(Solved) How to remove Android.Downloader.4930 and Android/Syringe.AD System Application on Evercoss Genpro X Pro S50 (MT6735) - Security Discussion

Please help me to remove com.android.sc (known as Android/Syringe.AD System Application) on Evercoss Genpro X Pro S50 MT6735. This Trojan exisit in the officeal firmware http://evercoss.com/img/software/EVERCOSS_S50_7_0_021_P1_180314_OE_CPB.zip
I use mtk-su to gain access to remove this trojan.
EVERCOSS_S50:/ $ cd /data/local/tmp
EVERCOSS_S50:/data/local/tmp $ ./mtk-su -v
armv7l machine
param1: 0x1000, param2: 0x8040, type: 4
Building symbol table
kallsyms_addresses pa 0x40bc2460
kallsyms_num_syms 54191, addr_count 54191
kallsyms_names pa 0x40bf7330, size 646794
kallsyms_markers pa 0x40c951c0
kallsyms_token_table pa 0x40c95510
kallsyms_token_index pa 0x40c95890
Patching credentials
Parsing current_is_single_threaded
c0362760: MOVW R0, #0x8d50
c0362764: MOVT R0, #0xc102
Possible list_head tasks at offset 0x290
comm swapper/0 at offset 0x400
Found own task_struct at node 1
cred VA: 0xc667e500
init_task VA: 0xc1028d50
Parsing avc_denied
c0aeca70: MOVW R12, #0x1278
c0aeca74: MOVT R12, #0xc113
selinux_enforcing VA: 0xc1131278
Setting selinux_enforcing
Selinux is already permissive
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
EVERCOSS_S50:/data/local/tmp # pm list package com.android.sc
package:com.android.screenrecord
package:com.android.sc -> bloatware Android/Trojan.Syringe.AD (System Application)
EVERCOSS_S50:/data/local/tmp # pm uninstall com.android.sc
Failure [DELETE_FAILED_INTERNAL_ERROR]
EVERCOSS_S50:/data/local/tmp # pm uninstall -k --user 0 com.android.sc
Success
It still exists when I query list package
EVERCOSS_S50:/data/local/tmp # pm list package com.android.sc
package:com.android.screenrecord
package:com.android.sc -> bloatware Android/Trojan.Syringe.AD (System Application)
After I reboot the device, com.android.sc will installed its self.
Any suggestion?
Thank you
Sincerey, Dedetok

build.prop
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=NRD90M
ro.build.display.id=EVERCOSS_S50_V13_7.0_09022018
ro.build.version.incremental=1521000161
ro.build.version.sdk=24
ro.build.version.preview_sdk=0
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=7.0
ro.build.version.security_patch=2018-03-05
ro.build.version.base_os=
ro.build.date=Wed Mar 14 12:02:39 CST 2018
ro.build.date.utc=1521000159
ro.build.type=user
ro.build.user=zhuangsf
ro.build.host=freecom8
ro.build.tags=release-keys
ro.build.flavor=full_len6737m_35_n-user
ro.product.model=S50
ro.product.brand=EVERCOSS
ro.product.name=EVERCOSS_S50
ro.product.device=EVERCOSS_S50
ro.product.board=EVERCOSS_S50
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.cpu.abilist=armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=
ro.product.manufacturer=EVERCOSS_S50
ro.product.locale=en-US
ro.wifi.channels=
ro.board.platform=mt6737m
# ro.build.product is obsolete; use ro.product.device
ro.build.product=len6737m_35_n
# Do not try to parse description, fingerprint, or thumbprint
ro.build.description=full_len6737m_35_n-user 7.0 NRD90M 1521000161 release-keys
ro.build.fingerprint=EVERCOSS/EVERCOSS_S50/EVERCOSS_S50:7.0/NRD90M/1517820838:user/release-keys
ro.build.characteristics=default
# end build properties
ro.product.sub_flash=yes
ro.product.alsps=stk3x1x-new
ro.product.fingerprint=yes
ro.product.tp_ges=true
ro.product.gyroscope_support=yes
ro.product.aecamera_support=yes
ro.product.doujia=yes
ro.custom.build.version=EVERCOSS_S50_V13_7.0_09022018
ro.build.realversion=ZH096_TRX_L5032_360OS_N23112_C99ba_20180314_37m35_32G3G_DDR3_HD_G4W18L135840K_GpsS_ALS_FP_
ro.build.realversion2=OTG_GYRO_120051
ro.antos.model=wt-6-ZH096-TRX-0-EVERCOSS-S50
#
# from device/lentek/len6737m_35_n/system.prop
#
#
# system.prop for generic sdk
#
rild.libpath=mtk-ril.so
rild.libargs=-d /dev/ttyC0
# MTK, Infinity, 20090720 {
wifi.interface=wlan0
# MTK, Infinity, 20090720 }
# MTK, mtk03034, 20101210 {
ro.mediatek.wlan.wsc=1
# MTK, mtk03034 20101210}
# MTK, mtk03034, 20110318 {
ro.mediatek.wlan.p2p=1
# MTK, mtk03034 20110318}
# MTK, mtk03034, 20101213 {
mediatek.wlan.ctia=0
# MTK, mtk03034 20101213}
#
wifi.tethering.interface=ap0
#
ro.opengles.version=196609
#ro.kernel.qemu=1
#ro.kernel.qemu.gles=0
wifi.direct.interface=p2p0
#dalvik.vm.heapgrowthlimit=128m
#dalvik.vm.heapsize=256m
# USB MTP WHQL
ro.sys.usb.mtp.whql.enable=0
# Power off opt in IPO
sys.ipo.pwrdncap=2
ro.sys.usb.storage.type=mtp
# USB BICR function
ro.sys.usb.bicr=no
# USB Charge only function
ro.sys.usb.charging.only=yes
# audio
ro.camera.sound.forced=0
ro.audio.silent=0
ro.zygote.preload.enable=0
# temporary enables NAV bar (soft keys)
qemu.hw.mainkeys=1
#=0
ro.kernel.zio=38,108,105,16
#ro.kernel.qemu=1
#ro.kernel.qemu.gles=0
#ro.boot.selinux=disable
ro.sf.lcd_density=320
#240
# performance
ro.mtk_perf_simple_start_win=1
ro.mtk_perf_fast_start_win=1
ro.mtk_perf_response_time=1
ro.setupwizard.suppress_d2d_nfc=true
ro.product.otg_support=yes
#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.qiku.version.hardware=P1
ro.qiku.version.date=180314
ro.qiku.version.kernel=3.18.35+.P1.180314.NRD90M
ro.qiku.version.software=7.0.001.P1.180314.WW6_TRX_TRXZH096L5032_OE
ro.qiku.version.release=7.0.021.P1.180314.TRXZH096L5032.WW6_TRX_TRXZH096L5032_OE
ro.qiku.globality=0
ro.qiku.efuse.type=0
persist.qiku.ctstest=1
ro.qiku.gms=1
persist.sys.sw.vdd=2.8
persist.sys.sw.touch.para.r=0x06
persist.sys.sw.touch.para.c=0x0c
persist.sys.sw.touch.level=0x18
persist.sys.sw.speed.max=6000
persist.sys.sw.pix.area=60
persist.sys.sw.enroll.double=1
persist.sys.sw.enroll.frm.num=0
persist.sys.sw.enroll.quality=30
persist.sys.sw.key.mod=1
persist.sys.sw.key.nav_dir=UDLR
persist.sys.sw.key.screenoff=1
persist.sys.sw.verify.retry=1
persist.sys.sw.light.mod=0
persist.sys.sw.light.devs=/dev/input/event2
persist.sys.sw.light.uevet=leds-mt65xx/leds/lcd-backlight
persist.sys.sw.idh.nums=0
persist.sys.sw.transsion.f14=0
ro.carrier=unknown
ro.mediatek.chip_ver=S01
ro.mediatek.platform=MT6737M
ro.telephony.sim.count=2
persist.radio.default.sim=0
ril.specific.sm_cause=0
bgw.current3gband=0
ril.external.md=0
ro.sf.hwrotation=0
persist.radio.fd.counter=150
persist.radio.fd.off.counter=50
persist.radio.fd.r8.counter=150
persist.radio.fd.off.r8.counter=50
drm.service.enabled=true
fmradio.driver.enable=1
ril.first.md=1
ril.flightmode.poweroffMD=1
ril.telephony.mode=0
dalvik.vm.mtk-stack-trace-file=/data/anr/mtk_traces.txt
mediatek.wlan.chip=CONSYS_MT6735
mediatek.wlan.module.postfix=_consys_mt6735
ril.read.imsi=1
ril.radiooff.poweroffMD=0
ro.frp.pst=/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/frp
ro.mtk_protocol1_rat_config=Lf/Lt/W/G
ro.mediatek.version.branch=alps-mp-n0.mp1
ro.mediatek.version.release=alps-mp-n0.mp1-V1.0.2_len6737m.35.n_P192
ro.mediatek.version.sdk=4
ro.setupwizard.mode=OPTIONAL
ro.com.google.gmsversion=7.0_r13
ro.num_md_protocol=2
persist.radio.multisim.config=dsds
ro.mtk_besloudness_support=1
ro.mtk_wapi_support=1
ro.mtk_bt_support=1
ro.mtk_wappush_support=1
ro.mtk_agps_app=1
ro.mtk_audio_tuning_tool_ver=V1
ro.mtk_wlan_support=1
ro.mtk_gps_support=1
ro.mtk_omacp_support=1
ro.mtk_search_db_support=1
ro.mtk_dialer_search_support=1
ro.mtk_dhcpv6c_wifi=1
ro.have_aacencode_feature=1
ro.mtk_fd_support=1
ro.mtk_oma_drm_support=1
ro.mtk_widevine_drm_l3_support=1
ro.mtk_eap_sim_aka=1
ro.mtk_fm_recording_support=1
ro.mtk_send_rr_support=1
ro.mtk_emmc_support=1
ro.mtk_tetheringipv6_support=1
ro.telephony.default_network=9,9
ro.mtk_shared_sdcard=1
ro.mtk_enable_md1=1
ro.mtk_flight_mode_power_off_md=1
ro.mtk_pq_support=2
ro.mtk_pq_color_mode=1
ro.mtk_miravision_support=1
ro.mtk_wifi_mcc_support=1
ro.mtk_sim_hot_swap=1
ro.mtk_bip_scws=1
ro.mtk_world_phone_policy=0
ro.mtk_perfservice_support=1
ro.mtk_sim_hot_swap_common_slot=1
ro.mtk_cam_mfb_support=0
ro.mtk_lte_support=1
ro.mtk_cam_cfb=1
ro.mtk_rild_read_imsi=1
ro.sim_refresh_reset_by_modem=1
ro.mtk_external_sim_only_slots=0
ro.mtk_bg_power_saving_support=1
ro.mtk_bg_power_saving_ui=1
ro.have_aee_feature=1
ro.sim_me_lock_mode=0
ro.mtk_dual_mic_support=0
ro.mtk_is_tablet=0
persist.mtk_nlp_switch_support=1
persist.mtk_ims_support=1
ro.mtk_multiple_ims_support=1
persist.mtk_volte_support=1
persist.mtk.volte.enable=1
persist.mtk_vilte_support=1
ro.mtk_vilte_ut_support=0
wfd.dummy.enable=1
wfd.iframesize.level=0
ro.mediatek.project.path=device/lentek/len6737m_35_n
ro.mtk_microtrust_tee_support=1
persist.mtk.wcn.combo.chipid=-1
persist.mtk.wcn.patch.version=-1
persist.mtk.wcn.dynamic.dump=0
service.wcn.driver.ready=no
service.wcn.coredump.mode=0
persist.mtk.connsys.poweron.ctl=0
ro.com.android.mobiledata=true
persist.radio.mobile.data=0,0
persist.meta.dumpdata=0
ro.mtk_md_sbp_custom_value=0
dalvik.vm.heapgrowthlimit=128m
dalvik.vm.heapsize=256m
persist.radio.mtk_dsbp_support=1
persist.mtk_dynamic_ims_switch=0
persist.radio.mtk_ps3_rat=G
ro.boot.opt_c2k_lte_mode=0
ro.boot.opt_md1_support=5
ro.boot.opt_lte_support=1
persist.log.tag.AT=I
persist.log.tag.RILMUXD=I
persist.log.tag.RILC-MTK=I
persist.log.tag.RILC=I
persist.log.tag.RfxMainThread=I
persist.log.tag.RfxRoot=I
persist.log.tag.RfxRilAdapter=I
persist.log.tag.RfxController=I
persist.log.tag.RILC-RP=I
persist.log.tag.RIL-DATA=I
ro.boot.opt_using_default=1
mtk.vdec.waitkeyframeforplay=1
ro.sys.sdcardfs=1
persist.mtk.datashaping.support=1
persist.datashaping.alarmgroup=1
persist.runningbooster.support=1
persist.runningbooster.upgrade=1
ro.media.maxmem=500000000
ro.mtk_disable_navigation_bar=1
persist.sys.timezone=Asia/Jakarta
ro.com.google.clientidbase.am=android-evercoss
ro.com.google.clientidbase.ms=android-evercoss
ro.com.google.clientidbase=android-evercoss
persist.mtk_ussi_support=1
ro.qiku.xlocker.capture=1
persist.qiku.fingerprint=0
persist.sys.st.value=0
ro.com.android.dateformat=dd-MM-yyyy
ro.config.agenda_alert=Schedule.ogg
ro.config.alarm_alert=Feeling.ogg
ro.config.notification_sound=Evercoss_Message.wav
ro.config.ringtone=Evercoss_Ringtone.mp3
ro.config.ringtone_2=Evercoss_Ringtone.mp3
ro.config.smstone=Evercoss_Message.wav
ro.config.smstone_2=Evercoss_Message.wav
ro.qiku.bt.voicerecord=0
ro.qiku.version.tag=LC
ro.qiku.sales.channel=2
ro.qiku.display.360logo=0
ro.vendor.channel.number=WW6_TRX_TRXZH096L5032_OE
ro.vendor.name=WTWD6
ro.product.model=S50
ro.product.brand=EVERCOSS
ro.product.manufacturer=EVERCOSS
persist.sys.language=en
persist.sys.country=US
persist.qiku.allmode.operator=0
persist.qiku.version.bm=0
ro.qiku.product.devicename=EVERCOSS_S50
ro.qiku.app.safetydialog=0
ro.build.uiversion=360UI:V2.0
ro.build.ota.type=stable
ro.qiku.oldman.phone=0
persist.qiku.oldman.mode=0
persist.qiku.children.mode=0
ro.qiku.hotknot=0
ro.qiku.product.type=LE
ro.qiku.privacyspace.support=0
persist.qiku.operators.mode=0
persist.qiku.cmcc.mode=0x00
persist.qiku.defaultmode=0
persist.qiku.comm.runmode=0000
persist.qiku.cmcc.brand=0x00
persist.sys.dm=0
persist.qiku.perf_opt=0
persist.qiku.log.level=YWW4
persist.qiku.operators.isabroad=1
ro.qiku.lucky.money.alert=0
persist.sys.dalvik.vm.lib.2=libart.so
dalvik.vm.isa.arm.variant=cortex-a53
dalvik.vm.isa.arm.features=default
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
# begin fota properties
ro.fota.platform=MTK6737_7.0
ro.fota.type=phone
ro.fota.app=5
ro.fota.oem=qiku_sz6737_7.0
ro.fota.device=S50
S50
ro.fota.version=7.0.021.P1.180314.TRXZH096L5032.WW6_TRX_TRXZH096L5032_OE
ro.fota.token=a42e45927e8210def34b83a3ef65477b
# end fota properties
ro.expect.recovery_id=0x4a993bb2198cac1fe86bb34af8da1aff28888304000000000000000000000000

