Yet ANOTHER possible CVE for root or privilege elevations (CVE-2016-2494) - LG G5 Guides, News, & Discussion

Looking through the June security bulletin and found this https://www.exploit-db.com/exploits/39921/. I downloaded it from the source, and it cam with a compiled PoC. I ran it and it seemed to work, but I don't know exactly what it is doing. Here is a log of what the code gives me after being run:
127|[email protected]:/data/local/tmp $ ./sdcard_poc
[*] sdcard off-by-one poc
[*] getting everything ready...
- creating 16 small entries
- creating large entries
- adjusting pad_1 entry
rename_pad_1(1, 2)
rename_pad_1(2, 1)
- resizing overflow entries
rename_overflows(255)
[*] triggering!
rename_pad_2(1, 2)
rename_pad_2(2, 3)
rename_pad_2(3, 4)
rename_pad_2(4, 5)
rename_pad_2(5, 6)
rename_pad_2(6, 7)
rename_pad_2(7, 8)
rename_pad_2(8, 9)
rename_pad_2(9, 10)
rename_pad_2(10, 11)
rename_pad_2(11, 12)
rename_pad_2(12, 13)
rename_pad_2(13, 14)
rename_pad_2(14, 15)
rename_pad_2(15, 16)
rename_pad_2(16, 17)
rename_pad_2(17, 18)
rename_pad_2(18, 19)
rename_pad_2(19, 20)
rename_pad_2(20, 21)
rename_pad_2(21, 22)
rename_pad_2(22, 23)
rename_pad_2(23, 24)
rename_pad_2(24, 25)
rename_pad_2(25, 26)
rename_pad_2(26, 27)
rename_pad_2(27, 28)
rename_pad_2(28, 29)
rename_pad_2(29, 30)
rename_pad_2(30, 31)
rename_pad_2(31, 32)
rename_pad_2(32, 33)
rename_pad_2(33, 34)
rename_pad_2(34, 35)
rename_pad_2(35, 36)
rename_pad_2(36, 37)
rename_pad_2(37, 38)
rename_pad_2(38, 39)
rename_pad_2(39, 40)
rename_pad_2(40, 41)
rename_pad_2(41, 42)
rename_pad_2(42, 43)
rename_pad_2(43, 44)
rename_pad_2(44, 45)
rename_pad_2(45, 46)
rename_pad_2(46, 47)
rename_pad_2(47, 48)
rename_pad_2(48, 49)
rename_pad_2(49, 50)
rename_pad_2(50, 51)
rename_pad_2(51, 52)
rename_pad_2(52, 53)
rename_pad_2(53, 54)
rename_pad_2(54, 55)
rename_pad_2(55, 56)
rename_pad_2(56, 57)
rename_pad_2(57, 58)
rename_pad_2(58, 59)
rename_pad_2(59, 60)
rename_pad_2(60, 61)
rename_pad_2(61, 62)
rename_pad_2(62, 63)
rename_pad_2(63, 64)
rename_pad_2(64, 65)
rename_pad_2(65, 66)
rename_pad_2(66, 67)
rename_pad_2(67, 68)
rename_pad_2(68, 69)
rename_pad_2(69, 70)
rename_pad_2(70, 71)
rename_pad_2(71, 72)
rename_pad_2(72, 73)
rename_pad_2(73, 74)
rename_pad_2(74, 75)
rename_pad_2(75, 76)
rename_pad_2(76, 77)
rename_pad_2(77, 78)
rename_pad_2(78, 79)
rename_pad_2(79, 80)
rename_pad_2(80, 81)
rename_pad_2(81, 82)
rename_pad_2(82, 83)
rename_pad_2(83, 84)
rename_pad_2(84, 85)
rename_pad_2(85, 86)
rename_pad_2(86, 87)
rename_pad_2(87, 88)
rename_pad_2(88, 89)
rename_pad_2(89, 90)
rename_pad_2(90, 91)
rename_pad_2(91, 92)
rename_pad_2(92, 93)
rename_pad_2(93, 94)
rename_pad_2(94, 95)
rename_pad_2(95, 96)
rename_pad_2(96, 97)
rename_pad_2(97, 98)
rename_pad_2(98, 99)
rename_pad_2(99, 100)
rename_pad_2(100, 101)
rename_pad_2(101, 102)
rename_pad_2(102, 103)
rename_pad_2(103, 104)
rename_pad_2(104, 105)
rename_pad_2(105, 106)
rename_pad_2(106, 107)
rename_pad_2(107, 108)
rename_pad_2(108, 109)
rename_pad_2(109, 110)
rename_pad_2(110, 111)
rename_pad_2(111, 112)
rename_pad_2(112, 113)
rename_pad_2(113, 114)
rename_pad_2(114, 115)
rename_pad_2(115, 116)
rename_pad_2(116, 117)
rename_pad_2(117, 118)
rename_pad_2(118, 119)
rename_pad_2(119, 120)
rename_pad_2(120, 121)
rename_pad_2(121, 122)
rename_pad_2(122, 123)
rename_pad_2(123, 124)
rename_pad_2(124, 125)
rename_pad_2(125, 126)
rename_pad_2(126, 127)
rename_pad_2(127, 128)
rename_pad_2(128, 129)
rename_pad_2(129, 130)
rename_pad_2(130, 131)
rename_pad_2(131, 132)
rename_pad_2(132, 133)
rename_pad_2(133, 134)
rename_pad_2(134, 135)
rename_pad_2(135, 136)
rename_pad_2(136, 137)
rename_pad_2(137, 138)
rename_pad_2(138, 139)
rename_pad_2(139, 140)
rename_pad_2(140, 141)
rename_pad_2(141, 142)
rename_pad_2(142, 143)
rename_pad_2(143, 144)
rename_pad_2(144, 145)
rename_pad_2(145, 146)
rename_pad_2(146, 147)
rename_pad_2(147, 148)
rename_pad_2(148, 149)
rename_pad_2(149, 150)
rename_pad_2(150, 151)
rename_pad_2(151, 152)
rename_pad_2(152, 153)
rename_pad_2(153, 154)
rename_pad_2(154, 155)
rename_pad_2(155, 156)
rename_pad_2(156, 157)
rename_pad_2(157, 158)
rename_pad_2(158, 159)
rename_pad_2(159, 160)
rename_pad_2(160, 161)
rename_pad_2(161, 162)
rename_pad_2(162, 163)
rename_pad_2(163, 164)
rename_pad_2(164, 165)
rename_pad_2(165, 166)
rename_pad_2(166, 167)
rename_pad_2(167, 168)
rename_pad_2(168, 169)
rename_pad_2(169, 170)
rename_pad_2(170, 171)
rename_pad_2(171, 172)
rename_pad_2(172, 173)
rename_pad_2(173, 174)
rename_pad_2(174, 175)
rename_pad_2(175, 176)
rename_pad_2(176, 177)
rename_pad_2(177, 178)
rename_pad_2(178, 179)
rename_pad_2(179, 180)
rename_pad_2(180, 181)
rename_pad_2(181, 182)
rename_pad_2(182, 183)
rename_pad_2(183, 184)
rename_pad_2(184, 185)
rename_pad_2(185, 186)
rename_pad_2(186, 187)
rename_pad_2(187, 188)
rename_pad_2(188, 189)
rename_pad_2(189, 190)
rename_pad_2(190, 191)
rename_pad_2(191, 192)
rename_pad_2(192, 193)
rename_pad_2(193, 194)
rename_pad_2(194, 195)
rename_pad_2(195, 196)
rename_pad_2(196, 197)
rename_pad_2(197, 198)
rename_pad_2(198, 199)
rename_pad_2(199, 200)
rename_pad_2(200, 201)
rename_pad_2(201, 202)
rename_pad_2(202, 203)
rename_pad_2(203, 204)
rename_pad_2(204, 205)
rename_pad_2(205, 206)
rename_pad_2(206, 207)
rename_pad_2(207, 208)
rename_pad_2(208, 209)
rename_pad_2(209, 210)
rename_pad_2(210, 211)
rename_pad_2(211, 212)
rename_pad_2(212, 213)
rename_pad_2(213, 214)
rename_pad_2(214, 215)
rename_pad_2(215, 216)
rename_pad_2(216, 217)
rename_pad_2(217, 218)
rename_pad_2(218, 219)
rename_pad_2(219, 220)
rename_pad_2(220, 221)
rename_pad_2(221, 222)
rename_pad_2(222, 223)
rename_pad_2(223, 224)
rename_pad_2(224, 225)
rename_pad_2(225, 226)
rename_pad_2(226, 227)
rename_pad_2(227, 228)
rename_pad_2(228, 229)
rename_pad_2(229, 230)
rename_pad_2(230, 231)
rename_pad_2(231, 232)
rename_pad_2(232, 233)
rename_pad_2(233, 234)
rename_pad_2(234, 235)
rename_pad_2(235, 236)
rename_pad_2(236, 237)
rename_pad_2(237, 238)
rename_pad_2(238, 239)
rename_pad_2(239, 240)
rename_pad_2(240, 241)
rename_pad_2(241, 242)
rename_pad_2(242, 243)
rename_pad_2(243, 244)
rename_pad_2(244, 245)
rename_pad_2(245, 246)
rename_pad_2(246, 247)
rename_pad_2(247, 248)
rename_pad_2(248, 249)
rename_pad_2(249, 250)
rename_pad_2(250, 251)
rename_pad_2(251, 252)
rename_pad_2(252, 253)
rename_pad_2(253, 254)
255|[email protected]:/data/local/tmp $
I am not sure what steps to take next, can anyone offer any help? This seems to be pretty promising as it actual works for once.

