How To Guide Get BCM4389 into monitor mode for WIFI sniffing - Google Pixel 6 Pro

Hey all,
I was trying to watch beacon frames transmitted by my access point, but had no capable hardware in my house to sniff it. Or did I?
Turns out, Pixel 6 / Pixel 6 Pro can do it. Here's my howto.
Getting the BCM4389 in Pixel 6 into monitor mode for tcpdump/Wireshark WIFI sniffing
A little side project to debug a WIFI 6E TP-Link mesh network in my house, went from "This sounds easy!" to "This is impossible!" to "It can...
chrisf4.blogspot.com
Short answer: Flash an aosp_raven-userdebug build from Google, then use wifi_sniffer and some related system properties to configure frequency and bandwidth, and enable monitor mode using a special firmware that is shipped in the userdebug build. Then, use tcpdump on the newly created radiotap0 interface.
Enjoy,
Chris

Is there any real difference from doing it this way?
GitHub - kimocoder/qualcomm_android_monitor_mode: Qualcomm QCACLD WiFi monitor mode for Android
Qualcomm QCACLD WiFi monitor mode for Android. Contribute to kimocoder/qualcomm_android_monitor_mode development by creating an account on GitHub.
github.com

x56x said:
Is there any real difference from doing it this way?
GitHub - kimocoder/qualcomm_android_monitor_mode: Qualcomm QCACLD WiFi monitor mode for Android
Qualcomm QCACLD WiFi monitor mode for Android. Contribute to kimocoder/qualcomm_android_monitor_mode development by creating an account on GitHub.
github.com
Click to expand...
Click to collapse
Hi x56x, a dependency for that is "3. WiFi chipset that actually uses the QCACLD driver/firmware."
Since Pixel 6 uses a Broadcom WIFI chip and not Qualcomm, you would need my directions for Pixel 6 and 6 Pro.
-Chris

ccfries said:
Hi x56x, a dependency for that is "3. WiFi chipset that actually uses the QCACLD driver/firmware."
Since Pixel 6 uses a Broadcom WIFI chip and not Qualcomm, you would need my directions for Pixel 6 and 6 Pro.
-Chris
Click to expand...
Click to collapse
I actually used these commands for qualcomm on a rooted stock A12 P6P and it worked flawlessly. Never got a chance to mess around with packet sniffing. I am curious as to how you found this? Maybe someone can take a deeper look at the firmware and start working on packet injection.

x56x said:
I actually used these commands for qualcomm on a rooted stock A12 P6P and it worked flawlessly. Never got a chance to mess around with packet sniffing. I am curious as to how you found this? Maybe someone can take a deeper look at the firmware and start working on packet injection.
Click to expand...
Click to collapse
I don't think it could work
raven:/ # ls -l /sys/module/wlan/parameters/con_mode
ls: /sys/module/wlan/parameters/con_mode: No such file or directory

Are you on Android 12, 12.1, or 13? I got it to work on 12 when the phone first came out, so something had to have changed.

I worked on Pixel 6 kernel software and this didn't change..

Just to be sure, you can sniff WIFI packets that the kernel sees, without any changes and just root, using tcpdump. If you want to see other traffic that the WIFI chip would normally filter out, you need monitor mode and you need to load this separate firmware to get into monitor mode.

I pulled the wifi sniffer binary, firmware and .rc files needed to get monitor mode working and packed them into a magisk module. you can find it here on my github
GitHub - Biohazardousrom/nh-magisk-wifi-firmware-gs101-gs201: This Magisk module adds the required firmware for external wireless adapters to be used with NetHunter.
This Magisk module adds the required firmware for external wireless adapters to be used with NetHunter. - GitHub - Biohazardousrom/nh-magisk-wifi-firmware-gs101-gs201: This Magisk module adds the r...
github.com

Duhjoker said:
I pulled the wifi sniffer binary, firmware and .rc files needed to get monitor mode working and packed them into a magisk module. you can find it here on my github
GitHub - Biohazardousrom/nh-magisk-wifi-firmware-gs101-gs201: This Magisk module adds the required firmware for external wireless adapters to be used with NetHunter.
This Magisk module adds the required firmware for external wireless adapters to be used with NetHunter. - GitHub - Biohazardousrom/nh-magisk-wifi-firmware-gs101-gs201: This Magisk module adds the r...
github.com
Click to expand...
Click to collapse
Tried to install today, Didnt see a Release on the Github page, tried to manually compile the magisk module and just get error "Failed to unzip" in magisk. Any ideas? Thanks regardless, been searching up and down for the Wifi_Sniffer binary

try this zip. github is weird sometimes with magisk modules source when you download it.
as for the binaries and the firmware they are located in the system/vendor folder in the zip

Duhjoker said:
try this zip. github is weird sometimes with magisk modules source when you download it.
as for the binaries and the firmware they are located in the system/vendor folder in the zip
Click to expand...
Click to collapse
WORKS PERFECT, THANKS A MILLION!!!!

raven(bear)claws said:
WORKS PERFECT, THANKS A MILLION!!!!
Click to expand...
Click to collapse
on a side note, i am getting "permission denied" while trying to run "wifi_sniffer start". on a rooted pixel 6 pro, factory image but have ro.userdebugging enabled. adb sees the process just does not have access to view it. Could be my goof since i am not using userdebug build

go to data/adb/modules look for the module and go to system/vendor/bin and change the permissions with
chmod a+x wifi_sniffer
chmod a+x wifi_perf_diag
i guess i need to fix that somehow

Duhjoker said:
go to data/adb/modules look for the module and go to system/vendor/bin and change the permissions with
chmod a+x wifi_sniffer
chmod a+x wifi_perf_diag
i guess i need to fix that somehow
Click to expand...
Click to collapse
It starts now!! time for me to fiddle with this "Unable to open /sys/wifi/firmware_path, Failed to up radiotap0" error, surely i made a mistake.

i havent had much time to play with it. i was really hoping someone could figure it out and recount thier steps here.
i noticed some sepolicy stuff reguarding wifi_sniffer while building a few roms for pixel 7, theres an incomplete package to build it. right now adding the package to the device trees to build enables the sepolicy for it but thats it. we may not be able to use them with out using a beta preview until android 14 is released. thats speculation though, cause i dont know.
but please anyone that gets this working please share your steps

Duhjoker said:
i havent had much time to play with it. i was really hoping someone could figure it out and recount thier steps here.
i noticed some sepolicy stuff reguarding wifi_sniffer while building a few roms for pixel 7, theres an incomplete package to build it. right now adding the package to the device trees to build enables the sepolicy for it but thats it. we may not be able to use them with out using a beta preview until android 14 is released. thats speculation though, cause i dont know.
but please anyone that gets this working please share your steps
Click to expand...
Click to collapse
I actually got useful help from ChatGPT. dmesg has an output of [wlan] wl_cfg80211_alert ←[0m: In : error alert eventing, reason=0x6, which indicated firmware corruption. Will start looking at the firmware file its self momentarily.

