yashsingh1/xdaforums huggingface dataset:
[HTC Wildfire S] no.human.being:
This would be "security through obscurity" and by definition neither good design, nor particularly secure. Android is quite a secure operating system by design. It makes use of privilege separation, software isolated processes, everything you can imagine.

Most of these security measures come from the Linux kernel Android is based upon, but some have been "enhanced" or "modified" by Google in order to meet the requirements of an embedded system. The HTC people have simply stuck some device drivers for their particular platform in and developed this dreaded user-interface disimprovement they call "Sense". It's not that phones like the WFS were more "hardened" than phones which have already been cracked, it's just that each Android build is a bit different in certain details and that no one has done it yet for this particular one.

Yes it is. It's only the kernel though afaik and even this one is HUGE.

Eeerm ... I don't understand quite what you were trying to state, but most of it doesn't make sense. There's no password we'll have to crack. For S-OFF, you basically need to do two things.

1. Obtain super-user (root) privileges on a shell. Revolutionary have already written an exploit for this and it works fine.

2. Create a software that resets the "device-security" flag and run it on the shell you did privilege-escalation on in step 1. The software will "inherit" the privileges from its parent process (the shell) and turn the phone S-OFF.

The Revolutionary people have completed step 1 with their zergRush exploit and we are probably close to completing step 2, but currently no one can actually do it because we lack a suitable C compiler.

Yes, that's basically it. It's rather C though, not C++. No need for object orientation and abstraction when creating exploits. Basically, the closer you get to the metal, the easier it becomes.

Embedded skills could also come in handy, e. g. reading disassembled ARM code obtained from a memory dump of a stock Android image.

Obviously, some experience in IT security will be very beneficial, even though this is more of an art than an exact science. Luckily, there are actually some very good IT security lectures held at our university and I have a really strong passion for this topic. You probably cannot become really proficient in this area without that passion.

Before all these efforts go too much off-track: What we need next is a suitable toolchain, most importantly a C compiler, for Android/ARMv6 now, not a mysterious "USB software" from zulea.
[HTC Wildfire S] SavageButcher:
What do you guys think about the "gsm to cmda to s-off" method in the other thread?
[HTC Wildfire S] Lt.Win:
I want to try it, but I can't, custom I'm on from my phone. But I'm also scared, don't wanna brick my only phone.
[HTC Wildfire S] XDA_h3n:
Cdma Rom on a gsm WILL BRICK YOUR DEVICE. Umph. Im stumped here now. If CDMA flashes on GSM. How come CDMA RUU Doesn't remove any of the GSM security images/hboot files

So theres a 96% chance of a
[HTC Wildfire S] Lt.Win:
There. I knew it. :-)
[HTC Wildfire S] XDA_h3n:
Cdma Rom on a gsm WILL BRICK YOUR DEVICE. Umph. Im stumped here now. If CDMA flashes on GSM. How come CDMA RUU Doesn't remove any of the GSM security images/hboot files

If CDMA Rom doesn't modify/remove/edit any hboot files this is a waste of time anyway.
[HTC Wildfire S] island3r:
Dude most of the time, I could swear that you don't even know what you are taking about.
[HTC Wildfire S] XDA_h3n:
Thats the best thing I do :D
[HTC Wildfire S] drummer1839:
XDA_h3n can you change your signature it's so f***g big you post 1 line post and the signature takes half of the screen... :P
[HTC Wildfire S] bingzz:
If yo0u've downgraded the hboot correctly, putting a CDMA rom on a GSM phone will not brick it. I've done it to my phone to test matt5eo's method. It didn't S-off sadly but it didn't brick either.
[HTC Wildfire S] ONeill123:
But can your phone register in GSM? Or comes message no network?
[HTC Wildfire S] bingzz:
Actually if you take your sim out, it asks for a sim. I'm sure CDMA phones aren't supposed to do that. But since it's the rom and the not the actual there must be a difference. When the sim was in, I had 3 bars of signal but I couldn't call, text or use the mobile network.
[HTC Wildfire S] ONeill123:
Ok, and how u flash this?

With the rom.zip from the temp folder?

Another question:

Did anyone know how i can flash the enghboot.nb0

???
[HTC Wildfire S] compro01:
CDMA does have SIMs (called CSIMs), but unlike GSM, they're an optional part of the spec and not used much.
[HTC Wildfire S] XDA_h3n:
D: stigty goney
[HTC Wildfire S] drummer1839:
XDA_h3n thank's :D
[HTC Wildfire S] BeciMester:
It's not about the program (which is an online tool anyway), it's about the bootloader of the phone, which in our case doesn't support the necessary command to extract the information HTC's online tool needs. So unless HTC releases a software update for the WFS that supports this, we can't use the official unlock tool, no matter how much it's updated.

