yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] Vinchenzop:
First, bounties do nothing to further progress, it only causes individuals to get greedy and be secretive.

Second, just because the last exploits happened to come from a "complex" bug source, doesn't mean that those were the only ways the phone(s) could of been opened, and doesnt mean that the person was anymore talented or informative than anyone working on this now. No offense to them, but if they were vastly superior to "us" wheres their solution to the problem at hand? There is no need to undermine or improperly compare "us" to "them", because we're all in this boat together.
[HTC EVO 3D] wasupwithuman:
anyone looking at the pm command? It runs at root, and has a lot of commands... It let me uninstall flashplayer, even when the settings application wouldn't let me. It has an option for listing dangerous permissions < whatever the hell that is... but when I run it it comes up with. com.orange.permission.SIMCARD_AUTHENTICATION whatever the F that means... It just seems like this program has to have a flaw somewhere..... It even lets you enable testkeys.
[HTC EVO 3D] :
Since it looks like im the only one that updated, is there something you guys might need or want me to look for?
[HTC EVO 3D] Vinchenzop:
I updated to tony
[HTC EVO 3D] :
Ok.
[HTC EVO 3D] liquidjesus:
I'm not trying to undermine or compare any one. I was calling those devs talented because they are, i never called them superior my intention was not to insult any one.

And yes, no simpler exploits been found recently.

Everything takes time my friend, those exploits took time to discover, time to write and time to implement.

Keep in mind, i'm not trying to offend any one, merely point out that the time time for simple rooting methods may have come and gone.
[HTC EVO 3D] wasupwithuman:
I'm updated as well...

+ permission:android.permission.INTERNAL_SYSTEM_WINDOW

package:android

label:display unauthorized windows

description:Allows the creation of windows that are intended to be used by the

internal system user interface. Not for use by normal applications.

protectionLevel:signature

+ permission:com.swype.android.inputmethod.PRIVATE_COMMANDS

package:com.swype.android.inputmethod

label:private_permission

description:Private permission allows an internal Swype app to talk to the Inp

ut Method

protectionLevel:signature

+ permission:android.permission.MOVE_PACKAGE

package:android

label:Move application resources

description:Allows an application to move application resources from internal

to external media and vice versa.

protectionLevel:signatureOrSystem

+ permission:com.sprint.internal.permission.SLOT0

package:com.htc

label:Mobile IP profile 0 permission

description:llow applications to use MIP 0

protectionLevel:normal

+ permission:com.android.mms.permission.WRITE_DATA

package:com.android.mms

Value	Meaning

"normal"	The default value. A lower-risk permission that gives requesting applications access to isolated application-level features, with minimal risk to other applications, the system, or the user. The system automatically grants this type of permission to a requesting application at installation, without asking for the user's explicit approval (though the user always has the option to review these permissions before installing).

"dangerous"	A higher-risk permission that would give a requesting application access to private user data or control over the device that can negatively impact the user. Because this type of permission introduces potential risk, the system may not automatically grant it to the requesting application. For example, any dangerous permissions requested by an application may be displayed to the user and require confirmation before proceeding, or some other approach may be taken to avoid the user automatically allowing the use of such facilities.

"signature"	A permission that the system grants only if the requesting application is signed with the same certificate as the application that declared the permission. If the certificates match, the system automatically grants the permission without notifying the user or asking for the user's explicit approval.

"signatureOrSystem"	A permission that the system grants only to applications that are in the Android system image or that are signed with the same certificates as those in the system image. Please avoid using this option, as the signature protection level should be sufficient for most needs and works regardless of exactly where applications are installed. The "signatureOrSystem" permission is used for certain special situations where multiple vendors have applications built into a system image and need to share specific features explicitly because they are being built together.
[HTC EVO 3D] slimm609:
I just need to original OTA and then the OTA with the eng hboot.

I think the entire update.zip is signed. or is the firmware.zip signed? either way we can work with it. double collisions would be almost impossible
[HTC EVO 3D] pongoface:
Ok, here is my non-dev handyman tinkering. Everyone is saying that we cant use the exploits from others because 3d shipped with 2.3.3. So I said f*** it and tried something dumb. I wanted to try and load froyo. I used 2.0.35 htc sync and tried to send the ruu shipped rom 3.70 from the evo lol. It recognized the phone and firmware version as old and the 3.70 as the replacement. It got stuck at waiting on bootloader for 5 mins and the 3d was in the black with grey htc update screen but no progress bar. So I pulled the the cord screw it right. When I did, the bootloader had ruu in the screen.

