OnePlus left a backdoor in its devices capable of root access - OnePlus 5 Guides, News, & Discussion

Just a month ago, OnePlus was caught collecting personally identifiable data from phone owners through incredibly detailed analytics. While the company eventually reversed course on the data collection, another discovery has been made in the software of OnePlus phones. One developer found an application intended for factory testing, and through some investigation and reverse-engineering, was able to obtain root access using it.
Read more Androidpolice:
http://www.androidpolice.com/2017/11/13/oneplus-left-backdoor-devices-capable-root-access/

Does anyone know if uninstalling that app via adb (without root: https://www.google.nl/amp/s/www.xda...arrier-oem-bloatware-without-root-access/amp/) will cause any problems?

swa100 said:
Does anyone know if uninstalling that app via adb (without root: https://www.google.nl/amp/s/www.xda...arrier-oem-bloatware-without-root-access/amp/) will cause any problems?
Click to expand...
Click to collapse
You can root easily using the EngineerMode APK then (after that) uninstall it! ::

I'm trying to push the su binaries, but when I try to mount /system as rw using "mount -o rw,remount,rw /system" I get the following error:
Code:
mount: '/dev/block/dm-0'->'/system': Device or resource busy
Any ideas on how to get around this? Something to do with dm-verity?
Update:
Got the system to mount using:
Code:
mount -o rw,remount -t ext4 /dev/block/dm-0 /system
But whenever I try to push the su binary, the phone reboots.
Update 2:
SuperSu is now working. See https://www.reddit.com/r/oneplus/comments/7cuu0w/gain_root_via_the_recent_backdoor/

I think it's time to switch to aosp
Sent from my Oneplus 5 using Tapatalk

Waits patiently for him to push apk out to root without rooting

Yeah,im waiting/on it since morning.I did run the adb command,it says Root successfull in engineering mode app ,but Super su says Binary not found.
And the best part it has MR ROBOT references everywhere.
The guy who found exploit has twitter account themed MrRobot.
The final best one the IRONY,the password of backdoor is 'ANGELA'
Looks like fan of series in Oneplus or Qualcomm.

I will be incredibly happy even if the only thing this allows us to do is to install adaway without having to unlock bootloader, install custom recovery and all that...

I've found the app and set "Modify system settings" to "no". Would that stop someone giving root access? [I know it can be re-enabled, just asking]
Alan

IonAphis said:
I will be incredibly happy even if the only thing this allows us to do is to install adaway without having to unlock bootloader, install custom recovery and all that...
Click to expand...
Click to collapse
i don't understand what's the matter with unlocking the bootloader n flashing a custom recovery n everything ? what's the problem with it ?

ReyTheBoss said:
i don't understand what's the matter with unlocking the bootloader n flashing a custom recovery n everything ? what's the problem with it ?
Click to expand...
Click to collapse
Reasons.

This app "Engineer mode" is present in many "chinese" phones and in mediateks phones.
Personnaly, i'm not surprised but this exploit was never expoited before...
Time to install aosp rom... OnePlus is a youg company and i think security is not a priority for them

AOSP and other open source ROMs are most secure than Oxygen, but has too much bugs and requires more time to configure it.
Isn't a good solution to all users.

bartito said:
AOSP and other open source ROMs are most secure than Oxygen, but has too much bugs and requires more time to configure it.
Isn't a good solution to all users.
Click to expand...
Click to collapse
blinkin said:
I think it's time to switch to aosp.
Click to expand...
Click to collapse
I'm going to suggest the NoLimits ROM, which is based upon OOS but no spying junk; I'm not seeing the engineering mode app in the list of apps.
https://forum.xda-developers.com/on...xxx-nolimits-1-1-speed-ram-optimized-t3627121
(Don't be lazy; push yourself to learn something new.)
It's pretty stable and has a few nice bells and whistles which make it a compelling alternative to OOS.
If you want spying junk you can't easily get rid off, stick with OOS. If you want more control and better privacy, go with a custom ROM, even one that is based on OOS.

ReyTheBoss said:
i don't understand what's the matter with unlocking the bootloader n flashing a custom recovery n everything ? what's the problem with it ?
Click to expand...
Click to collapse
Same question here, is that hard to unlock the bootloader and install a custom recovery?
The only reason that I can think is because maybe someone that don't have access to a PC

ReyTheBoss said:
i don't understand what's the matter with unlocking the bootloader n flashing a custom recovery n everything ? what's the problem with it ?
Click to expand...
Click to collapse
Unlocking bootloader wipes of our data including internal storage. And we have to take backup whole data and restore once its done which is pain in the a$$

When will the APK come out to root? Hopefully before OnePlus patches it.

pacattack81 said:
When will the APK come out to root? Hopefully before OnePlus patches it.
Click to expand...
Click to collapse
But... The reason you gained access in the first place is because the app was there. When the app goes so does your root access. No?
I am surprised that no one is commenting on the weird apparent coincidence that the password is a theme on the same movie that the discoverer of the exploit is a fan on. Emphasis on "apparent". Anyone want to bet that we soon learn that the "discoverer" is either an OP or Qualcomm employee who had a hand of putting it there in the first place?
And finally, is there any apparent downside of just deleting this thing? Or a Magisk module to disable it, just like the one that got made for the other Spyware?

