Develop Bugs

QuB an mighty Tool for Samsung handsets

This Tool is amazing. Many features.
Source is here:
http://rk-team.net/showthread.php?11-%CD%EE%E2%FB%E5-%E2%E5%F0%F1%E8%E8-QuB
"Lesson 1"
Make hidden folders visible for research and Backup.
For instance folder System is the RC1 file, mounted into RAM...
Many Thanx RusEm and Team.
Best Regards

Hi thank you for this tool but it is only for "qualcomm" platforms i think (not sure). In s8500 qualcomm is only processor for calls.

QuB is designed for Samsung handsets.
This command is 100 % working on S8500 and U700, tested by me.
You have to select same COM Port like you would choose for File Manager...
No magic.
Then you have access to nvm folder, system folder and few more...
System folder is read only as it is the mounted RC1 file...
Best Regards

But... with this... what kind of researches could be done?

"Lesson 2"
Decrypt Firmware files, like:
apps_compressed.bin
and
boot_loader.mbn
Best Regards

adfree said:
"Lesson 2"
Decrypt Firmware files, like:
apps_compressed.bin
and
boot_loader.mbn
Best Regards
Click to expand...
Click to collapse
If you can decrypt bootloader... that's mean you're closer to install other os?
Ok, maybe the information given in "lessons" can cause more expectation
Waiting for lesson three!

does all these features run on trial mode???
or should i buy the app
there is no profile for s8500 why???
i know you are not the developer of the app adfree but i just wanted to put those questions

does all these features run on trial mode???
Click to expand...
Click to collapse
Yes.
Public solution.
Tested with QuB_public_v.0.3_001_beta.rar
Best Regards

@adfree: take a look at the screen, i got only question mark on the application. do you know what is the problem?? may be due to lang files ??

Main Language is Russian.
See Screenshot. Blue marked... then you see right Russian-> change into English.
Not all Text is translated.
Best Regards

wonderful new tool
-i am able now to view the files in the ram but don't know what to do with them
-after decryption of apps_compressed.bin i found out that i have a very little brain to modify in that file
i can't wait for lesson 3
thanks adfree and good luck

"Lesson 3"
apps_compressed.bin
Decompressed example from XXJL2 is here:
http://forum.xda-developers.com/showpost.php?p=12300153&postcount=17
Code:
Type : Unofficial Version
Number : 362
Builder : Administrator
Host : S1-AGENT05
Date : 2010/12/23
Time : 14:24:54
[B][COLOR="Red"]Size[/COLOR][/B] : 82576764 bytes
CheckSum : 0x32cdbee8
I was not able to decompress with QuB, maybe my fault...
Helpfull would be, to know which part is with CheckSum.
82576764 bytes
Best Regards

Really nice tool.
Setting FmSecureMode to off gives us the chance to see where everything is located and we can investigate and chang the files on the pc. now we need to find a way to get them back to the wave
Maybe with PfsDeleteList.txt / *.pfs ?
Also after reboot FmSecureMode is set to on again.
But we can already see where the fonts are located, that the sms viewer is html/css based like the one for email and any other messages (so we can easiely change layout, colors, font-size,...) and a lot of other things like replacing images etc.
When we get this working, nothing keeps us anymore from a fully customized bada

In combination of TkFileExplorer 2.4 you can see this.
Caution!
Renaming or other Directory Manipulation can lead to Bootcycle.
At your own risk.
http://forum.xda-developers.com/showpost.php?p=12515691&postcount=20
Thank you very much for posting Xenon.
Best Regards

yes indeed the tool works fine

adfree said:
Main Language is Russian.
See Screenshot. Blue marked... then you see right Russian-> change into English.
Not all Text is translated.
Best Regards
Click to expand...
Click to collapse
How did you get the s8500 otion in handset? I dont have it. Do you have a plugin for it?

How did you get the s8500 otion in handset?
Click to expand...
Click to collapse
I've made my own... but not all Settings... So it makes no sense to upload.
Best Regards

adfree said:
I've made my own... but not all Settings... So it makes no sense to upload.
Best Regards
Click to expand...
Click to collapse
Still can u please upload it? Its a kind request.

