[MOD][XPOSED][OMAPI] Override SIM Secure Element Access Control - Xposed Framework Modules

Hi!
This module may be mainly interesting for developers. This module alone does nothing if not properly used together or within another app. Only use it if you know what you are doing.
Overview:
I created a Xposed module which overrides the Access Rule Checks within the SIMalliance Open Mobile API. These checks normally determine which app is allowed to access a SIM-card based Secure Element (SE) and which is not. Normally within the Secure Element (SIM card) there exists a special "Access Rule File" (also called "ARF") or a special card applet called "Access Rule Application Master" (also called "ARA-M") which has the AID A00000015141434C00) and (basically) contains application signatures and according access rules. So the maintainer of the Secure Element can define (and also update) the access rules with these mechanisms: which app is allowed to access the SE and which not. (see reference [1] for details below).
So while the access rules are securely stored in the hardware module (SE) the enforcement of these rules is done in software (within the Open Mobile "SmartcardService.apk"). And this is where this Xposed module hooks into. By using this module (or by integrating it into your app) you may access the SIM-card-based Secure Element with your app, even if the access rules within the SE would not allow it.
Here's the code:
https://github.com/johnzweng/XposedOMAPIOverrideSEAccessRules
This module does not globally disable the access rule checks but instead only grants full access to a single package name (app) which you manually have to define in code as TARGET_APPLICATION_PACKAGE_NAME.
More details and background story:
A few months ago the banks here in Austria started to roll out NFC-based tap'n'pay solutions which allow you to pay with your Android smartphone worldwide at every NFC-capable payment terminal. In contrast to Android Pay this is not a cloud-based software solution (using Host Card Emulation) but instead really uses a hardware-based secure element (like the chips used within EMV (chip'n'pin) plastic NFC banking cards). Austrian Banks decided to use Secure Elements located within the SIM-card (which is basically the same technology as your banking-card chip) so they don't need cooperations with all the phone manufacturers (and also not with Google), but only with the three mobile network operators (MNOs) here in Austria (which control all the SIM cards).
Unfortunately Google has not included an API in current Android which allows accessing SIM-card-based Secure Elements from an app (I guess they don't want banks and MNOs to develop their own independent payment solutions but instead want to push Android Pay). For this reason one of the largest smartcard manufacturers (Giesecke & Devrient - G&D) started to work on a third-party system API which is nowadays known as SIMalliance OpenMobile API (OMAPI). The SIMalliance is a group of industry players which want to push the use of Secure Elements in mobile phones. See also: Members of SIMalliance.
As this API is not part of official Android API the phone manufacturers (OEMs) have to include this API additionally on the phones. A lot of manufacturers do this already. You can check on your phone if this 3rd-party API exists by looking for these files:
/system/etc/permissions/org.simalliance.openmobileapi.xml
/system/framework/org.simalliance.openmobileapi.jar
/system/priv-app/SmartcardService/ (which hosts "SmartcardService.apk")
(and optionally in newer versions: /system/priv-app/UiccTerminal/)
As Google currently doesn't support this type of access to the SIM-card Secure Element you will not find this API on the Nexus phones. One exception was the Nexus 6 running Lollipop where Google included the SIMalliance Open Mobile API because they supported the Softcard (formerly Isis Mobile) wallet. After Google has acquired Softcard in 2015 they removed again the OpenMobile API from Nexus 6 in Android 6.
As I personally used a LG Nexus 5 and now use the Motorola Nexus 6 I started to work on integrating the Open Mobile API myself (which should be possible now on every phone since Android Lollipop (API level 21) as the TelephonyManager system class has got a few interesting new methods including one for sending APDUs over a logical channel to the SIM card: iccOpenLogicalChannel(String AID). As every phone running Android 5 or newer must implement this API you now can get the OMAPI working on every phone running Android 5 or newer (with minor restrictions). (Also the phone needs to have a special hardware wiring between the SIM card and the NFC chip - see "Single Wire Protocol" for details - to get a NFC payment working). But this is a different story which doesn't belong in this thread. For the interested, look at my Github repo which contains a fork of OMAPI working on unmodified Android versions (and two pre-built releases for OMAPI 2.05 and OMAPI 3.0 under the "releases" section - including a short How-To). This worked for me on a Nexus 5 and a Nexus 6.
But back to this topic:
After I had worked out the integration of OMAPI into Android 6.0.1 I finally was able to use tap'n'pay with my Nexus 6 using the banking card within my SIM card Secure Element. But as I am curious I was also interested in exploring my banking-card within the SIM Secure Element using a self-written app. This was when I realized that there is some kind of access control within the Secure Element which blocks my own test-app but not the app of my bank. (See reference [1] for details on these access rules.) To circumvent this I wrote this Xposed module and voilá, now we also have the possibility to talk with the Secure Element over OMAPI.
Final notes:
This Xposed module will only work if your device has the SIMalliance Open Mobile API (OMAPI) installed
This Xposed module may not work if the OMAPI on your device has been compiled using code obfuscation or was modified otherwise by your phone OEM (as the OMAPI is not part of official Android, every OEM may include its own version)
This Xposed module also may not work on other versions of OMAPI (it was tested with OMAPI v2.05 and should also work with OMAPI V3.0)
I hope this might be useful for someone. Have a nice day.
References:
[1] GlobalPlatform Device Technology - Secure Element Access Control (PDF)
[2] Open Mobile API specification - V2.05 (PDF)
[3] Open Mobile API specification - V3.0 (PDF)
[4] my Github repository for this Xposed module: XposedOMAPIOverrideSEAccessRules
[5] my Github repository with OMAPI fork for working on unmodified Android 5 or newer

I'm very impressed! Love your 'investigations'

I installed OMAPI 2.05 with adb on my xperia sp with cyanogenmod 13 (android 6.0.1).
After that I installed the elba-pay app, but it's not working. May you help me?

polo_joe said:
I installed OMAPI 2.05 with adb on my xperia sp with cyanogenmod 13 (android 6.0.1).
After that I installed the elba-pay app, but it's not working. May you help me?
Click to expand...
Click to collapse
Hi polo_joe:
This doesn't directly match the topic of this thread. But send me a PM then we can continue to communicate on a different channel (email, etc.). Most interesting would be a output of "logcat":
On your computer enter the command: "adb logcat -v time > logcat_debug.txt" in a terminal window then try to start the ELBA Pay app and afterwards look in the "logcat_debug.txt" logfile for errors.
john

androcheck said:
Hi polo_joe:
This doesn't directly match the topic of this thread. But send me a PM then we can continue to communicate on a different channel (email, etc.). Most interesting would be a output of "logcat":
On your computer enter the command: "adb logcat -v time > logcat_debug.txt" in a terminal window then try to start the ELBA Pay app and afterwards look in the "logcat_debug.txt" logfile for errors.
john
Click to expand...
Click to collapse
thanks, will do!

Related

[ROM][KVT49L] ArchiDroid [Carbon][Linaro][Stable][Flexible][Excellent][28/04/14]

