yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] Sortilege:
These ideas are awsome. I fawking love you all. You are doing gods work ;-)
[HTC EVO 3D] wineguy:
Yes, something about updating the binary file can not be completed, saved to SD card, boot into recovery to install. Something to that effect...
[HTC EVO 3D] CrippleB:
I did not get this. In the market it shows as installed. But the open button is not able to press.
[HTC EVO 3D] chubbzlou:
if su is installed in the bin the we can or should be able to write the system.
[HTC EVO 3D] mrjaydee82:
Okay. In safe mode su installed. I restarted phone and superuser is there and shows up. I tried titanium backup but says root access failed. But Su is definitely on my phone....just doesn't work lol
[HTC EVO 3D] juggaman:
After bring into safe mode, my only downloaded app that shows is adobe reader...meaning it is a system app. possible exploit?
[HTC EVO 3D] Vinchenzop:
I saw someone mention sprint zone...telenav gets installed via sprint zone and it is a system app, maybe we can work this edge
[HTC EVO 3D] chubbzlou:
ok dam then even in safe mode we can r/w to the bin folder.
[HTC EVO 3D] wineguy:
I got this message when I rebooted and actually went into apps and opened SU.
[HTC EVO 3D] Leoisright:
Weird, mine didn't install to SD card. But then again I edited that apk to have dependancy on the framework.jar

Can anyone else install su who already hasn't to see it it installs to sdcard or phone?

Sent from my 3VO..
[HTC EVO 3D] kellyrx8:
you can install it regardless it just wont give the correct SU permissions without root access.
[HTC EVO 3D] Vinchenzop:
Unfortunately, that just means that the apk is installed but not the su binary, you'd have to check /system/bin for "su" when trying to check this
[HTC EVO 3D] chubbzlou:
adobe expoit was already discussed the expoit has been patch already on 2.3.3.
[HTC EVO 3D] TMartin:
Installing the Superuser apk works but it doesn't install the binary.
[HTC EVO 3D] kellyrx8:
mine installed to the phone.
[HTC EVO 3D] juggaman:
SU installed to my phone afdc installed from safe mode
[HTC EVO 3D] Leoisright:
Ok, chubbz, since you deodexed the system already, try to install some of the system apps then see it it is on system/app?

It seems all Sprint apps are not odexed. With that said, you think any of those are exploided and we can get to system that way?

Sent from my 3VO..
[HTC EVO 3D] irock1985:
Not in safe mode installs to phone
[HTC EVO 3D] chubbzlou:
Superuser installes but the binary don't so it puts it on the sdcard as a zip to install at a later time.
[HTC EVO 3D] bsims85:
I was able to install Superuser without going into safe mode. It's definitely not installing the binary.

Sent from my HTC Evo
[HTC EVO 3D] wasupwithuman:
Ok, so I've been trying to find out a way to do this. My attempt has been trying to modify the adobe flash apk, so it installs su. I was getting a signing error, so i signed it with test keys, and when trying to install it, it tells me it's already installed. What version of flash are we running? It says 10.2 but i'm trying to install a 10.3 apk, so not exactly sure on that. I tried to reinstall it using pw but it gives me a certificate error, so I enabled the tag that will allow testkeys to be installed and it once again tells me that it is already installed. any ideas?
[HTC EVO 3D] CrippleB:
Mine as well.

Edit: SHortcuts created on home screens even if they do not show in apps in safe mode will run. In safe I launched su from home screen short and finally got the binary file error. Don't know if this helps but you can launch some non system apps from home screens in safe. Netflix was really all i tried so far.
[HTC EVO 3D] kellyrx8:
im on 10.2, just rolled back the update on the phone. was on 10.3 most likely a market update in my case.
[HTC EVO 3D] SAShady:
Sorry just got home. Sure enough fails when I add the other hboot. Bummer
[HTC EVO 3D] wasupwithuman:
SU installs but it doesn't place the file in system/app/ I tried this yesterday. I noticed yesterday that HTC sync can be moved to sdcard, but when I did that I could not find anything on my sdcard, so yeah.... I doubt HTC Sync even runs as root.
[HTC EVO 3D] irock1985:
I believe they were asking for you to post your zip w/o the hboot
[HTC EVO 3D] Leoisright:
Check to see if anything updated. Also, check system update. Got a feeling it didn't do anything.

