cyborg-one
commented
2 years ago To view the values in the packet headers, use network traffic sniffers. In your log, the rules for iptables are set correctly.
Open Zibri opened 2 years ago
cyborg-one
commented
2 years ago To view the values in the packet headers, use network traffic sniffers. In your log, the rules for iptables are set correctly.
Zibri
commented
2 years ago I repeat: it does not work. TTL is still decreased. I found a different solution for that, a simple patch to any kernel would just avoid the ttl decrease. Just unpack a boot image then search for C9220039C816007968F24039E8002836 and replace it with 1F2003D51F2003D568F24039E8002836.
If you have magiskboot binary:
magiskboot unpack -h boot.img
magiskboot hexpatch kernel C9220039C816007968F24039E8002836 1F2003D51F2003D568F24039E8002836
magiskboot repack boot.img boot_ttlfix.imgfastboot boot boot_ttlfix.img (to test it)
or
fastboot flash boot boot_ttlfix.img to flash it.
cyborg-one
commented
2 years ago Nfqttl does not process all packets, only incoming packets with ttl values of 64 and 128 are processed on hotspot device. Therefore, the ttl value in ping is not indicative. In version 2.8, packet filtering is done in code, in version 2.1.2, packet filtering is done by iptables rules. Both versions are worth trying. The value of ttl look tcpdump.
cyborg-one
commented
2 years ago If you have magiskboot binary:
magiskboot unpack -h boot.img magiskboot hexpatch kernel C9220039C816007968F24039E8002836 1F2003D51F2003D568F24039E8002836 magiskboot repack boot.img boot_ttlfix.img fastboot boot boot_ttlfix.img (to test it)
I try this on device redmi 4x.
/data/adb/magisk/busybox dd if="/dev/block/bootdevice/by-name/boot" of="boot.img" conv=notrunc <
131072+0 records in 131072+0 records out 67108864 bytes (64.0MB) copied, 5.402307 seconds, 11.8MB/s santoni:/data/data/com.termux/files/home/tmp # /data/adb/magisk/magiskboot unpack -h boot.img < Parsing boot image: [boot.img] HEADER_VER [0] KERNEL_SZ [26950316] RAMDISK_SZ [2761311] SECOND_SZ [0] EXTRA_SZ [0] OS_VERSION [7.1.2] OS_PATCH_LEVEL [2018-10] PAGESIZE [2048] NAME [] CMDLINE [console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 androidboot.bootdevice=7824900.sdhci earlycon=msm_hsl_uart,0x78B0000 buildvariant=user] CHECKSUM [92a488f4658ece83714982c130fb01d6c07cd76d000000000000000000000000] KERNEL_DTB_SZ [16967923] KERNEL_FMT [gzip] RAMDISK_FMT [gzip]
data/adb/magisk/magiskboot hexpatch kernel C9220039C816007968F24039E8002836 1F2003D51F2003D568F24039E8002836 < 1|santoni:/data/data/com.termux/files/home/tmp # 1|santoni:/data/data/com.termux/files/home/tmp # data/adb/magisk/magiskboot repack boot.img new.img < Parsing boot image: [boot.img] HEADER_VER [0] KERNEL_SZ [26950316] RAMDISK_SZ [2761311] SECOND_SZ [0] EXTRA_SZ [0] OS_VERSION [7.1.2] OS_PATCH_LEVEL [2018-10] PAGESIZE [2048] NAME [] CMDLINE [console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 androidboot.bootdevice=7824900.sdhci earlycon=msm_hsl_uart,0x78B0000 buildvariant=user] CHECKSUM [92a488f4658ece83714982c130fb01d6c07cd76d000000000000000000000000] KERNEL_DTB_SZ [16967923] KERNEL_FMT [gzip] RAMDISK_FMT [gzip] Repack to boot image: [new.img]
HEADER_VER [0] KERNEL_SZ [26950316] RAMDISK_SZ [2761311] SECOND_SZ [0] EXTRA_SZ [0] OS_VERSION [7.1.2] OS_PATCH_LEVEL [2018-10] PAGESIZE [2048] NAME [] CMDLINE [console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 androidboot.bootdevice=7824900.sdhci earlycon=msm_hsl_uart,0x78B0000 buildvariant=user] CHECKSUM [92a488f4658ece83714982c130fb01d6c07cd76d000000000000000000000000] santoni:/data/data/com.termux/files/home/tmp # /data/adb/magisk/busybox dd if="new.img" of="/dev/block/bootdevice/by-name/boot" conv=notrunc <
131072+0 records in 131072+0 records out 67108864 bytes (64.0MB) copied, 9.078945 seconds, 7.0MB/s santoni:/data/data/com.termux/files/home/tmp #
Reboot and Ping on the receiving device and tcpdump on the hotspot device.
