[kencar31]

A HISTORY OF WHAT WE'VE DONE: WHAT WE'RE DOING: AND WHERE WE'RE GOING NEXT

PLEASE FUCKING READ THIS ONE, ALRIGHT?

Okay... A lot of you have read a little bit of what I've been posting in this thread. I searched for it just to see if this is still going on.  A few of you have hit the way of the master in trying to get everyone to dump as much DiSa shit on here as possible. This is GOOD! But it isn't the puzzle or the solution to that puzzle that vexes many people I bet are reading this thread, or will someday find it.

So, let me catch you up, all of you who aren't retardedly and pointlessly obsessed with these cheap Chinese plastic pieces of crap that barely have a TI calculator speaker installed on them:
The first Nextbook series 10.1" was made by EFun primarily with Intel brand or associated brand parts. The original kicked ass. It had nice speakers, a micro-HDMI output, a just-as-good expansion for SD that the current ones have. THE BEST NEWS FOR ANYONE WITH AN INTEL MODEL LOOKING TO MOD/CRACK/HACK/WHATEVER: THESE ARE THE HOLY GRAIL! THEY ARE THE MODELS WITH .TESTDISA IN THE MAIN ANDROID FILE AND EVERY TIME YOU ENTER A BAD PIN IT GIVES YOU MORE DATA IN THE HASH LINES!!! YOU CAN EYEBALL A REPEATING PATTERN AND RUN IT THROUGH CRACKSTATION FOR A 5 SECOND, INSTANTANEOUS DECRYPTION AND ACTIVATION OF THE WHOLE DEVICE FOREVER AND FOREVER BIG BIG PROMISES!!! NOW PREPARE FOR DEFEAT: This model is no longer manufactured, and if you have an Intel chipset Nextbook that still has the PIN lock on, permanently remove it by looking up the 32 repeating bytes in the text of .testdisa, running the hash through crackstation, and enter your PIN. It works forever and will do whatever you want it to.
THIS IS THE EASIEST TO CRACK VERSION THAT WE AS A TEAM KNOW THE LEAST ABOUT!

The Next Nextbook generation came when EFun ditched Intel for the hardware and went with a much less powerful quad-core ARM64 processor, slower RAM, the worst speakers of any tablet ever made, and well... everything is just bad on these things... Some of us dug too deep on the old model, we found the data, worked it, and turned it into one of the simplest, complete activation decryptions with no setbacks anyone has ever found. We were so proud of our work that we posted it fucking everywhere, cause damn! If it's so easy why deny anyone the knowledge?
IT WAS THIS GREAT SHARING OF AN EASY-TO-USE HACK INVOLVING NOTHING BUT THE DEVICE, A TEXT FILE, AND A WEBSITE TO CRACK A HASH THAT CAUSED THEM TO CREATE THE NEXT GENERATION: THE ONES WE'RE WORKING WITH NOW!!!

I'll be a little more detailed here because I really have done my homework. EFun and DiSa (if you don't know who DiSa is, go way, way, way back to the beginning and read EVERYTHING) release software updates, with minimal pentesting, every quarter of the year since they were rebuilt using slower memory and an ARM64 CPU. So there's been a Spring 2017 version, a Summer 2017 version, and finally a Fall 2017 version. For some reason the area I was working in when some of us decided DiSa was getting a little too big for their britches. Spring 2017 Nextbooks could still be decrypted by eyeballing hash strings in the .testdisa. This was the absolute last of that version of the PoSA system DiSa had originally created.

SUB-VERSION SUMMER 2017:
Things started to get a little difficult with this one. They had changed up what they were doing from a piece of wetware, relying on both the software and the hardware to access different parts of the activation process, it was pure software now. Those of us procuring new devices, hacking them, and physically tearing them apart just to see what was what was a daily occurrence. Someone in my type of home-type with my kind of equipment and setup-type, who was even same age, same height, same build, came up with some workarounds like using fooView, NovaLauncher, Application Inspector, and Startup Manager, a few other programs used by each particular hacker depending on his style.

