Database Develop

Possible intruder on my N6

I have recently purchased a used Nexus 6 and I have just noticed that my phone may be compromised. It took a while to set up the phone as i wasn't getting the original account info to complete the setup, but now that I have run the setup, and set up a 'group' on the home screen that I labelled 'Entertainment' which holds a couple games. I see now, that the label has been changed to 'D's Sacs Was DQ'. Why would this happen and or what can be done to secure my phone? Please help!
Thank you
FK

fkoulbot said:
I have recently purchased a used Nexus 6 and I have just noticed that my phone may be compromised. It took a while to set up the phone as i wasn't getting the original account info to complete the setup, but now that I have run the setup, and set up a 'group' on the home screen that I labelled 'Entertainment' which holds a couple games. I see now, that the label has been changed to 'D's Sacs Was DQ'. Why would this happen and or what can be done to secure my phone? Please help!
Thank you
FK
Click to expand...
Click to collapse
LMAO! Really?! Did you factory wipe it? Is it stock or boot loader unlocked? Is it rooted?

fkoulbot said:
I have recently purchased a used Nexus 6 and I have just noticed that my phone may be compromised. It took a while to set up the phone as i wasn't getting the original account info to complete the setup, but now that I have run the setup, and set up a 'group' on the home screen that I labelled 'Entertainment' which holds a couple games. I see now, that the label has been changed to 'D's Sacs Was DQ'. Why would this happen and or what can be done to secure my phone? Please help!
Thank you
FK
Click to expand...
Click to collapse
Flash userdata.img and erase and flash cache.img in fastboot (if you have a unlocked bootloader) and after that data factory reset in recovery and reboot. That all you can you do.

Flashing it to ensure it was wiped of anything on it prior to use, since it was used, should have been the first thing done to it (ensuring ti wasn't locked to an account or you would have issues afterwards).

gee2012 said:
Flash userdata.img and erase and flash cache.img in fastboot (if you have a unlocked bootloader) and after that data factory reset in recovery and reboot. That all you can you do.
Click to expand...
Click to collapse
How do i know if I have an unlocked bootloader? I'm worried if i do a factory reset I'd be locked out if their account is still considered the original.

fkoulbot said:
How do i know if I have an unlocked bootloader? I'm worried if i do a factory reset I'd be locked out if their account is still considered the original.
Click to expand...
Click to collapse
To get in booltoader/fastboot mode:
1. with adb, type in cmd: adb reboot bootloader
2. Manualy: power down the phone and press both volume up and down + power.

RW-1 said:
Flashing it to ensure it was wiped of anything on it prior to use, since it was used, should have been the first thing done to it (ensuring ti wasn't locked to an account or you would have issues afterwards).
Click to expand...
Click to collapse
That was an issue when I began. I needed their account info to log in during setup but then was able to add my info.

fkoulbot said:
That was an issue when I began. I needed their account info to log in during setup but then was able to add my info.
Click to expand...
Click to collapse
Try logging in and boot the phone with the original account, delete the account and then perform a data factory reset in recovery. Then boot up with your account and that should do it usualy.

fkoulbot said:
How do i know if I have an unlocked bootloader? I'm worried if i do a factory reset I'd be locked out if their account is still considered the original.
Click to expand...
Click to collapse
Or even easier... do you see a little icon of an unlocked lock at the bottom of the screen when you boot your phone?

Or, something much less nefarious...
I would think that it could be possible you may have placed the phone in a pocket with the home screen showing (or some similar action) and the folder got renamed with random presses that also triggered random words through autocomplete. Been there, done that.

It was me.. I hacked you.. But once I was in, I couldn't think of anything to do, so I renamed a folder. Was gonna key log your bank details but this was way better

I hack phones and change events in the calendar app. Because I like confusion and making people late.

Can't get into Nexus 6 that has encryption

So I am a developer, making a lockscreen app. Part of the app allows it to set a system lock for double protection. Upon doing this, it set PIN needed for phone to start up. The pin I had set wouldn't work so I entered it in too many times and it wiped my device. The weird thing is, the default password "0" worked in TWRP but NOT to boot Android. Now, after it wiped my device, it boots up to the Android screen, and tells me to enter my PIN again.. It still doesn't work, but tells me in -1 attempts my device will be wiped. How can I just get this all to go away and start again? I have root and TWRP installed. Is there anything I can do?
I can't even boot into Android because it asks for the PIN, even though it already wiped it. I can't use my phone at all.

Flash factory images?
Sent from my Nexus 6 using Tapatalk

Will this mess up TWRP?

