Hello,
I very recently had to remove the FRP lock on a client's Motorola G4 Plus because he had forgot his email and password (EXTREMELY common with old people getting smartphones). I have some experience with dirtycow, Samsung modem commands injection (using Realterm) and other bypass methods. Dirtycow was not working since this phone had security update from December 2016 so I had to use an online service with remote USB support. This service required me to enter Motorola's "Factory Mode" from the boot menu.
My question is: does anyone has experience with this special mode? Is there some literature regarding special commands, COM port settings or else when in this mode, or is everything kept private by the people who provide the service? Any basic information on what it does/how it works?
For what its worth, here's how the process went:
-Connected remotely with USB Redirector
-Booted into bootloader and activated "Factory Mode". Phone boots into OS but seems to operate in a special mode.
-Technician does something. I reboot into bootloader and boot again in factory mode.
-Technician somehow is able to enable ADB in 2nd "Factory Mode" boot. (this was not possible when I had access to Settings menu through "Talkback hack")
-Reboot again in normal mode and FRP seems to be removed. Setup has been bypassed, phone boots directly to Google Now Launcher.
What did he do? What does this "Factory mode" unlocks that permits him to enable ADB and completely bypass the Setup and Google Account verification? Did he erase the PERSIST partition? Did he inject app data from an already finished Setup?
Anyways, I am currently looking into it and will open another thread when I have more information.
Thank you!
If the technician used ADB it's likely you can Google whatever command he could have used. My guess is that he either wiped a file that concerns the Setup and Google Account Verification. Maybe he completely removed GApps remotely using ADB?
Sent from my Moto G (4) using Tapatalk
ironman38102 said:
If the technician used ADB it's likely you can Google whatever command he could have used. My guess is that he either wiped a file that concerns the Setup and Google Account Verification. Maybe he completely removed GApps remotely using ADB?
Sent from my Moto G (4) using Tapatalk
Click to expand...
Click to collapse
But these Apps are system apps, which would require ROOT to uninstall... Phone did not seemed rooted and bootloader was still locked after the procedure. I would think that finding a way of disabling the Setup/Google Services apps, and then re-enabling them, you would still be stuck when trying to add a Google Account afterwards since it will check for the PERSIST/FRP lock partition. Can the PERSIST partition be wiped through ADB without ROOT? Even then, how was ADB enabled in the first place? Some special AT command?
daveribss said:
But these Apps are system apps, which would require ROOT to uninstall... Phone did not seemed rooted and bootloader was still locked after the procedure. I would think that finding a way of disabling the Setup/Google Services apps, and then re-enabling them, you would still be stuck when trying to add a Google Account afterwards since it will check for the PERSIST/FRP lock partition. Can the PERSIST partition be wiped through ADB without ROOT? Even then, how was ADB enabled in the first place? Some special AT command?
Click to expand...
Click to collapse
Actually now that I think about it, you're right you can't remove GApps without root and you can't wipe Persist partition without root. I suppose he enabled ADB because that Factory Mode maybe has some special sort of commands, but even then what use is ADB when you don't have root?
Sent from my Moto G (4) using Tapatalk
This is the command that he uses in adb:
Code:
adb shell content insert --uri content://settings/secure --bind name:s:user_setup_complete --bind value:s:1
sachingodishela said:
This is the command that he uses in adb:
Code:
adb shell content insert --uri content://settings/secure --bind name:s:user_setup_complete --bind value:s:1
Click to expand...
Click to collapse
does anyone know the command to use in Factory Mode to enable ADB?
daveribss said:
But these Apps are system apps, which would require ROOT to uninstall... Phone did not seemed rooted and bootloader was still locked after the procedure. I would think that finding a way of disabling the Setup/Google Services apps, and then re-enabling them, you would still be stuck when trying to add a Google Account afterwards since it will check for the PERSIST/FRP lock partition. Can the PERSIST partition be wiped through ADB without ROOT? Even then, how was ADB enabled in the first place? Some special AT command?
Click to expand...
Click to collapse
Just to shed some light, adb does allow you to remove system apps or for that fact google apps without root
A tad late to the party but I'll give you a hint on the ADB enabling thing for Moto's.
Before he got ADB he probably set the device into 'factory' mode. This mode lets you send bytes to a certain TCP port via USB that sets system props. One of them is ADB enable.
