Discussion on SysScope

Search This thread
By:
Advanced…
dwitherell

dwitherell

Retired Forum Moderator
May 2, 2011
4,061
9,253
Well I don't know if I would quite consider myself a developer - as such I am a bit anomalous and am much more comfortable in the land of smali lol - dex2jar is a pretty handy tool though, thanks!
 
A

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
A

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
0tt0m@n said:
@Aou
That means your files are not deodexed. Grab them from a deodexed stock alike rom.
Click to expand...
Click to collapse

Thanks. I was beginning to gather that on my own, after pulling a few other SecSettings.apk's from other deodex'd ROMs. Now I'm just trying to find one which hasn't been molested too badly from its original state. I'd like to remain as stock as possible for the time being. ;)
 
B

bahtsiz_bedevi

Senior Member
Dec 12, 2011
440
190
Aou said:
Thanks. I was beginning to gather that on my own, after pulling a few other SecSettings.apk's from other deodex'd ROMs. Now I'm just trying to find one which hasn't been molested too badly from its original state. I'd like to remain as stock as possible for the time being. ;)
Click to expand...
Click to collapse
I suggest you to use a good comparing tool like http://www.diffnow.com/ or winmerge. Compare our modified ones and your original file. It'll help you a lot
 
A

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
0tt0m@n said:
I suggest you to use a good comparing tool like http://www.diffnow.com/ or winmerge. Compare our modified ones and your original file. It'll help you a lot
Click to expand...
Click to collapse

Yeah, the changes are pretty fricken' scary inside Status.smali. "Holy crap, what did I get myself into?" were my first thoughts. I'm no programmer, just a jack-of-all-trades IT guy.

From what I can tell, all I really needed to edit in SecSettings.apk was this:
Code: 
.method private changeSysScopeStatus()V
    .registers 8

    .prologue
    const-wide/16 v3, 0x3e8

    const v6, 0x7f09013e

    const/4 v5, -0x1

    .line 956
    const-string v0, "sysscope_status"

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->findPreference(Ljava/lang/CharSequence;)Landroid/preference/Preference;

    move-result-object v2

    .line 958
    invoke-static {}, Landroid/os/SystemClock;->uptimeMillis()J

    move-result-wide v0

    div-long/2addr v0, v3

    .line 959
    invoke-static {}, Landroid/os/SystemClock;->elapsedRealtime()J

    move-result-wide v0

    div-long/2addr v0, v3

    .line 961
    const-wide/16 v3, 0x0

    cmp-long v3, v0, v3

    if-nez v3, :cond_1e

    .line 962
    const-wide/16 v0, 0x1

    .line 965
    :cond_1e
    iget v3, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

    if-ne v3, v5, :cond_30

    const-wide/16 v3, 0x78

    cmp-long v0, v0, v3

    if-lez v0, :cond_30

    .line 966
    invoke-virtual {p0, v6}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    .line 977
    :goto_2c
    invoke-virtual {v2, v0}, Landroid/preference/Preference;->setSummary(Ljava/lang/CharSequence;)V

    .line 978
    return-void

    .line 968
    :cond_30
    iget v0, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

    const/4 v1, 0x2

    if-ne v0, v1, :cond_3a

    .line 969
    invoke-virtual {p0, v6}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    goto :goto_2c

    .line 970
    :cond_3a
    iget v0, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

    if-ne v0, v5, :cond_46

    .line 971
    const v0, 0x7f09013f

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    goto :goto_2c

    .line 973
    :cond_46
    const v0, 0x7f09013d

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    goto :goto_2c
.end method

changing it to:
Code: 
.method private changeSysScopeStatus()V
    .registers 8

    .prologue
    const v6, 0x7f09013e

    .line 956
    const-string v0, "sysscope_status"

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->findPreference(Ljava/lang/CharSequence;)Landroid/preference/Preference;

    move-result-object v2

    .line 966
    invoke-virtual {p0, v6}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    .line 977
    invoke-virtual {v2, v0}, Landroid/preference/Preference;->setSummary(Ljava/lang/CharSequence;)V

    .line 978
    return-void
.end method

After much trouble, and my first experience (ever) deodexing my own apk, decompiling/recompiling with smali/baksmali, and then re-odexing my apk... I think I've done it. The "Device Status" still shows "Custom" but the padlock/custom bootloader image is GONE.

I've run out of time for today, but I'll be looking into this a bit more to figure out what the other changes you made were, so that I can remove the "custom" status inside the About Phone. Also, I've taken some notes, so I might be able to make a write-up on how to do this for us S4 people, and perhaps provide my re-compiled work.

It's exciting. It really is.

EDIT (followup): Uh, never mind about it working. Sure, I have no custom boot logo anymore, but I also have no phone service, I just realized. >_< ... I might have failed on the re-odexing part, methinks.
 
Last edited:
B

bahtsiz_bedevi

Senior Member
Dec 12, 2011
440
190
Aou said:
Yeah, the changes are pretty fricken' scary inside Status.smali. "Holy crap, what did I get myself into?" were my first thoughts. I'm no programmer, just a jack-of-all-trades IT guy.

From what I can tell, all I really needed to edit in SecSettings.apk was this:
Code: 
.method private changeSysScopeStatus()V
    .registers 8

    .prologue
    const-wide/16 v3, 0x3e8

    const v6, 0x7f09013e

    const/4 v5, -0x1

    .line 956
    const-string v0, "sysscope_status"

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->findPreference(Ljava/lang/CharSequence;)Landroid/preference/Preference;

    move-result-object v2

    .line 958
    invoke-static {}, Landroid/os/SystemClock;->uptimeMillis()J

    move-result-wide v0

    div-long/2addr v0, v3

    .line 959
    invoke-static {}, Landroid/os/SystemClock;->elapsedRealtime()J

    move-result-wide v0

    div-long/2addr v0, v3

    .line 961
    const-wide/16 v3, 0x0

    cmp-long v3, v0, v3

    if-nez v3, :cond_1e

    .line 962
    const-wide/16 v0, 0x1

    .line 965
    :cond_1e
    iget v3, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

    if-ne v3, v5, :cond_30

    const-wide/16 v3, 0x78

    cmp-long v0, v0, v3

    if-lez v0, :cond_30

    .line 966
    invoke-virtual {p0, v6}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    .line 977
    :goto_2c
    invoke-virtual {v2, v0}, Landroid/preference/Preference;->setSummary(Ljava/lang/CharSequence;)V

