yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] mazook98:
Guys, ill check, and I'm just kinda winging it, but I just backdoor installed Superuser from ChainsDd latest, and it worked..here's a pic... At the least, this should let us install some root apps..

Here's a link to the pic if its not showing up... http://db.tt/8otxQpB
[HTC EVO 3D] wake69:
how did u do this exactly?
[HTC EVO 3D] Stericson:
open terminal and show us a root prompt, installing super user proves nothing.

Also, please keep posts in this thread pertaining to development. Do not post things about taking your phone back, emailing HTC, how mad you are the bootloader is not unlocked, etc. The only reason you should be commenting in this thread is if you have something related to the developmental work going on within this thread. We need to keep these threads clean.

Regards,

Stericson
[HTC EVO 3D] smw6180:
Anyone can install that from the market. But it won't work.
[HTC EVO 3D] mazook98:
Sorry, just trying to help...I had to do it this way once with another device that didn't have full root before...but there was another file "su" (like 216 kb) that goes with it...anyone know where that should go? And terminal command was Su denied,....(sorry if I'm wasting yalls time. I'm gonna just watch for a while.)
[HTC EVO 3D] chubbzlou:
the su file goes in the system/bin
[HTC EVO 3D] Stericson:
Your not wasting anyones time, you were trying to help :)

the SU binary goes anywhere in your PATH, normally in /system/bin but you cannot put it there because it is read only for the SHELL. We won't be able to get this to work until we have root or a way to remount /system/bin as RW
[HTC EVO 3D] Scott:
Ok, I guess my question is why did the bootloader flash but not the system?
[HTC EVO 3D] Tilde88:
because it checked an officially signed image first, then the SD was switched with a manufacture signed one (universal) which doesnt match the signature, if the signature would match i assume the phone would boot. this could easily be tested if we had an ENG phone... then again, we wouldnt be here.

Edit: /system is within eMMC, which is completely write protected. bootloader is in HBOOT which is only protected by a password (so to speak), but can still be written into if you know the code (if the FILE knows the code :-p)

See it's supposed to go in this order. Manufacture (ENG) trumps encryption of any kind. Then /system trumps any sort of user blocks (with ROOT). In order to prevent /system being overriden, the phone says, if you're a manufacturer, you dont need an ENG bootloader cuz you have the key. So if hboot can't be unlocked /system can't be written to. What is being done is a hotswap to make it think nothing changes after the check for hboot is cleared. But it is not a pre-emptive only system. Checks back and forth. $.02 laymans.
[HTC EVO 3D] xHausx:
The radio was reported to refuse using an eng hboot as long as it is s-on. That is still interesting it actually flashed though.
[HTC EVO 3D] TrevE:
What I don't get is for ota to write to system they would need to include new hboot boot radio recovery each time asuming its sha1 checking done from another partition. That would make for huge otas...

If its not sha and just cert checking for a key then we could edit images...
[HTC EVO 3D] Tiffany84:
Even though it didn't work I just wanted to mention I was rooting a friends ThunderBolt the other day and when I was flashing the PG05IMG.zip through his hbot it did the same thing when it got to updating the system. It kept unzipping and then updating over and over again and it really had me freaking out cause I had never seen that before but after SEVERAL times of it looping it finally said ok and continued on. When I booted it up everything was good so that is definitely not out of the norm. I know it didn't work but just wanted to let u know that it happened to me and it did actually flash successfully. Sorry if it's a little of topic.
[HTC EVO 3D] Tilde88:
ah... sneaky bastards
[HTC EVO 3D] Scott:
Ok, thats what I was wanting to know...

...Like I said.. Its very odd that it took the flash even though it bricked. Just doesnt make sense to me. Not that I am a guru at all.
[HTC EVO 3D] agrabren:
From an eye-on-the-prize perspective, I believe we are targeting the radio-config partition. The eng hboot only matters after s-off, and is trivial.

