6
195 People.PRIMARY_EMAIL_ID, // 7
196 People.PRESENCE_STATUS, // 8
197 SORT_STRING, // 9
198 };
199
200 static final String[] SIMPLE_CONTACTS_PROJECTION = new String[] {
201 People._ID, // 0
202 NAME_COLUMN, // 1
203 };
204
205 static final String[] STREQUENT_PROJECTION = new String[] {
206 People._ID, // 0
207 NAME_COLUMN, // 1
208 People.NUMBER, // 2
209 People.TYPE, // 3
210 People.LABEL, // 4
211 People.STARRED, // 5
212 People.PRIMARY_PHONE_ID, // 6
213 People.PRIMARY_EMAIL_ID, // 7
214 People.PRESENCE_STATUS, // 8
[B] 215 "photo_data", // 9[/B]
216 People.TIMES_CONTACTED, // 10 (not displayed, but required for the order by to work)
217 };
Yeah,
I've seen it and tried to modify columns columns order to add photo to it, but not luck.
It compiles, but photo is not retrieved.
Looks like someone did it before it is included in some modded rom.
I am looking for it now, we have to find it.
Xenio
try this one. has photos. base of cm's source.
http://kugou.me/Contacts.apk
Yes it works... now we have to found how it was done and close the thread.
I'll check the cyanogen github.
xenio2000 said:
Yes it works... now we have to found how it was done and close the thread.
I'll check the cyanogen github.
Click to expand...
Click to collapse
I have just take a look at the ContactsListActivity.java source:
You should pay attention here:
Code:
static final String[] CONTACTS_PROJECTION = new String[] {
People._ID, // 0
NAME_COLUMN, // 1
People.NUMBER, // 2
People.TYPE, // 3
People.LABEL, // 4
People.STARRED, // 5
People.PRIMARY_PHONE_ID, // 6
People.PRIMARY_EMAIL_ID, // 7
People.PRESENCE_STATUS, // 8
SORT_STRING, // 9
};
and
Code:
static final String[] STREQUENT_PROJECTION = new String[] {
People._ID, // 0
NAME_COLUMN, // 1
People.NUMBER, // 2
People.TYPE, // 3
People.LABEL, // 4
People.STARRED, // 5
People.PRIMARY_PHONE_ID, // 6
People.PRIMARY_EMAIL_ID, // 7
People.PRESENCE_STATUS, // 8
"photo_data", // 9
People.TIMES_CONTACTED, // 10 (not displayed, but required for the order by to work)
};
The second one has the "photo_data" column . Please try yourself because I cannot build the Contacts app now.
bpmtri said:
The second one has the "photo_data" column . Please try yourself because I cannot build the Contacts app now.
Click to expand...
Click to collapse
I've tried to add new column, and to move columns. Doesn't work.
Standard cyanogen one doesn't seem to have photos at least from what I see in sourcecode, changes are done to BT contact send.
akirah said:
I've tried to add new column, and to move columns. Doesn't work.
Standard cyanogen one doesn't seem to have photos at least from what I see in sourcecode, changes are done to BT contact send.
Click to expand...
Click to collapse
Hi akirah,
Please make sure you have:
Code:
static final int MODE_ALL_CONTACTS = 10 | MODE_MASK_SHOW_PHOTOS;
to show the default picture, and
Code:
static final String[] CONTACTS_PROJECTION = new String[] {
People._ID, // 0
NAME_COLUMN, // 1
People.NUMBER, // 2
People.TYPE, // 3
People.LABEL, // 4
People.STARRED, // 5
People.PRIMARY_PHONE_ID, // 6
People.PRIMARY_EMAIL_ID, // 7
People.PRESENCE_STATUS, // 8
"photo_data", // 9
SORT_STRING, // 10
};
to have "Photo data". "photo_data" column must have index = 9.
I just try to read the source code and suggest you. Hope this help you to make it work.
Yep last Cyanogen Mod from github does not have Photos I misunderstood the x140d4n post
Ok the Contacts.apk posted from x140d4n works and it came from here a Chinese site...thanks for it.
http://www.kugou.me/
You can translate with google...
Looks like the mod with the picture is added by geesun (I think) to the Cyanogen Mod and this is the mod cm 4.2.3.1-geesunmod, if you download it and extract the Contacts.apk it works very well a little slow the first time but it is nice.
I did'n found this tweak here in XDA, another site that x140d4n give to me is http://www.androidin.net
I did't found any source... just the zip with the apk...
Xenio
REMOVE THE .ZIP EXTENSION
bpmtri said:
to have "Photo data". "photo_data" column must have index = 9.
I just try to read the source code and suggest you. Hope this help you to make it work.
Click to expand...
Click to collapse
This is exactly what I've tried. But still photo is not retrieved from database.
xenio2000 said:
Yep last Cyanogen Mod from github does not have Photos I misunderstood the x140d4n post
Ok the Contacts.apk posted from x140d4n works and it came from here a Chinese site...thanks for it.
http://www.kugou.me/
You can translate with google...
Looks like the mod with the picture is added by geesun (I think) to the Cyanogen Mod and this is the mod cm 4.2.3.1-geesunmod, if you download it and extract the Contacts.apk it works very well a little slow the first time but it is nice.
I did'n found this tweak here in XDA, another site that x140d4n give to me is http://www.androidin.net
I did't found any source... just the zip with the apk...
Xenio
REMOVE THE .ZIP EXTENSION
Click to expand...
Click to collapse
i installed it but it didnt work force close on contacts i delete original Contacts.apk and dalvik-cache and rebooted
any ideas? im tryin to get original one and still having issues lol
johnnylicious said:
i installed it but it didnt work force close on contacts i delete original Contacts.apk and dalvik-cache and rebooted
any ideas? im tryin to get original one and still having issues lol
Click to expand...
Click to collapse
You get FC's when you push original one ?
akirah said:
You get FC's when you push original one ?
Click to expand...