dedetok said:
Please help me to remove com.android.sc (known as Android/Syringe.AD System Application) on Evercoss Genpro X Pro S50 MT6735. This Trojan exisit in the officeal firmware http://evercoss.com/img/software/EVERCOSS_S50_7_0_021_P1_180314_OE_CPB.zip
I use mtk-su to gain access to remove this trojan.
Android/Trojan.Syringe.AD (System Application)
After I reboot the device, com.android.sc will installed its self.
Any suggestion?
Thank you
Sincerey, Dedetok
Click to expand...
Click to collapse
It use this to achieve its permanency.
GitHub - DroidPluginTeam/DroidPlugin: A plugin framework on android,Run any third-party apk without installation, modification or repackage
A plugin framework on android,Run any third-party apk without installation, modification or repackage - GitHub - DroidPluginTeam/DroidPlugin: A plugin framework on android,Run any third-party apk w...
github.com
Sure, it does look suspicious, but is it a trojan?
Does it show ads? Or do some other weird stuff?
System apps do not uninstall. Just remove its folder to do it, i.e. "/system/priv-app/SystemClean". This might cause boot problems though. Depends...
What you could do is install a firewall at least to disable it receiving data from qiku.com or whatever...

CXZa said:
It use this to achieve its permanency.
GitHub - DroidPluginTeam/DroidPlugin: A plugin framework on android,Run any third-party apk without installation, modification or repackage
A plugin framework on android,Run any third-party apk without installation, modification or repackage - GitHub - DroidPluginTeam/DroidPlugin: A plugin framework on android,Run any third-party apk w...
github.com
Sure, it does look suspicious, but is it a trojan?
Does it show ads? Or do some other weird stuff?
System apps do not uninstall. Just remove its folder to do it, i.e. "/system/priv-app/SystemClean". This might cause boot problems though. Depends...
What you could do is install a firewall at least to disable it receiving data from qiku.com or whatever...
Click to expand...
Click to collapse
I used Malware Bytes to scan my device, and it's reported as Syringe.AD. in apk decompile "com.android.com", it has has url string: http:// api <dot> os <dot> qiku <dot> com. I decompile the APK using JavaDecompiler online, and can be download from https://garasiku.my.id/android_malware_source/com.android.sc-1.3.3-1033_source_from_JADX.zip. But I have no skill to read the code.
"application inspector" by uniquesoft report unknown applications was installed, they are:
1. "App Settings" source code by JavaDecompiler online (APK Decompile) , and can be download from https://garasiku.my.id/android_malware_source/com.app.settings.amtapp-2.66-266_source_from_JADX.zip
2. "com.viysr.wkcx" source code by JavaDecompiler online (APK Decompile) , and can be download from https://garasiku.my.id/android_malware_source/com.viysr.wkcx-1.0-1_source_from_JADX.zip

I just looked the system.img file through the hex editor, so not that deep. It looked like it or some other app might try to hook some of the browsers. Then that firewall could be useless. Block at least https://api.os.qiku.com and https://api-en.os.qiku.com if you can. Although that qiku firm seems to be okay...
Odd that the stock firmware would contain a trojan...
But if so, it has planted there on purpose...
It's maybe included in some other stocks too...
English Community-Lenovo Community
https://community.umidigi.com/forum.php?mod=redirect&goto=findpost&ptid=16559&pid=92962

command verbose to block api.os.qiku.com and api-en.os.qiku.com:
$ adb pull /system/etc/hosts ./
edit hosts
127.0.0.1 localhost
127.0.0.1 api.os.qiku.com
127.0.0.1 api-en.os.qiku.com
::1 ip6-localhost
::1 api.os.qiku.com
::1 api-en.os.qiku.com
$ adb push ./hosts /data/local/tmp/
$ adb shell
EVERCOSS_S50:/ $ cd /data/local/tmp
EVERCOSS_S50:/data/local/tmp $ ./mtk-su
UID: 0 cap: 3fffffffff selinux: permissive
EVERCOSS_S50:/data/local/tmp # mount -o rw,remount /system
EVERCOSS_S50:/data/local/tmp # cat hosts
127.0.0.1 localhost
127.0.0.1 api.os.qiku.com
127.0.0.1 api-en.os.qiku.com
::1 ip6-localhost
::1 api.os.qiku.com
::1 api-en.os.qiku.com
EVERCOSS_S50:/data/local/tmp # cp hosts /system/etc/
EVERCOSS_S50:/data/local/tmp # cat /system/etc/hosts
127.0.0.1 localhost
127.0.0.1 api.os.qiku.com
127.0.0.1 api-en.os.qiku.com
::1 ip6-localhost
::1 api.os.qiku.com
::1 api-en.os.qiku.com
EVERCOSS_S50:/data/local/tmp # mount -o ro,remount /system

dedetok said:
command verbose to block api.os.qiku.com and api-en.os.qiku.com:
$ adb pull /system/etc/hosts ./
edit hosts
Click to expand...
Click to collapse
Yes, that does that does the trick - blocks those urls....
But I think that it's just a false alarm.
You seem to have this in it...
360os - 概述 - 360手机
360 OS基于Android 5.1深度定制,以多种出色而自然的方式,让你的Android系统变得更加好用。
www.qiku.com
360OS - 全球领先OS智能生态服务提供商
360OS是全球领先的OS智能产品及生态服务提供商,致力于驱动以OS+为核心的智能互联。以OS+安全产业互联网、OS+AI、OS+UI的商业闭环模式,覆盖全球多个地区市场生态。
www.360os.com
360 OS - All you need to Know about Android based 360 OS
Here is all you need to about 360 OS. 360 OS is new Android based OS. Have a look at unique features in 360 OS.
www.digitalstacks.org

was a double post because of the error message while posting..
Oops! We ran into some problems. Please try again later. More error details may be in the browser console.
Click to expand...
Click to collapse

CXZa said:
Yes, that does that does the trick - blocks those urls....
But I think that it's just a false alarm.
You seem to have this in it...
360os - 概述 - 360手机
360 OS基于Android 5.1深度定制,以多种出色而自然的方式,让你的Android系统变得更加好用。
www.qiku.com
360OS - 全球领先OS智能生态服务提供商
360OS是全球领先的OS智能产品及生态服务提供商,致力于驱动以OS+为核心的智能互联。以OS+安全产业互联网、OS+AI、OS+UI的商业闭环模式,覆盖全球多个地区市场生态。
www.360os.com
360 OS - All you need to Know about Android based 360 OS
Here is all you need to about 360 OS. 360 OS is new Android based OS. Have a look at unique features in 360 OS.
www.digitalstacks.org
Click to expand...
Click to collapse
No ...... It is Not False alarm....
I use App Inspector to monitor any change on my Evercoss S50 ( I have 3 similar devices ). I know exactly what happened to those handsets.
These 2 apks were installed before I changed /system/etc/hosts.
Maybe S50 using 360 OS..... You can download the firmware http://evercoss.com/download/detail/s50 and help me where those 2 files came from.
Please share the patch for the rest of S50 users.

