How to mitigate the risk of having an unlocked bootloader against an evil maid attack that side-loads malware/spyware? - Security Discussion

I want to clarify, i already saw many threads mentioning how you can protect your data with an unlocked bootloader, so no need to go deep into that.
But it also seems to me, many people just avoid the other issues, like an attacker being able to sideload malware in your device.
How to mitigate those other risks?

cablop said:
I want to clarify, i already saw many threads mentioning how you can protect your data with an unlocked bootloader, so no need to go deep into that.
But it also seems to me, many people just avoid the other issues, like an attacker being able to sideload malware in your device.
How to mitigate those other risks?
Click to expand...
Click to collapse
Sideloading malware requires physically access to your device. You have to reboot into bootloader mode and flashing e.g. a patched system.img and then reboot into system again. To avoid this: Never leave your device unattended.

WoKoschekk said:
Sideloading malware requires physically access to your device. You have to reboot into bootloader mode and flashing e.g. a patched system.img and then reboot into system again. To avoid this: Never leave your device unattended.
Click to expand...
Click to collapse
I am fully aware of that. But there are time you leave it unattended, you can't carry a bag with all your belongings with you to every place you must be in, e.g., bathroom, beach, gym, etc.
So, if you leave it unattended and then you come back and you think it was compromised, what can you do, apart from a full reset? Can't you have a tool that tells you if something changed, somebody took it, it rebooted, etc.?

cablop said:
I am fully aware of that. But there are time you leave it unattended, you can't carry a bag with all your belongings with you to every place you must be in, e.g., bathroom, beach, gym, etc.
Click to expand...
Click to collapse
It seems a bit paranoid... When I'm not at home my phone is in my pocket or locked up (e.g. gym). That's it.
cablop said:
So, if you leave it unattended and then you come back and you think it was compromised, what can you do, apart from a full reset? Can't you have a tool that tells you if something changed, somebody took it, it rebooted, etc.?
Click to expand...
Click to collapse
A full reset would do nothing for you. In bootloader menu you have no access to /data. Even if fully booted up nobody can access /data due to my display pattern. So, a full wipe wouldn't help you since it only wipes /data.
As I already said you could only patch the system.img/vendor.img with malware. But if Android verified boot is enabled, it's impossible to change something on these partitions.

WoKoschekk said:
It seems a bit paranoid... When I'm not at home my phone is in my pocket or locked up (e.g. gym). That's it.
Click to expand...
Click to collapse
Not really paranoid. You only need to see the ads offering ways to people to know what their partners do, don't they? Keyloggers predate Android phones, so how can i think they are not a real risk?
WoKoschekk said:
A full reset would do nothing for you. In bootloader menu you have no access to /data. Even if fully booted up nobody can access /data due to my display pattern. So, a full wipe wouldn't help you since it only wipes /data.
As I already said you could only patch the system.img/vendor.img with malware. But if Android verified boot is enabled, it's impossible to change something on these partitions.
Click to expand...
Click to collapse
BTW. If it was impossible to write on those partitions, then it would be impossible to change the firmware of the phone, but we do when we unlock the bootloader, and then we patch stuff, like a new recovery partition and even root the phone. So it is not something the Android verified boot can do.

It seems to me that while Google and the vendors think it is important to keep the bootloader locked for security reasons, the community keeps looking in other direction to say it is not, and there's no risk, but there is.

cablop said:
BTW. If it was impossible to write on those partitions, then it would be impossible to change the firmware of the phone
Click to expand...
Click to collapse
You mixed up things. A new firmware is not the same as patching /system on a stock ROM. Even a custom recovery requires a patched vbmeta.img in most cases.
Malware is an executable file that can only be stored on a file system. You can't store it on a boot.img or recovery.img since they are only binaries. No, you need e.g. /system or /vendor. Only there you could store a malicious file like a patched APK that gets executed by system during the next boot sequence.

WoKoschekk said:
You mixed up things. A new firmware is not the same as patching /system on a stock ROM. Even a custom recovery requires a patched vbmeta.img in most cases.
Malware is an executable file that can only be stored on a file system. You can't store it on a boot.img or recovery.img since they are only binaries. No, you need e.g. /system or /vendor. Only there you could store a malicious file like a patched APK that gets executed by system during the next boot sequence.
Click to expand...
Click to collapse
ok, that is interesting, but comes with a doubt... then, how does Magisk work? afaik it is a patch outside the firmware or system or data... Can't we install a malware to the phone in a similar way Magisk gets installed?

cablop said:
ok, that is interesting, but comes with a doubt... then, how does Magisk work? afaik it is a patch outside the firmware or system or data... Can't we install a malware to the phone in a similar way Magisk gets installed?
Click to expand...
Click to collapse
Even Magisk needs an installation for the Manager APK when a patched boot.img gets booted. The APK isn't part of the patch and the installation must be granted by the user.

WoKoschekk said:
Even Magisk needs an installation for the Manager APK when a patched boot.img gets booted. The APK isn't part of the patch and the installation must be granted by the user.
Click to expand...
Click to collapse
Hmmm.
Ok, maybe i am confused by thinking the bootloader of Android can work in a similar fashion as the boot of Linux or even Windows.
So, just to be sure, what you are telling me is that there's no way to install with an unlocked bootloader a malware in the system, either as new software or replacing an existing one, but that the risk is they can read my data, something that i can solve with a proper device or userspace encryption, right?
Can't we flash some things from the TWRP or alike like the GMS directly into the system?

