Getting serious about root: FIOASYNC bug - Droid Eris Android Development

Presently we're running a little short on kernel exploits, with the following being the only one that looks remotely plausible:
http://xorl.wordpress.com/2010/01/14/cve-2009-4141-linux-kernel-fasync-locked-file-use-after-free/
Big hold-up? For all that we have a trigger, we don't have an exploit. I believe it's up to us at this point to make that happen.
If I'm reading it right, it looks like the bug initially rears its head right here:
Code:
void __kill_fasync(struct fasync_struct *fa, int sig, int band)
{
while (fa) {
struct fown_struct * fown;
if (fa->magic != FASYNC_MAGIC) {
printk(KERN_ERR "kill_fasync: bad magic number in "
"fasync_struct!\n");
return;
}
[B]fown = &fa->fa_file->f_owner;[/B]
/* Don't send SIGURG to processes which have not set a
queued signum: SIGURG has its own default signalling
mechanism. */
if (!(sig == SIGURG && fown->signum == 0))
send_sigio(fown, fa->fa_fd, band);
fa = fa->fa_next;
}
}
... as fa_file now points to invalid memory (having been free'd earlier). The f_owner member gets shot out to send_sigio, which look like this:
Code:
void send_sigio(struct fown_struct *fown, int fd, int band)
{
struct task_struct *p;
enum pid_type type;
struct pid *pid;
int group = 1;
read_lock(&fown->lock);
type = fown->pid_type;
if (type == PIDTYPE_MAX) {
group = 0;
type = PIDTYPE_PID;
}
[B]pid = fown->pid;[/B]
if (!pid)
goto out_unlock_fown;
read_lock(&tasklist_lock);
do_each_pid_task(pid, type, p) {
send_sigio_to_task(p, fown, fd, band, group);
} while_each_pid_task(pid, type, p);
read_unlock(&tasklist_lock);
out_unlock_fown:
read_unlock(&fown->lock);
}
... in which we see the f_owner member being dereferenced. Also it gets pushed through several other functions which may be exploitable.
There are several questions to be answered before we can start attacking this:
Can we resolve the address of the fa_file data structure so we can overwrite the f_owner value?
Can we do anything with it once we've done that? (Presumably we can set it to zero to cause a null-pointer dereference, but we're mmap_min_addr = 32768 on the most recent versions, so unless we can flag the mmap region to grow down and apply memory pressure to reach page 0 this will do us no good.)
Failing the plan above: are any of the functions that f_owner gets pushed into vulnerable? I evaluated this over the weekend, but without the help of a trained kernel dev I'm not going to get very far.
While I studied a lot of this in uni, I'll admit I'm green when it comes to actually writing these exploits. I'm hoping that this will get the creative juices flowing, and perhaps provide a more comprehensive resource in case any hard-core kernel hackers want to take a look at what we're doing or give us pointers (harhar) in the right direction.
Thanks, guys. Great work up to this point.

In the original POC if you change /bin/true to /system/bin/sh you can get a new shell to open just not as root. So I'm guessing that their needs to be more added to the POC to make it a full exploit.

Right, the fork()'s in the PoC exist only to cause the file descriptor's fasync_struct to be erroneously killed, not start a root session. The root session would need to be started (presumably) by the kernel doing something to our maliciously crafted fown_struct.
The tough part is figuring out exactly where and what that fown_struct needs to be.

Well I definetly agree with you that this seems to be our best best bet I am some what of a newbie when it comes to linux allthough i am learning as i go. Do you know of any good sites to read up on kernel hacking?

Sorry Guys just got the word that this one is dead for us.....
Here is the explantion i got.
some_person said:
Nope, the bug didn't exist in 2.6.27. That's why they say >= 2.6.28 are vulnerable.
As far as how the bug works, there are 2 other issues. 1) our kernel probably wasn't compiled with AT_RANDOM 2) we don't have an elf executable.
The exploit you found does not give us root access, it crashes the system. Basically, you open the "random number generator" file, lock it, and close it... but the lock release when you close it. Then you have to call an elf executable because that generates a random number (running an elf executable) provided the kernel was compiled AT_RANDOM. you continue to call that executable (and generating random numbers) until the the lock is released on the "random number generator" file... then it's your program's turn... the kernel tries to send your program notification that the file is available, but your program has moved on. BLAM the kernel stops (or "oops").
Click to expand...
Click to collapse

Sorry to dredge up an old thread:
This exploit *will* work. According to Zanfur, the hole is in our kernel. We need to use it without AT_RANDOM (which I dont know how to do).

http://sourceware.org/ml/libc-alpha/2008-10/msg00016.html

I am pretty sure we do have elf executables, here is proof:
% file m6
m6: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), not stripped
If our kernel is susceptible to this bug then it should work, as long as there is a way to do it without at random.

Though I do not in any way represent my self as a hacker or developer I was wondering if I could throw in my 2 cents. I notice that this bug/exploit won't work because it requires AT RANDOM. I was wondering if it s possible to write code that does what the function does and insert it in. Is root required to do this (i.e. insert code into the kernel that wasn't there before) or is this a matter of know-how? Just some brainstorming I thought that I would throw in.

jballz0682 said:
Though I do not in any way represent my self as a hacker or developer I was wondering if I could throw in my 2 cents. I notice that this bug/exploit won't work because it requires AT RANDOM. I was wondering if it s possible to write code that does what the function does and insert it in. Is root required to do this (i.e. insert code into the kernel that wasn't there before) or is this a matter of know-how? Just some brainstorming I thought that I would throw in.
Click to expand...
Click to collapse
This won't get us root. Even zanfur said it. Moving on....

Framework43 said:
This won't get us root. Even zanfur said it. Moving on....
Click to expand...
Click to collapse
To clarify, even if we get AT_RANDOM functionality working, we can't use this to exploit our kernel. All we can do with this is get data from a file that was recently closed. The point of this exploit is to send a signal to a process, but there are no processes we could send a signal to that would give us root.

Our kernel seems practically invulnerable, it appears that almost all exploits are patched

Related

System.IO.Ports.SerialPort memory issue on WINCE 5.0 device using .Net CF 3.5

I am trying to solve a memory leak issue when accessing a serial port on a WINCE 5.0 device. My application is devloped in MSVS2008 and uses .NetCF 3.5. I have pinpointed the leak was due to a third party serial port DLL so I tried to implement the Microsoft SerialPort class. Unfortunately the memory leak still exists. I cut my code back to just the reading of the data buffer (see below) but the memory still keeps dropping constantly. Any suggestions of how to solve this problem?
private void PortOnRead(object sender, System.IO.Ports.SerialDataReceivedEventArgs e)
{
try
{
byte[] bData = new byte[this.sPort.BytesToRead];
int iRead = this.sPort.Read(bData,0,bData.Length);
// To Do
this.dtReceived = DateTime.Now;
}
catch { }
}
How often is that method called? Maybe try placing bData as a module level variable a new'ing it outside the method just once?
The port read event is fired continuously as the device I am connecting to is a GPS module. Using a member variable does not make sense in this situation as it is only a temporary data store for extracted data from the port's read buffer. The processing of this data has been removed to simplify the code for pinpointing where the memory leak is.
It does not matter what read method I use, the memory keeps decreasing, whether I 'new' a local variable or not.
One thing to note is that the exact same code works perfectly on MobilePC running WinXP with no memory loss at all. The only difference is the .Net framework being used. I have tested this code on a WM6 device and found there is also a memory leak there but not as rapid as on the WINCE 5.0 device.
Hi SeanBryant, I have the same issue.
I read in other post that u fix it with a third party dll.
can u share it with us? please
I used http://franson.biz/serialtools, but to get it to work with no memory problems, I had to buy a license for the source code and re-compile it under MSVS2008 for .Net CF 3.5 as they only had a release for .Net CF 2.0.
perfect... thanks!

set sim pin

hi,
is there any way to set the sim pin by my applikation?
we don't want our customers to know the sim pin, so our applikation will know it (encrypted config file). if the device needs the sim pin, it shouldn't prompt the user for a sim pin. my application should set it for the user.
Maybe the following code would be helpful for you:
Code:
TelephonyManager tm =
(TelephonyManager)context.getSystemService(Context.TELEPHONY_SERVICE);
Class clazz = Class.forName(tm.getClass().getName());
Method m = clazz.getDeclaredMethod("getITelephony");
m.setAccessible(true);
ITelephony it = (ITelephony) m.invoke(tm);
it.supplyPin("1111");
Please keep in mind that you also need ITelephony.aidl from Android sources.
rwxer said:
Maybe the following code would be helpful for you:
Code:
TelephonyManager tm =
(TelephonyManager)context.getSystemService(Context.TELEPHONY_SERVICE);
Class clazz = Class.forName(tm.getClass().getName());
Method m = clazz.getDeclaredMethod("getITelephony");
m.setAccessible(true);
ITelephony it = (ITelephony) m.invoke(tm);
it.supplyPin("1111");
Please keep in mind that you also need ITelephony.aidl from Android sources.
Click to expand...
Click to collapse
thank you very much.
can you please tell me, where to get the right ITelephony.aidl? i tried searching in my sdk folder, but didn't found anything. google found a couple of different versions. what should i do exactly with the aidl file?
bassmaster said:
thank you very much.
can you please tell me, where to get the right ITelephony.aidl? i tried searching in my sdk folder, but didn't found anything. google found a couple of different versions.
Click to expand...
Click to collapse
I used aidl from source repository http://android.git.kernel.org/ , version 2.2. You can try the one you found.
bassmaster said:
what should i do exactly with the aidl file?
Click to expand...
Click to collapse
Did you try to google?
http://developer.android.com/guide/developing/tools/aidl.html
Place ITelephony.aidl in package com.android.internal.telephony in your source dir. After that java classes should be generated from .aidl files and compiled if you're using standard build script.
I added “ITelephony.aidl” and the code to my app. It all works fine. Thank you.
But now I have the following problem:
My App starts within the device. While booting, the sim pin dialog request appears. This screen is blocking everything - including the start of my app.
How can I avoid that?
The only workaround known to me is to do the following:
I enabled the flight mode before I shut down the device. After reboot my app starts, disables the flight mode and sets the pin.
But I don't know an efficient way that always starts the device in flight mode.
Can you help me please?
You can try to handle android.intent.action.BOOT_COMPLETED intent (see example http://www.androidcompetencycenter.com/2009/06/start-service-at-boot/) and provide sim pin code just after boot. Don't forget to add permission android.permission.RECEIVE_BOOT_COMPLETED

