Related
(by McNevin and mloamiller from T-Mobile forums)
On the weather tab, when I click on "More Detail Online" I get a 404 error page. It does the same thing on my PC, if type the address manually. I can look up detailed weather pages, I know that Athens, Greece works.
The correct address is:
http://www.accuweather.com/m/en-us/NAM/US/WA/Seattle/details.aspx
What I get when I click is:
http://www.accuweather.com/m/NAM/US/WA/Seattle/details.aspx
I searched for a registry settng that would define this URL, but the only setting I found pointed to "manila:IDS_WEATHER" or something like that (don't remember the exact syntax). I remember seeing a large number of files named "manila" in the Windows folder, and also remember someone saying this was the app name for the TF3D interface. I took a look at one of those files - they seem to be XML files, and the one I looked at had several tags such as
<trans-unit id="IDS_MENU">
<source>Menu</source>
</trans-unit>
I would be willing to bet that one of these _manila files includes an "IDS_WEATHER" tag with the actual URL that gets used by the weather app; changing that URL may fix the problem. Unfortunately, there are hundreds of these _manila files and I don't have a way to search all of them for "WEATHER".
Any ideas on how to fix this?
Don't have an answer to the specific question, but if you were to copy all of the manilla xml files on to your desktop you could then use the Windows search to search for snippets of the url within them.
However, it's entirely possible that this data is compiled into the applications binary files. If you have no luck, email accuweather and tell them there are embedded devices that have the wrong URL. They surely want the inbound traffic so it's in their interests and relatively trivial for them to set up a redirect from the broken one on their site. To be honest, this would be the best solution as it would work for everyone!
I thought of that, but the files don't have any extension (e.g. 00a49dc2_manila); doesn't Windows Search require an extension, so a specific viewer can be associated with them? I couldn't figure out how to rename all of them to have an XML (or even TXT) extension so they could be searched.
However, I just answered my own question - I remember I had Notepad++ on my machine which allows me to search through files regardless of their extension. I'll give that a shot.
I was able to search through all of the "manila" files for "WEATHER" and found 463 hits among 63 different files. Of those, "accuweather" only showed up 4 times in one file (17ae3d30_manila), but none of them are the URL I was looking for. Back to the drawing board, I guess.
That file looks to be the html page it sends you to when you hit "About" in the weather tab.
How about this:
http://forum.xda-developers.com/showpost.php?p=2488224&postcount=73
Hi all.
This is a little collection of things that i have been noticing while testing hacking issues on the phone.
Remember that those are "non-useful" (not to jailbreak) the phone, and just curiousity as topic.
Easy Hidden Menu Call
Do you need a search on the net to remember the hidden menu code? No more!. Test this phone-number string instead:
(Edited now): ##PROGRAMNITT
Max size for an app name/web favorite
Seems to be no max per se, but after doing some test, where i created title as: "chunk1chunk2chunk......chunkN" i was able to load a 1691124 characters title. Further than that, the browser seems to crash.
That's about a 3MB text string, just for the title. Would work well, when testing if several of them pinned reduce our 8gb storage(use storage) or doesn't (uses other).
Btw, you can pip up to 67 apps, (51 new) so... that's a max anyway,
Application Menu "About:blank" hack
Test this in the browser bar as direction: "about:blank". Kin IE will yell that it's not a supported protocol. Yeah, that's right. Let's dev a page on a local webserver with:
PHP:
<html>
<head>
<title>Mad redirection!</title>
</head>
<body>
<h3>Mad redirection tool!</h3>
<p> Testing: <div id="testTab"></div></p>
<p> Errors:
<div id="errorsTab"></div>
</p>
<script type="text/javascript">
var urlToTest = "about:blank";
try {
var test = document.getElementById("testTab");
test.innerHTML = urlToTest;
window.location=urlToTest;
}
catch (error) {
var err = document.getElementById("errorsTab");
err.innerHTML = "Error going to " +urlToTest+"<br/>"+error.message;
}
</script>
</body>
</html>
Browse it with the kin and you will land in the about:blank page, with the ability to be pinned on the application menu. Of course it will work, having the App link on the App menu, with a non working link (Kin still yells if you use it from menu).
Useless, but weird...
