Hello all,
I figured this tutorial may come in handy to a few people out there since the documentation for getting this to work is quite atrocious.
What this tutorial is:
A step-by-step walkthrough of setting up wpa_supplicant.conf to access advanced networking protocols that we otherwise don't have access to (note, this will ONLY work with root at the moment).
What this tutorial is not:
A wireless troubleshooting thread for any wireless issues not related to wpa_supplicant, EAP-TLS, EAP-TTLS, etc.
Thanks ahead of time.
NOTE: This tutorial will be giving instructions for a Windows 7 machine, but 90% of the code I provide can easily be copied over to Linux/BSD/OSX, just replace with the Bash equivalents.
To begin, you will need a few things:
--ADB, with working drivers, though you don't NEED root access through it it is nice to have, since it cuts the typing in half, and the setup for that can be found here: [App]: ADB Root Hijack [ADB Runs as Root now]
--openSSL, for converting certificates to the proper formats.
Windows instructions: Requires Cygwin, see this link here. This will install several other useful tools, and you'll love Cygwin if you're a power user
Linux/BSD/OSX instructions: install using your favorite repositories or from binaries (in the case of OSX). For Ubuntu/Debian: sudo apt-get install openssl
--You will need access to the Development menu (use an app or the Any Cut app to make a shortcut), as well as Root Browser lite (or Root Explorer).
--Alot of patience, and a bit of time. This should be straightforward, but don't expect a perfect solution for everyone.
1) The most important step, since this will cause you no end of headaches for possibly an hour or two as you trace it down: Go into the Development menu, UNCHECK USB Debugging and RECHECK it, then UNCHECK Auto Mount. So, even if debugging is checked, uncheck and check it anyway. And make SURE Auto Mount is unchecked, otherwise this will automatically install the "normal" NT drivers and screw up the entire process.
2) Plug in the Nook, and bring up the command line (cmd.exe). Run:
Code:
adb devices
If this returns an alphanumeric string (or anything), your device is in and you're good to go. Otherwise, check the other forum topics for troubleshooting (link to come).
3) To begin, we need to convert our tickets to the correct format. For this we will use OpenSSL. To make this easy, I piled all of my working space into a folder in the root of the C: drive, called "certs". For this example, I will assume that you were given a root certificate named rootCA.crt and a private certificate names [email protected].p12 (because I was, for the eduroam worldwide network).
This example also assumes EAP-TLS authentication. To convert the files:
Code:
openssl x509 -in rootCA.crt -out rootCA.der -outform DER
openssl x509 -in rootCA.der -inform DER -out rootCA.pem -outform PEM
then
openssl pkcs12 -in [email protected] -out cert.pem -clcerts -nokeys
openssl pkcs12 -in [email protected] -out key.pem -nocerts
Note: even if your business/Uni doesn't use a separate hashed key normally (For example, the University of Alaska system), you will need it here. Normally a certificate app handles all of this (on AOSP and custom builds).
4) Thanks to good ol' FSTAB, we will have to remount /system so we can read/write to it:
Code:
adb shell
su
mount -o remount,rw /system /system
5) Now, we have three new files: rootCA.pem, cert.pem and key.pem in the C:\certs folder. We push them to their proper directory on the NT:
Code:
adb push rootCA.pem /system/etc/wifi/
adb push cert.pem /system/etc/wifi/
adb push key.pem /system/etc/wifi/
Note: This is where it gets tricky without root ADB access...the option is to push them to "/media/My Files/My Downloads/" (including quotes) and then use a terminal or root browser to move them to /system/etc/wifi/
6) Next, we get to pull wpa_supplicant finally!
Code:
adb pull /system/etc/wifi/wpa_supplicant.conf .
Note: Make sure to include the . at the end, this means 'copy it to the current directory'
7) Open wpa_supplicant.conf in Wordpad (NOT notepad, wrapping issues), and build a profile based on the examples located here.
Here is an edited version of mine, if you use EAP-TLS this will work for you:
Code:
network={
ssid="YourAPNameHere"
scan_ssid=1
key_mgmt=WPA-EAP
pairwise=CCMP TKIP
group=CCMP TKIP
eap=TLS
identity="[email protected]"
ca_cert="/system/etc/wifi/rootCA.pem"
client_cert="/system/etc/wifi/cert.pem"
private_key="/system/etc/wifi/key.pem"
private_key_passwd="yourPassHere"
priority=20
}
Change ssid, identity, and private_key_passwd to your respective information.
