Category Archives: English

Flashing Android Firmware Builds using Android Flash Tool

As a long-time Android user (since the days of Android 2.0, if I remember correctly), I have seen many things already, especially as I was involved in the development of mobile phones, and also fiddled a lot with CyanogenMod, LineageOS, and other custom ROMs. Still, I recently discovered something new for myself, and this is something I really find spectacular. It’s a new mechanism to flash Android firmware builds, and it’s called “Android Flash Tool” (AFT).

Let me elaborate…

Usually, to reflash a device you need to install a program on your workstation, like a vendor flashing tool, or the Android Debug Bridge (adb) command-line tool. With the Android Flash Tool, this is no longer required. The only thing you need is your WebUSB-capable (browser). 🙂 Currently, only Chrome or Edge support it. (Firefox currently doesn’t support it due to security concerns.)

Also, the number of devices which support the AFT is very, very limited. Basically, it’s just the Google Pixel series of phones, plus a few development boards.

But if you have one of those devices, it’s pretty cool.

Continue reading Flashing Android Firmware Builds using Android Flash Tool

Netgear GS108Ev3 – Huge packet loss when pinging management IP

I have a quite complex infrastructure in my house, and I monitor everything.  Among others, I have SmokePing probes towards multiple destinations in my LAN, and also to my internet provider’s infrastructure, and even external hosts.

When I added a graph for the management IP of my Netgear GS108Ev3 8 Port Gigabit Ethernet Smart Managed Plus Switch, which is my “core” switch, I noticed that there is a huge packet loss, in the range of 4% average, about 40% max.

The strange thing is that other destinations in my LAN which can be reached via this switch, have absolutely zero packet loss. That means that the cabling itself is definitely ok, and also that the packet switching functionality of the switch is ok.

So I opened a ticket towards NetGear, and the response I got was quite surprising (but still somehow makes sense):

This is a known issue, and it is by design. The put the highest priority on the packets flowing thru the switch, while the management traffic has a lower priority, so that ICMP packets to the switch’s management IP may get lost, and in extreme cases the web UI may not be reachable at all.

It’s not a big issue for me, because in the end I wanted to create graphs that exhibit whether I have any internal packet loss. Whether the switch’s management interface has packet loss or not is not really important to me. As long as all my internal devices that I actively use, like my NAS devices or streaming boxes, are properly connected with no packet loss, all is well. 🙂

Google Fi Activation fails with Error Code B050

If you get an error code of “B050” when trying to activate your “Google Fi” service, it is because you are identified as not being in the US right now. This was confirmed to my by Google Support on the phone a few minutes ago.

Whether this is being identified by your IP address or your phone’s location, I can’t tell (yet). Could be that I bring up a VPN to check… 😉

2020-02-19 Update: I was just too curious, so only a day later I quickly wrapped up a VPN with a source IP from the US (thanks, AWS! :-)). And, presto, I could activate Google Fi. So it is crystal clear that they identify you by your IP address.

I could make calls via VoWiFi, but when I disabled WiFi I couldn’t attach to the mobile network. This is probably because I’ve never joined my “home (mobile) network” yet. I’ll be in Florida soon, then I will join the mobile network there. And I’m sure when I return to Germany I’ll be able to join German mobile networks as well…

Use SmartThings Multi-Purpose Sensor without Magnet

While browsing around in the SmartThings IDE I stumbled across a setting for the multi-purpose sensor called garageSensor.

Googling it turned out that you can manually put the sensor into a mode where it detects it has been tilted, and then reports this state as “open.” This can be used for sectional garage doors, in which case you don’t have to use the magnet, but just the main “sensor” part.

Mount the garage door sensor vertically so that when the garage door is vertical, it will read “closed.” When horizontal, it will read “open.”

To put the sensor into the “garage sensor” mode, open the device in the IDE, and then click on the “edit” link for the device preferences:

This could possibly also be used for windows which can only be tilted — it wouldn’t make much sense to use this setup for windows which can also be “turned” open (like most European-style windows).