Ops, blocking via /system/etc/hosts did very effective. I still got the "malware" dropped in my device with name "App UI" (Screen shoot)
The easiest way is to use NoRoot Firewall created by Grey Shirts.
In Home Screen there is option to checked "Auto start on boot"
You need to enable VPN, NoRoot Firewall will create local VPN on your phone to filter any application connected to internet.
in Apps, you need to set which application allow or not to connect to internet
For my device I blocked (sign with red X)
1. 360 security
2. Aging Test, Android SYstem, BT Tool,......
3. Anti-Theft
4. CaptivePortalLogin
5. com.mediatek.ims, ....
6. ConfigCenter
7. ConfigUpdater
8. Initiator
9. Intent Filter Verification Service
10. Market Feedback Agent
11. Power Master
12. System
13. System-UI
14. Work profile setup
May be the list is to much.... LOL.... but you won't get "App UI" dropped into your phone anymore....
The other way is to use /system/bin/iptables......
These are backgroud connections capture in NoRoot Firewall by Grey Shirts
Anti Theft
ip 36.110.234.87 port 80 whois: CHINANET-BJ 36.110.0.0 - 36.110.255.255 CIDR 36.110.0.0/16
ip 104.192.109.67 port 5227 whois: CHINANET-LAX-IDC-2014 104.192.108.0 - 104.192.111.255 CIDR 104.192.108.0/22
ip 211.151.195.194 port 80 whois: CHINA-21VIANET 211.151.0.0 - 211.151.255.255 CIDR 211.151.0.0/16
com.android.sc
ip 47.90.110.234 port 80 whois: AL-3 47.88.0.0 - 47.91.255.255 CIDR 47.88.0.0/14
ip 104.192.110.206 port 80 whois: CHINANET-LAX-IDC-2014 104.192.108.0 - 104.192.111.255 CIDR 104.192.108.0/22
ip 104.192.110.243 port 80 whois: CHINANET-LAX-IDC-2014 104.192.108.0 - 104.192.111.255 CIDR 104.192.108.0/22
ip 124.156.123.59 port 443 whois: ACEVILLEPTELTD-SG 124.156.96.0 - 124.156.191.255 CIDR 124.156.96.0/19 124.156.128.0/18
ip 180.163.251.181 port 80 whois:CHINANET-SH 180.160.0.0 - 180.175.255.255 CIDR 180.160.0.0/12
Config Center
ip 104.182.110.205 port 443 whois: SIS-80-7-29-2014 104.176.0.0 - 104.191.255.255 CIDR 104.176.0.0/12
Initiator
ip 101.198.192.187 port 80 whois: QIHOO 101.198.196.0 - 101.198.199.255 CIDR 101.198.196.0/22
ip 101.198.192.189 port 80 whois: QIHOO 101.198.196.0 - 101.198.199.255 CIDR 101.198.196.0/22
Create script s50_iptables.sh
#!/bin/sh
echo "Inserting iptables"
if [ "$(/system/bin/iptables -S INPUT | grep -ce '36.110.0.0/16 -j DROP')" != 0 ]
then
echo "Skiped 36.110.0.0/16 -j DROP"
else
/system/bin/iptables -I INPUT -s 36.110.0.0/16 -j DROP
echo "Added 36.110.0.0/16 -j DROP"
fi
if [ "$(/system/bin/iptables -S INPUT | grep -ce '104.192.108.0/22 -j DROP')" != 0 ]
then
echo "Skiped 104.192.108.0/22 -j DROP"
else
/system/bin/iptables -I INPUT -s 104.192.108.0/22 -j DROP
echo "Added 104.192.108.0/22 -j DROP"
fi
if [ "$(/system/bin/iptables -S INPUT | grep -ce '211.151.0.0/16 -j DROP')" != 0 ]
then
echo "Skiped 211.151.0.0/16 -j DROP"
else
/system/bin/iptables -I INPUT -s 211.151.0.0/16 -j DROP
echo "Added 211.151.0.0/16 -j DROP"
fi
if [ "$(/system/bin/iptables -S INPUT | grep -ce '47.88.0.0/14 -j DROP')" != 0 ]
then
echo "Skiped 47.88.0.0/14 -j DROP"
else
/system/bin/iptables -I INPUT -s 47.88.0.0/14 -j DROP
echo "Added 47.88.0.0/14 -j DROP"
fi
if [ "$(/system/bin/iptables -S INPUT | grep -ce '124.156.96.0/19 -j DROP')" != 0 ]
then
echo "Skiped 124.156.96.0/19 -j DROP"
else
/system/bin/iptables -I INPUT -s 124.156.96.0/19 -j DROP
echo "Added 124.156.96.0/19 -j DROP"
fi
if [ "$(/system/bin/iptables -S INPUT | grep -ce '124.156.128.0/18 -j DROP')" != 0 ]
then
echo "Skiped 124.156.128.0/18 -j DROP"
else
/system/bin/iptables -I INPUT -s 124.156.128.0/18 -j DROP
echo "Added 124.156.128.0/18 -j DROP"
fi
if [ "$(/system/bin/iptables -S INPUT | grep -ce '180.160.0.0/12 -j DROP')" != 0 ]
then
echo "Skiped 180.160.0.0/12 -j DROP"
else
/system/bin/iptables -I INPUT -s 180.160.0.0/12 -j DROP
echo "Added 180.160.0.0/12 -j DROP"
fi
if [ "$(/system/bin/iptables -S INPUT | grep -ce '104.176.0.0/12 -j DROP')" != 0 ]
then
echo "Skiped 104.176.0.0/12 -j DROP"
else
/system/bin/iptables -I INPUT -s 104.176.0.0/12 -j DROP
echo "Added 104.176.0.0/12 -j DROP"
fi
if [ "$(/system/bin/iptables -S INPUT | grep -ce '101.198.196.0/22 -j DROP')" != 0 ]
then
echo "Skiped 101.198.196.0/22 -j DROP"
else
/system/bin/iptables -I INPUT -s 101.198.196.0/22 -j DROP
echo "Added 101.198.196.0/22 -j DROP"
fi
echo "Done"
To run the script, open Termux and run mtk-su to gain root
Download the script
# wget http://garasiku.my.id/folder/s50_iptables.sh.txt
Rename and change permission
# mv ./s50_iptables.sh.txt ./s50_iptables.sh
# chmod 744 ./s50_iptables.sh
Run it
# ./s50_iptables.sh
To check it run
# /system/bin/iptables-save | grep INPUT
Or
# /system/bin/iptables -S INPUT
Known Problem: After restarting or boot the device, the firewall rules will be flush! In the future, I will fix to to put it in /system/etc/init and run it when the device finish booting.
To run on ADB, replace #!/bin/sh to #!/system/bin/sh.
Credit:
MTK-SU by Diplomatic
NoRoot Firewall by Grey Shirts
Application Inspector by UBQSoft
I put my work on garasiku.my.id

Okay. this is weird. Viruses from the factory.
Tried searching that app file name from all files. Got stuck because anti-virus. Trojan in /system/lib/libcheckperlib.so
File name search finds that you're not the only one.
Might be that you cannot make it clean if it's deep in the system.
Yet another [almost] non-removable trojan for Android
At the end of 2019, system-monitoring routines on some of our customers' smart phones detected changes in the file /system/lib/libc.so.
news.drweb.com
Fortunately evercoss has a solution... LOL
Cara Jitu Menghapus Virus Trojan di Smartphone Android
Banyak kerugian dari virus Trojan yang tidak segera ditangani, termasuk bocornya data personal. Inilah solusi menghapus virus trojan di smartphone EVers!
blog.evercoss.com
Have you re-flashed it? Does the same start again even if those urls are blocked?

CXZa said:
Okay. this is weird. Viruses from the factory.
Tried searching that app file name from all files. Got stuck because anti-virus. Trojan in /system/lib/libcheckperlib.so
File name search finds that you're not the only one.
Might be that you cannot make it clean if it's deep in the system.
Yet another [almost] non-removable trojan for Android
At the end of 2019, system-monitoring routines on some of our customers' smart phones detected changes in the file /system/lib/libc.so.
news.drweb.com
Fortunately evercoss has a solution... LOL
Cara Jitu Menghapus Virus Trojan di Smartphone Android
Banyak kerugian dari virus Trojan yang tidak segera ditangani, termasuk bocornya data personal. Inilah solusi menghapus virus trojan di smartphone EVers!
blog.evercoss.com
Have you re-flashed it? Does the same start again even if those urls are blocked?
Click to expand...
Click to collapse
thank you for your help.
flashing device does not help. after it connect to internet, it starts pull some apk from internet.
I'll try to search /system/lib/libcheckperlib.so as your sugestion.

CXZa said:
Okay. this is weird. Viruses from the factory.
Tried searching that app file name from all files. Got stuck because anti-virus. Trojan in /system/lib/libcheckperlib.so
File name search finds that you're not the only one.
Might be that you cannot make it clean if it's deep in the system.
Yet another [almost] non-removable trojan for Android
At the end of 2019, system-monitoring routines on some of our customers' smart phones detected changes in the file /system/lib/libc.so.
news.drweb.com
Fortunately evercoss has a solution... LOL
Cara Jitu Menghapus Virus Trojan di Smartphone Android
Banyak kerugian dari virus Trojan yang tidak segera ditangani, termasuk bocornya data personal. Inilah solusi menghapus virus trojan di smartphone EVers!
blog.evercoss.com
Have you re-flashed it? Does the same start again even if those urls are blocked?
Click to expand...
Click to collapse
Yes, /system/lib/libcheckperlib.so contains Android.DownLoader.4930 trojan.
I deleted it and let device without net filtering to monitor any change in android system.
Thank you for your clue.