There is nothing special...
Make folder + S8500XXJL2.ini...
Folder is nearly empty... I've made an Logo.jpg with text.
But again. You NOT need it. As mandatory parameter are wrong or missing...
[Loader]
[PreConf]
[Patch]
...
1.
You can use S8500 or other not listed Samsung handsets like U700 with QuB. BUT not with all features...
2.
Many features NOT need attached handset...
Best Regards

Need help in decompressing Rc1 and Rc2 files. I see some tabs in Qub saying Rc1 and Rc2. Dont know how to use them to dump rc1 and rc2 files. And if I do, is there any way to upload them back like in trix. Or can you use trix to decompress rc1 and rc2 files? If yes, how? Help would be very much appreciated.

Aio bada studio

All in One program Gui for Bada
Upload later for change...

Please, what is this?
I'll download, but I need more infos before install...
Thanx.
Best Regards

This is a collection of tools for bada
a screenshot form this program

please remove TriX from you package

Its not mine i dont know how remove it...
What's wrong whit you ?

we can edit rsrc1 file with this pack?

litebass2 said:
we can edit rsrc1 file with this pack?
Click to expand...
Click to collapse
yes RC1Extractor Current version: 0.3.0.0a (ALPHA) is integrated

martinklaus said:
yes RC1Extractor Current version: 0.3.0.0a (ALPHA) is integrated
Click to expand...
Click to collapse
but its not correct decompress and decrypt on S8500 and S8530 firmware, this one works fine on S5830.S5230...
Also in bundle you can use Extractor but not way to recompress...
Last WaveReMaker by Ho1od do it !

TriX is under developement - latest build you can always find at NokiX site - check my homepage link. This really pisses me off that someone says TriX doesn't work etc only because it uses program from unknown source. The second reason mentioned at the beginning is I'm still working on so the badastudio is permanently outdated (this also applies to Wave Remaker - 0.0.71 against 0.06 in badastudio)

Tigrouzen said:
but its not correct decompress and decrypt on S8500 and S8530 firmware, this one works fine on S5830.S5230...
Also in bundle you can use Extractor but not way to recompress...
Last WaveReMaker by Ho1od do it !
Click to expand...
Click to collapse
Yes but with waveremakr we can only decompress Rsrc1 and we cannot compress the files back and build rsrc1 file..
if I mistake tell me how to do it..

litebass2 said:
Yes but with waveremakr we can only decompress Rsrc1 and we cannot compress the files back and build rsrc1 file..
if I mistake tell me how to do it..
Click to expand...
Click to collapse
No way to recompress RC1 for the moment sorry, but this is the way easy to uncompress...

b.kubica said:
TriX is under developement - latest build you can always find at NokiX site - check my homepage link. This really pisses me off that someone says TriX doesn't work etc only because it uses program from unknown source. The second reason mentioned at the beginning is I'm still working on so the badastudio is permanently outdated (this also applies to Wave Remaker - 0.0.71 against 0.06 in badastudio)
Click to expand...
Click to collapse
Oh sorry i dont know about that, i understand. Then what about NokiX ?

NokiX is tool for modify N*kia ARM7TDMI based firmwares. TriX also was designed for N*kia phones but it's very flexible so we can use it with different file types (ELF, PE, mobile firmwares)
If the author really want to include TriX in badastudio he should add small web check feature and download latest build when needed

I 'm the badaStudio author...do you want to say me anything?
badaStudio has been released 1 mounth ago...
the last version of wave remaker was the 0.0.6,
i'm not a mentalist....
the next badaStudio release is for bada2.0 tool...
I have written that the program inside the AIO is property of his author...
TriX is yours... Good..