Related

[Q] Considering rooting the Nexus 5

So I have a black Nexus 5 with a capacity of 16GB. The device is only about 4 months old, so I still have it covered with warranty until June 2016. The device is as good as new and I'm very happy with it because everything is so fast and smooth.
Recently I've been thinking about rooting the device for maybe some little extras. For example, I have GTA SA installed but I would like to play it with the Cleo mod to have a little bit more fun. Or maybe I'll install some kind of adblocker so I could enjoy my brand new phone without the annoying gold diggers. Or perhaps I want to hide some apps from my app drawer so it would look neat and organised. Or I would like to install an apk that isn't available for non-rooted devices. Or in case I want to see the battery percentage next to the time display or anything like that.
As you can see I would only want to root it for rather small reasons. I definitely don't want to overclock anything because it already meets my criteria for speed, nor do I want to install any custom ROMs because I really like the pure android experience. So I have a few questions because I'm a total noob at the field of tweaking android:
Is my current data going to be wiped if I would want to root it?
I'm aware of the upcoming Android L release, so would I be able to update it right away (remember, I'm not going to use any custom ROMs) or would I have to unroot and reset everything first?
In case something goes wrong and I want to use my warranty, could any traces be found after I would have unrooted the device? (because rooting voids your warranty, right?)
What would be the top reasons to root the Nexus 5? For example, any features the device should've had but unfortunately hasn't.
And is it actually 100% safe...?
So regarding to the last question... A friend of mine has a rooted Moto G, he made me familiar with rooting and it's probably thanks to him that I'm considering it. Everything was going well but there were a few times that he woke up and his phone wasn't worth more than a brick. Apparently, it was because of some ROM he installed. This probably won't affect me in any way because like I said, I'm not going to install any custom ROMs, but my friend expected everything to be normal while it wasn't. He probably did everything like it should be done but then he suddenly woke up with a brick next to his head. So apparently, even if you do everything exactly like they tell you to do it, there's still a slight chance that it's going to end up badly, right?
So basically, I'm considering rooting my device but I'm still not sure what I would have to do because there are lots of tutorials and everything is quite confusing and I have some questions. All the help would be greatly appreciated, thanks in advance!
root/unlockbootloader/install twrp&busybox no data loss
root/unlockbootloader/install twrp&busybox no data loss without P.C, okay here we go mod's remove if you think it's not helping. download towelroot by geohot,now the rest from playstore, es file exploer,super su,busybox,reboot app,nexus unlock bootloader,
make sure you have security unknowen sources ticked and verify apps unticked.
download towelroot from chrome with es file exploer open and install hit make it rain tab, next install busybox,next install super su app.unlockbootloader with in the app.,install twrp and auto install recovery for hammerhead from twrp, now you should have full root after reboot.super user and busybox unlocked bootloader and twrp installed, and you know what the reboot app is for . no data loss and without a P.C, or you could use fastboot install just look in Q&A, kind regard's joe hope this help's.
Spaceblow said:
Is my current data going to be wiped if I would want to root it?
Click to expand...
Click to collapse
Yep; when you unlock bootloader of your device (before root), all of data will be wiped.
Spaceblow said:
I'm aware of the upcoming Android L release, so would I be able to update it right away (remember, I'm not going to use any custom ROMs) or would I have to unroot and reset everything first?
Click to expand...
Click to collapse
Nope. When you upgrade to Android L, it might be overwrite existing system clearly.
Spaceblow said:
In case something goes wrong and I want to use my warranty, could any traces be found after I would have unrooted the device? (because rooting voids your warranty, right?)
Click to expand...
Click to collapse
We are using Google Nexus. Just revert with Nexus Factory Image.
http://developers.google.com/android/nexus/images
Spaceblow said:
What would be the top reasons to root the Nexus 5? For example, any features the device should've had but unfortunately hasn't.
Click to expand...
Click to collapse
In my case, to connect NTFS filesystem.
Spaceblow said:
And is it actually 100% safe...?
Click to expand...
Click to collapse
Maybe, but it's at your own risk.
Jongmin Kim said:
Yep; when you unlock your device (before root), all of data will be wiped.
Nope. When you upgrade to Android L, it might be overwrite existing system clearly.
No. We are using Google Nexus. Just revert with Nexus Factory Image.
http://developers.google.com/android/nexus/images
In my case, to connect NTFS filesystem.
Maybe, but it's at your own risk.
English is too difficult... I'm trying to understand right now.
Click to expand...
Click to collapse
root and then unlock bootloader with the app from playstore. has to be this way. regard's p.s no data wiped ,
Spaceblow said:
So I have a black Nexus 5 with a capacity of 16GB. The device is only about 4 months old, so I still have it covered with warranty until June 2016. The device is as good as new and I'm very happy with it because everything is so fast and smooth.
Click to expand...
Click to collapse
First of all:
Lethargy said:
I think OP got his question reversed. Should be:
"Why buy a Nexus 5 if you're not going to root?"
:angel:
Click to expand...
Click to collapse
Spaceblow said:
So I have a few questions because I'm a total noob at the field of tweaking android:
Is my current data going to be wiped if I would want to root it?
I'm aware of the upcoming Android L release, so would I be able to update it right away (remember, I'm not going to use any custom ROMs) or would I have to unroot and reset everything first?
In case something goes wrong and I want to use my warranty, could any traces be found after I would have unrooted the device? (because rooting voids your warranty, right?)
What would be the top reasons to root the Nexus 5? For example, any features the device should've had but unfortunately hasn't.
And is it actually 100% safe...?
Click to expand...
Click to collapse
1. Unlocking the bootloader is what wipes the data partition, not root access.
2. Don't bother with OTAs to update, they're too much of a bother to try to get to work, when you can just flash factory images/zip, most likely before you even get the OTA pushed to you.
3. Depends where you bought it from. If you got it off the Play Store, then Google does not care about the software you have on your device as long as it's a legitimate manufacturing fault covered by the warranty. You can RMA to Google with a custom ROM and kernel if you wanted to. If you bought it from elsewhere, You'll have to send it to LG for repair. It's possible to reflash factory images and reset the tamper flag, there isn't anything else on the Nexus 5 that will tell LG anything. The easiest way is using LG Flashtool, which can be found in the first link of my signature. If your device is completely dead however, it doesn't matter since LG wouldn't be able to boot it up.
4. Root access is simply root access. You get access to /system, and therefore can use root apps and other modifications.
