[DEV][WIP] PyAdb Python 2.7 Package [Windows/Unix] - Android Software Development

KEarlier I saw a thread that demonstrated a python wrapper for the adb command. I remembered a while ago that adb uses a TCP protocol (duh it's written in the docs)
I had some spare time today so I decided to write a script for you all (I know how redundant it is, but hey why not)
This script incorporates the core functionality of adb into it, such as detecting your device... that's pretty much it at this stage..
so here it is. PyAdb​
I doubt this will brick anyone's devices... but just in case..
disclaimer:
if this bricks your device, it was not my fault. you used this at your own risk.
I don't care if this crashes your computers, or shoots you in the foot. you used it, not me
Click to expand...
Click to collapse
The general concept with how this works is below:
firstly, you have to choose your command from this list
secondly: the length of that command (in hexadecimal) needs to be prefixed before the command is sent. This is probably to do with security so the adb server on the device only reads the right amount of data
thirdly:... well there's not much more to it. just enjoy, tinker with it, and remember to contribute!!
note about getting device detected:
You need to ensure that the Android Debugging Bridge driver is installed for your device. this is normally supplied with standard device drivers. please refer to your device forums for instructions on how to install these
You also need to make sure your pc is authorised with stock adb, otherwise you won't be able to connect with PyAdb (for 4.2 upwards)
note about the current shell integration:
I now have a threaded interactive console, however single commands are still not read from a thread. If you want to use grep or kmsg, launch a full session

page not found!

Fixed link: https://github.com/cybojenix/PyAdb/
Looks like OP removed the file he linked to and forgot to change the link.

404 page not found?
cybojenix said:
Earlier I saw a thread that demonstrated a python wrapper for the adb command. I remembered a while ago that adb uses a TCP protocol (duh it's written in the docs)
I had some spare time today so I decided to write a script for you all (I know how redundant it is, but hey why not)
This script incorporates the core functionality of adb into it, such as detecting your device... that's pretty much it at this stage..
so here it is. PyAdb​
I doubt this will brick anyone's devices... but just in case..
disclaimer:
The general concept with how this works is below:
firstly, you have to choose your command from this list
secondly: the length of that command (in hexadecimal) needs to be prefixed before the command is sent. This is probably to do with security so the adb server on the device only reads the right amount of data
thirdly:... well there's not much more to it. just enjoy, tinker with it, and remember to contribute!!
note about getting device detected:
You need to ensure that the Android Debugging Bridge driver is installed for your device. this is normally supplied with standard device drivers. please refer to your device forums for instructions on how to install these
note about the current shell integration:
I haven't added a threaded data capture method yet, purely because I don't have time at the moment. it will (should) work with single commands. it isn't reliable for commands that take a while to run (such as grep)
Click to expand...
Click to collapse
404 page not found?

omegavesko said:
Fixed link: https://github.com/cybojenix/PyAdb/
Looks like OP removed the file he linked to and forgot to change the link.
Click to expand...
Click to collapse
lol yeah thanks. I did some file changes and forgot I linked to the file in the thread rather than the repo