I do know that this is pure thread necromancy and that those are old news but:
a) if you are able to do the trick (using the sample html i posted) you can see that indeed it comes to about:blank and is shown as that on the title: "ABOUT:BLANK".
b) if you are so smart to change it to "about:lame" it goes there but shows a "Action canceled" webpage, where it suggest you to press the "refresh" button or use menu opcion "File -> work offline".
Like if you could.. rofl.
That means:
1) "about:" protocol is supported (at least about:blank) to be navigated BUT is nerfed from the direction bar. So other protocols could work. For example, smtp and ftp does trigger a popup from the IE, but res:// file:// and rtsp:// do not (even if they crash later, and rtsp opening zune for streaming).
2) This is a pure IE (with file menu,hopefully )
3) some other things can be tested, and every person can!
I upgraded the posted code, so it outputs an error when the redirection doesnt work (almost allways).
If you try it, remember not to end your url with \ (backslash) as it interferes with the doublequotes.
I've just completed testing a couple of things.
First, I successfully tested the "about:blank".
I also tried "about:", "about:about", "about:cache", and "about:home". These each resulted in the action canceled page described above.
I also tried the "file://" protocol, with the address "file://localhost/c:/" and received the following:
Errors:
Error going to file://localhost/c:/
Could not complete the operation due to error 80070005.
[edit] It seems that error 80070005 is given when you do not permission. The solution? Log on with administrator privileges... (see link)
Upon further testing:
about:desktopitemnavigationfailure works and displays "navigation cancelled" page.
about:navigationcanceled works and displays "navigation cancelled" page.
about:navigationfailure works and displays "navigation cancelled" page.
about:noadd-ons displays "navigation cancelled" page.
about: offlineinformation works and informs the user that the current page can not be viewed off line.
about: postnotcached works and informs the user that to refresh the current page, information entered in a form will have to be re-posted.
about:securityrisk displays "navigation cancelled" page.
about:tabs (unsuprisingly) displays "navigation cancelled" page.
I read that about:mozilla works in older versions of IE. However, it displayed the "navigation cancelled" page. You can also supposedly access the about:mozilla page using the following URL: res://mshtml.dll/about.moz
However, while this "res" protocol appears to be supported, I received the same permissions error as referenced in the above post.
I tested the mms protocol on a couple of working mms streams, but received the notification that the protocol is not supported.
I tried view-source://(random web address) and unsuprisingly was told that the protocol isn't supported. While this protocol works with some browsers, it doesn't seem to work on internet explorer even on a regular computer.
I tried the javascript protocol and it seems to work, but is different than about:, http:, etc. Mainly, it processes the javascript without leaving the script "address" in the address bar like we see with about: and http:
I was a little disappointed in this one, hoping to bookmark a javascript to test the videohamster flash video viewer for ipods, or itransmogrify for other flash files.
very nice work here. I like what you have done with this.
I'm glad that other than about:blank works (apart of the "action cancelled").
I took my time to install a wm6.5 emulator and test where do this "Action cancelled" come from in the pocket IE url bar.
They are from " res://.....navcancl.dll ".
Maybe there's a way to bypass the restrictions (the permission error) by calling some parameter in the "about:XXXX", but i can't bet on it.
Edit:
about:version seems to work (it auto-says "cannot find server", although my python custom-made-for-exploits server says that it delivered my html). But it keeps loading after the javascript redirection happens.... lol, so random .
One thought I had, that I have not had time to experiment with yet, is how deep the permissions restrictions go. For example, at times I have been logged on to a windows-based computer and have access to certain user-specific files but not to system files or to files or folders closer to the root. So for instance, we may be able to access the WinCE equivalent of "C:\Documents and Settings\<UserName>" using the file:// or res:// protocols even though we don't have permission to access "C:\".
Here's another potential avenue for information related to the "res" protocol. Apparently, it can be used to enumerate the software on a machine by identifying certain executables or dlls. (see here).
Unfortunately, the example cited in the article is not available so I can't view the code on how it was done. However, the results can be viewed here, where incidentally you can see the software installed on the computer that crawled this webpage.