    .line 978
    return-void

    .line 968
    :cond_30
    iget v0, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

    const/4 v1, 0x2

    if-ne v0, v1, :cond_3a

    .line 969
    invoke-virtual {p0, v6}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    goto :goto_2c

    .line 970
    :cond_3a
    iget v0, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

    if-ne v0, v5, :cond_46

    .line 971
    const v0, 0x7f09013f

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    goto :goto_2c

    .line 973
    :cond_46
    const v0, 0x7f09013d

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    goto :goto_2c
.end method
changing it to:
Code: 
.method private changeSysScopeStatus()V
    .registers 8

    .prologue
    const v6, 0x7f09013e

    .line 956
    const-string v0, "sysscope_status"

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->findPreference(Ljava/lang/CharSequence;)Landroid/preference/Preference;

    move-result-object v2

    .line 966
    invoke-virtual {p0, v6}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    .line 977
    invoke-virtual {v2, v0}, Landroid/preference/Preference;->setSummary(Ljava/lang/CharSequence;)V

    .line 978
    return-void
.end method
After much trouble, and my first experience (ever) deodexing my own apk, decompiling/recompiling with smali/baksmali, and then re-odexing my apk... I think I've done it. The "Device Status" still shows "Custom" but the padlock/custom bootloader image is GONE.

I've run out of time for today, but I'll be looking into this a bit more to figure out what the other changes you made were, so that I can remove the "custom" status inside the About Phone. Also, I've taken some notes, so I might be able to make a write-up on how to do this for us S4 people, and perhaps provide my re-compiled work.

It's exciting. It really is.

EDIT (followup): Uh, never mind about it working. Sure, I have no custom boot logo anymore, but I also have no phone service, I just realized. >_< ... I might have failed on the re-odexing part, methinks.
Click to expand...
Click to collapse

You don't have re-odex it, copy it as-is. Just don't forget to remove SecSettings.odex.
From your original code All I can say, it's pretty much the same to ours. That's a good news for you :)
 
A

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
0tt0m@n said:
You don't have re-odex it, copy it as-is. Just don't forget to remove SecSettings.odex.
From your original code All I can say, it's pretty much the same to ours. That's a good news for you :)
Click to expand...
Click to collapse

Okay, got it this time. I refined my notes and did not re-odex it this time (yet... still planning to!). I know of deleting the .odex file whenever you deodex something, that wasn't the problem at all.

As for the code, it seems to work great! My device status shows "custom" but I have the original boot logo. All is well. Next up, I need to review your notes through this thread and on GitHub to determine what exactly I need to edit to get the Device Status to show Official always.

I haven't tried deleting SysScope.apk yet - I'm going to wait until I get this next step completed. ;)

EDIT: Also, if anyone else is following along, I am planning to post all my notes as a guide here on XDA, but over in the S4 forums. Apart from code changes, the notes should apply to most Galaxy devices with SysScope...
 
B

bahtsiz_bedevi

Senior Member
Dec 12, 2011
440
190
Aou said:
Okay, got it this time. I refined my notes and did not re-odex it this time (yet... still planning to!). I know of deleting the .odex file whenever you deodex something, that wasn't the problem at all.

As for the code, it seems to work great! My device status shows "custom" but I have the original boot logo. All is well. Next up, I need to review your notes through this thread and on GitHub to determine what exactly I need to edit to get the Device Status to show Official always.

I haven't tried deleting SysScope.apk yet - I'm going to wait until I get this next step completed. ;)

EDIT: Also, if anyone else is following along, I am planning to post all my notes as a guide here on XDA, but over in the S4 forums. Apart from code changes, the notes should apply to most Galaxy devices with SysScope...
Click to expand...
Click to collapse
Well done ;)

Actually that part of the modification belongs to dwitherell
At first I tried to change changeSysScopeStatus() to show device status always as "Normal" but I couldn't succeed
Whenever I tried to get into "Status" section, SecSettings was crashing. Therefore I removed that code completely.
At that time thankfully dwitherell came up with a solution :) (he has more experience with smali than I do.)
I wasn't deleting an intent listener (Status$2.smali) that were causing error.

This modification he made hopefully will give you a clue ;) https://github.com/sinancetinkaya/D.../com/android/settings/deviceinfo/Status.smali
Just focus on lines 509-533 and 1709-1731. Ignore other lines because they are just the reverts of my modification

You have to delete SysScope because it triggers "Custom" system status on the bootloader screen.
If you have "Custom" system status there, you have to make it "Official" manually.
This mod doesn't convert "Custom" to "Official" on the bootloader screen but prevents it to be "Custom" again.
 
Last edited:
A

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
0tt0m@n said:
Well done ;)

Actually that part of the modification belongs to dwitherell
At first I tried to change changeSysScopeStatus() to show device status always as "Normal" but I couldn't succeed
Whenever I tried to get into "Status" section, SecSettings was crashing. Therefore I removed that code completely.
At that time thankfully dwitherell came up with a solution :) (he has more experience with smali than I do.)
I wasn't deleting an intent listener (Status$2.smali) that were causing error.

This modification he made hopefully will give you a clue ;) https://github.com/sinancetinkaya/D.../com/android/settings/deviceinfo/Status.smali
Just focus on lines 509-533 and 1709-1731. Ignore other lines because they are just the reverts of my modification

You have to delete SysScope because it triggers "Custom" system status on the bootloader screen.
If you have "Custom" system status there, you have to make it "Official" manually.
This mod doesn't convert "Custom" to "Official" on the bootloader screen but prevents it to be "Custom" again.
Click to expand...
Click to collapse

Actually, I picked up on both those edits. I went through Status.smali and looked through all the differences between my files and the one that's in the github, and made several changes. The good news: it no longer shows "Custom" in the Device Status. The bad news: it now shows "Unsuccessful". hehe

I still didn't get the custom logo/padlock on boot, even with SysScope.apk still installed and functional. Interestingly enough, as soon as I uninstall it, I lose my 3G/4G (no signal) and everything goes nuts. Even restoring it from a TiBu backup doesn't work - I'm forced to restore from a nandroid backup.

