Database Info

Android bug: security risk

Android bug: MMS attack affects 'one billion' phones - http://www.bbc.co.uk/news/technology-33689399
Can the patch be manually downloaded from somewhere and manually installed in rooted phones? Where?
Prefer to not go the OTA route because I am rooted and use xposed framework.

Is the patch issued out and available by Google yet?
Running Cataclysm, but don't see an update for it yet for the MMS bug.

Patched stagefright libraries for AOSP 5.1.1
For those who are interested: I patched AOSP 5.1.1 (LMY48B) with the code changes that were submitted to CM by the researcher who detected the flaw, see e.g. here. The attached archive contains the 17 (!) modified libraries. I just pushed the files to my device running stock 5.1.1 and it boots fine. I do not not have any information on whether the patch actually does what it is supposed to do or whether the new libs result in breakage somewhere else.
Update: added three additional patches to libstagefright submitted to CM by the same security researcher (jduck) as detailed here.
Update (August 14): added latest stagefright vulnerability patch as described here

From what I have read this should not really affect our devices. It is more older devices that have issues.

wangdaning said:
From what I have read this should not really affect our devices. It is more older devices that have issues.
Click to expand...
Click to collapse
Well, from what I've read/seen it appears that the Nexus 5 on 5.1.1 is fully exploitable. However, sandboxing and "address space layout randomization" make it a lot more difficult to actually achieve anything with the exploit, but the probability is not zero. We will probably know more after the hacker conference next week.
Note that I have updated the patched libraries that I attached to my previous post. In the update I added three additional patches to libstagefright that have been submitted to CM by the security researcher who has found the exploit back in April, see here

chdloc said:
For those who are interested: I patched AOSP 5.1.1 (LMY48B) with the code changes that were submitted to CM by the researcher who detected the flaw, see e.g. here. The attached archive contains the 17 (!) modified libraries. I just pushed the files to my device running stock 5.1.1 and it boots fine. I do not not have any information on whether the patch actually does what it is supposed to do or whether the new libs result in breakage somewhere else.
Edit: added three additional patches to libstagefright submitted to CM by the same security researcher (jduck) as detailed here.
Click to expand...
Click to collapse
Added the patched libs and my phone didn't blow up so that's a good sign. Too bad there isn't a good way to test it.

chdloc said:
Well, from what I've read/seen it appears that the Nexus 5 on 5.1.1 is fully exploitable. However, sandboxing and "address space layout randomization" make it a lot more difficult to actually achieve anything with the exploit, but the probability is not zero. here
Click to expand...
Click to collapse
Is the rooted nexus 5 on 4.4.4 (with xposed) any safer?
How to sandbox? Is there an app for that?
Thanks.

Anderson2 said:
Is the rooted nexus 5 on 4.4.4 (with xposed) any safer?
Click to expand...
Click to collapse
A rooted device is less secure than a non-rooted device. A device with Xposed is theoretically less secure than that.
Anderson2 said:
How to sandbox? Is there an app for that?
Click to expand...
Click to collapse
Application sandboxing is done by default in Android.

chdloc said:
For those who are interested: I patched AOSP 5.1.1 (LMY48B) with the code changes that were submitted to CM by the researcher who detected the flaw, see e.g. here. The attached archive contains the 17 (!) modified libraries. I just pushed the files to my device running stock 5.1.1 and it boots fine. I do not not have any information on whether the patch actually does what it is supposed to do or whether the new libs result in breakage somewhere else.
Update: added three additional patches to libstagefright submitted to CM by the same security researcher (jduck) as detailed here.
Click to expand...
Click to collapse
Just an fyi; if you're waiting for your rom to be updated, swapping in these patched libs will close the hole (at least according to zImperium's Stagefright check app).

