Related
I'm using android revolution right now as my current rom. It is missing a few things, that I'm used to from being on clean rom and infected for a while.
Can anyone help me figure these things out and add them to the rom myself.
Added camera settings - HDR, Panorama, sound on/off ~ http://forum.xda-developers.com/showthread.php?t=1263813
Dimmed Capacity Buttons with custom kernel ~ http://forum.xda-developers.com/showthread.php?t=1276936
Transparent Rosie
Transparent Pull down
Extended Quick Settings
Extended Power Options
I looked around for some flashable zips for these things but I couldnt find any. Thanks for your help.
faugnom1 said:
I'm using android revolution right now as my current rom. It is missing a few things, that I'm used to from being on clean rom and infected for a while.
Can anyone help me figure these things out and add them to the rom myself.
Added camera settings - HDR, Panorama, sound on/off ~ http://forum.xda-developers.com/showthread.php?t=1263813
Dimmed Capacity Buttons with custom kernel ~ http://forum.xda-developers.com/showthread.php?t=1276936
Transparent Rosie
Transparent Pull down
Extended Quick Settings
Extended Power Options
I looked around for some flashable zips for these things but I couldnt find any. Thanks for your help.
Click to expand...
Click to collapse
I don't know about the transparent things, but have done the last 2.
For extended settings, you just need to delete all of the following lines in quicksettings.smali inside of systemui.apk.
Code:
.line 79
iget-object v2, p0, Lcom/android/systemui/statusbar/preference/QuickSettings;->mSettingItems:[Lcom/android/systemui/statusbar/preference/StatusBarPreference;
aget-object v2, v2, v7
invoke-virtual {v2, v7}, Lcom/android/systemui/statusbar/preference/StatusBarPreference;->setEnable(Z)V
.line 80
iget-object v2, p0, Lcom/android/systemui/statusbar/preference/QuickSettings;->mSettingItems:[Lcom/android/systemui/statusbar/preference/StatusBarPreference;
aget-object v2, v2, v8
invoke-virtual {v2, v7}, Lcom/android/systemui/statusbar/preference/StatusBarPreference;->setEnable(Z)V
.line 85
sget-boolean v2, Lcom/android/systemui/statusbar/StatusBarFlag;->HTC_QS_TASK_MANAGER:Z
if-nez v2, :cond_0
.line 86
iget-object v2, p0, Lcom/android/systemui/statusbar/preference/QuickSettings;->mSettingItems:[Lcom/android/systemui/statusbar/preference/StatusBarPreference;
aget-object v2, v2, v10
invoke-virtual {v2, v7}, Lcom/android/systemui/statusbar/preference/StatusBarPreference;->setEnable(Z)V
.line 92
:cond_0
iget-object v2, p0, Lcom/android/systemui/statusbar/preference/QuickSettings;->mSettingItems:[Lcom/android/systemui/statusbar/preference/StatusBarPreference;
aget-object v2, v2, v11
invoke-virtual {v2, v7}, Lcom/android/systemui/statusbar/preference/StatusBarPreference;->setEnable(Z)V
Also change
Code:
.line 94
.local v0, cm:Landroid/net/ConnectivityManager;
if-eqz v0, :cond_2
.line 95
invoke-virtual {v0}, Landroid/net/ConnectivityManager;->getTetherableWifiRegexs()[Ljava/lang/String;
move-result-object v1
.line 96
.local v1, hotspotRegexs:[Ljava/lang/String;
array-length v2, v1
if-eqz v2, :cond_1
invoke-virtual {v0}, Landroid/net/ConnectivityManager;->isTetheringSupported()Z
move-result v2
if-nez v2, :cond_2
.line 97
:cond_1
to
Code:
.line 94
.local v0, cm:Landroid/net/ConnectivityManager;
if-eqz v0, :cond_[COLOR="Red"]1[/COLOR]
.line 95
invoke-virtual {v0}, Landroid/net/ConnectivityManager;->getTetherableWifiRegexs()[Ljava/lang/String;
move-result-object v1
.line 96
.local v1, hotspotRegexs:[Ljava/lang/String;
array-length v2, v1
if-eqz v2, :cond_[COLOR="Red"]0[/COLOR]
invoke-virtual {v0}, Landroid/net/ConnectivityManager;->isTetheringSupported()Z
move-result v2
if-nez v2, :cond_[COLOR="Red"]1[/COLOR]
.line 97
:cond_[COLOR="Red"]0[/COLOR]
For the extended power menu and reboot options, you need to edit android.policy.jar. Take one from a stock rom and compare the decompiled version to one from a custom rom (I usually use SteelH's ROM). I cannot remember exactly which files are changed.
Ty sir. I found some old transparency zips on my computer. Ill post them here in case anyone else wants them.
Just for the sake of transparency Here is a quick rundown of the process for everyone to see.
High level overview:
1. ) baksmali classes.dex from NfcNci.apk
2. ) Mod the resulting smali.
3. ) smali, and inject back into NfcNci.apk
Since this is the dev section I will focus on step 2 you can read about steps 1 and 3 elsewhere. For the sake of this example I will be working with the system dump from the original release of the gt-i9505g (S4 Google Edition) System Software.
