Database Users

Does changing the date actually force the update check?

Can anyone confirm that changing the date actually forces a check? Though the idea has been tossed around here like truth for a couple of days, I have seen only one post where someone said it works. Everyone else has said something along the lines of: I came home and it was up.
Everyone knows that if you set the clock forward, it says that the system was checked under system updates. Sorry, but that's not proof that it checks. That's proof that update check clock changes. I am asking if anyone has proof that changing the clock date actually forces a check. Proof would be either:
1) Someone has had the update actually happen immediately after changing the clock; or
2) There's evidence of internet activity consistent with checking for an update.
Can someone who's gotten the update explain what it looks like? When you turned it on, did it come up right after the animation? If you did the date trick, did you click "set" and it popped up immediately on screen? I am starting to think that the date change thing is only slowing this down; it just resets the clock for the update, it doesn't actually force the check.
Anyone have any other ideas? I am supposed to be studying for a final which is certainly why I'm obsessing about this, but I really can't help it. Anything to take my mind off studying for that horrible class. This final is going to kill me. (Then again, it's the last one I will EVER take!!!)

No it hasn't worked for me.

Coldheat1906 said:
No it hasn't worked for me.
Click to expand...
Click to collapse
Thanks. It hasn't worked for many people. I'm curious if anyone knows if it CAN work, or if it's just a myth.

the update will appear as a notification on the lower right hand of your Xoom kin a like a notification like you are downloading something from the market.

slack04 said:
Can anyone confirm that changing the date actually forces a check? ...
Click to expand...
Click to collapse
On my Wifi only Xoom it forces a check.
For example;
1. My Xoom says it last checked for an update at 1:10pm and it is now 6:10pm on the same day
2. I change the date to one day in advance
3. I go to sytem updates and it says it last checked at 6:10pm
So it did force a check.
Whether or not an update is available for your Xoom is a different story.
The date change will force a check but not force the actual update.

laredo7mm said:
On my Wifi only Xoom it forces a check.
For example;
1. My Xoom says it last checked for an update at 1:10pm and it is now 6:10pm on the same day
2. I change the date to one day in advance
3. I go to sytem updates and it says it last checked at 6:10pm
So it did force a check.
Whether or not an update is available for your Xoom is a different story.
The date change will force a check but not force the actual update.
Click to expand...
Click to collapse
Sorry, but that's not proof that it checks. That's proof that update check clock changes. I thought that was clear in my first post. I am asking if anyone has proof that changing the clock date actually forces a check. Proof would be either:
1) Someone has had the update actually happen immediately after changing the clock; or
2) There's evidence of internet activity consistent with checking for an update.

you can force an update check using these steps:
1. hold power+volup, the xoom will reboot
2. after reboot go to system settings and check for updates

doin this hasn't worked for me at all. Tried several times even with reboots. Yes the time changes but doesn't mean it really did anything. Frustrated the Wifi users are rolling today and here I sit with 3G and nothing still.

ruinah said:
doin this hasn't worked for me at all. Tried several times even with reboots. Yes the time changes but doesn't mean it really did anything. Frustrated the Wifi users are rolling today and here I sit with 3G and nothing still.
Click to expand...
Click to collapse
Yesterday I re-imaged my xoom to stock but realized too late that I was using 3.0 instead of 3.0.1. I went in and changed the date and set it back to automatic. My Xoom immediately started downloading the 3.0.1 patch. That is about as much proof as I can provide.

Yes it does force a check
This is what shows up in the logcat after changing the date:
D/SystemClock( 8596): Setting time of day to sec=1307904965
D/SystemClock( 133): Setting time of day to sec=1305226357
D/Beautiful Widgets( 846): Received Weather refresh Intent
E/Beautiful Widgets( 846): Acquiring new WakeLock on an existing notheld instance
D/Beautiful Widgets( 846): Service for Weather started
V/Beautiful Widgets( 846): Service AccuWeather onStart()
D/Beautiful Widgets( 846): Service AccuWeather Thread started
I/Beautiful Widgets( 846): Provider is network
I/Beautiful Widgets( 846): Requesting location update
I/EventLogService( 247): Aggregate from 1307904746624 (log), 1307904746506 (data)
E/TelephonyManager( 247): Hidden constructor called more than once per process!
E/TelephonyManager( 247): Original: com.google.android.location, new: com.google.android.gsf
I/CheckinService( 247): Preparing to send checkin request
I/EventLogService( 247): Accumulating logs since 1307904965403
D/dalvikvm( 846): GC_CONCURRENT freed 867K, 13% free 8280K/9479K, paused 3ms+4ms
I/CheckinTask( 247): Sending checkin request (1486 bytes)
D/dalvikvm( 846): GC_CONCURRENT freed 561K, 12% free 8406K/9479K, paused 3ms+3ms
V/AlarmClock( 8642): AlarmInitReceiver finished
D/dalvikvm( 133): GC_CONCURRENT freed 3891K, 29% free 21271K/29639K, paused 4ms+10ms
D/CalendarWidget( 8547): Scheduled next update at [1307941200000] 00:00:00 (+603 mins)
D/dalvikvm( 846): GC_CONCURRENT freed 963K, 14% free 8177K/9479K, paused 5ms+7ms
D/dalvikvm( 846): GC_CONCURRENT freed 494K, 12% free 8348K/9479K, paused 4ms+3ms
D/dalvikvm( 227): GC_FOR_ALLOC freed 1629K, 3% free 124319K/127879K, paused 77ms
D/dalvikvm( 227): GC_CONCURRENT freed 519K, 3% free 124143K/127879K, paused 2ms+13ms
I/CheckinTask( 247): Checkin success: https://android.clients.google.com/checkin (1 requests sent)
I/CheckinService( 247): From server: Intent { act=android.server.checkin.FOTA_CANCEL }
As you can see I still haven't gotten 3.1