NoLimits is removing EngineeringMode app (and also other related apps) if you select the agressive debloating mode on install.
I have done it this morning on my rooted O+5.
Now I delete the following apps each time that I reinstall OOS:
Code:
/system/app/AndroidPay"
/system/app/BasicDreams"
/system/app/BookmarkProvider"
/system/app/BTtestmode"
/system/app/Calculator"
/system/app/Calendar"
/system/app/CalendarGoogle"
/system/app/Chrome"
/system/app/DMAgent"
/system/app/Drive"
/system/app/Duo"
/system/app/Email"
/system/app/EngineeringMode"
/system/app/EngSpecialTest"
/system/app/ExactCalculator"
/system/app/FaceLock"
/system/app/Gmail2"
/system/app/GoogleTTS"
/system/app/GoogleWallpaperPicker"
/system/app/LatinIME"
/system/app/LatinIme"
/system/app/LatinImeGoogle"
/system/app/LiveWallpapersPicker"
/system/app/LogKitSdService"
/system/app/Maps"
/system/app/messaging"
/system/app/Music2"
/system/app/MusicFX"
/system/app/NFCTestMode"
/system/app/OemAutoTestServer"
/system/app/OEMLogKit"
/system/app/OPBackup"
/system/app/OPBugReportLite"
/system/app/OPPush"
/system/app/OPSocialNetworkHub"
/system/app/OpenWnn"
/system/app/OPLauncher_aosp"
/system/app/OPWallpaperResources"
/system/app/PartnerBookmarksProvider"
/system/app/Photos"
/system/app/PhotosOnline"
/system/app/PicoTts"
/system/app/PrintSpooler"
/system/app/SecureSampleAuthService"
/system/app/SensorTestTool"
/system/app/Stk"
/system/app/talkback"
/system/app/Videos"
/system/app/WifiRfTestApk"
/system/app/YouTube"
/system/priv-app/Eleven"
/system/priv-app/Gallery2"
/system/priv-app/H2DefaultIconPack"
/system/priv-app/H2FolioIconPack"
/system/priv-app/H2LightIconPack"
/system/priv-app/Launcher3"
/system/priv-app/Launcher3-azaidi"
/system/priv-app/OPDeviceManager"
/system/priv-app/OPDeviceManagerProvider"
/system/priv-app/OneplusCircleIconPack"
/system/priv-app/OnePlusGallery"
/system/priv-app/OneplusIconPack"
/system/priv-app/OneplusSquareIconPack"
/system/priv-app/OPMms"
/system/priv-app/Snap"
/system/etc/usb_drivers.iso"
/system/bin/bugreport*"
/system/bin/fmfactorytest*"
/system/bin/oemlogkit"
/system/bin/WifiLogger_app"
CaptShaft said:
I'm going to suggest the NoLimits ROM, which is based upon OOS but no spying junk; I'm not seeing the engineering mode app in the list of apps.
https://forum.xda-developers.com/on...xxx-nolimits-1-1-speed-ram-optimized-t3627121
(Don't be lazy; push yourself to learn something new.)
It's pretty stable and has a few nice bells and whistles which make it a compelling alternative to OOS.
If you want spying junk you can't easily get rid off, stick with OOS. If you want more control and better privacy, go with a custom ROM, even one that is based on OOS.
Click to expand...
Click to collapse

I have two question to the people who actually have some knowledge. If I gain root access via ADB and that app:
1) will I be able successfully to flash OTAs in the future?
2) will the root disappear once the next ota is applied to my phone (in case the answer for the previous question is positive)?

Related

How long till we may see the 6 rooted?

