***LOCKED UNTIL FURTHER NOTICE*** System Shell Exploit - ALL Samsung Mobile Devices NO BL UNLOCK REQUIRED.

[subevilx]

I have not removed eToken crap...

My stupid Bootloader sboot.bin ONLY checks text string...

If "he" find mrk text string... then I can flash with Odin...

If FACtory text string fac...

Then blocked... by sboot.bin Exynos Bootloader...

But again...

My Bootloader sboot.bin is unlocked... AND vbmeta.img is patched by Magisk...
Or you can do it manually... because only 1 Byte...

This is no Rocket Science to change text... from same size...


Also my GW4 SM-R870 and SM-R875F allows Bootloader downgrade...

So full Rollback is possible... including ALL files and partitions... with Odin + USB cable.

IMHO Phones especially modern Samsung Phones are better protected... so sboot.bin downgrade is maybe close to impossible... if full Knox crap activated...

Best Regards

I tried this i was able to flash my boot.img and recovery but i got stuck on download mode then decided to do it for the whole file then I started getting secure boot fail for all files except boot and recovery i did this on a combination file any way to fix secure check?

 

[adfree]

@subevilx
Now we come closer to Rocket Science... because damn Crypto...

Other files also different secured... Minimum by Samsung signing stuff...

For instance I have no idea how to disable Security check in:

vbmeta_system.img

Similar to vbmeta.img... which holds Security info for boot.img and recovery.img

Then I could flash modified super.img... in theory...

Maybe somebody have an idea. As my Bootloader has no Fastboot Support...
Only FACtory sboot.bin has Fasboot...

Best Regards

 

[Moshe fasten]

Someone may have already asked this question: but with this exploit, is there a way to enable call recording without changing to a different CSC? and if so how?

 

[adfree]

Memo to me...

Will try this week, what happens if I copy su into:

/system/bin

Sorry, the test device is GW4 SM-R875F allready rooted with Magisk 25.2...
Bootloader sboot.bin is unlocked
vbmeta.img is patched by Magisk
boot.img is patched by Magisk

I have read AND write access...
Thanx to Magisk

Step 1.

freshul:/ $ su
freshul:/ # cd /system/bin
freshul:/system/bin # ls -a1l su
lrwxrwxrwx 1 root root 8 2023-01-25 06:26 su -> ./magisk

For later to make the chmod Command correct...
For my tiny Windows Brain I need chmod calculator like this...

Chmod Calculator

I have allready copied the working su Binary.... ehm... from Magisk...

Step 2.

I have to prepare few things...

But IMHO test 1 is writing boot.img and vbmeta.img from Stock Firmware... via Odin.

To check if my SM-R875F detect the modified super.img...

Only as stupid test...

Best Regards

Edit 1.

First attempts... to make it easier for me, as su as symlink allready exists... renamed into su2

D:\Android\adb>adb push su2 /sdcard
su2: 1 file pushed, 0 skipped. 2.8 MB/s (154452 bytes in 0.052s)

D:\Android\adb>adb shell
freshul:/ $ su
freshul:/ # cd /sdcard
freshul:/sdcard # ls -a1l su
-rw------- 1 u0_a118 u0_a118 154452 2023-01-22 22:16 su
freshul:/sdcard # ls -a1l su2
-rw------- 1 u0_a118 u0_a118 154452 2023-01-22 22:17 su2
freshul:/sdcard # mount -vo remount,rw /
try '/dev/block/dm-0' type 'ext4' on '/'
freshul:/sdcard # cd /system/bin
freshul:/system/bin # ls -a1l su
lrwxrwxrwx 1 root root 8 2023-01-25 06:26 su -> ./magisk
freshul:/system/bin # ls -a1l su2
ls: su2: No such file or directory
1|freshul:/system/bin # cd /sdcard
freshul:/sdcard # cp su2 /system/bin
freshul:/sdcard # cd /system/bin
freshul:/system/bin # ls -a1l su
lrwxrwxrwx 1 root root 8 2023-01-25 06:26 su -> ./magisk
freshul:/system/bin # ls -a1l su2
-rw------- 1 root root 154452 2023-01-25 06:58 su2
freshul:/system/bin # chmod 6775 su2
freshul:/system/bin # ls -a1l su2
-rwsrwsr-x 1 root root 154452 2023-01-25 06:58 su2
freshul:/system/bin #

Okidoki... lazy me took chmod command from other Thread...