5. The root process itself is pretty much 100% safe. The Nexus 5 is really, really hard to brick, unless you flash something that isn't meant for your device or something similar, so user error is the only risk in the process. Software-wise, of course root access comes at some form of a security risk. Just be sure of what apps you're granting root access to and you should have no problem.
Spaceblow said:
So regarding to the last question... A friend of mine has a rooted Moto G, he made me familiar with rooting and it's probably thanks to him that I'm considering it. Everything was going well but there were a few times that he woke up and his phone wasn't worth more than a brick. Apparently, it was because of some ROM he installed. This probably won't affect me in any way because like I said, I'm not going to install any custom ROMs, but my friend expected everything to be normal while it wasn't. He probably did everything like it should be done but then he suddenly woke up with a brick next to his head. So apparently, even if you do everything exactly like they tell you to do it, there's still a slight chance that it's going to end up badly, right?
Click to expand...
Click to collapse
Most likely user error, or simply because a Moto device could be locked down more (which also makes it riskier and harder to restore) and not as easy to develop for. The Nexus 5 is one of the hardest devices to brick (again, excluding user error), and if you have any issues it would either be user error or a bug in the ROM/kernel.
Spaceblow said:
So basically, I'm considering rooting my device but I'm still not sure what I would have to do because there are lots of tutorials and everything is quite confusing and I have some questions. All the help would be greatly appreciated, thanks in advance!
Click to expand...
Click to collapse
Check out the first link of my signature and read some threads before proceeding blindly.
There are ways to gain root access without unlocking the bootloader and without a PC as mentioned above, but it's recommended to do it the traditional way by backing up your internal storage to a PC first and using fastboot. Those methods are useful for other devices that are more locked down. This is a Nexus device, it's better to do it properly.
Lethargy said:
First of all:
1. Unlocking the bootloader is what wipes the data partition, not root access.
2. Don't bother with OTAs to update, they're too much of a bother to try to get to work, when you can just flash factory images/zip, most likely before you even get the OTA pushed to you.
3. Depends where you bought it from. If you got it off the Play Store, then Google does not care about the software you have on your device as long as it's a legitimate manufacturing fault covered by the warranty. You can RMA to Google with a custom ROM and kernel if you wanted to. If you bought it from elsewhere, You'll have to send it to LG for repair. It's possible to reflash factory images and reset the tamper flag, there isn't anything else on the Nexus 5 that will tell LG anything. The easiest way is using LG Flashtool, which can be found in the first link of my signature. If your device is completely dead however, it doesn't matter since LG wouldn't be able to boot it up.
4. Root access is simply root access. You get access to /system, and therefore can use root apps and other modifications.
5. The root process itself is pretty much 100% safe. The Nexus 5 is really, really hard to brick, unless you flash something that isn't meant for your device or something similar, so user error is the only risk in the process. Software-wise, of course root access comes at some form of a security risk. Just be sure of what apps you're granting root access to and you should have no problem.
Most likely user error, or simply because a Moto device could be locked down more (which also makes it riskier and harder to restore). The Nexus 5 is one of the hardest devices to brick (again, excluding user error), and if you have any issues it would either be user error or a bug in the ROM/kernel.
Check out the first link of my signature and read some threads before proceeding blindly.
There are ways to gain root access without unlocking the bootloader and without a PC as mentioned above, but it's recommended to do it the traditional way by backing up your internal storage to a PC first and using fastboot. Those methods are useful for other devices that are more locked down. This is a Nexus device, it's better to do it properly.
Click to expand...
Click to collapse
lol yeah i have to agree with you, but i find this help's when on the go,
joecool666 said:
lol yeah i have to agree with you, but i find this help's when on the go,
Click to expand...
Click to collapse
If you don't have access to a PC, or you're using a locked-down Samsung/HTC/Moto/Sony/whatever device, then sure, go ahead and use the exploit methods.
But if you do have access to a PC, and it's a Nexus device, just do it properly, it'll cause fewer possible issues.
Lethargy said:
If you don't have access to a PC, or you're using a locked-down Samsung/HTC/Moto/Sony/whatever device, then sure, go ahead and use the exploit methods.
But if you do have access to a PC, and it's a Nexus device, just do it properly, it'll cause fewer possible issues.
Click to expand...
Click to collapse
i do use my p.c and lg flashtool and fastboot.just incase lol.and it is the better way of doing it, p.s when OTG rooting don't forget to bring the XDA app.
joecool666 said:
root and then unlock bootloader with the app from playstore. has to be this way. regard's p.s no data wiped ,
Click to expand...
Click to collapse
You mean Towelroot? I'm also considering this option because it would be nice to keep all my data.
Lethargy said:
First of all:
1. Unlocking the bootloader is what wipes the data partition, not root access.
2. Don't bother with OTAs to update, they're too much of a bother to try to get to work, when you can just flash factory images/zip, most likely before you even get the OTA pushed to you.
3. Depends where you bought it from. If you got it off the Play Store, then Google does not care about the software you have on your device as long as it's a legitimate manufacturing fault covered by the warranty. You can RMA to Google with a custom ROM and kernel if you wanted to. If you bought it from elsewhere, You'll have to send it to LG for repair. It's possible to reflash factory images and reset the tamper flag, there isn't anything else on the Nexus 5 that will tell LG anything. The easiest way is using LG Flashtool, which can be found in the first link of my signature. If your device is completely dead however, it doesn't matter since LG wouldn't be able to boot it up.
4. Root access is simply root access. You get access to /system, and therefore can use root apps and other modifications.
5. The root process itself is pretty much 100% safe. The Nexus 5 is really, really hard to brick, unless you flash something that isn't meant for your device or something similar, so user error is the only risk in the process. Software-wise, of course root access comes at some form of a security risk. Just be sure of what apps you're granting root access to and you should have no problem.
Most likely user error, or simply because a Moto device could be locked down more (which also makes it riskier and harder to restore) and not as easy to develop for. The Nexus 5 is one of the hardest devices to brick (again, excluding user error), and if you have any issues it would either be user error or a bug in the ROM/kernel.
Check out the first link of my signature and read some threads before proceeding blindly.
