yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] xHausx:
! = nothing to do

? = WTF am I supposed to do with this

For the most part at least :)

I noticed they not only disabled adb in the recovery but they took it out and replaced it with something else, I think it had me install a new driver that was possibly for the radio
[HTC EVO 3D] DomSim:
like make the gerbal run the other way in the wheel? thats how these things run right? everything you just said confuses and impresses me. you do your thing and im gonna keep getting drunk and watching.

edit: that sounds kinda dirty hmmmm
[HTC EVO 3D] Leoisright:
no ****..i can't get adb to do anything except pull the system... i was hoping once the update was installing we could push stuff in but, nope...adb is a no go now during reboot

edit: so with the question mark, does this mean the bootloader is open you think?
[HTC EVO 3D] mhespenh:
Yep- I believe the USB connection uses different VID/PID combinations depending on how the phone is connected (hboot, fastboot, recovery, etc).

What makes you think it was for the radio? Would be interesting to see if we can get a terminal connection opened with the radio and throw AT commands at it...
[HTC EVO 3D] AyyRayy:
I noticed that too. A lot of changes in this phone

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] unCoRrUpTeD:
Get to work then. LOL

Are you running Windows or Linux. When I was in the recovery I had to do a battery pull to even get out of it. I tried adb commands, fastboot commands and pressing all the buttons on the phone.
[HTC EVO 3D] xHausx:
It popped up for a split second talking about a radio or something like that, then once the driver was installed it changed to something like myHTC.
[HTC EVO 3D] Leoisright:
ok, so it did pop open... this is a step in the right direction then. but we can't past the firmware.

so, next question is... can we manipulate the updater-script to install something to system? or framework?

edit: so the best guess at this moment is the firmware.zip may have a key in it to open up the hboot??? would it be smart to decompile each .img in there and comb thru it line by line?
[HTC EVO 3D] xHausx:
If you can thats all we would need for root, just /system/bin/su with the permissions set to 6755.
[HTC EVO 3D] Leoisright:
ok, going to decompile each img. Chubbz and i will look in to this.

hmmm, maybe we can symlink it in there then. will look in to this part of it. Also, we will decompile the img's to see if there is anything repetative in there
[HTC EVO 3D] xHausx:
Win 7, you can use volume up + power to bring up the UI there.
[HTC EVO 3D] puertoblack2003:
playing around with this but not sure what it means

[+] Plain Gingerbread mode!

[+] Found system: 0xafd184b1 strcmp: 0xafd3855d

[+] Found PT_DYNAMIC of size 232 (29 entries)

[+] Found GOT: 0x0001537c

[+] Using device /devices/platform/goldfish_mmc.0

[*] vold: 0128 GOT start: 0x0001537c GOT end: 0x000153bc
[HTC EVO 3D] liquidjesus:
gingerbreak just hangs here, you can't achive temp root this way.
[HTC EVO 3D] mhespenh:
Can you open up device manager and tell me what the VID and PID are when you are in that mode? VID should be 0x0BB4 (HTC).
[HTC EVO 3D] mbobino:
Has anyone tried tearing apart the recovery.img? Theres some random info in there that could possibly be useful. I had a look through /system/etc at recovery.fstab and it leads me to think that it's using the emmc for specific partitions (/boot, /misc, and /recovery). Also of note is it shows ext4 for the other partitions. If need be I can upload the extracted files. Hope this gets us closer.
[HTC EVO 3D] thesparky007:
if this is of any use, i see files such as cwkeys, bootcomplete, init, init.goldfish and i also see a folder named dev with all kinds of files in it....

this could most well be something on everyone's phone but it looked interesting to me so i thought i could chime in to see if its useful
[HTC EVO 3D] unCoRrUpTeD:
Yes it is. I'm going to look at the recovery some more tomorrow, but we can't use adb in recovery. Tried a couple of things tonight with recovery, but didn't get any where.
[HTC EVO 3D] bmxrider4444:
So I have noticed that you are able to get the Sprint banner changed through QPST, now has anyone changed that and performed a ##786# (WARNING WILL RESET PHONE TO FACTORY) now if this stuck could we maybe find a way to use this to get us into the system as it appears to give root of some sort to the app, maybe try performing everything up until the part where you go in to change the banner and try pushing a different hboot or something, just a thought, can't try it myself as I am still stuck with my OG EVO. Also since entering in your msl gives you root of sorts for certain things is there any way we can look into like EPST or another app that's requires an msl and see what it calls upon and see if we can't exploit something there like having it use the msl to run with higher privilages?
[HTC EVO 3D] Product F(RED):
##786# doesn't reset your phone to factory. It just lists specific information about the phone, such as the MEID HEX (aka ESN), original activation date, and other things.
[HTC EVO 3D] xHausx:
Under Android USB Devices:

My HTC

USB\VID_0BB4&PID_0C03&REV_0226&MI_01

USB\VID_0BB4&PID_0C03&MI_01

Disk Drives:

HTC Android Phone USB Device

USBSTOR\DiskHTC_____Android_Phone___0000

USBSTOR\DiskHTC_____Android_Phone___

USBSTOR\DiskHTC_____

USBSTOR\HTC_____Android_Phone___0

HTC_____Android_Phone___0

USBSTOR\GenDisk

GenDisk
[HTC EVO 3D] lilcza1:
if you hit menu while in ##786# it will allow a factory reset.

occationally on the evo and epic, it would not truly reset and would need to be done thru bootloader mode or in settings - sd & phone storage - factory reset
[HTC EVO 3D] bmxrider4444:
You have to scroll to the bottom and hit menu then reset, sorry I forgot about that part, but when I was ATS at Sprint it was what we used to do a factory reset, and it doesn't just wipe the normal stuff like when you are installing a new Rom and wiping, it wipes the phones programming and other info, it just seems to be a lower level wipe than what we normally use, so I was hoping it might help provide info or an exploit.
[HTC EVO 3D] il Duce:
Ok this may seem retarded, but Leo was talking about the hacked update going half way. Are you able to start a log with DDMS first, hopefully to catch an output of the fail?

BANG! from my shooter...
[HTC EVO 3D] Shinzul:
I went through the rigamarole on this yesterday, and no.
[HTC EVO 3D] TMartin:
Any thoughts/suggestions on trying to manipulate the OTA or possibly finding a system apk to modify?? Any chance of either of those working in your opinion?
[HTC EVO 3D] mastibeta:
Hey leo, did you get through the decompile? If not can you share the firmware.zip? I'll poke around a bit.
[HTC EVO 3D] Leoisright:
Hey t, I worked on setting dependancies of Su to some different framework jars last night. It installed just fine after too. But still a no go.

I was curious if there were any old school dos commands we could throw at this thing during recovery or bootloader because adb can't see it.

Since for a brief moment it seems like we got the hboot unlocked but then closed again using a modified ota to try and install an older hboot. Got stuck at the ? After 40% progress bar.

More curious if we could get to this thru dos, ping, something when its unlocked.

Sent from my 3VO..
[HTC EVO 3D] Shinzul:
Heh I spent all morning and most of yesterday afternoon trying to get in the middle of the OTA process, but I haven't had any success yet. I'm not totally ready to mark it as tried yet, I still have a few more ideas.
[HTC EVO 3D] Leoisright:
Yeah, give ne a little bit. Half hour tops. I will rev up the machine and upload it.

Edit: off topic and know you guys are tired of hearing the generic statements from HTC.

The did respond to the request send me a unlocked phone or send updated hboot. They said no of course but then said they planned to unlock for future devices and made it clear about that. I am not so sure they plan on this one so it may be up to us and certainly don't take their otas yet as it may still be closing security holes. I did respond as a developer and hopefully get a flear answer if they are or are not for this phone.

Sent from my 3VO..
[HTC EVO 3D] lithid-cm:
From what I know and am able to talk about, the 3VO was already in contract a locked device before the CEOs announcement was made. I work for a backbone provider for alot of these carriers and manufacturers. From what I have heard 3VO isn't going to be unlocked by HTC. All phones that were not finalized before the announcement will be from here on out. Please don't ask me how I know or specifics, my job could be at stake.

Now that I have said that, I just repaired my EVO and have the new GB update with the new HBOOT 2.16 since all exploits are fixed looks like I will be working with you guys to find the exploit in 2.3.3. I have been following this thread so I won't be asking dumb questions, just saying im in.
[HTC EVO 3D] :
In the beginning of this thread i was able to check HBOOT by volume down and power as normal.....after update i foolishly did i was still able to check(I think). I just tried now to get into it and the phone does nothing but power on. Is this the result of the locked Bootloader?
[HTC EVO 3D] celthunder:
Turn off fast boot or pull the battery
[HTC EVO 3D] Leoisright:
welcome aboard lithid. I figured this was gonna be the case about the 3vo.. None the less, let's get a crackalackin on the new HBoot.

I have ideas of using DOS to ping the phone during the ota install, if it can ping it, we should be able to access it at some point.