After removing /system/lib/libcheckperlib.so that contains Android.DownLoader.4930 trojan, and monitor the device for two months, there is no more unwanted installed on device.
Here is step to remove /system/lib/libcheckperlib.so that contains Android.DownLoader.4930 trojan:
Requirement:
rooted android or temporary root using mtk-su create by Diplomatic
pc with adb or Termux
This are steps to remove malware Android.Downloader.4930 /system/lib/libcheckperlib.so using Termux created by Grey Tshirts:
Create these bash script and save it as s50_patch2021.sh
#!/system/bin/sh
FILE="/system/lib/libcheckperlib.so"
echo "checking $FILE"
if [ -f $FILE ]; then
echo "File $FILE exists."
echo "Try remount system rw."
/system/bin/mount -o rw,remount /system
echo "Backing up $FILE."
/system/bin/mkdir /sdcard/dedetok
/system/bin/cp $FILE /sdcard/dedetok
echo "Removing $FILE"
/system/bin/rm $FILE
echo "Remount system ro"
/system/bin/mount -o ro,remount /system
echo "Done, reboot your Evercoss S50"
else
echo "File $FILE does not exist."
fi
Or you can download it from this site. Open Termux and type
$ wget http://garasiku.my.id/folder/S50_patch2021.sh.txt
rename it
$ mv ./S50_patch2021.sh.txt ./S50_patch2021.sh
change permission
$ chmod 744 ./S50_patch2021.sh
run mtk-su and run the cript
# ./S50_patch2021.sh
reboot your phone
Don't forget to run your antivirus after reboot your phone. android is not save operating system. Use application inspector to inspect unwanted application and remove it.
Garasiku - Evercoss Genpro X Pro S50 removing malware Android.Downloader.4930 /system/lib/libcheckperlib.so
Garasiku
garasiku.my.id

Related

[Bash] got bored? bash styles

i got bored looking at the standard # or $ in bash so modified my bashrc with something from bashstyle-ng.
does anyone else have a different bash? show it off!
replace /etc/bash/bashrc file with this one to get the same look
Code:
# /etc/bash/bashrc
#
# This file is sourced by all *interactive* bash shells on startup,
# including some apparently interactive shells such as scp and rcp
# that can't tolerate any output. So make sure this doesn't display
# anything or bad things will happen !
function pre_prompt {
newPWD="${PWD}"
user="whoami"
host=$(echo -n $HOSTNAME | sed -e "s/[\.].*//")
datenow=$(date "+%a, %d %b %y")
let promptsize=$(echo -n "+([email protected]$host ddd., DD mmm YY)(${PWD})+" \
| wc -c | tr -d " ")
let fillsize=${COLUMNS}-${promptsize}
fill=""
while [ "$fillsize" -gt "0" ]
do
fill="${fill}-"
let fillsize=${fillsize}-1
done
if [ "$fillsize" -lt "0" ]
then
let cutt=3-${fillsize}
newPWD="...$(echo -n $PWD | sed -e "s/\(^.\{$cutt\}\)\(.*\)/\2/")"
fi
}
# Test for an interactive shell. There is no need to set anything
# past this point for scp and rcp, and it's important to refrain from
# outputting anything in those cases.
if [[ $- != *i* ]] ; then
# Shell is non-interactive. Be done now!
return
fi
# Bash won't get SIGWINCH if another process is in the foreground.
# Enable checkwinsize so that bash will check the terminal size when
# it regains control. #65623
# http://cnswww.cns.cwru.edu/~chet/bash/FAQ (E11)
shopt -s checkwinsize
# Enable history appending instead of overwriting. #139609
shopt -s histappend
use_color=false
# set some environment variables
HOME=/sdcard
TERM=linux
PROMPT_COMMAND=pre_prompt
export black="\[\033[0;38;5;0m\]"
export red="\[\033[0;38;5;1m\]"
export orange="\[\033[0;38;5;130m\]"
export green="\[\033[0;38;5;2m\]"
export yellow="\[\033[0;38;5;3m\]"
export blue="\[\033[0;38;5;4m\]"
export bblue="\[\033[0;38;5;12m\]"
export magenta="\[\033[0;38;5;55m\]"
export cyan="\[\033[0;38;5;6m\]"
export white="\[\033[0;38;5;7m\]"
export coldblue="\[\033[0;38;5;33m\]"
export smoothblue="\[\033[0;38;5;111m\]"
export iceblue="\[\033[0;38;5;45m\]"
export turqoise="\[\033[0;38;5;50m\]"
export smoothgreen="\[\033[0;38;5;42m\]"
case "$TERM" in
xterm)
PS1="$bblue+-($orange\[email protected]\h \$(date \"+%a, %d %b %y\")$bblue)-\${fill}-($orange\$newPWD\
$bblue)-+\n$bblue+-($orange\$(date \"+%H:%M\") \$$bblue)->$white "
;;
screen)
PS1="$bblue+-($orange\[email protected]\h \$(date \"+%a, %d %b %y\")$bblue)-\${fill}-($orange\$newPWD\
$bblue)-+\n$bblue+-($orange\$(date \"+%H:%M\") \$$bblue)->$white "
;;
*)
PS1="+-(\[email protected]\h \$(date \"+%a, %d %b %y\"))-\${fill}-(\$newPWD\
)-|\n+-(\$(date \"+%H:%M\") \$)-> "
;;
esac
# Set up a ton of aliases to cover toolbox with the nice busybox
# equivalents of its commands
for i in cat chmod chown df insmod ln lsmod mkdir mount mv rm rmdir rmmod umount; do
eval alias ${i}=\"busybox ${i}\"
done
unset i
alias ls='busybox ls --color=auto'
alias sysro='mount -o remount,ro /system'
alias sysrw='mount -o remount,rw /system'
# Try to keep environment pollution down, EPA loves us.
unset use_color safe_term match_lhs
overkill
x3maniac said:
i got bored looking at the standard # or $ in bash so modified my bashrc with something from bashstyle-ng.
does anyone else have a different bash? show it off!
Click to expand...
Click to collapse
Your prompt takes too much space, and it contains date + time, which are already shown on the screen (top and bottom).
Just make the prompt PS1='\e[34m\[email protected]\h:\w \$ \e[0m' so it's ready for cut&paste, e.g. when you're copying files with scp.

[Q] TechniPad - root ?

