Step-by-step: Bypass Java security on Rogers LG Shine (TU720)

[aah_tree]

i dont think what they do is debrand it, what they do is to replace some files of the tu720 to the shine.

[sensesfusion]

change roger.pol doesn't work me......i still can not install google maps...

The newest google maps doesn't work for me as well.

[z22styles]

me either, is there an older version we can download?

[hybrid77]

I wasnt able to at first either. Rather, it would let me download, but not run google maps.

Instead, I downloaded google maps from http://www.getjar.com/products/3388/GoogleMapsformobile and it worked fine. Don't know if its the most recent version or not, but does it really matter?

Good Luck

[Dark Mirage]

Ok, I've found the Telus version of the file under :Brew/ams in the file system. I corrected the _policy.txt file to look like this:

domain: CN=TELUS Mobility Trusted Third Party Domain Root,O=TELE-MOBILE COMPANY,OU=TELUS Mobility,L=Toronto,ST=Ontario,C=CA
oneshot(oneshot): phone_call
oneshot(oneshot): messaging
blanket(oneshot): read_user_data
blanket(oneshot): write_user_data
blanket(session): application_auto_invocation
blanket(session): multimedia_recording
blanket(session): system_information
blanket(session): location
blanket(session): net_access
blanket(session): local_connectivity

domain: untrusted
oneshot(oneshot): phone_call
oneshot(oneshot): messaging
blanket(oneshot): read_user_data
blanket(oneshot): write_user_data
blanket(session): application_auto_invocation
blanket(session): multimedia_recording
blanket(session): system_information
blanket(session): location
blanket(session): net_access
blanket(session): local_connectivity

Basically I copied everything under the first header and copied under the domain:untrusted header. Is that the correct way to do it? Because I'm still unable to download Opera Mini off the web browser.

[k20z3_si]

I tried to re download Google Maps today and they seem to have fixed the HTTP prompt problem (or maybe it was where I went to download it: www.google.com/gmm). The new version now has a "Allow Per Session" option. Now to see it GMail will work, it freezes my CU720!

[Bpenney]

hey just wondering when u copy everything from domain: """C=CA;O=Rogers Wireless;CN=Rogers""" and put in under ""domain untrusted"".. does that include u copy the header as well like the ("""C=CA;O=Rogers Wireless;CN=Rogers Wireless Test Root CA""") and patse it or just everything under it, and whats a good way to figure out if this worked..

sorry for my English...

[k20z3_si]

I don't know if any US AT&T owners are still looking for how to do the Java security bypass, but I figured out how to do it. Just follow the steps in the first post but instead of deleting everything under the "untrusted" header and replacing it with everything copied from the section "domain: C=CA;O=Rogers Wireless;CN=Rogers Wireless Test Root CA", just replace the stuff under the "untrusted" header with this:

domain: untrusted
allow: packet_data_access_http_https
allow: comm_connectivity_options
oneshot: local_connectivity
oneshot: low_level_packet_data_access_2

[rookie88]

sorry if this question has been asked but looks like my LG shine is one of those SOL where the Java "Install" option was disabled by the service provider.

Would the "install" option reappear after the security policy file is removed?

I really want to try out http://www.getjar.com/products/14533/Sudoku

Cheers
RR

[Toofurroucious]

Okay I am a new howard forum user, excuse me if I make any mistakes...

Okay I have done the part where I have to change the domain and etc. Now where it says to add games.... where can I find games on the computer? and another question is when I find a game how do I save it as in, in what format? and then how do i save it under bitpim in my phone???? do I overwrite some file if so how? do i delete existing games???
I don't know
HELPPP!!!!

Please reply... Thank You

[Toofurroucious]

I made an earlier post with instructions for adding custom ringtones to the LG Shine from Rogers. This post uses the same method to bypass the Java security restrictions imposed on the phone which require the user to accept every request for data communication, for all but Rogers signed applications.

What kind of apps could benefit from this? Gmail mobile, Google Maps, Opera mobile browser, etc.

* disclaimer: this works for me but I can't guarantee it won't turn you phone into a pretty looking brick *

OK, here's the procedure. The first few points are the same as for ringtones.

