yashsingh1/xdaforums huggingface dataset:
[EVO 4G Android Development] skatrwannabe3:
Didn't mean to add the negatory spin ;) I've been reading up on the topic to sort of get an handle on the whole first root thing. The main goal is S-Off. To do that we use a method like Unrevoked, if one exists and there are none for 2.3, right? And we can't crack the bootloader since we don't have HTC's goods for an "official" signed zip. Many people suggest "tricking" the phone, but more people report using the PC36img doesn't work at all (because of the bootloader?). What other way can we make the phone think it's flashing an "upgrade" to Froyo?

I dunno what comes first, but mikey said temp root. What do we need to achieve that?
[EVO 4G Android Development] backspacepc:
I agree, but what I was wondering is which files are used for signing the stock update in order to trick it.

Sent from the land of motorcycles!
[EVO 4G Android Development] Nick N:
So maybe 3.70 repacked and signed to look like a 4.25 update? If I had a Froyo Evo with S-On, I could use the current version of UnrEVOked to get S-off today?

In my recent experience the 4.24 file renamed to PC36IMG.zip loaded and updated just fine, obviously it reset the phone. The 3.70 file renamed PC36IMG.zip loaded but gave the error message:

Main Version Older! Update Fail!
[EVO 4G Android Development] backspacepc:
Yes, that's what I was talking about.

Sent from the land of motorcycles!
[EVO 4G Android Development] 1gr8papa:
excellent idea for the thread. can we look at the hboot.img, boot.img, and recovery.img from the evo 4g 2.3.3 witha hex editor? configure them to look like a future update? or look for the sig in the same .img's from 3.70, grab the sig copy to 4.24? Just hoping! this is taking forever to get s-off. any word if the evo 3d or sensation perma-temp root will work for legacy evo's?
[EVO 4G Android Development] backspacepc:
I've tried the temp root from the 3d and it will not work on the EVO.

Sent from the land of motorcycles!
[EVO 4G Android Development] JBO1018:
The problem with trying to take an RUU and modify it to trick the phone into downgrading is anytime you change ANYTHING in an RUU it breaks the signature. Which means to make that RUU flash on a s-on device you would need to resign it with HTC's private key.

Sent from my HTC Thunderbolt
[EVO 4G Android Development] xbiker321:
Keep up the good work guys. I have a friend who has an EVO 2.3.3 and needs it rooted.
[EVO 4G Android Development] Nick N:
Has anyone (inside or outside EVO 4G dev) verified that it has to be signed with HTC's signature or simply signed with a later version number?
[EVO 4G Android Development] HipKat:
First off, Brilliant thread!

Now, I'm no programmer, but I do believe I excel at common sense, and common sense tells me that what was said above about breaking the signature is the key. Any changes, and the signature fails, so, not knowing the process, it seems to me that the idea of decompiling the code in the pc36img to basically resign the version number is the way to go.

I can only imagine what that consists of, however, but if enough people take pieces of the file and start going through the code, line by line, someone is going to find that needle in the haystack.
[EVO 4G Android Development] 1gr8papa:
Just run the 3.70 RUU, pull the rom.zip from temp folder. Grab the img's out of there. Then see if we can hex edit it to fool the newer hboot.
[EVO 4G Android Development] ww3kc:
Thanks In Advance

Those of us who want to root our EVO's, but don't know what to do, really appreciate you people who DO know what you're doing!! :)
[EVO 4G Android Development] 1gr8papa:
Hhhm?

Isn't the newer private signature in the new ota? If so, can we grab and use that for the 3.70 PC36IMG? All theoretical of course.
[EVO 4G Android Development] Nick N:
The 4.24 PC36IMG.zip update image is located here:

http://xdaforums.com/showthread.php?t=1133379

Latest Firmware

Must be flashed through hBoot/Fastboot! Not Recovery.

PC36IMG - Radio_2.15.00.05.02 WiMAX_R4623-EVO27243 PRI_2.15_003
[EVO 4G Android Development] bonao1851:
rooting evo

This is a good thing you are doing, let's find a way to root, I'm all ears.
[EVO 4G Android Development] {ParanoiA}:
isnt the word from htc that they will be unlocking bootloaders soon? or is that just for the 3d & sensation? (no promises, i know) either way we need to get root! maybe someone knows someone who knows someone that has inside info on how these files are officially signed? just thinkin outloud...what about hardware hacks? is that even possible?
[EVO 4G Android Development] JBO1018:
If you could take a signed file, pull out what's in there, put in whatever you want and have it pass the signature check then...well it would make signed images useless as a form of security.

