yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] Doward:
I've got multi-lib capabilities here on my development Gentoo box. I saw xHausx posted ld, I'll grab that - but I'm new to attempting root, so tell me what you need done :)
[HTC EVO 3D] SAShady:
dunno if this will help. from the stock RUU installer

Serial# 78 3c 21 4b 94 ad fd a9 3e 24 08 06 df 51 55 71

Signature Algorithm: sha1RSA

Public Key: RSA (2048 Bits):

30 82 01 0a 02 82 01 01 00 a5 39 ff 1d f5 93 d1 56 85 fe 15 8c 03 02 ba 90 41 03 2e 67 b3 bc 73 8a 60 85 f0 e3 0a 1e 3a 35 4a b0 d7 12 6a 8c 71 06 c4 38 21 f0 d6 61 29 ae 31 cb 44 7a 96 65 aa 2d f9 1d 37 4b 61 6c 17 5c cd 28 6f b1 cb 33 ec 95 bf a4 78 c1 c2 6c 38 3d 2d 3d a6 27 b4 df 4e 75 ba fe 27 ac 94 32 ba 4b 6e a5 59 ce 4f 6f 2e 51 85 2b a8 5c df 19 8f 07 10 54 a8 9c fc b0 72 2a ba 8f 5b fa 25 3a 31 db f5 27 38 35 de 43 05 0f 00 c6 0e 51 f5 09 dd c4 7a 0f 43 52 b5 3e 39 f7 9f 29 8a 6a 2f 21 bd 6d 67 00 42 e4 2c e3 91 2e c0 2c b7 82 fb 92 b4 2b fd ae 7c 34 e7 2c e5 97 a3 e9 6f 44 7f 97 62 57 97 1e 73 53 ff 59 db ff 45 4f ec 46 88 e5 92 a5 ed 5e e4 ad 71 e6 89 93 85 71 d2 ec eb ba d0 6c 9d a3 ca 63 ae c5 c6 02 d6 91 52 b1 b7 6e 19 2c d2 a2 bf 39 86 64 e8 b8 55 90 8f 82 a6 5c ed 41 02 03 01 00 01

Code Signing (1.3.6.1.5.5.7.3.3)

Authority Key Identifier:

KeyID=cf 99 a9 ea 7b 26 f4 4b c9 8e 8f d7 f0 05 26 ef e3 d2 a7 9d

Thumbprint Algorithm: sha1

Thumbprint: ‎d7 7a 10 28 c8 08 12 6f 0f 99 5f af ca 07 51 c5 15 1a 18 4a
[HTC EVO 3D] xHausx:
o_0

How were you able to get this from it?
[HTC EVO 3D] RVDigital:
Well **** MAN, I'd say this is the most progress I've seen yet. Can you give us a little more info as to how you went about getting this? We're going to need it!

And, Thank you!

:)
[HTC EVO 3D] SAShady:
Go into properties and view certificates in windows
[HTC EVO 3D] pinky059:
So, in theory, we could make our own ceriticate for an RUU which contains the ENG H-boot, maybe, possibly??

Or maybe even use it to sign the ENG bootloader directly.
[HTC EVO 3D] agrabren:
Does someone have the private key that goes with it?
[HTC EVO 3D] issafram:
Exactly....a public key is public. And the private one is...does anyone have it?
[HTC EVO 3D] Leoisright:
@Haus

when we hack the hotspot we have to decompile the classes.dex then edit the smali in a specific file. Is it even possible to decompile the hboot and then edit a couple strings and recompile it?

When using notepad++ on line 9443 you will see the string:

system partition only can be formated while security is OFF. I was able to change it to ON but not sure what else is in there with out completely decompiling it. Just a thougth.
[HTC EVO 3D] Geniusdog254:
Modded bootloaders are nothing new. On the G1 (oh the good ole days lol) we had modded bootloaders that changed the partition table so we could have bigger roms. As dangerous as it is, it is still very possible. However, the issue is that even if you do that, you can't flash it back to the device, because the signature will be different than it should be.

It's the same issue that's keeping us from having root now.