santoni:/ # /data/data/com.termux/files/usr/bin/tcpdump -vvvni any host 8.8.8.8 -c 4
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
22:46:46.281844 IP (tos 0x0, ttl 64, id 45282, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.42.24 > 8.8.8.8: ICMP echo request, id 14760, seq 1, length 64
22:46:46.281982 IP (tos 0x0, ttl 63, id 45282, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.1.100 > 8.8.8.8: ICMP echo request, id 14760, seq 1, length 64
22:46:46.355923 IP (tos 0x20, ttl 106, id 0, offset 0, flags [none], proto ICMP (1), length 84)
8.8.8.8 > 192.168.1.100: ICMP echo reply, id 14760, seq 1, length 64
22:46:46.356115 IP (tos 0x20, ttl 105, id 0, offset 0, flags [none], proto ICMP (1), length 84)
8.8.8.8 > 192.168.42.24: ICMP echo reply, id 14760, seq 1, length 64
4 packets captured
4 packets received by filter
0 packets dropped by kernel
santoni:/ #
Zibri
commented
2 years ago @cyborg-one
it didn't work because your kernel image was NOT patched.
if magiskboot finds the searchstring it outputs the patching had effect. In your case it outputs nothing, meaning it didn't find the search string.
it works on my kernel for "redmi note 10 pro".
if you send me your kernel, I can look into it... just attach here or send me a link to your stock recovery.img or boot.img
nevermind.. I did it for you:
use this:
magiskboot unpack -h boot.img
magiskboot hexpatch kernel A0160079A022403900040051A0220039 1F2003D5A0224039000400511F2003D5
magiskboot repack boot.img boot_ttlfix.img@cyborg-one did that work?
cyborg-one
commented
2 years ago magiskboot unpack -h boot.img magiskboot hexpatch kernel A0160079A022403900040051A0220039 1F2003D5A0224039000400511F2003D5 magiskboot repack boot.img boot_ttlfix.img
It worked like it should.
patch kernel A0160079A022403900040051A0220039 1F2003D5A0224039000400511F2003D5 < Patch @ 00B957A0 [A0160079A022403900040051A0220039] -> [1F2003D5A0224039000400511F2003D5]
santoni:/ # /data/data/com.termux/files/usr/bin/tcpdump -vvvni any host 8.8.8.8 -c 4 tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes 17:02:11.958672 IP (tos 0x0, ttl 64, id 28689, offset 0, flags [DF], proto ICMP (1), length 84) 192.168.42.79 > 8.8.8.8: ICMP echo request, id 12111, seq 1, length 64 17:02:11.958864 IP (tos 0x0, ttl 64, id 28689, offset 0, flags [DF], proto ICMP (1), length 84) 192.168.1.100 > 8.8.8.8: ICMP echo request, id 12111, seq 1, length 64 17:02:12.031352 IP (tos 0x20, ttl 105, id 0, offset 0, flags [none], proto ICMP (1), length 84) 8.8.8.8 > 192.168.1.100: ICMP echo reply, id 12111, seq 1, length 64 17:02:12.031534 IP (tos 0x20, ttl 105, id 0, offset 0, flags [none], proto ICMP (1), length 84) 8.8.8.8 > 192.168.42.79: ICMP echo reply, id 12111, seq 1, length 64
You can show tcpdump output when running nfqttl?
Zibri
commented
2 years ago It worked like it should.
patch kernel A0160079A022403900040051A0220039 1F2003D5A0224039000400511F2003D5 < Patch @ 00B957A0 [A0160079A022403900040051A0220039] -> [1F2003D5A0224039000400511F2003D5]
Good! I didn't test it because I own a different phone and for some reason the compiled code is totally different from my kernel. Good to know it worked. I'll add the patch to my module.
You can show tcpdump output when running nfqttl?
hmm.. no... I can't use nfqttl with my patch in place.
cyborg-one
commented
2 years ago @Zibri From the first post in the iptables output, you can see that netfilter sends packets to the queue and since the Internet is working, this means that nfqttl processed the packets. Without tcpdump output, I don't see nfqttl not working properly.
Zibri
commented
2 years ago @Zibri From the first post in the iptables output, you can see that netfilter sends packets to the queue and since the Internet is working, this means that nfqttl processed the packets. Without tcpdump output, I don't see nfqttl not working properly.
I can just tell you I downloaded and used it on my Redmi Note 10 pro. Then tried pinging the same address from phone and wifi or usb tehered pc and the TTL differed by 1. So I decided to write my patch which is simpler and IMHO more effective.
LunaWuna
commented
1 year ago Hello, I see the module isn't compatible with the OnePlus 11, how easy would it be to support it?
cyborg-one
commented
1 year ago @LunaWuna
Hello, I see the module isn't compatible with the OnePlus 11, how easy would it be to support it?
Hi. What exactly is the incompatibility? Installation errors?
I am connected to the phone using USB tethering.
Ping from phone to google:
64 bytes from 172.217.21.14: icmp_seq=1 ttl=106 time=94.7 msPing from pc to same address:64 bytes from 172.217.21.14: icmp_seq=1 ttl=105 time=87.0 msoutput of iptables-save: