Nook Simple Touch -> Nook Multi Touch [Screensaver Locking Issue Explanation Added]

Nook Simple Touch -> Nook Multi Touch [Screensaver Locking Issue Explanation Added] - Nook Touch General

Nook Simple Touch -> Nook Multi Touch [Screensaver Locking Issue Explanation Added]
After long discussion on how to enable multitouch
http://forum.xda-developers.com/showthread.php?t=1361296
Finally we get something very exciting,
mixing with the noRefresh app, thank to everyone developing this app
http://forum.xda-developers.com/showthread.php?t=1502723
==Exciting Videos==
AngryBird: http://www.youtube.com/watch?v=Chy0MGorjmo
Excellent PDF Reading: http://www.youtube.com/watch?v=JDk8a0leP4U
======For User======
For those who want a simple installation package
Can use the following update-package made by mali100, thanks to mali100
mali100 made an update-zip to install multitouch through CWM
[NST][CWR][RC2] Clockworkmod based Recovery
For thise users want to install manually
Can achieve Multi-touch by 2 Steps:
| Replacing Kernel:
| -make sure you haven't changed it before, otherwise u have to combine the changes and compile a new one
| -remember, a backup is a MUST
| for firmware 1.1 users
| Use Noogie or other methods, change the uImage with the attached one ( or the combined kernel mentioned below )
| arkusuma teaches us how to change uImage using ADB here
| *Thanks to arkusuma!
|
| Adding Permission node:
| in "/etc/permissions/required_hardware.xml", add
|
Code:
<feature name="android.hardware.touchscreen" />
<feature name="android.hardware.touchscreen.multitouch" />
|
| Reboot
For those users who also want to achieve USB host
Can find the combined kernel here: ( Thanks mali100! )
http://forum.xda-developers.com/showthread.php?p=24180134
Known Issue:
Sometimes the nook would act like un-responsive when it is in screensaver.
To solve it, try to drag the screen with two fingers.
The reason for this is, a cache is added between hardware input and linux subsystem, if the driver missed one of the "finger up" event before, it would result it leaving a phantom finger touching in your next touch. The screen cannot unlock by 2 fingers. But when you drag the screen with 2 fingers. It will clear all the cache, so as to erase the phantom touching.
Click to expand...
Click to collapse
======For Developer======
It is done by editing the kernel + adding permission node
*Thanks to arkusuma, who improved the code, added a cache for touching data, which prevents the pervious "un-stable" situation from happening
Kernel: just replace zforce.c, then compile
Two main changes on zforce,
first one is process_touch_event ( report touch information ),
second one is zforce_probe, this one just added a few input_set_abs_params ( register for device capability )
http://github.com/arkusuma/nook-touch-multitouch
Permission node: in "/etc/permissions/required_hardware.xml", add
Code:
<feature name="android.hardware.touchscreen" />
<feature name="android.hardware.touchscreen.multitouch" />
Click to expand...
Click to collapse
Thanks to arkusuma for improving the code again !

Why not work multi touch zoom in Opera mini?

love it ;]
also.. it works in OPERA 'mobile'.

osowiecki said:
love it ;]
also.. it works in OPERA 'mobile'.
Click to expand...
Click to collapse
Yes, you're right. Thank you.
PS: in UC Browser works too

Congrats on getting multitouch working!

wheilitjohnny,
Congrats on your feat! Maybe you should do a tutorial on how to install those files, for those poor lame souls like myself who can do simple things like run installer and such, even run a rooter, but need help on anything else.

Thank you for your support, I also wish to make a 1-click-install later.
But since the multi-touch is still not very smooth when the fingers are not moving, I want to package the things when I have a better release!
Wish that day comes earlier ^ ^

Could anyone say if kernel for 1.1 will work on 1.1.2? Then could someone compile one if it does not?

Hi, I've made some adjustment of wheilitjohnny's source. It seems to be working properly now, even when there's no finger movement. Changes can be viewed at github:
github.com/arkusuma/nook-touch-multitouch
I'm attaching the resulting uImage for those interested.

Cool ! Thanks arkusuma
You added a cache !
Seems that it is perfect now...
I wanna also improve the noRefresh app, make it being enabled when we are dragging......
But seems difficult

Now we get into the dueling uImages.
I guess that everybody will have to start building their own.
The problem is when somebody offers their uImage for Option A and somebody offers their uImage for Option B.
I could use a uImage for multitouch and USB host mode.
wheilitjohnny said:
I wanna also improve the noRefresh app, make it enable when we are dragging...
Click to expand...
Click to collapse
It's not difficult, but it has to (well, no, but most easily can be) integrated into the app.
I've got one of my personal apps that does this already.
I've stripped it down to a demo.
This only pans. Notice that it switches back and forth between A2 and normal modes.

Do the USB host one released the source code?
If yes, u can combine them and compile a whole new one to enjoy both hacks !
=======================
I just wonder, if it is possible, to make an app.
Getting information from the kernel directly, and set the mode using the raw information.
Then it can support all Apps
Any method for an app to read /dev/input/event2 ?

wheilitjohnny said:
Do the USB host one released the source code?
Click to expand...
Click to collapse
Yes, verygreen put it somewhere.
wheilitjohnny said:
Any method for an app to read /dev/input/event2 ?
Click to expand...
Click to collapse
Yes, /dev/input is where the good stuff is, but it's a bit more complicated.
The order of devices changes depending on what is connected/active.
Moreover, you can't really take over something that another process is reading.
Here's what my system is showing (with two USB keyboards plugged in ):
Code:
# ls -l /dev/input
crw-rw---- root input 13, 70 2012-03-27 08:34 event6
crw-rw---- root input 13, 33 2012-03-27 08:34 mouse1
crw-rw---- root input 13, 69 2012-03-27 08:34 event5
crw-rw---- root input 13, 68 2012-03-27 08:34 event4
crw-rw---- root input 13, 67 2012-03-27 08:34 event3
crw-rw---- root input 13, 66 2012-03-26 12:19 event2
crw-rw---- root input 13, 32 2012-03-26 12:19 mouse0
crw-rw---- root input 13, 63 2012-03-26 12:19 mice
crw-rw---- root input 13, 65 2012-03-26 12:19 event1
crw-rw---- root input 13, 64 2012-03-26 12:19 event0

maybe it is possible for me to add in dummy information in driver to raise extra input events.
my problem now is how an app (service in background) read device input event directly
I think we can make an input event separately from anything else
only let that app to read it, is it possible?
any permission stuff?
how to impletment the code in Java environment for the app?
how exactly the code should be typed?

Hi,
is this hack compatible with Edit n/reading now/side btns/RecentApps+ActivityPicker+ForceOrient from XorZone

tebra said:
Hi,
is this hack compatible with Edit n/reading now/side btns/RecentApps+ActivityPicker+ForceOrient from XorZone
Click to expand...
Click to collapse
Yes, this one is kernel based, XorZones is a hack of the framework.

I tried making "Dragging NoRefresh" using JNI
But the permission problem when I try to access /dev/input/event making me feel mad...

Really great news. i tried it with opera mobile, really good experience..
may i ask which pdf reader is this thats seen on the video?

Thanks for this!
Does anybody know how to flash a kernel image without using Noogie (using CWM, for example)?

drmxmyt said:
Really great news. i tried it with opera mobile, really good experience..
may i ask which pdf reader is this thats seen on the video?
Click to expand...
Click to collapse
that is ezPDF Reader
marspeople said:
Thanks for this!
Does anybody know how to flash a kernel image without using Noogie (using CWM, for example)?
Click to expand...
Click to collapse
is it possible to make it a "update-package" ? just like that one for official firmware update.