Desire-Oxygen2.3.2 | WFS-stock
[HTC Wildfire S] ieftm:
Opening MTD blocks and writing to them has nothing to do with hboot in itself.

These block devices are protected on a hardware level, eg, NAND RW protection.

In radio nvram, to be exact. HBOOT has control over the handset by setting hardware flags (such as above mentioned NAND locks) whenever a kernel is executed (recovery / android boot).

Don't waste your time with linux permissions. They're not what will get you S-OFF. The actual locks are much more low-level. So no, it's not a protection within Android. The actual NAND device (and following that, the driver) returns ECC errors when trying to write to a locked block.

I think you're confused. How would /dev/block/mtdblock3 give you 'S-OFF'?

As long as NAND hardware rw protections are in effect, you will never be able to write to any of these protected blocks. Not /system, not /boot, not hboot.
[HTC Wildfire S] ONeill123:
So, how we can change the value of secuflag?

And the secuflag is stored where? Anybody said in the radio, or where?
[HTC Wildfire S] *se-nsei.:
It could be, you never know. HTC announced that ALL 2011 models can now be unlocked and changes to the site will appear in the coming weeks. So not entirely sure yet people.
[HTC Wildfire S] Lt.Win:
Unlocking the bootloader isn't full s-off. You can just install custom rom and get Full permanent root. I don't know about the custom cwm though.
[HTC Wildfire S] breaky9973:
So is there anyway that we can remove or disable these NAND hardware RW protection with the Wildfire S? (without use of a XTC clip ofcourse)

What kind of tips can you give?
[HTC Wildfire S] meanmug:
So very true take a look at this http://www.m-99.co.uk/Mobile_Phone_...d_Informa/motorola_test_sim_card_informa.html. Xtc-clip acts as a test sim card and I dont see how software mods can enable this.
[HTC Wildfire S] csoulr666:
@ieftm - I would like to ask you something.......why reply now.....didn't you say its "an old **** in a new package"???:rolleyes:

Why help us now???
[HTC Wildfire S] MindBurn010:
So, did anyone investigate the NAND Unlock methods... for EVO 3D for example, or if Wildfire S and EVO 3D have the same new NAND protection?

Can we try NAND perm root?
[HTC Wildfire S] d33ps1x:
The more minds the merrier.
[HTC Wildfire S] csoulr666:
It would be a lot merrier if the revolutionary team helped us.....Lets just hope ieftm helps us out at some roadblocks and doesnt go AWOL

---------- Post added at 06:08 PM ---------- Previous post was at 05:27 PM ----------

Hey guys!!Found something that might help!! Its another exploit for shell root which stays even after we pull the battery or restart!!!!

Check it out here

It is a little unstable though....I hav ebeen getting FC's of the Status bar after it..
[HTC Wildfire S] ONeill123:
Yes, i have tried it. U have the same functions like softroot with zergRush, if any other functions are possible idk, but u can't write at the /system or /recovery partition.
[HTC Wildfire S] csoulr666:
There are 3 things new

1.Its a bit unstable

2.It remains until you give the command to stop it

3.Its a new exploit(duh :D)
[HTC Wildfire S] ONeill123:
But why use it, zergRush did the same without the faults. ANd i don't know if we become s-off with this exploit or with this help.
[HTC Wildfire S] *se-nsei.:
It might help better than zergrush because it's more powerful I guess.
[HTC Wildfire S] ONeill123:
Hmm, maybe, but now i have an idea, why 2-3 threads with the same content, the most activity thread in this way is:

http://xdaforums.com/showthread.php?t=1374926

Maybe we can work all at this thread, its better as these 2 threads at the same time!
[HTC Wildfire S] bonesy:
I suddenly remembered that the Legend is also MSM7227 and wondered if you could do it a similar way? http://xdaforums.com/showthread.php?t=1223950 Something to do with copying misc.img for an edited one i believe.Im no developere so i wouldnt know where to start but maybe someone with the knowledge could compare files/code in the misc.img and compare it to the Legends standard misc.img to see where the exploit it??
[HTC Wildfire S] Lt.Win:
New Exploit, Old Method

Using the new temproot exploit, which doesn't go even after a battery pull, can't we boot into fastboot and follow revolutionary's method? Isn't that what they did? We're just using another temproot exploit, that's all.
[HTC Wildfire S] meanmug:
Quote from jcase "It works fine, you just don't understand that root is not the same as unlocked.

