yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] guitardoc64:
I don't think he was referring to a hardware "pin", more likely a pin code. (I may be totally wrong:confused:)
[HTC EVO 3D] smoochiezz24:
Nothing to see here, please disregard.
[HTC EVO 3D] AyyRayy:
Lulzzzzzzz. Bro you definitely missed all of viper's sarcasm. He is a pretty big contributor in the android community . He was joking obviously. Viper nice bloat manger BTW. Is there anyway to physically jtag the EVO 3Ds. Im willing to try :D

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] stealthee:
Omg talk about missing the point...... Ok let me spell it out for you HE WAS NOT SERIOUS. You can tell by you smiley faces and rasberrys.
[HTC EVO 3D] smoochiezz24:
Lmao I definitely didn't look at the user name, I can admit when I'm wrong. That ya go. *smacks forehead* should of have my v8.
[HTC EVO 3D] steal25:
sorry :D
[HTC EVO 3D] LCL22:
hello, as a fellow evo 4g user, ive been following the progress on this thread for a while, since this bootloader is similar to the one for evo, id assume some progress here means og evo users are that much closer to a root, following our forums, i saw this thread, i know more than one person has had this happen...perhaps it sheds some light on a exploit or security hole? i leave such judgments to people more knowledgable than I but i thought it pertinent to link this thread here for the devs

http://xdaforums.com/showthread.php?t=1167217
[HTC EVO 3D] -viperboy-:
No idea dude lol hardware isn't my thing.

LOL!

That was pretty funny lol no worries though!
[HTC EVO 3D] smoochiezz24:
That is Hilarious! It was exactly one of those moments. okay, enough from me, again, my bad guys, I'll let you all continue interrupted.
[HTC EVO 3D] hupo224:
Too much stupid here.
[HTC EVO 3D] kpkimmel:
this thread is so off track i wouldn't be suprised/hopeful they close it and #teamwin just starts a new one with updates..
[HTC EVO 3D] pbedard:
Where is that one so I can unsubscribe this one
[HTC EVO 3D] xHausx:
It would break the sig and cause it to reject the update.
[HTC EVO 3D] Leoisright:
Call account services and let them know you have been thinking about switching to thunderbolt. Then say you've seen online a lot of people getting service credit for extending their contract. You would like to get the credit or may just switch.

I did that and they put a $50 credit on my bill and pushed my eligability date up so I could get the 3D on launch day..
[HTC EVO 3D] Tiffany84:
Well they've given me my upgrade back but your saying I might be able to get a 50 dollar credit too?
[HTC EVO 3D] Leoisright:
Well looking at the updater, looks like each update has its matching md5 linked, but also we may be able to open the update with Winrar and push just the updater script in there. It may break that and worse case we can't install. Best case, we could atleast see if that is a vulnerable attack point.

Edit: also thinking that maybe during the update process that hasn't been changed, is the door open to do any adb functions at all. Or logcat work while its updating. Very slim chance while installing you could push that flash update
[HTC EVO 3D] Leoisright:
I did both no problems at all. Was real easy. Call and talk to account services or retentions and they may give you more. Some got $75-$90 credited.
[HTC EVO 3D] xHausx:
If youre able to resign it so it doesn't get rejected then you are in business, the phone would be wide open. Pretty sure the hboot unlocks everything for the recovery.
[HTC EVO 3D] Leoisright:
Has anyone tried it? I mean, what can it hurt? If its wide open for that split second that may be enough to brute force your way in
[HTC EVO 3D] juortiz85:
What if i rename an older h-boot to update.zip and place it to the SD card. Go to adb shell type reboot bootloader and go into bootloader and try the update or rename it to pg86img.zip. will any of this work? I'm just brain storming.
[HTC EVO 3D] Rydah:
I doubt it. Since. They have the eng hboot, I'm sure they tried.
[HTC EVO 3D] juortiz85:
Where can I find that at?
[HTC EVO 3D] Keithgordon:
30 82 01 0a 02 82 01 01 00 a5 39 ff 1d f5 93 d1 56 85 fe 15 8c 03 02 ba 90 41 03 2e 67 b3 bc 73 8a 60 85 f0 e3 0a 1e 3a 35 4a b0 d7 12 6a 8c 71 06 c4 38 21 f0 d6 61 29 ae 31 cb 44 7a 96 65 aa 2d f9 1d 37 4b 61 6c 17 5c cd 28 6f b1 cb 33 ec 95 bf a4 78 c1 c2 6c 38 3d 2d 3d a6 27 b4 df 4e 75 ba fe 27 ac 94 32 ba 4b 6e a5 59 ce 4f 6f 2e 51 85 2b a8 5c df 19 8f 07 10 54 a8 9c fc b0 72 2a ba 8f 5b fa 25 3a 31 db f5 27 38 35 de 43 05 0f

this is supposedly the private key code, dropped off in #htc-evo-3d by someone nickname steph_, dont know if its worth anything, just thought it should be shared in case it was something
[HTC EVO 3D] Rydah:
Haus's thread, in its op.
[HTC EVO 3D] #Winning#:
Thats pretty funny, may just be a coincidence but a user who has a username beginning in Steph also posted this.... http://xdaforums.com/showthread.php?t=1140259

Check out the other threads as well pretty much all in regards to root. Probably wouldn't trust it, but how funny would it be if that was someone from HTC trying to see why we want root and then posting the key lol.

Far fetched... yes but hey who knows just a thought.
[HTC EVO 3D] edufur:
I dont see it over in #htc-evo-3d. Did it get removed?
[HTC EVO 3D] RVDigital:
Spend a little more time around here/IRC and you'd know that's a troll.

Nothing to see here, move along.
[HTC EVO 3D] DomSim:
Guys, if it is not signed it will not flash period.
[HTC EVO 3D] xdviper:
Has anyone even tried that key? Just try it and see what the deal is.

Even though its not the key, it doesn't hurt, just need one for the sensation also
[HTC EVO 3D] mazook98:
How about using a non-root app to do a specific task on reboot...like using the app that activates when a headphone plug is inserted to seek alternate boot?.I used this successfully on the Nook Color to seek uRecRam and URecImg on the microSD , where CWM was waiting...Just throwing it out there...
[HTC EVO 3D] salmanaman:
Heres an idea. when the google app "chrome to phone" asks for permission its kinda looks like its asking for root permissions. Can someone look into what part of the phone is being read when that app goes thru that process. Just an idea ; ) ..
[HTC EVO 3D] dragonfyre13:
If you're talking about installation routine, I've been down that route already. Thought there was a hole there, but ended up not. If you can find one, more power to you, but not as far as I can find.

If you're talking about when you push something, that's already being run as the application user, and doesn't get us anything even if we break into it. You can accomplish the same using run-as via ADB.
[HTC EVO 3D] Dees_Troy:
Hacking a phone for S-OFF / permanent root isn't a task that you can say you're getting closer to finishing. It goes more along the lines of, "Well, we've found a bunch of stuff that doesn't work, but we haven't found something that works yet." As you try more stuff that doesn't work, you do get a better idea of how things work, so you're sort of closer, but you still have no idea where the end is until you've cracked the phone wide open.

Now, I suggest that people stop asking for progress. When it's done, it'll be done. If the hackers have given up, then they'll say so. Otherwise, it'll be much better for everyone if we leave the hackers to hacking instead of asking them for "status updates" that just say "no we haven't found it yet."

If you want to help but have no clue about hacking, then bug HTC for kernel source. Kernel source will almost certainly help with the hacking, and we'll want the source anyway once the hacking is done so that we can get custom kernels and/or AOSP kernels on our EVO 3Ds.
[HTC EVO 3D] smw6180:
I thought you were returning your phone since we didn't have root yet, so what difference does it make?

July 10th:

July 7th:

The only thing worse than a troll is a troll who doesn't follow through.
[HTC EVO 3D] pbedard:
Ppl make mistakes ok ?? Let's not clutter this place with useless stuff
[HTC EVO 3D] jagaroth:
Been asked by Tenfar to post the partitions on an s-off sensation (before the noobs flame me the phones are so similar this is on topic and relevant)

Quiet simply I don't know how to do this and Google doesn't help. So if anyone can provide the adb/fastboot commands I am happy to post data.

