Programación

Luis David Moreno

Secrete Hack codes for Android Mobile phones

Secret hack codes are usually hidden from users to prevent misuse and exploit. Android is a very new platform so there aren't many hack codes for Androids available. Today I will share all of the hack codes of Android cellphones that I know. I have tested these codes on my Samsung Galaxy with the Android OS version 2.2. I am sure these will work on all previous versions.

Secret Hack Codes for Android Mobile Phones:

1. Complete Information About Your Phone

*#*#4636#*#*

This code can be used to get some interesting information about your phone and battery. It shows the following 4 menus on the screen:

Phone information
Battery information (How to maximize or boost battery life in android phones)
Battery history
Usage statistics

2. Factory data reset

*#*#7780#*#*

This code can be used for a factory data reset. It'll remove the following things:

Google account settings stored in your phone
System and application data and settings
Downloaded applications

It will NOT remove:

Current system software and bundled application
SD card files e.g. photos, music files, etc.

Note: Once you give this code, you will get a prompt screen asking you to click on the "Reset phone" button, giving you the chance to cancel your operation.

3. Format Android Phone

*2767*3855#

Think before you input this code. This code is used for factory formatting. It will remove all files and settings, including the internal memory storage. It will also reinstall the phone firmware.

Note: Once you give this code, there is no way to cancel the operation unless you remove the battery from the phone.

4. Phone Camera Update

*#*#34971539#*#*

This code is used to get information about phone camera. It shows following 4 menus:

Update camera firmware in image (Don't try this option)
Update camera firmware in SD card
Get camera firmware version
Get firmware update count

WARNING: NEVER use the first option. Your phone camera will stop working and you will need to take your phone to a service center to reinstall camera firmware.

5. End Call/Power

*#*#7594#*#*

This one is my favorite. This code can be used to change the action of the "End Call/Power" button. Be default, if you hold the button down for a long time, it shows a screen asking you to select between silent mode, airplane mode, and power off.

Using this code, you can enable this button to power off without having to select an option, saving you some time.

6. File Copy for Creating Backup

*#*#273283*255*663282*#*#*

This code opens a file copy screen where you can backup your media files e.g. images, sound, video and voice memo.

7. Service Mode

*#*#197328640#*#*

This code can be used to enter into service mode. In service mode, you can run various tests and change settings.

8. WLAN, GPS and Bluetooth Secret Hack Codes for Android:

*#*#232339#*#* OR *#*#526#*#* OR *#*#528#*#* – WLAN test (Use "Menu" button to start various tests)

*#*#232338#*#* – Shows WiFi MAC address

*#*#1472365#*#* – GPS test

*#*#1575#*#* – Another GPS test

*#*#232331#*#* – Bluetooth test

*#*#232337#*# – Shows Bluetooth device address

9. Codes to get Firmware version information:

*#*#4986*2650468#*#* – PDA, Phone, H/W, RFCallDate

*#*#1234#*#* – PDA and Phone

*#*#1111#*#* – FTA SW Version

*#*#2222#*#* – FTA HW Version

*#*#44336#*#* – PDA, Phone, CSC, Build Time, Changelist number

10. Codes to launch various Factory Tests:

*#*#0283#*#* – Packet Loopback

*#*#0*#*#* – LCD test

*#*#0673#*#* OR *#*#0289#*#* – Melody test

*#*#0842#*#* – Device test (Vibration test and BackLight test)

*#*#2663#*#* – Touch screen version

*#*#2664#*#* – Touch screen test

*#*#0588#*#* – Proximity sensor test

*#*#3264#*#* – RAM version

@EVERYTHING NT

Continue reading

Luis David Moreno

Interators are usually implemented using signed integers like the typical "for (int i=0; ..." and in fact is the type used indexing "cstr[i]", most of methods use the signed int, int by default is signed.
Nevertheless, the "std::string::operator[]" index is size_t which is unsigned, and so does size(), and same happens with vectors.
Besides the operator[] lack of negative index control, I will explain this later.

Do the compilers doesn't warn about this?

If his code got a large input it would index a negative numer, let see g++ and clang++ warnings:

No warnings so many bugs out there...

In order to reproduce the crash we can load a big string or vector from file, for example:

I've implemented a loading function, getting the file size with tellg() and malloc to allocate the buffer, then in this case used as a string.
Let see how the compiler write asm code based on this c++ code.

So the string constructor, getting size and adding -2 is clear. Then come the operator<< to concat the strings.
Then we see the operator[] when it will crash with the negative index.
In assembly is more clear, it will call operator[] to get the value, and there will hapen the magic dereference happens. The operator[] will end up returning an invalid address that will crash at [RAX]

In gdb the operator[] is a allq 0x555555555180 <_znst7__cxx1112basic_stringicst11char_traitsicesaiceeixem plt="">

(gdb) i r rsi
rsi 0xfffffffffffefffe -65538

The implmementation of operator ins in those functions below:

(gdb) bt
#0 0x00007ffff7feebf3 in strcmp () from /lib64/ld-linux-x86-64.so.2
#1 0x00007ffff7fdc9a5 in check_match () from /lib64/ld-linux-x86-64.so.2
#2 0x00007ffff7fdce7b in do_lookup_x () from /lib64/ld-linux-x86-64.so.2
#3 0x00007ffff7fdd739 in _dl_lookup_symbol_x () from /lib64/ld-linux-x86-64.so.2
#4 0x00007ffff7fe1eb7 in _dl_fixup () from /lib64/ld-linux-x86-64.so.2
#5 0x00007ffff7fe88ee in _dl_runtime_resolve_xsavec () from /lib64/ld-linux-x86-64.so.2
#6 0x00005555555554b3 in main (argc=2, argv=0x7fffffffe118) at main.cpp:29

Then crashes on the MOVZX EAX, byte ptr [RAX]

Program received signal SIGSEGV, Segmentation fault.

