yashsingh1/xdaforums huggingface dataset:
[Sony Xperia P, U, Sola, Go] shakeador:
I was also worried about this, I use mainly my work Exchange Email rather than Gmail, and I had Gmail Widget but no one for the email app.

I tried replacing (with Root Explorer, you can rename the original apk to apk1 and copy this instead) the stock email app with the one from Xperia T, that you can find here:

http://xdaforums.com/showthread.php?t=1898425

It worked for my Xperia P, first I got a FC when launching the email app, but deleted all data from App (from App Manager) reconfigured and it worked nice, with a working email widget.
[Galaxy S III Q&A, Help & Troubleshooting] dj-suicide:
does the Samsung galaxy s2 mhl lead work on the s3? I was told that it doesn't but not sure. any one any thoughts?
[Galaxy S III Q&A, Help & Troubleshooting] Shug69:
Doesn't work. There is a new cable for the s3 though.
[Galaxy S III Q&A, Help & Troubleshooting] NZtechfreak:
As per the above post, doesn't work (Samsung will sell you adapter to make the old one work though, no idea when those will be available though).

Friendly reminder to search the forums too, you could have found this information very easily.
[Galaxy S III Q&A, Help & Troubleshooting] chrisd1a1:
thread closed as the question is answered
[Android Q&A, Help & Troubleshooting] asimons81:
Here's some more details for you folks... looks like the tab WILL have Tegra 3 and will be out in July (Australia first), if this rumor is true:

http://omgdroid.com/google-nexus-tablet-info-leaking-down-under/

What do you think? Is this a bad spot or will you be happy?
[Android Q&A, Help & Troubleshooting] -DarkKnight-:
I JUST BOUGHT AN ACER A100 lol

SOOO PISSED
[Android Q&A, Help & Troubleshooting] edowar:
Yes I will as like Linus mad to nvidia :D
[Android Q&A, Help & Troubleshooting] jstgabytz:
Tegra 3 it's ok, but 1280 x 800 it's not !
[Android Q&A, Help & Troubleshooting] jcroot003sh:
I live in Japan and after more than 6 months I have successfully and permanently rooted both my Sharp 003 SH Galapagos and the 005SH Galapagos (Softbank not Docomo). My next concern is how to SIM unlock. I have been reading the posts about hacking the nv_bin file. I have searched through all of the the files (Root FTP thank you!) but there was no such file. I am happy to send along any screenshots or data files if that helps.

Thanks in advance.

Search Sharp 003SH Root Success and Sharp 005SH Root success on Youtube for more info
[Android Q&A, Help & Troubleshooting] eternalardor:
Can't really help you. Don't know anything about it. But I would like to know how you ended up rooting this phone of ours.
[Android Q&A, Help & Troubleshooting] DominikB:
Its not a file on the filesystem. The sim locking in these phones is in the radio image; which can be accessed when you use the custom build kernel thats in the latest rootkit (I assume thats what you are using).

See the 2ch root/ROM thread for more details, but basically it is done through ADB, manually backing up the "_modem" partition; stripping the spare/ECC bytes and then extracting the radio OS using QualcommDumpAnalyser

I have managed to extract this image, but no idea where to go from there. None of the other device info seems to apply to this (HTC, Samsung, LG, any other Android that has had its sim-lock discovered in the radio)

Advice i got from the guys on 2ch: "Qualcomm's NAND code is neither difficult, nor unique, so if you know what you are looking for its not hard"
[Android Q&A, Help & Troubleshooting] jcroot003sh:
003SH 005SH Sim unlock

Thanks very much for giving me a new direction. I'll get started on it right away and let you know how it progresses.
[Android Q&A, Help & Troubleshooting] DominikB:
It just sucks that the guys who know how to unlock it are staying quiet, saying its "taboo"

FYI, stripping the Spare/ECC bytes can be done manually (i wrote a C program to do it), but there is an option in the RevSkills app to do it all for you - i recommend doing that.

Of course we face another issue once we find the actual unlock - recalculating the ECC bytes after making the change; the only way to access the radio is with raw data access.