Clean | Stable | Carbon | Flexible | Optimized | Excellent
-> ArchiDroid 2.X <-
Ported to the Galaxy Player 4.0
BIG thanks to @JustArchi
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Changelog
ArchiDroid 2.4.3
- Improved archidroid_pixelserv
# Previously archidroid_pixelserv responded to all requests with the same 1x1 NULLGIF response (GIF89a[]![])
# This was OK but in some apps it showed our gif in binary form (GIF89a[]![]) instead of showing nothing, i.e. in Subway Surfers game
# Now we respond with a "NULL" content proper for request
# If app requests JPG, we respond with NULLJPG, if app requests TEXT, we respond with NULLTEXT etc.
# This way app "gets what it wants" and won't show something, which it can't understand to user
# Surprisingly, at least Subway Surfers doesn't show any ad right now, so it also stops some apps from displaying NULL content, instead of showing NULL in binary form
- Removed VNC Viewer
- Updated ArchiDroid Backend tools (dnsmasq, haveged, dnsproxy2, pixelserv) to latest versions
- Updated PA GAPPS to 0417
- Used Carbon as base; Omni is maybe coming in future (if requested; this eventually needs much time)
Download
All Files Dev-Host
Experimentals on GitHub
Stable: ArchiDroid 2.4.3
Oldstable: ArchiDroid 2.X
Remember that you don't need anything else to flash. Google Apps are included already.
Known Issues
All known and unknown Carbon/CM bugs (if any)
Debian and adflash are not working yet (maybe we have to create a virtual ext4 partition cause of too little /data partition).
If this is working it's possible to modify adflash to fit my GitHub repository.
Follow (original) ArchiDroid On XDA!
Write A Review!
Rate the Official Thread!
Buy The Masterchief A Beer (he created this awesome ROM!!)
Like ArchiDroid On Facebook!
Hit Thanks!
Informations:
[ROM] [KVT49L] [OmniROM] [Linaro] [Stable] [Flexible] [Excellent] [20/04/14] ArchiDroid V2.4.3 | Power In Your Hands, a ROM for the Samsung Galaxy Player 4.0
Contributors
JustArchi
andreasltcf
ROM OS Version: 4.4.x KitKat
ROM Kernel: Linux 3.0.x
Based On: Carbon; ArchiDroid
Version Information
Status: Beta
Created 2014-04-28
Last Updated 2014-04-28
[SIZE="+3"]ArchiDroid's FAQ / Q&A (i9300)[/SIZE]​[SIZE="+1"]Remember.. This is the Galaxy Player 4.0 thread.. And based an Carbon.. It maybe differs from following information..[/SIZE]​
[SIZE="+1"]Features / Why ArchiDroid?[/SIZE]
First of all, ArchiDroid includes everything available in it's base. The whole point of ArchiDroid is to improve the base, without needing of making any trade-offs, so by flashing ArchiDroid, you're getting everything offered by the base itself. There's nothing to lose, everything to gain.
You can read detailed information about every ArchiDroid component here. It's a massive wall of text, so I'm only going to list the core features without describing them.
These were written from scratch, they're completely unique and you won't find exactly the same implementation in any other ROM.
ArchiDroid-Unique features:
- ArchiDroid's AROMA Installer
- ArchiDroid's Pocket Debian
- ArchiDroid's Flasher
- ArchiDroid's RunOnce
- ArchiDroid's Init
- ArchiDroid's Backend Control
- ArchiDroid's HArdware Volatile Entropy Gathering and Expansion Daemon (Haveged)
- ArchiDroid's Fast Random Number Generator (Frandom)
- ArchiDroid's Adblock (dnsmasq/dnrd, dnsproxy2, pixelserv)
- ArchiDroid's Forced Update
Apart from that, here, on the credits page, you can find all third-party projects, which have been implemented into ArchiDroid. In addition to that, it's up to YOU to decide if you want to install something, or not.
ArchiDroid focuses on flexibility and user choice.
If you're looking for fastest ROM, choose ArchiDroid.
If you're looking for most battery-saving ROM, choose ArchiDroid
If you're looking for cutting-edge functions, choose ArchiDroid
If you're looking for the most flexible rom ever created, definitely choose ArchiDroid
ArchiDroid adjusts to your needs. You can make it whatever you want. With bunch of presets, modes and questions, you can make your ArchiDroid behave. Check yourself why ArchiDroid is The TOP 1 ROM for Galaxy S3http://forum.xda-developers.com/galaxy-s3#romList, according to number of followers, rates, reviews and downloads count. Check the Reviews, take a look at Video Reviews, do whatever you want to, ArchiDroid is proven to be one of the best ROMs for Galaxy S3, ever created.
Try ArchiDroid once, and you'll never look back. I can assure you.
Disclaimer
Developer's Kitchen
Unless stated otherwise, all ArchiDroid components are licensed under the Apache License:
Code:
Copyright 2014 [email protected]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Especially:
ArchiDroid is one of the most complex ROMs ever created. When you start digging in my work, you can very easily get lost. And I'm not talking about base itself, but about everything next to it. You can use every part of my work, as long as:
1. You include proper credit where you should. This usually includes proper comment in a script/file and in the credits of the project, including license (if needed)
2. You let me know about this fact. Through PM on xda or e-mail
I'm always happy to help, especially with the problems I faced in the past. However I also want to be respected, considering that most of the ArchiDroid parts were written from scratch.
Know Your ArchiDroid
ArchiDroid is not only a rom. It's not only a baked android with third-party apps, modifications and tweaks. ArchiDroid is an universal backend which improves rom by many built-in functions.
Let me tell you a story. During developing first version of ArchiDroid 2.0 I experienced many problems, which were not that easy to solve. First of all - apps data. Trust me or not but you can't simply extract data, put it in /data/data after install and hope that it works. Android will detect such injection, report inconsistent of data and wipe everything attached to that. Okay so... How I should provide you with my boeffla preset? CoolTool settings? STweaks profile? If I put my data during flashing it'll get wiped. If I put my data and deny wiping it then Android will report inconsistent of data to user and work unstable. Yes guys, it's impossible to do so without a trick or without recompiling whole rom.
I won't tell you a whole story, because you probably don't want to hear about ArchiDroid development. I'll simply tell you that I overcome MANY difficulties, simply because I do what I like, and I like what I do. After countless number of hours, I can finally provide you with the ROM, which is the best. Why is it the best? Because I'm improving the base, and I'm not making any trade-offs.
GitHub / Versioning / Experimental Versions
You can easily "pack" latest experimental and flash without needing to wait for the next build. I'll tell you how to download and flash it by yourself.
[Newbie Version]
1. Open 2.X-EXPERIMENTAL branch.
2. Click on Download Zip button located in bottom-right corner.
3. Install 7-Zip if you don't have that already. Other programs may, or may not work correctly.
4. Right-Click on zip, select Extract Here
5. Navigate to newly created ArchiDroid-2.X-EXPERIMENTAL folder
6. Select all files WITHOUT __dont_include folder, right-click and select 7-Zip => Add to archive
7. Make sure that you have zip format, Fastest compression (to save some megabytes) and Deflate method of compression.
8. Voila, copy newly created ArchiDroid-2.X-EXPERIMENTAL.zip to your phone and flash as usual.
[Expert Version]
1. Install Git for Windows or Linux
2. If you're on windows then make sure that windows won't change LF into CRLF (git config --global core.autocrlf false)
3. Clone my git repository using .git file. Keep in mind to specify depth, as this repo is really big. (git clone https://github.com/andreasltcf/ArchiDroid.git --branch 2.X-EXPERIMENTAL --depth 1)
4. Select all files WITHOUT __dont_include folder zip them into standard .zip format with Deflate compression or without any compression.
5. Copy .zip to your phone and flash as usual
6. In order to update your local repo execute git pull origin 2.X-EXPERIMENTAL and go to point 4.
Additionally you can watch @JustArchi's short video, which shows how to flash experimental ArchiDroid going through "Expert Version" (Archi's GitHub).
ArchiDroid Features
Know your ArchiDroid, learn how to use it
Introduction / Basics
Welcome to ArchiDroid's world mortal. In this tutorial we will show you what ArchiDroid has "inside" and what it really offers. All of things included in this post are ArchiDroid-specific, which means that you won't find any ROM with the same features, as they're written from scratch.
Here you can find some definitions of the words used in sections below. You should know most of them, but in case somebody is lost here you can get back on track.
Terminal, Shell - Typical android shell, which may be obtained in three ways.
1. Through native Android Debug Bridge (ADB) with command "adb shell" from the PC or even "ADB through network" (if supported).
2. Through any Android terminal app, f.e. Android Terminal Emulator bundled with ArchiDroid.
3. Through secure shell daemon (sshd), which needs to be turned on firstly. This is extremely useful in terms of pocket debian, which will be described later.
You can use any of these methods to access android's terminal, however usually Android Terminal Emulator will be the easiest one, as it's android app bundled with ArchiDroid. WARNING! Most of the commands below WILL require root access. You can log in to super user shell by "su" command right after obtaining shell. If you're unsure if you're logged as root or not, "whoami" command should print actual user, "root" or "unknown uid 0" are OK, others are not.
ArchiDroid's Pocket Debian
From wikipedia:
From debian site:
How exactly this covers our beloved SGS3 (and countless number of other android arm-based phones)?
As you may (or even should!) know, Android operates on it's own Linux-based kernel. Android's kernel is literally a fork of Linux kernel, with a few special/unique functions which are required, mostly hardware-specific. Because of that kernel itself is VERY compatible with everything based on Linux.
However there have always existed one typical problem, lack of proper environment. We have a great kernel, great power, linux-based android environment, but this environment lacks of very common and required libraries/binaries. If you ever wondered what is or what does busybox, this is the answer. Busybox is just a small package which offers a few standalone GNU/Linux binaries, which are required to make certain things work. For example, swap priorities. Android knows what swap is, and nothing else. It doesn't know that swap could have a priority, so if you use android's swapon command on 4 devices, it will firstly fill first device, and then proceed to the next. That's why we need busybox in ALL custom kernels, because android environment isn't enough.
However busybox sometimes isn't enough. If we focus only on Android itself, it is. But if you for example want to run stricly linux-based service, I don't know, a web server for example... Is it possible to run a native linux web server on an android? No, it's not. You should firstly compile such service on arm architecture, including all dynamic and static libraries (wrrr ) in it only to finally get mad because of missing libraries or other dependencies. Of course if you're patient you'd finally compile everything and set up, however how long would it take? A few days maybe? If you're skilled in what you're doing...
This is why I included built-in "pocket" debian in ArchiDroid. It's FULLY compatible with everything compiled/based on armhf/armel GNU/Linux architecture, for example Raspberry Pi. With two easy commands you can literally jump into debian environment and use every typical GNU/Linux utilities known from debian itself. Of course this means nothing for most of the users, because they'll never have any reason to use such debian environment but from the developer side, it's big step forward. The best example is with github. As you know ArchiDroid has it's own repo on github, from where you can download/manage stuff. There also exists git app for linux and windows. If you want to follow "expert" way of flashing experimental ArchiDroid version, such program is required. The scenario is the same as compiling web server for an android, it requires much more effort than it's worth. And even then you can end up with syncing external dependencies and searching for solutions for the problems you've never seen before... And with ArchiDroid's pocket debian? It's as simple as in any debian/ubuntu distro. "apt-get update && apt-get install git" and voila. Your git is installed and ready for work. Going further I've even included git in pocket debian itself. Okay, I have debian, I have git, and what next? With git utility I can for example provide you with delta updates for ArchiDroid! ArchiDroid can easily use pocket debian to set up and sync ArchiDroid's repository and then pack and flash latest version without even needing of a PC, using 7-zip or anything else. Another example? A web server. I know that it's very dev-specific but if you for any reason need a web server running, just for example to test simple website, you can have it with just one command. Going further, VNC? MySQL server? PHP? Python? Perl? Ruby? Maybe conditional tasks with cron? Persistent minimal IRC client? rtorrent with rutorrent GUI over WWW? The list goes on... Anything based on linux will work. You can even host a server for your favourite game, as long as it has armhf/armel binaries (unfortunately most of the games don't).
