[BitPim-devel] Hacking BitPim to delete locked files

[Brian Blakley]

I've started hacking about in the BitPim code to see if I can discover a command to unlock a locked file to enable a locked file to be deleted or replaced.

While not a Python programmer, I am *a* programmer and I was able to get Python and the other required modules installed, and grab the BitPim code off the CVS. A little hacking and I found the sections in p_brew.py and p_brew.p that needed to be changed to start my quest.

I started by noting all of the command numbers that were presently utilized:

0x00 Make a directory
0x01 Delete a Directory
0x02 List Subdirectories
0x04 Read File
0x05 Write File
0x06 Delete a File
0x0B Get one diretory entry
0x0C Memory configure

This left me wondering what 0x03, and 0x07 - 0x0A might do.

So, I changed the code in those two files to use 0x03 instead of 0x06 when the "delete" function is used. I repeated with 0x07 - 0x0A. Below are my results (no breakthoughs yet):

0x03 -----> Something to do with directories (get a "no such directory error")

0x07 -----> No error with this one, but nothing happens either. Was hopeful this was an "unlock" so I changed "Delete" back to 0x06 and tried it, but still no joy.

0x08 -----> ValueError: The value read should be a constant of 89, but was 21 instead

0x09 -----> ValueError: The value read should be a constant of 89, but was 21 instead

0x0A -----> ValueError: The value read should be a constant of 89, but was 21 instead

Being that 0x07 didn't kick any sort of error and the others did, I'm guessing that 0x07 indeed has to do with files, and perhaps is a "set attributes" command and requires a parameter - perhaps a bitmask of the attributes to be set - to do anything useful. I don't know enough about BitPim or Python yet to take this much further.

I feel there is significant value in the possiblity of overwriting locked files since some files appear to be locked for no good technical reason (just the carrier wanting to prevent you from doing as you wish with a given feature). Case in point is that the Virgin Mobile V7 has Internet capability, but unlike other models of the same phone through other carriers, the ##BROWSER command doesn't work to let you set your proxy server. Virgin's proxy server doesn't let you go anywhere but where Virgin wants you to. A bit of hacking revealed that the Internet proxy settings are in /nvm/nvm/nvm_hei. A bit more hacking using a sacrificial eBay phone, of the same model but for another carrer, that *does* support the ##BROWSER command allowed me to map the nvm_hei file and figure out how to change the proxy server IP, username, password, etc. Of course, like most phones, everything in the /nvm/nvm directory seems to be locked. Being able to overwrite nvm_hei with my own would be very useful. I have seen posts from others indicating that they have various uses for overwriting locked files as well.

I do not think these particular files are actively locked by a process because I was able to bring up BitPim with the phone powered off but connected to a charger (in theory no apps running) and the file still could not be deleted. This makes me think that it is indeed just an attribute on the file similar to the "read only" attribute in DOS.

Any ideas or other experience on this topic would be welcome.

Thanks!

[Brian Blakley]

Oops, I would swear that I was set to plain text for that message
submission, but obviously not - sorry about that. This message is
definitely in plain text.

I have an update to my analysis:

I tested changing the 0x01 function in BitPim (delete directory) to 0x03
(unknown function) and got no error, but no apparent changes either. It is
now my opinion that the 0x03 function does whatever 0x07 does, it just does
it for subdirectories whereas 0x07 does it (whatever "it" is) for files.
I'm hoping that "it" is a way to set the attributes of a file/subdirectory,
and make it writable. I've been looking at the BitPim code a bit more in
Python and trying to deduce how to properly pass a second parameter (other
than the filename) to experiment with seeing if it does anything - so far
I'm still a little in the dark on Python.

My original post (in plain text) was:
---

I've started hacking about in the BitPim code to see if I can discover a
command to unlock
a locked file to enable a locked file to be deleted or replaced.

While not a Python programmer, I am *a* programmer and I was able to get
Python and the
other required modules installed, and grab the BitPim code off the CVS. A
little hacking
and I found the sections in p_brew.py and p_brew.p that needed to be changed
to start my
quest.

I started by noting all of the command numbers that were presently
utilized:

0x00 Make a directory
0x01 Delete a Directory
0x02 List Subdirectories
0x04 Read File
0x05 Write File
0x06 Delete a File
0x0B Get one diretory entry
0x0C Memory configure

This left me wondering what 0x03, and 0x07 - 0x0A might do.