Between Sub-Version Summer 2017 and Sub-Version Fall 2017 you were basically dependent upon an OTG cable/keyboard to gain access to the Dev Options, a method still without equal today, except we went a little... Weird... with things. We were using apps like fooView to start out with SOMETHING, ANYTHING someone could use to gain access to any sort of accessibility at all. Lucky for apps like fooView and SideBar, they replaced the Launcher/Desktop if you didn't like using it (for whateverthefuckreason that might be ??), but these ghetto-fabulous free programs were flawed. You need a desktop launcher no matter how many different versions of a thumb-controller you have because the controller needs the Launcher to display a full app list!
So basically at this point, the person who lives creepy close to and may look a lot like someone who resembles my username, was using Zipper, Startup Manager, fooView, and NovaLauncher in order to make the tablets work THIS WAY:
fooView starts before just about everything Android runs, so it always starts and pops up above the PIN lock, being perfectly usable the entire time the machine is booted. Zipper and Startup Manager (oddly enough) boot up after fooView does, but he'd install them and make programs launch when he decided they needed to anyway.  fooView allows the launch of the third party desktop NovaLauncher, which also happens to be my pick for least burdensome third-party laucher. So even though the device booted up into the PIN screen, you'd get a little icon off to the side allowing you to open a desktop and make the thing work. Startup Manager, Zipper, and Application Inspector, all three together would give you quite a bit of control over which background processes and apps were launched, and when if at all. Biggest problem: not having access to the system's preferred launcher (Home3) made it slightly unstable and unusable at times. Play Store no longer worked, even to update programs already installed, but a lot of stuff wasn't getting installed at activation because we weren't able to rid ourselves of the PIN to start the GoogleInit process. Many, if not most of us, working on the Nextbook were pretty newbile to the entire system, so there was a lot that could have gone on to improve things that didn't.
This was a bunch of bullshit though, and a last resort as many of us were still gaining speed, using the Nextbook as a launchpad into understanding the complexities of Android as a Linux distro instead of a 'when I poke things they work!" type kindergartner OS. In the end, with enough process and app managers going you could get a semblance of a working Android tablet, as long as you were willing to Google, find and install independent APK's instead of using the Play Store.

SUB-VERSION FALL 2017:
So, without much progress being made with the guy who is incredibly handsome like me, nothing to speak of on SL, and even less happening on more restrictive pentesting/hacking forums and websites, progress came to a halt. FALL 2017 was a strange release. They skipped winter and just made more FALL 2017 SUB-VERSIONS than any other version of the tablet, 10.1" or 8". No one did much work with the Flexx or Ares 11 for whatever reason, so, at least to this post, those devices pentesting around that time halted while those of us that were still grinding away didn't do much but fuck around with the 10.1" guys. The Android distro that came with the 8" was just a clone of the 10.1" but with half the storage space and a less responsive screen. There was something that came over us Nextbookers an DiSa haters at this point though. It took us a little while to get the basics mastered, but we were fucking LEARNING! We'd learned through shitty process monitors combined with other shitty process monitors how the apps we wanted modified or removed interacted with one another and the system.
It should've taken us a hell of a lot less time, but we were here and we were moving forward. Before this Sub-Version, my doppleganger figured out how, where, and why DiSa was hiding the PIN screen and he started doing at least 12 hours a day just learning Android (not even Nextbooks specifically) for about a month point five. He figured out very quickly, and within creating 2 hi-res door jams he learned NEVER EVER EVER USE RECOVERY MODE TO TRY TO MOUNT /SYSTEM TO RW!!! Actually, up until SUB-VERSION SUMMER 2017, Nextbooks had a working FASTBOOT mode, but the guy I'm mostly speaking about wasn't TOO familiar with the power of the ADB yet. He was a slow learner, but once he got stuff going it was off to the races.
FALL 2017 ended up being a combination crack between having ONE WORKING ANDROID MENU and last SUB-VERSION's crack. The only problem was that DiSa had actually gotten one up on us with their bragging. Not a damn program would boot before the PoSA System Lock, so every boot had to be joined with an OTG-cable, and a keyboard.
My doppleganger, let's just call him me; realized that as far as he knew, as far as he had read, everyone had pretty much stopped doing shit with the Nextbooks. Pretty much everyone seemed to have gone on the "cheap Chinese pieces of plastic crap" train on out of EFun town. I would never give up, not as long as DiSa was bragging their asses off every single freaking day and no one was putting them in their place for it. You only get to brag as much as they do if you have some pretty damn nice software. They haven't. They didn't. They don't.

