[Q] Elocity A7 and Android ID - A7 General

I owned an Archos and returned it. Aside from the 256MB of RAM really bothering me about the potential upgrades, the deal breaker was on the Froyo update, the "Android_ID" field was left blank (NULL).
There are several apps. that require the Android_ID to be set and one of them is the Siruis/XM app. I rooted the system and attempted to modify several sqlite3 tables to include the ID but nothing worked properly. (Confirmed by others at Slatedroid).
Anyway, can somebody tell me whether the Android_ID field is properly filled out on the Elocity A7 ? There is a free app, in Google Market (yes I had added the Market to the Archos, as well) called ID. It will tell you the Android_ID and several other fields. Even the Android emulator, has all the various fields filled out.
Thanks in advance,
JR

My A7 has an Android ID.
Sim Serial, Device ID, and Subscriber ID all say "null"
rosenbj said:
I owned an Archos and returned it. Aside from the 256MB of RAM really bothering me about the potential upgrades, the deal breaker was on the Froyo update, the "Android_ID" field was left blank (NULL).
There are several apps. that require the Android_ID to be set and one of them is the Siruis/XM app. I rooted the system and attempted to modify several sqlite3 tables to include the ID but nothing worked properly. (Confirmed by others at Slatedroid).
Anyway, can somebody tell me whether the Android_ID field is properly filled out on the Elocity A7 ? There is a free app, in Google Market (yes I had added the Market to the Archos, as well) called ID. It will tell you the Android_ID and several other fields. Even the Android emulator, has all the various fields filled out.
Thanks in advance,
JR
Click to expand...
Click to collapse

If you have market working, download an app called android info. Once downloaded, expand the information under OS, there you will find the android ID. If you have market working you have an android ID.

Rapcon,
Actually, my Archos tablet had the Android market hack installed and fully functional. However, the Android_ID was NULL. I installed the Sirius App from Google Market Place and it didn't work (stuck at checking for updates) due to the non-existant Android_ID. I verified this with the "ID" app as well as SQLITE3 commands against the table in the DB on the rooted Archos Android OS. Most of the other Apps I installed worked fine.
Jazzbone,
Thanks so much for verifying the Android ID field is not null on the A7. One more reason to buy the A7.
One other concern:
Now I only wish it could connect to the PC as a USB device. Using Websharing, ADB via Wifi, or constantly swapping the MicroSD card is a real pain. Anybody know whether the new series of 7" A71, A72, A73 will have both USB Host mode and USB Slave mode capabilities?
Thanks,
Jeff

I found additional info about AndroidID when it's NULL
In instructions are some various methods...
Did you try this?
0. Do all things to create androidid with emulator and SDK...
1. Copy gls.db from /data/data/com.google.android.googleapps/databases/ to root of sd-card
2. With SQLite modify gls.db
Code:
- Browse data
- Choose Table:meta
name strvalue intvalue
1. AndroidID *insert value of androidid here*
- Save
3. Add Google-account
4. Place modified gls.db in fodler /data/data/com.google.android.googleapps/databases/
5. Reboot

Strogino,
Yeah. I tried updating the databases themselves using SQLite (which I took from the emulator) since it wasn't available in the Archos build. After reboot, that DB was reverted back to the original settings. I eventually gave up but with the A7 shouldn't be an issue.
All,
Still want to hear from people about the lack of USB Slave support. Do people use ADB over Wifi, Web Sharing, or just remove and add the MicroSD over and over again. Biggest concern is transferring MP3s and Video without this USB slave support. Wondering is the new line (A10, A71-A73) will support USB slave and it is worth waiting a few months.....
Thoughts?
Thanks,
JR

bluetooth
Swapping the microsd card is very simple for me since my laptop has a slot builtin.
For the occasional file, I'll use bluetooth file transfer.
rosenbj said:
Strogino,
Yeah. I tried updating the databases themselves using SQLite (which I took from the emulator) since it wasn't available in the Archos build. After reboot, that DB was reverted back to the original settings. I eventually gave up but with the A7 shouldn't be an issue.
All,
Still want to hear from people about the lack of USB Slave support. Do people use ADB over Wifi, Web Sharing, or just remove and add the MicroSD over and over again. Biggest concern is transferring MP3s and Video without this USB slave support. Wondering is the new line (A10, A71-A73) will support USB slave and it is worth waiting a few months.....
Thoughts?
Thanks,
JR
Click to expand...
Click to collapse