DRatJr said:
Will this mess up TWRP?
Click to expand...
Click to collapse
does it matter? it takes 10-15 seconds to flash twrp, or reflash. but anyways i have a feeling that itll ask again, i hope not.

Yea. I would fastboot erase and reflash everything. If bootloader is locked you are hosed.

DRatJr said:
So I am a developer, making a lockscreen app. Part of the app allows it to set a system lock for double protection. Upon doing this, it set PIN needed for phone to start up. The pin I had set wouldn't work so I entered it in too many times and it wiped my device. The weird thing is, the default password "0" worked in TWRP but NOT to boot Android. Now, after it wiped my device, it boots up to the Android screen, and tells me to enter my PIN again.. It still doesn't work, but tells me in -1 attempts my device will be wiped. How can I just get this all to go away and start again? I have root and TWRP installed. Is there anything I can do?
I can't even boot into Android because it asks for the PIN, even though it already wiped it. I can't use my phone at all.
Click to expand...
Click to collapse
Contact the previous owner for his unlocking gesture or code/pin and Gmail account, then factory reset and login with his account and when done delete this accoubt in /settings/accounts/. Then data factory reset again and it should be fixed imo. Or send your phone to the prev. owner so he can do it himself. Look here too http://forum.xda-developers.com/nexus-6/general/guide-properly-prepare-nexus-6-resale-t3104504.

I've had this phone since it came out haha. I haven't stolen it or anything. The problem came because I was solely testing on Samsung devices. Here, I set a backup PASSWORD in case you couldn't unlock your phone. My app was a device admin so it had the ability to set phone lock and lock the phone. What happened was when I tested it on my Nexus, between making the password and setting the password there is the option of "require at boot", which mysteriously, my app automatically selected. Now the issue comes in when I rebooted my phone and Google did NOT let me put a PASSWORD it, but required a PIN. This was an impossible scenario because the android lock screen was set with a PASSWORD, not a PIN.
The even weirder thing was that my app automatically sets the backup android pin to "0" if no backup password is set. When I tried 0 at boot it wouldn't work. BUT when I tried it in TWRP 0 was the only thing that decrypted the phone. I am still not sure why this whole thing happened (Google not letting me put a PASSWORD instead of a PIN if the device is encrypted. My app automatically selecting require PIN at boot, and the backup "0" working in TWRP when it wouldn't work to boot Android).
So @gee2012 I know it may seem like another thread where someone stole a Nexus and wanted to break in to use it. But I assure you I am the only one to ever own this phone. This was just a weird scenario that hopefully won't happen again.
But for the sake of the question:
Flashing factory images worked! Thanks @HolyAngel

DRatJr said:
I've had this phone since it came out haha. I haven't stolen it or anything. The problem came because I was solely testing on Samsung devices. Here, I set a backup PASSWORD in case you couldn't unlock your phone. My app was a device admin so it had the ability to set phone lock and lock the phone. What happened was when I tested it on my Nexus, between making the password and setting the password there is the option of "require at boot", which mysteriously, my app automatically selected. Now the issue comes in when I rebooted my phone and Google did NOT let me put a PASSWORD it, but required a PIN. This was an impossible scenario because the android lock screen was set with a PASSWORD, not a PIN.
The even weirder thing was that my app automatically sets the backup android pin to "0" if no backup password is set. When I tried 0 at boot it wouldn't work. BUT when I tried it in TWRP 0 was the only thing that decrypted the phone. I am still not sure why this whole thing happened (Google not letting me put a PASSWORD instead of a PIN if the device is encrypted. My app automatically selecting require PIN at boot, and the backup "0" working in TWRP when it wouldn't work to boot Android).
So @gee2012 I know it may seem like another thread where someone stole a Nexus and wanted to break in to use it. But I assure you I am the only one to ever own this phone. This was just a weird scenario that hopefully won't happen again.
But for the sake of the question:
Flashing factory images worked! Thanks @HolyAngel
Click to expand...
Click to collapse
Who talked about stolen devices mate, I surely didn`t! I thought that you bought a used Nexus 6 mate, and the previous owner didn`t delete his account :silly:

gee2012 said:
Who talked about stolen devices mate, I surely didn`t! I thought that you bought a used Nexus 6 mate, and the previous owner didn`t delete his account :silly:
Click to expand...
Click to collapse
Oh sorry :/ haha. Wasn't sure if it seemed that way. But nah this has been my baby since unboxing lol

