unpin3

Android Unpin #3

Play Apps: Defeat Pinned Session Completely

Google Bug # Android-20632894

Background

After accidental discovery of Unpin Trick #1 (patched in 5.1), defeating Android's "App Pinning" has become a little game of mine. Here is the second of two freshly-discovered ways to circumvent the pinning feature. We'll just keep defeating it till it's rock-solid: That's how we do.

While Unpin #2 only navigates out of the pin "jail", this one breaks it entirely and returns one to a normal user session under full control.

It is evident that this should not happen, because inter-user navigation without the trick immediately locks the screen (smart). But somehow, this navigation trick breaks that handling. That's the bug.

Test device: Nexus 4, Android 5.1

Software: Stock system images, not rooted. Google Now launcher, no alternate lockers. Stock everything.

Note: This unpin requires at least two accounts "on the device" - it seems possible to work around that, but I don't do so here.

Start from an ordinary unpinned session.

I have demonstrated Play Books here, but suspect that any of the "Play" suite are susceptible, as with Unpins 1 and 2.

Open Play Books and pin it.

Answer the Pin confirmation screen.

"Screen Pinned" is shown here for validation.

Pay no attention to the overdose of geek in this screen shot.

Access "Help & Feedback" via the side panel. I suspect any other means will also suffice.

Interesting note: Unpins 1 and 2 were also both accessed via Help.

You are in the help browser. Pull-down the actions menu and select "Print..."

From the print preview, pull-down the printer selector, and choose "All printers..."

In the upper-right, tap "Add printer"

While (ostensibly) adding a printer, choose "Cloud Print"

This looks like a dead-end, but it's got an awesome twist: A slide-out panel on the left with user context switching!

Pull the left panel out with a swipe or tap...

With the left panel open, select any other account. Nothing apparent will change.

Now press back several times, repeatedly, until you are back at the pinned Books screen.

When you are back in Books, pull-out the side panel again...

...and pull-down the accounts selector. Select the same account you used in step 10.

And get this very strange result: The alternate account's play library (it has no books), and a notice about your pinned session!

Slide-out the left panel, and switch back to the original "pinned" user...

...and find yourself back in their library!

But - I wonder why it didn't mention that thing about pinning?

That's, um, "interesting".

Tap the "Home" button.

Or any other button. Because you are no longer pinned!

Fly away, be free! ;)

Additional Notes

Pizza donations graciously accepted.

Coming soon...

Bypass Swipe-Codes From Front Screen (!)
Temporarily Brick Device, With No Special Perms

Page updated

Google Sites

Report abuse