What you are looking for is this function contained in the NfcIntegrityChecker class:
Code:
.method public checkIntegrity(Ljava/lang/String;)Z
If we track back the exception error message that comes up in the debug log ("Client module is tampered"), you will see that the text is contained in the NfcService class within the function ".method public enforceNfcIntegrity()V"
Code:
.method public enforceNfcIntegrity()V
.locals 3
.prologue
.line 470
iget-object v1, p0, Lcom/android/nfc/NfcService;->mIntegrityChecker:Lcom/android/nfc/NfcIntegrityChecker;
monitor-enter v1
.line 471
:try_start_0
iget-object v0, p0, Lcom/android/nfc/NfcService;->mIntegrityChecker:Lcom/android/nfc/NfcIntegrityChecker;
invoke-virtual {v0}, Lcom/android/nfc/NfcIntegrityChecker;->getStatus()I
move-result v0
const/4 v2, 0x3
if-ne v0, v2, :cond_0
.line 472
new-instance v0, Ljava/lang/SecurityException;
const-string v2, "NfcIntegrityChecker is not on the proper status"
invoke-direct {v0, v2}, Ljava/lang/SecurityException;-><init>(Ljava/lang/String;)V
throw v0
.line 480
:catchall_0
move-exception v0
monitor-exit v1
:try_end_0
.catchall {:try_start_0 .. :try_end_0} :catchall_0
throw v0
.line 475
:cond_0
:try_start_1
iget-object v0, p0, Lcom/android/nfc/NfcService;->mIntegrityChecker:Lcom/android/nfc/NfcIntegrityChecker;
invoke-virtual {v0}, Lcom/android/nfc/NfcIntegrityChecker;->getStatus()I
move-result v0
const/4 v2, 0x2
if-eq v0, v2, :cond_1
iget-object v0, p0, Lcom/android/nfc/NfcService;->mIntegrityChecker:Lcom/android/nfc/NfcIntegrityChecker;
const-string v2, "client"
invoke-virtual {v0, v2}, Lcom/android/nfc/NfcIntegrityChecker;->checkIntegrity(Ljava/lang/String;)Z
move-result v0
if-eqz v0, :cond_1
iget-object v0, p0, Lcom/android/nfc/NfcService;->mIntegrityChecker:Lcom/android/nfc/NfcIntegrityChecker;
const-string v2, "clientlib"
invoke-virtual {v0, v2}, Lcom/android/nfc/NfcIntegrityChecker;->checkIntegrity(Ljava/lang/String;)Z
move-result v0
if-nez v0, :cond_2
.line 478
:cond_1
new-instance v0, Ljava/lang/SecurityException;
const-string v2, "Client module is tampered"
invoke-direct {v0, v2}, Ljava/lang/SecurityException;-><init>(Ljava/lang/String;)V
throw v0
.line 480
:cond_2
monitor-exit v1
:try_end_1
.catchall {:try_start_1 .. :try_end_1} :catchall_0
.line 481
return-void
.end method
If we follow the flow of the application we see that the code for this failure is only reached if the function call to
Code:
checkIntegrity(Ljava/lang/String;)Z
returns false, or the status is not properly set. (the 'Z' at the end means it returns a boolean).
There are two ways to handle this. We can either patch out the call to checkIntegrity entirely (jump over it, or literally remove the calls), or we can modify the checkIntegrity function so that it always returns true.
So, let's look at the checkIntegrity function:
Code:
.method public checkIntegrity(Ljava/lang/String;)Z
.locals 11
.parameter "type"
.prologue
const/4 v10, 0x2
const/4 v9, 0x1
const/4 v8, 0x0
.line 293
iget-object v5, p0, Lcom/android/nfc/NfcIntegrityChecker;->mModuleMap:Ljava/util/HashMap;
invoke-virtual {v5, p1}, Ljava/util/HashMap;->get(Ljava/lang/Object;)Ljava/lang/Object;
move-result-object v2
check-cast v2, Ljava/util/ArrayList;
.line 294
.local v2, modules:Ljava/util/ArrayList;,"Ljava/util/ArrayList<[Ljava/lang/String;>;"
const/4 v1, 0x0
.line 295
.local v1, module:[Ljava/lang/String;
const/4 v3, 0x1
.line 296
.local v3, ret:Z
invoke-virtual {v2}, Ljava/util/ArrayList;->size()I
move-result v4
.line 298
.local v4, size:I
const/4 v0, 0x0
.local v0, i:I
:goto_0
if-ge v0, v4, :cond_2
.line 299
invoke-virtual {v2, v0}, Ljava/util/ArrayList;->get(I)Ljava/lang/Object;
move-result-object v1
.end local v1 #module:[Ljava/lang/String;
check-cast v1, [Ljava/lang/String;
.line 301
.restart local v1 #module:[Ljava/lang/String;
if-eqz v1, :cond_0
array-length v5, v1
if-eq v5, v10, :cond_4
.line 302
:cond_0
sget-boolean v5, Lcom/android/nfc/NfcIntegrityChecker;->DBG:Z
if-eqz v5, :cond_1
const-string v5, "NfcIntegrityChecker"
const-string v6, "checkIntegrity module format error"
invoke-static {v5, v6}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
.line 303
:cond_1
const/4 v3, 0x0
.line 314
:cond_2
:goto_1
if-nez v3, :cond_3
iput v10, p0, Lcom/android/nfc/NfcIntegrityChecker;->mStatus:I
.line 316
:cond_3
return v3
.line 307
:cond_4
aget-object v5, v1, v8
aget-object v6, v1, v9
invoke-direct {p0, v5, v6}, Lcom/android/nfc/NfcIntegrityChecker;->checkModuleIntegrity(Ljava/lang/String;Ljava/lang/String;)Z
move-result v5
if-nez v5, :cond_6
.line 308
sget-boolean v5, Lcom/android/nfc/NfcIntegrityChecker;->DBG:Z
if-eqz v5, :cond_5
const-string v5, "NfcIntegrityChecker"
new-instance v6, Ljava/lang/StringBuilder;
invoke-direct {v6}, Ljava/lang/StringBuilder;-><init>()V
const-string v7, "checkModuleIntegrity "
invoke-virtual {v6, v7}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v6
aget-object v7, v1, v8
invoke-virtual {v6, v7}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v6
const-string v7, " tampered : "
invoke-virtual {v6, v7}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v6
aget-object v7, v1, v9
invoke-virtual {v6, v7}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v6
invoke-virtual {v6}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v6
invoke-static {v5, v6}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
.line 309
:cond_5
const/4 v3, 0x0
.line 310
goto :goto_1
.line 298
:cond_6
add-int/lit8 v0, v0, 0x1
goto :goto_0
.end method
There is only one return statement, so this should be a simple matter of setting our value, and calling return. In some cases there is code that your application needs to run in order to function, so usually a light touch is a good idea, but in this case all of the code is there to run various checks so we can skip most of it.
