[MOD][THINKTANK] Building TaintDroid In a Galaxy S Kernel - Vibrant Android Development

A project for our Kernel devs maybe? i found this in the I9000 Forums and though i might keep it going over here in the Vibrant quadrant of XDA.
http://forum.xda-developers.com/showthread.php?t=812879
Most people don't yet know that many Android software leak all sorts of information to the internet with only scant user acknowledgement (basically what you accept when you install the app).
Due to this and the fact that there are already privacy information harvesting apps for Android on the marketplace - a team of security experts have created TaintDroid:
What is TaintDroid?
From the project's web page: "A realtime monitoring service called TaintDroid that precisely analyses how private information is obtained and released by applications "downloaded" to consumer phones."
From: http://appanalysis.org/index.html
How can I install TaintDroid?
As TaintDroid is currently compiled into the kernel, you cannot easily install it, but you have to cook your own kernel. Instructions (for Nexus 1) are available at the project web site: http://appanalysis.org/download.html
How does TaintDroid work?
Here's a video demonstrating how TaintDroid works once it is installed and configured:
http://appanalysis.org/demo/index.html
Why would you want to install this?
There can be many reasons for installint TaintDroid:
- You want to learn about privacy features and play with Android kernel
- As it is currently impossible to differentiate between innocent and sneaky Android apps based only on what access rights they request, you may want to dig in deeper
- You are worried about what apps are doing behind your back and you want to know which apps to uninstall
- You want to help create Android a more secure and privacy-protected platform, instead of the swiss cheese it currently is
What can you do?
As compiling kernels is mostly beyond the reach of mere mortals currently, consider cooking TaintDroid into your kernel, if you are cooking one yourself and offering it available for others to try and use.
Hopefully increased awareness and usage will bring this program eventually into other modders and perhaps even Google's attention and something more easily accessible is offered for the public at large.
BTW, I'm just a user, interested in getting TaintDroid on my own Galaxy S. I'm not affiliated with the research program, but I like what they are doing. This information is purely FYI.
Click to expand...
Click to collapse

Cool Idea. probably could have thought of a better name.
GrundleDroid or GoochDroid, perhaps?

Lol true but it would be a great idea to add into our kernels
Sent from my SGH-T959 using XDA App

junglizste said:
Cool Idea. probably could have thought of a better name.
GrundleDroid or GoochDroid, perhaps?
Click to expand...
Click to collapse
TaintDroid - it's just in-between ........