So that's it. In short, debian is an operating system built-in in ArchiDroid to provide you with (unfortunately missing) GNU/Linux environment, with full power, ready to handle anything you could request. I made my best to include fully working debian in ArchiDroid for a minimal cost. Whole OS is packed in one big tar file, compressed using highest bzip2. As for now pocket debian has ONLY 40 megabytes of size, maybe in future it will have up to 50 megabytes, but no more. It's a VERY small cost for having such great power, especially if you know how to use it.
This is a really cutting-edge feature, mostly because I have no limitiations what I can include in my ROM right now, and while other developers are dealing with OpenDelta updates and many Android-based problems, I'm just launching my pocket debian and manages linux stuff.
I'm SURE that most of the advanced ArchiDroid user will just LOVE this feature, as much as I love it. I'm looking forward to your responses how YOU use pocket debian with your ArchiDroid. It's also a great time to learn what does the debian offer and how you can simplify your common tasks with just one example debian utility .
Technical informations:
1. Pocket Debian does not cause any additional overhead. We don't need to use emulation, neither virtualization to boot our monster. I used chroot technology to "jump" into debian environment with already running kernel and Android. That means additional required CPU/RAM is based on what you run in pocket debian. Booting itself doesn't require anything, just about one megabyte of ram for /bin/bash shell .
2. Android has some restrictions, mostly sockets. It doesn't allow to create inet sockets by default, even for root users. You will need to add your custom debian users to special group called "inet" (GID 3003) to allow creating of inet sockets, and you may also need to add a group to net_raw group (GID 3004) to allow creating of raw sockets. Please keep in mind that it's only required if you're running an app which required it's own socket, for example mysql server. So apt-get install mysql-server will fail right after booting, you will need to use "addgroup mysql inet" and then apt-get -f install to complete installation. Of course "mysql" is the new user under which mysql-server really operates. I've added root to both of these groups by default.
3. The only "real" restriction is the kernel. Our debian uses Android kernel and it's filesystem. It should work with most common tasks but in some cases our kernel may lack specific modules or built-in code, for example tun/tap required for OpenVPN. Still it's enough to run pretty much everything and if you get in touch with your favourite kernel developer you can also kindly ask for specific missing things.
4. Debian is built and included thanks to debootstrap utility, ArchiDroid command used for creating debian environment is debootstrap --verbose --arch armhf --include=git,ca-certificates,ssh,htop,tightvncserver,xterm,xfonts-base --exclude=manpages,man-db,rsyslog,vim-common,vim-tiny testing debian http://ftp.fr.debian.org/debian
HowTo:
Pocket Debian contains two main terminal commands, "adlinux" and "debian". Both of them are described below. By adlinux and debian you boot and jump into debian's chroot, which means you can use any debian-specific commands.
Examples:
passwd - changes password of actual user. This is needed to login as specific user, for example through ssh.
service ssh start - starts local SSH (secure shell) daemon on native port :22, to which you can easily access via any client supporting ssh, f.e. PuTTY. So basicly after you start shell you can literally connect to your local area network (LAN) IP on port 22 f.e. through PuTTY from your PC.
ifconfig - prints network-related informations about online interfaces, including your local IP, which may be useful for connecting to SSH.
htop - Enhanced top utility. Gives you very good terminal-based view on actual running processes, used ram, load, and more.
apt-get update - Syncs with debian's apt repository. This is mandatory to use many of apt commands because ArchiDroid's debian comes without local repo available, however fully configured to download and access it with just one command
apt-get install XXX - installs packet XXX from debian's repository.
apt-cache search XXX - searches for all packets including keyword "XXX". Ultra useful in terms of searching for specific packet.
Please note that pocket debian is VERY similar to normal native Debian/Ubuntu distribution, therefore above commands are not ArchiDroid's magic, they're very widely used in Debian/Ubuntu distros. If you want to learn more, most of the Debian/Ubuntu tutorials will be very helpful.
ArchiDroid's Pocket Debian Booter (adlinux)
You can call "adlinux" command from your favourite terminal.
adlinux is designed to boot and prepare ArchiDroid's Pocket Debian environment. It requires mode to be specified, and also respects any extra arguments passed.
If you call standalone "adlinux" command then it will print usage and then ask you what you want to do with giving proper informations about every choice. Additionally if you know what you want to do, you can also pass arguments directly to adlinux command, f.e. by executing "adlinux default", which will execute adlinux with "default" mode.
Available modes:
default - Will mount /data /system /storage/sdcard0 /storage/sdcard1 and core filesystems in chroot. Default suggested mode
safe - Will mount only core filesystems in chroot. Useful if you don't want to share your storage in chroot
bare - Won't mount even core filesystems such as /proc /dev or /sys. Requires "debian force" to enter chroot. This is the "real" safe mode. You won't be able to interact with an android in any way, while debian itself will work in very limited environment, making core functions unavailable. Suggested only for testing purposes
rebuild - Will automatically reboot your device and remove debian folder in the safe way. WILL CAUSE ALL DEBIAN DATA TO BE LOST!
unmount - Will automatically reboot your device to safely unmount debian environment
Extra options:
extsd - Use external sd card (/storage/sdcard1 /storage/extSdCard), if possible
intsd - Use internal sd card (/data/media/0)
Additional information about modes:
Debian shares core kernel filesystems in "safe" and "default" modes, while it also shares your internal and external sd card in "default" mode. This is nothing to be scared of, as you have full control of what you run in debian, however please note that you CAN'T do whatever you want. All mounted partitions in debian are "binded". "Bind" means that it's mirrored to the mount point and all changes on mounted partition WILL affect the mount point, which is logical. This is nothing to be scared of, as long as you know that debian only extends your environment, it does not fully works in it's own and you CAN cause serious problems from inside of chroot. The only really safe mode is "bare" mode, however in "bare" mode debian can't really do anything, as kernel filesystems are absolutely required for most of the functions. Okay so, you need to know one thing. If you have booted debian you SHOULD NOT touch debian's folder, which is ArchiDroid/debian (on your internal or external sd card, depends what you choosed).. As you know debian for example binds /data to it's folder /data, which is physically ArchiDroid/debian/data. If you for example delete ArchiDroid/debian through root explorer WITH mounted debian then it will ALSO delete debian/data folder, which is binded to /data, and therefore will delete your whole internal sd card, that's why it's extremely important to take care because booted debian becomes part of the android and deleting it can cause at least soft bricks, with a possibility of hard as well. If you want to delete debian folder PLEASE use "rebuild" mode, only through this way you're absolutely sure that nothing bad happens and you won't delete your whole system partition by accident.
Note about extsd option:
Debian requires symlink functionality, typically native windows filesystems DON'T support symlinks, therefore you need to have your external sd card formatted in one of the native linux filesystems, f.e. ext4. adlinux will automatically tell you if debian can be unpacked and used on your external sd card, however it won't be possible under most common filesystems, such as exFAT or FAT32.
Technical informations:
1. Pocket debian archive is located in ArchiDroid/System/debian.tar.gz file. This is "bare" system used for creating environment for the first time, you should not touch it.
2. adlinux detects if debian is already extracted when booting, if not, it's firstly extracted from the file described above.
3. After extracting (if required), core filesystems are mounted with "bind" option based on the mode you've selected in "mode" question above. Typically it mounts /data /system /storage/sdcard0 /storage/sdcard1 /storage/extSdCard /dev /proc /sys.
4. Unmounting is not fully supported right now (linux barrier), therefore both "unmount" and "rebuild" options require a restart to execute properly.
ArchiDroid's Pocket Debian Shell/Chroot (debian)
You can call "debian" command from your favourite terminal.
debian command is designed to allow you "jumping" into debian chroot created by adlinux. Please read how adlinux command works firstly if you haven't done that already. debian command checks if core filesystems are available (if debian is booted), and if they are then it firstly modifies required environment variables to make debian happy (such as TERM, HOME, PATH), then it changes root (chroots) into debian folder, therefore allowing you to execute everything from inside of chroot. It's very generic command, therefore standalone "debian" command won't give you a choice the way adlinux did.
Available options (parameters):
force - required for jumping into bare debian, created with "adlinux bare" command above. This skips debian checks for mounted core filesystems, normally you should avoid it at all cost, unless you know what you're doing. If core filesystems are missing then it's very likely that your debian will be disabled in more than 90%.
extsd - Use external sd card (/storage/sdcard1 /storage/extSdCard), if possible
intsd - Use internal sd card (/data/media/0)
cmd - Executes command in debian chroot
WARNING! cmd parameter will cause all further parameters to be threated as a command passed to debian, therefore you need to make sure that this is the last debian parameter which you want. For example "debian force cmd service ssh start" will skip filesystems checks and execute "service ssh start" in debian's chroot, however "debian cmd force service ssh start" will pass "force service ssh start" to debian, therefore respecting filesystems checks and passing invalid command.
This function is extremely useful for making init.d and other startup scripts. For example you can easily call "adlinux default" and then "debian cmd service ssh start" to call secure shell daemon on every boot with two easy steps.
Technical informations:
1. debian command uses chroot technology to change root of current shell to debian shell.
2. After chrooting to debian directory, /bin/bash shell is automatically called as default debian shell.
ArchiDroid's Flasher (adflash)
You can call "adflash" command from your favourite terminal.
adflash is a great small utility, which allows you to easily update your ArchiDroid to latest stable or experimental version with one easy command and delta upgrade. It utilizes ArchiDroid functions, therefore you must be running ArchiDroid to use it.