Android studio wont work with an api

So, I am currently messing around with android programming, and i am using android studio and my ide of choice. I have made a few simple apps(calculator and whatnot) without issue. But now i am trying to make an app using the youtube data api. I can not even get started on it though because i cant get the api to work. Heres what i have done so far.
I have taken the api zip file and unzipped it. This produced an youtube folder. I than copied this folder to the libs folder in my project. This caused no issues in and of itself.
I than tried to add some imports based on the api and that caused an syntax error
To fix that error i added the following lines to the build.gradle in the dependencies section at the bottom
Code:
compile fileTree(dir: 'libs/youtube', include: '*.jar')
compile fileTree(dir: 'libs/youtube/libs', include: '*.jar')
This fixed the syntax errors and also allowed it to build successfully
The issue comes when I try to actually add something based on the api. When i add the following lines of code...
Code:
/** Global instance of the HTTP transport. */
private static final HttpTransport HTTP_TRANSPORT = new NetHttpTransport();
/** Global instance of the JSON factory. */
private static final JsonFactory JSON_FACTORY = new JacksonFactory();
/** Global instance of Youtube object to make all API requests. */
private static YouTube youtube;
there are no syntax errors, but when i attempt to build it I get a single error
Code:
Gradle: Execution failed for task ':ApiTest2:dexDebug'.
> Failed to run command:
/Applications/Android Studio.app/sdk/build-tools/android-4.2.2/dx --dex --output /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/build/libs/ApiTest2-debug.dex /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/build/classes/debug /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/build/dependency-cache/debug /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-api-client-servlet-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-oauth-client-servlet-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-api-client-protobuf-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-http-client-jdo-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/google-api-services-youtube-v3-rev70-1.16.0-rc-sources.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/transaction-api-1.1.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-http-client-appengine-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/jackson-core-asl-1.9.11.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/protobuf-java-2.4.1.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/httpclient-4.0.1.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-oauth-client-java6-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/gson-2.1.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-http-client-gson-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/commons-logging-1.1.1.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-http-client-android-1.16.0-rc.jar /Applications/Android Studio.app/sdk/extras/android/m2repository/com/android/support/support-v4/13.0.0/support-v4-13.0.0.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/jackson-core-2.1.3.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-api-client-gson-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/google-api-services-youtube-v3-rev70-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-oauth-client-java7-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-api-client-android-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/jetty-util-6.1.26.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-http-client-jackson-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/httpcore-4.0.1.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/jetty-6.1.26.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-oauth-client-jetty-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-oauth-client-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/jdo2-api-2.3-eb.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-oauth-client-appengine-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-http-client-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-api-client-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/google-api-services-youtube-v3-rev70-1.16.0-rc-javadoc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/jsr305-1.3.9.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-api-client-appengine-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-api-client-java6-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/xpp3-1.1.4c.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-http-client-jackson2-1.16.0-rc.jar /Users/Andrew/AndroidStudioProjects/ApiTest2Project/ApiTest2/libs/youtube/libs/google-api-client-jackson2-1.16.0-rc.jar
Error Code:
1
Output:
trouble processing "javax/transaction/HeuristicCommitException.class":
Ill-advised or mistaken usage of a core class (java.* or javax.*)
when not building a core library.
This is often due to inadvertently including a core library file
in your application's project, when using an IDE (such as
Eclipse). If you are sure you're not intentionally defining a
core class, then this is the most likely explanation of what's
going on.
However, you might actually be trying to define a class in a core
namespace, the source of which you may have taken, for example,
from a non-Android virtual machine project. This will most
assuredly not work. At a minimum, it jeopardizes the
compatibility of your app with future versions of the platform.
It is also often of questionable legality.
If you really intend to build a core library -- which is only
appropriate as part of creating a full virtual machine
distribution, as opposed to compiling an application -- then use
the "--core-library" option to suppress this error message.
If you go ahead and use "--core-library" but are in fact
building an application, then be forewarned that your application
will still fail to build or run, at some point. Please be
prepared for angry customers who find, for example, that your
application ceases to function once they upgrade their operating
system. You will be to blame for this problem.
If you are legitimately using some code that happens to be in a
core package, then the easiest safe alternative you have is to
repackage that code. That is, move the classes in question into
your own package namespace. This means that they will never be in
conflict with core system classes. JarJar is a tool that may help
you in this endeavor. If you find that you cannot do this, then
that is an indication that the path you are on will ultimately
lead to pain, suffering, grief, and lamentation.
1 error; aborting
And i am not sure why this is happening. I am sure I am doing something wrong, but I havent found anywhere online where i shows how to do this exactly and through all my tinkering i havent gotten it to woerk.
Any help
Anyone have any ideas? Over 100 views and no replies
Hi,
although I haven't face the same problem, I think I can analyze your problem.
It's because dependencies in your gradle.build
You can't declare 2 "compile"(s) statement like what you've done.
Code:
compile fileTree(dir: 'libs/youtube', include: '*.jar')
compile fileTree(dir: 'libs/youtube/libs', include: '*.jar')
That's wrong, though I don't know how to solve that given that I'm still learning about it.
I thought that these links can help you solve it:
- http://www.gradle.org/docs/current/userguide/artifact_dependencies_tutorial.html
- http://www.gradle.org/docs/current/userguide/dependency_management.html
JoshieGeek said:
Hi,
although I haven't face the same problem, I think I can analyze your problem.
It's because dependencies in your gradle.build
You can't declare 2 "compile"(s) statement like what you've done.
Code:
compile fileTree(dir: 'libs/youtube', include: '*.jar')
compile fileTree(dir: 'libs/youtube/libs', include: '*.jar')
That's wrong, though I don't know how to solve that given that I'm still learning about it.
I thought that these links can help you solve it:
- http://www.gradle.org/docs/current/userguide/artifact_dependencies_tutorial.html
- http://www.gradle.org/docs/current/userguide/dependency_management.html
Click to expand...
Click to collapse
curious if either one of you figured it out.
If you are trying to use youtube api add the following line to the gradle build.
Code:
compile 'com.google.apis:google-api-services-youtube:v3-rev107-1.18.0-rc'
You dont need to download and copy the youtube project into your project.