Related

i really dont understand

I am still having same issue with adb and linux not recognizing my epic I have posted in regards to this and had no responses there all so many devs that work with epic and yet not one has commented to offer a fix i have tried adding 99-samsung.rules with proper edits and changed the 51 rules to match i have reloaded those rules I have added the edited adb i have restarded linux i have changed cables phones usb ports and it picks up my friend og droid no prob but neither me nor my fiances epic will be recognized. any help please.
mikeew83 said:
I am still having same issue with adb and linux not recognizing my epic I have posted in regards to this and had no responses there all so many devs that work with epic and yet not one has commented to offer a fix i have tried adding 99-samsung.rules with proper edits and changed the 51 rules to match i have reloaded those rules I have added the edited adb i have restarded linux i have changed cables phones usb ports and it picks up my friend og droid no prob but neither me nor my fiances epic will be recognized. any help please.
Click to expand...
Click to collapse
This is the way its done. Sorry up front for quoting myself but I have responded to this issue in the past:
Download the file from this post
http://forum.xda-developers.com/showpost.php?p=8752645&postcount=5
Follow the steps with this post
http://forum.xda-developers.com/showpost.php?p=14199959&postcount=11
Profit!
Holy run on sentence Batman.
Sounds like a drivers issue, or that you don't have USB debugging enabled on the phone.
Open the Dalvik Debugging Monitor Service (DDMS) that came with the Android SDK.
Does it recognize the phone at all in DDMS?
If yes, then does it say "online"? If yes, then you have something blocking adb from talking to your phone from your computer. (firewall?)
If no, then you have a driver or USB connectivity issue. (bad driver installation, usb debugging not enabled on phone, bad usb cable, plugged usb cable into a port not directly on the motherboard)
EDIT: Looks like the post above me could understand the run on sentence more than I could.
You can also run the command lsusb and it should tell you if your system is seeing the device.
What Linux distro your running?
Sent from an Epic with 4G
ok to recap
I have followed your prior threads does not work. I have usb debugging on as explaiend i have tried everything means I have searched for hours on end and come with nothing. I have replaced the ADB and created 99-android.rules and edited that as well as editing the 15-android.rules files I have run lsusb and it does show samsung device.
tried your directions again
I have tried them again and they do not work.
Try the usb cable for the droid x. Its a really good one.
if that were an option
I have an incredible cord i can try that is about the only one but i dont see how it has anything to do with the usb cable when lsusb recognizes the device plugged in just adb will not list it on devices so that i dont think is the answer but thank you for the suggestion.
mikeew83 said:
I have followed your prior threads does not work. I have usb debugging on as explaiend i have tried everything means I have searched for hours on end and come with nothing. I have replaced the ADB and created 99-android.rules and edited that as well as editing the 15-android.rules files I have run lsusb and it does show samsung device.
Click to expand...
Click to collapse
You should only have 1 rules file, my suggestion, delete the 15 one and keep the 99.
Make sure the permissions are configured correctly, the biggest issue to run this type of operations in linux is the permissions and the ownership on the config files
Sent from an Epic with 4G
thanks
could you possibly explain this a bit more in detail as im still very new to this im a quick learner and great at researching.
mikeew83 said:
could you possibly explain this a bit more in detail as im still very new to this im a quick learner and great at researching.
Click to expand...
Click to collapse
Let me go over what to do:
After downloading the rules file on the above post, for example I have the SDK (adb) installed on my PC on the following path: ~/android/tools/, so go to your SDK folder (where adb is located) and run the chmod a+rwx adb command.
After this, take the rules file you downloaded from the above post and moved it to the /etc/udev/rules.d/ folder (logged as root, NOT SUDO). After doing this, run the following commands:
make sure that 51-android.rules file has the following permissions -rw-r--r (read and write for owner, group + others read only)
su [then placed the password] (Once again DO NOT USE SUDO)
chown root:root 51-android.rules
Once done, restart the PC and it should be working 100%. Before connecting the phone, make sure USB Debugging is active, and restart your phone.
Connect your phone via USB and run the lsusb command to confirm the connection of the device and then run ./adb devices and check for the positive return!
Note: if you have never had a password on su, run the following command: sudo passwd and change the password and try running the series of command above.
Note2: add your user to the plugdev group on your computer
Note3: sometimes while performing the ./adb devices command will return a response stating that a device by the name ?????????????? is connected, this is OK, you can connect via ./adb shell and you will see your device file structure, if you request SU permissions you will have to authorize it on the phone via the SUPERUSER app that gets installed when rooting the device.
IMPORTANT: The password for ROOT (su) user is not the same as the password you enter for the SUDO command (your user) unless you make them the same!
I'm not sure what exact problem you are having, but I was having a similar problem until this morning (of ADB not recognizing the phone) until I did this:
A) Open the phone dialer.
B) Enter "##8778#".
C) Set both options to "PDA".
D) Make sure sure "USB Debugging" is enabled under "Settings", "Applications", "Development".
I have no idea if this fully applies to your issue, but if it helps, great. If not, no harm done.
SweetBearCub said:
I'm not sure what exact problem you are having, but I was having a similar problem until this morning (of ADB not recognizing the phone) until I did this:
A) Open the phone dialer.
B) Enter "##8778#".
C) Set both options to "PDA".
D) Make sure sure "USB Debugging" is enabled under "Settings", "Applications", "Development".
I have no idea if this fully applies to your issue, but if it helps, great. If not, no harm done.
Click to expand...
Click to collapse
Though this is good info (thanks for pointing it out), I would highly suggest to leave UART as Modem, and just change USB to PDA.
Sometimes you may have issues with Tethering if you set the UART to PDA.
I have been a bit busy I appreciate the run down and will try it here tomorrow or its 2am so later today I also checked the 8778 and my usb is already set to what was specified.
Sent from my SPH-D700 using Tapatalk

