yashsingh1/xdaforums huggingface dataset:
[Wildfire General] dannyjmcguinness:
Using this method I believe you can flash any Buzz RUU. The problem is after the first bootloader downgrade, any attempts to reflash reults in all other partitions flashed ok but the bootloader (hboot) is bypassed. It does however result in ratc working again, to some extent so there must still be some way to hack it.

I have managed to push su and busybox to /system/bin/ a couple of times without any memory error messages but lost it when I tried to remount /system read only which caused a reboot.

For anyone interested the command I've been trying to use to mount system to achieve this is :

mount -o remount,rw,alldev,allexec,allsuid,allpid,dirasync,relatime,mode=755,errors=force_remount,rw,alldev,allexec,allsuid,allpid,dirasync,relatime,mode=755 /system /system

sometimes i incorporate recurse, expand, compress or move. It would appear you can omit the type, it should remount automatically with correct type. Also I think /system can be used instead of /dev/block/mtdblock3 as they both point to same place (kind of).

The above command if ran alone will cause a termination and segmentation error (some of my research would indicate a segmentation fault is a good thing, its an inication of a working exploit), or a reboot.

In order to make it work I had to write a batch file that would repeatably mount the various partitions in different ways with different permissions in rapid succession. It doesn't allways work but it would appear that just occasionally this command can sneak by unoticed
[Wildfire General] lokeshramesh:
Root possible??

If flash of 0.80 hboot ROM is possible then I think there's many option to root... :)

Also check out what I Found:

Sebastian Krahmer the famed “rage

against the cage” exploit dev has

released the latest version of exploit

that exploits Android 2.3.3

Gingerbread and may also exploit

Android 3.0 Honeycomb and may

also exploit Android 2.2 Froyo. As

the official post claims -

Free your phone, once again.

Successfully tested on Gingerbread

(2.3.3) but might also run on Froyo

and Honeycomb. If it fails there, some

offsets and indexes need to be

adjusted which is left to the reader.

NOTE: You use it at your own risk! I

am not responsible for any failure or

damage. Make sure to read the

README file carefully! Download it

here. If you successfully run it

anywhere, please make a comment

with exact device model/firmware

running.

[Update] I replaced the tarball with a

new version to fixsome glitches while

parsing vold.fstab. Should now also

work on the GalaxyS.

The best part ? Since the exploit is

released, we can expect Unrevoked

team to release Unrevoked 3.33

soon :)

Hope wildfire will be rooted in this...
[Wildfire General] EchoVelocity:
For reference the actual article is on his blog here: http://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html
[Wildfire General] dannyjmcguinness:
Interesting,

Anyone else tried this. It hasnt worked for me on my initial attempt but must follow the instuction properly later.

I wonder if I have to re-upgrade to Froyo to make it work.

The code certainly seems to indicate that its for permanent rooting
[Wildfire General] EchoVelocity:
The exploit works and puts me into a root shell, but the NAND protection still stops me copying su and busybox to /system/bin even if I remount it as rw. Furthest I've managed to do is get an "can not allocate memory" error when attempting to copy the files.

@Danny: Could you give us the script you used to remount the system as rw? Can it be run by the phone over adb? That way we could run the GingerBreak exploit and then attempt to copy it over afterwards. That might work?

Sent from my HTC Wildfire
[Wildfire General] alvaritolalala:
You must search for psneuter first, I think. It's a exploit to get shell root access. Once you've managed to gain root just do this:

adb shell
cat /dev/mtd/mtd0 > /sdcard/mtd0.img

*Edit mtd0.img with some hex editor and look for your version number and change it to the RUU version you want to downgrade. I reccomend you to download RUU_Buzz_HTC_WWE_1.37.405.1_Radio_13.53.55.24H_3.35.19.25_release_151892_signed.exe since it has 2.1 and you can use Visionary+ to temproot. If you choose this RUU, change the 2.XXX.XXX.X version on mtd0 to 1.37.405.1

Then you have to download flash_image and push it to the phone. Remember to chmod +x these files in order to run them.

adb push psneuter /data/local/tmp
adb push flash_image /data/local/tmp
chmod 777 /data/local/tmp/psneuter
chmod 777 /data/local/tmp/flash_image
/data/local/tmp/psneuter

*ADB will reboot so just re-adb :p

adb shell (Now you have root!)
/data/local/tmp/flash_image misc /sdcard/mtd0.img

Then just run the RUU and it will "soft-debrand" the wildfire, removing vodafone crap

I don't have the files nor the download links right now but I want to open a thread for all of us who have been trying to root/unlock the "2.2.1/hboot1.01", to share ideas, and I will upload the files. Just wait until night :p

and no, you cannot downgrade to 0.80.
[Wildfire General] alvaritolalala:
Gingebreak won't work on hboot1.01 S-ON due to NAND lock
[Wildfire General] BarclayTech:
He clearly says 0.80

Sent from my HTC Wildfire
[Wildfire General] alvaritolalala:
Ooops my fault :p

Anyway, for the rest of us with 1.01 :D
[Wildfire General] BarclayTech:
keep getting CID error on RUU. any ideas?