NOTE: priority, near the bottom, determines when it will connect to the network when others are around. Compare it to the values of the priority's set in /data/misc/wifi/wpa_supplicant.conf, the higher the value the higher the priority when they're all within range.
Now save and close the file.
8) Now, we push and reboot:
Code:
adb push wpa_supplicant.conf /system/etc/wifi/
then reboot the nook.
Now, after reboot, it should be good to go!
Notice, one bit of trouble I ran into, if you just get "error" when turning on the wireless after reboot, double-check that your certificates are correct and in the correct places, and wpa_supplicant.conf points at them. If thats fine, try erasing /data/misc/wifi/wpa_supplicant.conf, then reboot, and the list will be rebuilt and your AP will automatically connect.
Please let me know if there are any issues with the instructions, it's 6am and I haven't slept more than 8 hours in the last 3 days troubleshooting this, building kernels and playing Skyrim
reserved for future things
Also of note: I'm working on making this into scripts, don't worry everyone. And, if you bork your wifi, I will have a wireless fix in the works too.
Hi
First of all, thanks for this tutorial
I'm pretty sure this should be very straightforward but not to mess this thing up what do I need to change for a network with the following definitions:
Network SSID: eduroam
Security: 802.1x Enterprise
EAP method: PEAP
Phase 2 authentication: MSCHAPV2
Cheers
LacerdaPT said:
Hi
First of all, thanks for this tutorial
I'm pretty sure this should be very straightforward but not to mess this thing up what do I need to change for a network with the following definitions:
Network SSID: eduroam
Security: 802.1x Enterprise
EAP method: PEAP
Phase 2 authentication: MSCHAPV2
Cheers
Click to expand...
Click to collapse
Hey, it's not a problem at all. Pulled from the source here: NookDevs.com wpa_supplicant.conf I built this skeleton here:
Code:
network={
ssid="eduroam"
scan_ssid=1
key_mgmt=WPA-EAP
pairwise=CCMP TKIP
group=CCMP TKIP
eap=PEAP
identity="[email protected]"
password="YOUR-PASSWORD"
ca_cert="/system/etc/wifi/cacert.pem"
phase1="peapver=0"
phase2="MSCHAPV2" }
As you can see, you'll need to enter your University email in the identity field and your password in the password field, and if you don't have the needed certificates/password/etc you can get that from your local IT office (I would ask to speak with your network technicians though, helpdesk may not have it). Make SURE to read the instructions in that link, the openssl bit is different than the guide above!
Thanks!
On monday I will try that and will report the outcome.
Cheers
Hi.
It worked like a charm! No problem at all.
Thanks!
Cheers
Awesome! Glad to hear it.
Hi, I recently purchased the ZTE Open C and want to synchronize its calendar with my own Caldav server.
Firefox rejects the connection tough, because the server has an invalid (self signed) certificate.
So i tried adding my certificate to firefox.
I found this guide:
http : // wiki . mozfr . org / Adding_CA_to_FirefoxOS
(Sorry for inserted spaces, won't let me post a link in first post.)
However I fail in the very first steps.
Code:
adb shell ls /data/b2g/mozilla/
Returns: /data/b2g/mozilla/: Permission denied
This means I dont have reading rights in this directory.
How do I get those rights, or alternativeley is there a better way to achieve my Caldav-Server goal?
Mathews123 said:
Hi, I recently purchased the ZTE Open C and want to synchronize its calendar with my own Caldav server.
Firefox rejects the connection tough, because the server has an invalid (self signed) certificate.
So i tried adding my certificate to firefox.
I found this guide:
http : // wiki . mozfr . org / Adding_CA_to_FirefoxOS
(Sorry for inserted spaces, won't let me post a link in first post.)
However I fail in the very first steps.
Code:
adb shell ls /data/b2g/mozilla/
Returns: /data/b2g/mozilla/: Permission denied
This means I dont have reading rights in this directory.
How do I get those rights, or alternativeley is there a better way to achieve my Caldav-Server goal?
Click to expand...
Click to collapse
You cannot use that method unless your phone is rooted, BUT...
I had the same problem and solved it a lot easier. Just launch the browser and input your server's URL. Then you will be warned about the not valid cert, add a permanent exception and that's all, now calendars should sync over HTTPS.
