Deployment Decisions - Android Software Development

Well, after a lot of hours of work, I'm real close to putting my first app out.
It includes a 5MB database that can't be loaded from /assets due to it's size. The app itself is small.
Now, as I know it, there are 2 deployment methods:
1. Google Market
2. My own hosted site
Google Market is easy on end user...find an app, install (and pay if req'd). Works over 3g and WiFi. Gives you 24 hours to uninstall before you're credit card is charged. Drawbacks are one-time $100 vendor fee and 20% fee per download. Plus, as my apps may grow, the databases I use could get fairly large. Now, most phones can handle the size (my Droid goes to 40 gig with 32 gig SD card), but searching a huge database on the phone could lag like crazy.
A self-hosted site can be had for $50 a year from GoDaddy or 1 and 1 with FTP, MySQL databases and much, much more. With the SQL running on a hosted server, queries would be fast. Drawbacks are the user has to download Google ADB package, app and database. Then hook-up phone via USB, set a couple of settings on the phone and actually run the "adp install <package name>". Then you need some type of payment center (Paypal) and possibly a refund policy.
So, I'm on the fence here...comments and suggestions appreciated!

From what I've read, lagging for loading databases can be brought to a minimum by altering the way it loads. Instead of loading all the content up front (possibly with a dialog to keep the user amused while waiting) or by loading it as the information comes in. The listView might lag because of the phone's memory available as opposed to a problem with the app. It could be the app. If it needs resources, then make it a top priority and allow it to tell the OS to kill other resource-hogging applications to make way for the information download. It's just a speculation. I don't know this for sure, but I would check the Android Dev site and other places for more information.

Interesting idea...I could just set the data (about 80,000 rows) up as a flat file and then do an INSERT based on user input. Do query, return results and delete rows from table. That takes it to, on average, about a 2,000 row table.
Not sure how I can encapsulate (hide) the data from prying eyes or worse yet, changes to the data! But I will research that idea further and do some code changes and testing....thank you very much

I decided to get a hosted site for a couple of reasons:
1. To get my OWN MySQL databases
2. To create a web site to drive my business and apps delivery
I've finished my application and it works great. 80,000 row database on server, app is 40kb on the phone. Data retrieval is fast...i can get over 100 rows back in 2 seconds on 3G; WiFi would be even faster.
I've decided to push my apps to users via the web site. I'll offer a crippled demo version for review before they buy...no return policy. That is, if you like the demo and buy it, well, you made the choice LOL
I'm still not warm and fuzzy about making user download adb package, hook-up phone via usb and install. But I'll offer something I don't see much on Google Market and that is: SUPPORT. Each app I create will have it's own e-mail address for comments, concerns, enhancements and, god forbid, bug reports. I'll probably also offer free updates if I change the program or upgrade the database.
Well, time to go do the web site. I'll admit I would rather be coding vs. web site design!

Why not both? You could use google and it's HUGE base of users (which may never even know about your app otherwise) and still host the database online at your site. Note that many (most) phones are crippled by the carrier to NOT allow downloads from anything but the market.
Frankly, I think you could probably do it more efficiently. I don't know the details, but why not have the app download the database from your site upon first usage and store it to SD card? A local copy even on an SD card will be orders of magnitude faster than any online solution.

Yeah, I'm still 50/50 on it.
Speed is not an issue on this app; max rows I pull back may be 60 and it takes 2 seconds. Literally, by the time your finger is off the "Search" button, you have your data And if you think about it, how many databases are out there already that people are hitting off of web pages? My 2 second download was on 3G, I imagine the WiFi to be even faster (just tested it on WiFi...3G was faster LOL)
I like the control of the database on my end and it keeps the user from having to download a new copy if the database is updated.
And I'm trying to look at the big picture here too. I'm an unemployed programmer after a 13 year career. I don't mind coding apps for "the people", but I want to get my foot in the door of business' that are going to need smart apps, just like they all needed a web page years ago.
I just have to do some more research and make a decision. However, I do think you are right; the market has huge exposure and can even lead people to my site. The hosted sites is dirt cheap...$50 a year.
I know my app is pretty solid, just hate to think about paying that one-time vendor fee and the 20% per download. Then again, that takes ALL the billing concerns from me; the market handles it all.
Thanks for your feedback!

Related

[Q] APP IDEA for College Students

Hello everyone, I had an idea for an application that I am pretty sure has not been developed.
Would it be possible to develop an application that automatically alerts students when a college class is open or closed? I guess I am just looking for an app that automatically checks the desired class every hour or so and when there is a spot available it alerts the student (maybe even automatically sign the student up?).
Any ideas?
The greatest challenge with this kind of application is actually having the college use it for their classes, nothing impossible though
An app like that would need to interface into the school's system for optimum efficiency.
You might be able to do a web based setup that would 'learn' the schools format for passing data back and forth, and poll until a 'seats available' column changed, but it'd be messy.
You would probably be better off finding someone create one specific for your school. It's a great idea but unfortunately, schools probably are not using the same online services to handle their registration process, etc.
You could work this out in 2 different ways:
1. The Hard One: Make the time scheme from your schools website sync with the time scheme you use in your app, this would be incredebly hard to do, and i'm an IT student and I already know this that this is inpossible at my school.
2. The Easy One: Make a time scheme that you can fill in by yourself and an alarm will go off everytime a new class starts
Thanks for the posts guys. That makes sense, I understand why that would be difficult. That it too bad though, it would be such a useful app! I bet a lot of people would pay money for it.

Which approch should I go?