Awesome to have you in bro
[HTC EVO 3D] :
Duh..I had a stupid moment, LOL!
[HTC EVO 3D] wake69:
check if fast boot is checked under power. and does it work after battery pull?
[HTC EVO 3D] :
It worked :)
[HTC EVO 3D] kmagn13:
Just wondering about root folder on the phone...its a stock sd card....the folder looks empty...Folder date is 6/13....found using astro....
[HTC EVO 3D] Dees_Troy:
For those of you that have no clue how to hack a phone to get root without following someone else's guide or program to do it for you, try this.
[HTC EVO 3D] mikeyfg:
Ok were there 3vo's shipped with s-off? If so I have 2 Sprint reps at 2 different stores and one adcom digital rep willing to boot into the bootloaders of all of the ones they have right now. If anyone can tell me if some shipped s-off so they wont waste they're time. Let me know guys
[HTC EVO 3D] Anonamoose:
Thanks for this I am useless in achieving root so I personally have been e-mailing them every day. Just got done went here and saw your post. I will be asking them on twitter and facebook as well. The more vocal we are the more likely we are to succeed . While I understand they cannot stop production on a phone being made they could've posted a downloadable patch on there website that voids your warranty but allows S-Off. I mean all were asking for is a chance to break or phones to buy another one at full retail right? (lol) Anyways thanks again everyone for the hard work on getting this done I appreciate it.
[HTC EVO 3D] Leoisright:
No, they were not shipped s-off. But if they have some of the demo ones, those could be. If they could be looking for the smart_io.crd that could be located on the sd card would be a nice find. Either that or some miracle where they have a s-off phone.
[HTC EVO 3D] unCoRrUpTeD:
You can also do adb shell reboot bootloader while keeping fastboot checked. I do this so I can still use the Fast Boot option.
[HTC EVO 3D] mikeyfg:
[Q[/B]UOTE=Leoisright;15192432]No, they were not shipped s-off. But if they have some of t[/B]he demo ones, those could be. If they could be looking for the smart_io.crd that could be located on the sd card would be a nice find. Either that or some miracle where they have a s-off phone.[/QUOTE]

Ok I will ask wont they have to actually boot the phone and skip the initial setup process to access the sdcard or would just removing the sdcard and insert it into a card reader suffice? Just need a clear understanding so i can provide them with the proper instructions
[HTC EVO 3D] cordell12:
Can the Eng Hboot be HEX edited to look like it is the 1.40 Hboot?

Also due to the 3d aspecof our phone I don't see HTC unlocking it. The popularity will attract more users, younger users, idiotic users, just to many potential problems with a open phone of this caliber. The sensation has a better chance then we do, with both phones being the same that's probably why its taking so long. They are finding a way to unlock sensation without jeopardizing the 3VO security. Though they will say we are next and deliver the bad news after our 30 days are up
[HTC EVO 3D] DomSim:
you make a good point lol. i just know there are hoops they have to jump though in order to get there. what they need to do is just be a bit more transparent about the whole thing. let the masses know the status of the whole thing.
[HTC EVO 3D] alchemist316:
me to i never mention xdas work so its mostly just me and people who care
[HTC EVO 3D] Buff McBigstuff:
Agreed, transparency would be best.
[HTC EVO 3D] alchemist316:
right there closed lipped on this slipping otas here and there
[HTC EVO 3D] CheesyNutz:
this crap is making me want to wait for a proper unlock to be found or released .. ad lest with my evo i have root
[HTC EVO 3D] DataDork:
im soo holding on to my 4g until root comes around in 30 days.. i love my minimalistic theme.. cm7.
[HTC EVO 3D] k2buckley:
Yea, me too. My Evo 3D should be here sometime this afternoon, and I don't think I'm even going to activate it until some of this gets sorted out. I'll keep my rooted Evo 4g running until there is some more hope with this thing.

There is no problem with me not activating it, right? I've never bought a phone this way, but there's nothing saying that I need to activate it within a certain amount of time, right?
[HTC EVO 3D] pancho8188:
these guys are the best dev bunch,, if it can be rooted it will be done soon by the xda dev's just hold on to your panties lol
[HTC EVO 3D] alchemist316:
http://www.groubal.com/otaruu-for-all-new-and-old-devices-asap-htc-no-more-lies/

sign if support
[HTC EVO 3D] l33tlinuxh4x0r:
should have used a more mainstream petition site like change.org
[HTC EVO 3D] mlin:
I highly doubt there is any red tape on the carrier side. Sprint already said that bootloader locking is solely the decision of manufacturers.
[HTC EVO 3D] alchemist316:
now i gotta get my evo back so stupid
[HTC EVO 3D] pancho8188:
i agree we need to just wait ,, root is around the corner anyways
[HTC EVO 3D] alchemist316:
good call still can right
[HTC EVO 3D] l33tlinuxh4x0r:
regarding the fact that they didn't release a date/time for unlocking the bootloaders. It will probably be unlocked very near to EOL(end of life) for the device.

