A bunch of things I learned while fighting androids

2019-11-10 23:06 -0300. Tags: comp, android, in-english

I recently had to bypass Android's Factory Reset Protection again, this time for a Samsung Galaxy J4. The procedure at the end turned out to be relatively simple (find a way to get to a browser from the initial screen, download a pair of APKs, finish the Google account login with a random Google account, uninstall the APKs). However, due to the circumstances I was operating in, I spent a lot of time figuring out how to share an internet connection from my laptop with a second Android phone so I could share it with the J4 using the second phone as a wi-fi hostspot. This post documents what I learned.

Bypassing FRP on the Samsung Galaxy J4

There are dozens of videos on YouTube explaining how to do it. I will summarize the information here.

Part 1: Getting to a browser

At the initial screen, select the language and connect to a wi-fi network.
When you get to the screen asking for the Google account, hit the Home button (the large middle one below the screen) 5 times. This will enable the TalkBack accessibility thing.
Draw an L gesture on the screen; this will bring up TalkBack global context menu.
Select "TalkBack settings". (To select things while TalkBack is enabled, first tap the thing once to select it, then tap the screen twice to activate it. You can disable TalkBack by hitting Home 5 times again after you get to the settings menu.)
Select "Help and feedback".
Select "About Switch Access for Android". This will lead to a help screen containing a YouTube video. Tap the video "Share" icon, then the "…" icon. This will lead to the YouTube app.
Swipe down (scroll up) to make the YouTube top bar visible, and click the user/login icon at the top right.
On the login screen, click "Privacy terms". This will open up Chrome. It will ask you to accept the terms and conditions (click 'Accept'), then ask you about Data Saver (it doesn't matter what you choose here, just click 'Next'), and ask you to log in on Chrome (don't log in, click 'No, thanks').
Congrats, you have landed on a browser.

Part 2: Installing a bunch of APKs

Go to https://frpfile.com/bypass/. DISCLAIMER: I don't know if those APKs can be trusted.
Download and install "Google-Account-Manager-Android-8.apk".
Download and install "BypassFRP-1.0.apk" and click "Open" at the end of the installation.
You will land on a screen asking for a password. Ignore that; click "⋮" and select "Login in browser".
Now log in with a Google account of your own choosing. I would recommend using an account other than your main account, since we don't really know if the APKs we just installed are trustworthy or are capable of stealing your credentials. 🤷
Finish the phone setup normally.
After the phone has finished starting, go to "Settings > Apps" and uninstall the APKs you just installed. (I'm innocently assuming here that uninstalling them is enough to stop them from doing any harm. 🤷)

That's it.

Internet sharing shenanigans

Sharing your Android phone's internet connection with your computer is pretty easy: you just enable USB tethering on the phone, and everything magically works (at worst, you have to call dhclient YOUR-USB-INTERFACE on Linux if you don't have NetworkManager running). Doing the opposite, i.e., sharing your (Linux) computer connection with the phone, has to be done manually. Here is how it goes (I'm assuming a rooted phone; mine runs LineageOS 14.1 (Android 7)):

Put the phone USB connection into RNDIS mode: Settings > Developer Options > Select USB Configuration > RNDIS (USB Ethernet).
On a terminal, as root (either via the Terminal app or via adb shell from the computer), set up the interface with some IP of choice, e.g.,
```
ip addr add 10.0.5.2/24 dev rndis0
ip link set rndis0 up
```
Do the same on the computer, with a different IP address in the same subnetwork:
```
sudo ip addr add 10.0.5.1/24 dev rndis0
sudo ip link set rndis0 up
```
Note: Most likely you will have to replace rndis0 with something else, depending on the name your system decided to give to the USB interface.
By now, you should be able to ping one machine from the other (i.e., ping 10.0.5.2 from the computer should work).
Caution: if NetworkManager is enabled, it may mess your settings for the new interface. You have to either convince NetworkManager to ignore the interface, or stop NetworkManager (which is what I did: sudo service network-manager stop).

Now, to share the internet connection:

On the PC, set up an iptables rule to do NAT forwarding:

sudo iptables -t nat -A POSTROUTING -o <your-internet-interface> -j MASQUERADE

Enable forwarding: echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
On the phone, set the default gateway to point to the PC:
```
ip route add default via 10.0.5.1
```
You should now be able to ping internet addresses from the phone, e.g., ping 8.8.8.8 should work).
Now a weird thing happens: after you do that, only root sees the internet. You have to run the following incantation to give everyone access (source): ip rule add from all lookup main

We still have to set DNS. Android does not seem to have a resolv.conf file; I found multiple ways you can set DNS (using 1.0.0.1 and 1.1.1.1 as the DNS servers in the examples):

setprop net.dns1 1.0.0.1; setprop net.dns2 1.1.1.1
setprop net.rndis0.dns1 1.0.0.1; setprop net.rndis0.dns1 1.1.1.1
ndc resolver setnetdns rndis0 1.0.0.1 1.1.1.1

The last one is the only one that worked for me – and it requires two DNS servers as arguments.

By now, you should have a working internet connection on your phone (you can try it in the browser, for example).

If you want to share it with other devices via wi-fi, you can now enable Wi-Fi Hotspot on the phone. However, there is another weird thing here: for some reason, my phone would reject all DNS queries coming from the other devices. The 'solution' I ended up using was to redirect all requests to port 53 (DNS) coming from other devices to the DNS server I wanted to use:

iptables -t nat -A PREROUTING -p tcp --dport 53 -j DNAT --to-destination 1.0.0.1:53
iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to-destination 1.0.0.1:53

This will skip the Android builtin DNS server entirely, and send DNS requests directly to the desired DNS server.

Elmord's Magic Valley

Computers, languages, and computer languages. Às vezes em Português, sometimes in English.