So, I changed the code in those two files to use 0x03 instead of 0x06 when
the "delete"
function is used. I repeated with 0x07 - 0x0A. Below are my results (no
breakthoughs yet):

0x03 -----> Something to do with directories (get a "no such directory
error")

0x07 -----> No error with this one, but nothing happens either. Was
hopeful this was an
"unlock" so I changed "Delete" back to 0x06 and tried it, but still no joy.

0x08 -----> ValueError: The value read should be a constant of 89, but was
21 instead

0x09 -----> ValueError: The value read should be a constant of 89, but was
21 instead

0x0A -----> ValueError: The value read should be a constant of 89, but was
21 instead

Being that 0x07 didn't kick any sort of error and the others did, I"m
guessing that 0x07
indeed has to do with files, and perhaps is a "set attributes" command and
requires a
parameter - perhaps a bitmask of the attributes to be set - to do anything
useful. I don't
know enough about BitPim or Python yet to take this much further.

I feel there is significant value in the possiblity of overwriting locked
files since some
files appear to be locked for no good technical reason (just the carrier
wanting to prevent
you from doing as you wish with a given feature). Case in point is that the
Virgin Mobile
V7 has Internet capability, but unlike other models of the same phone
through other
carriers, the ##BROWSER command doesn"t work to let you set your proxy
server. Virgin's
proxy server doesn"t let you go anywhere but where Virgin wants you to. A
bit of hacking
revealed that the Internet proxy settings are in /nvm/nvm/nvm_hei. A bit
more hacking using
a sacrificial eBay phone, of the same model but for another carrer, that
*does* support the
##BROWSER command allowed me to map the nvm_hei file and figure out how to
change the proxy
server IP, username, password, etc. Of course, like most phones, everything
in the /nvm/nvm
directory seems to be locked. Being able to overwrite nvm_hei with my own
would be very
useful. I have seen posts from others indicating that they have various
uses for
overwriting locked files as well.

I do not think these particular files are actively locked by a process
because I was able
to bring up BitPim with the phone powered off but connected to a charger (in
theory no apps
running) and the file still could not be deleted. This makes me think that
it is indeed
just an attribute on the file similar to the "read only" attribute in DOS.

Any ideas or other experience on this topic would be welcome.

Thanks!

[Roger Binns]

Look in the fields for listing directories and for opening files for
writing. Both include a four byte field which is probably the
attributes. You may get somewhere figuring out what they are.

Roger

[Brian Blakley]

I'm a little stuck and hope someone who knows the code better can help.

In p_brew.p, line 102 appears the "unknown1" piece of data (4 bytes) which
is speculated to be the file attributes. I'd like to include that value in
the Filesystem tab display so I can see if known locked files have a
different value than others. I've made a lot of progress (for a non-Python
programmer), but am stuck (quite close to the finish line I believe).

First, I modified gui.py in the vicinity of line 1830 to read:

self.AddColumn("Name")
self.AddColumn("Size")
self.AddColumn("Date")
self.AddColumn("Unknown1") <----- This is my new line
self.SetMainColumn(0)
self.SetColumnWidth(0, 300)
self.SetColumnWidth(2, 200)
if self.datacolumn:
self.AddColumn("Extra Stuff")
self.SetColumnWidth(3, 400)

I see that I've usurped the use of column 3 which was reserved for "Extra
Stuff" if self.datacolumn is true, but it must not be true because that
column doesn't show, so that appears safe. This addition causes my
"Unknown1" column to appear in the display.

Later, in the vicinity of line 1964 (still in gui.py), I modified it to
read:

if result[file]['type']=='file':
self.dirhash[result[file]['name']]=0
self.SetItemHasChildren(found, False)
self.SetItemText(found, `result[file]['size'] `, 1)
self.SetItemText(found, " "+result[file]['date'][1], 2)
self.SetItemText(found, result[file]['unknown1'], 3) <----- This is
my new line
if self.datacolumn:
self.SetItemText(found, result[file]['data'], 3)

I of course get an error because the 'unknown1' element doesn't exist in the
result[file] associative array (Perl terminology, sorry if it's not right
for Python). I've hunted a good bit for the section of code that populates
this associative array so I can kindly ask it to include the 'unknown1'
element in there, but have had no luck so far.

Of course if I change the line to read:

self.SetItemText(found, "Hi There", 3)

instead, then it says "Hi There" for every file, in my new Unknown1 column,
so I know I've hacked to the right place.

Please forgive my lack of Python knowledge - I think I'm doing rather well
for a Perl programmer who doesn't know a lick of Python. I think here
however that it is simply my lack of familiarity about which parts of the
program build the various complex data structures in memory that is holding
me up.

