yashsingh1/xdaforums huggingface dataset:
[Sharp Aquos Crystal] :
[MENTION=5314976]uberlaggydarwin[/MENTION], I already knew getting TWRP to work for the device wouldn't be an issue but awesome to see that you have it running. Doesn't do me any good though lol. Can't write to the recovery so I haven't bothered with making a device tree. Once the day becomes a reality I will build TWRP for my wife. Meanwhile, not wasting my time on this device.

Edit: and good speech from [MENTION=591147]Entropy512[/MENTION] in his previous comment.
[Sharp Aquos Crystal] parkerlreed:
http://xdaforums.com/aquos-crystal/general/sim-card-holder-spring-t3165630

https://www.reddit.com/r/aquos_crystal/comments/3c4am9/well_****/cuh9lay

It may be a minority but it's definitely happening to some people. I didn't even drop my phone. Just picked it up one morning and had no 4G.
[Sharp Aquos Crystal] QuickNET Tech:
I haven't had sim slot issues, however, it is a known issue with the aquos crystal that the quote on quote "earpiece" just stops working. Mine just so happens to be one of the units affected by this defect. I can no longer make phone calls without headphones that have a mic.

Like others have said, steer clear of this phone like the plague!
[Sharp Aquos Crystal] x000x:
thats a shame. it is such a unique looking device, that is what i find interesting about it.
[Sharp Aquos Crystal] DaemeonZane:
That's a major part of why I bought it. Necessity had a small part to play, mainly because I have unlimited everything, and I'm a truck driver who needs his entertainment.

Still, based on the research, which i should have done beforehand, (Damn those impulse buys) the phone just doesn't have enough going for it unless you never want anything other than a stock experience, which it delivers to some degree of satisfaction minus a few minor glitches, battery, and SIM issues.

Sent from a potato using Kung-Fu
[Sharp Aquos Crystal] uberlaggydarwin:
I advise you don't upgrade to S7232 as some bugs are patched if you want a exploitable device.. Looking into solutions for this!
[Sharp Aquos Crystal] QuickNET Tech:
So it was a good idea for me to not take the latest update?
[Sharp Aquos Crystal] Alldayismokedro:
SIM card slot

So I did post a thread of how to fix the SIM card issue I haven't had any problems with it since I did what I did to it will post picture pictures for more detail I guess but its pretty self explanatory it is sticker you pull down from the top EastEnders little tab it you pry open pretty much you've been back and you'll see when you stick your SIM card into the slot if a little bar comes down if you push that far up and bend it that way I send cards fits perfectly and I haven't had a problem with it since I did that 2 months ago
[Sharp Aquos Crystal] uberlaggydarwin:
Depends on if you like a relatively insecure phone.

I don't but I'm (of course) biased...

I'd recommend hold off if you like custom ROM'S..
[Sharp Aquos Crystal] :
I thought you wasn't releasing anything?
[Sharp Aquos Crystal] uberlaggydarwin:
I probably won't but I'm giving general advice if any other researcher wants to do this. :) - new firmware as a patched vulnerability which is frustrating to bypass.

I won't comment if you'd rather I didn't then :)

Edit: Please remember that you aren't the only group of people that want unlocked phones so you aren't my ideal customer market..
[Sharp Aquos Crystal] :
No, no, you are fine. Just wanted some clarification is all. Continue on.
[Sharp Aquos Crystal] daet1234:
Additional problems from newer phones

I have recently acquired a small amount of these phones and have been attempting to use the info on this thread to temp root. I can push the files, but they will not execute. Checking the software number: S8216. Maybe the exploit has been patched. These are new phones from a trustworthy source. May acquire additional units soon.

--------

Sorry, apparently the software numbers are not ordinal:

support.sprint.com/support/article/Find-and-update-the-software-version-on-your-Sharp-AQUOS-Crystal/WServiceAdvisory_542_GKB76042-dvc8270008prd?_escaped_fragment_=/#!/

(As found in another thread on XDA)
[Sharp Aquos Crystal] compuguy1088:
Honestly I understand where you are comming from. Better to save them to use for a higher end device than this (no offence taken).

---------- Post added at 01:56 PM ---------- Previous post was at 01:53 PM ----------

I honestly just bought it as a emergency/glovebox phone and because the screen was neat. Honestly its better these days just to get a Sprint/Boost Moto E (2nd Gen) and BL unlock that.
[Sharp Aquos Crystal] enki7:
Is this a scheme or real deal? (or was a real deal, as the license code link is dead now)

(I cant post links, cause I am new here... but it is "nullsharpwp (dot) com" )
[Sharp Aquos Crystal] uberlaggydarwin:
Nullsharpwp is legit

[MENTION=5535815]enki7[/MENTION]

well yeah it is legit, that was my tool but it must have been leaked early :( -.

it uses a licencing system because this tool will be used by larger companies (a more feature rich version that can be mass used) but will be opened up to the public too. it includes a server side component so I can stop abuse of the tool (malware) and quickly pull down parts if incase a sharp update patches critical parts, the other reason for doing a server side component is to make reverse engineering harder (sharp patching the bug or others pirating my work) and I can compensate myself (cheap but licences will be paid for in $, likely via PayPal or similar service) for the amount of work done/time spent.