FYI, added latest stagefright vulnerability patch as described here to post #3.
As before, you need to push the libraries manually to /system/lib/, followed by an adjustment of permissions (644), if required.
The latest Zimperium Stagefright Detector app, updated today, returns "not vulnerable" to the (as of today) seven known security vulnerabilities of stagefright.

chdloc said:
FYI, added latest stagefright vulnerability patch as described here to post #3.
As before, you need to push the libraries manually to /system/lib/, followed by an adjustment of permissions (644), if required.
The latest Zimperium Stagefright Detector app, updated today, returns "not vulnerable" to the (as of today) seven known security vulnerabilities of stagefright.
Click to expand...
Click to collapse
Works like a charm... until the next hole is discovered.

chdloc said:
I just pushed the files to my device running stock 5.1.1 and it boots fine. I do not not have any information on whether the patch actually does what it is supposed to do or whether the new libs result in breakage somewhere else.
Click to expand...
Click to collapse
Thanks so much for doing this! I've unzipped these to Dirty Unicorns OFFICIAL-v9.5 (5.1.1) and things appear to be booting/running OK. Zimperium detector also says everything is now good.

I am on rooted nexus 5, version 5.1.1
By manually pushing it do you mean through custom recovery or for example by using flashify app to flash the file, or directly copy pasting it?
And by adjusting permission if required, can you explain how that is done?
Thank you

+1
Are they the same patches for 4.4.4?

persianrisk said:
I am on rooted nexus 5, version 5.1.1
By manually pushing it do you mean through custom recovery or for example by using flashify app to flash the file, or directly copy pasting it?
And by adjusting permission if required, can you explain how that is done?
Thank you
Click to expand...
Click to collapse
To be safe, backup your device before proceeding.
By "pushing files to phone" I mean unpack the archive attached to the third post in this thread and manually copy the resulting files to your device by either using
adb push [...]
or (assuming you use Windows on your host machine)
Explorer
to copy all files to the "sdcard" on your phone.
Then use a file explorer on your phone, such as Root Explorer, to copy the files into place, i.e. /system/lib/
To adjust permissions, again, use the file explorer on your device to verify the "permissions" property of each of the new files. If you don't see rw-r--r, or 644, adjust the permissions appropriately.
Anderson2 said:
+1
Are they the same patches for 4.4.4?
Click to expand...
Click to collapse
No, the patched files posted in the third post of this thread were built on Android (AOSP) 5.1.1. They will not work on KitKat.

Are there similar patched files for 4.4.4?

Anderson2 said:
Are there similar patched files for 4.4.4?
Click to expand...
Click to collapse
Unless patches are forthcoming from Google, I don't think there will be. KK development is essentially dead.

Thank you very much. I followed your steps (used Root Explorer as ES File Manager did not work).
When I run Stage fright detector App by Zimperium INC. and the one by Michael Kohl it says that I am not vulnerable.
But, when I run the one by LookOut Security says I am vulnerable. Any thoughts?

OK, I guess I will move to 5.1.1. May sound easy to pros like you but it's a scary step to users like me. ?