This is my last semester before I graduate.
So, I decided to add my own Android application to my portfolio.
After a few meeting with my friends, we decide to create a game.
Our rough game's specs (Could be changed).
1. Collect all statistic locally, No statistic/central server.
(Low budget project)
2. 2d turn-base game, have some but not much amimations.
(Imagine a multi-player board game)
3. Multi-player over Bluetooth, WiFi or 3G. No single player.
4. Should playable on most of the 2.1 device
What we know/are learning
1. 3 years experience in mid-level Java programing (J2SE, J2EE)
2. 3 years experience in SQL-base database
3. 3 years experience in HTML, CSS, Javascript and Ajax
3. A year experience in Mid-level of Python, OpenGL
4. A year experience in Design pattern, Project Planing, Application Development
5. Android Application Development with Eclipes, Android SDK, JRE (In progress)
6. Titanium Appcelerator (In progress)
7. WebView, PhoneGap (In progress)
8. Publish into Android Market
Now, what we don't know/are questioning
1. Communication between android device
We decided not to use a statistic/central server. Which mean a device have to communicate to each other directly. We are not sure is it possible or not and how to accomplish that. Also some issues such as handle communication failure.
2. Approch
I'm not sure which language will be suited between C++ and Java (Best gaming experience, less issue, library/add-on support). Also still no clue which approch to go. Standard (SDK + Eclipes + JRE) or Titanium or WebView.
3. Device hardware difference
It will be not cool if this game can run smoothly on one device but laggy/false display on others. Most important question is the screen resolution.
4. Game engine
Still don't know that we need a game engine or not. Which one is suited to our project.
5. Server
We plan to go for commercial version in the future which will have more features such as Matchup, Ranking, Upgrade character and else. By the time, we do need a server right? If we do, do we need more than 1 server to handle global incoming connections?
6. What else should be take a look?
I'm currently spend my time to understaning all above question but advise from you guys would be much help. Correct me if I misunderstanding anything.
Thanks in advance, Sincere.
Still looking for answers
1. You will still need to use a central server, this server would keep track of all active(logged in ) accounts. This server will have the soul purpose of linking players or sending request from one player to another. As the ip address of our phones dynamic i see no way around this. For local games this is obviously a different story.
2. Depends on how gfx intensive your program is, if you are even semi fluent in ogl i would use this. But if not the standard Canvas android offers should be fine for 2d. I like c++, so i use java & c through jni. But if time is an issue(and u dont want headakes) i would just stick to java.
3. Android offers a compatibility mode which adapts software meant for one res to fit on others. I have zero experience in this so i can not elaborate on its effectiveness. if not with ogl it wouldnt be hard to make your program scalable to other resolutions. Tho of course you would have to alot of backend work to make sure it looks good. Wide ranging of devices is a huge plus for android users, huge headake for us devs :S.
4. If you are doing just a 2d board game ish game i dont think an actual game engine is needed...but w/e floats your boat.
5. Go to question 1. hehe.
6. No time, will comment later.
I am probably not as skilled dev as should be commenting in this thread, just fyi lol.
You can check out AndEngine as well, it is a free 2d opengl engine. It has a multiplayer extension based on java sockets but this part is incomplete, you should look out for more info on java.net.* for multiplayer purposes.
Another free opengl engine is Rokon.
Both use opengl es 1.0 and are compatible from android 1.6 onwards. I´m actually starting a 2d project based on AndEngine and have no complaints so far.
Since its not that intensive i woudn´t sugest to go for c++. I heard that not all devices are compatible with the ndk, but it is just hearsay, if some one can confirm this better.
@jug6ernaut
Thanks for your comment. Clarify me a lot.
About the server, do you have any suggestion where should I place/rent a server?
I'm living in south-east asia. I'm worry about lag issue will accur to US and Europe user when they communicate with server in this region. Our infrastructure is 10-20 years behind yours.
@rastanthology
Thanks for your comment. As you suggest, I think we will stick to Java as we planned. Plus, I'll take a look on AndEngine and Rokon.
1.- You don't need a webbased server for gameplay. You can just pair the devices over bluetooth or send the data over wifi (hell, if you wanted to make it really expensive and laggy, you could send the data over sms ). I think, connectivity wise this would be the way to go, not only because people some have data limitations in their phoneplan.
However, sending the gameplay data to a central server and distributing it back to the other player would make data collection and tracking easy, but that would be equally easy (and less data intensive for your data costs on your server) with a robust log you send to your server as you grow the game. Of course, even your peer-to-peer game will have a kind of client/server infrastructure, internally/programmaticaly speaking: maybe both devices run a client and a server, as you'll need classes/threads which send data, receive data and process data. Depending on the speed of the game and send/recieve speeds, you might want to have one of the devices be the one which has absolute say over timings/positions, or you might allow both devices to keep track and have some kind of collaborative conflict resolution
2.- pick the programming language you're best in. If you have to pick up c/c++ whilst you make the game, you're only doubling your frustration Make that be a factor in your choice of framework/engine, too. For a 'simple' game, you might just use pure java and libraries. For the game you're describing, you don't need the speed of c/c++. Nowhere near
3.- that's not a question 2D boardgames have a better chance of scaling well than even a 2d fast moving action game; I'd say that if you don't make it too complex (hundreds of transparent .png's simultaneously moving), most android devices should be able to run a 2 player boardgame without AI. Be sure to use suitable (correctly scaled etc) graphics, maybe even have multiple data sets for diff. devices.
4.- depends Sometimes, learning to use a game engine takes as much time as building those few things you need from scratch or using smaller routines/code/libraries. Design your program, find out what you need and then stack up "how much time will it take to build these classes/systems ourselves, to our exact specs" against "how much time will it take to find an engine which does kinda what we want, learn how to use the systems we want and modify them for what we want (and maybe not end up with exactly what we want)". Sometimes the (learning of the) engine is simple to learn and use, and saves you much time ... sometimes it doesn't
5.- yes. Depends on traffic (amount of connections, size of data). If you only sends logs etc and not realtime (gameplay) communications, you might have enough with one server. If you have many, many users, you might need more, and if the data has to have low latency, you will have to get more geographically situated servers.
6.- don't forget sound. Test your game on people. Prototype first, fast and often and don't be afraid to change the gameplay if what you prototype doesn't seem to be found "fun" by the people test your game
Good luck!
@MacDegger
Thanks so much. You just gave me a lot of Idea. I mean I can see the whole picture more clearly with your answer. Cheers!!
One more thing I want to know. If this game can be play only via BT or WIFI. Will people buy it?
As we plan to sell it in the market in the future. Even the gameplay is fun, nice or whatever. But, the game cant be play unless you have a friend with Android device and this game installed. That's sound not so interesting game anyways (at least for me).
I woudn't like to be pessimist but i don't think so. The best approach would be to release a free version with webview adds and a payed version add-less. From what i heard you might be receiving the same profit from both versions
rastanthology said:
I woudn't like to be pessimist but i don't think so. The best approach would be to release a free version with webview adds and a payed version add-less. From what i heard you might be receiving the same profit from both versions
Click to expand...
Click to collapse
I'm thinking about that too.
Free version with adds and less feature.
Paid version without adds and full feature.
Still don't have a clue how google adds works. Pay for each view or something I guess.
XeCeL said:
I'm thinking about that too.
Free version with adds and less feature.
Paid version without adds and full feature.
Still don't have a clue how google adds works. Pay for each view or something I guess.
Click to expand...
Click to collapse
given my software is not very ad exploiting(live wallpaper so only shows ads in settings), but in my experience ads pay like crap. 4000+ hits and ive made like 36c. Most if not all coming from clicks on the ads.
jug6ernaut said:
given my software is not very ad exploiting(live wallpaper so only shows ads in settings), but in my experience ads pay like crap. 4000+ hits and ive made like 36c. Most if not all coming from clicks on the ads.
Click to expand...
Click to collapse
Well, 4000+ hits but 36c I would better exclude it