At this point I felt alone in my quest to discipline them for their vanity without substance, but I had become ridiculously comfortable in the ADB and with a number of apps I'd come to rely on with every single breakthrough. There were actually 4-5 total hacks that I developed and publicly released, one for every change they made to their software. Most worked just enough to give me access with two programs or less and in under 5 minutes of cracking open a new tablet. Actually, the closest I got to actually ACTIVATING the device was looking through every single background process the machine ever tried to run under any circumstances, running it by itself, and seeing what it did. I discovered the Google Init that opens up immediately upon PIN activation can be run without activating or decrypting and though it did not rid me of the damn PIN, I had given myself a pulldown menu!! A DEFAULT ANDROID MENU THAT ACTUALLY WORKED  GAVE ACCESS WITHOUT HAVING TO PLUG SOMETHING IN, OR TAKE ADVANTAGE OF LAGS BETWEEN SCREEN LOADS, OR SOME OTHER NONSENSE!!!
This gave me an inkling of what I call my Nextbook Final Solution. If I could activate Google's launcher installer and give myself some functionality, what else could I install to gain a greater degree of control over this machine?
So, end of 2017, I had an epiphany someone a lot stupider or smarter, take your pick, should've figured out right at the fucking beginning. Around New Year's I started messing around with THIS COMMAND IN ADB:


"ADB SHELL"

And it opened up a whole new world for me. I had lost the view that even Android is still a Linux flavor and thus HAS to have a shell, and respond to scripting. But there was still a bit of exploring to be done to find SUB-VERSION SPRING 2018's secrets. This was also exceptionally hard because everyone around here was so broke, or so tired of having no working hacktivation for the machines that the last SUBVERSION just sat on shelves without being restocked. This happened to work out in my favor though. I had a very decently long period of time where I had ONE piece of software to repeatedly attack, day in and day out, on the SAME OS and same homebaked software controller suites I'd been developing for my own ease of use.

Blah, blah, blah, some SHIT happened, some time was covered, and I found a program and a shell command that changed everything. These two things were the absolute beginning for what I call and will always call the Nextbook's Final Solution. Believe it or not, I'd been using Linux the GUI with minimal shell interaction since the early 2000's. I was a DOS Baby, what do you want from me? Once Windows 3.1 came out, sure DOS had to be used, but the day of the GUI had arrived in my life and really never left until recently when I started pentesting Android devices and their processes/apps, and doing it hard.

THE BEGINNING OF THE FINAL FUCKING SOLUTION, GODDAMNIT!!!:
So after becoming, not just familiar, but deeply intimate with every aspect that I understood of these computers, I just had to take  a baby step and download two specific programs, one of which I have no fucking clue what it was actually called, I only have a functionary description: While your device was on, the program temporarily mounted /system to RW, but only while the machine was on and the program was running. Along with that I'd also heard about ES File Browser and was continuing to fuck around with the ADB shell. I learned how to, at least while the device was running at that second, turn off the fucking PoSA PIN, activate the GoogleInit, and util it ran out of batteries (not fucking hard on these things, despite the battery being dual-celled and fucking meaty; taking up the bulk of the PC's innards), as long as I had a third-party launcher (Launcher3 REFUSED to do ANYTHING without that damn hacktivation of the PIN),  I was in business with a normal acting tablet.