I am an idiot

Today a scenario popped up and I quickly set up a 4 digit PIN code and pressed enter. As is on stock Lollipop 5.1, I'm required to enter password twice to confirm. So I did (and as far as I could tell, it was four digits, from a quick glance), but then when I wanted to unlock, it wouldn't, typing in the same passcode that I thought I'd typed in (and the one I used previously when it had a screen lock, disabled it in June). I've tried to brute force my way through, up to almost 300 attempts, but no luck. There's no forgot password option, at least not in plain sight, and Android device manager was no help (it locked the phone, but I could press home and I'd just be back at the lock screen). ADB is disabled. PC doesn't recognize phone. Does anyone know of secret tricks or programs that can brute force through for me? Thanks!

Do you have your bootloader unlocked and a custom recovery? As long as you didn't enable encryption with this code, you should be able to use recovery to backup files from your phone... However there is no way for you to get into your phone without the code. So after backing up, you would need to factory reset it. As far as brute forcing goes there is no way for you to do it. You would have to enter every combinaton that exists manually. That would take forever... So factory reset is your best option.
Sent from my XT1095 using Tapatalk

AGISCI said:
Do you have your bootloader unlocked and a custom recovery? As long as you didn't enable encryption with this code, you should be able to use recovery to backup files from your phone... However there is no way for you to get into your phone without the code. So after backing up, you would need to factory reset it. As far as brute forcing goes there is no way for you to do it. You would have to enter every combinaton that exists manually. That would take forever... So factory reset is your best option.
Sent from my XT1095 using Tapatalk
Click to expand...
Click to collapse
No custom recovery. Encryption isn't on. Is there an app or hidden Google solution for this? (I'm in denial right now, ha)

AB__CD said:
No custom recovery. Encryption isn't on. Is there an app or hidden Google solution for this? (I'm in denial right now, ha)
Click to expand...
Click to collapse
You said no custom recovery... but you didn't say if your bootloader is unlocked or not. If it's unlocked, you are in luck and can flash a custom recovery, then backup your files. If it's locked... No choice but to factory reset.
Sent from my XT1095 using Tapatalk

AB__CD said:
Today a scenario popped up and I quickly set up a 4 digit PIN code and pressed enter. As is on stock Lollipop 5.1, I'm required to enter password twice to confirm. So I did (and as far as I could tell, it was four digits, from a quick glance), but then when I wanted to unlock, it wouldn't, typing in the same passcode that I thought I'd typed in (and the one I used previously when it had a screen lock, disabled it in June). I've tried to brute force my way through, up to almost 300 attempts, but no luck. There's no forgot password option, at least not in plain sight, and Android device manager was no help (it locked the phone, but I could press home and I'd just be back at the lock screen). ADB is disabled. PC doesn't recognize phone. Does anyone know of secret tricks or programs that can brute force through for me? Thanks!
Click to expand...
Click to collapse
Sounds suspicious... You did enter the 4 digit pin, but cant get it unlocked with those code? Is that your own phone or others? Sorry, but your case is very strange...
Sent from my XT1095 using Tapatalk

bimasakti85 said:
Sounds suspicious... You did enter the 4 digit pin, but cant get it unlocked with those code? Is that your own phone or others? Sorry, but your case is very strange...
Sent from my XT1095 using Tapatalk
Click to expand...
Click to collapse
Absolutely is my phone. I entered it so quickly i may have mistyped it. And no, bootloader is locked.

Normally there is an option to put in your Google email and password if you forget your password

chapelfreak said:
Normally there is an option to put in your Google email and password if you forget your password
Click to expand...
Click to collapse
Not there in Lollipop. Apparently they took it out. Because it only shows emergency call, below the numbers where it used to be in KitKat, and the dialog box that prompts you every 5 failures will only warn you and have an OK button.

AB__CD said:
Not there in Lollipop. Apparently they took it out. Because it only shows emergency call, below the numbers where it used to be in KitKat, and the dialog box that prompts you every 5 failures will only warn you and have an OK button.
Click to expand...
Click to collapse
That's stupid of Google to do that. I guess I would do a nandroid backup and factory reset if I forgot mine.

chapelfreak said:
That's stupid of Google to do that. I guess I would do a nandroid backup and factory reset if I forgot mine.
Click to expand...
Click to collapse
Yeah it's absolutely idiotic. Wish they'd do something about it.
Sent from my XT1092 using Tapatalk