El Daddy said:
This is what shows up in the logcat after changing the date:
D/SystemClock( 8596): Setting time of day to sec=1307904965
D/SystemClock( 133): Setting time of day to sec=1305226357
...
...
...
I/CheckinTask( 247): Checkin success: https://android.clients.google.com/checkin (1 requests sent)
I/CheckinService( 247): From server: Intent { act=android.server.checkin.FOTA_CANCEL }
Click to expand...
Click to collapse
slack04 said:
Sorry, but that's not proof that it checks. That's proof that update check clock changes. I thought that was clear in my first post...
Click to expand...
Click to collapse
Well, there you have your proof. Now, go study and quit being such a d-bag. I guess you were not clear since you had to go back and edit your post after I submitted my initial response.

laredo7mm said:
Well, there you have your proof. Now, go study and quit being such a d-bag. I guess you were not clear since you had to go back and edit your post after I submitted my initial response.
Click to expand...
Click to collapse
Excuse me? Yeah, I edited the post to make my question more clear.
Your post was not useful; in fact it showed that you hadn't really thought through the process before you posted. I wasn't rude to you, I just pointed out the error in your logic, which made me realize that I should go back and clarify my question. Who's the "d-bag" here?

Huh? I edited my post to bold the checkin. I skimmed through this thread and thought I would confirm to people it did indeed check in. I'm not trying to show anyone up. Just trying to be helpful.
Wtf?
Sent from my Xoom using XDA Premium App

El Daddy said:
Huh? I edited my post to bold the checkin. I skimmed through this thread and thought I would confirm to people it did indeed check in. I'm not trying to show anyone up. Just trying to be helpful.
Wtf?
Sent from my Xoom using XDA Premium App
Click to expand...
Click to collapse
Thanks dude, you answered the question. He was actually talking to me; I couldn't tell you what his problem is, though. In any case, you've answered the question, so I'm going to go back to clock-changing-update-checking right now! Thank you!

well I'm just glad its been proven. And I don't agree with the ops original statement that it would have caused an issue if it didn't actually force a check. Only because I don't feel that changing the date would actually affect anything to do with checking for an update, either way it is checking the same server w/the same access codes.
For example, if someone would have 3.0 and set the date back to the xooms launch day and ran a check for an update would still be updated to 3.01 or if lucky 3.1.
Like the date on your xoom is only for creating time stamps on the xoom.

I explained how this works in my post below:
http://forum.xda-developers.com/showthread.php?t=1076295

RadDudeTommy said:
well I'm just glad its been proven. And I don't agree with the ops original statement that it would have caused an issue if it didn't actually force a check. Only because I don't feel that changing the date would actually affect anything to do with checking for an update, either way it is checking the same server w/the same access codes.
For example, if someone would have 3.0 and set the date back to the xooms launch day and ran a check for an update would still be updated to 3.01 or if lucky 3.1.
Like the date on your xoom is only for creating time stamps on the xoom.
Click to expand...
Click to collapse
It's moot at this point, but it was when you wrote your post also. What I was suggesting was that, if it wasn't actually checking by changing the date, then we could be stopping the actual update check from happening by trying, therefore setting us back by 12 hours (about the frequency of the automatic checks) every time we tried to "cheat." Of course, now that it's shown that the check does actually query the server (and that makes very little difference to when you actually get your update) my original guess (not statement) is obviously incorrect.

laredo7mm said:
Well, there you have your proof. Now, go study and quit being such a d-bag. I guess you were not clear since you had to go back and edit your post after I submitted my initial response.
Click to expand...
Click to collapse
+1
Really getting tired of this guy talking down to everyone. Don't know when I have ever see someone as condescending.
Sent from my ADR6300 using XDA App

RadDudeTommy said:
well I'm just glad its been proven. And I don't agree with the ops original statement that it would have caused an issue if it didn't actually force a check. Only because I don't feel that changing the date would actually affect anything to do with checking for an update, either way it is checking the same server w/the same access codes.
For example, if someone would have 3.0 and set the date back to the xooms launch day and ran a check for an update would still be updated to 3.01 or if lucky 3.1.
Like the date on your xoom is only for creating time stamps on the xoom.
Click to expand...
Click to collapse
Suppose our entire solar system was contained in a drop of water abiut to get wiped by a windshield wiper?

kyoteqwik said:
+1
Really getting tired of this guy talking down to everyone. Don't know when I have ever see someone as condescending.
Sent from my ADR6300 using XDA App
Click to expand...
Click to collapse
That's friendly.

Please try running nmap

Hi,
I have run nmap (from my windows xp machine) against my Samsung Galaxy S2:
Phone: GT-I9100
Android version: 2.3.4
Kernel: Linux/2.6.35.7-I9100XWKI4-CL575468
Command: nmap -v -sT -p1-65535 IP-ADDRESS-HERE-OF-SGS2
Results:
PORT STATE SERVICE
25/tcp open smtp
80/tcp open http
110/tcp open pop3
119/tcp open nntp
143/tcp open imap
465/tcp open smtps
563/tcp open snews
587/tcp open submission
993/tcp open imaps
995/tcp open pop3s
3124/tcp open unknown
3127/tcp open unknown
3128/tcp open squid-http
8008/tcp open http
8080/tcp open http-proxy
8081/tcp open blackice-icecap
8091/tcp open unknown
8888/tcp open sun-answerbook
33003/tcp open unknown
I don't understand why those ports are opened. My phone is not rooted.
Please try to run the same command against your device to test.
Are those ports opened by default? Is this normal?
I have run netstat(after restarting the device) with Terminal Emulator:
$ netstat
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 127.0.0.1:7777 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7203 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:32500 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7777 127.0.0.1:42230 ESTABLISHED
tcp 0 0 127.0.0.1:42230 127.0.0.1:7777 ESTABLISHED
tcp 0 0 127.0.0.1:7777 127.0.0.1:42229 ESTABLISHED
tcp 0 0 127.0.0.1:42229 127.0.0.1:7777 ESTABLISHED
tcp6 0 0 ::ffff:10.0.0.67:33003 :::* LISTEN
tcp6 0 0 ::ffff:10.0.0.67:43328 ::ffff:173.194.35.177:443 ESTABLISHED
tcp6 0 0 ::ffff:10.0.0.67:40398 ::ffff:173.194.70.188:5228 ESTABLISHED
tcp6 0 0 ::ffff:10.0.0.67:48864 ::ffff:46.137.161.127:5223 ESTABLISHED
udp6 0 0 :::1900 :::* CLOSE

