yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] Leoisright:
I saw that too. Can we compare that with an ota to see if the key is in there then maybe figure out a way to make a smart_io file with the key and instructions on what we want? Forgive the ignorance if way off base
[HTC EVO 3D] ScrapSilicon:
@xHausx ..

oops /system/system
[HTC EVO 3D] xHausx:
The code they give is assembler, which would need to be changed to work on ARM processors. They also leave out the exploit part of it which is what we need.
[HTC EVO 3D] jimbotron:
Nit sure if this would help

theandroidsite.com/2011/06/04/htc-sensation-found-in-france-rooted-with-s-off-engineering-boot loader
[HTC EVO 3D] xHausx:
saw that on FB too, old news. We have an eng hboot but are in the same situation they are, no root.
[HTC EVO 3D] will75:
Is this exploit, the attachments we get in spam mail called "UPS" etc.. delivery notification or "package? " I am sure with enough googling someone can find the infected file
[HTC EVO 3D] Shaquiel Harris:
Wonderful. Gotta love you guys. I swear I'm the only one from the sensation forums who is trying to help the cause lol. :p Will be back on my own comp in a moment to help.

Sent from my HTC Pyramid using the XDA Premium App.
[HTC EVO 3D] pinky059:
I have experience in assembly language, not sure about ARM processor assembly language though...

Let me know if I can help..

I also know ALOT of SQL and PL/SQL (Oracle) which owns Java, so let me know.

;)
[HTC EVO 3D] retnuh730:
So if the flash vulnerability is real, is there any way to patch it without us manually downloading the patch from the market? Basically is there any way htc could stop us without us downloading an update from them.
[HTC EVO 3D] xHausx:
You're just the person we're looking for then :D

I can do C with a little bit of research and a lot of trial and error but Asm is past me. Right now I'm just trying to find out it would be easier to try finding the exploit they used or to come up with a new one.

If it is on the system partition they would have to push an OTA to fix it. I haven't looked yet but HTC is good about fixing security holes, I would be willing to bet money that this was one thing that was fixed in the last update.
[HTC EVO 3D] Shaquiel Harris:
I don't get your question. If your asking could HTC stop us from using flash unless we update or something then no. Besides, HTC doesn't own Flash or anything, and we could always just find an old apk with the vulnerability in it.
[HTC EVO 3D] retnuh730:
Since Flash is a system app could we even install an old app on top of it? Plus doesn't the app need to be in /system for an exploit to even be worth it?
[HTC EVO 3D] xHausx:
It has to be placed there by an OTA update, just installing it as a regular app won't help us
[HTC EVO 3D] Leoisright:
Ok, if MD5 calculates the size of the file, can't we technically make the size if the file what ever we want pretty easily? Still thinking using an ota to manipulate the system may be a good attack point.
[HTC EVO 3D] Shaquiel Harris:
Oh i see what your saying. Hm, i think we could go on market and we could go to the app and probably click "uninstall updates" on the flash to go back to a older version of it since you usually can. I thought that flash was flash lite?
[HTC EVO 3D] Shaquiel Harris:
I must have missed alot, and i just read the past pages. you guys's OTA update(s) have exploits in them or something? I'm lost now.
[HTC EVO 3D] retnuh730:
Well the flash we have now is the oldest version we can stick with since it's in /system. We can install newer versions but we can't roll further back than the flash it shipped with.
[HTC EVO 3D] xHausx:
This is actually why I mentioned not taking updates, the version the phone shipped with is over a month old and has a few known security holes where the newest OTA has probably fixed them all. The one we're looking at is called a zero day because that's about how long they last after they are found.
[HTC EVO 3D] jhuff83:
I saw in the faq that some lucky people had their phones shipped with s-off. Haus were you able to get in contact with any of those people?
[HTC EVO 3D] xHausx:
still looking for them, RVDigital said he saw a bunch of them but wouldn't say who or give any more info about it...
[HTC EVO 3D] retnuh730:
What version is the stock flash without any OTAs? Mine's 10.2.157.49
[HTC EVO 3D] Shaquiel Harris:
Random..Multi Quote works again for me.:cool:

Yeah i understand that, sometimes, in SOME cases you could thats all.