(background Tenfar got CWM working on Sensation (by extension the Evo3d) and Cha Cha.

Thread here -> http://xdaforums.com/showthread.php?t=1168521
[HTC EVO 3D] dj_L:
Ignore, I can't read...
[HTC EVO 3D] jagaroth:
Worked out the DD commands and uploaded here -> http://www.sensation-devs.com/index.php/w4lth3r/535/devs-onlyhtc-sensation-emmc-partition-layout/

The interesting part seems to be p15 (radio) the rest are either empty or contain ASCII.
[HTC EVO 3D] Evil-Dragon:
I've compared mmcblk0p3 to my S-ON device. Line 420 in hex for security is different. Is this data telling the device that it is S-OFF? Just curious when a device is changed from S-ON to S-OFF, where is the data stored for that change and how does the device check what it's security status is?
[HTC EVO 3D] kpkimmel:
Pretty sure they said there is a chip in between emmc and radio that is acting as the security check between so .....anything that is changed or written is automatically checked against the stored data and if not eq than changes are erased and restored to original data...
[HTC EVO 3D] Evil-Dragon:
So, If the data in mmcblk0p3 was changed/reflashed and we some how managed to get the emmc write protection to drop, would the radio detect the change and use the mmcblk0p3 data or does it use it's own internal data on the state of secure_flag and reverse/ignore the changes made to mmcblk0p3?

Sorry if this sounds noobish, i'm still learning about how this device handles the security.
[HTC EVO 3D] sn0b0ard:
I made a post about this earlier:

http://xdaforums.com/showthread.php?t=1169663

The technology is called Reliable Write and it detects the modifications we make to the phone and reverts it.

Post was originally in Development thread for you devs to see, but mods moved it into General section.
[HTC EVO 3D] couraage:
It would be awesome if we could use ReliableWrite to somehow write our S-Off payload for us. Is this even feasable?
[HTC EVO 3D] mayfield103:
+1

don't forget to bring a towel!
[HTC EVO 3D] CyWhitfield:
IF it is an eMMC feature being used to revert and/or commit changes, then technically it is possible. However, to be able to do so we would have to know the specific mechanism to use, and would likely have to have some unknown set of credentials before we could employ such a mechanism.

I tried to get technical details on a qualcomm chip that interfaces with eMMC from Micron, but my request fell on deaf ears.

Not that it would necessarily have helped in the first place, because so far as we know it is not established that this is the technology being used in the first place. It does seem highly likely that it is, in my opinion, but empirical evidence to that effect has not surfaced, so far as I know.
[HTC EVO 3D] USSENTERNCC1701E:
From what I understand it does not actually re-write the chip, the feature will only write to empty portions of the chip. If it is determined that the write was complete and legitimate then the address for the data is changed and the old data is marked as now empty. Since there is never any re-writing or overwriting I don't think this feature could actually be used for us, it would need to be deactivated.
[HTC EVO 3D] Vinchenzop:
I. Like kpkimmel, have been very quiet on this thread. I'm a rom maker and modder by trade, but I've been trying behind closed doors to crack this thing open wide with little to no prevaile. My hat is off to those that continue, and i hope to ride along and hopefully I can be of service in one way or another in the future.

Good night and good luck,

Personally,

Vinchenzo Pisegna
[HTC EVO 3D] B-dub25:
Okay I don't know if this is old news or not but you can talk to the phone via recovery

usb 1-1.1: new high speed USB device using ehci_hcd and address 30

[17684.807736] scsi25 : usb-storage 1-1.1:1.0

[17685.804676] scsi 25:0:0:0: Direct-Access HTC Android Phone 0000 PQ: 0 ANSI: 2

[17685.805426] sd 25:0:0:0: Attached scsi generic sg2 type 0

[17685.808411] sd 25:0:0:0: [sdb] Attached SCSI removable disk

thats while its in recovery I found a file and read it

target26:0:0/26:0:0:0# cat vendor

HTC

so this is on my computer while my phone is in recovery so like I was saying I'm not sure if its old news
[HTC EVO 3D] B-dub25:
sys/bus/scsi/devices/target26:0:0/26:0:0:0/generic/device/bsg/26:0:0:0/device cat model