Need correct chmod for su2 to have same like su shows...

Edit 2.

Stupid mewinfanboy... lt could be from symlink... so maybe chmod 777 is enough... hopefully...

freshul:/system/bin # ls -a1l su
lrwxrwxrwx 1 root root 8 2023-01-25 06:26 su -> ./magisk
freshul:/system/bin # ls -a1l su2
-rw------- 1 root root 154452 2023-01-25 06:58 su2
freshul:/system/bin # chmod 6775 su2
freshul:/system/bin # ls -a1l su2
-rwsrwsr-x 1 root root 154452 2023-01-25 06:58 su2
freshul:/system/bin # chmod 777 su2
freshul:/system/bin # ls -a1l su2
-rwxrwxrwx 1 root root 154452 2023-01-25 06:58 su2

Now will Factory Reset and boot... and try su without Magisk APK...


Edit 3.

Maybe i shoot in my own knie by playing before with few reboot Commands...
like reb..t secure

Because this funny Icon with x.... and I was not able to Factory Reset from menu... but from Recovery...
Puh... need to check how I can remove this...

D:\Android\adb>adb shell
freshul:/ $ su2
/system/bin/sh: su2: inaccessible or not found
127|freshul:/ $ cd /system/bin
freshul:/system/bin $ ls -a1l su2
ls: su2: No such file or directory
1|freshul:/system/bin $ ls -a1l su
lrwxrwxrwx 1 root root 8 2023-01-25 07:16 su -> ./magisk
freshul:/system/bin $ su
Permission denied

Edit 4.

Interesting the symlink allready exists... so not the Magisk APK generates this...

Edit 5.

Okidoki... also after full activating Magisk with APK my su2 is missing...

freshul:/ $ su
Permission denied
13|freshul:/ $ su
freshul:/ # cd /system/bin
freshul:/system/bin # ls -a1l su2
ls: su2: No such file or directory
1|freshul:/system/bin # ls -a1l su
lrwxrwxrwx 1 root root 8 2023-01-25 07:37 su -> ./magisk

So I need undo my stupid things before... to get rid of secure blabla...

I hope Bootloader lock unlock do this for me...

Edit 6.

Need some sleep... Watch need charging battery...

At the moment I have flashed back Original vbmeta.img and boot.img.. did few times Bootloader lock unlock...
Now only Bootloader is unlocked... Original boot.img... and only patched:

vbmeta.img

Watch is starting... and accept my "modified" super.img... its not dream because I have insert APks and deleted few files...
Will try next days to understand what happens to su2...

 

[javadahut]

Could someone confirm having similar issue?

Failure [INSTALL_FAILED_BLOCKED_CROSS_DOWN: INSTALL_FAILED_BLOCKED_CROSS_DOWN] ROLLBACK FAILED

I tried manually installing SMT recommended version but after adb uninstall and uninstalling updates and resetting it doesn't work when I try to manually install it throws an error, though after few moments get voice data menu and as far as I get is lang.poc after nothing else also

Confirmed, I have the same issue.

Android 13
Nov 2022 Security Patch
Default SMT system app v3.3.02.75

 

[mohitgalaxy3]

So trying to find how can i further improve network issues or find the difference between global and Korean model. Found that it doesn't support secondary 4G/LTE, though not sure the info is correct or not.

 

[Abish4i]

Confirmed, I have the same issue.

Android 13
Nov 2022 Security Patch
Default SMT system app v3.3.02.75

Actually I'm on dec 2021 patch

 

[profi_fahrer]

Sadly, I can't get it working. It basicly stops after opening the two shells with the commands. The easy method is unable to access the needed DLLs, even with Windows Defender turned completly off.

Is the "K0mraids_POC.apk" supposed to show a blank screen on startup, or should it load something else?

 

[adfree]

Somebody forked... whatever this means... and created exploit.sh...

Ehmmm... I am tooo blind to find this Shell Script.

Can somebody please help to find this?

Thanx in advance.

