tewilove

#include <android/log.h>
#include <jni.h>
#include <binder/Binder.h>
#include <binder/Parcel.h>
#include <binder/IServiceManager.h>
#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

tewilove

ln -s /path/to/victim /data/local/tmp/ooxx
echo 'GO-RLOG local/tmp/ooxx with me' > /data/tmp/logd_cmd

tewilove

struct fota_seg_hdr {
    uint32_t crc;
    uint32_t size;
    uint32_t upi_ver;                   // seems to be 0x00014050
    uint32_t scout_ver;                 // seems to be 0x00013880
    uint32_t flags1;
    uint32_t flags2;
    uint32_t field_18;
    uint32_t field_1c;
    uint32_t index_offset;              // index data offset in unLZMAed data(strings starts from 0)

tewilove

/*
 *
 * SHARP shdiag mode
 *     [email protected], All rights reserved
 *
 */

#include <sys/types.h>
#include <unistd.h>

tewilove

/*
 *
 * SHARP FOTA parser DEMO
 *     [email protected], All rights reserved
 *
 */

#include <sys/types.h>
#include <sys/stat.h>

tewilove

package tewilove.unlock.pb25;

import java.util.HashMap;
import java.util.Map;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

tewilove

<?php

$target = isset($argv[1]) ? $argv[1] : "modem";

$out = shell_exec("readelf -l ${target}.mdt 2>/dev/null");
// printf($out);
$seg = array();
$lines = split("\n", $out);
for ($i = count($lines) - 1; $i >= 0; $i--) {
    if (!strstr($lines[$i], "NULL") &&

tewilove

/*
 *
 * SHARP fldr mode
 *     [email protected], All rights reserved
 *
 */

#include <sys/types.h>
#include <unistd.h>

tewilove

    /*
     * data:
     *   IV: 16 bytes
     *   AESed Data(
     *    data:
     *     data:
     *      info: offset 0x200,24
     *                   0x220,240
     *      name: offset 0x400,8(DL50, etc)
     *      ...

tewilove

<?php
$req = array(
    "method" => "get_all_builds",
    "params" => array(
        "device" => "icesky_msm8992_user", // ro.product.device + "_" + ro.build.type
        "version" => "2.5.3-2016012303-user-is", // ro.smartisan.version
        "buildtime" => "1453489594", // ro.build.date.utc
        "deviceid" => "990006210028584", // IMEI
        "flag" => "0", // rooted
        )