BTW this worked for me until FFOS v1.4. Today I updated to FFOS 2.1 and this trick stopped working, so you have been warned.
Thank you for the suggestion.
I am not running v2.0, so I tried it.
I could add the certificate.
However, when trying to connect, I get:
"Unknown Error. Please try again later."
Any way to figure out what's wrong now?
Seems to be a problem with the server I used. (Baikal)
Using a different one (Owncloud - sadly quite a lot bigger), it works with your tip.
So thanks for the help.
to ged rid of the "unknown error" in Caldav (etc.?)
doragasu said:
I had the same problem and solved it a lot easier. Just launch the browser and input your server's URL. Then you will be warned about the not valid cert, add a permanent exception and that's all, now calendars should sync over HTTPS.
Click to expand...
Click to collapse
thank you so much :victory:
=========================================
HOW TO MAKE AND SIGN, A DRIVER AND CERTIFICATE: INTRO TO ENCRYPTION~!
=========================================
Today we are going to get our feet a little wet in Cryptography~!
Why would I need this?
For this Use Case, we will be discussing the NVIDIA SHIELD~!
PLEASE NOTE, THE TOPICS BEING DISCUSSED TODAY MAY BE ILLEGAL IN YOUR COUNTRY. PLEASE USE DISCRETION AND KNOW YOUR COUNTRY'S LAWS REGARDING CRYPTOGRAPHY BEFORE GOING FURTHER.... PEACE AND LOVE
Spoiler: OPENSSL WARNING
OPENSSL WARNING:
"Please remember that export/import and/or use of strong cryptography software, providing cryptography hooks,
or even just communicating technical details about cryptography software is illegal in some parts of the world. So
when you import this package to your country, re-distribute it from there or even just email technical suggestions
or even source patches to the authors or other people you are strongly advised to pay close attention to any laws
or regulations which apply to you. The authors of OpenSSL are not liable for any violations you make here. So be
careful, it is your responsibility."
Many Users on Windows 11 are reporting issues with Android Bootloader not installing and giving an Error Code 10.
Spoiler: LIKE THIS
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Error Code 10 is due to Nvidia's driver's digital certificate expiring. Crypto~!
Spoiler: SHOWN HERE
Spoiler: SOFTWARE DEVELOPMENT TOOLS
This is exclusively for beginners~! I don't care about your fancy IDE's Thank You~!
Intro to Cryptography By a Noob
Hello Friends~! I have built information trees, to teach you about these tools. I was originally going to package them all together, but in my efforts of doing so I realize that the process was getting too convoluted, when there is already an...
forum.xda-developers.com
The Bad Drivers From Nvidia:
Gameworks Download Center
Get the latest Gameworks software for your game development work.
developer.nvidia.com
Spoiler: MAKE A CERTIFICATE IN OPENSSL
GENERATING A PRIVATE AND PUBLIC KEY, AND A CSR
openssl genrsa -out shield.key 2048
openssl rsa -in shield.key -pubout -out shield_public.key
openssl req -new -key shield.key -out shield.csr
openssl x509 -in shield.csr -out shield.crt -req -signkey shield.key -days 365
Spoiler: BUILDING THE DRIVER
To be Continued~!
Spoiler: REFS
This article turned me on to the make cert tool
UWP - SignTool Error: No certificates were found that met all the given criteria
I'm getting this error after our company changed its AD domain. UWP app development with VS 2019 and Windows 10 (1903) C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Micr...
stackoverflow.com
MakeCert - Windows drivers
MakeCert (Makecert.exe) is a command-line CryptoAPI tool that creates an X.509 certificate that is signed by a system test root key or by another specified key.
docs.microsoft.com
Cryptographic Keylength Recomendation
Keylength - Cryptographic Key Length Recommendation
Certificate Stores - Windows drivers
Certificate Stores
docs.microsoft.com
System Store Locations - Win32 apps
A system store is a collection that consists of one or more physical sibling stores.
docs.microsoft.com
SignTool.exe (Sign Tool) - .NET Framework
Learn about SignTool.exe, the Sign Tool. This command-line tool digitally signs files, verifies signatures in files, and applies timestamps to files.
docs.microsoft.com
Using SignTool to Sign a File - Win32 apps
Explains how to use SignTool to sign a file.
docs.microsoft.com
COMMANDS FROM WINSDK LEARNED BUT NOT USED
Spoiler: MAKECERT COMMANDS
-sk <keyName> Subject's key container name; To be created if not present
-pe Mark generated private key as exportable
-ss <store> Subject's certificate store name that stores the output
certificate
-sr <location> Subject's certificate store location.
