yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] Leoisright:
As of now we can't adb at all during recovery. Is there another method. Someone mentioned telenet or something like that

Sent from my 3VO..
[HTC EVO 3D] mastibeta:
My understanding leads me to believe it just allows the bootloader to point the files to the ROM install reference. Like: IF signature verification = true Then ref 0x4000 or w/e it is set to, so my thought would be to try and slip in the su during the write to ROM segment.
[HTC EVO 3D] mhespenh:
I'm going to explore other communication methods in recovery tomorrow
[HTC EVO 3D] AyyRayy:
Let's go today I'm down for any suggestions

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] urcboss07:
I just want to share the info that I got from Sprint chat today. I activated my 3D online on 06/22/2011 and I activated the phone successfully with email confirmation with msl 6 digits activation code but some how that code is wrong. I tried to do ##786# and entered the code that I got after I activated the phone, it kept saying the code is wrong and it is wrong. Then I chatted with Sprint this morning to request the msl code, the rep told me the msl code is hidden in the encrypted form. I asked how is about the code that I received when I activated the phone online, rep did not answer me and they gave me another 6 digits code, then I do ##786# enter that new code, it worked. That's why I think HTC 3D has encrypted file that most codes are hidden under this encrypted form, may be Bootloader code as well? Can someone ask Sprint how to access the encrypted form in 3D? Thanks
[HTC EVO 3D] xdviper:
The Sensation has the flashlight app... It won't do much for the Evo users but it's still one step closer to getting temp root for the Evo users... Any devs working on the sensation?
[HTC EVO 3D] tomyboombotz:
Can't we take files out of the aigned and replace it will the unlock boot and flash that so it thinks it signed and it think its flaging a signed boot but the files are actually s-off files
[HTC EVO 3D] thedarkpassenger:
What would be the point of signing it if that were possible? Modifying files changes the signature...
[HTC EVO 3D] AyyRayy:
If you even think about touching signed files they break . Moving and replacing needs a new sig

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] desairs:
Wtf are you talking about? There is a one time msl and a permanent mal....
[HTC EVO 3D] mlin:
Thanks to everyone trying to make this happen. I have enjoyed reading through all of the great and intriguing ideas in this thread. Many times I have no idea what some of you are talking about which makes me appreciate your work that much more. Thanks again and best of luck!
[HTC EVO 3D] AyyRayy:
Love the support :D

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] rockypr:
Guys don't know is this is useful or not, or has been talk but if you press..

##3282#

There is one option that tells you USB Charging... Maybe that has something to do with ABD?
[HTC EVO 3D] AyyRayy:
Quick question. Does the 3d camera button have any impact on bootloader or recovery combinations. I used to work on droids a while back and the camera button had functionality in recovery

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] steal25:
I dont have the slightest clue if this is even possible but just throwing it out there-

what about going through the phone itself, like adding a contact that when dialed accesses root, or the phone hacked to be a sort of installer to install a hacked contact/app when dialed, like i said I have no clue just trying to help you guys that are gonna be able to get this done. Haus,leo,Aray,chubbz and everyone else working on this I have more faith in you guys than I do HTC!
[HTC EVO 3D] Leoisright:
Lol, **** mlin, half the time I don't know what I'm talking about. :). Then again, I can't always put on paper (or text) what my brain is thinking.

Thanks for the positive comment. These comments go way further than people posted crap about not gonna happen or just the pesamistic people.

Sent from my 3VO..
[HTC EVO 3D] AyyRayy:
+1 on that. Lol that's awesome you guys support us. If you guys have any ideas just give a shout out. At this point anything is worth a shot

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] Kingmac38:
If this was the case then I would not have been able to get my msl from cdma workshop.....
[HTC EVO 3D] panamaniac:
Pep Rally

Mega dittos from me: it's amazing to watch you all work.

And it still blows me away how....empowering..and..RIGHT...it feels to try to root (I'm new in this world). It's our goddamn phone! But instead, we're in this strange era of history where consumer goods are sophisticated enough to be "ours" yet actually they are working for the seller--> for example having demo apps you can't uninstall...

What I'm saying is that a non-rooted phone is sort of like Angry Birds: slick, enjoyable, but with an ulterior motive (ads, etc.)

Ok, enough ranting.