Click to collapse
well im using the eclair theme 2.0 over cyan's 4.3.2.1 i tried pushing the original themed one back into system/app and still get error
hmm

[APP] Zune software remote control

Instructions + download: http://forum.xda-developers.com/showpost.php?p=17254652&postcount=7
I have finally found a way to control the Zune software running on Windows. The Zune API is horrible so there are few(if any) programs that interface with the software externally. Today I came across the SendMessage method. The idea is your Android device is a big remote control for the Zune software. If you already have a media remote then this application isn't needed. I only have a remote on my laptop, not desktop so that's why I'm bothering to write it. I thought I would share it on XDA for free.
http://pastebin.com/C85isGsW - that was my test program. When I opened it my music paused(yay!).
Anyways this will be a 2-part system. The Windows app will run in the background(either as a service or in the system tray) and listen on some random TCP port for a connection. It will be relatively small, using less than 50MB RAM. This one uses 27MB right now(yes, C# is bloated).
The Android app will simply connect over the wifis or even over the internet(just remember to forward ports) and after a quick handshake it will be able to send and receive data from the service/app in tray. First I'll start with simple play/pause buttons and a volume slider and eventually I'll add all the interfaces listed here: http://msdn.microsoft.com/en-us/library/ms646275(v=vs.85).aspx
Step 1: install service or open the Windows program
Step 2: type computer IP in android app
Step 3: press play/pause or control volume etc. It will save the IP so you don't have to keep typing it in. In fact I will have a dropdown list so you can select different computers(HTPC, basement computer etc.)
I just started writing the program so it will by done by the end of the weekend. Figured I would create the thread since I know it will work.
inb4 zune sucks
Interested in seeing this.
Sent from my Transformer TF101 using XDA Premium App
yes dude yes!!! imso amped for this! thanks so much.
OK I got the windows side app 95% done... started the Android version and well.. I'm a noob. Looks like honeycomb makes you interface with TCP in a separate thread...
Windows server code:
Code:
hile (stop != 1)
{
// Perform a blocking call to accept requests.
// You could also user server.AcceptSocket() here.
TcpClient client = server.AcceptTcpClient();
data = null;
// Get a stream object for reading and writing
NetworkStream stream = client.GetStream();
int i;
// Loop to receive all the data sent by the client.
while ((i = stream.Read(bytes, 0, bytes.Length)) != 0)
{
// Translate data bytes to a ASCII string.
data = System.Text.Encoding.ASCII.GetString(bytes, 0, i);
//Console.WriteLine("Received: {0}", data);
if (Convert.ToString(data).CompareTo("PP") == 0) SendMessageW(hwnd, WM_APPCOMMAND, hwnd, (IntPtr)APPCOMMAND_MEDIA_PLAY_PAUSE);
if (Convert.ToString(data).CompareTo("UP") == 0) SendMessageW(hwnd, WM_APPCOMMAND, hwnd, (IntPtr)APPCOMMAND_VOLUME_UP);
if (Convert.ToString(data).CompareTo("DN") == 0) SendMessageW(hwnd, WM_APPCOMMAND, hwnd, (IntPtr)APPCOMMAND_VOLUME_DOWN);
if (Convert.ToString(data).CompareTo("PR") == 0) SendMessageW(hwnd, WM_APPCOMMAND, hwnd, (IntPtr)APPCOMMAND_MEDIA_PREVIOUSTRACK);
if (Convert.ToString(data).CompareTo("NE") == 0) SendMessageW(hwnd, WM_APPCOMMAND, hwnd, (IntPtr)APPCOMMAND_MEDIA_NEXTTRACK);
// Process the data sent by the client.
//device.AudioEndpointVolume.MasterVolumeLevelScalar = (Convert.ToInt64(data) / 100.0f);
//byte[] msg = System.Text.Encoding.ASCII.GetBytes(data);
//byte[] msg = System.Text.Encoding.ASCII.GetBytes("Successfully set to " + data);
// Send back a response.
//stream.Write(msg, 0, msg.Length);
//Console.WriteLine("Sent: {0}", data);
}
// Shutdown and end connection
client.Close();
}
}
What needs to happen to connect to the server(client code)
Code:
static void Connect(String server, String message)
{
try
{
// Create a TcpClient.
// Note, for this client to work you need to have a TcpServer
// connected to the same address as specified by the server, port
// combination.
Int32 port = 13000;
TcpClient client = new TcpClient(server, port);
// Translate the passed message into ASCII and store it as a Byte array.
Byte[] data = System.Text.Encoding.ASCII.GetBytes(message);
NetworkStream stream = client.GetStream();
// Send the message to the connected TcpServer.
stream.Write(data, 0, data.Length);
// Close everything.
stream.Close();
client.Close();
}
catch (ArgumentNullException e)
{
MessageBox.Show("ArgumentNullException: " + e.ToString());
}
catch (SocketException e)
{
MessageBox.Show("SocketException: " + e.ToString());
}
}
So I would call Connect("192.168.1.40", "PP"); to pause/play the server(desktop running Zune)
Code:
package com.pwn.control;
import android.app.Activity;
import java.io.*;
import java.net.*;
import android.widget.*;
import android.os.Bundle;
import android.os.StrictMode;
public class ControlActivity extends Activity {
/** Called when the activity is first created. */
@Override
public void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
tv = new TextView(this);
tv.setText("HELLO WORLD");
setContentView(tv);
run();
}
TextView tv;
public void run()
{
new Thread(new Runnable() { public void run() {
Socket socket;
try
{
InetAddress serverAddr = InetAddress.getByName("192.168.1.40");
socket = new Socket("192.168.1.40", 13000);
//socket.connect();
DataOutputStream out = new DataOutputStream(socket.getOutputStream());
out.writeBytes("PP");
//PrintWriter out = new PrintWriter(new BufferedWriter(new OutputStreamWriter(socket.getOutputStream())), true);
//out.println("PP");
socket.close();
}
catch (Exception e)
{
tv.setText(e.toString());
//setContentView(R.layout.main);
}
}
} ).start();
}
}
Unfortunately the above code doesn't work. Kinda stuck lol... maybe someone knows more about writing android apps than I do.
http://www.youtube.com/watch?v=PMjNrd1d4FM
Got it working with an ASP site...
now the annoying part... I tried setting it up with a default IIS instance and it doesn't have permissions to use the user32.dll!!! I tried forced impersonation and tons of different tricks but for some reason it isn't getting as high permissions as the ASP.NET debugging server.