Sent from my 3VO..
[HTC EVO 3D] Vinchenzop:
Dont worry about the hboot, just try to add the su binaries to /system/bin
[HTC EVO 3D] JoshuaAlba:
Mine installed to SD card. Idk if this helps, everyone else mentioned it installed to their phone. Been trying to not post anything stupid here since saturday lol
[HTC EVO 3D] AyyRayy:
Before booting into safe mode, place whatever apps you desire to access root explorer, astro, etc.. put these on one of your carousel windows. Reboot into safe mode and you can now access these.

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] Leoisright:
Did you update Ur phone or not? Wondering why some install to phone and others to sdcard

Sent from my 3VO..
[HTC EVO 3D] unCoRrUpTeD:
I'm looking at an exploit to run during start up or shutdown. So far nothing.

Was looking through dmesg for partition sizes and found some crazy things.

Doesn't have to do with root, just weird...

[ 0.407261] input: Macintosh mouse button emulation as /devices/virtual/input/input4]
[HTC EVO 3D] kellyrx8:
yeah did you install the OTA? seems everyone is installing to phone and not SD

***edit leo alrady asked***
[HTC EVO 3D] JoshuaAlba:
Yeah I installed the OTA. It's saved on the root of the SD card.
[HTC EVO 3D] CrippleB:
I posted that earlier, can anything come of this?
[HTC EVO 3D] kthejoker20:
Did anyone try the obvious?

Boot in safemode and them open terminal and type su ?

If you try this and get # let us know.
[HTC EVO 3D] Leoisright:
So if you installed update, the hboot may close ability to install any foreign apks to phone now.

Sent from my 3VO..
[HTC EVO 3D] Leoisright:
Yes, permission denied.

Sent from my 3VO..
[HTC EVO 3D] JoshuaAlba:
Ugh. I knew I shouldn't have updated. Green Hornet was a crappy movie to begin with :mad:
[HTC EVO 3D] Leoisright:
Lol, sorry bro. I was able to watch without update. So how many updates have their been, I thought two?

Sent from my 3VO..
[HTC EVO 3D] JoshuaAlba:
Well I bought mine on saturday, and I only had just one update. I'm assuming 1.13.651.7 is the latest.
[HTC EVO 3D] CrippleB:
I won't even let htc watch update because it keeps trying to push a system update. Glad to hear it sucks then there is no urgency for me to watch it.
[HTC EVO 3D] Leoisright:
As soon as it opens, press bottom left of the screen where the tab is. It may take a few times but you will bypass the ota request. Be fast, hit it before the ota request comes.

Movie is worth watching in 3D. Not a great movie but cool to see the 3D effects.

Sent from my 3VO..
[HTC EVO 3D] bradley26:
I updated and have installed apps outside of the market.
[HTC EVO 3D] CrippleB:
Man you are so damn smart, I knew there was a reason I liked you. First time seeing the movie. Good looking out

Edit: Wow that really does look good in 3d on this phone.
[HTC EVO 3D] ianoob:
I have installed 3 updates... 1st changed hboot, 2nd fixed watch, 3rd fixed lockscreen.

I installed the Sony panoramic camera from general android via forum after the updates
[HTC EVO 3D] Leoisright:
True, but what I'm saying is it may not install to phone but to sdcard. Means they could have closed an exploit of installing to system.

Have no idea, just a thought is all.

Sent from my 3VO..
[HTC EVO 3D] drob311:
Been watching this thread because I'm waiting to go get the 3evo until root is achieved... I love the creative and outside the box thinking. Keep up the excellent work!!!! Reason I'm posting is because I have an evo shift and was just notified that I have to update apps...

One of them is adobe flash, just thought I would post that because I read somewhere back it might be an exploit, since they are updating it I gotta think there is an exploit there somewhere...

Please don't flame me, I'm only trying to help without sounding like a meathead... Keep chugging guys, you will get it!!! We all have confidence in y'all! :)
[HTC EVO 3D] AyyRayy:
According to the xmlmanifest for Sprint zone it has all the system permissions necessary to install superuser to system/app

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] Leoisright:
Yup, that's what I thought. But have no idea on how to make it install su to bin.

Sent from my 3VO..
[HTC EVO 3D] t3project:
haha, the facebook app is the same way. if you click on a persons profile that is private or that you're not friends with and wait it will tell you that only certain people can see it but if you click on it then immediately click on any of the tabs at the bottom it pulls up the wall/photos etc.

sorry not root related but just throwing it out there.
[HTC EVO 3D] AyyRayy:
Could we escalate the privs on the superuser.apk so that it has access to write its binaries in system/bin?