As for eMMC, the device stores everything in eMMC. HBOOT is the name of their bootloader, not a storage method.

Can we flash the radio-config with the swap method?
[HTC EVO 3D] AyyRayy:
We can try I can't risk this EVO tho at the moment, because of yesterday's event lol but that could be tried
[HTC EVO 3D] Scott:
I can try when I get home in a few hours. What exactly do you want to swap?
[HTC EVO 3D] USSENTERNCC1701E:
I'll try if someone can tell me what to do to the file or upload a modded one.
[HTC EVO 3D] xHausx:
From what I've seen the hboot looks for {partitionname}*.img or {partitionname}*.nb0 for signed partitions. If you added it to the zip as radio_config.img it may pick it up and install it.

I posted this awhile ago but since it is buried on god knows what page I mine as well repost it. (see attachment) As for it repeatedly trying to flash the system partition, it looks like it will unzip part of it into a buffer and flash it little by little once the buffer is full.

edit: corrected radioconfig to radio_config as shown by the hboots partition list
[HTC EVO 3D] TrevE:
Cool read. We would need that in the original ruu though wouldn't we? I can't imagine we could flash something after swapping that didn't exist in original update
[HTC EVO 3D] agrabren:
Careful and back up your device first with fre3vo and dd...
[HTC EVO 3D] xHausx:
Was it ever confirmed where the security flag was located?
[HTC EVO 3D] d3vilskid:
If eng hboot brick the device, how about ship soff
[HTC EVO 3D] xHausx:
The radio is what decides S-OFF or S-ON, but the ENG hboot ignores the radio and always uses S-OFF. The SHIP hboot uses what the radio tells it to so it can be off or on.
[HTC EVO 3D] d3vilskid:
Gotta, thanks for clearing that up.
[HTC EVO 3D] AyyRayy:
@agrabren the sensation fr3vo thread has been reopened? Any good news to the recent findings? :D
[HTC EVO 3D] xHausx:
If anyone is able to give this a try I can hex in the security flag for you. I would but I am waiting on a call tonight so I need my phone.

To get the file needed root and from a shell use:

stop ril-daemon
(wait a few seconds)
dd if=/dev/block/mmcblk0p19 of=/sdcard/radio_config.img
start ril-daemon
[HTC EVO 3D] USSENTERNCC1701E:
Here you be
[HTC EVO 3D] xHausx:
Right on, before I begin putting the files together for you I want to make sure you understand the risks involved. If it actually does flash this, there is a very good chance it will brick or damage your phone. As long as it will boot into the hboot afterward there is a small chance you could change it back, but for the most part I'm guessing it will either turn out really good or really bad.

If you're still willing to give it a try I'll also need to know what version firmware you are using. It should be 1.11 if you haven't taken the update or 1.13 if you have.

On a different note, I wonder if this could be used to downgrade?
[HTC EVO 3D] USSENTERNCC1701E:
I took the update 1.13.651.7

As I understand it, worst case, complete brick (I'm within 30 days and have insurance). If it will boot to HBOOT but not to system I may (no guarantee) be able to run the RUU.

Have to ask you in all honesty would you do this to your phone?

I'm taking off to diner with fam right now. Will run when I get back. Please give Barney style instructions, I've never done anything like this and want to be sure if it fails it's because it won't work not because I ****ed it up.
[HTC EVO 3D] ktulu909:
Bravo. Effing pioneers here. I'd love to join in, but I'm over 30 days
[HTC EVO 3D] johnsonjs:
I'll give it a shot, fully understanding the consequences. radio_config generated from my phone is attached. Also on 1.13.
[HTC EVO 3D] VoXHTC:
Awesome work all, I would help but I'm outside my 30 days and my phone is my bread winner.