I tried that and I think it only gains System Privelleges. But honestly I really haven't seen any change. I even checked with id. Still was 2000 as usual.

NavSad said:
I tried that and I think it only gains System Privelleges. But honestly I really haven't seen any change. I even checked with id. Still was 2000 as usual.
Click to expand...
Click to collapse
So is this useless? I'm just kind of confused on what this does exactly...

It did some weird stuff to my phone, and I ended up having to factory reset. It seemed to have completely wiped the quick settings feature, and everything was back to the factory settings except for the apps that I had downloaded before

Honestly Annoying said:
So is this useless? I'm just kind of confused on what this does exactly...
Click to expand...
Click to collapse
I think someone would need to put some code into it that could inject system permission. Otherwise it's just a buffer overflow.

NavSad said:
I think someone would need to put some code into it that could inject system permission. Otherwise it's just a buffer overflow.
Click to expand...
Click to collapse
Yeah that makes sense...
In the meantime, check this out: https://www.exploit-db.com/exploits/39340/

Honestly Annoying said:
Yeah that makes sense...
In the meantime, check this out: https://www.exploit-db.com/exploits/39340/
Click to expand...
Click to collapse
I think this exploit could be patched because it was published in Janurary. But here's another exploit: http://www.cvedetails.com/cve/CVE-2016-3135/. Just need someone to port it over.

NavSad said:
I think this exploit could be patched because it was published in Janurary. But here's another exploit: http://www.cvedetails.com/cve/CVE-2016-3135/. Just need someone to port it over.
Click to expand...
Click to collapse
The thing about this exploit is that it was never assigned an official CVE, so it could have gone unnoticed.
And I'll check that one out. I've ported them over before. Is there a download link for it?

NavSad said:
I think this exploit could be patched because it was published in Janurary. But here's another exploit: http://www.cvedetails.com/cve/CVE-2016-3135/. Just need someone to port it over.
Click to expand...
Click to collapse
Also, this is an OLD root exploit that used a buffer overflow http://security.stackexchange.com/questions/68442/escalating-from-apache-shell-to-root/68482#68482

Honestly Annoying said:
The thing about this exploit is that it was never assigned an official CVE, so it could have gone unnoticed.
And I'll check that one out. I've ported them over before. Is there a download link for it?
Click to expand...
Click to collapse
Yes there is. https://bugs.chromium.org/p/project-zero/issues/detail?id=758&redir=1

NavSad said:
Yes there is. https://bugs.chromium.org/p/project-zero/issues/detail?id=758&redir=1
Click to expand...
Click to collapse
Yeah I just saw that... I'm trying right now but there's only a .c file. I'll see what I can do

I really appreciate you guys trying to get root, I wish I could do the same but I have no idea what to do.

NavSad said:
I think this exploit could be patched because it was published in Janurary. But here's another exploit: http://www.cvedetails.com/cve/CVE-2016-3135/. Just need someone to port it over.
Click to expand...
Click to collapse
I believe that I have ported the CVE over.
I have two different files, one of them gives an "unshare: Invalid argument" error. In the other file, I just deleted the lines that had "unshare" in them and recompiled it. This one seems to run the right way, but I don't exactly know what to do with it. Why did you say this CVE would work? And what can I do to see if it is working for me?

Honestly Annoying said:
I believe that I have ported the CVE over.
I have two different files, one of them gives an "unshare: Invalid argument" error. In the other file, I just deleted the lines that had "unshare" in them and recompiled it. This one seems to run the right way, but I don't exactly know what to do with it. Why did you say this CVE would work? And what can I do to see if it is working for me?
Click to expand...
Click to collapse
I said I thought it might work because Android and Linux share the same kernel, so problems can be ported over. Try adding some code that can inject root after the exploit is finished, maybe that could work.

Would adding something that would run "chmod 777 /data" work? If it is something like that it should be no problem

NavSad said:
I said I thought it might work because Android and Linux share the same kernel, so problems can be ported over. Try adding some code that can inject root after the exploit is finished, maybe that could work.
Click to expand...
Click to collapse
Would adding something that would run "chmod 777 /data" work? If it is something like that it should be no problem

Honestly Annoying said:
Would adding something that would run "chmod 777 /data" work? If it is something like that it should be no problem
Click to expand...
Click to collapse
Yeah put the file in data/local/tmp and do chmod 777.

NavSad said:
Yeah put the file in data/local/tmp and do chmod 777.
Click to expand...
Click to collapse
No I mean adding to the code. How can I get this to open a root shell?

Honestly Annoying said:
Would adding something that would run "chmod 777 /data" work? If it is something like that it should be no problem
Click to expand...
Click to collapse
I think he wanted to use the exploit to change the root folder's permissions to read write execute and then inject a su binary via file manager, and wanted to know if that would work... :/

MadnessChi1d said:
I think he wanted to use the exploit to change the root folder's permissions to read write execute and then inject a su binary via file manager, and wanted to know if that would work... :/
Click to expand...
Click to collapse
? I want to add code to the .c file to execute an exploit

Related

Nook Simple Touch -> Nook Multi Touch [Screensaver Locking Issue Explanation Added]