Related

Hi, looking for developer feedback

Hello,
My name is Isaac and I am here to find out what developers and publishers find useful as far as reviews of their mobile applications. I have just finished developing a website that totally caters smartphone applications. It is non-platform specific so if you develop for Iphone, Droid, blackberry, etc.. then your apps could be listed at the site.
What I am looking to get out of this is to find out what information developers want to get from end users the most. This way I can configure the review site so it can get the most useful information to developers. Thus giving developers the info they need to concentrate on what is more important to their target audience.
So I hope some of this interest and lets get talking, what are important questions you like to see answered in reviews
come on guys, help me out, what are things that you found most important when getting reviews of your applications?
If someone reviewed my mobile app, I'd like to know about a couple of things like:
Ease of use,
Functionality,
If usage of app can provide a longterm solution,
and/or if the user was satisfied with the app all around.
smartadmin said:
come on guys, help me out, what are things that you found most important when getting reviews of your applications?
Click to expand...
Click to collapse
Hi,
First of all before developing any application, I check the user requirement. As you know people want different type of applications. So I collect the user opinion from different places. Then I develop an application according to user requirement. After completing the application, I post my application reviews on different mobile based forums and get some feedback.
Tribulattifather said:
If someone reviewed my mobile app, I'd like to know about a couple of things like:
Ease of use,
Functionality,
If usage of app can provide a longterm solution,
and/or if the user was satisfied with the app all around.
Click to expand...
Click to collapse
Thanks, all good things to have rated to know how well your app is perceived by end users.
Michael_robert said:
Hi,
First of all before developing any application, I check the user requirement. As you know people want different type of applications. So I collect the user opinion from different places. Then I develop an application according to user requirement. After completing the application, I post my application reviews on different mobile based forums and get some feedback.
Click to expand...
Click to collapse
So basically if you have an idea for an app you then question potential users for what they would like to see and then build something from that?
Any particular questions you post on the forums that you feel gives you best info?
I always look for a decent star rating from those before me and also read through the developer description. If it seems useful I get it and worse case you just end up deleting it later. The main thing that makes an app flourish in the market is it's star rating and number of downloads.
But honestly, there are already several similar sites. I guess it will be really hard for you to build a big user base for your website. Other players are already in the market for a few years. And they are all free...
Maybe it is a better approach that the devs do not have to upload the app to you page but that you just allow the users to "request features" and you can allow them to vote for features. This could provide a feedback to the developer of the most important missing/demanded features. Maybe there is a chance to contact the developers via one of the google apis for marketplace once you have significant feedback from your users for a specific application...
SimonOnline2000 said:
But honestly, there are already several similar sites. I guess it will be really hard for you to build a big user base for your website. Other players are already in the market for a few years. And they are all free...
Maybe it is a better approach that the devs do not have to upload the app to you page but that you just allow the users to "request features" and you can allow them to vote for features. This could provide a feedback to the developer of the most important missing/demanded features. Maybe there is a chance to contact the developers via one of the google apis for marketplace once you have significant feedback from your users for a specific application...
Click to expand...
Click to collapse
Yes there are many similar sites, mostly concentrating on a particular platform though. Which to me makes no sense since a lot of developers want to make apps for different platforms . But you make a good point allow users to vote on proposed features that the developer is thinking of working on so they know what users really want and would likely buy for.

[SOURCE] KERNEL Source Released!