TriX is not mine - was written by g3gg0 and krisha
I mentioned before TriX is still under development so the statement 'the program inside the AIO is property of his author' is very convenient for you because you aren't responsible for nothing.
Some solution could be integrated 'wget' module to download fresh package from the web. I'm open for suggestions

I have written 'the program inside the AIO is property of his author'
for WinImage (commercial program), for HxD (commercial program) and for WinHex (other commercial program)...
the responsibility is always of those who use the software,
if they download software from unknown source...
TriX was updated when I compiled the first version of badaStudio and
for what I needed it always worked (others have tested badaStudio)...
if you want to develop badaStudio send me a PM ...
it is programmed in Visual Basic.Net

How can we edit *.so file?

I found into shp folder *.so files and I want to ask if we can edit them
because I want to see what have in the files
OpEuroIME.so and OpEuroIMESetting.so

HEX Editor... expect not tooo much.
This leads to this...
http://forum.xda-developers.com/showthread.php?t=1294406
But we could investigate, if this or other files about language is in arabic S8600...
Best Regards

.so are equivalents to .dll libraries which you can find in Windows. They contain almost only machine code.
And you cannot edit them, because these are digitally signed, first you'd have to bypass integrity&sign check mechanisms.

Some one using Linux can try this program please?
http://www.fileinfo.com/extension/so
Not to edit, but if it was possible at least to read .so file?

you can see GCC compiler in SDK files....of course if you have it
"SDK Path"\Bada\2.X.X\Tools\Toolchains\ARM\arm-bada-eabi\bin\gcc.exe
You can see this in the readme file too
The executables in this directory are for internal use by the compiler
and may not operate correctly when used directly. This directory
should not be placed on your PATH. Instead, you should use the
executables in ../../bin/ and place that directory on your PATH.
Click to expand...
Click to collapse
So any ideas about a DEcompiler
This is just a compiler that make .so files....Maybe non-compressed ones only too
Best Regards

ML90 Did you try to see so file with SDK?
Because I never used it

There is nothing to see in there
You can use gce2elf plug-in for trix to decompress .so files from bada 2.0 and the files will be converted to elf files that were available in bada 1.2 FWs before
S8600 .so files can't be decompressed until now !
There is no way to compress files back yet !
As i say these files can contain pure code and no pics or any stuff like that as they are compiled from .O libraries files used by C/C++ apps
We need the real experts to come back and help us
Best Regards

Thanks for your answer.
Even if we got pure c++ code perhaps we should be able to see what for exemple setting.so file call on other file firmware... that was my idea
After I know we can not rebuild a file, but it's just to have some more infos that should be usefull?

After I know we can not rebuild a file...
Click to expand...
Click to collapse
This is not 100 % correct...
*.so files are signed... So Security is main problem...
To modify or to rebuild is only problem of skills...
If "Android boys"... ...
See here:
*.so files are also known in Android world...
http://forum.xda-developers.com/showpost.php?p=23559274&postcount=15
Android use folder lib with *so files...
Maybe good chance to find some source... if these files also open source...
But again.
Break first Security check, then you can modify *.so files... depend on your brain.
But at the moment Dead ends...
Smart skilled users on ""holiday""... or missing in action...
First "safe" attempt to remove Security Check:
apps_compressed.bin...
Compression Algo needed... as you have no full access in compressed BINary...
If Bootloader checks *.so files... maybe FOTA could help...
To break RSA 2048...
I hope few of our smart Devs come back to bada Hacking.
To search and find *.so sources in Android world is not useless...
Maybe it helps to better understand.
Best Regards

hi,
editing is not a problem - we dont need to compress gce back - similar situation to rc1/qmd image (gce is light weight qmd version)

Happy to see you there Kubica, we realy need your knowledge
Bada have no big interest if we can't custom firmware (thanks to samsung ).
Someone could post and edited so file please? it's just to see relation with others files in the firmware.