Open ports are opened on your modem/router, it has nothing to do with your phone. I.e. port 80 is used for websites, etc.
Sent from my GT-I9100 using XDA

I have run the nmap command on the IP address of my phone. I don't understand what you are trying to say. I have a router of course.

icf80 said:
I have run the nmap command on the IP address of my phone. I don't understand what you are trying to say. I have a router of course.
Click to expand...
Click to collapse
You said you don't understand why the ports are open. They're open because you're on the Internet. Your phone doesn't need to be rooted because it has nothing to do with your phone.
The ports are open on your modem/router, not your phone. There open because they are used to communicate, like 80 is used to communicate with websites, if port 80 was closed, you would have a lot of problems.
Do you understand now?
P.s. Different people will have different ports open depending what they're doing, so there's no need to ask people to post their results.
Sent from my GT-I9100 using XDA

If you run NMAP from a computer in the same network as the phone, you'll see that there are no open ports on it, unless you're running network daemons on your phone.

scraps elsometa
try this
http : // IP-ADDRESS-OF-YOUR-SGS2-PHONE : 33003/
from a computer on the lan where also the phone is connect via wi-fi.
I get this:
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"></head><body></body></html>
An empty page
If I do telnet on it(port 33003) I receive, after writing something random:
HTTP/1.1 400 Bad Request
Content-Type: text/html; charset="utf-8"
Server: Linux/2.6.35.7-I9100XWKI4-CL575468 DoaHTTP
Content-Length: 0
Date: Fri, 16 Mar 2012 18:11:46 GMT

Are you sure you scanned the phone IP ? there are lots of open ports in your scan, but it doesn't match the netstat output (an Android phone wouldn't have ports 25 and 80 open anyway).
Bad news: netstat on Android lacks a "-p" option to show the PID of the listening process. You could do "cat /proc/net/tcp" and get the uid column values (which are actually user IDs) and inquire further from there.
Good news: you shouldn't worry much, as all the listening services you've shown in your netstat are tied to the loopback interface (listening locally and not open to the outside world). When you see something like "*ort_number" or "your.public.iport_number" in netstat, that's when you should check the processes.
After cleaning my phone from all Samsung stuff, I still have listening processes on ports 7777, 7203, 5037 and 32500 (all on the loopback interface). 7777 seems to be used for RILD connections from libsecril-client (Samsung's non-free RIL). 5037 seems to belong to ADB. No idea for 7203 and 32500 though.

icf80 said:
I have run the nmap command on the IP address of my phone. I don't understand what you are trying to say. I have a router of course.
Click to expand...
Click to collapse
He seems to think that you're scanning a router's IP address instead of the phone's IP address.

Your nmap scan output and netstat output does not match. Unless until you running these services on your phone these ports should not be shown as open.
Why don't you download a packet stiffer like "shark for root" and analyze the packet capture(if you know bow to do it)
If you still feel that you scanned the right ip address and you did not install these services then my second suspicion would be a malware or backdoored app on your phone which typically opens up random ports to steal data and send to its c&c servers. Malware can get in to your phone if you use non market app or warez .
Hope that helps.
Sent from my GT-I9100 using xda premium

I have used only Google Market(Play) to install apps. I never rooted the phone.
There is a matching port at least:
nmap: 33003/tcp open unknown
netstat: tcp6 0 0 ::ffff:10.0.0.67:33003 :::* LISTEN
I have re-run the command at home only on the first 1000 ports:
nmap -v -sT -p1-1000 192.168.1.173
Starting Nmap 5.51 ( http :// nmap . org ) at 2012-03-19 18:41 GTB Standard Time
Initiating ARP Ping Scan at 18:41
Scanning 192.168.1.173 [1 port]
Completed ARP Ping Scan at 18:41, 0.49s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 18:41
Completed Parallel DNS resolution of 1 host. at 18:41, 0.03s elapsed
Initiating Connect Scan at 18:41
Scanning 192.168.1.173 [1000 ports]
Discovered open port 993/tcp on 192.168.1.173
Discovered open port 995/tcp on 192.168.1.173
Discovered open port 143/tcp on 192.168.1.173
Discovered open port 25/tcp on 192.168.1.173
Discovered open port 587/tcp on 192.168.1.173
Discovered open port 110/tcp on 192.168.1.173
Discovered open port 465/tcp on 192.168.1.173
Discovered open port 563/tcp on 192.168.1.173
Discovered open port 119/tcp on 192.168.1.173
Completed Connect Scan at 18:41, 41.31s elapsed (1000 total ports)
Nmap scan report for 192.168.1.173
Host is up (0.00040s latency).
Not shown: 991 filtered ports
PORT STATE SERVICE
25/tcp open smtp
110/tcp open pop3
119/tcp open nntp
143/tcp open imap
465/tcp open smtps
563/tcp open snews
587/tcp open submission
993/tcp open imaps
995/tcp open pop3s
MAC Address: xx:yy:zz:aa:vv:dd (Unknown) (the mac address is correct)
---
$ netstat
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 127.0.0.1:7777 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7203 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:32500 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7777 127.0.0.1:44180 ESTABLISHED
tcp 0 0 127.0.0.1:44179 127.0.0.1:7777 ESTABLISHED
tcp 0 0 127.0.0.1:44180 127.0.0.1:7777 ESTABLISHED
tcp 0 0 127.0.0.1:7777 127.0.0.1:44179 ESTABLISHED
tcp6 0 0 ::ffff:192.168.1.173:33003 :::* LISTEN
tcp6 0 0 ::ffff:192.168.1.173:53469 ::ffff:74.125.232.206:443 TIME_WAIT
tcp6 0 0 ::ffff:192.168.1.173:42985 ::ffff:173.194.70.188:5228 ESTABLISHED
tcp6 0 0 ::ffff:192.168.1.173:35035 ::ffff:46.137.160.71:5223 ESTABLISHED
tcp6 0 0 ::ffff:192.168.1.173:46207 ::ffff:173.194.35.146:443 ESTABLISHED
udp6 0 688 :::1900 :::* CLOSE
udp6 0 0 :::1900 :::* CLOSE
$ cat /proc/net/tcp
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
0: 0100007F:1E61 00000000:0000 0A 00000000:00000000 00:00000000 00000000 1001 0 1893 1 e625c4a0 300 0 0 2 -1
1: 0100007F:1C23 00000000:0000 0A 00000000:00000000 00:00000000 00000000 1001 0 1892 1 e625c000 300 0 0 2 -1
2: 0100007F:7EF4 00000000:0000 0A 00000000:00000000 00:00000000 00000000 1000 0 1436 1 e62a8000 300 0 0 2 -1
3: 0100007F:1E61 0100007F:AC94 01 00000000:00000000 00:00000000 00000000 1001 0 1997 1 e62a8940 20 0 0 5 -1
4: 0100007F:AC93 0100007F:1E61 01 00000000:00000000 00:00000000 00000000 1000 0 1902 1 e625c940 20 4 20 4 -1
5: 0100007F:AC94 0100007F:1E61 01 00000000:00000000 00:00000000 00000000 1013 0 1995 1 e62a84a0 20 4 24 2 -1
6: 0100007F:1E61 0100007F:AC93 01 00000000:00000000 00:00000000 00000000 1001 0 1903 1 e625cde0 20 4 17 5 -1
$