Related

[FIX] Full Market on Viewsonic G TntLite 3.1.4 Easy Edition

I just got the Viewsonic G tablet today and I was pretty bummed that there were hardly any market apps. I decided to take matters in my own hands to get full market on the device without having to edit a bunch of stuff.
Requirements...
A rooted android phone preferably 2.1 or higher.
a Viewsonic tab... duh.
Step 1.
Download Android ID Changer on your rooted phone.
Download Atstro Filemanager.
Keep the Viewsonic close by, your going to need it soon.
After both files are downloaded on your rooted device open Astro File Manager and press menu > tools> application manager/backup.
Backup Android ID changer.
Now plug the phone into your computer and browse to Sdcard/backups/apps and transfer the Android ID Changer.apk to your desktop or use your favorite file manager that can send files via email/bluetooth and send to yourself which ever is easier for you.
Plug your Gtab into your desktop via USB and enable usb transfer.
Copy the Android ID Changer.apk to your Gtab's Sdcard root.
[Magic Time!]
Now Go back to your Rooted Android Phone and run the Android Id Changer
When you run the id changer its going to ask for ROOT access, this is fine, allow it.
On the top under current Android ID please write down the 16 digit Android ID number.
that is all you need from your phone. Uninstall or do what you wish with it.
Use the Ifilemanager that is bundled with the Tnt 3.1.4 rom and navigate to your SDCARD Root, look for android id changer.apk and install it.
Once installed, launch the android id changer and grant it root/superuser permissions.
You will see a white box that says Enter New Android ID
Enter the 16 digit android id number and double check your work even triple check.
click save android id and then Change Id, This will reboot your machine instantly.
When you get back to the home screen reopen android id changer and check to make sure it matches your phone's id.
Now go to your home screen and press the menu button, then go to settings, then go to applications, then system applications, go to market application and clear cache and force stop. go to Market updater and force stop, Go to Google Services Framework and clear *DATA*, force stop. go to your home screen and launch Market. If you get an error than it worked, Reboot your machine and you will be welcomed with a full market.
Things i noticed...
1. Sometimes the market will give me a connection error but i think its my wifi im not sure, i do have full market and i have installed countless apps.
2. The Android id is basically cloning my phone making market think my gtab is a HTC EVO.
3. The Market is stable aside from every now and then a connection error will show but hitting retry and it goes on through but like i said i think its my network more than anything.
This is only confirmed on Tnt 3.1.4 nothing else, I'm sharing this information with you because i didn't want to install a dirty market, i want something i knew would work.
If this information already exists, please remove this post I honestly didn't go that deep in the forums looking for an answer when I just made it work myself.
Do you see NFS Shift?
No, but I do see dungeon defenders. I don't know if NFS shift supports the hardware inside these devices personally. I have the whole market, i mean i can search for appbrain, i got it, i can search for autokiller, i got it. I would almost have to be the hardware conflict between the devices. or not even that, it could be as simple as "Does this game support tegra 2? no? ok then dont show it on the list" Dungeon Defenders openly states that it supports Tegra processors and would explain why its showing up on market and not NFS shift.
*update*EA stated that they are making a NFS shift for Tablets meaning Tegra 2 support. that explains it not showing on market.
So Could i pull the data from my droid X and use that?
not to burst your bubble or anything but all of your steps about getting the 16 digit code from your phone can be skipped. just do a search for market fix and you will find the way to do it.
it is very similar to what you had after the 16 digit copy thing. it will save you a bunch of time.
i have just about a full market just as you explain but without copying the 16 digit thing.
None of the EA Games will run on The G Tab.
I know it doesnt run on the Gtab, but its an app i KNOW for a fact its missing in my market. Since he said he had a cloned market from his evo, i asked. Its just the same as the usual market fix.
Thanks
Firefox will not show up for me and I know it runs on the g-tab
Can you share how you were able to get that 16 digit Android ID number?
I would like to use the number from my Droid X...
Powers16 said:
I just got the Viewsonic G tablet today and I was pretty bummed that there were hardly any market apps. I decided to take matters in my own hands to get full market on the device without having to edit a bunch of stuff.
Requirements...
A rooted android phone preferably 2.1 or higher.
a Viewsonic tab... duh.
Step 1.
Download Android ID Changer on your rooted phone.
Download Atstro Filemanager.
Keep the Viewsonic close by, your going to need it soon.
After both files are downloaded on your rooted device open Astro File Manager and press menu > tools> application manager/backup.
Backup Android ID changer.
Now plug the phone into your computer and browse to Sdcard/backups/apps and transfer the Android ID Changer.apk to your desktop or use your favorite file manager that can send files via email/bluetooth and send to yourself which ever is easier for you.
Plug your Gtab into your desktop via USB and enable usb transfer.
Copy the Android ID Changer.apk to your Gtab's Sdcard root.
[Magic Time!]
Now Go back to your Rooted Android Phone and run the Android Id Changer
When you run the id changer its going to ask for ROOT access, this is fine, allow it.
On the top under current Android ID please write down the 16 digit Android ID number.
that is all you need from your phone. Uninstall or do what you wish with it.
Use the Ifilemanager that is bundled with the Tnt 3.1.4 rom and navigate to your SDCARD Root, look for android id changer.apk and install it.
Once installed, launch the android id changer and grant it root/superuser permissions.
You will see a white box that says Enter New Android ID
Enter the 16 digit android id number and double check your work even triple check.
click save android id and then Change Id, This will reboot your machine instantly.
When you get back to the home screen reopen android id changer and check to make sure it matches your phone's id.
Now go to your home screen and press the menu button, then go to settings, then go to applications, then system applications, go to market application and clear cache and force stop. go to Market updater and force stop, Go to Google Services Framework and clear *DATA*, force stop. go to your home screen and launch Market. If you get an error than it worked, Reboot your machine and you will be welcomed with a full market.
Things i noticed...
1. Sometimes the market will give me a connection error but i think its my wifi im not sure, i do have full market and i have installed countless apps.
2. The Android id is basically cloning my phone making market think my gtab is a HTC EVO.
3. The Market is stable aside from every now and then a connection error will show but hitting retry and it goes on through but like i said i think its my network more than anything.
This is only confirmed on Tnt 3.1.4 nothing else, I'm sharing this information with you because i didn't want to install a dirty market, i want something i knew would work.
If this information already exists, please remove this post I honestly didn't go that deep in the forums looking for an answer when I just made it work myself.
Click to expand...
Click to collapse
You get the number by installing Android ID changer from the market using your Rooted Droid X. Once the Android ID Changer is installed on your phone then you can open it and grant the software Super users privlidges and then it will show you the 16 digit id number.
This fix is for those who dont want to download modified markets or "dirty markets"
they can just download any market at that point and use it normally. But like i stated earlier if there is a easier fix then by all means use it, this is my personal fix im sharing with you all.
MikeTheSith200 said:
None of the EA Games will run on The G Tab.
Click to expand...
Click to collapse
Not completely true. Tetris works on the tablet
lol
So, fyi, this is a standard market hack. Furthermore, Most of the ea apps run, including madden, on the GTab. They have substantial texture issues though. Fifa may be broken now as of the last update. I can see many ea titles in my market, including NFS Shift, most likely due to modifying my Build Prop to match my droidx's signature.
Thats funny, no matter how many times I do a market hack/fix on TNT 4.0 it doesn't see any of the EA games.
Where exactly do you download the ID changer apk from? It's missing from the market, and google is providing no results just a dead link to the market.
Can you download flick kick football?
Could you attach the andriod Changer apk to the posting. It's blocked in the Market and you can't even search it.
Nice job works great using my droid ID. Are there any potential negative repercussions from having two devices with the same ID?
I did change id as per instructions as on my phone, but still same apps. The apps I can see on my phone are shown on my tab even after doing all this exercise.
bmwron said:
Could you attach the andriod Changer apk to the posting. It's blocked in the Market and you can't even search it.
Click to expand...
Click to collapse
Code:
https://market.android.com/details?id=adaptive.cogid
bump...
khj