This helped? Then please let me know… 🙂

Huawei P8 (GRA-L09) modding

This post about “modding” of a Huawei P8 aims to summarize most of the standard procedures you need when you want to modify the device software (also called “firmware”), because you are a developer or want to be more flexible in how you use your device.

Normally, in order to gain this knowledge, you have to read a lot of “geeky” posts on sites like xda developers, which is very time consuming, and sometimes even leads to complete failure (you end up “bricking” your device), because many people there don’t bother to post clear and comprehensive instructions, but simply assume people have some pre-knowledge and know how to do things.

I don’t yet consider this post “finalized” yet (it needs some “polishing”), but I would like to make it available already now to make sure it won’t be forgotten… 😉

Fastboot Mode

“Fastboot” mode is a special mode your device can be put into in order to perform certain maintenance operations, such as (un-) locking your boot loader, flashing partition images, etc. The tool you use on your PC or Mac to communicate with the phone while it is in “fastboot” mode is also called fastboot. It is part of the Android platform tools which you can download here directly from Google.

Continue reading Huawei P8 (GRA-L09) modding

ntp running in chroot stopped working after Debian Stretch upgrade

Today I upgraded my root server from Jessie to Stretch, and suddenly ntp stopped working.

I found errors like follows in the log, which were obviously due to failures in name resolution:

2018-05-31T07:44:48.900756+00:00 myhost ntpd[22855]: giving up resolving host 1.debian.pool.ntp.org: Servname not supported for ai_socktype (-8)

The solution to make this work was to bind-mount some files and directories essential for name resolution into the chroot jail.

First create some directories and some dummy files:

# mkdir /var/lib/ntp/etc /var/lib/ntp/lib /var/lib/ntp/proc
# mkdir /var/lib/ntp/usr /var/lib/ntp/usr/lib
# touch /var/lib/ntp/etc/resolv.conf /var/lib/ntp/etc/services

Then update your /etc/fstab as follows:

...
#ntpd chroot mounts
/etc/resolv.conf  /var/lib/ntp/etc/resolv.conf none bind 0 0
/etc/services	  /var/lib/ntp/etc/services none bind 0 0
/lib		  /var/lib/ntp/lib none bind 0 0
/usr/lib	  /var/lib/ntp/usr/lib none bind 0 0
/proc		  /var/lib/ntp/proc none bind 0 0

Finally mount all these binds:

# mount -a

Thanks to the ArchLinux guys where I found this.

To check whether your ntp is working again, you can use the following command which shows a list of peers known to your ntp server:

# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 0.debian.pool.n .POOL.          16 p    -   64    0    0.000    0.000   0.000
 1.debian.pool.n .POOL.          16 p    -   64    0    0.000    0.000   0.000
 2.debian.pool.n .POOL.          16 p    -   64    0    0.000    0.000   0.000
 3.debian.pool.n .POOL.          16 p    -   64    0    0.000    0.000   0.000
*ptbtime1.ptb.de .PTB.            1 u   46   64  377   11.483   -0.411   0.201
+ptbtime2.ptb.de .PTB.            1 u   52   64  377   11.502   -0.533   1.069
+ptbtime3.ptb.de .PTB.            1 u   47   64  377   11.451   -0.510   3.866
#batleth.sapient 131.188.3.221    2 u   44   64  377    0.188    1.097   0.176
#5.199.135.170 ( 130.149.17.21    2 u   45   64  377   11.271    0.581   0.396
-mail.morbitzer. 193.175.73.151   2 u   47   64  377    2.760    0.556   0.278
#hotel.zq1.de    161.62.157.173   3 u   46   64  377    0.094    1.384   0.261
-ntp2.m-online.n 212.18.1.106     2 u   47   64  377    7.167   -0.333   0.190
#2a03:b0c0:3:d0: 81.94.123.16     3 u   49   64  377    6.288   -2.071   1.760
#touka.thehomeof 130.149.17.21    2 u   48   64  377    0.206    0.932   0.222
+maggo.info      124.216.164.14   2 u   42   64  377    0.278   -0.137   0.436
+weyoun4.cord.de 124.216.164.14   2 u   44   64  377    2.849   -0.255   0.409
+opnsense.sauff. 222.217.153.8    2 u   43   64  377    0.270   -0.617   0.167
-web1.sys.ccs-ba 192.53.103.104   2 u   35   64  377    0.173   -1.251   0.220
#uruz.org        122.227.206.195  3 u   49   64  377    0.216    1.694   0.309
#clients5.arcani 162.23.41.55     2 u   38   64  377    6.120   -1.500   0.130
+stratum2-1.NTP. 129.70.130.71    2 u   47   64  377   14.043    1.625   0.394