Luckily, a manual or how-to paper is available here. I will try to check it out and see if I can figure out something useful.
i checked, it doesnt yell at you if you use a res:// but either if using ftp:// so the big problem is that you must pre-know the res:// uri before testing.
And in the best case, you will just get an image shown, ad js cannot give you the binary data.
anyway, i'm interested in this things....
Here's a couple other likely non-useful tidbits.
The browser will attempt to open the following filetypes with the Zune player:
.avi
.3gp
.mov
.fli
.mp4
.wmv
.wmx
When you open a VBScript in the browser, the script isn't executed, but it is displayed.
The mailto: protocol works from the browser and opens up the email dialog.
The following script causes the browser to hang (and deleting temporary files does not resolve the problem--but restarting the Kin does):
HTML:
<html><body onLoad=Demo()><script>
// MoBB Demonstration
function Demo() {
var a = new ActiveXObject("Internet.HHCtrl.1");
var b = unescape("XXXX");
while (b.length < 256) b += b;
for (var i=0; i<4096; i++) {
a['Image'] = b + "";
}
}
</script>
</body></html>
I haven't played around with the logs at all, but would this provide an error that gives some useful log output?
After some further testing, I discovered the Kin does not yell about the following protocols as being unsupported (in other words, they seem to be supported):
gopher://
nntp://
telnet://
news://
snews://
windowsmail.url.mailto://
windowsmail.url.news://
windowsmail.url.nntp://
windowsmail.url.snews://
johnkussack said:
Maybe there's a way to bypass the restrictions (the permission error) by calling some parameter in the "about:XXXX", but i can't bet on it.
Click to expand...
Click to collapse
I tried playing around with about:____, such as with the following types of addresses:
about:<input%20type=file>
about:<a%20href=C:\windows\>Click-Here</a>
but without luck.
I also tried the shell handler "Shell:" which seems to be another supported protocol, but again without luck. I tried the following Shell commands:
Shellrofile
ShellrogramFiles
Shell:System
Shell:ControlPanelFolder
Shell:Windows
Shell:::{21EC2020 shell:::{21EC2020-3AEA 3AEA-1069 1069-A2DD A2DD-08002B30309D}
Here are a couple more that I found other people sometimes try that I haven't tried (at least not yet):
shell:ControlPanelFolder
shell:::{35786D3C-B075-49b9-88DD-029876E11C01}
shell:::{208D2C60-3AEA-1069-A2D7-08002B30309D}
shell:::{7007ACC7-3202-11D1-AAD2-00805FC1270E}
shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
shell:::{450D8FBA-AD25-11D0-98A8-0800361B1103}
shell:::{E17D4FC0-5564-11D1-83F2-00A0C90DC849}
Ok, so this will be my last post in this thread tonight . For some unknown reason, you can access your emotes when in camera mode.... It doesn't do anything if you try to use one though.
great to hear about the shell::XXXX thing.
Does it trigger something? like about:blank or the other trigger a blank or a "cannot go" page.
btw, a real path on the phone (granted by the logs) is:
\Windows\eri.bin
That's assured , with the start backslash ("\\" if used on js code)
these hacks arent nonuseful
you should have called these hacks something other than non useful because we can use these little tips and tricks in combination with others to actually create an in browser jailbreak using the unrestricted protocols.
shell commands
try the net user admin <username> <password> console command in the shell protocol and see if you an bypass restrictions. theres no reason why console commands shouldnt work even though i havent tried this myself.
X-15D9W8491 said:
try the net user admin <username> <password> console command in the shell protocol and see if you an bypass restrictions. theres no reason why console commands shouldnt work even though i havent tried this myself.
Click to expand...
Click to collapse
Sorry, I'm not sure where you mean to do this. Unless I completely missed the revelation, so far, nobody has been able to get any type of shell/console access (as it doesn't really exist on a Windows Mobile OS anyway).
i called them as is, cause in first place, they were non useful, lol.
Although now, it could be a good try to get some "jailbreak" procedure.
as we dunno what windows mobile i6 can do, i guess we should/must try into a real mobile device (maybe my old pda too), or a win mobile 6.5 emulator, to test procedures (less restrictions), and then repeat on the kin (restricted).