MORE POWER TO YOU!
[HTC EVO 3D] urcboss07:
That's why it is strange to me, I always get one msl # on each device that I own but this time is completely strange, I got 6 digits code thru email after I activated the htc 3D but when I input that code, it says the code is wrong. I tried to enter many times one number at a time, it is still not correct, then I decide to contact Sprint about the code I got in email confirmation, Sprint told me activation code is hidden under encrypted form of htc 3D. Then they gave me the new msl code, after I input the new code, it works and I can reset my phone as normal. That's what I want to know if sprint knows about the encrypted form, then they should know about the bootloader encrypted code. Just an idea.
[HTC EVO 3D] p3tr0s:
as long as I've been messing with sprint phones there have always been two programming codes. both are six digits but one is used to program the phone the first time, the second is the msl. if you swap phones online you see both codes.
[HTC EVO 3D] panamaniac:
Yeah, I was given 2 MSL codes for my phone when we manually activating it over the phone. One worked, the other didn't (wrote them down I think)
[HTC EVO 3D] Vinchenzop:
What youre basically hinting at is adding a code to the epst function of the phone...even if we could edit that, theres no way to add the edited program/apk to system/app...if we could add/push that, we may as well just push su to system/bin
[HTC EVO 3D] Randy D:
Terrified to post on this page, thought I learned not to... But... Got off the phine with sprint, said the firmware update was a problem with netflix. Why update firmware because of that? Isnt that on netflix end? weird.

Maybe a problem with green hornet conflicting, htc hub
[HTC EVO 3D] sgt. slaughter:
my off the wall idea is still to do something with the HTC transfer app that transfers everything over bluetooth like contacts sms and such, and in the process have it transfer over a exploit or something along those lines...

long day at work here so far. lol brain is fried
[HTC EVO 3D] AyyRayy:
Iv been playing with that and iv got some ideas ;) hopefully my brother's EVO could do the trick

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] mastibeta:
I dont think this has r/w permissions to system.
[HTC EVO 3D] mazook98:
I just got off the phone with Sprint as well...I initially just called to get my MSL, to change proxies, blah, blah, . Anyway, while I was talking to the girl, I mentioned my GPS wasn't as accurate as it was on my EVO, and had slightly better 3g connection speeds,yada...Anyway, here's where it got interesting..She finally told me that if adjusting things with the MSL didn't help, and I got better speeds before the Ota (which I hinted at), then I could set up an appointment at, and only at, a Sprint Corporate Service Store, and they could take off, or reverse the OTA. (That would in turn deprecate the bootloader from 1.4 to 1.3, correct?) I had her check, double check, give me the contact and location of the nearest one. This would mean someone at (I'm guessing) every corporate store has the access key we all need, correct?
[HTC EVO 3D] sgt. slaughter:
you might be right there.

I was just going through the system apps and that onee crossed my mind b/c it actually transfers stuff onto the phone but didn't think about where the stuff is transfered or if that could be controlled to our advantage.

didn't leo post up all the system apps that had write access to the system earlier?

One would think there would be an exploit in youtube app somewhere....

also is there not a way to possibly install an app that has system write priviliges from the market or outside, or is superuser and such the only way that works?
[HTC EVO 3D] CrippleB:
Sorry if this is wrong, but I saw the flashlight idea a few pages back. Isn't the "flashlite" and "flashlight" two different things? Flashlite is a flash plugin and flashlight the flashlight app. I just thought in leos speedy thread someone pointed out that the flashlight apk was removed and the person was referencing the flashlite plugin. Again sorry if I am way off here.
[HTC EVO 3D] TMartin:
Yes. Flash Lite & FlashLight are two entirely different things.
[HTC EVO 3D] desairs:
This is a **** in the dark but what about something similar to a jtag?
[HTC EVO 3D] AssAssiN FtC:
You can go back to a older version of firmware but your bootloader will still be the same.

SeNt FrOm YoUr MoThErS VaGiNa!!!
[HTC EVO 3D] mastibeta:
Next train of thought. Bootloader recieves file, checks sig, decrypts data and then executes instructions. Didn't someone say they were able to get a file to pass verification with minor edits? Or did i dream about that? Literally a 4-6 character edit would solve this entire issue.
[HTC EVO 3D] CrippleB:
Wasn't leo able to get it to 50% then failed when it got to the firm.zip?
[HTC EVO 3D] kellyrx8:
i think this is his post

http://xdaforums.com/showpost.php?p=15181859&postcount=1144
[HTC EVO 3D] agrabren:
Reminder to all... We don't need to write to /system. We really need temp root. There is a big difference. To write to /system requires remounting the share. Temp root gives us short-lived keys to the kingdom. None of the built-in stuff can write to /system except for recovery. But if we can execute a shell as root, we can likely get s-off without ever getting permanent root or writing to /system.
[HTC EVO 3D] Leoisright:
It got about 40% yes, but aparently it failed at signature check affording to another that accessed the UI of the process by power/volume up while ota.