There are ways to gain root access without unlocking the bootloader and without a PC as mentioned above, but it's recommended to do it the traditional way by backing up your internal storage to a PC first and using fastboot. Those methods are useful for other devices that are more locked down. This is a Nexus device, it's better to do it properly.
Click to expand...
Click to collapse
This is some great information, thank you very much! So in case I would want to do it manually, this thread has everything I need (in combination with the 15 seconds ADB Installer)?
Spaceblow said:
This is some great information, thank you very much! So in case I would want to do it manually, this thread has everything I need (in combination with the 15 seconds ADB Installer)?
Click to expand...
Click to collapse
Yep. :good: I also recommend using TWRP instead of CWM as your recovery. PhilZ Touch is also another good alternative, but it is no longer maintained and probably won't work for Lollipop's default encryption.
Latest SuperSU is located here, flashable in a custom recovery.
Lethargy said:
Yep. :good: I also recommend using TWRP instead of CWM as your recovery. PhilZ Touch is also another good alternative, but it is no longer maintained and probably won't work for Lollipop's default encryption.
Latest SuperSU is located here, flashable in a custom recovery.
Click to expand...
Click to collapse
Thanks for helping me but I used Towelroot and it works flawlessly!
Spaceblow said:
Thanks for helping me but I used Towelroot and it works flawlessly!
Click to expand...
Click to collapse
Cool. :good:
Even though you now have root access, I recommend using Bootunlocker or whatever app to unlock the bootloader from within Android (which doesn't wipe), then flashing a custom recovery with fastboot while in the bootloader anyways.
Why?
If something goes wrong and your phone doesn't boot, you'll have no choice but to unlock the bootloader WITH a wipe using fastboot, then flash a custom recovery or reflash factory images, unless you've done the above, in which case you can dirty-flash (no wipe) a stock ROM zip downloadable here. :angel:
back up
Spaceblow said:
Thanks for helping me but I used Towelroot and it works flawlessly!
Click to expand...
Click to collapse
make sure you make a back up back up most important,regard's joe
To be clear, the *whole* phone including your sdcard partition will be wiped so make sure you back up before unlocking your bootloader. I would use an app like ES File Explorer and copy all your files to Dropbox or Google Drive if you dont have a computer but you'll need a computer anyway.
Sent from my Nexus 5 using XDA Free mobile app
MrObvious said:
To be clear, the *whole* phone including your sdcard partition will be wiped
Click to expand...
Click to collapse
If we want to be clear, we should also be accurate. The *whole* phone is not wiped. The /data partition is wiped, which includes /data/app (where user apps are stored) /data/data (where user settings and app data is stored) and /data/media (where /sdcard data is stored)
Lethargy said:
Cool. :good:
Even though you now have root access, I recommend using Bootunlocker or whatever app to unlock the bootloader from within Android (which doesn't wipe), then flashing a custom recovery with fastboot while in the bootloader anyways.
Why?
If something goes wrong and your phone doesn't boot, you'll have no choice but to unlock the bootloader WITH a wipe using fastboot, then flash a custom recovery or reflash factory images, unless you've done the above, in which case you can dirty-flash (no wipe) a stock ROM zip downloadable here. :angel:
Click to expand...
Click to collapse
Thanks for the tip but then I'll be unable to receive OTA updates unless I restore everything, including everything being wiped, right?
joecool666 said:
make sure you make a back up back up most important,regard's joe
Click to expand...
Click to collapse
By using Titanium Backup?
Spaceblow said:
Thanks for the tip but then I'll be unable to receive OTA updates unless I restore everything, including everything being wiped, right?
Click to expand...
Click to collapse
All guides and info threads are in my signature. One such INFO thread is OTA help-desk, which explains that you can receive OTA with custom recovery, however there are extra steps.
However, please let me explain 1 thing. OTA is the ultimate noob move. Only root-noobs receive OTA updates. They are the most inconvenient method of updating your OS if you are rooted. Long before you even receive the OTA update, there will be a pre-rooted flashable.zip that can be flashed via recovery.
noobs will often say "but..but..but I wont have to wipe if I accept an OTA"... Little do they know... Even after an official OTA, things screw up. Whenever an OS is upgraded, a wipe is highly recommended as OTA's are imperfect and data between apps and settings conflicts between versions.
OTA is a fools errand if you're rooted. Now you're rooted, leave OTA to the unrooted and learn to manage your rooted device properly. All the info you could ever need is available in my signature as previously mentioned.
Spaceblow said:
Thanks for the tip but then I'll be unable to receive OTA updates unless I restore everything, including everything being wiped, right?
By using Titanium Backup?
Click to expand...
Click to collapse
or helium back up
Owning a Nexus makes fastboot your best friend, especially if you have issues.
Read up on adb/fastboot and forget OTA's. Nothing like a clean fresh install of a new version. And there's many options to save /backup your data and important files.
Without learning fastboot and adb.... Simple fix issues can become major headaches.
Don't be intimidated. Read, learn, then do. ?
---------- Post added at 09:49 AM ---------- Previous post was at 09:48 AM ----------
@rootSU has everything you need in his sticky roll up thread.
rootSU said:
All guides and info threads are in my signature. One such INFO thread is OTA help-desk, which explains that you can receive OTA with custom recovery, however there are extra steps.
However, please let me explain 1 thing. OTA is the ultimate noob move. Only root-noobs receive OTA updates. They are the most inconvenient method of updating your OS if you are rooted. Long before you even receive the OTA update, there will be a pre-rooted flashable.zip that can be flashed via recovery.
noobs will often say "but..but..but I wont have to wipe if I accept an OTA"... Little do they know... Even after an official OTA, things screw up. Whenever an OS is upgraded, a wipe is highly recommended as OTA's are imperfect and data between apps and settings conflicts between versions.
OTA is a fools errand if you're rooted. Now you're rooted, leave OTA to the unrooted and learn to manage your rooted device properly. All the info you could ever need is available in my signature as previously mentioned.
Click to expand...
Click to collapse
Well, you convinced me to take my N5 to a step further.
So I already Towelrooted my phone which gave me root access and an untouched bootloader and recovery. My next step would be to backup every app and all data to be sure in case something goes wrong, this would be done by using Titanium Backup. Then I should be unlocking the bootloader by simply using BootUnlocker for Nexus Devices so I wouldn't get my data wiped (I know I would be able to restore it with my backup but I rather do it a bit faster and less complex). When I did that, I have to head over to this thread and flash TWRP by following the instructions at "2. Installing a Custom Recovery".
So after all these steps my phone would have no limitations and it would be as unlocked as for example your Nexus 5, right?