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] xHausx:
The NAND lock (s-on) prevents writing to the system partition in all but the hboot and recovery. You may be able to put something there temporarily but it won't survive a reboot. Still, if you can get su there temporarily, or possibly even just on /data, with the correct permissions will be good to go.

With the update getting half way through it was probably un zipping the file and then checking the sig for that specific partition. When I flashed the leaked PG86IMG I used fastboot and remember seeing it do that.
[HTC EVO 3D] mastibeta:
Can you put an app in sys app then sign and flash?
[HTC EVO 3D] mastibeta:
Add another function...and code it for root shell.
[HTC EVO 3D] EJerVJerO:
Found these on another website

Mark_Baker@htc.com Senior Director Enterprise Business Unit Americas

Cher_Wang@htc.com Chairman

John_Wang@htc.com Chief Marketing Officer, HTC Corporation

Keith_Nowak@htc.com Senior Public Relations Manager at HTC

Fred_Liu@htc.com COO of HTC

HT_Cho@htc.com Board Member of HTC

Peter_Chou@htc.com CEO

Lotus_Chan@htc.com VP HTC

Horace_Luke@htc.com Chief Innovation Officer
[HTC EVO 3D] DeathBySnuggles:
To be literal, they said the boot loader would be unlocked for "future devices". Some people posted personal emails where the 3d was suggested to be part of that group but nothing public and no timeframe. Afterall the phone is not officially out yet.
[HTC EVO 3D] Leoisright:
Hey guys. I understand the hesitation but this thread is for help to unlock the bootloader. Not trying to be a hall monitor but let's get back on track so we can crank this out. Already had one monitor say they are keeping an eye on this thread.

Sorry but complaining won't fix. We need peeps with 3d in hand and work with haus, tmartin, and myself to figure this out.

For those (including myself) thought this would be rooted by the first day were jumping the gun....
[HTC EVO 3D] TMartin:
Here's a little info from the Sensation section....we might want to keep an eye on developer.htc.com
[HTC EVO 3D] alchemist316:
apologies leo
[HTC EVO 3D] Leoisright:
It's all good. Just gotta reign it in at times.. trust me, I'm excited as the next. In fact, I use WiFi tether as main source of internet. I want it badly
[HTC EVO 3D] alchemist316:
ill help on fri like im sure many will
[HTC EVO 3D] ajs421:
I'm an avid user and pretty fluent in the language of these forums, but when it comes to development I'm green. I'm willing to help exhaust different options of getting root as long as it's safe and I'm provided instructions ^__^

Didn't they manage to do it on the Incredible 2 and Sensation already?
[HTC EVO 3D] mbh87:
Not the Sensation as far as I know. They can't get it temp rooted which is needed for AlphaRevX
[HTC EVO 3D] t3project:
yea, me too. i already have mine in hand but have yet to take it out of the box. i still have my evo and am not afraid to brick the 3d so if any devs want to hit me up with some more extravagent stuff pm me.
[HTC EVO 3D] xHausx:
It looks like that's the same boat we are in. If we could get temp root we should be able to use the eng bootloader to unlock it.
[HTC EVO 3D] TMartin:
My thoughts exactly :D
[HTC EVO 3D] xHausx:
Can you give gingerbreak a try with it just out of the box? Also, if you have a card reader can you check to see if the Smart_io.crd file is on it before you turn the phone on?
[HTC EVO 3D] l33tlinuxh4x0r:
isn't this what I said a long time ago???
[HTC EVO 3D] xHausx:
That we can use the eng hboot to unlock it?
[HTC EVO 3D] mbh87:
Has anyone hit up Scotty2 yet? He worked his magic on the g2 and the thunderbolt.
[HTC EVO 3D] readingkeeper:
As soon as I get my phone Friday morning, I'll definitely try it for you.
[HTC EVO 3D] rugedraw:
I read through the GingerBreak thread and it says that it does NOT work on S-on phones. Should we bother giving it a go?

Also, volume down + power doesn't get me into the bootloader. Can anyone tell me how to get this one into that menu so I can check it out? Mine didn't even prompt me for an OTA when I turned mine on and activated it.
[HTC EVO 3D] l33tlinuxh4x0r:
yeah we can softroot then use flashimage to flash the bootloader and recovery
[HTC EVO 3D] cordell12:
SHOOTER XC SHIP S-ON RL

HBOOT-1.30.0000

eMMC-boot

May 20 2011

will it take OTA as soon as I boot or can I click later?
[HTC EVO 3D] Leoisright:
What are the bin files for adb too? If we could get them in there I wonder if we could push during hboot

Edit: bin, sysro, and sysrw would be the three bins that help us achieve root in my oppinion.