I always though that the browser was the weakest part anyway
if you do tel: in the browser, and write anything after that it opens it up in a bubble....it lets you call letters, although it gives an error in the phone app
When using the TRACERT (Trace Route) in the programnitt menu I found a quirk.
Using 127.0.0.1 to Trace replies: WindowsCE
...that's obvious but interesting.
Using 127.0.0.0 to Trace replies: * 87 (30 times, hits limit and stops)
I have no idea why it would reply with the voicemail number....
I have a main form with a load of controls on it. I have a listbox, and a piece of code that is looking at individual items eg:
Code:
dim listitem as listboxitem = me.listbox.item(0)
when i use the navigationservice.navigate function to navigate to a different page, and then navigate back to the main page i can no longer edit that list box. The code still runs and doesnt error, but the list item is not updating. Its almost like there are two instances of the form open.
Any ideas?
thanks
when im navigating back to the main form i am using another navigationservice.navigate. Im guesing this is creating a new form everytime you use the .navigate as when i use navigationservice.goback from the second form it works fine.
To that end, is there a way you can close a form once you have navigated away from it using .navigate? and can you navigate to an already open form (without creating a new instance) and without using .goforward?
thanks (im using vb silverlight by the way)
adamrob69 said:
... i can no longer edit that list box. The code still runs and doesnt error, but the list item is not updating. Its almost like there are two instances of the form open.
Click to expand...
Click to collapse
Hmm... Could you explain what do you mean? How do you "edit" list box?
Post your code and explain what are you trying to do.
P.S. Have you tried to trace your code with breakpoints on the page constructors? Just try - you will be very surprised
Code:
''MainForm
sub EditListBox()
dim listitem as listboxitem = me.listbox.item(0)
listitem.content = "New List Text"
end sub
sub Navigate()
NavigationService.Navigate(new uri("/Page2.xml",relative))
end sub
Code:
''Form 2
sub NavigateBack()
NavigationService.Navigate(new uri("/MainForm.xml",relative))
end sub
The EditListBox() routine is called every x mins from a system timer. When navigated to form2 then back again the code still runs, i can put a break in and can see it running through the code but the listbox isn't updating. I believe this is because when you use the NavigationService.Navigate function it creates a new instance of the page. On form2 if I use NavigationSevice.GoBack instead of .navigate the main form updates the listbox correctly.
So if that is the case; is there a way you can close a form once you have navigated away from it using NavigationService.navigate? and can you navigate to an already open form (without creating a new instance) and without using .goforward?
I've already gave you a hint (to debug constructors). Yes, if you are using NavigationService.Navigate(new Uri("/MainPage.xaml", UriKind.Relative)); or NavigationService.Source = new Uri("/MainPage.xaml", UriKind.Relative); it creates a new page.
This implementation have a sense if you start thinking in web-based terms (what is Silverlight built for!)
BTW, I don't understand your requirements. Why do you need this? What's wrong with GoBack() or GoForward()? Also, have you tried other WP7 layouts (Panorama etc.)?
Try to follow the MS "Metro UI" recommendations and many questions will disappear shortly...
GoFoward won't work:
http://msdn.microsoft.com/en-us/lib...ation.navigationservice.goforward(VS.92).aspx
It seems like your problem isn't navigation, (because you should be using GoBack) but that the previous page that you GoBack to isn't how you wanted it.
If this is the case, you should add some sort of way to tell an event occurred. For example, if you did (note this is really rough)
Page2.xaml.cs
{
...
public static bool VisitedPage = false;
...
}
and when you visit the page, simply set it to true.
Then, when you GoBack, in OnNavigatedTo
protected override void OnNavigatedTo(NavigationEventArgs e)
{
if (Page2.VisitedPage)
{
//process why you needed to go tot he page
//clear the page for a fresh run
}
}
Have you tried unselecting that listbox item when you goback?
I had this same issue not too long ago where since it was the same instance of the page the listbox item was still selected when I returned and since the event on the listbox is "selectedchanged" it doesnt change when you select the same 1.
I've been going through the NetworkController.smali in LJ7 trying to find the right "if-nez~" to # out to get a legit 3G/1X mod. Unfortunately there are 21 different instances of the bolded line below. I've compiled 21 different SystemUI.apk's to find the right one. In the area I live I generally don't have 3g which should make it easy for me to find which line is the right one. It's not... Not one of the ones I've flashed have given me the results I am looking for.