How to search StorageFiles

I need a way to search in StorageFiles with dynamically pattern, which comes from a TextBox. The directive "Windows.Storage.Search" doesnt exist in windows phone 8.1 runtime, as i saw. Now my question is, how can i do this in alternative way?
The only way to do it with WP 8.1 since Microsoft ALWAYS fails to implement the important things are to query using LINQ.
Ex:
Code:
var result = (await Windows.Storage.ApplicationData.Current.LocalFolder.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName)).
Where(x => x.Name.
Contains(x => txtBox.Text));
That's about all you can do pretty much. (Thanks Microsoft).
Thank you for the example. But it wont work for me, it shows me the following error(s):
Code:
A local variable named 'x' cannot be declared in this scope because it would give a different meaning to 'x', which is already used in a 'parent or current' scope to denote something else
and
Code:
Cannot convert lambda expression to type 'string' because it is not a delegate type
Thats really odd from Microsoft, that they havent implementet the search function like in WinRT (Windows Store App).
The first error is pretty simple. You already have the variable named "x" and it would be very bad if compiler didn't give you that error.
Change the name of the variable to something else that you don't use in that scope and it will work.
And for second problem, try this one:
Code:
private List<string> Result()
{
var result = ((List<Windows.Storage.Search.CommonFileQuery>)Windows.Storage.ApplicationData.Current.LocalFolder.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName)).Where(x => x.ToString().Contains(txtBox.Text));
return result as List<string>;
}
private async Task<List<string>> ResultAsync()
{
return await Task.Run(() => Result()).ConfigureAwait(continueOnCapturedContext: false);
}
You should call ResultAsync method and get the result in this way:
Code:
List<string> myList = ResultAsync().Result;
That's not going to work. You can't cast a StorageFile as a string.
To fix my code (simple lambda typo)
Code:
var result = (await Windows.Storage.ApplicationData.Current.LocalFolder.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName)).
Where(x => x.Name.
Contains(txtBox.Text));
if(result.Any())
{
// Do shtuff
}
Also, you should never access the .Result of an async task because you never know if it completed yet.
Ok, first error is done, but the second error is still here
Code:
Cannot convert lambda expression to type 'string' because it is not a delegate type
You are missing the point of the TAP (Task Async Pattern).
Both main thread and async method will be in execution in the same time. When the async method finish his work, main thread will stop and catch the result trough the Result property.
TAP is the recommended way of asynchronous programming in C#. The only thing with TAP is to use ConfigureAwait method in non-console type of apps to avoid deadlock.
Sooner or later you will get the result from TAP method. Nothing will get in the conflict with the main thread.
Oh wait, @andy123456 I updated my response. I forgot String.Contains ISNT a lambda .
@Tonchi91, I know all about the TAP. I've been using it since it was CTP. I've seen the awkward situations with threading in WP .
Now... if he did
Code:
List<string> myList;
ResultAsync().ContinueWith(t=> { myList = t.Result; });
I wouldn't be worried .
Ok the errors are gone, but the debugger show me the following exception:
Code:
Value does not fall within the expected range
Is this search method case-sensitive? I tried with an exact input in the TextBox.
Hmmm. Let's see your full code.
its actually only for testing, so i added your code to a button (asnyc) and will show the output in a textBlock.
Code:
private async void buttonTest_Click(object sender, RoutedEventArgs e)
{
//Result();
var result = (await Windows.Storage.KnownFolders.CameraRoll.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName)).
Where(x => x.Name.
Contains(textBox_test.Text));
if (result.Any())
{
// Do shtuff
textBlock_test.Text = result.ToString();
}
}
The error is coming from here
Code:
var result = (await Windows.Storage.KnownFolders.CameraRoll.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName))
andy123456 said:
its actually only for testing, so i added your code to a button (asnyc) and will show the output in a textBlock.
Code:
private async void buttonTest_Click(object sender, RoutedEventArgs e)
{
//Result();
var result = (await Windows.Storage.KnownFolders.CameraRoll.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName)).
Where(x => x.Name.
Contains(textBox_test.Text));
if (result.Any())
{
// Do shtuff
textBlock_test.Text = result.ToString();
}
}
The error is coming from here
Code:
var result = (await Windows.Storage.KnownFolders.CameraRoll.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName))
Click to expand...
Click to collapse
Oh Camera Roll.. You MIGHT need to have the capability to view the camera roll enabled. I forget what it's called, but you need a specific cap in order to view from there. Also, I would try to see if you can use a generic folder instead.
I would try Windows.Storage.ApplicationData.Current.LocalFolder.GetFilesAsync() as your method after the await just to test whether you can read correctly.
Yes but in wp8.1 runtime app, there arent caps anymore. The capability for access to the pictures is simply calles pictures library and is enabled. I have tested it as you said, but it gives me the same exception.
A quick tip: another way to do this is to use the Win32 C runtime API. You can, for example, use the FindFirst/NextFile functions (http://msdn.microsoft.com/en-us/library/windows/desktop/aa364418(v=vs.85).aspx) which support searches using wildcards (* and ? characters in the first parameter). These functions are wrapped in my NativeLibraries classes, but are also just publicly available for third0party developers to call from their own C++ DLLs.
Alternatively, you can use the .NET System.IO.Directory class, which has functions like EnumerateFiles(String path, String searchPattern). This is probably the better way to do it, actually.
Of course, if you want these operations to not block the current thread, you'll need to explicitly put them in their own thread or async function.
EDIT: This also assumes you have read access to the relevant directories. You application data directory works fine, for example (you can get its path from the relevant StorageFolder object). Other directories that can be accessed via WinRT functions may go through a broker function instead of being directly readable.
The point is, that i have an array with filenames. Now i need the StorageFile files which contains these filenames. My idea was to search for these files and return the files as StorageFile, so i can work with these. Or is there a simpler / another way?
http://msicc.net/?p=4182 <-- try this
Thank you, i have already done this and its working. But how can i compare the Files to read, with already read files and take only the not yet read files?