I've never owned a Nexus/Google phone, how long would you all guess it's going to take to root the Nexus 6?
Thanks! :fingers-crossed:
Kidding I hope
Pyros2008 said:
I've never owned a Nexus/Google phone, how long would you all guess it's going to take to root the Nexus 6?
Thanks! :fingers-crossed:
Click to expand...
Click to collapse
Before you even get it
Sent from my A0001 using XDA Free mobile app
Nope, the first time I rooted was a month ago, my Note 3. I take it the device can be rooted off the bat.. or there something else I am missing?
Give Chainfire a couple hours with the phone
Pretty sure the process will be similar to other Nexus devices... Fastboot oem unlock, etc, etc.
http://phandroid.com/2014/11/17/nexus-6-lollipop-root/
all hail king chainfire?
kgeissler said:
http://phandroid.com/2014/11/17/nexus-6-lollipop-root/
Click to expand...
Click to collapse
That has 6 nexus devices with root. Bit not the nexus 6.
I would make sure to wait until Google releases the factory image before rooting just in case something goes wrong
I'm pretty sure that the factory images have to be out as he has to create a modified kernel for the N6 for superuser to work on 5.0.
lordgodgeneral said:
I'm pretty sure that the factory images have to be out as he has to create a modified kernel for the N6 for superuser to work on 5.0.
Click to expand...
Click to collapse
I think he just patches the existing kernel so don't think he would need images. Think being the key word there as I don't know for sure how it works exactly.
You don't need a developer to root a nexus. Boot into the bootloader, connect to your computer, run: fastboot oem unlock, then install the recovery of your choice via fastboot (fastboot flash recovery blahxxx.img), then just flash whatever superuser you want (e.g. SuperSU)
Sent from my XT1053 using Tapatalk
bongostl said:
You don't need a developer to root a nexus. Boot into the bootloader, connect to your computer, run: fastboot oem unlock, then install the recovery of your choice via fastboot (fastboot flash recovery blahxxx.img), then just flash whatever superuser you want (e.g. SuperSU)
Sent from my XT1053 using Tapatalk
Click to expand...
Click to collapse
Sorry but this is no longer accurate. First off, there are no custom recoveries yet. Second, lollipop requires additional work arounds for root other than just flashing superuser.
akellar said:
Sorry but this is no longer accurate. First off, there are no custom recoveries yet. Second, lollipop requires additional work arounds for root other than just flashing superuser.
Click to expand...
Click to collapse
Hm? I'm running oneplus one with root on lollipop. All I had to do was just flash supersu in recovery.
Hopefully we can see a twrp on nexus 6 soon.
Sent from my A0001 using Tapatalk
zephiK said:
Hm? I'm running oneplus one with root on lollipop. All I had to do was just flash supersu in recovery.
Hopefully we can see a twrp on nexus 6 soon.
Sent from my A0001 using Tapatalk
Click to expand...
Click to collapse
It's likely not a complete build with the SELinux improvements that google made to the kernel. You need to modify the kernel on lollipop to have root so your one plus probably just has a ROM not a full image of the lollipop on it. Also as stated earlier you can't root anything without the factory image posted by google for the nexus. Then the developers can have at it. Until your happens we are just left waiting.
Pilz said:
It's likely not a complete build with the SELinux improvements that google made to the kernel. You need to modify the kernel on lollipop to have root so your one plus probably just has a ROM not a full image of the lollipop on it. Also as stated earlier you can't root anything without the factory image posted by google for the nexus. Then the developers can have at it. Until your happens we are just left waiting.
Click to expand...
Click to collapse
SELinux is currently permissive and yep its built off CM12 sources. But to answer OP's question, probably won't take too long but no ETAs.
zephiK said:
SELinux is currently permissive and yep its built off CM12 sources. But to answer OP's question, probably won't take too long but no ETAs.
Click to expand...
Click to collapse
Then that's why you can flash it in recovery. Normally you wouldn't be able to if it wasn't changed.
Chainfire said:
On LPX13D, SELinux, and root
As promised, here are some more details about the current situation.
Why it breaks
Google has really put some effort into better securing Android, and we've seen a lot of SELinux related commits to the AOSP tree over the past months. There is some disconnect between the AOSP tree and actual L preview builds, some things from AOSP are not in the L preview build, and vice versa. Ultimately, it's a pretty good bet these things will mostly align, though.
On most devices and firmwares, SuperSU's daemon is started by the install-recovery.sh service script that runs at system boot time, as user root with the init context. This is what the daemon needs to function.
Recently, they've started requiring all started services to run in their own SELinux context, instead of init. Developers and security guys following AOSP have known this was coming; AOSP builds have been logging complaints about this specific service not having its own context for a while now.
Now this script runs as root, but as the install_recovery context, which breaks SuperSU's operation, as it is a very restrictive context.
In the last AOSP build I have tried (a few weeks old), there were a fair number of other holes that we could use to launch the daemon. At first glance(!), it seems those have all been closed. An impressive feat by the guys working on this, if it proves true.
How to fix it
To fix root, all that really had to be done was ensure the daemon's startup script is run at boot as the root user with the init context.
There are multiple ways to do this, but unfortunately for now it seems that it does require a modified kernel package (changing the ramdisk).
In the modified kernel packages I've posted for the Nexus 5 and Nexus 7, the daemon's startup is fixed by commenting out the line in init.rc that forces the install-recovery.sh script to run as the install_recovery context, so now it runs as init again, and all is well.
Repercussions
As stated above, it seems for now that modifications to the kernel package are required to have root, we cannot attain it with only modifications to the system partition.
Combine that with a locked bootloader (and optionally dm-verity) and a device becomes nigh unrootable - exactly as intended by the security guys.
Exploit-based roots are already harder to do thanks to SELinux, and now because of the kernel requirements for persistent root, these exploits will need to be run at every boot. Exploits that make the system unstable (as many do) are thus out as well.
Of course, this is all dependent on OEMs implementing everything exactly right. If a certain OEM doesn't protect one of their services correctly, then we can leverage that to launch the daemon without kernel modifications. While I'm fairly certain this will be the case for a bunch of devices and firmwares, especially the earlier L firmwares, this is not something you should expect or base decisions on. It is now thus more important than ever to buy unlocked devices if you want root.
It might also mean that every firmware update will require re-rooting, and OTA survival mode will be broken. For many (but far from all) devices we can probably automate patching the kernel package right in the SuperSU installer ZIP. We can try to keep it relatively easy, but updating stock firmwares while maintaining root is probably not going to work as easy and fast as it did until now.
Apps need updates
Unsurprisingly, with a new major Android release, apps will need updates. None more so than apps that go beyond the Android API, as root apps do, but even some non-root apps will be affected by the security changes.
As one example, someone posted in the SuperSU thread of a kernel flashing app that didn't work. From the logcat you could see that it was looking for partitions in /dev/block from its normal non-root user and non-init context. That used to be possible, but now it is restricted: normal apps no longer have read access there.
The solution for that app is actually quite simple: list the /dev/block contents using root instead. But simple solution or not, the app will still need to be updated.
By far most root apps should be updateable for L without too much issue. There are indeed exceptions that will need some special care, but those are rare.
Permissive vs enforcing
The kernel packages I posted for the Nexus 5 and 7 LPX13D firmware keep SELinux mostly set to enforcing. I say mostly, because SuperSU actually switches a small part of the system to permissive, so apps calling su can do most things without much interference. The details on this are lengthy (yes, your apps will be able to modify policies as well if needed, which should be rare), and I will document these for other developers after L retail release, assuming it will all still work at that time.
Alternatively, you can set the whole system to permissive or otherwise disable SELinux. There are other kernel packages released that indeed do this. The advantage here is that it instantly fixes some apps' issues, as the SELinux based restrictions have all gone the way of the dodo. The disadvantage here is that you've just shut down a major part of the security system of the device.
Some would argue that a device with an unlocked bootloader, root, encrypted modem firmwares of which nobody really knows what they're doing, etc, is inherently insecure, and thus disabling SELinux doesn't make much difference.
I personally disagree with this. While I do agree that these things weaken security down from the ideal level, I would still not disable more security features than I absolutely need to. Just because you cannot eliminate all attack vectors, is no reason to just completely give up on defending against them.
It is of course your own choice if you want to run a permissive system or not. I will strive to keep everything working in enforcing mode though, and I hope other root app developers will do the same - as stated earlier in the post, I believe this is still possible.
(everything in this post is subject to change for retail L release, obviously)
Click to expand...
Click to collapse
https://plus.google.com/+Chainfire/posts/VxjfYJnZAXP
http://www.xda-developers.com/android/supersu-beta-2-23-lollipop/
Pilz said:
Then that's why you can flash it in recovery. Normally you wouldn't be able to if it wasn't changed.
Click to expand...
Click to collapse
Good news everyone, starting one of the upcoming SuperSU updates, modified kernels will no longer be needed for root on Android 5.0 ... !
Click to expand...
Click to collapse
https://twitter.com/ChainfireXDA/status/535253476021116928

