Skip to content

Commit

Permalink
[WIP] 2024/11/21
Browse files Browse the repository at this point in the history
  • Loading branch information
@s1204IT
s1204IT committed Nov 20, 2024
1 parent 1da1068 commit c633335
Show file tree
Hide file tree
Showing 6 changed files with 114 additions and 36 deletions.
2 changes: 1 addition & 1 deletion .gitattributes
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
* text=auto eol=lf
*.bat eol=crlf
/app/src/main/assets/shrinker binary
/app/src/main/assets/* binary
*.jar binary
*.jks binary
10 changes: 7 additions & 3 deletions app/build.gradle
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ android {
compileSdk 34

defaultConfig {
minSdk 28
minSdk 24
//noinspection ExpiredTargetSdkVersion
targetSdk 22
versionCode 4
Expand Down Expand Up @@ -36,8 +36,12 @@ android {
}

compileOptions {
sourceCompatibility JavaVersion.VERSION_17
targetCompatibility JavaVersion.VERSION_17
sourceCompatibility JavaVersion.VERSION_21
targetCompatibility JavaVersion.VERSION_21
}

lintOptions {
ignore 'SdCardPath', 'deprecation'
}
}

Expand Down
Binary file added app/src/main/assets/gdisk
View file
Binary file not shown.
Binary file added app/src/main/assets/mtk-su
View file
Binary file not shown.
129 changes: 99 additions & 30 deletions app/src/main/java/com/saradabar/easyblu/MainActivity.java
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
package com.saradabar.easyblu;

import android.annotation.SuppressLint;
import android.app.Activity;
import android.app.AlertDialog;
import android.content.ComponentName;
Expand Down Expand Up @@ -34,9 +33,14 @@

public class MainActivity extends Activity {

private static final int DELAY_MS = 2000;
private static final String CT3 = "TAB-A04-BR3";
private static final String MMCBLK0 = "/dev/block/mmcblk0";
private static final String CTX = "TAB-A05-BD";
private static final String CTZ = "TAB-A05-BA1";
private static final String DCHA_PACKAGE = "jp.co.benesse.dcha.dchaservice";
private static final String DCHA_SERVICE = DCHA_PACKAGE + ".DchaService";
private static final String DigichalizedStatus = "dcha_state";
private static final String DCHA_STATE = "dcha_state";
private static final int DIGICHALIZE_STATUS_DIGICHALIZED = 3;
private static final String DCHA_SYSTEM_COPY = "/cache/..";
private static final String SETTINGS_PACKAGE = "com.android.settings";
Expand All @@ -47,7 +51,9 @@ public class MainActivity extends Activity {
private static final String FRP_FIXING_TEMP = "tmp.bin";
private static final String SHRINKER = "shrinker";
private static final String SHRINKER_SUCCESS = "Permissive";
private static final String SHRINKER_BIN_PATH = "/data/data/com.saradabar.easyblu/files/";
private static final String MTK_SU = "mtk-su";
private static final String GDISK = "gdisk";
private static final String APP_PATH = "/data/data/com.saradabar.easyblu/files/";

DataOutputStream dos;
BufferedReader bufferedReader, bufferedReader1;
Expand All @@ -72,81 +78,109 @@ void init() {
.setTitle("実行しますか？")
.setMessage("続行するには OK を押下してください\n\nキャンセルを押すと Android 設定に遷移します")
.setPositiveButton("OK", (dialog, which) -> {
addText("- 通知：" + SHRINKER + " を実行しました");
addText("- 通知：" + (Build.PRODUCT.equals(CT3) ? MTK_SU : SHRINKER) + " を実行しました");
addText("- 警告：デバイスには絶対に触れないでください。処理が終了するまでお待ち下さい。");
addText("- 警告：デバイスが再起動した場合は失敗です。起動後に再度実行してください。");

new Handler().postDelayed(() -> {
String result = shrinker();
String result = Build.PRODUCT.equals(CT3) ? mtkSu() : shrinker();
if (result.contains(SHRINKER_SUCCESS)) {
addText("- 通知：成功しました。");
addText("- 通知：" + FRP_FIXING_FILE + " の修正を試みます。");
new Handler().postDelayed(this::overwriteFrp, 5000);
addText("- 通知：" + (Build.PRODUCT.equals(CT3) ? "expdb のサイズを計算します。" : (FRP_FIXING_FILE + " の修正を試みます。")));
new Handler().postDelayed(Build.PRODUCT.equals(CT3) ? this::checkFixed : this::overwriteFrp, DELAY_MS);
} else {
addText("- 通知：失敗しました。再度実行します。");
new Handler().postDelayed(this::retry, 5000);
new Handler().postDelayed(Build.PRODUCT.equals(CT3) ? this::retryMtkSu : this::retryShrinker, DELAY_MS);
}
}, 5000);
}, DELAY_MS);