ViPER4Android Universal Fix CM13 Android 6.0/+

So... here I will share 2 scripts I made to fix permissions for ViPER4Android running with enforced SELinux.
Why 2 scripts?
I like to keep everything open-source. Here I like to notice, Cyanogenmod is taking the wrong direction in my point of view. Every update takes out something of the customization possibilities of the user, so I am thinking of choosing new ROM. I faced real nightmare with SELinux permissions (well... SELinux is good, but Cyanogenmod doesn't provide any tool or way to manage those permissions). The more funny part is that with branch 13.0 of cyanogenmod there is no more init.d. Before someone corrects me - yeah... there is init.d, but SELinux blocks any script from executing at boot time, so don't use it. You will get your logs spammed by error messages. So... I've tried to enable init.d again, but there is no way to manage init.d to work as before. I've tried lots of different fixes from other posts, but nothing seems to work anymore, because of SELinux restrictions. I didn't managed to find any way to run scripts on boot time with root permissions in a suitable way... without messing with other system files or rebuilding build.img... so I came with those 2 solutions:
ViPER4Android (OpenSource) This is the solution I recommend to all of you. It is full open source. It doens't mess with you current system and it should work on any device/ROM. The zip file contains ViPER4Android app and driver, sepolicy-inject tool from setools-android so we can set permissions for ViPER4Android to work with enforced SELinux and Universal Init.d.
sepolicy-inject is open source equivalent to supolicy tool of Chainfire's SuperSU. I strongly recommend sepolicy-inject over supolicy, because every root closed source app should be threaten as security risk as the code can't be examined. I don't trust it esepcially when it is part of your android root manager
Universal init.d is just a application - it simulates init.d function. Imagine it like init.d on the user side... sadly enough you need to be pre-rooted to get it running.
ViPER4Android (Legacy) Maybe more of you will like this solution as it is more automated and it doesn't require any user action after installing the zip. This zip will do the same as the one above - it will install ViPER4Android removing all other DSP apps, but here come the difference - THIS SCRIPT WILL INSTALL CHAINFIRE'S SUPERSU in order to set SELinux policies for ViIPER4Android. Chainfire's SuperSU uses supolicy-tool - it let you manage SELinux policies on boot time. Chainfire's SuperSU will run everything in /system/su.d/ so again... you have init.d support - this is the real pain in the ass.
Before you download and flash, please read:
Both scripts WILL REMOVE other DSP apps from your device and will install ViPER4Android 2.4.0.1. I STRONGLY RECOMMEND TO USE SOLUTION 1 AS IT IS FULL OPEN SOURCE! Support open source software!!!
INSTRUCTIONS
ViPER4Android (OpenSource) - IN ORDER TO WORK, YOUR DEVICE MUST BE ROOTED! (Your device need to be rooted as Unversal Init.d needs root permissions in order to simulate init.d functionality)Download the .zip; Flash and reboot; Open Universal Init.d and grant root permission if asked; Reboot once more in case it don't work!
Sometimes Universal init.d is not fully initialized and needs some root permissions. That's why you need to reboot second time - then everything works. No further actions needed.
ViPER4Android (Legacy) - Just flash and reboot... but once more - SUPPORT OPEN SOURCE AND CHOOSE SOLUTION 1!!!!
For Samsung devices - if the scripts above doesn't work for you, check this post. Thx to Viper4713 for the instructions and voshchronos for solving the issue!!!
Hope to make someone happy
PS: If u want to make me happy with some beer, here you can donate a small amount. Thank you for your support.

Can i flash it on android one device running on 6.0.1

Yes. If you have any issues, please let me know!

rpangelov said:
Yes. If you have any issues, please let me know!
Click to expand...
Click to collapse
Hi, i tried to install the open source version on my kltedv running resurrection remix 6.0.1 however it is still not working. The init.d shows the kernel doesnt support init.d, and v4a drivers status is abnormal. It is also cause screen freeze and random restart. Any ideas? Your kind input would be very much appreciated. Thanks.

hiropandaz said:
Hi, i tried to install the open source version on my kltedv running resurrection remix 6.0.1 however it is still not working. The init.d shows the kernel doesnt support init.d, and v4a drivers status is abnormal. It is also cause screen freeze and random restart. Any ideas? Your kind input would be very much appreciated. Thanks.
Click to expand...
Click to collapse
I've just readed some info about the ROM you use. As it is based on Cyanogenmod I assume there is root manager builded in. Maybe it is disabled as CM root access is disabled by defaults? Look at: Settings -> Developer Options -> Root Access - turn in on by "Apps only".
Then just follow this steps:
1. Start Universal Init.d
2. Turn it off from the toggle button
3. Run test from the button on the bottom of Universal Init.d
4. If ask for root permissions, grant them!
5. Turn Universal Init.d ON from the toggle (step 2 you turned it off)
6. Restart your device and check once more!
If you still have any issues, please let me know!
Greetz,
Angelov

---------- Post added at 10:44 PM ---------- Previous post was at 10:42 PM ----------
rpangelov said:
I've just readed some info about the ROM you use. As it is based on Cyanogenmod I assume there is root manager builded in. Maybe it is disabled as CM root access is disabled by defaults? Look at: Settings -> Developer Options -> Root Access - turn in on by "Apps only".
Then just follow this steps:
1. Start Universal Init.d
2. Turn it off from the toggle button
3. Run test from the button on the bottom of Universal Init.d
4. If ask for root permissions, grant them!
5. Turn Universal Init.d ON from the toggle (step 2 you turned it off)
6. Restart your device and check once more!
If you still have any issues, please let me know!
Greetz,
Angelov
Click to expand...
Click to collapse
Hi Angelov, many thanks for your helpful instruction. I couldnt get it work with open source version. However it is working now after i install V4A legacy version. Many Thanks once again.

hiropandaz said:
---------- Post added at 10:44 PM ---------- Previous post was at 10:42 PM ----------
Hi Angelov, many thanks for your helpful instruction. I couldnt get it work with open source version. However it is working now after i install V4A legacy version. Many Thanks once again.
Click to expand...
Click to collapse
You are welcome! As I mentioned in the instructions - the legacy script will work always, but I don't like the implementation of it. I am working on new version of the opensource script, so there won't be any issues of that kind. When I am ready I will upload it here after updating my first post.
Greetz,
Angelov

This "universal" fix has been shared several months ago on XDA and a simple root shell is enough to use V4A in enforcing mode.
FYI init.d is deprecated now but it's not related to CM. Use su.d instead.