But again, something doesn't match: you're saying netstat shows port 33003 open on an IPv6 interface, but your scan is for a IPv4 interface with 192.168.1.173. And none of the ports match at all, if it was the same device you'd have to have at least 1-2 ports in common.
Your router probably does some automatic port forwarding (UPNP-style) or you're scanning the wrong address. Just for kicks, I've done a nmap on my own phone connected directly to the laptop through WiFi:
Code:
vaxxi$ sudo nmap -sT -O -Pn 10.0.2.4
Starting Nmap 5.51 ( http://nmap.org ) at 2012-03-19 18:14 CET
Nmap scan report for 10.0.2.4
Host is up (0.015s latency).
Not shown: 999 closed ports
PORT STATE SERVICE
8080/tcp open http-proxy
OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU
No OS matches for host
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.78 seconds
vaxxi$ telnet 10.0.2.4 8080
Trying 10.0.2.4...
Connected to 10.0.2.4.
Escape character is '^]'.
GET / HTTP/1.0
HTTP/1.0 301 Moved Permanently
Location: http:///www/index.html
Content-Length: 0
Connection: close
Date: Mon, 19 Mar 2012 17:15:02 GMT
Server: Swift1.0
Connection closed by foreign host.
Only port 8080 is open and that is Kies air.

Best way to judge is to trust your netstat output.
You can run port scanner on your mobile itself on 127.0.0.1 and cross verify.
try this https://play.google.com/store/apps/details?id=com.twistandroid.portscan

safepacket said:
Best way to judge is to trust your netstat output.
Click to expand...
Click to collapse
Not really. The 1st thing a decent rootkit would do is to modify the system tools in order to hide itself
That portscanner you posted is for scanning other hosts from your phone, not really helpful here. A nmap scan from outside is excellent, but you have to make sure you're scanning the right thing. And perhaps some wiresharking on the Ethernet interface of the device would be helpful.

VAXXi said:
Not really. The 1st thing a decent rootkit would do is to modify the system tools in order to hide itself
That portscanner you posted is for scanning other hosts from your phone, not really helpful here. A nmap scan from outside is excellent, but you have to make sure you're scanning the right thing. And perhaps some wiresharking on the Ethernet interface of the device would be helpful.
Click to expand...
Click to collapse
Rootkits comes later in the game, For confirming which ports are open in a system as a general rule of thumb netstat is the best way. It will show you what are the listening services simple as that.
NO serivice running no port open.
Nmap undoubtedly is a class, but doing port scanning externally can some times gives false positives depending on network conditions. Infact if you start testing a port scanner the developers compare there scanners against the output of Netstat.
Now since you brought up Rootkits let me say
In my initial post it self i mentioned that open ports on his phone can be due to wrong ip address(router issue) or may be a malware and
also wirsharking idea was mentioned.
icf80 seems to be using only apps from market and i am assuming his system must be clean unless until market has backdoored apps
And lastly please try the scanner on your phone on 127.0.0.1 and it will show you the open ports on your phone. I tried and tested in on mine before sharing the link. Btw nmapping on 127.0.0.1 on linux/win will also work.

Sorry, but either you're not understanding my comments or you don't know what you're talking about
safepacket said:
Rootkits comes later in the game, For confirming which ports are open in a system as a general rule of thumb netstat is the best way.
Click to expand...
Click to collapse
If I want to keep my listening process hidden, one of the 1st things to do would be modifying the system tools (ls, ps, netstat) to hide my stuff. No tool on a system can be 100% trusted.
safepacket said:
Nmap undoubtedly is a class, but doing port scanning externally can some times gives false positives depending on network conditions.
Click to expand...
Click to collapse
For a crappy scanner, perhaps. But if a host is answering on a port, then there's something listening on that port, plain and simple.
safepacket said:
And lastly please try the scanner on your phone on 127.0.0.1 and it will show you the open ports on your phone.
Click to expand...
Click to collapse
Well, duh, but it's irrelevant. As I wrote before: you have several processes on any system which are listening on the local interface for interprocess communication. It's normal to see them when you're looking from your OWN phone ! however, as they're not tied to an external interface, there is no harm in having them since they are not open to the outside world.

