Getting ADB working on the Jio Phone

[AdvancedHACKERniV1]

For some reason, developer options does not show up even after Jailbreaking the Jio Phone which means no access to ADB.

I would like to request some help enabling ADB on the Jio Phone.

If we are successful then we can even get the WhatsApp client app package from the Jio Phone via ADB.

Potentially allowing us to install WhatsApp on the Nokia 8110 4G via OmniSD.

[Nayam Amarshe]

ADB was working in 2017 firmware, although it didn't boot in my f50y, the recovery was working.
What model do you have?
We can get recovery working, I have a theory though, we can push our RSA adb keys via update zip file in jiophone to authorize our computer and then use adb freely.

[speeduploop]

If I got your nickname right you should be able to do this on your own :D

-- if it's possible to install zips than root shouldn't be a problem

-- as root you may install every binary you want (telnetd, adbd, ftpd, ...)

-- ?????

-- profit!

With an update.zip you may even install such binaries without the step of rooting first.

---> just create an update.zip with a script dumping infos about your root-fs (you need to know contents of /system/bin, location/names of init-scripts, list of busybox-applets)

---> now mod one of those int-scripts to start your desired binary (telnetd, adbd, ftpd, ...)

But as I said before: updates.zips must be working. And some KaiOS-/Android-Device won't boot if you change something in /system.

(Nokia 8110 doesn't check -- JioPhone I don't know -- those checks may be enabled with a future firmware-update...)

Getting the needed infos and testing it out is no problem if you have a Jio -- I don't ;)

[AdvancedHACKERniV1]

I have Jio Phone F50Y.

The problem is signature verification when installing an update.zip.

[Nayam Amarshe]

Because you need to sign em with test keys.

[AdvancedHACKERniV1]

I think we can use Aroma File Manager (root file manager for recovery mode) to edit build.prop or something to get ADB working.

[speeduploop]

If they really need the test-keys (and not their own) than that's no problem.

The test-keys are provided by Kaitech in their GIT and in the AOSP (v6.0.1 IIRC) source-tree also.

[speeduploop]

The try it.

But even if this works you would most probably get a restricted adb (no root rights).

--> at least adb on the 8110 just ignores all 'root-flags' for adb.

[AdvancedHACKERniV1]

We need ADB with root privileges to access the app packages in the /data partition right ? 

[speeduploop]

Yes.

But you don't need adb -- you need somekind of Shell-/File-Server... this can be adb but you could use telnet or ftp or whatever...

(my first root for Nokia 8110 used a patched adbd - but now I use a simple telnetd. It's simpler and KaiOS doesn't use the 'extended' features of adb - it's not Android)

If the filesystem of the Nokia and Jio is quite the same - a small change in my telnet-mod for Nokia 8110 would make it work on the Jio...

[AdvancedHACKERniV1]

Now I realized that we can get WhatsApp package without ADB.

We can copy the package to an SD using Aroma File Manager.

[AdvancedHACKERniV1]

For some reason signature verification failed again; 

errors:

E:footer is wrong

E:signature verification failed

don't know what a footer is.

[speeduploop]

and we don't know what you did to get this error ;)

[AdvancedHACKERniV1]

Signed a package with testkey.pk8 and testkey.x509.pem

[speeduploop]

So either test-keys aren't working or files are corrupt or wrong arguments used while signing...

We would know more if you really wrote what you did - not what you wanted to do ;)

If someone should help you then ask 'complete' questions and give some informations about what exactly doesn't work.

No one can read your mind :D

-- so I'm out.

[AdvancedHACKERniV1]

I wanted to run Aroma File Manager on the Jio Phone through which I can copy the WhatsApp package from the /data partition.

So I Signed Aroma File Manager .zip with the test keys.

I used the java version of signapk to sign the package.

But even after I signed the package with the test keys, signature verification failed.