This is how i get wifi_sniffer to work. first download and install the nethunter firmware magisk module. check permissions of the binaries.
next reboot your device and disable wifi and data. This must be done in order to restart the wlan in monitor mode
now open terminal emulator and either type or copy and paste the commands below
in su shell
Code:
su
# Set bandwidth to 160 MHz for sniffing on 2.4 GHz
Code:
setprop persist.vendor.wifi.sniffer.bandwidth 160
# Set 2.4GHz band
Code:
setprop persist.vendor.wifi.sniffer.freq 2412
# start wifi sniffer
Code:
wifi_sniffer start
#tcp dump to .pcap file
Code:
tcpdump -i radiotap0 type mgt subtype beacon -w /data/beacon-capture.pcap

Related

[Q] Google goggles ipv6

Hi all,
I have Fat Free Froyo installed with the latest 14th Jan 2011 kernel voguimg-240x320-2.6.32-froyo-14-01-11_14.nbh edited to froyo & panel type 2 from t029000.massey.ac.nz but Google Goggles needs ipv6 support.
Is this a kernel problem or a problem with the build itself? I am experienced in linux, so can modprobe or insmod the ipv6.ko but I don't know where to get it from
Any help would be appreciated!
(message for kernel's developers) take this man! he can dev ipv6!
Jumping the gun there a bit
I triage bugs and work on stuff for Ubuntu. Have also ported a few linux bits to ppc64 (PlayStation 3).
I'm pinching the ipv6.ko from slayhers latest kernel build, hopefully that will work insmod-ding or modprobing it into the kernel thru the terminal on the Kaiser itself.
So, fingers crossed, this may be solved in 5 minutes!!
Didn't work, it must be compiled for a different platform...
Anyone have or know where to get a kernel for the Kaiser with ipv6 support, or failing that the correctly built ipv6.ko for the Kaiser so that it can be insmodded?
Getting it compiled in the kernel is the easy bit, although it does use up a lot of space which is limited in the kaiser's kernel so a little tweaking is needed. Getting it to work with the Kaiser's modem and the builds we currently use is a different matter unfortunately. It will take a bit of modding for it to work but it's more then achievable with a bit of free time. Wish i could buy that stuff!!If i get a chance i will get you the ipv6 module for the kaiser's kernel or a kernel with support for it so you can have a play.
I definitely look forward to it! If I knew how and what to modify I'd do it myself, but I thought arch-specific kernels had to be compiled on the arch itself? If that's the case, I can see how free time would be needed, it'd take hours or days to compile the linux kernel at 400MHz
I have compiled kernels before so if/when I learn how to do it myself, I could start to use my own git repo for more recent daily builds or something.
I'm also thinking about starting working on some *buntu stuff (I know Ubuntu is there for the Kaiser, but soem tweaks would help if I get a chance.)
Hmm, a little Googling goes a long way http://www.androidonhtc.com/wiki/Get_Involved << was hard to find that,so hopefully I can add ipv6 somewhere in the 'make menuconfig' options for the kernel.
Are the standard kernel options used by "make vogue_defconfig" ok to use, i.e. will it build a normal useable kernel so that everything works?
xteejx said:
Hmm, a little Googling goes a long way http://www.androidonhtc.com/wiki/Get_Involved << was hard to find that,so hopefully I can add ipv6 somewhere in the 'make menuconfig' options for the kernel.
Are the standard kernel options used by "make vogue_defconfig" ok to use, i.e. will it build a normal useable kernel so that everything works?
Click to expand...
Click to collapse
Yes, that is th correct make file to use. I have built the kernel with IPV6 support, haven't tested it but have attached the module to the post for you to try
Brilliant! I'll try it sometime within the next couple of days, although I might myself be working on a blazing fast kernel specifically for the HTC Kaiser, and it is SERIOUSLY!!!! fast, even at 400MHz I can notice a massive increase in speed with the exact same build, but I haven't economised too much.
I can see the the options for ipv6 in the ncurses menuconfig, so I guess it's just a case of enabling it and building the zImage right?
I seem to be having the old problem with the wifi though, and I know it's kernel related, but there are only patches for it, i.e. the wlan.ko, but can't see how to implement it myself so it's an all-in-one solution
When I get the hang of the Kaiser hardware properly, I might just push through a newer kernel from the armlinux site so watch this space
xteejx said:
I might myself be working on a blazing fast kernel specifically for the HTC Kaiser, and it is SERIOUSLY!!!! fast, even at 400MHz I can notice a massive increase in speed with the exact same build
Click to expand...
Click to collapse
How have you managed that??? What have you done?
I have no idea how it happened, perhaps the other devs add a load of useless options, but all I did was follow the instructions at that link above and compiled a zImage from the 2.6.32 arm branch, using the 2010 arm tools. Used NBHeditor to edit it for Kaiser, panel 2, froyo, flashed it and bang (not literally thank god).
I can't answer any better than that. I used the default options (for now at least) that the vogue build script uses for the kernel, but bluetooth, camera and gps work. No internet connection as yet either through the network or wifi, dumno what I've missed there, and no ipv6 (but can add that easily enough). Wifi doesn't work either, but I'm working on it, although that MAY be the reason why it's so fast...maybe it's missing a few options...still unsure at this point.
I notice that although this is an open community, and people attach NBHs, there are no changelogs or anything showing what the people have done with the kernel to implement some options, so it's kinda holding me back at the minute.
xteejx said:
I notice that although this is an open community, and people attach NBHs, there are no changelogs or anything showing what the people have done with the kernel to implement some options, so it's kinda holding me back at the minute.
Click to expand...
Click to collapse
That isn't true, all tested changes are pushed to git, you can see what has been changed and how from here: http://androidhtc.git.sourceforge.n....git;a=shortlog;h=refs/heads/htc-vogue-2.6.32
*facepalm!*
Didn't see that, will bookmark it and keep an eye on it, perhaps work with it. Thanks for the link
the androidhtc.com site is not related directly to the develop project because no developer is connected to it. Also the git repository it not hosted in linux to go but on sourceforge (so download the correct git). That site is very outdated.
wifi works if you use the correct branch (on sourceforge) and modules.
Am I right in thinking that http://androidhtc.git.sourceforge.n...7c0bf5edc4f5c6d64ce4df29254e8332ce26b;hb=HEAD is the prebuilt kernels and nbhs from the source at http://androidhtc.git.sourceforge.n...og;h=62f075ddd13f378fd252be94c77e4f93d12584fb ??
I think I'm looking at the right tree now.
Flashing the latest NBH: VOGUIMG-320-FROYO-01-16-11.NBH still gives me the wifi error. Do I need to manually add the wlan.ko to it or ??
I could've sworn that an NBH I flashed before had all that in the NBH and it worked fine.
Ok, got it back to how I had it:
Flashed latest.NBH from http://androidhtc.git.sourceforge.n...7c0bf5edc4f5c6d64ce4df29254e8332ce26b;hb=HEAD and dropped androidupdate.tgz to the /andboot folder of the SD card, installed update thru the boot menu and done.
So in reality there's nothing stopping me grabbing the same kernel source, building it and adding ipv6 support in the ncurses kernel config menu and making an NBH from it and flashing that over, and then doing the androidupdate.tgz, although I think with HTCFlasherGUI you can flash a zImage directly right??
Is there something wrong with the git at http://androidhtc.git.sourceforge.net/git/gitweb.cgi?p=androidhtc/kernel.git;a=summary I can't get access, it's showing old stuff. It looks closed since git clone rejects me
xteejx said:
Is there something wrong with the git at http://androidhtc.git.sourceforge.net/git/gitweb.cgi?p=androidhtc/kernel.git;a=summary I can't get access, it's showing old stuff. It looks closed since git clone rejects me
Click to expand...
Click to collapse
No, nothing wrong with it. Just do:
git clone git://androidhtc.git.sourceforge.net/androidhtc/kernel.git
You then need to set it to the correct branch using 'git checkout -b <branch you want> '
It's the 2.6.32 branch you are interested in, you can find out exactly what it's called using 'git branch -a' which will list the available branches.
Cool. Knew something went wrong somewhere, had to be me lol!
I added that ipv6.ko to the NAND via a androidupdate.tgz (only way I could do it), and it didn't work, something about incorrect module format (or something like that).
Are there any prebuilt kernels or NBHs for the Kaiser that include ipv6? Either as a module that I can insmod it in the terminal or built-in?
I hate being upstaged by people that can use Goggles without any problems.
I know slayher's kernels have ipv6, but I flashed the new stock one from http://forum.cyanogenmod.com/topic/4434-froyo-kernels-by-slayher/ and it didn't work. I mean the kernel did, but Goggles didn't - couldn't insmod it either - same invalid module format as the ipv6.ko scooter did for me
Also the git clone didn't work:
Initialized empty Git repository in /home/name/android-git/kernel/.git/
fatal: The remote end hung up unexpectedly

[Q] Working & stable SSHD/sftpd for ZE55xML ?