Funny how some people ask for help then have a go at those who volunteer their assistance

VAXXi said:
Sorry, but either you're not understanding my comments or you don't know what you're talking about
If I want to keep my listening process hidden, one of the 1st things to do would be modifying the system tools (ls, ps, netstat) to hide my stuff. No tool on a system can be 100% trusted.
For a crappy scanner, perhaps. But if a host is answering on a port, then there's something listening on that port, plain and simple.
Well, duh, but it's irrelevant. As I wrote before: you have several processes on any system which are listening on the local interface for interprocess communication. It's normal to see them when you're looking from your OWN phone ! however, as they're not tied to an external interface, there is no harm in having them since they are not open to the outside world.
Click to expand...
Click to collapse
Dude, i am not talking about a compromised phone which has some root kit installed. OP scanned his phone and found several ports open, Now suspicion is that he scanned on a wrong ip(or some router issue).
To avoid this confusion of ipaddress's i suggested netstat is the best bet assuming his phone is not tampered by a rootkit. This is what logically any one would do.
If you think form a security stand point , rootkits can do wierd things like closing/killing a legit service running on a port and starting a malcious service on the same port so that the user gets fooled that every thing is ok.
Do you think scanning externally can help in above situation. Rootskits have evolved beyond modding (ps/netstat/etc) to a new level.
Bottom line is that if think phone is comparmised nither netstat not scanning externally would give you actual result.
Does that make sense to you ? i hope yes. please correct me if i am wrong , i will be gald to learn some thing new if its right.

Yes, that's what I'm saying: on a compromised system nothing can be trusted anymore. That system gets disconnected from everything and you assume the worst onwards. You'd be surprised of what a hidden kernel module can do
But I highly doubt any current Android malware would go as far to modify low-level tools which aren't known by 90% of users anyway. Most go for easy stuff, like sending premium SMS.
tl;dr and to conclude this discussion:
- his netstat doesn't show anything suspicious
- the external scan matches the fingerprint of a normal web server (with too many open services, but that's something else)
- 99,99% he didn't scan the phone; adding the -O option in nmap would clarify things.

VAXXi said:
Yes, that's what I'm saying: on a compromised system nothing can be trusted anymore. That system gets disconnected from everything and you assume the worst onwards. You'd be surprised of what a hidden kernel module can do
But I highly doubt any current Android malware would go as far to modify low-level tools which aren't known by 90% of users anyway. Most go for easy stuff, like sending premium SMS.
tl;dr and to conclude this discussion:
- his netstat doesn't show anything suspicious
- the external scan matches the fingerprint of a normal web server (with too many open services, but that's something else)
- 99,99% he didn't scan the phone; adding the -O option in nmap would clarify things.
Click to expand...
Click to collapse
Agree! On a side note there are android malware's which can steal your call logs,sms and record coversations and lastly capture GPS coordinates.
i recently did some reversing on those samples to demo it to my employer.
Any ways good healthy discussion Cheers mate!

Yep, cheers for that. The premium numbers/SMS I can understand (you get money), but always wondered what would malware authors do with call logs and messages. Oh well, guess that's why I'm not into the malware business it's a shame indeed that it's such a mess with permissions on Android, good thing we have PDroid and DroidWall.
Now we have to see the OP's response, I'm curious.

[Q] cabotEL.log - tracking data?

While checking out my N4 I found the file cabotEL.log containing things like:
Code:
Feb 14, 2013 6:55:32 PM [First location received ] Location
--- Provider: gps
--- Lat: 29.XXXXXXXX
--- Lon: -82.XXXXXXXX
--- Accuracy: 3.0
--- HasSpeed: true Speed: 21.25
--- Time: 06:22:21
Feb 14, 2013 6:55:32 PM [OnLocationChanged: ] Location
--- Provider: network
--- Lat: 29.XXXXXXXX
--- Lon: -82.XXXXXXXX
--- Accuracy: 20.0
--- HasSpeed: false Speed: 0.0
--- Time: 06:55:32
and
Code:
Feb 14, 2013 6:57:17 PM Processed event: DisconnectedEvent BDA: XX:XX:XX:XX:XX:XX
Feb 14, 2013 7:02:36 PM Processed event: ConnectedEvent BDA: XX:XX:XX:XX:XX:XX
Feb 14, 2013 7:02:37 PM Processed event: USER_AGENT BDA:
Feb 14, 2013 7:02:37 PM Processed event: BATTERY BDA:
Feb 14, 2013 7:02:37 PM Processed event: DON BDA:
Feb 14, 2013 7:02:37 PM Processed event: SENSORSTATUS BDA:
This seems to be the bulk of the file. I've looked pretty thoroughly and I haven't been able to identify the culprit.
Has anyone seen this before?
Matt

berglundma said:
While checking out my N4 I found the file cabotEL.log containing things like:
Code:
How did you get this out of the file? I have the same thing in my Nexus 4 I noticed today. This is the only post anywhere about it.
Click to expand...
Click to collapse

Interesting I would like to know as well. I did search for the file but I didn't find any. Do you have location history on? I have it off. I wonder if that's the case or caused by a certain app?
Sent from my Nexus 4 using Tapatalk 4 Beta

I just found this thread looking for more information on the cabotel.log file. I realise this in an old post, but I'm updating in case it helps anyone else as this is the only relevant hit on google.
Looking through my app install history, I found the cabotel.log started immediately after I installed the plantronics find my headset app. Closer look at the connect / disconnect events show my handsfree's bluetooth mac address.
If you have (had) plantronics find my headset installed, that's probably a safe bet for where the file came from. So long as it doesn't upload this to some third party it's at least helpful tracking data.
--fg

fg said:
I just found this thread looking for more information on the cabotel.log file. I realise this in an old post, but I'm updating in case it helps anyone else as this is the only relevant hit on google.
Looking through my app install history, I found the cabotel.log started immediately after I installed the plantronics find my headset app. Closer look at the connect / disconnect events show my handsfree's bluetooth mac address.
If you have (had) plantronics find my headset installed, that's probably a safe bet for where the file came from. So long as it doesn't upload this to some third party it's at least helpful tracking data.
--fg
Click to expand...
Click to collapse
I also realize this is an old post but I can confirm this has to do with plantronics find my headset app. My log started on the 24th of this past September same time I got my headset and installed the app.
Sent from my Nexus 5 using Tapatalk

One or Some of plantronics apps would be..
Plantronics apps tracking your bluetooth devices would be the one you are looking for.