[GUIDE] Setting up fastboot for linux

I've just updated the Dell Streak 5 wiki with a guide to setup fastboot for linux in the Flashing guide section.
Oh, the sdk finally readded the fastboot binaries for *nix and osx are finally readded.
Main reason the nix and osx guides were stubs were that previously the fastboot binaries for all 3 os groups were missing from like platform-tool r6-r9 and they're included again in r10
I'm gonna update fastboot+adb.zip to include these files and take a look at the win drivers and do a big update.
I'm also going to rewrite your portion once I get fastboot+adb.zip reorganized and bring it to parity with the win version. Thanks!
Finally, the *nix portion will be added to the s7 and venue guides too to maintain parity and the s10 one when I get around to making the rest of it
Yeah, i saw your edit, i've since shortened the guide, because the relevant additional info is available on the android website and i've linked it, however, having only adb and fastboot in a zip is even better.
I'll see if the Mac version works on PC-BSD 9, and if it does, i'll add that as well (you never know)
No command udev in my fedora. At least in the my user PATH! In my root's PATH, I have only udevd and udevadm! I use Fedora, are these instruction Ubuntu specific?
Ultimately only the basics will be covered, I'm not willing to add (or even let others add) a dozen different branches to support every different flavor of linux.
When I'm ready to release a new Fastboot+ADB I will trim it down more if needed and leave it at that, currently it's pretty much about what I'd like it to be, it's mostly just a little formatting to make it match the rest of the guide.
The guide techincally also skirts the issue of different windows versions, there might be some minor things depending on which ver of windows and if it's x64/x86 but those details are left to the user to fill in on their own.
Users should be able to fill in some stuff like this on their own, just like the implied availablity of a unzipper.
If it's something that's specific to fastboot or adb and it's missing, we'll add it of course.
bazzoon said:
No command udev in my fedora. At least in the my user PATH! In my root's PATH, I have only udevd and udevadm! I use Fedora, are these instruction Ubuntu specific?
Click to expand...
Click to collapse
Udev is the udev daemon. I'm not familiar enough with Fedora to know what's the command to restart it, but you could reboot the computer and the new rules should take effect.
Yes, it is Ubuntu specific, since i use it, and the intructions on the official android site are for Ubuntu.
Actually the only thing that isn't mentioned anywhere, except in the Streakdroid install guide, was adding the -i 0x413c option after fastboot (or the respective USB VendorID), an omission that took me along time to find and kept me really frustrated by being unable to change ROMs.
Edit The Manii
I've linked to the SDK-Platform tools zip on the official android site, to save a few steps of installing the full SDK, so for now, you don't need to host a separate zip of adb and fastboot, until Google updates the SDK.
-i 0x413c is optional depending on how your env is set up.
I believe that optional step you made to register that ID makes it optional on *nix too, but as I dont use fastboot under linux I cannot verify.
It is optional under windows though.
I merely havnt finished testing the s7 drivers, the zip was missing the *nix/osx fastboot binary, it always had the adbd binary
For me fastboot didn't work without that option, just stayed on 'waiting for device' despite having read pretty much every guide that's out there for setting up fastboot and adb on linux (and ubuntu specifically), even though adb worked perfectly fine.
As far as not adding a custom rule in udev, I'm pretty sure it's needed since it's posted on the official android site and it's stated that it's required in order for the OS to recognize your phone.
As for the Mac OSX version, just downloading and extracting the SDK Platform-tools package and running fastboot from there should just work, but i don't have a Mac to test it on.

[Partial] Hacking myford touch, were getting closer!!!

