1ultimat3 / BadIntent

Intercept, modify, repeat and attack Android's Binder transactions using Burp Suite
BSD 3-Clause "New" or "Revised" License
322 stars 62 forks source link

Freezing + bootloop #4

Open Neckilljo opened 6 years ago

Neckilljo commented 6 years ago

I'm experiencing bootloops on every device I installed it. Tested on Moto g2 2014 (titan, cm13), Redmi 4 pro (markw, stock marshmallow), zuk z2 pro (z2121, stock marshmallow), galaxy A5 2016 (stock marshmallow). I'm using justtrustme and inspeckage modules altogether. When it starts to slow down, freeze and bootloop, I have to enter twrp and delete badintent to recover from it.

1ultimat3 commented 6 years ago

Have you switched on the system app hooking? There are watchdog issues when hookimg system apps. Could you provide your preferences of Badintent Android?

ehsandeep commented 6 years ago

Hello @Neckilljo @mateuszk87,

i noticed the same bootloop behavior on my device running on Android 6, and did the same thing via TWRP, anyway i also read this:

There are known limitations in hooking all system apps and all interfaces. During the boot proccess the Android system will remain in a boot loop and you will not be able to uninstall BadIntent from your Android device. Therefore, it is strongly recommended to use the mentioned setup in case all system apps are hooked

so am assuming we can't use BadIntent on the real devices, am i correct @mateuszk87 ?

1ultimat3 commented 6 years ago

Turn off system hooking :) up to now badintent focuses on user app hooking. Full system support is on its way (some parts are not published yet)

ehsandeep commented 6 years ago

Yes, user app hooking is only what i am looking for, but once we install the BadIntent from Xposed or APK, we need to reboot/soft reboot the device for enabling the module and once we reboot it went into bootloop state?

Correct me if i missed any step @mateuszk87 & thanks for making this.

1ultimat3 commented 6 years ago

Before rebooting, you can simply change the BadIntent configuration :)

ehsandeep commented 6 years ago

Hello @mateuszk87,

Thanks for quick reply but by default the Hook System App is disabled only ? but still i can see the boot loop issue!

1ultimat3 commented 6 years ago

Hi, oh, you are right https://github.com/mateuszk87/BadIntent/blob/master/BadIntentAndroid/app/src/main/res/xml/bad_intent_preferences.xml#L42 , it is disabled by default. Do you have a chance to use logcat and provide the output?

Regards

Mateusz

ehsandeep commented 6 years ago

Hello @mateuszk87!

sorry but didn't understood clearly what you asked, logcat of running badintent before reboot or ? anyway did you tried on any real device and found same or it's just me?

ehsandeep commented 6 years ago

Hello @mateuszk87, did u had any luck with replicate it or resolve it ?

1ultimat3 commented 6 years ago

I am working on it :) In (approx) December there will be a greater commit / update, which will tackle the boot freeze issues.

mnessenz commented 5 years ago

Meh bootloop problem still exists, at least for me

synnack commented 5 years ago

The system app exclusion list does not cover any cyanogenmod/lineageos/samsung/motorola apps. This likely causes the boot loops.

I've gotten Cyanogenmod 13 working with this exclusion list, not sure about newer android/lineage versions yet:

    protected String[] getBypassList() {
        boolean hookSystem = sPrefs.getBoolean(BadIntentConstants.HOOK_SYSTEM_SWITCH, false);
        if (hookSystem) {
            //only bypass android core
            return new String[]{
                    "android"
            };
        } else {
            return new String[]{
                    "android",
                    "com.android.*",
                    "com.google.*",
                    "org.cyanogenmod.*",
                    "org.lineageos.*",
                    "de.robv.android.xposed.*",
                    "de.mat3.badintent",
            };
        }
    }
synnack commented 5 years ago

Newer android versions apparently also have some issues with parcels / intents so more fixes are needed there to work on newer LineageOS versions. (aside from MODE_WORLD_READABLE -> MODE_PRIVATE like in issue #6)