[Q] New User...couple of questions

Hello,
Just got my Elocity A7 and so far my feelings on it are mixed. When it does what I want it to, I love it! But I am having a couple of issues....
1. How do I copy files from the sd card to the internal memory? I am trying to get the Nook app to recognize some epubs I have loaded on to the sd card. It does not see them at all. I was thinking the solution would be to get the files copied to the nook\mydocuments folder the app created in the internal memory but I cant figure out how to move the files. I tried connecting the A7 to my PC but when I do the PC does not recognize it at all. I tried running terminal, thinking I could just move the files that way, but when it opens, how to you type? Do you need an external keyboard?
2. Every USB storage device I have connected to the A7 just says "checking for errors" and that never seems to go away so it doesnt seem to be mounting the USB devices correctly.
3. Is it normal for this device to have a very limited wifi range? I have several other wifi devices, including the original nook, a media player and a laptop all of which work fine throughout my home but the A7 does not. However, I applied dexter's mod and then did the new official update and that seems to be a bit better now.
Any help or advice would be much appreciated! I have about 12 days left before I can no longer return it so I really want to make sure I can get these issues resolved before then since after its going to be a lot hard to return if I want.
Thank you!
Chris
Re. 1 - I don't have an A7, but it should have a file explorer apparently, and you should be able to use that to copy. For term, try pressing the menu button, or longpress to see if a keyboard or input method menu appears.
Jim
****** All below is from my experience using Dexter's Mod 1.1 ******
1) OI File Manager should be in your list of available mods. Open it, click on the SD card icon at the top. You are not at the sd card level yet, but the A7s symbolic sd card. Go down and find sdcard-disk0 as this is your actual SD card, click on it to open the sd card. Continue to find the desired file. Long hold on the file and a menu appears select copy. Now transverse your way to the desired spot to drop the file (Not in the folder, but to where you can see the folder -- you may not have write permisions to drop a file in some folders -- using a program such as Root Explorer will let you see if you have the right permissions). Long hold on the destination folder, and a menu will appear again. Select copy. Reasons this may not work...permissions and ownership. Linux/unix is particluar about these things.
2) More than likely your USB device is not formatted FAT/FAT32 must be to be able to utilize that type of device.
3) My range isn't extremely strong, but it is not bad. I use it in sever environments from sitting on top of the access point to being down a hall in a brick building with several walls between the A7 and the AP (lots of other devices) and it seems to work. My co-worker has an iPad and it is as strong as the iPad.
Hope that helps!
Dale
EDIT: Thought maybe I should add the following. I have tried several Droid Tablets/Pads and sent them back. Without Dexters mod, this one is not bad. With Dexter's mod it is near perfect (multi-touch would be nice). I am planning to develop software on it and use it as a organizational tool. I have DesktopToGo for editing office products and that works really good. PDF's rock. Music is pretty good (although my Archos 705 has my entire music collection on it with room for a lot more and several movies). I am using compiled help files (have extensive collection of ebooks in PDF format and CHM format) and those are awesome. I can tether this with my Droid phone and it in effect has 3G with no additional expense. I can VNC into my home computers and work computers and have full SSH access to all my servers. Several interesting games are awesome and I can keep up on Facebook and Twitter including playing a couple FaceBook games (and search for my previous posts and you can find out how to update Facebook). The face to face video/front facing video is not a huge item I would use, but it would definitely be adequate. Volume from the speakers is low, but works. Battery life is fine. I guess I am not sure what more I could want to do with it that I haven't been able to figure out. So for me, and mostly because of Dexter's MOD, IT IS A KEEPER!
I am about to try Dexter's mod at version 1.2 when I get home from work tonight.
So far I was on the fence about this device. I think for me I really wanted 3.0 on it and I did not have the patience to wait until 3.0 was released and there was some time for tablet makers to catch up. So in part my dilemna with this device is my own fault for being impatient. That being said I think there was some mis-information out there in regards to the touch screen which is one of the reasons I bought this device for future upgrade.
Now I see for $100 more I can have all I wanted in the newer device about to be on pre-order feb 15th. Of course $300 was a stretch for me so $400 is out of the question. I thought of returning this and getting a nook but the Tegra is so snappy and I just do not know if the Nook will be as responsive as the Elocity is but at least I know someone has already put 3.0 on that device.
My thinking is that there are so many talented and genius type developers who love to tinker and Dexter is one of those who I am so impressed and grateful to that at some point they will figure a way to get 3.0 on here some how!!
However, as you stated so well in your post as it is right now this device really is very nice. It does a heck of a lot and does it pretty well.
I have been thinking despite its shortcomings and unless you spend a lot of cash most of these devices have some shortcomings that I will say almost it is a keeper!! She is so close!!
I am hopeful that when I get Dexters Mod I will be equally happy and it may just lean the tipping machine in favor of the Elocity.
Rob
If you want Honeycomb for $300 or less, I don't really see any other options than the Nook Color.