})
.setNegativeButton("キャンセル", (dialog, which) -> {
try {
Settings.System.putInt(getContentResolver(), DigichalizedStatus, DIGICHALIZE_STATUS_DIGICHALIZED);
Settings.System.putInt(getContentResolver(), DCHA_STATE, DIGICHALIZE_STATUS_DIGICHALIZED);
} catch (Exception ignored) {
}
startActivity(new Intent().setClassName(SETTINGS_PACKAGE, SETTINGS_ACTIVITY));
})
.show();
}

@SuppressLint("SdCardPath")
String shrinker() {
stringBuilder = new StringBuilder();
addText("- 通知：" + getFilesDir() + " にファイルをコピーしています。");
copyAssetsFile(this);
sh();
addText("- 通知：実行権限を付与しています。");
execute("chmod +x " + new File(getFilesDir(), SHRINKER).getAbsolutePath());
execute(SHRINKER_BIN_PATH + SHRINKER);
copyAssetsFile(this, SHRINKER);
sh("sh");
execute(APP_PATH + SHRINKER);
String text = getText().toString();
addText("- 結果：");
addText(text);
return text;
}

String mtkSu() {
stringBuilder = new StringBuilder();
addText("- 通知：" + getFilesDir() + " にファイルをコピーしています。");
copyAssetsFile(this, MTK_SU);
sh(APP_PATH + MTK_SU);
execute("getenforce");
String text = getText().toString();
addText("- 結果：");
addText(text);
return text;
}

@SuppressLint("SdCardPath")
@Deprecated
void retry() {
execute(SHRINKER_BIN_PATH + SHRINKER);
void retryShrinker() {
execute(APP_PATH + SHRINKER);
String text = getText().toString();
addText("- 結果:");
addText(text);
if (text.contains(SHRINKER_SUCCESS)) {
addText("- 通知：成功しました。");
addText("- 通知：frp.bin の修正を試みます。");
new Handler().postDelayed(this::overwriteFrp, 5000);
new Handler().postDelayed(this::overwriteFrp, DELAY_MS);
} else {
addText("- 通知：失敗しました。再度実行します。");
new Handler().postDelayed(this::retryShrinker, DELAY_MS);
}
}

@Deprecated
void retryMtkSu() {
execute(APP_PATH + MTK_SU);
String text = getText().toString();
addText("- 結果:");
addText(text);
if (text.contains(SHRINKER_SUCCESS)) {
addText("- 通知：成功しました。");
addText("- 通知：expdb のサイズを計算します。");
new Handler().postDelayed(this::checkFixed, DELAY_MS);
} else {
addText("- 通知：失敗しました。再度実行します。");
new Handler().postDelayed(this::retry, 5000);
new Handler().postDelayed(this::retryMtkSu, DELAY_MS);
}
}

private void copyAssetsFile(Context context) {
private void copyAssetsFile(Context context, String file) {
File bin = new File(context.getFilesDir(), file);
try {
InputStream inputStream = context.getAssets().open(SHRINKER);
FileOutputStream fileOutputStream = new FileOutputStream(new File(context.getFilesDir(), SHRINKER), false);
InputStream inputStream = context.getAssets().open(file);
FileOutputStream fileOutputStream = new FileOutputStream(bin, false);
byte[] buffer = new byte[1024];
int length;
while ((length = inputStream.read(buffer)) >= 0) {
fileOutputStream.write(buffer, 0, length);
}
bin.setExecutable(true);
fileOutputStream.close();
inputStream.close();
} catch (IOException ignored) {
}
}

private void sh() {
private void sh(String cmd) {
try {
Process process = Runtime.getRuntime().exec("sh");
Process process = Runtime.getRuntime().exec(cmd);
dos = new DataOutputStream(process.getOutputStream());
bufferedReader = new BufferedReader(new InputStreamReader(new DataInputStream(process.getInputStream())));
bufferedReader1 = new BufferedReader(new InputStreamReader(new DataInputStream(process.getErrorStream())));
Expand Down Expand Up @@ -196,7 +230,6 @@ void overwriteFrp() {
addText("- 通知：DchaService にバインドしています。");
if (!bindService(new Intent(DCHA_SERVICE).setPackage(DCHA_PACKAGE), new ServiceConnection() {

