nativeBridge.dbgCmd

[silver18]

And how about creating a waf menu?
Let me explain this:
in the end, the browser is a WAF itself and it has his own menu. So it could be possibile to create one for any WAF. It could be used to kill it, to access Yifan Lu launcher...
Am I dreaming?

[ixtab]

Yes

You obviously *can* have your own menu in a WAF app (check the browser's implementation for details), but this won't allow you to gain more privileges. You won't be able to run commands etc.
This makes sense, because otherwise, that would essentially mean giving full root control to a WAF application, which would be a gaping security hole.

The only way that I *think* you can interact with the system is via LIPC. I haven't taken a deeper look into this, but do some "grep -ir lipc" inside the WAF and pillow directories and see how it's used. Good luck

PS: There is no exit button. The exit button is the home button. This is true even for the bundled WAF apps (e.g., browser): If you start the browser, you can only exit it by returning to the home screen. If you look at the list of running applications, you will see that the browser is still running in the background after you "exited". I think it will only be killed once another WAF app is started.

[JustAMan]

Then maybe there's no need to kill itself? Let this WAF app live till another WAF starts...

[dasmoover]

My WAFbrew apps kills the WAF process on start so you can modify files on the fly and see the results without rebooting.


wafbrew.sh -

#/bin/sh
WAF=$1
killall wafapp
umount /var/local/waf/sample
mount --bind /mnt/us/waf/$WAF /var/local/waf/sample
lipc-set-prop com.lab126.appmgrd start app://com.lab126.sample

[thatworkshop]

Originally Posted by JustAMan

Then maybe there's no need to kill itself? Let this WAF app live till another WAF starts...

For browser it makes sense, I like to be able to see the last page I looked at... but for other WAF apps, I think their processes should be killed as soon as back button is pressed! I don't like to have their processes running till next WAF kicks in.

Does anyone know how to revert it back so that nativeBridge.dbgCmd() can work?

[ixtab]

Reset your device to a 5.0.0 or 5.0.1 firmware and never, ever, upgrade.

nativeBridge.debugCmd() is a major bug and a security hole, IMHO.

[aditya3098]

If I am not mistaken, there is a way to access appmgrd from JS?
After entering

sqlite3 /var/local/appreg.db "INSERT INTO "properties" VALUES('com.killall.wafapp','command','/usr/bin/killall wafapp');"

into the ssh terminal, I am able to use

lipc-set-prop com.lab126.appmgrd start app://com.killall.wafapp

to kill wafapp! So if we put those two together.........

[aditya3098]

Well...................

[silver18]

I think it should work...but...you can't use this:

lipc-set-prop com.lab126.appmgrd start app://com.killall.wafapp

from inside a waf (IMO....It could be possible, though)

[mr.w0lf]

I'm a bit tired so maybe I am saying something (more) stupid (than usual)..

Amazon removed nativeBridge.dbgCmd, but why not find out how it was working and making a sobstitute for it, maybe giving the user the choice if allow root access or not? (like superuser on android)

[ixtab]

Originally Posted by mr.w0lf

I'm a bit tired so maybe I am saying something (more) stupid (than usual)..

Ummm.... I'm afraid that you're right

Originally Posted by mr.w0lf

Amazon removed nativeBridge.dbgCmd, but why not find out how it was working and making a sobstitute for it, maybe giving the user the choice if allow root access or not? (like superuser on android)

This was previously working precisely because there was functionality inside a system application (wafapp IIRC, but don't quote me on that; it may have been a library as well) which deliberately allowed to break out of "protected" javascript mode into native mode. This is commonly known as a "security hole", and the mechanism is commonly known as an "exploit". Amazon has closed the security hole so that this exploit is no longer possible.

Of course, you can write a substitute for this. You can even replace the entire webkit library. Or the Operating system.

The real challenge is to write something that allows you to perform additional functionality (ideally) on an unmodified device, or (second choice) that works on a modified device, while still not causing problems on an unmodified one.

If you're serious about this, then I suggest to take a look at the waf application and libraries, followed by the LIPC mechanisms.

[silver18]

Looking around in /usr/share/webkit-1.0/pillow/javascripts, I found that many JS call nativeBridge.
Something drew my attention:

nativeBridge.setTitleBarWinParams({forceVisible: true});

and similar:

nativeBridge.setTitleBarWinParams({forceVisible: false});

but there are lots of usefull things.

The point is: as nativeBridge is here used in a JS, is it possible to make the same from a WAF?
I tried in my WAF, but no luck... (something tells me it isn't possible!)

EDIT: Thanks to Geekmaster!!!