Can I unroot pixel without changing build.prop

Is it possible to flash back a stock imagine without causing changes to the file build.prop?
I am not familiar with the Android systems. Please be specific. Perhaps it's possible to insert a modified build.prop file into the image?
I rooted the phone to enable the hotspot and that's all I need. Now, my banking apps refuse to accept a rooted phone.
Scotty.d.allen said:
Is it possible to flash back a stock imagine without causing changes to the file build.prop?
I am not familiar with the Android systems. Please be specific. Perhaps it's possible to insert a modified build.prop file into the image?
I rooted the phone to enable the hotspot and that's all I need. Now, my banking apps refuse to accept a rooted phone.
Click to expand...
Click to collapse
you could mod the image but without prior know-how i HIGHLY recommend not even thinking about that. You could instead try getting xposed or different root hiding methods(both assuming you are using magisk and if you arent using magisk you should fix that)
Scotty.d.allen said:
Is it possible to flash back a stock imagine without causing changes to the file build.prop?
I am not familiar with the Android systems. Please be specific. Perhaps it's possible to insert a modified build.prop file into the image?
I rooted the phone to enable the hotspot and that's all I need. Now, my banking apps refuse to accept a rooted phone.
Click to expand...
Click to collapse
your best bet is try to suhide (with SuperSU) or use magisk for root, then add your banking app to 'magisk hide' and see if it works...
I use magisk for android pay, my phone passes safetynet checks (via magisk and my kernel). no issue with having root, either....
*** I wouldn't get into trying to add files to the stock firmware image. probably not the way to go; plus, if u ever locked your bootloader with the modified file in the firmware; your phone would brick. (verified boot would trip and your phone would be toast.)...
Scotty.d.allen said:
Is it possible to flash back a stock imagine without causing changes to the file build.prop?
I am not familiar with the Android systems. Please be specific. Perhaps it's possible to insert a modified build.prop file into the image?
I rooted the phone to enable the hotspot and that's all I need. Now, my banking apps refuse to accept a rooted phone.
Click to expand...
Click to collapse
Fashing the factory image from Google will remove root and take you back to pure stock. Just be sure to remove the -w inside the flash-all file so you don't lose data and be sure you are flashing the same version of Android you are currently using (or a more recent version, but definitely not an older version) or else keeping your data won't work.
CatThief said:
Fashing the factory image from Google will remove root and take you back to pure stock. Just be sure to remove the -w inside the flash-all file so you don't lose data and be sure you are flashing the same version of Android you are currently using (or a more recent version, but definitely not an older version) or else keeping your data won't work.
Click to expand...
Click to collapse
that's not what he was asking about, just an fyi.... he was asking how he could retain his hotspot changes that he applied when using root, but he wants to keep them or somehow apply them to the factory image - but he won't be able to do that...
you sare just explaining to him how to flash a factory image without losing his data - nothing to do with what he is asking...
nine7nine said:
that's not what he was asking about, just an fyi.... he was asking how he could retain his hotspot changes that he applied when using root, but he wants to keep them or somehow apply them to the factory image - but he won't be able to do that...
you sare just explaining to him how to flash a factory image without losing his data - nothing to do with what he is asking...
Click to expand...
Click to collapse
Yep, misunderstood the objective.
Uninstall all the SU stuff. Flash the boot image to both slots. I believe that will do it. That will leave you behind on updates though.
Wait, why not switch to Magisk for root. That should solve the bank app problem.

squashfs to ext4 (copy from watch r thread)