Here are my edits:

Remove:
Code: 
.field private isSysScopeStatus:I

Remove:
Code: 
.field private mSysScopeReceiver:Landroid/content/BroadcastReceiver;

Remove:
Code: 
    .line 264
    new-instance v0, Lcom/android/settings/deviceinfo/Status$2;

    invoke-direct {v0, p0}, Lcom/android/settings/deviceinfo/Status$2;-><init>(Lcom/android/settings/deviceinfo/Status;)V

    iput-object v0, p0, Lcom/android/settings/deviceinfo/Status;->mSysScopeReceiver:Landroid/content/BroadcastReceiver;

Remove:
Code: 
    .line 216
    const/4 v0, -0x1

    iput v0, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

Remove:
Code: 
.method static synthetic access$402(Lcom/android/settings/deviceinfo/Status;I)I
    .registers 2
    .parameter "x0"
    .parameter "x1"

    .prologue
    .line 102
    iput p1, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

    return p1
.end method

.method static synthetic access$500(Lcom/android/settings/deviceinfo/Status;)V
    .registers 1
    .parameter "x0"

    .prologue
    .line 102
    invoke-direct {p0}, Lcom/android/settings/deviceinfo/Status;->changeSysScopeStatus()V

    return-void
.end method

Remove:
Code: 
   .line 687
    iget-object v0, p0, Lcom/android/settings/deviceinfo/Status;->mSysScopeReceiver:Landroid/content/BroadcastReceiver;

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->unregisterReceiver(Landroid/content/BroadcastReceiver;)V

Remove:
Code: 
   .line 657
    iget-object v1, p0, Lcom/android/settings/deviceinfo/Status;->mSysScopeReceiver:Landroid/content/BroadcastReceiver;

    new-instance v2, Landroid/content/IntentFilter;

    const-string v3, "com.sec.intent.action.SYSSCOPESTATUS"

    invoke-direct {v2, v3}, Landroid/content/IntentFilter;-><init>(Ljava/lang/String;)V

    invoke-virtual {p0, v1, v2}, Lcom/android/settings/deviceinfo/Status;->registerReceiver(Landroid/content/BroadcastReceiver;Landroid/content/IntentFilter;)Landroid/content/Intent;

Change:
Code: 
    .line 952
    const v1, 0x7f09013f
to
Code: 
    .line 952
    const v1, 0x7f090123

Change:
Code: 
.method private changeSysScopeStatus()V
    .registers 8

    .prologue
    const-wide/16 v3, 0x3e8

    const v6, 0x7f09013e

    const/4 v5, -0x1

    .line 956
    const-string v0, "sysscope_status"

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->findPreference(Ljava/lang/CharSequence;)Landroid/preference/Preference;

    move-result-object v2

    .line 958
    invoke-static {}, Landroid/os/SystemClock;->uptimeMillis()J

    move-result-wide v0

    div-long/2addr v0, v3

    .line 959
    invoke-static {}, Landroid/os/SystemClock;->elapsedRealtime()J

    move-result-wide v0

    div-long/2addr v0, v3

    .line 961
    const-wide/16 v3, 0x0

    cmp-long v3, v0, v3

    if-nez v3, :cond_1e

    .line 962
    const-wide/16 v0, 0x1

    .line 965
    :cond_1e
    iget v3, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

    if-ne v3, v5, :cond_30

    const-wide/16 v3, 0x78

    cmp-long v0, v0, v3

    if-lez v0, :cond_30

    .line 966
    invoke-virtual {p0, v6}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    .line 977
    :goto_2c
    invoke-virtual {v2, v0}, Landroid/preference/Preference;->setSummary(Ljava/lang/CharSequence;)V

    .line 978
    return-void

    .line 968
    :cond_30
    iget v0, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

    const/4 v1, 0x2

    if-ne v0, v1, :cond_3a

    .line 969
    invoke-virtual {p0, v6}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    goto :goto_2c

    .line 970
    :cond_3a
    iget v0, p0, Lcom/android/settings/deviceinfo/Status;->isSysScopeStatus:I

    if-ne v0, v5, :cond_46

    .line 971
    const v0, 0x7f09013f

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    goto :goto_2c

    .line 973
    :cond_46
    const v0, 0x7f09013d

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    goto :goto_2c
.end method
to
Code: 
.method private changeSysScopeStatus()V
    .registers 4

    .prologue
    const v1, 0x7f090123

    .line 956
    const-string v0, "sysscope_status"

    invoke-virtual {p0, v0}, Lcom/android/settings/deviceinfo/Status;->findPreference(Ljava/lang/CharSequence;)Landroid/preference/Preference;

    move-result-object v2

    .line 966
    invoke-virtual {p0, v1}, Lcom/android/settings/deviceinfo/Status;->getString(I)Ljava/lang/String;

    move-result-object v0

    .line 977
    invoke-virtual {v2, v0}, Landroid/preference/Preference;->setSummary(Ljava/lang/CharSequence;)V

    .line 978
    return-void
.end method


I guess something is still calling SysScope.apk?

EDIT/UPDATE:

It appears that SysScope.apk (and its counterpart on the S4 EdmSysScopeService.apk with its odex file) must both be removed together, while the device is stopped, and at the same time as applying the modified SecSettings.apk. If you fail to do all of this within the same "stop", the system freaks out and kills your cell signal somehow. Very strange. I've added this to my notes.

It still shows "Unsuccessful" though. Not a huge deal, though... At least SysScope is gone!


EDIT AGAIN:

0x7f090123 is obviously the status that we're returning. But where is this kept? What are the other options? Originally, mine said 0x7f09013e.
 
Last edited:
B

bahtsiz_bedevi

Senior Member
Dec 12, 2011
440
190
First of all 0x7f090123 code is "Normal" status for XXDME1 N7100.
Your original code is saying it's 0x7f09013d but you have check it in public.xml

Please read https://github.com/sinancetinkaya/DeviceStatus#for-those-on-other-variants-of-the-note-ii
Once you are to that point you can use the information here to see where things were changed and use that as a means to replicate the changes in your own files. Things may not match exactly (they may though as well), so you will have to be mindful of what you are changing and why. IN PARTICULAR - there are a few places where methods were altered and resource ids were changed (not many places, but a few). These may be the same for you, but you should not assume so.
Click to expand...
Click to collapse
 
  • Like
Reactions: Aou
dwitherell

dwitherell

Retired Forum Moderator
May 2, 2011
4,061
9,253
Aou said:
...0x7f090123 is obviously the status that we're returning. But where is this kept? What are the other options? Originally, mine said 0x7f09013e.
Click to expand...
Click to collapse
You need to decompile fully (using apktool) SecSettings and look for the resource id (in /res/values/public.xml) of the string that reports back the status Normal (found in /res/values/strings.xml) to find the correct resource id to use instead of 0x7f090123.
 