Apologize for possible OT, but I can't find an always working (and stable) SSH daemon app for the Zenfone2's Lollipop
This is what I tried, any of them PAID apps:
QuickSSHd - too old, not even starts
SSHDroid Pro - sometime starts, only first time after reboot, but only without root and higher ports (>1024)
RRooted SSH/SFTP Daemon - always refusing connections
Ssh Server Pro (olive tree) - seems promising, but very poor of binaries
The Dropbear service hanging issue seems the root of this problem
Thanks for any hint
I can't even find a proper ssh binary. I just tried sshd from an x86 cyanogen port (RAZRi, I think). Got this after loading appropriate library in lib (same as client)
1|[email protected]:/ # sshd
CANNOT LINK EXECUTABLE: could not load library "libssh.so" needed by "sshd"; caused by cannot locate symbol "EVP_ripemd160" referenced by "libssh.so"...
Good luck sir
Blades said:
I can't even find a proper ssh binary. I just tried sshd from an x86 cyanogen port (RAZRi, I think). Got this after loading appropriate library in lib (same as client)
1|[email protected]:/ # sshd
CANNOT LINK EXECUTABLE: could not load library "libssh.so" needed by "sshd"; caused by cannot locate symbol "EVP_ripemd160" referenced by "libssh.so"...
Good luck sir
Click to expand...
Click to collapse
Hi,
I followed the following guide which you can get from googling "Compiling-Dropbear-for-a-Nexus-7-tablet". Sorry, I can't post any links yet as my post counts are still below 10
The difference with the info from the website above is that we don't need to cross compile if you're compiling in a Linux x86-64 system. Just need to make a static binary.
Let me know if you have any questions and I'll try to help out.
Cheers.
wolfdude said:
The difference with the info from the website above is that we don't need to cross compile if you're compiling in a Linux x86-64 system. Just need to make a static binary.
Let me know if you have any questions and I'll try to help out.
Click to expand...
Click to collapse
Thanks for your answer.
Sorry but I can't get the exact entry-point, bypassing all the NDK / X-compiling stuff, as we're on a x86_64 architecture
Referring to the "simplified" version of your link (here: https://nerdoftheherd.com/articles/cross-compiling-dropbear-rsync-android/ ),
how should I compile the Dropbear source ?
Something like this ?
Code:
./configure \
--disable-zlib --disable-largefile --disable-loginfunc --disable-shadow --disable-utmp --disable-utmpx --disable-wtmp \
--disable-wtmpx --disable-pututline --disable-pututxline --disable-lastlog \
CFLAGS='-Os -W -Wall -fPIE' LDFLAGS='[COLOR="Red"]-static[/COLOR] -fPIE -pie'
... right before make-ing ?
Thanks for any further hint in the right direction
Hi,
I didn't refer to that site you have posted BUT that site does have a link at the bottom to the site where I followed.
From that site, what I did was :-
1) Download dropbear v58 (dropbear-2013.58.tar.bz2). I know this is older but the patch available is based on this version.
2) Download patch (dropbear-patch2) from that site.
3) Apply patch to the original dropbear (v58) source.
4) Run configure :-
./configure --disable-zlib --disable-largefile --disable-loginfunc \
--disable-shadow --disable-utmp --disable-utmpx --disable-wtmp \
--disable-wtmpx --disable-pututline --disable-pututxline --disable-lastlog
5) Run make :-
STATIC=1 MULTI=1 SCPPROGRESS=0 PROGRAMS="dropbear dropbearkey scp dbclient" make strip
6) You should end up with "dropbearmulti" which is a static binary that you can then copy over the the phone & go on from there.
There are some issues with that version of the code (v58+patch). Namely the "scp" doesn't work (but I have found the offending code in scp.c and found a workaround).
Let me know if you need more details. If I have some time, I might look at getting the latest dropbear version & working out a patch for it to get it to work on android x86.
Cheers.
wolfdude said:
Hi,
I didn't refer to that site you have posted BUT that site does have a link at the bottom to the site where I followed.
[...]
There are some issues with that version of the code (v58+patch). Namely the "scp" doesn't work (but I have found the offending code in scp.c and found a workaround).
Let me know if you need more details. If I have some time, I might look at getting the latest dropbear version & working out a patch for it to get it to work on android x86.
Cheers.
Click to expand...
Click to collapse
Yes of course. The main link you weren't able to post is:
http://blog.xulforum.org/index.php?post/2013/12/19/Compiling-Dropbear-for-a-Nexus-7-tablet
Actually that procedure seemed too complex as mostly dealing with the cross-compiling issue, which didn't apply to x86 case.
So I named the derivative one
Thanks for pointing out the static compiling is done within MAKE and not CONFIGURE phase... I'm quite newbie in those flags so I do appreciate any of your words
About issues, what about using the latest v67 for Dropbear sources ? (see here)
If the patch doesn't work for such different version, I guessed commenting out the interactive password line would be enough
I'm trying to compile it this way and - for instance - replace the binaries in one of the SSHD packages I named in the OP...
Thank you again for your time
Val3r10 said:
About issues, what about using the latest v67 for Dropbear sources ? (see here)
If the patch doesn't work for such different version, I guessed commenting out the interactive password line would be enough
I'm trying to compile it this way and - for instance - replace the binaries in one of the SSHD packages I named in the OP...
Thank you again for your time
Click to expand...
Click to collapse
Hi,
Yes, the patch for v58 does not work for v67. I think one just have to go through the patch and "adjust" it slightly for the newer v67. Hopefully there isn't much changes from v58 to v67. There may be more than just commenting out the password prompt as there are certain functions that don't work in Android as in *NIX. When I have some time, I will attempt to patch v67 meanwhile, I'm running v58 fine on my ZE550ML so no complains there.
Cheers.
Hi,
I've created a guide on compiling the latest dropbear (2015.67) :-
http://forum.xda-developers.com/zenfone2/general/compiling-dropbear-2015-67-zenfone-2-t3142222
Hope it helps.
Cheers.
wolfdude said:
I've created a guide on compiling the latest dropbear (2015.67)
Click to expand...
Click to collapse
Thanks a lot.
Do you think the same process (STATIC build, of course, not patching) could be likely used for other small binaries too ?
Val3r10 said:
Thanks a lot.
Do you think the same process (STATIC build, of course, not patching) could be likely used for other small binaries too ?
Click to expand...
Click to collapse
Of course. I've managed to compile tcpdump, iperf, gdbserver, etc... successfully and working fine on the Zenfone 2.
Cheers.
I found that "Servers Ultimate" SSH/SFTP modules work on the Zenfone2 once properly configured. Its not working 100% but its already more then most solutions out there.