Ok Devs-
(ALSO sync owners, don't update your sync systems anymore by ford, we are getting close to unlock it, and they will put out updates to bork our hack).
I need some help please. I need to modify this POS sync. You can't do anything with it. I want to get navigation running or bluestacks to run android.
I got the official ford , usb reboot file I have attached it here. It has the signed files that we need.
I was able to tigger the install event with those files. And I believe this is our key to Jailbreak the system.
The best part is that you can run stacked commands on those install scripts. https://www.coalfire.com/The-Coalfire-Blog/October-2014-(1)/Reverse-Shells-and-Your-Car?feed=blogs
I have been struggling to get it it to execute, presumably, I don't know anything about win CE.
I have the win CE cmd.exe on my usb. Place it into the system, it recognizes and initiates upload. What the code below is trying to do is piggy back on the copy via stacked code to upload cmd.exe to the system then execute it. UNless there is another way to get a shell, once we get the shell, WE OWN THEM.
This is what my path is listed on my autoinstall.1st file -
Open1 = DelayedReboot.cab; cmd.exe \tmp\cmd.exe; \tmp\cmd.exe
the cab is required as it is signed by microsoft and bypasses the lock to load additional code.
Changing the semi colon to & makes it error out, so the semi colon is correct, just dunno if I have the paths right. Normally, it would be something like for linux /fs/usb0/etc...... but I am not sure about CE lists the usb device path...again I am win CE retarded. UNless there is a way to % to the paths, but I dunno much about win.
Sync, recognizes and executes with no errors. If I change my code a little, it will not work and say error.
SO what am I missing to get the cmd to run? Or is it already? I was expecting a shell to pop up?
If someone can point me in the right direction, or to point what file I can call to execute the onboard navigation, that would be awesome as well.
Even if we can't get a shell, I'd like to be able to execute a file, then I can run MIOpocket on this thing and ditch sync for android apps.
I have also attached the sync app developer guide link. With programming commands for apps.
https://developer.ford.com/uploads/DevConf%20-%20Track%205%20-%20Best%20Practices.pdf
Here is a link to the windows 7 automotive guide on how the system operates, kernel info, driver info, and stuff.
http://download.microsoft.com/download/0/A/1/0A1E07D6-7562-4566-AACF-E04DF4FF8879/A%20Technical%20Companion%20to%20Windows%20Embedded%20Automotive%207%20(final).pdf
UPDATE: 04/19/2015 -
While it is not a software hack, IT IS possible to unlock the navigation only portion of the MFT 8", if you have it without nav.
IF YOU DO THIS, YOUR CAR WARRANTY IS VOID. You've been warned.
It will cost a little money, but not set you back $1000 like nav tv and lockpick are charging. Maybe $100 or so.
Here is what you need to do, if you can't wait for us to unlock the bootloader.....
1 - Get a used APIM only part with the numbers DS7T in it. (aluminum only part with the fins, you DO NOT need the screen)
2 - Get the VIN# of the car it came out of and check the VIN to see if it was enabled with factory NAV. There are internet sites that will check the VIN for you. Must be a unit with NAV enabled.
http://researchmaniacs.com/VIN-Number-Lookup/WindowSticker/Ford.html
3. Install the APIM only to the back of your LCD.
4. The system will reboot and reset.
5. The system will them ask you to insert the NAV sd card, do that. (obviously, you have to buy a nav card from ebay as well, but those are $10)
6. Enjoy factory NAV for about $100
This is the only workaround for now. THE APIM is separate from the sync system and only interfaces with it. So, you will retain all your OEM VIN# locked stuff and it will survive reboots and updates. The nac actually just unlocks on that APIM portion, believe it or not. This method doesn't tie into the file system software, it merely accesses it.
Now.... if someone would be so kind as to just rip the NAND chip from one of those units and post it, so that we can just flash over our existing equipment, we can do this for FREE!!!!!!
Still working on the video bypass.... It would be nice if our Russian friends can start chiming in for that one please.....
DON"T FALL FOR THE EBAY GUY CHARGING $600 to $700 for this. Let's put him out of business.... Your help is needed.
PROPS TO rahrena8690 for the find.
WORKING FILE LINKS - FOR DEVELOPERS ONLY
Delayed Reboot project
https://mega.co.nz/#!m0BEWSrA!qrdgIRYTvccH52794ktdpRfrulI_pSdY3g-iiCyhaFs
awesome work
kthejoker20 said:
Ok Devs-
(ALSO sync owners, don't update your sync systems anymore by ford, we are getting close to unlock it, and they will put out updates to bork our hack).
I need some help please. I need to modify this POS sync. You can't do anything with it. I want to get navigation running or bluestacks to run android.
I got the official ford , usb reboot file I have attached it here. It has the signed files that we need.
I was able to tigger the install event with those files. And I believe this is our key to Jailbreak the system.
The best part is that you can run stacked commands on those install scripts. https://www.coalfire.com/The-Coalfire-Blog/October-2014-(1)/Reverse-Shells-and-Your-Car?feed=blogs
I have been struggling to get it it to execute, presumably, I don't know anything about win CE.
I have the win CE cmd.exe on my usb. Place it into the system, it recognizes and initiates upload. What the code below is trying to do is piggy back on the copy via stacked code to upload cmd.exe to the system then execute it. UNless there is another way to get a shell, once we get the shell, WE OWN THEM.
This is what my path is listed on my autoinstall.1st file -
Open1 = DelayedReboot.cab; cmd.exe \tmp\cmd.exe; \tmp\cmd.exe
the cab is required as it is signed by microsoft and bypasses the lock to load additional code.
Changing the semi colon to & makes it error out, so the semi colon is correct, just dunno if I have the paths right. Normally, it would be something like for linux /fs/usb0/etc...... but I am not sure about CE lists the usb device path...again I am win CE retarded. UNless there is a way to % to the paths, but I dunno much about win.
Sync, recognizes and executes with no errors. If I change my code a little, it will not work and say error.
SO what am I missing to get the cmd to run? Or is it already? I was expecting a shell to pop up?
If someone can point me in the right direction, or to point what file I can call to execute the onboard navigation, that would be awesome as well.