Oh wait. actually yeah. it dosnt work
[Wildfire General] BarclayTech:
where do you pull the rom.zip from? cant find temp files
[Wildfire General] dannyjmcguinness:
When you run the RUU the Ruu is extracted into user temporary folders. Using Windows 7 or vista this will be located at

C:\Users\UserName\AppData\Local\Temp\{885df1de-eb01-4b3f-a585-4ad2c69bba25}

Obviously UserName needs substituted with your pc username and the last string will randomly change. There will be two similar looking folders running for 1 RUU.

In xp this folder will C:\Documents and Settings\UserName etc

You will need to unhide folders and also display system files.

If you are getting a CID error it means you have incorrectly created your goldgard.

Make sure you have HTC sync installed and netframework during goldcard creation
[Wildfire General] BarclayTech:
Ok. And hmmm I used a guide online on the goldcard creation and was sure I did it right. Ok ill try again tonight.

Sent from my HTC Wildfire
[Wildfire General] lokeshramesh:
Hboot 1.01 can be rooted!!

:) c - s k i l l s .b l o g s p o t . c o m /2011/04/yummy-yummy-gingerbreak . h t m l :)

Check out here an anonymous says he has successfully rooted HTC Wildfire with root access to /system folder as well... Check out fast...

First said:

>Works on Wildfire/2.2.1 (Froyo). However, it doesn't always work on the first attempt and it helps if you keep the phone busy (e.g. permanent touch-screen inputs) while doing it.

Unfortunately no R/W access to /system is available (-> yaffs error messages), would be nice to have this permanently.

~He forgot to chmod system folder~

Next he said:

>I'm sorry, because I was wrong in My last message. I forget to chmod the file :$

The exploit works like a charm in HTC Wildfire!:):p

~Now Its our turn to try it and root the wildfire permanently by installing superuser & busybox ;)
[Wildfire General] gogusteliade:
any proof? :)
[Wildfire General] lokeshramesh:
I said to try it, I'm too working on this and i got shell root now trying to get root access to /system... I got Root access to /system yesterday by 'mount' method but it restarted immediately and lost the root access :(
[Wildfire General] Ouistyty:
I do like the way how this thread is goiing.

It's sound promising.

:-)
[Wildfire General] lokeshramesh:
Try installing custom Roms!!

Any1 tried installing Custom Roms using the method provided here, Hope we can try it, if success we can get root access except to system folder I think??

Many problems will be solved if we can install Custom Roms!!
[Wildfire General] gloc33:
Had to try another microSD card than the original SanDisk one provided (to a 2Gb Kingston from another phone) to create a successful goldcard. Hope that helps.
[Wildfire General] BarclayTech:
I made a goldcard now on 4GB TDK but for some reason. i can downgrade the rom but not the HBOOT. hmm
[Wildfire General] vedant chamaria:
cn u post the steps

hi dude,

great work man but cn you share your work wid others.......?

can you plz post your steps for thee temproot??

sorry for the wrong english
[Wildfire General] vedant chamaria:
nice work

hey,

great work dude....

can you plz share your hard work with us.....

can you please tell us that what did you do to temproot your phone???

thanx.....
[Wildfire General] lokeshramesh:
Some Idea!!!

>Hi! Can we spoof the hboot by making changes in hboot file which RUU installs. Changes like changing the version to higher than 1.01 to something 1.1 or 2.0 etc... by this the hboot will think its newer then he installs the new hboot. what u say?

>Do custom Rom works with ur idea?
[Wildfire General] BarclayTech:
i was thinking of swapping the HBOOT with Alpha Rev (when its released) in the rom.zip file. Then basically tricking the phone.

and no. custom roms dont work.
[Wildfire General] ErwinP:
As far as I know you cant just swich the hboot that is in a RUU or an official update.zip. If you do you have to resign the update file with the HTC key (which nobody knows) so that your phone will see it as an official update and install "your" hboot.