The easiest way would be to replace the whole function with this:
Code:
.method public checkIntegrity(Ljava/lang/String;)Z
.locals 2
.parameter "type"
.prologue
const/4 v0, 0x1
return v0
.end method
But that method never sat right with me (old school c++ cracking I guess), so I prefer something like this:
add a goto, and modify the constant here:
.line 303
:cond_1
:goto_666
const/4 v3, 0x1
then add the following line to the beginning of the function (after the .prologue)
goto :goto_666
We end up with something like this:
Code:
.method public checkIntegrity(Ljava/lang/String;)Z
.locals 11
.parameter "type"
.prologue
const/4 v10, 0x2
const/4 v9, 0x1
const/4 v8, 0x0
goto :goto_666
.line 293
iget-object v5, p0, Lcom/android/nfc/NfcIntegrityChecker;->mModuleMap:Ljava/util/HashMap;
invoke-virtual {v5, p1}, Ljava/util/HashMap;->get(Ljava/lang/Object;)Ljava/lang/Object;
move-result-object v2
check-cast v2, Ljava/util/ArrayList;
.line 294
.local v2, modules:Ljava/util/ArrayList;,"Ljava/util/ArrayList<[Ljava/lang/String;>;"
const/4 v1, 0x0
.line 295
.local v1, module:[Ljava/lang/String;
const/4 v3, 0x1
.line 296
.local v3, ret:Z
invoke-virtual {v2}, Ljava/util/ArrayList;->size()I
move-result v4
.line 298
.local v4, size:I
const/4 v0, 0x0
.local v0, i:I
:goto_0
if-ge v0, v4, :cond_2
.line 299
invoke-virtual {v2, v0}, Ljava/util/ArrayList;->get(I)Ljava/lang/Object;
move-result-object v1
.end local v1 #module:[Ljava/lang/String;
check-cast v1, [Ljava/lang/String;
.line 301
.restart local v1 #module:[Ljava/lang/String;
if-eqz v1, :cond_0
array-length v5, v1
if-eq v5, v10, :cond_4
.line 302
:cond_0
sget-boolean v5, Lcom/android/nfc/NfcIntegrityChecker;->DBG:Z
if-eqz v5, :cond_1
const-string v5, "NfcIntegrityChecker"
const-string v6, "checkIntegrity module format error"
invoke-static {v5, v6}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
.line 303
:cond_1
:goto_666
const/4 v3, 0x1
.line 314
:cond_2
:goto_1
if-nez v3, :cond_3
iput v10, p0, Lcom/android/nfc/NfcIntegrityChecker;->mStatus:I
.line 316
:cond_3
return v3
.line 307
:cond_4
aget-object v5, v1, v8
aget-object v6, v1, v9
invoke-direct {p0, v5, v6}, Lcom/android/nfc/NfcIntegrityChecker;->checkModuleIntegrity(Ljava/lang/String;Ljava/lang/String;)Z
move-result v5
if-nez v5, :cond_6
.line 308
sget-boolean v5, Lcom/android/nfc/NfcIntegrityChecker;->DBG:Z
if-eqz v5, :cond_5
const-string v5, "NfcIntegrityChecker"
new-instance v6, Ljava/lang/StringBuilder;
invoke-direct {v6}, Ljava/lang/StringBuilder;-><init>()V
const-string v7, "checkModuleIntegrity "
invoke-virtual {v6, v7}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v6
aget-object v7, v1, v8
invoke-virtual {v6, v7}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v6
const-string v7, " tampered : "
invoke-virtual {v6, v7}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v6
aget-object v7, v1, v9
invoke-virtual {v6, v7}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v6
invoke-virtual {v6}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v6
invoke-static {v5, v6}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
.line 309
:cond_5
const/4 v3, 0x0
.line 310
goto :goto_1
.line 298
:cond_6
add-int/lit8 v0, v0, 0x1
goto :goto_0
.end method
confirmed working
thanks again!
This is great, thanks for your contribution!
So does the integrity check call only have to do with access to the secure element? Or does it also eliminate the need to spoof device model for compatibility purposes?
CPA Poke said:
This is great, thanks for your contribution!
So does the integrity check call only have to do with access to the secure element? Or does it also eliminate the need to spoof device model for compatibility purposes?
Click to expand...
Click to collapse
It is just for the secure element. You can modify the wallet apk to bypass things like root checking, model versions, and carrier checks as well. It looks like the xposed framework patch that has been floating around does some of this, but it doesn't seem to patch the calls to read the device properties for device ID and such.
In my testing, I was able to replace all of those calls in the wallet app with constant strings containing "valid" values. This would kind of suck to have to do for each update... Though It would be a simple enough matter to write a script to do this automagically for each update. (Baksmali, sed/awk to find and replace in the smali, and smali to classes.dex) or write an xposed module to watch for calls to read prop values originating from wallet.
Sent from my GT-I9505G
Fenny said:
It is just for the secure element. You can modify the wallet apk to bypass things like root checking, model versions, and carrier checks as well. It looks like the xposed framework patch that has been floating around does some of this, but it doesn't seem to patch the calls to read the device properties for device ID and such.
In my testing, I was able to replace all of those calls in the wallet app with constant strings containing "valid" values. This would kind of suck to have to do for each update... Though It would be a simple enough matter to write a script to do this automagically for each update. (Baksmali, sed/awk to find and replace in the smali, and smali to classes.dex) or write an xposed module to watch for calls to read prop values originating from wallet.