Even if we can't get a shell, I'd like to be able to execute a file, then I can run MIOpocket on this thing and ditch sync for android apps.
I have also attached the sync app developer guide link. With programming commands for apps.
https://developer.ford.com/uploads/DevConf%20-%20Track%205%20-%20Best%20Practices.pdf
Here is a link to the windows 7 automotive guide on how the system operates, kernel info, driver info, and stuff.
http://download.microsoft.com/download/0/A/1/0A1E07D6-7562-4566-AACF-E04DF4FF8879/A%20Technical%20Companion%20to%20Windows%20Embedded%20Automotive%207%20(final).pdf
Click to expand...
Click to collapse
I have been wanting to get into this system since the day I got my truck. All ford has succeeded in doing is piss me off with "updates" that didn't amount to much. I would be happy if they would at least allow applink on the touch systems, as that would at least give us some options to add our own work.
I would love to help, but don't have much experience with "rooting", Windows CE, etc. But looking at what you have so far, I will offer some thoughts that came to mind:
It seems to me that you are working at the bootloader level, not the OS level. I may be way off here, but this could be why cmd won't work, as the OS is not loaded, so a traditional shell is not yet possible.
If you are indeed at the OS level, I wonder since you didn't get any errors when trying to launch cmd, if it was indeed actually running. I know on windows systems, if you manage to launch a process as "system", you typically can't interact with it (security issue). I don't know CE at all, but wonder if PsExec would work if it is launching your exe, but as system...
If it is executing your exe as system, perhaps a script or small app that writes some info about the system to a file on the usb drive would help. IE, have it list the folder structure for example.
I know we are not alone on people wanting to work on this. It looks to me that with Sync 3 dumping MSFT, we may be left in the dust with no further updates, although, this guy has found some signs that it might still get some useful updates:
http://www.reddit.com/r/Ford/comments/2rf2cc/ford_may_announce_updates_to_sync_gen2_myford/
Thanks
kthejoker20 said:
Ok Devs-
(ALSO sync owners, don't update your sync systems anymore by ford, we are getting close to unlock it, and they will put out updates to bork our hack).
I need some help please. I need to modify this POS sync. You can't do anything with it. I want to get navigation running or bluestacks to run android.
I got the official ford , usb reboot file I have attached it here. It has the signed files that we need.
I was able to tigger the install event with those files. And I believe this is our key to Jailbreak the system.
The best part is that you can run stacked commands on those install scripts. https://www.coalfire.com/The-Coalfire-Blog/October-2014-(1)/Reverse-Shells-and-Your-Car?feed=blogs
I have been struggling to get it it to execute, presumably, I don't know anything about win CE.
I have the win CE cmd.exe on my usb. Place it into the system, it recognizes and initiates upload. What the code below is trying to do is piggy back on the copy via stacked code to upload cmd.exe to the system then execute it. UNless there is another way to get a shell, once we get the shell, WE OWN THEM.
This is what my path is listed on my autoinstall.1st file -
Open1 = DelayedReboot.cab; cmd.exe \tmp\cmd.exe; \tmp\cmd.exe
the cab is required as it is signed by microsoft and bypasses the lock to load additional code.
Changing the semi colon to & makes it error out, so the semi colon is correct, just dunno if I have the paths right. Normally, it would be something like for linux /fs/usb0/etc...... but I am not sure about CE lists the usb device path...again I am win CE retarded. UNless there is a way to % to the paths, but I dunno much about win.
Sync, recognizes and executes with no errors. If I change my code a little, it will not work and say error.
SO what am I missing to get the cmd to run? Or is it already? I was expecting a shell to pop up?
If someone can point me in the right direction, or to point what file I can call to execute the onboard navigation, that would be awesome as well.
Even if we can't get a shell, I'd like to be able to execute a file, then I can run MIOpocket on this thing and ditch sync for android apps.
I have also attached the sync app developer guide link. With programming commands for apps.
https://developer.ford.com/uploads/DevConf%20-%20Track%205%20-%20Best%20Practices.pdf
Here is a link to the windows 7 automotive guide on how the system operates, kernel info, driver info, and stuff.
http://download.microsoft.com/download/0/A/1/0A1E07D6-7562-4566-AACF-E04DF4FF8879/A%20Technical%20Companion%20to%20Windows%20Embedded%20Automotive%207%20(final).pdf
Click to expand...
Click to collapse
Thanks Pro. any new updates. Actually i just purchase Lincoln MKZ 2014, although i know it is hardware capable to run navigation since i get latitude and longitude, but unfortunately no navigation from the factory. i just play with My Lincoln Touch and on the sittings there is a tab for installing apps. so can we install and windows CE app?
Nothing yet.
Sync updates are rolled out every 6 months.
Rumor was that we are all getting blackberry upgrade from Microsoft.
Update is expected Feb 2015 or so.
We are sitting on the sidelines waiting to see what Ford will do, before we start porting over. There may be no need for our work if we get port link to the new system. I think Ford is on our side, as they don't want us open sourcing the system and have to deal with warranty claims.
kthejoker20 said:
Nothing yet.
Sync updates are rolled out every 6 months.
Rumor was that we are all getting blackberry upgrade from Microsoft.
Update is expected Feb 2015 or so.
We are sitting on the sidelines waiting to see what Ford will do, before we start porting over. There may be no need for our work if we get port link to the new system. I think Ford is on our side, as they don't want us open sourcing the system and have to deal with warranty claims.
Click to expand...
Click to collapse
i don't think so. we will not get the QNX update. I think it is a different system with different architecture and requirements. but i hope they unlock the FMT or LMT so we can install any windows ce app.
Please don't reply to this thread with comments or requests.
I'd like to keep it clean to only development comments.
