yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] sgt. slaughter:
It was me that posted it, but i have no clue how it was done. guess hit up the author for info on it if it would be useful.

I just ran across it when i was tossin ideas out lookin around. kinda like the idea of using the HTC transfer app to have it transfer a hole to exploit since it writes to the system when it transfers contacts, sms, and all that no?
[HTC EVO 3D] ckoadiyn:
Lol needs to be brand new.exploit :p
[HTC EVO 3D] Meanee:
This is not that old. 3D went gold not that long after the date. Maybe it's worth a shot?
[HTC EVO 3D] will75:
15 years ago I was in the scene. Knew amazing crackers and software exploiters, that could bypass CD checks etc.. would need someone to exploit the program by rewriting it to do otherwise.
[HTC EVO 3D] TMartin:
I see how to run it, I'm just confused on how it works exactly.

EDIT: Maybe I'll try it and see what it does.
[HTC EVO 3D] Indirect:
I am in the scene (kind of) I'll talk to some of my friends, see if they can do anything.
[HTC EVO 3D] mazook98:
Guys, is this any help? I just pulled out the CWkeys file from the 3d and opened it with txt editor...its this:

{64,0x514f7a2d,{3910343259,2225617198,944538402,4229984983,356634445,50668161,3470245793,3817955698,3056803353,861613297,2119737617,3331607703,2695556226,692623951,1648223702,248171821,315039404,935569791,2410263280,3754806305,3868802544,700782289,2271965102,2982676235,2557902076,2215461360,2141374645,2002567094,637307533,3755657762,4026829306,3953307184,1063650241,1062824505,2962651622,3249551099,3502171227,3953229894,1471561847,3093774057,2412683762,1156378943,3913191860,1341687844,1955399809,2823302562,3129368388,1320484038,3417231822,57111853,1144042353,2375283767,2678489510,931996291,683630187,3089371963,1907973886,1292523450,1882406632,1798009423,3894740985,3893292389,2828657627,3105644676},{3409493504,3044026671,3025488236,4054926089,1473501611,3500455907,70156471,3004658068,3093207773,1906355120,190391206,4142667659,3528504473,486221107,2074864403,2302194352,4160012684,3809228131,3385811127,42648625,3419907349,2609648242,2036536078,2763378069,2611811851,638591104,2916045640,4120589117,986983165,3601442397,2667084738,3378509947,3690505897,3753516454,2780766048,2406748021,4001286070,863086071,4261412774,2325179756,85673109,908539088,2194596224,1767030935,1174729233,3276743755,3426769497,2524753638,2836135958,2106408932,4189318796,2125401242,1442896537,399329412,2298498361,2503899020,3442141986,3600806899,3468149762,1850288682,4110558852,4153568787,1307640881,82502199}}

I used file expert, which is like root explorer without being rooted..I'm sure you guys probably already have this, but JIC......
[HTC EVO 3D] bigbiff:
I looked at the video and I think it was just a local DoS by crashing the browser with a long GET string.
[HTC EVO 3D] Product F(RED):
There IS a restore mode that runs when you run an RUU from the computer, just like on the Evo. Go into the bootloader, go down to recovery.
[HTC EVO 3D] B-dub25:
I haven't seen this anywhere so I'll post it here. I stumbled across this by accident

Reverse Logistics Support

##786#
[HTC EVO 3D] ktulu909:
Would there be any potential in a glitch attack linked through the SDcard at boot?

I was also a tester back in the DTV hayday,but have no idea where any of my gear is.

http://rdist.root.org/2007/05/07/glitch-attacks-revealed/

Old article,but who knows?
[HTC EVO 3D] :
Not really possible

This worked by interrupting the voltage to the processor during one or more clock cycles, and thus causing it to skip over one of more bytes, and execute a different op code. This is not related to an "SDcard" and would not work. It required knowing extremely precise timing of what a specific instruction was executed after boot down to the ms.
[HTC EVO 3D] ktulu909:
Thanks for the response,just tossing it against the wall hoping for it to stick.