The following command confirms that your current time is actually correct (within certain limits, of course):

# ntpstat
synchronised to NTP server (192.53.103.108) at stratum 2
   time correct to within 15 ms
   polling server every 64 s

If this was helpful, I would be happy to hear from you.

Exim malware scanner issue after upgrade from Jessie to Stretch

Today I finally upgraded by personal root server from Debian Jessie to Stretch, thereby upgrading Exim from 4.84 to 4.89.

After the upgrade, I observed the following errors in mainlog:

2018-05-31 08:02:03 +0000 1fOIX5-0001rg-AM malware acl condition: cmdline  : scanner returned error code: 36096
2018-05-31 08:02:03 +0000 1fOIX5-0001rg-AM H=([IPv6:2a00:6020:1efc:ee20:8857:7824:6a49:8368]) [2a00:6020:1efc:ee20:8857:7824:6a49:8368]:48523 I=[2a01:4f8:141:429::2]:465 Warning: ACL "warn" statement skipped: condition test deferred
2018-05-31 08:02:04 +0000 1fOIX5-0001rg-AM malware acl condition: cmdline  : scanner returned error code: 13
2018-05-31 08:02:04 +0000 1fOIX5-0001rg-AM H=([IPv6:2a00:6020:1efc:ee20:8857:7824:6a49:8368]) [2a00:6020:1efc:ee20:8857:7824:6a49:8368]:48523 I=[2a01:4f8:141:429::2]:465 Warning: ACL "warn" statement skipped: condition test deferred
2018-05-31 08:02:05 +0000 1fOIX5-0001rg-AM malware acl condition: cmdline  : scanner returned error code: 13
2018-05-31 08:02:05 +0000 1fOIX5-0001rg-AM H=([IPv6:2a00:6020:1efc:ee20:8857:7824:6a49:8368]) [2a00:6020:1efc:ee20:8857:7824:6a49:8368]:48523 I=[2a01:4f8:141:429::2]:465 Warning: ACL "warn" statement skipped: condition test deferred

Each of the three cmdline scanners caused an error, as shown above.

It seems there was a change in Exim from upstream, as reported by another user. Somehow it seems that if you define a cmdline scanner that uses a chain of commands, when there was an error return code encountered in the middle of the chain, the whole chain is considered failed.

To “fix” this issue (or rather work-around it), I changed the three ACL clauses as follows:

   warn  message                = This message contains malware ($malware_name)
         set acl_m0      = cmdline:\
-                               /usr/lib/AntiVir/guard/avscan -s --batch --scan-mode=all %s; /bin/echo -e \N"\navira_retval $?"\N:\
+                               /usr/local/bin/avscan_wrapper %s:\
                                \N^avira_retval 1$\N:\
                                \N^.*ALERT::[ \t]+([^;]*)[ \t]+;.*$\N
         malware                = *

I created a “wrapper” that effectively hides error return codes, and forces a return code of 0. The above wrapper looks like this:

#!/bin/bash

ARG="$1"

/usr/lib/AntiVir/guard/avscan -s --batch --scan-mode=all "${ARG}"
/bin/echo -e "\navira_retval $?"

exit 0

To make sure I didn’t break the malware scanning by my changes, I downloaded the EICAR test virus and sent it to myself. Exim caught the “virus” and ditched it.