Best Regards

Edit 1.

Oh great... EXE AND Avira crashed on my old Notebook...

Edit 2.

The good news... for me.

SM-R860 tested also with "new" Firmware GWA3 successfully.

Notify Update

"""Security crap""" from January 2023...

So in theory also working for GW5... but here nobody confirmed yet...

 

[adfree]

Please help... need few ideas about folders... from where I can execute Binaries...

Here again stupid test with su as su2 renamed... I can chmod 777 in /cache folder but not execute...

In /cahce I can also mkdir... from system...

adb push su2 to /sdcard i did from other adb Window... as normal user...

This output only from system shell...

S/system/bin/sh: can't find tty fd: No such device or address
/system/bin/sh: warning: won't have full job control
:/ $ ls
ls: .: Permission denied
1|:/ $ cd /data/local/tmp
/system/bin/sh: <stdin>[2]: cd: /data/local/tmp: Permission denied
2|:/ $ cd /data/local/
:/data/local $ ls
ls: .: Permission denied
1|:/data/local $ mkdir test1
mkdir: 'test1': Permission denied
1|:/data/local $ cd ..
:/data $ mkdir test1
mkdir: 'test1': Permission denied
1|:/data $ whoami
system
:/data $ cd ..
:/ $ ls
ls: .: Permission denied
1|:/ $ fd -h
/system/bin/sh: <stdin>[11]: fd: inaccessible or not found
127|:/ $ df -h
Filesystem                                          Size  Used Avail Use% Mounted on
/dev/block/dm-0                                     3.4G  3.3G   99M  98% /
tmpfs                                               646M  1.2M  645M   1% /dev
tmpfs                                               646M     0  646M   0% /mnt
/dev/block/dm-1                                      84M   81M  1.3M  99% /vendor
/dev/block/dm-2                                     169M  169M     0 100% /product
/dev/block/dm-3                                     3.9M  984K  2.9M  25% /odm
/dev/block/platform/10500000.dwmmc0/by-name/prism   581M  179M  390M  32% /prism
/dev/block/platform/10500000.dwmmc0/by-name/optics   39M  500K   37M   2% /optics
tmpfs                                               646M     0  646M   0% /apex
/dev/block/by-name/omr                               16M   24K   15M   1% /omr
/dev/block/platform/10500000.dwmmc0/by-name/cache   193M  6.0M  183M   4% /cache
/dev/block/platform/10500000.dwmmc0/by-name/sec_efs 3.8M  1.3M  2.3M  37% /efs
/dev/fuse                                           8.3G  701M  7.5G   9% /storage/emulated
:/ $ cd /sdcard
:/sdcard $ ls
Alarms
Android
Audiobooks
DCIM
Documents
Download
Movies
Music
Notifications
Pictures
Podcasts
Ringtones
:/sdcard $ ls -a1l
total 36
drwx------ 2 u0_a117  u0_a117  3452 2023-01-25 08:04 Alarms
drwxrws--x 5 media_rw media_rw 3452 2023-01-25 08:04 Android
drwx------ 2 u0_a117  u0_a117  3452 2023-01-25 08:04 Audiobooks
drwx------ 2 u0_a117  u0_a117  3452 2023-01-25 08:04 DCIM
drwx------ 2 u0_a117  u0_a117  3452 2023-01-25 08:04 Documents
drwx------ 2 u0_a117  u0_a117  3452 2023-01-25 08:04 Download
drwx------ 3 u0_a117  u0_a117  3452 2023-01-25 08:04 Movies
drwxrwxr-x 4 media_rw media_rw 3452 2023-01-25 08:04 Music
drwx------ 2 u0_a117  u0_a117  3452 2023-01-25 08:04 Notifications
drwx------ 3 u0_a117  u0_a117  3452 2023-01-25 08:04 Pictures
drwx------ 2 u0_a117  u0_a117  3452 2023-01-25 08:04 Podcasts
drwx------ 2 u0_a117  u0_a117  3452 2023-01-25 08:04 Ringtones
:/sdcard $ ls -a1l