[TOOL] A QUICK Android OTA payload dumper

Made with Go. By utilizing goroutines, this can extract img files from (full) OTA payload.bin really quickly.
See how fast this is: https://i.imgur.com/adpijqf
Source Code: https://github.com/ssut/payload-dumper-go
Prebuilt binaries: https://github.com/ssut/payload-dumper-go/releases/tag/1.0.0 (for macOS and Windows only)
Howto:
1. Copy original image (zip archive or payload.bin) to the same directory as payload-dumper-go exists.
2. ./payload-dumper-go payload.bin
Notes:
- Incremental OTA payloads are currently not supported but definitely will be in near future.
ssssut said:
Made with Go. By utilizing goroutines, this can extract img files from (full) OTA payload.bin really quickly.
See how fast this is: https://i.imgur.com/adpijqf
Source Code: https://github.com/ssut/payload-dumper-go
Prebuilt binaries: https://github.com/ssut/payload-dumper-go/releases/tag/1.0.0 (for macOS and Windows only)
Howto:
1. Copy original image (zip archive or payload.bin) to the same directory as payload-dumper-go exists.
2. ./payload-dumper-go payload.bin
Notes:
- Incremental OTA payloads are currently not supported but definitely will be in near future.
Click to expand...
Click to collapse
Thanks for creating this, I wanted to give it a try on Windows but it came out this error: liblzma-5.dll not found. Do I need to install any per-requisite? Thanks
EDIT: managed to get the dll from here https://tukaani.org/xz/ and it's all working nicely.
Works great. As a Mac user this is extremely helpful!
Another very good option! cheers
zellleonhart said:
Thanks for creating this, I wanted to give it a try on Windows but it came out this error: liblzma-5.dll not found. Do I need to install any per-requisite? Thanks
EDIT: managed to get the dll from here https://tukaani.org/xz/ and it's all working nicely.
Click to expand...
Click to collapse
can i ask how to install liblzma-5 please? in system? in the program?
mixlex said:
can i ask how to install liblzma-5 please? in system? in the program?
Click to expand...
Click to collapse
You just put the .dll in the same directory as the payload-dumper-go .exe; the issue could be pretty easily avoided if it were compiled static.
In fact, I spent some time today figuring out how to static cross-compile payload-dumper-go from my Ubuntu VM to Win32, Linux x86 and armhf, since it's usually better to go for lowest common denominator, and of course having arm since on-device is where payload-dumper-go might be most useful!
After digging into the recent Docker commit for some hints, then adding stripping and disabling DWARF debugging info generation to have the smallest binary possible, here are my notes for Linux x86:
Bash:
# install latest Go (currently 1.16.2) to /usr/local/go per the Linux instructions at https://golang.org/doc/install
export PATH=$PATH:/usr/local/go/bin
git clone https://github.com/ssut/payload-dumper-go
cd payload-dumper-go
apt-get install liblzma-dev
GOOS=linux GOARCH=386 CGO_ENABLED=1 CC=i686-linux-gnu-gcc go build -a -ldflags '-extldflags "-static -s -w"'
Then, I found that payload-dumper-go's go-xz dependency also in turn being dependent on the toolchain hopefully containing liblzma is extremely problematic/frustrating for Go cross-compiling, but was able to hack the MSYS2 mingw-w64-i686-xz liblzma into the Ubuntu mingw-w64 toolchain to make a static Win32 build:
Bash:
apt-get install mingw-w64
# install include and lib from https://packages.msys2.org/package/mingw-w64-i686-xz to /usr/i686-w64-mingw32
GOOS=windows GOARCH=386 CGO_ENABLED=1 CC=i686-w64-mingw32-gcc go build -a -ldflags '-extldflags "-static -s -w"'
And finally, for Android, NDK gcc wasn't cooperating with `go build` but, since we're building static, Linux armhf will still work fine, but we still need a similar trick to get Ubuntu's own armhf liblzma into the armhf toolchain:
Bash:
apt-get install gcc-arm-linux-gnueabihf
# install include and lib from https://launchpad.net/ubuntu/bionic/armhf/liblzma-dev/5.2.2-1.3 to /usr/arm-linux-gnueabihf
GOOS=linux GOARCH=arm GOARM=7 CGO_ENABLED=1 CC=arm-linux-gnueabihf-gcc go build -a -ldflags '-extldflags "-static -s -w"'
I also noticed it doesn't print instructions even though there are some in the code, and have added a PR to fix that: https://github.com/ssut/payload-dumper-go/pull/5
Hopefully @ssssut will still see about adding Incremental OTA support at some point, maybe do something about go-xz to make cross-compiling easier, and ideally add a feature to only dump specific partitions, since extracting the entire payload.bin can be time-consuming (and RAM-consuming!) when all you want is boot.img.
So, without further ado, here are my builds:
[ Attachments removed since they're now superseded by CI releases on GitHub in all major architectures! ]
Made a Magisk module with a wrapper to get the arm build working smoothly on-device: https://forum.xda-developers.com/t/...ices-platforms.2239421/page-149#post-84753275
osm0sis said:
ideally add a feature to only dump specific partitions
Click to expand...
Click to collapse
There is python variant of dumper with this feature (if anyone interested).
GitHub - sabpprook/payload_dumper
Contribute to sabpprook/payload_dumper development by creating an account on GitHub.
github.com
Trying this on a SP7 with Oneplus6 firmware -- I get a crash towards the end "panic: Memory allocation failed" (I use the static compiled version by osmosis)
hayvan96 said:
Trying this on a SP7 with Oneplus6 firmware -- I get a crash towards the end "panic: Memory allocation failed" (I use the static compiled version by osmosis)
Click to expand...
Click to collapse
To quote my module post: "Only issue I've seen so far is that on a HUGE payload.bin it can run out of memory and fail to extract the largest partitions, regardless of platform, so I believe that's more of an issue with payload-dumper-go itself than my compiles. It certainly works very well to get boot.img and recovery.img, etc. from a Full OTA quickly. Generally I've had best results extracting on my OnePlus 8T, which is a decently beefy device."
OK I'll try to extract it on my phone directly then
osm0sis said:
To quote my module post: "Only issue I've seen so far is that on a HUGE payload.bin it can run out of memory and fail to extract the largest partitions, regardless of platform, so I believe that's more of an issue with payload-dumper-go itself than my compiles. It certainly works very well to get boot.img and recovery.img, etc. from a Full OTA quickly. Generally I've had best results extracting on my OnePlus 8T, which is a decently beefy device."
Click to expand...
Click to collapse
Ok fixed by dumping the xz5.2.5 libs in the same directory (as instructed above) -- but I had to rename libzlma.dll to libzlma-5.dll, maybe this should be added to have a working fix.
hayvan96 said:
Ok fixed by dumping the xz5.2.5 libs in the same directory (as instructed above) -- but I had to rename libzlma.dll to libzlma-5.dll, maybe this should be added to have a working fix.
Click to expand...
Click to collapse
Even with my static compiles? Weird..
osm0sis said:
To quote my module post: "Only issue I've seen so far is that on a HUGE payload.bin it can run out of memory and fail to extract the largest partitions, regardless of platform, so I believe that's more of an issue with payload-dumper-go itself than my compiles. It certainly works very well to get boot.img and recovery.img, etc. from a Full OTA quickly. Generally I've had best results extracting on my OnePlus 8T, which is a decently beefy device."
Click to expand...
Click to collapse
Looks like @luca020400 and @LuK1337 from Lineage fixed this today and added the feature to select partitions to extract!
Hopefully @ssssut can make some new official binary release builds (static this time ), and I'll be happy to post some for any architectures not covered and update my Magisk module.
osm0sis said:
Looks like @luca020400 and @LuK1337 from Lineage fixed this today and added the feature to select partitions to extract!
Hopefully @ssssut can make some new official binary release builds (static this time ), and I'll be happy to post some for any architectures not covered and update my Magisk module.
Click to expand...
Click to collapse
Man it was using 7GB of RAM here, I had to fix it.
v1.1.0 is up thanks to some more solid work from @LuK1337! Now it automatically builds in all major architectures.
Releases · ssut/payload-dumper-go
an android OTA payload dumper written in Go. Contribute to ssut/payload-dumper-go development by creating an account on GitHub.
github.com
Updated Magisk module to v1.1.0 as well: https://forum.xda-developers.com/t/...ices-platforms.2239421/page-149#post-84753275
Probably solid now until Incremental OTA support can be looked into.
@ssssut - I tried a few different versions of windows_386 payload-dumper-go up to 1.1.1 on Windows XP Professional with Service Pack 3. Unfortunately, the payload-dumper-go software does not work. When trying to execute payload-dumper-go.exe, I receive the following error message:
[Path the executable]\payload-dumper-go.exe is not a valid Win32 application.
Click to expand...
Click to collapse
Please update the software so that it may work on Windows XP Professional with Service Pack 3.
Hmm I think it worked fine for me on Windows 10 x86 last I checked, so I guess it just doesn't support XP.. Not sure if there's anything to be done for that.
Very useful tool! Updated my firmware on [email protected]
Thank you!
thanks, bro...
very simple but pretty useful tool