Bought phone from ebay, now registration wizard won't let me pass

So I bought this phone from eBay, like many before it. But this time it came with a twist: when I booted the phone, initial setup ran and all wend fine until I got to the register Google account screen.
There, the phone says: "This phone was reset. To continue, sign in with a Google Account that was previously synced on this device".
No matter what account I use, I always get a Toast message saying "Unable to sign in to device due to a unknown error. Please try another account or try to sign in again after 24 hours.".
I'm guessing this is some kind of theft protection where entering a previously synced account "proves" that you're the legit owner. The authorised service here told me that I need some kind of proof that I'm the legit owner and surely enough the eBay seller has issued no invoice containing the phone's IMEI (or any similar document).
Anyway, here I am with this gorgeous phone on my hands which is little more than a brick due to this.
Is there any way I could get it to work again? Returning it will just generate more costs for me and I'd like to avoid that.
I've seen guides on youtube where they managed to bypass this security measure, but both methods I've seen failed for me. I guess the version running on my phone is just too recent and plugged all the holes.
Do I have any way of downgrading the software at least? Note that this is a fully locked phone and I can't even start TWRP from fastboot.
Anything else?
Edit: Now that I'm re-reading this post, it occurred to me that there's very little chance that this phone wouldn't be a stolen one. Had it not been, the seller would easily issue me an invoice.
Leaving this post only because my searching hasn't turned up anything on XDA. Probably also reporting the guy on eBay.

velis74 said:
So I bought this phone from eBay, like many before it. But this time it came with a twist: when I booted the phone, initial setup ran and all wend fine until I got to the register Google account screen.
There, the phone says: "This phone was reset. To continue, sign in with a Google Account that was previously synced on this device".
No matter what account I use, I always get a Toast message saying "Unable to sign in to device due to a unknown error. Please try another account or try to sign in again after 24 hours.".
I'm guessing this is some kind of theft protection where entering a previously synced account "proves" that you're the legit owner. The authorised service here told me that I need some kind of proof that I'm the legit owner and surely enough the eBay seller has issued no invoice containing the phone's IMEI (or any similar document).
Anyway, here I am with this gorgeous phone on my hands which is little more than a brick due to this.
Is there any way I could get it to work again? Returning it will just generate more costs for me and I'd like to avoid that.
I've seen guides on youtube where they managed to bypass this security measure, but both methods I've seen failed for me. I guess the version running on my phone is just too recent and plugged all the holes.
Do I have any way of downgrading the software at least? Note that this is a fully locked phone and I can't even start TWRP from fastboot.
Anything else?
Edit: Now that I'm re-reading this post, it occurred to me that there's very little chance that this phone wouldn't be a stolen one. Had it not been, the seller would easily issue me an invoice.
Leaving this post only because my searching hasn't turned up anything on XDA. Probably also reporting the guy on eBay.
Click to expand...
Click to collapse
From the Settings / About, what is exact (full) build name/number?
Generally, if you are on Nougat then IMO, rolling back to MM should completely reset your phone.
You cannot flash TWRP without unlocking Bootloader. But that will not help much for resetting Google protection.
Btw, enable Developer's menu, does it allow you to unlock FRP/OEM Unlocking - in that case you will be able to reset all from EMUI recovery.

zgfg said:
From the Settings / About, what is exact (full) build name/number?
Generally, if you are on Nougat then IMO, rolling back to MM should completely reset your phone.
You cannot flash TWRP without unlocking Bootloader. But that will not help much for resetting Google protection.
Btw, enable Developer's menu, does it allow you to unlock FRP/OEM Unlocking - in that case you will be able to reset all from EMUI recovery.
Click to expand...
Click to collapse
He can't get passed the setup screen

Twisted Prime said:
He can't get passed the setup screen
Click to expand...
Click to collapse
- Boot to Recovery (switch off, press and keep pressing Vol+ and Pow). Does it boot to stock Recovery and does it allow there to Factory reset (it should but if FRP was unlocked)
- Boot to Fastboot (switch off, connect by USB to PC, press Vol- and Pow), do you see Phone (Bootloader) and FRP locked or unlocked?

zgfg said:
- Boot to Recovery (switch off, press and keep pressing Vol+ and Pow). Does it boot to stock Recovery and does it allow there to Factory reset (it should but if FRP was unlocked)
- Boot to Fastboot (switch off, connect by USB to PC, press Vol- and Pow), do you see Phone (Bootloader) and FRP locked or unlocked?
Click to expand...
Click to collapse
It is stock recovery. I don't recall the option for factory reset. In fact there's no options at all, save for reboots.
Fastboot says everything is locked as it should be.
Don't know how to downgrade to MM.