What version of Flash are we looking at anyways? Just wanted to make sure i was up to par with you guys. My pyramid came out before this anyway and mines seems slower/unoptimized compared to you guys's so i should be good to go, just wanted to make sure.
[HTC EVO 3D] Saleenfiend:
C++ EXP here.

Is there anyway we can push a previously leaked RUU in with an Exploit-able flash/reader file/version?
[HTC EVO 3D] Shaquiel Harris:
Expert huh? Welcome to the forum. :cool::)

I don't think it will work at all. the phone does a double check of the ruu's and what not and even the SLIGHTEST change in it, it won't go through.
[HTC EVO 3D] Saleenfiend:
Experience. Haha.. I wish.

Could we use the Sprint file... fotasign_Pubkey.Der?
[HTC EVO 3D] Arnezie:
That would be great if we could find somone who has one, It would be alot further ahead.
[HTC EVO 3D] Saleenfiend:
Someone was supposed to dump theirs but IDr what hapoened
[HTC EVO 3D] Shaquiel Harris:
Ah, my apologies. :) I honestly don't know. I think you should talk to leoisright when he's back on.
[HTC EVO 3D] xHausx:
I was able to roll back to the stock RUU posted here in the dev section but I think it's the same for the most part. If you're wanting to modify it than no.
[HTC EVO 3D] chumba8:
so if i did the ota and the ota messes up the root process I can RUU back to the old one? Sprint updated mine for me while i was there without knowing it
[HTC EVO 3D] Shaquiel Harris:
How were you able to? I don't think we were able to. I would LOVE to roll to a stock ruu for my sensation without this bloatware and what not.
[HTC EVO 3D] l33tlinuxh4x0r:
stock meaning stock htc with the bloatware
[HTC EVO 3D] Shaquiel Harris:
hey guys, check this out, from the IRC

<MACK1E> hey guys i just talked to a guy from xda on the phone, he works for sprint. he is telling me there is an RIL file on the sdcard that could give us the keys to unlocking this bootloader, has anyone heard of this
[HTC EVO 3D] xHausx:
you can give it a try, the RUU is still on the first page of this section
[HTC EVO 3D] alchemist316:
Xhausx did u ask what bl checks for in bootloader or u figure it? ??

Shooter
[HTC EVO 3D] pinky059:
IF we do in fact explore the Flash or Reader exploit, does anyone know where we can get the code for it? :)

Can anyone get a hold of the actual
[HTC EVO 3D] xHausx:
dont quite understand what you're asking, hboot = bootloader lol

I started looking but got distracted by more people saying they found the SMART_IO.CRD file. Still waiting on someone to find the SMART_IO.CRD file... lol
[HTC EVO 3D] alchemist316:
Yea sorry and it checks for a bunch of pc86diag and some others none that are found??

I have a pic of all of it from my other evo

Shooter
[HTC EVO 3D] Knucklessg1:
Can all of you please read this? http://xdaforums.com/showthread.php?t=1137758

It would definitley speed up the root for both Sensation and EVO 3D.

TL;DR This thread says it all, the file we are looking for SMART_IO.CRD, and it is hidden on the Stock SD card. You need to open "dd" on ubuntu and copy the sd card "block by block" so you can copy the SMART_IO.CRD file and open it, This file holds the key to run signed code onto the bootloader.

If we combine our forces, we can achieve this faster, thanks!
[HTC EVO 3D] xHausx:
It does when you go into the bootloader ya, those are signed the same as RUUs though. Ariel on IRC said it looks for a file named PG86000.img when booting up too but I dont know anything about that one
[HTC EVO 3D] alchemist316:
Shooter
[HTC EVO 3D] geebs:
http://www.exploit-db.com/exploits/17175/

Not sure if this is the code for the .swf, not too familiar with Adobe Flash. Figure it might help whomever if our stock Evo 3D Flashplayer (10.2.157.49) is exploitable.
[HTC EVO 3D] johnsonjs:
I still have a virgin 3VO (never booted) that I can pull the card from. I can boot into a Live Ubuntu version but not sure you what you mean by "dd" . Thanks
[HTC EVO 3D] gtkansan:
I have one as well. Dual booting ubuntu narwhal. Can you tell me specifically what you would like run? If you can be specific I can open up the box and get you whatever you want (provided it is there :) ).