Sent from my 3VO..
[HTC EVO 3D] liquidjesus:
I thought that was already tried, no adb durring hboot...
[HTC EVO 3D] Leoisright:
But it may be because we won't have it in bin. Hell I don't know anymore.

Sent from my 3VO..
[HTC EVO 3D] maine620:
you dont have 2 do all that, jus add the watch widget to 1 of ur screens n watch it from there
[HTC EVO 3D] sniperkill:
Is there anyway you could take an app like root explorer, and even tho it doesn't have root permissions yet, could you put the apk on the computer, edit it to run with root permissions, somehow, and then install it to the sdcard? I got no idea what I'm talking about, I was just trying to throw an idea out there. So please don't flame me..

Unlock our bootloaders HTC, or I walk in 28 days and counting-Evo 3D
[HTC EVO 3D] -viperboy-:
No. No. No.
[HTC EVO 3D] mastibeta:
Need root to grant root
[HTC EVO 3D] Leoisright:
Well I thought maybe setting the dependancy would help but was a no go for me. But maybe editing the values like public strings it could acheive this.

Anyone know?

Sent from my 3VO..
[HTC EVO 3D] kooks05:
What about the hotspot app has it been looked at?
[HTC EVO 3D] Kidmet:
Not to stay off topic, but clicking these things are the same things you'd see on a private profile on a computer, just not mobile. Nothing more than if you just pulled that same profile up on a computer. Sorry to burst the bubble. GO DEVS!
[HTC EVO 3D] sniperkill:
Maybe you could do something with "Stericsons busybox apk". Somehow mod that app to write to system.bin?

Edit: Nvm, I'm barking up the same tree, LOL.

Unlock our bootloaders HTC, or I walk in 28 days and counting-Evo 3D
[HTC EVO 3D] t3project:
for people who have photo albums private (friends only), you can view all of their albums this way, not just tagged photos. you cant do that from the desktop
[HTC EVO 3D] mastibeta:
Has any recieved the resigned zip that made it through hboot...without writing new hboot?

Other idea..has anyone tried to essentially merge root shell into a root shell permissions app like green hornet? I'm in class going crazy reading this stuff.
[HTC EVO 3D] t3project:
and if this actually worked, why cant we just add the su bin to it?
[HTC EVO 3D] AyyRayy:
No. Entire system file is read only. We are trying to achieve writing access so we can have root.

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] mastibeta:
That is what I have been saying...with correct permissions...very easy...just have to add and sign...unless it didn't work before.
[HTC EVO 3D] t3project:
more than likely we were lied to then cuz we would have temp root by now if it did.
[HTC EVO 3D] mastibeta:
Your missing the idea...put it in pc36img.zip or w/e ours is called...not home...sign and flash in hboot...don't need Eng hboot...just Su with perm in sys app
[HTC EVO 3D] SAShady:
It didn't update anything. Was tried again by someone else
[HTC EVO 3D] xHausx:
Adb is in the ramdisk(/sbin/adbd), but if we could get it going in the recovery we may be able to do something with it. it's a long shot but you could try using an updater script to change some of the properties and enable adb instead of installing a file, you would probably have to have the system partition mounted and use setprop from there though.

sysro & sysrw would still require s-off for them to be used in the rom
[HTC EVO 3D] AyyRayy:
No I understand. If it was that easy it would have been done. We can't sign the PG86IMG.zip file. We do not have HTC's private key. That has been the issue since @leoisright and i started modifying the Ota firmware hboot file. Iv tried signing with fake test keys. Iv tried to flash fake Ota, hboot, and update.zip through recovery. None of it works without HTC'S private key and there is no way to get that as of now.

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] AyyRayy:
This sounds like it could work, but to change the properties in the system we would have to be able to rewrite correct? How would that go about ?

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] Leoisright:
For awhile I was thinking each file was signed in the ota. Now thinking its just the ota zip itself. So here is a question.

Is there anyway we could just build an apk or take a system apk and decompile it where we can force it to write to bin? Maybe Sprint zone or another Sprint apk we are able to decompile, set it to write bin, then recompile.

I have never written a program but since it would have system rights, it should he able to be done then.

Sent from my 3VO..
[HTC EVO 3D] SpyFi:
Thanks!

Hey everyone! Much thanks for all of the help. I have been following the thread since day one. I have been trying to find ways to get SU into System/bin using safemode etc. I am not an expert dev but know my way around a linbox and android well. If you need anyone to test a theory feel free to bump me. Also looking into some exploits. Mostly re-building .apk using apktool to increase privilege escalation and plant su where it needs to be.