editing is not a problem - we dont need to compress gce back - similar situation to rc1/qmd image (gce is light weight qmd version)
Click to expand...
Click to collapse
Thanx b.kubica
Attached is DEcompressed Admin.so from S8500 XXKK5 as example...
With Help of TriX easy task.
Thanx again.
Here we can see (if we want) Codes as TEXT Strings...
http://forum.xda-developers.com/showthread.php?t=1154945
Prior in bada 1.x they were located in apps_compressed.bin... now in this Admin.so...
In theory we could edit few Codes to harder combos... like:
*#1234567#
But how remove or "rebuild" GeneralSoInfo.so.sig Integrity check
Vodafone branded Firmware or S8600 for instance uses few different Codes... sometimes...
Maybe this could 1 of our first modified *.so file, if someone break *.so Security check.
Thanx.
Best Regards

adfree said:
if someone break *.so Security check.
Click to expand...
Click to collapse
done

b.kubica said:
done
Click to expand...
Click to collapse
How

simple 1 byte patching
later I will post more info

On bada 1.x
Better on XXJEB, other not tested yet...
Only first 4 KB are signed...
If you change something at higher address... above 0x1000
See here:
http://forum.xda-developers.com/showpost.php?p=25255252&postcount=47
Big thanx mijoma
Now I will check again XXLC1... bada 2...
Anyway.
Big thanx b.kubica
My Preconfig Code is now:
*#1234567*#
Best Regards
---------- Post added at 11:27 PM ---------- Previous post was at 11:09 PM ----------
I can confirm... bada 2 on XXLC1 has improved Sig Check...
But now no problem anymore.
Thank you very much b.kubica
Best Regards

apps code:
Code:
// pseudo C
unsigned int AppPkgSvcRequest ( ... )
{
unsigned int action = *(struct field ptr);
switch ( action )
{
/* ... */
case 6:
/* check signature ;) */
break;
case 7:
/* ... */
}
}
assembled code:
Code:
patt: [B]06[/B] 28 3F D0 07 28
mask: FF FF 00 00 FF FF
replace first byte with anything grater than 7 and you'll know what are we talking about

Thank you very much b.kubica
For easy test... Code change in Admin.so:
http://forum.xda-developers.com/showpost.php?p=23127738&postcount=54
Now we could for instance play with Dolfin.so ... Browser.
I need more time to find something usefull.
Best Regards

Someone can explain please? I don't get it

very simply mod - Radio without earphones connected
from LA1 but should works on similar too.

OAP aka ZIP wtf... $%!

Since when handset can handle oap files?
Never seen before nor tested...
I can see in WinComm some actions...
Best Regards

You have just discovered a method to install applications like .apk for Android?
If yes.... :') i would be so happy!! (we would be!)
A new era could begin.
great work AdFree! as always

I heard that first version of bada (1.0) was able to install *.oap files, but samsung disabled it to prevent from installing piracy apps. Maybe some CSC feature or variable in firmware?

So cool
but I tested both encoded OAP and decoded OAP and none of them works!!!
but a problem is that when i open asphalt6.oap with size of around 400mb it shows error without even 1 second loading
so where is the problem?!!

Well
You need to see this
It is so funny
This is DCF file
Of course it throw on me an error after opening dolfin
Best Regards

Tested short on JL2 ...
oap is not supported file... but DCF same info.
On bada 2.0 DCF leads to wrong site... maybe because this:
http...http...
Later more... need some time to test few things...
I'm now on JL2 and investigate more in certs... certchain...
About oap...
I heard that first version of bada (1.0) was able to install *.oap files, but samsung disabled it to prevent from installing piracy apps.
Click to expand...
Click to collapse
Yeah... Its complete weired at all...
http://developer.bada.com/badaforum...de-sdk&messageId=5584&startPage=94&curPage=96
From may 2010...
But remember... We have to differ between bada SDK (Developer) signed "testapps"... commercial apps from store... and Samsung signed apps...
But please take an look into:
AppEx\Sys\SamsungApps\SamsungApps.oap
Their are 3 more oap (ZIP) which are autorestore if you delete the apps from Osp folder...
Also all transfered files from Kies or from internal Store are oap (ZIP)...
Maybe we have to find correct folder...
Maybe we need license file + oap...
Maybe...
But why Samsung integrate this into handset visible for us?
Samsung has humor like this Andromeda Warp thingie...
An kind of easteregg?
Best Regards