P.S. hope you have warranty on your phones - this is very likely to brick at least one phone until we get it right

---------- Post added at 12:30 PM ---------- Previous post was at 12:24 PM ----------

In the spirit of open cooperation, here are the instructions i was given, translated and simplified

In ADB Shell, type su to get the # prompt, then:

cat /proc/mtd <Enter>

Confirm that you have the "_modem" partition available. If not, you need to reflash with the custom build kernel

Dump the image to file with the following command:

dump_image -r -D -F _modem /sdcard/backupimages/modem.img

Access this with anything as "raw dump" and all blocks will get read as ECC error, so definitely dont do this

ECC positioning is different to Linux, so take care

The following maps out how 512bytes of data and 10 bytes of ECC info are stored in a 528 byte block:

0000 - 01CF (0-463): Data

01D0 - 01D1 (464-465): Unused (0xff)

01D2 - 0201 (466-513): Data

0202 - 020B (514-523): ECC

020C - 020F (524-527): Unused (0xff)

Use RevSkills application to extract the data portions:

Menu⇒Calculators/Generators⇒Android MTD Nand remove Spare and ECC

Extract all of the Data only portions out of the raw dump, and then use QualcommDumpAnalyser to read it and split up the various parts. I did notice that i wasnt able to get the AMSS block out with QualcommDumpAnalyser - i copied that out manually by calculating the byte positions shown in QDA.
[Android Q&A, Help & Troubleshooting] jcroot003sh:
003SH bootloader key sequence?

Eternalardor,

I'd be happy to swap information. Perhaps you could shed some light on the question of the bootloader for the Sharp 003SH and 005SH? There seems to be no discernible key sequence (Power+home+Volume up etc.) to access the bootloader. I feel like I've tried them all. Can you tell me this critical piece of information?

Is a form of the USB Jig necessary to access it?

Looking forward to your response.
[Android Q&A, Help & Troubleshooting] jcroot003sh:
003SH SIM unlock

Dominik,

Here are the results of the original /proc/mtd (before rooting)

boot

cache

misc

recovery

ipl

system

persist

log

battlog

calllog

ldb

userdata

I don't see the _modem partition. Should I?

I have also included a screenshot of the results showing size. I have most of them backed up as .img files too.

FYI: .img backed up sizes. Perhaps this will help you to ponder where the _modem partition may have gone. Maybe it's been renamed?

boot 11,264KB

cache 3,072KB

misc 1,024KB

recovery 11,264KB

ipl 15,360KB

system 419,840KB

persist 30,720KB

ldb 45,056KB

userdata 405,120KB
[Android Q&A, Help & Troubleshooting] DominikB:
There is no bootloader menu AFAIK. If you install the custom kernel, you will have the option of a quasi-recovery mode, by pressing the home button between 7-12 seconds after the Galapagos logo is seen (or was that the Softbank logo)

Anyway, looking at the screenshots, it seems you do not have the custom kernel.

How did you achieve root on your phone?

To do this, you need to use the "003sh_005sh_dm009sh-rootkit" from at least 5/27 (recommend _0614); which is available on the 2ch forums. This includes 2 possible ways of achieving root:

1. A modified standard kernel (boot image), which, when flashed gives you regular root access

2. A custom compiled kernel, which has full root, a bunch of power profiles, and heaps more features (inc that quasi recovery), as well as access to the "_modem" image.

Judging from your youtube videos, you speak some Japanese, so the Japanese menus in the rootkit shouldnt be much trouble.

http://www1.axfc.net/uploader/Si/so/142435

This is what i used.

Go here for help/instructions http://anago.2ch.net/test/read.cgi/android/1337845757/

And dont even think about typing in English on there, or you will be ignored and/or told to go away
[Android Q&A, Help & Troubleshooting] jcroot003sh:
This all looks familiar. I have been using the root kit (5/27) to get where I am now - step by blessed step. It was pretty straight forward BUT I have never seen the option to write to the system partition. It is in all the instructions but the only option I have with respect to the system partition is to back it up. I'm confused as to why it doesn't seem to show up for me. I am using a Japanese machine so all the characters are displayed and I can read the instructions but I can't find help anywhere as to why I don't have that particular (and critical) option. I can see a lot of new and cool options in the 6/14 release. I'm excited and would like to get it installed.

I'll let you know how it goes. Thanks for your help .... keep it coming!
[Android Q&A, Help & Troubleshooting] jcroot003sh:
And another thing

Could you explain a little more about "having" the custom kernel? Using the root kit, I wrote to the Recovery partition then the Boot partition then rebooted from the Recovery partition and all seemed well. As I said above, I have never been able to write to the System partition despite it appearing in all the instructions. I suspect that is what is holding me back from the latest and greatest custom kernel. Still, I am enjoying all the same functionality that everyone else seems to be enjoying in root. What am I missing?
[Android Q&A, Help & Troubleshooting] DominikB:
Eep, you wrote to the boot partition before trying the recovery? Brave!