total 188
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Alarms
drwxrws--x 5 media_rw media_rw   3452 2023-01-25 08:04 Android
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Audiobooks
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 DCIM
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Documents
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Download
drwx------ 3 u0_a117  u0_a117    3452 2023-01-25 08:04 Movies
drwxrwxr-x 4 media_rw media_rw   3452 2023-01-25 08:04 Music
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Notifications
drwx------ 3 u0_a117  u0_a117    3452 2023-01-25 08:04 Pictures
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Podcasts
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Ringtones
-rw------- 1 u0_a117  u0_a117  154452 2023-01-22 22:17 su2
:/sdcard $ chmod 777 su2
:/sdcard $ ls -a1l
total 188
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Alarms
drwxrws--x 5 media_rw media_rw   3452 2023-01-25 08:04 Android
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Audiobooks
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 DCIM
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Documents
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Download
drwx------ 3 u0_a117  u0_a117    3452 2023-01-25 08:04 Movies
drwxrwxr-x 4 media_rw media_rw   3452 2023-01-25 08:04 Music
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Notifications
drwx------ 3 u0_a117  u0_a117    3452 2023-01-25 08:04 Pictures
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Podcasts
drwx------ 2 u0_a117  u0_a117    3452 2023-01-25 08:04 Ringtones
-rw------- 1 u0_a117  u0_a117  154452 2023-01-22 22:17 su2
:/sdcard $ ./su2
/system/bin/sh: <stdin>[18]: ./su2: can't execute: Permission denied
126|:/sdcard $ ./su2
/system/bin/sh: <stdin>[18]: ./su2: can't execute: Permission denied
126|:/sdcard $ cd /cache
:/cache $ ls -a1l
total 48
drwxrwx---  7 system cache   4096 2023-01-25 08:02 .
drwxr-xr-x 27 root   root    4096 2008-12-31 15:00 ..
d?????????  ? ?      ?          ?                ? backup
drwx------  2 system system  4096 2023-01-25 08:02 backup_stage
drwxrwx---  2 system system  4096 2023-01-25 08:02 fota
drwxrwx---  2 root   root   16384 2023-01-25 08:02 lost+found
drwxrwx---  2 system cache   4096 2023-01-26 01:52 recovery
:/cache $ mkdir test1
:/cache $ ls -a1l
total 52
drwxrwx---  8 system cache   4096 2023-01-26 02:10 .
drwxr-xr-x 27 root   root    4096 2008-12-31 15:00 ..
d?????????  ? ?      ?          ?                ? backup
drwx------  2 system system  4096 2023-01-25 08:02 backup_stage
drwxrwx---  2 system system  4096 2023-01-25 08:02 fota
drwxrwx---  2 root   root   16384 2023-01-25 08:02 lost+found
drwxrwx---  2 system cache   4096 2023-01-26 01:52 recovery
drwx------  2 system system  4096 2023-01-26 02:10 test1
:/cache $ cd /sdcard
:/sdcard $ cp su2 /cache
:/sdcard $ cd /cache
:/cache $ ls -a1l su2
-rw------- 1 system system 154452 2023-01-26 02:11 su2
:/cache $ chmod 777 su2
:/cache $ ls -a1l su2
-rwxrwxrwx 1 system system 154452 2023-01-26 02:11 su2
:/cache $ ./su2
/system/bin/sh: <stdin>[29]: ./su2: can't execute: Permission denied
126|:/cache $ su2
/system/bin/sh: <stdin>[30]: su2: inaccessible or not found
127|:/cache $ /cache/su2
/system/bin/sh: <stdin>[31]: /cache/su2: can't execute: Permission denied