Android Phone
[HTC EVO 3D] xHausx:
There was someone earlier on in the thread who was able to talk to the radio from the recovery, not sure if anything came of it or what was tried with it though
[HTC EVO 3D] Evil-Dragon:
In a nutshell, HTC appear to have disabled alot of the commands used before to talk to the radio. So, I don't think there was much progress on that front. Is there anyway we can dump all the commands that the radio can accept?
[HTC EVO 3D] markgolly:
Been working on that. The problem is that the radio run on a different kernel (L4/Pischashio) and not Linux, so some of my tools don't work the same way.
[HTC EVO 3D] B-dub25:
This is a little diff here.... the phone is mounted in 3 diff places while I'm messing around in recovery
[HTC EVO 3D] vampirefo:
Here are the kernel and recovery initramfs, the kernel isn't much, but the recovery initramfs has keys so may be useful, both kernel and recovery both have one key in common cwkeys, that key might be required in custom kernels.

http://dl.dropbox.com/u/26438943/evo3d_kernel_recovery_initramfs.zip

Also

cat /proc/emmc

shows the partition lay out might be useful.
[HTC EVO 3D] pbedard:
Finally something sediment man keep up the great job

sent from my troll car lol
[HTC EVO 3D] vampirefo:
LOL troll car, at least it's not a troll bike.
[HTC EVO 3D] bluediablito:
hello all

sorry to be of no help...............but i was wondering and if this does not apply then i am sorry for taking peoples time.

feel free to ignore me if it does not apply.

can the phone be rooted the same way the original PSP was modded?

a battery was created along with a special memory card.

just thinking out laud.
[HTC EVO 3D] :
Its different but I think the xtc clip is kinda like that. A hardware helping type hack.
[HTC EVO 3D] markgolly:
First batch of commands - I'm omitting the "AT" in front. I don't believe any of these commands are what we are looking for, but here they are. I am still searching for more commands.

+FAA, +FAP, +FBO, +FBS, +FBU, +FCQ, +FCC, +FCR, +FCT, +FDR, +FDT, +FEA, +FFC, +FHS, +FIE, +FIP, +FIS, +FKS, +FLI, +FLO, +FLP, +FMS, +FNR, +FNS, +FPA, +FPI, +FPP, +FPR, +FPS, +FPW, +FRQ, +FRY, +FSA, +FSP
[HTC EVO 3D] TimidRat:
I completely forgot about that route, but it does sound like an xtc clip unlock almost, i rooted my friends G2 the other day and had to create a gold card, which is similair, and someone mentioned the .tiff exploit earlier also, i believe, i never understood how the picture file crashed the system and allowed root, but always wondered if it could apply to android?
[HTC EVO 3D] TrinaryOuroboros:
quick question, I know the bare minimum about this but I heard the only major hold up is that /system is on a ramdisk, maybe this is a false rumor, again I don't know details only bit and pieces - I've been way too busy handling a red hat scientific cluster alongside literally Just getting engaged, so forgive the lack of homework on this. IF the issue is only the aforementioned ramdisk, wouldn't that:

a) mean the system is unstable since RAM is volatile

b) mean an easy fix is running a constant sync with the file system and injecting state recovery during boot time?

I am by no means even an intermediate android tinker, but desperately want to make some permanent changes to this thing other than a hosts file...
[HTC EVO 3D] k2buckley:
Sorry, nevermind
[HTC EVO 3D] kpkimmel:
tried the "gold card" method...no luck..
[HTC EVO 3D] duffkiligan:
Anything involving a .tiff or anything like that (the PSP breaks) is actually a code written inside of an image. The code is so long and the PSP doesn't stop it from running the exploit can be run outside of userland.