Related

KK 4.4 !! [Solved] Wifi Regional problem with sim card inserted

For 4.4 goto 2'nd post
This is for JB 4.3.1
If you like me have the problem of : ( wifi + sim_card ) = wifi not working
here is the fix : credits to HTCZ715E
http://forum.xda-developers.com/showthread.php?t=2368501
but just 1 more step , after making the new "telephony-common.jar" and adb push , and chmod 644
you HAVE TO wipe dalvik+cache
without wipe dalvik+cache it never worked for me.
HTC MyTouch 4G
[ROM] CM-10.2 | AOSP 4.3 Jellybean [KANG] [Oct-11]
cm-10.2-20131011-Albinoman887-glacier

Well heads up to the android 4.4
non of the previous solutions is not working :crying:
today i tried ROM Legacy Carbon 4.4
so i started to use my knowledge about cracking from the old MS-dos ages !!!!!!!!! and i cracked the bcmdhd.ko file
using IDA dissembler and HexEdit the bcmdhd.ko file.
Now wifi works again. :good:
The problem is that , in this method i cannot provide a universal file and you have to make your own cracked driver ".ko" file.
Or the developers of each Rom should use the working source code for the wifi driver which has the complete support for all languages.
refer to this post:
http://forum.xda-developers.com/showthread.php?t=1077329
and also here are some lines from logcat (i changed my mcc , mnc and country to XX ) with the cracked driver.
(i prefer to use cracking instead of patching because it was previously we called it)
Code:
D/Tethering( 1874): Exception adding default nw to upstreamIfaceTypes: java.lang.NullPointerException
E/wpa_supplicant( 2047): wpa_driver_nl80211_driver_cmd: failed to issue private commands
E/WifiStateMachine( 1874): Failed to set country code XX
D/MccTable( 2051): updateMccMncConfiguration: mcc=XXX, mnc=XX
D/MccTable( 2051): getLocaleFromMcc to null_ir mcc=XXX
D/MccTable( 2051): getLocaleForLanguageCountry: skipping no language
D/MccTable( 2051): WIFI_COUNTRY_CODE set to ir
I/WifiService( 1874): WifiService trying to set country code to XX with persist set to true
D/MccTable( 2051): updateMccMncConfiguration updateConfig config={1.0 XXXmccXXmnc ?locale ?layoutDir ?swdp ?wdp ?hdp ?density ?lsize ?long ?orien ?uimode ?night ?touch ?keyb/?/? ?nav/? themeResource=null}
I/ActivityManager( 1874): Config changes=3 {1.0 XXXmccXXmnc en_US ldltr sw384dp w384dp h615dp 200dpi nrml long port finger -keyb/v/h tball/v s.6 themeResource=null}
The whole problem started from the "wldev_set_country" function in "C" code in a ".h" file of wifi driver.
i don't have the knowledge to manipulate the source code of the wifi driver and compile compile the ".ko" file.

This method is not for pplz who don't know about reverse engineering.
So i opened the "bcmdhd.ko" in IDA disassembler and select the ARM Architecture.
Then searched for the "wldev_set_country" function and in the disassembled code there is some Branches which should be re-routed.
for example: (these are the OP-Codes of ARM cpu)
BNE loc_206E4 in the hex view window "08-00-00-0A"
BNE = Branch if not Equal , (and must have to change to just Branch no matter what is the result of compare )
0A = BNE
EA = B (Branch)
AA = BGE (Branch if Greater or Equal)
..... and etc
The important thing is that in IDA hex-view for examaple it shows : 000206BC 08 00 00 1A
but at the bottom of window it shows: 000206F0 <= this is the address which u needs to find and change in your hex-ediotor
and in hex editor we will change that 1A to 0A
The whole process i re-route 4 branches to get success.
Also i've checked it , and there is no need to appliy the previous patch "telephony-common.jar"
Only the bcmdhd.ko driver needs to patch

I attached the cracked version of my bcmdhd.ko file.
you can try it , BUT IT MAY NOT FOR YOUR COUNTRY AND/OR YOUR SIM CARD and for sure it only works in some Roms
this is the driver version from dmesg
Dongle Host Driver, version 5.90.195.114
Compiled in drivers/net/wireless/bcmdhd on Nov 18 2013 at 17:0
Click to expand...
Click to collapse
i made the attachment for this Rom
[ROM][UNOFFICIAL] LegacyCarbon 4.4 \\ 18.11.2013 \\ Built From Source
you should unzip it and use "adb push" and "chmod 644 "
Code:
adb root
adb push bcmdhd.ko /system/lib/modules/
adb shell
su
cd /system/lib/modules/
chmod 644 bcmdhd.ko
and reboot
----------------------------------------------
HTC MyTouch 4G
[ROM][UNOFFICIAL] LegacyCarbon 4.4 \\ 18.11.2013 \\

I test this file on [ROM][Official][4.4] Evervolv Nightlies
It's compatible And works 100% :good:

BobZombiE said:
I test this file on [ROM][Official][4.4] Evervolv Nightlies
It's compatible And works 100% :good:
Click to expand...
Click to collapse
Did you use it? Bug important? I want to know some information. Thanks!

Sure , i'm using this patched driver almost on all Roms i'm testing and never had any wifi problems.
Sent from my myTouch 4G using xda app-developers app

BobZombiE said:
I test this file on [ROM][Official][4.4] Evervolv Nightlies
It's compatible And works 100% :good:
Click to expand...
Click to collapse
Camera, cam recording, and Browser? What any problem?
If I want back Rom 4.3 after install 4.4. Can I back?!
Thank so much your infomation!

hdhthed said:
Camera, cam recording, and Browser? What any problem?
If I want back Rom 4.3 after install 4.4. Can I back?!
Thank so much your infomation!
Click to expand...
Click to collapse
go to the related thread and take a look , or make a nandroid backup and try.
anyway:
Evervolv 4.0: at this moment: Camera does not work at all . but stock browser is ok :good:
Carbon 4.4 Rom : at this moment : Camera & Cam recording is ok. but stock browser does not work. u have to use other browsers like firefox

Yea! Make a nandroid backup ,after I can restore in Recovery. Have lost root?

hdhthed said:
Yea! Make a nandroid backup ,after I can restore in Recovery. Have lost root?
Click to expand...
Click to collapse
i don't think so

BobZombiE said:
i don't think so
Click to expand...
Click to collapse
Mean? You think lose root or cant restore a backup nandroid ?

hdhthed said:
Mean? You think lose root or cant restore a backup nandroid ?
Click to expand...
Click to collapse
i'm root and s=off , HBOOT 75
and flashed, backed up, restored my phone more than 100 times last week . and never lost root

This is my old phone... Fun to be back here.
I am asking about this modified driver. I need to find out first if my phone uses this driver (looks like a broadcom driver), but if it is, I am going to try it.
My question to the author is: do the changes you made make this driver location agnostic? Because you changed the BNE, to just branch, it seems that you are allowing it to function regardless of the country (in the MMC).
I have an HTC One running 4.4 and my issue is that I really need to use channel 13. My router is set to 13, but no matter what changes I make to the wi-fi region encoding (the region encoding change is successful), I still am limited to only channels 1 to 11.
So I just thought I'd ask to get your input on this...
Thanks,
Paul

help me solve my wifi issue
BobZombiE said:
For 4.4 goto 2'nd post
This is for JB 4.3.1
If you like me have the problem of : ( wifi + sim_card ) = wifi not working
here is the fix : credits to HTCZ715E
http://forum.xda-developers.com/showthread.php?t=2368501
but just 1 more step , after making the new "telephony-common.jar" and adb push , and chmod 644
you HAVE TO wipe dalvik+cache
without wipe dalvik+cache it never worked for me.
HTC MyTouch 4G
[ROM] CM-10.2 | AOSP 4.3 Jellybean [KANG] [Oct-11]
cm-10.2-20131011-Albinoman887-glacier
Click to expand...
Click to collapse
Hey guys ... I'am a normal user having sony xperia ion Lt28h .... I've just flashed CM11 unofficial rom but I have a wifi problem ..... can you teach me how to solve my regional wifi issue as I am in syria and have faced this problem earlier so i know it's a regional problem ..... thx for help