Nook Simple Touch -> Nook Multi Touch [Screensaver Locking Issue Explanation Added]
After long discussion on how to enable multitouch
http://forum.xda-developers.com/showthread.php?t=1361296
Finally we get something very exciting,
mixing with the noRefresh app, thank to everyone developing this app
http://forum.xda-developers.com/showthread.php?t=1502723
==Exciting Videos==
AngryBird: http://www.youtube.com/watch?v=Chy0MGorjmo
Excellent PDF Reading: http://www.youtube.com/watch?v=JDk8a0leP4U
======For User======
For those who want a simple installation package
Can use the following update-package made by mali100, thanks to mali100
mali100 made an update-zip to install multitouch through CWM
[NST][CWR][RC2] Clockworkmod based Recovery
For thise users want to install manually
Can achieve Multi-touch by 2 Steps:
| Replacing Kernel:
| -make sure you haven't changed it before, otherwise u have to combine the changes and compile a new one
| -remember, a backup is a MUST
| for firmware 1.1 users
| Use Noogie or other methods, change the uImage with the attached one ( or the combined kernel mentioned below )
| arkusuma teaches us how to change uImage using ADB here
| *Thanks to arkusuma!
|
| Adding Permission node:
| in "/etc/permissions/required_hardware.xml", add
|
Code:
<feature name="android.hardware.touchscreen" />
<feature name="android.hardware.touchscreen.multitouch" />
|
| Reboot
For those users who also want to achieve USB host
Can find the combined kernel here: ( Thanks mali100! )
http://forum.xda-developers.com/showthread.php?p=24180134
Known Issue:
Sometimes the nook would act like un-responsive when it is in screensaver.
To solve it, try to drag the screen with two fingers.
The reason for this is, a cache is added between hardware input and linux subsystem, if the driver missed one of the "finger up" event before, it would result it leaving a phantom finger touching in your next touch. The screen cannot unlock by 2 fingers. But when you drag the screen with 2 fingers. It will clear all the cache, so as to erase the phantom touching.
Click to expand...
Click to collapse
======For Developer======
It is done by editing the kernel + adding permission node
*Thanks to arkusuma, who improved the code, added a cache for touching data, which prevents the pervious "un-stable" situation from happening
Kernel: just replace zforce.c, then compile
Two main changes on zforce,
first one is process_touch_event ( report touch information ),
second one is zforce_probe, this one just added a few input_set_abs_params ( register for device capability )
http://github.com/arkusuma/nook-touch-multitouch
Permission node: in "/etc/permissions/required_hardware.xml", add
Code:
<feature name="android.hardware.touchscreen" />
<feature name="android.hardware.touchscreen.multitouch" />
Click to expand...
Click to collapse
Thanks to arkusuma for improving the code again !
Why not work multi touch zoom in Opera mini?
love it ;]
also.. it works in OPERA 'mobile'.
osowiecki said:
love it ;]
also.. it works in OPERA 'mobile'.
Click to expand...
Click to collapse
Yes, you're right. Thank you.
PS: in UC Browser works too
Congrats on getting multitouch working!
wheilitjohnny,
Congrats on your feat! Maybe you should do a tutorial on how to install those files, for those poor lame souls like myself who can do simple things like run installer and such, even run a rooter, but need help on anything else.
Thank you for your support, I also wish to make a 1-click-install later.
But since the multi-touch is still not very smooth when the fingers are not moving, I want to package the things when I have a better release!
Wish that day comes earlier ^ ^
Could anyone say if kernel for 1.1 will work on 1.1.2? Then could someone compile one if it does not?
Hi, I've made some adjustment of wheilitjohnny's source. It seems to be working properly now, even when there's no finger movement. Changes can be viewed at github:
github.com/arkusuma/nook-touch-multitouch
I'm attaching the resulting uImage for those interested.
Cool ! Thanks arkusuma
You added a cache !
Seems that it is perfect now...
I wanna also improve the noRefresh app, make it being enabled when we are dragging......
But seems difficult
Now we get into the dueling uImages.
I guess that everybody will have to start building their own.
The problem is when somebody offers their uImage for Option A and somebody offers their uImage for Option B.
I could use a uImage for multitouch and USB host mode.
wheilitjohnny said:
I wanna also improve the noRefresh app, make it enable when we are dragging...
Click to expand...
Click to collapse
It's not difficult, but it has to (well, no, but most easily can be) integrated into the app.
I've got one of my personal apps that does this already.
I've stripped it down to a demo.
This only pans. Notice that it switches back and forth between A2 and normal modes.
Do the USB host one released the source code?
If yes, u can combine them and compile a whole new one to enjoy both hacks !
=======================
I just wonder, if it is possible, to make an app.
Getting information from the kernel directly, and set the mode using the raw information.
Then it can support all Apps
Any method for an app to read /dev/input/event2 ?
wheilitjohnny said:
Do the USB host one released the source code?
Click to expand...
Click to collapse
Yes, verygreen put it somewhere.
wheilitjohnny said:
Any method for an app to read /dev/input/event2 ?
Click to expand...
Click to collapse
Yes, /dev/input is where the good stuff is, but it's a bit more complicated.
The order of devices changes depending on what is connected/active.
Moreover, you can't really take over something that another process is reading.
Here's what my system is showing (with two USB keyboards plugged in ):
Code:
# ls -l /dev/input
crw-rw---- root input 13, 70 2012-03-27 08:34 event6
crw-rw---- root input 13, 33 2012-03-27 08:34 mouse1
crw-rw---- root input 13, 69 2012-03-27 08:34 event5
crw-rw---- root input 13, 68 2012-03-27 08:34 event4
crw-rw---- root input 13, 67 2012-03-27 08:34 event3
crw-rw---- root input 13, 66 2012-03-26 12:19 event2
crw-rw---- root input 13, 32 2012-03-26 12:19 mouse0
crw-rw---- root input 13, 63 2012-03-26 12:19 mice
crw-rw---- root input 13, 65 2012-03-26 12:19 event1
crw-rw---- root input 13, 64 2012-03-26 12:19 event0
maybe it is possible for me to add in dummy information in driver to raise extra input events.
my problem now is how an app (service in background) read device input event directly
I think we can make an input event separately from anything else
only let that app to read it, is it possible?
any permission stuff?
how to impletment the code in Java environment for the app?
how exactly the code should be typed?
Hi,
is this hack compatible with Edit n/reading now/side btns/RecentApps+ActivityPicker+ForceOrient from XorZone
tebra said:
Hi,
is this hack compatible with Edit n/reading now/side btns/RecentApps+ActivityPicker+ForceOrient from XorZone
Click to expand...
Click to collapse
Yes, this one is kernel based, XorZones is a hack of the framework.
I tried making "Dragging NoRefresh" using JNI
But the permission problem when I try to access /dev/input/event making me feel mad...
Really great news. i tried it with opera mobile, really good experience..
may i ask which pdf reader is this thats seen on the video?
Thanks for this!
Does anybody know how to flash a kernel image without using Noogie (using CWM, for example)?
drmxmyt said:
Really great news. i tried it with opera mobile, really good experience..
may i ask which pdf reader is this thats seen on the video?
Click to expand...
Click to collapse
that is ezPDF Reader
marspeople said:
Thanks for this!
Does anybody know how to flash a kernel image without using Noogie (using CWM, for example)?
Click to expand...
Click to collapse
is it possible to make it a "update-package" ? just like that one for official firmware update.

[DEV][WiP][Python3] AndroPy - Library - It's like chatting with your phone!