My thought was to get froyo on the 3d from the evo hoping that the 3d would run well enough to get one of the exploits to root. Then recovery and flash a rooted stock rom.

I was on the same screen on the 3d that showed when I took the update. Is it possible to Tear apart a ruu.exe with the root files built in and push it to the 3d that way thru a hacked ruu.exe.

Like I said no dev at all here obviously lol. Just shooting from a different angle. Hopefully someone can build from there.

Thanks All
[HTC EVO 3D] xHausx:
Doing something with the eng hboot we could forgo the update zip and just use the firmware zip but there are a lot of variables there as to what it will and will not accept. If you want to hop on the IRC channel there are a lot of people in there who could help figure out the best way to do this. It's #htc-evo-3d on chat.freenode.net
[HTC EVO 3D] sniperkill:
i would think it needs to be signed. once you edit the RUU/update, you gotta sign it, and we dont have HTC's signing key. Someone correct me if im wrong..
[HTC EVO 3D] igotroot:
Hmmmm indeed that sounds interesting... I'm no DEV as well, but that sounds good.
[HTC EVO 3D] il Duce:
Non dev post... I just want to thank all those keeping their heads up and doing crazy and innovative things to gain root. For literally ANYBODY who comes in here with the negativity and hopelessness, please remember, this device has been on the market all of 6 DAYS, chill it and keep quiet lol.

Keep it up y'all :)

BANG! from my shooter...
[HTC EVO 3D] ssojyeti2:
I have an innovative idea...let's build a time machine and steal a EVO 3d with an unlocked bootloader and bring it back in time. Or we can kidnap the president of HTC and hold him hostage until we get our OTA update. I know I'm a genius...
[HTC EVO 3D] agrabren:
The idea of using an older, signed update isn't too bad... It's very likely that HTC uses the same keys. I guess someone could verify this by checking the public keys...
[HTC EVO 3D] Shaquiel Harris:
Honestly, that's a really great idea. But realistically, i doubt this approach will really work, especially since we are going back to a froyo rom for a different device with a different resolution. Remember the evo and evo 3D (yes I refuse to use 3vo.. Sounds so stupid) has different resolutions, the evo 3D having a 540x960 resolution while the evo had the 400x800 resolution.
[HTC EVO 3D] Vinchenzop:
That, and it would lack the encrypted sig...but its worth a shot if someone has the guesto to try it
[HTC EVO 3D] AyyRayy:
Lol let's do it!

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] Vinchenzop:
Sorry if I missed or read past it but has anyone attempted anything while using the qpst stuff? Theres a post about being able to change the main volume of the phone right under this post in the dev section. I would think if qpst could change a system property like the volume, it may harness some sort of power to write/edit system files (su binaries or uid)
[HTC EVO 3D] klbjr:
Says who? You? Your opinion means nothing to anyone but you. It's not about who is more superior or smarter. Their devs or ours. Whoever eventually finds the key to root first will get it as a matter of luck & the hard work of the people who tried & failed before them. So the group or person that does get it, learned from everybody before them and by process of elimination didn't have to waste their time on things that have already failed. I could care less if they take all of the credit or bounty. All I care about is getting root. By any means necessary! I'm all for a bounty, bribe, payoff, payout....whatever gets us root the fastest. Anyone starting a bounty, count me in for $50 to start.
[HTC EVO 3D] chidave09:
Agreed
[HTC EVO 3D] markgolly:
Crashbug in bluetooth

Guys, I found a crash in the EVO's Bluetooth today. I tried to pair with a Mac to transfer files (heh, didn't have my cable w/ me) and never could. When the Mac popped up the access code, the EVO's Bluetooth stack would crash. I had to turn Bluetooth off and back on to get it going again. Since I have verified that bluetoothd runs as root, maybe this is a possible exploit....
[HTC EVO 3D] JoshuaAlba:
I rather not rush the devs :)
[HTC EVO 3D] Vinchenzop:
can you repeat the crash?
[HTC EVO 3D] mhespenh:
Awesome- if you're getting a USB connection while in recovery that's interesting since ADB is disabled there. The usual PID/VID combo (while in fastboot) is different than what you've listed. I'm gonna see if I can get a serial-over-usb connection going while in recovery and see if I can push some files in that way.
[HTC EVO 3D] lil_bono:
Interesting...

Do we know what shell commands bluetooth will respond to? We would need to know what was happening when it crashed. What branch of code was timing out, or choking...

