Differences

This shows you the differences between two versions of the page.

--- doc:appunti:hardware:gretel_a7 [2019/10/15 12:34] – [Latest Software] niccolo
+++ doc:appunti:hardware:gretel_a7 [2019/10/15 12:52] – [Infected Stock ROM 20170908] niccolo
@@ Line 363: / Line 363: @@
     * **Swipe to confirm Flash**.
-===== Infected Stock ROM 20170908 =====
+===== Installing Stock ROM 20170908 (with trojan launcher) =====
 On the internet we found the file **Y8303.YX.A7.Gretel.B1B8.6.0.V01.07.20170908.rar** (md5sum decb53fef12c13c30a8759fc55f5dfa4). It seems an offical Gretel ROM, but it has some **malware inside the launcher**. We flashed that ROM using **SP Flash Tool 5.1916** downloading all the partitions to the phone; after some hours **unwanted icons popped-up on the home screen** (icon labels were //Tarot// and //Funny//).
+  - Power-off the phone. Using SP Flash Tool from a PC, **flash the partitions**: //preloader//, //lk//, //boot//, //recovery//, //logo//, //secro//, //system//, //cache// and //userdata// from stock ROM archive. This will erase all user data and settings on the phone.
+  - Reboot into normal system and enable **USB debugging**:
+    * //Settings// => //About phone//, tap 7 times on //Build number//.
+    * //Settings// => //Developer options//, enable //OEM unlocking// and //USB debugging//.
+  - Upload **SuperSU** and **Rootless Pixel Launcher** from the PC to /sdcard/ directory, using **adb push**.
+  - Power-off the phone and **flash TWRP** recovery image with SP Flash Tool. Boot in //Select Boot Mode Menu// with **Volume UP+Power**, then choose Recovery.
+  - From TWRP Recovery, install **SuperSU**.
+  - Reboot into system, install **Rootless Pixel Launcher** from the file manager; from //Settings// => //Home//, make it the default.
+  - From the PC, run **adb shell** and remove the trojanized launcher using root privileges. See below.
 We checked the **apk** file found into the **/system/priv-app/Launcher3_G_Develop_yisheng_A47_201709071813/** directory against some on-line checking services (notably [[https://www.drweb.com/|Dr. Web]]), and it was marked as **infected with Android.Ibingo.1.origin**.