Hello
Is it possible that technipad (of technisat) to root? It is built a rockchip.
Thank you
Philip
Me too
Also trying to root this device. Tried many ways but cannot get through.
ADB root does not work - adbd cannot run as root in production builds
though adb shell get similar message as uid 2000 - cannot change to 0
Cannot use psneuter either.
Going round and round in circles, anyone with some help it would be appreciated.
Thanks,
Root checker results
Root Access is not properly configured or was not granted.
Super User Application Status:
SuperSU application - version 1.51 - is installed!
System File Properties for Root Access:
Standard Location
Check Command: ls -l /system/bin/su:
Result: /system/bin/su: No such file or directory
Analysis: File /system/bin/su does not exist.
Standard Location
Check Command: ls -l /system/xbin/su:
Result: -rwsr-sr-x root root 62932 2013-05-10 12:41 su
Analysis: Setuid attribute is present and root user ownership is present. Root access is correctly configured for this file! Executing this file can grant root access!
Alternative Location
Check Command: ls -l /sbin/su:
Result: /sbin/su: Permission denied
Analysis: File system permissions restricted and denied access.
Alternative Location
Check Command: ls -l /system/xbin/sudo:
Result: /system/xbin/sudo: No such file or directory
Analysis: File /system/xbin/sudo does not exist.
Root User ID and Group ID Status:
SU binary not found or not operating properly
System Environment PATH: /sbin /vendor/bin /system/sbin /system/bin /system/xbin
ADB Shell Default User:
ADB shell setting for standard access, stored in default.prop, is configured as: shell (non root) user - ro.secure=1
Results provided on your TechniPad 8 device by Root Checker Pro version 1.3.4 from joeykrim in the Android Market
Hello,
Have you found anything?
mfG
Philip
philidinator said:
Hello,
Have you found anything?
mfG
Philip
Click to expand...
Click to collapse
Nothing yet am afraid. It's a bit confusing at the device seems to think it is already rooted, but it isn't when you check for root capability. Am going to try something today - but it might end up making it a lovely paperweight. Will keep you posted.
Nothing new?
mfG
Philip
Rooted Technipad 8
philidinator said:
Nothing new?
mfG
Philip
Click to expand...
Click to collapse
SUCCESS!!
FOLLOW THE INSTRUCTIONS HERE AND ROOT ACCESS IS GRANTED - NOW TO FIND A CUSTOM ROM AND UPGRADE TO JB 4.2
JUST ROOTED MY TECHNIPAD 8 SO IF YOU NEED ANY HELP JUST ASK BUT THE INTRSUCTIONS WERE PRETTY SIMPLE TO FOLLOW.
GOOD LUCK! :good:
http://forum.xda-developers.com/showthread.php?t=2414994
I have a Technipad 10 and the rooting instructions mentioned above did not work unfortunately. Is anybody out there who know a possibilty to root this tablet?
For a little help, I would be very grateful.
Try this one:
https://github.com/Lostech/Root_Box/tree/V1.0
https://github.com/Lostech/Root_Box/archive/V1.0.zip
I made this based on other RK30 root´s for the TechniPad 10G with Android version 4.1.1 and build version GE.Technisat.S10_g.V107.
Calibaan said:
I made this based on other RK30 root´s for the TechniPad 10G with Android version 4.1.1 and build version GE.Technisat.S10_g.V107.
Click to expand...
Click to collapse
Hello Calibaan,
I’m thrilled, your program did work really well.
Thank you very much and have a nice weekend!
Technipad 7T
Hi,
i own a Technipad 7T and try to root it with Rootbox V1.1, but it wont work.
It has Android V4.2.2.
Any ideas why it wont work?
At which point does the root process fail?
I found Version 1.6 of root_box. but still no luck.
I use WinXp. Driver installation failed inside of root_box, so I installed the seperatly.
I failed doing the root.
Su was transfered to the root-dir.
After that I got a lot of "system/bin/su: rksu: not found" and "system/bin/su: suu: not found" and the Technipad is doing a reset.
But there is still no root-access or superuser installed.
Android-Info:
================
AndroidInfo V1.1
================
build.prop Inhalt:
------------------
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=JDQ39
ro.build.display.id=GE.TechniPad.V1.07
ro.build.version.incremental=20140514
ro.build.version.sdk=17
ro.build.version.codename=REL
ro.build.version.release=4.2.2
ro.build.date=Wed May 14 10:36:07 CST 2014
ro.build.date.utc=1400034967
ro.build.type=user
ro.build.user=liuyang
ro.build.host=swubuntu
ro.build.tags=test-keys
ro.product.model=TechniPad_7T
ro.product.brand=MID
ro.product.name=TPad_7T
ro.product.device=TechniPad_7T
ro.product.board=TPad_7T
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=TechniSat
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=13
ro.board.platform=meson6
# ro.build.product is obsolete; use ro.product.device
ro.build.product=TPad_7T
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=g17refm170m-user 4.2.2 JDQ39 20140514 test-keys
ro.build.fingerprint=MID/g17refm170m/g17refm170m:4.2.2/JDQ39/20140514:user/test-keys
ro.build.characteristics=tablet,nosdcard
# end build properties
ro.sf.lcd_density=160
keyguard.no_require_sim=1
#set keyguard.enable=false to disable keyguard
keyguard.enable=true
ro.statusbar.widget=true
ro.statusbar.button=true
ro.statusbar.yearmonthdayweek=true
# Time between scans in seconds. Keep it high to minimize battery drain.
# This only affects the case in which there are remembered access points,
# but none are in range.
#wifi.supplicant_scan_interval = 60
#alsa.mixer.playback.master=DAC2 Analog
#alsa.mixer.capture.master=Analog
hwui.render_dirty_regions=false
# Disable un-supported Android feature
hw.nopm=false
hw.nobattery=false
hw.nophone=false
hw.novibrate=true
hw.hasethernet=true
#hw.hasdata=true
ro.platform.has.touch=true
#set to 0 temporarily so touch works without other changes
ro.sf.hwrotation=0
# Use OSD2 mouse patch
ro.ui.cursor=osd2
ro.hardware=amlogic
sys.fb.bits=32
# Disable GPS
gps.enable=true
# Enable player buildin
media.amsuperplayer.enable=true
media.amplayer.enable-acodecs=ape,flac,dts
media.amplayer.enable=true
media.amsuperplayer.m4aplayer=STAGEFRIGHT_PLAYER
media.amsuperplayer.defplayer=PV_PLAYER
media.amplayer.thumbnail=true
#media.amplayer.widevineenable=true
media.amplayer.startmode=true
media.arm.audio.decoder=ape,ac3,eac3
# Nand write need force sync when gadget
gadget.nand.force_sync=true
# Status bar customization
ro.statusbar.widget.power=true
ro.statusbar.yearmonthdayweek=true
#support rotation btn for apk compatibility,set true btn useful
sys.rotation.settings=false
# HDMI
ro.hdmi480p.enable=false
#rw.fb.need2xscale=ok
#media.amplayer.osd2xenable=true
#Configure the dtv standard, can only be DVB,ATSC
dtv.standard=DVB
dtv.deinterlace.disable=true
dtv.transmission=3
audio.policy.digital.fixed=false
# App optimization
ro.app.optimization=true
#Dual display
ro.vout.dualdisplay3=true
ro.vout.player.exit=false
# CPU settings
ro.has.cpu.setting=true
# CPU freq customized in setting menu
# normal, performance, powersaving
ro.cpumode.maxfreq=1200000,1512000,800000
# when usbstorage, CPU mode and freq
ro.usbstorage.cpumode=performance
ro.usbstorage.maxfreq=600000
#ro.bootanimation.rotation=180
persist.service.adb.enable=0
#used to set default surface size, set 1 when hwrotation is 270, set 3 when hwrotation is 90;need set ro.bootanimation.rotation 0;
#debug.default.dimention=1
#support media poll uevent,can use sd cardread on usb port
#has.media.poll=false
has.media.poll=true
#used forward seek for libplayer
media.libplayer.seek.fwdsearch=1
#enable address bar cover issue fixing
ro.flashplayer.surfacehack=1
#fix hls sync
libplayer.livets.softdemux=1
libplayer.netts.recalcpts=1
#map volume
ro.audio.mapvalue=0,0,0,0
ro.media.partition.label=TechniPad7T
hw.has.bluetooth=true
#screenshot icon in status bar
ro.statusbar.screenshot=true
#vol + - icon in status bar
ro.statusbar.volume=true
#set HDMI ratation
#hdmi.hdmirotation=2
#systemui interval
rw.systemui.interval=40
media.libplayer.modules=vhls_mod
#for tabletui display
#ro.ui.tabletui=true
#skyworth Modify default language/country/timezone.
persist.sys.timezone=Europe/Berlin
persist.sys.language=de
persist.sys.country=De
#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.com.android.dateformat=MM-dd-yyyy
ro.config.ringtone=Ring_Synth_04.ogg
ro.config.notification_sound=pixiedust.ogg
ro.carrier=unknown
ro.opengles.version=131072
ro.config.alarm_alert=Alarm_Classic.ogg
dalvik.vm.heapstartsize=8m
dalvik.vm.heapgrowthlimit=64m
dalvik.vm.heapsize=384m
dalvik.vm.heaptargetutilization=0.75
dalvik.vm.heapminfree=512k
dalvik.vm.heapmaxfree=8m
wifi.interface=wlan0
gps.enable=false
hw.cameras=2
ro.camera.orientation.front=270
ro.camera.orientation.back=90
rw.sensors.gsensor.installdir=0110
ro.app.optimization=true
drm.service.enable=true
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
/bin Verzeichnis:
------------------------
/bin//bin: No such file or directory
/sbin Verzeichnis:
-------------------------
/sbin/opendir failed, Permission denied
/xbin Verzeichnis:
------------------------
/xbin//xbin: No such file or directory
/system/bin Verzeichnis:
------------------------
/system/bin/AmlHostsTool
/system/bin/abcc
/system/bin/adb
/system/bin/am
/system/bin/app_process
/system/bin/applypatch
/system/bin/atrace
/system/bin/bmgr
/system/bin/bootanimation
/system/bin/bu
/system/bin/bugreport
/system/bin/cat
/system/bin/chat
/system/bin/chmod
/system/bin/chown
/system/bin/cmp
/system/bin/content
/system/bin/cp
/system/bin/curl
/system/bin/dalvikvm
/system/bin/date
/system/bin/dbus-daemon
/system/bin/dd
/system/bin/debuggerd
/system/bin/dexopt
/system/bin/df
/system/bin/dhcpcd
/system/bin/dhd
/system/bin/dig
/system/bin/dmesg
/system/bin/dnsmasq
/system/bin/drmserver
/system/bin/du
/system/bin/dumpstate
/system/bin/dumpsys
/system/bin/fsck.exfat
/system/bin/fsck_msdos
/system/bin/getevent
/system/bin/getprop
/system/bin/glgps
/system/bin/grep
/system/bin/gzip
/system/bin/hd
/system/bin/hostapd
/system/bin/id
/system/bin/ifconfig
/system/bin/iftop
/system/bin/ime
/system/bin/init-pppd.sh
/system/bin/input
/system/bin/insmod
/system/bin/installd
/system/bin/ioctl
/system/bin/ionice
/system/bin/ip
/system/bin/ip6tables
/system/bin/iptables
/system/bin/keystore
/system/bin/kill
/system/bin/linker
/system/bin/ln
/system/bin/log
/system/bin/logcat
/system/bin/logwrapper
/system/bin/ls
/system/bin/lsmod
/system/bin/lsof
/system/bin/make_ext4fs
/system/bin/md5
/system/bin/mdnsd
/system/bin/mediaserver
/system/bin/mkdir
/system/bin/mksh
/system/bin/monkey
/system/bin/mount
/system/bin/mount.exfat
/system/bin/mtpd
/system/bin/mv
/system/bin/nandread
/system/bin/ndc
/system/bin/netcfg
/system/bin/netd
/system/bin/netstat
/system/bin/newfs_msdos
/system/bin/notify
/system/bin/ntfs-3g
/system/bin/ping
/system/bin/pm
/system/bin/pppd
/system/bin/printenv
/system/bin/ps
/system/bin/racoon
/system/bin/reboot
/system/bin/renice
/system/bin/requestsync
/system/bin/rild
/system/bin/rm
/system/bin/rmdir
/system/bin/rmmod
/system/bin/route
/system/bin/run-as
/system/bin/schedtest
/system/bin/schedtop
/system/bin/screencap
/system/bin/screenshot
/system/bin/sdcard
/system/bin/sendevent
/system/bin/sensorcalibrate
/system/bin/sensorservice
/system/bin/service
/system/bin/servicemanager
/system/bin/set_display_mode.sh
/system/bin/setconsole
/system/bin/setprop
/system/bin/settings
/system/bin/setup_fs
/system/bin/sh
/system/bin/sky_remount
/system/bin/sky_sudo
/system/bin/sleep
/system/bin/smd
/system/bin/start
/system/bin/stop
/system/bin/surfaceflinger
/system/bin/svc
/system/bin/sync
/system/bin/system_key_server
/system/bin/system_server
/system/bin/tc
/system/bin/tinycap
/system/bin/tinymix
/system/bin/tinyplay
/system/bin/toolbox
/system/bin/top
/system/bin/touch
/system/bin/uiautomator
/system/bin/umount
/system/bin/uptime
/system/bin/usb_modeswitch
/system/bin/usbpower
/system/bin/usbtestpm
/system/bin/vdc
/system/bin/vmstat
/system/bin/vold
/system/bin/watchprops
/system/bin/wififix.sh
/system/bin/wipe
/system/bin/wl
/system/bin/wpa_supplicant
/system/sbin Verzeichnis:
-------------------------
/system/sbin//system/sbin: No such file or directory
/system/xbin Verzeichnis:
------------------------
/system/xbin/[
/system/xbin/[[
/system/xbin/adjtimex
/system/xbin/arp
/system/xbin/ash
/system/xbin/awk
/system/xbin/base64
/system/xbin/basename
/system/xbin/bbconfig
/system/xbin/blkid
/system/xbin/blockdev
/system/xbin/brctl
/system/xbin/bunzip2
/system/xbin/busybox
/system/xbin/bzcat
/system/xbin/bzip2
/system/xbin/cal
/system/xbin/cat
/system/xbin/catv
/system/xbin/chattr
/system/xbin/chgrp
/system/xbin/chmod
/system/xbin/chown
/system/xbin/chroot
/system/xbin/clear
/system/xbin/cmp
/system/xbin/comm
/system/xbin/cp
/system/xbin/cpio
/system/xbin/crond
/system/xbin/crontab
/system/xbin/cut
/system/xbin/date
/system/xbin/dc
/system/xbin/dd
/system/xbin/depmod
/system/xbin/devmem
/system/xbin/dexdump
/system/xbin/df
/system/xbin/diff
/system/xbin/dirname
/system/xbin/dmesg
/system/xbin/dnsd
/system/xbin/dos2unix
/system/xbin/du
/system/xbin/echo
/system/xbin/ed
/system/xbin/egrep
/system/xbin/env
/system/xbin/expand
/system/xbin/expr
/system/xbin/false
/system/xbin/fbset
/system/xbin/fbsplash
/system/xbin/fdisk
/system/xbin/fgrep
/system/xbin/find
/system/xbin/flash_lock
/system/xbin/flash_unlock
/system/xbin/flashcp
/system/xbin/flock
/system/xbin/fold
/system/xbin/free
/system/xbin/freeramdisk
/system/xbin/fstrim
/system/xbin/fsync
/system/xbin/ftpget
/system/xbin/ftpput
/system/xbin/fuser
/system/xbin/getopt
/system/xbin/grep
/system/xbin/groups
/system/xbin/gunzip
/system/xbin/gzip
/system/xbin/halt
/system/xbin/head
/system/xbin/hexdump
/system/xbin/id
/system/xbin/ifconfig
/system/xbin/inetd
/system/xbin/insmod
/system/xbin/install
/system/xbin/ionice
/system/xbin/iostat
/system/xbin/ip
/system/xbin/kill
/system/xbin/killall
/system/xbin/killall5
/system/xbin/less
/system/xbin/ln
/system/xbin/losetup
/system/xbin/ls
/system/xbin/lsattr
/system/xbin/lsmod
/system/xbin/lsof
/system/xbin/lsusb
/system/xbin/lzcat
/system/xbin/lzma
/system/xbin/lzop
/system/xbin/lzopcat
/system/xbin/man
/system/xbin/md5sum
/system/xbin/mesg
/system/xbin/mkdir
/system/xbin/mkdosfs
/system/xbin/mke2fs
/system/xbin/mkfifo
/system/xbin/mkfs.ext2
/system/xbin/mkfs.vfat
/system/xbin/mknod
/system/xbin/mkswap
/system/xbin/mktemp
/system/xbin/modinfo
/system/xbin/modprobe
/system/xbin/more
/system/xbin/mount
/system/xbin/mountpoint
/system/xbin/mpstat
/system/xbin/mv
/system/xbin/nanddump
/system/xbin/nandwrite
/system/xbin/nbd-client
/system/xbin/netstat
/system/xbin/nice
/system/xbin/nohup
/system/xbin/nslookup
/system/xbin/ntpd
/system/xbin/od
/system/xbin/patch
/system/xbin/pgrep
/system/xbin/pidof
/system/xbin/ping
/system/xbin/pipe_progress
/system/xbin/pkill
/system/xbin/pmap
/system/xbin/poweroff
/system/xbin/printenv
/system/xbin/printf
/system/xbin/ps
/system/xbin/pstree
/system/xbin/pwd
/system/xbin/pwdx
/system/xbin/rdev
/system/xbin/readlink
/system/xbin/realpath
/system/xbin/reboot
/system/xbin/renice
/system/xbin/reset
/system/xbin/resize
/system/xbin/rev
/system/xbin/rm
/system/xbin/rmdir
/system/xbin/rmmod
/system/xbin/route
/system/xbin/run-parts
/system/xbin/rx
/system/xbin/sed
/system/xbin/seq
/system/xbin/setconsole
/system/xbin/setserial
/system/xbin/setsid
/system/xbin/sh
/system/xbin/sha1sum
/system/xbin/sha256sum
/system/xbin/sha3sum
/system/xbin/sha512sum
/system/xbin/sleep
/system/xbin/sort
/system/xbin/split
/system/xbin/stat
/system/xbin/strings
/system/xbin/stty
/system/xbin/sum
/system/xbin/swapoff
/system/xbin/swapon
/system/xbin/sync
/system/xbin/sysctl
/system/xbin/tac
/system/xbin/tail
/system/xbin/tar
/system/xbin/taskset
/system/xbin/tee
/system/xbin/telnet
/system/xbin/telnetd
/system/xbin/test
/system/xbin/tftp
/system/xbin/tftpd
/system/xbin/time
/system/xbin/timeout
/system/xbin/top
/system/xbin/touch
/system/xbin/tr
/system/xbin/traceroute
/system/xbin/true
/system/xbin/ttysize
/system/xbin/tune2fs
/system/xbin/umount
/system/xbin/uname
/system/xbin/uncompress
/system/xbin/unexpand
/system/xbin/uniq
/system/xbin/unix2dos
/system/xbin/unlzma
/system/xbin/unlzop
/system/xbin/unxz
/system/xbin/unzip
/system/xbin/uptime
/system/xbin/usleep
/system/xbin/uudecode
/system/xbin/uuencode
/system/xbin/vi
/system/xbin/watch
/system/xbin/wc
/system/xbin/wget
/system/xbin/whoami
/system/xbin/xargs
/system/xbin/xz
/system/xbin/xzcat
/system/xbin/yes
/system/xbin/zcat
Potentielle SuperUser Dateien:
------------------------------
/system/bin/surfaceflinger -> (su)rfaceflinger
/system/xbin/sum -> (su)m
You´re using the "T" Variant of the TechniPad which is different to the regular TechniPad´s. I didn´t have one of these but it seems that the regular Rockchip root for Android 4.1/4.2 does not work on this variant like on the other TechniPads. But since you do have Android V4.2.2 installed there is still the chance that rooting is possible with the TowelRoot method (menu entry 3 within the RootBox 1.6 or take the APK from the original TowelRoot creator GeoHot @ https://towelroot.com/). So I assume to give TowelRoot a try.
I tried Towelroot but still no luck. Startet it, make it rain and it shows "this phone isnt currently supported".
It seems that this TechniPad model is very different to the other models and I have no clue what could work for it. So in this case I can´t help you any further, sorry.
Thanx for your help.