I would like to have pictures of everyone's faces of those actually flash this though :D

Will be funny to see. I hope it all works though.
[HTC EVO 3D] Scott:
Good luck all!
[HTC EVO 3D] xHausx:
I'm going to have to get back to you all in a little bit. I want to make sure I know exactly what needs to be changed first before we go flashing to the radio.
[HTC EVO 3D] sentra99:
If you need another volunteer here is my radio config.
[HTC EVO 3D] johnsonjs:
If I do this I'll definitely be documenting the entire process with my HD camcorder ... shaking from nervous hands of course. :p
[HTC EVO 3D] TrevE:
Well I've made 2 modded images ok in past days and flashed without bricking, aray92 did win a brick but odds are still looking in your favor for whoever tries next :)
[HTC EVO 3D] Scott:
Dont sweat it Bro... One of three things will happen...

1. Nothing at all

2. You will make a large advancement in obtaining S-Off

3. You will brick your device.

I am hoping for #2!!!!!

And please upload the video regardless of the outcome

Thanks man! Good luck to you! I got my fingers crossed!
[HTC EVO 3D] AyyRayy:
This is true I know not to try and flash the hboot lol. I really want to try more but I have to have my phone for work and luckily my foolishness was yesterday on my day off and had it taken care of immediately :p
[HTC EVO 3D] xHausx:
ty to everyone who volunteered, someone is about to give it a try so we should know tonight if it's a go or not.
[HTC EVO 3D] TrevE:
cool can't wait to see how it all ends up, hopefully this work and 1 3d bricked was for something :)

on another note how do we get to ramdump mode in hboot? See it referenced in 1.30.000 it looks to be a menu item but can't figure our how to get to it.
[HTC EVO 3D] mbobino:
Just out of curiosity, how does HTC go about "refurbishing" these bricked devices? Do they just scrap them or do they fix them and re-sell them? Just thinking out loud I guess but if we could figure this out we'd never have to worry about bricking our phones.
[HTC EVO 3D] tehbeetus:
For bricks they have hardware/software that can fix this ****. Just like sony does.
[HTC EVO 3D] d3vilskid:
Are you able to do it for the sensation?
[HTC EVO 3D] AyyRayy:
You can try lol if you have the hboot update files signed
[HTC EVO 3D] xHausx:
Well, it doesn't appear to work with a radio_options.img. If someone wants to try it with a stock PG86IMG you could swap out just the system.img from another version. eg. use the 1.11.651.2 PG86IMG and add the system.img from the 1.13.651.7 zip or vice versa. That may work better than swapping it out with a completely different PG86IMG
[HTC EVO 3D] TrevE:
i did try swapping with EU system.img, so unless its a keycheck i failed becuase i used foreign image or smethng thats no go either

Has anyone tried a usb to serial device and seing if we can talk to hboot or radio in ruumode? https://www.noisebridge.net/wiki/File:G1-two-usb-to-serial-cable.jpg

i have an adrino board i can rip up a cable if its worth trying
[HTC EVO 3D] sn0b0ard:
I tried talking to the radio in recovery mode (where it shows that red triangle) and I loaded the usbserial module in Linux with the proper vendor ID and product so I can send commands to /dev/ttyUSB0 and I was unable to locate /dev/ttyUSB0, so there wasn't anything to talk to using the screen binary. I can talk with the device when it is in fastboot USB, but it essentially blocks any command sent to it. Not sure if that helps, but thought I would share.
[HTC EVO 3D] TrevE:
well im hacking up a usb cable now to put into a usb->ttl board just solderering stuff togeether now, ill see what happens
[HTC EVO 3D] sn0b0ard:
Good luck! I really hope you are able to get a response from the phone and either unlock this son-of-a-***** or find something interesting that will eventually get us S-OFF :)
[HTC EVO 3D] xHausx:
If you're using Linux there is a way to but I'm still(doing so ATM actually) looking for a solution for windows7.