The (internet connection) server side process is only used once to check licence then you can safely delete the app.

Dodgy repair shops across the world can find tools like this very useful and they will just pirate/redistribute/rebrand my work if I was to just release a binary.

XDA bounties never pay out fully and are incredibly insignificant to the amount of work & time and money that goes into a release like this. just the software (ida ,hopper + my own tools and scripts) for reversing costs 3000$+ to develop the exploit and I spent a lot of time working on this device and even more learning in the past..

and no, my tool will not be open source or free. please don't ask. Go reverse sharp biotloaders yourself, make your own free tool if you really want to spend the time.
[Sharp Aquos Crystal] enki7:
Well, I am cool paying for the hard work of someone else :)

How much an unlocking/root/everything will cost?

Any problem with any carrier ? CDMA phones can be unlocked to gsm?

Thanks.
[Sharp Aquos Crystal] uberlaggydarwin:
I'm not sure, I guess I might do a pay what you want (between $5 and 15$ ) for root/BL unlock/wp-off. This is of course toggle-able so you can tick the options you want (for the same price).

It's possible in theory to enable GSM but I'm not sure on the legality for me to enable it. It will depend on your country.

I'm not going to offer radio unlocking to anybody with the consumer version as my carrier clients need this feature themselves (CDMA porting) - (the main motivation to get this wp broken was clients).
[Sharp Aquos Crystal] :
This is why I simply stick with OEM's that support unlocking the bootloader lol. Don't want nor don't need any hassle inbetween. I definitely don't intend to feed their pockets with my hard earn cash because they are against freelance developers. Would be relatively pleasant to see Google shut down Sharp, but hey, one can only wish huh. Meanwhile, picking me up a Ham 2 for the wife this week - already bought. So good luck to all you guys/gals future endeavors. Cheers.
[Sharp Aquos Crystal] enki7:
Great!

Well, I have some 306sh, cause I thought I would unlock them to use here, in Brazil.

In Brazil, there is no problem about locked cellphones, we can unlock as we want. In fact, there are no more locked cellphones around... and the 306sh doesnt even is sold here.

So, please, let me know when I can pay for the unblocking, please :) If you want a test subject, even paying, I am your man :D
[Sharp Aquos Crystal] DarknesSh:
Try kmod exploit once ur root to remount system part..
[Sharp Aquos Crystal] QuickNET Tech:
please please please
[Sharp Aquos Crystal] soudara:
why you are not working on 302,303 and 304sh is the better hardward and very low coast now

i have 305sh unlocked and i just resell it because this phone very limited hardware no want to lose my time with this old spec phone but all other 30x sh serie had very good hardware spec i can make a good donation for root it

thank you
[Sharp Aquos Crystal] enki7:
What you mean?

Can you point some guide or direction? :D

Please!
[Sharp Aquos Crystal] tewilove:
Someone can dump kernel for me?

I have a test program which tries to remove write protection. But kernel must be patched first. As someone mentioned my device is bricked.
[Sharp Aquos Crystal] wangxiantaoye:
how to dump?
[Sharp Aquos Crystal] tewilove:
with this temp root, dd boot partition and pull it out.
[Sharp Aquos Crystal] tewilove:
i dont remember exactly. ??? = you must fill it according to your device.

# cd /dev/block/platform/???/by-name

# dd if=boot of=/data/local/tmp/boot.img

then you can pull it out with

adb pull /data/local/tmp/boot.img

don't forget paste your rom build version along with boot dump.
[Sharp Aquos Crystal] wangxiantaoye:
on page5
[Sharp Aquos Crystal] Xtensensed:
Someone already dumped it, yes on page 5. Did you patch the kernel successfully?, If so I could test it out
[Sharp Aquos Crystal] tewilove:
Somebody knows what is the exactly build version?

Tell me this two please.

adb shell getprop ro.product.model

adb shell getprop ro.build.display.id

I need your boot.img and matching version, otherwise the kernel patch is incorrect, which may cause reboot and has no effect.
[Sharp Aquos Crystal] Xtensensed:
Model: 306SH

id: KVT49L

boot image

http://xdaforums.com/attachment.php?attachmentid=3364217&d=1434399016
[Sharp Aquos Crystal] ybachtiar:
How to flash this phone ? i used 306SH Boost Mobile
[Sharp Aquos Crystal] Xtensensed:
The root file has no permission,so it says permission denied, set it to 777 with shell and it works but it doesn't get root it says segmentation fault
[Sharp Aquos Crystal] enki7:
It is funny, with v3, i cant even get temp root.