Ok guys,
I found this a while ago:
https://forum.xda-developers.com/g-watch-r/development/getting-ext4-instead-squashfs-6-0-1-t3341166
I wanted to do the same on the urbane 2, to give us the full potential of this watch.
There are a few things to be changed.
After getting the boot.img, for us it is the 'fstab.nemo' that has to be edited first.
I really want to finish this for us too, but always short on time. Will try to go further tonight and get the partitions online on gparted. anybody wanna join and help, just let me know.
:highfive:
Ok, late update. while i repaired my watch, i was back on this thread.
seems we can't flash it as intended while secure boot is breaking on this point. whenever i want to start with ext4, the watch will not boot to system, but hang on lg bootlogo
sebj84 said:
Ok, late update. while i repaired my watch, i was back on this thread.
seems we can't flash it as intended while secure boot is breaking on this point. whenever i want to start with ext4, the watch will not boot to system, but hang on lg bootlogo
Click to expand...
Click to collapse
Nice to see you again for inspiring us the reason why I was stuck in staring at the bootlogo. Good job guy. Hope there could be idea to deal with that in someways.
we would need a way to turn of Secure Boot.
I have the ABOOT image, but don't know how to modify it
sebj84 said:
we would need a way to turn of Secure Boot.
I have the ABOOT image, but don't know how to modify it
Click to expand...
Click to collapse
It seems that aboot will be checked by SBL when booting so turning off Secure Boot can truly be a difficult job for me due to knowing little about it. But on the other hand, I've tested Magisk V21.4, finding it working amazingly well. I wonder if it's able to function what we need systemlessly by the powerful tool - Magisk.
wendster said:
It seems that aboot will be checked by SBL when booting so turning off Secure Boot can truly be a difficult job for me due to knowing little about it. But on the other hand, I've tested Magisk V21.4, finding it working amazingly well. I wonder if it's able to function what we need systemlessly by the powerful tool - Magisk.
Click to expand...
Click to collapse
i will try the new version today.
anyhow, I'm still interested to get /system modifiable and the only way will be to get rid of secure boot.
Was the old wear 1.5 already squash FS?
maybe flashing back would be an option?
wendster said:
It seems that aboot will be checked by SBL when booting so turning off Secure Boot can truly be a difficult job for me due to knowing little about it. But on the other hand, I've tested Magisk V21.4, finding it working amazingly well. I wonder if it's able to function what we need systemlessly by the powerful tool - Magisk.
Click to expand...
Click to collapse
did you try riru and sandhook with 21.4?
i bootlooped earlier when installing sandhook.
sebj84 said:
did you try riru and sandhook with 21.4?
i bootlooped earlier when installing sandhook.
Click to expand...
Click to collapse
I'm not sure whether earlier WearOS has already begun using suashfs or not as I'm a new user of WearOS because my watch is secondhand.
EdXposed doesn't support Android 7 and below, how did you install it? You would like to try original Xposed Framework in Magisk by rovo89 and install the modified Xposed Installer provided by the author to properly detect Systemless Xposed. However, it may lead to high CPU rate and cause an unpleasant using experience. Good luck, hope we can find the way to make this watch totally in control.
sebj84 said:
did you try riru and sandhook with 21.4?
i bootlooped earlier when installing sandhook.
Click to expand...
Click to collapse
Futhermore, I'm working on trying emulating Mifare cards on my watch by using NFC but only to find it so difficult to archieve my goal. Is there any way to emulate cards with all sectors?
sebj84 said:
did you try riru and sandhook with 21.4?
i bootlooped earlier when installing sandhook.
Click to expand...
Click to collapse
Solved!
I found it from here when I was finding some posts in Coolapk but came across the great surprise what we need.
Just download it and flash it by fastboot.
Enjoy!
wendster said:
Solved!
I found it from here when I was finding some posts in Coolapk but came across the great surprise what we need.
Just download it and flash it by fastboot.
Enjoy!
Click to expand...
Click to collapse
did you try that already. its too good tonbe true.
will be downloading in a minute
with the ext4 image i will hang on 'searching for updates' while setting up the watch
ok, clean install fixed that for me, but still get a prob setting up the watch with wear app
finally connection isnt possible
In actual fact it's unnecessary to wipe data. Just wipe cache and davlik cache in recovery and then you will get your watch with nothing changed but system unlocked. I've succeeded in this way.
wendster said:
In actual fact it's unnecessary to wipe data. Just wipe cache and davlik cache in recovery and then you will get your watch with nothing changed but system unlocked. I've succeeded in this way.
Click to expand...
Click to collapse
I went a harder route....
Finally had to flash stock and update again.
Flashed then after the fresh Wear 2.0 update and it worked flawlessly.
But i still encountered the problem with connection to Phone.
Could only resolve by adb reconnect to phone.
But anyhow, works now and is all fine.

Multirom?

For the sake of discussion, y'all ever see Tassadar's Multirom making a comeback ever? It was the absolute coolest thing ever!
That said, the new way Android works most likely killed this off entirely. A/B partitions that share userdata, and encryption that locks you out of your phone unless the security patch at least matches. Kinda hate the new way Android works to be honest.