As stated above, we are way beyond fake signatures. We need something to hiccup and give rights beyond its normal utility.
[HTC EVO 3D] Vandelay007:
Sent from my 3VO
[HTC EVO 3D] fastamx79:
I also use Mac.. I'll give it a shot on my zero day Evo 3D as well and see what happens...

BTW.. lurker since day 1 and I appreciate all the hard work going on here. I'll report my findings shortly... I have 2 Macs to try, each running different OS versions to see if maybe it is caused on the Mac side from older OS version VS the newest MacOS update
[HTC EVO 3D] Shaquiel Harris:
Ah, using a system App like bluetooth as an exploit.. Reminds me of when I first rooted my HTC dream..those were the times.
[HTC EVO 3D] markgolly:
Oh, definitely. I tried three times to pair. Never did.

Just now tried pairing with my Linux box - no problems. Seems to be an issue with Mac.
[HTC EVO 3D] aimbdd:
My mac pairs fine first try.
[HTC EVO 3D] fastamx79:
On Mac OS 10.6.7 and 10.6.8 I can sync with my 3D and send files from computer to my phone, but not phone to my computer(s). Pairing went smoothly but beyond that I can't get stuff sent with out crashes.

Don't know if this helps or not...:confused:
[HTC EVO 3D] evasilisin:
I'll do it. I ain't scared. How do I get the EVO 3.70 to my device though. I dont have it on my pc.

Sent from my HTC EVO 3D using the XDA Premium App.
[HTC EVO 3D] markgolly:
More Details on crashbug

Mac info:

iMac running 10.6.8.

C2D

4G ram

500Gig HD

Evo 3D 1.13.651.7 (yep, I took the updates - silly me)

EDIT: I have both FTP Server and Message access turn on on my 3VO.
[HTC EVO 3D] fastamx79:
For reference on my tries I used my wife's Mini C2D 1.83GHz running 10.6.7 and my Macbook Pro i7 2.66GHz running 10.6.8 and my 3D is running 1.11.651.3
[HTC EVO 3D] evasilisin:
I have an ingenious idea. The sensation is 540x960 and is HTC device obviously. Use HTC sync to push the stock firmware, use gingerbreak and then flash rooted EVO 3d firmware would it work ? I'm a dev, but rooting isn't my thing. Apk writing is lol.

Sent from my HTC EVO 3D using the XDA Premium App.
[HTC EVO 3D] AyyRayy:
How would gingerbreak work?

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] evasilisin:
Gingerbreak worked on shipped sensation!!!

Sent from my HTC EVO 3D using the XDA Premium App.
[HTC EVO 3D] pongoface:
I tried it but bailed after it got stuck on waiting for bootloader after 3-5 mins lol.
[HTC EVO 3D] rockypr:
Tried on the 3D?
[HTC EVO 3D] evasilisin:
Somebody tried already apparently. It's earlier in this forum. But if we install sensation firmware and then use gingerbreak and then install rooted shooter wouldn't it work?

Sent from my HTC EVO 3D using the XDA Premium App.
[HTC EVO 3D] markgolly:
Hummm, guess its just me, then. :(
[HTC EVO 3D] unCoRrUpTeD:
Count me In!!

You'll probably fry the phone. Different radio's.
[HTC EVO 3D] mhespenh:
I'm trying some of the methods the old <strike>hero</strike> Vision folks used- unlocking by writing directly to the radio.

I've got a serial-over-usb connection going to the phone while in recovery. I can "dial in" with minicom and issue AT commands to the radio, and get the correct responses. However it looks like the AT command to disable security has been removed. I tried "AT@SIMLOCK?AA" and "AT@SIMLOCK=7,0" but both errored :(

Not sure if I can find a way to push a file in yet- anyone have any ideas?

Edit: To clarify, I have the phone connected through a normal USB cable to my linux box, then loaded usbserial into the kernel using the VID/PID for the device. This creates /dev/ttyUSB0 which I can "dial into" using minicom (or screen, whichever) and issue AT commands. For example: Sending "AT" returns "OK" as it should.

Edit 2: Added screenie

Edit 3: Yep- definitely talking to the radio- it's nifty, but I can't upload any files :-/ Maybe some old linux hand will be able to do something more useful with it
[HTC EVO 3D] evasilisin:
I don't need the phone to work other than boot and install gingerbreak.

How do i get sensation shipped ROM and how do i install. I'll try it... Y not.