So I need to either fix the android app so it will communicate with the service, or I need to find a way to get the IIS instance enough permissions to interact with the desktop. I did set the IIS Admin service to "interact with desktop" but nothing happened.
I also tried setting up Apache 2.2 with mod_asp installed but it has the same result... blocked from interacting.
Ok I got it working but it's really really makeshift right now...
ASP website --> loopback on port 13000 --> C# app(that will actually interface with the Zune software)
I couldn't make the API call from the C# code in the ASP site because IIS doesn't have enough permissions. So since my only drawback before was that I couldn't communicate between .NET TcpListener and Java, I can just use the ASP site to make the TcpClient connection.
The good thing is you can access this interface from anything with a web browser. Just make http://computer-ip:port/ZuneControl a favorite on any device and you can control Zune from it.
http://www.youtube.com/watch?v=haVLCOY0l6U
If you're really eager to try the alpha build with IIS that's fine...
Just set up IIS like I do in the video and add port 13000 to your inbound and outbound firewall rule. I'll work on the UI when I get some time next weekend.
Here is the code for the C# app. http://pastebin.com/08kCjKQW
The web code is in the RAR file. I just copied and pasted out of that pastebin with some extra buttons.
http://tunerspotter.com/\dropbox\misc\ZuneControl.rar
In that ZuneControl folder, ZuneControl.exe is the app. Click start, then minimize it after you set up IIS. It will work for Apache installations also. I have Apache on port 82. http://sourceforge.net/projects/mod-aspdotnet/
Instruction video: http://www.youtube.com/watch?v=ClCQhmQxC7Q
Well i've been using the web interface for a few days and it kicks ass. Does exactly what i want. I can be in bed and change songs/volume from another tab in Opera.
Next weekend Ill see if i can get the program to listen on port 81 as a web service so instead of setting up IIS or apache all you have to do is open the app and click start(then minimize it)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
hey are you still working on this? I would really love something like this!
well i gave up on the app and just turned it into a ASP site + windows application. so yeah i've been using it for a few months. works great, i can pull up on any web capable device and adjust my music. Whether it's my zune, tablet, computer, or phone, i can adjust volume, go back/next, and pause/play from any device. i set up port forwarding with dyndns.org so it works over 3G

How to Edit Frequencies in Exynos4412?

I've built a custom kernel for my Galaxy Tab 10.1 The link is in my signature. When I wanted to add custom frequencies to it, there was a very informative post that told me how to edit the frequency table to make the new clock speeds on tegra2 come out right and also how to edit the voltage tables. At least on the tegra2 it involved editing tegra2_clocks.c where you had to change the pll_x frequency table, change the pll_x max speed, virtual cpu max speed, sku max speed, and add an additional frequency table for your new clock speeds. The voltage was done in tegra2_dvfs.c where you added changed the min/max voltages accordingly and added in your new frequencies there.
I have looked all over the internet for a similar guide for my I9300. The cpufreq-4x12 looks nothing like the tegra one. It appears that every frequency has an entry in clkdiv_cpu0_4412 (for the S3 at least) with dividers for cryptic values like "divcore" "divcorem0". I've tried doing a grep search in the kernel source and couldn't find those names mentioned anywhere. There also appears to be another clkdiv_cpu1_4412 with even more cryptic values which don't appear in grep either. Then of course, there's yet another cryptic table that each frequency seems to go to called "apll_pms". It appears as the voltages go to the asv tables but how you accommodate new frequencies is beyond me. The L0,L1.. etc labels don't appear to follow the conventions stated earlier where 1800MHz is labelled L0 at the top but L-2 later.
I realize that many experienced developers probably take this information for granted and I wouldn't be asking for this if it was available somewhere else. The documentation folder in the kernel doesn't provide any information either.
Please help a startup enthusiast As a beginner, I've typically answered similar how to questions on my own thread in the beginning, when other people were interested in how to get their hands dirty with modifications. (Although now, people just seem to be interested in the final product which is fine too.)
Each divider value represents the real divider minus 1. So a value of 7 divides by 8. Populate the divider talbes with new entries like that. The registers have a limit so see the register maps in /mach/regs-clock.h. The dividers divide the final CPU clock. What values you give the dividers is up to you to decide.
The CPU clock is decided by the PLL as you saw. PMS decides the PLL frequency. The source quartz runs at 24MHz. The frequency is calculated by (P * Xtal) / (M << S).
Example 500MHz: ((125<<16)|(3<<8)|(0x1)), the format is ((P<<16)|(M<<8)|(S)).
(P * Xtal) = 125*24 MHz = 3000MHz
(M << S) = 3 << 1 = 6
End result is 3000MHz / 6 = 500MHz.
That's all you need to know. Alternatively, just copy what other devs have already done. Be careful with the Lx levels when you add new ones, you need shift all the existing ones throughout the file.
AndreiLux said:
Each divider value represents the real divider minus 1. So a value of 7 divides by 8. Populate the divider talbes with new entries like that. The registers have a limit so see the register maps in /mach/regs-clock.h. The dividers divide the final CPU clock. What values you give the dividers is up to you to decide.
The CPU clock is decided by the PLL as you saw. PMS decides the PLL frequency. The source quartz runs at 24MHz. The frequency is calculated by (P * Xtal) / (M << S).
