[Exploit] [Shizuku Support] SMT Shell v2.0 - get a SYSTEM SHELL (UID 1000) within the app itself - and write your own system app with an API

Search This thread

ser8210

Senior Member
Hi.

Amazing work.
Galaxy note 10+ exynos (SM-N975F) in less than 30 seconds.

Screenshot_20230326-001454_SMT Shell.jpg Screenshot_20230326-000749_Configuration update.jpg Screenshot_20230325-235321_SMT Shell.jpg

Salu2
 
  • Like
Reactions: wr3cckl3ss1
Watch 4...S22 Ultra....S23 Ultra. Need i say more.
Good work @BLuFeNiX
Keep it coming bro.
 

Attachments

  • 20230325_215600.jpg
    20230325_215600.jpg
    605.8 KB · Views: 76
  • 20230325_215503.jpg
    20230325_215503.jpg
    450.9 KB · Views: 69
  • 20230325_215419.jpg
    20230325_215419.jpg
    616.3 KB · Views: 60
  • 20230325_215348.jpg
    20230325_215348.jpg
    786.2 KB · Views: 69
  • Screenshot_20230325_221014_SMT Shell.jpg
    Screenshot_20230325_221014_SMT Shell.jpg
    444.5 KB · Views: 67
  • Screenshot_20230325_222028_SMT Shell.jpg
    Screenshot_20230325_222028_SMT Shell.jpg
    326.8 KB · Views: 79
  • Like
Reactions: bigron77

BLuFeNiX

Senior Member
Jan 18, 2013
436
222

Attachments

  • Screenshot_20230329_001943_IMS Settings.jpg
    Screenshot_20230329_001943_IMS Settings.jpg
    187.4 KB · Views: 146
  • Screenshot_20230329_001908_IMS Settings.jpg
    Screenshot_20230329_001908_IMS Settings.jpg
    292.1 KB · Views: 142
  • Screenshot_20230329_001915_IMS Settings.jpg
    Screenshot_20230329_001915_IMS Settings.jpg
    368.8 KB · Views: 120
  • Screenshot_20230329_001927_IMS Settings.jpg
    Screenshot_20230329_001927_IMS Settings.jpg
    189.7 KB · Views: 109
  • Screenshot_20230329_001930_IMS Settings.jpg
    Screenshot_20230329_001930_IMS Settings.jpg
    248.8 KB · Views: 95
  • Screenshot_20230329_001959_IMS Settings.jpg
    Screenshot_20230329_001959_IMS Settings.jpg
    220.1 KB · Views: 86
  • Screenshot_20230329_002017_IMS Settings.jpg
    Screenshot_20230329_002017_IMS Settings.jpg
    155.7 KB · Views: 150
I am unfortunately the link doesn't work for 5.1 and my apologies, I read your post wrong. It said some versions of 5.1 like my 23.

Haha I guess I'll wait for a way to change settings in the imyou realize you do realize that you don't need a system shell to call on s; need video calling
What S23, do you have? Also, while yes it's nice having a system shell to be able to call a lot of system level activities you don't need a system shelf to open those activities... I have two elevated apps that do this and it's all without a system shell .
 
  • Haha
Reactions: Mr. Beluga
Just downgrade your firmware to this


And you'll have system shell access. Follow the OP. (Heads up moderators, i know i posted this link once before and i know the rules about links, etc. Don't want to get penalized.)
 

redhatperl

Member
Nov 5, 2007
13
0
Just downgrade your firmware to this


And you'll have system shell access. Follow the OP. (Heads up moderators, i know i posted this link once before and i know the rules about links, etc. Don't want to get penalized.)

I am sorry but could you please share the names of those two apps? Or PM me the links, please?

I have two elevated apps that do this and it's all without a system shell .
 

badmaan

Senior Member
Jan 10, 2016
67
82
Istanbul
What S23, do you have? Also, while yes it's nice having a system shell to be able to call a lot of system level activities you don't need a system shelf to open those activities... I have two elevated apps that do this and it's all without a system shell .
I have S918B/DS, could you share those apps in DM? I need to use Service Menu, I can't downgrade to Verizon firmware. Thank you.
 