<CurrentUser|LocalMachine>. Default to 'CurrentUser'
-# <number> Serial Number from 1 to 2^31-1. Default to be unique
-$ <authority> The signing authority of the certificate
<individual|commercial>
-n <X509name> Certificate subject X500 name (eg: CN=Fred Dews)
-? Return a list of basic options
-! Return a list of extended options
Extended Options
-tbs <file> Certificate or CRL file to be signed
-sc <file> Subject's certificate file
-sv <pvkFile> Subject's PVK file; To be created if not present
-ic <file> Issuer's certificate file
-ik <keyName> Issuer's key container name
-iv <pvkFile> Issuer's PVK file
-is <store> Issuer's certificate store name.
-ir <location> Issuer's certificate store location
<CurrentUser|LocalMachine>. Default to 'CurrentUser'
-in <name> Issuer's certificate common name.(eg: Fred Dews)
-a <algorithm> The signature's digest algorithm.
<md5|sha1|sha256|sha384|sha512>. Default to 'sha1'
-ip <provider> Issuer's CryptoAPI provider's name
-iy <type> Issuer's CryptoAPI provider's type
-sp <provider> Subject's CryptoAPI provider's name
-sy <type> Subject's CryptoAPI provider's type
-iky <keytype> Issuer key type
<signature|exchange|<integer>>.
-sky <keytype> Subject key type
<signature|exchange|<integer>>.
-l <link> Link to the policy information (such as a URL)
-cy <certType> Certificate types
<end|authority>
-b <mm/dd/yyyy> Start of the validity period; default to now.
-m <number> The number of months for the cert validity period
-e <mm/dd/yyyy> End of validity period; defaults to 2039
-h <number> Max height of the tree below this cert
-len <number> Generated Key Length (Bits)
Default to '2048' for 'RSA' and '512' for 'DSS'
-r Create a self signed certificate
-nscp Include Netscape client auth extension
-crl Generate a CRL instead of a certificate
-eku <oid[<,oid>]> Comma separated enhanced key usage OIDs
-? Return a list of basic options
-! Return a list of extended options
Spoiler: SIGNTOOL COMMANDS
Typing Signtool brings up this
sign -- Sign files using an embedded signature.
timestamp -- Timestamp previously-signed files.
verify -- Verify embedded or catalog signatures.
catdb -- Modify a catalog database.
remove -- Remove embedded signature(s) or reduce the size of an
embedded signed file.
Spoiler: SIGN
Usage: signtool sign [options] <filename(s)>
Use the "sign" command to sign files using embedded signatures. Signing
protects a file from tampering, and allows users to verify the signer (you)
based on a signing certificate. The options below allow you to specify signing
parameters and to select the signing certificate you wish to use.
Certificate selection options:
/a Select the best signing cert automatically. SignTool will find all
valid certs that satisfy all specified conditions and select the
one that is valid for the longest. If this option is not present,
SignTool will expect to find only one valid signing cert.
/ac <file> Add an additional certificate, from <file>, to the signature block.
/c <name> Specify the Certificate Template Name (Microsoft extension) of the
signing cert.
/f <file> Specify the signing cert in a file. If this file is a PFX with
a password, the password may be supplied with the "/p" option.
If the file does not contain private keys, use the "/csp" and "/kc"
options to specify the CSP and container name of the private key.
/i <name> Specify the Issuer of the signing cert, or a substring.
/n <name> Specify the Subject Name of the signing cert, or a substring.
/p <pass.> Specify a password to use when opening the PFX file.
/r <name> Specify the Subject Name of a Root cert that the signing cert must
chain to.
/s <name> Specify the Store to open when searching for the cert. The default
is the "MY" Store.
/sm Open a Machine store instead of a User store.
/sha1 <h> Specify the SHA1 thumbprint of the signing cert.
/fd Specifies the file digest algorithm to use for creating file
signatures. If this parameter is not specified, an error will be
generated.
/u <usage> Specify the Enhanced Key Usage that must be present in the cert.
The parameter may be specified by OID or by string. The default
usage is "Code Signing" (1.3.6.1.5.5.7.3.3).