EDIT:

I also have a rooted evo shift. COuld I take the unbooted card out of my new 3VO and stick it in the EVO shift to look at the files? Would this help?
[HTC EVO 3D] cuban4lf:
<?xml version="1.0" ?>

- <adept:deviceInfo xmlns:adept="http://ns.adobe.com/adept">

<adept:deviceClass>htc_shooter</adept:deviceClass>

<adept:deviceSerial>HT169HX02542</adept:deviceSerial>

<adept:deviceName>HT169HX02542</adept:deviceName>

<adept:deviceType>mobile</adept:deviceType>

<adept:version name="hobbes" value="9.2.35142" />

<adept:version name="clientOS" value="Linux 2.6.35 armv7l" />

<adept:version name="clientLocale" value="US" />

<adept:version name="clientVersion" value="HTCReader" />

<adept:fingerprint>qYi1WZZYyis53Mh0CIHagOCA3mg=</adept:fingerprint>

</adept:deviceInfo>
[HTC EVO 3D] wrxtc714:
More wrong info

I posted this suggestion pages back for you fools that don't read first

Booting into clockwork from the sd card will allow you to flash a rom to internal memory. Yes it will run a rom straight from the sd card but the purpose of the clockworkmod boot is to let you install your rom to the internal memory.

Don't know why you think it leaves the stock rom "INTACT"

Once again the purpose of this is to install a rom on the internal memory

I have looked into it and tried it and unfortunately it won't work on the evo 3d

Please stop posting Garbage people
[HTC EVO 3D] Saleenfiend:
Enough.. jibber jabber to the PMs please. This is annoying.

1. We are able to accomplish reverting to an original RUU

2. Some 1.3 hboots gain a limbo type temp root with zroot

3. Need Smart Card (on SD?)

4. Need some RIL file (on SD?)

5. Need to figure out what PCB86000.img is

6. Need to decode/decifer figure out what the fotasign_pubkey.Der file is

7. Possible exploit with 1.3 RUU and older Adobe version
[HTC EVO 3D] Shaquiel Harris:
@haus..

C:\SDK\tools>fastboot oem writesecureflag ?

... OKAY [ 0.047s]

finished. total time: 0.048s

his is completely different.. it just skips it. should i ask him to fastboot oem writesecureflag 0 just to see what it does?
[HTC EVO 3D] jcase:
I dont see how z4root would do anything, considering that it is long ago patched, and i have no clue what "limbo root" is. I assume this is a poor assumption based on an app not responding correctly (z4)

Smart cards use sim slots, not sdcards. Will do you no good on a CDMA device.

RIL is radio interface layer, not sure what it has to do with root

fotasign_pubkey, its hte public key for OTA, you cant decode/decifer it.
[HTC EVO 3D] darkflame:
Can we use FOTASIGN_PUBKEY to sign our own firmware? Or is this the key the phone uses to do it's dirty work.

If not can we replace this file with a generated pair that we make ourself and sign the rom using the other half of that pair?
[HTC EVO 3D] jcase:
ITs a public key not a private key
[HTC EVO 3D] urcboss07:
I wonder whether anyone tried to unlock bootloader the way people did on Nexus S. Will this method work? I tried on windows 7 X64, but I couldn't get android sdk to download thru when I opened SDK Manager, any advise?
[HTC EVO 3D] mattfmartin:
Are you talking about adb fastboot oem unlock?
[HTC EVO 3D] urcboss07:
Yes, adb fastboot oem unlock, then do Recovery. It should be exact method that we unlock bootloader on Nexus S.
[HTC EVO 3D] xHausx:
nope, that's what they used on the nexus one but they have something different with their newer ones. fastboot oem writesecureflag 0 should do the same thing but it looks for a smart card in order to work
[HTC EVO 3D] zonyl:
RIL file? Dont see anything on the 8GB card on a quick scan. Dont see why a the htc private key would be sitting on an sdcard at any point in time. Is that all the information they have?