Sent from my GT-I9505G
Click to expand...
Click to collapse
I think that's what the existing Xposed Wallet hack modules do (watch for the read prop values originating from Wallet). But for whatever reason it won't intercept the calls on initial setup, which is why you have to actually change the build.prop prior to initially setting up Wallet.
Fenny said:
It is just for the secure element. You can modify the wallet apk to bypass things like root checking, model versions, and carrier checks as well. It looks like the xposed framework patch that has been floating around does some of this, but it doesn't seem to patch the calls to read the device properties for device ID and such.
In my testing, I was able to replace all of those calls in the wallet app with constant strings containing "valid" values. This would kind of suck to have to do for each update... Though It would be a simple enough matter to write a script to do this automagically for each update. (Baksmali, sed/awk to find and replace in the smali, and smali to classes.dex) or write an xposed module to watch for calls to read prop values originating from wallet.
Sent from my GT-I9505G
Click to expand...
Click to collapse
if you had time to add a how-to to bypass root checking, model version and carrier check, I'd update it every time. wouldn't be a problem and I'd be happy to help out.
mrvirginia said:
if you had time to add a how-to to bypass root checking, model version and carrier check, I'd update it every time. wouldn't be a problem and I'd be happy to help out.
Click to expand...
Click to collapse
Bypassing Root:
Look at the com.google.android.apps.wallet.security.EnvironmentProperty class in the constructor method.
We're looking for this segment containing SU_COMMAND_LOCATIONS:
Code:
.line 70
new-array v0, v4, [Ljava/lang/String;
const-string v1, "/system/bin/su"
aput-object v1, v0, v3
const-string v1, "/system/xbin/su"
aput-object v1, v0, v2
sput-object v0, Lcom/google/android/apps/wallet/security/EnvironmentProperty;->SU_COMMAND_LOCATIONS:[Ljava/lang/String;
Note: These variable names change (v3, v4, etc...), usually they will be the const/4 numbers defined at the beginning of the method. Just make sure you use the one that contains 0.
Change this line from v4 (which contains the number 2)
Code:
new-array v0, v4, [Ljava/lang/String;
to v3 (which contains the number 0)
Code:
new-array v0, v3, [Ljava/lang/String;
Then simply delete the following lines:
Code:
const-string v1, "/system/bin/su"
aput-object v1, v0, v3
const-string v1, "/system/xbin/su"
aput-object v1, v0, v2
This will Set the environment property SU_COMMAND_LOCATIONS as an empty string array which will cause the checkDevice function in Lcom/google/android/apps/wallet/security/EnvironmentProperty$1 to simply break out of it's for loop and return 0 (which is what we want).
Bypassing device/carrier restrictions:
Here is a quick script I whipped up to replace the build prop calls automagically.
Usage would be something like:
Baksmali the classes.dex in your apk:
java -jar baksmali.jar your.apk -o outdir
Run the script (below):
/path/to/pwnprop.sh outdir
Do whatever other changes to the outdir directory.
Then smali:
java -jar smali.jar outdir -o classes.dex
Finally, winzip, lol. (If you actually use winzip imma kill you.)
The script:
Save this as pwnprop.sh (or whatever you feel like) and chmod +x
Code:
#!/bin/bash
do_replace ()
{
case $3 in
# Replace these with whatever device you want to clone.
MODEL)
ours="Galaxy Nexus";;
BRAND)
ours="Google" ;;
BOARD)
ours=""tuna"
ID)
ours="JDQ39E" ;;
PRODUCT)
ours="yakju" ;;
DEVICE)
ours="yakju" ;;
FINGERPRINT)
ours="google/yakju/maguro:4.2.2/JDQ39/573038:user/release-keys" ;;
*)
echo "Replacement property not defined: "$3" in "$1
return ;;
esac
sed -i 's{sget-object '$2', Landroid/os/Build;->'$3':Ljava/lang/String;{const-string '$2', "'$ours'"{g' $1
echo sed -i 's{sget-object '$2', Landroid/os/Build;->'$3':Ljava/lang/String;{const-string '$2', "'$ours'"{g' $1
}
OIFS=$IFS; IFS=$'\n'
for line in `grep -ro "[v0-9]*, Landroid/os/Build;->[A-Z]*" $ | sed 's{, Landroid/os/Build;->{:{'`
do
IFS=':'
temparray=($line)
if [ ${#temparray[@]} -eq 3 ]
then
do_replace $line
fi
IFS=$OIFS
done
CPA Poke said:
I think that's what the existing Xposed Wallet hack modules do (watch for the read prop values originating from Wallet). But for whatever reason it won't intercept the calls on initial setup, which is why you have to actually change the build.prop prior to initially setting up Wallet.
Click to expand...
Click to collapse
I think it actually just replaces the function that checks, "Is this device id allowed?" But for the initial setup the strings in build prop are sent to google where they can reject them server-side.
when trying to run the script, i keep getting a syntax error
pwnprop.sh: line 2: $'\r': command not found
pwnprop.sh: line 3: syntax error near unexpected token `$'\r''
'wnprop.sh: line 3: `do_replace ()
i'm doing:
bash pwnprop.sh classes
classes is my "outdir"
edit: alright, i've converted dos2unix. now i'm just getting errors that the file doesn't exist. argh, oh linux.
edit: zip has been updated to no longer check for su binary. still needs a device/carrier bypass restriction removed...
Fenny said:
I think it actually just replaces the function that checks, "Is this device id allowed?" But for the initial setup the strings in build prop are sent to google where they can reject them server-side.
Click to expand...