Kick ass apps wanted

Need an apk that signs my update.zip files from titanium blackup.
I don't understand why it hasn't been done. The code to do it is already in java! Search the forums for testsign.jar
I know everything you need to do to get it done but I don't have a development environment at my disposal. Help me out and I'll show you how to convert your jarred up code libraries to run on android!
Please and Thank You.
* edit - this question has been solved by brainmaster! ZipSigner if you find this application helpful please thank him below.
- Posted via mobile
New application proposal: ZeroNetAccess (ZeNA?)
Concept: an app that can block other apps network access.
Market alternative: DroidWall (root only, low market potential)
Methods: Maybe by modifying the apk manifest and resigning? Im not sure if there is a framework you could subclass for this.
Why: i turned off stats reporting for an app and i saw it writing reports to the web from logcat. Google took our rights away by not letting us do this from the application settings. Its my device and i have to pay the bill not google or the rude ppl who made the app. I will never understand why we were not given the right to administer mobile data access rights.
Potential: highly lucrative. People want to save money nowadays. In that respect voiding phone warranty for root access may not sit well with potential customer.
- Posted via mobile
Avid Droidery said:
New application proposal: ZeroNetAccess (ZeNA?)
Concept: an app that can block other apps network access.
Methods: Maybe by modifying the apk manifest and resigning? Im not sure if there is a framework you could subclass for this.
Why: i turned off stats reporting for an app and i saw it writing reports to the web from logcat. Google took our rights away by not letting us do this from the application settings. Its my device and i have to pay the bill not google or the rude ppl who made the app. I will never understand why we were not given the right to administer mobile data access rights.
Potential: highly lucrative. People want to save money nowadays.
- Posted via mobile
Click to expand...
Click to collapse
For rooted devices try DroidWall
Application Proposal: Web Page to PDF/HTML Safari Plug-In
Concept: Seriously?
Why: Cant save pages from the browser I safari always reloads the page when you come back to it from other activities (pointless nethog!) whats the friggin cache for anyway? It is better to save an article copy that you could view on the computer later or add to your info library if you write books or do any kinda technical research than it is to save a bookmark that may become 404 not found. Researchers nightmare!
Methods: execute shell command wget on page source. Use regular expression to get media list. Build directory tree. For each media call wget. Done.
Potential: medium. Not many people are so technically inclined.
Usefulness: extremely high, especially with zip/+email caps.. Roundabout source code viewer for nosy/curious folks.
Average potential, stream lehigh usefulness I would sell for a buck 99. Free (1 ad per saved page, no zip email)
- Posted via mobile
3rdstring said:
For rooted devices try DroidWall
Click to expand...
Click to collapse
Thank you! Will do!
- Posted via mobile
Application proposal: WarBastard
Concept: wardriving app featuring google my maps! Maps are shared globally by locale. Signals can be pinpointed by triangulation through cross reference of mac address, signal strength and previously detected locations in a global locale based database. While we are at, throw in a google navigation intent, and a compass with distance to closest accesible AP! Dont stop there! I wonder where that cell tower is located?
Purpose: to aid weary travellers and cheap bastards to connect with their loved ones and services over open networks. Services could also be used for cellular network signal diagnostics across hundreds of thousands of devices.
Potential: astronomical I would pay 5 bux. Better yet 12 bucks per year. Free (1 ad per download of database, 1 ad per connect to AP. Possibly integrated with APs for increased revenue potential across the board.) The map data can also be used to find good places to set up an advertising AP 4 even more potential earnings.
Anybody wanna pay me to sit around and do this all day? Lol.
SERIOUSLY you are looking at my qualifications. Asking 50k p. yr. to start Project Mgr./Analyst/Sr. Developer. consulting options available. Willing to relocate. Pm for inquiries/proposals.
- Posted via mobile
Avid Droidery said:
Need an apk that signs my update.zip files from titanium blackup.
I don't understand why it hasn't been done. The code to do it is already in java! Search the forums for testsign.jar
I know everything you need to do to get it done but I don't have a development environment at my disposal. Help me out and I'll show you how to convert your jarred up code libraries to run on android!
Please and Thank You.
- Posted via mobile
Click to expand...
Click to collapse
You should use the search function: ZipSigner.
It implements in the Titanium Backup and signs it on your wish.
brainmaster said:
You should use the search function
Click to expand...
Click to collapse
You are correct. I should never have assumed that this wasn't already in the market. Actually I didn't really plan to use this to sign titanium backups. For my purpose however the concept is the same.
* edit Human beings arent the fastest search engine but collectively we are the most accurate information sources on the planet. feel free to quote me on this
I thought that it would be better to ask someone who might know than it would be to search for something that may not exist. If I had access to a computer I would have no questions to post. Only answers! Being that I am stuck on my android for the time being, I appreciate all the help I can get!
Thank you for providing me with another helpful for resource!
* Edit: Dear brainmaster, words cannot express my level of gratitude! I am truly overjoyed by the passing of this shortcoming. Signapktic is exactly what I was looking for and I never would have found this application had it not been for your assistance. The topic of this thread is kick ass apps wanted. Even though this is an application that no longer needs to be developed (because real developers don't reinvent the wheel unless absolutely necessary,) you have met or exceeded the topic issue with flying colors!
- Posted via mobile
New application proposal: Launchpad Homescreen Widget
Concept: a widget that will pop up an on screen menu (complete with icons) onClick similar to pc desktop start menus. Customizable shortcuts Horizontal or vertical (and scrollable) layouts by preference and Customizable folders.
Why: I would rather have a feature like this than an app drawer any day. This would allow individuals to organize launcher short cuts by task. It would also be great if it were possible to open files in the system such as pdf, video, music or text files with appropriate application. Another great feature would be the ability to launch shell scripts. I have searched the market and nothing like this was found.
Potential: high. will save customer time allow them to become more visually organized and task oriented as well as adding more visual appeal to the home screens. $5.99 I would buy it! Time limited trial only.
- Posted via mobile