Is Possible To Store A Large Amount of Data Locally?

I'm planning to create an android application library system for the school, the school already have this kind of system that is accessible on the intranet(they will be soon implementing the online version). But before proceeding on the development on this project, I have come up with this following questions:
First, I'm planning to have my application to have the online and offline version, the online version is self explanatory, the offline version is to have the data(books etc.) searchable even without internet connection, What I think I'm going to do is to copy all the data from the web server and store it on the local database of the device(or this idea is wrong?). The problem is I don't know if the device can handle that large amount of data.
Second, if the above is possible, how can I make the application fetch the newly added data(the data that is added when the user is not connected to the internet) when the user has somewhat find an internet connection.
This problem is bothering me for many days already, hope you can help me with this one with your knowledge and ideas.

For the first part i can say if the particular device has got enough free space, it can of course handle that amount. I mean look at all those games that have to additionally download 1 or more gigs of data. Well i dont know what amounts you would be talking about but there shouldnt be a problem
---------------------------------
Phone : Nexus 4
OS :
- KitKat 4.4.4 stock
- Xposed: 58(app_process); 54(bridge)
- SU: SuperSU
- no custom recovery
---------------------------------
4d 61 73 72 65 70 75 73 20 66 74 77
Gesendet von Tapatalk

clonedaccnt said:
I'm planning to create an android application library system for the school, the school already have this kind of system that is accessible on the intranet(they will be soon implementing the online version). But before proceeding on the development on this project, I have come up with this following questions:
First, I'm planning to have my application to have the online and offline version, the online version is self explanatory, the offline version is to have the data(books etc.) searchable even without internet connection, What I think I'm going to do is to copy all the data from the web server and store it on the local database of the device(or this idea is wrong?). The problem is I don't know if the device can handle that large amount of data.
Second, if the above is possible, how can I make the application fetch the newly added data(the data that is added when the user is not connected to the internet) when the user has somewhat find an internet connection.
This problem is bothering me for many days already, hope you can help me with this one with your knowledge and ideas.
Click to expand...
Click to collapse
Your idea is correct and entirely feasible. You should use a local SQLite database to store information retrieved from the web server using JSON. I wouldn't worry about the space too much, SQLite databases are very compact, I have one for my schools app that has I think around 600-700 entries and it comes in at around 400KB so it shouldn't be an issue.

Thank you all for the comments.

Hacking the Casio G-Shock GW-B5600 BLE

Hello all, this is my first post here!
In this article I will explain my method of hacking the Square G-Shocks that make use of a Bluetooth module (I have a GW-B5600, but it should theoretically work on the GMW-B5000 too) with the goal to create our own Android app that will allow to get info and set the watch via BLE (Bluetooth Low Energy) commands/requests.
The tools I am using are: (sorry no link I am too new)
nRF Connect for Android by Nordic Semiconductor from the Play Store
Wireshark desktop (Windows/Mac) from the official website
The official "G-Shock Connected" Android app from the Play Store
And adb that can be found in the Android platform tools (by default in "C:\Users\usrname\AppData\Local\Android\Sdk\platform-tools")
Your phone does not need to be rooted but needs the Developer options enabled.
1 Discover the services offered by the G-Shock
I am using nRF Connect installed from the Play Store to scan for BT devices.
Long-press the (C) (bottom left) button on the B5600 to enable BT on the watch.
Hit Scan in nRF and search for "CASIO GW-B5600" and tap it to show the following details:
Code:
Device BT Name: CASIO GW-B5600
Device BT Address: [B]EB:1C:FF:90:C2:34[/B]
Offered services: 0x1801 Generic Attribute
0x1800 Generic Access
0x2A00 (R) Device Name
0x2A01 (R) Appearance
0x1804 Tx Power
0x2A07 (R) Tx Power Level
0x26EB00 0D Unknown Service
(UUID 0x2902 for all)
[B]0x26EB002C (W*) Custom Service #2C[/B]
[B]0x26EB002D (NW) Custom Service #2D[/B]
0x26EB0023 (NW) Custom Service #23
0x26EB0024 (NW*)Custom Service #24
(R) is read only (W) write (W*) write no response (N) notify.
The important information has been set in bold: the BT address that we will use to analyze the packets, and the 2 services that I called #2C and #2D that are used by the official G-Shock app to get and set info from/to the watch.
2 Enable Bluetooth traces on the phone
After that, open the phone Developer options > Enable Bluetooth HCI snoop log.
Or use the USB debugging mode, plug the phone to the computer and type the following command in a prompt:
Code:
adb shell settings put secure bluetooth_hci_log 1
To know where the BT traces will be stored, type the following command:
Code:
adb shell cat /etc/bluetooth/bt_stack.conf
and look at the line starting with 'BtSnoopFileName=' to locate the BT log files.
3 Capture BT activity and save the logs on computer
Install and run the "G-Shock Connected" app on your phone from the Play Store.
Do manipulations between the watch and the app, take note of the time you make them.
Then plug the phone and type:
Code:
adb pull /data/log/bt/btsnoop_hci*.log
Note: the place and name of the logs are for my Huawei Mate 10. You will need to adapt the path with the one you got at step 2.
4 Analyze the BT traces in Wireshark
Open Wireshark and drag and drop one of the "btsnoop_hci*.log" files pulled to the computer onto the program.
Add a filter on the G-Shock BT address we got from nRF Connect at step 1:
Code:
bluetooth.addr==EB:1C:FF:90:C2:34
And hit enter to see the BLE activity on the watch.
Now the fun (or the boring part, it depends ) begins... Understanding the BT requests/answers (get info) and BT commands (set info)!