[Q] usb reverse tether to feature phone

I have a basic samsung feature phone. Id like to use this as a modem for my Acer if possible. This phone works fine on all my ubuntu systems - just plug it in for the first time, click next-next in the wizard and I'm online. On the tablet, I see that it shows up as a /dev/ttyACM0. I belive this means that its a matter of getting the correct chat commands and associating pppd with the android layer. I imagine the process must be similar as to getting a USB 3G dongle working. Does anyone have any thoughts on how to do this?
There are already some threads about tethering the tablet to your phone, as well as 3G dongles.
http://forum.xda-developers.com/showthread.php?t=1152869
But yeah, no solution yet.
got it working
I thought I'd post the info on how I got this working for my specific situation. I have not read many other threads about this so maybe this type of info is already out there.
My phone is a basic samsung feature phone on AT&T that I called up and got unlimited data for $10/mo extra. This phone is practically unusable for browsing on itself. I plugged it into my ubuntu laptop and basically the tethering worked right away. I thought then that it should be able to work on the tablet. I wanted to make sure that "unlimited data" also applied to tethering to a computer. They said yes, if you can get tethering working - still no limit. I get 1-2Mbit rate over it.
This is on a rooted tablet, of course.
When I plug it into my tablet I get a single /dev/ttyACM0. If your phone is similar, you maybe able to use this info.
I went to At+t website and found this:
Then I read the man pages for pppd "man pppd". From this information, I understood how to modify the sample scripts "gprs", "gprs-connect-chat" and "gprs-disconnect-chat".
I then came up with a suitable "ip-up" script, based on ones found in the Huawei 3G modem example code. This is called when a ppp0 connection is made. Some of the lines in there I am not sure of, but it works, regardless.
I was surprised to find the standard "chat" program was not present in any of the roms I'd tried. Currently I am using virtuous Xoom. Somewhere, I found "chat-ril" which did the trick.
I've attached "modem.zip" which contains all the mentioned files.
From a root shell, you type:
pppd call gprs &
(This is kind of a pain but I'd like to find a way to automatically do that when the phone is plugged in)
If you do ifconfig ppp0, you should have an address, then try to browse.
Now I'm watching Netflix on my A500 as I drive! Also google navigation is absolutely great on a tablet, once you have the data connection.
willyampz said:
I've attached "modem.zip" which contains all the mentioned files.
From a root shell, you type:
pppd call gprs &
(This is kind of a pain but I'd like to find a way to automatically do that when the phone is plugged in)
If you do ifconfig ppp0, you should have an address, then try to browse.
Now I'm watching Netflix on my A500 as I drive!
Click to expand...
Click to collapse
Thanks for the work, but what are we to do with the modem.zip file you provided?
Modem zip contains the scripts and the chat-ril utility that need to be copied to your tablet. There's two ways to copy the files to your tablet:
1)
first unzip the files on your PC
use adb and push the files over to your tablet in the corresponding locations under /system.
2)
unzip the files to a micro SD or USB stick
remount the /system partition as read/write
copy them to the corresponding locations in the tablet filesystem from the SD or USB stick.
Copying files to your /system partition is described elsewhere in the forum but I can give more detail if needed.
I'm admittedly a noob on many levels. I think I followed your instructions but I get:
# pppd call gprs &
# /system/bin/chat-ril: permission denied
Any suggestions?
make sure you do it as root by typing 'su' first. Also check the permissions of chat-ril binary to be executable.
Thanks, it was the chat-ril with incorrect permissions.
So going with what you provided and much help from Google, I was able to make my own set of scripts for my phone and carrier (a Nokia 5230 and T-mobile). It looks like it's connecting both in my shell on the tablet (all "got it"s and OKs) and on the phone side which shows it with the 3G connection in use. Executing that ifconfig ppp0 gives me an ip address with a [up point-to-point running multicast].
My problem is I can't seem to access anything on the tablet. I can ping google from within the shell but the default browser, Dolphin, and the rest of my internet accessing apps don't work. I did change a line in the ip-up file from /system/bin/setprop "net.interfaces.defaultroute" "gprs" to "3g", which is what I named my connection script. Is there something else I'm missing?
Thank you for all the help.
Well, the good news is you can ping which probably means it can work and you are just about there.
The stuff in ip-up I don't completely understand myself, but that's probably where the issue is. By that point I was so close and anxious, that I just manually did some 'setprop's and experiment until it worked. I had exactly the same issue where I could ping but not browse at one point. Also, make sure the dns setprop's are set. Are you sure the "3g" should not be "gprs". I'm not sure that has to do with the script name. But maybe just the fact that you can ping means that's ok. I'm just not sure. Good luck.