If you remove encryption and AVB/Verity shouldnt it still work?
virtyx said:
If you remove encryption and AVB/Verity shouldnt it still work?
Click to expand...
Click to collapse
See now you got me thinking... Since Multirom mounts the userdata as system and then isolates the userdata for secondaries, it should right? Although people who have removed encryption on these newer devices have said you can't even have a screen lock or fingerprint at all with encryption gone, that's a big trade off. Hmm...
H4X0R46 said:
See now you got me thinking... Since Multirom mounts the userdata as system and then isolates the userdata for secondaries, it should right? Although people who have removed encryption on these newer devices have said you can't even have a screen lock or fingerprint at all with encryption gone, that's a big trade off. Hmm...
Click to expand...
Click to collapse
Hello, so what do you think is a good thing or a bad thing?
Personally, I'm a little afraid about that
H4X0R46 said:
See now you got me thinking... Since Multirom mounts the userdata as system and then isolates the userdata for secondaries, it should right? Although people who have removed encryption on these newer devices have said you can't even have a screen lock or fingerprint at all with encryption gone, that's a big trade off. Hmm...
Click to expand...
Click to collapse
On my pixel 3, removing encryption wouldn't let me use a pin or finger print to unlock, so no gpay.
On my 7 pro I tested out removing encryption and everything still worked perfectly, even removed Verity/ AVB too, fingerprint and pin worked fine.
I think the reason it didn't work on my pixel 3 is the Titan chip - but I'm unsure.
virtyx said:
On my pixel 3, removing encryption wouldn't let me use a pin or finger print to unlock, so no gpay.
On my 7 pro I tested out removing encryption and everything still worked perfectly, even removed Verity/ AVB too, fingerprint and pin worked fine.
I think the reason it didn't work on my pixel 3 is the Titan chip - but I'm unsure.
Click to expand...
Click to collapse
So you were able to keep your screen lock? That's neat! [emoji848] How do you remove encryption on these newer devices? I remember it used to just be a flag in the boot image, but has that changed?
H4X0R46 said:
So you were able to keep your screen lock? That's neat! [emoji848] How do you remove encryption on these newer devices? I remember it used to just be a flag in the boot image, but has that changed?
Click to expand...
Click to collapse
Firstly, you need to have twrp
Format data
Then
Make sure vendor is mounted
You need to pull the vendor/etc/fstab file to your PC
Rename "fileencryption" to "encryptable"
Then push it back to the vendor/etc location
I also make it a habit to do this before flashing magisk when unencrypted
Echo "KEEPVERITY" = false>>/data/.magisk
Echo "KEEPFORCEENCRYPT" =false>>/data/.magisk
Install magisk
And it's done.
To keep unencrypted between updates, you need to do the fstab move again in twrp and flash magisk again before first boot.
I suspect the pixels Titan chip prevents us from using a screen lock when decrypted
Which is silly, but I understand the security behind it.
virtyx said:
Firstly, you need to have twrp
Format data
Then
Make sure vendor is mounted
You need to pull the vendor/etc/fstab file to your PC
Rename "fileencryption" to "encryptable"
Then push it back to the vendor/etc location
I also make it a habit to do this before flashing magisk when unencrypted
Echo "KEEPVERITY" = false>>/data/.magisk
Echo "KEEPFORCEENCRYPT" =false>>/data/.magisk
Install magisk
And it's done.
To keep unencrypted between updates, you need to do the fstab move again in twrp and flash magisk again before first boot.
I suspect the pixels Titan chip prevents us from using a screen lock when decrypted
Which is silly, but I understand the security behind it.
Click to expand...
Click to collapse
Shoot I might just do this! I've always hated having to match the security patch when flashing a rom, or getting locked out of my phone, this might actually be better since Incan try roms and scrap em easily if I don't like em like I used to do in the older days of Android. Thanks so much! Gonna screenshot these steps and give it a go when I have time. Worst case, I restore a backup or use the MSM Tool, so no biggie! [emoji4]
H4X0R46 said:
Shoot I might just do this! I've always hated having to match the security patch when flashing a rom, or getting locked out of my phone, this might actually be better since Incan try roms and scrap em easily if I don't like em like I used to do in the older days of Android. Thanks so much! Gonna screenshot these steps and give it a go when I have time. Worst case, I restore a backup or use the MSM Tool, so no biggie! [emoji4]
Click to expand...
Click to collapse
No worries! Shoot me a PM if you have trouble
There is a noverity zip lying around somewhere but I prefer to do the steps manually gives me piece of mind.
virtyx said:
No worries! Shoot me a PM if you have trouble
There is a noverity zip lying around somewhere but I prefer to do the steps manually gives me piece of mind.
Click to expand...
Click to collapse
https://forum.xda-developers.com/android/software/universal-dm-verity-forceencrypt-t3817389
This is the zip you mentioned right? Since the change is made in the vendor partition, flashing a stock boot image wouldn't set it back to forced right? Or wrong?
H4X0R46 said:
https://forum.xda-developers.com/android/software/universal-dm-verity-forceencrypt-t3817389
This is the zip you mentioned right? Since the change is made in the vendor partition, flashing a stock boot image wouldn't set it back to forced right? Or wrong?
Click to expand...
Click to collapse
Right, but full rom zip will revert it back
Would this possibly mean multirom would be possible?