In Wireshark, the important information for each BT frame are contained in the fields
Bluetooth Attribute Protocol > Handle > UUID
and in Bluetooth Attribute Protocol > Value
The very first -easiest- command I was able to identify is the one to Get and Set the Home City and the 5 World Time (WT) Cities.
When you analyse the BT packets, you can see the name of the cities written in all letters in the Value field:
Code:
0000 1f 01 48 4f ..HO
0010 4e 47 20 4b 4f 4e 47 00 00 00 00 00 00 00 00 00 NG KONG.........
We can observe that to GET the Home City, we send a Write command with the value 1F00 to the service 0x26EB002C (aka Custom Service #2C). In return, we will receive a notification through the service 0x26EB002D (aka Custom Service #2D) containing an echo of the Command ID (1F00) followed by the name of the Home City in upper-case (e.g. "PARIS").
To SET the Home City is just as easy: we send a Write request to the service 0x26EB002D (Custom Service #2D) with the value 1F00 followed by the name of the new Home City on 18 Bytes (e.g. "PARIS"), tailed with 0x00.
GETting and SETting the 5 World Time Cities is very similar: you only need to use the Command IDs 1F01 to 1F05...

The next command I reverse engineered is the one to set the date and time.
I started to search for the hexadecimal value "07 E4" in the traces (2020 in decimal = the current year). The search returned zero result... If finding a WORD (value encoded on 2 bytes) in big endian* fails, you gotta try searching it in little endian* so I did another search for "E4 07" this time, and bingo! It appears in a SET command starting with the ID 0x09.
* search Wikipedia for "Endianness"
The full structure of the binary value is:
Code:
([B]09[/B]) YYYY MM DD HH mm ss ?? ?? 01 ?? ?? is the milliseconds in big endian(?)
[B]Mon.13-JAN (15:54:10) traces[/B]
([B]09[/B]) E4 07 01 0D 0F 36 0B 01 F2 01 --> 2020-01-13 15:54:11 (,498?)
[B]Wed.15-JAN (15:29:27) traces[/B]
([B]09[/B]) E4 07 01 0F 0F 1D 1E 03 44 01 --> 2020-01-15 15:29:30 (,836?)
You can notice there's a difference in the trace timestamp and the time sent, respectively 1 second and 3 seconds. That is quite normal: I disabled the time synchronization in the watch settings, so the watch time can deviate from the atomic time by a few seconds (the user guide states a tolerance of +/- 15s per month average).

Hey, did you ever manage to get any further with this @mougino ? I've also got one of these watches, and have been playing around with the BLE connection to it. I've managed to successfully set the alarm times and on/off state – but so far haven't had any luck with setting the actual time. I tried writing with the op-code you suggested of 0x09, but it doesn't seem to actually do anything for me.

Up its interesting.

Hope somebody can help me. I'm having trouble getting/setting time on my Casio GW-B5600BC-2BJF. I can get and Set most other things like alarms, home city, etc using the #2D command (Characteristic: 26eb002d-b012-49a8-b1f8-394fb2032b0f), but when I try to set the time, it has no effect. The command does not complain, but does not change the time. Should I be using a different characteristic? Here are supported BLE services on my watch:
[CD:85:24:01:62:17][LE]> connect
Attempting to connect to CD:85:24:01:62:17
Connection successful
[CD:85:24:01:62:17][LE]> characteristics
handle: 0x0003, char properties: 0x02, char value handle: 0x0004, uuid: 00002a00-0000-1000-8000-00805f9b34fb
handle: 0x0005, char properties: 0x02, char value handle: 0x0006, uuid: 00002a01-0000-1000-8000-00805f9b34fb
handle: 0x0008, char properties: 0x02, char value handle: 0x0009, uuid: 00002a07-0000-1000-8000-00805f9b34fb
handle: 0x000b, char properties: 0x04, char value handle: 0x000c, uuid: 26eb002c-b012-49a8-b1f8-394fb2032b0f
handle: 0x000d, char properties: 0x18, char value handle: 0x000e, uuid: 26eb002d-b012-49a8-b1f8-394fb2032b0f
handle: 0x0010, char properties: 0x18, char value handle: 0x0011, uuid: 26eb0023-b012-49a8-b1f8-394fb2032b0f
handle: 0x0013, char properties: 0x14, char value handle: 0x0014, uuid: 26eb0024-b012-49a8-b1f8-394fb2032b0f
[CD:85:24:01:62:17][LE]>
Here is the command I'm sending:
Wrote to characteristic 26eb002d-b012-49a8-b1f8-394fb2032b0f | value: 0x09 E6 07 03 19 0B 29 07 05 4F 01
Thanks in advance.

seanlano said:
Hey, did you ever manage to get any further with this @mougino ? I've also got one of these watches, and have been playing around with the BLE connection to it. I've managed to successfully set the alarm times and on/off state – but so far haven't had any luck with setting the actual time. I tried writing with the op-code you suggested of 0x09, but it doesn't seem to actually do anything for me.
Click to expand...
Click to collapse
Same here. Did you resolve this? See my message above. Thanks.

izivkov said:
Same here. Did you resolve this? See my message above. Thanks.
Click to expand...
Click to collapse
Nah I kind of dropped it, and haven't picked it up again for quite a while. I'd love to get it working though!

seanlano said:
Nah I kind of dropped it, and haven't picked it up again for quite a while. I'd love to get it working though!
Click to expand...
Click to collapse
OK, I will let you know if I figure it out.
Just curious, are you wring an Android app for the watch?

izivkov said:
OK, I will let you know if I figure it out.
Just curious, are you wring an Android app for the watch?
Click to expand...
Click to collapse
I was planning on having something running on a Raspberry Pi Zero W – I can program, but I've never made an Android app. My plan was to do something in Python, ideally having the Pi Zero running somewhere in my bedroom so that the Casio watch can do the time synchronisation at night. If I can get that working I'd also thought about setting some alarms and reminders for the day ahead, like maybe connect it to a calendar and put any important events into the reminders function of the watch, things that the existing Casio app can't do. An Android app would be a better way of doing this, but I figured I'd get it working in Python first since it's faster for me.