Stock recovery and upgrading Lollipop with future OTAs after rooting

Hello everyone,
I'm back to a nexus 6 after a very short stint with a 6+.
A little background for my questions: This is the very first time that I rooted a phone. I'm rooting to only install these 3 apps:
adaway
titanium backup
greenify
I do not plan on using any custom ROMs or kernels.
I see from all the guides and tutorials that people also create a custom recovery whenever they root. I haven't done that yet and wasn't sure if I had to. I would like to maintain the stock recovery that I have currently so that I can go back to stock if I unRoot. My questions are:
1. Am I wrong in thinking that I can still use the stock recovery if I unRoot?
2. When a new OTA comes out and I flash it (since I'm rooted an no longer can install them automatically), will that also upgrade my still stock recovery properly?
3. Following up on the previous question, when I upgrade manually because I'm rooted, would that be a fresh install where I have to go in and configure things the way I like them again (system settings, apps and their settings, root the phone again, etc)?
Thanks in advance!
LordGrahf said:
Hello everyone,
I'm back to a nexus 6 after a very short stint with a 6+.
A little background for my questions: This is the very first time that I rooted a phone. I'm rooting to only install these 3 apps:
adaway
titanium backup
greenify
I do not plan on using any custom ROMs or kernels.
I see from all the guides and tutorials that people also create a custom recovery whenever they root. I haven't done that yet and wasn't sure if I had to. I would like to maintain the stock recovery that I have currently so that I can go back to stock if I unRoot. My questions are:
1. Am I wrong in thinking that I can still use the stock recovery if I unRoot?
2. When a new OTA comes out and I flash it (since I'm rooted an no longer can install them automatically), will that also upgrade my still stock recovery properly?
3. Following up on the previous question, when I upgrade manually because I'm rooted, would that be a fresh install where I have to go in and configure things the way I like them again (system settings, apps and their settings, root the phone again, etc)?
Thanks in advance!
Click to expand...
Click to collapse
1. No, you're not wrong. Recovery will stay stock and can be used normally
2. You can't simply flash the new OTA. This will not work manually nor automatically.
3. All you need to do is not flash the user data image and you will not loose your data, settings etc. You will loose root however. See bellow.
Google posts android stock images for each device typically before OTA hits your phone. That's what you want to grab and use for the update. Just make sure you don't run the automatic scripts that come with those images because you need to avoid flashing user data image.
OTA zip file does you no good unless you get your system back to unmodified stock.
Thank you sir!
obsanity said:
1. No, you're not wrong. Recovery will stay stock and can be used normally
2. You can't simply flash the new OTA. This will not work manually nor automatically.
3. All you need to do is not flash the user data image and you will not loose your data, settings etc. You will loose root however. See bellow.
Google posts android stock images for each device typically before OTA hits your phone. That's what you want to grab and use for the update. Just make sure you don't run the automatic scripts that come with those images because you need to avoid flashing user data image.
OTA zip file does you no good unless you get your system back to unmodified stock.
Click to expand...
Click to collapse
Based on the OP, it sounds like he has only rooted. Thus, the OTA will work fine. No need to flash image files.
Edit: I see that at least one other member has stated that an unroot still did not allow OTAs to function. That's a bit strange and unique. Not sure what root is modifying to prevent the OTA.
I'm kinda curious myself. I had no idea root killed OTA's. Maybe I wouldn't have done that if I knew that. I'm very new to the Nexus device. It's my 1st. I unlocked the bootloader and rooted already.
Sent from Mark's Nexus 6
crowbarman said:
Edit: I see that at least one other member has stated that an unroot still did not allow OTAs to function. That's a bit strange and unique. Not sure what root is modifying to prevent the OTA.
Click to expand...
Click to collapse
This is pretty scary. So you can unroot and GI back to stock and still can't update in anyway?
I have always side-loaded OTAs, I have never flashed anything.
After installing an OTA, on the next reboot, Android takes some time to optimize all your apps. Does this also happen after flashing a new system image? Thanks!
LordGrahf said:
This is pretty scary. So you can unroot and GI back to stock and still can't update in anyway?
Click to expand...
Click to collapse
not sure what you mean by GI, but according to some others, after uninstalling root via SuperSU an OTA will still not install. This should not be the case unless the boot or recovery images are modified. Easily fixed by following the procedures above to fastboot the stock images on your phone.
kjnangre said:
I have always side-loaded OTAs, I have never flashed anything.
After installing an OTA, on the next reboot, Android takes some time to optimize all your apps. Does this also happen after flashing a new system image? Thanks!
Click to expand...
Click to collapse
Yes, it behaves exactly the same.
crowbarman said:
Based on the OP, it sounds like he has only rooted. Thus, the OTA will work fine. No need to flash image files.
Edit: I see that at least one other member has stated that an unroot still did not allow OTAs to function. That's a bit strange and unique. Not sure what root is modifying to prevent the OTA.