I also forgot that we had an HU card dump leaked to point us in the direction of the timing.Man,the good old days of glitchers and emulators and bootloaders.I digress
[HTC EVO 3D] Shinzul:
Unfortunately, all of the known exploits are closed.

I've tried stack overflows, vold exploits, linux kernel cracks, flash exploits, and so far nothing is available.

Next on the list to try is writing a daemon with self-escalating privileges, but that's a long shot. That's the problem with hacking an open source system :). They fix it!
[HTC EVO 3D] Techronico:
We should try planting this thing next to a tree...who knows. It could get rooted eventually.

On a serious note... Just want to thank you guys for working so hard on getting this thing rooted. You are all very inspirational to me. I fully enjoyed the work you guys have done on the EVO 4G and look forward to what you guys do on the 3VO (is that name sticking?).
[HTC EVO 3D] zonyl:
That's why I'm hoping that there will be some fun in the htc driver code that could be used once we get source code. Ive always assumed that far better people have picked through Linux. :)
[HTC EVO 3D] mhespenh:
****, at 1.2GHz we're talking NS timing.

Looks like HTC really outdid themselves with this smartcard bootloader nonsense :mad:.
[HTC EVO 3D] austontatious:
If you say it I believe it... Good luck!
[HTC EVO 3D] AyyRayy:
Glad to see shinzul in the forums ! :D

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] eldiablito004:
guys i have a question! if i want to change the sd card on my evo 3d to a 16g one can i move everything to the 16g card or do you guys recommend not doing anything? thanks in advance....
[HTC EVO 3D] KLLSWITCH:
seriously? this is a thread about getting root and you feel the need to post this Question here why not try this Question in the Q&A forum?

http://xdaforums.com/forumdisplay.php?f=1186
[HTC EVO 3D] Negrito:
This isn't the thread for such a question but your fine, the SD card thing doesn't seem to be an avenue we can utilize.

sent from my 3rd dimensional device...
[HTC EVO 3D] TheMike1:
I have a logcat output from when I was running z4root and it said "acquiring root shell" should I post that up? Will that information be helpful at all?
[HTC EVO 3D] edufur:
no.

-10char
[HTC EVO 3D] m03sizlak:
Alpha Rev X has released a beta version of their Incredible2 S-OFF utility:

http://alpharev.nl/x/beta/

I can only imagine that the method used could quite possibly be adapted to the 3D. Someone needs to open these tools up in IDA and start reverse-engineering.
[HTC EVO 3D] Shinzul:
The incredible 2 shipped with Froyo on it, which means that there are plenty of available exploits that can be used to gain a root shell. As far as I understand, the inc2 guys didn't have a leaked eng bootloader, so once they had temp root, they had no way to unlock the bootloader without essentially hex editing the existing one and then coming up with a process to overwrite the existing one.

We have an eng bootloader for the 3VO, so all we really need to do is gain a root shell and then write the boot and recovery images and reboot - poof, s-off.

Props to the AlphaRev team for the inc2 work, but unfortunately, it doesn't help one bit for us.

Edit: Haus, can you put this in the OP so people aren't confused?
[HTC EVO 3D] mrrogers1:
Haus, can you actually update your OP with the updates when the topic date shows an update?

Great work everyone, just keep digging and of course, if there are things us regular joe blows can do to help, let us know. Standing by idly watching isn't much fun and I'm sure more folks would love to help if it doesn't involve too high of a chance of a shiny new paper weight. :D

THANK YOU!
[HTC EVO 3D] TheMike1:
You sure :D
[HTC EVO 3D] edufur:
Yes. What value could it possibly have. Basically you are saying you have log of an attempt. Why would we need a log of something we already know that we did?
[HTC EVO 3D] wasupwithuman:
Still brainstorming....