velis74 said:
It is stock recovery. I don't recall the option for factory reset. In fact there's no options at all, save for reboots.
Fastboot says everything is locked as it should be.
Don't know how to downgrade to MM.
Click to expand...
Click to collapse
Rollback instructions are here
https://forum.xda-developers.com/showpost.php?p=72153575&postcount=2
But not sure would it allow you to setup.
That is Factory Reset Protection (FRP/OEM Unlocking) - if it was unlocked you would be allowed to reset from recovery.
You can ask seller - maybe he can login to his Google account and remotely remove Google account from the sold phone.
Or you can try DC Unlocker, not sure would it work
https://www.dc-unlocker.com/DC-Phoenix-flash-repair-tutorial

Well, DC unlocker ultimately worked, but not before buying a wrong package, having to ask tech support, etc, etc. Not to mention the guy really has no patience for people who don't have his level of understanding of the subject. Why does he do it then if he hates the whole thing so much?

velis74 said:
Well, DC unlocker ultimately worked, but not before buying a wrong package, having to ask tech support, etc, etc. Not to mention the guy really has no patience for people who don't have his level of understanding of the subject. Why does he do it then if he hates the whole thing so much?
Click to expand...
Click to collapse
So did you use DC Unlocker to unlock Bootloader or DC Phoenix to reinstall the phone?

zgfg said:
So did you use DC Unlocker to unlock Bootloader or DC Phoenix to reinstall the phone?
Click to expand...
Click to collapse
DC unlocker. I wanted minimal impact on the OS as the phone is for my daughter and she doesn't do custom ROMs et al

velis74 said:
DC unlocker. I wanted minimal impact on the OS as the phone is for my daughter and she doesn't do custom ROMs et al
Click to expand...
Click to collapse
Sorry for bothering but I'm interested now - when Bootloader was unlocked (and FRP too), were you just able to pass setup or you needed to do Factory reset from Recovery or how did you get the stock ROM working for you

Final resolution: the seller sent me an invoice. I guess that means that the phone wasn't stolen after all since they can only expect that this will be entered into Huawei databases.
zgfg said:
Sorry for bothering but I'm interested now - when Bootloader was unlocked (and FRP too), were you just able to pass setup or you needed to do Factory reset from Recovery or how did you get the stock ROM working for you
Click to expand...
Click to collapse
The procedure was thus:
1. unlocker unlocked the FRP
2. phone rebooted into a factory reset (low level) mode - it specifically said "low level"
3. phone booted into normal Android where the FRP protection was no longer active. On screen where it previously demanded a previous Google account it now only demanded A (any) Google account as I'm used to from all the other phones I ever bought.

Sorry old post

OnePlus 3T forgot PW (Unlocked Bootloader)

Hi there guys, is there a option to regain access to my Oneplus 3T without loosing all my Data?
Fingerprint is still saved on the device, Bootloader is unlocked, its rooted and i think not encryptet.
At startup i get the message "Your device has been unlocked and cant be trusted"
It would be great to regain access because i have a lots of personal data and my google authenticator on that phone...
AndroidLost is also installed on the Phone but since android 7 sadly you cant unlock it with an App
Any advice would be great.

DirtyButterBrot said:
Hi there guys, is there a option to regain access to my Oneplus 3T without loosing all my Data?
Fingerprint is still saved on the device, Bootloader is unlocked, its rooted and i think not encryptet.
At startup i get the message "Your device has been unlocked and cant be trusted"
It would be great to regain access because i have a lots of personal data and my google authenticator on that phone...
AndroidLost is also installed on the Phone but since android 7 sadly you cant unlock it with an App
Any advice would be great.
Click to expand...
Click to collapse
The message you're seeing is normal for an unlocked bootloader. It's just a warning, nothing else.
Is that message all you're concerned about? The phone will boot normally if you don't press any keys.

BillGoss said:
The message you're seeing is normal for an unlocked bootloader. It's just a warning, nothing else.
Is that message all you're concerned about? The phone will boot normally if you don't press any keys.
Click to expand...
Click to collapse
I forgot the Code and i need my Data back from the device.
i just thought this would open some possibilites to regain access on my phone

DirtyButterBrot said:
I forgot the Code and i need my Data back from the device.
i just thought this would open some possibilites to regain access on my phone
Click to expand...
Click to collapse
If you install TWRP, then you can remove your lock screen password by deleting any gatekeeper.* and locksettings.* files from /data/system using the TWRP file manager.