This exploit just gains root. You will need a second exploit to unlock."

---------- Post added at 11:55 PM ---------- Previous post was at 11:20 PM ----------

If after applying new temproot method and phone gets stuck in bootloop, load PG76DIAG.nbh to sdcard from pc, reboot to hboot, and clean s58. You will lose all info including failed temproot data.
[HTC Wildfire S] logout20:
is it working for you....why don't you give a tutorial......

---------- Post added at 09:44 AM ---------- Previous post was at 08:59 AM ----------

hey guys there is a new thread on xda china regarding software S-OFF...

http://bbs.xda.cn/thread-10928318-1-1.html...
[HTC Wildfire S] ctt812:
this won't work, the HTCdev method for unlock not supported
[HTC Wildfire S] ONeill123:
How revolutionary works. Maybe with the new temproot exploit we can port the revolutionary method to wildfire s.
[HTC Wildfire S] Lt.Win:
I'm just asking, i'm no dev to make it run that way. :P
[HTC Wildfire S] Lt.Win:
That's just what I said, in other words. :P
[HTC Wildfire S] bonesy:
I really think you will have more luck with this if you talk to the Devs responsible for S-OFF on the wildfire, they even managed to make the system partition writeable with S-ON so you would only need to use Fake Flash recovery to install custom roms.If your desperate for Revolutionary to do it, send them a wildfire s.Doesnt have to be fully functional.A broken digitiser one would be perfect as its all they needed for the orig wildfire..

Just a quick Q.. If i got a XTC Clip and charged say £2.50 to unlock your phones,Who would be interested in it?
[HTC Wildfire S] ONeill123:
You can't fake flash the unooficial recovery of the wildfire s. It say, that an error with oem.... and the phone restarts

So i think, htc has closed this method.

An i hope, that revolutionary will help us to find a way, but for now, they wouldn't help us.
[HTC Wildfire S] logout20:
I'm interested ..I'm from India....
[HTC Wildfire S] timbohobbs:
Im interested too bonesy, I've still got my hero but my girlfriend has wfs. I'm in gloucestershire. I remember you from your work on hero ages ago :-)
[Motorola Atrix 2] jimbridgman:
Ok, so now that we are partitioned we can do some real fun stuff, and by fun stuff I mean command line. :)

I would make sure you are plugged into a power source when you are doing this part, becuase the script will run for a very long time, it is copying 1GB of data to your SDcard, and installing a patch that includes another 100 or so MB of needed programs.

Go get this tarball

IT IS VERY IMPORTANT THAT YOU COPY THIS INTO /data/local ON YOUR PHONE

Copy this to your system with:

adb push webtop_unlock.tar /data/local

Now connect to your phone with ADB

adb shell

su

cd /data/local

tar -xvf webtop_unlock.tar

chmod 755 setup_webtop.sh

sh ./setup_webtop.sh

This will do a whole lot of things, like copy the webtop install to your SDcard, then patch it, so that you can run synaptic and a termial and disable the FACLs and MACLs that Motorola has implemented, so that it is not locked down anymore.

***Note: I only had a chance to run and test this script once, so if it is an issue please let me know nicely in a post here, or PM me, but please copy any errors or get a screen print if you can, so that I know what to fix. Please don't post a reply with it did not work, give me as much info as you can.

After your phone reboots ADB into it again, and do this:

su

mount -o remount, rw /

**take note that you must run the "mount -o remount, rw /" command anytime you reboot your phone because any programs you get thru apt-get or synaptic will error out during installation
[Motorola Atrix 2] jimbridgman:
Now that you have most of what you need Do this:

Connect to webtop with whatever method you like, HD dock, or lapdock, or TV (you most likely have to have a bluetooth keyboard mouse to use your TV).

Then when the webtop session starts:

Ctrl+Alt+T

When the Terminal launches type this at the command line and hit return

sudo apt-get update

From here, you can run "gksu synaptic" and use the password "test" to start installing various different programs and packages that are normally available on Ubuntu.

Dependencies

Take caution when modding Webtop because there are some dependencies that will break Webtop if they are upgraded such as anything ending in a .mot or anything resembling that.

Credits

Please thank [mbm] for fixing what Motorola took out, without him, none of this would be possible without his patch.

Sogarth for being the pioneer of Webtop hacking.
[Motorola Atrix 2] voodoomurphy:
Hiya Jim! Thanks for posting this!