Based on what I'm reading around the page 26 mark (bootloaders section of the windows embedded 7 pdf), it sounds like we need to attempt to give the IPL boot arguments to get into update or development mode and from there we could have a chance of pushing our own files. I would think update mode looks for a signature but dev mode might let anything in.
Way ahead if you. The attached file has the signature. I was able to successfully run stacked commands by modifying the attached reboot file. Problem, the command doesn't stick on reboot.
kthejoker20 said:
Way ahead if you. The attached file has the signature. I was able to successfully run stacked commands by modifying the attached reboot file. Problem, the command doesn't stick on reboot.
Click to expand...
Click to collapse
So you were able to launch a command prompt via the delayed reboot zip? I wonder if it would be possible to hack a sync update and then use this to push it.
I need a zip please... I can induce an update no command prompt yet
I can only run commands stacked, but I need to run a script on the sync side, but I can't figure out how to push the script to the sync
kthejoker20 said:
I need a zip please... I can induce an update no command prompt yet
I can only run commands stacked, but I need to run a script on the sync side, but I can't figure out how to push the script to the sync
Click to expand...
Click to collapse
This the latest myford touch update Gen2-V3.7.11
http://www.mediafire.com/?79v3d0d8972sy44
Here is the Delayed Reboot zip
http://outofmytouch.com/assets/delayed_reboot.zip
So some very quick looking tonight and I found EA5T-14D546-ATD contains the master patch. Decompiling some of the shockwave files I have found some interesting code. These would most likely be the files to hack to change factory behavior. Getting them flashed to a vehicle might be a whole other issue though.
Edit: After more browsing I think we need to target a master patch for an older version of Sync. I was looking at the master patch for the most current so there are going to be less files patched. I will have a peek at those later.
For some reason, the coalfire site took down it's information regarding the reverse shell of the infotainment system.
Here is what I am talking about with the command on the delayed reboot file. I have conveniently located the stacked command image and attached it for your viewing pleasure.
If we can patch the files, this is how we push them to the chip. Otherwise, I may have to PHYSICALLY pull the system files through JTAG tap... sigh... not really wanting to do that though...
If we can push them, we would have to unlock the bootloader to bypass the sigs... This is where my brain is staring to hurt....
Obviously, these commands do not apply to what we are doing, as that is QNX. Plus, I don't want any noobs spunking their system with our fashizzle yet...until we test it.
Just a final thought, as a plan B, we could reverse shell with the USB exploit as well... just saying.. might be easier
An integer overflow might work as well, but I have never experiemented on an embedded chip. Stacked command invoking an integer overflow, might give us write access to the system.
Has any thought gone into rewriting one of the dll's included in the latest patch to include some sort of backdoor? It seems it'd be easy (maybe I'm missing something here) to just modify the latest patch's install files to install our new dll.
I haven't had time yet, but I am going to try to USB otg pull.... I'm sure I can probably at least disable the vss lock.
kthejoker20 said:
I haven't had time yet, but I am going to try to USB otg pull.... I'm sure I can probably at least disable the vss lock.
Click to expand...
Click to collapse
When you tried running the cmd prompt with the stacked command approach did get any indications of the program running? I was thinking about adding some arguments to the end of the command to write a random file to the root of an available drive (like you said, who knows how the thumb drive is recognized).
Also, what type of processor does the system run on?
---------- Post added at 11:51 PM ---------- Previous post was at 11:30 PM ----------
duckboy81 said:
When you tried running the cmd prompt with the stacked command approach did get any indications of the program running? I was thinking about adding some arguments to the end of the command to write a random file to the root of an available drive (like you said, who knows how the thumb drive is recognized).
Also, what type of processor does the system run on?
Click to expand...
Click to collapse
I think I answered one of the questions. From the PDF you posted "A Technical Companion..." it's a Freescale IMX35 processor.
freescale.com/webapp/sps/site/taxonomy.jsp?code=IMX35_FAMILY&cof=0&am=0
Looking forward to following the progress of this thread! I hope that you all will discover a new solution to our these outdated systems! Good luck guys, I am rooting for you!
duckboy81 said:
When you tried running the cmd prompt with the stacked command approach did get any indications of the program running? I was thinking about adding some arguments to the end of the command to write a random file to the root of an available drive (like you said, who knows how the thumb drive is recognized).
Also, what type of processor does the system run on?
---------- Post added at 11:51 PM ---------- Previous post was at 11:30 PM ----------
I think I answered one of the questions. From the PDF you posted "A Technical Companion..." it's a Freescale IMX35 processor.
freescale.com/webapp/sps/site/taxonomy.jsp?code=IMX35_FAMILY&cof=0&am=0
Click to expand...
Click to collapse
Actually I am pretty sure the MyFord Touch processor is an I.MX51 acccording to a Ford PDF I found. Unfortunately I am new to posting here and it won't let me post links.
I work on the almost identical I.MX53 processor at work doing Linux kernel, u-boot boot loader, and Linux application software, so I might be able to help.
Most of the I.MX processors have built in ROM code that allows booting to a USB or Serial downloaded mode. This allows loading any software you want into any RAM address and then booting from it. Then you run completely out of RAM (like a live CD). Depending on how Ford setup the I.MX51 e-fuse settings, there may be an external pin that could be used to enter this serial downloaded mode. Freescale provides a tool called the MfgTool to load software using the serial download mode. Then you could load Linux, Android, or whatever. The e-fuses also allow you to lock out JTAG, serial downloaded mode, and enable boot time signature checking, but I am not sure if Ford used any of these to lock the system down.
Do we know where the processor is located in the fusion?