/uw Specify usage of "Windows System Component Verification"
(1.3.6.1.4.1.311.10.3.6).
/fdchw Generate a warning if the file digest algorithm and the hash algorithm
used in the signing certificate's signature are different.
Private Key selection options:
/csp <name> Specify the CSP containing the Private Key Container.
/kc <name> Specify the Key Container Name of the Private Key.
Signing parameter options:
/as Append this signature. If no primary signature is present, this
signature will be made the primary signature instead.
/d <desc.> Provide a description of the signed content.
/du <URL> Provide a URL with more information about the signed content.
/t <URL> Specify the timestamp server's URL. If this option is not present,
the signed file will not be timestamped. A warning is generated if
timestamping fails.
/tr <URL> Specifies the RFC 3161 timestamp server's URL. If this option
(or /t) is not specified, the signed file will not be timestamped.
A warning is generated if timestamping fails. This switch cannot
be used with the /t switch.
/tseal <URL> Specifies the RFC 3161 timestamp server's URL for timestamping a
sealed file.
/td <alg> Used with the /tr or /tseal switch to request a digest algorithm
used by the RFC 3161 timestamp server. This parameter
is required if the /tr or /tseal is specified.
/sa <OID> <value> Specify an OID and value to be included as an authenticated
attribute in the signature. The value will be encoded as an
ASN1 UTF8 string. This option may be given multiple times.
/seal Add a sealing signature if the file format supports it.
/itos Create a primary signature with the intent-to-seal attribute.
/force Continue to seal or sign in situations where the existing signature
or sealing signature needs to be removed to support sealing.
/nosealwarn Sealing-related warnings do not affect SignTool's return code.
/tdchw Generate a warning if the digest algorithm used by the RFC 3161
timestamp server and the hash algorithm used in the signing certificate's
signature are different.
Digest options:
/dg <path> Generates the to be signed digest and the unsigned PKCS7 files.
The output digest and PKCS7 files will be: <path>\<file>.dig and
<path>\<file>.p7u. To output an additional XML file, see /dxml.
/ds Signs the digest only. The input file should be the digest
generated by the /dg option. The output file will be:
<file>.signed.
/di <path> Creates the signature by ingesting the signed digest to the
unsigned PKCS7 file. The input signed digest and unsigned
PKCS7 files should be: <path>\<file>.dig.signed and
<path>\<file>.p7u.
/dxml When used with the /dg option, produces an XML file. The output
file will be: <path>\<file>.dig.xml.
/dlib <dll> Specifies the DLL implementing the AuthenticodeDigestSign or
AuthenticodeDigestSignEx function to sign the digest with. This
option is equivalent to using SignTool separately with the
/dg, /ds, and /di switches, except this option invokes all three
as one atomic operation.
/dmdf <file> When used with the /dlib option, passes the file's contents to
the AuthenticodeDigestSign or AuthenticodeDigestSignEx function
without modification.
PKCS7 options:
/p7 <path> Specifies that for each specified content file a PKCS7 file is
produced. The PKCS7 file will be named: <path>\<file>.p7
/p7co <OID> Specifies the <OID> that identifies the signed content.
/p7ce <Value> Defined values:
Embedded - Embeds the signed content in the PKCS7.
DetachedSignedData - Produces the signed data part of
a detached PKCS7.
Pkcs7DetachedSignedData - Produces a full detached PKCS7.
The default is 'Embedded'
Other options:
/ph Generate page hashes for executable files if supported.
/nph Suppress page hashes for executable files if supported.
The default is determined by the SIGNTOOL_PAGE_HASHES
environment variable and by the wintrust.dll version.
/rmc Specifies signing a PE file with the relaxed marker check semantic.
The flag is ignored for non-PE files. During verification, certain
authenticated sections of the signature will bypass invalid PE
markers check. This option should only be used after careful
consideration and reviewing the details of MSRC case MS12-024 to
ensure that no vulnerabilities are introduced.
/q No output on success and minimal output on failure. As always,
SignTool returns 0 on success, 1 on failure, and 2 on warning.
/v Print verbose success and status messages. This may also provide
slightly more information on error.
/debug Display additional debug information.
Spoiler: TIMESTAMP
Use the "timestamp" command to add a timestamp to a previously-signed file.
The "/t" option is required.
/q No output on success and minimal output on failure. As always,
SignTool returns 0 on success and 1 on failure.
/t <URL> Specify the timestamp server's URL.