Security breach found on htc devices

The Vulnerability
In recent updates to some of its devices, HTC introduces a suite of logging tools that collected information. Lots of information. LOTS. Whatever the reason was, whether for better understanding problems on users' devices, easier remote analysis, corporate evilness - it doesn't matter. If you, as a company, plant these information collectors on a device, you better be DAMN sure the information they collect is secured and only available to privileged services or the user, after opting in.
That is not the case. What Trevor found is only the tip of the iceberg - we are all still digging deeper - but currently any app on affected devices that requests a single android.permission.INTERNET (which is normal for any app that connects to the web or shows ads) can get its hands on:
the list of user accounts, including email addresses and sync status for each
last known network and GPS locations and a limited previous history of locations
phone numbers from the phone log
SMS data, including phone numbers and encoded text (not sure yet if it's possible to decode it, but very likely)
system logs (both kernel/dmesg and app/logcat), which includes everything your running apps do and is likely to include email addresses, phone numbers, and other private info
Normally, applications get access to only what is allowed by the permissions they request, so when you install a simple, innocent-looking new game from the Market that only asks for the INTERNET permission (to submit scores online, for example), you don't expect it to read your phone log or list of emails.
But that's not all. After looking at the huge amount of data (the log file was 3.5MB on my EVO 3D) that is vulnerable to apps exploiting this vulnerability all day, I found the following is also exposed (granted, some of which may be already available to any app via the Android APIs):
active notifications in the notification bar, including notification text
build number, bootloader version, radio version, kernel version
network info, including IP addresses
full memory info
CPU info
file system info and free space on each partition
running processes
current snapshot/stacktrace of not only every running process but every running thread
list of installed apps, including permissions used, user ids, versions, and more
system properties/variables
currently active broadcast listeners and history of past broadcasts received
currently active content providers
battery info and status, including charging/wake lock history
and more
Let me put it another way. By using only the INTERNET permission, any app can also gain at least the following:
ACCESS_COARSE_LOCATION Allows an application to access coarse (e.g., Cell-ID, WiFi) location
ACCESS_FINE_LOCATION Allows an application to access fine (e.g., GPS) location
ACCESS_LOCATION_EXTRA_COMMANDS Allows an application to access extra location provider commands
ACCESS_WIFI_STATE Allows applications to access information about Wi-Fi networks
BATTERY_STATS Allows an application to collect battery statistics
DUMP Allows an application to retrieve state dump information from system services.
GET_ACCOUNTS Allows access to the list of accounts in the Accounts Service
GET_PACKAGE_SIZE Allows an application to find out the space used by any package.
GET_TASKS Allows an application to get information about the currently or recently running tasks: a thumbnail representation of the tasks, what activities are running in it, etc.
READ_LOGS Allows an application to read the low-level system log files.
READ_SYNC_SETTINGS Allows applications to read the sync settings
READ_SYNC_STATS Allows applications to read the sync stats
Theoretically, it may be possible to clone a device using only a small subset of the information leaked here.
I'd like to reiterate that the only reason the data is leaking left and right is because HTC set their snooping environment up this way. It's like leaving your keys under the mat and expecting nobody who finds them to unlock the door. For a more technical explanation, see the section below.
Additionally, and the implications of this could end up being insignificant, yet still very suspicious, HTC also decided to add an app called androidvncserver.apk to their Android OS installations. If you're not familiar with the definition of VNC, it is basically a remote access server. On the EVO 3D, it was present from the start and updated in the latest OTA. The app doesn't get started by default, but who knows what and who can trigger it and potentially get access to your phone remotely? I'm sure we'll know soon enough - HTC, care to tell us what it's doing here?
Technical Details
In addition to Carrier IQ (CIQ) that was planted by HTC/Sprint and prompted all kinds of questions a while ago, HTC also included another app called HtcLoggers.apk. This app is capable of collecting all kinds of data, as I mentioned above, and then... provide it to anyone who asks for it by opening a local port. Yup, not just HTC, but anyone who connects to it, which happens to be any app with the INTERNET permission. Ironically, because a given app has the INTERNET permission, it can also send all the data off to a remote server, killing 2 birds with one stone permission.
In fact, HtcLogger has a whole interface which accepts a variety of commands (such as the handy :help: that shows all available commands). Oh yeah - and no login/password are required to access said interface.
Furthermore, it's worth noting that HtcLogger tries to use root to dump even more data, such as WiMax state, and may attempt to run something called htcserviced - at least this code is present in the source:
/system/xbin/su 0 /data/data/com.htc.loggers/bin/htcserviced
HtcLoggers is only one of the services that is collecting data, and we haven't even gotten to the bottom of what else it can do, let alone what the other services are capable of doing. But hey - I think you'll agree that this is already more than enough.
Patching The Vulnerability
... is not possible without either root or an update from HTC. If you do root, we recommend immediate removal of Htcloggers (you can find it at /system/app/HtcLoggers.apk).
Stay safe and don't download suspicious apps. Of course, even quality-looking apps can silently capture and send off this data, but the chance of that is lower.
Affected Phones
Note: Only stock Sense firmware is affected - if you're running an AOSP-based ROM like CyanogenMod, you are safe.
EVO 4G
EVO 3D
Thunderbolt
EVO Shift 4G? (thanks, pm)
MyTouch 4G Slide? (thanks, Michael)
the upcoming Vigor? (thanks, bjn714)
some Sensations? (thanks, Nick)
View 4G? (thanks, Pat)
the upcoming Kingdom? (thanks, Pat)
most likely others - we haven't verified them yet, but you can help us by downloading the proof of concept above and running the APK
HTC's Response
After finding the vulnerability, Trevor contacted HTC on September 24th and received no real response for five business days, after which he released this information to the public (as per RF full disclosure Policy). In my experience, lighting fire under someone's ass in public makes things move a whole lot faster, which is why responsible disclosure is a norm in the security industry. (This is where we come in.)
As far as we know, HTC is now looking into the issue, but no statement has been issued yet.
HTC, you got yourself into this mess, and it's now up to you to climb out of the hole as fast as possible, in your own interest.
The ball is in your court.
Credit
ANDROID POLICE
Huge thank you to Trevor Eckhart who found the vulnerability and Justin Case for working with us today digging deeper.
Hi there, I need help, someone is consistently hacking into my phone, htc evo 4g, they are penetration testers and pc savvy, currently I cant login to the phn for trying to do a factory reset. They kept intercepting me and now my password does not work. Who knows maybe they changed it on their side. I wrote down everything I saw. I was seeing all these process running for the same app. in my applications. My phone was getting hot, freezes but its people that live in my apt complex and at work. can you help?
zzm5 said:
Hi there, I need help, someone is consistently hacking into my phone, htc evo 4g, they are penetration testers and pc savvy, currently I cant login to the phn for trying to do a factory reset. They kept intercepting me and now my password does not work. Who knows maybe they changed it on their side. I wrote down everything I saw. I was seeing all these process running for the same app. in my applications. My phone was getting hot, freezes but its people that live in my apt complex and at work. can you help?
Click to expand...
Click to collapse
Is your device rooted?
I used root explorer and removed the HtcLoggers.apk and other than the forced close loop that removing it caused (requiring me to remove the battery), after rebooting all seems to be working fine.
EDIT: Actually I didn't just delete HtcLoggers.apk but moved it to a safe location on the SD Card in case there was a problem and it needed to be restored. I highly suggest you do this instead of just deleting it, or better yet, a nandroid backup.
there are a few good ROMS out there that have the ICQ loggers removed already.
Do we really need three threads on the front page about the same thing?