Well, this is sure an interesting email that I just received back from LG's support team, when asked about the kernel sources.
The rep seems to know what I'm asking for-- but for whatever reason denies my request (which is reasonable by the GPL).
Anyway, full email here:
Dear Tyler,
Thank you for inquiring of LG Electronics.
We do apologize for any inconvenience this may have caused.
We would be more than happy to provide the Kernel source which is: 2.6.32.9-PERF
[email protected] #1
Unfortunately, the source will not be released.
Please feel free to contact us if you have any additional questions or concerns. Thank you again for contacting LG Electronics.
Maya C
E-Mail Administrator
Customer Interactive Center
LGEAI
-----------Original Customer Inquiry------------
Received Date : 06/22/2011 02:03 10
The type of inquiry : Others
Product/Model No. : CDMA/LGVS910
As per the GPL, is there somewhere that I can find kernel sources for the LGVS910?
It is not on your LG Open Source page, is there an alternate location I should look?
If there is no public place to download the source, what is your timeline for releasing it?
Thank you!
Click to expand...
Click to collapse
Hmm, should I quote the GPL back to them, or try asking nicely again?
thecubed said:
Well, this is sure an interesting email that I just received back from LG's support team, when asked about the kernel sources.
The rep seems to know what I'm asking for-- but for whatever reason denies my request (which is reasonable by the GPL).
Anyway, full email here:
Hmm, should I quote the GPL back to them, or try asking nicely again?
Click to expand...
Click to collapse
Yeah, that's an invalid response if the code is GPLed.
I'm not quite sure why or how they think they can get away with that, considering the source for all their other phones is available here: http://www.lg.com/global/support/opensource/opensource.jsp
Even the tmobile g2x has it's sources posted...
What I wonder is if they're just saying that _this_ kernel's sources won't be posted.
Maybe they're embarassed? Hope not, because I demand this kernel's source!
thecubed said:
I'm not quite sure why or how they think they can get away with that, considering the source for all their other phones is available here: http://www.lg.com/global/support/opensource/opensource.jsp
Even the tmobile g2x has it's sources posted...
What I wonder is if they're just saying that _this_ kernel's sources won't be posted.
Maybe they're embarassed? Hope not, because I demand this kernel's source!
Click to expand...
Click to collapse
They may be protecting Microsoft's interests (they think) or they had a side agreement with Netflix. Either way, they can't deny a derivative work. It doesn't work that way. (at least I think? I haven't read the most recent GPL in a while...lol)
majorpay said:
They may be protecting Microsoft's interests (they think) or they had a side agreement with Netflix. Either way, they can't deny a derivative work. It doesn't work that way. (at least I think? I haven't read the most recent GPL in a while...lol)
Click to expand...
Click to collapse
As far as my understanding of the GPL, any code they modify that is released as GPL must be released as GPL also.
So, they (CodeAurora) modified Linux-2.6.32.9, which is GPL, hence they must release any modifications.
Where it gets grey is in terms of proprietary modules. However, if it's compiled into the kernel, I understand that it must also be released as source also. The only way to avoid that is to use module loading and taint the kernel, which then does some other license-protecting stuff.
Damn, the GPL is complicated.
EDIT: I'm in LG Live Chat right now asking...
thecubed said:
As far as my understanding of the GPL, any code they modify that is released as GPL must be released as GPL also.
So, they (CodeAurora) modified Linux-2.6.32.9, which is GPL, hence they must release any modifications.
Where it gets grey is in terms of proprietary modules. However, if it's compiled into the kernel, I understand that it must also be released as source also. The only way to avoid that is to use module loading and taint the kernel, which then does some other license-protecting stuff.
Damn, the GPL is complicated.
Click to expand...
Click to collapse
Yeah, it gets more so every year, and depending on what version of GPL is in use depends on what the specifics are. I'd have to say even if their module loading taints the kernel, they should be able to (read: must) release the modified source prior to the dirty side mods.
if they are anything like samsung, they will sit on it for as long as possible.
LG Chat:
Jorge: Hello Guest. Welcome to LG Electronics! How may I provide you with excellent service today?
Guest: Hello, I was wondering when the kernel sources for the LGVS910 would be posted? Specifically kernel 2.6.32.9-PERF [email protected]
Jorge: unfortunately we do not have a date
Guest: Any reasonable estimate?