Has anyone looked at HTC Sync... Anyone know what the service is that runs on the phone and what permission it has?
[HTC EVO 3D] Product F(RED):
There IS a download mode if you go into the bootloader -> Recovery. Just like the Evo's stock recovery. Then you can plug it into a computer and run an RUU.
[HTC EVO 3D] edufur:
Even so, we still need a signed RUU. Do you have one handy that has root?
[HTC EVO 3D] Vinchenzop:
Would it be possible to make the phone think that a particular system app can be updated, and use that opening to push a modded version of that particular system app that can run what we need with root permissions?
[HTC EVO 3D] slimm609:
sure... if we can sign the app that needs updated. pretty much the only way to get anywhere is to find a 0-day in the software that is currently loaded on the phones. trying to fake the signing is really a waste of time.
[HTC EVO 3D] retnuh730:
One off topic post and 5 replies by wannabe moderators saying that THEY'RE the ones clogging up the thread.
[HTC EVO 3D] Shaquiel Harris:
Pretty sure the it has root but on most things I read, you want htc sync disabled.
[HTC EVO 3D] Vinchenzop:
I didn't think system apps had to be resigned, if rebuilding with apk tool, signing system apps always caused my apps to not load, but drag and drop of the resources.arsc/classes.dex from the "build" output maintained the proper signing. And if we could mock the app update via OTA fashion, in theory, wouldn't it install itself without us needing to "fake the signing" process?
[HTC EVO 3D] deanesn:
I was thinking exactly that. Maybe find an app that can easily be altered.
[HTC EVO 3D] retnuh730:
How does HTC's ota app updates (not system updates) work? That needs root access and it updates the apps while the system's live. Anybody looked at that yet?
[HTC EVO 3D] Randy D:
Mplayer is interesting no root though, ad free is outdated
[HTC EVO 3D] pinky059:
You'd have to find an app that has root privs already. Not ALL system apps do...
[HTC EVO 3D] Leoisright:
Chubbz tried something similar and a drag and drop method and didn't work. Still looking more in to this. Also, we are looking at decompiling the hboot. I understand it isn't possible to recompile it but at least we can understand what needs to be done better

Sent from my 3VO..
[HTC EVO 3D] Leoisright:
Look at the updater script of the most recent ota. It will give you an idea the process its doing.

Sent from my 3VO..
[HTC EVO 3D] retnuh730:
I remember before the PSP had an official web browser, the game Wipeout Pure accidentally gave you one by setting your internet settings to a certain address instead of normal internet settings, and that loaded an address bar instead of a DLC store. Would it be possible to 'fake' the flag for an OTA app update (again, not system update), then download a modified app in its place? Or are even the app updates signed?
[HTC EVO 3D] xHausx:
Updated

I haven't looked myself but that is definitely something that should be looked at. I don't believe it has root permissions but there is a possibility that it does or that it could get them.

Two people replied, at the same time, letting him know that this wasn't the place to ask that. I dont know man but it looks like their posts are a lot more relevant than what you just added.
[HTC EVO 3D] TMartin:
If we found one, all we have to do is change the version number in the aol and use the old meta folder from the original apk and it'll always US to update with our modded apk.
[HTC EVO 3D] deanesn:
I don't think the HTC Sync would have root permissions as it only updates basic directories that we already have write access. Meaning it doesn't make changes to system directors but then again I am not sure do I could be wrong.
[HTC EVO 3D] pinky059:
Correct, but how many apks actually have root?? Probably not very many is my guess. At least one that is able to modified and pushed back, which is where the problem lies.

Anyone think if we intercepted communication between the update servers and our phones when downloading an OTA which contains such things as hboots, we would find anything?? There has to be an acknowledgement sent from the server that says "Okay to update phone because firmware is correct key". Now, I know it uses PKI so the private key is never reveled, however, what if we faked the acknowledgement from the server? Or faked the verificiation process altogether and sent back an "OK" message to the phone. (ACK) for everyone not a dev....