  • Like
Reactions: Aou
A

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
0tt0m@n said:
First of all 0x7f090123 code is "Normal" status for XXDME1 N7100.
Your original code is saying it's 0x7f09013d but you have check it in public.xml

Please read https://github.com/sinancetinkaya/DeviceStatus#for-those-on-other-variants-of-the-note-ii
Click to expand...
Click to collapse

Oh, awesome. I feel a tad bit stupid now, because I read through that once (not knowing what you were talking about), and then promptly forgot about it until now.

0tt0m@n said:
S4 is a very popular device. Can't you ask someone for help who has more experience with smali?
Click to expand...
Click to collapse

It is indeed popular, but it seems that the devs for the S4 really don't care about SysScope. Otherwise, people are just using the Xposed Mod that deals with this. Personally, once I found out about SysScope, I wanted to eradicate it.

dwitherell said:
You need to decompile fully (using apktool) SecSettings and look for the resource id (in /res/values/public.xml) of the string that reports back the status Normal (found in /res/values/strings.xml) to find the correct resource id to use instead of 0x7f090123.
Click to expand...
Click to collapse

"decompile fully" are the words I needed, thank you! I had decompiled it before, but not fully ("option 9"). I've used this option with other stuff, but didn't think to use it here. Thank you. I found the string I was looking for. I couldn't find any sort of hex numbers for the strings, but I did find that the "Official" string was exactly two strings prior to "Scanning...", so I simply adjusted the number accordingly.

Just as 0tt0m@n suggested: 0x7f09013d

I think I'm good-to-go. I'm updating my notes and cleaning them up further. I should have a write-up ready soon!
 
You must log in or register to reply here.

Similar threads

alephzain
[ROOT][SECURITY] Root exploit on Exynos
Replies
36
Views
467K
hartlezzevolved
hartlezzevolved
D
[DEV][Porting] Ubuntu Touch on Galaxy Note II (GT-N7100)
Replies
182
Views
217K
psndna88
psndna88
A
CSC feature.xml Discussions
Replies
7
Views
22K
K
kbythwood
joeldroid
Porting AOSP Contacts & Dialer for Samsung Roms
Replies
15
Views
19K
MattBooth
MattBooth
HybriDelta
Secret menu on settings [4.1.2]
Replies
5
Views
9K
B
bahtsiz_bedevi

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 8
    B
    bahtsiz_bedevi
    [Update] Solution is here SysScopeFix :)
    ​

    0tt0m@n said:
    A project have been started on github https://github.com/sinancetinkaya/DeviceStatus

    Current Collaborators :
    dwitherell (Big thanks to him)
    0tt0m@n

    If you know backsmali/smali stuff, feel free to join.
    Click to expand...
    Click to collapse




    First of all, I want to thank to Samsung for bringing this headache to us.
    I'm not a java programmer and nor an expert at those smali stuff. I know some C++ and little programming.
    I just wondered how SysScope works and what can we do about it.
    Apparently SysScope is using a SQL database SysScope\assets\databases\SysScope.db
    And there is an interesting table
    attachment.php

    It looks like to me SysScope is reading su binary from the offset for the size bytes, and comparing the data's md5 hash?

    Under \SysScope.apk\smali\com\sec\android\app\sysscope\job there two interesting subroutine

    KernelStatusChecker: It's using libcordon.o library. I don't think this subroutine is responsible for setting the settings at the bootloader screen. More likely it's just generating some reports to make system modified and send it Samsung?
    Code: 
    # virtual methods
.method public final a(Landroid/os/Bundle;)Lcom/sec/android/app/sysscope/service/f;
    .locals 4

    sget-object v0, Lcom/sec/android/app/sysscope/service/f;->f:Lcom/sec/android/app/sysscope/service/f;

    invoke-virtual {p0}, Lcom/sec/android/app/sysscope/job/KernelStatusChecker;->getCmdLine()Ljava/lang/String;

    move-result-object v1

    invoke-direct {p0, v1}, Lcom/sec/android/app/sysscope/job/KernelStatusChecker;->b(Ljava/lang/String;)Z

    move-result v1

    if-eqz v1, :cond_0

    sget-object v0, Lcom/sec/android/app/sysscope/service/f;->a:Lcom/sec/android/app/sysscope/service/f;

    :cond_0
    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "code="

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/sec/android/app/sysscope/job/KernelStatusChecker;->getCmdLine()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v2, " custom binary download count="

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    iget-wide v2, p0, Lcom/sec/android/app/sysscope/job/KernelStatusChecker;->b:J

    invoke-virtual {v1, v2, v3}, Ljava/lang/StringBuilder;->append(J)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-virtual {p0, v1}, Lcom/sec/android/app/sysscope/job/KernelStatusChecker;->a(Ljava/lang/String;)V

    return-object v0
.end method

.method public final c()V
    .locals 0

    return-void
.end method

.method public final d()Ljava/lang/String;
    .locals 1

    const-string v0, "Kernel Checker"

    return-object v0
.end method

.method public final e()I
    .locals 1

    const/4 v0, 0x0

    return v0
.end method
    RootProcessScanner: It's looks like this subroutine is checking the processes unde /proc and checking them whether they are in the approved list.
    Code: 
    # virtual methods
.method public final a(Landroid/os/Bundle;)Lcom/sec/android/app/sysscope/service/f;
    .locals 11

    const/4 v4, 0x1

    const/4 v2, 0x0

    sget-object v0, Lcom/sec/android/app/sysscope/service/f;->a:Lcom/sec/android/app/sysscope/service/f;