Click to collapse
Gotcha, that makes perfect sense.
mrvirginia said:
when trying to run the script, i keep getting a syntax error
pwnprop.sh: line 2: $'\r': command not found
pwnprop.sh: line 3: syntax error near unexpected token `$'\r''
'wnprop.sh: line 3: `do_replace ()
i'm doing:
bash pwnprop.sh classes
classes is my "outdir"
edit: alright, i've converted dos2unix. now i'm just getting errors that the file doesn't exist. argh, oh linux.
edit: zip has been updated to no longer check for su binary. still needs a device/carrier bypass restriction removed...
Click to expand...
Click to collapse
Make sure you have the sed, echo, and grep utilities installed and in your path.
Sent from my GT-I9505G
Fenny said:
Make sure you have the sed, echo, and grep utilities installed and in your path.
Sent from my GT-I9505G
Click to expand...
Click to collapse
i finally figured out what the problem was. iirc, i was running it as root or something. had the same problem when i tried using the Kitchen again a week or two ago and got it sorted so i'll attempt to run this again [hopefully] over the weekend and give everyone a working Wallet regardless of device so they won't have to do silly tweaks anymore with build.prop etc. thank you again, sir.
oh, did you ever figure out the SIM unlock issue?
Causes NFC to FC on official 4.3 with full wipe. Oddly, it works with dirty flash. Ideas?
[Edit]
Never mind. It was just a bad signature.
@ OP: this NfcNci mod works on TW firmware MF8.
maanz said:
@ OP: this NfcNci mod works on TW firmware MF8.
Click to expand...
Click to collapse
Good to hear. Sounds like this is a new feature in Samsung firmware. Still makes me wonder if non-samsung devices suffer the same fate. The function call is the same no matter which implementation of NfcNci you are using, but I suppose that each vendor's implementation of the integrity checks by necessesity will differ.
Sent from my GT-I9505G
@Fenny looks like Superuser (unsecure) check was removed from newest Wallet release on the Google Play Store
mrvirginia said:
@Fenny looks like Superuser (unsecure) check was removed from newest Wallet release on the Google Play Store
Click to expand...
Click to collapse
That is great news. Much less work to be done on it then.
Keep up the good work! You guys are close, I can feel it! I would offer to help this weekend, but I think I would just slow you down.
Sent from my Galaxy Nexus using XDA Premium 4 mobile app
Please give credit if you use this in your ROM or MOD.
Decompile SecPhone.apk
Edit the following Smali.
SecPhone/smali/com/android/phone/PhoneGlobals$1.smali
Remove or Comment Out the following Lines in RED:
Code:
.line 738
:sswitch_c7
move-object/from16 v0, p0
iget-object v0, v0, Lcom/android/phone/PhoneGlobals$1;->this$0:Lcom/android/phone/PhoneGlobals;
move-object/from16 v17, v0
move-object/from16 v0, v17
iget-object v0, v0, Lcom/android/phone/PhoneGlobals;->notificationMgr:Lcom/android/phone/NotificationMgr;
move-object/from16 v17, v0
[COLOR="Red"]--invoke-virtual/range {v17 .. v17}, Lcom/android/phone/NotificationMgr;->showDataDisconnectedRoaming()V[/COLOR]
goto/16 :goto_27
.line 742
:sswitch_d8
move-object/from16 v0, p0
iget-object v0, v0, Lcom/android/phone/PhoneGlobals$1;->this$0:Lcom/android/phone/PhoneGlobals;
move-object/from16 v17, v0
move-object/from16 v0, v17
iget-object v0, v0, Lcom/android/phone/PhoneGlobals;->notificationMgr:Lcom/android/phone/NotificationMgr;
move-object/from16 v17, v0
[COLOR="red"]--invoke-virtual/range {v17 .. v17}, Lcom/android/phone/NotificationMgr;->hideDataDisconnectedRoaming()V[/COLOR]
goto/16 :goto_27
PLEASE DONT ASK FOR A FLASHABLE MOD, AS I DO THIS FOR MY HEAVILY THEMED JELLYBOMB ROM.
RESERVED
RESERVED
Well I for one appreciate it. Since I'm trying to keep knox 0x0 these mods you put out at least let me gain some needed functionality. Thanks again!
From my Note 3 using Tapatalk
Thread Closed, We Now have a Sticky for all GUIDES and HOW TO's.
That Thread is HERE!
Okay, alot of dev's/themers been looking for this one...
If you use, please give credit, I spent many hours finding this Mod... Dont take credit for someone else's work...