Primokorn said:
This "universal" fix has been shared several months ago on XDA and a simple root shell is enough to use V4A in enforcing mode.
FYI init.d is deprecated now but it's not related to CM. Use su.d instead.
Click to expand...
Click to collapse
Can you provide me a link to this universal fix you are talking about?
PS: init.d is deprecated in AOSP, i get that. Please read my first post once more, obviously isn't clear enough. Using su.d will result in using closed source tools to manage your Selinux policy's. As I mentioned it above - please support open source software. Every closed source root app has to be threaten as security risk. My opinion...

rpangelov said:
Can you provide me a link to this universal fix you are talking about?
PS: init.d is deprecated in AOSP, i get that. Please read my first post once more, obviously isn't clear enough. Using su.d will result in using closed source tools to manage your Selinux policy's. As I mentioned it above - please support open source software. Every closed source root app has to be threaten as security risk. My opinion...
Click to expand...
Click to collapse
Check the official V4A thread for instance. Others have opened threads in device specific forums or in the App & Games forum.
Have a look at this thread, it might interest you: http://forum.xda-developers.com/android/software-hacking/wip-selinux-capable-superuser-t3216394
FYI I do support open-source free/libre softwares, as much as I can.

Primokorn said:
Check the official V4A thread for instance. Others have opened threads in device specific forums or in the App & Games forum.
Have a look at this thread, it might interest you: http://forum.xda-developers.com/android/software-hacking/wip-selinux-capable-superuser-t3216394
FYI I do support open-source free/libre softwares, as much as I can.
Click to expand...
Click to collapse
I've seen phh's SuperUser but I didn't tried it - this is one of my tasks for this/next week.
As I've tried the most scripts, I didn't liked all the actions needed to be taken before running the .zip script in order to get viper working. I compile my own Cyanogenmod and I don't use gapps. Almost all apps I use on my device are opensource as I use F-droid as my only market (well... I need whatsapp, but I download it just from the website). Anyway... Cyanogenmod has it's own root manager builded in.... so why I need to install one more, which contains closed source tools in it? That is also the reason I don't advice people to use it... and I don't see that as solution to my problem. AOSP is opensource, but nowadays it is very dependent on some closed-source elements and I want to wipe them all out and use open source alternatives for. I hope you understand why using su.d isn't solution in this case. You just make your self and others dependent on one more closed source app, so I don't get where is the support for open source? I think that opensource script is good solution to the problem without using any closed source tool.
To make it easy as possible - just flash the .zip and you are ready to go, I included the latest version of Chainfire's SuperSu in the legacy script, so you don't need to install it before running the .zip. It looks easier to me....
Actually it is very stupid because the result of using the scripts (doesn't matter which one) you will end up with rooted device anyway (if it isnt already), but in order to get opensource script working your device has to be rooted before running the .zip, but if your device is already rooted, you just flash the zip and you are ready to go.

rpangelov said:
I've seen phh's SuperUser but I didn't tried it - this is one of my tasks for this/next week.
As I've tried the most scripts, I didn't liked all the actions needed to be taken before running the .zip script in order to get viper working. I compile my own Cyanogenmod and I don't use gapps. Almost all apps I use on my device are opensource as I use F-droid as my only market (well... I need whatsapp, but I download it just from the website). Anyway... Cyanogenmod has it's own root manager builded in.... so why I need to install one more, which contains closed source tools in it? That is also the reason I don't advice people to use it... and I don't see that as solution to my problem. AOSP is opensource, but nowadays it is very dependent on some closed-source elements and I want to wipe them all out and use open source alternatives for. I hope you understand why using su.d isn't solution in this case. You just make your self and others dependent on one more closed source app, so I don't get where is the support for open source? I think that opensource script is good solution to the problem without using any closed source tool.
To make it easy as possible - just flash the .zip and you are ready to go, I included the latest version of Chainfire's SuperSu in the legacy script, so you don't need to install it before running the .zip. It looks easier to me....
Actually it is very stupid because the result of using the scripts (doesn't matter which one) you will end up with rooted device anyway (if it isnt already), but in order to get opensource script working your device has to be rooted before running the .zip, but if your device is already rooted, you just flash the zip and you are ready to go.
Click to expand...
Click to collapse
I mentioned su.d because that's a solution with newer Android versions but I didn't say it's the best one. Using FLOSS softwares is a good move but you are using proprietary codes with CM.