Not trying to dis on anyone, Im all for this type of collaborative brainstorming and I am far from an expert.

Sent from my HTC Thunderbolt
[EVO 4G Android Development] NinjaWolf:
Ok, i am rooted, but wanted to share an idea i have, im no root masteer, but i know how the android system works, and was thinking bout ota's today and came up with this:

The HBoot(2.05,2.10,2.16) are made to not accept older hboots, so couldnt we hex edit the 2.10 hboot to be 2.20(higher than .16), then we can make fake new rom(4.25 maybe), and use the same radio's, then build a PC36IMG, flash it,which will trick the hboot to thinking this one is newer, which will be an exploitable one(2.10), then we can s-off since the hboot is exploitable, and then root.theen flash amon_ra.

Take this as a grain of salt, but sounds stable.

Can someone please start testing this theory. By hex editing the 2.10 hboot to show 2.20. then once we get the hex edited hboot, i(or someone else), will build a Fake Ota(2.24, spoofed to be 2.25), then build the pc36img(recovery will be stock, will flash a diff. one after we s-off). I beleive this should work, can someone please verify this.

Hope this leads to you guys getting root.
[EVO 4G Android Development] runcool:
oh oh oh! I know how to root our new phones! We sue HTC and Sprint to get a patch out that for one, gives us an option in the menu to root our phone and also sue android and make them come out with patches that doesn't require our providers to send the updates to us. lol. I like my idea. okay, so it won't work? okay, you're right. :-D But it was an idea. :-P
[EVO 4G Android Development] ca1ne:
No way to spoof the signature required to pass the check to start running the ruud, any modification to the files will break the signature.
[EVO 4G Android Development] HipKat:
The EVO was not on that list of devices in their statement
[EVO 4G Android Development] skatrwannabe3:
Does it have to be an unrooted 2.3 Evo? I'll do it, but I'm rooted with a custom rom
[EVO 4G Android Development] skatrwannabe3:
Not so much. FLAME ON! kidding, surely the OP wants this thread free of bickering
[EVO 4G Android Development] Nick N:
Sorry, here is the link to the stock 4.24 zip file that I renamed to PC36IMG.zip, placed on the root of the SD card, and successfully flashed in Hboot.

Post where I found the link: http://xdaforums.com/showpost.php?p=14437807&postcount=1

Link: http://goo-inside.me/supersonic/ruu

File used:

PC36IMG_SuperSonic_GB_Sprint_WWE_4.24.651.1_Radio_2.15.00.05.02_NV_2.15_release_199233_signed.zip

When I flashed this, it updated in this order:

BOOTLOADER (acted more like a check because of how fast it updated)

RADIO_V2

*Phone reboots into Hboot*

SYSTEM

RECOVERY

BOOTLOADER

RADIO_V2

WIMAX

USERDATA

SPLASH1
[EVO 4G Android Development] chavonbravo:
The new hboot doesn't really pose any new blocks, as far as I've seen. The focus should be on looking for a temp root solution. Once that's found, you can flash the misc partition and that will allow downgrading to a previous official release, like 3.70, then s-off that way, and obtain full root.
[EVO 4G Android Development] skatrwannabe3:
Haha, well I found a willing recruit on facebook who's unrooted. I actually sold her the phone awhile back =P
[EVO 4G Android Development] Omgadroid:
EDIT:Best of luck I truer to run boot no luck sorry

I'm 100% stock no root
[EVO 4G Android Development] JBO1018:
The signature process and associated private key are a form of encryption. You are not going to be able to just copy and paste the signature out of an RUU. Also flashing randomly edited hboots is a bad idea even considering an s-on phone wont flash anything not signed.

Sent from my HTC Thunderbolt
[EVO 4G Android Development] Omgadroid:
Like I sed ill be a guinea pig I'm 100% stock and I can care less about bricking my phone
[EVO 4G Android Development] skatrwannabe3:
Great, do you know how to flash the file newalker posted the link for?
[EVO 4G Android Development] bubby323:
Temp root.

adb devices
adb install Superuser.apk
adb push su /data/local/tmp/su
adb push busybox /data/local/tmp/busybox
adb shell chmod 0755 /data/local/tmp/su
adb shell chmod 0755 /data/local/tmp/busybox
adb shell /data/local/tmp/su

Permanent root.

adb shell mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
adb shell mv /data/local/tmp/su /system/bin/su
adb shell mv /data/local/tmp/busybox /system/bin/busybox

You can't run anything with adb shell because you'll get permission denied. Wait..got an idea.