Cobwebs growing on Windows phone 8 blogs and forums

At least with windows 7.x you could switch ROMs and side load useful apps, with this safeboot thing and Microsoft's lame attitude to give us more of the features and apps that we want it's no wonder why Windows Phone 8 fourms and blogs are so boring. Way to go Microsoft.
Agreed. I used to come here every day but, now it's once a week (kind of how it was on PPCgeeks.com). No roms, No interop unlocks, no unlocks period.
If you want more discussion about WP8, I suggest going to WPcentral.com...It's pretty active over there...
I really wish a hack of some type would hit, this is getting old. I just want my custom colors back (like I have with WP7).... Advanced Config I miss you !!!
Nobody has been able to find an exploit yet , but I don't really mind lack of activity in forms though as long as cobwebs don't settle upon the entire ecosystem itself we'll be fine
DavidinCT said:
Agreed. I used to come here every day but, now it's once a week (kind of how it was on PPCgeeks.com). No roms, No interop unlocks, no unlocks period.
If you want more discussion about WP8, I suggest going to WPcentral.com...It's pretty active over there...
I really wish a hack of some type would hit, this is getting old. I just want my custom colors back (like I have with WP7).... Advanced Config I miss you !!!
Click to expand...
Click to collapse
Yea I agree that WP Central has lost more action going on but it's all the same stuff; I mean how many reviews of itsdagram, Facebook, Angry Birds and Skype can one handle before they get bored.
I always use to wonder why XDA turned into Android forum almost over night; now I know why its thanks to Microsoft. I feel sorry for Nokia though they took a big risk and now MS is being stubborn.
sinister1 said:
Yea I agree that WP Central has lost more action going on but it's all the same stuff; I mean how many reviews of itsdagram, Facebook, Angry Birds and Skype can one handle before they get bored.
I always use to wonder why XDA turned into Android forum almost over night; now I know why its thanks to Microsoft. I feel sorry for Nokia though they took a big risk and now MS is being stubborn.
Click to expand...
Click to collapse
Agreed, it's the same *****ing over there sometimes. Don't get me wrong, it's a good site if you want new and useful Windows Phone news. This site used to be a WM haven, just like PPCgeeks was. As that is all there was at the time, we had WM and BB...they were all mainly used by business people or hackers like ourselves.
WP7.x was pretty hackable after a while (with custom roms for most phones and interop unlock for about 90% of the models) so it was pretty active but, now with everyone moving to WP8 (ex WP7 users and converts) and No hacks yet, it's slowed down to almost nothing.
Android is mostly hackable and most phones have or NEED a custom rom, so this became a haven for Android users. And for now, as long as they are not going in this area and trolling, there is no issue with it or at least, I don't have an issue with it.
I do think it's a matter of time, they will find a exploit in WP8. I know why MS locked it down, once WP7 was hacked, it opened the doors for the pirates and some people took advantage if it. Sure there was some cool underground apps but, it just opened the system for the pirates. They wanted to lock down WP8 to make the higher end DEVs come and create the apps and games people want, to grow the system.
Nokia was paid pretty well to make a change to WP and over all they are doing very well with it...and their market is growing.
I'm stil deciding if I am going to pick up the Lumia 928 or stick with my HTC 8X(full price, Not giving up my unlimited data)....Hmmmmm... I just wish I could use Advanced Config to get my custom tile colors back
^stick with 8x at least till Nokia world sometime in September because surprises are on its way
Personally I like the very secure nature of my windows phone, I have rimmed more than my share of devices over the years, so its kind of refreshing to k ow this nuts hard to crack. Nokia did take a big risk but I think its been good for both companies. Nokia has done well with exclusive apps in a starved market and there devices are aimed well at a growing group of android overloaded users. With apps like tumble, netflix, Hulu and others coming over the devices are getting more main stream support and with time that will pay good dividends too. All in all I have found little reason to "root" this device other than for the hell of it. They come pretty lean on apps out of box. The biggest thing people seem to be trying to do is get tethering to work without paying out to a carrier for it. Personally if that's basically the reason your wanting to rom so bad, go back to android its far easier get going. I ramble now though, to sum up phone runs great unrommed, clean eco system and very secure setup makes for an all around pleasant device. I think special rimming is more or less unneeded for these devices. Been running unrommed windows mobile 7 and 8 now for about two years collectively. Have android tablets all rommed and a s3 rommed as a backup device.
Sent from my RM-878_nam_usa_100 using XDA Windows Phone 7 App
Meh... I considered WP7 without hacks to be nigh-unusable, even though I stuck with a stock ROM. No way to have apps open files automatically, for example (but I could manually add the registry entries, and could write apps that knew how to handle them). No way to access the filesystem (but I could sideload Kindle ebooks using homebrew file managers). No way back up app data or messages (except with homebrew). Minimal control of theming (as a class, this was one of the biggest homebrew categories). No real control over multitasking (I like that the default behavior is so conserving of battery life, but sometimes I don't *want* Puzzle Quest 2 or Fruit Ninja to have to go through its entire launch process just because I switched tasks or let the phone sleep for a bit!). Severe limit on sideloaded apps (I have over 30 of them, counting small utilities that that I developed, and not counting outdated versions, redundent apps, or anything else I removed). No listener sockets (though this didn't require a very fancy hack). No C++ code reuse (same as the server sockets). No way to tell how much space each app was using (but there's a homebrew for that).