AndroPy
a python3 library to communicate with your phone
INTRODUCTION
Hey there! In relation to THIS library written in JAVA :silly: I decided to write another library in Python3.
I try to reach the same functionality as that JAVA lib and maybe even more. "Why Python3?" you may ask..
Because it's the language I love the most, it's platform-independent and has got a beautiful syntax.
It's in early stage and there are only some functions working right now which I will explain in another block.
Click to expand...
Click to collapse
FEATURES
Install ADB-binary (only working on linux 64-bit for now)
Reboot (system, recovery, bootloader)
Execute shell commands and get output-lines as a list
Get list of connected devices
Get build.prop as a dictionary
Click to expand...
Click to collapse
EXAMPLES
I included a function called example wich will be automatically executed if you run adb_util.py.
It shows what you can do with that library. The installer isn't fully working yet, only in Linux 64bit systems.
In order to use adb_util.py the adb-binary has to be in ~/.andropy/bin.
Click to expand...
Click to collapse
Install adb via installer.py on Linux 64-bit machines
Just execute it like:
Code:
python3 installer.py
Click to expand...
Click to collapse
Show content of /sdcard
Code:
import andropy
with andropy.ADBInterface() as ai:
print(ai.exec_shell_cmd("ls /sdcard/"))
Get screen-resolution
Code:
import andropy
with andropy.ADBInterface() as ai:
build_props = ai.get_build_props()
print(build_props['ro.device.screen_res'])
Samle output from adb_util.py
Code:
[email protected]:~/src/andropy$ python3 adb_util.py
# Welcome to AndroPy #
----------------------
Number of devices detected: 1
Number of your downloaded apps: 41
Your phone's CPU: 1.7 GHz quad-core
Your phone's model: HTC m7ul
SOURCE
https://github.com/tehmk/andropy
But as I mentioned it isn't nearly ready yet. Some of you maybe know how to use it in this state.
I will add features and more detailed instructions step by step.
Click to expand...
Click to collapse
hey saw this pop up in the portal. after a quick glance this can become a good concept for users, such as timed logs, or a function to dump information (build prop, kmsg, logcat, bugreport, tombstones, you get the idea)
I'd like to bring your attention to this though. the prop parser
Code:
def get_build_props(self):
build_props = {}
out = subprocess.check_output([ADB_EXE, "shell",
"cat /system/build.prop"],
universal_newlines=True)
self.check_output(out)
for line in out.split('\n'):
if line == '':
continue
prop = line.split('=')
if not prop[0].startswith('#'):
build_props[prop[0]] = prop[1]
return build_props
you don't need to fetch the whole build prop (for most of the time). this is an extra function that you can use
Code:
def get_prop(self, prop):
out = subprocess.check_output([ADB_EXE, "shell",
"getprop", "{}".format(prop)])
self.check_output(out)
return out
if you need any other help or tips, feel free to ping me on freenode, or drop a message here
This is great. Thank you. Will be using and might contribute.
Seems like I've started a trend here. Lol
Beatsleigher said:
Seems like I've started a trend here. Lol
Click to expand...
Click to collapse
seems so. I've got the base layer of a python package that plugs directly into the adb server. none of these wrappers needed

KK 4.4 !! [Solved] Wifi Regional problem with sim card inserted

For 4.4 goto 2'nd post
This is for JB 4.3.1
If you like me have the problem of : ( wifi + sim_card ) = wifi not working
here is the fix : credits to HTCZ715E
http://forum.xda-developers.com/showthread.php?t=2368501
but just 1 more step , after making the new "telephony-common.jar" and adb push , and chmod 644
you HAVE TO wipe dalvik+cache
without wipe dalvik+cache it never worked for me.
HTC MyTouch 4G
[ROM] CM-10.2 | AOSP 4.3 Jellybean [KANG] [Oct-11]
cm-10.2-20131011-Albinoman887-glacier
Well heads up to the android 4.4
non of the previous solutions is not working :crying:
today i tried ROM Legacy Carbon 4.4
so i started to use my knowledge about cracking from the old MS-dos ages !!!!!!!!! and i cracked the bcmdhd.ko file
using IDA dissembler and HexEdit the bcmdhd.ko file.
Now wifi works again. :good:
The problem is that , in this method i cannot provide a universal file and you have to make your own cracked driver ".ko" file.
Or the developers of each Rom should use the working source code for the wifi driver which has the complete support for all languages.
refer to this post:
http://forum.xda-developers.com/showthread.php?t=1077329
and also here are some lines from logcat (i changed my mcc , mnc and country to XX ) with the cracked driver.
(i prefer to use cracking instead of patching because it was previously we called it)
Code:
D/Tethering( 1874): Exception adding default nw to upstreamIfaceTypes: java.lang.NullPointerException
E/wpa_supplicant( 2047): wpa_driver_nl80211_driver_cmd: failed to issue private commands
E/WifiStateMachine( 1874): Failed to set country code XX
D/MccTable( 2051): updateMccMncConfiguration: mcc=XXX, mnc=XX
D/MccTable( 2051): getLocaleFromMcc to null_ir mcc=XXX
D/MccTable( 2051): getLocaleForLanguageCountry: skipping no language
D/MccTable( 2051): WIFI_COUNTRY_CODE set to ir
I/WifiService( 1874): WifiService trying to set country code to XX with persist set to true
D/MccTable( 2051): updateMccMncConfiguration updateConfig config={1.0 XXXmccXXmnc ?locale ?layoutDir ?swdp ?wdp ?hdp ?density ?lsize ?long ?orien ?uimode ?night ?touch ?keyb/?/? ?nav/? themeResource=null}
I/ActivityManager( 1874): Config changes=3 {1.0 XXXmccXXmnc en_US ldltr sw384dp w384dp h615dp 200dpi nrml long port finger -keyb/v/h tball/v s.6 themeResource=null}
The whole problem started from the "wldev_set_country" function in "C" code in a ".h" file of wifi driver.
i don't have the knowledge to manipulate the source code of the wifi driver and compile compile the ".ko" file.
This method is not for pplz who don't know about reverse engineering.
So i opened the "bcmdhd.ko" in IDA disassembler and select the ARM Architecture.
Then searched for the "wldev_set_country" function and in the disassembled code there is some Branches which should be re-routed.
for example: (these are the OP-Codes of ARM cpu)
BNE loc_206E4 in the hex view window "08-00-00-0A"
BNE = Branch if not Equal , (and must have to change to just Branch no matter what is the result of compare )
0A = BNE
EA = B (Branch)
AA = BGE (Branch if Greater or Equal)
..... and etc
The important thing is that in IDA hex-view for examaple it shows : 000206BC 08 00 00 1A
but at the bottom of window it shows: 000206F0 <= this is the address which u needs to find and change in your hex-ediotor
and in hex editor we will change that 1A to 0A
The whole process i re-route 4 branches to get success.
Also i've checked it , and there is no need to appliy the previous patch "telephony-common.jar"
Only the bcmdhd.ko driver needs to patch
I attached the cracked version of my bcmdhd.ko file.
you can try it , BUT IT MAY NOT FOR YOUR COUNTRY AND/OR YOUR SIM CARD and for sure it only works in some Roms
this is the driver version from dmesg
Dongle Host Driver, version 5.90.195.114
Compiled in drivers/net/wireless/bcmdhd on Nov 18 2013 at 17:0
Click to expand...
Click to collapse
i made the attachment for this Rom
[ROM][UNOFFICIAL] LegacyCarbon 4.4 \\ 18.11.2013 \\ Built From Source
you should unzip it and use "adb push" and "chmod 644 "
Code:
adb root
adb push bcmdhd.ko /system/lib/modules/
adb shell
su
cd /system/lib/modules/
chmod 644 bcmdhd.ko
and reboot
----------------------------------------------
HTC MyTouch 4G
[ROM][UNOFFICIAL] LegacyCarbon 4.4 \\ 18.11.2013 \\
I test this file on [ROM][Official][4.4] Evervolv Nightlies
It's compatible And works 100% :good:
BobZombiE said:
I test this file on [ROM][Official][4.4] Evervolv Nightlies
It's compatible And works 100% :good:
Click to expand...
Click to collapse
Did you use it? Bug important? I want to know some information. Thanks!
Sure , i'm using this patched driver almost on all Roms i'm testing and never had any wifi problems.
Sent from my myTouch 4G using xda app-developers app
BobZombiE said:
I test this file on [ROM][Official][4.4] Evervolv Nightlies
It's compatible And works 100% :good:
Click to expand...
Click to collapse
Camera, cam recording, and Browser? What any problem?
If I want back Rom 4.3 after install 4.4. Can I back?!
Thank so much your infomation!
hdhthed said:
Camera, cam recording, and Browser? What any problem?
If I want back Rom 4.3 after install 4.4. Can I back?!
Thank so much your infomation!
Click to expand...
Click to collapse
go to the related thread and take a look , or make a nandroid backup and try.
anyway:
Evervolv 4.0: at this moment: Camera does not work at all . but stock browser is ok :good:
Carbon 4.4 Rom : at this moment : Camera & Cam recording is ok. but stock browser does not work. u have to use other browsers like firefox
Yea! Make a nandroid backup ,after I can restore in Recovery. Have lost root?
hdhthed said:
Yea! Make a nandroid backup ,after I can restore in Recovery. Have lost root?
Click to expand...
Click to collapse
i don't think so
BobZombiE said:
i don't think so
Click to expand...
Click to collapse
Mean? You think lose root or cant restore a backup nandroid ?
hdhthed said:
Mean? You think lose root or cant restore a backup nandroid ?
Click to expand...
Click to collapse
i'm root and s=off , HBOOT 75
and flashed, backed up, restored my phone more than 100 times last week . and never lost root
This is my old phone... Fun to be back here.
I am asking about this modified driver. I need to find out first if my phone uses this driver (looks like a broadcom driver), but if it is, I am going to try it.
My question to the author is: do the changes you made make this driver location agnostic? Because you changed the BNE, to just branch, it seems that you are allowing it to function regardless of the country (in the MMC).
I have an HTC One running 4.4 and my issue is that I really need to use channel 13. My router is set to 13, but no matter what changes I make to the wi-fi region encoding (the region encoding change is successful), I still am limited to only channels 1 to 11.
So I just thought I'd ask to get your input on this...
Thanks,
Paul
help me solve my wifi issue
BobZombiE said:
For 4.4 goto 2'nd post
This is for JB 4.3.1
If you like me have the problem of : ( wifi + sim_card ) = wifi not working
here is the fix : credits to HTCZ715E
http://forum.xda-developers.com/showthread.php?t=2368501
but just 1 more step , after making the new "telephony-common.jar" and adb push , and chmod 644
you HAVE TO wipe dalvik+cache
without wipe dalvik+cache it never worked for me.
HTC MyTouch 4G
[ROM] CM-10.2 | AOSP 4.3 Jellybean [KANG] [Oct-11]
cm-10.2-20131011-Albinoman887-glacier
Click to expand...
Click to collapse
Hey guys ... I'am a normal user having sony xperia ion Lt28h .... I've just flashed CM11 unofficial rom but I have a wifi problem ..... can you teach me how to solve my regional wifi issue as I am in syria and have faced this problem earlier so i know it's a regional problem ..... thx for help