Click to expand...
Click to collapse
Root on Lollipop is not what it used to be. There are files that need to be modified in order to allow root. That's why this time OTA will fail if you are rooted.
Un-rooting however, will allow OTA as long as it is done properly and all traces are covered up and returned to stock. If it does fail after you have un-rooted, go back to the developer of that un-root method and let the know they missed something.
Here is the best way to un-root. Flash all of the old stock images besides user data image.
obsanity said:
Root on Lollipop is not what it used to be. There are files that need to be modified in order to allow root. That's why this time OTA will fail if you are rooted.
Un-rooting however, will allow OTA as long as it is done properly and all traces are covered up and returned to stock. If it does fail after you have un-rooted, go back to the developer of that un-root method and let the know they missed something.
Here is the best way to un-root. Flash all of the old stock images besides user data image.
Click to expand...
Click to collapse
That makes sense. Is there a manual root procedure or list of required modifications for root out there? I did some precursors searches but Came up empty. Can't tell what's missing in SuperSU unroot without those details.
crowbarman said:
That makes sense. Is there a manual root procedure or list of required modifications for root out there? I did some precursors searches but Came up empty. Can't tell what's missing in SuperSU unroot without those details.
Click to expand...
Click to collapse
Explanation from Chainfire:
https://plus.google.com/113517319477420052449/posts/S5zoKTzKUW1
obsanity said:
Explanation from Chainfire:
https://plus.google.com/113517319477420052449/posts/S5zoKTzKUW1
Click to expand...
Click to collapse
Thanks for this. A good read, but I'm surprised nobody has demanded more details than 'patched the policies in SELinux'. Not that I don't trust Chain fire (I do) , but who really knows what has been done to our phones?
crowbarman said:
Thanks for this. A good read, but I'm surprised nobody has demanded more details than 'patched the policies in SELinux'. Not that I don't trust Chain fire (I do) , but who really knows what has been done to our phones?
Click to expand...
Click to collapse
That's the problem with Chainfire's work... he does not release source.
Again, best un-root method is to flash original images less user data.
obsanity said:
That's the problem with Chainfire's work... he does not release source.
Again, best un-root method is to flash original images less user data.
Click to expand...
Click to collapse
Thanks for sharing this info. Its a bit concerning tbh. Is there a cleaner way to root other than using superSU?
LordGrahf said:
Thanks for sharing this info. Its a bit concerning tbh. Is there a cleaner way to root other than using superSU?
Click to expand...
Click to collapse
I'm afraid not but Chainfire's is probably the cleanest possible. Koush was the one with an open source solution but he hasn't updated his to 5.0 yet.
obsanity said:
I'm afraid not but Chainfire's is probably the cleanest possible. Koush was the one with an open source solution but he hasn't updated his to 5.0 yet.
Click to expand...
Click to collapse
There is an argument that publishing the method would allow Google to close it that much quicker, I suppose.
crowbarman said:
Thanks for this. A good read, but I'm surprised nobody has demanded more details than 'patched the policies in SELinux'. Not that I don't trust Chain fire (I do) , but who really knows what has been done to our phones?
Click to expand...
Click to collapse
The base changes and reasoning for those changes are actually documented on my website. Specific policy adjustments are present in plain text in the supolicy executable, as any hex editor will show you. Those who really wanted to know rather than whine about OSS, know.
By far most policy adjustments just drop audit log output for contexts that are already permissive, though.
All that information is still completely useless unless you understand SELinux in detail and how it's implemented on Android, though.
I assume that the encryption doesn't get in the way of being able to flash the images?
When I went from 5.0 to 5.0.1 on my old Nexus 5 all I did was flash the two new 5.0.1 images I extracted from the full factory image, then re-rooted. This is far cleaner than reverting back to the previous image then doing an OTA. I've not had to update my N6 yet so I don't know if my method will work still, but I hope it does.
Chainfire said:
The base changes and reasoning for those changes are actually documented on my website. Specific policy adjustments are present in plain text in the supolicy executable, as any hex editor will show you. Those who really wanted to know rather than whine about OSS, know.
By far most policy adjustments just drop audit log output for contexts that are already permissive, though.
All that information is still completely useless unless you understand SELinux in detail and how it's implemented on Android, though.
Click to expand...
Click to collapse
Thanks for the additional information.
I did spend a fair amount of time reading your documentation but failed to utilize a hex editor. I am not 'whining' about the lack of open source, rather, simply mildly surprised, but your website aptly describes the challenges with 5.0. Many are used to various root methods being available.
Your solution is fine with me.. I love your work.
Edit: I thought I'd add that the discussion has devolved from the OP, which was whether an OTA can be applied after uninstalling root. The answer was no, due to the unknowns about what still might be modified following the uninstall via SuperSU.