@SuppressLint("SdCardPath")
@Override
public void onServiceConnected(ComponentName componentName, IBinder iBinder) {
IDchaService mDchaService = IDchaService.Stub.asInterface(iBinder);
Expand Down Expand Up @@ -250,9 +283,9 @@ public void onServiceConnected(ComponentName componentName, IBinder iBinder) {
try {
mDchaService.setSetupStatus(3);
startActivity(
Settings.Secure.getInt(getContentResolver(), Settings.Global.DEVELOPMENT_SETTINGS_ENABLED, 0) == 1
? new Intent(Settings.ACTION_APPLICATION_DEVELOPMENT_SETTINGS)
: new Intent().setClassName(SETTINGS_PACKAGE, SETTINGS_ACTIVITY)
Settings.Secure.getInt(getContentResolver(), Settings.Global.DEVELOPMENT_SETTINGS_ENABLED, 0) == 1
? new Intent(Settings.ACTION_APPLICATION_DEVELOPMENT_SETTINGS)
: new Intent().setClassName(SETTINGS_PACKAGE, SETTINGS_ACTIVITY)
);
} catch (Exception ignored) {
}
Expand All @@ -275,11 +308,47 @@ public void onServiceDisconnected(ComponentName componentName) {
}
}

String getExpdbSize() {
stringBuilder = new StringBuilder();
copyAssetsFile(this, GDISK);
sh(APP_PATH + MTK_SU);
execute(APP_PATH + GDISK + " -l " + MMCBLK0);
String text = getText().toString();
addText("- 結果：");
addText(text);
return text;
}


void createFrp() {
addText("- 通知：expdb を削除します。");
sh(APP_PATH + MTK_SU);
execute("echo -e p\\nq | " + APP_PATH + GDISK + " " + MMCBLK0);
String text = getText().toString();
addText("- 結果：");
addText(text);
}

void checkFixed() {
if (getExpdbSize().contains("262143")) { // expdb の終了セクタ
addText("- 通知：expdb は修正されていません。");
createFrp();
} else {
addText("- expdb は既に修正済みです。");
callBootloader();
}
}

void callBootloader() {

}

void addText(String str) {
TextView textView = findViewById(R.id.text);
textView.append(str.isEmpty() ? System.lineSeparator() : " " + str + System.lineSeparator());
ScrollView scrollView = findViewById(R.id.scroll);
scrollView.fullScroll(View.FOCUS_DOWN);
scrollView.post(() -> scrollView.fullScroll(ScrollView.FOCUS_DOWN));
}

}
9 changes: 7 additions & 2 deletions docs/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ fastboot flashing unlock

## 対応機種

- チャレンジパッド３
- チャレンジパッド Neo
- チャレンジパッド Next

Expand All @@ -48,5 +49,9 @@ fastboot flashing unlock

このアプリは以下のライブラリーを使用しています。

- app/src/main/assets/**shrinker**
[**CVE-2022-38181**](https://github.com/SmileTabLabo/CVE-2022-38181)
- **shrinker**
[SmileTabLabo/CVE-2022-38181: CVE-2022-38181 PoC for CTX(TAB-A05-BD) and CTZ(TAB-A05-BA1)](https://github.com/SmileTabLabo/CVE-2022-38181)
- **mtk-su**
[Amazing Temp Root for MediaTek ARMv8 \[2020-08-24\] | XDA Forums](https://xdaforums.com/t/3922213/)
- **gdisk**
[\[HOW TO\] BOOT FROM SD CARD \[SUCCESSFULLY\] on QMobile Z8 with BRICKED/DEAD eMMC | XDA Forums](https://xdaforums.com/t/3712171/)

0 comments on commit c633335

Please sign in to comment.