Sent from my 3VO..
[HTC EVO 3D] AyyRayy:
I was also about 40%

It notes it fails whole file Sig check. We can't modify without HTC's private key

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] alammori:
I doubt that here is someone who will unscrew his 3evo to jtag it.:)
[HTC EVO 3D] mastibeta:
Do you still have that zip laying around? Is that the one you posted up? If so, you only changed the hboot to eng correct?

nevermind, thanks aray, didnt realize it was a full sig check fail.
[HTC EVO 3D] Leoisright:
So any suggestions on getting shell of root? If one can access adb shell during recovery.img install we could do a lot of stuff. Like write su to system/bin which would allow us to write all day.

Sent from my 3VO..
[HTC EVO 3D] rugedraw:
Ok, so here's my uneducated and probably already thought of idea:

From looking at dragonfyre13's thread here, I see that one of the things that has all the necessary permissions is the bootanimation:

-rwxr-xr-x root shell 44404 2011-05-23 09:33 bootanimation

Didn't I see at some point in this thread that someone was able to change the bootanimation using QPST? If that's the case, could something be cooked into a bootanimation to be used as an exploit?
[HTC EVO 3D] SAShady:
Ran a modified zip renamed pg86img.zip that I signed with zipsigner2 with the autotest key, and it didn't fail verification.
[HTC EVO 3D] mastibeta:
Alright, last thought process before work. This has already been chimed on, but we have some apps with root shell permissions, that already exist in the sys/app folder...have we tried to modify and install them over top of the existing...as though it was an update?
[HTC EVO 3D] mastibeta:
what was in the zip? it will only hit verification when it attempts to write i believe.
[HTC EVO 3D] SAShady:
It was the update with the hboot removed
[HTC EVO 3D] mastibeta:
have you tried to recompile with the ENG Hboot?
[HTC EVO 3D] liquidjesus:
so it looks like signature verification only fails when writing to the hboot?

can post your zip?
[HTC EVO 3D] chubbzlou:
What zip you modified?
[HTC EVO 3D] Leoisright:
Yes, that is the firmware and actually the original from the ota. No changes.

Sent from my 3VO..
[HTC EVO 3D] SAShady:
I'm doing this at work from my phone.
[HTC EVO 3D] Leoisright:
Say again? You were able to go thru the entire process? Can you modify the firmware with other hboot?

Sent from my 3VO..
[HTC EVO 3D] Leoisright:
Not true, chubbz and I tried all sorts of stuff.

If this is truly the case, we could edit the updater and have it install su to bin possibly.??????

Sent from my 3VO..
[HTC EVO 3D] chubbzlou:
So you took the ota removed the hboot zip it up resign it with zipsigner2 and renamed it to pg86img.img and it installed from the fastboot?
[HTC EVO 3D] clark44:
Read the above post lol. But I don't think he will able to because its not signed. It maybe went through because everything was signed
[HTC EVO 3D] mastibeta:
Very easily, I'm stuck at class til 9 ET...hope i get to it before ya'll i want the credit...lol, but seriously if that zip passes sig check then we will have root in no time...dont even need to get the hboot in the zip, just push su
[HTC EVO 3D] Leoisright:
Yeah but if this is true, it means we could swap in our own stuff possibly. And take out hboot.

Sent from my 3VO..
[HTC EVO 3D] bsims85:
All of you guys will get credit...This is an incredible team effort.

Sent from my HTC Evo
[HTC EVO 3D] Leoisright:
**** dude, aren't you feeling sick???? You need to duck out of school...lol. jk

Believe me, no one will be taking credit away from anyone. We all want the same goal.

Sent from my 3VO..
[HTC EVO 3D] mastibeta:
was a joke, i just want root...if this sig check pass is legit, ill be pretty happy.
[HTC EVO 3D] rdcrds:
It won't pass the 40% we need the keys from HTC last 4 pages i just read of the same thing from 8 pages ago.

Unless we have those we can't get past this 40% area.