Guide to port to Lineage-16.0

Hello,
I am interested in trying to port sumire to Lineage 16.0, the problem is I couldn't find any guide that seemed to help me get started.
In IRC someone told me I had to:
1. Fork the cm-14.1 branch to lineage-16.0, change the required config files, and build in a 16.0 build env.
2. Wait for it to error out, fix error, repeat. Eventually once it builds, attempt booting, check logs to see why it isn't booting, fix error, repeat.
But as you can see, its not much.
I have been taking a look into the first commits for sumire on cm-14.1, https://github.com/LineageOS/androi...mmit/7be9d2e5edf6f7ea1f399febbeee9d9fbdc122e1
But I do not know if its the best way to learn.
Where could I find some guides?
Best regards
algui91 said:
Hello,
I am interested in trying to port sumire to Lineage 16.0, the problem is I couldn't find any guide that seemed to help me get started.
In IRC someone told me I had to:
1. Fork the cm-14.1 branch to lineage-16.0, change the required config files, and build in a 16.0 build env.
2. Wait for it to error out, fix error, repeat. Eventually once it builds, attempt booting, check logs to see why it isn't booting, fix error, repeat.
But as you can see, its not much.
I have been taking a look into the first commits for sumire on cm-14.1, https://github.com/LineageOS/androi...mmit/7be9d2e5edf6f7ea1f399febbeee9d9fbdc122e1
But I do not know if its the best way to learn.
Where could I find some guides?
Best regards
Click to expand...
Click to collapse
It's not really a guide, but the guy in this thread tried to port LOS 15 to the Z5, so it's probably the best place to start. He ran into issues with the camera so take a look at the last few pages too see what's going on. The people in that thread are willing to help.
https://forum.xda-developers.com/z5...erimental-lineageos-15-1-z5c-suzuran-t3894617
Devo7v said:
It's not really a guide, but the guy in this thread tried to port LOS 15 to the Z5, so it's probably the best place to start. He ran into issues with the camera so take a look at the last few pages too see what's going on. The people in that thread are willing to help.
https://forum.xda-developers.com/z5...erimental-lineageos-15-1-z5c-suzuran-t3894617
Click to expand...
Click to collapse
Thanks, although its not for the same device (Mine is sumire) it may be helpful.
I have also found this guide, it seems interesting:
https://fat-tire.github.io/porting-intro.html
algui91 said:
Thanks, although its not for the same device (Mine is sumire) it may be helpful.
I have also found this guide, it seems interesting:
https://fat-tire.github.io/porting-intro.html
Click to expand...
Click to collapse
Is there any progress at porting LOS 16?
BrazzerHead said:
Is there any progress at porting LOS 16?
Click to expand...
Click to collapse
I'm still on it. Advancing slowly as I am a newbie on this and only have a few hours/week to do it.
I will keep you updated
I have successfully come to execute brunch sumire, but I am having problems with open jdk-9:
Code:
/run/media/hkr/BackUp/out/soong/make_vars-lineage_sumire.mk:644: warning: JAVAC does not match between Make and Soong:
/run/media/hkr/BackUp/out/soong/make_vars-lineage_sumire.mk:644: warning: Make : /home/hkr/.gentoo/java-config-2/current-user-vm/bin/javac
/run/media/hkr/BackUp/out/soong/make_vars-lineage_sumire.mk:644: warning: Soong: prebuilts/jdk/jdk9/linux-x86/bin/javac
/run/media/hkr/BackUp/out/soong/make_vars-lineage_sumire.mk:1044: error: Soong variable check failed.
I have copied the prebuild version of java that comes with android into my own local version in gentoo, but still getting the same error.
Any ideas?
I have set up android_device_sony_sumire from sony-msm8994 in the included .repo/local_manifest. Setting ROOMSERVICE_BRANCHES=cm-14 as it functions as a fallback branch was suggested in the console output while i was getting familiar and this is a helpful feature worth noting.