There's similar tools on Youtube for repair and FRP removal like motoservice.exe
I myself reversed this years back and even found a few bytes that weren't used in the app but able to inject to change device properties.
Anyway, read this wanted to share. Motorola still has this mode, but now some devices won't let you boot factory mode.
Booting in factory mode exposes CQATest. They are using it to run shell commands, in this case to enable adb.
Related
I jumped the gun installed the original and the latest 2.1 leaks, so I am not rooted. I just recently learned how to use the ADB push feature in the tools of the Android SDK to install a custom boot animation and I'm stoked at how awesome it works.
I was wondering what all you can use the ADB push feature for on a NON-rooted Eris. Any help is greatly appreciated.
Thanks devs for all your hard work!
Adding custom boot images.
Thanks jcase! I was seriously hoping that there was there would be other things that I could use it for. Oh well, guess I'll just wait until the Official OTA 2.1 is released, then wait until you genius devs crack it open and get it rooted. Thanks again!
You can make a script to quickly install apps in mass.
#!/bin/sh
echo "Installing apps..."
./adb install apps/app1.apk
echo "app1 Installed."
./adb install apps/app2.apk
echo "app2 Installed."
./adb install apps/app3.apk
echo "app3 Installed."
./adb install apps/app4.apk
echo "app4 Installed."
./adb install apps/app5.apk
echo "app5 Installed."
echo "done"
how do i install ADB on my computer. I downloaded SDk and in the tools when i click or ADB or Emulator it opens and instantly disappears. im running windows 7.
interscion said:
how do i install ADB on my computer. I downloaded SDk and in the tools when i click or ADB or Emulator it opens and instantly disappears. im running windows 7.
Click to expand...
Click to collapse
....
EDIT: check your inbox interscion, I sent you a message in order to keep this thread uncluttered and on subject.
Android22 said:
....
EDIT: check your inbox interscion, I sent you a message in order to keep this thread uncluttered and on subject.
Click to expand...
Click to collapse
would you send me one too i have sdk setup and when i click adb a screen pops up and disapears ,,, help!! please please
trhanks
PM
Jimmie's 2.1 Eris said:
would you send me one too i have sdk setup and when i click adb a screen pops up and disapears ,,, help!! please please
trhanks
Click to expand...
Click to collapse
Sent, check your inbox...
I know this is an old thread, but I just got a replacement eris and i'm trying to avoid signing into the market before I root (for a completely clean install, probably doesn't matter, I'm just funny like that), in which case, I want to install 1-click root before I do anything. So, if someone could point me in the right direction to do an adb install on an un-rooted eris, that would be great.
demmo86rt said:
I know this is an old thread, but I just got a replacement eris and i'm trying to avoid signing into the market before I root (for a completely clean install, probably doesn't matter, I'm just funny like that), in which case, I want to install 1-click root before I do anything. So, if someone could point me in the right direction to do an adb install on an un-rooted eris, that would be great.
Click to expand...
Click to collapse
No need to bypass activation, skip account setup, Settings->Applications->Unknown sources, Settings->Applications->Development->USB Debugging.
Then this plus this:
Code:
adb install erisone010.apk
You are making unnecessary work for yourself - if you want a Nandroid backup of the factory ROM in a near virginal state, root the phone with OneClick (so that a custom recovery gets installed) - NOT including insallation of the engtools (or rootme, whatever it is called), and then perform a factory reset afterwards. (That will clear accounts & account data from the phone, and you can then boot to the recovery to make a backup of the virginal ROM).
bftb0 said:
No need to bypass activation, skip account setup, Settings->Applications->Unknown sources, Settings->Applications->Development->USB Debugging.
Then this plus this:
Code:
adb install erisone010.apk
You are making unnecessary work for yourself - if you want a Nandroid backup of the factory ROM in a near virginal state, root the phone with OneClick (so that a custom recovery gets installed) - NOT including insallation of the engtools (or rootme, whatever it is called), and then perform a factory reset afterwards. (That will clear accounts & account data from the phone, and you can then boot to the recovery to make a backup of the virginal ROM).
Click to expand...
Click to collapse
That's basically what I ended up doing (got impatient and didn't wait for a reply), except I did sign in to the market and picked up 1-click that way. Thanks for your reply though, to my question asked in an attempt to feed my OCD tendencies.
