Building your own ROM

I have a new project I want to start, and I will probably need some help.

I am concerned with Android's download policy. It is way too easy to download something malicious. There is no prompt confirming you want to download something, it just begins once you click on a link to a downloadable file, or open an app. Downloads can also be triggered in many other ways, all of which provide no confirmation prompt. It has been proven at several blackhat conferences over the past few months that certain parts of the Android download system can be compromised in such a way that apps can be downloaded, installed, and activated with virtually no user interaction beyond visiting an app window or a webpage. This can result in all sorts of harmful behaviors, such as mms being sent to a premium number, or phone calls being placed to premium service numbers, data being mined, etc.

While many may argue this simple download system is desired, I believe it is way to dangerous. I propose adding a confirmation prompt to all downloads. A setting can be added to override this prompt behavior for those who like to live dangerously.

To begin, I used grep to find all instances of the term "download" in the source code and pasted the results here: Grep--download - Pastebin.com. There are other terms that should be searched for as well, this is just a begining point.

Step 1 - determine which files need to be addressed
Step 2 - determine which point in the process it would be best to insert a prompt
Step 3 - determine the best methodology to provide additional security without compromising functionality
Step 4 - test, retest, test some more
Step 5 - submit for public scrutiny
Step 6 - make changes and test again
Step 7 - push to the AOSP source tree

If you would be interested in helping with this project, please indicate so in this thread, I will provide more details as to a project location etc as this progresses.

Thanks for any help offered! ;)

Note- I've cross posted at XDA, since this affects all Android devices.
 
Last edited:
Thekraven, I was trying to find the fix you had used for stuck Auto-brightness icon in the notification-bar power widget. Could you post a link here to the commit in your repo? Happy new year everyone.
 
Thekraven, I was trying to find the fix you had used for stuck Auto-brightness icon in the notification-bar power widget. Could you post a link here to the commit in your repo? Happy new year everyone.

I'll look for it when I get home. It was 3 parts, in the arrays,strings, and services java.



Sent from my MB855 using Tapatalk
 
The temp fix is download auto brightness switch from the market. And uncheck dim, and auto in cm settings

Sent from my MB855 using Tapatalk
 
  • Like
Reactions: mrg666
I've added the option to change the notification dropdown's background color, options are Theme(default), Custom argb color, Transparent. There are two commits, one set for CMParts, the other for frameworks/base:

https://github.com/JerryScript/android_frameworks_base/commit/a79e67e2ba9c632eb46993ad5028d7f4989c1a2a
https://github.com/JerryScript/android_packages_apps_CMParts/commit/58a14b117db2f1b0d51ea00ab0d54256c7d13881

@thekraven, thanks for the mic fix, included it in BACKside 01022012, will let you know how it works out
@BobZhome & rb64, thanks for the two-way-recording in call feature, I'm sure someone is going to have ammo for a lawsuit handy with that one. ;)

On a different subject, anyone setup Eclipse to use for debugging? I just did, and I'm finding it awfully slow to load, and pretty slow when using keyboard shortcuts to add properties etc. Anyone try Netbeans, and if so is it any better than Eclipse?

Happy New Year Everyone!
 
Last edited:
I've never tried, but I assume you can pipe it out to a txt file like with most other things:

make bacon > ~/build-log.txt

This would prevent anything from being shown in the terminal until the build was finished.
 
  • Like
Reactions: thekraven
That's one of the most asked noob questions, it will be nice to have a fix

Sent from my LG-VM670 using Tapatalk

Indeed, that was one of the things on my todo-list.

Interesting (and sad) to see that most/all of the initrd is proprietary vendor binaries.

Does anyone happen to know how the system is informed that it's charging while offline? It would be cool to make a more informative display, perhaps with an actual percentage indicator. I've grown attached to NoLED and would miss it...
 
It looks like charging while powered off finally will work. See the offline charging bits.
It's part of a big code push https://github.com/adfad666/android...06b61e4789885c584a353a80cad0eb3afa631/p500.mk

Part of this commit warning... long.. https://github.com/adfad666/android...06b61e4789885c584a353a80cad0eb3afa631#p500.mk

Has anyone tested this? It doesn't change where the files are being pushed to during the build, so is it a matter of different files? Am I'm missing something in that huge commit.

...Interesting (and sad) to see that most/all of the initrd is proprietary vendor binaries....
Now you know the biggest hurdle we have to deal with. Android may be open source, but the necessary vendor files are still proprietary. Kinda like giving the car away without the owner's manual, you can use it, but not to it's fullest extent.
 
Look at the lge e510 commit in their device folder. We will need to add at top of our init.thunderc.rc:
on boot-pause
exec sbin/chargerlogo



And a line in the BoardConfig.mk
 
  • Like
Reactions: JerryScript
I've never tried, but I assume you can pipe it out to a txt file like with most other things:

make bacon > ~/build-log.txt

This would prevent anything from being shown in the terminal until the build was finished.

Errors will normally show on stderr, so I'd recommend this:

make bacon >& build.log
 
  • Like
Reactions: JerryScript
Look at the lge e510 commit in their device folder. We will need to add at top of our init.thunderc.rc:
on boot-pause
exec sbin/chargerlogo



And a line in the BoardConfig.mk

I tried with no luck, phone still boots up as soon as you plug it in, but I'm not sure I have everything necessary:
commit:95e3f4ca
 

Latest posts

Trending Posts

Forum statistics

Threads
956,571
Messages
6,968,886
Members
3,163,569
Latest member
rosebudk1973