As for some of the other root ideas I've seen this far, getting an authentic copy of SMART_IO.CRD to use seems the best until HTC unlocks the bootloader as promised.

The CVE-2011-0611 mentioned in the OP might have potential if done right, but I think even if we could smash through with Flash it'd be difficult to get root with it, since flash isn't running as root to start with. That's why the old Gingerbreak & RageAgainstTheCage exploits worked so well. They targeted system services that were already running as root. RATC exploited a flaw in coding logic that allowed us to have our way with the device, and Gingerbreak uses an out of bounds array.

I hate to say it, but waiting for HTC may be our best option unless we can get a leak of the SMART_IO.CRD, or find a zero-day exploit we can get root with.
[HTC EVO 3D] Shadowmite:
Well, you guys could also go and implement out all the stubs required in the smartcardio spec as listed:

http://download.oracle.com/javase/6/docs/jre/api/security/smartcardio/spec/

This would most likely not be a entire waste of time. Meanwhile we might have something up our sleeves eventually.
[HTC EVO 3D] Leoisright:
thanks for the explanation. This clears up a lot. I just can't stop thinking of different ways to help. I only wish I could he helpful in this rooting process but really don't know where to begin. My talents are in porting and customizing not bootloaders..
[HTC EVO 3D] Geniusdog254:
No biggie. A lot of us have never specialized in rooting devices or any really low level stuff. I've built popular overclock kernels for the Epic 4G and the Nook Color, but that's about it. The whole community is interdependent on the people who specialize in other things.

I have no clue what I'm doing here, just what I've messed with in kernels, and that's about it. I'm a Java dev, I don't do bootloaders. Lol
[HTC EVO 3D] AyyRayy:
Bro thats some good information. That breaks down all the public aspects of the smart_io.crd API. Good Find!
[HTC EVO 3D] Geniusdog254:
Definitely! Although, I just skimmed it, it seems like it's more of the API to implement to use the cards, like what's running in the bootloader. Plus, it's higher level code, not C or ASM like in the bootloader. We might be able to use it to make a card though, assuming HTC hasn't tweaked anything.
[HTC EVO 3D] AyyRayy:
Thats great news! I'm extremely new to code but would love to try and work on this and test when needed. =]
[HTC EVO 3D] Doward:
I've been researching the Java Card angle - the VM evidently runs on a processor embedded into the Java Card - not on the device itself.

In other words, we'd need a SmartCard microSD with an embedded processor to even begin working in that direction.
[HTC EVO 3D] Shaquiel Harris:
That's why we get that java-error as well..
[HTC EVO 3D] ckoadiyn:
so if we can get the "public key" from the ruu we couldnt get the private key from the leaked rom that has s-off? jw
[HTC EVO 3D] chogardjr:
I don't know much about finding root as that is not my area of specialty.

BUT....what about the built in mirroring? Is there a system app or some way to reverse the data flow of the hdmi/usb/charging port while it thinks it is mirroring to an hdtv? I can't think of mirroring happening before without having some kind of root permission.

Just throwing things out here.
[HTC EVO 3D] Geniusdog254:
I'm not entirely sure what you mean? Of course the mirroring thing has root permissions to both framebuffers (built in display, HDMI out, and maybe even a 3rd for 3D), but it's running as a system service. Sure there may be exploits there, but the same could be said of anything the kernel is running.

As for people that keep asking about the private key: NO! It's not released anywhere. It's kept somewhere safe & sound on an HTC server. They sign with the public key and the private key before an update, and that's it. Done. Private key never goes out. They wouldn't even have reason to move it from their build machines.

As for the smart card processor thing, damn. That sucks.
[HTC EVO 3D] Apeleon:
No it would change they key signature that the phone recognize as safe/official the only ways I can think if is a gold card method which would ignore signatures or to some how inject a block of memory or data to run a temporary root at boot.
[HTC EVO 3D] zonyl:
Further still you would need the private key to be put on said card. It would appear HTC has upped the ante on keeping the private key safe. They no longer have to give out the private key to anyone in order to develop or "remanufacture" phones, just distribute these cards where the Private Key can not be read from.

