Building your own ROM

JerryScript

Daydream Believer
Mar 8, 2011
2,055
1,559
0
Visit site
I have a new project I want to start, and I will probably need some help.

I am concerned with Android's download policy. It is way too easy to download something malicious. There is no prompt confirming you want to download something, it just begins once you click on a link to a downloadable file, or open an app. Downloads can also be triggered in many other ways, all of which provide no confirmation prompt. It has been proven at several blackhat conferences over the past few months that certain parts of the Android download system can be compromised in such a way that apps can be downloaded, installed, and activated with virtually no user interaction beyond visiting an app window or a webpage. This can result in all sorts of harmful behaviors, such as mms being sent to a premium number, or phone calls being placed to premium service numbers, data being mined, etc.

While many may argue this simple download system is desired, I believe it is way to dangerous. I propose adding a confirmation prompt to all downloads. A setting can be added to override this prompt behavior for those who like to live dangerously.

To begin, I used grep to find all instances of the term "download" in the source code and pasted the results here: Grep--download - Pastebin.com. There are other terms that should be searched for as well, this is just a begining point.

Step 1 - determine which files need to be addressed
Step 2 - determine which point in the process it would be best to insert a prompt
Step 3 - determine the best methodology to provide additional security without compromising functionality
Step 4 - test, retest, test some more
Step 5 - submit for public scrutiny
Step 6 - make changes and test again
Step 7 - push to the AOSP source tree

If you would be interested in helping with this project, please indicate so in this thread, I will provide more details as to a project location etc as this progresses.

Thanks for any help offered! ;)

Note- I've cross posted at XDA, since this affects all Android devices.
 
Last edited:

mrg666

Well-known member
Jul 16, 2011
730
1,067
0
Visit site
Thekraven, I was trying to find the fix you had used for stuck Auto-brightness icon in the notification-bar power widget. Could you post a link here to the commit in your repo? Happy new year everyone.
 

thekraven

Well-known member
Nov 10, 2010
1,407
1,148
0
Visit site
Thekraven, I was trying to find the fix you had used for stuck Auto-brightness icon in the notification-bar power widget. Could you post a link here to the commit in your repo? Happy new year everyone.

I'll look for it when I get home. It was 3 parts, in the arrays,strings, and services java.



Sent from my MB855 using Tapatalk
 

thekraven

Well-known member
Nov 10, 2010
1,407
1,148
0
Visit site
The temp fix is download auto brightness switch from the market. And uncheck dim, and auto in cm settings

Sent from my MB855 using Tapatalk
 
  • Like
Reactions: mrg666

thekraven

Well-known member
Nov 10, 2010
1,407
1,148
0
Visit site

mrg666

Well-known member
Jul 16, 2011
730
1,067
0
Visit site

JerryScript

Daydream Believer
Mar 8, 2011
2,055
1,559
0
Visit site
I've added the option to change the notification dropdown's background color, options are Theme(default), Custom argb color, Transparent. There are two commits, one set for CMParts, the other for frameworks/base:

https://github.com/JerryScript/android_frameworks_base/commit/a79e67e2ba9c632eb46993ad5028d7f4989c1a2a
https://github.com/JerryScript/android_packages_apps_CMParts/commit/58a14b117db2f1b0d51ea00ab0d54256c7d13881

@thekraven, thanks for the mic fix, included it in BACKside 01022012, will let you know how it works out
@BobZhome & rb64, thanks for the two-way-recording in call feature, I'm sure someone is going to have ammo for a lawsuit handy with that one. ;)

On a different subject, anyone setup Eclipse to use for debugging? I just did, and I'm finding it awfully slow to load, and pretty slow when using keyboard shortcuts to add properties etc. Anyone try Netbeans, and if so is it any better than Eclipse?

Happy New Year Everyone!
 
Last edited:

JerryScript

Daydream Believer
Mar 8, 2011
2,055
1,559
0
Visit site
I've never tried, but I assume you can pipe it out to a txt file like with most other things:

make bacon > ~/build-log.txt

This would prevent anything from being shown in the terminal until the build was finished.
 
  • Like
Reactions: thekraven

pbailey212

Well-known member
Mar 20, 2011
765
219
0
Visit site

tdm

Well-known member
Apr 11, 2011
1,409
3,596
0
Visit site
That's one of the most asked noob questions, it will be nice to have a fix

Sent from my LG-VM670 using Tapatalk

Indeed, that was one of the things on my todo-list.

Interesting (and sad) to see that most/all of the initrd is proprietary vendor binaries.

Does anyone happen to know how the system is informed that it's charging while offline? It would be cool to make a more informative display, perhaps with an actual percentage indicator. I've grown attached to NoLED and would miss it...
 

JerryScript

Daydream Believer
Mar 8, 2011
2,055
1,559
0
Visit site
It looks like charging while powered off finally will work. See the offline charging bits.
It's part of a big code push https://github.com/adfad666/android...06b61e4789885c584a353a80cad0eb3afa631/p500.mk

Part of this commit warning... long.. https://github.com/adfad666/android...06b61e4789885c584a353a80cad0eb3afa631#p500.mk

Has anyone tested this? It doesn't change where the files are being pushed to during the build, so is it a matter of different files? Am I'm missing something in that huge commit.

...Interesting (and sad) to see that most/all of the initrd is proprietary vendor binaries....
Now you know the biggest hurdle we have to deal with. Android may be open source, but the necessary vendor files are still proprietary. Kinda like giving the car away without the owner's manual, you can use it, but not to it's fullest extent.
 

thekraven

Well-known member
Nov 10, 2010
1,407
1,148
0
Visit site
Look at the lge e510 commit in their device folder. We will need to add at top of our init.thunderc.rc:
on boot-pause
exec sbin/chargerlogo



And a line in the BoardConfig.mk
 
  • Like
Reactions: JerryScript

tdm

Well-known member
Apr 11, 2011
1,409
3,596
0
Visit site
I've never tried, but I assume you can pipe it out to a txt file like with most other things:

make bacon > ~/build-log.txt

This would prevent anything from being shown in the terminal until the build was finished.

Errors will normally show on stderr, so I'd recommend this:

make bacon >& build.log
 
  • Like
Reactions: JerryScript