yashsingh1/xdaforums huggingface dataset:
[Xperia Play Android Development] Mills00013:
I just tried a T-mo and an AT&T SIM, neither give me any sort of insertion notification or acknowledgement that they are present. So I'd say the slot is firmware disabled. But it should still have an IMEI, right? That would be programmed by Qualcomm out of the factory before Ericsson would have even installed it. Or am I taking crazy pills?
[Xperia Play Android Development] b00sted:
do a ADB devices on your phone it gives what I think is a IMEI number and if you put the first 14 in on sony's site it gives you a unlock code, i am to much of a wussy to try it tho lol.
[Xperia Play Android Development] ace518:
more than willing to be take a chance on mine. i ran adb devices. got code. first 14 digits (minus the b) sent to sony and got an unlock code.

next steps i'm confused on. how do i boot to fastboot mode? i tried holding menu key and inserting usb... didnt' seem to do anything...

ran

9. In the cmd windows type in fastboot.exe -i 0x0fce getvar version

and it did nothing just sat there (waiting for device).

Is there an indication you are in fastboot mode? should 0fce be different on our phones? any ideas?

EDIT: its hold search, not menu, got it to fastboot mode and got response.. trying now. will post results

EDIT 2 : and fail.
[Xperia Play Android Development] b00sted:
ya I just tried too and fail :/ #sadpanda
[Xperia Play Android Development] Logseman:
Neither the adb devices nor the fastboot devices codes have anything to do with the IMEI number.

Enviado desde mi R800i usando Tapatalk
[Xperia Play Android Development] b00sted:
I am willing to donate towards the first person that can get root and CWM on this!
[Xperia Play Android Development] Blagus:
as said, i need A-F 0-9

0000000000000000

to

FFFFFFFFFFFFFFFF

dictionary for cain&abel
[Xperia Play Android Development] Mills00013:
are you seeing this hash in the TA dumps from the CDMA play? What line do you believe it is on? I'm wanting to take a look too.
[Xperia Play Android Development] Mills00013:
Blagus, I'm going to investigate another avenue when I get home tonight.

Thinking about the way that the key is copied over, I see a couple of different ways they could do it. The first option is that your unlock code is sent to the phone when you initiate the command and fastboot on the device hashes and compares. The other option is they take the unlock code and hash it in fastboot. They then send it over USB in the fastboot oem unlock command and compare the hashed value against the value stored on the phone. The second, option, although less likely, could give us a way in if we can see this information.

I'm going to compile a simple USB debugger this evening or maybe even use Wireshark and watch whats being sent over USB. If we can intercept the packets before they are sent over USB, we could match what is in the TA file and send that information.

Just an idea.
[Xperia Play Android Development] Blagus:
that won' t work. everything is did on phone, key is sent via standard oem unlock command. you can check it, although.
[Xperia Play Android Development] Mogul345:
Blagus,

I googled cain&abel, as I didn't know what you were talking about. Interesting tool indeed. But now I'm a little confused. I found this tutorial for it and the example dictionary.txt file just lists the raw values, not the hashes for the values along with the values.

To make sure I understand your request correctly, is this the type of file you're looking for? Because if that's the case, I was overthinking things earlier. I thought you needed the hashes calculated for 0000000000000000 through FFFFFFFFFFFFFFFF. If you really just need a list of the values themselves, one on each line, that is easy, I can whip up that for you really quick, nothing special required.
[Xperia Play Android Development] Mogul345:
True, but I was hoping to just whip this up in .NET/Mono as a console app. It would be multithreaded so we can peg the CPU cores. Cmd line params would be the range of values to generate hashes for, and path to output file of hashes.

Then I could post here and we could all generate specific ranges for Blagus.

I think either way, GPU or CPU, its going to take a while to generate all those hashes! And we all likely have x86 CPUs, but we've got a good mix of Nvidia & AMD/ATI users. And quite a few Intel users who would be totally left out of the mix.
[Xperia Play Android Development] Yufice:
i have a thunderbolt, not an xperia play....this is all greek to me, but i'm running a core 2 quad and have a radeon 6790. if theres anything i can do to help, holla.
[Xperia Play Android Development] NeoandGeo:
We could employ the 2,200 PS3s the US Military is allegedly using for its supercomputer. :p
[Xperia Play Android Development] Mogul345:
All,

I finished up the application to generate the dictionaries that Blagus needs to run a dictionary attack against that hash of his. The application and the source code are attached.