Hi everyone, i flashed both of the zips with TWRP but i got an error code : 255. Any idea how to fix it ? Please help me. I'm using an x86 phone btw

trongtin64 said:
Hi everyone, i flashed both of the zips with TWRP but i got an error code : 255. Any idea how to fix it ? Please help me. I'm using an x86 phone btw
Click to expand...
Click to collapse
I think it's because your phone architecture... anyway - I will look at it today and I will let you know if I find a solution for your problem. Can you tell me which phone exactly you own ? Thank you.
Greetz, Angelov

rpangelov said:
I think it's because your phone architecture... anyway - I will look at it today and I will let you know if I find a solution for your problem. Can you tell me which phone exactly you own ? Thank you.
Greetz, Angelov
Click to expand...
Click to collapse
i'm using a zenfone 5 (A501CG) with resurrection remix mm 5.6.7

trongtin64 said:
i'm using a zenfone 5 (A501CG) with resurrection remix mm 5.6.7
Click to expand...
Click to collapse
You have a x86 architecture and this zip is probably for arm only. I guess you need the updater-binary for x86 and place it into the zip in META-INF/com/google/android.

Primokorn said:
You have a x86 architecture and this zip is probably for arm only. I guess you need the updater-binary for x86 and place it into the zip in META-INF/com/google/android.
Click to expand...
Click to collapse
Ok so i need an updater-binary for x86 right? Can i copy it from other zip to your zip? Will it work?

trongtin64 said:
Ok so i need an updater-binary for x86 right? Can i copy it from other zip to your zip? Will it work?
Click to expand...
Click to collapse
AFAIK you can use the one from a custom rom. You need a compatible custom recovery of course.

Primokorn said:
AFAIK you can use the one from a custom rom. You need a compatible custom recovery of course.
Click to expand...
Click to collapse
I'll use the one from my custom rom . Thank you for helping me :good:

It works great. thanks.
my bad for not following the instructions.

Install Xposed + Disable PIE

I repackaged the xposed zip to also install a patched system linker removing the pie requirement for binary execution. Just a cosmetic change cause modern binaries compiled for android meet the requirement anyways. I also can upload a tweaked kernel boot image if anyone is interested. You could also repackage the zip to install a tweaked build.prop or other patched binaries which could open some doorways for improvements to performance or device functionality. Install in TWRP recovery environment. Enjoy!

Does this zip contain only linker or something else ?
Can I use this in mediatek variant of e4 ?
EDIT: 4 views and only one thank . This is how XDA users being generous to someone's post right now . LOL Just pressed the download button and don't bother to press thanks button.

Francesco Franz said:
Does this zip contain only linker or something else ?
Can I use this in mediatek variant of e4 ?
EDIT: 4 views and only one thank . This is how XDA users being generous to someone's post right now . LOL Just pressed the download button and don't bother to press thanks button.
Click to expand...
Click to collapse
I didn't download it, but definitely thanked. Love seeing development for this phone. I installed regular Xposed and it worked ok. I was going to try it later when I further understood the benefits.

anthonykb said:
I repackaged the xposed zip to also install a patched system linker removing the pie requirement for binary execution. Just a cosmetic change cause modern binaries compiled for android meet the requirement anyways. I also can upload a tweaked kernel boot image if anyone is interested. You could also repackage the zip to install a tweaked build.prop or other patched binaries which could open some doorways for improvements to performance or device functionality. Install in TWRP recovery environment. Enjoy!
Click to expand...
Click to collapse
So what's the benefit to removing pie? Just curious because the regular Xposed 88.2 worked fine for me.
Update: ok I did some reading, and found that removing that requirement can prove useful in certain situations.
Because Google in the update from Android KitKat to Android Lollipop has introduced a new type of restriction that blocks the execution of non-PIE binary.
This block mainly forces the user to copy the binaries he wants to run in /system/bin, /system/xbin, or in /sbin.
This restriction stops executing some apps (also app no-root), this modified version removes that restriction.