Enabling The Double Tap To Wake Up in Lineage OS and Resurrection Remix

Hi guys;
I found a way to enable the double tap to wake up in LineageOS and RR for the mi mix.
Here it comes:
1: Donwload the Root Explorer and the QuickEdit;
2: With Root Explorer, go to sys/bus/i2c/12-0038/wakeup-mode;
3: Open that with Quick Edit and change the value "0" to "1";
4: Save it;
5: Have fun.
This is my first post here, take easy guys. I searched here for a solution for this problem, but didn't find anything about this two roms.
Thanks if it works!
PS: The only problem is that when you reboot the system, the system automatically returns to "0", so you will have to do the whole process again every time you restart the device. Does anyone know the solution to leave this fixed by default?
I'll add that to init process in ramdisk and enable it in source again. In build 0412 it is disabled, but it seems to work anyway Thx for finding it out.
pappschlumpf said:
I'll add that to init process in ramdisk and enable it in source again. In build 0412 it is disabled, but it seems to work anyway Thx for finding it out.
Click to expand...
Click to collapse
No problem! This is a tweak that I cant live without! And, congratulations for the amazing job. The ROM is perfect to me, Im using as my daily driver. The only 2 problens that I found, is this one and the low volume in Calls. Thanks to provide this ROM, I really appreciated.
Great! Is working fine...
Hello ,
works fine , but after reboot it is back to"0"
mfg , hjf
hjfisch said:
Hello ,
works fine , but after reboot it is back to"0"
mfg , hjf
Click to expand...
Click to collapse
As I said
Couldn't i just change the value and save the file as read only? I'm kind of afraid to try it out but wouldn't that work?
Blackphantom said:
Couldn't i just change the value and save the file as read only? I'm kind of afraid to try it out but wouldn't that work?
Click to expand...
Click to collapse
Will work. Just change the value to 1, save and exit. But, every time that you reboot the device, u will need make the process again.
I understand that. My question was if i save the file as read only wouldn't that "deny" the system from changing the value even after rebooting?
Blackphantom said:
I understand that. My question was if i save the file as read only wouldn't that "deny" the system from changing the value even after rebooting?
Click to expand...
Click to collapse
Dont know. Could you try and post the result?
Blackphantom said:
I understand that. My question was if i save the file as read only wouldn't that "deny" the system from changing the value even after rebooting?
Click to expand...
Click to collapse
NO, as /sys is just a mountpoint for a virtual Filesystem (type sysfs)
So basically, everything under /sys/ is virtual, so no real Files, so no persistance after a reboot. At least not by interacting with sysfs.
This is the Linux way of making runtime live adaptations of certain hardware or software features.
Let me give you an example.
On a regular Dektop-Linux, if you do:
>> echo "1" > /sys/block/sda/device/delete
on the command line, you tell the kernel to flush the caches of the sda disk and spin it down. (so you could safely hotswap)
and if you do not replace your disk, but now want to get that disk spinning again, you put:
>> echo "0 0 0" > /sys/bus/scsi/devices/host1/scsi_host/host1/scan
into console.
So some of the Files there are read only (in like nothing happens when you change the content) , and others can be tampered with, but every change is gone after reboot.
except when you can manage to let some startup-skript make those changes, or you can edit the kernel-source default initialisation variables.
rootgremlin said:
NO, as /sys is just a mountpoint for a virtual Filesystem (type sysfs)
So basically, everything under /sys/ is virtual, so no real Files, so no persistance after a reboot. At least not by interacting with sysfs.
This is the Linux way of making runtime live adaptations of certain hardware or software features.
Let me give you an example.
On a regular Dektop-Linux, if you do:
>> echo "1" > /sys/block/sda/device/delete
on the command line, you tell the kernel to flush the caches of the sda disk and spin it down. (so you could safely hotswap)
and if you do not replace your disk, but now want to get that disk spinning again, you put:
>> echo "0 0 0" > /sys/bus/scsi/devices/host1/scsi_host/host1/scan
into console.
So some of the Files there are read only (in like nothing happens when you change the content) , and others can be tampered with, but every change is gone after reboot.
except when you can manage to let some startup-skript make those changes, or you can edit the kernel-source default initialisation variables.
Click to expand...
Click to collapse
Yeah that makes sense. I tried it and realized that it was set back to zero every time i restarted so i figured it would be something like that. Luckily DT2W works now in the build so we don't have to do that anymore.
Thanks for the explanation though. Really appreciated.
Hey there
i followed your steps but i cant seem to find the 12-0038 folder after i2c. Any thoughts?
If you're using Lineage just install the DragonXiaKernel. Double Tap To Wake is working fine.
Tiago A said:
Hi guys;
I found a way to enable the double tap to wake up in LineageOS and RR for the mi mix.
Here it comes:
1: Donwload the Root Explorer and the QuickEdit;
2: With Root Explorer, go to sys/bus/i2c/12-0038/wakeup-mode;
3: Open that with Quick Edit and change the value "0" to "1";
4: Save it;
5: Have fun.
This is my first post here, take easy guys. I searched here for a solution for this problem, but didn't find anything about this two roms.
Thanks if it works!
PS: The only problem is that when you reboot the system, the system automatically returns to "0", so you will have to do the whole process again every time you restart the device. Does anyone know the solution to leave this fixed by default?
Click to expand...
Click to collapse
I installed "lineage-14.1-20170415-UNOFFICIAL-X3". I only get path till sys/bus/i2c/
There is no 12-0038/ folder. Can you help me out on this? I need it badly.
same here, no 12-0038
running smooth with 14.1-20170725-NIGHTLY-hammerhead though
Same for me on 14.1 LG g4 can't t find the file
Ls .../i2c/devices/
0-0006
0-a004
0-a006
1-0051
10-0048
11-003b
...
There iz no 12-0038 in both /i2c/ and /i2c/devices/
:crying:
Vipxpert said:
Ls .../i2c/devices/
0-0006
0-a004
0-a006
1-0051
10-0048
11-003b
...
There iz no 12-0038 in both /i2c/ and /i2c/devices/
:crying:
Click to expand...
Click to collapse
DT2W is working in RR (Oreo) just fine and I assume it's the same for Lineage 15.1 (Oreo). Which ROM are you using?
gavin19 said:
DT2W is working in RR (Oreo) just fine and I assume it's the same for Lineage 15.1 (Oreo). Which ROM are you using?
Click to expand...
Click to collapse
RR oreo as u said !