Security breach found on htc devices

The Vulnerability
In recent updates to some of its devices, HTC introduces a suite of logging tools that collected information. Lots of information. LOTS. Whatever the reason was, whether for better understanding problems on users' devices, easier remote analysis, corporate evilness - it doesn't matter. If you, as a company, plant these information collectors on a device, you better be DAMN sure the information they collect is secured and only available to privileged services or the user, after opting in.
That is not the case. What Trevor found is only the tip of the iceberg - we are all still digging deeper - but currently any app on affected devices that requests a single android.permission.INTERNET (which is normal for any app that connects to the web or shows ads) can get its hands on:
the list of user accounts, including email addresses and sync status for each
last known network and GPS locations and a limited previous history of locations
phone numbers from the phone log
SMS data, including phone numbers and encoded text (not sure yet if it's possible to decode it, but very likely)
system logs (both kernel/dmesg and app/logcat), which includes everything your running apps do and is likely to include email addresses, phone numbers, and other private info
Normally, applications get access to only what is allowed by the permissions they request, so when you install a simple, innocent-looking new game from the Market that only asks for the INTERNET permission (to submit scores online, for example), you don't expect it to read your phone log or list of emails.
But that's not all. After looking at the huge amount of data (the log file was 3.5MB on my EVO 3D) that is vulnerable to apps exploiting this vulnerability all day, I found the following is also exposed (granted, some of which may be already available to any app via the Android APIs):
active notifications in the notification bar, including notification text
build number, bootloader version, radio version, kernel version
network info, including IP addresses
full memory info
CPU info
file system info and free space on each partition
running processes
current snapshot/stacktrace of not only every running process but every running thread
list of installed apps, including permissions used, user ids, versions, and more
system properties/variables
currently active broadcast listeners and history of past broadcasts received
currently active content providers
battery info and status, including charging/wake lock history
and more
Let me put it another way. By using only the INTERNET permission, any app can also gain at least the following:
ACCESS_COARSE_LOCATION Allows an application to access coarse (e.g., Cell-ID, WiFi) location
ACCESS_FINE_LOCATION Allows an application to access fine (e.g., GPS) location
ACCESS_LOCATION_EXTRA_COMMANDS Allows an application to access extra location provider commands
ACCESS_WIFI_STATE Allows applications to access information about Wi-Fi networks
BATTERY_STATS Allows an application to collect battery statistics
DUMP Allows an application to retrieve state dump information from system services.
GET_ACCOUNTS Allows access to the list of accounts in the Accounts Service
GET_PACKAGE_SIZE Allows an application to find out the space used by any package.
GET_TASKS Allows an application to get information about the currently or recently running tasks: a thumbnail representation of the tasks, what activities are running in it, etc.
READ_LOGS Allows an application to read the low-level system log files.
READ_SYNC_SETTINGS Allows applications to read the sync settings
READ_SYNC_STATS Allows applications to read the sync stats
Theoretically, it may be possible to clone a device using only a small subset of the information leaked here.
I'd like to reiterate that the only reason the data is leaking left and right is because HTC set their snooping environment up this way. It's like leaving your keys under the mat and expecting nobody who finds them to unlock the door. For a more technical explanation, see the section below.
Additionally, and the implications of this could end up being insignificant, yet still very suspicious, HTC also decided to add an app called androidvncserver.apk to their Android OS installations. If you're not familiar with the definition of VNC, it is basically a remote access server. On the EVO 3D, it was present from the start and updated in the latest OTA. The app doesn't get started by default, but who knows what and who can trigger it and potentially get access to your phone remotely? I'm sure we'll know soon enough - HTC, care to tell us what it's doing here?
Technical Details
In addition to Carrier IQ (CIQ) that was planted by HTC/Sprint and prompted all kinds of questions a while ago, HTC also included another app called HtcLoggers.apk. This app is capable of collecting all kinds of data, as I mentioned above, and then... provide it to anyone who asks for it by opening a local port. Yup, not just HTC, but anyone who connects to it, which happens to be any app with the INTERNET permission. Ironically, because a given app has the INTERNET permission, it can also send all the data off to a remote server, killing 2 birds with one stone permission.
In fact, HtcLogger has a whole interface which accepts a variety of commands (such as the handy :help: that shows all available commands). Oh yeah - and no login/password are required to access said interface.
Furthermore, it's worth noting that HtcLogger tries to use root to dump even more data, such as WiMax state, and may attempt to run something called htcserviced - at least this code is present in the source:
/system/xbin/su 0 /data/data/com.htc.loggers/bin/htcserviced
HtcLoggers is only one of the services that is collecting data, and we haven't even gotten to the bottom of what else it can do, let alone what the other services are capable of doing. But hey - I think you'll agree that this is already more than enough.
Patching The Vulnerability
... is not possible without either root or an update from HTC. If you do root, we recommend immediate removal of Htcloggers (you can find it at /system/app/HtcLoggers.apk).
Stay safe and don't download suspicious apps. Of course, even quality-looking apps can silently capture and send off this data, but the chance of that is lower.
Affected Phones
Note: Only stock Sense firmware is affected - if you're running an AOSP-based ROM like CyanogenMod, you are safe.
EVO 4G
EVO 3D
Thunderbolt
EVO Shift 4G? (thanks, pm)
MyTouch 4G Slide? (thanks, Michael)
the upcoming Vigor? (thanks, bjn714)
some Sensations? (thanks, Nick)
View 4G? (thanks, Pat)
the upcoming Kingdom? (thanks, Pat)
most likely others - we haven't verified them yet, but you can help us by downloading the proof of concept above and running the APK
HTC's Response
After finding the vulnerability, Trevor contacted HTC on September 24th and received no real response for five business days, after which he released this information to the public (as per RF full disclosure Policy). In my experience, lighting fire under someone's ass in public makes things move a whole lot faster, which is why responsible disclosure is a norm in the security industry. (This is where we come in.)
As far as we know, HTC is now looking into the issue, but no statement has been issued yet.
HTC, you got yourself into this mess, and it's now up to you to climb out of the hole as fast as possible, in your own interest.
The ball is in your court.
Credit
ANDROID POLICE
Huge thank you to Trevor Eckhart who found the vulnerability and Justin Case for working with us today digging deeper.
Hi there, I need help, someone is consistently hacking into my phone, htc evo 4g, they are penetration testers and pc savvy, currently I cant login to the phn for trying to do a factory reset. They kept intercepting me and now my password does not work. Who knows maybe they changed it on their side. I wrote down everything I saw. I was seeing all these process running for the same app. in my applications. My phone was getting hot, freezes but its people that live in my apt complex and at work. can you help?
zzm5 said:
Hi there, I need help, someone is consistently hacking into my phone, htc evo 4g, they are penetration testers and pc savvy, currently I cant login to the phn for trying to do a factory reset. They kept intercepting me and now my password does not work. Who knows maybe they changed it on their side. I wrote down everything I saw. I was seeing all these process running for the same app. in my applications. My phone was getting hot, freezes but its people that live in my apt complex and at work. can you help?
Click to expand...
Click to collapse
Is your device rooted?
I used root explorer and removed the HtcLoggers.apk and other than the forced close loop that removing it caused (requiring me to remove the battery), after rebooting all seems to be working fine.
EDIT: Actually I didn't just delete HtcLoggers.apk but moved it to a safe location on the SD Card in case there was a problem and it needed to be restored. I highly suggest you do this instead of just deleting it, or better yet, a nandroid backup.
there are a few good ROMS out there that have the ICQ loggers removed already.
Do we really need three threads on the front page about the same thing?