I am assuming that if vold was exploited, the rild code has been poured over already thousands of times as well.

Surprised I havent heard this requested on FB, but where is the HTC kernel source for this device? That they are legally required to give us now and may expose a driver exploit / etc.
[HTC EVO 3D] smw6180:
They have 30 days to release the source, legally.
[HTC EVO 3D] Leoisright:
As far as I understand the license. They only provide source code to android not kernel. Correct me if I'm wrong.
[HTC EVO 3D] zonyl:
Linux = gpl v2

http://www.gnu.org/licenses/old-licenses/gpl-2.0.html

I thought only gpl3 added a 30 day cure. http://www.gnu.org/licenses/gpl.html#section8
[HTC EVO 3D] smw6180:
The kernel is also open source.
[HTC EVO 3D] sgt. slaughter:
Android is opensource from Google so you already have the source for that. you will not see HTC release source for their sense version of it though. They will however release their(HTC) kernel source. developer.htc.com is where it will pop up.
[HTC EVO 3D] CheesyNutz:
What is an RIL file google comes up blank

E3D
[HTC EVO 3D] nick cannon:
The RIL file contains updated drivers and setting to work with a specific Radio version. (RIL) radio interface layer
[HTC EVO 3D] Doward:
Can anyone give me more info on this? I've got busybox executable in /data/local/tmp, but I'm not savvy enough to exploit it.
[HTC EVO 3D] tcmoon:
I have adobe flash 10.1.106.16 & I was able to install. Not sure if their still looking into flash exploits. I noticed the first page no longer shows updates.
[HTC EVO 3D] cordell12:
Remember that RUU that leaked way back, uit had like 3 or 4 diff phone models in build.prop. Being that these devices are nearly all identical, IF that RUU had a Eng H-boot, perhaps, maybe by luck, it would run. Allowing us to apply the Eng H-boot we have that is for our device only, maybe?
[HTC EVO 3D] lawnguy:
To get unrevoked to read turn on your debug, and all drivers installed, bet it reads. Debug is off by default on these.
[HTC EVO 3D] Arnezie:
What?? UnrEVOked has been tried several times by several people and it does not work.
[HTC EVO 3D] puertoblack2003:
runnign this command "fastboot oem readsecureflag" i got his

(bootloader) secure_flag: 3

OKAY [ 0.009s]

finished. total time: 0.009s

so that mean i have that SMART_IO.CRD on my sdcard?
[HTC EVO 3D] l33tlinuxh4x0r:
no, your phone/adb can read stuff all day but you need the file to write stuff.
[HTC EVO 3D] SideKick2:
I don't have my new evo yet but it worked on sensation. Can anyone try this...

http://justamp.blogspot.com/2011/05/how-to-root-htc-sensation-android-23.html

"HTC Sync needs to be temporarily removed; the instructions for uninstalling the HTC Sync can be found on the internet "
[HTC EVO 3D] kcodya:
Gingerbreak doesn't work anymore.
[HTC EVO 3D] SideKick2:
Have you disabled the sync?
[HTC EVO 3D] l33tlinuxh4x0r:
I just disabled all sync and am running gingerbreak... lets hope that it works, but I really doubt it.

EDIT: didn't work :(
[HTC EVO 3D] cordell12:
running both gingerbreak and gingersnap at the same time. gingersnap runs from PC, it gets past the first part "setting permissions" but seems to stick @ stealing the soul :(
[HTC EVO 3D] l33tlinuxh4x0r:
confirmed 10char
[HTC EVO 3D] dj_L:
I attempted to use libc.so from a 2.2 stock ROM. but exporting LD_LIBRARY_PATH didn't work. While I managed to find _a_ bug, it was unusable (unless temporarily loosing the ability to use adb/fastboot is usable in some way). I suspect that the installed binaries are compiled with rpath-link. PATH munging did nothing as well. I do not have a working development environment, so I haven't actually verified that rpath is used. Native tools such as readelf and ldd would be nice to have on the device if somebody would like to share, but I have no multi-lib system available currently (and no plans to create one) so I'm too a dead end ATM.
[HTC EVO 3D] CheesyNutz:
interesting this was shown in irc

http://i.imgur.com/KiR6J.jpg
[HTC EVO 3D] Product F(RED):
I don't know, it looks fake to me. The font doesn't look like the one on the hboot screen, especially since the one on the hboot screen is grainy because the font is low-res and the screen is high-res.
[HTC EVO 3D] daneurysm:
Unfortunately that looks very fake.
[HTC EVO 3D] retnuh730:
http://xdaforums.com/showthread.php?t=1142409
[HTC EVO 3D] bluediablito:
just a quick question

what has the key on the phone?