This is probably why there hasnt been and never will be a leaked signed eng hboot. There is probably only one person in the world who has seen the key.

http://www.certgate.com/index.php?id=71&L=1
[HTC EVO 3D] austontatious:
Jeez - is this the company actually providing the SmartCards? 2048 encryption... Does anyone have a quantum computer lying around?
[HTC EVO 3D] ekt8750:
Just throwing **** on the wall and hoping it sticks, HTC just announced that the 3D is going across the pond to Europe. If that ships with an unsigned bootloader, any chance we could use that to our advantage here?

http://www.androidcentral.com/htc-evo-3d-coming-europe-july
[HTC EVO 3D] Stericson:
Please try to keep conversations within this thread specific to the topic of the thread. I am working on cleaning the thread up and will be deleting posts as needed and warning users who continue to post non related "junk" that does not belong within this thread.

Thanks,

Stericson
[HTC EVO 3D] SAShady:
http://db.tt/S0P4zEJ

Heres a list of all the sha1 checksums for the update.zip
[HTC EVO 3D] unCoRrUpTeD:
Adobe flash exploit

I hope this doesn't get buried in all the post that have nothing to with the actual work of rooting the device. If anyone could figure out how to get the exploit for adobe flash to work on our phone, you can install the version of flash that is in question. I can't look into any more today, because I have to go into work until midnight.
[HTC EVO 3D] pastorbob:
I believe they already explored this to an extent... they think that since Flash doesnt need root to run it likely wont be a workable exploit for our task at hand...

I could be wrong though.
[HTC EVO 3D] hdad2:
I see people giving up on the flash angle. How did this work on the evo4g with flash lite? We still have flash lite on the 3vo. Just a browser plugin as opposed to the full flash app. I'm sure Adobe keeps up flash pretty secure but maybe flash lite is more vulnerable? I don't know, maybe they are built with the same security.

Presumably, if this wouldn't work now when it did before, its because all has been patched.
[HTC EVO 3D] m03sizlak:
http://www.gottabemobile.com/2011/06/21/droid-incredible-2s-bootloader-gets-unlocked-by-community/

The f**k?
[HTC EVO 3D] cordell12:
This is good news, it should help us as w may be able to us same method!
[HTC EVO 3D] kkwus74:
Wow! I hope this is for real!

Sent using my smoking Evo3D
[HTC EVO 3D] chaseclear:
Ditto! That would be such a slap in the face to HTC! I am definitely going to hold my breath for this! :D
[HTC EVO 3D] cordell12:
its REAL!!!

http://www.androidpolice.com/2011/0...2-rooted-and-unlocked-s-off-by-alpharev-team/
[HTC EVO 3D] darkflame:
Lol 3 minutes before he releases Htc is gonna drop a facebook message saying they want to unlock the bootloaders becauase they dont want to have the PR fallout of a having to acknowledge the fact someone else has to do it for them.

Sent from my 3vo.
[HTC EVO 3D] kkwus74:
Lmao... That's their fault if it happens.... Kinda embarrassing for them when it happens tbo

Sent using my smoking Evo3D
[HTC EVO 3D] bigant262:
See the date for that? The 20th, I would have expected something already! lol. Well anyway, I found the thread, http://xdaforums.com/showthread.php?t=1132920
[HTC EVO 3D] kkwus74:
Well maybe he has another method for htc devices cos that's what the article said bout htc devices being unlocked.

Sent using my smoking Evo3D
[HTC EVO 3D] mbh87:
we need temp root, we have an eng hboot, we dont need alpharev.
[HTC EVO 3D] unCoRrUpTeD:
Temp root, no use.

Why do you say that. With temp root you could run root apps and modify certain things.

Sent from 3D land
[HTC EVO 3D] mbh87:
we obviously cant use their method though, or else we would already be rooted. so the inc 2 having s-off doesnt help us.
[HTC EVO 3D] l33tlinuxh4x0r:
if we had s-off we could root without temp root. and we could flash a recovery and what not too.
[HTC EVO 3D] sgt. slaughter:
Yes you are correct. a way to get S-Off is pointless without a temp root at the least from what I gather. Those have had temp root there for awhile I think. The DInc2 uses gingerbreak to get root, now they are using AlphaRevX to get S-Off on top of that.