The steps should be:

Write image to recovery partition;

Then reboot to recovery partition (from the menu) and confirm it all works without errors.

Then write image to boot partition

And then turn off the phone, and reboot (the last part is only my instructions - you could just select "reboot to boot partition" from the menu)

You are doing this on your 005SH right? It should be the same for the 003SH, but i only have the 005SH. In the rootkit there is 2 options when you say "burn custom image":

1 カスタムビルドrootedカーネル（リカバリーキット機能付き）

2 S4080 標準rootedカーネル（簡易リカバリー機能付き）

Q 中止してメインメニューへ戻る

You must do the first one, the CUSTOM rooted kernel, to get any of the really cool features. The second option is only if you just want root access for a particular app or something. AFAIK the second option doesnt even disable MIYABI LSM, which prevents you from mounting the system dir as R/W

But either way, writing to the System dir is not important for what we are doing. You need the Custom kernel, which gives you access to the "_modem"

Edit, i just noticed in your screenshots above, you didnt even get root in ADB shell?

Type

ADB Shell<Enter>

Then type

su<enter>

The cursor should change to a #, this means root. You may get a prompt on the phone from Superuser asking you to give root access to "shell". Once you have this try the cat /proc/mtd again
[Android Q&A, Help & Troubleshooting] zjg1727:
jcroot003sh,

can you tell me how to root 003sh?
[Android Q&A, Help & Troubleshooting] DominikB:
Use the link i provided in my previous post

http://xdaforums.com/showpost.php?p=27989085&postcount=8

You can use a translator if you dont understand Japanese, but the general instructions are in the post above yours

I translated it for a friend, but that is at work, so wont be able to put it up until monday.
[Android Q&A, Help & Troubleshooting] zjg1727:
Thank you for your replying. I will wait for your translated version. You are really a good person.
[Android Q&A, Help & Troubleshooting] jcroot003sh:
Progress

I have successfully found and dumped the "_modem" image. Exactly as you stated - forgot the "su" command in ADB. Thanks. The next problem is editing out the code. I am way above my head here so I will do some research before bugging you for a step-by-step for that.

Also, the bootloader worked. I didn't realize how to do it until I read the notes in the 6/14 release. I successfully put a previously dead phone back on it's feet EXACTLY to the point of my current phone simply by backing up and then restoring partitions through the bootloader. Very slick and easy.

Will get to work. I'll be in contact soon with my progress on the SIM unlock.
[Android Q&A, Help & Troubleshooting] DominikB:
I have spent a bit of time looking at it, it certainly isnt easy (Certainly isnt a "lock=yes" section). I assume the actual locking portion is encrypted/compressed/or just compiled, because it would be too easy otherwise (be happy to be proven wrong). For starters, i cannot even find my IMEI number in the dump file... I think that this dump only includes the radio code, not the NV RAM which contains the IMEI and SIM Lock status. If that is the case then the solution should be to change the portion of the radio code that queries the NV RAM, so that it doesnt care if the SIM lock is supposed to be applied.

Extracting the spare/ECC bits out should be done with the RevSkills app; extracting the relevant portions, that is a bit of a cludge; QualcommDumpAnalyser can show the start/end positions, but doesnt extract the AMSS part (AFAIK thats where the code will be). You need to use a hex editor to cut that part out manually... And i am still not 100% sure what the block size is on this NAND.

Good luck!

And if there *are* any experienced hackers out there willing to help out, i can offer some monetary help (as will a few of my fellow Japanese smartphone owning friends) as this will be valuable for not just these 2 phones (there is an army of 007SH owners waiting on this unlock)
[Android Q&A, Help & Troubleshooting] jcroot003sh:
Shall we give the 007/009 a shot?

I can see mountains of the 007SH on the auction (mostly pink). Perhaps I should pick one up and take it for a spin. I am happy to try to do something to help out for all the help I am receiving.

Or perhaps the 009SH?

How hard would it be to crack the 007? The 009SH looks like it is supported in the latest release kit.

Thoughts?
[Android Q&A, Help & Troubleshooting] DominikB:
Currently, the 003/005SH are going to be the easiest, because they have the custom kernel which allows access to the "_modem" image. To do it on the 007SH we need to build a custom kernel (compiled from the sources available on the ktai-dev site), and add the modem access code (this is in the src directory of the rootkit). Not impossible, but i dont have a Linux machine to compile the sources.