I am sorry but could you please share the names of those two apps? Or PM me the links, please?

I have two elevated apps that do this and it's all without a system shell .
Yeah same was trying to avoid downgrading or modifying. If you can DM apps
I have S918B/DS, could you share those apps in DM? I need to use Service Menu, I can't downgrade to Verizon firmware. Thank you.
I guess the days of doing research and exploring for yourself are long gone. Here you are gentlemen. As per you requests, I'll kindly point you all to ONE of those apps. What you do with it, is all on you and please refrain from asking "Why", "Where" or "How".

 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    works on sm-a426u running on verizon
    For R&D purposes only
    *S918U & S918U1 devices only*

    Take the following info as is. Nothing too great about it. Just know, it wasn't anything hi tech or anything that required a whole lot of knowledge. I achieved system shell access on the S23 Ultra by flashing this.


    This is a probably around the first known build available for the S23 Ultra. Security patch is Nov 1 2022. Samsung was in no way ever thinking about patching SMT back then. So I GOT LUCKY and figured it out by simply doing what i usually do when I get a new device. Flash this and follow the OP's instructions and you too can see system shell access. @BLuFeNiX @V0latyle
    1
    works on sm-a426u running on verizon
    I see that you're a new member. Welcome. Welcome to the land of overage misfits and disgruntled ex tech employees. Always remember to use that search button up at the top and always be respectful because someone here will always have something to say. Is your device on One UI 5.0 or 5.1? If on 5.0, SMT Shell works as is. If on 5.1, then this will not work but using that search option can direct you to bypassing Samsung's bandaids up until May 2023.
    1
    Hi.

    Thank you very much for keeping the project alive. My april upgraded galaxy note 10+ exynos (SM-N975F) feels very happy again.
    Screenshot_20230530-125926_#system_shell_2#.jpg

    Screenshot_20230530-130449_Configuration update.jpg
    Screenshot_20230530-130632_IMS Settings.jpg
    Screenshot_20230530-130815_Service mode RIL.jpg

    Salu2
  • 11

    SMT Shell v2.0​

    GitHub: https://github.com/BLuFeNiX/SMTShell

    Hi everyone! After seeing the recent controversy over a similar tool, I have decided to maintain my own version of the Samsung system shell exploit, targeting CVE-2019-16253.

    Original CVE: CVE-2019-16253

    What does it do?​

    This tool allows most Samsung devices to achieve a system shell (UID 1000). It was patched in OneUI 5.1, but will work on Android 13 running OneUI 5.0 or older, as well as some very early versions of OneUI 5.1 (like the S23). It should work as far back and Android 9.0 (and maybe earlier).

    It has a feature set similar to Samsung Toolkit, but I've added even more stuff, and have additional plans for the future. It also has an API so you can write your own apps. You can think of it like SuperSU/Magisk for uid 1000 instead of root.

    API source code and instructions: https://github.com/BLuFeNiX/SMTShell-API

    Usage (with Shizuku)​

    Simply run the app and grant Shizuku access.

    Usage (no Shizuku)​

    1. Downgrade the TTS app to the version provided (this must be done after every reboot):
      adb install -d com.samsung.SMT_v3.0.02.2.apk
      alternatively, you can use pm install -d /data/local/tmp/com.samsung.SMT_v3.0.02.2.apk if you copy the file to your device first, via adb push
    2. Install and open the SMT Shell app.

    02.png
    03.png


    Troubleshooting​

    1. Try clearing the Samsung SMT app data: adb shell pm clear com.samsung.SMT
    2. kill and run the SMT Shell app again
    3. If the above fails, reboot and follow the usage instructions again.

    Thanks to @flanker017 !!!​

    This work is based purely off of the original 2019 exploit code, authored by flanker017. Although other similar projects may exist, this uses absolutely no code from them. You can find the original work at the following links:

    * https://github.com/flankerhqd/vendor-android-cves (specifically the SMT-CVE-2019-16253 folder).
    * https://blog.flanker017.me/text-to-speech-speaks-pwned/

    Changes from the original exploit​

    I have refactored/simplified nearly all of the code, as well as implemented my own reverse shell.