SuperSU and SafetyNet / Android Pay

This is the place to discuss anything and everything related to SuperSU and SafetyNet / Android Pay.
To clarify, I am not currently actively doing any development on having SuperSU pass SafetyNet detection, or having Android Pay work; the same way I put no effort into beating other root detection methods such as various enterprise security tools.
In case any SuperSU-rooted device passes SafetyNet, that is a bug in SafetyNet, not a feature of SuperSU.
While I may not agree with Google's stance, I'm not about to go messing with payment systems. Is it possible though? Probably yes.
This thread has been created because you guys simply cannot stop talking about this, so these posts can now go here, where I don't ever have to see them.
Will v2.50 cause Android Pay not to work in 6.0? If so, I am guessing there is no way around it?
0.0 said:
Will v2.50 cause Android Pay not to work in 6.0? If so, I am guessing there is no way around it?
Click to expand...
Click to collapse
Root is a no no with android pay and I think custom ROMs are also out at the moment
Sent from my A0001 using Tapatalk
Pure Drive GT said:
Hey, thanks for your continued support for root on Android, was just wondering, is google making it harder to achieve decent root privileges, as in they don't want rooted devices or are they just unrelatedly changing up things which forces you guys to adapt?
On another note, is there any progress on root without the modded boot? This is by no means an ETA, just wanted to know if you think it's possible or the situation looks rather dire.
Thanks again for your many efforts!
Click to expand...
Click to collapse
Well, just look at Android Pay, it will not allow one to add a credit card if it detects the device is rooted. So yeah, Google definitely wants to stop root, or at least make sure there is a strong dissuasion towards same. It's not a bad thing persae, as Google is just making the devices more secure for the masses. We 'power users' are lucky to have those such as Chainfire working so hard to get us what they can.
mdamaged said:
Well, just look at Android Pay, it will not allow one to add a credit card if it detects the device is rooted. So yeah, Google definitely wants to stop root, or at least make sure there is a strong dissuasion towards same. It's not a bad thing persae, as Google is just making the devices more secure for the masses. We 'power users' are lucky to have those such as Chainfire working so hard to get us what they can.
Click to expand...
Click to collapse
Many banking and financial apps restrict access on rooted devices; it's not just Google.
It makes sense in some ways: root access allows running things in the background to either circumvent, monitor, or interrupt program transactions. They're being paranoid, and I don't blame them.
I don't like the Google Pay concept (or Apple's either); like every other encryption or security system, it's destined to eventually be hacked.
mdamaged said:
Well, just look at Android Pay, it will not allow one to add a credit card if it detects the device is rooted. So yeah, Google definitely wants to stop root, or at least make sure there is a strong dissuasion towards same. It's not a bad thing persae, as Google is just making the devices more secure for the masses. We 'power users' are lucky to have those such as Chainfire working so hard to get us what they can.
Click to expand...
Click to collapse
Yep, I was able to add my debit card but not credit.
VZW LG G4
mdamaged said:
Well, just look at Android Pay, it will not allow one to add a credit card if it detects the device is rooted. So yeah, Google definitely wants to stop root, or at least make sure there is a strong dissuasion towards same. It's not a bad thing persae, as Google is just making the devices more secure for the masses. We 'power users' are lucky to have those such as Chainfire working so hard to get us what they can.
Click to expand...
Click to collapse
http://www.androidpolice.com/2015/0...hy-android-pay-doesnt-support-rooted-devices/
shaggyskunk said:
Yet the Note 5 has been rooted for at least a couple of weeks
Click to expand...
Click to collapse
On Lollipop... And you also have to unlock your bootloader to do that, right? If yes, then you will trip the KNOX, and that mean you will loose some of your device functionality (Samsung Pay for example), without option to take it back. On the Nexus on the other hand, when you want to use Android Pay on Nexus, you can restore your phone to completely stock condition, without any trace of previously used root.
Also, all of this is completely irrelevant to carried device users, since they have a locked bootloaders.
Srandista said:
On Lollipop... And you also have to unlock your bootloader to do that, right? If yes, then you will trip the KNOX, and that mean you will loose some of your device functionality (Samsung Pay for example), without option to take it back. On the Nexus on the other hand, when you want to use Android Pay on Nexus, you can restore your phone to completely stock condition, without any trace of previously used root.
Also, all of this is completely irrelevant to carried device users, since they have a locked bootloaders.
Click to expand...
Click to collapse
I believe that it's only at&t and Verizon that locks the bootloader - And none in Canada and many other Countries.
Sent From my SM-N910W8 Running SlimRemix V5.1
Had an interesting event, on 2.52.
I unchecked "Enable Superuser" in Settings, to attempt to use Android Pay (Android Pay still wouldn't work). Then, when I rechecked "Enable Superuser", the re-installation of the binary failed, and I was prompted to reboot to try again. However, then I got a boot loop (never even got the opportunity to enter my encryption code). The only way I was able to boot was to re-flash the modified boot.img and re-install SuperSU from the zip (no idea whether both steps were necessary).
I have a Marshmallow Nexus 6, encrypted. For what it's worth, I was previously rooted on 5.1.1, and, after updating to 6.0 and until I re-rooted, I always got a "Your device is corrupt" message on startup, despite being all stock.
NYZack said:
Had an interesting event, on 2.52.
I unchecked "Enable Superuser" in Settings, to attempt to use Android Pay (Android Pay still wouldn't work). Then, when I rechecked "Enable Superuser", the re-installation of the binary failed, and I was prompted to reboot to try again. However, then I got a boot loop (never even got the opportunity to enter my encryption code). The only way I was able to boot was to re-flash the modified boot.img and re-install SuperSU from the zip (no idea whether both steps were necessary).