    :try_start_0
    new-instance v1, Ljava/io/File;

    const-string v3, "/proc"

    invoke-direct {v1, v3}, Ljava/io/File;-><init>(Ljava/lang/String;)V

    invoke-virtual {v1}, Ljava/io/File;->exists()Z

    move-result v3

    if-nez v3, :cond_1

    new-instance v2, Ljava/io/FileNotFoundException;

    new-instance v3, Ljava/lang/StringBuilder;

    invoke-direct {v3}, Ljava/lang/StringBuilder;-><init>()V

    invoke-virtual {v3, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/Object;)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v3, " is missing (man 5 proc)"

    invoke-virtual {v1, v3}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-direct {v2, v1}, Ljava/io/FileNotFoundException;-><init>(Ljava/lang/String;)V

    throw v2

    :catch_0
    move-exception v1

    :cond_0
    :goto_0
    return-object v0

    :cond_1
    new-instance v5, Ljava/util/ArrayList;

    invoke-direct {v5}, Ljava/util/ArrayList;-><init>()V

    invoke-virtual {v1}, Ljava/io/File;->listFiles()[Ljava/io/File;

    move-result-object v6

    if-eqz v6, :cond_2

    array-length v1, v6

    if-lez v1, :cond_2

    array-length v7, v6

    move v1, v2

    :goto_1
    if-lt v1, v7, :cond_3

    :cond_2
    invoke-interface {v5}, Ljava/util/List;->size()I

    move-result v1

    if-lez v1, :cond_0

    sget-object v1, Lcom/sec/android/app/sysscope/service/f;->d:Lcom/sec/android/app/sysscope/service/f;
    :try_end_0
    .catch Lcom/sec/android/app/sysscope/job/f; {:try_start_0 .. :try_end_0} :catch_0
    .catch Ljava/io/FileNotFoundException; {:try_start_0 .. :try_end_0} :catch_1

    :try_start_1
    const-string v0, ""

    :goto_2
    invoke-interface {v5}, Ljava/util/List;->size()I

    move-result v3

    if-lt v2, v3, :cond_7

    invoke-virtual {p0, v0}, Lcom/sec/android/app/sysscope/job/RootProcessScanner;->a(Ljava/lang/String;)V
    :try_end_1
    .catch Lcom/sec/android/app/sysscope/job/f; {:try_start_1 .. :try_end_1} :catch_3
    .catch Ljava/io/FileNotFoundException; {:try_start_1 .. :try_end_1} :catch_2

    move-object v0, v1

    goto :goto_0

    :cond_3
    :try_start_2
    aget-object v8, v6, v1

    invoke-virtual {v8}, Ljava/io/File;->isDirectory()Z

    move-result v3

    if-eqz v3, :cond_5

    const-string v3, "\\d+"

    invoke-virtual {v8}, Ljava/io/File;->getName()Ljava/lang/String;

    move-result-object v9

    invoke-static {v3, v9}, Ljava/util/regex/Pattern;->matches(Ljava/lang/String;Ljava/lang/CharSequence;)Z

    move-result v3

    if-eqz v3, :cond_5

    move v3, v4

    :goto_3
    if-eqz v3, :cond_6

    new-instance v3, Ljava/lang/StringBuilder;

    const-string v9, "/proc/"

    invoke-direct {v3, v9}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v8}, Ljava/io/File;->getName()Ljava/lang/String;

    move-result-object v9

    invoke-virtual {v3, v9}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v3

    invoke-virtual {v3}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v3

    invoke-virtual {p0, v3}, Lcom/sec/android/app/sysscope/job/RootProcessScanner;->checkIsApprivedProcess(Ljava/lang/String;)I

    move-result v3

    if-gez v3, :cond_6

    move v3, v4

    :goto_4
    if-eqz v3, :cond_4

    const-string v3, "SysScopeRootScanner"

    new-instance v9, Ljava/lang/StringBuilder;

    const-string v10, "isUnapprovedRootProcess returns true: "

    invoke-direct {v9, v10}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v8}, Ljava/io/File;->getName()Ljava/lang/String;

    move-result-object v10

    invoke-virtual {v9, v10}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v9

    invoke-virtual {v9}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v9

    invoke-static {v3, v9}, Lcom/sec/android/app/sysscope/engine/Log;->b(Ljava/lang/String;Ljava/lang/String;)I

    invoke-interface {v5, v8}, Ljava/util/List;->add(Ljava/lang/Object;)Z
    :try_end_2
    .catch Lcom/sec/android/app/sysscope/job/f; {:try_start_2 .. :try_end_2} :catch_0
    .catch Ljava/io/FileNotFoundException; {:try_start_2 .. :try_end_2} :catch_1

    :cond_4
    add-int/lit8 v1, v1, 0x1

    goto :goto_1

    :cond_5
    move v3, v2

    goto :goto_3

    :cond_6
    move v3, v2

    goto :goto_4

    :cond_7
    :try_start_3
    new-instance v3, Ljava/lang/StringBuilder;

    invoke-static {v0}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

    move-result-object v0

    invoke-direct {v3, v0}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-interface {v5, v2}, Ljava/util/List;->get(I)Ljava/lang/Object;

    move-result-object v0

    check-cast v0, Ljava/io/File;

    invoke-static {v0}, Lcom/sec/android/app/sysscope/job/RootProcessScanner;->a(Ljava/io/File;)Ljava/lang/String;

    move-result-object v0

    invoke-virtual {v3, v0}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v0

    const-string v3, " "

    invoke-virtual {v0, v3}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v0

    invoke-virtual {v0}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
    :try_end_3
    .catch Lcom/sec/android/app/sysscope/job/f; {:try_start_3 .. :try_end_3} :catch_3
    .catch Ljava/io/FileNotFoundException; {:try_start_3 .. :try_end_3} :catch_2

    move-result-object v3

    add-int/lit8 v0, v2, 0x1

    move v2, v0

    move-object v0, v3

    goto/16 :goto_2

    :catch_1
    move-exception v1

    goto/16 :goto_0

    :catch_2
    move-exception v0

    move-object v0, v1

    goto/16 :goto_0

    :catch_3
    move-exception v0

    move-object v0, v1

    goto/16 :goto_0
.end method
    SysScope.apk\smali\com\sec\android\app\sysscope\service\f :
    Code: 
    # direct methods
.method static constructor <clinit>()V
    .locals 9

    const/4 v8, 0x4

    const/4 v7, 0x3

    const/4 v6, 0x2

    const/4 v5, 0x1

    const/4 v4, 0x0

    new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "OK"

    invoke-direct {v0, v1, v4, v4}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->a:Lcom/sec/android/app/sysscope/service/f;

    new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "ADB_RUNNING_AS_ROOT"

    const v2, 0x10001

    invoke-direct {v0, v1, v5, v2}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->b:Lcom/sec/android/app/sysscope/service/f;

    new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "PARTITION_TAMPERED"