Alpharev and unrevoked use an exploit in the older hboot so they do there thing.

Erwin
[Wildfire General] BarclayTech:
Well atleast i was able to de-brand my phone. 3 is quite annoying.
[Wildfire General] Les1976:
Wow, erm? I have no idea what you guys are going on about with your tech babbling but you look confident and exited. So I'm exited too, but I'm not going attempt to follow your complex looking instructions as I would probably go wrong and brick my phone. Anyway I hope you will be victorius, I will wait and hope I don't need a PHD of some sort to crack my phone once a way is found. Good luck and thanks :)
[Wildfire General] lokeshramesh:
New Idea...

> Try installing cn froyo 2.2 ROM if it installs successfully there's a method to downgrade cn froyo 2.2 to 2.1 in ROM Development forum. Then after that install original WWE or your country's froyo 2.1...

~Please try it b4 saying anything as once said it won't work no one will ever try it on their, and Best of Luck!!~

I would hav tried it but I'm using mobile net and its really slow and limited to download huge ROMs..:(

Also what's the difference between hboot 1.01.0001 and .0002??
[Wildfire General] 3xeno:
Although I am not in a position to test your theory, CN Froyo used HBoot 0.93, not 1.01.
[Wildfire General] BarclayTech:
if i am correct. HBOOT 1.01.0002 is slightly more locked down than 1.01.0001. i have finally got HBOOT 1.01.0001 going and have temproot froyo 2.2.1
[Wildfire General] ErwinP:
What did/do you use to get temproot, psneuter, super one click, gingerbreak,..?

Is it with temproot possible to write in the /system folder? Or am I confusing things? Sorry if that is a stupid question, but whilest everybody speaks about getting temproot, nobody says what it can be used for.. or at least not where I can find it.

Thank you in advance,

Erwin
[Wildfire General] anonimo95:
hmmm

First: I achieved temp root with gingerbreak

Second: It´s imposible to to write in /system , so you cannot copy busybox to there

I hope this helped you
[Wildfire General] BarclayTech:
i used gingerbreak for temproot.
[Wildfire General] ManuStaufi:
Is it possible for you to write a short howto?
[Wildfire General] anonimo95:
I

I could write a short howto of gingerbreak on wildfire, but there's no point in,i tried it and you only achive temp root in adb shell, not into the mobile, because when i tried to copy busybox to /system y got the famous "permisson denied"
[Wildfire General] ManuStaufi:
And have you got read permissions for /system ??

Then you could read the /com.google.android.location
[Wildfire General] dannyjmcguinness:
I already tried this before your post, and it does appear to help if phone is busy while attemting stuff like this. Also useful if its running short on memory. I found it useful to fill all the partitions up. Mount everything and fill it to the brim. Also you know when your phone runs slow, that seems to help.

I think if anyone has some sort of virus/exploit/hack/app or wants to write one that has a serious impact on system performace then that could be most usefull
[Wildfire General] lokeshramesh:
Oh gr8, then i think we r very near to root., to keep system busy use 'Audio Player with EQ'.. This media player software always nearly hang my wildfire.. So, now try to use the trick...
[Wildfire General] anonimo95:
so

so, when should we keep busy the phone, when we're running gingerbreak??
[Wildfire General] lokeshramesh:
Yes, When u run GingerBreak and also after that mount /system as rw try to install su and busybox using shell u get success or not reply... Also downgrade the hboot to 1.01.0001 by using method on this thread after that try ginger break...
[Wildfire General] anonimo95:
so

i´m not being at home next 5 days, can someone try it??
[Wildfire General] Angulardragon03:
Im gonna keep watching this... :)
[Wildfire General] coolbits:
Someone try this:

Compile this module with the 2.2.1 kernel (if available?)

http://xdaforums.com/showpost.php?p=5727436&postcount=223

After that compiled, get temp root, insmod this module and maybe you get off nand protection.

When no nand protection, you can copy "su" to /system/bin and youre perm rooted :)
[Wildfire General] Skye Menjou:
Not possible.

Also Tattoo has no Nand/S-on.
[Wildfire General] :
I think chinese froyo used the HBOOT 0.83.0002

I have downloaded the chinese froyo RUU from the shipped roms website,

RUU_Buzz_Froyo_HTCCN_CHS_2.10.1400.3_Radio_13.53.55.24H_3.35.19.25_release_151119_signed.exe

Then i opened it, explored the user temporary folder, copied the rom.zip to a safe location.