http://tjworld.net/wiki/Android/HTC/Vision/RadioAnalysis#TalkingtotheRadio
[HTC EVO 3D] TrevE:
im just building the damn cable. should be easier than playing with drivers and crarp if it works

step1 drunk solder usb cable, complete - http://i.imgur.com/AE6vo.jpg
[HTC EVO 3D] sn0b0ard:
I've been using VirtualBox with Fedora on Windows 7 x64 to try and talk with the device. Only thing I can't get working is talking with HBOOT because Windows doesn't recognize a USB device when in HBOOT.
[HTC EVO 3D] xHausx:
nice, unfortunately I don't have access to an adapter atm. I do have the same cabinets as you do though lol

how were you able to forward the USB port to virtual box? I couldn't get it to. Also check to make sure it shows hboot usb (something), it doesn't always connect right; you can also connect to it through the recovery.
[HTC EVO 3D] sn0b0ard:
You have to install the Guest Additions in the Virtual Machine before you can start forwarding the ports. After installing that restart the VM, make sure that Windows detects the USB device properly (i.e. HTC drivers installed, qualcomm, etc...) and then once in the VM you can select Devices > USB > and you should find the Android device in there, depending on what state the phone is in, obviously.

HBOOT USB doesn't appear on my phone because I think the qualcomm or HTC drivers are taking over when im in HBOOT. I've been experimenting in Windows to add new devices (COM Ports) and what not, but I get resource conflicts, and haven't been successfull in getting HBOOT USB when in Windows.

Additionally, I am using Fedora 14 if you want to take a shot at that. It's been working for me just fine, all I had to do was to make sure to install development packages / libraries and install the screen binary to get it to communicate with the phone. Looks like Fedora 15 is out now, but I haven't tested that yet.
[HTC EVO 3D] xHausx:
hboot usb plug actually, put it in hboot usb mode and if it doesn't add 'plug' unplug and replug it in
[HTC EVO 3D] TrevE:
well i have the cable plugged iin, only thing is its detecting it as FASTBOOT AC instead of FASTBOOT USB. when i type anything in putty to the com port the AC flashes though, so something is getting sent. I wonder if this is why the g1 has two cables, one going to serial one to usb.

i have it wired ( i think this is right)

black - gnd

red - vdd

green -txd

white - rxd
[HTC EVO 3D] sn0b0ard:
Ok, so I boot the phone into HBOOT with no USB attached, insert usb cable, Windows doesn't detect anything and the 3vo still shows HBOOT, I've tried unplugging and plugging back in, going into fastboot, which shows fastboot USB, and then back into HBOOT, but it still doesn't show HBOOT USB PLUG. Any ideas?
[HTC EVO 3D] sn0b0ard:
You should check to see if your output is showing FAILED... It says something close to that anyways, haven't sent commands to fastboot usb in a few days. That's what I get when I try any command. You get the same thing?
[HTC EVO 3D] TrevE:
im sending through a modded usb -> ttl cable, not regular fastboot

trying to get some kinda console if you look back a few pages like the htc vision
[HTC EVO 3D] sn0b0ard:
Yeah I know exactly what you are trying to do because I tried the same thing over usbserial in Linux. For some reason, the phone doesn't allow commands to fastboot usb. If you are on fastboot ac or just regular fastboot, I would be interested to see if you get a console and what sort of commands you can send...
[HTC EVO 3D] TrevE:
well i guess i can unplug VCC/GND and see if just tx/rx will do ****, but i kinda doubt it having no power. if that doesnt work im going to take vcc/gnd and just solder it back to another usb cable like g1 did
[HTC EVO 3D] xHausx:
Make sure you select 'HBOOT USB' from the hboot menu. You can use fastboot to send commands to it through fastboot mode but it's different than the radio.

edit: my bad, just noticed they removed that option from the evo 3d. I'm working on something for the 4G too so I wasn't looking at that one instead. Unless you are able to get rtask working through fastboot(please let me know if you can) it looks like you'll need to bring up the recovery to talk to the radio on the 3d
[HTC EVO 3D] sn0b0ard:
I'm going to try unrevoked modified usb drivers to see if I can get hboot usb plug. Ill post what happens.