[Help] Is there any verified root solution for a P3 running android 12 yet?

Just wanted to see if anyone else has successfully rooted their p3 once it's running android 12 and have it successfully pass safetynet.
I'm relatively sure that most of the people reading these forums have quite a few root apps that make their lives and phone experience easier and would like to keep those on android 12.
Thanks
Can confirm root and safety net pass with a12 release
acidspider said:
Can confirm root and safety net pass with a12 release
Click to expand...
Click to collapse
Which version/build of Magisk are you using? Any modules for hiding from detection?
Psychotc said:
Which version/build of Magisk are you using? Any modules for hiding from detection?
Click to expand...
Click to collapse
Latest canary and safety net fix
Did you just fastboot flash after updating to A12? Did you have to flash the vmbeta also?
prabs99 said:
Did you just fastboot flash after updating to A12? Did you have to flash the vmbeta also?
Click to expand...
Click to collapse
yes just fastboot flashed the magisk_patched boot.img and all was good
p.s whats the vmbeta?
acidspider said:
yes just fastboot flashed the magisk_patched boot.img and all was good
p.s whats the vmbeta?
Click to expand...
Click to collapse
Magisk allows for 'systemless' root. We've all read that. What that means though is basically, it doesn't 'touch' root (it does a kind of 'overlay' of it, but doesn't modify actual System).
when we flash disable-verity etc zip, it keeps the data partition from becoming encrypted, so twrp backup can backup that partition.
you can additionally, if desired, disable vbmeta. That allows u to make modifications in System, Op, etc, and the changes will stick even after a reboot. It is said though if yer changes are in System, yer much better off using a magisk module, as they can be easily reverted, if needed.
To disable vbmeta u have to use fastboot. This would be the fastboot command: fastboot --disable-verity --disable-verification flash vbmeta_a blank_vbmeta.img. You don't have to use a blank vbmeta, you can just flash back the original. Also, if u do fastboot --h it will show all commands and these are listed towards the end of the output.
cheers
AsItLies said:
Magisk allows for 'systemless' root. We've all read that. What that means though is basically, it doesn't 'touch' root (it does a kind of 'overlay' of it, but doesn't modify actual System).
when we flash disable-verity etc zip, it keeps the data partition from becoming encrypted, so twrp backup can backup that partition.
you can additionally, if desired, disable vbmeta. That allows u to make modifications in System, Op, etc, and the changes will stick even after a reboot. It is said though if yer changes are in System, yer much better off using a magisk module, as they can be easily reverted, if needed.
To disable vbmeta u have to use fastboot. This would be the fastboot command: fastboot --disable-verity --disable-verification flash vbmeta_a blank_vbmeta.img. You don't have to use a blank vbmeta, you can just flash back the original. Also, if u do fastboot --h it will show all commands and these are listed towards the end of the output.
cheers
Click to expand...
Click to collapse
This should not be necessary on the P3; this only became an issue with Android 12 on the 4a 5g and up. All prior devices are unaffected AFAIK.
V0latyle said:
This should not be necessary on the P3; this only became an issue with Android 12 on the 4a 5g and up. All prior devices are unaffected AFAIK.
Click to expand...
Click to collapse
I was responding to the person who asked what disabling vbmeta was. So I explained what it was.
it "being necessary" on p3 or any device, I have no idea about, nor am I proclaiming it to be one way or another.
it might be better to direct your comment to those that believe it's needed, if you have reason to believe it is not.
cheers
AsItLies said:
I was responding to the person who asked what disabling vbmeta was. So I explained what it was.
it "being necessary" on p3 or any device, I have no idea about, nor am I proclaiming it to be one way or another.
it might be better to direct your comment to those that believe it's needed, if you have reason to believe it is not.
cheers
Click to expand...
Click to collapse
No need to become defensive.
rocketrazr1999 said:
No need to become defensive.
Click to expand...
Click to collapse
No need to respond to people that aren't asking a question.
AsItLies said:
I was responding to the person who asked what disabling vbmeta was. So I explained what it was.
it "being necessary" on p3 or any device, I have no idea about, nor am I proclaiming it to be one way or another.
it might be better to direct your comment to those that believe it's needed, if you have reason to believe it is not.
cheers
Click to expand...
Click to collapse
I'm afraid you're incorrect. Dm-verity and vbmeta verification have nothing to do with encrypting the data partition, nor is vbmeta used for encryption whatsoever. It is, however, used for "tamper-evident storage" of /boot and /system.
Dm-verity is a method by which a hash is generated from a block storage device. Vbmeta verification compares that generated hash to a cryptographically signed hash stored in /vbmeta to determine they match. These are used for Android Boot Verification on the Pixel 4a 5g, 5, 5a, and 6; those of us using those devices have had to reflash vbmeta with --disable flags in order to flash patched boot images.
However, none of this applies to the Pixel 3, 3XL, 3a, 4, 4XL, or 4a.
The only requirement for root on these devices is an unlocked bootloader. Root is accomplished in exactly the same way as it always has - patch the boot image in Magisk.
V0latyle said:
I'm afraid you're incorrect. Dm-verity and vbmeta verification have nothing to do with encrypting the data partition, nor is vbmeta used for encryption whatsoever. It is, however, used for "tamper-evident storage" of /boot and /system.
Dm-verity is a method by which a hash is generated from a block storage device. Vbmeta verification compares that generated hash to a cryptographically signed hash stored in /vbmeta to determine they match. These are used for Android Boot Verification on the Pixel 4a 5g, 5, 5a, and 6; those of us using those devices have had to reflash vbmeta with --disable flags in order to flash patched boot images.
However, none of this applies to the Pixel 3, 3XL, 3a, 4, 4XL, or 4a.
The only requirement for root on these devices is an unlocked bootloader. Root is accomplished in exactly the same way as it always has - patch the boot image in Magisk.
Click to expand...
Click to collapse
My exact words:
"I was responding to the person who asked what disabling vbmeta was. So I explained what it was.
it "being necessary" on p3 or any device, I have no idea about, nor am I proclaiming it to be one way or another."
What, in my words, are any different than what you're saying?
AsItLies said:
My exact words:
"I was responding to the person who asked what disabling vbmeta was. So I explained what it was.
it "being necessary" on p3 or any device, I have no idea about, nor am I proclaiming it to be one way or another."
What, in my words, are any different than what you're saying?
Click to expand...
Click to collapse
This:
AsItLies said:
when we flash disable-verity etc zip, it keeps the data partition from becoming encrypted, so twrp backup can backup that partition.
Click to expand...
Click to collapse
Disabling verity has nothing to do with data encryption, because it is used exclusively to verify /boot with /vbmeta, and /system with /vbmeta_system.
There is no need for users of the Pixel 4a or below to flash or reflash /vbmeta at any point during update or attempting root.
V0latyle said:
This:
Disabling verity has nothing to do with data encryption, because it is used exclusively to verify /boot with /vbmeta, and /system with /vbmeta_system.
There is no need for users of the Pixel 4a or below to flash or reflash /vbmeta at any point during update or attempting root.
Click to expand...
Click to collapse
V0latyle said:
This:
Disabling verity has nothing to do with data encryption, because it is used exclusively to verify /boot with /vbmeta, and /system with /vbmeta_system.
There is no need for users of the Pixel 4a or below to flash or reflash /vbmeta at any point during update or attempting root.
Click to expand...
Click to collapse
I'm talking about disable-verity-force-encrypt. Ever heard of it? it's the magisk zip module that's been used by probably millions of people, and it does exactly what I said, from a practical standpoint.
And again, I didn't say the vbmeta was specific to any device, I said specifically "I don't know" if it's relevant for the p3, etc etc etc.
I just said, from a practical perspective, what it does.
what's your problem?
AsItLies said:
I'm talking about disable-verity-force-encrypt. Ever heard of it? it's the magisk zip module that's been used by probably millions of people, and it does exactly what I said, from a practical standpoint.
And again, I didn't say the vbmeta was specific to any device, I said specifically "I don't know" if it's relevant for the p3, etc etc etc.
I just said, from a practical perspective, what it does.
what's your problem?
Click to expand...
Click to collapse
No problem here, just doing what I can to try to ensure the information shared is clear, relevant, and accurate.
I would suggest that if you're going to continue to participate in public conversations such as this, you might want to consider your defensive reaction to certain circumstances, as has already been pointed out by another member.
V0latyle said:
No problem here, just doing what I can to try to ensure the information shared is clear, relevant, and accurate.
I would suggest that if you're going to continue to participate in public conversations such as this, you might want to consider your defensive reaction to certain circumstances, as has already been pointed out by another member.
Click to expand...
Click to collapse
And I would suggest to you, if someone makes a point, and it's accurate, then there's no reason to tell them they are wrong? is there?
doing such would make anyone defensive, in public or private. Only someone with their head buried where the sun doesn't shine would not understand that.
AsItLies said:
And I would suggest to you, if someone makes a point, and it's accurate, then there's no reason to tell them they are wrong? is there?
doing such would make anyone defensive, in public or private. Only someone with their head buried where the sun doesn't shine would not understand that.
Click to expand...
Click to collapse
It seems we understand each other.
Cheers!
V0latyle said:
It seems we understand each other.
Cheers!
Click to expand...
Click to collapse
Very nice passive-aggressive response. You'd be a lot better off with 'I was wrong, I misunderstood'.
cheers!
AsItLies said:
Very nice passive-aggressive response. You'd be a lot better off with 'I was wrong, I misunderstood'.
cheers!
Click to expand...
Click to collapse
Do you not find it just a little hypocritical to try to correct someone else when you yourself have become extremely defensive?
I will admit that I was partly wrong - Verified Boot is indeed tied to device encryption on some newer devices, including the 4a 5g and up.
The point I was trying to make is that an excess of information can be confusing to people looking for a solution. But, this community thrives on individuals who all try to help those around them, so the information you provided is appreciated.

Categories

Resources