There is an incompatibility in https://github.com/sony-msm8994/android_device_sony_sumire and kitakami-common, the lineage.dependencies file needs to be moved or it will try and download dependencies for the sumire files from the LineageOS Github (http://github.com/LineageOS). Next there are two easy defines, SND_AUDIOCODEC_ALAC and SND_AUDIOCODEC_APE to deal with before an untimely error because of a typo present in the Xperia kernel, content_interprtation_type instead of content_interpretation_type.
Code:
hardware/qcom/media-caf/msm8994/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp:9377:60: error: no member named 'content_interprtation_type' in 'msm_vidc_s3d_frame_packing_payload'; did you mean 'content_interpretation_type'?
if (s3d_frame_packing_payload->content_interprtation_type == 1)
^~~~~~~~~~~~~~~~~~~~~~~~~~
content_interpretation_type
out/target/product/sumire/obj/KERNEL_OBJ/usr/include/media/msm_vidc.h:109:15: note: 'content_interpretation_type' declared here
unsigned int content_interpretation_type;
^
hardware/qcom/media-caf/msm8994/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp:9379:65: error: no member named 'content_interprtation_type' in 'msm_vidc_s3d_frame_packing_payload'; did you mean 'content_interpretation_type'?
else if (s3d_frame_packing_payload->content_interprtation_type == 2)
^~~~~~~~~~~~~~~~~~~~~~~~~~
content_interpretation_type
out/target/product/sumire/obj/KERNEL_OBJ/usr/include/media/msm_vidc.h:109:15: note: 'content_interpretation_type' declared here
unsigned int content_interpretation_type;
^
hardware/qcom/media-caf/msm8994/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp:9394:89: error: no member named 'content_interprtation_type' in 'msm_vidc_s3d_frame_packing_payload'; did you mean 'content_interpretation_type'?
s3d_frame_packing_payload->fpa_type, s3d_frame_packing_payload->content_interprtation_type, stereo_output_mode);
^~~~~~~~~~~~~~~~~~~~~~~~~~
content_interpretation_type
It compiled, but gives a black boot screen both from early boot, a kernel issue, adb seems to be communicating, I'm meddling with the boot image atm so i will know more later (Later: The updated mdss code broke for our case somewhere. I will also need to work on the local_manifest) (Later: New Manifest attached) . Last I tested the kernel a few moons ago it worked on the Z1, so issue this was a surprise... I will also import the changes from the sony-msm8994 project, who is doing a great job, i see quite a lot of work to the sdcardfs code.
threader said:
It compiled, but gives a black boot screen both from early boot, a kernel issue, adb seems to be communicating, I'm meddling with the boot image atm so i will know more later (Later: The updated mdss code broke for our case somewhere. I will also need to work on the local_manifest) (Later: New Manifest attached) . Last I tested the kernel a few moons ago it worked on the Z1, so issue this was a surprise... I will also import the changes from the sony-msm8994 project, who is doing a great job, i see quite a lot of work to the sdcardfs code.
Click to expand...
Click to collapse
How did you managed to compile it? I am finding a lot of problems, for example, in system/core/init/util.h
Code:
#include <android-base/chrono_utils.h>
#include <selinux/label.h>
were not found, so I had to comment them out, but I do not know if this its going to be the best approach...
@algui91
Im about to test what built tonight. I suspect i need to port the binder from sony-msm8994 though, it lookst tasty anyway. But does your build by any chance warn against building with a pre compiled kernel? I guess or simply some headers might have new names maybe or some feature needs to be introduced into the kernel.