how big is the inscription of the key?

why not brute force in order to get the key and sign files to update?
[HTC EVO 3D] l33tlinuxh4x0r:
brute force takes years to break encryption. (unless you get very lucky)
[HTC EVO 3D] daneurysm:
not enough computers, not enough time and depending on the key there might not be enough energy in the entire universe to power the operation until completion...in theory

The key might be 255 bits of 0 and the 256th bit is 1....
[HTC EVO 3D] cordell12:
I opened the Hboot in Notepad, why are so many phones listed in our current 1.30 Hboot?

pyramid_backlight_off pyramid_init_sd pyramid_init_display pyramid_init_backlight ÿ¥ pyramid_init pyramid_i2c_qup_init pyramid_aic3254_loopback doubleshot_backlight_off doubleshot_init_sd doubleshot_init_display doubleshot_init_backlight doubleshot_init doubleshot_i2c_qup_init doubleshot_aic3254_loopback shooter_backlight_off shooter_init_uart_to_MSM shooter_init_sd shooter_init_display shooter_init_backlight shooter_init shooter_i2c_qup_init shooter_aic3254_loopback verdi_init_backlight verdi_tmo_gpio_init verdi_vzw_gpio_init verdi_att_vzw_tmo_pmic_gpio_init verdi_common_gpio_init verdi_spcs_gpio_init verdi_spcs_pmic_gpio_init ! verdi_init_vee_chip verdi_init_display verdi_umts_gpio_init verdi_umts_pmic_gpio_init verdi_att_gpio_init verdi_i2c_qup_init verdi_init rider_backlight_off rider_init_sd rider_init_display rider_init_backlight rider_i2c_qup_init rider_init rider_aic3254_loopback shooter_u_backlight_off shooter_u_init_sd shooter_u_init_display shooter_u_init_backlight shooter_u_i2c_qup_init shooter_u_init shooter_u_aic3254_loopback dhdsdio_download_nvram bcm_iovar_lookup bcmsdh_iovar_op dhd_prot_ioctl dhdsdio_download_state dhd_init ai_addrspacesize ai_addrspace Ü|€8 2 8 2 wlmnRateSet |€§KÞ Ñ"á$'a)Ô+m.-14-7r:é=”AwE”IñMRsW¢\bïgnžt‡{Ù‚™ŠÐ’ƒ›º¤|®Ó¸ÇÃ`ÏªÛ®èxöbcmsdh_cfg_read bcmsdh_send_buf bcmsdh_recv_buf bcmsdh_reg_write bcmsdh_reg_read msm_nand_block_isbad msm_nand_dm_write_oob ÿÿÿÿ ìª ÿÿ ÿ

crack one and we crack them all!
[HTC EVO 3D] zonyl:
HBOOT = RSA-2048-SHA1 Signature Decryption

Thats a big signature to guess ;)

"RSA claims that 1024-bit keys are likely to become crackable some time between 2006 and 2010 and that 2048-bit keys are sufficient until 2030. "

Found a paper that estimated the cost of brute forcing at 2048 on Amazon cloud would be around $200,000,000,000,000,000 - $1,000,000,000,000,000,000 (One Quintillion dollars) With the trend value of the dollar recently you had better get started now.
[HTC EVO 3D] alchemist316:
i have all those leaks still well double shot , all the shooters and pymid are all signed by the same person ?
[HTC EVO 3D] Zarboz:
well have to use a method like for DHD phones with gold card possibly then

but without temp root that wont get us anywhere because we cant write the hboot without s-off

i was thinking something like what we had for DHD but idk if that would work

just throwin ideas around
[HTC EVO 3D] myn:
Absolutely fake.