/tr <URL> Specifies the RFC 3161 timestamp server's URL.
/tseal <URL> Specifies the RFC 3161 timestamp server's URL for timestamping a
sealed file. One of /t, /tr or /tseal is required.
/td <alg> Used with the /tr or /tseal switch to request a digest algorithm
used by the RFC 3161 timestamp server. If this parameter is not
specified, a warning will be generated. In future releases,
this parameter will be required if /tr or /tseal is specified
/tp <index> Timestamps the signature at <index>.
/p7 Timestamps PKCS7 files.
/force Remove any sealing signature that is present in order to timestamp.
/nosealwarn Warnings for removing a sealing signature do not affect SignTool's
return code.
/v Print verbose success and status messages. This may also provide
slightly more information on error.
/debug Display additional debug information.
Spoiler: VERIFY
Usage: signtool verify [options] <filename(s)>
Use the "verify" command to verify embedded or catalog signatures.
Verification determines if the signing certificate was issued by a trusted
party, whether that certificate has been revoked, and whether the certificate
is valid under a specific policy. Options allow you to specify requirements
that must be met and to specify how to find the catalog, if appropriate.
Catalogs are used by Microsoft and others to sign many files very efficiently.
Catalog options:
/a Automatically attempt to verify the file using all methods. First
search for a catalog using all catalog databases. If the file is
not signed in any catalog, attempt to verify the embedded
signature. When verifying files that may or may not be signed in a
catalog, such as Windows files and drivers, this option is the
easiest way to ensure that the signature is found.
/ad Find the catalog automatically using the default catalog database.
/as Find the catalog automatically using the system component (driver)
catalog database.
/ag <GUID> Find the catalog automatically in the specified catalog database.
Catalog databases are identified by GUID.
Example GUID: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}
/c <file> Specify the catalog file.
/o <ver> When verifying a file that is in a signed catalog, verify that the
file is valid for the specified platform.
Parameter format is: PlatformID:VerMajor.VerMinor.BuildNumber
/hash <SHA1 | SHA256> Optional hash algorithm to use when searching for
a file in a catalog.
SignTool uses the "Windows Driver" Verification Policy by default. The options
below allow you to use alternate Policies.
Verification Policy options:
/pa Use the "Default Authenticode" Verification Policy.
/pg <GUID> Specify the verification policy by GUID (also called ActionID).
Signature requirement options:
/ca <h> Verify that the file is signed with an intermediate CA cert with
the specified hash. This option may be specified multiple times;
one of the specified hashes must match.
/r <name> Specify the Subject Name of a Root cert that the signing cert must
chain to.
/sha1 <h> Verify that the signer certificate has the specified hash. This
option may be specified multiple times; one of the specified hashes
must match.
/tw Generate a Warning if the signature is not timestamped.
/u <usage> Generate a Warning if the specified Enhanced Key Usage is not
present in the cert. This option may be given multiple times.
Other options:
/all Verify all signatures in a file with multiple signatures.
/ds <index> Verify the signature at <index>.
/ms Use multiple verification semantics. This is the default behavior
of a Win8 WinVerifyTrust call.
/sl Verify sealing signatures for supported file types.
/p7 Verify PKCS7 files. No existing policies are used for p7 validation.
The signature is checked and a chain is built for the signing
certificate.
/bp Perform the verification with the Biometric mode signing policy.
/enclave Perform the verification with the enclave signing policy. This also
prints the Unique ID and Author ID information.
/kp Perform the verification with the kernel-mode driver signing policy.
/q No output on success and minimal output on failure. As always,
SignTool returns 0 on success, 1 on failure, and 2 on warning.
/ph Print and verify page hash values.
/d Print Description and Description URL.
/v Print verbose success and status messages. This may also provide
slightly more information on error. If you want to see information
about the signer, you should use this option.
/debug Display additional debug information.
/p7content <file> Provide p7 content file incase of detached signatures (signed using PKCS7DetachedSignedData).
Spoiler: CATDB
Usage: signtool catdb [options] <filename(s)>
Use the "catdb" command to add or remove catalog files to or from a catalog
database. Catalog databases are used for automatic lookup of catalog files,
and are identified by GUID.
Catalog Database options allow you to select which catalog database to operate
on. If you do not specify a catalog database, SignTool operates on the system
component (driver) database.
Catalog Database options:
/d Operate on the default catalog database instead of the system
component (driver) catalog database.