[unofficial][linux3.4][native][tarchive][multirom]ArchLinuxARM release for N7 2013

This is not an Android project so I don't feel that posting it in the Android Development forum would be appropriate.
ArchLinuxARM for the flo (2013 Nexus 7) - Native Boot with MultiROM
This is only tested on the Wi-Fi version. With a kernel swap, it should work on the deb (LTE) tablet, though mobile data is highly unlikely to work.
Big thanks to crondog at github for the initial porting work. https://github.com/crondog/arch-flo
Working:
3D Acceleration (OpenGL ES 3.0, Mesa) - can be unstable, however.
Wi-Fi (with NetworkManager)
Bluetooth
Audio
Installation
MultiROM must already be installed, and you must already have a hardboot-capable kernel installed as well.
You will need a Terminal Emulator or ADB Shell to install.
This assumes that arch_flo_20141210_multirom.tar.gz is in the root of your internal storage (/data/media/0).
Code:
su
tar -C /data/media/0/multirom/roms -xpzvf /data/media/0/arch_flo_20141210_multirom.tar.gz
Logging in
The username is "arch" and the password is "archlinux". Change the password ASAP.
For root, the username is "root" and the password is also "root". CHANGE THE PASSWORD ASAP!
You'll probably want to enable the On-Screen Keyboard (onboard) and set your Session to "MATE" up in the top right corner.
Downloads
MultiROM hierarchy tarchive: https://drive.google.com/file/d/0B4WUjKii92l2X1F1LVhsaG5DbUE/view?usp=sharing
Kernel Source: https://github.com/willcast/kernel_flo
Also available for:
Samsung Galaxy S III LTE: http://forum.xda-developers.com/gal...unofficial-port-archlinuxarm-release-t2969290
HP TouchPad: http://forum.xda-developers.com/hp-touchpad/other/unofficial-archlinuxarm-release-hp-t2969310
Nexus 10: http://forum.xda-developers.com/nexus-10/general/unofficial-archlinuxarm-release-nexus-10-t2969450
HTC HD2: http://forum.xda-developers.com/hd2-ubuntu/development/unofficial-archlinuxarm-htc-hd2-t2970483

looks interesting will give it a crack and see how it goes

thanks for the work. it boots impressingly fast.
castrwilliam said:
You'll probably want to enable the On-Screen Keyboard (onboard) and set your Session to "MATE" up in the top right corner.
Click to expand...
Click to collapse
if I activate the onboard keyboard ist shows at the bottom of the login screen. login works without password. when beeing logged in the keyboard is gone. I can see the keyboard symbol on the left besinde the speaker symbol but tapping on it doesn't trigger anything. also changing any options in the control center -> onboard settings have no effects. logging in without keyboard activated and then control center -> onboard settings has no effects either.
I cannot "adb shell" due to lack of permissions
Code:
# adb devices
List of devices attached
???????????? no permissions
and I'm not owning a bluetooth keyboard. so right now I can only play minesweeper - oh wait, it's not installed...

is there any way to rotate the screen as its really annoying having it in portrait all the time

Toby0897 said:
is there any way to rotate the screen as its really annoying having it in portrait all the time
Click to expand...
Click to collapse
Yeah it is in the monitor options but it's worthless since Xorg crashes when changing the rotation

Great stuff!
I would remove the KDE plasma etc packages as that desktop seemed to unusable. (Due to broken hw acceleration?).
what's next?

Hi, I'm having a big trouble...
While I'm trying to do the installation (by adb shell or terminal emulator, both of them) and I enter the command posted in the OP it says:
127|[email protected]:/ # tar -C /data/media/0/multirom/roms -xpzvf /data/media/0/arch_flo_20141210_multirom.tar.gz
tmp-mksh: tar: not found
What can I do to resolve this error? I really would like to install it on my Nexus 7
Thanks in advance!

hugomc92 said:
Hi, I'm having a big trouble...
While I'm trying to do the installation (by adb shell or terminal emulator, both of them) and I enter the command posted in the OP it says:
127|[email protected]:/ # tar -C /data/media/0/multirom/roms -xpzvf /data/media/0/arch_flo_20141210_multirom.tar.gz
tmp-mksh: tar: not found
What can I do to resolve this error? I really would like to install it on my Nexus 7
Thanks in advance!
Click to expand...
Click to collapse
You will need to install busybox for tar to work

daringblaze said:
You will need to install busybox for tar to work
Click to expand...
Click to collapse
Thank you very much!! That make tar to work!!
Gonna try archLinux ASAP!!
Thanks!

updates
Hi, great stuff!
After installing it, I tried to update arch (
Code:
sudo pacman -Syu
) but this resulted in a blank screen upon boot. I assume that this is due to updated packages overwriting parts of the OS that were installed manually, but I don't know what or where. Would you have any ideas of what packages would be responsible for this, so that I know not to upgrade them?
Thanks!

computer-whisperer said:
this resulted in a blank screen upon boot. I assume that this is due to updated packages overwriting parts of the OS that were installed manually, but I don't know what or where. Would you have any ideas of what packages would be responsible for this, so that I know not to upgrade them?
Thanks!
Click to expand...
Click to collapse
Make sure you ignore xorg and mesa stuff. Add
Code:
IgnorePkg = glu mesa mesa-dri mesa-libgl xorg-server-common xorg-server-devel xorg-fonts-misc xproto libdrm
IgnoreGroup = xorg
to /etc/pacman.conf.
The list probably contains some extra entries, but works for me

It took xda 2 years, but they finally did it.
In all seriousness, props to you. I've been waiting for this for along time.

castrwilliam said:
Downloads
MultiROM hierarchy tarchive: https://drive.google.com/......
Click to expand...
Click to collapse
Hi castrwilliam, would you mind sharing what step you went through to create arch_flo_20141210_multirom.tar.gz ?

Great work guys! I was looking for this for a really long time and i am writing this on my n7 with linux but i have a few questions:
1. is it possible to overclock(and how) because my n7 runs on 1.89ghz and 477mhz gpu in android with elementalx kernel and it would be nice to have some more power
2. can the screen be rotated so the hardware buttons are on top (i saw a post saying it chrashes but i cant even find the setting xD) because it would be alot easier to use the OTG cable
And thank you guys for making this happen, i love linux on the note 10.1 and im so glad to have this run it too(would be maaad if it can be overclocked )

Thank you for this wonderful package!
I recently updated all packages ) and iam trying to fix the issue without reinstall (challenge accepted)
It seems that the xorg-server 1.17 is the problem. I compiled. Freedreno and the freedreno mesa 10.3 and libdrn packages without success. The xserver is segfaulting when it loads libexa.so.
Now i try to downgrade to 1.16 . ive read that the xf86-video-freedreno-git package is not working with flo. Is that correct? Did youbuild this packages with modificationa?
I believe this is why i love arch. Its like lego for nerds or something