    const v2, 0x20001

    invoke-direct {v0, v1, v6, v2}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->c:Lcom/sec/android/app/sysscope/service/f;

    new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "ROOT_PROCESS_FOUND"

    const/16 v2, 0x3001

    invoke-direct {v0, v1, v7, v2}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->d:Lcom/sec/android/app/sysscope/service/f;

    new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "DANGEROUS_FILE_DETECTED"

    const v2, 0x40001

    invoke-direct {v0, v1, v8, v2}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->e:Lcom/sec/android/app/sysscope/service/f;

    new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "NOT_OFFICIAL_BINARY"

    const/4 v2, 0x5

    const v3, 0x50001

    invoke-direct {v0, v1, v2, v3}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->f:Lcom/sec/android/app/sysscope/service/f;

    const/4 v0, 0x6

    new-array v0, v0, [Lcom/sec/android/app/sysscope/service/f;

    sget-object v1, Lcom/sec/android/app/sysscope/service/f;->a:Lcom/sec/android/app/sysscope/service/f;

    aput-object v1, v0, v4

    sget-object v1, Lcom/sec/android/app/sysscope/service/f;->b:Lcom/sec/android/app/sysscope/service/f;

    aput-object v1, v0, v5

    sget-object v1, Lcom/sec/android/app/sysscope/service/f;->c:Lcom/sec/android/app/sysscope/service/f;

    aput-object v1, v0, v6

    sget-object v1, Lcom/sec/android/app/sysscope/service/f;->d:Lcom/sec/android/app/sysscope/service/f;

    aput-object v1, v0, v7

    sget-object v1, Lcom/sec/android/app/sysscope/service/f;->e:Lcom/sec/android/app/sysscope/service/f;

    aput-object v1, v0, v8

    const/4 v1, 0x5

    sget-object v2, Lcom/sec/android/app/sysscope/service/f;->f:Lcom/sec/android/app/sysscope/service/f;

    aput-object v2, v0, v1

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->i:[Lcom/sec/android/app/sysscope/service/f;

    return-void
.end method
    Probably this subroutine is returning all the result codes that other subroutines need ?
    Such as
    is ADB_RUNNING_AS_ROOT
    is PARTITION_TAMPERED
    is ROOT_PROCESS_FOUND
    is DANGEROUS_FILE_DETECTED
    is NOT_OFFICIAL_BINARY

    SysScope.apk\smali\com\sec\android\app\sysscope\engine\SystemDiagnosisManager
    To me it looks like the main routine
    Code: 
    # virtual methods
.method public final a()V
    .locals 10

    const/4 v3, 0x0

    const/4 v1, 0x0

    iget-object v4, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->c:[Ljava/lang/String;

    iget-object v5, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->d:Landroid/content/Context;

    new-instance v6, Ljava/util/ArrayList;

    invoke-direct {v6}, Ljava/util/ArrayList;-><init>()V

    array-length v7, v4

    move v2, v3

    :goto_0
    if-lt v2, v7, :cond_0

    invoke-interface {v6, v1}, Ljava/util/List;->remove(Ljava/lang/Object;)Z

    new-instance v0, Lcom/sec/android/app/sysscope/engine/f;

    invoke-direct {v0, v3}, Lcom/sec/android/app/sysscope/engine/f;-><init>(B)V

    invoke-static {v6, v0}, Ljava/util/Collections;->sort(Ljava/util/List;Ljava/util/Comparator;)V

    iput-object v6, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->b:Ljava/util/List;

    sget-object v0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->e:Lcom/sec/android/app/sysscope/job/c;

    invoke-virtual {v0}, Lcom/sec/android/app/sysscope/job/c;->a()V

    return-void

    :cond_0
    aget-object v0, v4, v2

    const-string v8, "rpscanner"

    invoke-virtual {v0, v8}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v8

    if-eqz v8, :cond_1

    new-instance v0, Lcom/sec/android/app/sysscope/job/RootProcessScanner;

    invoke-direct {v0}, Lcom/sec/android/app/sysscope/job/RootProcessScanner;-><init>()V

    :goto_1
    if-eqz v0, :cond_7

    invoke-interface {v0}, Lcom/sec/android/app/sysscope/engine/d;->c()V

    invoke-interface {v0}, Lcom/sec/android/app/sysscope/engine/d;->b()Ljava/lang/String;

    move-result-object v8

    const-string v9, "general"

    invoke-virtual {v8, v9}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v8

    if-eqz v8, :cond_6

    new-instance v8, Lcom/sec/android/app/sysscope/engine/l;

    invoke-direct {v8}, Lcom/sec/android/app/sysscope/engine/l;-><init>()V

    invoke-virtual {v8, v0}, Lcom/sec/android/app/sysscope/engine/l;->a(Lcom/sec/android/app/sysscope/engine/d;)Lcom/sec/android/app/sysscope/engine/g;

    move-result-object v0

    :goto_2
    invoke-interface {v6, v0}, Ljava/util/List;->add(Ljava/lang/Object;)Z

    add-int/lit8 v0, v2, 0x1

    move v2, v0

    goto :goto_0

    :cond_1
    const-string v8, "adbscanner"

    invoke-virtual {v0, v8}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v8

    if-eqz v8, :cond_2

    new-instance v0, Lcom/sec/android/app/sysscope/job/a;

    invoke-direct {v0}, Lcom/sec/android/app/sysscope/job/a;-><init>()V

    goto :goto_1

    :cond_2
    const-string v8, "su_scanner"

    invoke-virtual {v0, v8}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v8

    if-eqz v8, :cond_3

    new-instance v0, Lcom/sec/android/app/sysscope/job/g;

    invoke-direct {v0, v5}, Lcom/sec/android/app/sysscope/job/g;-><init>(Landroid/content/Context;)V

    goto :goto_1

    :cond_3
    const-string v8, "partition_checker"

    invoke-virtual {v0, v8}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v8

    if-eqz v8, :cond_4

    new-instance v0, Lcom/sec/android/app/sysscope/job/b;

    invoke-direct {v0}, Lcom/sec/android/app/sysscope/job/b;-><init>()V

    goto :goto_1

    :cond_4
    const-string v8, "kernel_checker"

    invoke-virtual {v0, v8}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v0

    if-eqz v0, :cond_5

    new-instance v0, Lcom/sec/android/app/sysscope/job/KernelStatusChecker;