I did some thought experiments while playing around with the file tables, searching around for program install sources, and upgrading to the SUBVERSION SPRING 2018. One day it came to me: How to put together all the parts I'd been thinking about to subdue this action, or cause this one to activate, gaining access to stuff I had no right being in without activation... I was at the very limits of what someone can do with normal ADB commands, and a pretty good theoretical and working knowledge of Android 6 and 7 was well inside my brain pan. I just had to combine. So I did.
I used RW+, ES, Application Inspector, QuickShortCut Creator and the ADB Shell to create the easiest, non-decrypting, you'll hate yourself for not thinking of it sooner, hacktivation of A Nextbook Ares 10a 10.1" tablet.
Using these various apps, I gained access to where all the pre-installed crap was stored in /system, exact app install folder locations, and discovered which were dummies, simply acting like DiSa's real work, and which were the real deal.
For the FINAL SOLUTION, this was actually the easy part. In SUBVERSION SPRING 2018, DiSa's PoSA system actually showed up under the running app manager in Developer Options. If you could get into DevOp, you could see the protection software, humming, always humming away doing nothing but keeping you from your computer.  
THIS IS WHERE DISA FUCKED UP!!! Android is actually, without the proper apps or knowhow to poke around, pretty good at separating actively running APPS from background PROCESSES and not really letting you touch any of the processes, or many of the foreground APPS for that matter...
They made the PoSA System an actively running foreground app, unable to be disabled or even stopped, but there enough to tease out where the fuck its running components were.
LONG STORY FUCKING SHORT AND SORRY FOR ALL THE GODDAMN CURSING BUT LISTEN!! THIS IS THE GOOD PART!

So I RW+'d, found the app/process/whatever for DiSa's PoSA System that they're constantly jerking off over, and I fucking erased it. No hacking. No cracking. Just a shell command. ONE SHELL COMMAND: PAY ATTENTION BECAUSE THIS ACTIVATES TABLETS! IT JUST DOES! DON'T WORRY ABOUT ANY COMPLICATION BUT FACTORY RESET!!!

HERE ARE THE MOTHERFUCKING BEST COMMANDS I EVER CAME ACROSS OR LEARNED AFTER ALMOST 9 MONTHS OF DEALING WITH THIS FUCKING TABLET FOR UNDER THE TABLE PAY CAUSE PEOPLE WERE REALLY STARTING TO PICK THEM UP, THE BETTER I GOT AT HACKTIVATING THEM, ANYWAY!

All of this works in the ADB in Windows, Linux, or OSX (don't use OSX, so I honestly don't even know if there's an ADB, but it's such a simply programmed tool there HAS to be one for OSX). This just adds the things Windows users need to do to start the cracking process:

START MENU
TYPE 'CMD' AND HIT ENTER
CHDIR C:/PLATFORM-TOOLS
C:/PLATFORM-TOOLS>ADB START-SERVER
C:/PLATFORM-TOOLS> ADB DEVICES
C:/PLATFORM-TOOLS>ADB SHELL
USER$> PM UNINSTALL -K --USER 0 COM.ANDROID.YFDISA

AND THAT IS IT!!! HOME3 LAUNCHER ACTIVATES! GOOGLE ACTIVATES! PLAY SERVICES GOES! PLAY STORE WORKS 100%! YOUR TABLET, WITHOUT BEING HACKED OR CRACKED OR ANYTHING THAT IT MIGHT NOT WANT TO DO 100%, IS WORKING EXACTLY AS IT SHOULD BE WITHOUT ANY SPYWARE/MALWARE/BLOATWARE BEING INSTALLED BECAUSE YOU NEVER ACTUALLY ACTIVATED ANYTHING THAT WAS GOING TO INSTALL THE SHITE PEOPLE COMPLAIN ABOUT THESE TABLETS COMING WITH!!!
IF YOU WANT TO GO A BIT FURTHER, AND YOU SHOULD, USE APPLICATION INSPECTOR TO SEE WHERE DISA'S INSTALL APK IS STORED, USE THE SAME UNINSTALL COMMAND TO REMOVE THAT FILE, THEN REMOVE THE APP ITSELF, AND THEN THERE WILL BE NOTHING FOR THE COMPUTER TO REINSTALL THE POSA WITH UPON FACTORY RESET!!! NO REINSTALLATION OF DISA'S POSA UPON FACTORY RESET IF YOU UNINSTALL YFDISA-INSTALL-FILE-WHATEVER.APK!