Hence if you check alpharevx twitter they specifically say do not update to the Gingerbread OTA for Inc2 users b/c it patches gingerbreak.

We still gotta find a way to get temp root here.
[HTC EVO 3D] mbh87:
you need temp root for alpha rev or the eng hboot we have. so without temp root, we have pretty much nothing.
[HTC EVO 3D] sgt. slaughter:
but your suggesting getting s-off without getting root to begin with, how would this work out?

now in regards to alpharevx's method they are getting s-off only on devices that already have temp root from what i read so still their method is not gonna work here at this point.
[HTC EVO 3D] lowetax:
hell no - imma gonna accepta the OTA

i want the calendar to work properly ! ;)

J/K

should have mine in an hour or so

pm if you want me to do anything

(the developer part is a Myn's RLS 5 thread joke)
[HTC EVO 3D] NxtGenCowboy:
2.6.35.10-gcb1cf83

htc-kernel@and18-2 #1

SMP PREEMPT Mon June 13 20:03:22 CST 2011
[HTC EVO 3D] CheesyNutz:
could be .....
[HTC EVO 3D] Evil Bob:
Grrrr... curse you damn goldcard!
[HTC EVO 3D] xHausx:
ohh yeah, that was just last week. Gingerbreak is definitely not going to work then. You have hboot 1.40 right?
[HTC EVO 3D] DomSim:
"hitting their facebook" is not needed. they promised to unlock and im sure they will. they never made any promise of time though. there is a lot of red tape they will have to jump through with carriers im sure so it may be a bit. the ceo very publicly announced they would unlock them including the e3d so it WILL happen. of course, our devs may beat them to it ;)
[HTC EVO 3D] NxtGenCowboy:
Yes I do. OTA...
[HTC EVO 3D] dagnasty:
Mine shows:

2.6.35.10-g93c03bf

htc-kernel@and18-2 #1

SMP PREEMPT Mon May 23 21:29:47 CST 2011
[HTC EVO 3D] l33tlinuxh4x0r:
I sure hope that this gets full root by Sunday. And knowing our hard working devs it will be.
[HTC EVO 3D] alchemist316:
already started lol
[HTC EVO 3D] Evil Bob:
It's already begun, their wall is being hammered now as we type. Several other dev forums have discovered the same info we have... encrypted signature.
[HTC EVO 3D] xHausx:
Time to get the pitchforks back out.
[HTC EVO 3D] poopymt3g:
They also said the HD2 would get WP7...not that anyone really wants it but they also promised that and failed..
[HTC EVO 3D] NxtGenCowboy:
delete this message mods
[HTC EVO 3D] alchemist316:
im only pissed cause i sold my 4g
[HTC EVO 3D] l33tlinuxh4x0r:
I'll sell you my rooted evo 4g for $175 plus shipping
[HTC EVO 3D] sdc177:
+ 1
[HTC EVO 3D] Buff McBigstuff:
They promised Duke Nukem Forever 14 years ago!!! If you told those poor dead bastards who died waiting for it that "they never made any promise of time" they'd kick you in your nuts. Do you wanna wake up on some cold winter morning 2 years from now when nobody cares and find out that HTC just unlocked the bootloader?

EDIT: I smoke, I might be dead in 2 years.
[HTC EVO 3D] mrrogers1:
Oh damn... we knew it would be locked out of the box but I hope the hammering helps and does not hender our cause.

Time will tell.
[HTC EVO 3D] Zarboz:
That's the same hboot we have ??

sent from my EVO 3D
[HTC EVO 3D] johnsonjs:
Just posted on twitter

htc HTC

@

@idiedlastyear We're sticking by our decision to provide a way for people to unlock their bootloaders. We greatly appreciate your patience.

5 minutes ago
[HTC EVO 3D] xHausx:
I'm still looking in to it for us but that one was a 0 day, it will only work on a limited number of phones now that everyone knows about it. It also means that everybody who updated would still be stuck w/o.
[HTC EVO 3D] Shaquiel Harris:
What's the 0 day flash version again? Just curious. Glad your still working on it though. I'm assuming there was no exploit in Adobe reader or adobe air?
[HTC EVO 3D] unCoRrUpTeD:
Was there one made for android. Post a link if there is. I'll look into it when I get home.

