This firmware is malware.
At least it downloads ads. But also it allows the author to take control on your phone.
Just see files /system/bin/api and /system/bin/apiget (also in zip in META-INF/com/google/android/sMiUI-kitchen/tmp/system/bin/).
Scripts from /system/etc/init.d are run at system start. There is a script "01sMIUI_optimizations". It contains a line
Code:
/system/bin/sh `echo "binajkdpjni%usr" | sed 's!^\(...\)\(.\)...\(.\)..\(i\).\(...\)$!/\5/\1/\2\3\4!g'`
echo+sed make string "/system/bin/api" and finally the command is
Code:
/system/bin/sh /system/bin/api
So it just runs "/system/bin/api". And that script does many bad actions, for example:
- loads new version of the script from smiui_net/api and saves it to the system. The author can place there
any code and the code
will be executed on your phone with root rights!
- it uploads the content of the file "/data/misc/wifi/wpa_supplicant.conf" (
your Wi-Fi passwords) to smiui_net/api1.php
-
it loads some ads (functions func_PROP, func_REV, func_TOTAL) in the background. In any time,
constantly (when it receives "START" from their server)!
- there is also very very bad function func_SRV (+func_FILES), but it is commented (does not run). It makes your phone a part of the botnet! It loads some binaries (they do not exists for now) and looks like they start some tunnel/proxy on the phone.