----- Original Message -----
From: "Roger Binns" <***@rogerbinns.com>
To: <bitpim-***@lists.sourceforge.net>
Sent: Wednesday, July 13, 2005 12:01 AM
Subject: Re: [BitPim-devel] Re: Hacking BitPim to delete locked files

Post by Roger Binns
Look in the fields for listing directories and for opening files for
writing. Both include a four byte field which is probably the
attributes. You may get somewhere figuring out what they are.
Roger

[Joe Pham]

I was looking into this a while back, as far as I could determine, code 3 lists the files in the specified sudirectory; code 7 returns the status/properties of the specified file; code 8 & 9 just echoes the commands back. Have not found any 0x59 code that either unlocks a file or changes its properties. Good luck.

-Joe Pham



______________________________________________________________________
Surfing so fast you won't believe it's not broadband!
Try NetZero HiSpeed 3G.
Visit http://www.netzero.com to sign up today!

[Roger Binns]

Post by Joe Pham
Have not found any 0x59 code that either unlocks a file or changes its properties. Good luck.

0x59 is the byte that introduces any filesystem command. If you have it repeated then
the phone probably thinks it is getting duplicate data and ignores the first one.

Roger

[Joe Pham]

the "unknown1" piece of data (4 bytes) which is speculated to be the
file attributes. I'd like to include that value in the Filesystem
tab display so I can see if known locked files have a different value
than others.

You got a good idea but you're going down the wrong path. That fields is part of an output message that BitPim sends to the phone, and is set to a constant right now. What you might want to try is to figure out what that field means and what happens when its value varies.

-Joe Pham



______________________________________________________________________
Surfing so fast you won't believe it's not broadband!
Try NetZero HiSpeed 3G.
Visit http://www.netzero.com to sign up today!

[Brian Blakley]

Thanks for the reply Joe. I do intend to start writing test files to the
phone while changing that constant in some logical way, to see if I can put
a "locked" file onto the phone.

Regarding the "unknown1" field, forgive my ignorance - I do see it listed
several places where it appears to be used during a "write" operation, but
(at least if I'm reading the variable names correctly), it looks like this
particular data (listfileresponse) is a map of the data that comes back from
the phone after a listfilerequest - shouldn't that be data that was just
read *from* the phone?

PACKET listfileresponse:
* responseheader header
4 UINT entrynumber
4 UNKNOWN unknown1 "probably the file attributes"
4 UINT date
4 UINT size
4 UNKNOWN unknown2
* com_brew.SPURIOUSZERO spuriouszero "on some models there is a zero
here"
1 UINT dirnamelen "which portion of the filename is the directory,
including the last /"
* STRING {'terminator': None, 'pascal': True} filename

as opposed to this block of code:

PACKET writefilerequest:
* requestheader {'command': 0x05} +header
1 UINT {'value': 0} +blockcounter
1 BOOL {'value': self.filesize>0x100} +*thereismore
1 UINT {'constant': 1} +unknown1
4 UINT filesize
4 UINT {'constant': 0x000100ff} +unknown2 "probably file attributes"
* STRING {'terminator': 0, 'pascal': True} filename
2 UINT {'value': len(self.data)} +*datalen
* DATA data

which obviously is being written *to* the phone and contains the constants.

If the "listfileresponse" section isn't the map of what comes back from the
phone when doing a directory listing, could you point me to that code?

Thanks! Sorry again for any incorrect assumptions on my part.

----- Original Message -----
From: "Joe Pham" <***@netzero.com>
To: <bitpim-***@lists.sourceforge.net>
Sent: Thursday, July 14, 2005 12:54 AM
Subject: Re: [BitPim-devel] Re: Hacking BitPim to delete locked files

Post by Joe Pham

the "unknown1" piece of data (4 bytes) which is speculated to be the
file attributes. I'd like to include that value in the Filesystem
tab display so I can see if known locked files have a different value
than others.

You got a good idea but you're going down the wrong path. That fields is

part of an output message that BitPim sends to the phone, and is set to a
constant right now. What you might want to try is to figure out what that
field means and what happens when its value varies.

Post by Joe Pham
-Joe Pham

[Joe Pham]

shouldn't that be data that was justread *from* the phone?

Good point. You can view the data going back & forth between BitPim and the phone by turning on the protocol logging view (Menu 'View' -> 'View protocol logging'), and also the protocol analyser view (Ctrl+Alt+p on the protocol logging view).

-Joe Pham



______________________________________________________________________
Surfing so fast you won't believe it's not broadband!
Try NetZero HiSpeed 3G.
Visit http://www.netzero.com to sign up today!