[AdvancedHACKERniV1]

I used the following arguments:

java -jar .\signapk.jar .\testkey.x509.pem .\testkey.pk8 aromafm-1.00-120512-002.zip aromafm-1.00-120512-002_Signed.zip

[Nayam Amarshe]

That will never work.

1. Aroma doesn't support mouse input or Keyboard Input, in this case, keypad will do no good, you won't even be able to pass the introduction screen.

2. Don't sign an already signed zip, they don't work most of the time.

3. Aroma won't work, this phone doesn't use dalvik, it uses b2g. So android apps can't run(imo)

[speeduploop]

I try to answer/react by number... :D

(1) --> yes - and I think on such a small screen this GUI is too much.

(2) --> if you delete the old signature from the zip beforehand that's no problem.

(3) --> KaiOS has some Android-parts but to be safe I would recommend static-linking for such apps.

[AdvancedHACKERniV1]

Aroma File Manager is our only hope.

Unless there is another recovery file manager that is better.

Aroma can be used with Volume+ Volume- and Power or touch screen.

Jio Phone has no touch screen but only a few have realized that

navigation up = Volume+

navigation down = Volume-
call end = Power

Somehow we might be able to customize Aroma to fit in a screen with a wired resolution(Jio Phone Screen).

The telnet hack is not functional on the Jio Phone as Jio Phone has ADB disabled therefore we cant telnet localhost

and if I use PuTTY to telnet using the phone's local IP, I get a 'connection refused'.

Even if telneton.zip got installed successfully without errors, it is of no use without a way to telnet into the phone.

We can create an update.zip which dumps the /data partition to the SD.

But I feel using Aroma is a better solution.

We might be able to use the telnet hack but for that, we need a telnet client app for KaiOS as Jio Phone currently does not have ADB enabled and it refuses incoming telnet requests from a different client.

[AdvancedHACKERniV1]

And I think aroma is not an android app.

It can universally run on devices with an android recovery and an android kernel.

[speeduploop]

As I said before: my telnet-hack is restricted to local connections by design... it doesn't has to be.

(it would be a minimal change to allow connections over WLAN from any PC ;) )

Dumping /data to sd with an update.zip is also trivial.

[AdvancedHACKERniV1]

Can you please provide me with the modified version of telneton.zip with not restrictions to local connections?

[speeduploop]

1. I can't guarantee that it works on the Jio - but if the file system is like the one on Nokia 8110 it should.

2. I restricted the access for a reason in my normal version... without this restriction EVERYONE on same WLAN (worstcase even worldwide) can access your phone over telnet. You should probably avoid public WLANs :D

[AdvancedHACKERniV1]

Thank You Very Much :))))))))))

And can I use telnetoff.zip to disable telnet-unsafe.zip?

[speeduploop]

yes - both telnet-zips use the same 'marker' for uninstall... so telnetoff works.

telneton and telnet-unsafe are nearly the same - the whole difference is one argument to telnetd ;)

(which sets the 'bind-address')

[Nayam Amarshe]

You should probably open aroma installer zip to see if it has an apk structure or not.
Anyways, it still won't work, as I said, It doesn't support keyboard or mouse input, If you know C++ you can modify original source code to enable keyboard but that requires hours of looking into the code. Me and my friends tried to do it but we couldn't enable the keyboard input, probably because of the drivers and all those things and original aroma developer has abandoned the project along with xda.

[AdvancedHACKERniV1]

I don't think it has an apk structure.

If my current directory has Aroma.zip extracted then

./META-INF/com/google/android/update-binary

is the Aroma File Manager.

It is in some kind of binary not shell script.

And I don't think it requires keyboard support as it can be operated with Volume+ Volume- and Power

[AdvancedHACKERniV1]

Bad news:(

It didn't work

'connection refused' again.

[speeduploop]

Have you checked the install-log after update from sd?

(it should show an error when the init-script I use doesn't exist on the Jio)

Then you would need a dump of /system to make it work.

(check init-scripts and if telnetd is available in device's busybox)

[AdvancedHACKERniV1]

Do you have an update.zip that dumps /system to a directory on the SD card?