Maybe other usefull Binaries possible to run... or some *.sh shell scripts...

Thanx for every idea...

If we can not access to /system/bin... then maybe we can Copy and Paste to other path and run...

Who knows....

Best Regards

Edit 1.

Google search...

Execute a pure binary file on Android

Is there a way to run a binary executable file (compile with NDK), on Android? /* #includes #defines ... */ int main(){ // Do something when this is executed return 0; } I want it to run

stackoverflow.com

/data/bin

Hmmm... seems not exists in my device... I can not mkdir bin in /data

Edit 2.

From ADB Window...

freshul:/sdcard $ ls
Alarms  Android  Audiobooks  DCIM  Documents  Download  Movies  Music  Notifications  Pictures  Podcasts  Ringtones  su2
freshul:/sdcard $ cp su2 /data/local/tmp
freshul:/sdcard $ cd /data/local/tmp
freshul:/data/local/tmp $ ls -a1l
total 15758
drwxrwx--x 2 shell shell     3452 2023-01-26 02:37 .
drwxr-x--x 4 root  root      3452 2023-01-25 08:02 ..
-rw-rw-rw- 1 shell shell 15955101 2023-01-18 17:08 samsungTTSVULN2.apk
-rw------- 1 shell shell   154452 2023-01-26 02:37 su2
freshul:/data/local/tmp $ chmod 777 su2
freshul:/data/local/tmp $ ls -a1l
total 15758
drwxrwx--x 2 shell shell     3452 2023-01-26 02:37 .
drwxr-x--x 4 root  root      3452 2023-01-25 08:02 ..
-rw-rw-rw- 1 shell shell 15955101 2023-01-18 17:08 samsungTTSVULN2.apk
-rwxrwxrwx 1 shell shell   154452 2023-01-26 02:37 su2

Edit 3.

Hmmmmmmmmmm... from ADB Window...

freshul:/data/local/tmp $ /data/local/tmp/su2
su2: applet not found
1|freshul:/data/local/tmp $ /data/local/tmp/su2 -version
su2: applet not found
1|freshul:/data/local/tmp $ /data/local/tmp/su2 -h
su2: applet not found
1|freshul:/data/local/tmp $ /data/local/tmp/su2 --help
su2: applet not found

This su is taken from Magisk 25.2 ... will check some easier Binary...

Edit 4.

after found this...

Google Issue Tracker

issuetracker.google.com

Tried via system shell...