Motion Sense Radar Bypass

Hello everyone! I'm looking some advice from the wise about bypassing the region restrictions for the Soli Radar (Motion Sense) in my Pixel 4. I am pretty new at running ADB (Android Debug Bridge) from my Windows PC. That said, I'm sure I overlooked something very simple. I can't get the commands to work at all. I followed the XDA YouTube video step by step on how to install and setup the SDK Platform tools on my PC. As well as how to prepare my device to receive commands from my PC. But it fails every time. I'm pretty sure that I'm just running the ADB incorrectly, but I don't know. I have only been able to find instructions on how to install and setup the SDK package. But no clear instructions on how exactly to utilize it. Again, I've never done this before. I am running the latest version on Android 10 on my phone and my PC is running Windows 10. And before running any commands, I verified that the device is in fact attached to the PC by running "adb devices" first. I wish there was an option to attach a screenshot of failure message I'm getting. But it says:
setprop: failed to set property 'pixel.oslo.allowed_override' to 'true'
I get this same failure when I run the alternative command line as well. And I have tried both command prompt and Power Shell and receive the same failure message. Anything advice that can be shot my way would be greatly appreciated. Thanks!
First check the windows 10 device manager to confirm that your device and computer are successfully connected.
Then try to replace with a new data cable, a USB 2.0 cable may be better.
Is the phone bootloader unlocked or have you rooted it yet? Honestly I am not sure if either of those are required for the changes, but I suspect they are. If you haven't rooted the phone yet, then I bet you don't have the correct privileges to make those kind of changes to the phone.