Example 500MHz: ((125<<16)|(3<<8)|(0x1)), the format is ((P<<16)|(M<<8)|(S)).
(P * Xtal) = 125*24 MHz = 3000MHz
(M << S) = 3 << 1 = 6
End result is 3000MHz / 6 = 500MHz.
That's all you need to know. Alternatively, just copy what other devs have already done. Be careful with the Lx levels when you add new ones, you need shift all the existing ones throughout the file.
Click to expand...
Click to collapse
I'm a bit confused by what M << S means. From lookig at the example it looks like the formula is: P * 24 / ( M * 2^s)? Also, I'm assuming the voltage tables don't have to be touched. Thanks so much for the information. And... what fun would it be if you did a straight up copy and paste? :cyclops:
Ummm that's a bit-wise left-shift operation. And yes you also need to add entries in the voltage table.
AndreiLux said:
Be careful with the Lx levels when you add new ones, you need shift all the existing ones throughout the file.
Click to expand...
Click to collapse
And in any other files that reference levels... Namely any that contains a level-based DVFS lock.
I think much of Samsung's newer code does frequency-based locks with a frequency-to-level lookup, but in older 4210 kernels, there were lots of locks that called out specific levels. Some of these locks were in throttling code. Levels go from high freq to low freq.
So if L2 was originally 800 MHz, and L2 is now 1000 MHz, and thermal throttling code locks to a minimum level (maximum frequency) of L2... Whoops, now the thermal throttling is broken.
Hi again,
For some reason, the exynos4 sources seem to be much more fussy than the galaxy tab 10.1 tegra2 sources I messed with in the summer. Right of the bat (with no modifications), it refuses to compile giving me issues in the file arch/arm/mvp/mvpkm/mvpkm_main.o. I haven't touched anything or made any changes yet. I downlaoded the latest sources from Samsung. I tried switching toolchains and I get 1 of 2 errors. With an older toolchain I get
/tmp/ccC3yZT8.s:4865: Error: unknown pseudo-op: `.arch_extension'.
With a newer toolchain I get an error about making a pointer to int conversion without a cast. Wow, truly unbelievable!!!??? I just want to make a baseline run, haven't touched a character of code and it refuses. I tried compiling CM10.1's kernel (also with no modifications) but for some reasons the graphics are Pentium 1 slow. ADB shell with logcat keeps saying hwcompser can't do vsync and it attempts to fake it.
I don't remember it being this hard on my galaxy tab 10.1. Am I missing something obvious?
---------------------added-----------------
I got cm sources compiling correctly. I think i forgot to undo previous experiments
AndreiLux said:
Each divider value represents the real divider minus 1. So a value of 7 divides by 8. Populate the divider talbes with new entries like that. The registers have a limit so see the register maps in /mach/regs-clock.h. The dividers divide the final CPU clock. What values you give the dividers is up to you to decide.
The CPU clock is decided by the PLL as you saw. PMS decides the PLL frequency. The source quartz runs at 24MHz. The frequency is calculated by (P * Xtal) / (M << S).
Example 500MHz: ((125<<16)|(3<<8)|(0x1)), the format is ((P<<16)|(M<<8)|(S)).
(P * Xtal) = 125*24 MHz = 3000MHz
(M << S) = 3 << 1 = 6
End result is 3000MHz / 6 = 500MHz.
That's all you need to know. Alternatively, just copy what other devs have already done. Be careful with the Lx levels when you add new ones, you need shift all the existing ones throughout the file.
Click to expand...
Click to collapse
I have been meaning to thank you for this, I have not seen this information elsewhere. Could you please briefly explain how to set the values in cpufreq_clkdiv? I have noticed different kernels have different values for the same frequency, and I don't know which one is correct for me.
Example:
/*
* Clock divider value for following
* { DIVCORE, DIVCOREM0, DIVCOREM1, DIVPERIPH,
* DIVATB, DIVPCLK_DBG, DIVAPLL, DIVCORE2 }
*/
Samsung source (I believe)
/* ARM L0: 1600Mhz */
{ 0, 3, 7, 0, 6, 1, 2, 0 },
Perseus:
/* ARM L0: 1600Mhz */
{ 0, 4, 7, 0, 6, 1, 7, 0 },​
ffolkes said:
I have been meaning to thank you for this, I have not seen this information elsewhere. Could you please briefly explain how to set the values in cpufreq_clkdiv? I have noticed different kernels have different values for the same frequency, and I don't know which one is correct for me.
Example:
/*
* Clock divider value for following
* { DIVCORE, DIVCOREM0, DIVCOREM1, DIVPERIPH,
* DIVATB, DIVPCLK_DBG, DIVAPLL, DIVCORE2 }
*/
Samsung source (I believe)
/* ARM L0: 1600Mhz */
{ 0, 3, 7, 0, 6, 1, 2, 0 },
Perseus:
/* ARM L0: 1600Mhz */
{ 0, 4, 7, 0, 6, 1, 7, 0 },​
Click to expand...
Click to collapse
I don't have any exact technical explanation behind the physical CPU blocks that those auxiliary dividers are clocking.
Personally I just fired up Excel and adjusted them in to what seemed to me a reasonable curve with the rest of the frequency clocks which Samsung provided. These are the values I put in Perseus.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You could probably adjust M0 again beyond 1800 MHz to be somewhat lower.

[Guide] PHP Development on Android [25 May 2015]

Thread link
[Guide] PHP Development on Android
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
WHAT?
Yes, you can develop with PHP on your Android device, no I am not mad (yet) - not guaranteed for lifetime. This guide is just to help you starting and hopefully kicks off some discussions about this (currently) not very common opportunity.
WHY the heck...?
Well, by now it's just playing with our devices, sure. But let's face it and let's see the potential of an Android device in the future, maybe in only a few years. Do I have to boot my computer or notebook or is it more likely I just wake my smartphone or tablet and give it a power source by placing it in the stand? Either way, it also makes fun playing around by now and using a maybe older device as a low power consuming web app server.