Sony Xperia X Compact Modding

I decided to write this post since I couldn’t find any single page that lists all the “secrets” you need to know when modding your Sony Xperia X Compact (XC) codenamed “Kugo” in a concise manner and in a single place. And after half a year when I last tinkered with my XC, I had forgotten about all the details again, so I had to research them again anyway…

I give credit to the following XDA people (but not limited to them, I apologize to those who I might have forgotten):

General Approach

The general approach when modding your phone is the following:

  1. Flash custom recovery
  2. Backup current installation/data
  3. (Optionally: flash latest stock firmware)
  4. (Optionally: flash custom recovery that works with your new stock firmware)
  5. Root
  6. Flash other mods or use “root” apps

Custom Recovery

Fastboot Mode

First let’s explain what “fastboot mode” is: Fastboot is both a tool and a protocol for writing data directly to your phone’s flash memory. In practical use, it is used to flash images such as recoveries, bootloaders, and kernels to your Android device.

The “fastboot” tool (as well as “adb” which is also needed when tinkering with your Android smart phone) is part of the Android “platform tools,” which you can download directly from Google (roughly 4M only).

To bring your phone into fastboot mode, perform the following steps:

  1. Switch the phone off.
  2. Hold “Volume up” and connect your phone to the USB port of your PC. The notification LED should first light up in red, then blue, and provided you have correctly installed drivers, you will be able to use fastboot commands.
    Note that the screen will remain black. You can check whether you are in fastboot mode with the following command:

    $ fastboot devices
    BH901XXXXX    fastboot

    If you see output similar to the above, you have successfully put your phone in fastboot mode.

Continue reading Sony Xperia X Compact Modding

Get certificates for “internal” hosts from Let’s Encrypt

I have a pretty large internal IT “landscape” in my house, and as an IT pro I want everything to be clean and “safe.” So even internally I’m using official SSL (or I should say “TLS”, as SSL 2.0 or 3.0 is deprecated since many years…) certificates for my router, WiFi access points, NAS devices, intranet server, etc., using host names in my own domain. I host this domain DNS-wise myself on a root server I rent from Hetzner.

Before the StartSSL disaster I got my certs from them. Afterwards I switched to WOSign, but now that they had their scandal as well, what to do?!

Well, Let’s Encrypt, a free public CA, is something I’m using anyway for my root server since they started operating. But to verify ownership of a domain name you had to run a web server on that respective host — something I can’t easily do for my internal hosts, as they have private IP addresses only, and their host names are not even publicly visible (they don’t have  a public A record, only one visible in my internal LAN). Even for my router’s externally visible host name I can’t easily use an HTTP-based challenge, as for security reasons I don’t want to operate a web server there.

By chance I came across the dns challenge that is now available in Let’s Encrypt’s certbot. This challenge works by deploying a TXT record that certbot requests to be under this domain name. Once you did this, you tell Let’s Encrypt to check, and if they find the TXT record this proves that you have authority over the domain.

Using it is quite straight forward:

# certbot certonly --manual -d hostname.internal.bergs.biz --preferred-challenges "dns"
[...]
Please deploy a DNS TXT record under the name
_acme-challenge.hostname.internal.bergs.biz with the following value:

YrAE-fmu-Zjsdhsjhd328723hjdhjcjHJJHJhds

Once this is deployed,
-------------------------------------------------------------------------------
Press Enter to Continue

A few seconds later I had successfully received my certificate.

So now I will write a script that will run periodically on my intranet server, and that will retrieve the then-current certificates for my internal hosts from my root server, and deploy them internally.

Hard drive slot does not matter in Synology

You can read all over the internet that it’s important to put your hard drives into their original slots, e. g. when you migrate to a new Synology device, or when you need to remove the drives to add memory.

This is simply not true.

As expected DSM, which is a flavor of “Linux,” will automatically discover your physical partitions based on the GUIDs each partition has, and then reassemble your volumes. I just tested this (i. e. intentionally put the drives into the device in the wrong order) with a JBOD volume, and I had no issues whatsoever. I cannot see why this should be different with SHR or RAID-5, for example.

If you have also tested this, please let me know how it went for you.