yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] agrabren:
My thoughts and opinions on everything...

So it's no secret to all of you that I'm pretty verbal about my thoughts and feelings. My work on these devices is my passion and my way of relaxing. I try to work with the community as best I can, and share what I know, as I know it. I released fre3vo with the intent that the community could use it to improve our devices. I wasn't aware about the NAND-locking scheme at the time, so it had it's limitations which surfaced. And as a community, you took my tool, helped me expand it to the Sensation, Flyer, Shift (some versions, more coming), etc. And you found ways around it's limitations to make the devices yours. People I talk to online even today commented that the only reason they're able to talk to me during the day is because they can tether their EVO 3D via fre3vo root. While it may have crossed my mind to "hold back" the temp root, since it wasn't even full root, the community as a whole has proven to me why I did it. Think of it as "buying time" for something more to come. I made the right decision. Those of you following my twitter feed know that I try to keep people abreast of any new directions or progress, and the people I've helped and worked with have taken amazing steps to different methods to unlock the device. The only person I feel bad that I inadvertently screwed over is MarkGolly. And to him, I'm sorry. (For those who don't know, he asked me for some stuff and I never got back to him with it).

Any of you who follow my twitter feed know that I rant at times, and I react pretty strongly. During my long days at work, I have to keep a lot of stress controlled and my opinions have to be "tuned" to be constructive. So when I'm doing my "free time" stuff, I just don't have that level of restraint left. The overwhelming majority of you support the devs, and that really is what makes it worth the stress.

So what am I doing now? Well, I owe some people some HDMwIn love... Another project that has it's perils of "war" between teams. Plus, I'm still curious about the latest discoveries by dragonfyre13 and I, which I'll likely poke at to see what it does. I've got a personal project I want to get going on for the community, which should be fun. And I've got more devices to root.

Will I keep everyone posted? Of course. If anything, I'm a loudmouth. Except for the personal project. That's a secret. Am I still helping on fre3vo? Of course!

Why did I close the fre3vo threads? They've outlived their usefulness. There are far better threads with full scripts to help people do more with their device. My thread was just a placeholder for debate about development. That part is behind us.

We want fre3vo to temp-root as many devices as possible. That's probably a priority, especially knowing that temp-root leads to S-OFF... There are devices out there that still need temp-root help, either to downgrade with existing HBOOT hacks, or to become available to newer HBOOT hack methods.
[HTC EVO 3D] agrabren:
kmdm, thank you. It would be wonderful if we didn't need to keep aces up our sleeves against the phone manufacturers, but sadly, we do. And I'm glad that fre3vo will prevent more exploits being burned in getting the devices unlocked.

In the meantime, I'm thinking I'm going to write a "Fre3safe" tool, which uses fre3vo to back up the entire device for people. That way, anything that goes wrong, there's no risk that they would permanently lose things like their WiMAX keys. It's not quite a "nandroid" backup, because it's not handled from recovery. But for those who use it, it may make the trip a little bit safer... (I've heard some of the horror stories of the EVO 4G S-OFF work)
[HTC EVO 3D] Arnezie:
thanks to the people that are working hard for us on s-off
[HTC EVO 3D] pierre1321:
Fre3safe would be a sweet option to have, would also like to see where dragonfyre13 is going on his path too.
[HTC EVO 3D] Tiffany84:
Thank u for all the work u have done and time you've spent. It's greatly appreciated.
[HTC EVO 3D] Mr. Clown:
Can we stop the derailing of this thread please?.

Back on topic, please.

Thanks,
[HTC EVO 3D] VoXHTC:
Thank you for handling this with maturity and not abusing your powers.
[HTC EVO 3D] d3vilskid:
curious here. whats the difference in MMc and eMMc. and the disabling of MMc vs eMMc. Which i believe for the 3d and sensation eMMc hasn't been able to be disabled yet, correct?
[HTC EVO 3D] USSENTERNCC1701E:
eMMC means embedded MMC. It is essentially the same tech and the standards are defined by the same organization as MMC, it is your phones storage media. I hope you mean write protection disabled, cause disabling your eMMC is a brick.
[HTC EVO 3D] SpyFi:
I was reading in the evo 3d schematics and there was a label i believe that mentioned emmc cmd. Could this be a hint at commands other than AT commands?

Sent from a blazing fast 1.8 GHZ Evo 3D.
[HTC EVO 3D] d3vilskid:
Thanks I know I read it somewhere in here but I lost page. So what sets the security apart from the two. I was talking about write protection, sorry that I wasn't clear.
[HTC EVO 3D] agrabren:
The eMMC command pin is what is used to transmit commands into the MCP. Things like "read", and "write" are commands, as well as all the configurations.
[HTC EVO 3D] markgolly:
AT Commands Evo 3D Modem Recognizes

Next batch. Same goes - don't know if they are necessary or not and I've left off the prefixing "AT"....

S0 S3 S4 S5 S6 S7 S8 S9 S10 S11 S30 S103 S104

$QCCLR $QCDMR $QCDNSP $QCDNSS $QCTER $QCSLOT

$QCSLIP $QCPWRDN $BREW $QCSYSMODE $QCCTM

$QCBANDPREF $QCVOLT $QCHWREV $QCBOOTVER

$MODEST $MODAUTH $MODPSET

$QCMIP $QCMIPP $QCMIPT $QCMIPEP $QCMIPMASS

$QCMIPMHSS $QCMIPMASPI $QCMIPMHSPI $QCMIPRT

$QCMIPNAI $QCMIPHA $QCMIPPHA $QCMIPSHA

$QCMIPGETP $QCMIPMASSX $QCMIPMHSSX

$QCOTC $QCVAD $QCCAV $QCCHV

^HWVER ^RESET ^VOLT ^CPIN

+HTC_RSINFO +HTC_RSINFO +HTC_BSINFO
[HTC EVO 3D] TrevE:
Been playing in radio running commands, throwing stuff up that worked in our synergy project wiki if anyone cares

https://code.google.com/p/synergy-evo3d/wiki/Radio

*Edit* Also non-radio related i also tried making 2 PG86IMG.zip files on sdcards, one legit one modded with most images changed with same file names but eu stuff

Plugged phone into AC, let it verify real PG86IMG.zip, pulled battery swapped sdcard and pressed vol up with the modded sd card img in. it went throrugh and said everything OK but i was left at stock US no EU stuff actally flashed even though it said OK. I cant imagine it sends the whole image file on device being so big, and i found it weird it said OK and not a FAIL, but regardless i couldnt get anything different to flash. maybe someone else will have some luck

*Edit 2* I also found out how to read the locked nvm folder on EFS. Uses old open sesame trick :)

https://code.google.com/p/synergy-evo3d/wiki/Radio#Reading_locked_EFS_Folders
[HTC EVO 3D] TheMike1:
Glad to see you here
[HTC EVO 3D] xHausx:
TY for keeping track of them all, AT&V is another one it responds too.
[HTC EVO 3D] TrevE:
Cool I was in the middle of updating, I tracked down what most of the commands do. Ones I cant find anything for that seemed interesting:

ATS30? ATS103? ATS104?

AT+HTC_RA-KEY=0

AT+HTC_RA-KEY=1

AT$QCSYSMODE

AT$MODEST?

AT$MODAUTH?

AT$MODPSET
[HTC EVO 3D] sn0b0ard:
Ra-key=1 returns a 256bit key. I'm assuming its rsa.
[HTC EVO 3D] AyyRayy:
I re packaged a PG86IMG.zip file with the eng hboot and did an SD card swap before i clicked voulme up to update and my phone bricked lol. Luckily I was still within my 30 day period yesterday :D
[HTC EVO 3D] agrabren:
Ya, you can't install an eng hboot if the radio is s-on, it'll brick.
[HTC EVO 3D] miniterror:
Sorry for youre phone but lmfao

Omg how could you just do that
[HTC EVO 3D] AyyRayy:
I learned the hard way. But the black tie protection saved me and had a new 3vo within 2 hours. You have to trick the phone into staying on by booting in hboot without an SD, plug into usb, remove battery, click fastboot, insert real PG86IMG.zip SD card, click bootloader, let it scan and Sig check, after it prompts for volume up to update, swap SD card with the modded PG86IMG.zip file, cross your fingers, volume up. Then unfortunately as agrabren stated I bricked it. So be careful playing around with that.
[HTC EVO 3D] TrevE:
well thats good news though right? means we can actually write to ****. maybe if we replace everything thats signed at once we can change to different images?

also had better luck with AC than USB, provides more power to the thing wiithout a battery in it.
[HTC EVO 3D] Evil-Dragon:
Thanks for taking one for the team, at least we know not to try stupid stuff like that ;)
[HTC EVO 3D] guitardoc64:
+1 on that. Wow, that's interesting news though, that at least it will accept it.

Sent from my temp rooted Shooter!
[HTC EVO 3D] Scott:
That my friend is ingenious! What did you try to flash it with? Did you just do an OS update or did you try to flash an entire ROM with bootloader, recovery, etc? I think you are on to something here...

Edit1: Damn... I really wish you didint post this... There is no way I cant not try something like this. Tell us the details of the ZIP you tried to flash.

Edit2: Damn, I cant stop thinking about this...
[HTC EVO 3D] pbedard:
+1
[HTC EVO 3D] TrevE:
When I tried originally I extracted the EU ruu, put our radio in, zipped it up with winrar zip + SFX and then rrenamed to .zip after. Seems to be how the officials are packed.

Everything said OK, i was left at stock US image though. I thnk we still need to keep stuff signed with with same signature together or nothing will actually accept. recovery/hboot/boot, is that it?

*edit* actually that dsnt make sense if he coould flash hboot. guess that theorys out
[HTC EVO 3D] Tilde88:
i knew i knew that name....just cam to me as i was burnin, yea lets go torrent some ROMs.... hahaha good times... good to see you here.

anyways, to post something actually slightly on topic. Yea I remember I bricked a TP2 on release week. I learned my lesson about fiddling with anything to do with radios. I was trying to get Diamond2 radios to work with it... But didn't even check that they weren't equal partitions. I thought if TP1=Diamond1, then TP2=Diamond2 (wrong). In any case, even if everything matches up in that manner, the 256bit algorithm would be corrupt. If it's anything like hacking Xbox 360's, then there would be internal signature (ill call it a key). So say you were to flash the eng hboot, the key written to that partition does not match the master key. For example, the CPU key is 123456. That would be the primary key which all other sub-components would have to match, or no longer work. This is for an Xbox, but can still apply here. By flashing that un-signed bootloader (which has a manufacture key applied by default), the phone cannot match the loader key with the radio key (radio being the equivalent of the CPU key). This would work, I assume, on another device without cryptographic signatures. Just saying, the process is good, but the middleware on the phone is goodr. :-p
[HTC EVO 3D] AyyRayy:
Basically had a perfect signed pg86img.zip from xhaus post. Copied it. Put the real one on a SD . Then pulled files from the other and replaced hboot eng. Idk if the recovery would flash or anything else because after it flashed the bootloader. I bricked lol. Just be careful playing around or atleast have a warranty to back up your mistakes like I did hah :p
[HTC EVO 3D] TrevE:
:) yeah man, i finally got a place to live without a garage where the kitchen should be (landlord decided to drive truck through old place) and virus hooked me up with a 3d so been doing synergy stuff lately. good seeing old faces again

anyway thats what worried me with keys, im guessing almost everything fun is signed so we probably cant do much. With the 360 as a reference and reading the conspiracy theories about htc voiding warranties and stuff also got me a bit worried about having to do some spoofing, if you look at the at commands

- https://code.google.com/p/synergy-evo3d/wiki/Radio -

AT+HTC_RA-KEY=0	+HTC_RA-KEY=0 (26 CHAR NUMERIC STRING)	??

AT+HTC_RA-KEY=1	+HTC_RA-KEY=1 (first 26 char same as above with 6 digits more at end )	??

AT+HTC_RSINFO=0	+HTC_RSINFO:(looks like version, some numbers,IMEI, checksum hash(?),NVRam Version	??

those 3 could probably be enough to detect a unlocked hboot. i miss when a simple exploit for root was all you needed :(
[HTC EVO 3D] Scott:
Have you tried to flash just a ROM? With nothing else, just boot.img and system.img? Just curious as this will be what I am trying when I get home late tonight ;)
[HTC EVO 3D] Scott:
If it flashed the bootloader and bricked it then it will flash the OS. I just want to flash the OS. Hmmmm...

Ive already got a ROM that I built ready to go... I am testing this biotch out when I get home (way too late tonight!)

Basically I am saying... If you can brick it you are flashing something. AFAIK no one has done that and reported it. Excep AlpharevX but the method they are using is not disclosed yet... So...

EDIT: Damn, I just realized I am out of 30 day warranty. But they should still exchange it... I think?
[HTC EVO 3D] TrevE:
flashing system might be possible. Now in the ruu the only stuff thats clearly marked is boot_signed, hboot_signed, recovery_signed. I dont know how to tell if system is signed, the filename doesnt say it is(big deal).

i know is radio.img has the following in it, but no other parts has anything that looks like a cert in hex atleast. I would try leaving everything stock but a system.img and swap and hope for the best. Could be why mine failed and left me stock with just data wiped because i put in our radio and a different boot/hboot/recovery. im guessing from file names those 4 parts need to be stock and probably match the RUU you swapped from.

HTC Root CA10
U
HTC10U
HTC Corp10UTaoyuan1
0	UTW1
0	UTW0
110324084630Z
310319084630Z0‚+1
0	UTW10UHTC Secure Boot10UTaoyuan10
U
HTC1
0	UTW10U
04 0000 OEM_ID10U
05 000000F0 SW_SIZE10U
06 0000 MODEL_ID10U
07 0001 SHA2561"0 U
01 0000000000000002 SW_ID1"0 U
02 004210E100000000 HW_ID1"0 U
03 0000000000000000 DEBUG0? 0
[HTC EVO 3D] Scott:
Yeah, I am going to (try) flash a system image with this method. Nothing else. Well, see what happens, everything else will be stripped out.
[HTC EVO 3D] AyyRayy:
Good luck buddy :D I don't wanna risk my new one quite yet hah
[HTC EVO 3D] TrevE:
i wouldnt strip everything else out. i would have 2 images with identical filenames in them just one modded SFX+ZIP with different system.img in it.
[HTC EVO 3D] Evil-Dragon:
It might work, even if it just gave a rooted /system with su, busybox, etc..

I dunno, it sounds too easy.

EDIT: Only problem is it still wouldn't give any ability to write due to the protection, so it would only have limited use. But at least it would be a perm root?
[HTC EVO 3D] Scott:
Nope... Reason being... You stand a greater chance of bricking a device with the hboot, radio, recovery than you do with just the OS.

If I screw up the OS partition of my device I can just run the legit RUU and get it back. If I loose the recovery partition I am hosed. Does that make sense? Have to type fast while at work.

I wish some like agrabren or haus would chime in on this. I would like a "professional" opinion on this theory.
[HTC EVO 3D] Scott:
Thats exactly what I am getting at!
[HTC EVO 3D] TrevE:
forget professional, im a modder im going in.

zippping up now, if you hear someone rage its just me bricking my phone.
[HTC EVO 3D] aleksis2010:
Oh wow, good luck man!
[HTC EVO 3D] Scott:
Dude, take my advice, Just the OS. Not other stuff.... Use the real p86img.ZIP. then swap it with a zip that has JUST a rooted system.img. Thats what i am going to try anyways.

And you stole my idea, I hope you do brick!!! JUST KIDDING MAN! Good luck! If I was at home I would be right there with you. Keep us posted and post often.