Edit: unrevoked drivers didn't work.

Going to try and disable fastboot and see what happens.
[HTC EVO 3D] xHausx:
I'm using them as well and didn't have any luck with the hboot, it looks like htc removed it.
[HTC EVO 3D] sn0b0ard:
Damn that really sucks. I think I might have hosed my Win 7 installation with all of the driver uninstalling / re-installing, manually adding devices, etc, lol. Oh well. I will try talking to recovery. I think that in order to talk with recovery you have to use a serial type connection with no qualcomm or htc driver loaded in order for it to work (just a hunch).
[HTC EVO 3D] Evil-Dragon:
On the Sensation we have been looking at mmcblk0p3 which contains information about various aspects of security and simlock and it differs between an S-ON and S-OFF phone. When i was speaking to IEF the other day, he was saying how the S-OFF state was different to how it's been on other HTC phones, he said it was a multistate S-OFF. I don't know if he just means that the S-OFF value is just held in multiple places and communicated by each part (radio, hboot and radio rom) or if he means something different. We tried flashing mmcblk0p3 but it falls under the same emmc write protection.
[HTC EVO 3D] TrevE:
heres my attempt #2 at making a usb -> serial cable

http://i.imgur.com/J92V4.jpg

black / red go to normal USB plug, then white green are going to my rs232 board. this is like how the g1 did theirs, lets see what happens...
[HTC EVO 3D] xHausx:
lol, you really need to get some quick connects or butt connectors. They're much much easier to work with.
[HTC EVO 3D] TrevE:
haha yeah i know :) itis uguly :p

same thing happens this time, it lists the device as FASTBOOT AC. when i hit any keys on the keyboard the word AC flashes on and off the screen. cant imagine what else could be borked...

put a video of what im talking about here -

http://tinypic.com/r/2n9dveu/7

Black + Red go to regular usb plug, white goes to RXD on board, Green goes to TXD
[HTC EVO 3D] markgolly:
I'm still working on it. :(
[HTC EVO 3D] TrevE:
Still cant get anywhere with usb->serial, ive tried every way making that damn cable now. Trying to find my damn mulitmeter now, just moved so its probably burried somewhere

So the evo3d is suppose to do hdmi right? how the hell do you get HDMI over a 5pin microusb port? is there some kinda trickery going on here im missing
[HTC EVO 3D] k2buckley:
Sorry you had no luck, and thanks for your efforts. For hdmi to work, you need one of these MHL adapters. http://www.tessco.com/products/displayProductInfo.do?sku=398898&eventPage=1
[HTC EVO 3D] TrevE:
i wonder if theres any serial on that or how it splits the 5 pins out? looking at some other cables that were made: http://forum.gsmhosting.com/vbb/archive/t-909826.html / http://www.instructables.com/id/Android-G1-Serial-Cable/

they needed to use other pairs with htcs extusb cable to get serial besides the usb data pairs i tried just using.

*edit* somehting like this - http://www.sparkfun.com/products/9167
[HTC EVO 3D] wranglerray:
what are you tryin to talk to the phone with over serial? If i could sugguest try hyper termial. If the baud rate is correct and hardware acceraltion is turned off the the com port your using you should see some kind of return from the phone...
[HTC EVO 3D] pbedard:
Yes s off this week in a patch
[HTC EVO 3D] juvenile43:
i guess someone from alpharev said that is bs and didn't come from a verified source. hope thats not true..........
[HTC EVO 3D] jermx:
Huh? Patch this week? From alpharevx or HTC?
[HTC EVO 3D] pbedard:
Alpharev
[HTC EVO 3D] pbedard:
http://www.facebook.com/SensationDevs/posts/10150377325923084

Facebook page
[HTC EVO 3D] TimidRat:
Looks like a troll to me, the person who claims it'll be out this week has a 2 day old FB profile.

lol. beat me too it.
[HTC EVO 3D] CrippleB:
Sensation is not putting out tool, alpharev is. Unless heard from them don't get your hopes up.
[HTC EVO 3D] TrevE:
so i got serial going.

in fastboot USB anything you tye shows FAILnot allowed

hboot doesnt respond at all

recovery leaves this:

wwhiich looks like radio, but i could only type A's. checking cable for shorts now and trying RUU mode....

