Verizon MMS protocol issue (voice note/video not playing)

jumptoheaven · May 28, 2026, 5:13pm

Requests.txt

MMS DOWNLOAD REQUESTS — captured via strace on com.android.phone
Captured: 2026-05-28
Device: F21 Pro
Source: /storage/emulated/0/Download/mms-capture-20260528-124948/phone.strace
Transport: PLAIN HTTP (no TLS, no encryption)

====================================================================

TRANSACTION 1

Time: 12:58:08.835712 EDT
MMSC: 63.59.107.146:80 (Verizon)

-– REQUEST (exact bytes on wire) —
POST /servlets/mms HTTP/1.1
Accept: /, application/vnd.wap.mms-message, application/vnd.wap.sic
Accept-Language: en-US
User-Agent: Android-Mms/2.0
x-wap-profile: http://uaprof.sonymobile.com/H8296R5111.xml
Content-Type: application/vnd.wap.mms-message
Content-Length: 30247
Host: mms.vtext.com
Connection: Keep-Alive
Accept-Encoding: gzip

-– RESPONSE —
HTTP/1.1 200 OK
Server: Apache
Content-Type: application/vnd.wap.mms-message
Date: Thu, 28 May 2026 16:58:09 GMT
Connection: Keep-Alive
Content-Length: 46

MMS PDU headers (decoded):

====================================================================

WHAT VERIZON SEES ON EVERY MMS DOWNLOAD

Your phone number (MDN) in two plaintext headers:
x-up-calling-line-id:
X-VzW-MDN:
Your device model in User-Agent and Profile URL.
Verizon stores the full MMS before your phone fetches it.
No encryption at any layer — plaintext HTTP end to end.

Switching SMS apps does NOT help (all use the same AOSP MmsService).
Use Signal or Matrix to prevent Verizon seeing message content.

ars18 · May 28, 2026, 5:14pm

F21 with Verizon on receiving mms?

jumptoheaven · May 28, 2026, 5:16pm

Yes. Sent to myself using Google messages with rcs turned off.

ars18 · May 28, 2026, 5:17pm

Send from another phone

jumptoheaven · May 28, 2026, 5:17pm

Can’t atm. APK installation blocked

walt_cohn · May 28, 2026, 5:58pm

[+] strace ready: /data/local/tmp/strace_mmsc
[+] com.android.phone found (PID 11258)
[*] Output dir: /data/local/tmp/mms-capture-20260528-135549
[*] Strace running — 45s window
[*] Send yourself an MMS NOW
[+] Capture window closed.
[*] strace log:
Session 1: attaching to PID=11380
WARNING: linker: Warning: “/data/local/tmp/strace_mmsc” unused DT entry: unknown processor-specific (type 0x70000001 arg 0x0) (ignoring)
Illegal instruction
Session 2: attaching to PID=11380
WARNING: linker: Warning: “/data/local/tmp/strace_mmsc” unused DT entry: u…
MMS DOWNLOAD REQUESTS – captured via strace on com.android.phone
Captured: 2026-05-28
Transport: PLAIN HTTP (no TLS, no encryption)

No MMSC transactions found.
Log lines: 8150

ars18 · May 28, 2026, 6:06pm

Newest plz

jumptoheaven · May 28, 2026, 6:06pm

[+] strace ready: /data/local/tmp/strace_mmsc
[+] com.android.phone found (PID 16761)
[] Output dir: /data/local/tmp/mms-capture-20260528-140437
[] Strace running — 45s window
[] Send yourself an MMS NOW
[+] Capture window closed.
[] strace log:
Attaching to PID=17004
WARNING: linker: Warning: “/data/local/tmp/strace_mmsc” unused DT entry: unknown processor-specific (type 0x70000001 arg 0x0) (ignoring)
Illegal instruction

MMS DOWNLOAD REQUESTS – captured via strace on com.android.phone
Captured: 2026-05-28
Transport: PLAIN HTTP (no TLS, no encryption)

No MMSC transactions found.
Log lines captured: 4

All connect() calls in log:
(none)

walt_cohn · May 28, 2026, 6:11pm

Newest apk? It is.

ars18 · May 28, 2026, 6:15pm

What did you use before? The script I posted? Termux?

jumptoheaven · May 28, 2026, 6:20pm

first time script with termux. second time, apk

ars18 · May 28, 2026, 6:27pm

Please do the same but send yourself an mms pic and vn (separate) with Termux script.

DIFFERENT phone to send, or use gvoice

Send an image over 1mb, that’s the limit of your device before it compresses.