;) Just a thought, it was posted elsewhere on XDA, so I figured the logic made sense and I would post here.
[HTC EVO 3D] dragonfyre13:
nah, that's not really how it works. The package itself is signed, there's no "hey, this is OK to update" handoff going on between HTC/sprint and our phones. Just the update being signed.
[HTC EVO 3D] cordell12:
Green Hornet apk may just be the way in.

Owner: root

Group: root

They did update the app for being buggy, perhaps it is exploitable?
[HTC EVO 3D] :
Wow! This is interesting.
[HTC EVO 3D] retnuh730:
Perhaps swapping the Green Hornet .m4v with a loaded file?
[HTC EVO 3D] Leoisright:
I was able to bypass the ota and access the movie. What exactly can we do about it?

Sent from my 3VO..
[HTC EVO 3D] xHausx:
do a 'ls -l -a /system/app' and for system/bin ;)

But, someone correct me if I'm wrong, I think the app would have to be ran by something that is root for it to inherit its permissions.
[HTC EVO 3D] Leoisright:
So haus, I edited the updater on the ota by deleting the phone check and removing th hboot from firmware.zip and went to install. It got half way thru the progress bar before it stopped and went to phone with ?. You think that means it opened the bootloader and stopped when it got to the install firmware.zip ?

Sent from my 3VO..
[HTC EVO 3D] Vinchenzop:
Wouldn't it checking for it's update (or license check) through htcwatch more than likely be a root process. I can't imagine the security process that is checking and verifying the license not requiring root...we may be able to use that to jump start our attack
[HTC EVO 3D] cordell12:
I see, I also cant correct you, as I dont know :) Just tossing a idea out, retnuh730 built on it by loading a file via greenhornet.apk. But looks like a longshot/fail :(
[HTC EVO 3D] xHausx:
Hmm, you may be on to something then, it should have failed before that. Did it update your rom but not your hboot?

check out the permissions there, I think there are 2 or 3 that are superuser in there (under the bin at least)
[HTC EVO 3D] l33tlinuxh4x0r:
have you tried replacing the hboot with the eng hboot and then try to flash?
[HTC EVO 3D] dragonfyre13:
check the other thread. Got a lot of this info in there, commands run, etc already.

http://xdaforums.com/showthread.php?p=15170198
[HTC EVO 3D] Leoisright:
i don't think it did. it looks like once it hit the firmware zip it cancelled out of it all. but i will say it got the progress bar to about 50% which doesn't show that until right around the install of the firmware.zip
[HTC EVO 3D] krunkymonkey:
i dont think the greenhornet.apk was bugged. It just links to htc watch and htc watch checks for an update at launch (to keep it from being pirated) or it wont play.
[HTC EVO 3D] Leoisright:
no, i didn't. is that in the op? i certainly will give it a go then and try again
[HTC EVO 3D] Rydah:
:) sounds to good to be true, but then, it has to be cracked some way.
[HTC EVO 3D] r0cky0790:
I mentioned this a few pages back. Theres a way to bypass ota and watch the movie. I only pitched this idea because it constantly prompts you for an ota like it has an exoloit for root or something.

My ''xDU4L C0R3 SH00T3Rx'' shot you down in 3D!
[HTC EVO 3D] Leoisright:
do you have the eng hboot you can upload on here?
[HTC EVO 3D] agrabren:
Htc watch runs under an app account. Just verified this. Trying to find an app that runs as root...
[HTC EVO 3D] Rydah:
Isn't it in op?
[HTC EVO 3D] Leoisright:
well it looks nothing like the hboot, that's what was throwing me off.
[HTC EVO 3D] l33tlinuxh4x0r:
It is in OP.
[HTC EVO 3D] mhespenh:
hboota.bin in OP is the ENG hboot. Looking at the two (SHIP and ENG) in hex editor reveal them to be *very* similar. Maybe try copying hboota.bin into firmware.zip and rename it to "hboot_1.40.0000_signedbyaa_signedbyaa.nb0"?