Then came to know that the hboot file inside the "rom.zip" has the version 0.83.0002
[Wildfire General] nikelisgod:
I have tried the GingerBreak2 and got an temproot. It seems, that /system is too full and have no free space, and so you can't write something to it. I tried to remove some apps (Gmail.apk for example), but "rm -rf" don't work in that shell and "rm Gmail.apk" said, that directory is not empty. I couldn't cd in Gmail.apk either. Maybe busybox can help there.

I used simple trick, to get binaries under /system/xbin/ (but only temporary):

cd /data/local/tmp

mkdir bin

cd /system/xbin

for i in * ; do cat $i > /data/local/tmp/bin/$i ; done

cd /data/local/tmp/bin

chmod 0755 *

cat /sdcard/su > su

chmod 04755 su

mount -o bind /data/local/tmp/bin /system/xbin

Clockworkmod didn't said, that it's need root, but didn't worked.
[Wildfire General] dannyjmcguinness:
Still working on this, found some code with several other types it will accept.

I'm now thinking that it may be looking for an image within this image
[Wildfire General] dannyjmcguinness:
Tried this also, tried modding the AndroidInfo.txt within the ROM as well.

Am I right in thinking that that modifying the htcpreupdate parameters within this file could force hboot update?????

The problem is modifying this file without extracting it, which would destroy the signature or interupting the signature in any other way, which would be difficult because of the checksums.

So you can't spoof the signature, but is it possible to spoof a checksum?
[Wildfire General] krishnashk:
guys can i install custom ROM with the SHELL root?
[Wildfire General] lokeshramesh:
Nope!! To install custom roms it requires permanent root and clockworkmod to be installed after which u can install custom Roms:)
[Wildfire General] nikelisgod:
If the checksum is some good hash (such as sha*), then it is difficult. If it is an huffman or crc, when it is possible.
[Wildfire General] dannyjmcguinness:


If it were possible to obtain a "clean" copy of hboot below 1.0 I wonder if it would be possible to flash it by itself.

I think in order to obtain a clean copy you would need a signed OTA update that has extracted itself when confirming update. I think I have a clean copy of 1.01.0002 by removing sdcard before reboot and inserting in pc.

I'm not sure if it would help though as the code seems to indicate that hboot 1.0* will only accept "large" (above version 1) and not "small" (below version 1) hboots. This is because it tells any other hboot that the partition is too small, which is why it gets skipped downgrade.

I think that in conjuction with a ROM (PC49IMG.zip) a copy of PC49IMG.nb0 is required which contains an image of the partition table necessary for PC49IMG.zip to be able to flash every partition.

Surely these files must exist, someone, somewhere must have a copy.
[Wildfire General] lokeshramesh:
Can this page help to root:

http://blogs.sonyericsson.com/developerworld/2011/05/06/how-to-build-a-linux-kernel/

Also HTC should learn from Sony Ericsson as they are providing boot unlocking as open source to everyone.
[Wildfire General] brilldoctor:
see my sig
[Wildfire General] dannyjmcguinness:
Allready looked into this as well. I can tell you that the 0x0fce needs altered to match HTC's OEM code. I think we need to find out if HTC wildfires have this functionality enabled (and something tells me, they are not about to tellus). If they do I imagine the code is encrypted somewhere within the phone.

I was thinking, wouldn't the custom ROM developers know this kind of thing? You know what certain files etc are for
[Wildfire General] Skye Menjou:
This page is about flashing a kernel, SE has a special program to UNLOCK their BOOTLOADERS.

You cannot unlock Wildfire's S-OFF and other security with something made for SE and SE alone.
[Wildfire General] lokeshramesh:
Try this command on fastboot mode:

>Open cmd prompt

>Point the current directory to the directory of android sdk and inside it where the location of fastboot.exe locates.

Eg: c:\android-sdk-windows\platform-tools\

>Type "fastboot oem boot" without quotes.

>U'll get info on HTC boot.:)

Might be useful to unlock/erase bootloader...
[Wildfire General] nthnthn:
I downgraded and temprooted my wildfire, and i have set the system partition to read/write. I tried to push su to my /system/bin folder but it said there was not enough memory... so i deleted a system app and tried again, but it said again not enough memory.

I also have read somewhere that the pre-released version of froyo had s-off in it. And its probably a signed update, so you just could upgrade to that and have s-off instantly. But i never found the firmware :D

grtz
[Wildfire General] lokeshramesh:
Any1 knows

> which files are signed in a stock roms (Eclair & Froyo) any particular or all?