    invoke-direct {v0}, Lcom/sec/android/app/sysscope/job/KernelStatusChecker;-><init>()V

    goto :goto_1

    :cond_5
    move-object v0, v1

    goto :goto_1

    :cond_6
    invoke-interface {v0}, Lcom/sec/android/app/sysscope/engine/d;->b()Ljava/lang/String;

    move-result-object v8

    const-string v9, "filescanning"

    invoke-virtual {v8, v9}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v8

    if-eqz v8, :cond_7

    new-instance v8, Lcom/sec/android/app/sysscope/engine/c;

    invoke-direct {v8}, Lcom/sec/android/app/sysscope/engine/c;-><init>()V

    invoke-virtual {v8, v0}, Lcom/sec/android/app/sysscope/engine/c;->a(Lcom/sec/android/app/sysscope/engine/d;)Lcom/sec/android/app/sysscope/engine/g;

    move-result-object v0

    goto :goto_2

    :cond_7
    move-object v0, v1

    goto :goto_2
.end method

.method public final a(Lcom/sec/android/app/sysscope/engine/m;)V
    .locals 0

    iput-object p1, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->a:Lcom/sec/android/app/sysscope/engine/m;

    return-void
.end method

.method public final b()V
    .locals 10

    const/4 v3, 0x1

    const/4 v2, 0x0

    invoke-static {}, Ljava/util/concurrent/Executors;->newSingleThreadExecutor()Ljava/util/concurrent/ExecutorService;

    move-result-object v4

    iget-object v0, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->b:Ljava/util/List;

    if-nez v0, :cond_1

    iget-object v0, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->a:Lcom/sec/android/app/sysscope/engine/m;

    invoke-interface {v0}, Lcom/sec/android/app/sysscope/engine/m;->a()V

    iget-object v0, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->a:Lcom/sec/android/app/sysscope/engine/m;

    const-string v1, "no jobs loaded"

    invoke-interface {v0, v2, v1}, Lcom/sec/android/app/sysscope/engine/m;->a(ZLjava/lang/String;)V

    :cond_0
    :goto_0
    return-void

    :cond_1
    iget-object v0, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->a:Lcom/sec/android/app/sysscope/engine/m;

    if-eqz v0, :cond_2

    iget-object v0, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->a:Lcom/sec/android/app/sysscope/engine/m;

    iget-object v1, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->b:Ljava/util/List;

    invoke-interface {v1}, Ljava/util/List;->size()I

    move-result v1

    invoke-interface {v0, v1}, Lcom/sec/android/app/sysscope/engine/m;->a(I)V

    :cond_2
    new-instance v5, Lcom/sec/android/app/sysscope/service/SysScopeResultInfo;

    invoke-direct {v5}, Lcom/sec/android/app/sysscope/service/SysScopeResultInfo;-><init>()V

    iget-object v0, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->b:Ljava/util/List;

    invoke-interface {v0}, Ljava/util/List;->iterator()Ljava/util/Iterator;

    move-result-object v6

    move v1, v2

    :cond_3
    :goto_1
    invoke-interface {v6}, Ljava/util/Iterator;->hasNext()Z

    move-result v0

    if-nez v0, :cond_5

    invoke-interface {v4}, Ljava/util/concurrent/ExecutorService;->shutdown()V

    iget-object v0, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->b:Ljava/util/List;

    invoke-interface {v0}, Ljava/util/List;->clear()V

    invoke-static {}, Lcom/sec/android/app/sysscope/engine/j;->a()Lcom/sec/android/app/sysscope/engine/j;

    move-result-object v0

    invoke-virtual {v0, v5}, Lcom/sec/android/app/sysscope/engine/j;->a(Lcom/sec/android/app/sysscope/service/SysScopeResultInfo;)V

    invoke-virtual {v5}, Lcom/sec/android/app/sysscope/service/SysScopeResultInfo;->a()I

    move-result v0

    const-string v1, "SysScopeDiagnosisManager"

    new-instance v4, Ljava/lang/StringBuilder;

    const-string v6, "SysDiagnosisManager > call storeResult"

    invoke-direct {v4, v6}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v4, v0}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v4

    invoke-virtual {v4}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v4

    invoke-static {v1, v4}, Lcom/sec/android/app/sysscope/engine/Log;->b(Ljava/lang/String;Ljava/lang/String;)I

    invoke-virtual {p0, v0}, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->storeResult(I)I

    move-result v1

    const-string v4, "SysScopeDiagnosisManager"

    new-instance v6, Ljava/lang/StringBuilder;

    const-string v7, "SysDiagnosisManager > storeResult:"

    invoke-direct {v6, v7}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v6, v1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-static {v4, v1}, Lcom/sec/android/app/sysscope/engine/Log;->b(Ljava/lang/String;Ljava/lang/String;)I

    iget-object v1, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->a:Lcom/sec/android/app/sysscope/engine/m;

    if-eqz v1, :cond_0

    iget-object v1, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->a:Lcom/sec/android/app/sysscope/engine/m;

    if-eq v0, v3, :cond_4

    move v2, v3

    :cond_4
    invoke-virtual {v5}, Lcom/sec/android/app/sysscope/service/SysScopeResultInfo;->toString()Ljava/lang/String;

    move-result-object v0

    invoke-interface {v1, v2, v0}, Lcom/sec/android/app/sysscope/engine/m;->a(ZLjava/lang/String;)V

    goto :goto_0

    :cond_5
    invoke-interface {v6}, Ljava/util/Iterator;->next()Ljava/lang/Object;

    move-result-object v0

    check-cast v0, Lcom/sec/android/app/sysscope/engine/g;

    if-eqz v0, :cond_3

    invoke-virtual {v0}, Lcom/sec/android/app/sysscope/engine/g;->a()I

    move-result v7

    const/4 v8, 0x2

    if-gt v7, v8, :cond_3

    invoke-interface {v4, v0}, Ljava/util/concurrent/ExecutorService;->submit(Ljava/util/concurrent/Callable;)Ljava/util/concurrent/Future;

    move-result-object v7

    iget-object v8, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->a:Lcom/sec/android/app/sysscope/engine/m;

    if-eqz v8, :cond_6

    iget-object v8, p0, Lcom/sec/android/app/sysscope/engine/SystemDiagnosisManager;->a:Lcom/sec/android/app/sysscope/engine/m;

    invoke-virtual {v0}, Lcom/sec/android/app/sysscope/engine/g;->b()Ljava/lang/String;

    move-result-object v0

    invoke-interface {v8, v1, v0}, Lcom/sec/android/app/sysscope/engine/m;->a(ILjava/lang/String;)V