/g <GUID> Operate on the specified catalog database.
Other options specify what to do with the selected catalog database, and other
behavior. If you do not specify any other options, SignTool will add the
specified catalogs to the catalog database, replacing any existing catalog
which has the same name.
Other options:
/q No output on success and minimal output on failure. As always,
SignTool returns 0 on success and 1 on failure.
/r Remove the specified catalogs from the catalog database.
/u Automatically generate a unique name for the added catalogs. The
catalog files will be renamed if necessary to prevent name
conflicts with existing catalog files.
/v Print verbose success and status messages. This may also provide
slightly more information on error.
/debug Display additional debug information.
Spoiler: REMOVE
Usage: signtool remove [options] <filename(s)>
Use the "remove" command to remove the embedded signature(s) or sections of
the embedded signature on a PE/COFF file.
WARNING: This command will modify the file on the disk. Please create a backup
copy if you want to preserve the original file.
The option "/c" and/or "/u", or "/s" is required.
/c Remove all certificates, except for the signer certificate
from the signature.
/q No output on success and minimal output on failure. As always,
SignTool returns 0 on success and 1 on failure.
/s Remove the signature(s) entirely.
/u Remove the unauthenticated attributes from the signature
e.g. Dual signatures and timestamps.
/v Print verbose success and status messages. This may also provide
slightly more information on error.
This thread may explain why this is happening, AMD CPU and USB 3.0 unsupported on these old dang drivers
Fastboot problem on USB 3.0 ports
Hi guys, today I set up my notebook, to use in the future, MIUI flashing tool (No bootloader unlock in this machine, cause: ryzen CPU). After installing the drivers I restarted in fastboot mode and all ok..recognized device (Android bootloader...
forum.xda-developers.com
This is not complete and the code shown is placeholder. I am getting so deep in note taking I had to put up what I have so I can see it better and clearer~! I'll update when I am done and will post a video walkthrough. For Now... I need Sleep. Bah~! I hate having to sleep all the time.
jenneh said:
This is not complete and the code shown is placeholder. I am getting so deep in note taking I had to put up what I have so I can see it better and clearer~! I'll update when I am done and will post a video walkthrough. For Now... I need Sleep. Bah~! I hate having to sleep all the time.
Click to expand...
Click to collapse
What do you need to know?
persona78 said:
What do you need to know?
Click to expand...
Click to collapse
I'm trying to learn how to take a fresh USB driver ini file and build a cert for it with sha 256 hash just to learn how to run the algorithm while fixing the problem of the original ini file being expired. It's funny to think about some of this software we use, as having "shelf dates" almost. Haha. Like a food product or something organic. Interesting! Crypto~!
jenneh said:
I'm trying to learn how to take a fresh USB driver ini file and build a cert for it with sha 256 hash just to learn how to run the algorithm while fixing the problem of the original ini file being expired. It's funny to think about some of this software we use, as having "shelf dates" almost. Haha. Like a food product or something organic. Interesting! Crypto~!
Click to expand...
Click to collapse
I know how to create a certificate and sign a exe.
This helps?
persona78 said:
I know how to create a certificate and sign a exe.
This helps?
Click to expand...
Click to collapse
Yes!!
Hi!
@jenneh this are the batch tools i create: Tools
1-Extract to Desktop
2-Create your cert.pfx and paste inside Sign_Batch folder
3-paste the app you want in to sign inside Sign_Batch folder to
4-Pick and drop the app over the appsign_soft.bat
5-Right click over app and check Digital signature
6-Select the signature and go to details
7-Check your certificate
8-Install your certificate, like this system will know that is safe
9-Done!
Your app is now signed with your certificate!
Spoiler: Print Screens
persona78 said:
Hi!
@jenneh this are the batch tools i create: Tools
1-Extract to Desktop
2-Create your cert.pfx and paste inside Sign_Batch folder
3-paste the app you want in to sign inside Sign_Batch folder to
4-Pick and drop the app over the appsign_soft.bat
5-Right click over app and check Digital signature
6-Select the signature and go to details
7-Check your certificate
8-Install your certificate, like this system will know that is safe
9-Done!
Your app is now signed with your certificate!
Spoiler: Print Screens
View attachment 5544459
View attachment 5544463
Click to expand...