castrwilliam said:
This is not an Android project so I don't feel that posting it in the Android Development forum would be appropriate.
ArchLinuxARM for the flo (2013 Nexus 7) - Native Boot with MultiROM
This is only tested on the Wi-Fi version. With a kernel swap, it should work on the deb (LTE) tablet, though mobile data is highly unlikely to work.
Big thanks to crondog at github for the initial porting work. https://github.com/crondog/arch-flo
Working:
3D Acceleration (OpenGL ES 3.0, Mesa) - can be unstable, however.
Wi-Fi (with NetworkManager)
Bluetooth
Audio
Installation
MultiROM must already be installed, and you must already have a hardboot-capable kernel installed as well.
You will need a Terminal Emulator or ADB Shell to install.
This assumes that arch_flo_20141210_multirom.tar.gz is in the root of your internal storage (/data/media/0).
Code:
su
tar -C /data/media/0/multirom/roms -xpzvf /data/media/0/arch_flo_20141210_multirom.tar.gz
Logging in
The username is "arch" and the password is "archlinux". Change the password ASAP.
For root, the username is "root" and the password is also "root". CHANGE THE PASSWORD ASAP!
You'll probably want to enable the On-Screen Keyboard (onboard) and set your Session to "MATE" up in the top right corner.
Downloads
MultiROM hierarchy tarchive: https://drive.google.com/file/d/0B4WUjKii92l2X1F1LVhsaG5DbUE/view?usp=sharing
Kernel Source: https://github.com/willcast/kernel_flo
Also available for:
Samsung Galaxy S III LTE: http://forum.xda-developers.com/gal...unofficial-port-archlinuxarm-release-t2969290
HP TouchPad: http://forum.xda-developers.com/hp-touchpad/other/unofficial-archlinuxarm-release-hp-t2969310
Nexus 10: http://forum.xda-developers.com/nexus-10/general/unofficial-archlinuxarm-release-nexus-10-t2969450
HTC HD2: http://forum.xda-developers.com/hd2-ubuntu/development/unofficial-archlinuxarm-htc-hd2-t2970483
Click to expand...
Click to collapse
What's NOT working

Hello, is there some instruction howto run (native) arch on nexus 4? I see only for n7, n10...

Hello, I have some trouble when I boot.
config: rastapop 5.1.1 (AOSP based) + last multirom v32A + Kernel w/ kexec-hardboot patch (Stock 5.1.1)
Installing archlinux correctly from the terminal emulator. Load it --> black screen (about 6seconds) --> Google Logo forever
Someone know what I can do for make it work ?

Cool I will give it a try.

Yet ANOTHER possible CVE for root or privilege elevations (CVE-2016-2494)

Looking through the June security bulletin and found this https://www.exploit-db.com/exploits/39921/. I downloaded it from the source, and it cam with a compiled PoC. I ran it and it seemed to work, but I don't know exactly what it is doing. Here is a log of what the code gives me after being run:
127|[email protected]:/data/local/tmp $ ./sdcard_poc
[*] sdcard off-by-one poc
[*] getting everything ready...
- creating 16 small entries
- creating large entries
- adjusting pad_1 entry
rename_pad_1(1, 2)
rename_pad_1(2, 1)
- resizing overflow entries
rename_overflows(255)
[*] triggering!
rename_pad_2(1, 2)
rename_pad_2(2, 3)
rename_pad_2(3, 4)
rename_pad_2(4, 5)
rename_pad_2(5, 6)
rename_pad_2(6, 7)
rename_pad_2(7, 8)
rename_pad_2(8, 9)
rename_pad_2(9, 10)
rename_pad_2(10, 11)
rename_pad_2(11, 12)
rename_pad_2(12, 13)
rename_pad_2(13, 14)
rename_pad_2(14, 15)
rename_pad_2(15, 16)
rename_pad_2(16, 17)
rename_pad_2(17, 18)
rename_pad_2(18, 19)
rename_pad_2(19, 20)
rename_pad_2(20, 21)
rename_pad_2(21, 22)
rename_pad_2(22, 23)
rename_pad_2(23, 24)
rename_pad_2(24, 25)
rename_pad_2(25, 26)
rename_pad_2(26, 27)
rename_pad_2(27, 28)
rename_pad_2(28, 29)
rename_pad_2(29, 30)
rename_pad_2(30, 31)
rename_pad_2(31, 32)
rename_pad_2(32, 33)
rename_pad_2(33, 34)
rename_pad_2(34, 35)
rename_pad_2(35, 36)
rename_pad_2(36, 37)
rename_pad_2(37, 38)
rename_pad_2(38, 39)
rename_pad_2(39, 40)
rename_pad_2(40, 41)
rename_pad_2(41, 42)
rename_pad_2(42, 43)
rename_pad_2(43, 44)
rename_pad_2(44, 45)
rename_pad_2(45, 46)
rename_pad_2(46, 47)
rename_pad_2(47, 48)
rename_pad_2(48, 49)
rename_pad_2(49, 50)
rename_pad_2(50, 51)
rename_pad_2(51, 52)
rename_pad_2(52, 53)
rename_pad_2(53, 54)
rename_pad_2(54, 55)
rename_pad_2(55, 56)
rename_pad_2(56, 57)
rename_pad_2(57, 58)
rename_pad_2(58, 59)
rename_pad_2(59, 60)
rename_pad_2(60, 61)
rename_pad_2(61, 62)
rename_pad_2(62, 63)
rename_pad_2(63, 64)
rename_pad_2(64, 65)
rename_pad_2(65, 66)
rename_pad_2(66, 67)
rename_pad_2(67, 68)
rename_pad_2(68, 69)
rename_pad_2(69, 70)
rename_pad_2(70, 71)
rename_pad_2(71, 72)
rename_pad_2(72, 73)
rename_pad_2(73, 74)
rename_pad_2(74, 75)
rename_pad_2(75, 76)
rename_pad_2(76, 77)
rename_pad_2(77, 78)
rename_pad_2(78, 79)
rename_pad_2(79, 80)
rename_pad_2(80, 81)
rename_pad_2(81, 82)
rename_pad_2(82, 83)
rename_pad_2(83, 84)
rename_pad_2(84, 85)
rename_pad_2(85, 86)
rename_pad_2(86, 87)
rename_pad_2(87, 88)
rename_pad_2(88, 89)
rename_pad_2(89, 90)
rename_pad_2(90, 91)
rename_pad_2(91, 92)
rename_pad_2(92, 93)
rename_pad_2(93, 94)
rename_pad_2(94, 95)
rename_pad_2(95, 96)
rename_pad_2(96, 97)
rename_pad_2(97, 98)
rename_pad_2(98, 99)
rename_pad_2(99, 100)
rename_pad_2(100, 101)
rename_pad_2(101, 102)
rename_pad_2(102, 103)
rename_pad_2(103, 104)
rename_pad_2(104, 105)
rename_pad_2(105, 106)
rename_pad_2(106, 107)
rename_pad_2(107, 108)
rename_pad_2(108, 109)
rename_pad_2(109, 110)
rename_pad_2(110, 111)
rename_pad_2(111, 112)
rename_pad_2(112, 113)
rename_pad_2(113, 114)
rename_pad_2(114, 115)
rename_pad_2(115, 116)
rename_pad_2(116, 117)
rename_pad_2(117, 118)
rename_pad_2(118, 119)
rename_pad_2(119, 120)
rename_pad_2(120, 121)
rename_pad_2(121, 122)
rename_pad_2(122, 123)
rename_pad_2(123, 124)
rename_pad_2(124, 125)
rename_pad_2(125, 126)
rename_pad_2(126, 127)
rename_pad_2(127, 128)
rename_pad_2(128, 129)
rename_pad_2(129, 130)
rename_pad_2(130, 131)
rename_pad_2(131, 132)
rename_pad_2(132, 133)
rename_pad_2(133, 134)
rename_pad_2(134, 135)
rename_pad_2(135, 136)
rename_pad_2(136, 137)
rename_pad_2(137, 138)
rename_pad_2(138, 139)
rename_pad_2(139, 140)
rename_pad_2(140, 141)
rename_pad_2(141, 142)
rename_pad_2(142, 143)
rename_pad_2(143, 144)
rename_pad_2(144, 145)
rename_pad_2(145, 146)
rename_pad_2(146, 147)
rename_pad_2(147, 148)
rename_pad_2(148, 149)
rename_pad_2(149, 150)
rename_pad_2(150, 151)
rename_pad_2(151, 152)
rename_pad_2(152, 153)
rename_pad_2(153, 154)
rename_pad_2(154, 155)
rename_pad_2(155, 156)
rename_pad_2(156, 157)
rename_pad_2(157, 158)
rename_pad_2(158, 159)
rename_pad_2(159, 160)
rename_pad_2(160, 161)
rename_pad_2(161, 162)
rename_pad_2(162, 163)
rename_pad_2(163, 164)
rename_pad_2(164, 165)
rename_pad_2(165, 166)
rename_pad_2(166, 167)
rename_pad_2(167, 168)
rename_pad_2(168, 169)
rename_pad_2(169, 170)
rename_pad_2(170, 171)
rename_pad_2(171, 172)
rename_pad_2(172, 173)
rename_pad_2(173, 174)
rename_pad_2(174, 175)
rename_pad_2(175, 176)
rename_pad_2(176, 177)
rename_pad_2(177, 178)
rename_pad_2(178, 179)
rename_pad_2(179, 180)
rename_pad_2(180, 181)
rename_pad_2(181, 182)
rename_pad_2(182, 183)
rename_pad_2(183, 184)
rename_pad_2(184, 185)
rename_pad_2(185, 186)
rename_pad_2(186, 187)
rename_pad_2(187, 188)
rename_pad_2(188, 189)
rename_pad_2(189, 190)
rename_pad_2(190, 191)
rename_pad_2(191, 192)
rename_pad_2(192, 193)
rename_pad_2(193, 194)
rename_pad_2(194, 195)
rename_pad_2(195, 196)
rename_pad_2(196, 197)
rename_pad_2(197, 198)
rename_pad_2(198, 199)
rename_pad_2(199, 200)
rename_pad_2(200, 201)
rename_pad_2(201, 202)
rename_pad_2(202, 203)
rename_pad_2(203, 204)
rename_pad_2(204, 205)
rename_pad_2(205, 206)
rename_pad_2(206, 207)
rename_pad_2(207, 208)
rename_pad_2(208, 209)
rename_pad_2(209, 210)
rename_pad_2(210, 211)
rename_pad_2(211, 212)
rename_pad_2(212, 213)
rename_pad_2(213, 214)
rename_pad_2(214, 215)
rename_pad_2(215, 216)
rename_pad_2(216, 217)
rename_pad_2(217, 218)
rename_pad_2(218, 219)
rename_pad_2(219, 220)
rename_pad_2(220, 221)
rename_pad_2(221, 222)
rename_pad_2(222, 223)
rename_pad_2(223, 224)
rename_pad_2(224, 225)
rename_pad_2(225, 226)
rename_pad_2(226, 227)
rename_pad_2(227, 228)
rename_pad_2(228, 229)
rename_pad_2(229, 230)
rename_pad_2(230, 231)
rename_pad_2(231, 232)
rename_pad_2(232, 233)
rename_pad_2(233, 234)
rename_pad_2(234, 235)
rename_pad_2(235, 236)
rename_pad_2(236, 237)
rename_pad_2(237, 238)
rename_pad_2(238, 239)
rename_pad_2(239, 240)
rename_pad_2(240, 241)
rename_pad_2(241, 242)
rename_pad_2(242, 243)
rename_pad_2(243, 244)
rename_pad_2(244, 245)
rename_pad_2(245, 246)
rename_pad_2(246, 247)
rename_pad_2(247, 248)
rename_pad_2(248, 249)
rename_pad_2(249, 250)
rename_pad_2(250, 251)
rename_pad_2(251, 252)
rename_pad_2(252, 253)
rename_pad_2(253, 254)
255|[email protected]:/data/local/tmp $
I am not sure what steps to take next, can anyone offer any help? This seems to be pretty promising as it actual works for once.