Sent from my HTC EVO 3D using the XDA Premium App.
[HTC EVO 3D] Zarboz:
A couple.pages.back some one mentioned they removed stuff from.ruu and still got it.to write no idea if that was debunked.but if that's true we cab remove hboot and radio from sensation ruu in order to gingerbreak ... That is if it'll pass Sig check

sent from my EVO 3D
[HTC EVO 3D] drob311:
If adb worked in recovery couldn't you do gingerbreak manually using adb? So you wouldn't even have to use the radios... No? I dunno I'm trying to think optomistically ;)
[HTC EVO 3D] unCoRrUpTeD:
If you fry the phone it won't start. GSM radios use a higher voltage and will fry the phone. Running a RUU will install everything, radio included. Then you phone will be useless and wouldn't even help the community.

I don't think it really happened. There were several people that tried what he said and it did not work

adb in recovery will not work.
[HTC EVO 3D] ionballer:
I'm sorry if this sounds dumb but here is my two cents... Could someone with root back up a system app with titanium back up than edit the apk to to give su than uninstall orginal and use titanium to recovery the newly modified app? Sorry if its a noobs question
[HTC EVO 3D] unCoRrUpTeD:
link to the thread you were looking at. I'm sure they patched any exploit that was found
[HTC EVO 3D] pongoface:
So did gingerbreak work on the sensation or not. Looked at the xda sensation threads and seen nothing
[HTC EVO 3D] wrxtc714:
Seekdroid

I have an application on my phone called Seekdroid. One of the free amazon apps from a few days ago.

Anyway this application does request special permissions.

It has the ability to remotely wipe the system or sd card and hide itself like the app someone else mentioned a few pages back.

An application needs escalated privileges to do such things.

Am I correct?
[HTC EVO 3D] surgeon:
No. Gingerbreak does not work on S-On devices. Read here
[HTC EVO 3D] androidsupra:
Lurker here, just another EVO4g guy waiting for the 3d to be rooted before I pop for it.

But anyways, the 3d is a world phone according to one of my friends at Sprint, so doesn't this technically mean it has a gsm capable radio. I may be way off, but in theory it shouldn't fry the phone. Please correct me if I am wrong.
[HTC EVO 3D] evasilisin:
Gingerbreak does work on sensation....

http://justamp.blogspot.com/2011/05/how-to-root-htc-sensation-android-23.html

Sent from my HTC EVO 3D using the XDA Premium App.
[HTC EVO 3D] SpyFi:
Devices

I do not know for sure but. You can create different device Administrators. It's under location where they are stored but I am not sure how the apps become a device admin like the Overvi3w app I have installed. It defiantly seems like a form of escalation. I am going to look further into this.

EDIT: Device Administration

In this document

Device Administration API Overview

How does it work?

Policies

Sample Application

Developing a Device Administration Application

Creating the manifest

Implementing the code

Key classes

DeviceAdminReceiver

DevicePolicyManager

DeviceAdminInfo

Android 2.2 introduces support for enterprise applications by offering the Android Device Administration API. The Device Administration API provides device administration features at the system level. These APIs allow you to create security-aware applications that are useful in enterprise settings, in which IT professionals require rich control over employee devices. For example, the built-in Android Email application has leveraged the new APIs to improve Exchange support. Through the Email application, Exchange administrators can enforce password policies — including alphanumeric passwords or numeric PINs — across devices. Administrators can also remotely wipe (that is, restore factory defaults on) lost or stolen handsets. Exchange users can sync their email and calendar data.

This document is intended for developers who want to develop enterprise solutions for Android-powered devices. It discusses the various features provided by the Device Administration API to provide stronger security for employee devices that are powered by Android.

MORE INFO: http://developer.android.com/guide/topics/admin/device-admin.html
[HTC EVO 3D] readingkeeper:
Its not a world phone. At least, not one with a GSM radio. He may be confused and talking about the fact that there is going to be a GSM version.
[HTC EVO 3D] unCoRrUpTeD:
Someone correct me if I'm wrong, but as far as I know it is CDMA.
[HTC EVO 3D] wrxtc714:
I think it may only mean that you can only use it with other cdma carriers worldwide.

I didn't notice a sim card slot from doing a good check for one however I did notice a simlock option in the bootloader. That's what originally made me look around.

The original droid (sholes) was a true world phone and it did have a sim card slot.
[HTC EVO 3D] DGreen1:
I thought I read somewhere that this phone has a dual radio
[HTC EVO 3D] :
The MSM8660 is capable of using both CDMA and GSM radios.

According to Qualcomm.
[HTC EVO 3D] mhespenh:
Err, not hero- Vision.