To any other dev out there, am I missing something or have I gotten it and just have really been on 3g all this time? (lol?) If anyone else has had success, would you mind telling me the ".line ####" to look for?
Code:
iget-boolean v0, p0, Lcom/android/systemui/statusbar/policy/NetworkController;->mShowAtLeastThreeGees:Z
if-nez v0, :cond_8
.line 2777
[B]sget-object v0, Lcom/android/systemui/statusbar/policy/TelephonyIcons;->DATA_1X:[[I[/B]
The end call beep is EXTREMELY loud when connected via bluetooth to a car or headset I haven't measured but I'd have to say it is in the 80-90 db range on my cars. Anyone know how to disable it? I've done a google search and while the question is common, the answer seems elusive. I've seen one solution that was a modified Phone.apk file. I went looking for the M9's Phone.apk but haven't found it in system/app or priv-app. Some older android version seem to have a setting option to turn it off but it is sporadic and no where to be found on the M9. Others have suggested a play store app but the app only adds an end call notification, it doesn't stop the existing one.
I believe I've located the offending piece of code. It is in the telephony.apk. Who can modify the attached apk to remove the beep? I'm guessing you would be able to simply set the TONE_CALL_ENDED integer to 0. The apk is from @andybones stock deodexed rom.
l7777 said:
I believe I've located the offending piece of code. It is in the telephony.apk. Who can modify the attached apk to remove the beep? I'm guessing you would be able to simply set the TONE_CALL_ENDED integer to 0. The apk is from @andybones stock deodexed rom.
Click to expand...
Click to collapse
I don't see "TONE_CALL_ENDED" in integers.xml
Well that's no good. I was hoping it would be an easy change. Found an online decompliler and fed it the telephony.apk. The TONE_CALL_ENDED variable was defined in the CallNotifier.java file. I'm learning as I go here so I'm not sure I'm giving useful info. Just found apkstudio and am now poking through it to see what I can find.
I have the telephony.apk decompiled and found the variable definition in:
smali/com/android/phone/CallNotifier$InCallTonePlayer
I must be missing something trying to recompile though. I get told there are some missing resources.
l7777 said:
I have the telephony.apk decompiled and found the variable definition in:
smali/com/android/phone/CallNotifier$InCallTonePlayer
I must be missing something trying to recompile though. I get told there are some missing resources.
Click to expand...
Click to collapse
What changes did you make in that smali? I'll check it out when home in a few hours.
andybones said:
What changes did you make in that smali? I'll check it out when home in a few hours.
Click to expand...
Click to collapse
There is a variable defined named TONE_CALL_ENDED with a value of 0x5. I just changed it to 0x0 to match TONE_NONE.
I did finally get it to compile but when I replaced the original I had no service, didn't look like it even loaded the replacement apk. Not sure what happened there.
l7777 said:
There is a variable defined named TONE_CALL_ENDED with a value of 0x5. I just changed it to 0x0 to match TONE_NONE.
I did finally get it to compile but when I replaced the original I had no service, didn't look like it even loaded the replacement apk. Not sure what happened there.
Click to expand...
Click to collapse
I'm back on m8 ATM, but I'll give same method a try on m8 and If I get it port over to m9.
andybones said:
I'm back on m8 ATM, but I'll give same method a try on m8 and If I get it port over to m9.
Click to expand...
Click to collapse
If you get it to work on the M8 I'll test it too. It'll make my wife happy. She has the same complaint. Where do I look to see why it didn't like my recomplied apk? I didn't see anything obvious in the logcat.
l7777 said:
If you get it to work on the M8 I'll test it too. It'll make my wife happy. She has the same complaint. Where do I look to see why it didn't like my recomplied apk? I didn't see anything obvious in the logcat.
Click to expand...
Click to collapse
I believe it had something to do in the last method of the smali file ".method public stopTone()V", but not too sure, i tried changing a few things but couldn't get it, sorry my friend.
andybones said:
I believe it had something to do in the last method of the smali file ".method public stopTone()V", but not too sure, i tried changing a few things but couldn't get it, sorry my friend.