This is really just me thinking out loud, feel free to ignore it.
[EVO 4G Android Development] bubby323:
No go, but that's given with the android info reading a lower version than the newest that I'm running, and I'm positive that you can't fake HTC's signature.
[EVO 4G Android Development] Omgadroid:
Won't do anything
[EVO 4G Android Development] JBO1018:
I fully agree. However, in this case, I think finding temp root first will be necessary before s-off can be tackled.

Edit: Actually I would say in any case.

Sent from my HTC Thunderbolt
[EVO 4G Android Development] bubby323:
No problem.
[EVO 4G Android Development] skatrwannabe3:
temping

So what's the plan, how does one obtain temporary root on any device?
[EVO 4G Android Development] bubby323:
An application running from the system of Android on any rom has more power than simply running adb from the SDK on a computer to your phone. When you're running scripts from inside the system you have access to the system, if you can remount it as r/w.

Hm.
[EVO 4G Android Development] mikeyinid:
Gingerbreak can be modified to get temp root on it. I dont know anything about scripts though, so I would ask that someone that does take a look at it.
[EVO 4G Android Development] bubby323:
I've already taken a look at it. The source code shows that it looks for the partitions to mount and a logcat reveals that it does mount the system, but it can't mount it as r/w. Gingerbreak also seems to be patched in the most current version we are running on the Evo. Bummer..
[EVO 4G Android Development] Nick N:
Deleted. See reason for edit.
[EVO 4G Android Development] JBO1018:
Find an exploit in the firmware that will allow privilege escalation. Remount system as r/w.

I dont know how you find these exploits but thats where you start. There are probably other ways and better explanations but thats about as far as my knowledge goes at this.point.

Sent from my HTC Thunderbolt
[EVO 4G Android Development] bubby323:
We really just need to get the file into the system first off, which is possible with an apk. But then the apk is a container for the files.

Its like this.

[ANDROID-apk-ANDROID]

If you can release the assets of the apk into the system partition, more specifically into xbin or bin, then you have root, which in theory sounds great but system is read only until you mount it differently which errors out without root.

Permission denied.
[EVO 4G Android Development] bubby323:
They really just use either there assets included in the apk file or libs already on the device and in the file system.
[EVO 4G Android Development] bubby323:
System links might come in handy. If you could link su from /data/local/tmp to /system/xbin.

In Linux this is possible with

ln -s

The ln binary (used for syslnks) is present in Sense in the directory of /system/bin/ln, and the help states that you can use that same command

ln -s "object" "new_dir"

However, you still can't "write" to the system partition, without it being r/w.
[EVO 4G Android Development] bubby323:
From working on kernels for a long while, I also know that in the kernel, init.rc more specifically, you can automatically boot the system as r/w.
[EVO 4G Android Development] JBO1018:
Wouldnt you need the apk to run an exploit that grants it higher permissions (read:root) first, then run the command to remount the system as r/w and then you can push the binaries to bin and xbin.

Sent from my HTC Thunderbolt
[EVO 4G Android Development] bubby323:
I'm not aware of the highest permissions an application can ask for, probably not very high without root being present.
[EVO 4G Android Development] JBO1018:
I just mean the only way assets from an apk could get into the system partition is if that apk first ran an exploit to get root and then remounts the system r/w. Then as long as it isnt write protected it can push the su binary and app so root will stick.

Sent from my HTC Thunderbolt
[EVO 4G Android Development] dsotm82:
http://xdaforums.com/showthread.php?t=884060

Nevermind.... see it's been up for a bit...should really click through to the end eh?
[EVO 4G Android Development] 1gr8papa:
Went thru the check newalker, but went right back to sit on the bootloader.
[EVO 4G Android Development] loveshinesthru:
When I orig got my evo, my roommate took a copy of the stock pc36img and replaced the recovery image with one that had recovery from clockwork or a similar one. It automatically rooted my phone and turned it to s-off. I never had to use unrevoked or go that route. Can this be done now with an updated version of the stock pc36img? I was going to try it, but didnt want to chance bricking my phone. I just got a replacement and it has gingerbread on it. :(
[EVO 4G Android Development] HipKat:
I wondered that too, if it could be so simple as to just replace the stock recovery in the OTA with a CWM or AR, but I have to think it's been tried...
[EVO 4G Android Development] Nick N:
So if a file is signed and you modify the contents of the file does is break or modify the signature?