Reverse tethering.. it works but no DNS!

I've a Samsung S5 with CM12.1 + FakeWifi (Xposed).
I use the following script to reverse tether with ubuntu.
Code:
#!/bin/bash
ADB="adb"
# We need root on the host to mess with networking
if [[ $(whoami) != "root" ]]; then
echo "You must be root to run this script!"
exit 1
fi;
# We need root on the device to mess with networking
$ADB -d root
# Keep NetworkManager from messing with the adapter
grep 'usb0 inet manual' /etc/network/interfaces
if [ ! $? ]; then
echo 'Configuring usb0 for manual control'
echo 'iface usb0 inet manual' >> /etc/network/interfaces
restart network-manager
fi
echo 'Setting up usb networking on device'
$ADB -d shell 'ip addr add 192.168.200.2/30 dev rndis0;\
ip link set rndis0 up; \
ip route delete default; \
ip route add default via 192.168.200.1; \
setprop net.dns1 192.168.200.1'
echo 'Setting up usb interface on the host'
ip addr flush dev usb0
ip addr add 192.168.200.1/30 dev usb0
ip link set usb0 up
# Turn off the firewall if one is active
echo 'Checking for ufw firewall'
which ufw && ufw status || ufw disable
echo 'Enabling NAT and IP Forwarding'
# Start forwarding and nat (use existing default gw)
iptables -F -t nat
iptables -A POSTROUTING -t nat -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 'Starting dnsmasq'
dnsmasq --interface=usb0 --no-dhcp-interface=usb0
echo 'Connection is active! Press any key to shutdown.'
read
echo 'Attempting to shut down reverse tethering'
killall dnsmasq
ip link set usb0 down
iptables -F -t nat
echo 0 > /proc/sys/net/ipv4/ip_forward
echo 'Disabling usb networking on host'
$ADB shell ip route delete default
echo 'Disable and re-enable Wifi to return the device to normal'
Now the problem is that if I ping a public IP it works, but if I ping or curl the corresponding domain it fails "unknown host", "could not resolve".
What the heck should I do in order to make DNS working?
Thanks a lot for your help
Tsktsk said:
I've a Samsung S5 with CM12.1 + FakeWifi (Xposed).
I use the following script to reverse tether with ubuntu.
Code:
#!/bin/bash
ADB="adb"
# We need root on the host to mess with networking
if [[ $(whoami) != "root" ]]; then
echo "You must be root to run this script!"
exit 1
fi;
# We need root on the device to mess with networking
$ADB -d root
# Keep NetworkManager from messing with the adapter
grep 'usb0 inet manual' /etc/network/interfaces
if [ ! $? ]; then
echo 'Configuring usb0 for manual control'
echo 'iface usb0 inet manual' >> /etc/network/interfaces
restart network-manager
fi
echo 'Setting up usb networking on device'
$ADB -d shell 'ip addr add 192.168.200.2/30 dev rndis0;\
ip link set rndis0 up; \
ip route delete default; \
ip route add default via 192.168.200.1; \
setprop net.dns1 192.168.200.1'
echo 'Setting up usb interface on the host'
ip addr flush dev usb0
ip addr add 192.168.200.1/30 dev usb0
ip link set usb0 up
# Turn off the firewall if one is active
echo 'Checking for ufw firewall'
which ufw && ufw status || ufw disable
echo 'Enabling NAT and IP Forwarding'
# Start forwarding and nat (use existing default gw)
iptables -F -t nat
iptables -A POSTROUTING -t nat -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 'Starting dnsmasq'
dnsmasq --interface=usb0 --no-dhcp-interface=usb0
echo 'Connection is active! Press any key to shutdown.'
read
echo 'Attempting to shut down reverse tethering'
killall dnsmasq
ip link set usb0 down
iptables -F -t nat
echo 0 > /proc/sys/net/ipv4/ip_forward
echo 'Disabling usb networking on host'
$ADB shell ip route delete default
echo 'Disable and re-enable Wifi to return the device to normal'
Now the problem is that if I ping a public IP it works, but if I ping or curl the corresponding domain it fails "unknown host", "could not resolve".
What the heck should I do in order to make DNS working?
Thanks a lot for your help
Click to expand...
Click to collapse
Hi! Unfortunately, I have no idea on how to fix these issues, but if you'd be willing to try a different reverse tethering solution, you might want to try ReverseTethering NoRoot, an app I have developed. I have opened a dedicated thread over here: http://forum.xda-developers.com/android/apps-games/app-reversetethering-noroot-t3316716
Tsktsk said:
I've a Samsung S5 with CM12.1 + FakeWifi (Xposed).
I use the following script to reverse tether with ubuntu.
Code:
#!/bin/bash
ADB="adb"
# We need root on the host to mess with networking
if [[ $(whoami) != "root" ]]; then
echo "You must be root to run this script!"
exit 1
fi;
# We need root on the device to mess with networking
$ADB -d root
# Keep NetworkManager from messing with the adapter
grep 'usb0 inet manual' /etc/network/interfaces
if [ ! $? ]; then
echo 'Configuring usb0 for manual control'
echo 'iface usb0 inet manual' >> /etc/network/interfaces
restart network-manager
fi
echo 'Setting up usb networking on device'
$ADB -d shell 'ip addr add 192.168.200.2/30 dev rndis0;\
ip link set rndis0 up; \
ip route delete default; \
ip route add default via 192.168.200.1; \
setprop net.dns1 192.168.200.1'
echo 'Setting up usb interface on the host'
ip addr flush dev usb0
ip addr add 192.168.200.1/30 dev usb0
ip link set usb0 up
# Turn off the firewall if one is active
echo 'Checking for ufw firewall'
which ufw && ufw status || ufw disable
echo 'Enabling NAT and IP Forwarding'
# Start forwarding and nat (use existing default gw)
iptables -F -t nat
iptables -A POSTROUTING -t nat -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 'Starting dnsmasq'
dnsmasq --interface=usb0 --no-dhcp-interface=usb0
echo 'Connection is active! Press any key to shutdown.'
read
echo 'Attempting to shut down reverse tethering'
killall dnsmasq
ip link set usb0 down
iptables -F -t nat
echo 0 > /proc/sys/net/ipv4/ip_forward
echo 'Disabling usb networking on host'
$ADB shell ip route delete default
echo 'Disable and re-enable Wifi to return the device to normal'
Now the problem is that if I ping a public IP it works, but if I ping or curl the corresponding domain it fails "unknown host", "could not resolve".
What the heck should I do in order to make DNS working?
Thanks a lot for your help
Click to expand...
Click to collapse
Hi did you end up resolving this issue? I have the exact same problem. Can ping any site but DNS lookup fails. Then I installed DNSsetter app which allows me to change the dns server. Now I can do DNS lookups and it resolves correctly but none of the apps do not appear to be aware of the fact that the phone is using reverse USB tethering.