If you call standalone "adflash" command then it will print usage and then ask you what you want to do with giving proper informations about every choice. Additionally if you know what you want to do, you can also pass arguments directly to adflash command, f.e. by executing "adflash 2e git", which will execute adflash with 2.X-EXPERIMENTAL version using git mode.
Available versions:
2e - 2.X-EXPERIMENTAL
2s - 2.X-STABLE
1e - 1.X-EXPERIMENTAL
1s - 1.X-STABLE
Extra options:
git - Sets up local git repository, which gives you delta upgrades and bandwidth saving
direct - Downloads targeted branch as .zip file directly from github
clean - Cleans everything up, including local repo and tmp folder from ArchiDroid directory specified below
extsd - Use external sd card (/storage/sdcard1 /storage/extSdCard)
intsd - Use internal sd card (/data/media/0)
nozip - Shows changelog and changes only
Okay so, the most interesting option is the mode...
Direct mode is simple, fast and effective. It downloads target version (stable or experimental) from GitHub server, then it repacks downloaded zip file and makes it available for flash. You should use this mode for one-time downloads, such as once per stable version or two. The only advantage of this method is the ability to download from github (and with one command).
Git mode is complex. It uses ArchiDroid's Pocket Debian (read above) for cloning and updating local ArchiDroid repo. This gives several number of advantages, mostly for using experimental versions. Firstly, by having local ArchiDroid repo you have to download ONLY changes between your snapshot and server's snapshot, which means delta upgrades. Secondly, you have access to all commits from target branch, so you know exactly what has changed since your latest download. Again, this is extremely useful for experimental branch, as changelog may not be up-to-date. Keep in mind that git mode will require additional space on your device for keeping ArchiDroid repository, therefore you sacrifice some space for delta upgrades. This mode is extremely useful for flashing ArchiDroid often, for example daily experimental versions, because in fact you download only new commits instead of whole repo/archive.
ArchiDroid's RunOnce (Backend)
ArchiDroid's Init (Backend)
ArchiDroid's Backend Control
ArchiDroid Backend Control is a set of settings, which controls behaviour of ArchiDroid's Init. It's located in /system/archidroid/dev and contains a number of files, which are recognized by ArchiDroid's Init. You shouldn't directly touch /system/archidroid/dev, instead you can control behaviour of ArchiDroid's Backend through /system/archidroid/scripts. They can be easily executed through any script manager, f.e. Root Browser or Android Terminal Emulator. Some of the settings are also located in /system/archidroid/etc folder, mostly configurations for binaries utilized by ArchiDroid's Init.
ArchiDroid's HArdware Volatile Entropy Gathering and Expansion Daemon (Haveged)
The haveged project is an attempt to provide an easy-to-use, unpredictable random number generator based upon an adaptation of the HAVEGE algorithm. Haveged was created to remedy low-entropy conditions in the Linux random device that can occur under some workloads, especially on headless servers. Current development of haveged is directed towards improving overall reliablity and adaptability while minimizing the barriers to using haveged for other tasks.
The original HAVEGE research dates back to 2003 and much of the original haveged documentation is now quite dated. Recent work on haveged has included an effort to provide more recent information on the project and its applications.
The original research behind HAVEGE use was based upon studies of the behavior of processor caches from a hardware level. The 'Flutter' documents attempt to provide a modern view of HAVEGE at software level through the use of a diagnostic build of haveged that captures the non deterministic inputs to haveged for analysis by external tools.
ArchiDroid has built-in haveged entropy generator. It's controlable through ArchiDroid's Backend Control - ArchiDroid_Haveged_EnableDisable.sh. It's turned on in default configuration, through HAVEGED_ENABLED
ArchiDroid's Fast Random Number Generator (Frandom)
Frandom is a Linux kernel random number generator, which is 10-50 times faster than what you get from Linux' built-in /dev/urandom. And it uses very little (/dev/frandom) or none (/dev/erandom) of the kernel's entropy pool, so it is very useful for applications that require a handy source for lots of random data.
ArchiDroid has built-in frandom activator. It's controlable through ArchiDroid's Backend Control - ArchiDroid_Frandom_EnableDisable.sh. It's turned on in default configuration, through FRANDOM_ENABLED.
Notice: Kernel must support frandom module to actually make use of that. Init will try to search for frandom.ko module and load it, then use /dev/erandom for both /dev/random and /dev/urandom. If your kernel supports frandom, it will work. If it doesn't, obviously this will be skipped even if you have FRANDOM_ENABLED. Check ArchiDroid Init log located in /data/media/0/ArchiDroid/Init.log to check if frandom works properly for you.
ArchiDroid's Adblock (dnsmasq/dnrd, dnsproxy2, pixelserv)
dnsproxy2 is a replacement DNS proxy for Android 4.3+
This currently allows the user to manually override the DNS server IP,
and it sets the correct UID on outbound requests so they can be filtered
via iptables / AFWall+ / DroidWall / etc.
Dnsmasq is a lightweight server designed to provide DNS, DHCP and TFTP services to a small-scale network. It can serve the names of local machines which are not in the global DNS. The DHCP server integrates with the DNS server and allows machines with DHCP-allocated addresses to appear in the DNS with names configured either in each host or in a central configuration file. Dnsmasq supports static and dynamic DHCP leases and BOOTP for network booting of diskless machines.
Dnrd, Domain Name Relay Daemon is a caching, forwarding DNS proxy server. Most useful on vpn or dialup firewalls but it is also a nice DNS cache for minor networks and workstations.
Pixelserv is a super minimal webserver, it's one and only purpose is serving a 1x1 pixel transparent gif file. Using some creative firewalling (netfilter/iptables) rules you can redirect some webrequests (for adds for example) to pixelserv.
ArchiDroid has built-in Adblock. It's controlable through ArchiDroid's Backend Control:
ArchiDroid_Adblock_DnsmasqDnrdModeSwitch.sh
ArchiDroid_Adblock_EnableDisable.sh
ArchiDroid_Adblock_EnableDisableLocalDNSes.sh
ArchiDroid_Adblock_EnableDisableLocalDNSesDaemon.sh
ArchiDroid_Adblock_LockUnlockHosts.sh
ArchiDroid_Adblock_MoabAdawayHostsSwitch.sh
ArchiDroid_Adblock_Reload.sh
It's turned on in default configuration, through:
ADBLOCK_ENABLED
ADBLOCK_LOCAL_DNSES_DAEMON_ENABLED
ADBLOCK_LOCAL_DNSES_ENABLED
ADBLOCK_USE_ADAWAY_HOSTS
ADBLOCK_USE_DNSMASQ
In short. This is a very advanced and powerful solution for blocking ads through DNS queries. First of all we're forwarding all DNS traffic to localhost (127.0.0.1). Then we're handling them through local DNS server - dnsmasq (default), or dnrd (option). Our local DNS server reads blocked hostnames through special /system/archidroid/etc/hosts file, then if no record is found, it forwards DNS query to OpenDNS/Google DNS servers, or if it's found, returns 127.0.0.1 as the address. Lastly, pixelserv is providing a 1x1 NULLGIF response on local web server, so instead of big black/white screen instead of the AD, we get 1x1 transparent pixel, which usually perfectly hides ad from the app or the website.
Extra features:
1. You can specify if you want to use dnsmasq (default), or dnrd (option) as a local dns server. Dnsmasq is more flexible, modern, faster and has less memory footprint, however I also left dnrd as an option, because it's proven to work stable.
2. You can specify hosts file, which you want to use. In default configuration we use AdAway's hosts file, with more than 30 thousand of records, which results in extra ~2.5 MB memory usage. You have also an option to use MOAB (Mother Of Ad Blocking) hosts file, with more than 330 thousand of records, which will result in about ~30 MB memory usage. Eventually you can append your own rules or use non-standard hosts file, available in /system/archidroid/etc/hosts. Pro tip: You can point AdAway to use this hosts file (/system/archidroid/etc/hosts_adaway), which will result in automatic updates. /system/archidroid/etc/hosts is a symbolic link, either to hosts_away or hosts_moab, if you want to specify your own hosts, you can delete symbolic link and write your own rules.
3. Original /system/etc/hosts file has been locked from editing. This is to ensure that AdAway or other adblockers won't use obsolete and slow method of blocking ads through hosts. The whole point of implementing Adblock in ArchiDroid is to provide you with super-fast, flexible and effective way of blocking ads, also with getting rid of black/white ad screen. In 99% situations you don't want to touch ArchiDroid's default behaviour, as it blocks ads perfectly. Eventually, if you have a very good reason, you can unlock original hosts file through ArchiDroid's Backend Control and modify them, however keep in mind that every additional rule WILL slow down your network speed.
4. In default configuration local dns server uses two OpenDNS servers at port 5353, two Google DNS servers at port 53 and up to two local DNS servers provided by your Wi-Fi/3G connection, which overall gives a sum of 6 remote dns servers. In some rare scenarios (f.e. some wi-fi hotspots) you can notice that a moron, administrator of this wi-fi, blocked all dns queries and forces you to use his DNSes. This is BAD because of freedom and so on, but it's very common practice, that's why I turned on local DNSes as well. If you want to improve your privacy at least a bit, you can disable local DNS servers and then use only OpenDNS and Google DNS.
5. Above option initialy has been written to allow you one-time access to such non-trusty wi-fi's. But if you for any reason need automatic update of your local DNSes (3G and Wi-Fi's will use different local DNSes), you can also turn on Local DNSes Daemon, which will automatically query and update local DNSes if needed. This is also turned on in addition to local dnses above, of course in default preset.
ArchiDroid's Forced Update (RunOnce)
Forced update selected during mode selection in aroma tells RunOnce to work in "INSTALL" mode even on "UPDATE" mode, apart from that it works exactly the same as update mode, only RunOnce is affected.
Credits
ArchiDroid Core
- AROMA Installer
- AROMA Filemanager
- PhilZ Touch Recovery
- SuperSU
- Nova Launcher
- TouchPal Keyboard
- Hacker's Keyboard
- Android Terminal Emulator
- BetterBatteryStats
- Cool Tool
- Greenify
- MX Player & Custom Codec
- LMT
- Root Browser
- Titanium Backup
- CrossBreeder
- Online Nandroid
- Xposed Framework
- App Settings
- XPrivacy
- Debian
- cURL
- GitHub
ArchiDroid 2.X
- Carbon Rom
- Linaro Toolchain
- Impulse Kernel
- Spirit 2
Special thanks to:
- @JustArchi for creating ArchiDroid icluding all it's optimizations, a helpful hand to make this possible and his AWESOME SCRIPTS + documentation inside them.. really.. this guy is able to do ALL with scripts..
- @zaclimon for his work on our device with its own very little but awesome community, Impulse kernel, his sources for building and again all his contributions for our device..!!
- Kenshin, for graphic design and ArchiDroid Touhou bootanimation
- @mrtur, for graphic design and helpful hand during ArchiDroid experimental tests
- @malachow, for helping users across both international and polish board, sharing the spirit of ArchiDroid
- All ArchiDroid Contributors, for improving and making ArchiDroid better!
- ArchiDroid Facebook Group, for beta-testing the very first alphas of ArchiDroid 2.0.0
- ROM Cleaner, for awesome generic list of bloatware
- Android Revolution HD, for being ex-ArchiDroid 1.X base
- WanamLite, for being ex-ArchiDroid 1.X base
- Temasek's Unofficial Build, for being ex-ArchiDroid 2.X base
- crDroid, for being ex-ArchiDroid 2.X base
- You, for choosing ArchiDroid over other available ROMs
Nice to see it here as well, good luck with the port .
okay.. if anybody out there using this rom.. pocket debian is working fine.. (img on external sd).. have to write the scripts to do it all automatically..
edit: ups.. have to upload the rom first.... but if there's any interest in this.... btw if you're using carbon just now.. you'll love this rom..
I think people would be interested... I would be interested in trying it out once I get more time on my hands, maybe use it as a daily driver if it fits my needs.