This Mod will allow you to change the Samsung KeyBoard Swipe Color..(SamsungIME.apk)
Look for:
smali\com\diotek\ime\framework\view\AbstractKeyBoardView.smali
Search for -> .method private setTracePaintOptionsWithSettings()V
Click to see Org Code
Code:
.method private setTracePaintOptionsWithSettings()V
.locals 5
.prologue
const/16 v4, 0xff
const/4 v1, 0x1
const/4 v3, 0x0
.line 9829
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePaint:Landroid/graphics/Paint;
if-nez v0, :cond_0
.line 9830
new-instance v0, Landroid/graphics/Paint;
invoke-direct {v0}, Landroid/graphics/Paint;-><init>()V
iput-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePaint:Landroid/graphics/Paint;
.line 9832
:cond_0
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePoint:Ljava/util/ArrayList;
if-eqz v0, :cond_1
.line 9833
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePoint:Ljava/util/ArrayList;
invoke-virtual {v0}, Ljava/util/ArrayList;->clear()V
.line 9835
:cond_1
iput-short v3, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePointCount:S
.line 9836
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePaint:Landroid/graphics/Paint;
invoke-virtual {v0, v1}, Landroid/graphics/Paint;->setAntiAlias(Z)V
.line 9837
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePaint:Landroid/graphics/Paint;
invoke-virtual {v0, v1}, Landroid/graphics/Paint;->setDither(Z)V
.line 9838
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePaint:Landroid/graphics/Paint;
const/16 v1, 0xa5
const/16 v2, 0xf3
invoke-static {v4, v3, v1, v2}, Landroid/graphics/Color;->argb(IIII)I
Click to see what to change:
Code:
.method private setTracePaintOptionsWithSettings()V
.locals 5
.prologue
const/16 v4, [B][U][COLOR="Blue"]0xff[/COLOR][/U][/B] [B][COLOR="seagreen"]Change for Alpha Value - "0xff" [/COLOR][/B]
const/4 v1, 0x1
const/4 v3, [B][U][COLOR="Blue"]0x0[/COLOR][/U][/B] [B][COLOR="seaGreen"] - Change for Red Value - "0x0"[/COLOR][/B]
.line 9829
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePaint:Landroid/graphics/Paint;
if-nez v0, :cond_0
.line 9830
new-instance v0, Landroid/graphics/Paint;
invoke-direct {v0}, Landroid/graphics/Paint;-><init>()V
iput-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePaint:Landroid/graphics/Paint;
.line 9832
:cond_0
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePoint:Ljava/util/ArrayList;
if-eqz v0, :cond_1
.line 9833
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePoint:Ljava/util/ArrayList;
invoke-virtual {v0}, Ljava/util/ArrayList;->clear()V
.line 9835
:cond_1
iput-short v3, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePointCount:S
.line 9836
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePaint:Landroid/graphics/Paint;
invoke-virtual {v0, v1}, Landroid/graphics/Paint;->setAntiAlias(Z)V
.line 9837
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePaint:Landroid/graphics/Paint;
invoke-virtual {v0, v1}, Landroid/graphics/Paint;->setDither(Z)V
.line 9838
iget-object v0, p0, Lcom/diotek/ime/framework/view/AbstractKeyboardView;->mTracePaint:Landroid/graphics/Paint;
const/16 v1, [B][U][COLOR="Blue"]0xa5[/COLOR][/U][/B] [COLOR="seagreen"]- Change for Green Value - "0xa5"[/COLOR]
const/16 v2, [B][U][COLOR="Blue"]0xf3[/COLOR][/U][/B] [COLOR="seagreen"] - Change for Blue Value - "0xf3"[/COLOR]
invoke-static {v4, v3, v1, v2}, Landroid/graphics/Color;->argb(IIII)I
So what it boils down to is that the Swipe Color is what we call RGB color coding. I suggest a site like this to see values you can use:
Hex to RGB Color converter
Thats it folks.. swipe color squashed!!!!
Verified to work on N3 KeyBoards
A Little clarification on Instructions.
I was swamped with questions on how to edit and such.. So with @strongsteve help we dug more and here is an easier way to get your colors instead of trying to use RGB values..
change code:
Code:
const/16 v1, 0xa5
const/16 v2, 0xf3
to
Code:
const v3, 0x33
const v1, 0x66
const v2, 0xcc
Then just use any normal Hex Color code you would normally use!!!
In the above example I used 3366cc which is DarkHorse Blue..
I hope that helps
Thanks been looking for this myself. Great job!
Sent from my SCH-I545 using XDA Premium 4 mobile app
This has been long sought after....thanks for this and great work my friend! :highfive::good:
ALL Users must be reminded to give credit for this share, as, unless I am mistaken, it is not too many other places!
Sorry... can someone post what those lines should look like once they have been changed to a diff color? I'm not sure exactly what in those lines I should be changing (I do understand the color codes).
Sorry for the noobish question.
TheCelt said:
Sorry... can someone post what those lines should look like once they have been changed to a diff color? I'm not sure exactly what in those lines I should be changing (I do understand the color codes).
Sorry for the noobish question.
Click to expand...
Click to collapse
You would be changing the codes themselves.
i.e ff or a5, or whatever...
I will write up more in a bit..
Gunthermic said:
You would be changing the codes themselves.
i.e ff or a5, or whatever...
I will write up more in a bit..
Click to expand...
Click to collapse
Thanks for clarifying the coding changes.... one last (what I am sure if dumb) question. where does one find that file. I am rooted and searched the device for both "smali" and "diotek" using ES file Explorer and have not found the file referenced above.
TheCelt said:
Thanks for clarifying the coding changes.... one last (what I am sure if dumb) question. where does one find that file. I am rooted and searched the device for both "smali" and "diotek" using ES file Explorer and have not found the file referenced above.
Click to expand...
Click to collapse
Its contained inside the SamsungIME apk itself. It has to be decompiled and MODed
Gunthermic said:
Its contained inside the SamsungIME apk itself. It has to be decompiled and MODed
Click to expand...
Click to collapse
Got it. Thanks Gunthermic. Much appreciated.
Credits goes to @sagitt67 and @daxgirl .
Credits for toggle goes to @tdunham main guide is here and @asc1977 for the guide here big thanks to them.