SSHD problem (cm13)

Hi,
sshd won't work on my Moto G (Falcon) with CM13
Can anyone help me?
Logcat:
Code:
07-17 00:42:25.618 24464 24464 I /system/bin/sshd: Server listening on :: port 22.
07-17 00:42:25.618 24464 24464 I /system/bin/sshd: Server listening on 0.0.0.0 port 22.
07-17 00:42:28.787 24492 24492 E /system/bin/sshd: error: Could not load host key: /data/ssh/ssh_host_dsa_key
07-17 00:42:28.792 24492 24492 I /system/bin/sshd: WARNING: /data/ssh/moduli does not exist, using fixed modulus
07-17 00:42:28.901 218 218 F DEBUG : pid: 24493, tid: 24493, name: sshd >>> /system/bin/sshd: [net] <<<
07-17 00:42:28.938 218 218 F DEBUG : #10 pc 0000cdc9 /system/bin/sshd
07-17 00:42:28.938 218 218 F DEBUG : #13 pc 00020d6f /system/bin/sshd
07-17 00:42:28.938 218 218 F DEBUG : #15 pc 000073e4 /system/bin/sshd
07-17 00:42:28.989 24492 24492 E /system/bin/sshd: error: mm_request_receive: socket closed
/data/ssh:
Code:
drw------- 2 root shell 4096 1970-01-01 05:49 empty
-rw------- 1 root root 672 2016-07-17 01:01 ssh_host_dsa_key
-rw-r--r-- 1 root root 604 2016-07-17 01:01 ssh_host_dsa_key.pub
-rw------- 1 root root 1675 2016-07-17 01:01 ssh_host_rsa_key
-rw-r--r-- 1 root root 396 2016-07-17 01:01 ssh_host_rsa_key.pub
-rw------- 1 root root 5 2016-07-17 01:11 sshd.pid
-rw------- 1 root root 3330 2016-07-17 00:00 sshd_config
sshd_config:
Code:
# $OpenBSD: sshd_config,v 1.84 2011/05/23 03:30:07 djm Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
# The default requires explicit activation of protocol 1
Protocol 2
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /data/ssh/ssh_host_rsa_key
HostKey /data/ssh/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
#RSAAuthentication yes
PubkeyAuthentication yes
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile /data/ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
PermitEmptyPasswords no
# Change to no to disable s/key passwords
ChallengeResponseAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM no
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS yes
PidFile /data/ssh/sshd.pid
#MaxStartups 10
#PermitTunnel no
#ChrootDirectory none
# no default banner path
Banner /data/ssh/banner
# override default of no subsystems
Subsystem sftp internal-sftp
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# ForceCommand cvs server
/data/local/userinit.d/99sshd:
Code:
#!/system/bin/sh
umask 077
# DEBUG=1
DSA_KEY=/data/ssh/ssh_host_dsa_key
DSA_PUB_KEY=/data/ssh/ssh_host_dsa_key.pub
RSA_KEY=/data/ssh/ssh_host_rsa_key
RSA_PUB_KEY=/data/ssh/ssh_host_rsa_key.pub
AUTHORIZED_KEYS=/data/ssh/authorized_keys
DEFAULT_AUTHORIZED_KEYS=/system/etc/security/authorized_keys.default
if [ ! -f $DSA_KEY ]; then
/system/bin/ssh-keygen -t dsa -f $DSA_KEY -N ""
chmod 600 /$DSA_KEY
chmod 644 $DSA_PUB_KEY
fi
if [ ! -f $RSA_KEY ]; then
/system/bin/ssh-keygen -t rsa -f $RSA_KEY -N ""
chmod 600 /$RSA_KEY
chmod 644 $RSA_PUB_KEY
fi
if [[ ! -f $AUTHORIZED_KEYS && -f $DEFAULT_AUTHORIZED_KEYS ]]; then
cat $DEFAULT_AUTHORIZED_KEYS > $AUTHORIZED_KEYS
fi
if [ "1" == "$DEBUG" ] ; then
# run sshd in debug mode and capture output to logcat
/system/bin/logwrapper /system/bin/sshd -f /data/ssh/sshd_config -D -d
else
# don't daemonize - otherwise we can't stop the sshd service
/system/bin/sshd -f /data/ssh/sshd_config -D
fi
Thanks in advance
Post on cyanogenmod forum:
https://forum.cyanogenmod.org/topic/127039-sshd-problem-cm13/#comment-603490