Unofficial Lineage 18.1 GSI

Hi!
First: I am NOT a dev or contributor of this rom. Please visit before going ahead: https://forum.xda-developers.com/t/gsi-11-lineageos-18-x-gsi-all-archs.4205461/
Second: You do anything at your own risk and should know how to recover a non booting device!
Just playing around with this rom on my SHT-AL09, tested on version 20210317 so far:
Working
- Mobile network including 4G (German carrier Telekom)
- Outgoing & Incoming calls
- Bluetooth
- 2,4 & 5g Wifi
- Front & Back camera
- Video recording
- MTP
- SDcard
- GPS (seems to be working on Telegram)
- Fingerprint reader
Not Working:
- Mobile network icon shows no signal strength
- VoLTE
- VoWIFI
How to install:
- Make a backup.
- Device needs to have bootloader unlocked.
- Visit the above link again --> sourceforge --> lineage-18.x and download version "...treble_arm64_bv*" + unpack it.
- Visit: https://www.xda-developers.com/flash-generic-system-image-project-treble-device/ (I have done it via bootloader method.)
How to update:
- Dont know yet.
Unfortunately I cant get TWRP to work, so I cant test gapps or root. If you have a clue, please let me know - thx!
So you tested a GSI Lineage ROM on the your M5, is it rooted? Should be great to see magisk included in any room, i use Phh treble Quack, it's pre-rooted with su.
Hi @massima
according to this post by one of the dev's Magisk is broken and supersu should be used instead. I can confirm that this works. You do not need working TRWP, just install the app from fdroid, as mentioned.
For me the rom works well, but as I use the tablet without gapps and only as a youtube player (YT Vanced works fine!), I have not really tested "real world szenarios" yet. Also I cannot say something regarding camera quality and battery performance in comparsion to the stock rom, as I went straigt to Linage 15.1 when I got the tablet in 2018.
Yes, i remember that magisk is incompatible with GSI images. I never used Lineage, for me an AOSP experience is the best. I'm waiting to upgrade to Quack when it will receive its last update probably a vanilla edition because the gapps version has a RO system partition and the vnk version doesn't fit, every version is prerooted with phh-su.
Thanks
P.S.: i added a page of our beloved M5 in the phh's wiki.
massima said:
Yes, i remember that magisk is incompatible with GSI images. I never used Lineage, for me an AOSP experience is the best. I'm waiting to upgrade to Quack when it will receive its last update probably a vanilla edition because the gapps version has a RO system partition and the vnk version doesn't fit, every version is prerooted with phh-su.
Thanks
P.S.: i added a page of our beloved M5 in the phh's wiki.
Click to expand...
Click to collapse
Hi Massima,
Sorry for this noob question - where would I find the M5 entry in the phh's wiki?
And generally, is it possible to install a treble rom on the M5 with gapps and functioning bluetooth? I've been using Openkirin so far but no luck with bluetooth there.
Many thanks for any help you can offer.
spoo333 said:
Hi Massima,
Sorry for this noob question - where would I find the M5 entry in the phh's wiki?
And generally, is it possible to install a treble rom on the M5 with gapps and functioning bluetooth? I've been using Openkirin so far but no luck with bluetooth there.
Many thanks for any help you can offer.
Click to expand...
Click to collapse
This is the link, just search your device mine is the M5 8" wifi (sht-w09). You can flash a vanilla (no gapps), the gapps version (be aware is Read Only). if you need a rewritable System partition download the vndklite version (arm64-AB-gapps-vndklite is 2,9Gb but it will not fit in the standard partition <2,9GB ).
I haven't ever tested the bluetooth so i can't say if it works.
Thanks for your reply and the link. I'll check it out if I can figure out the flashing etc.
Flashing seems relatively straightforward. Curious if Bluetooth works. Mine is the CMR-W09-C432
Thanks for the report. This finally gave me confidence to upgrade mine. I did an upgrade from huawai 9.1 to ASOP Phhusson with gapps. I had to register the device at google to get access to gapps -pretty straightforward (https://www.google.com/android/uncertified/). It was relatively straightforward and took about an hour, which was mainly spend on reading.
Steffe89 said:
Thanks for the report. This finally gave me confidence to upgrade mine. I did an upgrade from huawai 9.1 to ASOP Phhusson with gapps. I had to register the device at google to get access to gapps -pretty straightforward (https://www.google.com/android/uncertified/). It was relatively straightforward and took about an hour, which was mainly spend on reading.
Click to expand...
Click to collapse
May I know how to do because when I key command in my pc adb shell, it shows:
C:\adb>adb shell 'sqlite3 /data/data/com.google.android.gsf/databases/gservices.db \ "select * from main where name = "android_id";"'
/system/bin/sh: sqlite3 /data/data/com.google.android.gsf/databases/gservices.db \ select * from main where name = android_id;: inaccessible or not found
Thanks
toystory2000 said:
May I know how to do because when I key command in my pc adb shell, it shows:
C:\adb>adb shell 'sqlite3 /data/data/com.google.android.gsf/databases/gservices.db \ "select * from main where name = "android_id";"'
/system/bin/sh: sqlite3 /data/data/com.google.android.gsf/databases/gservices.db \ select * from main where name = android_id;: inaccessible or not found
Thanks
Click to expand...
Click to collapse
Sure. There's a typo in the line, hence i wrote it in several commands, e.g.
> adb shell
> sqlite3 /data/data/com.google.android.gsf/databases/gservices.db
> "select * from main where name = "android_id";
Anyone know how to install magisk? I succeed patching recovery_ramdisk.img. However, does not flash properly (no warnings). My guess is that phh.superuser interveens and needs to be uninstalled (https://github.com/phhusson/device_phh_treble/blob/android-9.0/phh-securize.sh). As adb root i'm unable to do so though.
@Steffe89
"Magisk compatibility is mostly broken since Android 11 - use PHH-SU instead. Install the app and you'll get root for apps."
[DISCONTINUED][GSI][11] LineageOS 18.x GSI (all archs)
Background: This is a natural continuation/extension of the LineageOS 17.x GSIs I've been making since November 2019. LineageOS is a free, community built, aftermarket firmware distribution of Android, which is designed to increase performance...
forum.xda-developers.com
Besuz said:
@Steffe89
"Magisk compatibility is mostly broken since Android 11 - use PHH-SU instead. Install the app and you'll get root for apps."
[DISCONTINUED][GSI][11] LineageOS 18.x GSI (all archs)
Background: This is a natural continuation/extension of the LineageOS 17.x GSIs I've been making since November 2019. LineageOS is a free, community built, aftermarket firmware distribution of Android, which is designed to increase performance...
forum.xda-developers.com
Click to expand...
Click to collapse
Maybe.... According to many posts v21 brings stable magisk support to android 11 so that is a little contradictory....
Anyhow, I'm not really interested in root. I want try and see if magisk with universal patch could make root-hating apps and widewine L1 drm work.
Steffe89 said:
Sure. There's a typo in the line, hence i wrote it in several commands, e.g.
> adb shell
> sqlite3 /data/data/com.google.android.gsf/databases/gservices.db
> "select * from main where name = "android_id";
Anyone know how to install magisk? I succeed patching recovery_ramdisk.img. However, does not flash properly (no warnings). My guess is that phh.superuser interveens and needs to be uninstalled (https://github.com/phhusson/device_phh_treble/blob/android-9.0/phh-securize.sh). As adb root i'm unable to do so though.
Click to expand...
Click to collapse
Thanks a lot
Steffe89 said:
Sure. There's a typo in the line, hence i wrote it in several commands, e.g.
> adb shell
> sqlite3 /data/data/com.google.android.gsf/databases/gservices.db
> "select * from main where name = "android_id";
Anyone know how to install magisk? I succeed patching recovery_ramdisk.img. However, does not flash properly (no warnings). My guess is that phh.superuser interveens and needs to be uninstalled (https://github.com/phhusson/device_phh_treble/blob/android-9.0/phh-securize.sh). As adb root i'm unable to do so though.
Click to expand...
Click to collapse
You're probably aware of that anyway, but just checking that you didn't use "fastboot flash ramdisk patched_boot.img" or "fastboot flash recovery_ramdisk patched_boot.img"
spoo333 said:
You're probably aware of that anyway, but just checking that you didn't use "fastboot flash ramdisk patched_boot.img" or "fastboot flash recovery_ramdisk patched_boot.img"
Click to expand...
Click to collapse
sorry, meant to write: ... not "fastboot flash ramdisk patched_boot.img" but "fastboot flash recovery_ramdisk patched_boot.img"
I am not really sure that I did I correctly, but yes. I followed these instructions https://topjohnwu.github.io/Magisk/install.html#Huawei.
I think the problem is that I failed to remove phh-
Perhaps try again and check that you've got recovery_ramdisk as the target?
I'm also curious because I'm currently on Openkirin and would like to try what you've been doing. Currently have Magisk installed and wouldn't want to be without it because of Adaway etc.
Do you mind describing your steps: you had official Huawei 9.1 installed, then unlocked the bootloader, flashed Phhusson and then added Gapps?
@spoo333: i tried to send an image from my M5 to the pc and viceversa with bluetooth, no problem.
@Steffe89:
i read in the phh' s telegram channel to remove root with the securize option, then clean the cache. I did't test it.
I found this in the phh's gsi channel:
flash super su phh
create sbin
edit init.environ.rc (it's on /)
add line
export PATH /sbin:/vendor/bin:/system/bin
save
remove su in system/bin
done flash magisk
Once again i don't test it, i'm using phh supersu. See/write here.
massima said:
@spoo333: i tried to send an image from my M5 to the pc and viceversa with bluetooth, no problem.
@Steffe89:
i read in the phh' s telegram channel to remove root with the securize option, then clean the cache. I did't test it.
I found this in the phh's gsi channel:
flash super su phh
create sbin
edit init.environ.rc (it's on /)
add line
export PATH /sbin:/vendor/bin:/system/bin
save
remove su in system/bin
done flash magisk
Once again i don't test it, i'm using phh supersu. See/write here.
Click to expand...
Click to collapse
Massima, that's encouraging to hear re bluetooth. Hope Bluetooth headphones would work too...