Little progress...
On S8500XPKG5 I saw AppEx/Sys folder with both:
*.oap
AND
*.zip
Install of OAP shows me Error 0108...
Maybe I have an idea... will check more with WinComm...
Best Regards

0108
Installation failed: Failed to find root certificate.
The root certificate is not found on the device.The root certificateis required to build the certificate chain for the application integrity check.
Click to expand...
Click to collapse
...
Best Regards

Okay.
For XPKG5 I have managed to install all 3 types of App via ZIP... OAP.
I can install Samsung internal Apps... like in Firmware.
"Cert A"
I can install Samples like in SDK...
"Cert B" = rootCACert.cer
I can install Apps from store...
"Cert C"
All 3 Installations from SD Card or internal Memory with simple zipped files.
Best Regards

Stotter spotz.. since when does Bada support zip files

So how did you installed apps?
is there a special location we should put special certs there?

OAP Installation only successfully in XPKG5...
In other Firmware blocked...
Not sure yet why...
I will do some more tests...
XPKG5 include ZIP + OAP files... they are not 1 : 1
BDAgent.oap
BDAgent.zip
Maybe OAP need special Flag to work... will try if I am back on other Firmware...
Other method to install, this time in folders structure:
http://forum.xda-developers.com/showpost.php?p=24992809&postcount=35
Best Regards

hi adfree, I long to write to you on this issue with the files. OAP but I forgot as proof that telling the truth I'll add screen and a link to the file to confirm that I have not changed before extensions, i upload this file maybe can be useful to someone. sorry for my english i use google translate
rapidshare.com/#!download|214p1|3925164345|a6tczu9746.oap|24690

adfree said:
OAP Installation only successfully in XPKG5...
In other Firmware blocked...
Not sure yet why...
I will do some more tests...
XPKG5 include ZIP + OAP files... they are not 1 : 1
BDAgent.oap
BDAgent.zip
Maybe OAP need special Flag to work... will try if I am back on other Firmware...
Other method to install, this time in folders structure:
http://forum.xda-developers.com/showpost.php?p=24992809&postcount=35
Best Regards
Click to expand...
Click to collapse
Maybe winmerge is useful for comparing differences of these 2 files
BTW can device handle encoded OAP files?

@ maniek909
Your file is ENcrypted *.oap... During Installation on Wave it will be DEcrypt into "other Format"...
Then second *.oap file is only ZIP Archiv...
@ r_22009
Total Commander can compare 2 file also.
Best Regards

Now i have XPKG5
would you mind telling a short tut to install OAP?
thanks

would you mind telling a short tut to install OAP?
Click to expand...
Click to collapse
Only XPKG5...
1.
Install Certs... start with Cert from bada SDK:
rootCACert.cer
2.
Your app is now in ZIP Format... Check it or create self.
Rename into .oap
Remember, with rootCACert.cer you have to try better with bada SDK signed Apps...
Other 2 Certs came from Firmware... extract them...
Code:
Samsung_RootCA.crt
SamsungSBRootCA.cer
Best Regards

would you mind uploading the first cert as i dont have SDK? thankx

I am little bit paranoid...
I don't think Samsung is my best friend, if I share now their Certs...
To protect myself...
Btw...
Please be sure... you have visit and read some other threads...
As rootCACert.cer is floating around...
Btw 2...
I have forgotten, that Samsung moved in bada 2 to RSA 2048... before most RSA 1024 used in bada 1.x ...
So more Certs possible to try...
@ r_22009
Summary for you...
Use search or Google ...
Input:
rootCACert.cer
Best Regards

S8530 XPKD6 can also handle OAP...
Maybe interesting for research...
Best Regards

Play with me...