I tried that and I think it only gains System Privelleges. But honestly I really haven't seen any change. I even checked with id. Still was 2000 as usual.

NavSad said:
I tried that and I think it only gains System Privelleges. But honestly I really haven't seen any change. I even checked with id. Still was 2000 as usual.
Click to expand...
Click to collapse
So is this useless? I'm just kind of confused on what this does exactly...

It did some weird stuff to my phone, and I ended up having to factory reset. It seemed to have completely wiped the quick settings feature, and everything was back to the factory settings except for the apps that I had downloaded before

Honestly Annoying said:
So is this useless? I'm just kind of confused on what this does exactly...
Click to expand...
Click to collapse
I think someone would need to put some code into it that could inject system permission. Otherwise it's just a buffer overflow.

NavSad said:
I think someone would need to put some code into it that could inject system permission. Otherwise it's just a buffer overflow.
Click to expand...
Click to collapse
Yeah that makes sense...
In the meantime, check this out: https://www.exploit-db.com/exploits/39340/

Honestly Annoying said:
Yeah that makes sense...
In the meantime, check this out: https://www.exploit-db.com/exploits/39340/
Click to expand...
Click to collapse
I think this exploit could be patched because it was published in Janurary. But here's another exploit: http://www.cvedetails.com/cve/CVE-2016-3135/. Just need someone to port it over.

NavSad said:
I think this exploit could be patched because it was published in Janurary. But here's another exploit: http://www.cvedetails.com/cve/CVE-2016-3135/. Just need someone to port it over.
Click to expand...
Click to collapse
The thing about this exploit is that it was never assigned an official CVE, so it could have gone unnoticed.
And I'll check that one out. I've ported them over before. Is there a download link for it?

NavSad said:
I think this exploit could be patched because it was published in Janurary. But here's another exploit: http://www.cvedetails.com/cve/CVE-2016-3135/. Just need someone to port it over.
Click to expand...
Click to collapse
Also, this is an OLD root exploit that used a buffer overflow http://security.stackexchange.com/questions/68442/escalating-from-apache-shell-to-root/68482#68482

Honestly Annoying said:
The thing about this exploit is that it was never assigned an official CVE, so it could have gone unnoticed.
And I'll check that one out. I've ported them over before. Is there a download link for it?
Click to expand...
Click to collapse
Yes there is. https://bugs.chromium.org/p/project-zero/issues/detail?id=758&redir=1

NavSad said:
Yes there is. https://bugs.chromium.org/p/project-zero/issues/detail?id=758&redir=1
Click to expand...
Click to collapse
Yeah I just saw that... I'm trying right now but there's only a .c file. I'll see what I can do

I really appreciate you guys trying to get root, I wish I could do the same but I have no idea what to do.

NavSad said:
I think this exploit could be patched because it was published in Janurary. But here's another exploit: http://www.cvedetails.com/cve/CVE-2016-3135/. Just need someone to port it over.
Click to expand...
Click to collapse
I believe that I have ported the CVE over.
I have two different files, one of them gives an "unshare: Invalid argument" error. In the other file, I just deleted the lines that had "unshare" in them and recompiled it. This one seems to run the right way, but I don't exactly know what to do with it. Why did you say this CVE would work? And what can I do to see if it is working for me?

Honestly Annoying said:
I believe that I have ported the CVE over.
I have two different files, one of them gives an "unshare: Invalid argument" error. In the other file, I just deleted the lines that had "unshare" in them and recompiled it. This one seems to run the right way, but I don't exactly know what to do with it. Why did you say this CVE would work? And what can I do to see if it is working for me?
Click to expand...
Click to collapse
I said I thought it might work because Android and Linux share the same kernel, so problems can be ported over. Try adding some code that can inject root after the exploit is finished, maybe that could work.

Would adding something that would run "chmod 777 /data" work? If it is something like that it should be no problem

NavSad said:
I said I thought it might work because Android and Linux share the same kernel, so problems can be ported over. Try adding some code that can inject root after the exploit is finished, maybe that could work.
Click to expand...
Click to collapse
Would adding something that would run "chmod 777 /data" work? If it is something like that it should be no problem

Honestly Annoying said:
Would adding something that would run "chmod 777 /data" work? If it is something like that it should be no problem
Click to expand...
Click to collapse
Yeah put the file in data/local/tmp and do chmod 777.

NavSad said:
Yeah put the file in data/local/tmp and do chmod 777.
Click to expand...
Click to collapse
No I mean adding to the code. How can I get this to open a root shell?