[MOD][MAGISK][LineageOS] Iptables TTL/Unthrottled Hotspot

Obviously we all know this, but I'll say it anyway: I bear no responsibility for your device!
Background:
Initially I recompiled the kernel, but thanks to @fddm I was able to get this into a Magisk module. This is a take-off from https://forum.xda-developers.com/t/...-tether-lineageos-18-1.4295601/#post-86183959 Feel free to read that (minimal reading) for additional details.
What is this?
This Magisk mod adds the required iptables kernel module for TTL/Tether/unmetering for using your phone as a hotspot. I have Tmobile & with my plan, when I connect any device to the phone it is extremely throttled to around 0.5Mbps. With this mod and the settings below, you can get around that limitation. I go from 0.5Mbps=>80+Mbps with this mod. Root is required (look at above thread for details on that if needed).
Compatibility:
Confirmed OS's that work: LineageOS18.1, LineageOS19.1
ROMs: At this point I can't indicate what ROMs this will be compatible with, but it appears LineageOS18.1 works. I'm attaching that as well as a Android/AOSP12 version if anyone wants to test that. I'm also not sure if this is exclusive to the bramble/Pixel 4a5g device (If anyone knows what they're doing or wants to get ballsy, test & report your results!)
Carrier: I tested this against Tmobile. It depends on how your carrier throttles your hotspot connected devices; Tmobile uses the TTL to determine if its the phone vs a connected device. If your carrier uses that method this should work.
xt_HL.ko: This is the kernel module we're inserting to allow the "iptables ttl set" command. I tested the Android12 xt_HL.ko file on my LineageOS18.1 OS and it does NOT work. This tells me there is some type of versioning. OR: there's an issue with the A12 file...
InCompatibility: (as reported by users in the thread)
ProtonAOSP 12, pixel 4a5g
Steps:
Install Magisk module & read the output; Verify it installed successfully.
Download Termux app from playstore
Termux App: (Shouldn't be necessary if running latest script since that does this step for you on every boot)
su (Grant permissions)
iptables -t mangle -A POSTROUTING -j TTL --ttl-set 64 (should be no errors - if you have errors my kernel is not installed)
Test: Turn on phone Hotspot, connect any device, do a speed test comparing speed on phone should be similar to the connected device.
If any limitations/blocks: (Not sure but maybe http vs https is blocked sometimes)
Install VPN Hotspot app (Green key icon): "Wi-Fi hotspot" ON, wlan1 ON, DISABLE "Tethering HW Acceleration" in settings
Issues:
After running the iptables command you get this error: iptables v1.8.4 (legacy): unknown option "--ttl-set" Try 'iptables -h' or 'iptables --help' for more information. This means the module was not loaded (or isn't compatible. Assuming the correct version was selected, there's no fix. Likely your OS isn't compatible with this module. If anyone has additional troubleshooting to add feel free to chime in.
Technical Additional Info:
ttl_magisk_L18.1: This contains the xt_HL.ko file compiled from the lineage-18.1-20220102-nightly-bramble-signed repo
ttl_magisk_A12: This contains the xt_HL.ko file compiled from AOSP kernel: android-msm-redbull-4.19-android12
Updates:
* I updated the thread title since no one reporting the Android 12 kernel mod is working (only 11 works this far)
* I added "ttl_magisk_L19.zip" script which runs the iptables command for you on every boot. I just tested this on LineageOS19.1 and it works good. I'm working on testing it on LineageOS20.0...
Based on what @fddm said though, it sounds like a Magisk module like this will not work on stock AOSP because it "enforces signatures on modules". If anyone can confirm that, or a workaround that would be helpful. Also https://forum.xda-developers.com/t/...l-tether-lineageos-18-1.4295601/post-86173703 indicates we'll want to disable IP6 via these commands:
ndc interface ipv6 rndis0 disable
ndc interface ipv6 wlan0 disable
If anyone wants to test & get back that'll be great. With Tmobile I didn't need to do that (yet), but again feedback would be great.
I had checked the stock and Lineage configs and neither had signature enforcement enabled. I only had access to this phone for a couple days, so I unfortunately can't test for you.
fddm said:
I had checked the stock and Lineage configs and neither had signature enforcement enabled. I only had access to this phone for a couple days, so I unfortunately can't test for you.
Click to expand...
Click to collapse
So you think this should work on stock? Thanks man! I need my phone for work so can't put it offline for hours atm, but maybe over the weekend I can. I'd like to reflash android 12 stock & see if this works. I'd have to assume there's some interest in this... Someone else to test...who knows
hi, I am on ProtonAOSP 12, pixel 4a5g, tested the ttl A12 zip file. But it gave me error when trying to run the iptables command as per your instruction. So I guess it is not loading the module maybe
creezalird said:
hi, I am on ProtonAOSP 12, pixel 4a5g, tested the ttl A12 zip file. But it gave me error when trying to run the iptables command as per your instruction. So I guess it is not loading the module maybe
Click to expand...
Click to collapse
Apologies for your results. I just updated the OP with an "Issues" section I'll update with issues reported, and any fixes if we discover any. I've only successfully tested this against LineageOS18.1, and was only hopeful it would work against other OS's. Just for kicks, since it's a pretty simple/quick process, you may want to try the ttl_magisk_L18.1 version. BTW that entire command is case-sensitive in case someone didn't know (Eg. Iptables... will not work; iptables... will).
Regarding the fix for your issue...I think Proton is based just on AOSP, and nothing to do with LineageOS. I wouldn't think that would matter but pointing. I would've made an Android12/LineageOS19.0 module but it isnt official yet for this device. I'm not sure how willing the Proton folks would be, but the next logical step would be to have them add the following options to their ProtonAOSP12 "redbull_defconfig" file (or equivalent), build it, and send me over the xt_HL.ko file. Then I'll add a magisk module for that for you to test.
Side note: there are 4 recent AOSP kernel versions for this device. So if there are compatibility restraints with versions, I'd guess we'd have a maximum of 4 to deal with, depending on what OS you have. I don't know for sure, but wouldn't think your ROM being AOSP, LIneageOS, or Proton would make a difference, since typically custom ROMs only customize overlays, features, preferences, 3rd party SW, etc - they don't typically rewrite the kernel for example. But we'll find out. The modules I posted reflect LineageOS18.1 (should be android-msm-redbull-4.19-android11-qpr3 but I didn't verify; though this does work with a June 2021 build which is likely android-msm-redbull-4.19-android11-qpr2 or before) & Android12 (android-msm-redbull-4.19-android12). I don't have one for android-msm-redbull-4.19-android12-qpr1 yet, but there's a chance that's what you need. Recent bramble kernels:
android-msm-redbull-4.19-android11-qpr2
android-msm-redbull-4.19-android11-qpr3
android-msm-redbull-4.19-android12
android-msm-redbull-4.19-android12-qpr1
kevin71246 said:
Apologies for your results. I just updated the OP with an "Issues" section I'll update with issues reported, and any fixes if we discover any. I've only successfully tested this against LineageOS18.1, and was only hopeful it would work against other OS's. Just for kicks, since it's a pretty simple/quick process, you may want to try the ttl_magisk_L18.1 version. BTW that entire command is case-sensitive in case someone didn't know (Eg. Iptables... will not work; iptables... will).
Regarding the fix for your issue...I think Proton is based just on AOSP, and nothing to do with LineageOS. I wouldn't think that would matter but pointing. I would've made an Android12/LineageOS19.0 module but it isnt official yet for this device. I'm not sure how willing the Proton folks would be, but the next logical step would be to have them add the following options to their ProtonAOSP12 "redbull_defconfig" file (or equivalent), build it, and send me over the xt_HL.ko file. Then I'll add a magisk module for that for you to test.
Side note: there are 4 recent AOSP kernel versions for this device. So if there are compatibility restraints with versions, I'd guess we'd have a maximum of 4 to deal with, depending on what OS you have. I don't know for sure, but wouldn't think your ROM being AOSP, LIneageOS, or Proton would make a difference, since typically custom ROMs only customize overlays, features, preferences, 3rd party SW, etc - they don't typically rewrite the kernel for example. But we'll find out. The modules I posted reflect LineageOS18.1 (should be android-msm-redbull-4.19-android11-qpr3 but I didn't verify; though this does work with a June 2021 build which is likely android-msm-redbull-4.19-android11-qpr2 or before) & Android12 (android-msm-redbull-4.19-android12). I don't have one for android-msm-redbull-4.19-android12-qpr1 yet, but there's a chance that's what you need. Recent bramble kernels:
android-msm-redbull-4.19-android11-qpr2
android-msm-redbull-4.19-android11-qpr3
android-msm-redbull-4.19-android12
android-msm-redbull-4.19-android12-qpr1
Click to expand...
Click to collapse
Another note: it appears Proton does quite a bit of work with the kernel, mods/etc (eg. Features list here: https://forum.xda-developers.com/t/kernel-pixel-4a-5g-proton-kernel.4194685/ ). I'm not sure if you flashed their kernel (1 ROM says its not required), but if you did that may explain the incompatibility - but I'm just guessing.
kevin71246 said:
Another note: it appears Proton does quite a bit of work with the kernel, mods/etc (eg. Features list here: https://forum.xda-developers.com/t/kernel-pixel-4a-5g-proton-kernel.4194685/ ). I'm not sure if you flashed their kernel (1 ROM says its not required), but if you did that may explain the incompatibility - but I'm just guessing.
Click to expand...
Click to collapse
Not at all, I am just using the Proton without the Proton Kernal (this is optional). If not mistaken, the Dev mentioned somewhere that by default, the kernel is same as stock
creezalird said:
Not at all, I am just using the Proton without the Proton Kernal (this is optional). If not mistaken, the Dev mentioned somewhere that by default, the kernel is same as stock
Click to expand...
Click to collapse
Mind going into your phone settings & post your kernel version? Thx
kevin71246 said:
Mind going into your phone settings & post your kernel version? Thx
Click to expand...
Click to collapse
sure, here you go
kevin71246 said:
Obviously we all know this, but I'll say it anyway: I bear no responsibility for your device!
Background:
Initially I recompiled the kernel, but thanks to @fddm I was able to get this into a Magisk module. This is a take-off from https://forum.xda-developers.com/t/...-tether-lineageos-18-1.4295601/#post-86183959 Feel free to read that (minimal reading) for additional details.
What is this?
This Magisk mod adds the required iptables kernel module for TTL/Tether/unmetering for using your phone as a hotspot. I have Tmobile & with my plan, when I connect any device to the phone it is extremely throttled to around 0.5Mbps. With this mod and the settings below, you can get around that limitation. I go from 0.5Mbps=>80+Mbps with this mod. Root is required (look at above thread for details on that if needed).
Compatibility:
ROMs: At this point I can't indicate what ROMs this will be compatible with, but it appears LineageOS18.1 works. I'm attaching that as well as a Android/AOSP12 version if anyone wants to test that. I'm also not sure if this is exclusive to the bramble/Pixel 4a5g device (If anyone knows what they're doing or wants to get ballsy, test & report your results!)
Carrier: I tested this against Tmobile. It depends on how your carrier throttles your hotspot connected devices; Tmobile uses the TTL to determine if its the phone vs a connected device. If your carrier uses that method this should work.
xt_HL.ko: This is the kernel module we're inserting to allow the "iptables ttl set" command. I tested the Android12 xt_HL.ko file on my LineageOS18.1 OS and it does NOT work. This tells me there is some type of versioning. OR: there's an issue with the A12 file...
InCompatibility: (as reported by users in the thread)
ProtonAOSP 12, pixel 4a5g
Steps:
Install Magisk module & read the output; Verify it installed successfully.
Download Termux app from playstore
Termux App:
su (Grant permissions)
iptables -t mangle -A POSTROUTING -j TTL --ttl-set 64 (should be no errors - if you have errors my kernel is not installed)
Test: Turn on phone Hotspot, connect any device, do a speed test comparing speed on phone should be similar to the connected device.
If any limitations/blocks: (Not sure but maybe http vs https is blocked sometimes)
Install VPN Hotspot app (Green key icon): "Wi-Fi hotspot" ON, wlan1 ON, DISABLE "Tethering HW Acceleration" in settings
Issues:
After running the iptables command you get this error: iptables v1.8.4 (legacy): unknown option "--ttl-set" Try 'iptables -h' or 'iptables --help' for more information. This means the module was not loaded (or isn't compatible. Assuming the correct version was selected, there's no fix. Likely your OS isn't compatible with this module. If anyone has additional troubleshooting to add feel free to chime in.