Usage:

DictionaryGenerator startValue endValue outputFilePath

Example for blagus' problem:

DictionaryGenerator 0000000000000000 FFFFFFFFFFFFFFFF "C:\dictionary.txt"

Usage Notes:

There's only some rudimentary checks being done for validating the input. I suggest you don't fat finger, otherwise you might get an exception.

This file gets huge fast. I let it run for 5 min or so and it had generated a 13GB text file! So there's no way we can get all possible values in one file. So I leave it to Blagus how he wants to break the files down into more manageable sizes.

It will prompt you to overwrite your target file if it detects it already exists.
[Xperia Play Android Development] Mills00013:
Mogul, got your app in hand, ready to crunch whatever numbers Blagus needs.

Blagus, how can we help?
[Xperia Play Android Development] gotoman00:
i've got two pc's waiting on standby, what's the word
[Xperia Play Android Development] ace518:
add my cpu to the pool. I'm out of the country, but if i can RDP to it I could probably set it up.
[Xperia Play Android Development] Mogul345:
Guys,

I think we might need to rethink our strategy if we need every value in that range Blagus put up. I'm running more tests on my media rig. I just tried 0000000000000000 to 0000000100000000. I stopped it early as it had already generated a 24GB text file (Gonna try and see how far it got with a little powershell script). Trying to compress down but it says it's only 3% done and zip is already approaching a GB. The file compressed down to 1.9GB. Pretty good, but it did take a while to compress.

Even if we generate all this data for him, how are we getting it to him? That's a lot of data to move across the internetz.
[Xperia Play Android Development] ijustwantthedownload:
Anyone smart enough and has enough resources to set up a Folding@home type system where a client checks in, gets data, processes it, then returns the results? Be nice for ALL people wanting to crack android I'd think...
[Xperia Play Android Development] ryocoon:
>_< _IF_ we are going to attempt to crack like that, there is little point in trying to do it that way with an auto-generated dictionary of _EVERY_ value. That is silly, just have the cracker try to do brute force instead of generating a dictionary. Farm out the ranges to other folks so that we can distribute the computing burden. If we use OpenCL or CUDA enabled apps to do the crunching/breaking/cracking/hashing/etc then we can do it dramatically faster.

HOWEVER! I think that the first thing we need to do is figure out what Method of hash or encryption is being done, and then figure out the salt. To do that we would have to take the result and the original, do HashMethod+salt transforms till the (cows come home) results match.

Trying to brute force another key without figuring out the method is ludicrous. Trying to brute/generated-Dictionary attack another key where we have figured the hashing method, but haven't figured what the Salting method or key is, is just plain silly.

I know we are all excited, but we have to look at this realistically and not fly down alleyways blindly.
[Xperia Play Android Development] NeoandGeo:
This is my first sit in to an XDA Developers rooting progress thread for a phone, so I am not sure what to expect. But this seems like the complete wrong way to go about obtaining root, imo. Is this the general way it is done, or does a breakthrough come in some other form besides brute forcing?
[Xperia Play Android Development] Mills00013:
At this point, Neo, we are past trying to obtain a simple root, we are trying to unlock the locked bootloader on our phones so the root will be as simple as flashing an update.

Typically when people try to obtain root, they will look for security exploits in the kernel or system that affects the builds we are using and try to exploit them to gain root access. Right now, this thread is mostly talking about generating unlock keys since the phone is directly unlockable. The problem is we just dont know what the keys are because Ericsson / Verizon won't play nice with us.

Obtaining root through a conventional method would be nice because it would allow us to remove the bloat and whatnot, but what I think most people here really want is full control of their device down to the boot partition. We want to be able to customize our phones down to the ROM level and a simple root wont give us that.
[Xperia Play Android Development] gotoman00:
well when a roadmap is visualized here, i've got a few tb's of space at my disposal, two dual core machines with 8800gt's or greater, and about a 600kb/s upload speed... would love to make sweet, sweet data and move it.
[Xperia Play Android Development] Mogul345:
I agree. Not until I started generating a result set for what Blagus asked for did I really realize just how enormous the dataset is.