    Suggestion? Bug report?​

    Feel free to discuss here, but I will be most responsive if you create an issue on GitHub.

    Looking for a version that supports Samsung Watches?​

    See this neat fork by @Dante63
    5
    *COMMANDS FOR SYSTEM AND/OR ROOT USE ONLY*

    **WARNING**
    Do your research and find out what something does before you aimlessly execute the commands and mess something up. This is your only warning.

    IOTHiddenMenu.apk

    am start -n com.sec.hiddenmenu/.KOREA_Mode -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.KoreaMode_Prevail -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.SerialPort -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.ItsOnMenu -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.ServiceModeApp -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.Test -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.PhoneUtil -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.OTATest -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.LTE -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.FIELDTESTMODE -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.HiddenMenuEnable -e 7267864872 72678647376477466

    am start -n com.sec.hiddenmenu/.GlobalHiddenMenuEnable -e 7267864872 72678647376477466


    Change your CSC thru Preconfiguration. (Exclusive to primarily US devices)

    am start -n com.samsung.android.cidmanager/.modules.preconfig.PreconfigActivity -a com.samsung.android.action.SECRET_CODE -d secret_code://27262826 --ei type 2

    Option #2 for Possible CSC change on devices not from US.

    am start -n com.samsung.android.cidmanager/.preconfig.PreconfigActivity -a android.provider.Telephony.SECRET_CODE -d secret_code://272837883 --ei type 3


    Service Menu

    am broadcast -a com.samsung.android.action.SECRET_CODE -d android_secret_code://27663368378 -n com.sec.android.RilServiceModeApp/.SecKeyStringBroadcastReceiver

    Hidden Network Band Selection

    am start -n com.samsung.android.app.telephonyui/.hiddennetworksetting.MainActivity


    Use with CAUTION***

    am start -n com.wssyncmldm/com.idm.fotaagent.enabler.ui.admin.feature.AdminFeatureAndActionActivity

    am start -n com.wssyncmldm/com.samsung.android.fotaagent.common.feature.FeatureInjectionActivity

    am start -n com.sec.android.app.factorykeystring/com.sec.android.app.shutdown.ShutdownPreference

    am start -n com.samsung.android.sdm.config/.ui.DevConfigActivity

    am start -n com.sec.android.sdhms/.debugger.ui.ThermalLimitSettingActivity

    am start -n com.sec.usbsettings/.USBSettings

    am start -n com.android.settings/.development.DSULoader

    am start -n com.sec.android.app.servicemodeapp/com.sec.android.app.modemui.activities.PhoneUtil

    am start -n com.sec.android.app.myfiles/.external.ui.developer.DeveloperSettingActivity

    am start -n com.sec.android.app.factorykeystring/com.sec.android.app.phoneutil.UsbLogging

    am start -n com.samsung.sdm/com.samsung.sdm.logic.DMApp

    Have fun...
    --wr3cckl3ss1
    4
    I am sorry but could you please share the names of those two apps? Or PM me the links, please?

    I have two elevated apps that do this and it's all without a system shell .
    Yeah same was trying to avoid downgrading or modifying. If you can DM apps
    I have S918B/DS, could you share those apps in DM? I need to use Service Menu, I can't downgrade to Verizon firmware. Thank you.
    I guess the days of doing research and exploring for yourself are long gone. Here you are gentlemen. As per you requests, I'll kindly point you all to ONE of those apps. What you do with it, is all on you and please refrain from asking "Why", "Where" or "How".

    3
    So what you're referring to is me, with the S23 Ultra on One UI 5.1. I did achieve system shell access on this device.
    For R&D purposes only
    *S918U & S918U1 devices only*

    Take the following info as is. Nothing too great about it. Just know, it wasn't anything hi tech or anything that required a whole lot of knowledge. I achieved system shell access on the S23 Ultra by flashing this.


    This is a probably around the first known build available for the S23 Ultra. Security patch is Nov 1 2022. Samsung was in no way ever thinking about patching SMT back then. So I GOT LUCKY and figured it out by simply doing what i usually do when I get a new device. Flash this and follow the OP's instructions and you too can see system shell access. @BLuFeNiX @V0latyle
    3
    Version 2.0 released! See OP for details.