Requirements:

• Latest BitPim software from www.bitpim.org (tested with 1.0.2)
• LG phone tools software (provided in box)
• USB cable (provided in box)

Instructions:

1. Install software listed above
2. Hook up phone
3. Launch BitPim
4. BitPim should show "Other CDMA phone on COMx" (where x is the COM port being used)
5. Choose Edit, Settings
6. Change Phone Type to "LG-VX8700" (this is the CDMA version Shine)
7. Click OK to close
8. Choose View, View Filesystem
9. Click the Filesystem icon
10. Click the expand button beside "/"
11. It will say "Retrieving" for a minute or two
12. Expand to the following directory: /LGAPP/Media/Java/cert
13. Right-click on the file "rogers.pol" and select "Save ...", then save it to a location on your computer
14. MAKE A BACKUP COPY OF THE ORIGINAL FILE (just in case!)
15. Open the file with WordPad or another editor (Notepad does not display it correctly, not recommended)
16. You will notice the file is in sections. Go to the end of the file to the section headed by "domain: untrusted"
17. Delete everything under that header (but leave the header alone), and replace it with everything copied from the section "domain: C=CA;O=Rogers Wireless;CN=Rogers Wireless Test Root CA"
18. Save your changes (you did make a backup, right?)
19. Back in BitPim, right-click on the "cert" folder and select "New File ..."
20. Select the new "rogers.pol" file you modified, and overwrite the existing file
21. Disconnect and reboot the phone, you're all set to go!

A few more things you might be interested in:

• You will need to re-install existing applications. The security seems to be set at install time, so whatever apps you have installed you should remove and re-install.
• Proof that Rogers is evil - look at the cingular.pol file. It allows for application signed by any trusted source. The rogers.pol file only allows for apps signed by Rogers. This goes well beyond just wanting to protect the customer from bad applications!
• This edit makes the phone completely trust any java application, so make sure you know what you're installing before you install it!

Enjoy!

okay i get it to where it says

"[*]Back in BitPim, right-click on the "cert" folder and select "New File ...""

now I am lost on the next step where it now says
[*]Select the new "rogers.pol" file you modified, and overwrite the existing file[*]Disconnect and reboot the phone, you're all set to go!

which step am I do am I doing? Putting the new rogers.pol file as a new file or am I overwriting the existing rogers.pol file with the new one???

help me please I've been trying to figure this out for two days and its BUGGING ME that I can't

and then I need to know how can I actually get the game in the phone using bitpim.
Do I actually replace one of the old games under cert (cause I read somewhere I have to replace) or do I put it in as a new game? which ever way HOW????????
I AM SO LOST!
and then I read somewhere it said (find .jad files for your .jar files) how do I do that I downloaded the software jadmaker.com but for somereason it saved as a jadmaker.zip?????
I don't know what I am doing
HELP ME PLEASE!!!!!!!!!!
THANK YOU!!!!!!!! in advance!

[Toofurroucious]

i think i turned my phone into a brick!!!
HELP!

[DearJoey]

Does anyone know how you can tell if your Java Security has been by-passed or something?

Cause Ive done the same thing, followed every instruction. Its not a brick, its like totally fine. It seems as if nothing has changed.

So does anyone know how you can tell On the phone if it has passes Java Security?

Thanks in Advance.

[wcr]

Has Rogers changed their Java Security or something? I was just looking at the Rogers website and from what I can tell one can download something like Google Maps without having to bypass their java security. They just state that this app is not a rogers certified app and will incur extra data charges as someone uses it.

Has this always been this case and bypassing java security just sidesteps the extra data charges? They list several apps like Opera Mini, Mobile Firefox, Mobile Checkbook, Mobile Bartender etc etc that can be downloaded but are outside their unlimited browsing plan and just cost extra.

Can anyone clarify if its even worth by-passing Java for any reason other then downloading java games?

[windsorsean]

Has Rogers changed their Java Security or something? I was just looking at the Rogers website and from what I can tell one can download something like Google Maps without having to bypass their java security. They just state that this app is not a rogers certified app and will incur extra data charges as someone uses it.

Has this always been this case and bypassing java security just sidesteps the extra data charges? They list several apps like Opera Mini, Mobile Firefox, Mobile Checkbook, Mobile Bartender etc etc that can be downloaded but are outside their unlimited browsing plan and just cost extra.

Can anyone clarify if its even worth by-passing Java for any reason other then downloading java games?

I haven't posted here in a while, but the primary reason is that Rogers severly disables the usefulness of non-Rogers java apps by putting them in a restricted security zone when they are installed. So it prompts every time you launch it to allow data access. By bypassing security restrictions it allows you to launch the app without the annoying prompt every time. It has no impact on data charges.

Other vendors will at least allow applications signed by a trusted authority to be given higher permissions but Rogers puts the restrictrion on all apps not signed with the Rogers certificate.