Technical Additional Info:
ttl_magisk_L18.1: This contains the xt_HL.ko file compiled from the lineage-18.1-20220102-nightly-bramble-signed repo
ttl_magisk_A12: This contains the xt_HL.ko file compiled from AOSP kernel: android-msm-redbull-4.19-android12
Click to expand...
Click to collapse
Hi, I followed the steps and I am able to get this to work after making the changes to iptables. I did notice that if I reboot the phone the changes are not persisting. Is there any way to fix this?
Thanks!
ankur414 said:
Hi, I followed the steps and I am able to get this to work after making the changes to iptables. I did notice that if I reboot the phone the changes are not persisting. Is there any way to fix this?
Thanks!
Click to expand...
Click to collapse
That is odd. That iptables command should be persistent across a reboot. The steps in the OP are all I did. In fact once I get it working it's hard to undo it! Like I'll delete the iptables rule, reboot, and usually I still get I throttled data. Eventually it'll break again after messing with it. No clue why. Hopefully sometime else can chime in. For reference, please post your OS, build, kernel, assume Pixel 4a5g?...
kevin71246 said:
That is odd. That iptables command should be persistent across a reboot. The steps in the OP are all I did. In fact once I get it working it's hard to undo it! Like I'll delete the iptables rule, reboot, and usually I still get I throttled data. Eventually it'll break again after messing with it. No clue why. Hopefully sometime else can chime in. For reference, please post your OS, build, kernel, assume Pixel 4a5g?...
Click to expand...
Click to collapse
Hi, thanks for the response. I am using a Pixel 4a 5G:
LineageOS 18.1-20220116
Build: lineage_bramble-userdebug 11 RQ3A.211001.00110038514
Kernel: 4.19.160-ge469934bead0
it seems to be working fine connecting with my pc.
Shared out from pc both hotspot and ICS to router connecting devices register no internet
connection from META (oculus) Quest 2 shows connected, Internet works but ( BEATSABER WILL NOT CONNECT TO MULTIPLAYER ) .
Sorry.
tested the ttl A12 zip
Termux commands in op gave no error.
also ran #ndc interface ipv6 wlan0 disable (accepted)
#ndc interface ipv6 rndis0 disable would not take
noT Mobile buy metropolitition
if anyone could give me some advice for my quest2 multiplayer problem would have much love ... its the main reason I run hotspot.
OnePlus 6T
Model: A6013
Android 12
Sec. patch 1/5/2022
ProtronExtended version
12.2.1
[ROM][12L][fajita] ProtonXtended (PXOSP) [AOSP]
ProtonXtended (PXOSP) Android 12 based ROM About Project PXOSP (Proton Xtended Open Source Project) is a fork based on ProtonAOSP to enhance the user experience with useful addition features. Screenshots Screenshots of the PXOSP Installation...
forum.xda-developers.com
Kernel ver.
4.9.227Syberia+-g44a024f66f1a
#1 Tue Jan 25 19:55:25 UTC 2022
Linux version 4.9.227Syberia+-g44a024f66f1a ([email protected]) (Android (7485623, based on r416183b1) clang version 12.0.7 (https://android.googlesource.com/toolchain/llvm-project c935d99d7cf2016289302412d708641d52d2f7ee)) #1 SMP PREEMPT Tue Jan 25 19:55:25 UTC 2022
Magisk custom update channel
24.1 (24100)
@topjohnwu
kevin71246 said:
That iptables command should be persistent across a reboot.
Click to expand...
Click to collapse
iptables rules shouldn't be persistent unless you add them via script at startup. If anything, the opposite should be true. I know some devices will refresh their firewall rules after some time, at which point you have to add it back.
everburn said:
it seems to be working fine connecting with my pc.
Shared out from pc both hotspot and ICS to router connecting devices register no internet
connection from META (oculus) Quest 2 shows connected, Internet works but ( BEATSABER WILL NOT CONNECT TO MULTIPLAYER ) .
Click to expand...
Click to collapse
I have a very hard time believing that module worked for your device, are you sure your kernel doesn't already have xt_HL builtin? That aside, were you having issues before trying this? It's probably a compatibility issue between your unnamed provider and the platforms you want to use. If that's the case, just try out a bunch of VPNs until you find one that works and use it with VPN Hotspot.
fddm said:
iptables rules shouldn't be persistent unless you add them via script at startup. If anything, the opposite should be true. I know some devices will refresh their firewall rules after some time, at which point you have to add it back.
I have a very hard time believing that module worked for your device, are you sure your kernel doesn't already have xt_HL builtin? That aside, were you having issues before trying this? It's probably a compatibility issue between your unnamed provider and the platforms you want to use. If that's the case, just try out a bunch of VPNs until you find one that works and use it with VPN Hotspot.
Click to expand...
Click to collapse
yes its running according to magisk log. I was previously on pixel exp. rom android 12 and termux cmd ended in error
that is why I switched for the kernel. and from what i can tell all data is used as talk text data.... as my wifi hotspot 15GB still shows i have only used 2GB (which i have). as far as my B.S. problem I think it has something to do with multiplayer servers. it works fine on wifey's hotspot same carrier LG stylo 6 stock..
everburn said:
yes its running according to magisk log. I was previously on pixel exp. rom android 12 and termux cmd ended in error
that is why I switched for the kernel. and from what i can tell all data is used as talk text data.... as my wifi hotspot 15GB still shows i have only used 2GB (which i have). as far as my B.S. problem I think it has something to do with multiplayer servers. it works fine on wifey's hotspot same carrier LG stylo 6 stock..
Click to expand...
Click to collapse
If I'm understanding - it works, but some devices connected have random results? TMobile, or any cell phone provider, are known for issues with VPN, etc, so that doesn't surprise me. And a total guess, but TMobile uses cgnat & ip6, so maybe that's causing issues as well - but not sure what provider u have.
kevin71246 said:
If I'm understanding - it works, but some devices connected have random results? TMobile, or any cell phone provider, are known for issues with VPN, etc, so that doesn't surprise me. And a total guess, but TMobile uses cgnat & ip6, so maybe that's causing issues as well - but not sure what provider u have.
Click to expand...
Click to collapse
thats probably it right there thanks
Have tried both on Pixel 4a 5G, Android 11 stock, rooted, RQ1C.210205.006
"unknown option --ttl-set" on both

Categories

Resources