Ok, thanks for the info.
I more or less figured out how to set the time. It involves setting the DST for all world locations first. I guess makes sense, since the casio will update the time for all locations. I still don't understand some things so I will need to figure it out first, and I can share if you are interested.
I am working on an open source Android app to integrate the Casio watch with Google services on android, such as calendar and Alarm ckock. It will not replace the official app. I have been working on this app for about a month now, and got the alarms and now the time setting working. I think the callender integration will be the most challenging, since I don't know what the data means to Casio.
Currently the github is private, because it is WIP, but I will make it public when it is ready.

That would be very cool! I'll be happy to do some beta testing if you end up getting to that stage. Good luck!

@seanlano I have the basic app running, except for the reminders. If you like to try it, here is the github:
GitHub - izivkov/CasioGShockSmartSync
Contribute to izivkov/CasioGShockSmartSync development by creating an account on GitHub.
github.com
It is private, so not sure if you can access it, so let me know.
If you don't want to bother building the APK, I have put it on on my Google drive:
Google Drive: Sign-in
Access Google Drive with a Google account (for personal use) or Google Workspace account (for business use).
drive.google.com
I'm curious to see if for you the local time works properly, and the battery level is correct. Where are you located?
Of course, use at your own risk. It might screw up some settings on your watch. In that case, you may have to reset it like this:
Google Drive: Sign-in
Access Google Drive with a Google account (for personal use) or Google Workspace account (for business use).
drive.google.com
Ivo

izivkov said:
I'm curious to see if for you the local time works properly, and the battery level is correct. Where are you located?
Click to expand...
Click to collapse
Hey @izivkov, I tried it out and it seems to mostly work!
The time setting worked correctly (I made sure by manually setting the time to be very wrong, and your app brought it back to the correct time). The home time zone (Sydney) was correct too.
However, the battery level didn't work – the Casio app shows my watch at 100% but your app shows only maybe 20%.
The alarms worked well too, although I found that any time I set the alarms it turns off the hourly signal, and the app doesn't have a way to turn it back on (this isn't a big deal though, since it's only a couple of buttons to press on the watch).
Keep up the good work!

seanlano said:
Hey @izivkov, I tried it out and it seems to mostly work!
The time setting worked correctly (I made sure by manually setting the time to be very wrong, and your app brought it back to the correct time). The home time zone (Sydney) was correct too.
However, the battery level didn't work – the Casio app shows my watch at 100% but your app shows only maybe 20%.
The alarms worked well too, although I found that any time I set the alarms it turns off the hourly signal, and the app doesn't have a way to turn it back on (this isn't a big deal though, since it's only a couple of buttons to press on the watch).
Keep up the good work!
Click to expand...
Click to collapse
Hey, thanks for the feedback.
- I did not notice the hourly signal setting and will fix it. Possibly add a setting to the app to turn it on/off.
- For the battery level, I was not sure I was getting the right value, but for me seemed to be about right. Obviously, should look at other ways to set it.
- I'm working on Calendar events integration with Watch's reminders, and when I finish this and fix these issues you mentioned I will have another version and will let you know.
Cheers

izivkov said:
Hey, thanks for the feedback.
- I did not notice the hourly signal setting and will fix it. Possibly add a setting to the app to turn it on/off.
- For the battery level, I was not sure I was getting the right value, but for me seemed to be about right. Obviously, should look at other ways to set it.
- I'm working on Calendar events integration with Watch's reminders, and when I finish this and fix these issues you mentioned I will have another version and will let you know.
Cheers
Click to expand...
Click to collapse
Hay, thanks for starring my github. I moved the code to another repository: https://github.com/izivkov/CasioGShockPhoneSync, which is now public. Feel free to star the new one. ;-)
Basically, I added Google calendar event support, and fixed the issue with hourly chime getting reset. Still cannot figure out how the battery level is read. I get a value using command 0x28, but the value does not make sense. I get back something like 0x28 0x0f 0x17 0x00 for about 25% charged battery, and 0x28 0x13 0x19 0x00 for almost fully charged one. I think I will disable the battery icon until I can figure what is going on.
Anyway, adding some documentation now. Hope other people can contribute to this project and possibly support more watch models.

I'm a bit stuck. I'm trying to detect the difference between GW-B5600 long-press lower left button and short-press lower-right button as far at connection to the Android device is concerned. The app on the phone should be able to tell the difference, becase the official app acts differntly when the right button is pressed, i.e. sets the current location. This does not happen for left-button connection. But the data sent to the phone from the watch is identical. If somebody has figured this out, please let me know.

For those who are interested in how to communicate with the Casio G-Shock 5600 BT watches, here is the latest github I created:
GitHub - izivkov/CasioGShockSmartSync
Contribute to izivkov/CasioGShockSmartSync development by creating an account on GitHub.
github.com
And you can get the android app on PlayStore:
Casio G-Shock Smart Sync - Apps on Google Play
Add Smart functions to your Casio G-Shock Bluetooth (B5600, B5000, B2100) watch.
play.google.com
Enjoy

I've been working on a very similar app but for a slightly different Casio model. I'm not very familiar with the BLE and getting to a point where I'd happily pay someone for investigating the communication.
Would anyone be willing to figure it out?

drunkenHiker said:
I've been working on a very similar app but for a slightly different Casio model. I'm not very familiar with the BLE and getting to a point where I'd happily pay someone for investigating the communication.
Would anyone be willing to figure it out?
Click to expand...
Click to collapse
Sure, I can take a look. You can contact me by email directly at [email protected], or better still you can post to the github repository:
izivkov/CasioGShockSmartSync · Discussions
Explore the GitHub Discussions forum for izivkov CasioGShockSmartSync. Discuss code, ask questions & collaborate with the developer community.
github.com