But PHP is ridiculous, scripting for kids, security flaws, inconsistencies, ugly syntax...
PHP is one of the most important scripting languages in the web. It's not perfect, sure, but you can create really big projects like Wordpress and vBulletin and therefore also our beloved XDA. However, this is a thread about how to start PHP developing on an Android device, not about how great or how bad this programming language is.
You have a question? Post it in the thread.
You have improvements? Post it in the thread.
You know better apps? Post it in the thread.
You don't like PHP? Well, move along...
My test set up
Hardware
Android device (Samsung Galaxy S3 LTE GT-I9305, running Android 5.0.2)
Chromecast
FHD TV
USB OTG cable
USB keyboard
Software/Apps
code editor
web server with PHP support
I develop and apply the programs locally, means, code editor and server are on the same device. Uploading or managing files remotely is not not required in this case.
Optional and recommended accessories and apps
Hardware
Bluetooth input devices, so you can charge your device
USB cable to charge your device, you'll need it
alternatively use wireless charging if your device supports it
Software/Apps
DynDNS client
port forwarder (needs root to forward to standard port 80)
SFTP/FTPS server/client
SSH server/client
server monitor
The apps will raise the battery consumption, so for longer development sessions, use Bluetooth keyboards and mice or a BT keyboard with an integrated touchpad. Charge your device.
DynDNS client makes your device available to the internet using a simple subdomain name instead of the ip address. The port forwarder can redirect incoming HTTP requests to port 80 for example. To upload and manage your files from your Android device to a web server from your web hoster, you can use secured FTP (SFTP/FTPS) and SSH clients or use servers, if you upload from an Android to an Android device.
Code editors
To write code, you'll need code editors and some of them are quite good for doing that. Try some of these following, if you don't have any yet.
AIDE Web - Html,Css,JavaScript - paid: IAP
Updated: December 11, 2014
Current Version: 1.0.3beta
AWD - PHP/HTML/CSS/JS IDE - paid: IAP
Updated: April 30, 2015
Current Version: 0.41
XDA application thread by @divers
DroidEdit (free code editor) - paid: DroidEdit Pro (code editor))
Updated: March 03, 2015
Current Version: 1.23.0
Quoda Code Editor - paid: IAP
Updated: August 14, 2014
Current Version: 1.0.1.2
Turbo Editor ( Text Editor ) - paid: IAP, Turbo Editor PRO (Text Editor)
Updated: May 15, 2015
Current Version: 2.1
XDA application thread by @Vlad Mihalachi
Web servers with PHP support
Some web servers with integrated PHP interpreter are listed below. A lot of those on Google Play have a free trial period, so try before you buy.
Down below you find three free web servers with PHP interpreter. I also checked which server software they're running and it's version, as well as the version of the PHP interpreter.
AndroPHP
Updated: February 8, 2013
Current Version: 1.2.0
Web server: Lighttpd 1.4.29
PHP version: 5.4.8
View the complete output of phpinfo() as PDF (196 kB)
Palapa Web Server
Updated: August 26, 2014
Current Version: 2.1.1
Web server: Lighttpd 1.4.32
PHP version: 5.5.15
View the complete output of phpinfo() as PDF (291 kB)
Server for PHP
Updated: May 24, 2015
Current Version: 1.7.0
Web server: PHP 5.6.9 Development Server
PHP version: 5.6.9
View the complete output of phpinfo() as PDF (361 KB)
This one is basically a server collection, tons of servers for all your needs. Slightly outdated, no update for quite a long time, therefore an old PHP version. Hopefully the app gets new and updated servers. Trial version available.
Servers Ultimate (7 days trial) - paid: Servers Ultimate Pro
Updated: June 16, 2014
Current Version: 6.3.10
Web server: Lighttpd
PHP version: 5.4.8
View the complete output of phpinfo() as PDF (197 kB)
XDA application thread by @Themuzz
Web server monitor
To monitor your mobile web server, I recommend to set up a server monitor app, like Monyt - Server Monitor. The app itself is a client, pulling information from a script you have to place on your server. Just for the records, it's a PHP script.
Monyt - Server Monitor
Updated: March 15, 2013
Current Version: 1.1.4
XDA application thread by @evilsocket
Install Monyt - Server Monitor from Google Play store (on any Android device, this is basically only the client)
Paste the PHP code into a *.php file (link in the Google Play description) (on the server)
Configure the app, at least enter the URL to the PHP script
The monitor app can also be installed on your mobile server.