In this Guide we'll modify framework-res.apk and services.jar
framework-res.apk:
Download framework-res.zip that is attached below, extract and copy it in your decompiled framework-res.apk folder
now open res/values/arrays.xml
find <string-array name="config_globalActionsList"> and add blue
Code:
<string-array name="config_globalActionsList">
<item>power</item>
<item>datamode</item>
<item>airplane</item>
<item>restart</item>
<item>lockdown</item>
<item>bugreport</item>
<item>users</item>
[COLOR="blue"]<item>rebootsafestrap</item>[/COLOR]
<item>emergencymode</item>
<item>subscreen</item>
</string-array>
now go to res/values/strings.xml at very end and add blue
Code:
<string name="wifi_extender_notification_title">Wi-Fi extender on</string>
<string name="wifi_extender_notification_message">Tap here to set up.</string>
<string name="config_tspstate_threshold" />
[COLOR="blue"]<string name="tw_ic_do_restart_safestrap">Reboot Safestrap</string>[/COLOR]
</resources>
done with framework-res.apk recompile
Services.jar:
download services.zip that is attached below, extract and copy it in your decompiled services.jar folder
open smali/com/android/server/policy/GlobalActions.smali
add blue line in # instance fields
Code:
.field private mRestart:Lcom/android/server/policy/GlobalActions$SinglePressAction;
[COLOR="blue"].field private mRebootRecovery:Lcom/android/server/policy/GlobalActions$SinglePressAction;
[/COLOR]
.field mRestartIconResId:I
find .method private createDialog()Lcom/android/server/policy/GlobalActions$GlobalActionsDialog;
add blue
Code:
if-eqz v4, :cond_27b
const v4, 0x1080a58
.line 1642
:goto_11c
const v6, 0x104070e
.line 1639
move-object/from16 v0, p0
invoke-direct {v5, v0, v4, v6}, Lcom/android/server/policy/GlobalActions$21;-><init>(Lcom/android/server/policy/GlobalActions;II)V
move-object/from16 v0, p0
iput-object v5, v0, Lcom/android/server/policy/GlobalActions;->mRestart:Lcom/android/server/policy/GlobalActions$SinglePressAction;
[COLOR="Blue"]new-instance v4, Lcom/android/server/policy/GlobalActions$99;
move-object/from16 v0, p0
iget-object v0, v0, Lcom/android/server/policy/GlobalActions;->mContext:Landroid/content/Context;
invoke-virtual {v0}, Landroid/content/Context;->getResources()Landroid/content/res/Resources;
move-result-object v0
const-string v1, "tw_ic_do_restart_safestrap"
const-string v2, "drawable"
const-string v3, "android"
invoke-virtual {v0, v1, v2, v3}, Landroid/content/res/Resources;->getIdentifier(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)I
move-result v5
move-object/from16 v0, p0
iget-object v0, v0, Lcom/android/server/policy/GlobalActions;->mContext:Landroid/content/Context;
invoke-virtual {v0}, Landroid/content/Context;->getResources()Landroid/content/res/Resources;
move-result-object v0
const-string v1, "tw_ic_do_restart_safestrap"
const-string v2, "string"
const-string v3, "android"
invoke-virtual {v0, v1, v2, v3}, Landroid/content/res/Resources;->getIdentifier(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)I
move-result v6
move-object/from16 v0, p0
invoke-direct {v4, v0, v5, v6}, Lcom/android/server/policy/GlobalActions$99;-><init>(Lcom/android/server/policy/GlobalActions;II)V
move-object/from16 v0, p0
iput-object v4, v0, Lcom/android/server/policy/GlobalActions;->mRebootRecovery:Lcom/android/server/policy/GlobalActions$SinglePressAction;[/COLOR]
.line 1688
invoke-static {}, Lcom/samsung/android/feature/SemCscFeature;->getInstance()Lcom/samsung/android/feature/SemCscFeature;
move-result-object v4
const-string/jumbo v5, "CscFeature_Common_ConfigBikeMode"
invoke-virtual {v4, v5}, Lcom/samsung/android/feature/SemCscFeature;->getString(Ljava/lang/String;)Ljava/lang/String;
Now next part is tricky, add lines in blue and changes in green
Code:
const/4 v7, 0x1
move-object/from16 v0, p0
invoke-direct {v0, v6, v4, v5, v7}, Lcom/android/server/policy/GlobalActions;->addDialogItemsIfEnabled(ILcom/android/server/policy/GlobalActions$Action;Ljava/util/ArrayList;Z)Z
.line 1767
new-instance v4, Lcom/android/server/policy/GlobalActions$BugReportAction;
move-object/from16 v0, p0
invoke-direct {v4, v0}, Lcom/android/server/policy/GlobalActions$BugReportAction;-><init>(Lcom/android/server/policy/GlobalActions;)V
move-object/from16 v0, p0
iget-object v5, v0, Lcom/android/server/policy/GlobalActions;->mItems:Ljava/util/ArrayList;
[COLOR="blue"]const/16 v6, 0x100
const/4 v7, 0x1
move-object/from16 v0, p0
invoke-direct {v0, v6, v4, v5, v7}, Lcom/android/server/policy/GlobalActions;->addDialogItemsIfEnabled(ILcom/android/server/policy/GlobalActions$Action;Ljava/util/ArrayList;Z)Z
move-object/from16 v0, p0
iget-object v4, v0, Lcom/android/server/policy/GlobalActions;->mRebootRecovery:Lcom/android/server/policy/GlobalActions$SinglePressAction;
move-object/from16 v0, p0
iget-object v5, v0, Lcom/android/server/policy/GlobalActions;->mItems:Ljava/util/ArrayList;[/COLOR]
const/16 v6, [COLOR="Green"]0x200[/COLOR] [COLOR="Red"]#before was 0x100[/COLOR]
const/4 v7, 0x1
move-object/from16 v0, p0
invoke-direct {v0, v6, v4, v5, v7}, Lcom/android/server/policy/GlobalActions;->addDialogItemsIfEnabled(ILcom/android/server/policy/GlobalActions$Action;Ljava/util/ArrayList;Z)Z
now search for const-string/jumbo v4, "silent" and add blue line above it and green parts must match orange part
Code:
const-string/jumbo v4, "emergencymode"
invoke-virtual {v4, v11}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v4
if-eqz v4, :cond_381
.line 1835
move-object/from16 v0, p0
iget-object v4, v0, Lcom/android/server/policy/GlobalActions;->mItems:Ljava/util/ArrayList;
move-object/from16 v0, p0
iget-object v5, v0, Lcom/android/server/policy/GlobalActions;->mEmergency:Lcom/android/server/policy/GlobalActions$ToggleAction;
invoke-virtual {v4, v5}, Ljava/util/ArrayList;->add(Ljava/lang/Object;)Z
goto/16 :[COLOR="orange"]goto_2d9[/COLOR] #look that green part match this
.line 1836
:cond_381
[COLOR="Blue"]const-string/jumbo v4, "rebootsafestrap"