I have seen 3 sprint store reps today try this and can't get it to work they also claim we need the keys but keep trying i guess.
[HTC EVO 3D] mastibeta:
He installed a modified zip via bootloader...had to remove hboot to do so, but we dont need to write hboot to get su privledges for a shell.
[HTC EVO 3D] Leoisright:
Ok, chubbz mentioned last night about a md5 checker. What program is there for that because we may need to have that in the updater in order to have it install su to bin

Sent from my 3VO..
[HTC EVO 3D] SAShady:
I unzipped it, removed hboot, rezipped it. Had to have broken the sig
[HTC EVO 3D] mastibeta:
google md5 checker...its an app.
[HTC EVO 3D] kellyrx8:
slap my ass I hope that works, what was in the modded zip, I must have missed it.
[HTC EVO 3D] mastibeta:
just removed the hboot, im off to class, make me proud, lol...back around 9 et
[HTC EVO 3D] novanosis85:
Sometimes when's its to good to be true, it probably is true!!! LOL
[HTC EVO 3D] SAShady:
Yeah it seemed way too easy
[HTC EVO 3D] SAShady:
But maybe signing it from the phone is allowing it to find the correct key?
[HTC EVO 3D] AyyRayy:
I'm going to look into this, but it doesn't make any sense because HTC has to input their private key for their sig? I will report back, this could be a great find =]

EDIT:

tried resigning without bootloader, would not load (hboot PG86IMG.zip)

tried resigning with eng bootloader, no load (hboot)

without bootloader, no load operation invalid (recovery update.zip)

same with eng bootloader

tried resigning via system update with and without bootloader (40% load)

Even resigned the firmware.zip with and without bootloader then the OTA (40% load)
[HTC EVO 3D] deanesn:
The sensation does. This doesn't help the Evo guys but it's something. I can try it on my sensation if any one can point me to the exploit.
[HTC EVO 3D] irock1985:
Watching this thread is like listening to a baseball game on the radio.. Great entertainment just waiting for the Grand Slam lol - Many thanks and much appreciation to all who are working hard at this!
[HTC EVO 3D] wineguy:
I have no clue how to do what you guys do, but I appreciate it. I was just digging around on HTC's site and saw this if it might help?

How can I enter safe mode?

In order to enter safe mode, please turn off the phone. Then briefly press the Power button to turn on the phone. While the phone powers on, press and hold the Volume down button until phone loads the OS and "Safe Mode" should appear on the lower left part of the screen

NOTE 1: If the process does not allow you to enter safe mode, kindly remove the back cover, remove the battery and then place it back in.

NOTE 2: Safe mode is a way wherein you can view built-in applications without hard-resetting the phone.
[HTC EVO 3D] AyyRayy:
Thanks we need all the support and ideas we can get! :D

whoever said they passed signature verification, can you please post your signed PG86IMG.zip so we all can take a look at it. If this is real we can recompile with the eng bootloader and push su to /system/bin
[HTC EVO 3D] shad0w77:
Probably way off base here... But, the google voice app that I downloaded from the market seems to have installed as a system app. Prob doesn't do what you need, but though I would point it out.

Please don't flame me, just trying to add what I can...
[HTC EVO 3D] blakeboys:
sounds like the instructions to enter bootloader....
[HTC EVO 3D] Thaxx:
Cant someone call in and fake a family emergency for this guy?!
[HTC EVO 3D] kthejoker20:
So what your saying is that if I hit the "power" button, the phone turns on?

Sweet.....

10 char
[HTC EVO 3D] shad0w77:
or a bomb threat from a nearby pay phone lol
[HTC EVO 3D] juggaman:
Just tried it. It actually enters a "Safe Mode". Says it in the bottom left. Not sure where to go from there.
[HTC EVO 3D] AyyRayy:
no no no no no this is an entirely different boot he has just told us about.

boot your phone as soon as the white htc screen appears hold down your volume button until the phone loads you into the sense 3.0 lock screen you will see safe mode in the bottom left corner
[HTC EVO 3D] regulator207:
well i tried the safe mode and it worked. dont know what this implies but it's the first i've heard about it. just turn it on and press and hold vol down until it boots all the way. get a "safe mode" watermark in the bottom left of your screen.

edit: double post. i think aray beat me by a few secs.
[HTC EVO 3D] DomSim:
guys, he said he signed it while on the phone. just a thought but can someone try to replicate. unzip the update, remove hboot, rezip resign and try, just to confirm what mastibeta did. if that works then he may have been on to something.
[HTC EVO 3D] liquidjesus:
its not, its an actual safe mode. i'm not sure what it does yet. When i loaded it it give me widget issues that i would see from mismatching kernel...