Some screenshots made on a Sony Xperia Z3
Current link and content of the PHP script: http://www.monyt.net/monyt-server-script.txt
PHP:
<?php
error_reporting(0);
define( "MONYT_SCRIPT_VERSION", "1.0.1" );
if( isset($_GET['version'] ) )
{
die( MONYT_SCRIPT_VERSION );
}
else if( isset($_GET['check']) )
{
$aCheck = array
(
'monyt' => MONYT_SCRIPT_VERSION,
'distro' => '',
'kernel' => '',
'cpu' => '',
'cores' => ''
);
$sDistroName = '';
$sDistroVer = '';
foreach (glob("/etc/*_version") as $filename)
{
list( $sDistroName, $dummy ) = explode( '_', basename($filename) );
$sDistroName = ucfirst($sDistroName);
$sDistroVer = trim( file_get_contents($filename) );
$aCheck['distro'] = "$sDistroName $sDistroVer";
break;
}
if( !$aCheck['distro'] )
{
if( file_exists( '/etc/issue' ) )
{
$lines = file('/etc/issue');
$aCheck['distro'] = trim( $lines[0] );
}
else
{
$output = NULL;
exec( "uname -om", $output );
$aCheck['distro'] = trim( implode( ' ', $output ) );
}
}
$cpu = file( '/proc/cpuinfo' );
$vendor = NULL;
$model = NULL;
$cores = 0;
foreach( $cpu as $line )
{
if( preg_match( '/^vendor_id\s*:\s*(.+)$/i', $line, $m ) )
{
$vendor = $m[1];
}
else if( preg_match( '/^model\s+name\s*:\s*(.+)$/i', $line, $m ) )
{
$model = $m[1];
}
else if( preg_match( '/^processor\s*:\s*\d+$/i', $line ) )
{
$cores++;
}
}
$aCheck['cpu'] = "$vendor, $model";
$aCheck['cores'] = $cores;
$aCheck['kernel'] = trim(file_get_contents("/proc/version"));
die( json_encode($aCheck) );
}
$aStats = array( 'monyt' => MONYT_SCRIPT_VERSION );
$aStats['uptime'] = trim( file_get_contents("/proc/uptime") );
$load = file_get_contents("/proc/loadavg");
$load = explode( ' ', $load );
$aStats['load'] = $load[0].', '.$load[1].', '.$load[2];
$memory = file( '/proc/meminfo' );
foreach( $memory as $line )
{
$line = trim($line);
if( preg_match( '/^memtotal[^\d]+(\d+)[^\d]+$/i', $line, $m ) )
{
$aStats['total_memory'] = $m[1];
}
else if( preg_match( '/^memfree[^\d]+(\d+)[^\d]+$/i', $line, $m ) )
{
$aStats['free_memory'] = $m[1];
}
}
$aStats['hd'] = array();
foreach( file('/proc/mounts') as $mount )
{
$mount = trim($mount);
if( $mount && $mount[0] == '/' )
{
$parts = explode( ' ', $mount );
if( $parts[0] != $parts[1] )
{
$device = $parts[0];
$folder = $parts[1];
$total = disk_total_space($folder) / 1024;
$free = disk_free_space($folder) / 1024;
if( $total > 0 )
{
$used = $total - $free;
$used_perc = ( $used * 100.0 ) / $total;
$aStats['hd'][] = array
(
'dev' => $device,
'total' => $total,
'used' => $used,
'free' => $free,
'used_perc' => $used_perc,
'mount' => $folder
);
}
}
}
}
$ifname = NULL;
if( file_exists('/etc/network/interfaces') )
{
foreach( file('/etc/network/interfaces') as $line )
{
$line = trim($line);
if( preg_match( '/^iface\s+([^\s]+)\s+inet\s+.+$/', $line, $m ) && $m[1] != 'lo' )
{
$ifname = $m[1];
break;
}
}
}
else
{
foreach( glob('/sys/class/net/*') as $filename )
{
if( $filename != '/sys/class/net/lo' && file_exists( "$filename/statistics/rx_bytes" ) && trim( file_get_contents("$filename/statistics/rx_bytes") ) != '0' )
{
$parts = explode( '/', $filename );
$ifname = array_pop( $parts );
}
}
}
if( $ifname != NULL )
{
$aStats['net_rx'] = trim( file_get_contents("/sys/class/net/$ifname/statistics/rx_bytes") );
$aStats['net_tx'] = trim( file_get_contents("/sys/class/net/$ifname/statistics/tx_bytes") );
}
else
{
$aStats['net_rx'] =
$aStats['net_tx'] = 0;
}
die( json_encode( $aStats ) );
?>
Reserved
Bump... 1 month online and 181 views but no reaction
Somewhere a PHP developer... or a somehow interested one in any kind of coding on Android... or at least someone who heard about PHP or Android?
Hellow, i have been developing php on my android since 2013
The app that I used was AndroPHP but now is off the playStore
Also i have found an error on the Palapa Web Server on the moto g since it can't install the services and is useless to my client since he is buying moto g as the main device, I have a nexus 6 and an Intel tablet and i dont have this problem
I think i have the apk of AndroPhp somewhere in case someone need it
atondo27 said:
Hellow, i have been developing php on my android since 2013
The app that I used was AndroPHP but now is off the playStore
Also i have found an error on the Palapa Web Server on the moto g since it can't install the services and is useless to my client since he is buying moto g as the main device, I have a nexus 6 and an Intel tablet and i dont have this problem
I think i have the apk of AndroPhp somewhere in case someone need it
Click to expand...
Click to collapse
Thanks for your post. Developing PHP on Android since 2013 is quite a long time, but obviously it was possible. Do you still develop on Android and what's your setup like keyboard, mouse, monitor etc.?
I think I'll just remove the Palapa Web Server, which was removed recently from the Play Store. Can you suggest other code editors or development environments/servers?
atondo27 said:
Hellow, i have been developing php on my android since 2013
The app that I used was AndroPHP but now is off the playStore
Also i have found an error on the Palapa Web Server on the moto g since it can't install the services and is useless to my client since he is buying moto g as the main device, I have a nexus 6 and an Intel tablet and i dont have this problem
I think i have the apk of AndroPhp somewhere in case someone need it
Click to expand...
Click to collapse
Hi, also noticed that the amazing small and free Androphph is no longer on the playstore. Any ideas as to why it was removed? To be honest that app was rock solid in php/mysql.
ProjectER said:
Hi, also noticed that the amazing small and free Androphph is no longer on the playstore. Any ideas as to why it was removed? To be honest that app was rock solid in php/mysql.
Click to expand...
Click to collapse
I have been strugling with Androphp and Lolipop on the Moto G. Its been like 1 year since it was removed.
you can download the apk from here:
***.apk4fun.com/apps/com.ayansoft.androphp/
www
I'm using that version on some deployments

[GUIDE] Create “deathless” Android application: Protected from removal and stop

Author: Apriorit (@andruwik777, Driver Development Team)
Some types of applications require that the end users can not be able to remove or at least stop the application. For example, all types of Parental Controls, Data Leak Prevention, and applications with similar concepts should work on devices regardless of the user’s intentions. On the other hand, when trying to search proven solutions for implementing such applications, we cannot find some comprehensive answers in the Internet. This article describes one of the possible solutions.