Sent from my FroyoEris using XDA App
Hi,
My kids accidentally locked the phone with a password that he cannot recall after locking it.
Now the phone is password locked. Is there any way to unlock it? I was informed by Samsung Service Center that only way is to format the phone to factory default but all data will be lost which I have pictures in the phone which has not been back up.
Any suggestion to get the phone unlock?
Unlock your phone
You can do a factory reset in the recovery, trust me, your data like photos and musics ... (external and internal memory) won't be deleted but your apps will (data apps too like saves in the games). I hope that I helped you.
Bye
playnote said:
You can do a factory reset in the recovery, trust me, your data like photos and musics ... (external and internal memory) won't be deleted but your apps will (data apps too like saves in the games). I hope that I helped you.
Bye
Click to expand...
Click to collapse
Internal memory will be wiped completely (apps, their data, settings and all files on the internal storage). External storage (microSD) will not be touched.
I have no suggestion about the password though. I am not sure about password, but PIN security does have the option to unlock via Google account if certain wrong guessing threshold is reached.
Yes you can !
I already did it after i forgot my PIN on the Lockscreen. You just need to wipe the lockscreen-options .config file with adb
Try to google this keywords
If you have USB debugging enabled its possible yes
Hook up your phone to your computer, after you've downloaded and installed the "Samsung USB Drivers for Mobile Phones.exe". Download adb.exe and call it from your command prompt/console, like this:
Code:
cd c:\adb-fastboot
adb devices
If it shows a device with a long ID attached to it, you're in luck!
If you are rooted, you can bypass the screen lock.
If you are not rooted, you can still copy your photos.
To get the photos, use the "ls" command and "adb pull" to browse through your device and copy files and pictures back to your computer. Instructions for that
You can also use "adb backup" to retrieve all files, all app data, and even apks from the phone.
If you don't have the long ID, try rebooting to recovery mode and run "adb devices" again. Otherwise try another computer.
To bypass the lockscreen, use this command:
Code:
adb shell
rm /data/system/gesture.key
If you still can't get your computer to connect (USB Debugging disabled), you're still in luck if you have a Google account linked on the phone and an Internet connection. Download this Play app to your phone from a desktop to transfer your pictures to external storage. You'll need your notification drawer accessible I believe.
So here is my situation.... I have a damaged digitizer (the component which makes touch screen work) and Samsung have said they will repair it under warranty. I have not rooted or flashed anything to this phone yet as I always wait until the warranty expires for this exact reason.
However, the technician at Sammy have told me part of the repair process is to reset the phone so I need to do a backup. Great, lets install custom recovery and make a nandroid backup of the phone and also root to use titatnium as a backup backup. Oh wait, Sammy says thats voids the warranty!! Hmmmm, what other options do I have to backup.....
I was advised to use Samsung Smart Switch to create a backup and then restore that to the restored phone. But after using this app, it only backs up the APKs of all apps then the data of a select few apps. Well thats not a backup in my eyes! For example, I have an app with an 8MB APK. The data it uses is 150MB (no cache). The app states the backup of this app is 8MB. Anyone see the pattern??
So the reason I am here is to see if the XDA community can confirm what I believe to be my only option left.
I understand you can fastboot into a TWRP recovery which means that TWRP is not installed but is run like a Linux Live CD. I assume therefore this means I can create my full nandroid backup and restore this after my phone is reset. Am I correct in thinking this? Will having this temporary TWRP trip knox or anything else which will void my warranty? Is there an issue with DMVerity by attempting to run TWRP this way?
Lastly, I have been trying to work out if my phone has a locked bootloader but I am struggling to find out if it has or not. I have the SM-G935F variant on the Three network in the UK. I have restarted my phone in recovery mode and cannot see anything which would suggest a locked bootloader. Rebooting to the bootloader just starts my phone up as normal. Does anyone have a surefire way to check for a locked bootloader?
Hope someone can help!
Helium. Doesn't need root. Backs up save data of most apps. Works in conjunction with SmartSwitch. Let SmartSwitch backup the apks and all other settings. Let Helium do the 'data only' backup.