Question:

So with this it says you have to have a bluetooth keyboard and mouse for use with a TV. Did they disable the onscreen keyboard and mouse then?
[Motorola Atrix 2] jimbridgman:
If you use the webtop patch for connecting to a tv, I THINK you can still use the touch screen on the phone for keyboard and mouse, but I will be real honest, I have not tried it, since I have the HD dock and I have used a lapdock or two to play with.
[Motorola Atrix 2] voodoomurphy:
Jim,

I gparted my **** the other day and made a 4 gig partition called Linux, but when I ran the script I got this:

done. Sit back this will all take a while. ==========================================================

Finding the partition you setup and formatted to ext3....

Copying the scripts that will mount the osh partition on your sdcard at every boot.

Copied mountosh into place

stat: cannot stat '/tmp/osh': No such file or directory

Mounting your sdcard linux partition so that we can copy over the wetop install to it

link_image[1964]: 10279 could not load needed library 'liblog.so' for '/system/bin/mount' (link_image[1964]: 10279 could not load needed library 'libgcc_s.so.1' for 'liblog.so' (load_library[1106]: Library 'libgcc_s.so.1' not found))CANNOT LINK EXECUTABLE

[: 45881: unknown operand

Your SD card did not mount properly; Please send the log to the author of this script

root@edison:/data/local# Chris-Murphys-MacBook-Pro:~ chrismurphy$

and now the web top will not load to my TV. I am using the hdmi hack for that. Thoughts?
[Motorola Atrix 2] jimbridgman:
ok adb in and remove the files you used.

Code:

adb shell

cd /data/local

rm setup_webtop.sh

rm mountosh

rm mountosh1

rm unlock_webtop.tar

rm webtop_setup.log

mount -o remount, rw /system

cd /system/bin

rm mountosh

mv mountosh.orig mountosh

cd /data/local

mount -o remount, rw /system

End Code

Then go download the tarball again from the link in the OP (I made a slight change in the script that should fix the error about stating the /tmp/osh directory), and do the instructions in OP again.
[Motorola Atrix 2] voodoomurphy:
ok so when I tried to rm mountosh it gave me permissions denied.

EDIT** Ahh, I needed to be su after going into dab

Edit***: Jim When I try to run the webtop SH file I get this:

root@edison:/data/local# sh ./setup_webtop.sh

./setup_webtop.sh: 116: Syntax error: "}" unexpected (expecting "fi")

root@edison:/data/local#
[Motorola Atrix 2] jimbridgman:
Ok, I found the issue, I forgot to close out a new if loop I had to add to fix the last issue.

I have updated it, go re download and remove the files in /data/local

check to make sure that there is not a /system/mountosh.orig,

if there is, move it back to mountosh, and remove the mountosh script ONLY if there is a mountosh.orig. I am guessing that there is not one since this most likely did not run at all.

P.S. I can't test it, since I don't have my replacement phone yet, they did not have any in stock at the repair center, so Motorola had to send me a new one on Sat. I should have it tomorrow or Wed. at the latest, I will have to do all of these things again, and I can test it then is depth a little more. Otherwise if you don't mind Being the guinea pig I will fix any issues ASAP.
[Motorola Atrix 2] voodoomurphy:
Well Now I get this when I try to open the sh file:

root@edison:/data/local# sh ./setup_webtop.sh

.: Can't open /osh/upath.sh

root@edison:/data/local#

I'll Keep trying as long as you think it's fixable. :) Last thing I want is to lose my web top entirely.

EDIT**: Right now when I connect my phone to my monitor I get a moving Motorola logo like it's a screen saver.
[Motorola Atrix 2] jimbridgman:
It is fixable! I used to be a system admin, (before I switched to consulting and system architecture) and you can always fix it until it no longer boots.

when you ran the script, did fully run and did you see files being copied, and did it reboot your phone?

ok, now I need you to run a few commands and collect some data. post the output here, after you get it.

Code:

adb shell

su

/system/bin/fdisk -l /dev/block/mmcblk0 | grep -i linux

busybox df -h

ls -l /system/mountosh

ls -l /system/mountosh.orig

cd /osh

cd /osh/etc

ls -l

End Code

I am suspecting that the script somehow applied the patch, and the FACLs and MACLs are still in place.