[Q] Editing Android Kernel - HCE/NFC

I'm currently in the process of creating a custom version of AOSP that will edit the functionality of the Host-Card Emulation feature of Android, allowing me to manually set the AID produced when my device goes into emulation mode.
I've downloaded the Android source, and have located the files I think governs HCE functionality.
From the NFC System Service, I've located the following files:
"CardEmulationManager.java" and "HostEmulationManager.java" located in "/aosp/packages/apps/Nfc/src/com/android/nfc/cardemulation/"
And from the Android core framework, for the NFC API I have found:
"CardEmulation.java" located at "/frameworks/base/core/java/android/nfc/cardemulation/CardEmulation.java"
From here, i'm unsure how to get started in editing the code. I'm unsure of the interactions between the files, and how they are called at run (I.e. which functions in the file I should be looking at, how would I go about adding my own code/modifying existing code in the file)
Is there any documentation online about how these files work/are ran? Or how would I go about finding out on my own (Through debugger tools etc.)
I'm currently using Eclipse for Ubuntu, and will be developing for a Nexus 7

[MOD][Xposed]Malware Buster 1.1

Malware Buster
Intro:
This is a Xposed module. It helps to prevent malwares to register service/receiver which were disabled in My Android Tools before.
Manual:
Use My Android Tools/3C Tools to disable service/receiver of your target Apps Install this module, enable it in Xposed Installer, you need to reboot device at the frist time. Check the target Apps you want to disable in Malware Buster UI.
Troubleshoot:
Look at log of Xposed Installer, many runtime information will be shown there.
Reference:
http://developer.android.com/refere...tEnabledSetting(android.content.ComponentName, int, int) https://android.googlesource.com/pl...va/android/app/ApplicationPackageManager.java Some UI codes come from https://github.com/rovo89/XposedAppSettings
Download Link:
http://repo.xposed.info/module/com.rexpress.xposed.malwarebuster
流氓终结者
介绍:
Android上有很多流氓App, 比如xx地图, xx输入法, xxx钱包, xx点评, 会注册一堆service和receiver常驻后台, 即使在App的设置里关掉各种推送也没用. 常见的方法是使用绿色守护. 对于高级用户来说使用My Android Tools/3C Tools, 可以更有效地关闭不必要的service和receiver. 可是这些顽固的App会在运行的过程中重新注册这些service/receiver, 而My Android Tools只是静态地禁用, 没有常驻进程, 无法检测是否被重新开启了. 本App的解决方案是使用Xposed Module, 通过Hook setComponentEnabledSetting方法, 改写参数为DISABLED, 让流氓App无法重新注册service/receiver.
使用方法:
使用My Android Tools/3C Tools禁用service/receiver 初次安装在Xposed Installer里勾选后需要重启 打开本App的界面, 勾选需要和谐的App
Reference:
http://developer.android.com/refere...ting(android.content.ComponentName, int, int)
https://android.googlesource.com/pl...va/android/app/ApplicationPackageManager.java
Some UI codes come from https://github.com/rovo89/XposedAppSettings
Download:
http://repo.xposed.info/module/com.rexpress.xposed.malwarebuster
Source Code:
https://github.com/twilightgod/MalwareBuster
? good thx for share
来自我的 LG-D802 上的 Tapatalk
This module really caught my eye but I can't find "my android tools". Is this app only available for specific devices or in some countries? Can you post a play store link to "my android tools"?
[size=-4]Sent from my Boeffla powered Slim (4.4.4) GT-I9300[/size]
https://play.google.com/store/apps/details?id=cn.wq.myandroidtools
bravo
nice and neat, thank you developer
Is it possible to enable this also for System Apps?
I can see in Amplify that Play Services tries to use Services I have disabled.
Thanks!
need help
@twilightgod Some instruction with details would really be nice. What does it do? Does it just stop the components from loading, shut them down, bypasses them, or what? I already use My Android Tools, awesome app.
I don't have a plan to hack system app, it's dangerous in my local test.
Google Services work well and costs not so much battery without GFW, disabling some of them while keeping basic functionality work will not help to your battery in if you don't have a stable way to get off GFW (like shadowsocks) in my experience.
Sorry, I didn't put much details in English.
The use case is, some apps will register service/receiver when it's running, so even if you disable bad service/receiver in my android tools, they will be registered again in next run, because my android tools will not run all the time in background.
This app will help to prevent them from registration.
Myandroidtools is flagged as malware/Trojan/PUP by 4 different virus scanners and together with appstart and agree to the permissions of the app is a script invoking "qihoo", searching for x86, x64 and a few more libraries on your device.
I seldom buy applications, but this one seemed fine before I got to know it.

[ROM] LineageOS for easy microG + UnifiedNlp [Nov 2] [Nougat & Oreo]