Jorge: I will love to say a date but we do not have information.
Guest: Okay, thank you.
Click to expand...
Click to collapse
Well, maybe the person in the email was misinformed, or just plain ol confused...
thecubed said:
LG Chat:
Well, maybe the person in the email was misinformed, or just plain ol confused...
Click to expand...
Click to collapse
Or... the current rep is stalling? Why would there be a delay? Shouldn't the GPLed kernel be available immediately at request?
I'm going to assume it won't be too long before they release 2.3 for this phone.
majorpay said:
Or... the current rep is stalling? Why would there be a delay? Shouldn't the GPLed kernel be available immediately at request?
I'm going to assume it won't be too long before they release 2.3 for this phone.
Click to expand...
Click to collapse
Me too.
To give LG some benefit of the doubt, it is possible they just don't want to put the work into it, considering they may have something brand new around the corner.
But-- what I worry about is OTA locking down the phone.... hence my want/need for sources, just in case.
thecubed said:
Me too.
To give LG some benefit of the doubt, it is possible they just don't want to put the work into it, considering they may have something brand new around the corner.
But-- what I worry about is OTA locking down the phone.... hence my want/need for sources, just in case.
Click to expand...
Click to collapse
Yes, and I've seen 2.3 turn otherwise perfectly good phones into piles of poo, so I definitely want a way back if that happens here. Resource requirements and overall overhead seems to increase 10 fold on 2.3
Come to think of it... I just realized I should be really worried for the next OTA update...
Now, those of us with clockwork need not worry, since it just will say "invalid signature" when LG's updates try to install (since clockwork is signed with the testkeys from cyanogenmod). Once it says "invalid signature" you'd just click "reboot now" and grab the update file from /cache .
But still... the unknown is killing me!
Isn't that exactly what happend with the thunderbolt?
thecubed said:
Come to think of it... I just realized I should be really worried for the next OTA update...
Now, those of us with clockwork need not worry, since it just will say "invalid signature" when LG's updates try to install (since clockwork is signed with the testkeys from cyanogenmod). Once it says "invalid signature" you'd just click "reboot now" and grab the update file from /cache .
But still... the unknown is killing me!
Click to expand...
Click to collapse
Well, we can work on the assumption that it's never coming... because you know how Verizon is about releasing updates.
However, in the meantime LG needs to cough up the goods per legal requirement. It could all be part of a greater conspiracy, ha! Release the next batch of goods and destroy what had been previously done, THEN release the source code to the first kernel.
So in other words when we get 2.3 they'll unsuspectingly give us everything we need for custom roms and kernels once one of us extracts it from the cache...
Little Buddy Sr.
MXFrodo195 said:
So in other words when we get 2.3 they'll unsuspectingly give us everything we need for custom roms and kernels once one of us extracts it from the cache...
Little Buddy Sr.
Click to expand...
Click to collapse
Not likely... They'll release the source for 2.2 to the public when 2.3 gets pushed. We're helping them find all the holes they left in 2.2.
I guess the phones work differently. I have only experienced OTAs on the original droid. In that phone's case; once you got the OTA and the phone rebooted, it would reboot to clockwork. If you wanted to apply the OTA you just selected "Update from SD" (or something like that). If you didn't you just rebooted the phone. Now granted that it will keep on bugging you that you don't have the latest until you trick it by changing the signature (on one of the prop files I believe it was - not sure if it still works that way).
Someone please let me know what I need to say over live chat or by email ill send or talk with them. Nothing to lose and alot to gain. And several cold beverages of my choice will help. I'm just not in the know on open sorce code etc.... I want to help.
From the GPL:
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
Click to expand...
Click to collapse
As long as they hold out, they are in violation of the GPL. It should be noted, however, that they aren't the only ones in the Android world doing this. It has been the discussion hot topic for a lot of Android device manufacturers.
It could all be nothing, and they may not have "gotten around to it" yet. They have released all their previous and current works. It does question why this phone is on hold, and I'd venture to guess (but could be completely wrong) that it revolves around Microsoft protecting their digs in this machine.
The full thing is here if you want to review it...
http://www.gnu.org/licenses/gpl.html

