Tim Schneeberger timschneeb

Accessing a service menu:

Go to 'Settings > Gear info > About device'
Tap five on 'Serial number'
Enter a code of your choice

Secret code	Description
#0#	Test mode
*#0228#	Battery info
*#0283#	Speaker loopback config

Keybase proof

I hereby claim:

I am thepbone on github.
I am thepbone (https://keybase.io/thepbone) on keybase.
I have a public key ASDMfdDCw5nRbtZ48_uFAPQ5jtKhPsV0fPthAvAtqQh-qgo

To claim this, I am signing this object:

configure.bat -release -static -no-pch -optimize-size -opengl desktop -platform win32-msvc -prefix "C:\Qt\5.15.0-static" -skip webengine -nomake tools -nomake tests -nomake examples -openssl-linked -openssl -ssl -I "C:\OpenSSL-Win64\include" -L "C:\OpenSSL-Win64\lib\VC\static" OPENSSL_LIBS="-llibcrypto64MT -llibssl64MT"
time /t >> time.txt & jom -j8 & time /t >> time.txt
jom -j8 install

1:  #include <iostream>
2:  using namespace std;
3:  int main (void){
4:    int i = 1, j = 2;
5:    if (i > j && j > i) //if: i is bigger than j AND j is bigger than i ....
6:       i++;     //...then increment i by one. BUT this condition can never be true!
7:    
8:    if (i > j || j > i) //if: i is bigger than j OR j is bigger than i ....
9: j++; //...then increment j by one

API Reverse Engineering (MTV/South Park)

Base URL

Production Server:

https://api.mtvnn.com/v2/

Staging Server:

	#include <stdio.h>

	// PIN generator for com.samsung.rtlassistant (RTLAssistant used for Samsung's remote test lab service)
	// -> This program produces PIN: 37626543

	int main()
	{
	// Extracted from libcheckPin.so using Ghidra. Search for a named global called 'pin'. The pin is stored as ASCII, but I already converted it to a byte array with the actual numbers. (0x30 -> 0, 0x31 -> 1, ...)
	// The pin is scrambled from the algorithm below.
	char pin[] = {6, 4, 0, 7, 5, 3, 7, 7, 9, 6, 2, 6, 3, 5, 4, 3, 6, 6, 9, 8};

	admin-lbs: GPS Testing
	aul_test: Launch apps
	com.samsung.gearstore-fit
	com.samsung.tsp-trace-test

	vconftool: Edit settings
	memory/testmode/factorymode

	change-booting-mode.sh: Launch update mode

	#!/bin/bash
	kscreen-doctor -j 1 \| grep 'rotation' \| grep '4' &> /dev/null
	if [ $? == 0 ]; then
	kscreen-doctor output.1.rotation.normal
	else
	kscreen-doctor output.1.rotation.inverted
	fi

	import frida, sys, argparse

	parser = argparse.ArgumentParser(description='Inject custom firmware updates into Samsung\'s official Wearable app (Buds Plus only)')
	parser.add_argument('path', metavar='path', type=str, nargs=1,
	help='Path to firmware archive (on the Android device: ex. \'/sdcard/FOTA_R175XXU0ATF2.bin\')')
	args = parser.parse_args()

	jscode = '''
	setTimeout(function() {{
	Java.perform(function(){{

	/******************************************************************************

	Samsung Galaxy Buds RFComm Transmission CRC16 (CCITT) Algorithm

	*******************************************************************************/

	#include <stdio.h>

	int
	main ()