Honestly Annoying said:
Would adding something that would run "chmod 777 /data" work? If it is something like that it should be no problem
Click to expand...
Click to collapse
I think he wanted to use the exploit to change the root folder's permissions to read write execute and then inject a su binary via file manager, and wanted to know if that would work... :/

MadnessChi1d said:
I think he wanted to use the exploit to change the root folder's permissions to read write execute and then inject a su binary via file manager, and wanted to know if that would work... :/
Click to expand...
Click to collapse
? I want to add code to the .c file to execute an exploit

[Work In Progress] Install Ubuntu 16.04.3 Nexus 9

DON'T FORGET TO HIT THE THANKS BUTTON
!!!DISCLAIMER!!!!
You are solely responsible for whatever shtuff happens to your device by installing either of the two files to your device.
!!!DISCLAIMER END!!!
So this still needs a lot of work but I am providing a working boot.img and root filesystem archive for all Nexus 9 variants? (not sure needs others to test and confirm).
Will be edited as things start working
What's working:
WiFi. (Must use 'nmcli dev wifi con "SSID" password "passwd" ')
GPU @ anywhere from 900-2000 FPS
Sound works just needs reconfiguring
Screen rotation works best with minimal issues as desktop taskbar widgets command to turn clockwise into landscape:
Code:
sudo xrandr -o right; sudo xinput set-prop 7 "Evdev Axis Inversion" 0, 1; sudo xinput set-prop 7 "Evdev Axes Swap" 1
&
Code:
sudo xrandr -o right; sudo xinput set-prop 7 "Evdev Axis Inversion" 0, 0; sudo xinput set-prop 7 "Evdev Axes Swap" 0
For normal portrait orientation
However DO NOT USE THE DISPLAY SETTINGS TO ROTATE IT MESSES UP THE LOGIN ROTATION AND SCREEN GOES BLACK AND SOMETIMES SHOW BACK UP IN LANDSCAPE AND WILL NOT DEFAULT BACK INTO PORTRAIT ORIENTATION. SO YOU MUST DO IT MANUALLY!!!!! See screenshot below
Swipe gestures (Chromium-browser only).
Bluetooth: WORKING!!! Install package bluetooth-touch and set this command into a shell script or enter manually the ENTIRE string:
Code:
brcm_patchram_plus --enable_hci --use_baudrate_for_download --scopcm=0,2,0,0,0,0,0,0,0,0 --baudrate 3000000 --patchram /lib/firmware/bcm4354.hcd --no2bytes --enable_lpm --tosleep=50000 /dev/ttyTHS2
Also using a Bluetooth audio sink works by itself without keyboard connected. I've found it still needs work but, connecting to a keyboard still flawless in its function file transfer locks it up when sending not receiving. Pairing and connecting are all good but functionality of Bluetooth is down to one device at a time for best results
What's not working:
Cameras (Neither front nor rear camera works at all. Needs work).
NFC? (I have no idea how to check for this. Needs work).
Probably other things I missed.
What you will need:
Any Nexus 9 with an unlocked bootloader & latest TWRP recovery installed
USB keyboard
OTG cable
Instructions:
MAKE A BACKUP! Just in case.
1.) Enter into recovery go to wipe and format Data partition as Ext4
2.) Reboot into recovery and with the boot.img and rootfs on a flash drive or, push them to device via ADB.
3.) Go to terminal command in recovery issue the commands: cd /data; mkdir linux; cd linux
4.) tar xvjf /sdcard/rootfs.tar.bz2 -C /data/linux
5.) Flash N9boot.img with install image in TWRP Install submenu.
6.) Reboot into the new Linux system.
7.) If the Kernel panics and boot loops, go back into recovery and format the data partition again it will ask are you sure type yes & repeat steps 2-4
You will need to use a USB keyboard & OTG cable to install the necessary packages and connect to WiFi/Bluetooth.
It's much easier to install on device than in a chroot environment as I have had problems in the past. And some people have different favorite Desktop Environment's. However Gnome and KDE both do not work correctly and crash.
Fluxbox, Mate, XFCE, LXDE, all work as they should with Lightdm.
If there's anything I missed you can add it below, PM me and ask, whatever and I'll try to answer as soon as I am able.
If you are interested in building the entire thing from start to finish here are the original sources
https://forum.xda-developers.com/nexus-9/general/guide-linux-nexus-9-t2985958
https://forum.xda-developers.com/nexus-9/general/guide-linux-nexus-9-t2985958/page14
And thanks to @sonicadvance1 for his original guide & @Vartom for his work on porting some of the necessary Kernel drivers. And @Vartom again for his contributions to the Bluetooth and everything else to get us this far :good::good::good::good::good::good::good::good:
Xubuntu-Desktop Preinstalled 21.5 Drivers 1GB username=ubuntu password=ubuntu
https://drive.google.com/open?id=0B8NgGANYGMhOZS1OenNzZl94bEE
rootfs base only necessary packages root password=toor
https://drive.google.com/file/d/0B8NgGANYGMhOMjVObElVVnBWamM/view?usp=drivesdk
boot.img
https://drive.google.com/open?id=0B8NgGANYGMhOZXAwZHVrUUotZ0k
In order to get the preinstalled to fix login if having issues use the command as root in virtual terminal Ctrl+Alt+F1/F2, etc
Code:
chown ubuntu:ubuntu /home/ubuntu
.
This should fix the login issues, if you want you can create a different user and remove the premade user using these commands as root in virtual terminal.
Code:
deluser username
adduser username
addgroup username adm
addgroup username sudo
Additionally if you have an error when running glxgears there is a fix
Code:
xauth list
It should output something similar to this
Code:
localhost.localdomain/unix:0 MIT-MAGIC-COOKIE-1 a4f6256398303725763c5595f404afbb
You will need to export the display and add that MIT-MAGIC-COOKIE you got from xauth list
Code:
export DISPLAY=":0"; xauth add $DISPLAY . a4f6256398303725763c5595f404afbb
This should fix the display error.
And finally,
Enjoy Ubuntu on your Nexus 9

Video of it booting
https://youtu.be/PIGm47pwzj0

Booted fine.... However a username and password would help...lol
---------- Post added at 10:30 PM ---------- Previous post was at 09:45 PM ----------
andyroidking said:
Booted fine.... However a username and password would help...lol
Click to expand...
Click to collapse
Found the root password in the other thread. toor
Now on to getting wifi up so i can get a de installed....

Reserved

andyroidking said:
Booted fine.... However a username and password would help...lol
---------- Post added at 10:30 PM ---------- Previous post was at 09:45 PM ----------
Found the root password in the other thread. toor
Now on to getting wifi up so i can get a de installed....
Click to expand...
Click to collapse
sk1tch said:
Ha! Sorry I updated the guide above to include that little tidbit of info. Sweet I'm excited to read it worked so far. Hope the guide is simple enough for everybody who wants to try it out
Click to expand...
Click to collapse
Yeah now that I got wifi working I'm off to study how to get xfce4 installed. Everyone says Arch is hard but I'll tell you their repo's are extensive. Now I have to learn about ppa's...
Also, I'm over 50 and because we have a 2048 x 1536 display everything is very tiny making all of this more of a challenge... I tried a couple things to bump the font size but they don't work....

andyroidking said:
Yeah now that I got wifi working I'm off to study how to get xfce4 installed. Everyone says Arch is hard but I'll tell you their repo's are extensive. Now I have to learn about ppa's...
Also, I'm over 50 and because we have a 2048 x 1536 display everything is very tiny making all of this more of a challenge... I tried a couple things to bump the font size but they don't work....
Click to expand...
Click to collapse
I knew you were old school. I did get Arch Linux running on the original guide but it was choppy at best and only ran in the framebuffer but this was the aarch64 version. I do think it could be done because it's my preferred distro these days as well. I think we'd have to change a few things in the CPIO init scripts.. You know point to what it needs but, that's a little too advanced for me.
Also try setting a custom dpi in the settings menu if you're using XFCE I know there's the option there
and to install it you need to uncomment all the extra repos in /etc/apt/sources.list then do apt update && apt install xubuntu-desktop
it should look like in the picture