[XAP][Source] Webserver v0.6.0 (File uploads)

Version Alpha 0.6.0 is now available
I'm back! Not dead yet, I promise. This is actually a relatively small update in terms of user-facing features, with only one really big new thing - support for file uploading - but that's a lot bigger than it might sound. It's the first write support I've implemented in the server, and it also required some fairly massive updates to the HttpServer component (support for binary requests, for POST parameters, for MIME multipart parsing). These will be built upon in forthcoming versions to add support for things like registry editing, in-browser file viewing (possibly editing), and so on. There are also a large number of small fixes and improvements that I've made over the last two-weeks-shy-of-a-year, which should make the server faster, more robust, better able to support concurrent connections, and lighter on device resources. Finally, while the app still targets WP8.0 and should run on 8.0, it now is designed for 8.1 compatibility (especially the AllCapabilities version).
Previous update (0.5.6): This version is mostly bug fixes and UI changes. The biggest changes are: clearer display of weird registry data types, the server now consumes fewer threads (it used to spawn them with wild abandon) and does faster string compares, the app version is now shown on the phone, error pages are now better, if you launch the app without a WiFi IP address it'll offer to take you to the WiFi settings page, connections are no longer closed as soon as the app starts sending a response, and the server now defaults to using the Connection: keep-alive header, with a two-minute timeout. The last change, combined with the second-to-last, should hopefully both do away with the tendency to have the app fail to display a page. However, I shouldn't have *needed* to switch it to "keep-alive" - using "close" should have worked - but it still veeeery occasionally would kill the connection early. Agh. Anyhow, this is better in the meantime.
DevDB offers me a support / Q&A thread. Please use that thread to ask questions; don't PM me unless it needs to be kept private for some reason!
ISSUES ON WP8.1:
It *should* work to deploy the app with "Application Deployment", but if you have a problem try deploying with "Windows Phone Application Deployment 8.1" instead.
Problems have been reported in the past when the app is installed to the SD card. It's small, though; putting it on internal storage shouldn't be a problem.
RESOLVED The AllCapabilities version included a few capabilities that were present in 8.0 but removed in 8.1. Those capabilities have been removed; the AllCapabilities version now deploys and runs on capability-unlocked WP8.1 phones.
IN CASE OF OTHER ISSUES: Please provide a *detailed* error report - what phone and OS version you have, what hacks you've installed, what Webserver version you're running, what you do to get the error to occur, and exactly *what* occurs - and I'll fix it as soon as I can! There's a DevDB section for posting bug reports, and you can also use CodePlex if you want.
I finally implemented file upload! I'll work on getting more stuff like that (file delete, possibly file rename/move/copy, various registry edits), hopefully soon! I also hope to add support for different areas, like an "Applications" path, a "Processes" path, a "Services" path... eventually. Many of those are really hard without good privileges. I'm also looking at moving the server to a background process and making the app just a control UI for it, adding support for authentication and/or HTTPS, adding some stylesheets to the web UI, adding caching, and much more. I did finally implement Connection header support.
Once again, the XAP is published twice. One is a fairly standard XAP that any phone can sideload, and the second has many exotic capabilities to enable viewing of (and writing to) slightly more of the file system and registry. The standard XAP has had its list of capabilities expanded to pretty much all of them that can be used without interop-unlock. The high-capability variant requires not just interop-unlock, but the additional capability-unlock hack available in the interop-unlock thread. The AllCapabilities version now works with WP8.1; sorry for the long delay on that!
An item of note: the AllCapabilities version (or either version, on WP8.1) can open other drives in the file system. On phones with an SD card, it is mounted at D: and you can browse it as normal. Credit to @hjc4869 for this discovery!
DESCRIPTION: This is a simple webserver app which can enumerate those files that are in folders readable from the sandbox, can download and upload (access permitting) files, can browse the registry, and can display the contents of registry values of any type. It runs on WP8.x (not yet tested on W10M). It is a spiritual successor to the Functional Webserver / WebServer (Mango) projects from WP7. This version is still missing a lot of functionality as I decided to implement it from scratch, but it is advancing swiftly. Note that there's no access controls implemented; use it on a public network only at your own risk!
Instructions are simple: sideload the XAP, connect to WiFi (required), run the app (called "WebServer Native Access"), point a web browser (on a PC or phone that is also on that local network) to the URL that the app displays. You should get a basic index page. Click on a Filesystem or Registry link to begin browsing the phone. There's a textbox near the top of all filesystem pages, type in a path there (for example, "C:windows" with no quotes) and hit Enter or click Get Files. You'll see a list of the contents of that folder. Click on a file to download it or a directory to open it. There's also a box for uploading files, one at a time, to the current directory. Navigating the registry is similar, except you'll need to specify the registry hive and then the path from that hive (or no path, to access the root of the hive).
As of v0.6.0, uploading files is finally supported! Other modifications (editing files, creating, deleting, or changing registry keys or values) are currently not supported. They will be "soon" although my personal testing suggests that basically the whole registry, and most of the file system, is off-limits for writing unless you use restricted capabilities.
You might see an error code (error 5 is "ACCESS_DENIED", you'll see it a lot; I should replace it with an appropriate 403 or whatever). Or you might see a status 500 message because of an exception in the server. Or the server may just crash (hopefully not so often anymore...). I'm making it more resilient, but there are still bugs. Please report any previously-unreported issues you find, including how to reproduce them, and I'll fix them if possible.
Also feel free to request features or changes; I'll implement them if reasonably possible. The app is a mixture of C++ and C# code; I could probably have done it all in one or the other but wanted to have a C++ component in case I ran into something that wasn't available in C#, and although it probably would have saved some time, I decided that hacking up a web server in C++ was maybe not the best idea.