Sent from 3D land
[HTC EVO 3D] Randy D:
Maybe i missread the adobe flash exploit. I think 3 , 5 posts earlier for that request, my bad
[HTC EVO 3D] mhespenh:
ASM/ARM experience

Hey folks,

I'm finishing up my undergrad in Comp. Engineering (embedded systems) right now- saw several people asking about ASM and ARM experience- I've got that, but I'm not quite sure where I should be looking.

Anyone wanna task me out, or at least point me in the right direction?
[HTC EVO 3D] gjlowe:
Is the smart card image visible if I connect my 3VO in USB drive mode? Do I have to remove the card or show hidden files or something else?
[HTC EVO 3D] mlin:
Lmfao!
[HTC EVO 3D] lil_bono:
Smart card

I've had some experience with smart card usage back when I was testing DirecTV DSS cards. What kind of card do we believe that the device is looking for? Some sort of device linked thru the SD slot like the XTC clip? Or a small form factor Gold Card?

We can emulate a smart card as well I believe... We would need to know the type of card though.

Actually, if it is a card that we can get a leak of, and we could emulate it, we could use that as a form of rooting possibly... NAND unlock? Who knows.
[HTC EVO 3D] Shaquiel Harris:
Linked through the SDslot. Can you go to the IRC? #HTC-EVO-3D
[HTC EVO 3D] AyyRayy:
Sounds like a lead!

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] lil_bono:
Sure. Shaquiel Harris, check your PM...
[HTC EVO 3D] xHausx:
There was the one in the op but I dont think it'll be able to give us the permissions we need. I remember seeing an older one too but I can't remember which tbh, too many of them for adobe to keep track of lol
[HTC EVO 3D] Apeleon:
I am in no way a developer in any shape or form but this stood out to me in the terminal emulator the init.shooter.rc file is the the command to start loading the rom? Such as in linux you could do init.shooter.rc restart if if like a service or init file maybe we could reboot the rom and have it ran as another user to implement changes like I said no idea about android development just an idea
[HTC EVO 3D] freeza:
Can someone with "fast boot" disabled try something:

with a memory card in your phone and the charger plugged in, completely power it down, and tell me if your charging light goes off and comes back on.

Mine doesn't. requiring a battery pull to turn it back on every single time. This happens with the stock memory card as well as my 32GB. With no memory card in, it shuts down and boots back up just fine.

What does this have to do with root? IDK, I was messing around with the writesecureflag command as well as goldcard method from the Inspire 4G and some other ****. But then again, I noticed this on the first ****ing day I got my phone, so who really knows what they have to do with each other.
[HTC EVO 3D] kellyrx8:
Mine does when fast boot is off, red light goes out for like 3 seconds and then comes back on.
[HTC EVO 3D] AyyRayy:
Does the EVO 3d have anything similar to "download mode" in Samsung phones ? Because we can use sudo nautilus in ubuntu and add files to /system/bin and /system/app

Sent from a dual core beast 3VO. Do this on your iFail 4 :D
[HTC EVO 3D] ckoadiyn:
Already been talked about nope doesn't
[HTC EVO 3D] xHausx:
Cleaned up the OP some, wish I had more to post but there's not a whole lot to report yet.
[HTC EVO 3D] alchemist316:
Goes back on after 3 seconds usb and ac

Shooter
[HTC EVO 3D] popular nobody:
How can I help? I'm willing to sacrifice my pre-production device with no worries. Is their anything in particular you want to know from HTC, involving this process? I meet with them on Friday.
[HTC EVO 3D] sgt. slaughter:
Just wanna ask this ? just to be sure for myself if one of the experienced devs could chime in id appreciate it.

I know currently we are trying to get temp root so we can then push in the ENG bootloader to get s-off and full root correct?

And you can't get s-off any other way less you find a way to bypass the encryption somehow(other than temp root), or go through it, which is highly unlikely...correct?

