SMS spam filter [ezx_sms.cfg (Regarding SMS Messages)]

[mudassar]

Hello ppl,
just wondering if someone can provide me feedback on files of type .cfg.

These files are located in folder "/ezxlocal/download/appwrite/setup"

i created a small c++ binary that tells me a notification if some event happens in the directory, for e.g a file is changed, file is modified, file is created etc etc. Now i have found out after *alot* of trial and error that as soon as sms is received this is the directory that gets SMS notification. cos my events tells me as soon as SMS is received and i am monitoring this particular directory only..

Getting little technical on events notification, i am using DNOTIFY cos apparently these phones are on 2.4 kernel that doesnt support INOTIFY so i cant be notified of an exact file that is changed but only a directory notification. so i am trying to figure out which file it could be.. Most probably "ezx_sms.cfg" gets some event or *root.mdf* !!! that i dont know for sure.. i want to know how these .cfg files work ?

so the real question is: can anyone tell me how these .cfg files get notified or are used in the system ??
if anyone can provide me some feedback that be good.. for those who are confused what i am doing.. i am only trying to intercept an incomming sms msg...dont ask y ! lol

only for now i am sure that directory gets some events... cos i can detect it..

-MAQ

[yantz]

those are config files that are changed when you change settings eg, in setup menu, or network menu etc. eg when you change wallpaper in setup -> wallpaper, ezx_theme.cfg got changed. if you change setup -> input setting, ezx_system.cfg got change etc

[rhizod]

If you know which application it is that pokes around, you can use strace to find out what files it accesses. On the phone, just do
strace -p <pid> -f -s 500
where <pid> is the pid of the application you wish to monitor. You will see a huge list of system messages (if it is too much, dump it to a file by adding something like '> /mmc/mmca1/dump.txt 2>&1' to the above).

Look for 'stat' or 'open' syscalls in the dump. Good luck.

[mudassar]

thanks yantz and rhizod,

@yantz:
yeah i am thinking the same way. as soon as something changes in the system those files are changed. but is .cfg associated with QT graphics or something ? consider this in the file ezx_sms.cfg

[Mobeelife]
MMS_Connection_Profile = Mobeelife
MMS_Connection_Type =
MMS_PortNum = 9201
MMS_PortNum2 = 0
MMS_Secure_Connection_Type =
MMS_Server_Address = http://mms.mobeelife.net/mms/wapenc
MMS_WAP_Gateway = 88975552
MMS_WAP_Gateway2 = 0

lets assume this file gets triggered and it tells the system that this profile has to be used or was being used.. and all the settings associated with it... well in that case probably the port no can be useful cos we may be able to intercept or listen at that port.. but i think .cfg can not be anymore useful. i thought prolly i can c the data in the sms message.. i am still tryin to figure out...

@rhizod:
man are u sure strace works for u.. cos i was using it and it says strace not found. also, r u saying that if i put the pid of my c++ program that is monitoring the file .. it will tell me which file got the event or got changed... or do i have to use the pid of the program that invoked the event when sms receieved.. cos ofcourse that pid is of the native kernel code... ryt ? but yeh i can definately check my programs pid.. but does the command work for u ?

thanks guys,
-MAQ

[rhizod]

man are u sure strace works for u.. cos i was using it and it says strace not found.

Oh, you have to compile it with your own toolchain, or download it here:
http://www.pashkovsky.com/e680/
[link named: Lots of utils (nano,top,nc etc +libs)]
I was able to just take the strace binary from that archive, upload it to my E680i and run it from the directory I uploaded it to, like this: ./strace

also, r u saying that if i put the pid of my c++ program that is monitoring the file .. it will tell me which file got the event or got changed... or do i have to use the pid of the program that invoked the event when sms receieved.. cos ofcourse that pid is of the native kernel code... ryt ?

*Not* the pid of your program. The pid of the process that "invokes the event". I would belive *some* userspace process receive the text of the SMS and choses what to do with it. My guesses would be either the 'am' process (takes care of the basic UI) or the tapi process. But it could be any of the other native processes I guess.

[mudassar]

oh ok thanks !!
yeah i guess u r right. either the *am* or the *tapi* process receives it.. there is also an sms folder inside tapi that remains always empty even if sms is received..... !!!

anyhow, any idea how to get *tapi* pid ?

thanks
-MAQ

[rhizod]

anyhow, any idea how to get *tapi* pid ?

Oh, that is easy, 'ps' is already on the phone (no download nessecary). Run the following in telnet, all on one row:

COLUMNS=300 ps aux

and check for the line that ends with '/tapi' or '/am'
(tapi I think is for "telephone api")

[mudassar]

very well..!
yes i can get the pid()'s. i will get the tool chain and try strace to c which file gets modified. anyhow there is a new observation and u may have clue's there too..

i can get notification on /dev folder also. that means probably through some device drivers the message could be read ? but the thing is there are too many devices drivers there... i am going to try /dev/port and /dev/mem probably...

i think by just normally opening the device and capturing the FileDescriptor i can read through the device right ? any clue to which devices seem more closer to this SMS/Email feature.. ?

thanks,
-MAQ

[rhizod]

Ok; my hints above was just a reply to your question "how do I find out which files are accessed upon SMS delivery".

For your quesiton on how to intercept an SMS message, I don't think you will have much luck trying to read it directly from a device in /dev. The reason you see /dev access during SMS delivery may very well just be because of the notification sound playing...

But I think you have two options that *might* work:
1) put a notify on the phone:s internal SMS database (something native.db I think). Each time that file is written to, read it and check for new SMS messages.

2) Check with strace as I suggested above if strace actually is able to intercept the SMS message. It is not unlikely that you actually see the SMS text in the reports dumped by strace if you listen to the right process. Then write your own strace-like program that picks out these messages and does what it is you want to do with them.

[mudassar]

Awesome rhizod !!
i knew u'd point me to the right direction.. i might just be able to crack it down.. ok considering ur first step of reading native.db is absolutely correct. i do get notification there and i have read that native.db is where all the contacts, sms and addresses etc is stored...so i wrote a small code to read that file but for now it doesnt seem to be reading the right content.. prolly i am readin wrong.. here is the code:

void read_mem_linux()
{
int mem_fd, ret;
char var_char[4];
char *charp;
char buffer[128];

if((mem_fd = open("/ezxlocal/sysDatabase/native.db",O_RDONLY)) < 0){
printf("\n\nProblem in opening /ezxlocal..");
exit(-1);
}

ret = 1;
//charp = (char *)malloc(sizeof(char) * 256 * 256);
//printf("Memory assigned.\n.");
int counter = 1;
while(ret != 0 && ++counter<=5){
ret = read(mem_fd, buffer,12;
printf("\nret:%d buffer: %s",ret,buffer);
}
}

the output i get is

ret:128 buffer: "triangle shaped object facing down"
ret:128 buffer:
ret:128 buffer:
ret:128 buffer:

is there anything wrong in my code ? i can open the file fine but cant read properly.. ?

thanks,
-MAQ