The source code is on Codeplex, at the following projects: https://wp8webserver.codeplex.com/ for the server and the app (C#) and https://wp8nativeaccess.codeplex.com/ for the native access wrappers (C++). You may have to fix up the reference paths to get the C# component to see the C++ component correctly. The code is reasonably well documented, but let me know if you have any questions. Permission to re-use the code or components is granted under the MS-PL (Microsoft Permissive License) as posted on Codeplex.
Go forth and find cool stuff!
Version history (see the git commit logs for more detail:
07 July 2013 - 0.2.0: Initial release, FS only, 920 downloads (source: 652 downloads)
14 July 2013 - 0.3.2: initial registry, HTTP server and web app encapsulation, source on Codeplex, 225 downloads
0.3.3: bugfixes, 454 downloads
0.4.2: basic registry values display, 86 downloads
0.4.3: bugfixes, 326 downloads
0.4.6: multistring registry values, bugfixes, updated libraries, first AllCapabilities version (950 downloads), 453 downloads
25 Oct 2013 - 0.4.8: binary and long registry values, formatting and bugfixes, 451 downloads AllCaps, 201 normal
22 Dec 2013 - 0.4.9: all registry value types, better threading, proper resume, remembers port, 97 downloads AllCaps, 53 normal
24 Dec 2013 - 0.5.0: background operation using Location APIs. Downloads: 1011 AllCaps, 963 Normal
20 Jul 2014 - 0.5.1: More capabilities, better navigation. Downloads: 358 AllCaps, 352 normal
07 Aug 2014 - 0.5.3: .REG export, better traversal, bugfixes. Downloads as of 0.5.5 release: 260 AllCaps, 164 normal
10 Oct 2014 - 0.5.5: Bugfixes and back-end work. Downloads as of 0.6.0 release: 140 AllCaps, 113 normal
25 Oct 2014 - 0.5.6: Bugfixes and UI tweaks. Downloads as of 0.6.0 release: 1720 AllCaps, 1334 normal
12 Oct 2015 - 0.6.0: Binary requests, file uploads, bugfixes.
XDA:DevDB Information
WebServer Native Access, Tool/Utility for the Windows Phone 8 General
Contributors
GoodDayToDie
Source Code: https://wp8webserver.codeplex.com/
Version Information
Status: Alpha
Created 2014-10-17
Last Updated 2015-10-12
I'm going to use this space to mention something that's pretty cool:
J. Arturo of http://www.komodosoft.net is using a modified version of the HTTP server that powers this app in the ShareFolder app (http://www.windowsphone.com/s?appid=e2b9c82e-eaa1-4a3b-9d4a-8a2933a8bdb4) to support opening video files directly from Windows network shares! This was done to work around a limitation of the WP8 media control: it can only source from an isolated storage file or a HTTP URL. By running a server in the background and streaming the video file through it, and pointing the video player control at the localhost URL, it becomes possible to play the file on the phone without first copying it to the app's isolated storage. A very cool way to solve the problem! Also, reviewing the changes that were made to the network code of the server pointed me toward those threading fixes I made that have hopefully much improved version 0.4.9.
Please note that the updated version of ShareFolder with this feature may not yet be available, although it should be soon. It is a commercial (paid) app, but the author sought and received permission to use my code (although the license does not require such permission be received).
What exactly is the problem with sockets? I am battling myself with sockets atm too, maybe we can share knowledge?
Strictly speaking, the problem was with the phone's limited subset of the Sockets API forcing me to access it through functions I wouldn't normally use (asynchronous everything, SocketAsyncEventArgs and lambdas and AutoResetEvents and so on everywhere...) but I've got a pretty good handle on it now, at least for the System.Net.Sockets.Socket and its friends. The new .NET 4.x ones (using the async keyword and all) are in a different namespace; I didn't mess with them. They are more abstracted from the Bekeley sockets interface that I'm used to from C, but they are also (supposedly) more user-friendly, especially if you don't feel like writing all your own thread management code (and in fairness, I should re-write the webserver's threading to use threadpools; they're better for this type of work).
If you want to ask questions about the topic, I suggest starting a new thread (possibly in the Q&A subforum, although it's also dev related...) and I'll answer if I can.
GoodDayToDie, just an idea: how about sharing your source code via CodePlex or GitHub?
Oh man, this is pretty nice! GoodDayToDie does it again!
So far, I can read \Windows, the current install folder which you access just by typing "." with no quotes and the current application folder by typing ".." I can access the .dlls, .winmd and AppManifest.xml from the current install, but from everywhere else, it goes boom. This is a great step towards something awesome though!
EDIT:
I was wrong. For some reason, when you click on a folder it's trying to "download" it, rather than chdir. I can get pretty far into the Windows directory.
THAT's what you meant by "Click on a file (note: there's no current way to tell the difference between files and folders) to download it.
You might see an error code (error 5 is "ACCESS_DENIED", you'll see it a lot). Or you might see a status 500 message because of an exception in the server. It's getting a lot more resilient but there are surely still some bugs. ".
If you see a folder, just type the full path to it instead of clicking on it and you will be able to read the contents.
ANOTHER EDIT:
I just found a file inside of the \Windows\System32 directory named [guid].devicemetadata-ms (It's easier to just search for "devicemetadata-ms"). It's a cab file with some metadata about WP8 with a sign.cat and packagesign.cat file in the archive. I don't know what these files could potentially be useful for.
New version in a day or two (busy tonight). Features I plan to implement (not necessarily in the next version or at any particular time):
File upload (IsoStore and, of all crazy things, install directory are writable. I think I'll put a flag on each FS page that says whether the current dir is writable...).
File deletion (where possible, of course).
File and Directory distinction in the listing (clicking a dir should open it, not error out).
Filesystem index page with links to folders that can be accessed successfully (since the root isn't readable).
Some more file info (size, probably attributes, possibly permissions).
Possibly an option to preview a file (as plain text) without downloading it.
Some kind of background mode (the server uses minimal resources when not actively servicing a request, so I'll see if I can get it to work in the background, perhaps by abusing the music transfer agent...)
Some kind of offline mode (at least basic file browsing within the app, as an alternative to using the web interface, though I might just make a second app for that).
Source code changes: separate the server code from the webapp / phone app code (move it into its own project).