So the image is this big

<------->

and the PSP allows it to run this big

<------->

but the actual code is this big

<-------><--->

that extra code is run outside userland and actually is granted superuser and can exploit anything on the phone.

Finding an exploit like this is very difficult but can be done.

Just my two cents as an old PSP hacker. Android is out of my realm though.

(This is the same idea as the PDF hack that has just recently been fixed by Apple on all the iOS devices.)
[HTC EVO 3D] xHausx:
The sbin folder and init scripts are on the ramdisk(which is packed in the boot img with the kernel) but the system files/ROM are on a separate partition. My understanding of it is that everything is just placed on a temporary file system while the phone is running and anything written to it after boot is kept in RAM. These phones are supposed to have something like 4GB of onboard memory but by the time HTC is done with it only 1 is left. And that's with a firmware size of maybe 1GB.
[HTC EVO 3D] bballer71418:
Once we get s-off and custom roms will we be able to use more then just the 1gb if internal memory we have now?
[HTC EVO 3D] markgolly:
For those wondering about the memory of the 3D, it has 1GB of RAM and 4GB of flash (or eMMC for the technical out there). HTC uses about 3GB of flash/wKND for the various firmware (bootloaders, radio, android, recovery, config storage, etc.), leaving approximately 1GB for the user to load other programs.

And the radio uses part of the RAM, so that is why you don't see the whole 1GB.
[HTC EVO 3D] dragonfyre13:
As far as I can tell there's no reliable write going on with this chip, though I may well be wrong. Also, this phone actually has a check to make sure it doesn't have a Micron chip, and instead has a Samsung chip in it. Far as I can tell from prying into Samsung, it's a moviNand chip (potentially a moviMobi SoC). That means the eMMC controller comes bundled with the flash memory "card" as one chip (moviNand) or it comes bundled with the "card" and ram to go along with it (moviMobi). The moviMobi stuff I would assume also comes with an Amba controller (DMA controller chip) included, making for considerably faster reads and writes via DMA, since it's all on the same board. Granted, at this point either moviNand or moviMobi are speculation, just what I've been able to poke at via source and the Samsung site, but it's definitely a Samsung eMMC controller.

By the way, quick explanation of eMMC vs MMC, for those unaware. eMMC stands for embedded multi-media card, it's an open standard from JEDEC (now) which has been implemented from multiple manufacturers. the MMC spec also handled by JEDEC, and is a major contributor for the standards for everything from SD cards, (all variations) to eMMC cards (confusing!) to even xD and other flash memory formats. Each eMMC manufacturer has their own special take on the eMMC standard, but the spec is pretty detailed, and for the most part everyone complies.

In brief, the standard surrounds security, and control of reading and writing data to the "card" (being the flash memory portion) by bridging all requests for reads/writes through a separate controller chip. This chip manages everything being read and written, and manages the security of what goes on to the card, and what comes off. Manufacturers have created extensions to the spec, including things like "reliable write", to differentiate themselves in the market, from other eMMC manufacturers. From what I understand, Samsung has a chip which instead of implementing various of extensions to spec, competes primarily based on bundling with their other technology, in order to provide a better overall architecture, rather than additional features. Part of the reason for this is Samsung is a huge proponent of MMC, and has a lot of control/input into what actually makes it into the spec itself. Micron on the other hand has a feature rich controller with multiple extensions to the spec, which although bundled with memory at times, tends not to be bundled with much else (DMA controllers, full SoC, etc).

As for the radio stuff, sounds like people are taking a good crack at it, always a good thing, and it looks like you're making good progress. Keep it up!
[HTC EVO 3D] chavonbravo:
Is it possible to cat, or read/write to the ram used by the radio from within adb shell? Its unaccesible via qualcomm diagnostic port.
[HTC EVO 3D] xHausx:
With fastboot theres is the oem read_mmc command but I haven't had any luck getting it to do anything yet.