Doesn't seem to be working on the xt1776 though the official zip doesn't work either.

wrong section mate,,,,move to guide section...

Make your 7.1.2 AOSP Device Faster (Root required)

Hey guys,
I just revisited a magisk module that came out over the summer. It's called "enable sdcardfs".
Sdcardfs is the new filesystem used by Google in the Android Oreo update which replaces the dated "FUSE" filesystem used on all previous versions of Android. To put things simply, the new filesystem reduces I/O overhead making the device snappier. You can read more about the new filesystem here:
https://www.google.com/amp/s/www.xd...fuse-replacement-will-reduce-io-overhead/amp/
When news of this broke, I was disappointed that the update wouldn't be coming to Android 7.1.2, however, fast forward a few months and there was a magisk module created to enable it on 7.1.2. When the module released in the summer, it caused many apps to crash, however, as of now it seems very stable. Here is the link to the module thread:
https://forum.xda-developers.com/apps/magisk/module-enable-sdcardfs-t3603375
A download that works with the latest version of magisk is located on page 11 of the comments. Please note that after flashing the module, you'll need to add this line to your build.prop file:
"ro.sys.sdcardfs=true"
This module may not work for everyone, but it has been working wonders for me. I am currently running the 01/30 build of Lineage alongside V19 of Gamma Kernel. Snapchat works more quickly and is so much more usable now. My keyboard also opens much more fluidly and my V20 is more snappy overall.
If anyone tries this out, please let me know of you get positive results!

I'm assuming this doesn't work in the latest stock roms?

Works on magisk 16.0

ps3hacker3 said:
I'm assuming this doesn't work in the latest stock roms?
Click to expand...
Click to collapse
I've only tested on AOSP so I'm not too sure.
It is a Magisk module though so if anything goes wrong you could always remove the module with mount-magisk (flashable zip that lets you remove modules via the TWRP file manager).

hawkeye29 said:
Works on magisk 16.0
Click to expand...
Click to collapse
Did you notice any differences in performance?

NippleSauce said:
Did you notice any differences in performance?
Click to expand...
Click to collapse
Yea I do. I did input the code into terminal and can verify its working on magisk v16.0

unable to process request due to missing initial state

I followed the instructions here to put LOS 18.1 on the Uniherz Jelly 2:
[ROM] [UNOFFICIAL] Lineage OS 17.1 | Unihertz Jelly 2
https://drive.google.com/drive/u/0/folders/1VSmj_-a1PYNzFWtUfbsDGWg4uIh-Tgkd This ROM is built using binaries from non-european (TEE) version of Jelly 2. Theoretically it should work on european (EEA). If it won't - contact me, I'll prepare ROW...
forum.xda-developers.com
Next used the infos in this thread to make it spoof and put MicroG ( 0.2.14.204215 ) on it:
Signature Spoofing on unsuported Android 11 (R) Roms
How to get Signature Spoofing working on Android 11 (R) Roms that have no support for Signature Spoofing? In my Case here I use a Samsung Galaxy S8 with an unofficial LineageOS 18.1 (Android 11) by stricted I use TWRP recovery but this should...
forum.xda-developers.com
So now the main thing I wanted out of the latter is working - a car sharing app works on the phone.
I attempted however to run another mobility app, which does electric scooters and while it didn't complain about Play Services anymore, it eventually opened up some kind of empty browser window with the following text in it:
Unable to process request due to missing initial state. This may happen if browser sessionStoraage is inaccessible or accidentally cleared.
Click to expand...
Click to collapse
"Cloud Mesaging" in MicroG is not switched on, but doubt it is that. I added no Location modules (backends) as the GPS seems to work so well. Everything is ticked under the MicroG requirements, but I tried to switch on permission to access location in the background on MicroG but it will not let me switch it on. I'm scared to update MicroG from F-Droid to a newer version, since I followed instructions from somewhere to install it from Magisk along with something else which patched the services.jar to spoof.
Any ideas as to how to fix this problem and what things to try, in what order?