Rooting the webOS TV

pivotce.com informs that instructions have been published on gaining root access to a webOS TV. This is much harder than on the old phones and tablets. When this was done on legacy webOS, there was a wave of enhancements and tweaks made available to phone users from webOS Internals and other developers.
The instructions can be found on the Russian webOS forums here: webos-forums.ru/topic4650.html (English Translation via Google).
As the thread itself notes, this creates the possibility of fiddling with your TV in a way that may turn it into a large, thin brick and will almost certainly invalidate your warranty. The general user should stay well clear of this.
pivotCE published this for information only and recommend leaving investigations to those who know what they are doing or who can afford to wreck expensive television sets. We will watch to see if anything interesting emerges from this development.
+
Detailed analysis of the root access method described above:
forums.webosnation.com/lg-webos-tv/331754-pivotce-seems-webos-tv-has-been-rooted.html#post3450911
Hello!
I'm from webos-forums.ru. I've root on TV for a while and can help you with translation or testing on LG webOS 1.4.
rooting
I could use your help rooting my lg 65uf6450-ua if you would. Thank you
Root webOS
Hodizzal said:
I could use your help rooting my lg 65uf6450-ua if you would. Thank you
Click to expand...
Click to collapse
1. You need to install Developer Mode App and export private ssh-key with CLI (webostv.developer.lge.com/develop/app-test)
2. Convert private ssh-key with puttygen [import key <your private ssh-key>, then save private key]
3. Download exploit (zalil.su/6937580), then connect with TV User: prisoner, [<ip-tv>:9922] + private-key with WinSCP (or other SCP-client), upload to /media/developer on TV and rename it to root.
on linux
Code:
ssh -i <your private ssh-key> [email protected]<ip-tv> -p 9922 "/bin/sh -i"
4.
Code:
chmod +x root
Code:
./root
5. After try install any app from market go to LG App Store and try to install any app.
6. if third stage ok. the insert password 1111 as said.
7.
Code:
busybox chroot /proc/1/root
Code:
[email protected]tTV:/# id
Code:
uid=0(root) gid=0(root)........
I personally use Linux Subsystem on Windows 10 for all of this.
To install .ipk app:
Code:
ApplicationInstallerUtility -c install -p /tmp/<any-name>.ipk -u 0 -l /media/developer -d
Info about your linux kernel and TV firmware:
Code:
luna-send -n 1 -f luna://com.palm.systemservice/osInfo/query '{ "subscribe": false }'
Launch app:
Code:
luna-send -n 1 -f luna://com.webos.applicationManager/launch '{"id": "netflix"}'
All apps ID you can find with
Code:
luna-send -n 1 "palm://com.palm.applicationManager/listLaunchPoints" "{}"
or at a folder /media/cryptofs/apps/usr/palm/applications/<App ID>/appinfo.json
For permanent root access through telnet:
1)
Code:
[email protected]:/# mkdir -p /media/cryptofs/root/etc
2)
Code:
[email protected]:/# cp -r /etc/* /media/cryptofs/root/etc
3)
Code:
[email protected]:/# mount -o bind /media/cryptofs/root/etc /etc
4)
Code:
[email protected]:/# passwd root
Enter any new root password
5)
Code:
cp /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh /tmp/start-devmode.sh
6) Download with WinSCP start-devmode.sh and edit it locally.
You need to add at the beginning
Code:
mount -o bind /media/cryptofs/root/etc /etc
telnetd -l /sbin/sulogin &
Plus you can add the line to launch any App at start, e.g:
Code:
luna-send -n 1 -f luna://com.webos.applicationManager/launch '{"id": "netflix", "params":{}}'
And comment Dev Mode online check.
Here it's mine start-devmode.sh. It's for webOS 1.4. It can be different for other webOS versions:
Code:
#!/bin/sh
mount -o bind /media/cryptofs/root/etc /etc
telnetd -l /sbin/sulogin &
#luna-send -n 1 -f luna://com.webos.applicationManager/launch '{"id": "netflix", "params":{}}'
# FIXME: disable this to turn off script echo
set -x
# FIXME: disable this to stop script from bailing on error
# set -e
# TODO: Check upstart daemon/process tracking (do we need to change /etc/init/devmode.conf? start sshd as daemon?)
# set devmode ssh port here
SSH_PORT="9922"
# set arch:
ARCH="armv71"
grep -qs "qemux86" /etc/hostname && ARCH="i686"
# set directories
OPT_DEVMODE="/opt/devmode"
OPT_SSH="/opt/openssh"
DEVELOPER_HOME="/media/developer"
DEVMODE_SERVICE_DIR="/media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service"
CRYPTO_SSH="$DEVMODE_SERVICE_DIR/binaries-${ARCH}/opt/openssh"
CRYPTO_OPT="$DEVMODE_SERVICE_DIR/binaries-${ARCH}/opt"
if [ -s ${DEVMODE_SERVICE_DIR}/jail_app.conf ] ; then
mv ${DEVMODE_SERVICE_DIR}/jail_app.conf ${DEVELOPER_HOME}
mv ${DEVMODE_SERVICE_DIR}/jail_app.conf.sig ${DEVELOPER_HOME}
fi
if [ -r ${DEVMODE_SERVICE_DIR}/sessionToken ] ; then
mv -f ${DEVMODE_SERVICE_DIR}/sessionToken /var/luna/preferences/devmode_enabled
fi
# Make sure the ssh binaries are executable (in service directory)
if [ ! -x "${CRYPTO_SSH}/sbin/sshd" ] ; then
chmod ugo+x ${CRYPTO_SSH}/sbin/sshd ${CRYPTO_SSH}/bin/ssh* ${CRYPTO_SSH}/bin/scp* || true
chmod ugo+x ${CRYPTO_SSH}/bin/sftp ${CRYPTO_SSH}/lib/openssh/* || true
chmod ugo+x ${CRYPTO_OPT}/devmode/usr/bin/* || true
fi
# TODO: (later) Look for "re-init" flag to re-generate ssh key if requested by app (via devkey service)
# com.palm.service.devmode could have "resetKey" method to erase /var/lib/devmode/ssh/webos_rsa
# Kind of dangerous though, since new key will need to be fetched on the desktop (after reboot)...
# We could just require a hard-reset of the TV which should blow away /var/lib/devmode/ssh/...
# Initialize the developer (client) SSH key pair, if it doesn't already exist
if [ ! -e /var/lib/devmode/ssh/webos_rsa ] ; then
mkdir -p /var/lib/devmode/ssh
chmod 0700 /var/lib/devmode/ssh
# get FIRST six (UPPER-CASE, hex) characters of 40-char nduid from nyx-cmd
# NOTE: This MUST match passphrase as displayed in devmode app (main.js)!
# PASSPHRASE="`/usr/bin/nyx-cmd DeviceInfo query nduid | head -c 6 | tr 'a-z' 'A-Z'`"
# PASSPHRASE="`/usr/bin/nyx-cmd DeviceInfo query nduid | tail -n1 | head -c 6 | tr 'a-z' 'A-Z'`"
PASSPHRASE="`tail /var/lib/secretagent/nduid -c 40 | head -c 6 | tr 'a-z' 'A-Z'`"
${CRYPTO_SSH}/bin/ssh-keygen -t rsa -C "[email protected]" -N "${PASSPHRASE}" -f /var/lib/devmode/ssh/webos_rsa
# copy ssh key to /var/luna/preferences so the devmode service's KeyServer can read it and serve to ares-webos-cli tools
cp -f /var/lib/devmode/ssh/webos_rsa /var/luna/preferences/webos_rsa
chmod 0644 /var/luna/preferences/webos_rsa
# if we generated a new ssh key, make sure we re-create the authorized_keys file
rm -f ${DEVELOPER_HOME}/.ssh/authorized_keys
fi
# Make sure the /media/developer (and log) directories exists (as sam.conf erases it when devmode is off):
mkdir -p ${DEVELOPER_HOME}/log
chmod 777 ${DEVELOPER_HOME} ${DEVELOPER_HOME}/log
# Install the SSH key into the authorized_keys file (if it doesn't already exist)
if [ ! -e ${DEVELOPER_HOME}/.ssh/authorized_keys ] ; then
mkdir -p ${DEVELOPER_HOME}/.ssh
cp -f /var/lib/devmode/ssh/webos_rsa.pub ${DEVELOPER_HOME}/.ssh/authorized_keys || true
# NOTE: authorized_keys MUST be world-readable else sshd can't read it inside the devmode jail
# To keep sshd from complaining about that, we launch sshd with -o "StrictModes no" (below).
chmod 755 ${DEVELOPER_HOME}/.ssh
chmod 644 ${DEVELOPER_HOME}/.ssh/authorized_keys
chown -R developer:developer ${DEVELOPER_HOME}/.ssh
fi
# FIXME: Can we move this to /var/run/devmode/sshd ?
# Create PrivSep dir
mkdir -p /var/run/sshd
chmod 0755 /var/run/sshd
# Create directory for host keys (rather than /opt/openssh/etc/ssh/)
HOST_KEY_DIR="/var/lib/devmode/sshd"
if [ ! -d "${HOST_KEY_DIR}" ] ; then
mkdir -p ${HOST_KEY_DIR}
chmod 0700 ${HOST_KEY_DIR}
fi
# Create initial keys if necessary
if [ ! -f ${HOST_KEY_DIR}/ssh_host_rsa_key ]; then
echo " generating ssh RSA key..."
${CRYPTO_SSH}/bin/ssh-keygen -q -f ${HOST_KEY_DIR}/ssh_host_rsa_key -N '' -t rsa
fi
if [ ! -f ${HOST_KEY_DIR}/ssh_host_ecdsa_key ]; then
echo " generating ssh ECDSA key..."
${CRYPTO_SSH}/bin/ssh-keygen -q -f ${HOST_KEY_DIR}/ssh_host_ecdsa_key -N '' -t ecdsa
fi
if [ ! -f ${HOST_KEY_DIR}/ssh_host_dsa_key ]; then
echo " generating ssh DSA key..."
${CRYPTO_SSH}/bin/ssh-keygen -q -f ${HOST_KEY_DIR}/ssh_host_dsa_key -N '' -t dsa
fi
# Check config
# NOTE: This should only be enabled for testing
#${CRYPTO_SSH}/sbin/sshd -f ${CRYPTO_SSH}/etc/ssh/sshd_config -h ${HOST_KEY_DIR}/ssh_host_rsa_key -t
# Set jailer command
DEVMODE_JAIL="/usr/bin/jailer -t native_devmode -i com.palm.devmode.openssh -p ${DEVELOPER_HOME}/ -s /bin/sh"
#DEVMODE_JAIL="echo"
# Add for debugging, but this will cause sshd to exit after the first ssh login:
# -ddd -e
# Make environment file for openssh
DEVMODE_JAIL_CONF="/etc/jail_native_devmode.conf"
DEVMODE_OPENSSH_ENV="${DEVELOPER_HOME}/.ssh/environment"
if [ -f ${DEVMODE_JAIL_CONF} ]; then
echo " generating environment file from jail_native_devmode.conf..."
find ${DEVMODE_JAIL_CONF} | xargs awk '/setenv/{printf "%s=%sn", $2,$3}' > ${DEVMODE_OPENSSH_ENV}
${DEVMODE_JAIL} /usr/bin/env >> ${DEVMODE_OPENSSH_ENV}
fi
# Set path for devmode
if [ -f ${DEVMODE_OPENSSH_ENV} ]; then
echo "PATH=${PATH}:${OPT_DEVMODE}/usr/bin" >> ${DEVMODE_OPENSSH_ENV}
fi
sleep 5;
for interface in $(ls /sys/class/net/ | grep -v -e lo -e sit);
do
if [ -r /sys/class/net/$interface/carrier ] ; then
if [[ $(cat /sys/class/net/$interface/carrier) == 1 ]]; then OnLine=1; fi
fi
done
#if [ $OnLine ]; then
# sessionToken=$(cat /var/luna/preferences/devmode_enabled);
# checkSession=$(curl --max-time 3 -s https://developer.lge.com/secure/CheckDevModeSession.dev?sessionToken=$sessionToken);
# if [ "$checkSession" != "" ] ; then
# result=$(node -pe 'JSON.parse(process.argv[1]).result' "$checkSession");
# if [ "$result" == "success" ] ; then
rm -rf /var/luna/preferences/dc*;
# # create devSessionTime file to remain session time in devmode app
# remainTime=$(node -pe 'JSON.parse(process.argv[1]).errorMsg' "$checkSession");
# resultValidTimeCheck=$(echo "${remainTime}" | egrep "^([0-9]{1,4}(:[0-5][0-9]){2})$");
# if [ "$resultValidTimeCheck" != "" ] ; then
echo '900:00:00' > ${DEVMODE_SERVICE_DIR}/devSessionTime;
chgrp 5000 ${DEVMODE_SERVICE_DIR}/devSessionTime;
chmod 664 ${DEVMODE_SERVICE_DIR}/devSessionTime;
# fi
# elif [ "$result" == "fail" ] ; then
# rm -rf /var/luna/preferences/devmode_enabled;
# rm -rf /var/luna/preferences/dc*;
# if [ -e ${DEVMODE_SERVICE_DIR}/devSessionTime ] ; then
# rm ${DEVMODE_SERVICE_DIR}/devSessionTime;
# fi
# fi
# fi
#fi
# Cache clear function added (except Local storage)
if [ -e ${DEVMODE_SERVICE_DIR}/devCacheClear ] ; then
rm -rf `ls | find /var/lib/webappmanager*/* -name "Local Storage" -o -name "localstorage" -prune -o -print`;
rm ${DEVMODE_SERVICE_DIR}/devCacheClear;
fi
# Launch sshd
${DEVMODE_JAIL} ${OPT_SSH}/sbin/sshd
-o StrictModes=no
-f ${OPT_SSH}/etc/ssh/sshd_config
-h ${HOST_KEY_DIR}/ssh_host_rsa_key
-o PasswordAuthentication=no -o PermitRootLogin=no -o PermitUserEnvironment=yes
-D -p ${SSH_PORT}
7) Upload new start-devmode.sh and rewrite the old one
Code:
cp /tmp/start-devmode.sh /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh
8) Restart TV.
Connect with telnet and type previously entered password.
Code:
telnet <ip-tv>
Trying <ip-tv>...
Connected to <ip-tv>].
Escape character is '^]'.
webOS TV 1.4.0 LGSmartTV
Give root password for system maintenance
(or type Control-D for normal startup):
Entering System Maintenance Mode
[email protected]:/#
Does it work on WebOS 3.5 devices?
medi01 said:
Does it work on WebOS 3.5 devices?
Click to expand...
Click to collapse
Positive.
is it possible to install webOS 3.0 on an 65EF9500 that currently has WebOS 2.0 via the USB upgrade method?
enkrypt3d said:
is it possible to install webOS 3.0 on an 65EF9500 that currently has WebOS 2.0 via the USB upgrade method?
Click to expand...
Click to collapse
No
Is there any method to get 3.0 installed over 1.4 I have a 49ub8500-ua
syconu said:
Is there any method to get 3.0 installed over 1.4 I have a 49ub8500-ua
Click to expand...
Click to collapse
No
Is there anything hack related that I can do with this to and can is support a new air mouse with a dongle
Ok, so I get run the root app and first ,second , and third stage all are good. then it says try get root password is 1111. But the terminal keeps freezing after that happens. A couple times my tv rebooted too. I cant figure out what i could have messed up. ANyone with any experience using this method have any legit information?
steven817817 said:
Ok, so I get run the root app and first ,second , and third stage all are good. then it says try get root password is 1111. But the terminal keeps freezing after that happens. A couple times my tv rebooted too. I cant figure out what i could have messed up. ANyone with any experience using this method have any legit information?
Click to expand...
Click to collapse
Try to delete all 'cache' files from exploit at /media/developer. It doesn't wotk twice as far as I concerned
Is there anyway I can root my 1.4.0 and if so what r the benefits of the root? Can I install Android or kodi? What's the point
teffd said:
Try to delete all 'cache' files from exploit at /media/developer. It doesn't wotk twice as far as I concerned
Click to expand...
Click to collapse
I tried it stil seems to finish step 3 then says enter 1111. But this is where it freezes up and does not get any further.
Is this still working on 3.6? I'm stuck at try to install any app from market.
Mazda77 said:
Positive.
Click to expand...
Click to collapse
Which TV and firmware version?
Is this possible with UJ63 serie?
Hi, would the root access allow somehow to connect other bluetooth devices different than LG? Thanks!
You can do pretty much anything to the system with root, even include support for unsupported devices in form of additional kernel modules.
For example, I've added Samba support so I can mount use my NAS (see my blog at ddscentral dot org for details).
Hey guys is it possible to install android apps into WebOS? I just bought an Lg oled LG 55EG9A7V i want to use Perfect Player IPTV but i cant install it right now...Other then that i dont need anything else..
Can anyone help me?

Categories

Resources