EngmodeExtension is an undocumented object that can be found in navigator.engmodeExtension, navigator.jrdExtension, navigator.kaiosExtension. Primarily used for remote code execution via its startUniversalCommand() method. This object is used throughout KaiOS apps, most notably used in Wallace Toolbox to do various tasks.
This object is exposed in all web contexts with some methods being disabled. The setPropertyValue() method can be used to set the adb tcp port via any website accessed in the browser.
Because of this vulnerability, EngmodeExtension has been historically used to gain root priviledges via the browser alone. This vulnerability has been patched in newer KaiOS versions, however some methods are still allowed by the browser.
{
"type": "certified",
"permissions": {
"engmode-extension": {
"description": "Handle KaiOS 2.5.1+ devices"
},
"kaiosextension": {
"description": "Handle KaiOS 2.5 devices"
},
"jrdextension": {
"description": "Handle KaiOS 1.0 devices by TCL"
}
}
}
/**
* @private
*/
interface EngmodeExtension {
startUniversalCommand(
command: string,
unknownBoolean: boolean
): DOMRequest<"process-finished">;
setCameraLed(led: 0 | 1): void;
getPropertyValue(property: string): string;
setPropertyValue(property: string, value: string): "true";
getPrefValue<T extends string>(pref: string, returnValue: T): T | string;
setPrefValue(pref: string, value: string): void;
}
interface Navigator {
readonly engmodeExtension: EngmodeExtension;
readonly jrdExtension: EngmodeExtension;
readonly kaiosExtension: EngmodeExtension;
}
EngmodeExtension.getPrefValue(pref, returnValue)
pref The name of the preference to retrievereturnValue The value returned when the pref is not found or the pref is not a string prefEngmodeExtension.setPrefValue(pref, value)
pref The name of the preference to setvalue The value of the preference to setEngmodeExtension.setPropertyValue(property, value)
setprop command)
property The name of the property to setvalue The value of the property to setEngmodeExtension.getPropertyValue(property)
getprop command)
property The name of the property to retrieveEngmodeExtension.setCameraLed(led)
led a number, 0 turns off the led and 1 turns on the ledEngmodeExtension.startUniversalCommand(command, unknownBoolean)
DOMRequest with result "process-finished", the DOMRequest will always succeed even if the command would trigger an error
command Command to rununknownBoolean this should always be set to true, if not the DOMRequest will never resolve.EngmodeExtension.getSysInfo()
EngmodeExtension.run()
EngmodeExtension.stop()
EngmodeExtension.startAudioLoopTest()
EngmodeExtension.stopAudioLoopTest()
EngmodeExtension.startForceInCall()
EngmodeExtension.stopForceInCall()
EngmodeExtension.startUniversalCommandPre()
EngmodeExtension.stopUniversalCommand()
EngmodeExtension.startGpsTest()
EngmodeExtension.stopGpsTest()
EngmodeExtension.readNvitem()
EngmodeExtension.writeNvitem()
EngmodeExtension.readNvitemRoot()
EngmodeExtension.readNvitemEx()
EngmodeExtension.writeNvitemEx()
EngmodeExtension.eraseAPN()
EngmodeExtension.setDirProp()
EngmodeExtension.setDataProfileByType()
EngmodeExtension.setInitAttachProfile()
EngmodeExtension.getFilesLastTime()
EngmodeExtension.checkIsFileExist()
EngmodeExtension.checkIsCommandRunning()
EngmodeExtension.setChargerLed()
EngmodeExtension.setSubLCD()
EngmodeExtension.setKeypadLED()
EngmodeExtension.setChargingEnabled()
EngmodeExtension.setDbClickUnlock()
EngmodeExtension.fileReadLE()
EngmodeExtension.readJson()
EngmodeExtension.fileWriteLE()
EngmodeExtension.createFileLE()
EngmodeExtension.readRoValue()
EngmodeExtension.getFlipState()
EngmodeExtension.setPropertyLE()
EngmodeExtension.execCmdLE()
EngmodeExtension.setKAIOSLogPara()
EngmodeExtension.getOemfuseStatus()
Restart the KaiOS device. Taken from AppBuster.
var masterExt = navigator.engmodeExtension || navigator.kaiosExtension || navigator.jrdExtension;
if (window.confirm('Reboot phone to apply?')) {
masterExt.setPropertyValue('sys.powerctl', 'reboot');
}