Until Blagus gets back from vacation, I think we just need to sit tight, and get more details on the hash he's interested in.
[Xperia Play Android Development] :
Guys this isn't just the Verizon Xperia Play. Look at the Droid3 and other Android 2.3 phones. Currently there is no way to root those either. I'm sure once one of these devices gets rooted the rest of the devices will use a similar exploit. The guys in the Droid3 forum are also mad.

The reason that the GSM plays can be rooted is that they were launched before the CDMA model and at that time Sony Ericsson didn't know about the exploit. All current firmware versions CAN'T be rooted. The only way is to downgrade and then there is a loophole if you update with a rooted phone. Even Rogers Xperia Plays cant be rooted on 2.3.4 we have to use the UK firmware.
[Xperia Play Android Development] :
Sorry for the double post?

Has anyone tried the Gingersnap root method? Some people using a droid3 are saying it somewhat works it could work for you guys? If I was on 2.3.4 I would try it.
[Xperia Play Android Development] giventofly17:
The GSM models are bootloader unlockable. You can always just flash a rooted rom and you are good to go. I believe that's how root was originally acheived for this phone. Can't do that with CDMA version.
[Xperia Play Android Development] :
Not all GSM phones are bootloader unlockable. The North American Rogers play is not and a handful of european carrier branded plays are also locked. For the simlocked plays we used gingerbreak to get root access.
[Xperia Play Android Development] pouxonu:
Anyone tried this?

Sorry I'm tardy to the party but have peeked in once in a while to see if there has been any progress and today I stummbled onto this.

http://wiki.rootzwiki.com/index.php/Sony_Ericsson_Xperia_Play

It's showing CDMA on the specs list. Not sure if it's a typo or the page was set up before the launch and the root was stopped or what but I'm no good when it comes to ADB. If anyone wants to give this a shot hopefully it can get it done or maybe put someone in the right direction
[Xperia Play Android Development] ijustwantthedownload:
If you look on the right for "rooted status " it says "technically...no ". Worth a shot though.
[Xperia Play Android Development] ashergray:
Thanks to some help from Logseman and a little research I managed to find out that the code in the TA that corresponds to the unlock code is an Unsalted SHA-256.

So progress is being made.

for anyone willing to dive in, check out oclHashCat-lite

another couple days and we might just get into the bootloader.
[Xperia Play Android Development] giventofly17:
Tried, no good.
[Xperia Play Android Development] Mogul345:
They left it unsalted? That's excellent! I've got a Core i5 750/AMD 5770 I can throw at this. What's the distributed strategy for attacking the hash? I assume we need a copy of the hash in the TA to use with HashCat? Can I get a copy of it?
[Xperia Play Android Development] ashergray:
download the omnius software and backup your full TA

open the TA file with a text editor

next to RCK_H you will see the 256bit hash, that is the hash I am attacking.

but for now I am trying to get some help from the guys at the oclhashcat forums, I am having trouble setting up the cmd line to work with it properly.
[Xperia Play Android Development] Mills00013:
I love you.

This is more than progress being made. This is one of the biggest breakthroughs we have had to date on this device. Fantastic job to you and Logseman!
[Xperia Play Android Development] ashergray:
Haha, Thanks. I have made some more progress with the command line, so far the only thing holding me from getting it rolling is getting the proper character set for this.

check out my thread on the progress, I will keep it updated when I am not at work.
[Xperia Play Android Development] Logseman:
It's ashergray who's doing the job, so all commendations should go to him. I merely provided my backups, as I did with Blagus and with yourself when you asked for them. To me this is as arcane as stage magic, but I like to volunteer for the magicians' tricks.
[Xperia Play Android Development] ashergray:
I love the way you put that. I think I may have stumbled upon a way to bring the unlocked (verizon) bootloader to the masses once it is cracked. I am going to run it by blagus before I say anymore though.
[Xperia Play Android Development] T3mpr1x:
Loving the progress made in this thread! :cool:
[Xperia Play Android Development] Yufice:
I'm excited. Very excited.
[Xperia Play Android Development] ashergray:
Well, after speaking with Blagus about a pontential solution to bring the unlock to the masses, it seems pretty unlikely. As it would more likely brick the phone.

and More bad news, to crack the bootloader with my setup alone would take almost 82000 years. we may be able to try a distributed attack on a single rck_h code but even if we split it up it seems pretty unlikely we would get it before Xperia Play 2 comes out.

so does anyone else have any Ideas? I feel like I hit a wall here.

edit: possible work around found. going to do some research. I may have a distributed solution.
[Xperia Play Android Development] Blagus:
Only way to unlock BL is to produce unlock code which will be written to 8B2 unit in TA Misc.