Also. What ROM are you on? This all should really be done on 6.1.3…

jumptoheaven · May 28, 2026, 6:36pm

MMS DOWNLOAD REQUESTS — captured via strace on com.android.phone
Captured: 2026-05-28
Device: F21 Pro
Source: /storage/emulated/0/Download/mms-capture-20260528-143332/phone.strace
Transport: PLAIN HTTP (no TLS, no encryption)

====================================================================

TRANSACTION 1

Time: 14:34:05.102700 EDT
MMSC: 63.59.139.138:80 (Verizon)

-– REQUEST (exact bytes on wire) —
GET /servlets/mms?message-id=1079186DA14100002670000101 HTTP/1.1
Accept: /, application/vnd.wap.mms-message, application/vnd.wap.sic
Accept-Language: en-US
User-Agent: Android-Mms/2.0
x-wap-profile: http://uaprof.sonymobile.com/H8296R5111.xml
Host: 63.59.139.138
Connection: Keep-Alive
Accept-Encoding: gzip

-– RESPONSE —
HTTP/1.1 200 OK
Server: Apache
Content-Type: application/vnd.wap.mms-message
Date: Thu, 28 May 2026 18:34:05 GMT
Connection: Keep-Alive
Content-Length: 11959

MMS PDU headers (decoded):
X-Mms-Transaction-Id: 1079186DA14100002670000101
X-Mms-From: 7328061306/TYPE=PLMN
X-Mms-To: 3477864556/TYPE=PLMN
Attachment: 123_1.jpg (11 KB)

====================================================================

TRANSACTION 2

Time: 14:34:06.033348 EDT
MMSC: 63.59.107.146:80 (Verizon)

-– REQUEST (exact bytes on wire) —
POST /servlets/mms HTTP/1.1
Accept: /, application/vnd.wap.mms-message, application/vnd.wap.sic
Accept-Language: en-US
User-Agent: Android-Mms/2.0
x-wap-profile: http://uaprof.sonymobile.com/H8296R5111.xml
Content-Type: application/vnd.wap.mms-message
Content-Length: 34
Host: mms.vtext.com
Connection: Keep-Alive
Accept-Encoding: gzip

��1079186DA14100002670000101

jumptoheaven · May 28, 2026, 6:37pm

Random rom from @N-B

Voicenotes work on this rom too, though.

ars18 · May 28, 2026, 6:41pm

Not a full capture

jumptoheaven · May 28, 2026, 6:45pm

This is with a vn.

MMS DOWNLOAD REQUESTS — captured via strace on com.android.phone
Captured: 2026-05-28
Device: F21 Pro
Source: /storage/emulated/0/Download/mms-capture-20260528-144351/phone.strace
Transport: PLAIN HTTP (no TLS, no encryption)

====================================================================

TRANSACTION 1

Time: 14:44:14.863970 EDT
MMSC: 63.59.44.2:80 (Verizon)

-– REQUEST (exact bytes on wire) —
GET /servlets/mms?message-id=12791891999D0000E750000101 HTTP/1.1
Accept: /, application/vnd.wap.mms-message, application/vnd.wap.sic
Accept-Language: en-US
User-Agent: Android-Mms/2.0
x-wap-profile: http://uaprof.sonymobile.com/H8296R5111.xml
Host: 63.59.44.2
Connection: Keep-Alive
Accept-Encoding: gzip

-– RESPONSE —
HTTP/1.1 200 OK
Server: Apache
Content-Type: application/vnd.wap.mms-message
Date: Thu, 28 May 2026 18:44:15 GMT
Connection: Keep-Alive
Content-Length: 65246

MMS PDU headers (decoded):
X-Mms-Transaction-Id: 12791891999D0000E750000101
X-Mms-From: 8482272310/TYPE=PLMN
X-Mms-To: 3477864556/TYPE=PLMN

====================================================================

TRANSACTION 2

Time: 14:44:16.627370 EDT
MMSC: 63.59.169.146:80 (Verizon)

-– REQUEST (exact bytes on wire) —
POST /servlets/mms HTTP/1.1
Accept: /, application/vnd.wap.mms-message, application/vnd.wap.sic
Accept-Language: en-US
User-Agent: Android-Mms/2.0
x-wap-profile: http://uaprof.sonymobile.com/H8296R5111.xml
Content-Type: application/vnd.wap.mms-message
Content-Length: 34
Host: mms.vtext.com
Connection: Keep-Alive
Accept-Encoding: gzip

��12791891999D0000E750000101

jumptoheaven · May 28, 2026, 7:07pm

Coming up blank

walt_cohn · May 28, 2026, 7:50pm

Tried with pcapdroid, it showed no HTTP requests but the query with one phone it got instantmessaging-pa-jms-us.googleapis.comand another it didn’t get a URL.

ars18 · May 28, 2026, 7:55pm

Pcapdroid will not help u here

I really don’t want to turn on my f21

flipphoneguy · May 28, 2026, 8:14pm

@ars18 can I get a summery of where stuff are up to? What were you trying etc