To get here you only hold the vol down button once the htc screen flashes, not power+vol down.
[HTC EVO 3D] housry23:
Did I try signing it the same way that guy said he did?
[HTC EVO 3D] AyyRayy:
tried everything it wont work for me
[HTC EVO 3D] k2buckley:
Sorry in advance if my thinking is off base. When we used to have themes for the OG EVO that changed things in the status bar, and other things such as rosie and various colors throughout the theme, that would require changes in system and framework etc. Do the HTC skins modify things on a similar level, in system and what not? Perhaps there could possibly be an exploit to get into /system thru there? Could be way off base, but hell, it seems like everyone is throwing out any ideas they have....so I did too.
[HTC EVO 3D] CrippleB:
Everything seems to run like normal. I am streaming netflix right now. ALl of my widgits are still working, only default icon is androirc but that always does that after reboot.

Edit: root explorer seems to dissapear in safe mode. I went to market and it still says installed but will not show up in apps. Astro as well.

Edit 2: back out of safe mode both file manager apps are there. There must be something to safe mode to cause those two go away.
[HTC EVO 3D] mastibeta:
Double post
[HTC EVO 3D] mastibeta:
I don't think this is the right direction...I have to tear down the zip after class...but i think we can just push the exploit within system app.
[HTC EVO 3D] Leoisright:
Sprint zone looks to have system permissions and can be installed from my speedy port...

Sent from my 3VO..
[HTC EVO 3D] Leoisright:
In safe mode can you access adb in bootloader?

Sent from my 3VO..
[HTC EVO 3D] wineguy:
Safe mode according to HTC's web site will only allow system apps to run. That is why I was hoping someone would see something that just might "click" for us.

BTW, to those flaming and stating it was "just the bootloader", try before you just ramble from the mouth please, I found something new and unique to most...
[HTC EVO 3D] CrippleB:
Sorry I am a newb when it comes to that I recently downloaded sdk all I have done with adb is logcat.
[HTC EVO 3D] No1ustad:
lots of new ideas in the last four pages.

just to reiterate the current possibilities:

Safe Mode

Sprint Zone exploit

HTC Skins

mastibeta's thing

right?
[HTC EVO 3D] CrippleB:
So netflix would be a system app? I ran it for fun in safe mode. Also I am running the modded landscaped version of netflix.
[HTC EVO 3D] chubbzlou:
Safe mode load up as normal just with the system apps.

Cripple can you dl superuser.apk from the market and see if it installs the reason why I am asking is because when you install it it has the binary file that should install in the bin folder.
[HTC EVO 3D] t3project:
im sure you know plenty more than me but if you are in the bootlaoder you are not in safe mode and vice versa, correct? lol
[HTC EVO 3D] CrippleB:
Install in safe or normal?
[HTC EVO 3D] -viperboy-:
You're exactly right about safe mode. The OG Droid had this and it was pretty useful to me as a Verizon tech, you could tell if a downloaded app was causing an issue with the phone. Unfortunately, I don't think that safe mode will help with rooting the E3D.
[HTC EVO 3D] chubbzlou:
yes safemode please
[HTC EVO 3D] Shaquiel Harris:
Yeah we do. Could anyone give us a little info?
[HTC EVO 3D] CrippleB:
It installed but is not showing in apps. Edit: not showing in safe. If I restart it will probably show.
[HTC EVO 3D] chidave09:
Not sure if the ota caused this or not, but when i boot into safe mode the screen doesn't work at all. green notification light is blinking and when i push power the lights on the buttons go on and off, just no screen. been sitting like this for 5 minutes now. i tried it plugged in to the pc and unplugged, same results. don't know if this helps anyone or if anyone can tell me why this is happening

edit: screen works just fine while booting, just in case you were wondering
[HTC EVO 3D] AyyRayy:
no luck with anything in safe mode.

You guys maybe think I could recognize the 3d in safe mode on Ubuntu?

If safe mode could simulate "download mode" we could be golden
[HTC EVO 3D] chubbzlou:
did it ask anything about binary file?
[HTC EVO 3D] CrippleB:
This probably means nothing but Netflix is not showing in apps in safe mode. But I was able to launch it from my homescreen and succesfully run. Would that be the same for another non system app. Again it is the modded netflix.apk

Edit @ Chubbzlou No it did not do anything out of the ordinary. Just installed from market like normal. ALso I have not restarted yet so have not seen if it is apps after restart.
[HTC EVO 3D] wineguy:
Confirming that it will not show in apps list. But, would anything help if we had SU installed, booted into safe mode, then tried the OTA? I already did the OTA, yea, foolish, but theory is as OTA is installing, SU is installed, possible opening?