:/data/user/0 $ ls
android
com.acr.shellterminalemulator
com.android.backupconfirm
com.android.bluetooth
com.android.captiveportallogin
com.android.carrierconfig
com.android.cellbroadcastreceiver
com.android.certinstaller
com.android.companiondevicemanager
com.android.cts.ctsshim
com.android.cts.priv.ctsshim
com.android.dynsystem
com.android.hotspot2.osulogin
com.android.inputdevices
com.android.keychain
com.android.localtransport
com.android.location.fused
com.android.managedprovisioning
com.android.mms.service
com.android.modulemetadata
com.android.mtp
com.android.networkstack.inprocess
com.android.networkstack.permissionconfig
com.android.networkstack.tethering.inprocess
com.android.nfc
com.android.phone
com.android.providers.blockednumber
com.android.providers.calendar
com.android.providers.downloads
com.android.providers.media
com.android.providers.media.module
com.android.providers.settings
com.android.providers.telephony
com.android.providers.userdictionary
com.android.se
com.android.server.telecom
com.android.shell
com.android.soundpicker
com.android.statementservice
com.android.vending
com.android.wallpaperbackup
com.android.wearable.resources
com.android.wifi.resources
com.corproxy.files
com.google.android.apps.maps
com.google.android.apps.messaging
com.google.android.apps.wearable.retailattractloop
com.google.android.apps.wearable.settings
com.google.android.apps.wearable.systemui
com.google.android.apps.work.clouddpc
com.google.android.clockwork.oemsetup
com.google.android.ext.services
com.google.android.ext.shared
com.google.android.gms
com.google.android.gsf
com.google.android.marvin.talkback
com.google.android.networkstack.tethering.overlay
com.google.android.overlay.modules.cellbroadcastreceiver
com.google.android.packageinstaller
com.google.android.partnersetup
com.google.android.permissioncontroller
com.google.android.tts
com.google.android.wearable.ambient
com.google.android.wearable.app
com.google.android.wearable.app.overlay.refsysui.default
com.google.android.wearable.assistant
com.google.android.wearable.batteryservices
com.google.android.wearable.frameworkpackagestubs
com.google.android.wearable.healthservices
com.google.android.wearable.overlay.home.merlot
com.monotype.android.font.chococooky
com.monotype.android.font.cooljazz
com.monotype.android.font.foundation
com.monotype.android.font.rosemary
com.monotype.android.font.samsungone
com.samsung.SMT
com.samsung.SMT.lang.poc
com.samsung.aasaservice
com.samsung.accessibility
com.samsung.advancedcallservice
com.samsung.advp.imssettings
com.samsung.android.aircommandmanager
com.samsung.android.app.contacts
com.samsung.android.app.esimkeystring
com.samsung.android.app.reminder
com.samsung.android.app.routines
com.samsung.android.app.telephonyui
com.samsung.android.apps.wearable.recent
com.samsung.android.batterysavingsettings
com.samsung.android.bixby.agent
com.samsung.android.bixby.wakeup
com.samsung.android.calendar
com.samsung.android.cidmanager
com.samsung.android.clientconnection
com.samsung.android.dialer
com.samsung.android.dqagent
com.samsung.android.gallery.watch
com.samsung.android.honeyboard
com.samsung.android.incallui
com.samsung.android.location.locproxy
com.samsung.android.mcfds
com.samsung.android.mdecservice
com.samsung.android.mediacontroller
com.samsung.android.messaging
com.samsung.android.networkstack
com.samsung.android.providers.contacts
com.samsung.android.providers.factory
com.samsung.android.samsungnetworklocation
com.samsung.android.samsungpay.gear
com.samsung.android.scloud
com.samsung.android.sdk.handwriting.watch
com.samsung.android.service.health
com.samsung.android.shealthmonitor
com.samsung.android.smartgesture
com.samsung.android.stextclassifier
com.samsung.android.storage.watchstoragemanager
com.samsung.android.video.wearable
com.samsung.android.watch.alarm
com.samsung.android.watch.cameracontroller
com.samsung.android.watch.compass
com.samsung.android.watch.findmyphone
com.samsung.android.watch.findmywatch
com.samsung.android.watch.flashlight
com.samsung.android.watch.runestone.app
com.samsung.android.watch.safety_assistance
com.samsung.android.watch.screencapture
com.samsung.android.watch.stf
com.samsung.android.watch.stopwatch
com.samsung.android.watch.timer
com.samsung.android.watch.watchface.analogmodular
com.samsung.android.watch.watchface.analoguefont
com.samsung.android.watch.watchface.animal
com.samsung.android.watch.watchface.aremoji
com.samsung.android.watch.watchface.basicclock
com.samsung.android.watch.watchface.basicdashboard
com.samsung.android.watch.watchface.bespoke
com.samsung.android.watch.watchface.bitmoji
com.samsung.android.watch.watchface.companionhelper
com.samsung.android.watch.watchface.digitalfont
com.samsung.android.watch.watchface.digitalmodular
com.samsung.android.watch.watchface.dualwatch
com.samsung.android.watch.watchface.emergency
com.samsung.android.watch.watchface.endangeredanimal
com.samsung.android.watch.watchface.healthmodular
com.samsung.android.watch.watchface.large
com.samsung.android.watch.watchface.livewallpaper
com.samsung.android.watch.watchface.myphoto
com.samsung.android.watch.watchface.mystyle
com.samsung.android.watch.watchface.premiumanalog
com.samsung.android.watch.watchface.simpleanalogue
com.samsung.android.watch.watchface.simpleclassic
com.samsung.android.watch.watchface.simplecomplication
com.samsung.android.watch.watchface.superfiction
com.samsung.android.watch.watchface.tickingsound
com.samsung.android.watch.watchface.together
com.samsung.android.watch.watchface.typography
com.samsung.android.watch.watchface.weather
com.samsung.android.watch.weather
com.samsung.android.watch.worldclock
com.samsung.android.wcs.extension
com.samsung.android.wear.blockednumber
com.samsung.android.wear.calculator
com.samsung.android.wear.musictransfer
com.samsung.android.wear.shealth
com.samsung.android.wear.voicerecorder
com.samsung.android.wearable.music
com.samsung.android.wearable.samsungaccount
com.samsung.android.wearable.setupwizard
com.samsung.android.wearable.sysui
com.samsung.euicc
com.samsung.euicc.wmservice
com.samsung.packageinstalleroverlay
com.samsung.sec.android.application.csc
com.samsung.sree.classic
com.samsung.sree.countdown
com.samsung.sree.digital
com.samsung.sree.spin
com.samsung.wear.contacts.sync
com.sds.emm.cloud.knox.samsung
com.sec.android.RilServiceModeApp
com.sec.android.app.bluetoothtest
com.sec.android.app.factorykeystring
com.sec.android.app.factorymode
com.sec.android.app.hwmoduletest
com.sec.android.app.parser
com.sec.android.app.personalization
com.sec.android.app.servicemodeapp
com.sec.android.app.wlantest
com.sec.android.diagmonagent
com.sec.android.easyMover
com.sec.android.sdhms
com.sec.android.soagent
com.sec.app.RilErrorNotifier
com.sec.automation
com.sec.bcservice
com.sec.factory
com.sec.hiddenmenu
com.sec.imsservice
com.sec.location.nfwlocationprivacy
com.sec.modem.settings
com.sec.phone
com.sec.usbsettings
com.sem.factoryapp
com.skms.android.agent
com.wssyncmldm
de.szalkowski.activitylauncher
:/data/user/0 $