To be rooted or not to be? [A Fundamental Question]

To be rooted or not to be? [A Fundamental Question]
I guess you already read the news at CyanogenMOD about there thoughts regarding not enabling root access by default but rather give the user the option to be aware of the risk, if he is gonna enabling it by his own decision?
As a user you also should take some minutes and rethink about data security measurements on your device. If you're only using the phone with a prepaid mobile card and don't store confidential data like passwords or credit cards numbers or even do online payments with it, then you don't have to bother with security at all. Just enjoy your phone with the newest and fanciest ROM you would like to.
But in case you're intending to use its full potential, then below is my take on this subject. Read on, if and only if you really want to know about my personnel preferences on this topic. If my post hurts your eyes, ears or mouth in anyway, then please keep them all closed and move on. I'm very sorry, if I've stolen your precious time up to this point. ... ^^
<point-of-no-return>
Stock or Custom? Stay with unmodded stock rom, if you don't need the features the cooked roms is offering you. If something goes wrong (dialer, keylogger, trojan, ...), then Samsung have to take all the blame and financial loss for you. But only, if you're really carefull yourself about third party Apps. Install only from trustworthy sources and ask yourself, if the App should really get all the permissions it is asking for. Maybe an alternative App will do the same work but beeing less demanding?
Root What? If you don't understand the consequences of root permissions, then it probably is not what you should looking for.
Opensource or Closed? Only entrust third party ROMs with opensource code. You might never take a look at it, but there are other tech savvy users/developers, who will raise the issues publicly, if there happens to be any, because they can read the source and point out the security holes and eventually fix them quickly too. Since I'm reading many questions about the PROS or CONS of unofficial and official CyanogenMODs: You should by now be able to answer this question yourself, if you're a security and privacy loving individual.
Themes or Hacks? If you're missing some features on your current phone, then reconsider to get your hands dirty and do the needed changes yourself. Or at least know howto take the supplied MODs apart and thoroughly compare the modified files with your current installed ones. There is a reason why big companies distributing files with at least a MD5 or SHA1 checksum, you know? But since ACE, GIO and the MINI (->galaxyics) are midrange devices targeting teens as consumers, security or privacy is something most of this users don't want/have to worry about. Anyway, if the changes are not applied to the executable codes (dex files) but rather considered as widely known as theming (change layout, PNGs, color or text codes), then you should be on the riskfree side to apply them without further notice. ...
Hope I could give the more concerned users some points to think about towards ROMs and MODs in general.
ToS
[x]

[REQ] Xposed Development Guide Request

Hi!
I've been exploring the Xposed Framework for quite a while. There's rich repository of modules based on the framework api.
But I feel that there is quite a dearth of learning resource for people who want to learn about it.
hamzahrmalik has a great tutorial for developing modules although the setting up part is outdated. Also there are very less example for using Helpers, common errors solving and hooking method with parameters(seriously there are loads of posts asking about hooking with parameters but none have a clear answer). Going through source codes to find answers is pain in the bum since most of them have almost no documentation.
Honestly there ought to be a better documentation for the api seeing as how very popular and awesome it is.
Yes, fully agree. I created similar topic to discuss about new project "Xposed Wiki" where we can collect docs, examples but I received no feedback. Maybe such reaction is related to actual state of Xposed at all. Basically dead, no visible (and mainly documentable) progress since August 2014.
I also gave up and built my custom Xposer Installer build with some useful features which will never be implemented in official version since Xposed dev refused it (official statement: due to poor Xposed server - I believe many people would donate some money for better one but... Everything depends on dev's (in)activity).
This project needs the big PSA about its future. Maybe my post sounds too pesimistic but I see no reasons to be optimistic at the moment.
That's it

New to the community & Android development. Please direct me in the right direction.

New to the community & Android development. Please direct me in the right direction.
Hello, I'm new to the Android community. I have prior programming experience and I have made apps through Unity and have successfully published them on the Google Play store and competing app stores. I decided that I want to write native Android apps.... so here I am.
The problem:
I want to create a very simple app. It is a simple messaging app, just like the messaging in Snapchat. It is not like other text messaging apps where you are given a number and you can text anyone you want, even if they don't have the app. That is not my goal.
1. You must have the app
2. You do not get a new number. You get to choose a new username only.
This is the goal of the app. The question is... what libraries and APIs do I have to use? Are there any good tutorials on this subject? And the most important question is, would I have to buy any servers or something? Do I have to spend any money for this to work or can this work with the user's cell connection? I don't want to purchase anything / servers. Is this possible?
I'm sorry for the lack of knowledge, but I am aiming to improve myself! Thank you very much for the read.
Hello,
Messaging infrastructure needs a server to centralize users accounts, messages and users status.
You can find low cost VPS servers, but it's not free.
Sincerely.
Here, this one mcould help u http://djangostars.com/blog/app-development-cost-android-vs-ios/ . They've gor both ios and android review, so u should read only one part)
CCliff said:
Here, this one mcould help u . They've gor both ios and android review, so u should read only one part)
Click to expand...
Click to collapse
I guess he is going to be the coder so he can skip kind of the whole article.

Categories

Resources