If yes can please share the link?

[speeduploop]

No, I don't at the moment. But I thought about writing one.

But what about error-messages? (this would give some insight)

And you didn't forgot to mount /system before installing telnet? (just to be sure)

[AdvancedHACKERniV1]

I did mount /system and the installation was successful.(No Errors)

But connection is still refused by the phone

[speeduploop]

If it installs without errors than at least the init-script exists - which is good.

When I have time I will write a 'dump-all' zip... :D
-- this should then give the missing information.

[speeduploop]

In the meantime you could try this --> https://github.com/nexus511/nokia_8110_4g_dump (not from me)

Quite possible it works...

[syl...@rentoo.immo]

Personally I use busybox to do that:

#!/tmp/busybox sh

/tmp/busybox mount -t vfat -o rw /dev/block/mmcblk1p1 /sdcard

/tmp/busybox dd if=/dev/block/bootdevice/by-name/data of=/sdcard/data.img

echo "data dumped"

[speeduploop]

yes - I would do it nearly the same way... but this is to complicated for an AdvancedHacker ;)

(ok - I would use the builtin busybox to simplify things - and I want a 'dump-all' + some 'extra-infos')

-- to know how to install a backdoor I need /system and location/content of bin-folders + listing of busybox-applets.

(if I had a Jio on my desk this would be some minutes works - but I don't so I would have to create a 'investigation-script' :D )

[AdvancedHACKERniV1]

Thats easy.
I can create such scripts on my own but the problem is the signature verification.

[AdvancedHACKERniV1]

WhatsApp!!!!!!!!!!:

https://drive.google.com/open?id=1V3V1RQIXmyt47YU642PxQ4HqBXnTnY5T

All credits to speeduploop. It wouldn't be possible without speeduploop's guidance.

On Thursday, November 22, 2018 at 3:58:43 PM UTC+5:30, AdvancedHACKERniV1 wrote:

Potentially allowing us to install WhatsApp on the Nokia 8110 4G via OmniSD.

[AdvancedHACKERniV1]

Thank You very much.

It worked !!!!!!!!!!

All of Jio Phone's secrets are revealed

[AdvancedHACKERniV1]

speeduploop, you wanted to know Jio's /system 's contents right?

Here you go:

https://drive.google.com/open?id=1_hQQXO_VTYFxd_a47dtBAbR2t-VlOG-p

I've 7zipped it to reduce the file size.

[AdvancedHACKERniV1]

Jio Phone F50Y's latest OTA package:

https://drive.google.com/open?id=16HtsspQmB4qFVr4pDkoAz5e1FiuEDb-Q

But I couldn't update to the latest version as the system partition is modified.

Good that I didn't update. Who knows if Jio has included any kind of file-system-integrity patch which might stop us from modifying the /system partition in the future.

[Backwood]

Thanks a billion! He was an Advanced hacker after all...

Whatsapp wouldn't install, it said invalid signature.

[AdvancedHACKERniV1]

Sorry. I'll fix that and upload the updated package.

You can bypass the signature verification by deleting the certificates in META-INF directory inside application.zip and repacking everything.

[AdvancedHACKERniV1]

Check if it works now. I've updated the file. Use the same link.

[lindsey schaap]

oeh! nice! it's installing now, so got it installed, now its complaining with the following error:

'pleas update your dfevice software to the latest from settings'

I am emediatly going to have a look at a work around for that:)

let me see what i can figure out this afternoon...

[Nayam Amarshe]

Yo, email me on nayama...@atvxperience.com, I'll give you access to jbstore server so you can upload the apps for everyone ;) You're a Freaking genius boi, also speeduploop 👌

[AdvancedHACKERniV1]

Sorry :( Don't have a Nokia 8110 4G to test the app.

[AdvancedHACKERniV1]

Thank You.

But I don't think the app is functional on a Nokia 8110 4G yet.

Further testing is required before uploading it to the store.