[NST/G] USB debugging issue

What fun! Windows 10 and the NST
I find that I cannot negotiate ADB access via USB any longer. I don't know when that started, but it looks like maybe sometime in June. These events are displayed in the Device Manager when accessing "Portable Devices":
Driver Management has concluded the process to add Service WUDFWpdFs for Device Instance ID SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_B&N&PROD_NOOK_SIMPLETOUCH&REV_0100#7&22272E47&0&3012440020143004&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B} with the following status: 0.
Device SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_B&N&Prod_NOOK_SimpleTouch&Rev_0100#7&22272e47&0&3012440020143004&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} was not migrated due to partial or ambiguous match.
Last Device Instance Id: SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_B&N&Prod_NOOK_SimpleTouch&Rev_0100#3014760074133009&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Location Path:
Migration Rank: 0xF000FFFF0000F102
Present: false
Status: 0xC0000719
Device SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_B&N&Prod_NOOK_SimpleTouch&Rev_0100#7&22272e47&0&3012440020143004&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} requires further installation.
It's not beyond belief that the spate of major updates to Windows 10 recently trashed my ability to access the device via ADB/USB. The question is: how to fix it?
On the NST I have the following:
service.adb.tcp.port -1
persist.adb.tcp.port 0
All that stuff indicates that the NST is presenting as UMS.
Have you used UsbView.exe to see what interfaces are being presented?
Have you looked at sys.usb.config, sys.usb.config?
That stuff with adb.tcp is only for ADB over TCP (WiFi).
Renate said:
Have you used UsbView.exe to see what interfaces are being presented?
Click to expand...
Click to collapse
Mmm....is that in your signature (NOT)?
Renate said:
Have you looked at sys.usb.config, sys.usb.config?
Click to expand...
Click to collapse
And this is where?
I should have added that none of my three NST/G devices is connecting properly now (other than as USB file transfer devices) whereas all were formerly able to negotiate USB debugging and ADB.
UsbView.exe is the venerable Microsoft utility, to be found here: https://ftdichip.com/wp-content/uploads/2020/07/usbview.zip
You can also look in Windows Device Manager (devmgmt.msc), especially in "View > Devices by Connection"
Either OmapLink.exe or ImxLink.exe (in sig) will show you if ADB is showing (err, conditional upon the driver being loaded?)
Renate said:
UsbView.exe is the venerable Microsoft utility, to be found here: https://ftdichip.com/wp-content/uploads/2020/07/usbview.zip
You can also look in Windows Device Manager (devmgmt.msc), especially in "View > Devices by Connection"
Either OmapLink.exe or ImxLink.exe (in sig) will show you if ADB is showing (err, conditional upon the driver being loaded?)
Click to expand...
Click to collapse
This is the result from omaplink (green dot for ADB, black for UMS):
Code:
Waiting for bootloader or Fastboot or ADB...
ADB version: 01000000, payload: 4096, type: device
uid=0(root) gid=0(root)
In DeviceManager/Devices by Connection, the Nook shows up as a USB composite device.
And I've attached a screencap from usbview.
Well, OmapLink/ImxLink found your rooted device.
You do have only one Android plugged in?
What part of ADB is not working?
What version adb.exe are you using?
If the version is stone age it goes by VID/PID and it doesn't know about B&N.
Code:
C:\>adb version
Android Debug Bridge version 1.0.41
C:\>adb devices
12345678
Version is not that critical, but should at least be in the high 30's.
(For UsbView you want to click on the device so that you see interesting things in the right panel. But we're past that step.)
Wait, are you talking about UMS not working, not ADB?
Oh, don't tell me that you use UMS?
The NST presents two drives but there may not be anything mounted.
Run Disk Manager (diskmgmt.msc) and see if there are drive letters but nothing inside them.
Renate said:
UsbView.exe is the venerable Microsoft utility, to be found here: https://ftdichip.com/wp-content/uploads/2020/07/usbview.zip
You can also look in Windows Device Manager (devmgmt.msc), especially in "View > Devices by Connection"
Either OmapLink.exe or ImxLink.exe (in sig) will show you if ADB is showing (err, conditional upon the driver being loaded?)
Click to expand...
Click to collapse
This is the result from omaplink (green dot for ADB, black for UMS):
Code:
Waiting for bootloader or Fastboot or ADB...
ADB version: 01000000, payload: 4096, type: device
uid=0(root) gid=0(root)
In DeviceManager/Devices by Connection, the Nook shows up as a USB composite device.
And I've attached a screencap from usbview.
Renate said:
Wait, are you talking about UMS not working, not ADB?
Oh, don't tell me that you use UMS?
The NST presents two drives but there may not be anything mounted.
Run Disk Manager (diskmgmt.msc) and see if there are drive letters but nothing inside them.
Click to expand...
Click to collapse
Unless I am transferring a library book with ADE I like to keep UMS turned off since it locks you out of interacting with the screen while debugging...which now isn't happening for some unknown reason.
I try to do most file transfers wirelessly to save wear and tear on the USB jack.
So, yes, I am talking about ADB. "Device not found" is all I get now. I'll check on the version later today but I don't see why a version which was working just fine before should suddenly stop. Unless its Windows' fault.
nmyshkin said:
"Device not found" is all I get now.
Click to expand...
Click to collapse
Ah, ok.
It's definitely a problem with your adb.exe
OmapLink/ImxLink can find your device, connect and even do shell commands (id).
Those programs, unlike AdbSync, do not go through the ADB port 5037 of adb.exe like a normal ADB client does.
If you actually have adb.exe connected OmapLink/ImxLink won't be able to connect to the already connected device.
So this all means tht your WIndows drivers are fine.
You might have had a few copies of adb.exe and one of them got deleted or the PATH changed or a backup restored the wrong one or...
Also, there was that old C:\Users\Person\.android\usb_adb.ini file which was used by old versions of adb.exe
But you don't want/need that anymore, so forget that I mentioned it!
Renate said:
Ah, ok.
It's definitely a problem with your adb.exe
OmapLink/ImxLink can find your device, connect and even do shell commands (id).
Those programs, unlike AdbSync, do not go through the ADB port 5037 of adb.exe like a normal ADB client does.
If you actually have adb.exe connected OmapLink/ImxLink won't be able to connect to the already connected device.
So this all means tht your WIndows drivers are fine.
You might have had a few copies of adb.exe and one of them got deleted or the PATH changed or a backup restored the wrong one or...
Also, there was that old C:\Users\Person\.android\usb_adb.ini file which was used by old versions of adb.exe
But you don't want/need that anymore, so forget that I mentioned it!
Click to expand...
Click to collapse
ADB version is 1.0.31 (Minimal ADB and Fastboot)
Just to see, I connected up my regular non-Nook tablet and ADB saw the device right away. So the issue is definitely with the NST or the interface of the NST with Windows.
I actually do have that usb_adb.ini file, but again, why work with everything else and "suddenly" stop working with the NST?
When UMS is turned off, I do see the two "empty" drives (internal and sdcard) in Windows when I connect via USB.
Marshmallow came out in October 2, 2015.
That had ADB version 1.0.32
That was the first public release that eliminated vendor white-listing that was changed in November 21, 2014.
I could tell you how to fix the adb_usb.ini, but you really should just update a half decade or so.
Renate said:
Marshmallow came out in October 2, 2015.
That had ADB version 1.0.32
That was the first public release that eliminated vendor white-listing that was changed in November 21, 2014.
I could tell you how to fix the adb_usb.ini, but you really should just update a half decade or so.
Click to expand...
Click to collapse
Huh.
So I updated Minimal ADB and Fastboot to v.1.43 which is ADB version 1.0.39. And it worked right away. I still don't see why the previous version just stopped working with the NST. Like so much else in life, it makes no sense.
Anyway now I have another issue, for this version came with a genuine Windows installer and my previous version was a "dump into the folder of your choice and set up the paths". I'm wondering if it's safe to just delete that entire folder now (probably have to clean up the path statement too...). Ugh.
Once upon a time, adb.exe and fastboot.exe were completely standalone.
Now they require AdbWinApi.dll, AdbWinUsbApi.dll
They also require:
Code:
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
But these should already be found in the Windows "downlevel" directories.
There's no need to be adding to PATH for every little thing.
If you are invoking adb/fastboot from the command line, you might consider using doskey:
Regedit HKCU\Software\Microsoft\Command Processor AutoRun=\wherever\my-autorun.bat
Code:
doskey /macrofile=\wherever\my-aliases.txt
Code:
adb=C:\some-sort-of-path\adb.exe $*
fastboot=C:\some-sort-of-path\fastboot.exe $*
Edit: I forgot the arguments ($*).
If you are invoking adb/fastboot from a bat or makefile just put the full path in some define.

Categories

Resources