Intro
Though, there are individual solutions for the "Disable force stop and uninstall button on Android" tasks, but in order to activate these buttons, you simply need to perform the user’s actions in reverse order.
As for the task of creation of an unkillable application, there are opinions that it cannot be supported by the concept of Android (1, 2, 3), because the basic idea of this OS is to give the user permission to work with his device as he wishes.
However, we are going to consider one of the ways to create an application that can be stopped or removed only by the user (Admin), who installed it.
The task
Appearance of the application
Task: Create the TryStopOrUninstallMe application.
After the application start and security policy acceptance, within a 10 seconds timeout, application displays the information that it successfully works (Toast with the “Ooops! Try to kill me ” text).
If you stop the service, it will be restarted no later than in 2 seconds (by timeout).
The ForceStop and Uninstall buttons are inactive in the application menu. When you try to activate these buttons by disabling DeviceAdministrator for the application, phone is locked. At the same time the previous user password is deleted and further calls can be made only after unlocking the phone by administrator, who knows the password.
Used technologies
Programming language: Java.
Used libraries and technologies: Android SDK.
Minimum supported version of Android: 2.2
Maximum supported version of Android: 5.0.2 (the newest one for today)
ROOT-permissions requirements on the device: not required
Testing: the application was tested on Nexus 5 with Android 5.0.1.
Pending issues
In order to keep this article short and because of the triviality of the problem, we do not consider:
1. Creation of start Activity, in which the administrator would set a master password. Instead, we have simply hardcoded it (e.g., "12345");
2. Application startup at system startup.
The general principles of the mechanism
The following approaches will be used to implement this idea:
1. Disabling the application forced stop and uninstall will be implemented using Device Administration API. Although it is designed for a little bit different purposes (some of which will be shown later), we’ll use it as a "deactivator" of the ForceStop and Uninstall buttons for our application (a side effect is actually what we need):
To uninstall an existing device admin application, users need to first unregister the application as an administrator.
2. There is no standard mechanism to disable the DeviceAdmin mode unlocking for user. However, we can sign up to receive event alerts on removing our application from the list of administered ones. And in this case we can:
1. Reset the current password for device locking (one of the DeviceAdmin API purposes);
2. Lock the phone (another great DeviceAdmin API feature).
3. Our application will use the service to run in the background. For the cases when user tries to stop our service (Settings -> Application -> RunningServices) we will implement auto-start using the AlarmManager system mechanism.
4. If user stop the service and have enough time to go to the application menu until the system restarts the service, then the application (not the service) stop button will be available for him.
After application is stopped, nothing can be restarted by itself. Thus, to deprive user of this chance, we will redirect him to his desktop and lock the device. While user is returning to the target Activity, system has enough time to restart the service (during my testing, it always takes 1-2 seconds).
Graphical representation
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Implementation of the mechanism
Activation of the mechanism for self-protection against the application stop and uninstall, and the service launch (MainActivity.java)
Code:
public class MainActivity extends Activity {
private static final int REQUEST_CODE = 0;
@override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_main);
try {
// Initiate DevicePolicyManager.
DevicePolicyManager policyMgr = (DevicePolicyManager) getSystemService(Context.DEVICE_POLICY_SERVICE);
// Set DeviceAdminDemo Receiver for active the component with different option
ComponentName componentName = new ComponentName(this, DeviceAdminDemo.class);
if (!policyMgr.isAdminActive(componentName)) {
// try to become active
Intent intent = new Intent(DevicePolicyManager.ACTION_ADD_DEVICE_ADMIN);
intent.putExtra(DevicePolicyManager.EXTRA_DEVICE_ADMIN, componentName);
intent.putExtra(DevicePolicyManager.EXTRA_ADD_EXPLANATION,
"Click on Activate button to protect your application from uninstalling!");
startActivity(intent);
}
} catch (Exception e) {
e.printStackTrace();
}
startService(new Intent(this, BackgroundService.class));
}
}
Everything that is done in the main (and only one) Activity is DeviceAdmin activation and service launch. It is expected that the device administrator activates the protection by pressing Activate.
Otherwise, the user can stop or remove the application in a standard way.
The service launch and its running (BackgroundService.java)
Code:
public class BackgroundService extends Service {
private static final int FIRST_RUN_TIMEOUT_MILISEC = 5 * 1000;
private static final int SERVICE_STARTER_INTERVAL_MILISEC = 1 * 1000;
private static final int SERVICE_TASK_TIMEOUT_SEC = 10;
private final int REQUEST_CODE = 1;
private AlarmManager serviceStarterAlarmManager = null;
private MyTask asyncTask = null;
@override
public IBinder onBind(Intent intent) {
return null;
}
@override
public void onCreate() {
super.onCreate();
// Start of timeout-autostarter for our service (watchdog)
startServiceStarter();
// Start performing service task
serviceTask();
Toast.makeText(this, "Service Started!", Toast.LENGTH_LONG).show();
}
private void StopPerformingServiceTask() {
asyncTask.cancel(true);
}
private void GoToDesktop() {
Intent homeIntent= new Intent(Intent.ACTION_MAIN);
homeIntent.addCategory(Intent.CATEGORY_HOME);
homeIntent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
startActivity(homeIntent);
}
private void LockTheScreen() {
ComponentName localComponentName = new ComponentName(this, DeviceAdminDemo.class);
DevicePolicyManager localDevicePolicyManager = (DevicePolicyManager)this.getSystemService(Context.DEVICE_POLICY_SERVICE );
if (localDevicePolicyManager.isAdminActive(localComponentName))
{
localDevicePolicyManager.setPasswordQuality(localComponentName, DevicePolicyManager.PASSWORD_QUALITY_NUMERIC);
}
// locking the device
localDevicePolicyManager.lockNow();
}
@override
public void onDestroy() {
// performs when user or system kills our service
StopPerformingServiceTask();
GoToDesktop();
LockTheScreen();
}
private void serviceTask() {
asyncTask = new MyTask();
asyncTask.execute();
}
class MyTask extends AsyncTask<Void, Void, Void> {
@override
protected Void doInBackground(Void... params) {
try {
for (;;) {
TimeUnit.SECONDS.sleep(SERVICE_TASK_TIMEOUT_SEC);
// check if performing of the task is needed
if(isCancelled()) {
break;
}
// Initiating of onProgressUpdate callback that has access to UI
publishProgress();
}
} catch (InterruptedException e) {
e.printStackTrace();
}
return null;
}
@override
protected void onProgressUpdate(Void... progress) {
super.onProgressUpdate(progress);
Toast.makeText(getApplicationContext(), "Ooops!!! Try to kill me :)", Toast.LENGTH_LONG).show();
}
}
// We should register our service in the AlarmManager service
// for performing periodical starting of our service by the system
private void startServiceStarter() {
Intent intent = new Intent(this, ServiceStarter.class);
PendingIntent pendingIntent = PendingIntent.getBroadcast(this, this.REQUEST_CODE, intent, 0);
if (pendingIntent == null) {
Toast.makeText(this, "Some problems with creating of PendingIntent", Toast.LENGTH_LONG).show();
} else {
if (serviceStarterAlarmManager == null) {
serviceStarterAlarmManager = (AlarmManager) getSystemService(ALARM_SERVICE);
serviceStarterAlarmManager.setRepeating(AlarmManager.ELAPSED_REALTIME,
SystemClock.elapsedRealtime() + FIRST_RUN_TIMEOUT_MILISEC,
SERVICE_STARTER_INTERVAL_MILISEC, pendingIntent);
}
}
}
}
Everything here is also relatively simple.