If things look good, then we will try and move tomoyo out of the way.
[Motorola Atrix 2] voodoomurphy:
files did copy, but then it all errored out. BTW I went back in and followed your instructions for the partitioning.

here's what I have from the code you asked for:

Chris-Murphys-MacBook-Pro:~ chrismurphy$ adb shell

shell@edison:/$ su

root@edison:/# /system/bin/fdisk -l /dev/block/mmcblk0 | grep -i linux

/dev/block/mmcblk0p2 33 192864 6170624 83 Linux

root@edison:/# busybox df -h

Filesystem Size Used Available Use% Mounted on

tmpfs 464.7M 76.0K 464.6M 0% /dev

tmpfs 464.7M 0 464.7M 0% /mnt/asec

tmpfs 464.7M 0 464.7M 0% /mnt/obb

/dev/block/system 477.5M 329.2M 148.3M 69% /system

/dev/block/userdata 4.5G 457.2M 4.1G 10% /data

/dev/block/cache 688.6M 16.7M 671.9M 2% /cache

/dev/block/pds 3.9M 1.1M 2.8M 28% /pds

/dev/block/preinstall

274.7M 23.5M 251.3M 9% /preinstall

/dev/block/vold/179:1

23.8G 4.0G 19.8G 17% /mnt/sdcard

/dev/block/vold/179:1

23.8G 4.0G 19.8G 17% /mnt/secure/asec

df: /mnt/sdcard/.android_secure: Invalid cross-device link

/mnt/sdcard 23.8G 4.0G 19.8G 17% /mnt/sdcard

/dev/block/dm-0 3.0M 1.8M 1.2M 60% /mnt/asec/com.ea.worms_na-1

root@edison:/# ls -l /system/mountosh

/system/mountosh: No such file or directory

root@edison:/# ls -l /system/mountosh.orig

/system/mountosh.orig: No such file or directory

root@edison:/# cd /osh

root@edison:/osh# cd /osh/etc

cd: can't cd to /osh/etc

root@edison:/osh# ls -l

root@edison:/osh# ls

root@edison:/osh#
[Motorola Atrix 2] jimbridgman:
Ok, I see one issue, I think I miss-typed on location in those commands...

Run this for me.

Code:

adb shell

su

ls -l /system/bin/mountosh

ls -l /system/bin/mountosh.orig

End Code

show that to me...

It looks like /osh just is not mounted or the mountosh script is missing... That is easy to fix, at worst case if it is not there, that I can get for you when I get my replacement today or tomorrow.
[Motorola Atrix 2] voodoomurphy:
crap. User error strikes again. No Worries Jim, I will wait patiently. I wish there was a way to restore the whole phone to stock including the OSH info. Resetting up my phone prefs is damned easy. lol
[Motorola Atrix 2] jimbridgman:
Wait I edited my post after you read it... I misread, re read.... oh well, here, twas my issue..

Ok, I see one issue, I think I miss-typed on location in those commands...

Run this for me.

Code:

adb shell

su

ls -l /system/bin/mountosh

ls -l /system/bin/mountosh.orig

End Code

show that to me...

It looks like /osh just is not mounted or the mountosh script is missing... That is easy to fix, at worst case if it is not there, that I can get for you when I get my replacement today or tomorrow.
[Motorola Atrix 2] voodoomurphy:
root@edison:/# ls -l /system/mountosh

/system/mountosh: No such file or directory

root@edison:/# ls -l /system/mountosh.orig

/system/mountosh.orig: No such file or directory

root@edison:/#

here's an LS of the directory:

root@edison:/# ls

cdrom

misc

pds

config

cache

sdcard-ext

sdcard

acct

tmp

preinstall

osh

mnt

vendor

d

etc

ueventd.rc

ueventd.mapphone_umts.rc

ueventd.mapphone_cdma.rc

ueventd.goldfish.rc

system

sys

sbin

proc

init_prep_keypad.sh

init.rc

init.mapphone_umts.rc

init.mapphone_cdma.rc

init.goldfish.rc

init

default.prop

data

bin

root

dev

root@edison:/#
[Motorola Atrix 2] jimbridgman:
I did the same thing.... take a look again.

it is....

Code:

adb shell

su

ls -l /system/bin/mountosh

ls -l /system/bin/mountosh.orig

End Code

I typed it wrong the first time....
[Motorola Atrix 2] voodoomurphy:
root@edison:/# ls -l /system/bin/mountosh

/system/bin/mountosh: No such file or directory

root@edison:/# ls -l /system/bin/mountosh.orig

/system/bin/mountosh.orig: No such file or directory

root@edison:/#
[Motorola Atrix 2] jimbridgman:
Ok, so then they really are not there... So, Sit tight I will get the original mountosh that they ship on my replacement, and get it uploaded for you, then you can run the script again... that is why all the errors happened, since /osh was not mounted, from the original ( do alot of tests for it to be there in my script), and it could not mount since the script that does this was not there, nor the one I hacked to mount our partition over the default one.