Sent from my Galaxy S7 Edge Duos via Tapatalk
chanchan05 said:
Helium. Doesn't need root. Backs up save data of most apps. Works in conjunction with SmartSwitch. Let SmartSwitch backup the apks and all other settings. Let Helium do the 'data only' backup.
Click to expand...
Click to collapse
Thanks for your reply. I have looked in to Helium but it does not work out of the box for me. I believe this is down to the RPi using ARM architecture and the included adb is compiled for x86 / x64.
Luckily this isnt my first time with adb so I already have it installed for the RPi. So taking the script run.sh and reading in to it, I will run the commands manually and see if I can work around the included adb instead.
I will definitely be looking at koush's github to see what this com.koushikdutta.shellproxy.ShellRunner2 app is but he has a hell of alot of repos to look through!
I will update when I have more.
Well thats a fail!
Here is my update to the script to use the adb I have on my RPi (adb installed using apt-get install android-tools-adb):
Code:
pkg=$(adb shell pm path com.koushikdutta.backup)
pkg=$(echo $pkg | cut -d : -f 2 | sed s/\\r//g)
echo $pkg
adb shell << EOF
CLASSPATH=$pkg app_process /system/bin com.koushikdutta.shellproxy.ShellRunner2 [email protected] &
exit
EOF
And this is my output:
Code:
$ adb devices
List of devices attached
9885e6************ device
$ ./run.sh
/data/app/com.koushikdutta.backup-1/base.apk
CLASSPATH=/data/app/com.koushikdutta.backup-1/base.apk app_process /system/bin com.koushikdutta.shellproxy.ShellRunner2 &
exit
pp_process /system/bin com.koushikdutta.shellproxy.ShellRunner2 & <
[1] 31207
[email protected]:/ $ exit
sh: resetreason: can't execute: Permission denied
From the start I didnt understand how the app can access other app data without being rooted and the fact I'm getting permission denied seems to reinforce that. Looks like I'll be contacting the dev instead.
Don't you have a PC? Basically Helium without root simulates a connected PC, allowing app data backup. To activate the app, download the PC program and install, and install the app on the phone. Open app on phone and program on PC, plug the phone in, follow the instructions on the phone, then wait for activation.
Sent from my Galaxy S7 Edge Duos via Tapatalk
My phone is now my PC. I can cast my phone screen to my TV and use a bluetooth mouse n keyboard to do almost anything i can do on a PC
For the few things i cant do, I use a RPi and thats based on Linux. The instructions you gave is exactly what i am doing but using linux instead. The helium desktop 'app' is available on linux according to the support page (its really just a script which runs adb commands).
Since i have adb on Raspbian anyway, i just modified the script to use my built in version of adb as the bundled version is not compiled for ARM. The permission denied message is from the phone itself. So something else is going wrong. When i run the android app though it allows me to make backups but it doesnt look complete to me, much like the Smart Switch backup wasnt complete.
Fyi, i am a web developer by trade but dabble in python and c programming. I am currently writing my own android app to control my custom made home automation system using an API. Thats why i have adb preinstalled. So i am used to dealing with code to work out problems. I will liaise with the dev about the permission denied error as soon as i find the correct repo to report it in!
I've never been able to ge Helium to work reliably on my edge. Most of the time it won't work at all. Crappy unsupported software.
Unfortunately I've not found any solution that backs up everything, or even close to everything. Smart Switch will back up some, RERWARE's MyBackupPro will back up some. And those seem to be the best options out there. It's borderline criminal that Google still hasn't bothered to build a full backup solution into Android.
The Apps themselves should be set to use Google's online backup, but not all of them do. Games mostly follow. On restoring your phone, it will ask you if you want to restore from backups of your apps Google made, but that only works if the app developers were compliant with standards Google presented.
Sent from my Galaxy S7 Edge Duos via Tapatalk
Helium is working even with the permission denied error. The app runs and allows me to make backups but as ever, they dont appear to be complete. For example, as mentioned in original post, the backup only takes the 8MB APK and not the 150MB data. Its the same as Smart Switch.
As to the Google backup, you can now view these backups in the Google Drive app and only half my apps are there and again they dont look complete backups (one backup is apparently 1KB but app manager says it 12MB data).
I noticed that app manager reports data size but even this isnt accurate. If your app stores data in a folder on internal storage or sd card then this isnt counted as data. Only that in the data partition appears to count. My Torque logs are a prime example of this. 56MB of files on internal storage, app manager reporting 292KB data. No backup at all on Google Drive.