Well, I'm stuck. X won't start... I'll have to pull the log and see what up. Unfortunately I'm back to work tonight so it will be a while before I get to play again. Don't fret, I'll be back. :silly:
Edit: Pulled logs:
As root user:
https://pastebin.com/3bJE7HkJ
As reg user:
https://pastebin.com/ZVBrCAuM
They look the same to me...

andyroidking said:
Well, I'm stuck. X won't start... I'll have to pull the log and see what up. Unfortunately I'm back to work tonight so it will be a while before I get to play again. Don't fret, I'll be back. :silly:
Edit: Pulled logs:
As root user:
https://pastebin.com/3bJE7HkJ
As reg user:
https://pastebin.com/ZVBrCAuM
They look the same to me...
Click to expand...
Click to collapse
They look identical to me as well. Um try apt install xorg xubuntu-desktop lightdm-gtk-greeter.
then reboot it should automatically enable it with systemd while installing

Error 404
The links to the downloads are no longer working.

sk1tch said:
They look identical to me as well. Um try apt install xorg xubuntu-desktop lightdm-gtk-greeter.
then reboot it should automatically enable it with systemd while installing
Click to expand...
Click to collapse
I'll give that a shot. Sounds like solid advice. Probably not until Thursday or Saturday. Busy week kids back to school
a such...

humannequin777 said:
The links to the downloads are no longer working.
Click to expand...
Click to collapse
I fixed the links but the rootfs.tar.bz2 is down as I am uploading a preinstalled image archive with the XFCE4 DE w/ onscreen keyboard, still ironing out Bluetooth made good progress so hopefully I will have that finished soon

Cameras are not included in the kernel. I did not check their performance in this kernel.

Linux Inside... Nice. Well I found a few minutes and got this far.... https://imgur.com/a/VuDEN Xauthority issue? I'll check into it later. I assume suspend doesn't work? I tried once but didn't want to crash it right now. also changed scroll bar width... easier to tap. Border width is next.
Scroll bar width:
Open the .gtkrc-2.0 file, add the following to a new line starting at the bottom of the file:
Code:
style "myscrollbar"
{
GtkScrollbar::slider-width=XX
}
class "GtkScrollbar" style "myscrollbar"

How's the performance ?
Can I use it as a desktop?

Yes indeed it does work as a desktop I got screen rotation down to two three command scripts with desktop widgets. Most things work as of now Bluetooth sucks no matter what I do but, touchscreen works fine WiFi works fine no Cameras yet Sound only through headset. Hardware acceleration works at anywhere from 800 FPS - 2000 FPS. Videos like on YouTube stutter a little if you are doing other things while watching. Swipe gestures work in Chromium browser only. (Still working on installing multifunction swipe gestures) Your best bet would be to buy one of those $11 Micro-B USB wired tablet keyboards or just use the Onboard keyboard if its already in a rugged case or whatever. Those two green arrows at the top of the desktop are my rotate widgets

andyroidking said:
Linux Inside... Nice. Well I found a few minutes and got this far.... https://imgur.com/a/VuDEN Xauthority issue? I'll check into it later. I assume suspend doesn't work? I tried once but didn't want to crash it right now. also changed scroll bar width... easier to tap. Border width is next.
Scroll bar width:
Open the .gtkrc-2.0 file, add the following to a new line starting at the bottom of the file:
Click to expand...
Click to collapse
Yes there is an .Xauthority error when I flashed it as well that was why I said it's difficult to make a working install and that it was easier to install on device but either try chown ubuntu:ubuntu /home/ubuntu as root and it may fix your issue or you have to create a new user

Vartom said:
Cameras are not included in the kernel. I did not check their performance in this kernel.
Click to expand...
Click to collapse
I added the configs for the camera to my custom config to no avail... I dont have a headset jack debug cable so I can't see what going on during boot

sk1tch said:
I added the configs for the camera to my custom config to no avail... I dont have a headset jack debug cable so I can't see what going on during boot
Click to expand...
Click to collapse
Porting the cameras was not 100% complete. Therefore, simply adding lines to the config is not enough.
---------- Post added at 02:14 PM ---------- Previous post was at 02:08 PM ----------
Porting the cameras was not 100% complete. Therefore, simply adding lines to the config is not enough.
For bluetooth work, you need to download the corresponding firmware.
with some similar string
exec /usr/sbin/brcm_patchram_plus --enable_hci --use_baudrate_for_download --scopcm=0,2,0,0,0,0,0,0,0,0 --baudrate 3000000 --patchram /lib/firmware/bcm4324.hcd --no2bytes --enable_lpm --tosleep=50000 /dev/ttyTHS2
this can be added to the nvwifibt.conf config file.

Vartom said:
Porting the cameras was not 100% complete. Therefore, simply adding lines to the config is not enough.
---------- Post added at 02:14 PM ---------- Previous post was at 02:08 PM ----------
Porting the cameras was not 100% complete. Therefore, simply adding lines to the config is not enough.
For bluetooth work, you need to download the corresponding firmware.
with some similar string
exec /usr/sbin/brcm_patchram_plus --enable_hci --use_baudrate_for_download --scopcm=0,2,0,0,0,0,0,0,0,0 --baudrate 3000000 --patchram /lib/firmware/bcm4324.hcd --no2bytes --enable_lpm --tosleep=50000 /dev/ttyTHS2
this can be added to the nvwifibt.conf config file.
Click to expand...
Click to collapse
So just add this too the sbin config file??

sk1tch said:
So just add this too the sbin config file??
Click to expand...
Click to collapse
brcm_patchram_plus this package was not found. Add it to the fast failed.