Need help building a SM-T555 (gt510lte) LineageOS ROM

Dear all,
I am trying to build a LineageOS 17.1 ROM for the Galaxy Tab A 9.7 (gt510lte) SM-T555.
Using the repos of @retiredtab and aala27's repos I managed to build a config that resulted in a buildable LineageOS that I could install and that shows the Lineage boot animation but crashes/reboots after a while.
Fyi, my forks for the GT510LTE (SM-T555) I currently maintain here: https://github.com/blizzard4591?tab=repositories
Questions to @retiredtab:
- What is your current local_manifest/roomservice? I could not locate this in your Github and used one posted by aala27 in a different thread, but it might be "off".
- Did you extract the required proprietary files by hand from stock ROMs or is there an automated way? I have "SM-T555_1_20190103084053_we4a668guy_fac" with T555XXU1CQHA/T555XXU1CRG1 that I know works on my T555.
- The repo "vendor-samsung-gt5note10wifi" in your Github only contains a branch for Lineage 18.1, is that intentional?
Sadly, I am a total noob in the area of building Lineage, so I might miss some obvious things!
I am willing to put in some time and effort to make this work, but I just do not know enough to do it efficiently.
If you can spare the time for a few hints, I believe I can make some progress!
Cheers
Update 1:
My image is working, i.e. it boots and gives a stable system.
Problem: Bluetooth does not work and crashes a lot, I have no clue what the problem is.
Problem: Audio is not working, I see a lot of "audio_route: unable to find path 'low-latency-playback speaker'
The system settings dialog is missing the "Android Patchlevel" information - is this expected? I am building using "repo sync, breakfast gt510lte, brunch gt510lte" - is this correct? I am just an idiot.
Update 2:
Bluetooth and Audio are working, SELinux is not, so permissive it is for now.
Builds available on request.
RandomAndroidTinkerer said:
- What is your current local_manifest/roomservice? I could not locate this in your Github and used one posted by aala27 in a different thread, but it might be "off".
Click to expand...
Click to collapse
It was there before, but I think after the switch to Xenforo on Dec 1, 2020, it might have gotten lost. It's there now and what I use to generate 17.1 for T550.
RandomAndroidTinkerer said:
- Did you extract the required proprietary files by hand from stock ROMs or is there an automated way? I have "SM-T555_1_20190103084053_we4a668guy_fac" with T555XXU1CQHA/T555XXU1CRG1 that I know works on my T555.
Click to expand...
Click to collapse
No, I just used what's in at https://github.com/Galaxy-MSM8916. Having said that, I found that for the SM-T350, it was missing some very important files so I grabbed those from stock.
RandomAndroidTinkerer said:
- The repo "vendor-samsung-gt5note10wifi" in your Github only contains a branch for Lineage 18.1, is that intentional?
Click to expand...
Click to collapse
gt5note10wifi is for the P550, not T550. You shouldn't be using that as the *.mk files won't copy the correct blobs for your device.
RandomAndroidTinkerer said:
Update 1:
My image is working, i.e. it boots and gives a stable system.
Problem: Bluetooth does not work and crashes a lot, I have no clue what the problem is.
The system settings dialog is missing the "Android Patchlevel" information - is this expected? I am building using "repo sync, breakfast gt510lte, brunch gt510lte" - is this correct?
Click to expand...
Click to collapse
Congrats on getting a bootable stable system. For bluetooth, you are probably missing a bluetooth blob. Look in your adb logcat (see below) for red messages that are bluetooth related. It might say something like "missing libbt-nv.so".
Missing Android Patchlevel means you don't have a property declared in your *.mk file. Right now, I can' t remember what it is, but I will look for it.
Instead of brunch, I do
Code:
TARGET_BUILD_TYPE=debug TARGET_BUILD_VARIANT=eng make -j2 bacon
This makes an engineering build that starts adb logcat immediately. That way, you can see all the messages as soon as the device boots. It helps a lot in troubleshooting stuck at boot animation problems.
The -j2 indicates how many CPU cores I have. If you have more, say 4, then -j4.
Once you solved all your problems and if you want to share your ROM, then do a brunch which is userdebug by default (for me, I just do a make -j2 bacon).
For adb logcat, I find
Code:
adb logcat -C | nl
helpful. It color codes the log so anything in red (error) needs attention. Nl numbers the log so it's easier to remember where you error messages are vs a timestamp.
For the Android patch level, show me a screenshot so I exactly what you mean.
RandomAndroidTinkerer said:
Problem: Audio is not working, I see a lot of "audio_route: unable to find path 'low-latency-playback speaker'
Click to expand...
Click to collapse
Try not to edit your initial post because I didnt' see the audio problem. Just make a new one so that I see new responses.
The audio problem is likely you don't have the correct definition in mixer_paths.xml. aala27 had the exact same problem. It's likely this
[UNOFFICIAL][ROM] LineageOS 17.1 for Galaxy Tab A 9.7[SM-P550]
NOTE: There is no S-pen support. If you need S-pen, DO NOT USE THIS ROM. I am not responsible for lost data, identity theft, lost money, security vulnerabilities, bricked devices or any other hardware or software malfunctions that comes as a...
forum.xda-developers.com
For SM-T550, the line inside mixer_paths.xml looks like
Code:
<path name="low-latency-playback speaker">
<ctl name="QUAT_MI2S_RX Audio Mixer MultiMedia5" value="1" />
</path>
You can see above, I have a path name that matches 'low-latency-playback speaker' exactly. Your mixer_paths.xml probably doesn't have this defined so you get no audio.
BTW, all the info I'm giving wasn't available via search engine when I first started. It's extremely frustrating to troubleshoot when I first started. Even now, I have problems with audio over bluetooth and stuttering audio over bluetooth for two platforms that both worked perfectly on the previous last major revision on Android.
Thank you so much; I know how hard this kind of initial research is!
Regarding the audio issues:
I tried that already, as you can see in https://github.com/blizzard4591/android_device_samsung_gt510lte/tree/lineage-17.1/configs/audio I used the config files from my stock image (I had assumed they would work, but they do not - why?) and then added said speaker there, but no luck, it still has the same error message. What am I misunderstanding?
Regarding Bluetooth:
Thanks to you tip, I added the libbt-nv.so module, but this did not change the situation.
I am now building a debug/eng build, but in the log I still see no messages of missing drivers/firmware/SOs. You can find my Logcat attached - could you take a look and tell me whether I am missing something? Should there be messages?
How did you find out that you were missing BLOBs?
RandomAndroidTinkerer said:
I tried that already, as you can see in https://github.com/blizzard4591/android_device_samsung_gt510lte/tree/lineage-17.1/configs/audio I used the config files from my stock image (I had assumed they would work, but they do not - why?) and then added said speaker there, but no luck, it still has the same error message. What am I misunderstanding?
Click to expand...
Click to collapse
You need to check the actual rom image to see if the mixer_paths.xml is correct. Do
Code:
adb pull /system/vendor/etc/mixer_paths.xml
and compare if the two are the same.
RandomAndroidTinkerer said:
Regarding Bluetooth:
Thanks to you tip, I added the libbt-nv.so module, but this did not change the situation.
Click to expand...
Click to collapse
I only guessed at what might be missing. The logs will tell who what's missing.
RandomAndroidTinkerer said:
You can find my Logcat attached - could you take a look and tell me whether I am missing something?
Click to expand...
Click to collapse
I see no log attached. Zip the log and then attach it.
You need to check the actual rom image to see if the mixer_paths.xml is correct. Do