At the start, service activates reset mechanism. If for some reason it is stopped, PendingIntent with information about our service will be created and transferred to the AlarmManager system service indicating restart timeout.
As a task, service creates a thread, which uses an infinite loop to periodically display the "Ooops !!! Try to kill me " message on the user’s desktop.
The service “autostarter” code (ServiceStarter.java)
"Autostarter" is presented by a standard BroadcastReceiver, in which the attempt to start the service is performed.
Receiver triggers according to timeout due to the AlarmManager service, because receiver was registered at the start of the service.
If the service is already running, then the second onCreate for it will not be called. And that is exactly what we need.
Code:
public class ServiceStarter extends BroadcastReceiver {
@override
public void onReceive(Context context, Intent intent) {
Intent serviceLauncher = new Intent(context, BackgroundService.class);
context.startService(serviceLauncher);
}
}
The DeviceAdmin component code (DeviceAdminComponent.java)
We need DeviceAdmin in order to:
• prohibit user to stop or uninstall the application;
• have the possibility to change the password and lock the device if user attempts to disable the DeviceAdmin component.
Also note that the administrator password is hardcoded as the "12345" string.
The onDisableRequested code works out after the confirmation of the DeviceAdmin deactivation, but before the deactivation itself.
Code:
public class DeviceAdminComponent extends DeviceAdminReceiver {
private static final String OUR_SECURE_ADMIN_PASSWORD = "12345";
public CharSequence onDisableRequested(Context context, Intent intent) {
ComponentName localComponentName = new ComponentName(context, DeviceAdminComponent.class);
DevicePolicyManager localDevicePolicyManager = (DevicePolicyManager)context.getSystemService(Context.DEVICE_POLICY_SERVICE );
if (localDevicePolicyManager.isAdminActive(localComponentName))
{
localDevicePolicyManager.setPasswordQuality(localComponentName, DevicePolicyManager.PASSWORD_QUALITY_NUMERIC);
}
// resetting user password
localDevicePolicyManager.resetPassword(OUR_SECURE_ADMIN_PASSWORD, DevicePolicyManager.RESET_PASSWORD_REQUIRE_ENTRY);
// locking the device
localDevicePolicyManager.lockNow();
return super.onDisableRequested(context, intent);}}
Results
Thus, without using ROOT-permissions, incidents, or undocumented system features, we have managed to create the application that is practically impossible to be stopped or removed without knowing the administrator password. Although in some cases you can try to do it.
After studying this technique, we once again come to the conclusion that:
• it is almost always possible to find loopholes to circumvent any restrictions;
• it is strongly not recommended to install applications from untrusted sources. Especially if it requires the acceptance of the DeviceAdmin policies…
And what about you? Do you know a way to create a similar system?
Download sources at www(dot)apriorit(dot)com/dev-blog/355-create-deathless-android-applications.
This article is the intellectual property of Apriorit Inc. and their authors.
All materials are distributed under the Creative Commons BY-NC License.
Very, very cool.
How would you go about doing the same when a phone was rooted and/ or the user had access to ADB?
Creed14 said:
Very, very cool.
How would you go about doing the same when a phone was rooted and/ or the user had access to ADB?
Click to expand...
Click to collapse
I was going to ask the same thing. Is the protection absolute?
Sent from my SM-G920F using Tapatalk
Hello guys.
Thanks for questions and sorry for delay.
Do you ask exactly about ADB commands?
I am not sure all devices have similar behavior (but I really hope they do it), but my devices (moto X 1st gen; Android 4.4.4; both root and non-root) don't start adb demon on the device after it locks with some screen lock (pin/pattern/password).
So, you can't access to your device via adb commands if it has been previously detached from the PC.
Really? Cuz ADB is the most common suggestion for getting past a lockscreen if you forget the password. Not to mention from a softbricked phone, you should even be able to use it
You can try to overcome your own password via adb and share you results here (device brand, model, root/non-root, Android version etc.).
For the purity of the experiment I suggest to perform the next steps:
1) Unplug the device from the PC
2) Set your device screen lock password to "12345"
3) Reboot the device
4) Plug the device to the PC and try to unlock the device (or to find the correct password) using ADB.
The intrigue persists ...

Categories

Resources