[syl...@rentoo.immo]

you need to unzip, remove META_INF and rezip it

[AdvancedHACKERniV1]

I removed the certificate files.

There was another file.

I don't think that is one of the certificates.

Deleting that might break the app.

[hmst tsmh]

You should remove update.webapp

when it shows update you device to latest version.

[Backwood]

I removed this and re-zipped, also tried removing update.webapp but it still has the same problem.

[hmst tsmh]

now how to do ?

[lindsey schaap]

Well, I came to the point that I now know that the message is comming from within the page.js, but this stuff is writen real code ninja way, that it's nearly unreadable, still busy with figuring out at what point it exacutes this message.

[AdvancedHACKERniV1]

Open page.js.

Open Find and replace.

Find for "old_version"

you get case"old_version"

I think if you remove that, it might work.

Sorry. Don't have a Nokia 8110 4G to test.

[Backwood]

didn't work either

[lindsey schaap]

okey.. so it stopped giving the error after i forced it to tell that my devide is supported, but then still nothing happens:'(

any other idea's?

[AdvancedHACKERniV1]

Found something.....

Open "lang-en-js.js"

Open Find and Replace

Find "latest"

You will find something interesting .

[AdvancedHACKERniV1]

Open "page.js".

Open Find and Replace.

Find "deviceinfo".

I think it is something to do with that.

[lindsey schaap]

hmm... yeah I am passed that point, it's being called in page.js, after page.js calles common.js to test if it os support is true, if it is true, it will stop the error message from appearing, but it will not do much else, wont actually load new content on the screen, and as this code is minified fuckedup code, it is nearly unreadable..

:(

[AdvancedHACKERniV1]

speeduploop please help.

[syl...@rentoo.immo]

ive patched the version on the store, you can now use any kaios phone.

For now on the registrations restricted to Indian numbers, Im working on a patch.

[AdvancedHACKERniV1]

Wow great work!
Wish I could test it with a Nokia 8110 4G.

[hmst tsmh]

I know you can do that. come on........

[Backwood]

i didn't get any shortcut to my 8110 after installion from jbstore, dunno how to to uninstall it now :x

[hmst tsmh]

power off and power on now....

[lindsey schaap]

Hey Sylvian,

Supper awesome you managed to pull the trick!

It took me 4 hours to get knowwhere, so I am curious what you did to make it work?! :O

tnx in advance!

[speeduploop]

Sooo....

After reading a bit in your /system I know where it went wrong.

My telnet-root uses 'busybox' -- and there is no busybox on the Jio ;)

(and by the way... there is also no adbd on the Jio - so it's quite obvious why it wasn't possible to enable it :D)

Good news is that the init-scripts are where they should be and my patch worked...

(ok - the uninstall - telenetoff.zip - uses busybox and so it doesn't work... and your init has 3 non-working telnet-entries at the moment)

BUT: if we include a telnetd in the zip and change the script to not use busybox (or include a temp-busybox in the zip) the whole thing should work on the Jio.

On Friday, 23 November 2018 13:17:46 UTC+1, AdvancedHACKERniV1 wrote:

speeduploop, you wanted to know Jio's /system 's contents right?

Here you go:

https://drive.google.com/open?id=1_hQQXO_VTYFxd_a47dtBAbR2t-VlOG-p

I've 7zipped it to reduce the file size.

[Daniël Eikelenboom]

Holy shit, great work guys! It's indeed restricted to Indian numbers, but the app works! Awesome!

If there's anything I can do to help let me know (Im not really a programmer though)!

Op vrijdag 23 november 2018 20:17:15 UTC+3 schreef syl...@rentoo.immo:

[AdvancedHACKERniV1]

I suspected Jio to have removed some of the binaries to make their phones less prone to hacks.
But I never expected them to have removed adbd

[speeduploop]

And it's really surprising how different the root-fs of two KaiOS-v2.5-Phones can be...

[AdvancedHACKERniV1]

Any progress ??