Source code changes: move to a hosted version control service, probably CodePlex (good suggestion sensboston).
Maybe add an icon and such...
Any other suggestions?
I also want to try experimenting with various non-standard capabilities and see if I can get access to more of the system . I've already added the ability to access removable storage, but I've also found a bunch of really weird and frequently undocumented capabilities in the OS's policy configuration files, and I need to look into those... The interesting (and possibly the uninteresting) ones are probably blocked for unsigned sideloaded apps, but it's worth checking on anyhow.
Yeah sorry, I should have been more explicit about clicking on dirs. not working in 0.2.0. Also, it's "unofficial" but if you check the URL bar you'll see a URL parameter called something like "pattern" (by default, it's *) and if you change that, you can filter the results. For example, "foo*.exe" (note: no quotes!) will search for EXE files whose names start with "foo". Among other uses, this makes it a lot faster to load large dirs like System32. This will be added to the UI at some point. Also note that URL decoding is applied correctly to querystring parameters (Probably already noticed with the path sometimes written using %5C for \) so you can add special characters that way if needed, though currently any of them but \ will probably just cause an exception.
...
Actually, does this filesystem support Alternate Data Streams? If so, you should be able to download them by appending a : and the ADS name to the filename in the download URL...
OK, so that was a new version in five days. Sorry, stuff takes time.
The source code is now on Codeplex. The native access portion is at https://wp8nativeaccess.codeplex.com/, and the web server portion is at https://wp8webserver.codeplex.com/. Both are licensed MS-PL and use Git for version control. The full XAP is also available for download from the Webserver project on Codeplex.
GoodDayToDie said:
OK, so that was a new version in five days. Sorry, stuff takes time.
The source code is now on Codeplex. The native access portion is at https://wp8nativeaccess.codeplex.com/, and the web server portion is at https://wp8webserver.codeplex.com/. Both are licensed MS-PL and use Git for version control. The full XAP is also available for download from the Webserver project on Codeplex.
Click to expand...
Click to collapse
You are a god. I'll be sure to post my findings .
Hmm. When I first load up WebServer File Access then access from my laptop, I get the main page then the program crashes on my phone. It seems to hold a lock on to the socket as i can no longer access port 9999 from any other device when re-opening the app. I can access it again when I reboot, but the same thing happens.
EDIT: I think it may be due to the WiFi at work... it's junky. I'll try again when I get home. I was just able to browse some directories.
Wow, that's completely unexpected... I can beef up the error chacking and handling around the listener port though. That part of the code is really straightforward, so I actually haven't hardened it very much. I can also put in a Finally block to close the socket and/or mark the socket as re-usable so that other apps (or the same one again) can listen on it in the future.
I also plan to add support for setting your own port, but that doesn't solve the underlying problem. I'll put in more error reporting as well, to enable better debugging. Thanks for the report! Always good to have users report problems so I know where to prioritize fixes.
GoodDayToDie said:
Wow, that's completely unexpected... I can beef up the error chacking and handling around the listener port though. That part of the code is really straightforward, so I actually haven't hardened it very much. I can also put in a Finally block to close the socket and/or mark the socket as re-usable so that other apps (or the same one again) can listen on it in the future.
I also plan to add support for setting your own port, but that doesn't solve the underlying problem. I'll put in more error reporting as well, to enable better debugging. Thanks for the report! Always good to have users report problems so I know where to prioritize fixes.
Click to expand...
Click to collapse
I tried the app at home and it DOES crash on the first hit of the home page, but I'm able to open it up again and it works fine.
The new version 0.3.3 should be more rebust; try it and let me know if you still have issues. If you do, let me know what the exception message is (and any other info you can provide) and I'll try to track it down.
Downloading really big files should also work now. The app will read and push files in smaller chunks (the code to do this existed in the NativeAccess library before, but wasn't used).
a simple SDK?
Dear Sir
Will it be possible for you to make some sort of SDK from this so other developers can integrate this into their apps and enable browsing isolatedstorage?
Sorry if it is a stupid question.
Bruce_X_Lee said:
Dear Sir
Will it be possible for you to make some sort of SDK from this so other developers can integrate this into their apps and enable browsing isolatedstorage?
Sorry if it is a stupid question.
Click to expand...
Click to collapse
With the restrictions in permissions, this app only allows browsing of the app's isolatedstorage locally. You are able to use the IsolatedStorage API within your app to browse files and directories already.
snickler said:
With the restrictions in permissions, this app only allows browsing of the app's isolatedstorage locally. You are able to use the IsolatedStorage API within your app to browse files and directories already.
Click to expand...
Click to collapse
That's right. What I want is to allow the end user to be able to browse the isolatedstorage. Imagine I have a video download app, I want the user to be able to transfer those downloaded videos from the app's isolated storage to, say, a PC.
One can do this by integrating the webserver code into the said app.
Bruce_X_Lee said:
That's right. What I want is to allow the end user to be able to browse the isolatedstorage. Imagine I have a video download app, I want the user to be able to transfer those downloaded videos from the app's isolated storage to, say, a PC.
One can do this by integrating the webserver code into the said app.
Click to expand...
Click to collapse
Ahh I see what you mean now. That sounds like a pretty nice idea. I think more research needs to be done to see whether it would even be allowed in the marketplace.
The webserver portion is stand-alone (builds to its own .NET DLL with no dependencies on the other parts) and has a pretty clean interface. You'd need to implement the web application portion of it yourself - the thing that generates the response pages for a given request - but the HttpResponse class in the server does a lot of the work of that for you; you basically just specify the content you want to send (as a String or byte array) and it sends it.

Categories

Resources