At all: you cannot write new RCK_H or new TA because most stuff in TA Misc is hash-protected, plus IMEI being compared to one in OTP which cannot be reprogramed. Everyone knowing what is TA/GDFS would already have done that if it was so easy.
[Xperia Play Android Development] Mills00013:
Blagus, this whole process has shifted a few times and the general direction right now is of course trying to figure out what our keys are again. You have said previously you believe the phone knows whether it is locked or unlocked due to a key in the TA, so is still worth trying to figure out where that key might be in our TA?

Maybe this needs to come from the further development of your relock method.
[Xperia Play Android Development] Blagus:
Key is stored in 8B2 unit after unlock. Before first unlock 8B2 unit doesn't even exist.

Also, I'd like it if I would be credited for this too...
[Xperia Play Android Development] Mills00013:
Maybe a dumb question that I should know the answer to but what exactly is the B82 unit? I've seen you refer to it a few times. Is that part of the TA or is it a separate piece of data all together? What have you concluded are the restrictions on it? Writable or not? Hashed or open? I just have no idea what it is.

And I dont think that anyone here has forgotten by any stretch how helpful you have been to the project, probably more so than anyone. I have no doubt your name will be at the top of every "thank you" list.
[Xperia Play Android Development] ashergray:
Agreed, blagus was a huge help in all my research.
[Xperia Play Android Development] Mills00013:
While we're busy waiting, lets reinvestigate the original rooting methods.

Lets assuming for example that the Gingerbreak exploit wasnt patched for our devices. Maybe our devices have different values in different places. Lets just assume for a second that its simple variables that need to be changed in the Gingerbreak code.

I dont know if anyone actually investigated that. We all jumped to the conclusion that it had been patched simply because it didn't work the first time. Check out this post near the beginning of the D3 rooting thread: here.
[Xperia Play Android Development] Mogul345:
Another thought - Could we attempt something like unrevoked is doing? Do Sony phones have the same sort of S-On/S-Off concept?
[Xperia Play Android Development] Mills00013:
Updating first post with new news of root brought about by the unlocked bootloader.
[Xperia Play Android Development] ashergray:
I love how you put that. Free.

maybe it is just a certain setting in the kernel that causes it to go nuts like it did. perhaps now we can get some DEV love and get Cyanogen mod on here :D
[Xperia Play Android Development] Mills00013:
Im watching logcat while everything is going. I can confirm my 3g is working and the phone is responding fine. Its just god awful slow. Realized its probably because the kernel i just flashed is probably clocked to like 50mhz or something like that. I side loaded setcpu and im trying to get into it now. Will update once I can throw the clock speed up.

Also thinking with this working like its working, ash, there is a good chance CM will just work. Probably very little difference. Like I posted earlier, CWM is working flawlessly and we are booted with live radios. That is a really really good thing.
[Xperia Play Android Development] ashergray:
good luck keep me up to date on how that goes.

I had wondered if that might have been the reason myself.
[Xperia Play Android Development] Mills00013:
This speed is hopeless. I'm taking the plunge.... I'm gonna flash FreeXperia's CM and see where we end up. Wish me luck.
[Xperia Play Android Development] ashergray:
well I have the entire stock image here. if you need it, you could try xrecovery.

but if you have flash tool and SEUS you can decrypt the blob_fs files and make a flash using that if you screw up.

GO FOR IT!
[Xperia Play Android Development] Mills00013:
I have a tft file already made, but its on my computer at work. I'm not really worried about bricking; I know that I can get myself back into fastboot mode and thats all I will need to flash the tft with flashtool and that will bring me back to 100% stock, minus the locked bootloader state, of course.

And if i brick, I'm not out anything. I got a D3 to play with as well so I'll have my backup if i need it.