/something something too easy to be true :)

*edit* be happy to try it myself- how did you trigger the update once you put it on your phone?
[HTC EVO 3D] DomSim:
rename to update.zip and go to stock recovery or name PC86IMG.zip and try from bootloader
[HTC EVO 3D] Leoisright:
what i do is download the ota, then edit it. then pull down the notification bar after it's edited and click install. it goes thru the process... but have to download each time i edit
[HTC EVO 3D] kaos420:
you cant drag it to desktop and save original?
[HTC EVO 3D] retnuh730:
You have to download and run it on the phone, if you remove it the phone wont ask you to install it.
[HTC EVO 3D] Leoisright:
uhmmm, something weird. The ota is completely gone from my download folder now. it's not in data or downloads
[HTC EVO 3D] kaos420:
if you reboot phone does it prompt you again? check your boot loader im sure you would know if it went to 1.40
[HTC EVO 3D] clark44:
Did you try redownloading?
[HTC EVO 3D] Leoisright:
well i downloaded it, edited the updater script and installed the eng hboot in the firmware.zip, installed, it cancelled and now the entire zip is gone. not on sd card and not in system or data....just gone

edit: Still hboot 1.30.0000 S-ON
[HTC EVO 3D] retnuh730:
Maybe failed a signature check and was deleted.
[HTC EVO 3D] xHausx:
the hboot in the op is an older one, 1.09.200 I think. I'll try to find the version and add it to the OP for you all

Edit: try hboot_1.04.2000
[HTC EVO 3D] clark44:
Maybe it thought it was a bad download so it deleted it
[HTC EVO 3D] clark44:
Thanks. Also if you could can you paste a version of the updater script from the ota?
[HTC EVO 3D] Leoisright:
Thanks.. I gotta run out for about half hour but will be messing with this for a long time tonight..
[HTC EVO 3D] mhespenh:
Which lines are you removing from the updater script? I didn't edit it, and I can't get the update to even start installing.

Edit: Installing as update.zip and PC86IMG.zip don't work- both give "wrong image" type errors.
[HTC EVO 3D] Leoisright:
did you see any of the progress bar? this last time it got to about 25-30% then stopped

edit: i deleted all the top part about phone checks..
[HTC EVO 3D] mhespenh:
That might explain why it failed- it won't install an older version of hboot. I still think this is way to easy- we're probably going to fail a signature/checksum check at some point in this process.
[HTC EVO 3D] Vinchenzop:
Ill be here with you leo, after I get my daughter in bed that is...

And after I put out my last version of skyraider for the 4g folks
[HTC EVO 3D] lawnguy:
ok, tired of reading, I want to get invovled, what lines am I editing in upater script, the two checksum lines?
[HTC EVO 3D] Leoisright:
I think its important to leave the checksums alone. Next just editing the firmware.zip to see if we could put the entry hboot in there to replace the 1.4 that's in there

Sent from my 3VO..
[HTC EVO 3D] xHausx:
I'm not sure about the extension, personally I would try .bin, .img then .nb0
[HTC EVO 3D] chubbzlou:
the extention in the ota is nb0.
[HTC EVO 3D] lawnguy:
so just throw the new hboot in the firmware when he gets it posted, or still edit the updater as well?
[HTC EVO 3D] Leoisright:
That was throwing me off too. What are the s-off extentions?

Sent from my 3VO..
[HTC EVO 3D] xHausx:
I would try them all, think the old hboots used the .img extension while the new ones use nb0. I'm not sure if that has to do with them being signed or what, it may look for the android header or a file name that says signed if you use the new one.

In short, I have no idea. lol
[HTC EVO 3D] chubbzlou:
would the old hboot extention would be in the leak ota?
[HTC EVO 3D] xHausx:
Which one?
[HTC EVO 3D] chubbzlou:
The one from the leak is it nb0?
[HTC EVO 3D] xHausx:
Ohhh, the one in the op? I'm not sure, the fast boot command they used said .bin but I think that is just a generic extension. It came straight from the hboot's partition.