Are we certain it needs a specific signature or simply be signed?
[EVO 4G Android Development] inifekt:
It's my, very little, understanding that it will break the signature.
[EVO 4G Android Development] Nick N:
How can someone tell if a file has been signed? I thought I read somewhere on here (XDA) that even the recovery and other files are signed. Do they all have to have the same signature?
[EVO 4G Android Development] LCL22:
for the purposes of flashing and going S off , i think so yeah..its the hboot itself that allows for anything to be installed or modified so id assume that everything , including recovery, has to pass the same kind of signature check and thus they are likely to have the same digital signature

of course i am not certain but its a fair guess
[EVO 4G Android Development] jmin9012:
A quick way to tell is to unzip the PC36IMG.zip with winrar or winzip. It will tell you if it is signed by "SignApk"
[EVO 4G Android Development] evonate:
Do you think it has anything to do with file date and time matching? Might be worth a try.
[EVO 4G Android Development] tjmckenzie:
Looks like the Fre3vo team has managed to get a temp-root on the EVO 3D.

http://xdaforums.com/showthread.php?t=1150006

I'm not much of a developer, but would it be possible to do more to achieve S-OFF once you have temp root?
[EVO 4G Android Development] ca1ne:
Fre3vo, won't help us, it uses a method with a driver that we don't have on the evo.. But yes you need temp root, so you can change system folder to read write
[EVO 4G Android Development] HipKat:
Is here a way to turn debugging on, so you can access the device with ADB??
[EVO 4G Android Development] jmin9012:
Settings

Applications

Development

USB Debugging.
[EVO 4G Android Development] tjmckenzie:
Is it possible to run RUU to a previous version if the Evo is still S-ON?
[EVO 4G Android Development] xHausx:
This ^^

As long as you can downgrade the radio then you can get S-OFF, otherwise there still may be a way to flash ROMs and everything but your phone won't be fully unlocked.

Getting temp root is key here.
[EVO 4G Android Development] Omgadroid:
With the current version of hboot it won't allow downgrading but you can use it to rather factory reset same version or in the future upgrade the device
[EVO 4G Android Development] LCL22:
i think for most flashing roms would be more than ok, though i gotta ask, what would entail not having the phone unlocked? not using root apps? hotspot and such?
[EVO 4G Android Development] inifekt:
Do you think if/when root is achieved it will apply to the Evo from au by KDDI?
[EVO 4G Android Development] xHausx:
If downgrading is involved then unfortunately not, I have a few other ideas that may work on KDDI Evo's though.

Just, no matter what, do not upgrade to gingerbread if they offer an OTA. Otherwise you'll be stuck in the same boat as everyone else and waiting on an exploit.
[EVO 4G Android Development] HipKat:
I KNOW how to turn it on my phone, but I wonted to know if you could access this with ADB so you can get into the file system.

Keep in mind, I'm naive to this whole process.
[EVO 4G Android Development] complex88:
I just tried this and it didn't work. Good idea though.
[EVO 4G Android Development] loveshinesthru:
Thanks for trying, wish it wouldve worked!
[EVO 4G Android Development] xHausx:
HTC waited for google to patch gingerbreak before releasing the gingerbread update. They're pretty good about that kind of stuff once they know there is a hole there.

I have the rage source too if you really want it but that got patched way back with gingerbread.
[EVO 4G Android Development] jadejaws:
Just summing up....

Is this all correct HAUS? (or anyone else that can answer)

The basic problem is there is NO exploit at all right now to gain root access.

Without an exploit, there is nothing to be done.

I know I for one am not able to even identify an existing exploit to take advantage of in the patched 2.3.3 on the EVO 4G at this time.

These guys:

C-Skills have written the two most commonly used exploits for ALL android phones;Gingerbreak and Rageagainstthecage.

Follow C-Skills on twitter

Everyone uses these for almost all phones.

Both of these exploits have been patched on the latest firmware/OTA.

AlphaRev X has developed an exploit for certain HTC phones and are probably your best bet to follow at this time

Follow AlphaRev X on twitter

I am surely missing some expert reverse engineers here. I apologize to them.

The basic adb session for rooting any phone is as such:

adb devices
adb install Superuser.apk
adb push exploit (gingerbreak/rageagainstthecage)
adb push su /data/local/tmp/su
adb push busybox /data/local/tmp/busybox
adb shell chmod 0755 /data/local/tmp/su
adb shell chmod 0755 /data/local/tmp/busybox
cd /data/local/tmp
./exploit (root access gained after a period of time)
adb shell

mount -o remount,rw -t yaffs2 /dev/block/mtdblock(3 or 4) /system

cd /data/local/tmp

./busybox cp su /system/bin

./busybox cp busybox /system/bin

cd /system/bin

chmod 4755 su

chmod 4755 busybox

exit

exit

The problem is that there is no known exploit at this time to gain root access.