*edit* kickass, its actuually expecting AT commands, this is the radio. anyone know anythiing fun from here?

*edit2* i just usued screen in linux and it works the same as my cable. maybe others can join the fun too?

http://tjworld.net/wiki/Android/HTC...ctingusingserial-over-USBtotalktoRadioorHBoot
[HTC EVO 3D] steal25:
Latest from the horses mouth,

@Knucklessg1

@alpharevx Do you plan on beating HTC to S-OFF our HTC Sensation 4G and HTC EVO 3D's?

AlphaRev Development

@alpharevx

@Knucklessg1 pretty sure we will. Also, we will give you S-OFF, not just a 'bootloader unlock', whatever the hell that means ;-)

So..Maybe this week...Maybe sometime before Sept. Either way we gotta wait.

To everyone here working on it...Keep up the good fight!
[HTC EVO 3D] ckoadiyn:
Awesome go go go someone help him out lol
[HTC EVO 3D] TrevE:
well fastboot oem rebootRUU gives same FAIL everytimie you type.

normal boot connects but i icant seem to sened anything

only thing it looks like we can talk to is radio in recovery mode. hopefully theres some more AT commands there we can throw at this *****.

*edit* heres my 10 second tut on using screen in ubuntu

adb reboot recovery

sudo apt-get install screen

sudo modprobe -r usbserial

lsusb | grep High

at this point youll see something similar to:

Bus 011 Device 011 ID 0bb4:0c03 High Tech Computer Corp

the first part before the : in ID is vendor, second part is product. put 0X before it and load usbserial

sudo modprobe usbserial vendor=0X0BB4 Product=0X0C03

now do

tail -n 100 -f /var/log/kern.log

look for the line usb 1-6: generic converter now attached to ttyUSB0

the ttyUSB is the device yuo want. press ctrl+c to kill the log outpupt

now do

sudo screen /dev/ttyUSB0

and finid how to do something cool! The commands I was able to document that worked in regular mode are here - https://code.google.com/p/synergy-evo3d/wiki/Radio

i have not tested running much in this "serial recovery mode".
[HTC EVO 3D] sn0b0ard:
Looks like synergy has tested a good majority of the commands. I wouldn't even know what commands to send to try and get something useful. It would be interesting if we can somehow disable signature check in recovery using this.

Edit: Ok, I am able to talk with the radio now. Going to poke around a bit and see what I can find.

For anyone else interested, here are some additional commands that may work:

http://tjworld.net/wiki/Android/HTC/Vision/RadioATCommands

It's also extremely useful to enable verbose command responses:

ATE1

(You will see OK)

ATV1

(You will see OK)

Then you have verbose command responses :)

Edit 2:

So I successfully sent commands and received responses from the radio. I think the most interesting thing I found was the HTC_RA KEY, 26 character string. I don't know what this is.

After searching for what that could be, I stumbled across some pastebins, which appears to have some additional commands that we can try, which are not documented on the synergy or TJ World websites:

http://pastebin.com/3dsZLZGb

http://pastebin.com/E92jUWnq

Edit 3:

After searching for RA Key, I am thinking this may be a Results Analysis Key (a business code that HTC uses for manufacturing)? If it is, I don't think it will be any use to us :(
[HTC EVO 3D] xHausx:
I love pastebins :)

Ty for posting that and ty to whoever created them as well