invoke-virtual {v4, v11}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v4
if-eqz v4, :cond_3da
move-object/from16 v0, p0
iget-object v4, v0, Lcom/android/server/policy/GlobalActions;->mItems:Ljava/util/ArrayList;
move-object/from16 v0, p0
iget-object v5, v0, Lcom/android/server/policy/GlobalActions;->mRebootRecovery:Lcom/android/server/policy/GlobalActions$SinglePressAction;
invoke-virtual {v4, v5}, Ljava/util/ArrayList;->add(Ljava/lang/Object;)Z
goto/16 :[COLOR="Green"]goto_2d9 [/COLOR]
:cond_3da[/COLOR]
const-string/jumbo v4, "silent"
next part is missing in Android 7 services.jar so we need to readd it for mod
find .method private addCustomDialogItems(Landroid/graphics/drawable/BitmapDrawable;Ljava/lang/String;Landroid/content/Intent;ILjava/util/ArrayListZ
add this above method
Code:
[COLOR="Blue"].method static synthetic access$500(Lcom/android/server/policy/GlobalActions;)Landroid/content/Context;
.locals 1
iget-object v0, p0, Lcom/android/server/policy/GlobalActions;->mContext:Landroid/content/Context;
return-object v0
.end method[/COLOR]
thats it, recompile and push to phone
Note: For me one time i get after reboot a loop of phone restarts, only one time happens. If it happen i solved it with wipe dalvik-cache and cache
Credits goes to @TheDriller for this part in this guide
Note: no need to change the code in GlobalActions$99.smali already done
GlobalActions$99.smali:
find .method public onPress()V and replace blue lines with red one
Code:
move-result-object v0
check-cast v0, Landroid/os/PowerManager;
[COLOR="Red"]const-string v1, "recovery"
invoke-virtual {v0, v1}, Landroid/os/PowerManager;->reboot(Ljava/lang/String;)V[/COLOR]
to
Code:
move-result-object v0
check-cast v0, Landroid/os/PowerManager;
[COLOR="Blue"]const-string v1, "su -c echo 1 > /data/.recovery_mode && su -c reboot now"
invoke-static {}, Ljava/lang/Runtime;->getRuntime()Ljava/lang/Runtime;
move-result-object v2
invoke-virtual {v2, v1}, Ljava/lang/Runtime;->exec(Ljava/lang/String;)Ljava/lang/Process;[/COLOR]
Wow thia makes things so much easier
Sent from my SM-G950U using Tapatalk
This is different on the Note 8 isn't it? I got as far as the services jar .method private createDialog()Lcom/android/server/policy/GlobalActions$GlobalActionsDialog; I input the blue text that was mentioned but I'm curious why in your sample does it not have .method private createDialog()Lcom/android/server/policy/GlobalActions$GlobalActionsDialog; before the blue text?
The Second batch of code with the green changes I had no idea where to input that and I couldn't find const/16 v6, 0x100 to change to 200 either
The step after that I was genuinely lost nothing matched what you had in your sample I felt like I was so close to getting it.
Thanks
SM-N950W
dillweedinc said:
This is different on the Note 8 isn't it? I got as far as the services jar .method private createDialog()Lcom/android/server/policy/GlobalActions$GlobalActionsDialog; I input the blue text that was mentioned but I'm curious why in your sample does it not have .method private createDialog()Lcom/android/server/policy/GlobalActions$GlobalActionsDialog; before the blue text?
The Second batch of code with the green changes I had no idea where to input that and I couldn't find const/16 v6, 0x100 to change to 200 either
The step after that I was genuinely lost nothing matched what you had in your sample I felt like I was so close to getting it.
Thanks
Click to expand...
Click to collapse
I will check them soon.
Maybe @JavixKGD can help you as he asked for the mod and he got it working on Note 8.
It is important to specify that this mod only applies to Nougat, it needs to be updated for Oreo.
I am using Nougat 7.1.1 on a note 8 sm-n950w with me's samfail firmware bl1 - I sent him a message thanks! I see it built into another firmware that is available but id rather build it into me's samfail firmy since there is some issues to be wrinkled out in the other custom firmwares.
This thread is more currently active than the Safestrap one. I'm just here looking for more information on how to flash ROMS while keeping your others. Like do I activate that slot then start flashing and do you know if it's possible to use Slick ROM as one of the slots? I'm rooted with Partcyborg on bootloader v2
xSl33p said:
This thread is more currently active than the Safestrap one. I'm just here looking for more information on how to flash ROMS while keeping your others. Like do I activate that slot then start flashing and do you know if it's possible to use Slick ROM as one of the slots? I'm rooted with Partcyborg on bootloader v2
Click to expand...
Click to collapse
Dont quote me on this but im pretty sure the slots arent 100% functional yet you can do backups and restore your system flash zips ect. , I know this thread is more active but you should really stick with the topic of the thread, your question would get answered there.
I got an answer from the guy you recommended afaneh92 thanks, it looks like I need to place the smalis in a different folder as they go over the limit, I dont have time right now but he also sent me his services .jar so I can see what the difference is I got some learning to do.
Thanks
Canadian Dilly.
dillweedinc said:
Dont quote me on this but im pretty sure the slots arent 100% functional yet you can do backups and restore your system flash zips ect. , I know this thread is more active but you should really stick with the topic of the thread, your question would get answered there.
I got an answer from the guy you recommended afaneh92 thanks, it looks like I need to place the smalis in a different folder as they go over the limit, I dont have time right now but he also sent me his services .jar so I can see what the difference is I got some learning to do.
Thanks
Canadian Dilly.
Click to expand...
Click to collapse
Im working on update and some fixes for the mod, then will rewrite this guide in the Note 8 section.