Anyways- no threads, just some blog action:

http://tjworld.net/wiki/Android/HTC/Vision/RadioAnalysis#TalkingtotheRadio

http://tjworld.net/attachment/wiki/Android/HTC/Vision/RadioATCommands/radio-at-sim.log

I realize it is GSM, not CDMA, but most AT commands are fairly standard. Was worth a shot.
[HTC EVO 3D] TimidRat:
Yeah but thats just the processor, not the phone itself.
[HTC EVO 3D] ionballer:
Ginger break does not work on the sensation only works for s-off sensations which there are very few
[HTC EVO 3D] brandonb8:
If u go to wireless and networks and click on mobile networks it shows the option for international. I'm assuming this is for the gsm band? Forgive me if I am wrong.
[HTC EVO 3D] androidsupra:
I think you guys are right, I've searched the crap out of it and no official documentation of it being a world phone. Sorry to interrupt the thread, keep up the good work guys, I'm sure you get her cracked
[HTC EVO 3D] weidnerj:
Was thinking is it possible to use old school root technique? Use to use a cron job to schedule a job using level 0 to add a userid with no password with level 0 access. But the cron file would have to have the right permissions...
[HTC EVO 3D] pongoface:
Devs, I was playing with old school evo 4g simpleroot 1.47.651.1. I noticed that it allowed to pushed the files to the phone but they landed on the sd card. I tried flashing the ra recovery and it flashed and rebooted the phone. But no dice. But instead of going directly to the red triangle it goes to green circle arrows with the phone and then to red triangle lol. I did not go through the whole process since simpleroot is eclair and evo and the flash hack lol. Didnt want to press my luck. Am I wrong, but doesn't simpleroot use adb to push the files. Probably wrong since I really do not know squat.

But the program communicates with the 3d and can reboot the phone and whatnot. So I am thinking putting the eng boot rom in the program and the proper recovery. Anyways could someone with more knowledge check it out. Hopefully someone still has the program. I have it on my computer and can try to upload it if needed.

Sometimes we have to go old school!!!!! Just a hack here not a dev. Brainstorming ideas here trying to brick the 3d lmao.
[HTC EVO 3D] desairs:
I heard sticking your wang in the charger port does it :D

EDIT: Asians only (JUST KIDDING)
[HTC EVO 3D] TimidRat:
You'll only acheive f-off, not s-off haha
[HTC EVO 3D] weidnerj:
Believe that having the locked boot loader for now, that it will be impossible to load anything like RA. So no custom roms until then.

So first we need HTC to unlock the bootloader. Then to achieve root so that the the S-Off flag can be set.

It we get root, then it will be only on the current version and not a full root where the S-Off flag can be set until HTC unlocked the boot loader.

At least above is my understanding of the situation...
[HTC EVO 3D] ddark4eva:
lmao good one
[HTC EVO 3D] cuban4lf:
how about getting in thru one of the google apps or like the htc built in gmail syn. ???

and i had to get a replacement evo 4g came with the ota on it , if we get root here will it help with the evo 4g as well ??
[HTC EVO 3D] t3project:
i can if you need me to. i've been ****ing with qpst most of the day today. pm me and gimmie some **** to try
[HTC EVO 3D] clark44:
pastebin.com/4FMKu7WE
[HTC EVO 3D] unCoRrUpTeD:
When running the RUU does it produce a zip file that is then sent to the phone or does it create different images (system.img, boot.img, data.img)? I know it is placed in a temp folder.If it pushed the .img files to the phone could we possibly switch out the system.img with a system.img that has been modified and included su. OR even rename the switch out the hboots while keeping the name the same.

Also Open Sense Plugin Manager has the ability to mount and unmount filesystems.
[HTC EVO 3D] Vinchenzop:
I don't know anything about qpst, but it seemed like it is capable of decent privileges, so was pointing to anyone with decent knowledge about it to look into it
[HTC EVO 3D] keebler021:
I was thinking the same thing. Currently I have downloaded the update, but have not installed it. Reason would seem to dictate that the necessary update files are stored in a cache somewhere in the onboard storage, waiting to be installed. If someone can point me to the right location, I can try to use Astro to copy those files and upload them here for inspection by some of you geniuses :-)
[HTC EVO 3D] mhespenh:
Talk about brute force :D
[HTC EVO 3D] Rydah:
what might this be? i see the two zip files. not sure exactly what this is/means.
[HTC EVO 3D] t3project:
i've figured quite a bit of it out but nothing dev wise
[HTC EVO 3D] clark44:
Hop on irc
[HTC EVO 3D] novanosis85:
http://twitter.com/#!/agrabren/statuses/86292199138009088