    :cond_6
    sget-object v0, Lcom/sec/android/app/sysscope/service/f;->a:Lcom/sec/android/app/sysscope/service/f;

    :try_start_0
    invoke-interface {v7}, Ljava/util/concurrent/Future;->get()Ljava/lang/Object;

    move-result-object v0

    check-cast v0, Landroid/os/Bundle;

    add-int/lit8 v1, v1, 0x1

    if-eqz v0, :cond_3

    const-string v7, "result"

    invoke-virtual {v0, v7}, Landroid/os/Bundle;->getInt(Ljava/lang/String;)I

    move-result v7

    invoke-static {v7}, Lcom/sec/android/app/sysscope/service/f;->a(I)Lcom/sec/android/app/sysscope/service/f;

    move-result-object v7

    sget-object v8, Lcom/sec/android/app/sysscope/service/f;->a:Lcom/sec/android/app/sysscope/service/f;

    if-eq v7, v8, :cond_3

    const-string v8, "info"

    invoke-virtual {v0, v8}, Landroid/os/Bundle;->getString(Ljava/lang/String;)Ljava/lang/String;

    move-result-object v0

    invoke-virtual {v7, v0}, Lcom/sec/android/app/sysscope/service/f;->a(Ljava/lang/String;)V

    invoke-virtual {v5, v7}, Lcom/sec/android/app/sysscope/service/SysScopeResultInfo;->a(Lcom/sec/android/app/sysscope/service/f;)V
    :try_end_0
    .catch Ljava/lang/InterruptedException; {:try_start_0 .. :try_end_0} :catch_0
    .catch Ljava/util/concurrent/ExecutionException; {:try_start_0 .. :try_end_0} :catch_1

    goto/16 :goto_1

    :catch_0
    move-exception v0

    move-object v9, v0

    move v0, v1

    move-object v1, v9

    invoke-virtual {v1}, Ljava/lang/InterruptedException;->printStackTrace()V

    move v1, v0

    goto/16 :goto_1

    :catch_1
    move-exception v0

    move-object v9, v0

    move v0, v1

    move-object v1, v9

    invoke-virtual {v1}, Ljava/util/concurrent/ExecutionException;->printStackTrace()V

    move v1, v0

    goto/16 :goto_1
.end method
    View
    5
    A
    Aou
    And here's the write-up/guide:

    http://xdaforums.com/showthread.php?t=2333700

    Thank you again, both of you, for your help!
    View
    3
    MattBooth
    MattBooth
    Since we're all programmers... we probably know more about Java than smali, right? This can help:

    1 Drop an apk in the "dex2jar" folder

    2. Run the dex2jar batch file

    3. Open the jd-gui folder and run the jd-gui.exe (apologies if you're running Linux, I don't have a necessary binary for that)

    4. navigate to the dex2jar folder and open the .jar file to see the Java code.

    You can't edit the code, but it can give you a good idea of what is going on.
    View
    2
    B
    bahtsiz_bedevi
    @faria
    Yes, you're right.
    The permanent solution is to modify SysScope.
    I know this will never end, samsung always will come up with new measures :mad:
    That's why I'm disappointed in Samsung. They spend their efforts for such things rather than making their devices unbrickable :mad:

    "SysScope.apk\smali\com\sec\android\app\sysscope\service\f" has been widely used in the code. Looks like returning result codes.
    These lines are interesting
    Code: 
        const/4 v8, 0x4

    const/4 v7, 0x3

    const/4 v6, 0x2

    const/4 v5, 0x1

    const/4 v4, 0x0
    Code: 
        new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "OK"

    invoke-direct {v0, v1, v4, v4}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->a:Lcom/sec/android/app/sysscope/service/f;
    above you see v1 is status message which is "OK" and v4 status code which is described above "0x0"
    Code: 
    invoke-direct {v0, v1, v4, v4}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V
    this goes on
    Code: 
        new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "ADB_RUNNING_AS_ROOT"

    const v2, 0x10001

    invoke-direct {v0, v1, v5, v2}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->b:Lcom/sec/android/app/sysscope/service/f;
    Code: 
        new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "PARTITION_TAMPERED"

    const v2, 0x20001

    invoke-direct {v0, v1, v6, v2}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->c:Lcom/sec/android/app/sysscope/service/f;
    Code: 
        new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "ROOT_PROCESS_FOUND"

    const/16 v2, 0x3001

    invoke-direct {v0, v1, v7, v2}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->d:Lcom/sec/android/app/sysscope/service/f;
    Code: 
        new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "DANGEROUS_FILE_DETECTED"

    const v2, 0x40001

    invoke-direct {v0, v1, v8, v2}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->e:Lcom/sec/android/app/sysscope/service/f;
    Code: 
       new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "NOT_OFFICIAL_BINARY"

    const/4 v2, 0x5

    const v3, 0x50001

    invoke-direct {v0, v1, v2, v3}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->f:Lcom/sec/android/app/sysscope/service/f;
    Rather than trying to understand whole process code, just modifying the result codes to make always send "OK" and "0x0" would help.
    I tried to do that with apktool but apk file was never compiled correctly.
    I have no time to figure out how apktool works :(
    Can somebody who knows apktool better help us?
    View
    2
    B
    bahtsiz_bedevi
    faria said:
    I can help you with the apk tools. this apks versions are from 4.1.1 or 4.1.2?
    Click to expand...
    Click to collapse
    4.1.2
    change each result code like from this
    Code: 
        new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "ROOT_PROCESS_FOUND"

    const/16 v2, 0x3001

    invoke-direct {v0, v1, v7, v2}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->d:Lcom/sec/android/app/sysscope/service/f;
    to this
    Code: 
        new-instance v0, Lcom/sec/android/app/sysscope/service/f;

    const-string v1, "[COLOR=Red]OK[/COLOR]"
 
    const/16 v2, 0x3001

    invoke-direct {v0, v1, [COLOR=Red]v4, v4[/COLOR]}, Lcom/sec/android/app/sysscope/service/f;-><init>(Ljava/lang/String;II)V

    sput-object v0, Lcom/sec/android/app/sysscope/service/f;->d:Lcom/sec/android/app/sysscope/service/f;
    View

New posts