[AdvancedHACKERniV1]

Any progress getting WhatsApp working on non Indian numbers ??

On Saturday, November 24, 2018 at 1:10:15 PM UTC+5:30, AdvancedHACKERniV1 wrote:

Any progress ??

[AdvancedHACKERniV1]

Yeah.

I Assumed all KaiOS phone's rootfs is standardized.(Except small negligible things)

But turns out not.

Just as my father told. Which I didn't agree to.

But now I agree.

[Nayam Amarshe]

Running WhatsApp on this shit is so inconvenient but still, it's fun to see things work where we least expect them to😂

[Hossain Mohammed Shoaib]

Nayam sorry for disturbing 

i want to know restore.zip can work on Nokia 8110 

or install official update. plz

thanks in advance

[Nayam Amarshe]

Yes it will work, that's why I sent you the link.

[Hossain Mohammed Shoaib]

thanks a trillion in advanced. plz sent me the link on hossainmoha...@gmail.com

i want to just install update and reinstall 
OmniSD

-Nokia 8110 4G

[Daniël Eikelenboom]

Let us know whats in the update ;)

[Hossain Mohammed Shoaib]

The update of Nokia 8110 4G firmware version 13.00.17.01 is:

Changed youtube app with red icon like original android app.

Google Maps are updated to  version of 2018.1112.1 

[AdvancedHACKERniV1]

Any progress in making WhatsApp work on international numbers ??

[Hossain Mohammed Shoaib]

no update

[Backwood]

I tried to find a way to change the pre-filled +91 India to my own countrycode but I cannot locate the right values in the files, I dont speak Javascript. Dont know anything about coding, wish I did.

[Backwood]

This was also included in the codes, true story 

__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED

:D

[Daniël Eikelenboom]

hahaha thats hilarious

[Hossain Mohammed Shoaib]

hi Backwood do you able to install latest update

[Backwood]

Yeah the 13.00.17.01 installed fine yesterday. Dunno what it changed tho.

[Hossain Mohammed Shoaib]

with OmniSD or Without

[Backwood]

With OmniSD i used the way that doesnt break updates. And it didn't.

[Hossain Mohammed Shoaib]

which way please explain to me?

regards

Backwood

[Nayam Amarshe]

Read the thread by Luxferre.

[Hossain Mohammed Shoaib]

i am read that and now want conform that 

is that 1st way i mean using recovery mode.

[AdvancedHACKERniV1]

Yeah.

Even I found that yesterday and was puzzled.

I thought that it is for the developers behind this version of WhatsApp and just ignored it.

[Rubén Rodrigo]

Hi! I found this line in page.js: Na="91";function Ta(e){return e===Na}var Ra=[{name:"countriesIndia",cc:Na}

I've searched through all the files in the app with this command: grep -rnw -e '91'

That is the only line with those characteristics that includes country code plus other info. A few other country names appear in the same file but none with the pattern shown above. This might mean that this is the line to be changed.

If anyone could try changing the 91 to their country code, install the app and test? My phone is not jailbroken yet.

[syl...@rentoo.immo]

yes I have added an other country, but now I'm failing to get a sms verification code, WhatsApp don't recognise the phone user agent I guess.

Also if you add a country, add the translation :)

If you can provide me the full list of WhatsApp countries I will update the app 

[Backwood]

I believe whatsapp is available in every country cept China, North Korea, Iran, Cuba, Syria, UAE for their polical reasons..

I have tried changing that line to my country Finland 'n countrycode +358 but it still kept throwing India at me. Dunno how to change the translations. But there were very limited translations, is the whatsapp avaible only in those translations : /

[syl...@rentoo.immo]

Check my patched version on the store, I've indented the code and added France.

[Backwood]

Oh dear, yer a wizard! I'll try it as soon as my kids get off the computer ._.

[Getz Mikalsen]

I dont see the updated version but the app already didnt work with indian numbers, it grants an error message asking me to update the app.

But i believe that this is beyond the scope of this thread regarding adb on the jio.