Click to expand...
Click to collapse
Figures it wouldn't be easy. I can't believe no one at google or HTC thought that a loud tone at the end of every call would be a good idea.
Potential progress. If I comment
Code:
invoke-virtual {v1, v3}, Landroid/media/ToneGenerator;->startTone(I)Z
or
Code:
[STRIKE]invoke-direct {v1, p0}, Lcom/android/phone/CallNotifier$InCallTonePlayer$1;-><init>(Lcom/android/phone/CallNotifier$InCallTonePlayer;)V[/STRIKE]
in the CallNotifier$InCallTonePlayer.smali, the tone does not play. I have noticed that the speaker phone selection does not get reset now when I end a call. Not sure what else may be going on yet. It looks like commenting startTone prevents the tone from playing and doesn't cause any other side effects. I haven't tested yet but I'm guessing it will also not play call waiting tones. I will report once I test it.
l7777 said:
Potential progress. If I comment
Code:
invoke-virtual {v1, v3}, Landroid/media/ToneGenerator;->startTone(I)Z
or
Code:
[STRIKE]invoke-direct {v1, p0}, Lcom/android/phone/CallNotifier$InCallTonePlayer$1;-><init>(Lcom/android/phone/CallNotifier$InCallTonePlayer;)V[/STRIKE]
in the CallNotifier$InCallTonePlayer.smali, the tone does not play. I have noticed that the speaker phone selection does not get reset now when I end a call. Not sure what else may be going on yet. It looks like commenting startTone prevents the tone from playing and doesn't cause any other side effects. I haven't tested yet but I'm guessing it will also not play call waiting tones. I will report once I test it.
Click to expand...
Click to collapse
Confirmed, no call waiting tones either. Ideally we'd need an if statement and only invoke startTone when something other than the end call tone is selected. My smali skills are not up to that yet. I also can't seem to get things to output to the debug log to see what v1 and v3 are. If I can work that out then it should be possible.
Nice work my friend . :good:
Solution
Got it. If anyone wants to implement it, here's how I did it. I modified the run method of the CallNotifier$InCallTonePlayer class. The tone id for my M9 is to be 27. I got this by spitting the tone ids out to the debug log. For reference the call waiting tone is 22.
To start I bumped the .locals by 1 so I didn't have to worry about clobbering another register that was in use. This was on line 269 for me.
Code:
.method public run()V
.locals 13
#Was locals 12, upped to disable the end call tone
.prologue
const/16 v4, 0x25
const/4 v10, 0x2
const/4 v5, 0x1
const/4 v2, 0x0
const/16 v0, 0x50
The rest of the edits are around the call to startTone around line 630
Code:
const/16 v12, 0x1b
if-eq v3, v12, :cond_20
invoke-virtual {v1, v3}, Landroid/media/ToneGenerator;->startTone(I)Z
:cond_20
The code will now skip the startTone call if the tone id (v3) is 27. The resulting apk is attached, feel free to use it. I verified and now get call waiting tones but no end call tone. If you want to use it just replace your existing apk in recovery. Be careful of permissions if you do this.
3.37.605.7 (Marshmallow) has changed things up a bit. The run method starts around line 295 and already has locals a 13 so we bump to 14.
Code:
.method public run()V
.method public run()V
.locals 14
.prologue
.line 2611
# getter for: Lcom/android/phone/CallNotifier;->VDBG:Z
invoke-static {}, Lcom/android/phone/CallNotifier;->access$600()Z
move-result v10
if-eqz v10, :cond_0
The call to startTone is now around line 681 and some variables changed registers.
Code:
.line 2863
const/16 v13, 0x1b
if-eq v8, v13, :cond_20
invoke-virtual {v6, v8}, Landroid/media/ToneGenerator;->startTone(I)Z
:cond_20
:try_end_2
.catchall {:try_start_2 .. :try_end_2} :catchall_0
Modified Telephony.apk attached.
3.37.605.13 added.
Could you do another upgrade for the Nougat App?
I do have this deafening End Call tone and it is always ringing out my eardrums.
what is the apk that controls the end call tone in Lineage Os system.
Because there is no telephony.apk file
Yes, if this is fixable in lineage nougat, that would be just awesome!