This is LineageOS built from official sources (cm14.1 and lineage-15.0 branches), featuring two patches that allow for Signature Spoofing and Network Location providers to be used outside of /system. These two conditions allow for easy installation of microG and related-services, along with the modular location provider platform UnifiedNlp.
I also include a few other extras (see ROM Features below), and experiment with things every now and then. Suggestions are welcome!
What is microG and UnifiedNlp? microG is a free re-implementation of Google's proprietary apps and libraries. UnifiedNlp serves as a replacement to Google Location Services and helps your device find its location (more info).
Benefits of microG and UnifiedNlp:
FLOSS
Lightweight
Modular
Can run with relatively-limited permissions
Improved device performance and battery life
Lower data usage
Faster GPS locks and better location accuracy
Significantly more control over privacy
No max-brightness bug (related to Google Location Services; when you wake the screen and it goes max-bright for a short period of time)
ROM Features:
Upstream up-to-date LineageOS builds
Location Providers can be installed outside of /system (intended for UnifiedNlp and allows microG to provide that)
Can toggle Signature Spoofing on or off for applications that can use it (intended for microG and FakeStore)
Native 493 DPI (see compatibility notes below)
Steven Black's Unified Hosts File built-in (gambling and fakenews filters)
Various Tweaks
Latest Nougat Version (recommended):
2017/10/31
Latest Oreo Version (testing):
2017/11/02
Older Versions:
Google Drive Archive
Instructions:
Can be found in the 2nd post down or by clicking here
Recommendations and Tips
Can be found in the 3rd post down or by clicking here
Known Issues
Can also be found in the 3rd post down or by clicking here
Reporting Problems and Issues
I'm not too knowledgeable in Android development and likely can't help directly with most ROM, kernel, and/or hardware issues
The best advice I can give is to post issues in this thread and hope others can share a solution, and/or report the issue upstream to LineageOS developers/maintainers if applicable
Changelog:
Nougat/cm14.1 (at the bottom of the page)
Oreo/lineage-15.0 (at the bottom of the page)
LineageOS shamu Changelog
Compatibility Notes:
The latest Nougat/cm14.1 version of this ROM passes SafetyNet (last checked: 2017/10/31)
The latest Oreo/lineage-15.0 version does not pass SafetyNet (last checked: 2017/10/29)
LineageOS and the default kernel support F2FS, however, the unofficial TWRP projects that support F2FS for shamu currently don't support F2FS decryption. Unless you know what you're doing, I suggest using a custom kernel with forced-encryption disabled if you want to have Data and Cache partitions with F2FS
493 DPI is used on this ROM. The default DPI for a Nexus 6 is 560. Some apps from Play Store may not show when the DPI is not set to an expected value. Theoretically, apps acquired from F-Droid and Yalp Store (when spoofing a N6) are not affected by this, but reports about this are welcome (a quick fix is wm density 560)
Other Notes:
This ROM should work fine with GApps, but I don't test this kind of set-up. If you choose not to use microG nor go GApp-less, I recommend using Open GApps
This ROM is signed with my key and the build type is userdebug
I use this ROM daily with microG and primarily to play Pokemon GO and Ingress; I should be able to notice any SafetyNet, location, or other issues quickly but all reports are welcome!
The patches and my notes for compiling (below) should be easily adaptable for any device capable of running LineageOS, or any ROM theoretically (change the Motorola manifest for other non-moto devices or remove it and supply your own vendor blobs if applicable)
Modifications Done:
Notes for Nougat/cm14.1
Notes for Oreo/lineage-15.0
Additional Support:
microG on xda-developers
UnifiedNlp on xda-developers
microG Website
microG Wiki
Other Resources:
How this ROM is built
My Nexus 6 configuration and other notes
Reddit guide for setting up microG + UnifiedNlp
Shadow53's notes on flashable zips for microG and Play Store, Google Cal/Contact sync, and other information
Shadow53's NO GAPPS initiative
XDA:DevDB Information
LineageOS for easy microG + UnifiedNlp, ROM for the Nexus 6
Contributors
espionage724
ROM OS Version: 7.x Nougat
ROM Kernel: Linux 3.10.x
Based On: LineageOS
Version Information
Status: Nightly
Created 2017-07-06
Last Updated 2019-01-06
Instructions
Initial Instructions:
Wipe device (TWRP -> Wipe all partitions and Format Data)
Flash ROM (copy the zip over to the Internal Storage of the N6 over USB)
Format Data and Cache to F2FS (optional; need a supporting TWRP; note you cannot decrypt F2FS-encrypted partitions in TWRP currently)
Flash GApps (optional; DO NOT do this if wanting to use microG)
Flash a custom Kernel (optional)
Flash Magisk (optional)
Reboot to System
Update Instructions:
Boot to TWRP
Flash updated ROM zip
Flash custom kernel (optional; but if you've used a custom kernel before, it'll be replaced with the default LineageOS one when you update; I recommend using the same kernel or an updated version of it)
Reboot to System
Core microG + UnifiedNlp Apps Package
This will provide the microG Services Core, Services Framework Proxy, DroidGuard Helper, NominatimNlpBackend, and MozillaNlpBackend APKs for convenience (these can also be downloaded from F-Droid)
These are the core applications needed to get the most out of microG and can be installed either over adb or just manually installed one-by-one on the phone
You will still need to read the instructions below in order to get things working
F-Droid will update packages as needed; no need to worry if the date on this package appears old
Compatible with both Nougat and Oreo builds
2017/10/31
microG Application Descriptions:
microG Services Core: Core services and UnifiedNlp (required)
microG Services Framework Proxy: Google Cloud Messaging (GCM) support
microG DroidGuard Helper: SafetyNet support
UnifiedNlp Application Descriptions:
NominatimNlpBackend: Looks up location based on geo-data (required)
LocalGsmNlpBackend: Notes cellular towers you connect to and refers to a local database (created from online sources) to determine location
LocalWifiNlpBackend: Scans nearby WiFi APs, links them to GPS coordinates, and stores them in a local database to determine location
Apple UnifiedNlp: Scans nearby WiFi APs and uses Apple's database to determine location
MozillaNlpBackend: Scans nearby WiFi APs and uses Mozilla's database to determine location (less work to set-up than LocalGSM and LocalWifi)
microG + UnifiedNlp Instructions:
Install F-Droid
Enable Unstable Updates (F-Droid Settings -> Expert mode -> Unstable updates; it's currently required to install the latest unstable microG Services Core)
Add the microG repository (visit https://microg.org/download.html)
Install the following: microG Services Core, NominatimNlpBackend, location backend(s) of choice, and other microG applications of choice for additional features (see the above list)
Enable Signature Spoofing for microG Services Core (Settings -> Apps -> ⚙ -> App permissions -> Spoof package signature)
Grant all permissions available for microG Services Core and location backend(s) of choice Settings -> Apps -> (application) -> Permissions)
Open microG Settings and enable desired features (if using Google SafetyNet, you must do ⋮ -> Advanced -> Use official server)
Configure UnifiedNlp Settings (check Nominatim from address lookup backends, and check desired location backend(s) under location backends)
Verify Self-Check has confirmation on all checks (UnifiedNlp being registered in system may require a reboot to start working)
Recommended microG + UnifiedNlp Packages:
Install microG Services Core, microG Services Framework Proxy, microG DroidGuard Helper, NominatimNlpBackend, and MozillaNlpBackend
If you want to run location resolution locally, install LocalGsmNlpBackend and LocalWifiNlpBackend instead of MozillaNlpBackend, or alternatively, install all three and keep MozillaNlpBackend disabled until required
App Store Notes:
You'll likely either want Yalp Store and FakeStore, or legitimate Google Play Store
If you're trying to avoid Google services, Yalp Store + FakeStore is what you'll want
Play Store will likely be wanted if you want a higher chance at being able to use paid apps and IAP (no guarantees; untested)
Play Store needs to be installed as a privileged application to work properly, and also assigns itself high permissions
You can also choose to install Play Store and Yalp Store; note that FakeStore should not be installed at the same time as Play Store though
You can also use any other app store(s) instead of Play Store or Yalp Store or even choose to not install a store at all, but any apps you install that check if Play Store exists will need FakeStore installed still
Yalp Store Application Descriptions:
FakeStore: Fakes the existence of Google Play Store for applications that require it
Yalp Store: Allows downloading and updating of apps from Google Play Store, serves as an alternative to official Google Play Store, and if signed-in with your real Google account, allows for paid-apps to be downloaded; apps that do license checks post-install will fail, and IAP isn't possible currently
Yalp Store Instructions:
Open F-Droid
Install FakeStore and Yalp Store
Enable Signature Spoofing for FakeStore (Settings -> Apps -> ⚙ -> App permissions -> Spoof package signature)
Configure Yalp Store (⋮ -> Settings -> Pretend to be a Nexus 6; this is potentially required to avoid this)
Download desired applications
Enable only updating of applications acquired through Yalp Store (optional; sometimes versions differ from Play Store and F-Droid; ⋮ -> Settings -> Change app white list -> (select apps), and also set the Black or white list of apps for update to Only the chosen apps will be checked for updates)
Play Store Application Description:
Phonesky.apk: This is the name of the Play Store apk; allows for traditional Play Store behavior; apps that do post-install license checks and IAP are personally untested (feedback from anyone who tests this would be awesome)
Play Store Instructions:
Download the latest open_gapps-arm-7.1-pico archive (GitHub or the main site) (use 8.0 for Oreo; untested)
Extract it somewhere temporary