However i think that the code will be fairly universal. Once we find it on the 005SH we will know what we are looking for on the 007SH as well. That will make many people happy

Anyway, my 005SH is under warranty/anshin plan so i dont mind if it gets bricked (especially now that we can take nand backups).

First things first though - examining the 005SH modem image. Does anyone know whether the NAND is a 16kb or 128kb block size? Or is it something completely different?

P.S. The DM009SH is just the Disney Mobile version of the 003SH
[Android Q&A, Help & Troubleshooting] jcroot003sh:
Linux machine no problem

I have a Linux server running 24/7 so compiling the kernel is easy. Don't let that be the holdup. I'll keep working on the 003SH _modem image.
[Android Q&A, Help & Troubleshooting] zjg1727:
DominikB,

I can't open this site [anago.2ch.net/test/read.cgi/smartphone/1319287551/] on channel2 for free. This site had been moved to the past-log storehouse. So.... I even can't look at Japanese version for rooting 003sh. It is very helpful if you can show me the steps for rooting 003sh.
[Android Q&A, Help & Troubleshooting] jcroot003sh:
.bin files extracted ?!?!?!

Ok, I went through the steps as described and have a collection of bin files all neatly labelled. However, it is next to impossible to read them in text. I also extracted as both 16K and 128K size as there seems to be some confusion there.

Unfortunately there seems to be bits of recognizable text then large areas of gobbly gook. I have attached a screenshot of the sim_secure extracts for both the 16K and 128K sizes for the 40800 partition (I also have the 41000 partition).

Am I doing something wrong? How can we read any text from these binaries? I don't even know if they are the complete files.

When I tried translating them from binary to text I got an error "binaries must be divisible by 8".

If we set the correct size will the text magically appear?

Any ideas?
[Android Q&A, Help & Troubleshooting] DominikB:
I think you are looking at this the wrong way. This will NOT be text readable. This wont just stand out as a line that says "change this to unlock the phone." Its exactly the same as opening an EXE file and trying to work out the code behind it... There are some text strings that are readable, but they are the display strings/messages etc. The code itself is compiled or compressed, and possibly even encrypted - its never going to be readable by regular people

I am 99.9% that the next part of this journey requires someone that can hack/decode this binary stuff you are looking at. I am fine with reading source code, programming etc, but i dont know assembly/machine code. Reverse engineering tutorials are unfortunately quite scarce.

zjg... the old thread is here:

http://logsoku.com/thread/anago.2ch.net/smartphone/1319287551/

But all of the instructions you need are in the rootkit which i linked to in my previous post. The readme is an ANSI (not unicode) textfile which includes a tutorial. However, since it is ANSI, you cannot view it in Notepad (notepad opens files in your PC locale, which doesnt let you see the Japanese characters). Open it in your browser, and you should be able to see it, and copy/paste text to use with online translation tools.

---------- Post added at 03:33 AM ---------- Previous post was at 03:12 AM ----------

What you have is the Qualcomm REX OS dump (fairly certain): http://read.pudn.com/downloads155/doc/686659/Rex/80-24897-1.pdf

Some info on how it is reverse engineered

http://events.ccc.de/congress/2011/Fahrplan/attachments/2022_11-ccc-qcombbdbg.pdf

http://events.ccc.de/congress/2011/Fahrplan/events/4735.en.html

Still not sure how to work out where the part is that it looks for the SIM lock info.

Remember, it is also a very specific sim lock in that it also rejects Softbank prepaid sims - even though they should contain the right network info
[Android Q&A, Help & Troubleshooting] DominikB:
Here are the translations for 003sh_005sh_dm009sh-rootkit_20120614

You will need to download the original rootkit (http://www1.axfc.net/uploader/Si/so/142435 - Press the grey button on the page), and then replace the files included in the attached archive.

The readme_tokyo_dom includes a tutorial; It is fairly simple stuff, but obviously i take NO responsibility for the damage of your phone, be it from your mistake, or even if i stuffed up a translation (unlikely).

Edit: xda-dev's upload service is buggered, or maybe there are rules on it. I put my translations on the same upload service as the rootkit:

http://www1.axfc.net/uploader/Sc/so/359255

(same as above, press the grey button to enable download)
[Android Q&A, Help & Troubleshooting] zjg1727:
DominikB,

Thank you very much for your translated version.