Code:
adb pull /system/vendor/etc/mixer_paths.xml
and compare if the two are the same.
Click to expand...
Click to collapse
Yes, the file was incorrect, I guess the path
Code:
$(LOCAL_PATH)/configs/audio/mixer_paths.xml:$(TARGET_COPY_OUT_VENDOR)/etc/mixer_paths.xml
did not resolve to where it should, I changed that, once the build is done I will check.
I see no log attached. Zip the log and then attach it.
Click to expand...
Click to collapse
Interesting, I can see it, but I attached it as ZIP!
The log you attached is missing all the bootup sequence. You need to start adb logcat as soon as the device boots.
Audio
=====
Your mixer_paths.xml should be in /vendor/etc. /system/vendor is usually a link to /vendor. From my P550.
Code:
$ adb shell
gt5note10wifi:/ # ls -al vendor
lrw-r--r-- 1 root root 14 2008-12-31 17:00 vendor -> /system/vendor
If you are using the 17.1 msm8916-common repo, see lines 80 to 83
android_device_samsung_msm8916-common/msm8916.mk at lineage-17.1 · Galaxy-MSM8916/android_device_samsung_msm8916-common
Common MSM8916 tree for Samsung devices. Contribute to Galaxy-MSM8916/android_device_samsung_msm8916-common development by creating an account on GitHub.
github.com
may be overwriting your stock mixer_paths. I would comment out lines 80 to 83 as a test.
Bluetooth
=========
You have tons of errors with your bluetooth. If you view your logcat in color, these are all in red.
Code:
04-01 13:19:22.910 1212 1212 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
04-01 13:19:22.911 1212 1212 F DEBUG : LineageOS Version: '17.1-20210401-UNOFFICIAL-gt510lte'
04-01 13:19:22.911 1212 1212 F DEBUG : Build fingerprint: 'samsung/gt510ltexx/gt510lte:7.1.1/NMF26X/T555XXU1CQI8:user/release-keys'
04-01 13:19:22.911 1212 1212 F DEBUG : Revision: '8'
04-01 13:19:22.911 1212 1212 F DEBUG : ABI: 'arm'
04-01 13:19:22.912 1212 1212 F DEBUG : Timestamp: 2021-04-01 13:19:22+0200
04-01 13:19:22.912 1212 1212 F DEBUG : pid: 866, tid: 1203, name: bt_hci_thread >>> com.android.bluetooth <<<
04-01 13:19:22.912 1212 1212 F DEBUG : uid: 1002
04-01 13:19:22.912 1212 1212 F DEBUG : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
04-01 13:19:22.912 1212 1212 F DEBUG : Abort message: '[0401/131922.772914:FATAL:hci_layer_android.cc(119)] Check failed: btHci != nullptr.
When it crashes hard like above, there's no way bluetooth will work.
Again, if you are using the 17.1 msm8916-common repo, it's missing the bluetooth entries for manifest.xml and msm8916.mk.
For the manifest.xml you need something like
Code:
<hal format="hidl">
<name>android.hardware.bluetooth</name>
<transport arch="32+64">passthrough</transport>
<version>1.0</version>
<interface>
<name>IBluetoothHci</name>
<instance>default</instance>
</interface>
</hal>
For msm8916.mk, you need
Code:
# Bluetooth
PRODUCT_PACKAGES += \
[email protected]
[Sorry for the delay]
Okay, I think I ironed out most of the issues.
What is confirmed working:
- WLAN
- Bluetooth
- Audio
- GPS (though the initial fix took 30min+...)
What does not work
- SELinux
WLAN:
I see a messages like
wificond: No Offload Service available
wificond: Offload HAL not supported
wificond: Failed to get NL80211_ATTR_EXT_FEATURES
Click to expand...
Click to collapse
Is that an issue? I don't know...
I see a lot of messages from the PowerHAL:
QTI PowerHAL: Failed to acquire lock.
Click to expand...
Click to collapse
I already tried https://review.statixos.com/c/android_device_essential_mata/+/1626/1 but that apparently was not enough.
SELInux:
I added the policies by https://github.com/VirsysElectron/android_device_samsung_gt510wifi and made them work, but it seems they are not really working.
Example:
I/init ( 233): type=1400 audit(0.0:4): avc: denied { mounton } for path="/firmware-modem" dev="mmcblk0p25" ino=27 scontext=u:r:init:s0 tcontext=ubject_r:tmp_root_mount_file:s0 tclass=dir permissive=1
I/e2fsck ( 253): type=1400 audit(0.0:5): avc: denied { read } for name="mmcblk0p13" dev="tmpfs" ino=7580 scontext=u:r:fsck:s0 tcontext=ubject_r:efs_block_device:s0 tclass=blk_file permissive=1
I/e2fsck ( 253): type=1400 audit(0.0:6): avc: denied { open } for path="/dev/block/mmcblk0p13" dev="tmpfs" ino=7580 scontext=u:r:fsck:s0 tcontext=ubject_r:efs_block_device:s0 tclass=blk_file permissive=1
I/e2fsck ( 253): type=1400 audit(0.0:7): avc: denied { write } for name="mmcblk0p13" dev="tmpfs" ino=7580 scontext=u:r:fsck:s0 tcontext=ubject_r:efs_block_device:s0 tclass=blk_file permissive=1
I/e2fsck ( 253): type=1400 audit(0.0:8): avc: denied { ioctl } for path="/dev/block/mmcblk0p13" dev="tmpfs" ino=7580 ioctlcmd=127c scontext=u:r:fsck:s0 tcontext=ubject_r:efs_block_device:s0 tclass=blk_file permissive=1
I/init ( 1): type=1400 audit(0.0:9): avc: denied { relabelfrom } for name="rmt_storage" dev="debugfs" ino=6571 scontext=u:r:init:s0 tcontext=ubject_r:debugfs_rmt:s0 tclass=dir permissive=1
I/init ( 1): type=1400 audit(0.0:10): avc: denied { relabelfrom } for name="rmts" dev="debugfs" ino=6574 scontext=u:r:init:s0 tcontext=ubject_r:debugfs_rmt:s0 tclass=file permissive=1
Click to expand...
Click to collapse
I declare
/firmware-modem(/.*)? ubject_r:tmp_root_mount_file:s0
Click to expand...
Click to collapse
in device/samsung/gt510lte/sepolicy/file_contexts, but it is not applied:
dr-xr-x--- 3 system drmrpc ubject_r:vfat:s0 16384 1970-01-01 01:00 firmware-modem
Click to expand...
Click to collapse
And I really do not know enough about SELinux to effectively engage this.
@retiredtab: How did you solve SELinux in your builds for the T550?
RandomAndroidTinkerer said:
- GPS (though the initial fix took 30min+...)
Click to expand...
Click to collapse
That seems like a really long time. Did you go outside to do the GPS reading? Sometimes it makes a difference if you are in or outside. You should do an adb logcat while testing out GPS. It might show some clues as to why it takes so long.
With the P550 and using GPStest from
GPSTest | F-Droid - Free and Open Source Android App Repository
An app for testing GPS and GNSS capabilities of a device
f-droid.org
I get a lock in 48 seconds by the window.
RandomAndroidTinkerer said:
What does not work
- SELinux
Click to expand...
Click to collapse
You need to read posts 202 and beyond at
[ROM][SM-T350][UNOFFICIAL][crDroidAndroid-10.0][v6.17][ANDROID 10] Galaxy Tab A 8.0
Finally this thread is back :)
forum.xda-developers.com
I list the tools that you can use to help build selinux policies. As I wrote in the other thread, do you blindly trust the policies generated by the tools? I'm not an expert so I don't know and it's highly dependent on each hardware device.
I built an image with selinux enforcing as a test sometime in March and while it works, I'm not confident and ready to release that. In addition, each device will require it's own set of selinux policies. What might work for the P550 may not work on the T555 due to differences in hardware (LTE, S-pen).
Building the correct selinux policies is an iterative exercise. Wipe everything on your device, format data. Install the ROM only. You grant the initial batch of policies, reboot, look at logs, grant some more and repeat until they are gone. You should do this with the ROM only. Don't load gapps, games, apps, etc and then run selinux.
RandomAndroidTinkerer said:
Is that an issue? I don't know...
Click to expand...
Click to collapse
I see them in my own builds and so far there's been no problem.
RandomAndroidTinkerer said:
I see a lot of messages from the PowerHAL:
Click to expand...
Click to collapse
Same as above.
RandomAndroidTinkerer said:
I already tried https://review.statixos.com/c/android_device_essential_mata/+/1626/1 but that apparently was not enough.
Click to expand...
Click to collapse
You will find through experience and more building that what works for one platform may not work for another. It's highly dependent on the device and code specific to that device.
RandomAndroidTinkerer said:
SELInux:
I added the policies by https://github.com/VirsysElectron/android_device_samsung_gt510wifi and made them work, but it seems they are not really working.