Go into the Core folder and find vending-all.tar.lz
Extract its contents
Go into the vending-all/240-320-480/priv-app/Phonesky folder
Take Phonesky.apk and move it somewhere temporary or just note its location
Reboot your device to Recovery
Mount /system on the Android device and use adb push to copy Phonesky.apk from local storage to /system/priv-app/Phonesky.apk
Reboot to System
Issues, Recommendations, and Tips
Known Issues (Nougat/cm14.1):
PowerHAL errors flood the log when using a custom kernel with mpdecision removed such as FrancoKernel
Known Issues (Oreo/lineage-15.0):
Cannot decrypt storage from TWRP if using Encryption
vndbinder SELinux denial and crash occurs every 5 seconds (should be fixed with 2017/11/01)
Double-tap to wake is unreliable
Security patch level is old (August 5, 2017)
Recommended Apps:
Email: K9 (incompatible with webmail encrypted providers like Tutanota and ProtonMail)
Store: F-Droid, Yalp Store
Calendar and Contacts: DAVdroid (with a self-hosted Radicale server or a provider like Posteo)
Social: AndStatus with Mastodon or GNU social (choose a server or self-host one)
Chat: Conversations (choose a XMPP server or self-host one with something like Prosody)
Browser: Firefox Klar (Klar is on F-Droid and is also known as Focus; both are the same thing)
Weather: Forecastie
Password Database: KeePassDroid
2FA: andOTP
Maps: OsmAnd~
Recommended Settings:
Developer Options -> Disable Mobile data always active (Oreo/lineage-15.0)
Oreo/lineage-15.0 Findings (2017/10/29):
AsteroidOS Sync with a LG G Watch (dory) seems to work fine
A good bit of LineageOS-specific settings are missing (no Caffeine tile, no Expanded Desktop settings, no lockscreen digit scramble)
SELinux is Enforcing by-default
Only one wallpaper is included
When previewing a Ringtone, it starts out super quiet, then goes full volume (full being whatever the Ring volume is set at)
Thanks for the support.... What are some benefits of
"microG and UnifiedNlp" and/or how is different? I read the link about Floss which is really cool.
Sent from my Nexus 6 using Tapatalk
andrewjt19 said:
Thanks for the support.... What are some benefits of
"microG and UnifiedNlp" and/or how is different? I read the link about Floss which is really cool.
Click to expand...
Click to collapse
I notice GPS locks and accuracy seem to be a bit better; I use the LocalGSM and LocalWifi backends.
I particularly like that microG doesn't require a lot of permissions. Plus since I don't entirely use a lot of Google services, I don't need to have them installed or running in the background either.
I also like the better control over location. With the local backends, my location data doesn't have to be sent off to an online server somewhere. I grab a large database for cell towers from OpenCellID and Mozilla, and that has me covered for the GSM backend. And for Wifi, I just scan for access points as I travel around and build my own database. For first-time visits, I have to rely on the GSM backend first, but for return visits, the Wifi backend should work.
And finally, it's also just kind of neat using this kind of set-up I've tried to go without GApps in the past, but ever since I started playing Pokemon GO and Ingress, I didn't like having to lose those games. Plus there was a few apps I wanted from Play Store too. But now, I can be without GApps, and also have PoGO and Ingress, and even more surprisingly, I pass SafetyNet.
New build available; changes include resync with sources, 493 DPI set (I don't believe this will be a problem outside of Play Store app compatibility; in which case, it can be set back to 560 from the Local Terminal), and the target build changed from userdebug to user.
New build: Resync, previously removed default apps are re-added, and now the ROM includes Steven Black's Unified Hosts File built-in with the gambling, fakenews, and porn filters enabled
Interesting.... I may try this out.
For those who don't know, I provide flashable zips that ease the installation process of microG and/or the Play Store. I'm actually the site linked to on that Reddit post (kinda curious who linked to me).
The microG zips should completely check all boxes in the self-check checklist EXCEPT for the one about setting up the UnifiedNlp backends. The zips come with the Mozilla location backend and the Nominatim geocoder backend, I just haven't figured out how to get them enabled yet.
Those who are stuck using Google to sync contacts/calendar have an add-on zip that can be flashed to be able to sync those. Note that, as of last testing, you may need to go into Settings > Apps and manually enable permissions on one or both sync adapters in order to get it to work.
Finally, @espionage724, if it helps any I also provide a standalone PlayStore zip for people who want to install microG as a user app. It is the patched PlayStore from NanoMod that *should* support (in-)app purchases.
Links:
My own No Gapps/microG setup guide: https://shadow53.com/no-gapps/setup-guide/
FAQ for common issues while setting up microG:
https://shadow53.com/no-gapps/faq/
Table displaying alternatives to "all" Google apps:
https://shadow53.com/no-gapps/alternatives/
And the zip installer downloads
https://shadow53.com/no-gapps/downloads/
New build (2017/07/09) available: Resync with sources, and Steven Black's host file now only uses the default lists (removed gambling, fakenews, and porn filters)
Shadow53 said:
Interesting.... I may try this out.
For those who don't know, I provide flashable zips that ease the installation process of microG and/or the Play Store. I'm actually the site linked to on that Reddit post (kinda curious who linked to me).
The microG zips should completely check all boxes in the self-check checklist EXCEPT for the one about setting up the UnifiedNlp backends. The zips come with the Mozilla location backend and the Nominatim geocoder backend, I just haven't figured out how to get them enabled yet.
Those who are stuck using Google to sync contacts/calendar have an add-on zip that can be flashed to be able to sync those. Note that, as of last testing, you may need to go into Settings > Apps and manually enable permissions on one or both sync adapters in order to get it to work.
Finally, @espionage724, if it helps any I also provide a standalone PlayStore zip for people who want to install microG as a user app. It is the patched PlayStore from NanoMod that *should* support (in-)app purchases.
Links:
My own No Gapps/microG setup guide: https://shadow53.com/no-gapps/setup-guide/
FAQ for common issues while setting up microG:
https://shadow53.com/no-gapps/faq/
Table displaying alternatives to "all" Google apps:
https://shadow53.com/no-gapps/alternatives/
And the zip installer downloads
https://shadow53.com/no-gapps/downloads/
Click to expand...
Click to collapse
Thanks for the links and information!
Last Updated 2017-07-09
The Latest Version is not found on google drive.
gmzhouh said:
Last Updated 2017-07-09
The Latest Version is not found on google drive.
Click to expand...
Click to collapse
Thanks; I thought that URL looked like it was missing a bit of text, but it loaded fine for me when I added it at the time.
Fixed the URL in the first post, and it (2017/07/09) can be found here: https://drive.google.com/file/d/0B9CekGWwY1hjMEdhYmJoeGE2TlU/view?usp=sharing
New build (2017/07/11); just a resync from sources
Do I need to use MicroG to pass Safetynet? And do I need to use f2fs?
xNotta said:
Do I need to use MicroG to pass Safetynet? And do I need to use f2fs?
Click to expand...
Click to collapse
I believe you'll need either microG (and DroidGuard) or GApps to pass SafetyNet, otherwise, apps can't check for SafetyNet compatibility (Magisk's test throws an error if I try doing the check without either).
As for F2FS; you don't have to use it. By-default, /data and /cache partitions use ext4 which works fine.
espionage724 said:
I believe you'll need either microG (and DroidGuard) or GApps to pass SafetyNet, otherwise, apps can't check for SafetyNet compatibility (Magisk's test throws an error if I try doing the check without either).
As for F2FS; you don't have to use it. By-default, /data and /cache partitions use ext4 which works fine.
Click to expand...
Click to collapse
Thank you.
I was going to use BeansGApps full to flash gapps.
So, I can just ignore all the MicroG stuff and still pass Safetynet and have a working rom that plays Pokemon go?
I'm not ready to try f2fs yet.
xNotta said:
Thank you.
I was going to use BeansGApps full to flash gapps.
So, I can just ignore all the MicroG stuff and still pass Safetynet and have a working rom that plays Pokemon go?
I'm not ready to try f2fs yet.
Click to expand...
Click to collapse
Yep you can ignore the microG stuff, flash a GApps package, and pass SafetyNet, but if this is your only objective, you can also accomplish this on most other ROMs (including official LineageOS).
On the note of Bean GApps though, unless there was an update, the June Full package is broken. You'll have to use either May's Full package, or June's Mini package. I'd probably just recommend a variant of Open GApps depending on what packages you want.
eh this is great thanks, and thanks the people with microG and UnifiedNlp too. I didn't know anything about these. This is great
I trust that this will work fine for Verizon users?
Christopher8989 said:
eh this is great thanks, and thanks the people with microG and UnifiedNlp too. I didn't know anything about these. This is great
I trust that this will work fine for Verizon users?
Click to expand...
Click to collapse
I believe it should be fine for Verizon users (at least as fine as a regular LineageOS build would be anyway), but I haven't tried it.
New build (2017/07/13): https://drive.google.com/file/d/0B9CekGWwY1hjcWlFX01sRk12MmM/view?usp=sharing
New build (2017/07/16): https://drive.google.com/file/d/0B9CekGWwY1hjYXFyX0o2QWlJRGs/view?usp=sharing
I believe upgrades will be unaffected by this, but for fresh installs, I forgot to set 493 DPI. If you want this (or any other value; replace 493), you can run the following over adb shell while booted in TWRP (can be at any point after you flash the zip but before rebooting into System):
Code:
mount '/system' && sed -i 's/'ro.sf.lcd_density=560'/'ro.sf.lcd_density=493'/g' '/system/build.prop'
Or you can do it after booting into the ROM via normal means:
Code:
wm density 493