:/data/user/0 $ cd /sdcard
:/sdcard $ cp su2 /data/user/0
cp: /data/user/0/su2: Permission denied

 

[mohitgalaxy3]

@wr3cckl3ss1
I was wondering if the exploit can enable the cross flashing somehow. Like can we change model no for SM-G998N single sim to accept SM-G998B australian single sim firmware.
For example U and U1 can do cross flash.

 

[subevilx]

@subevilx
Now we come closer to Rocket Science... because damn Crypto...

Other files also different secured... Minimum by Samsung signing stuff...

For instance I have no idea how to disable Security check in:

vbmeta_system.img

Similar to vbmeta.img... which holds Security info for boot.img and recovery.img

Then I could flash modified super.img... in theory...

Maybe somebody have an idea. As my Bootloader has no Fastboot Support...
Only FACtory sboot.bin has Fasboot...

Best Regards

I cant go beyond this if I change even one bit in a file im stuck on file analysis any help?

 

[mauricio1352]

is there any way to contact you? I have an A71 with KG LOCKED, it would be interesting to test some commands on it, to see if I can get KG COMPLETED, just like yours

 

[Tofor]

sorry to bust in here and ask something somewhat off subject. But i was curious how you got the cmds for opening the hidden menus? What do all the numbers at the end stand for? I'm asking because there has always been something that has come up in my list of secret codes for samsung. near the end of the list there comes some secret codes that are in all caps letters. one such code that is on all my unlockable devices is *#UNLOCKKERNEL#. its part of the IOT hidden menu. but i cant find any such option inside the hidden menu itself. Curious if it could be executed the same way as you did for the other parts of the IOT Hidden Menu. to me. unlock kernel will either unlock the bootloader. or it will make the kernel debuggable. either would be awesome. Thanks for any light you can shed on this secret code.

 

[Tofor]

sorry to bust in here and ask something somewhat off subject. But i was curious how you got the cmds for opening the hidden menus? What do all the numbers at the end stand for? I'm asking because there has always been something that has come up in my list of secret codes for samsung. near the end of the list there comes some secret codes that are in all caps letters. one such code that is on all my unlockable devices is *#UNLOCKKERNEL#. its part of the IOT hidden menu. but i cant find any such option inside the hidden menu itself. Curious if it could be executed the same way as you did for the other parts of the IOT Hidden Menu. to me. unlock kernel will either unlock the bootloader. or it will make the kernel debuggable. either would be awesome. Thanks for any light you can shed on this secret code.

note. this secret code did not appear on my device until i used the system shell to enable the hidden menus

 

[[email protected]]

https://github.com/flankerhqd/vendor-android-cves/tree/master/SMT-CVE-2019-16253 is this the same?

