Multiple versions of T95 H616 firmware online include active botnets - Android Stick & Console AllWinner based Computers

I installed Pi-hole on my Android device and pointed DNS at 127.0.0.1
Saw a bunch of funky domains in the query log and blocked them.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
But what was causing it?
Code:
[email protected]:~# tcpflow -p -c -i wlan0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*'
reportfilename: ./report.xml
tcpflow: listening on wlan0
GET /logs/log.info?package=com.swe.dgbluancher&osv=10&gaid=ff9300dd-f771-40ff-84d7-42184fc40d95&get_ip_info=ff9300dd-f771-40ff-84d7-42184fc40d95&model=MBOX&make=Google&aid=df53b410ca1fd8a6&version=2.85&cid=1410&status=-1 HTTP/1.1
Host: 128.199.97.77
GET /logs/log.active?package=com.swe.dgbluancher&osv=10&gaid=ff9300dd-f771-40ff-84d7-42184fc40d95&model=MBOX&make=Google&aid=df53b410ca1fd8a6&version=2.85&cid=1410&status=-1 HTTP/1.1
Host: 128.199.97.77
GET /logs/log.info?package=com.swe.dgbluancher&osv=10&gaid=ff9300dd-f771-40ff-84d7-42184fc40d95&get_ip_info=ff9300dd-f771-40ff-84d7-42184fc40d95&model=MBOX&make=Google&aid=df53b410ca1fd8a6&version=2.85&cid=1410&status=-1 HTTP/1.1
Host: 128.199.97.77
GET /?timestamp=1668566687503&version=1&biz=10016&os=2&id=3e2dfd4c426e38721ac0bcc09612aa96&sign=d59dab2813001575f0a9dfb2ce850353 HTTP/1.1
Host: www.forfor123.com
GET /get_endpoint?timestamp=1668566687493&version=1&biz=10016&os=2&id=3e2dfd4c426e38721ac0bcc09612aa96&sign=135d9c2723c76587e86a540fced231ec HTTP/1.1
Host: qweqwe135.top
POST /u.php?id=30018&m=cTUJPWA&s=d1,u3&p=cY29tLnN3ZS5kZ2JsdWFuY2hlcg&aid=df53b410ca1fd8a6&am=2 HTTP/1.0
Host: v.sustat.com
GET /stg?channel=hzsdk_05&sdk=js_club HTTP/1.1
Host: sdk2.appclicking.com
GET /logs/log.info?package=com.swe.dgbluancher&osv=10&gaid=ff9300dd-f771-40ff-84d7-42184fc40d95&get_ip_info=ff9300dd-f771-40ff-84d7-42184fc40d95&model=MBOX&make=Google&aid=df53b410ca1fd8a6&version=2.85&cid=1410&status=-1 HTTP/1.1
Host: 128.199.97.77
GET /logs/log.info?package=com.swe.dgbluancher&osv=10&gaid=ff9300dd-f771-40ff-84d7-42184fc40d95&get_ip_info=ff9300dd-f771-40ff-84d7-42184fc40d95&model=MBOX&make=Google&aid=df53b410ca1fd8a6&version=2.85&cid=1410&status=-1 HTTP/1.1
Host: 128.199.97.77
GET /d/bcc/v2/o/ffeca781ecfd6067e5e56b04d67edc7e HTTP/1.1
Host: dct.g1ee.com

Related

Multiloader Under Linux

Flash rom, boot file, fota under linux
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Just install virtualbox and virtualbox extension
Donwload Windows xp 32bits iso
On configuration choose only Usb and disable Usb 2 support
Install Samsung driver
Boot DonwloadMode
Under Linux
Determine your device vendor and product IDs :
lsusb
You will see lines like this:
Bus 001 Device 049: ID 04e8:685d Samsung Electronics Co., Ltd GT-I9100 Phone [Galaxy S II] (Download mode)
Then chmod a+rw /dev/bus/usb/<bus number>/<device number> (exemple we have 001/049)
Mount Samsung GMO Samsung Mobile Modem under xp
Use Multiloader

EmydeOS Root access

Hello, how do i disable rootFS in emyde OS.?
tried:
| sudo /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --partitions 4 or
| sudo /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --partitions 2 or
| sudo /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --partitions "2 4"
no matter what, at each reboot cant get root access.
thank you
mindinguslove said:
Hello, how do i disable rootFS in emyde OS.?
tried:
| sudo /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --partitions 4 or
| sudo /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --partitions 2 or
| sudo /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --partitions "2 4"
no matter what, at each reboot cant get root access.
thank you
Click to expand...
Click to collapse
never mind, got it working and made a guide to install it on GPD pocket
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
https://forum.xda-developers.com/ha...gpd-pocket-t3928828/post79496417#post79496417

Stop Vibrations of Gcam

Hi guys
My devices: RMN9s (Vietnam Global Version)
ROM: India Global 11.0.3 rooted with magisk patched boot method
Problem: Install some Gcam to test and they Vibrations all the time.
Below is instruction how to fix it.
1. Find your Gcam Package, mine is com.google.android.GoogleCamera
2. Connect your device with ADB
3. Type cmd code
Code:
adb shell
Code:
cmd appops set <package> VIBRATE ignore
Example:
Code:
cmd appops set com.google.android.GoogleCamera VIBRATE ignore
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You won’t see any confirmation in the prompt, but as long as you don’t get an error message it should have worked.
Special Thanks to Mishaal Rahman for this article
Source: https://www.xda-developers.com/stop-vibrations-android-apps/

How Do I Submit an Application Signature Key and Upload a Key Certificate?

1. Obtain the pepk.jar tool from the Internet or another legitimate source.
2. Use the tool to export the existing private and public key certificates as a .zip file.
3. Upload the .zip file to AppGallery Connect.
4. Use the app signing method of Android to generate a new upload key.
5. Run the following command to export the certificate (in PEM format) for the generated upload key.
Replace the information in italic and bold with the actual values.
$ keytool -export -rfc -keystore upload-keystore.jks -alias upload -file upload_certificate.pem
6. Submit the generated key in AppGallery Connect.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Why is adb still showing "http" links in its terminal outputs?

Upon getting an permission error when using ./adb shell .... I noticed that in the displayed output, http links are being used instead of google's own aggresive years-long push for sites to use https due to security concerns of the http protocol etc...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
The whole developer.android.com site actually uses the https protocol, yet they refer to http in the output?
IMHO you should ask this question to the people who put the ADB version you are using into the world.
jwoegerbauer said:
IMHO you should ask this question to the people who put the ADB version you are using into the world.
Click to expand...
Click to collapse
Touche you're right.

Categories

Resources