0x00005555555554b3 in main (argc=2, argv=0x7fffffffe118) at main.cpp:29
29 cout << "penultimate byte is " << hex << s[i] << endl;
(gdb)

What about negative indexing in std::string::operator[] ?
It's exploitable!

In a C char array is known that having control of the index, we can address memory.
Let's see what happens with C++ strings:

The operator[] function call returns the address of string plus 10, and yes, we can do abitrary writes.

Note that gdb displays by default with at&t asm format wich the operands are in oposite order:

And having a string that is in the stack, controlling the index we can perform a write on the stack.

To make sure we are writing outside the string, I'm gonna do 3 writes:

See below the command "i r rax" to view the address where the write will be performed.

The beginning of the std::string object is 0x7fffffffde50.
Write -10 writes before the string 0x7fffffffde46.
And write -100 segfaults because is writting in non paged address.

So, C++ std::string probably is not vulnerable to buffer overflow based in concatenation, but the std::string::operator[] lack of negative indexing control and this could create vulnerable and exploitable situations, some times caused by a signed used of the unsigned std::string.size()

Related posts

Luis David Moreno

Research: F-Secure: OnionDuke: APT Attacks Via the Tor Network

Download

Download. Email me if you need the password (new link)

File attributes

Size: 219136

MD5: 28F96A57FA5FF663926E9BAD51A1D0CB

Size: 126464

MD5: C8EB6040FD02D77660D19057A38FF769

Size: 316928

MD5: D1CE79089578DA2D41F1AD901F7B1014

Virustotal info

https://www.virustotal.com/en/file/366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b/analysis/

SHA256: 366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b

File name: 366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b

Detection ratio: 8 / 52

Analysis date: 2014-11-15 18:37:30 UTC ( 8 hours, 44 minutes ago )

Antivirus Result Update

Baidu-International Trojan.Win32.Agent.adYf 20141107

F-Secure Backdoor:W32/OnionDuke.B 20141115

Ikarus Trojan.Win32.Agent 20141115

Kaspersky Backdoor.Win32.MiniDuke.x 20141115

Norman OnionDuke.A 20141115

Sophos Troj/Ransom-ALA 20141115

Symantec Backdoor.Miniduke!gen4 20141115

Tencent Win32.Trojan.Agent.Tbsl 20141115

https://www.virustotal.com/en/file/366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b/analysis/

SHA256: 366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b

File name: 366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b

Detection ratio: 8 / 52

Antivirus Result Update

Baidu-International Trojan.Win32.Agent.adYf 20141107

F-Secure Backdoor:W32/OnionDuke.B 20141115

Ikarus Trojan.Win32.Agent 20141115

Kaspersky Backdoor.Win32.MiniDuke.x 20141115

Norman OnionDuke.A 20141115

Sophos Troj/Ransom-ALA 20141115

Symantec Backdoor.Miniduke!gen4 20141115

Tencent Win32.Trojan.Agent.Tbsl 20141115

https://www.virustotal.com/en/file/0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade/analysis/

SHA256: 0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade

File name: 0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade

Detection ratio: 19 / 55

Analysis date: 2014-11-15 18:37:25 UTC ( 8 hours, 47 minutes ago )

Antivirus Result Update

AVware Trojan.Win32.Generic!BT 20141115

Ad-Aware Backdoor.Generic.933739 20141115

Baidu-International Trojan.Win32.OnionDuke.BA 20141107

BitDefender Backdoor.Generic.933739 20141115

ESET-NOD32 a variant of Win32/OnionDuke.A 20141115

Emsisoft Backdoor.Generic.933739 (B) 20141115

F-Secure Backdoor:W32/OnionDuke.A 20141115

GData Backdoor.Generic.933739 20141115

Ikarus Trojan.Win32.Onionduke 20141115

Kaspersky Backdoor.Win32.MiniDuke.x 20141115

McAfee RDN/Generic BackDoor!zw 20141115

McAfee-GW-Edition BehavesLike.Win32.Trojan.fh 20141114

MicroWorld-eScan Backdoor.Generic.933739 20141115

Norman OnionDuke.B 20141115

Sophos Troj/Ransom-ANU 20141115

Symantec Backdoor.Miniduke!gen4 20141115

TrendMicro BKDR_ONIONDUKE.AD 20141115

TrendMicro-HouseCall BKDR_ONIONDUKE.AD 20141115

VIPRE Trojan.Win32.Generic!BT 20141115

Related links

Programación

lunes, 31 de agosto de 2020

Secret Hack Codes For Android Mobile Phones

Secret Hack Codes for Android Mobile Phones:

1. Complete Information About Your Phone

2. Factory data reset

3. Format Android Phone

4. Phone Camera Update

5. End Call/Power

6. File Copy for Creating Backup

7. Service Mode

8. WLAN, GPS and Bluetooth Secret Hack Codes for Android:

9. Codes to get Firmware version information:

10. Codes to launch various Factory Tests:

Continue reading

domingo, 30 de agosto de 2020

C++ Std::String Buffer Overflow And Integer Overflow

OnionDuke Samples

Archivo del blog