Does anyone know anything about the oem load_modem_emmc command?
[HTC EVO 3D] xHausx:
Here's a dump of all the parameters from the radio in case it can be of use to anyone

&C: 1;
&D: 1;
&E: 0;
&F: 0;
&S: 0;
&W: 0;
E: 0;
L: 0;
M: 0;
Q: 0;
V: 0;
X: 3;
Z: 0;
\Q: 3;
\S: 0;
\V: 0;
O: 0;
S0: 0;
S3: 13;
S4: 10;
S5: 8;
S6: 2;
S7: 0;
S8: 2;
S9: 6;
S10: 14;
S11: 95;
S30: 0;
S103: 1;
S104: 1;
+FCLASS: 0;
+ICF: 3,3;
+IFC: 2,2;
+IPR: 115200;
+DR: 0;
+DS: 0,0,2048,6;
+CMEE: 1;
+EB: 1,0,30;
+EFCS: 1;
+ER: 0;
+ESR: 1;
+ETBM: 1,1,20;
+MA: ;
+MR: 0;
+MS: ;
+MV18R: 0;
+MV18S: 0,0,0;
+CXT: 0;
+CDR: 0;
+CDS: 0,1,2048,6;
+CFC: 0;
+CFG: "";
+CQD: 10;
+CRC: 1;
+CMUX: C,2;
+CRM: 2;
+CTA: 30;
+ES: 3,0,2;
+ILRR: 0;
+CMGF: 1;
+CPMS: "ME","ME","ME";
+CNMI: 1,1,0,2,0;
+CPIN: ,;
+FAA: 0;
+FAP: 0,0,0;
+FBO: 0;
+FBU: 0;
+FCQ: 1,0;
+FCC: 0,1,0,0,0,0,0,0;
+FCR: 0;
+FCT: 1E;
+FEA: 0;
+FFC: 0,0,0,0;
+FHS: 0;
+FIE: 0;
+FIP: 0;
+FIS: 0,1,0,0,0,0,0,0;
+FLI: "";
+FLO: 1;
+FLP: 0;
+FMS: 0;
+FNR: 0,0,0,0;
+FNS: "";
+FPA: "";
+FPI: "";
+FPP: 0;
+FPR: 8;
+FPS: 1;
+FPW: "";
+FRQ: 0,0;
+FRY: 0;
+FSA: "";
+FSP: 0;
+HTC_DM: ;
^PREFMODE: 0;
^CPIN: ,
0
[HTC EVO 3D] markgolly:
My understanding is that the modem's RAM is segmented off, so no, it can't be read without a JTAG. Furthermore, the modem has its JTAG and the applications processor (in our case, processors) has its own JTAG.
[HTC EVO 3D] sn0b0ard:
So, hopefully this isn't a troll trying to mess with me, but I posted on HTCs Facebook wall asking them to give us the unlock now and someone replied that Team AlphaRev X has got S-OFF / Root for our device and a package has already been prepared for our phones. Here is the comment:

I searched XDA, Google, and even went to AlphaRev X's website. I don't see anything posted yet. Anyone can confirm this?
[HTC EVO 3D] housry23:
Sorry, but you got trolled. I think if this were true it would be announced. I hate that this guy got your hopes up, but I think he doesn't know.

If it is true then YEAH!!! and I will swallow my words.
[HTC EVO 3D] 350zfern:
I think he confused it with the incredible 2. They managed to get s-off on the Incredible 2 but it shipped with froyo and thus was a bit more vulnerable to exploits.
[HTC EVO 3D] dragonfyre13:
Where did you find that the RAM is segmented off? I've found a few references in the kernel source from CAF, but those seem to be writing to a secure area of memory within kernel mem (actually not much more secure, if you're a kernel module), not to IO mapped memory.

By the way, for those following who want a really nice rundown of the hardware in this, (including eMMC chip that's in it), this sums up where I believe we're all at right now. We know bits and pieces in addition, but this is the high points (from basic to somewhat advanced level). http://androidforums.com/htc-evo-3d/346198-htc-evo-3d-full-specs-techies-dummies-2.html#post2776843
[HTC EVO 3D] pbedard:
You guys are doing sediment donations from me will be coming when u get s off

sent from my EVO 3D use xda premium