Lets hope that this isn't the case.
[HTC EVO 3D] mlin:
My FB comment was a joke FWIW. I think HTC will keep their word, its just a matter of when.
[HTC EVO 3D] cordell12:
EOL for my device is 29 days from now, lol

unless HTC or a dev/devs find a solution :)
[HTC EVO 3D] alchemist316:
@l33tlinuxh4x0r your right grubal is required a capcia or w.e before posting change does not
[HTC EVO 3D] TimidRat:
I thought they said it would ship unlocked? So maybe an OTA unlock on the official release date, my best guess if they wanna keep everyone happy.
[HTC EVO 3D] Vdubtx:
They never specified anything other than that they will unlock boot loaders. No timing or other details given in their statement.
[HTC EVO 3D] Sortilege:
I have zero knowledge with root but want ot contribute so bad. This is probably info that is already thought of or just plain stupid.

Why cant everything on the phone just be wiped out and fresh os and bootloader put on there to replace it?

Or is there a way in through the hardware itself? I remember for playstation to accept pirated games a mod chip needed to be soldered onto the board...is sonething like that an option?

Dont yell at me to bad.....just curious. Good luck all devs.
[HTC EVO 3D] Leoisright:
I worked on beyond compare last night for about an hour trying to figure out how to edit the HEX. It's a no go on that stand point. Now, once we do figure out how to edit it correctly, we need to have it signed and there may be a problem.

I was able to open it up in notepad++ and edit it to have security to wipe system with S-ON and not off and it saved but that means nothing if the hex isn't edited too.
[HTC EVO 3D] Leoisright:
we can't do that until we have access to r/w to the system. that's what we are trying to accomplish.

Also, there is not a chance we could open this thing up and solder anything. It needs to be a brute attack on the bootloader...
[HTC EVO 3D] mastibeta:
Any luck on that zip leo?
[HTC EVO 3D] AyyRayy:
@leoisright

I'v been trying to modify the OTA all night and get it to pass through. Next time when you get the red question mark quickly press volume up and the power button. This will bring up the entire process of what just happened on your screen.

Whole file signature check failed

Installation aborted

Rebooting

we need HTC's key to resign the firmware.zip or we are dead in the water

I'v even tried modifying the OTA and replacing the 1.4 with eng and creating an update.zip and try to flash through recovery and all I get is.

Invalid Operation

Rebooting
[HTC EVO 3D] Harfainx:
Can you PM me a link to your work? I have an idea for key/signature generation, but it might not go anywhere so I don't want to make a new thread about it yet lol. I've been running a scan for the past few days, and I think I might be on to something.

Also on a side note to everyone that has no input here... Please stop posting about "oh hey that could work" or things of that nature. If it in no way can HELP, then please take it somewhere else. These guys are working hard, and it makes it difficult to follow the work when there are hundreds of useless posts taking up space here.
[HTC EVO 3D] Leoisright:
Sorry bout that.

http://db.tt/misPtR6

Sent from my 3VO..
[HTC EVO 3D] clark44:
Ok I have a crazy idea. Instead of editing the eng bootloader and adding it to the ota how about editing the stock s-on bootloader and compare both make the stock the same hex wise and flash. The stock should stay signed and flash successfuly. Correct me if I'm wrong
[HTC EVO 3D] linuxkidd:
Ya, unfortunately, any modification to the stock image nullifies the signature and thus won't flash.
[HTC EVO 3D] AyyRayy:
Yeah, ill put it up after I get home . I'm out right now

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] B-dub25:
I did a ioclt mount loop and I get file numeric is wrong its a little weird I'llhave to come back to that.
[HTC EVO 3D] krunkymonkey:
Just about every question/idea asked on here could be answered by one of two answers.

1. It needs/breaks the signature.

2. Need root first.
[HTC EVO 3D] clark44:
But once we make the edit how is the signature removed? Could we track the process and reverse it? Like instead of unsign it sign it
[HTC EVO 3D] gtkansan:
Signature is like a wrapping on a package. Once you open the package, the wrapping is ruined. Can't be 'un done'.
[HTC EVO 3D] mastibeta:
So a little info on how this works. The data is encrypted by being run through an algorithm...so the current data is able to produce the proper key because it has the data that was present during encryption, the key wouldnt be valid once the data has been changed...or at least thats my understanding...here is a riop from another thread.