BTW. For those who aren't on IRC (irc.freenode.net #htc-evo-3d)

Come join us :) 184 peeps and counting :)

Either download mIRC for windows or you can use the web client here:

http://webchat.freenode.net/?channels=htc-evo-3d
[HTC EVO 3D] johnsonjs:
HTC response (more encouraging)

Dear Jackass, <--- what he wanted to call me

I understand that you are wondering when the HTC EVO 3D will have its boot loader unlocked. We’re pleased to announce that we have heard everyone’s comments and constructive suggestions and have decided to go forward with this initiative. However, at the time of the announcement the EVO 3D was indeed finalized and was thus an existing device, hence why it shipped with the locked bootloader. We currently don’t have concrete information regarding which existing phones will be unlocked, though from my understanding the EVO 3D will be among that number. Keep an eye on our official website and official social media outlets for announcements about which phones will be bootloader unlocked and when, as just with any update we don’t have official information as to when it may take place from here in Technical Support.

To send a reply to this message or let me know I have successfully answered your question log in to our ContactUs site using your email address and your ticket number ^^^^^^^^^^.

Sincerely,

Philip

HTC
[HTC EVO 3D] kthejoker20:
I wonder if the fastboot from the RUU will allow you to write hboot image vs. normal fastboot

I've been tinkering with the RUU and extracting files. Hboot and Recovery specifically have "signed" in the file names, as to taunt us....ugh....

Tried loading .76 bootloader no luck yet.
[HTC EVO 3D] xHausx:
hmm, a bug? Anything out of the norm is good at this point. You just reminded me I have ld too, lemme find it and I'll post it for ya.

edit: found it, you'll need to change the paths on it to run from /data/local
[HTC EVO 3D] xHausx:
If you have taken the update is is most likely patched, if not then there is no way you are since it wasn't known about yet.
[HTC EVO 3D] xHausx:
It has to be ran as a system file, which means it has to be installed as part of the ROM. This is why you never take OTA updates if you plan on rooting.
[HTC EVO 3D] Rydah:
Hate to sound like a noob, but which update? Adobe or OTA? (Im assuming OTA since you can uninstall Adobe updates.)
[HTC EVO 3D] xHausx:
OTA, while locked that and RUUs are the only way you can change the system files

yup, you can do a factory reset and it will undo the updates. That is if we are able to use it though...
[HTC EVO 3D] Kidmet:
Ok, this could sound noob, but if the OTA changed the bootloader version, is there a way to get the OTA file and find where its changing the bootloader as a possible exploit?
[HTC EVO 3D] tcmoon:
Now that sounds like a good idea.
[HTC EVO 3D] DomSim:
the ota and ruu's can modify anything they want because they are signed by a trusted source. modifying the file in any manor will nullify the signature and will no longer be able to be run. the devs already know how to replace hboot and recovery and such, it just cannot be done right now because of the signature check.
[HTC EVO 3D] ajones7279:
What I got from them.

Dear Antonio J,

I understand that you are wondering when the HTC EVO 3D will have its boot loader unlocked. We’re pleased to announce that we have heard everyone’s comments and constructive suggestions and have decided to go forward with this initiative. However, at the time of the announcement the EVO 3D was indeed finalized and was thus an existing device, hence why it shipped with the locked bootloader. We currently don’t have concrete information regarding which existing phones will be unlocked, though from my understanding the EVO 3D will be among that number. Keep an eye on our official website and official social media outlets for announcements about which phones will be bootloader unlocked and when, as just with any update we don’t have official information as to when it may take place from here in Technical Support.
[HTC EVO 3D] Saleenfiend:
I was under the impression previous hboots still had a patched Adobe version.
[HTC EVO 3D] xHausx:
The hboot is the bootloader while Adobe and the actual ROM is on the System part. One of the exploits were looking at was just found last week where the stock ROM the phone is shipped with is over a month old.
[HTC EVO 3D] Saleenfiend:
So, If we could push an exploitable version to the phone (pre patch) we could have used it? Although there is no way without root, temp root, or we have the key. (which then We wouldn't need adobe)