Ya know the other thing, too, is i just made a backup in CWM of my entire system with that kernel, at least its somewhat bootable. The way that CWM is setup, it can be booted from fastboot directly, so worse comes to worse, i can boot CWM from my computer locally over fastboot and restore my backup :)
[Xperia Play Android Development] Mills00013:
Updated initial post with basic root instructions that should get you to a stock rom build with su and superuser. All systems go.
[Xperia Play Android Development] NeoandGeo:
I finally have root, but I can't get Wireless Tether to work with the stock kernel. Is there a specific version I need?

What the latest version does is starts out fine, but then the Verizon hotspot notification pops up for a second, then disappears and I have no connection to the Verizon network at all forcing me to reboot. Tried the newest version before the 3.0 betas, and it exhibits the same behavior. It's like Verizon is disabling my connection because I am doing something they deem illegal on their network. :|
[Xperia Play Android Development] Mills00013:
Thats exactly right, its built into the kernel. You will need to replace the kernel with something custom in order to get around that.
[Xperia Play Android Development] NeoandGeo:
Ahh, gotcha. Can't wait for CM7 nightlies!
[Xperia Play Android Development] crono141:
I'm having the same issue. If you open the browser after you've tried to enable tethering, it actually pops up the Verizon add page to sign up for mobile hotspot. So I think the packets aren't getting routed properly.

New kernel would hopefully fix it.
[Xperia Play Android Development] Mills00013:
Verizon has modified their version of iptables (as i understand it) that sit in the kernel. So yeah thats exactly whats happening. Your requests are all getting redirected. Now that the bootloader is unlocked though, Verizon will have no part of our devices. They are completely free from the tyranny of big red.
[Xperia Play Android Development] Krislawl:
how did anyone manage to enable usb debugging for the adb shell part? my kernal made my phone EXTREMELY slow to the point where it can't do anything
[Xperia Play Android Development] Mills00013:
Good to hear that it's slow. I've been trying to verify that over in the State of Development thread.

If you have one of those kernels that's slow, you dont NEED to enable adb. Its a persistent connection. At worst, you can restart and get into recovery by mashing the volume keys (or at least you can on the freexperia kernels) at bootup time. That will have an adb connection as well.
[Xperia Play Android Development] Krislawl:
Alright I flashed the stock kernal back into it successfully through adb, but my phone is stuck in the Sony Ericsson boot up screen.
[Xperia Play Android Development] ashergray:
You may have to reflash everything back to stock.

sent from the original unlocked R800x.
[Xperia Play Android Development] Krislawl:
Could you list what all is needed?
[Xperia Play Android Development] Mills00013:
Another thing to consider is that I went to CWM between every single flash I did last night, kernel or system. And wiped data/cache and dalvik everytime. This could be causing the issues for you. But I would agree with ash this time, despite his bastardly, jealousy-inducing signature, you should probably try to flash the tft file when we get it uploaded.

And ash, if multiupload is going to slow for you can always try mediafire. its awesome too.
[Xperia Play Android Development] ashergray:
Probably most of the. Sin files

Kernel and System first to see if that resolves it otherwise you may need the whole ftf file from the seus blob file. I can make it and upload it tonight. If you do.

I am making the full stock(minus simlock.ta) TFT file it should be uploaded in about an hour.

sent from the original unlocked R800x.
[Xperia Play Android Development] Krislawl:
A system.sin flash fixed it, now I'm going to repeat the steps and hopefully correct an error I made

:EDIT: I now have a rooted and unlocked r800x with all of verizons crap apps removed. yeAAHAAH, asher youre the man
[Xperia Play Android Development] Mills00013:
Great to hear it! Just wait till we get CM running.
[Xperia Play Android Development] typikal82:
Man I wanna root so bad, but I'm scared to mess up my device

I had my OG Droid as modified as could be
[Xperia Play Android Development] gwaine:
Hey Typikal...I'm in the process of rooting mine. I'm a (computer literate) Android noob and I've messed it up kinda bad (it's stuck at the Sony Ericsson screen and the ADB shell command doesn't work) but the folks in another thread are being really helpful. Once I've got it all straight I'll write a little guide written from the perspective of a noob.
[Xperia Play Android Development] Mills00013:
hey when/if you do that guide, put it in this thread and I'll amend it to the original post so that everyone can see it here.