I figured out something weird by not uninstalling the installation apk, though. I found out that VUDU is Wally World's brand name, buy every title, version of Netflix and it's tied in to the DiSa activation. Inside the installation APK is a bunch of interesting stuff to look at in a text editor. Upon legit PIN entry, you are automatically signed up via your WM private key (whatever it is, I know we're still doing that part)to VUDU so you can start paying those Nazis $40 for a hard AND digital copy of your movie. Sure, you and I probably enjoy them for free, in the same resolution, but why not have Wally World store them on a private server you don't own in any way and then tie that to your own personal identity via account information, activation PIN, and Android's location tracker into one "WE KNOW WHEN YOU PEE" type situation with those fucking corporate goons.


So now here we are, almost half way through the year, and no one has done a post like this yet, even after all the progress being made. A quick note on that assface selling what should be a free hack in this thread: I just gave away my FINAL SOLUTION, complete with a way to make the PIN lock never, ever, ever, ever, come back. I didn't charge anyone a fucking thing, anyone good enough at Google dorking can find this post and the other couple in this thread explaining my FINAL SOLUTION to ALL SL. FOR FUCKING FREE! So take your "PayPal me real money for maybe-type results at best" shit and book out. (seriously, anyone who hasn't read the whole thread, I explained a non-decrypt method for doing this like 3-4 pages ago, giving the exact instructions each time.)  If you aren't just being a clever dickhead and uninstalling PoSA and it's reinstall APK. Then you have a very valuable tool at your disposal, a total decryption hack that we've all been sitting around asking one another to try and develop for fucking months and you're sitting there, having probably not even figured it out yourself, but were taught for free by a friend and now you're making money off being a tool. Cut it out.
Software, its fixes, updates, and hacks should all be provided to everyone for free. Period.

I kept my FINAL SOLUTION commands a secret from everyone who wanted them for months for simple fucking lulz. The second I told the guy who REALLY wanted to know (cause I wasn't having fun holding back the code anymore) he wanted to make money off what I freely gave and had been doing for friends for a few months at least once the method was down.
(Just a quick vent
This guy I told the commands to is called "The Tech Guy" locally. He pulls some bullshit magic trick I can't figure out to turn stolen computer parts into methamphetamine for himself and his wife, like flowers out of his sleeve- PCHAW! So anyway, the Tech Guy is my small town's 'premier independent IT repair tech' and everyone with grey/black market parts goes to him. He claims absolute wisdom of Windows and Android but when I showed up to his house one day to see what he was doing with my FINAL SOLUTION, it turns out the asshole didn't even know what my commands meant. Not even the SHELL commands. The ADB confused him.
I had to tell him where to download the platform-tools archive, and even had to tell him the fucking CHDIR command in the Windows CMD line to get to ADB, and only once I spent 15 minutes trying to teach him THREE FUCKING COMMANDS he got it, and an hour later he'd barely cracked a tablet.


Okay, so here's the point of all this rambling crap I just wrote, knowing the idiocy level of some of the "pro's" working out there: There's a past, present, and future for all the developments we have going on in various hacks and cracks, but you cannot possibly know wtf you're doing without the full picture, and storyline of your adventure. You need theory and labs for a properly working hack.
DON'T JUST QUICKLY FLIT THROUGH THIS THREAD LOOKING FOR A QUICK FIX!!! THERE IS TONS OF USEFUL STUFF IN HERE HEADING IN ALL SORTS OF DIRECTIONS THAT COULD ONE DAY BECOME EXCELLENT HACKS OF THEIR OWN!!! YOU JUST HAVE TO TAKE THAT THEORY AND PLAY WITH IT IN THE REAL WORLD UNTIL YOU KNOW HOW IT REACTS TO YOUR WELL-KNOWN SYSTEM SO WELL THAT YOU CAN CREATE THE HACKS IN YOUR HEAD WITHOUT TESTING THEM FIRST AND STILL KNOW THEY'LL WORK!
THE 'FINAL SOLUTION' TOOK ME 3 DAYS OF DEBUGGING AND FINALIZING IN MY HEAD BEFORE I EVER TOUCHED A KEYBOARD TO START IT! SO THINK!!!