Im trying do a nandroid backup using a temporary recovery. Ive tried 'fastboot boot twrp.img' and 'fastboot boot recovery twrp.img' but neither work. Nothing is recognised with 'fastboot devices' which is concerning. I also cant use 'adb reboot bootloader' as the phone just restarts like normal. Samsung and Three have both said they dont lock the bootloader so im at a loss as what to do next :/
That's weird. Helium works for me. I wonder what's the difference.
Sent from my Galaxy S7 Edge Duos via Tapatalk
meyerweb said:
I've never been able to ge Helium to work reliably on my edge. Most of the time it won't work at all. Crappy unsupported software.
Unfortunately I've not found any solution that backs up everything, or even close to everything. Smart Switch will back up some, RERWARE's MyBackupPro will back up some. And those seem to be the best options out there. It's borderline criminal that Google still hasn't bothered to build a full backup solution into Android.
Click to expand...
Click to collapse
THIS ^^ Exactly my thoughts. Without root and TWRP / Titanium you're screwed
Need some help, got a broken note 4 here and I want to access my files that are still stored inside it. I tried the Vysor Application to see the display but the problem is I forgot the passcode of my phone because i haven't touched that phone for over a month now.
My phone is running custom Note 7 port rom (Ditto Note 7) and I have TWRP installed as a recovery option for my phone. I tried using the adb shell comand su to my phone to remove the gesture.key but it seems that I haven't accept permissions for the adb on my device.
How do I clear the passcode of my phone? or can I clear the settings and data (without internal storage) using TWRP?
Need replies ASAP please
There's probably a few dozen (at least) threads on recovering data on XDA
Did you try the forum search?
I did and amazingly this turned up very quickly
https://forum.xda-developers.com/showthread.php?t=2339530
If that doesn't nail it, try a search yourself, it's free, and easy
Another option is to go to Find my phone/android device manager website, sign in, and unlock the phone, and then connect it to PC and copy as normal....
p.s. the denied on su is most likely because you do not have apps not apps AND adb option enabled in your superuser app under developer settings
stylemessiah said:
There's probably a few dozen (at least) threads on recovering data on XDA
Did you try the forum search?
I did and amazingly this turned up very quickly
https://forum.xda-developers.com/showthread.php?t=2339530
If that doesn't nail it, try a search yourself, it's free, and easy
Another option is to go to Find my phone/android device manager website, sign in, and unlock the phone, and then connect it to PC and copy as normal....
p.s. the denied on su is most likely because you do not have apps not apps AND adb option enabled in your superuser app under developer settings
Click to expand...
Click to collapse
Okay thanks for the reply I'll try the link above
Hello
According to the forum research if i
- perform factory reset then the previously debloated apps will be reinstalled
- they can be reinstalled by adb command adb shell cmd package install-existing com.android.something without needing to factory reset.
- disabled (frozen) apps can be enabled through adb pm enable <packagename>
I have tried al three but it does not work. the commands were correctly used.
- If i perform factory reset (tried only through twrp recovery clearing cache, dalvik,data) then after initial setup the previously debloated apps are not back (i did not try factory reset through system settings yet because i dont know how it affects magisk)
Edit: only Kids mode got reinstalled. strange!
- If i use adb command adb shell cmd package install-existing com.android.something the terminal gives back that "the app was succesfully installed to user 0" but after checking the tablet the app is nowhere. I have tried it using the newest adb fastboot toolkit which has a nice terminal UI so i can reinstall all apps at once- which apps should be present on the tablet they give back "the app was succesfully installed to user 0" (they were uninstalled from user 0 so installing to user 0 should be fine) but they are not reinstalled.
- Titanium backup had accidentally frozen two apps, one is smart things, the second it android system webview- i cannot defrost them through titanium backup. I have tried several apps but none of them defrosts back. I have tried adb command pm enable <packagename> which gives me message "package succesfully enabled" but after checking state through adb pm list packages -d or tablet app setting they are still frozen.
My samsung tablet is rooted (at least i believe rooting was succesful because root checker says that) and on stock ROM.. It is strange that none of these commands are effective.
Does anybody have any clue why?
Thank you