WP8 fixes many of the worst problems. We can now register filetype handlers (though Kindle still doesn't register .MOBI or .PRC, so no more sideloading my ebooks for now...), use native code (with restrictions, but it's better than the default on WP7), and theme our phones (well, a litttttle bit more than before; still not enough). They added some much-requested features (SMS backup, variable text size, ability to control the browser app bar at least a bit, WiFi on while sleeping, Skype integration) and of course the change in OS brought many other improvements (multi-core, removable SD cards, higher resolutions, etc.). However, it still has some big problems of its own. True multitasking is still very limited. Data backup is still iffy. Still no filesystem access (or ability to do anything outside an app sandbox except the official Settings tools). Still very limited sideloading.
I promise you, though, people are working on it. I'm one of them, and several of the other names you know from WP7 hacking are as well.
People like GoodDayToDie & netham45 make the windows forums so much fun to follow
nikufellow said:
^stick with 8x at least till Nokia world sometime in September because surprises are on its way
Click to expand...
Click to collapse
Yea but, I am on Verizon....After a release of a model it will take 6 months for Verizon to get a phone that is almost outdated on release.
The 8X is so limited on space that it's driving me nuts, If I find app or game I want to try, I have to uninstall a Paid app to install it. It's getting too old. 8X on format is 11.5gb and the Lumia 928 is 23.5gb, a little over double the space might be worth it, depending on what I can get it for, of course.
The blogs are dead because places like XDA that centralize around modding your phone to improve performance isn't necessary when WP8 software already performs flawlessly. Go to blogs like WPCentral and the Windows Phone community is alive and well swapping out our black Lumia shells for yellow and talking about games and apps. Pretty much doing what we should be doing on a phone, not repairing phones that came broken.
Flawlessly? Ahahahahaha
Still no app data backup machanism.
Still no custom themes.
Still no way to sideload XAP files (unless they are "company apps") without a PC.
Still no filesystem access.
Still no way to control the permissions an app has (what if I want to use the app, but don't want to give it access to my camera?)
Still no way remove "Settings" apps.
Still no way to do true multitasking (not the restricted and often crippled things that the official APIs call multitasking).
Still no way to overwrite file associations (you can choose them when opening a file that multiple apps claim to support, but that's it).
Still no way to change the default browser or email client or dialer.
Still no way to install apps to the SD card.
Still have only limited access to Bluetooth.
Still no way to browse, much less edit, the registry.
Still no way to sideload large numbers of (non-"company") apps.
...
Seriously, go look at the list of things that are possible with WP7 homebrew (never mind WinMo or Android or iOS), and then see how many of them are possible with WP8 right now. It's a joke. MS added some (much needed) features, but also took away some things that I think are vitally important, and took away our ability to re-create them for the new OS... unless and until we break it as we have broken OSes in the past.
You imply that WP8 didn't come "broken" and therefore doesn't need modding? Bull.
I've been wanting to root/unlock my Lumia for one purpose only, sideloading my own developed apps. It's gruesome to try an app in the emulator all the time, but in a month that will be fixed with an AppHub account. And after that my real purpose for rooting/unlocking is gone.
Always fun to see what's possible on the unlocked device though, code-wise.
Sent from my Lumia 920 using Board Express
GoodDayToDie said:
Flawlessly? Ahahahahaha
Still no app data backup machanism.
Still no custom themes.
Still no way to sideload XAP files (unless they are "company apps") without a PC.
Still no filesystem access.
Still no way to control the permissions an app has (what if I want to use the app, but don't want to give it access to my camera?)
Still no way remove "Settings" apps.
Still no way to do true multitasking (not the restricted and often crippled things that the official APIs call multitasking).
Still no way to overwrite file associations (you can choose them when opening a file that multiple apps claim to support, but that's it).
Still no way to change the default browser or email client or dialer.
Still no way to install apps to the SD card.
Still have only limited access to Bluetooth.
Still no way to browse, much less edit, the registry.
Still no way to sideload large numbers of (non-"company") apps.
...
Seriously, go look at the list of things that are possible with WP7 homebrew (never mind WinMo or Android or iOS), and then see how many of them are possible with WP8 right now. It's a joke. MS added some (much needed) features, but also took away some things that I think are vitally important, and took away our ability to re-create them for the new OS... unless and until we break it as we have broken OSes in the past.
You imply that WP8 didn't come "broken" and therefore doesn't need modding? Bull.
Click to expand...
Click to collapse
If there is one thing I do not understand about the new SDK APIs, is why on earth an app can not register itself to open file formats reserved by the system. IMO thats the most retarded idea ever implemented in the history of computing. And to make the retarded thing completely retarded, they made it so most common files are handled by system apps, so you can not override the file association.
I am really wondering what is microsoft going to do about these things. If they really want a marketplace full of games, facebook, youtube and instagram apps, then they should stick to their current plan. WP will never get useful in a broad sense.
I hope the update this fall brings new stuff, otherwise the platform will die soon.
GoodDayToDie said:
Flawlessly? ... You imply that WP8 didn't come "broken" and therefore doesn't need modding? Bull.
Click to expand...
Click to collapse
Although I don't agree with much of his bill-of-particulars, I have to agree with GDTD's sentiment.
Probably, modders need to correct deficiencies. I'm down with MS or anybody else who steps up. I'm in no hurry to crack my OS open right now, though.
I am especially offended at Microsoft's pitiful PDF reader attempt. And some of the apps in the store make me squint. I want to see the author "Google" emblazoned on my YouTube app, not a third party dev. I sure hope MS is putting these apps under a microscope.
The joy of homebrew (and of a developer forum, like this one) is, even if your goals are different from mine, it's possible for you to make your own changes to the device. It's yours; you control it. That's what security *means*, or at least what it's supposed to mean: you (the owner) are in control of what happens.
Ever since the iPhone, though, the trend has been twoards more and more lockdown, taking control away from the device owner and branding this as "security". I don't like it, so I aim to break it. Ideally, we break it in ways that only work with a local attack; I don't want somebody else able to control my device (that really would be the opposite of security)... but I do want to control it myself!
Part of the problem is that there have been no updates in recent months. Portico came out, Nokia dropped some new firmwares last month. But largely, nothing has changed in WP8 since launch. Personally, I find that boring. Maybe I should have an Android phone on the side to keep me entertained with updates, but I find Windows Phone much more usable day-to-day.
It has been more than 6 months since the WP8 launch, and GDR1 didn't really add much. Microsoft should have planned to have GDR2 out by now, even if it meant postponing some features for GDR3. I think most of us would rather have small quarterly updates to WP8, rather than a massive upgrade once a year. It's starting to feel like WP7 and the Mango anticipation all over again, now that it sounds like WP8.1 might be delayed into 2014. Hopefully they come through with their vaporware enthusiast program to keep our attention in the meantime.
I agree with the OP. Cobwebs on this side of the section totally. A thread in a week may be? But there is something I often read on many forums. People who are happy (I know it's a very wide term) with their devices, I.e don't run into problems with their devices, see no need to lurk around. So actually, it is a good sign. It shows how well-thought after a WP device is.
And GoodDayToDie, even though I agree with everything u've noted down, I don't quite believe WP needs all of that.
Still no app data backup machanism. - Umm...Data Sense?
Still no custom themes. - Fair Enough, but again, WP IS NOT meant to be themed to the T
Still no way to sideload XAP files (unless they are "company apps") without a PC. - I believe this is for security reasons.
Still no filesystem access. - Why do you even want that when the system is running flawless, (yes the same word u scorned at.)
Still no way to control the permissions an app has (what if I want to use the app, but don't want to give it access to my camera?) - LOL! You gotta be kidding me right?
Android has the worst permission management I have ever seen in my adult life. Android gives wayyyyyyyyyyyyyy more information out than any OS out there.
Still no way remove "Settings" apps. Umm..u sure u want that?
Still no way to do true multitasking (not the restricted and often crippled things that the official APIs call multitasking). Multi-tasking is really good with WP8.
Still no way to overwrite file associations (you can choose them when opening a file that multiple apps claim to support, but that's it). - Fair enough, but not a deal breaker either.
Still no way to change the default browser or email client or dialer. - I believe you are again entering the territory of themeing, already replied above. Every OS comes with it's own email client. I don't see the point here.
Still no way to install apps to the SD card. - Fair enough. By far the best point in your list.
Still have only limited access to Bluetooth. - In what way?
Still no way to browse, much less edit, the registry. - Again, WHY? WHy mend it when it's not broken.
Still no way to sideload large numbers of (non-"company") apps - U can download the app(paid or otherwise) from the App store on your computer, put it on the SD card and say install from the Store App on the phone. Simple?
DataSense has nothing even remotely to do with backing up (and restoring) app data; where'd you get that idea? Vital feature that homebrew eventually made avaialble in WP7 but is missing in WP8.
"IS NOT meant" nothing! Somewhere under all that sandboxing and locked-down UI is a general-purpose OS running on top of highly capable hardware. It's "meant" to be whatever the owner fo the device *wants* it to be, including (in the case of many, many people if the popularity of WP7 homebrew apps is any sign) theming. Stop being an apologist for Microsoft; it's one thing to say "extensive theming wasn't implemented because other features were higher priority" but when you start trying to tell me that I'm not supposed to theme it, you seriously need to put down the Kool-Ade. Besides, the very claim is ludicrous to the point of disingenious; have you *seen* the WP8 ads? They all stress the customizability of the Start screen. To the point of suggesting you can "meet" a person simply through how they have their phone set up... those ads freaking scream "customize me!" Then you discover there's only a handful of pre-set colors, two background styles, and the ability to mess with the tiles; nothing else.
No, it is quite absolutely *not* for "security" reasons. Security means the owner of the device controlling the device's behavior. If somebody else (like, for example, the manufacturer of the device) is controlling its behavior, that is not security; it's lockdown. The sideloading restriction can only be called security if it's not your device but actually belongs to Microsft. Screw that. Besides, that argument makes no sense anyhow; if I can pay my $99 and sideload with a PC, why can't I sideload without one (or without paying)? The marketplace has DRM to mitigate piracy and that's a darn weak excuse to cripple a device anyhow.