Thanks again will be following close and trying things. :)
[HTC EVO 3D] TMartin:
Each file is signed.
[HTC EVO 3D] AyyRayy:
If each file is signed then theoretically we can delete any file in the Ota without causing any flags?

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] unCoRrUpTeD:
The whole package is also signed
[HTC EVO 3D] -viperboy-:
Of course not, you break the signature.
[HTC EVO 3D] TMartin:
Exactly.
[HTC EVO 3D] Leoisright:
It seems like its the ota package and the hboot or firmware.zip. I have no clue how to sign an img file and leave it an img.

Sent from my 3VO..
[HTC EVO 3D] agrabren:
I have yet to find an apk that runs as root. HTC/Sprint must use a service in the backend to do the real work...

You can check via 'ps' and see what account an app is running as.

There has to be a hole in one of those apps... /data is mounted with nosuid, so even if you get su installed over there, it won't work. And /system is ro.

I was trying to find a way to get anything to automount an ext* partition without the nosuid block.
[HTC EVO 3D] Scotty_Two:
What about Swype? It's a system app, has anybody looked into it for a hole?
[HTC EVO 3D] AyyRayy:
Damn I'm new to the whole package signing deal. So since there is a zip file in the Ota itself. Not only would we have to sign the file we replace but sign the firmware.zip then the ota zip file?

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] slimm609:
The zip file is signed and checksumed with sha1. The only shot at getting the update.zip with the bootloader in there is create a sha1 collision. If someone has the update.zip and the modified update.zip with the bootloader i can put some machines to work on creating a collision.

sent from umm.... something
[HTC EVO 3D] vayman:
Just wanted to say THANK YOU all for your efforts here! I have been following this since the OP and I hadn't even picked up my 3VO yet. :) I have all the faith in the world in all involved w/ this effort! Keep it up, you have a whole community behind you! ;)
[HTC EVO 3D] AyyRayy:
I can take the OTA modify the bootloader and rename it to update.zip. But isn't that a stack overflow attack , I thought shinzul said that was a no go?

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] unCoRrUpTeD:
The mount command will not work. Permission denied. You can't even mount an ext partition on the sdcard.

Sent from 3D land
[HTC EVO 3D] No1ustad:
it'd be great to get this going while we look for alternatives.
[HTC EVO 3D] agrabren:
To help everyone understand a simple issue... Just because an app lives in /system or is owned by root doesn't make it elevated. sh lives in /system/bin, but isn't running elevated.

I'm not being a neysayer, I'm trying to help keep efforts towards areas with an exposure surface. If a process isn't running with elevated credentials, it can't grant us anything that we don't already have.

I'm mildly hopeful on a remotely possible kernel exploit I may have found for another device. I'm still digging thru to understand and try poking at it to see if there's really a bug there.
[HTC EVO 3D] SpyFi:
Devices

I came across this "Spy" app overvi3w (https://www.unfairware.com/instructions.php) that sends information to a remote service (Text messages etc). The app creates another device called PC. It hides the app and blocks the user from un-installing it. (To uninstall:

First you must remove the application from being a device administrator by going to Settings -> location and Security -> Device Manager and uncheck the PC box.

Then program can be uninstalled the same as any other program.)

My question is how does this app creat a new Device? Also can we create a device and give it escalated privileges? All the info and .APK download are on the site.

I hope this helps.
[HTC EVO 3D] liquidjesus:
I hate to say it, but we might be past looking for apk level, and faking updates. Look at the last 3 major exploits. Psneuter, Gingerbreak, and Rageagainstthecage. These are all complex setuid() bug exploits, written by very tallented devs. This might be the only available road for us from now on.

it may be bounty time soon...
[HTC EVO 3D] AyyRayy:
We will see about that . That will be in the future ;)

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] slimm609:
No its not a stack overflow. I pad the file 1 zero at a time and then check the hash. And repeat until the file creates a collision where the 2 hashes match. There are only so many possible hashes so you get to a point where the hash must be used again... Not sure now big the file will get but we can try

48 cores and 256 gb of ram :)
[HTC EVO 3D] xHausx:
that's what I was hoping to hear from someone :)

I'll be out til later on tonight but I can send you something when I get home later. We'll want to make sure we get it right the first time so we're not wasting your time.
[HTC EVO 3D] AyyRayy:
Ok so do you want the file I described earlier?

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] AyyRayy:
Ok haus will take care of it then :D

Can s-off come out and play? You run but you can't hide