If some one can open it up with a hex editor you should be able to see the 256 byte sig and the android header at the top, if it its there then it's signed.
[HTC EVO 3D] Zarboz:
So we could unodex it pack a exploit for when the app boots to gain root shell? Idk anything about rooting just porting just an idea or will the system check the sigs on green hornet and deny root?

sent from my EVO 3D
[HTC EVO 3D] Leoisright:
ok, well i edited the build on it to be greater than 1.4 to see if it will take then

edit: in the ota, the hboot is the only file in there that isn't an .img file. gonna try img first
[HTC EVO 3D] clark44:
If it signed its good
[HTC EVO 3D] Product F(RED):
I know some people were talking about HTC Watch using root. You can uninstall the update through Settings -> Applications. There's also another app/service called "HTCWatchRecv" which can be uninstalled.
[HTC EVO 3D] xHausx:
Edited the hboot file?
[HTC EVO 3D] Leoisright:
yup...gonna probably brick the phone but that's what insurance is for...jk

either it installs or not with this...trying it out now.

edit: same issue. gonna try somethin else.
[HTC EVO 3D] AyyRayy:
i have tried almost everything.

download OTA, Modify hboot to ENG and make it simulate 1.4 (30% load then red question mark)

download OTA, Modify hboot to ENG and make it simulate 1.4 , then rename to PG86IMG.zip , move from my download folder to the root of sd, boot into bootloader and it just checks and spits nothing out

download OTA, Modify ENG hboot in Hex editor to closer resemble file size of 1.4 (40% load then red triangle)

download OTA, Modify ENG with hex editor again and make it simulate 1.4 with similar file size , then rename to PG86IMG.zip , move from my download folder to the root of sd, boot into bootloader and it just checks and spits nothing out

WinRar shows that the files have been signed with SignAPK and I've tried that also. No luck but I feel we are getting closer
[HTC EVO 3D] Leoisright:
@haus, why the difference with ? and triangle. I noticed the triangle is the same you get when you select recovery. Hmmm, is it possible to get logcat at all while it's trying to install this? or adb push parrallel or anything.

He's right tho, seems like one gets a tad further than the other and it's gotta mean something
[HTC EVO 3D] mhespenh:
Modifying the hboot file is probably causing it to fail a signature check at some point.
[HTC EVO 3D] slimm609:
Gonna have to create a collision with the hash to get it to pass signature verification.
[HTC EVO 3D] unCoRrUpTeD:
I've been looking at a flash exploit. I have looked at several different ways. Here are my findings....

Running the exploit used on the Evo 4G will not work with the way our phone is setup. We can not see any directories in /data. The scripts used the ls command several times. I even tried

for i in * ; do
echo $i
done

in data with no luck

I have what I think is a 0 day exploit, but do not know what I would need to do with it. It is attached for any one that might know what they are doing. I can install an earlier version of Flash, but once I reboot it changes back to the version that cam on the phone, so I am not even sure if it is actually installing it to /system/app or just deleting and creating new data in /data/data.
[HTC EVO 3D] AyyRayy:
Yeah there has to be something we could do in a hex editor because my phone loaded a tad bit further.
[HTC EVO 3D] Leoisright:
ok, got a crazy idea

why not take a apk and moddify it with apktool, and when it asks if it's a system file we say yes and link it directly to stock framework that we pulled via adb pull system.

then we could rebuild and sign the apk with it being linked to the system... long shot but could it work?

edit: thinking about installing an outside apk like su to link to framework or com.htc.resources.apk

I also mean to set dependancy on system framework then we may gain access to system
[HTC EVO 3D] DomSim:
sounds like gibberish and black magic to me, but you go boy
[HTC EVO 3D] Leoisright:
well we were able to make the speedy rosie dependant on the kingdom com.htc.resources.apk and make it do things it normally wasn't meant to do...