Until the developers can find a security hole and write an exploit for it, its the ultimate waiting game.

Are their security holes in this OTA? Certainly. Its just a question of how soon someone writes the next exploit for Android OS in general, not just EVO.

Every manufacturer will patch the exploit used by gingerbreak eventually and a new method will have to be discovered.

So everyone that thinks root will never happen again on the EVO...it will.

The EVO and latest batch of HTC phones are just the unfortunate (or fortunate since technically HTC patched a security hole quicker than most which is a good thing) recipients of this patch.

The jerk move by HTC is locking the bootloader and preventing previous versions of software. I strongly disagree with the need to even run exploits on these devices. Every phone should ship like the Nexus S 4G and be unlocked from the get go. Of course.....I am just echoing the thoughts of most here though.
[EVO 4G Android Development] xHausx:
For the most part that's how you would get temp root although as long as you have S-ON none of the changes will survive a reboot.
[EVO 4G Android Development] jadejaws:
Thanks.

I guess I am impatient and fortunate because tomorrow I will have a Nexus S 4G instead of this phone.

Complained to Sprint enough with a large account on the line.

I like the EVO, but this is for the birds.
[EVO 4G Android Development] xHausx:
Do those of you with the 2.16 hboot still have the hboot usb option?
[EVO 4G Android Development] skatrwannabe3:
irony

Just realized I was looking for other news on a 2.3 root method using Google search HAHA
[EVO 4G Android Development] c-had2001:
I would think that since HTC announced they will be unlocking the bootloaders on the EVO 3d and sensation next month more people would be working to crack the EVO 4G. I mean why work on something that in 2 or 3 weeks will be easily attained, unless it will help on older devices that recently got locked. I am still confused as to if they are gonna unlock it or not, for every blog or article I find that says it will there is was that says it won't. I do want to sincerely thank everyone who is working on this, only thing I can offer is to test ideas as I have no programming knowledge.
[EVO 4G Android Development] bubby323:
adb push flash_image /sdcard/flash_image

cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/mtd-eng.img
[EVO 4G Android Development] c-had2001:
Yes sir its there on mine.
[EVO 4G Android Development] tjmckenzie:
Yes sir, I still have it on mine, too.
[EVO 4G Android Development] vandizzam:
Still got USB too
[EVO 4G Android Development] inifekt:
Sweet. Shoot me a PM if you need/want to test what you have for the KDDI Evo's.

And, yeah, I was tempted to just go to Gingerbread, but decided against it. Although in their update, it says...

Not sure if it means anything but KDDI Evo's do have a GB update available to them.
[EVO 4G Android Development] Omgadroid:
Usb is on my hboot too sorry autocorrect keeps popping its ugly head
[EVO 4G Android Development] :
FYI I have an Evo sitting that I'm willing to tinker (meaning if someone has a modified file they want me to run) with. 2.16 hboot 2.3.3. I found a rooted one on eBay so that's what I'm using daily. Im on the west coast and wouldn't be able to do it till I get home.
[EVO 4G Android Development] Omgadroid:
Any new ideas to test I have all day
[EVO 4G Android Development] pimp100500:
just wait till they root the E3D then most likely theyll b using the same root method....they came up with a temp root might wanna try that see if it works
[EVO 4G Android Development] Omgadroid:
I read somewhere that it doesn't work for og evo
[EVO 4G Android Development] mikeyinid:
Doesn't work.
[EVO 4G Android Development] bubby323:
If anybody wants to hit me up on gtalk (geek.preston@gmail.com) we can talk about my ideas, and you can test some stuff while i test some stuff to make everything go by a little faster. :)
[EVO 4G Android Development] Omgadroid:
I'm in to help as much as I can

im home on desktop now so im here to help

sdk and everything redy to go

Sent from my crappy desktop using google chrome lol
[EVO 4G Android Development] c-had2001:
Won't have to wait much longer for root because HTC is gonna unlock the bootloader on the 3vo and sensation, so I wish they would work on the EVO 4G. Once the 3vo gets unlocked by HTC maybe more folks will want to work on the EVO since there is still a challenge with it
[EVO 4G Android Development] Omgadroid:
yea but we misewell try there is no gain unless you try

like making linux kernal try to acsess android (found out i set my own kernal to R/O) -.- ant tryn that anymore lol
[EVO 4G Android Development] SGTSTEW75:
Sent a gtalk invite homie....

Sgtstew76

Hey are u rooted on that thing? Oh no...... well sit back and hold yer breath like the REST OF US......