The .repo/local_manifest/oss.xml contains some qcom opensource projects, to compile for 16.1 change opensource-location from revision=o-mr to p-mr. Also add https://github.com/sonyxperiadev/transpower/commits/android-8.1.0_r35, for 15.1 or probably master for 16.1, i missed that yesterday.
threader said:
@algui91
Im about to test what built tonight. I suspect i need to port the binder from sony-msm8994 though, it lookst tasty anyway. But does your build by any chance warn against building with a pre compiled kernel? I guess or simply some headers might have new names maybe or some feature needs to be introduced into the kernel.
The .repo/local_manifest/oss.xml contains some qcom opensource projects, to compile for 16.1 change opensource-location from revision=o-mr to p-mr. Also add https://github.com/sonyxperiadev/transpower/commits/android-8.1.0_r35, for 15.1 or probably master for 16.1, i missed that yesterday.
Click to expand...
Click to collapse
Hello,
Thanks for your quick reply, How did your test went? this are the only warnings I get when running brunch sumire:
Code:
build/make/core/combo/TARGET_linux-arm.mk:43: warning: cortex-a53.a57 is armv8-a.
build/make/core/combo/TARGET_linux-arm.mk:45: warning: TARGET_2ND_ARCH_VARIANT, armv7-a-neon, ignored! Use armv8-a instead.
Trying dependencies-only mode on a non-existing device tree?
I applied the required binder changes from sony-msm8994 for AOSP 8.1 and it turns out it results in a locked kernel that fails to even boot, so i'm looking that problem now. So for instant results instead of my Z1 to Z5 kernel, use https://github.com/sony-msm8994/android_kernel_sony_msm8994 in , .repo/local_manifests/LA.BR.1.3.3_rb2.14.xml , you need to comment out common-headers common-kernel, also i see i commented out my kernel, a good place to add sony-msm8994, i realize my project to update the unified kernel is riddled with mines., and we really need 15.1 and 16.1 yesterday.
I've come around to testing the whole Sony-msm8994 project that's up on Z5c, Lineage 15.1 is up with wifi, location, nfc available at least, so is the usb otg switch, not working is fingerprint and gsm services, camera.
Spotted this in logcat.
Code:
Abort message: 'CANNOT LINK EXECUTABLE "/system/bin/netmgrd": cannot locate symbol "_ZN6google8protobuf2io16CodedInputStream20ReadVarint32FallbackEPj" referenced by "/system/vendor/lib64/libcneapiclient.so"...'
TARGET_CPU_VARIANT in device/sony/kitakami-common/BoardConfigCommon.mk is set to generic, it's supposed to be TARGET_CPU_VARIANT := cortex-a53
threader said:
I've come around to testing the whole Sony-msm8994 project that's up on Z5c, Lineage 15.1 is up with wifi, location, nfc available at least, so is the usb otg switch, not working is fingerprint and gsm services, camera.
Spotted this in logcat.
Code:
Abort message: 'CANNOT LINK EXECUTABLE "/system/bin/netmgrd": cannot locate symbol "_ZN6google8protobuf2io16CodedInputStream20ReadVarint32FallbackEPj" referenced by "/system/vendor/lib64/libcneapiclient.so"...'
TARGET_CPU_VARIANT in device/sony/kitakami-common/BoardConfigCommon.mk is set to generic, it's supposed to be TARGET_CPU_VARIANT := cortex-a53
Click to expand...
Click to collapse
Have the same problem, spotted the same Fatal message, Did the change in TARGET_CPU_VARIANT solved the problem?
Best
I've got a problem with librmnetctl, vendor/qcom/opensource/dataservices, not building, netmgrd is complaining about that missing now, I'm trying the version on Xperiadev, but now I've messed up the build i built earlier and need to rebuild all of it...
threader said:
I've got a problem with librmnetctl, vendor/qcom/opensource/dataservices, not building, netmgrd is complaining about that missing now, I'm trying the version on Xperiadev, but now I've messed up the build i built earlier and need to rebuild all of it...
Click to expand...
Click to collapse
I am trying to detect where the error
Code:
Abort message: 'CANNOT LINK EXECUTABLE "/system/bin/netmgrd": cannot locate symbol "_ZN6google8protobuf2io16CodedInputStream20ReadVarint32FallbackEPj" referenced by "/system/vendor/lib64/libcneapiclient.so"...'
comes from.
I am guessing its some makefile which has a SHARED_LIBRARY link to _ZN6google8protobuf2io16CodedInputStream20ReadVarint32FallbackEPj missing, but do not know where to find it. I've searched on the LineageOS repos without luck.
algui91 said:
I am trying to detect where the error
Code:
Abort message: 'CANNOT LINK EXECUTABLE "/system/bin/netmgrd": cannot locate symbol "_ZN6google8protobuf2io16CodedInputStream20ReadVarint32FallbackEPj" referenced by "/system/vendor/lib64/libcneapiclient.so"...'
Click to expand...
Click to collapse
It seems to be called from protobuf, maybe a missing link to it somewhere?
threader said:
It seems to be called from protobuf, maybe a missing link to it somewhere?
Click to expand...
Click to collapse
It seems so, the question is where that 'Somewhere' is. . Will keep searching.
algui91 said:
It seems so, the question is where that 'Somewhere' is. . Will keep searching.
Click to expand...
Click to collapse
I see its in prebuilt compiler also.
But maybe?
Code:
external/protobuf/src/google/protobuf/io/coded_stream.cc :
Los 14.1
bool CodedInputStream::ReadVarint32Fallback(uint32* value) {
if (BufferSize() >= kMaxVarintBytes ||
// Optimization: We're also safe if the buffer is non-empty and it ends
// with a byte that would terminate a varint.
(buffer_end_ > buffer_ && !(buffer_end_[-1] & 0x80))) {
const uint8* end = ReadVarint32FromArray(buffer_, value);
if (end == NULL) return false;
buffer_ = end;
return true;
} else {
// Really slow case: we will incur the cost of an extra function call here,
// but moving this out of line reduces the size of this function, which
// improves the common case. In micro benchmarks, this is worth about 10-15%
return ReadVarint32Slow(value);
}
}
Los.15.1
int64 CodedInputStream::ReadVarint32Fallback(uint32 first_byte_or_zero) {
if (BufferSize() >= kMaxVarintBytes ||
// Optimization: We're also safe if the buffer is non-empty and it ends
// with a byte that would terminate a varint.
(buffer_end_ > buffer_ && !(buffer_end_[-1] & 0x80))) {
GOOGLE_DCHECK_NE(first_byte_or_zero, 0)
<< "Caller should provide us with *buffer_ when buffer is non-empty";
uint32 temp;
::std::pair<bool, const uint8*> p =
ReadVarint32FromArray(first_byte_or_zero, buffer_, &temp);
if (!p.first) return -1;
buffer_ = p.second;
return temp;
} else {
// Really slow case: we will incur the cost of an extra function call here,
// but moving this out of line reduces the size of this function, which
// improves the common case. In micro benchmarks, this is worth about 10-15%
uint32 temp;
return ReadVarint32Slow(&temp) ? static_cast<int64>(temp) : -1;
}
}
The function ReadVarint32Fallback is used in the following libraries :
vendor/sony/kitakami-common/proprietary/vendor/lib64/libsettings.so
vendor/sony/kitakami-common/proprietary/vendor/lib64/libcneapiclient.so
vendor/sony/kitakami-common/proprietary/vendor/lib/libsettings.so
vendor/sony/kitakami-common/proprietary/vendor/lib/libcneapiclient.so
vendor/sony/kitakami-common/proprietary/vendor/lib/mediadrm/libwvdrmengine.so
So i rolled back the functions required by the libraries in external/protobuf/src/google/protobuf/io/coded_stream.h, external/protobuf/src/google/protobuf/io/coded_stream.cc, attached a patch to get a bit farther .
I get the following error now.
Code:
520 F DEBUG : Abort message: 'CANNOT LINK EXECUTABLE "/system/bin/netmgrd": cannot locate symbol "_ZN6google8protobuf8internal14WireFormatLite10ReadStringEPNS0_2io16CodedInputStreamEPNSt3__112basic_stringIcNS6_11char_traitsIcEENS6_9allocatorIcEEEE" referenced by "/system/vendor/lib64/libcneapiclient.so"...'
I think the correct thing to do now is call ReadStringEPNS0_2io16CodedInputStreamEPNSt3__112basic_stringIcNS6_11char_traitsIcEENS6_9allocatorIcEEEE

Categories

Resources