"This is the typical, familiar, scramble-your-data algorithm. You use one secret key, together with your data (called plaintext), and input them to the function. It spits out random-looking output (ciphertext). You put your ciphertext back into it with the same key, and you get your original data back again. With this, either exactly the same function does encryption and decryption, or one function does encryption and a similar, but different one does decryption. The most popular algorithm is called AES."

Our best bet is to interrupt the load process while the bootloader is open. I am going to work at this tonight, anyone willing can meet me in IRC around 10 PM ET.
[HTC EVO 3D] T3hPWN:
Who wants to take a shot at this? http://xdaforums.com/showthread.php?t=803682 i have never personally used it but considering there are some HTC phones on there im sure some brave soul will want to try??
[HTC EVO 3D] mastibeta:
Won't work.
[HTC EVO 3D] clark44:
I'll be there
[HTC EVO 3D] RVDigital:
I believe the exploits being utilized here have already been confirmed to not work. These include rageagainstthecage and psneuter.

Primairly because we're using 2.3.3 with some additional 2.3.4 patches.
[HTC EVO 3D] T3hPWN:
I know it sux not having info to back up a claim but i could of swore that Root access was recently gained on an HTC phone via an exploit through the Flashlight app im not sure if this has been investigated as its a lot of pages to read.
[HTC EVO 3D] mikeyfg:
Did it have 2.3.3???
[HTC EVO 3D] gmfeny:
Evo3d doesn't ship with the flashlight app.
[HTC EVO 3D] cordell12:
Flashlight app isn't included with 3VO anyway, that cold be why though. That old RUU have the flashlight app in system?
[HTC EVO 3D] Vinchenzop:
You can attain the flashlight apk from the theme and app forum. I'm wondering if since it uses a plugin, that it has some form of root permission...
[HTC EVO 3D] Leoisright:
We need to figure out a way to install Su to system/bin. Also, its weird how some apks that are installed go to sdcard while others install on the phone. Example, su installs to phone but rootexplorer to SD card. Anyway we could edit an apk to install to system/app? Like maybe flashlite apk from ruu or maybe flashlight plugins?

Sent from my 3VO..
[HTC EVO 3D] cordell12:
It wont install in system by side loading. It would be data/app we need a exploit in system /app

Edit...flashlight app
[HTC EVO 3D] bsims85:
I have no idea how this stuff works so please don't flame me. Is the market app (vendor.apk) a system app? Im only asking because its not supposed to work if the background data is disabled, but you can still get it to work if you press search. Maybe the app has an exploit. Again, I have NOOO idea how this stuff works. I just know you guys were checking up on the Watch app after it wasn't working properly so i thought maybe there's something there.
[HTC EVO 3D] Leoisright:
Why do they have flashliteplugin.apk but no flashlight app? It installs just fine.

Should we see about deodexing some of the apps and install over?

Sent from my 3VO..
[HTC EVO 3D] unCoRrUpTeD:
I think background data would be like checking for updates, getting temps for weather, emails, etc.
[HTC EVO 3D] AyyRayy:
Oh quite the contrary ;) , if you have their private keys or can filter them some how we can unpack and repack all day. HTC uses SignAPK we have to get their key for the phone to accept the slightest modifications

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] dj_L:
Already tried...loop not in kernel, nor NFS. We do have fuse, but AFAIK, no userland tools.

Look at kernel config would save you some time. For those who don't know this already:

{{{

cat /proc/config.gz > /sdcard/config.gz &&

gzip -d /sdcard/config.gz

}}}

HTH

-- DJ Lucas
[HTC EVO 3D] MordyT:
Doesn't sense 3.0 have a screenshot app built in? Screenshot apps usually need root, maybe a way to exploit

Via my HTC Shooter
[HTC EVO 3D] AyyRayy:
Pm setinstalllocation in adb. This command can be used to force all apps to SD without root. Can we modify to force apps to /system/bin or /system/app. ?

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] Leoisright:
Does the ota actually open the bootloader or is it made so it allows install while s-on? Reason I ask is if we can adb during the unloacked bootloader we may have a shot to push Su to system/bin. But its gambling on then taking the ota and closing someother exploits

Sent from my 3VO..
[HTC EVO 3D] AyyRayy:
@leoisright consider my last post

In addition to what you said in quote, the bootloader is in a vulnerable state during the update but can you access adb on the 3d while in recovery?

Sent from a dual core beast 3VO. Do this on your iFail 4 :D