Click to expand...
Click to collapse
In order to boot selinux enforcing, you need to remove line 140 from
android_device_samsung_msm8916-common/BoardConfigCommon.mk at lineage-17.1 · blizzard4591/android_device_samsung_msm8916-common
Common MSM8916 tree for Samsung devices. Contribute to blizzard4591/android_device_samsung_msm8916-common development by creating an account on GitHub.
github.com
Also, I'm not an expert in selinux, but I don't know why you would permit untrusted_app.te, untrusted_app_25.te and untrusted_app_27.te?
retiredtab said:
That seems like a really long time. Did you go outside to do the GPS reading? Sometimes it makes a difference if you are in or outside. You should do an adb logcat while testing out GPS. It might show some clues as to why it takes so long.
With the P550 and using GPStest from
GPSTest | F-Droid - Free and Open Source Android App Repository
An app for testing GPS and GNSS capabilities of a device
f-droid.org
I get a lock in 48 seconds by the window.
Click to expand...
Click to collapse
I think it was just the initial, first fix, and yes, I was not in the best position. Now that it knows where and when it is, a new fix even inside takes a couple of seconds. I used the same tool, also from F-Droid
retiredtab said:
You need to read posts 202 and beyond at
[ROM][SM-T350][UNOFFICIAL][crDroidAndroid-10.0][v6.17][ANDROID 10] Galaxy Tab A 8.0
Finally this thread is back :)
forum.xda-developers.com
I list the tools that you can use to help build selinux policies. As I wrote in the other thread, do you blindly trust the policies generated by the tools? I'm not an expert so I don't know and it's highly dependent on each hardware device.
I built an image with selinux enforcing as a test sometime in March and while it works, I'm not confident and ready to release that. In addition, each device will require it's own set of selinux policies. What might work for the P550 may not work on the T555 due to differences in hardware (LTE, S-pen).
Building the correct selinux policies is an iterative exercise. Wipe everything on your device, format data. Install the ROM only. You grant the initial batch of policies, reboot, look at logs, grant some more and repeat until they are gone. You should do this with the ROM only. Don't load gapps, games, apps, etc and then run selinux.
Click to expand...
Click to collapse
I had to load Magisk and LiveBoot to even get the early-boot log. Using ADB logcat I was unable to get a log from "system start" - the adb process would hang and wait for the device to be fully booted. Even afterwards, no messages from boot. I had USB debugging enabled, default USB conf "file transfer", etc.
Any ideas what I am doing wrong?
retiredtab said:
I see them in my own builds and so far there's been no problem.
Same as above.
You will find through experience and more building that what works for one platform may not work for another. It's highly dependent on the device and code specific to that device.
In order to boot selinux enforcing, you need to remove line 140 from
android_device_samsung_msm8916-common/BoardConfigCommon.mk at lineage-17.1 · blizzard4591/android_device_samsung_msm8916-common
Common MSM8916 tree for Samsung devices. Contribute to blizzard4591/android_device_samsung_msm8916-common development by creating an account on GitHub.
github.com
Also, I'm not an expert in selinux, but I don't know why you would permit untrusted_app.te, untrusted_app_25.te and untrusted_app_27.te?
Click to expand...
Click to collapse
Good catch - I simply copied the policies from VirsysElectron to start, but since they do not really work, I don't think I will continue much on this path. I share your opinion on old drivers and the greater picture. I had hoped the old policies would work for most of the basics, but they do not.
RandomAndroidTinkerer said:
I had to load Magisk and LiveBoot to even get the early-boot log.
Click to expand...
Click to collapse
For an eng build, there's no need for Magisk and LiveBoot to get an adb logcat. Part of the eng parameters is that it enables adb right away.
For developing selinux policies, you leave it in permissive first, develop the policies as I stated and then when you think you are done, then enable selinux enforcing. More at
Validating SELinux | Android Open Source Project
source.android.com
RandomAndroidTinkerer said:
Good catch - I simply copied the policies from VirsysElectron to start,
Click to expand...
Click to collapse
And that's the problem right there. It's so easy to kang or copy someone else's work today (legal or illegal) that some don't bother to check if it's right in the first place. I'm not saying VirsysElectron code is wrong, he may have a good reason why those files are generated.
I also fall into that boat. I use the public open source repos, but there's no way that I have the expertise or time to check everything in the repo for errors, security vulnerabilities, code correctness, etc.
retiredtab said:
For an eng build, there's no need for Magisk and LiveBoot to get an adb logcat. Part of the eng parameters is that it enables adb right away.
Click to expand...
Click to collapse
No, that is the problem - it did not. I am using eng-builds and, as I described, adb did not work, and I have no clue why.
retiredtab said:
For developing selinux policies, you leave it in permissive first, develop the policies as I stated and then when you think you are done, then enable selinux enforcing. More at
Validating SELinux | Android Open Source Project
source.android.com
Click to expand...
Click to collapse
I read that and some other introductions to SELinux, I get the general idea and concept - but as shown in my example, the labeling rule
/firmware-modem(/.*)? u: object_r :tmp_root_mount_file:s0
Click to expand...
Click to collapse
is not applied, I did not find anything that would tell me why or how to debug such an issue.
retiredtab said:
And that's the problem right there. It's so easy to kang or copy someone else's work today (legal or illegal) that some don't bother to check if it's right in the first place. I'm not saying VirsysElectron code is wrong, he may have a good reason why those files are generated.
Click to expand...
Click to collapse
I started writing my own policies from scratch (its somewhere in the repo history), but I first wanted to get my bearings, see how things work - ideally from a known, working starting point - which was a good idea, as otherwise the issue mentioned above regarding the labeling rule that does not get applied would have cost me much more sanity than just questioning someone else's code
Hello RandomAndroidTinkerer
I also own a T555, currently with TWRP 3.3.1 and LineageOS 16.0 from Virsys( 20191231). It's very stable, except the SIM didn't work.
Am of course interested in your image and would like to test it out. Which TWRP version do you use ?
Friendly greetings
Schaagi
Hallo RandomAndroidTinkerer,
thank you very much for your work and of course thanks for retiredtab and the others for their work This is my first post here and I you are the only one I found who builded an actual image. I'm very interested in testing your build. Could you send me an link, please? Thank you and bye bye.
Hi, I applied for an uploader account at AndroidFileHost, once this is granted I will upload a current build.
Current engineering build is up: https://www.androidfilehost.com/?w=files&flid=324776
I am using TWRP 3.1.0 from here.
Be kind on the feedback
RandomAndroidTinkerer said:
Current engineering build is up: https://www.androidfilehost.com/?w=files&flid=324776
I am using TWRP 3.1.0 from here.
Click to expand...
Click to collapse
For fun, I tried it on the P550 and not surprisingly, it doesn't boot. It doesn't even out adb logcat.
LineageOS also builds it's own recovery.img as another recovery option to TWRP. It's not as user friendly and lacks some features, but it's functional.
Thank you so much for your image - I am very excited to test it. Feedback follows in the next days.

Categories

Resources