But i can't download it from your attached file.

It responds error-Not Found(404).
[Android Q&A, Help & Troubleshooting] jcroot003sh:
FYI Softbank will not unlock any phones

I visited my local Softbank shop yesterday to see if the "they will unlock your phone for a fee" rumour was true or not. No luck at Softbank. She looked at me like I was an alien .... which I am .....

It is rumoured Docomo will do it for Docomo phones/customers. I can`t check that one.
[Android Q&A, Help & Troubleshooting] DominikB:
No need to verify; i can tell you. Everything released after some time last year can be unlocked by Docomo for 3150 yen. Dont even need to be a subscriber, just bring the phone to them, bring your aliencard/J-drivers license and 3150 yen and they will do it.

Softbank staff are virtually useless. Often you have to show them on their website for them to know what they can and cant do. For example, these phones come default with a no-sim restriction that means you cant use the phone at all without a SIM card. But it can be removed, if the phone has been fully paid off (note that does NOT unlock the phone for other carriers, only to use the phone without a sim). The lock is called "kinou seigen" (機能制限) and they are supposed to do it for free; IF you are a softbank customer, and IF the phone is paid off. But of course half dont know about it until they call the service center, who has to fax through the instructions.

But anyway, I think we need to get the help of some experienced hackers here. Any ideas?

zjg1727: I uploaded it elsewhere, please see the edited post. Something wrong with the xda-dev upload service sorry
[Android Q&A, Help & Troubleshooting] cheeseus:
Rootkit download link

Here's the download link to the 14.06.2012 version of the rootkit:

http://sharp.cheeseus.org/index.php?page=Applications&id=47
[Android Q&A, Help & Troubleshooting] SuperSZ:
Hi guys. I know you're working trying to find the sim unlock, and I really appreciate it. But, IF in your research you happen to discover first how to unlock that "kinou seigen" lock; it would be great if you can post it here how you did it :)
[Android Q&A, Help & Troubleshooting] DominikB:
I wonder if that has any connection with the SIM lock?

Its been a while since i have seen a phone with that "features lock" enabled. If you had root on your 007SH, i would ask you to take a backup of your system to work out what is different between that and mine. I think it might just be phone.apk, however it is the SAME message screen as when you put an invalid SIM in... Hmmmm
[Android Q&A, Help & Troubleshooting] SuperSZ:
I still haven't rooted because I saw no purpose on doing it yet (I can't use my 007SH till the software sim unlock comes out). But if it'll help you in your research, I'll do it. The thing is that I want to take my time to do it (because it will be my first root) and I wanna read carefully every instruction in order to not brick my phone; and I'm studying right now, so I think I'll do it next week.

Just to be 100% sure; these instructions have every single step, right? http://www.howardforums.com/showthr...k-007SH-Unlock-FOUND!?p=14833772#post14833772
[Android Q&A, Help & Troubleshooting] jcroot003sh:
Docomo says "No!"

Went to Docomo today to see about the unlocking service for my Softbank 003SH. They will only unlock Docomo phones. Staff said they have a rule to NOT unlock other companies' phones.

Anyone able to confirm or deny at your local Docomo?

Hopefully we can solve this problem ourselves and save the hassle.
[Android Q&A, Help & Troubleshooting] cheeseus:
I don't understand why you even did that. Think of a SoftBank Sharp and a Docomo Sharp as two different brands - Docomo don't have the capability to unlock Softbank phones, it's not like they can but there's a rule saying "No, you can't do i."
[Android Q&A, Help & Troubleshooting] SuperSZ:
I've already posted it in another forum, but maybe it will be more useful here. Basicly there are 3 ways to unlock a phone: by software, by hypersim, and by some kind of box (I don't know the technical name for it). About the last one, there are hundreds of unlocking boxes but the ONLY box so far that IS SAID to support the 003SH/005SH chipset is the Riff Box. There's no official confirmation (I just got this that I found)

cheeseus, I don't know if they do this in japan, but here we have numeric portability (from wikipedia: "Mobile number portability (MNP) enables mobile telephone users to retain their mobile telephone numbers when changing from one mobile network operator to another." ). IF that also exists in Japan, it would be logical that if someone who has a Softbank phone wanna change to Docomo and want to retain his number, that Docomo can unlock his phone.
[Android Q&A, Help & Troubleshooting] zjg1727:
DominikB

Thank you very much.

My 003sh rooted successfully.