Click to collapse
You are like An Angel from Binary Heaven. I just Woke Up and was refreshing my memory on this~! I will check out your tools now and update my thread when I fully understand and properly credit you for your hard work. I really thank you So So much :> Your efforts will help Many~!
I only started this train of thought yesterday so bare with me, this is all new to me~!
jenneh said:
You are like An Angel from Binary Heaven. I just Woke Up and was refreshing my memory on this~! I will check out your tools now and update my thread when I fully understand and properly credit you for your hard work. I really thank you So So much :> Your efforts will help Many~!
I only started this train of thought yesterday so bare with me, this is all new to me~!
Click to expand...
Click to collapse
I hope it helps you!
persona78 said:
I hope it helps you!
Click to expand...
Click to collapse
OMG. I'm going through your work now... I got goosebumps. THANK YOU. I just need to get my coffee and some music going and Ima figure out how to explain all this in a video when I chain it together. haha
Oh and I want to tell the other WSA enthusiasts out there~! I see now how to chain this information over to WSA, specifically the MSIX bundle, decompiling it and adding rooted system images. I have seen where others on this forum have done the same thing, or come to the same conclusion but want to be secretive about their methods.
But WHy?~~! Haha~! That Tis Only the Soft Root as I am coining it. Explaining the modding of the msix file in order to gain root will be my next project on windows when this is complete. I would like to think... the stock root... would be a valuable resource that could be reported somewhere... But who knows?~! HMM
The letter of the day today is O, for OPEN SSL
/docs/man3.0/man7/crypto.html
www.openssl.org
Could not repeat the error. Tested using Virtual win11available here. Previous version though.
https://developer.microsoft.com/en-us/windows/downloads/virtual-machines/
Faked my LG to show as Nvidia...
CXZa said:
Could not repeat the error. Tested using Virtual win11available here. Previous version though.
https://developer.microsoft.com/en-us/windows/downloads/virtual-machines/
Faked my LG to show as Nvidia...
View attachment 5544673
Click to expand...
Click to collapse
The purpose of this article is to learn something about this obstacle, since Nvidia has not updated the drivers since 2018.
Which we are learning LOTS.
Not whether or not it is broke for all Users.
It's about engineering a fix for said problem.
Since I cannot easily edit the .inf Due to it's encryption.
jenneh said:
Nvidia Drivers, not an issue with Windows 11.
Click to expand...
Click to collapse
I was interested as it has been said that in future there are
more strick rules for drivers and such.
But this driver is ok. Installed properly and worked ok.
Or maybe the rules have changed in the later win versions.??
Try to restart your device. Maybe both of them...
CXZa said:
I was interested as it has been said that in future there are
more strick rules for drivers and such.
But this driver is ok. Installed properly and worked ok.
Try to restart your device. Maybe both of them...
Click to expand...
Click to collapse
Sorry that came off robotic, I THANK YOU For testing. Out of curiosity are you using amd or intel processor?
jenneh said:
Sorry that came off robotic, I THANK YOU For testing. Out of curiosity are you using amd or intel processor?
Click to expand...
Click to collapse
Intel...
Which win11 version you are using? Maybe the rules have changed like I said in previous post (added it after you quoted)
CXZa said:
Intel...
Which win11 version you are using? Maybe the rules have changed like I said in previous post (added it after you quoted)
Click to expand...
Click to collapse
I am on the latest version. Running AMD. I have uninstalled and reinstalled Many Times. I have used both Microsofts Factory isos, tried every iteration since preview, built my own modded ISOs ETC.
I have case Evidenced This problem for months and many of my viewers Have reported the Same Issue.
So what you are not understanding is, there are some of us who see a problem, regardless of the Root Cause,
We want a fix~! Your solutions have already been tried. So thank you, but this is an article regarding KNOWLEDGE
The shield is only a metaphor~! It is as said in the beginning just the Use Case. For the Lesson. This is a Live lesson.
Thank you.
Okay, have fun...
CXZa said:
Okay, have fun...
Click to expand...
Click to collapse
Oh I Am <3
So an Update~! I had theorized that I could just copy the contents of the .inf file, paste them into a new text document, rename it to android_usb.inf, then paste the rest of nvidia's original dlls etc, but Nope~! Apparently you have to modify the cat files and well every thing~! So another day of research it is!! Here's a nifty signing tool ;-)
ksign (Install) 2016.07.20.20170105
Free GUI and command line tool for software and installer signing
community.chocolatey.org