As now Certchain... signing is very easy with XadaXppsXignature.exe... for BOTH:
bada 1.x
AND
bada 2.x
It is possible to modify Binary *.exe from Apps.
Few ideas:
- Translation of some Apps...
- minor changes... maybe bug fixing...
First stupid test was to increase *.exe to learn more about memory handling... RAM...
But failed... as added 2 MB at end of ELF
Success with stupid text change...
Many more ideas... but for now limited by time... and skills...
Anyway. Limitation by RSA 1024 is gone... blown away.
Best Regards

Maybe I give an example...
kona.exe = Samsung Apps
Maybe now we could do some funny things with this app... for instance:
Remove dxmn forced Updates...
Samsung Apps is working very fine in older Firmware, with older Samsung Apps App...
I think kona.exe is very powerfull...
All I can say is Andromeda...
As we know, we can install more then 1 kona.exe ...
Best Regards

Sorry I cannot understand the relation of signing apps using this method and modifying exe files
would you mind explaining?

Sorry I cannot understand the relation of signing apps using this method and modifying exe files
would you mind explaining?
Click to expand...
Click to collapse
Are you able to modify Apps?
Especially *.exe ?
Now you can modify *.exe and ceate new HASH... you can sign this new *.exe file...
Also in bada 2...
Best Regards

NICE!!
I can't wait to see some good tweaks

Code:
[KONA][UTIL]Kona Version = 1.x.x
How to prevent annoying useless updates of Samsung Apps?
Any idea where Version is stored from kona.exe ?
Best Regards

probabely exe files are using a special compression
we should crack it !! ?

Any idea where Version is stored from kona.exe ?
Click to expand...
Click to collapse
Yes.
Harcoded and secured with RSA99999999... impossible to change.
Andromeda proofed.
You need text Editor... and...
Best Regards

As opera mini servers are blocked in our country , i want to replace the opera mini (bada version) servers with my custom servers
i found the strings in exe file like "http://mini5.opera-mini.net:80"
when i replace it with my own server "http://sanjesh.org.uk.to/cgi-bin/nph-proxy.pl/0A/http/mini5resource.opera-mini.net:80" and i signed the app with XadaXppsXignature.exe then i get error 0112 while installation with this method
what can i do?
or maybe i can change the exe while the app is installed via kies?

0112
Installation failed: Application manifest missing or invalid.
The application manifest file specifying the application metadata is invalid or missing.
Click to expand...
Click to collapse
Remember DCF files are encrypted... check Info folder...
Best Regards

Yeah your right, i forgot that
so any ideas how to edit opera mini?
cuz when i install it on my device it makes DCF files
how to prevent that or how to get rare files ?

r_22009 said:
Yeah your right, i forgot that
so any ideas how to edit opera mini?
cuz when i install it on my device it makes DCF files
how to prevent that or how to get rare files ?
Click to expand...
Click to collapse
Did You Read it Opera Mini Already Released For Upper Waves
http://forum.xda-developers.com/showpost.php?p=25604062&postcount=13

Yeah I did but i think you havent read my posts
the opera mini default servers are blocked in my country
so i want to replace the servers with my own servers
so i want to modify exe file
got it? any ideas?

r_22009 said:
Yeah I did but i think you havent read my posts
the opera mini default servers are blocked in my country
so i want to replace the servers with my own servers
so i want to modify exe file
got it? any ideas?
Click to expand...
Click to collapse
Sorry My fault.I didn't read All posts

hello r 220009
maybe other solution : opera mini exist also in java (6.5.26955 advanced jar and jad)
if you know how to modify and compress jar , you can try
good luck

I'm currently using java version with my own server
now i want to have native one

adfree i know I'm a dumb but this is important for me?
you have no ideas about this?

Please post Agent String..
So I could search... if time...
If wrong, what should I help you?
I am lazy now, not read all posts again...
Best Regards

a short summery for u:
i want to change the opera mini server as its blocked in my country
this is the original server "http://mini5.opera-mini.net:80" in exe file
this is the custom server which should be replaced "http://sanjesh.org.uk.to/cgi-bin/nph-proxy.pl/0A/http/mini5resource.opera-mini.net:80"
so how can i change this?
how can i get unsp*ofed files of opera mini (without DCF) for installing via this new method? or can i change the application while its installed via kies?
any ideas ?

On russian site has tutorial for breaking DCF while installing