The more I sit around and think about it the more i think this depends on finding a hole in gingerbread or really one of the components/apps installed on the system in order to get the goal done. Which is why reader and flash attacks have been mentioned mostly so far.

I can't imagine that it is fully secured and no holes, and am surprised that there hasn't been a hole found in any of the 2.3.3's yet. But now when I say that it kinda makes sense as most devices with 2.3.3 that are not nexus's are ones that likely had root before and so in turn the "need" for an exploit hasn't been near as big.

Sorry for the ramble there might be jumbled and lil confusing as its early morning here on the east coast.

new to coding and all somewhat but im the kinda person that takes stuff apart and reassembles to find out exactly how everything works.
[HTC EVO 3D] RVDigital:
/Cautiously Interested

May not be much you can do that hasn't already been done until significant progress is made. If you really are "meeting wit them"...

Get us a date for the Unlock, 30 days? 60? 90? 6 months?

and/or

Get a leak
[HTC EVO 3D] popular nobody:
I'm not sure how someone at Qualcomm could get you an HTC leak or stupid enough to admit to providing a leak, but a tentative date is doable. The bootloader situation is high priority level to HTC, so isn't like they reneged on their deal. People thinking they were going to see the Bootloaders updated by time of launch wasn't realistic. Both the Sensation 4g and 3D were gold before the announcement.
[HTC EVO 3D] will75:
Essentially you are saying they said it just so EVO 3 d sales would be good. Knowing they had no intention on delivering anytime soon. I know they know we can and will return this. That is why they announced it. So we would purchase. Knowing full well most would not of otherwise

Something tells me if they could just leak the key they would. But doing so would somehow put their trademark or whatever process the generation of the key at risk,thus providing a security problem in the future. They know day by day they are taking a image hit
[HTC EVO 3D] sgt. slaughter:
This isn't usefull at all is it?

Android 2.3.3 Exploit- Memory Exhaustion Attack

Other out of the box idea is what about looking into the HTC transfer app? would it be possible to have it transfer over a exploit embeded in one of the things you transfer to the evo3d since that is writing to the system no?
[HTC EVO 3D] zonyl:
Id be curious to confirm that their development on the device now requires a smartcard in the sdcard slot to flash their unsigned engineering bootloader, instead of previously needing a signed engineering bootloader.

Suggest to them that just placing a signed s-off bootloader on the HTC dev site would quiet everything down. They could even put some sort of legal jargon on it saying it is illegal to use, "dont use it", blah, to excuse liability.

While the rev from phone sales of 10% may not seem to impact sales, their social sites being spammed by the noisy 10% is costing them far more. It is also providing exposure to the 90% that didnt previously know they could root and why they should.

Also I would remind them that we need kernel source. ;)
[HTC EVO 3D] sgt. slaughter:
Thought that if the exploit allowed sys access then we would be able to flash the ENG bootloader we have, no?
[HTC EVO 3D] zonyl:
Ditto. I thought that is how Alpha Rev X did it for the Wildfire?
[HTC EVO 3D] Ep3n3wp:
Is it possible to move or copy files to

/data/local/tmp
[HTC EVO 3D] zonyl:
Yes +10char
[HTC EVO 3D] Ep3n3wp:
Don't know if this has been tried or talked about (sorry if it has)

But what about placing rageagiansthecage exploit in /data/local/tmp then executing it then place eng and what ever else is brief l needed
[HTC EVO 3D] MordyT:
That exploit is patched in gingerbread

Via my HTC Shooter
[HTC EVO 3D] Indirect:
Since the android OS is based on linux kernel (if I remember properly) wouldn't a kernel based privilege escalation exploit work for it?
[HTC EVO 3D] TMartin:
Someone posted the memory exhaustion exploit, which was a video, but I don't really see the exploitation in it. Can anyone elaborate?
[HTC EVO 3D] Ep3n3wp:
Ohh I thought I read somewhere that rage against the cage for 2.3.3 worked

http://www.amarjit.info/2011/04/unrevoked-333-may-launch-soon-exploits.html?m=1
[HTC EVO 3D] MordyT:
Nvrm

Via my HTC Shooter
[HTC EVO 3D] TMartin:
Check the date of the article: Friday, April 29, 2011