Actually, I think it was your idea first... but anyways... lol
[HTC EVO 3D] TrevE:
and you stole my swap idea :p -

http://xdaforums.com/showpost.php?p=15899487&postcount=735

so what i did because i was strapped foor time and wanna brick before sprint closes

1- put PG86IMG_Shooter_Sprint_WWE_1.11.651.2_Radio_radio_0.97.00.0518_NV_SPCS_1.15_release_193503_signed.zip on sdcard1

2- took that same rerelease, extacted it, stuck in system.img from RUU_Shooter_U_HTC_Europe_1.20.401.2_Radio_10.53.9020.00_10.13.9020.08_2M_release_203403_signed.zip zipped up the whole thing as sfx+zip in winrar and put it on sdcard2. iits got enuf different stuff i should know. if it works (https://code.google.com/p/synergy-evo3d/source/detail?r=6 to name a few) my theory keeping everything was bootloader ould try to flash thoose becase it expects it from original and fail.

3 - flashng nw :)
[HTC EVO 3D] Scott:
Yep, thats what I was gonna do too. Worse case scenario is a hosed SYS IMG. Which can be easily fixed....

BTW: what OS ver are you on now? 1.11 or 1.13? Im still rocking 1.11... That way if I do hose this thing I am thinking I should be able to flash 1.13.

Crosses fingers you!
[HTC EVO 3D] TrevE:
wwell that didnt work, it hit system in bootloader and just goes into a loop of unzipping and updating. donot know if its cuz i used EU or if its a sig thing or what

oh wait it looped like 10 times than says ok???? booting now...
[HTC EVO 3D] Scott:
Damn, that sucks. Oh well, you tried. it was worth a shot.

How did the other guy flash to a brick then?
[HTC EVO 3D] AyyRayy:
I already bricked my phone once I hope you guys are successful :D
[HTC EVO 3D] AyyRayy:
I replaced the hboot with the eng hboot
[HTC EVO 3D] TrevE:
well it did continue and boot after unzipping/updatng system like 30 times. it eventually gave OK and booted same old damn image

maybe someone can edit our img and try, see if that gtes lucky
[HTC EVO 3D] tehbeetus:
what ever happened? Did it boot?

My bad didn't see the new page.
[HTC EVO 3D] AyyRayy:
As soon as it said ok the screen went black lol never booted again
[HTC EVO 3D] sn0b0ard:
I commend the few that have tried swapping the rom during the flash process, but fyi I posted that idea back on 7/10 in this thread...
[HTC EVO 3D] Scott:
Ok this is what I dont get. You both used similar tactics. Aray bricked his phone because it DID write "something" Treve couldnt get it to write at all.

My question, what did you two do differently?
[HTC EVO 3D] Scott:
Did you try it all?
[HTC EVO 3D] housry23:
The difference was aray tried to flash with an eng hboot and treve tried to flash just a rooted system.img
[HTC EVO 3D] TrevE:
he wrote eng hboot and bricked, i tried EU ruu system img and nthng happend. some things must write under some conditions. im on 1.11 - PG86IMG_Shooter_Sprint_WWE_1.11.651.2_Radio_radio_0.97.00.0518_NV_SPCS_1.15_release_193503_signed.zip if it helps.

runnng out for a few hours ill be lurking on mobile tho
[HTC EVO 3D] sn0b0ard:
No, can't risk bricking my phone. Just wanted to say that this idea has been mentioned before in the thread is all.
[HTC EVO 3D] AyyRayy:
Exactly and I wouldn't recommend doing that if you like the EVO you have right now lol
[HTC EVO 3D] mazook98:
I've found that using file expert does not let you edit system files at all...not directly, anyway...What it DOES allow you to do is cut, copy, AND replace those files if you've edited them somewhere else...I figured out the copy allow by putting Youtube 2.17 on my regular EVO....(works fine)...The replace allow I figured out because I wanted to change my readaheadkb from 128 to 1024 in sys/devices/virtual/bdi/179 just like I did with OG EVO....wouldn't let me edit it, so I copied it to my SD, used text editor there, THEN pasted it back..That worked...Could this method be used to achieve something on a grander scale?
[HTC EVO 3D] tonyh703:
this is a hex key (or at least hex values). More advanced encryptions support special characters so I doubt that is legit. Plus that steph chick is just a troll.
[HTC EVO 3D] Kalash:
While we're throwing around stupid ideas...

Some of the 4g roms had an app to sign APK files.

Is the signing process similar for the upgrade ZIP's?

Could the signing process on the 4g be used (on a rooted device) to sign a 3d upgrade, then moved to the 3d and flashed?

Or is the signature tied to the hardware it's signed on somehow?
[HTC EVO 3D] tonyh703:
Check out this:

http://en.wikipedia.org/wiki/Key_(cryptography)

We would have to have the private key to 'sign' the ROM (update.zip, img, whatever). Then, when the phone boots, it makes sure the image was signed with the correct key. If we cannot obtain the private key, we are pretty much "f'd". Its how encryption works, its not just with the phone. If you try to gain access to encrypted files without the proper key, you just are not going to get it. With 2048 bit encryption, cracking it is out of the question (at least in this community). If we had foreign intelligence encrypted with this algorithm it would be very difficult to crack.
[HTC EVO 3D] mlin:
Can you push files to /system?
[HTC EVO 3D] dragonfyre13:
Granted, it's an RSA key and there's known ways of speeding it up (it's not like it's encrypted with GPG/PGP), and it's signed, not encrypted (which means it's considerably easier to crack).

That being said, you're looking at a minimum of many CPU years to crack it, considerably more if they were reasonably intelligent in what they did. If you've got a render farm in the multiple 100k range, along with very specialized software, and a LOT of experience with cryptography, you could do it in less than a year potentially (with today's tech, and the known attacks against RSA signing to reduce crack time). Unfortunately, as far as I know we've got none of these, so obtaining the private key via those methods is pretty much a waste.
[HTC EVO 3D] chubbzlou:
No gives you permission denied but you can push to data/local/tmp
[HTC EVO 3D] tonyh703:
true, but the encrypted key is signed with a hash, so thats even worse :)

http://en.wikipedia.org/wiki/Key_signature_(cryptography)
[HTC EVO 3D] mazook98:
Checking now..btw, I pulled this out..any help?

I just pulled out the CWkeys file from the 3d and opened it with txt editor...its this:

{64,0x514f7a2d,{3910343259,2225617198,944538402,4229984983,356634445,50668161,3470245793,3817955698,3056803353,861613297,2119737617,3331607703,2695556226,692623951,1648223702,248171821,315039404,935569791,2410263280,3754806305,3868802544,700782289,2271965102,2982676235,2557902076,2215461360,2141374645,2002567094,637307533,3755657762,4026829306,3953307184,1063650241,1062824505,2962651622,3249551099,3502171227,3953229894,1471561847,3093774057,2412683762,1156378943,3913191860,1341687844,1955399809,2823302562,3129368388,1320484038,3417231822,57111853,1144042353,2375283767,2678489510,931996291,683630187,3089371963,1907973886,1292523450,1882406632,1798009423,3894740985,3893292389,2828657627,3105644676},{3409493504,3044026671,3025488236,4054926089,1473501611,3500455907,70156471,3004658068,3093207773,1906355120,190391206,4142667659,3528504473,486221107,2074864403,2302194352,4160012684,3809228131,3385811127,42648625,3419907349,2609648242,2036536078,2763378069,2611811851,638591104,2916045640,4120589117,986983165,3601442397,2667084738,3378509947,3690505897,3753516454,2780766048,2406748021,4001286070,863086071,4261412774,2325179756,85673109,908539088,2194596224,1767030935,1174729233,3276743755,3426769497,2524753638,2836135958,2106408932,4189318796,2125401242,1442896537,399329412,2298498361,2503899020,3442141986,3600806899,3468149762,1850288682,4110558852,4153568787,1307640881,82502199}}

I used file expert, which is like root explorer without being rooted..I'm sure you guys probably already have this, but JIC......
[HTC EVO 3D] dragonfyre13:
My question is, did the change take? looks like these are the permissions on that file:

-rw-r--r-- root root 4096 2011-06-28 11:08 read_ahead_kb
[HTC EVO 3D] bpdamas:
Not really sure if this is valuable or just gibberish but there is a file in the OTA update that is labeled otacerts.zip.p. Here is the output. Could this be a key to allow the phone to accept an OTA update? I have no idea how to check or what I am looking for so I am just posting this. I opened it with an editor and just copied the whole string.