WiFi monitor mode

OK, I don't think this thread will get any attention, but I want to document it anyway. All this should work on other devices with qcom WiFi drivers.
TL;DR:
Grab iwpriv binary somewhere (i've got my here: https://github.com/kriswebdev/android_wireless_tools/tree/master/bin)
adb push iwpriv /data/local/tmp/
adb shell su -c chmod +x /data/local/tmp/iwpriv
Code:
#!/system/bin/sh
ip link set wlan0 down
sleep 1
echo 4 > /sys/module/wlan/parameters/con_mode
sleep 2
ip link set wlan0 up
/data/local/tmp/iwpriv wlan0 monitor 1
/data/local/tmp/iwpriv wlan0 MonitorModeConf 9 40 1 111 0
And enjoy your airodump output
NO PACKET INJECTION! (stubbed out in driver, removed previously?)
If you don't receive any packets, issue "/data/local/tmp/iwpriv wlan0 monitor 1" again.
How does this all work?
Some time ago I discovered these strings in wlan_hal_msg.h: (they appeared in google):
Code:
...
/* Monitor Mode */
WLAN_HAL_ENABLE_MONITOR_MODE_REQ = 302,
WLAN_HAL_ENABLE_MONITOR_MODE_RSP = 303,
WLAN_HAL_DISABLE_MONITOR_MODE_REQ = 304,
WLAN_HAL_DISABLE_MONITOR_MODE_RSP = 305,
...
Then I unscrambled some indirections:
WLAN_HAL_ENABLE_MONITOR_MODE_REQ to WDI_MON_START_REQ in WDI_2_HAL_REQ_TYPE
WDI_MON_START_REQ sent in WDI_ProcessMonStartReq <— actual message sents here!
Called from "Request Processing Array" in function WDI_MonStartReq
Wrapped in WDA_ProcessMonStartReq, which is called in WDA_McProcessMsg by message WDA_MON_START_REQ
Which message is posted by wlan_hdd_mon_postMsg if (MON_MODE_START == pMonCtx->state)
Which is called in __iw_setint_getnone with sub_cmd = WE_SET_MONITOR_STATE
Which is set by iw_priv cmd "monitor"
And then figured out that driver works in different modes:
(vos_types.h)
Code:
/// Concurrency role. These are generic IDs that identify the various roles
/// in the software system.
typedef enum
{ /*ON linux maintain 1-1 corespondence with device_mode_t in hdd*/
VOS_STA_MODE=0,
VOS_STA_SAP_MODE=1, //to support softAp mode . This is misleading. It means AP MODE only.
//The constant name has historical reason
VOS_P2P_CLIENT_MODE,
VOS_P2P_GO_MODE,
VOS_MONITOR_MODE,
VOS_FTM_MODE = 5,
VOS_IBSS_MODE,
VOS_P2P_DEVICE,
VOS_MAX_NO_OF_MODE
} tVOS_CON_MODE;
Mode can be changed by "con_mode" module parameter.
(idk why they reinvented the wheel and not used the default "iw dev wlan0 set mode monitor")
Combined all this and... got a kernel panic. You may get it too. Main reasons are:
- You have not disabled WiFi before changing the mode
- The sleep time after disabling interface is short
- Driver is old. Yes, you can get crashes on some kernels. If you are, flash AGNi.
After successful switching you'll get a working monitor (check this with tcpdump -i wlan0), but with ethernet packets instead of radiotap, so airodump will not work. Luckily, this giant crappy driver can work with radiotap, but you need to configure it. This is done by another iwpriv call:
MonitorModeConf: <channel> <bandwidth> <crccheck> <filter> <conversion_required>
Filter: 3 decimal numbers
least to most: management packets, control packets, data packets
Conversion: 1 - ARPHRD_ETHER (802.3 packets), 0 - ARPHRD_IEEE80211_RADIOTAP (802.11 packets)
(again don't know why they implemented these calls instead of default ioctl's for channel switch, etc. This makes airodump unable to switch channels)
As a result you may get something like on a screenshot
Happy sniffing!

Who said it will not be an interesting , I my self appreciated your effort to bring this up. Kudos to you friend.

Crayvolt said:
Who said it will not be an interesting , I my self appreciated your effort to bring this up. Kudos to you friend.
Click to expand...
Click to collapse
Thanks. I wanted to say that kenzo development is almost dead, we've lost official LOS and keep losing devs.... So it's most likely we'll not see working packet injection (cuz devs who know driver's internals better than me are left), and, possibly, a wrapper library implementing the default ioctl's (like channel switch) used in most programs.

i understand, hopefully we can have new devs. who will continue

This is a perfect news. At least if this device became obsolete, it should still be useful to be a portable linux pen test device, if possible. Anyway, awesome job mate. Very much appreciated
Sent from my Note 3 using XDA Labs

you dont have permission to capture on that device sokect operation not permitted

aldhi said:
This is a perfect news. At least if this device became obsolete, it should still be useful to be a portable linux pen test device, if possible. Anyway, awesome job mate. Very much appreciated
Sent from my Note 3 using XDA Labs
Click to expand...
Click to collapse
Thank you. I forgot to say that monitor mode requiers support from firmware (there's some code in driver that checks for it). Kenzo guys are lucky because we have it enabled . There's also sta+monitor mode (so you can have working wifi connection while sniffing), but it also requiers support from firmware and kenzo's fw compiled without it. I forgot how to enable it, but i think you need to issue "iwpriv wlan0 monitor 1" in default con_mode and check dmesg - there will be a string that says it's not supported (if it is not).
And if someone is interested, our wireless chip is wcn3680b, simmilar one (or same, idk) can be found in nexus 4 (mako)

cerg2010cerg2010 said:
Thank you. I forgot to say that monitor mode requiers support from firmware (there's some code in driver that checks for it). Kenzo guys are lucky because we have it enabled . There's also sta+monitor mode (so you can have working wifi connection while sniffing), but it also requiers support from firmware and kenzo's fw compiled without it. I forgot how to enable it, but i think you need to issue "iwpriv wlan0 monitor 1" in default con_mode and check dmesg - there will be a string that says it's not supported (if it is not).
And if someone is interested, our wireless chip is wcn3680b, simmilar one (or same, idk) can be found in nexus 4 (mako)
Click to expand...
Click to collapse
Can you ziping code and flashable instal on twrp?

Khimin said:
Can you ziping code and flashable instal on twrp?
Click to expand...
Click to collapse
There's nothing to install except iwpriv binary... But OK, I'll try to create a magisk module with enable/disable scripts.

cerg2010cerg2010 said:
There's nothing to install except iwpriv binary... But OK, I'll try to create a magisk module with enable/disable scripts.
Click to expand...
Click to collapse
Thx, im waiting

Khimin said:
Thx, im waiting
Click to expand...
Click to collapse
Ok, I made it quickly!
Source: https://github.com/cerg2010cerg2010/qcmon
There's 2 scripts, run them from shell:
monen - enables monitor mode (you can specify configuration in the parameters, see system/xbin/monen)
mondis - disables monitor mode. You can use your wifi connection again.

cerg2010cerg2010 said:
Ok, I made it quickly!
Source: https://github.com/cerg2010cerg2010/qcmon
There's 2 scripts, run them from shell:
monen - enables monitor mode (you can specify configuration in the parameters, see system/xbin/monen)
mondis - disables monitor mode. You can use your wifi connection again.
Click to expand...
Click to collapse
Thx dude

thank you you are awsome +thumbsup
---------- Post added at 08:49 AM ---------- Previous post was at 08:03 AM ----------
filter expresion syntax error using command tcpdump -i wlan0
help please
---------- Post added at 09:05 AM ---------- Previous post was at 08:49 AM ----------
can you help me?

cerg2010cerg2010 said:
Ok, I made it quickly!
Source: https://github.com/cerg2010cerg2010/qcmon
There's 2 scripts, run them from shell:
monen - enables monitor mode (you can specify configuration in the parameters, see system/xbin/monen)
mondis - disables monitor mode. You can use your wifi connection again.
Click to expand...
Click to collapse
Is it safe to flash with magisk in note 5 pro ?

cerg2010cerg2010 said:
Ok, I made it quickly!
Source: https://github.com/cerg2010cerg2010/qcmon
There's 2 scripts, run them from shell:
monen - enables monitor mode (you can specify configuration in the parameters, see system/xbin/monen)
mondis - disables monitor mode. You can use your wifi connection again.
Click to expand...
Click to collapse
@cerg2010 Tried to flash with magisk in note 5 pro. System apps are not working after disabling the module from magisk it returned to normal. Any solution for this ?

Perinban Parameshwaran said:
@cerg2010 Tried to flash with magisk in note 5 pro. System apps are not working after disabling the module from magisk it returned to normal. Any solution for this ?
Click to expand...
Click to collapse
Please understand that I don't have any "note 5 pro". You can send me logcat and I can try to identify the problem or ask your ROM developer to take a look (if it's not MIUI lol). Anyway, that's just scripts, so you can copy them to /data/local/tmp or /system/bin manually.

Lol I'm a n00b what does this do? Is this a packet sniffer or something?

Op_Flashpoint said:
Lol I'm a n00b what does this do? Is this a packet sniffer or something?
Click to expand...
Click to collapse
Sort of. It makes your sniffer to work - you will be able to capture raw WiFi packets from your device without any dongles.

plis whats rom u use ¿

cerg2010cerg2010 said:
Ok, I made it quickly!
Source: https://github.com/cerg2010cerg2010/qcmon
There's 2 scripts, run them from shell:
monen - enables monitor mode (you can specify configuration in the parameters, see system/xbin/monen)
mondis - disables monitor mode. You can use your wifi connection again.
Click to expand...
Click to collapse
thank you man, monitor mode now working on my poco F1, using its module magisk + aircrack-ng

Database Users

welcome