 

[adfree]

D:\Android\adb>adb shell
freshul:/ $ su
freshul:/ # mount -vo remount,rw /
try '/dev/block/dm-0' type 'ext4' on '/'
freshul:/ # cd /sdcard
freshul:/sdcard # ls -a1l su2
-rw------- 1 u0_a117 u0_a117 154452 2023-01-22 22:17 su2
freshul:/sdcard # cp su2 /system/bin
freshul:/sdcard # cd /system/bin
freshul:/system/bin # ls -a1l su2
-rw------- 1 root root 154452 2023-01-27 04:21 su2
freshul:/system/bin # chmod 777 su2
freshul:/system/bin # ls -a1l su2
-rwxrwxrwx 1 root root 154452 2023-01-27 04:21 su2
freshul:/system/bin # reboot



D:\Android\adb>adb shell
freshul:/ $ su
freshul:/ # cd /system/bin
freshul:/system/bin # ls -a1l su2
ls: su2: No such file or directory
1|freshul:/system/bin # exit
1|freshul:/ $ exit

D:\Android\adb>adb pull /sdcard .\dump
/sdcard/: 147 files pulled, 0 skipped. 2.6 MB/s (117491085 bytes in 42.623s)

D:\Android\adb>adb shell
freshul:/ $ su
freshul:/ # cd /sdcard
freshul:/sdcard # cp su2 /cache
freshul:/sdcard # cd /cache
freshul:/cache # ls -a1l su2
-rw------- 1 root root 154452 2023-01-27 04:48 su2
freshul:/cache # chmod 777 su2
freshul:/cache # ls -a1l su2
-rwxrwxrwx 1 root root 154452 2023-01-27 04:48 su2
freshul:/cache # /cache/su2 --help
su2: applet not found

Tried short again today...
On my Magisk rooted SM-R875F...

this time only rebooted after copied su2 into /system/bin

su2 is gone...

I am now trying to check what is in Log files... To find the "self cleaning"...

Also short tried same su2 from /cache folder with same result I know...

Plan for next days... flash normal unmodified Original Stock Firmware... and check other Binaries in /cache folder with system user...

Best Regards

 

[adfree]

partition_tools - platform/system/extras - Git at Google

What is with lpflash...

lpflash writes a non-sparse image from lpmake to a block device. It is intended to be run on the device itself.

Usage: lpflash /dev/block/sdX /path/to/image/file

Maybe this could be usefull... to prepare modified super.img...

Maybe this bypass Combination Firmware "problem"...

I need only to bring super.img to my SM-R875F...

boot.img and recovery.img I can flash via Odin...

Best Regards

 

[adfree]

Friendly user from Telegram group inspired me to check litle bit GSI stuff...

No idea why... but this tool not require system or root to show it exists...

On my Android 11 SM-R875F

freshul:/ $ gsi_tool --help
Unrecognized command: --help
gsi_tool - command-line tool for installing GSI images.

Usage:
  gsi_tool <disable|install|wipe|status> [options]

  disable      Disable the currently installed GSI.
  enable       [-s, --single-boot]
               [-d, --dsuslot slotname]
               Enable a previously disabled GSI.
  install      Install a new GSI. Specify the image size with
               --gsi-size and the desired userdata size with
               --userdata-size (the latter defaults to 8GiB)
               --wipe (remove old gsi userdata first)
  wipe         Completely remove a GSI and its associated data
  wipe-data    Ensure the GSI's userdata will be formatted
  cancel       Cancel the installation
  status       Show status
64|freshul:/ $ gsi_tool status
normal

After installing Treble Check APK from Playstore...
I have to sideload the APK with ADB...

I see few interesting things... see screenshots...

After some Google Power I saw this:

Dynamic System Updates (DSU) | Android Developers

Dynamic System Updates (DSU) lets developers install a GSI side by side with the device's system image on a DSU-supported device that runs Android 10 or higher.

developer.android.com

adb shell am start-activity \
-n com.android.dynsystem/com.android.dynsystem.VerificationActivity  \
-a android.os.image.action.START_INSTALL  \
-d file:///storage/emulated/0/Download/system_raw.gz  \
--el KEY_SYSTEM_SIZE $(du -b system_raw.img|cut -f1)  \
--el KEY_USERDATA_SIZE 8589934592

This looks not impossible to try...

My idea is to use system.img from Combination firmware... super.img...


So I have to prepare few steps before I can try... extracting with imjtool under Ubuntu...

Best Regards

 

[algarues]

If after succesfull exploit
An app is launched from command, will it have super user privileges?

For instance, would app manager or similar be enabled to stop services, broadcasts etc?