THE FUCKING FUTURE OF THESE PIECES OF CHEAP CHINESE CRAP:
I'm starting to see what I wanted to see when this thread started: people dumping raw data and looking for real information in the gibberish. Talk of real decryption and the problems therein (I think I mentioned bcrypt and the blowfish cipher way, way back in this thread or one before it and how I'd found traces of it by name all over the PIN Lock's install APK and no one really seemed to give a crap). I don't care if you're listening to me in particular, but pay attention to what people are writing when they've been spending a very long, tedious, boring amount of time figuring it out so you don't have to, eh?

So decryption is the name of the game now. We have 2-3 types of RCA tablets with PoSA on them, as well as 3 -4 kinds of Nextbooks and 5-8 total EFun products. Let's start dumping some fucking hashes, boys! Trust me, after the amount of these things they put out in SUBVERSION FALL 2017 alone should give us a nice amount of numbers to work with. And there seem to be a hell of a lot more of us dedicated to this decryption hacktivation than any other work around or back door I've seen mentioned.
Not bragging, I just think I've come the longest way in this thread hacking Nextbook tablets with a workaround rather than trying to work WITH the PoSA encryption, and in all honesty I think I did a damn fine job. So dump your serial numbers, working receipt PINs, and any other data WalMart is giving you right here in this thread so we can duplicate some freaking numbers and figure out generic combinations that make the tablets work.

My next move is to use the 'update from adb' command in recovery mode as a back door to fix the 'mount system' boot loop problem. Why? Because I know this fucking machine. I know how many of them some of us have sitting around bricked by nothing but a boot loop caused by a file permission error. Even if I can't do exactly what I'm setting down to, I'll figure out something else cool in the meantime because once you start using the SHELL terminal, the sky is the limit.
I have literally almost nothing on my current, personal Ares 10a because I've gotten rid of every single piece of software that the tablet will run without it being installed. I even rooted it by altering file and folder permissions. I have no bootloader, but that's because in SUBVERSION FALL 2017 they removed it. There's still a file named 'bootloader' but I have yet to explore it yet. All I know is that every search on Google tells me I can't run anything but an Intel Nextbook with root, yet here I am looking at a tablet that, by all accounts, should probably not even be working, but I have access to every file, folder, app, and process in the memory.


SO READ THIS REFRESHER!!! LEARN WHERE THE PROGRAM IS IN THE COMMUNITY AND WHERE IT'S GOING!!! THEN DO WHATEVER THE FUCK MAKES YOU THINK IT'LL BE MORE FUN THAT WAY IN THE END!!!

I MAY BE OBNOXIOUS AS FUCK, HAVE A FOUL MOUTH, AND JUST BE ANNOYING IN GENERAL, BUT I KNOW THE NEXTBOOK LINE AND WHERE IT'S LIKELY TO END UP LIKE...A... MAP... OR SOME SHIT!!!

BASIC AND FINAL POINT (SORRY I'M RAMBLING, I KNOW I'VE BEEN UP FOR 2 DAYS ON A CODING BINGE): READ ALL AVAILABLE RECAPS AND HISTORIES OF A PROJECT BEFORE YOU BEGIN WORK ON YOUR OWN VERSION!!! IT'LL SAVE YOU MONTHS, IF NOT YEARS!!!

I just want to say I admire the passion the people here have for their craft..I was a little sceptical and it went against my better judgement to sign up and give any info to a forum of hackers but since I have pretty much sabotaged my own financial status , I didn't think you guys could really cause me any harm. So here is my dilemma...
I bought a Voyager 3 new in the box from a guy at a gas station claiming he left his wallet and needed gas money.. it once again went against my better judgement but it was 15$ and I don't mind helping out a fellow human being.. I soon found out that it needs a code and of course it wasn't purchased at legit retailer.. I could go swap it for another one but the truth is it's not worth the hassle to me...I don't really need the damn thing anyway.. I spent hrs looking for a solution before making that decision..the search for a bypass brought me here...I know absolutely nothing about hacking but I spent hrs reading you threads and found it fascinating.. even though I did not understand much of it... I really like what you guys and gals are doing and decided I would donate the damn mini tablet to the cause if anyone wants it.. still new in the box ..I'd even pay shipping...maybe someday someone here could help me .. but if not I'd still like to help the cause.