When I can load my Puzzle Quest 2 savegames and other game progress and high scores, copy my PGP keychain, sideload my Kindle ebooks into the Kindle app (yes, this is possible on WP7), extract or replace the built-in audio files, and delete the junk which accumulates in the OS and uses up storage space (without hard resetting the device), then I will stop considering the level of filesystem access a problem. Until then, "running flawless" is quite worthy of scorn indeed.
Wow, I seriously question your reading comprehension. I never mentioned Android in this point, or anywhere else (except to point out that it has a lot of homebrew). But, for your information, the default permissions / capabilities handling in Android is just as broken as in WP8. The difference is that with Android, it is possible (CyanogenMOD did this, for example) to install apps without actually granting them all the permissions they ask for. On WP7, this wasn't properly possible yet, but I was working on a system to do it that hooked the app install process and allowed people to uncheck app capabilities they didn't want to permit.
Um yes, I'd like to remove the non-functioning Samsung apps (until they are fixed) that are taking up space on my phone's storage and making the Settings list longer. I can always re-install them if needed. Every other carrier or OEM app is removable; why should these get special treatment just because they have a field in their app manifest that says "install me in the Settings hub"?
Multitasking - true multitasking, where multiple apps can run at once - is nigh-nonexistent on WP8. Aside from things like audio background agents and once-every-30-minutes-you-get-a-few-seconds-of-CPU-time scheduled tasks, there basically isn't any multitasking (of third-party apps) at all. Fast app switching is *not* multitasking; every app aside from the main one is suspended, unable to do amything until brought into the foreground.
Changing file associations obviusly isn't a deal-breaker, or I wouldn't be using the phone... but definitely a problem. Windows has offered the ability to control file associations since at least Win95, and I think it was possible in 3.1 as well...
Changing the default browser and email client and calendar and dialer aren't "theming" by any conventional definition, but the point made above about theming stands anyhow: it's a matter of personalization. It can also be a matter of functionality (for example, the built-in email client can't handle S/MIME encrypted email at all and has no PGP integration). Or a matter of usability (I use folders a lot; it's a pain needing to expand a menu to get to them)! Or something else... the important point is that it should be possible. Every OS comes with an email client, but every OS except iOS (and WP) allows you to change the default email client, too. This isn't even hard to implement (the relevant registry keys were present on WP7, at least; carrying over the API to control them wouldn't have been hard at all); it's once again a case of Microsoft intentionally restricting what you can do with your phone. If I wanted a mobile OS designed by a control freak, I'd buy an iPhone...
Nothing more really needs to be said here, except that with filesystem access (create a symlink or junction in the apps folder, for example) this would be possible...
Many BT profiles, such as HID devices (for mice and keyboards), are missing from WP8. So far as I know, apps can't use the Headset profile either; the pseudo-turn-by-turn navigation on WP7 would give its instructions via the car's BT if possible, but Nokia/Here Drive must use the phone's speakerphone speaker instead.
When I can change default browser and text editor, create my own themes, enable features that a ROM shipped disabled (have you seen the thread by the guy who can't get visual voicemail?), sideload high-privilege apps (without paying for the privilege), and remove root certificates of CAs that I don't trust (in WP7, these were stored in the registry), then I will stop considering the level of registry access to be a problem.
If they're from the store, they aren't really sideloaded, just downloaded on a different machine. I'm talking homebrew, stuff that the isn't yet, or never will be, or *can't* be (because it breaks some policy of Microsoft's, or requires high privileges to work) put in the store. Besides, many of the most popular WP8 models don't have an SD card slot at all.
GoodDayToDie said:
Flawlessly? Ahahahahaha
Still no app data backup machanism.
Still no custom themes.
Still no way to sideload XAP files (unless they are "company apps") without a PC.
Still no filesystem access.
Still no way to control the permissions an app has (what if I want to use the app, but don't want to give it access to my camera?)
Still no way remove "Settings" apps.
Still no way to do true multitasking (not the restricted and often crippled things that the official APIs call multitasking).
Still no way to overwrite file associations (you can choose them when opening a file that multiple apps claim to support, but that's it).
Still no way to change the default browser or email client or dialer.
Still no way to install apps to the SD card.
Still have only limited access to Bluetooth.
Still no way to browse, much less edit, the registry.
Still no way to sideload large numbers of (non-"company") apps.
...
Seriously, go look at the list of things that are possible with WP7 homebrew (never mind WinMo or Android or iOS), and then see how many of them are possible with WP8 right now. It's a joke. MS added some (much needed) features, but also took away some things that I think are vitally important, and took away our ability to re-create them for the new OS... unless and until we break it as we have broken OSes in the past.
You imply that WP8 didn't come "broken" and therefore doesn't need modding? Bull.
Click to expand...
Click to collapse
The only thing I can agree with you on is the file system, bluetooth, and not being able to override the default apps associations (seriously, the default apps is the most retarded idea ever).

Categories

Resources