> What is Password of Signed Eclair ROM which is signed?

> Is password required to sign a ROM or they just can be signed using valid certificate?
[Wildfire General] rseke:
And are we have soft root on 2.2 wildfire?
[Wildfire General] sergey.sh:
No, we don't :(
[Wildfire General] AngiolettoNero:
Can we hope?
[Wildfire General] dannyjmcguinness:
How is it that you can chmod files in /system and also delete them. Isn't this in effect the same as writing to them?
[Wildfire General] suiller:
I successfully got temp root trough gingerbreak

successfully moved su, busybox, etc... always under tmp, I can freely read all files udner /system

successfully mounted /system & /data as rw (mount -o rw,remount ...)

but... I'm not able to copy anything even if I'm #root#

/system says it hasn't enough space, also replacing files trough dd is not possible...

all this due to nand lock?
[Wildfire General] :
Have u seen this. Replacing the file just before starting the update process.....

http://xdaforums.com/showpost.php?p=14049505&postcount=56

If it is possible for unsigned pc49diag.zip , then will it be possible for unsigned pc49img.zip

If yes, i think that helps someway.

edit: sorry PC49DIAG.NBH there, (and not pc49diag.zip)
[Wildfire General] lokeshramesh:
I've seen that and now i'll try to do the same with ruu if possible if that works then i think we can root and also i think we can s-off any htc phone easily
[Wildfire General] kishoreks:
Hoping to get the good news very soon :)
[Wildfire General] ErwinP:
I was thinking, perhaps is is via this way possible to downgrade the hboot to 0.80? It is an alternative that can be tested if you can't pass the "waiting for a signal from SIM card"-security check to wipe the secuflag.

I would try it myself, but I'm having exams right now, and can't effort to spend that much time on it (and we all know that once you get started in trying these things, you loose a whole day :D). But I'm following the topic more closely than is good for me!

Erwin
[Wildfire General] :
bypassing signature check.

GUYS, I think the signature check can be bypassed. OMG i cant believe this.

first i have taken the original pc49img.zip signed by htc (froyo ota).

then i have booted into hboot mode. it checked (here occurs the signature check) the zip file and asked to press vol up to start the process.

then i removed the memory card, and extracted the contents of zip file (using memory card reader here). Then repacked the contents to a zip file with an additional text file added. then renamed to pc49img.zip Then inserted the card and pressed vol up.

Surprisingly, it has done the update.

So the signature check occurs before the pressing of vol up button. This is really a great step. Thanks a lot to the discoverer.

But i think this cannot be possible with RUU (because RUU signature check occurs after starting the process) .
[Wildfire General] :
Doing one more experiment now.

wait.................
[Wildfire General] alvaritolalala:
Well actually I was thinking of repacking a rom.zip from RUU and change (with an hex editor) the vesion of the 0.80 bootloader to 1.01.0002 (for example) and see what happens.

I can't try it until this evening so if someone wants to try...
[Wildfire General] :
Dont know about that. Ok good luck. Thanks again for the great idea.
[Wildfire General] :
OK. what i did again is, I replaced the official recovery.img with the custom recovery.img from this link http://xdaforums.com/showpost.php?p=12188132&postcount=15

But no success.

The recovery.img of official recovery has a memory of 2.98 MB and that of custom recovery (frm that link) is 3.48 MB .

Well, the process said that it updated. It displayed "OK" like that of official one. But i found that custom recovery was not installed. Even after booting into recovery, there was official recovery with red triangle.

Now i have 2 doubts.

1.Are the contents of the edited pc49img getting installed or not.

2.Is the file size of recovery.img caused the custom recovery failed to install. (If so will it work if we have a 2.98 MB or even lesser custom recovery -- different version).

Or is that my concept of replacing the recovery.img (with a custom one) will never work.

[And be careful while doing the process, bcoz if the battery gets out accidentally, the phone will brick mostly]
[Wildfire General] :
It might work only on wildfire (+ some older devices). I think this might be the reason why htc implemented "signed boot partitions" and "signed recovery partitions" in newer devices.
[Wildfire General] majcn:
what about if you replace old hboot when repacking?
[Wildfire General] :
replacing with old hboot is nothing but doing the process with a signed older ruu.

hboot, cannot be downgraded by just bypassing the signature check. there is still nand protection.
[Wildfire General] :
But im expecting one thing can be possible if the signature bypassing is real.

Using an exploitable hboot and changing its version to the present hboot version (or even higher), such that the phone thinks its a newer update from htc and installs it.