I have a Marshmallow Nexus 6, encrypted. For what it's worth, I was previously rooted on 5.1.1, and, after updating to 6.0 and until I re-rooted, I always got a "Your device is corrupt" message on startup, despite being all stock.
Click to expand...
Click to collapse
Root doesn't have to be enabled for pay to fail. Any time the system partition is modified pay will not work. There was an xda news article on it. A quick Google search involving Android pay and root should find it.
Lrs121 said:
Root doesn't have to be enabled for pay to fail. Any time the system partition is modified pay will not work. There was an xda news article on it. A quick Google search involving Android pay and root should find it.
Click to expand...
Click to collapse
I also found that having an unlocked bootloader will stop Pay working. When MM released I decided to go fully back to stock but kept the bootloader unlocked so I could flash MM. Pay still failed, so I've given up and gone rooted again.
Sent from my Nexus 6 using Tapatalk
Ch3vr0n said:
@Chainfire if you actually are able to pull off fully working stable root WITHOUT modifying the /system does that mean you MIGHT have opened the door into having root AND still being able to get OTA's?
Click to expand...
Click to collapse
osm0sis said:
Yup, all you'd need to do is reflash stock kernel to pass the boot partition EMMC check, or, we could automate restoring the previous stock kernel, flashing the OTA and then injecting the new stock kernel with root after flashing (à la AnyKernel2 or MultiROM). So many exciting possibilities there where custom recoveries are concerned.
Click to expand...
Click to collapse
Chainfire said:
Honestly it's not so different from using FlashFire to flash re-flash system, then OTA, then re-root. But it is easier, yes.
Click to expand...
Click to collapse
This is indeed exciting. However, I noticed that @Chainfire posted this downside on Google+ :
Andrew Morykin 12:24
This should retain Android Pay, right?
Click to expand...
Click to collapse
Chainfire 12:58
+Andrew Morykin if it does, then it's by accident and not by design, and Android Pay will be updated to block it.
Click to expand...
Click to collapse
https://plus.google.com/+Chainfire/posts/aJbqUZ8PEP4
also, I was confused by this:
Chainfire said:
- I have not tested with encrypted devices
Click to expand...
Click to collapse
http://forum.xda-developers.com/showpost.php?p=63197935
Aren't
Nexus 6P / angler
angler-mdb08k-boot-systemless.zip
Click to expand...
Click to collapse
and
Nexus 5X / bullhead
bullhead-mdb08i-boot-systemless.zip
Click to expand...
Click to collapse
encrypted out of the box?
dabotsonline said:
This is indeed exciting. However, I noticed that @Chainfire posted this downside on Google+ :
Click to expand...
Click to collapse
How is that a downside?
It's exactly the same with every other form of root you will ever see. They don't want to support Android Pay (and some other stuff) on rooted devices. If we find a root that allows it, they will update their system to detect and block it. That cat and mouse game will not end as long as Google doesn't want Android Pay on rooted devices.
Maybe someone will make apps/modules that help circumvent this, but it certainly will not be me.
also, I was confused by this:
Aren't
Nexus 6P / angler
and
Nexus 5X / bullhead
encrypted out of the box?
Click to expand...
Click to collapse
Still can't test what I don't have.
russlowe73 said:
Factory images
Click to expand...
Click to collapse
So basically I have to go back to 100% stock using ADB, and then flash the new SuperSU stuff with any custom ROM? If so, what are the benefits of this other than getting Android Pay while rooted?
I'm not sure if anyone has specifically mentioned this, but Android Pay still works with this form of root on the Nexus 6!!
efrant said:
Starting with Android 5.0, OTA updates are now block-based rather than file-based, so any modification to the system partition will cause the OTA to fail, even mounting the system partition as r/w.
Click to expand...
Click to collapse
Just to add to this, it's a whole-partition /system patch OTA if the device launched with Lollipop or later, anything that launched with KitKat is still receiving the old file-based patch OTAs. Modifying Settings.apk would likely trip either method for a lot of OTAs though, since it's a pretty central component.
galaxyuserx said:
I use Galaxy s6 G9200 HK with Kernel compiled by me, but i have problem with root 5.1.1 and i think in future too 6.0
These root method is integrated in kernel source or i can integrate with those "boot.img systemless" my selfcompiled kernel?(repack boot.img with kernel compiled by me)
Is possible to work this new root method to android 5.1.1?
I have problem with gain root when i use kernel compiled by me ( STOCK kernel have too this problem BOOTLOOPs and FREEZEs on boot system) and i don't know how slove it :/
I found on chineese forums root integrated in boot.img it working good and isn't comunicat "KERNEL is not SEandroid enforced" but when i try integrate my kernel with this boot.img error with boot system :/
Click to expand...
Click to collapse
Yup, it's all ramdisk changes so should be workable on any version of Android. Chainfire left instructions outlining the ramdisk changes in the WIP thread if you want to give it a try.
phishfi said:
I'm not sure if anyone has specifically mentioned this, but Android Pay still works with this form of on the Nexus 6!!
Click to expand...
Click to collapse
Yup, seems to be the case with most banking and root-detecting apps... for now.
Can someone with the non-system SU use this app: https://play.google.com/store/apps/details?id=com.cigital.safetynetplayground and post the results?
This app is supposed to do the SafetyNet checks cleanly, the same way Android Pay does them.
Would be interesting to see if it succeeds on devices with this new supersu version.
secguy said:
Can someone with the non-system SU use this app: https://play.google.com/store/apps/details?id=com.cigital.safetynetplayground and post the results?
This app is supposed to do the SafetyNet checks cleanly, the same way Android Pay does them.
Would be interesting to see if it succeeds on devices with this new supersu version.
Click to expand...
Click to collapse
Just ran it and it passed.
Went ahead and installed su on a stock nexus 5, so far working well, android pay does not work but that was me being stupid and changing the host file and dpi before setting it up
I do notice a little input lag after this, not enough to even make me consider removing root, but it is noticeable, anybody else with this?