MIUI sends info to connect.rom.miui.com when loging to public hotspot

Mi 9T, MIUI 11/Android 10 (11.0.4.0 QFJEUXM), rooted Magisk), installed Adaway (ofc, must use systemless hosts)
I found that I was unable to connect to the public hotspots - it was not opening the hot-spot accept conditions/login page
By examining a logcat I found:
-ActivityTaskManager(1598): START u0 {act=com.miui.action.OPEN_WIFI_LOGIN dat=http://connect.rom.miui.com/...
...
-OpenWifiLogin(30894): IOException: java.net.ConnectException: Failed to connect to connect.rom.miui.com/::1:80
Upon whitelisting connect.rom.miui.com, phone successfully opens the login page again and I can connect to the public hot-spots
You may or may not have this login to hot-spot problem (with AdAway, DNS66, Blokada...) depending on which hosts sources you use
However, if you don't block connect.rom.miui.com (or you don't use an ad blocker), be aware that MIUI sends some data to its server every time you are connecting to a public hot-spot (?!)
Btw, http://connect.rom.miui.com is valid site (Welcome to nginx! - see a screenshot), and I found a similar report on the Net:
https://www.reddit.com/r/Xiaomi/comments/bk6viy/redmi_note_7_issues_with_public_wifi_networks/
zgfg said:
Mi 9T, MIUI 11/Android 10 (11.0.4.0 QFJEUXM), rooted Magisk), installed Adaway (ofc, must use systemless hosts)
I found that I was unable to connect to the public hotspots - it was not opening the hot-spot accept conditions/login page
By examining a logcat I found:
-ActivityTaskManager(1598): START u0 {act=com.miui.action.OPEN_WIFI_LOGIN dat=http://connect.rom.miui.com/...
...
-OpenWifiLogin(30894): IOException: java.net.ConnectException: Failed to connect to connect.rom.miui.com/::1:80
Upon whitelisting connect.rom.miui.com, phone successfully opens the login page again and I can connect to the public hot-spots
You may or may not have this login to hot-spot problem (with AdAway, DNS66, Blokada...) depending on which hosts sources you use
However, if you don't block connect.rom.miui.com (or you don't use an ad blocker), be aware that MIUI sends some data to its server every time you are connecting to a public hot-spot (?!)
Btw, http://connect.rom.miui.com is valid site (Welcome to nginx! - see a screenshot), and I found a similar report on the Net:
https://www.reddit.com/r/Xiaomi/comments/bk6viy/redmi_note_7_issues_with_public_wifi_networks/
Click to expand...
Click to collapse
its same with every vendor, like apple does it to captive.apple.com
anirudhks said:
its same with every vendor, like apple does it to captive.apple.com
Click to expand...
Click to collapse
Probably most send some data one way or another (btw, I don't use iPhones for that and several other reasons), but it is good to know for some who encounter a similar problem with ad blockers, when trying to connect to the public hotspots
Btw, some hosts sources for AdAway/DNS66 also block miui.com or update.miui.com, but update.miui.com is repository for downloading firmwares - eg, open (enable Desktop site):
https://c.mi.com/oc/miuidownload/detail?guide=2
and try to download some firmware - if you cannot, whitelist:
update.miui.com
EDIT:
Also, for Mi Account, to login and sync (backup/restore) the following two must not be blocked:
api.micloud.xiaomi.net
sgpac.account.xiaomi.com
Hey. I had the same issue. Make sure your DNS is set to automatic.
For some reason Xiaomi does not let you access DNS settings directly. You have to install quick shortcut make and access com.android.settings.Settings$NetworkDashboardActivity from the setting.
I didn't take into account your rooted phone. You may have the option right away or it may be one of the apps you installed.
tkiafar said:
Hey. I had the same issue. Make sure your DNS is set to automatic.
For some reason Xiaomi does not let you access DNS settings directly. You have to install quick shortcut make and access com.android.settings.Settings$NetworkDashboardActivity from the setting.
I didn't take into account your rooted phone. You may have the option right away or it may be one of the apps you installed.
Click to expand...
Click to collapse
As described above, access was blocked due to one of host source lists for AdAway (and solved as described above)
Im not using Private DNS, but you can set Private DNS (easier than by shortcut maker apps) through Hidden Settings for MIUI app, available from Playstore, root not required
To login and use Mi Account two more URLs must be whitelisted:
api.micloud.shaomi.net
sgpac.account.xiaomi.com
All together, I white-list four of them, i.e. these two also (as in the above posts):
update.miui.com
connect.rom.miui.com
This is needed (only) if using a particular hosts source blocking Xiaomi/MIUI analytics:
https://raw.githubusercontent.com/j...ter/Extension/GoodbyeAds-Xiaomi-Extension.txt
This maybe old thread, but if you are rooted/ just use adb from PC, you can change the default captive portal back to original/stock :
adb shell settings put global captive_portal_https_url https://google.com/generate_204
adb shell settings put global captive_portal_http_url http://google.com/generate_204

Categories

Resources