root

Hi,
How do I just root my OnePlus 3T? I want to keep everything the same but just be able to have root to install adblock.
Model - A3000
Oxygen - 4.0.3
Android - 7.0
Rob94 said:
Hi,
How do I just root my OnePlus 3T? I want to keep everything the same but just be able to have root to install adblock.
Model - A3000
Oxygen - 4.0.3
Android - 7.0
Click to expand...
Click to collapse
Unlock your boot loader, flash twrp and install supersu to root. or you can also try dns66 to block ads, it works without root.
https://fossdroid.com/a/dns66.html
bonham1988 said:
Unlock your boot loader, flash twrp and install supersu to root. or you can also try dns66 to block ads, it works without root.
https://fossdroid.com/a/dns66.html
Click to expand...
Click to collapse
I'm new to android, switched from ios. I'm not familiar with the terms, how would you do these? "Unlock your boot loader, flash twrp and install supersu to root."
Rob94 said:
I'm new to android, switched from ios. I'm not familiar with the terms, how would you do these? "Unlock your boot loader, flash twrp and install supersu to root."
Click to expand...
Click to collapse
here a guide https://forum.xda-developers.com/oneplus-3t/how-to/guide-how-to-root-oneplus-3t-unlock-t3544391
but if you just want Adblock, I'd suggest you try dns66 instead of root.
bonham1988 said:
here a guide https://forum.xda-developers.com/oneplus-3t/how-to/guide-how-to-root-oneplus-3t-unlock-t3544391
but if you just want Adblock, I'd suggest you try dns66 instead of root.
Click to expand...
Click to collapse
I installed the adb program but where are the files? I'm stuck on this step 2:30 in the video.
Rob94 said:
I installed the adb program but where are the files? I'm stuck on this step 2:30 in the video.
Click to expand...
Click to collapse
What files?
Sent from my OnePlus3T using XDA Labs
bonham1988 said:
What files?
Sent from my OnePlus3T using XDA Labs
Click to expand...
Click to collapse
I got past that part but now im stuck. I'm trying to install supersu but my computer isn't finding the oneplus 3t in my computer so I can't drag supersu to my phone to install it.
Part 8:47
https://www.youtube.com/watch?v=wwd31NU7VC0&feature=youtu.be
Everytime I plug in my phone I see this in device manager. Even though I install the ADB.
site to upload photos
I got it to work, just had to manually install MTP driver.
Could you help me find a guide for adblock install and in-app purchases?
Rob94 said:
Could you help me find a guide for adblock install and in-app purchases?
Click to expand...
Click to collapse
Google "AdAway XDA". The first result is the thread for the AdAway app.
And what do you mean in-app purchases? You install an app from the Play Store, tap the in-app button, add your gift card and/or credit/debit card (if required), buy.
If you're talking about circumvention, you are NOT going to get help here, AT ALL. This is not one of those places for that mess.
Rob94 said:
Could you help me find a guide for adblock install and in-app purchases?
Click to expand...
Click to collapse
Ad block you don't need any guide. Just install the apk from f-droid. When you'll open the app it will prompt you to grant root access. Just click yes and you have to enable adblock from the app.
Sent from my OnePlus3T using XDA Labs
Rob94 said:
I'm new to android, switched from ios. I'm not familiar with the terms, how would you do these? "Unlock your boot loader, flash twrp and install supersu to root."
Click to expand...
Click to collapse
I know you are new here, and here is some friendly advice:
1) Search before you post! Most of the info you want, and probably ever want, is already on XDA. It's probably been asked and answered before, probably numerous times. There are a number of guides posted for basic things, like how to root. Just using the search function, or for that matter just browsing through the thread titles will often yield a lot of the info you are looking for. Also, there are resource threads like the Index at the top of the 3T "Guides, News & Discussion" section, which organizes a lot of the useful threads and other resources (with links). Be sure to take advantage of these threads "sticky" to the top of each section.
Only after you have done your due diligence, and can't find what you're looking for, should you make a new thread. If every person who was wondering "how to root" made a new thread asking that, this whole website would quickly become a cluttered, useless mess. The folks here are happy to provide help and try to answer your questions, but only after you've taken at least a little time to try to find the answer yourself.
2) You need to slow down and do some learning and reading. This is something you should have done before starting to do any of the steps toward root. Halfway down the phone modding rabbit hole is not the time to be asking questions like "how do I put the SuperSU zip on the phone".
I've been around here a long time, and modded/rooted a lot of devices. Even so, every time I get a new device, I spend at least an hour or two reading about the root methods (plus possible pitfalls, issues, etc.) for that specific device (as every one has it's own peculiarities and nuances). I simply can't fathom jumping into the root/mod process without this minimum due diligence.
3) Make sure you understand the meaning and implications of an unlocked bootloader, root, etc. There are benefits, and there are also risks. When someone comes on here asking the questions you are asking, what often comes to mind is that a person with that lack of knowledge has no business having root. This isn't to be mean, it's just a fact (at least as I see it).
Side note: I'm not a fan of YouTube guides. They have a place, in conjunction with (but not a replacement for) proper reading and understanding. Just following one of those videos, without doing any other learning, is going to get you in trouble. You'll only know enough to get yourself into a jam (which is inevitable if you play with these devices), without a clue of how to get out. Know (at a minimum) how to recover or get back to stock. Case in point, the linked video skipped what is to me, a critical step. You should always make a TWRP backup before flashing any mods like root or custom ROM. It's not technically a "requirement" but to me, its a must. This gives you an easy way out, if anything goes wrong (and it eventually will). Sure, there are other ways to recover. But the simple step of making a TWRP backup is one way, that doesn't require any additional downloads, tools, etc. It's simply a no-brainer to me, to do this.

Question Hide status bar time clock?

Anybody know how to hide status bar time? In previous android versions,there used to be an option to hide clock but can't find on android 12. BTW, unrooted OnePlus 10 Pro global edition. Thanks
You can use system UI for that
You can use system UI for that
dladz said:
You can use system UI for that
Click to expand...
Click to collapse
I tried to use it but was unable to provide the app necessary permissions. Currently, I am unrooted, adb command mentioned in the app for the required permissions did not work for me. I have been using this app for years but on rooted phones. I will try it again. Thanks
Update: There is another System ui tuner app by Bryan that worked just fine without any permissions
Gr8man001 said:
I tried to use it but was unable to provide the app necessary permissions. Currently, I am unrooted, adb command mentioned in the app for the required permissions did not work for me. I have been using this app for years but on rooted phones. I will try it again. Thanks
Update: There is another System ui tuner app by Bryan that worked just fine without any permissions
Click to expand...
Click to collapse
Yep you'll definitely need to provide them permissions or root.
Is adb working? Can you say adb devices and get a feedback code?
Also why not root? It's a OnePlus, the one phone you can root without repercussions.
I have always rooted my phones for the last 16 years and most likely will root this one too. But quite honestly, at least for my needs, benefits of root vs.complexity of rooting process, steps necessary for each upgrade is not there. Lack of official twrp, issues r/t Titanium backup, etc are not encouraging. That being said, the moment I see a good custom ROM for this phone, I know I will root again. Thanks
Gr8man001 said:
I have always rooted my phones for the last 16 years and most likely will root this one too. But quite honestly, at least for my needs, benefits of root vs.complexity of rooting process, steps necessary for each upgrade is not there. Lack of official twrp, issues r/t Titanium backup, etc are not encouraging. That being said, the moment I see a good custom ROM for this phone, I know I will root again. Thanks
Click to expand...
Click to collapse
Funny you should say that, so have I, and in all honesty you mustn't have seen the guide I made on rooting as it's extremely clear.
Plus as from the 8 pro on wards, you simply do not need twrp, period..it'd be nice to have MSM, but we already have fastboot enhance which is actually better as it doesn't relock the bootloader .
Titanium also hasn't worked correctly for a while, it has issues with restoration.
Swift back up works perfectly for those needs and it can back up to the cloud..
I'm not going to go into the benefits of rooting but just getting rid of ads is massive for me, I couldn't stomach a device which allowed them.
But you do you
ROMs are coming soon btw
Guide to updating, rooting, Magisk and fastboot enhance.
You don't need twrp
(Guide) Rooting, payload dumper, magisk_patched guides NE2213
Hi all, Thought i'd share a guide on how to get these boot images yourself as well as all the files required, plus the patched boot.img if you just want to go ahead and boot/flash it without obtaining one yourself Please read the process before...
forum.xda-developers.com

Categories

Resources