Tried v2 again, with some different results from the 1st time. More codes appearing... and device rebooted after 0x4500000000 .

Weird.

2nd try, it stopped and rebooted in 0x4700000000.

p.s.: funny thing... while messing a lot with QPST and changing the bands/mode in my 360sh, suddenly, my WCDMA chip appeared ALIVE in the cellphone, clearly saying "CLARO BR" and finding signal... then the cellphone rebooted. And I dont know what I did to get this :)
[Sharp Aquos Crystal] QuickNET Tech:
Try setting it to 755, it works for me. Did you take the update? I have not so that may be why temp root still works for me.

---------- Post added at 04:36 AM ---------- Previous post was at 04:23 AM ----------

Are these commands to be entered into the temp root terminal window? How do we use the file "wpoff"? I assume that we type "/data/local/tmp/wpoff" into the temp root terminal window.

I am not on the newest firmware, do you need someone who is on the newest version or can I do it?
[Sharp Aquos Crystal] Xtensensed:
The boot.img from page 27 is from version KVT49L, 4.4.2 the newest firmware doesn't make significant changes, just bug fixes within the rom, I don't think that you need the latest firmware to make wpoff work. And yes it seems that the new root file v3 doesn't give root, the v2 gave root for the session ok.
[Sharp Aquos Crystal] loonbg:
[MENTION=1713470]tewilove[/MENTION] withyour last release but when i run /root then at end my phone reboot

p.p i test again and now give me segmentation fault ... strange
[Sharp Aquos Crystal] tewilove:
Well. I'm going to find another 306sh.
[Sharp Aquos Crystal] tewilove:
SHARP blocks talk to mmc by ioctl at kernel level. I need your kernel and version to exactly patch the kernel to make wpoff work.

To make most of you happy I may need every version...
[Sharp Aquos Crystal] captainescape:
what about 402sh? Does it work?:confused:
[Sharp Aquos Crystal] QuickNET Tech:
How do we do it? How do we know the exact dd command?
[Sharp Aquos Crystal] Xtensensed:
here is the boot img and getprop. The version of wpoff from v3 in page 1 doesn't work with my phone, I still can't write anything. So try with my boot img and prop.
[Sharp Aquos Crystal] QuickNET Tech:
Does everyone else have rw access to the external sd card?

I don't remember having rw access to the external sd card when I bought this phone. I am not sure if my attempt to enable rw access to the external sd card using temp root was successful or if Sharp has enabled rw access to the external sd card in an update and I was unaware. I am starting to doubt that I have enabled rw access to the external sd card due to the power on write protection placed on /system.
[Sharp Aquos Crystal] :
You will always have read and write access to the external sdcard. Doesn't matter what android phone you have. So not sure what you are currently referring to.
[Sharp Aquos Crystal] QuickNET Tech:
No, with kitkat google restricted 3rd party apps from writing to the external sd card. This means my file explorer couldn't make changes to files on the external sd card like moving files into folders or moving files from the internal card to the external card or even delete files on the external sd card.
[Sharp Aquos Crystal] :
My wife doesn't use this phone anymore but she still has it on her. I can confirm that writing apps to the external is limited, but I am able to move files around. However, now that you mention this, that would explain why her photos kept getting stored onto her internal sd storage even after I assumed I had fixed this. Although, in my humble opinion, kitkat was horribly designed. Would pick 4.3 over 4.4 any day of the week. Grateful that they released Lollipop when they did and now Marshmallow.

---------- Post added at 05:12 PM ---------- Previous post was at 05:07 PM ----------

Something you can do and should work without root access, is go to your internal sd and grab the applications folder and place it on your external sd storage with the same path and it will work from your external sd. Reboot may be necessary. Just thought of this trick when considering the restrictions being applied.

---------- Post added at 05:23 PM ---------- Previous post was at 05:12 PM ----------

1. Launch your favorite file manager with enabled root access rights.

You can use any app you prefer which can run elevated on your device.

For example, the 'Root Explorer' app or 'Total Commander' or 'File Manager' from CyanogenMod,

or ES File Explorer will do.

2. Navigate to the following file:

/system/etc/permissions/platform.xml

3. Find android.permission.WRITE_EXTERNAL_STORAGE and android.permission.WRITE_MEDIA_STORAGE lines. These are XML sections. You need to make them look exactly like the strings below:

<permission name="android.permission.WRITE_EXTERNAL_STORAGE" >

<group gid="sdcard_r" />

<group gid="sdcard_rw" />

<group gid="media_rw" />

</permission>

<permission name="android.permission.WRITE_MEDIA_STORAGE" >

<group gid="sdcard_rw" />

<group gid="media_rw" />

</permission>

Save the platform.xml file. It’s necessary to set the file permissions to 644 (rw-/r–/r–) before mobile restarting. Now reboot your Android device.

This didn't take long to figure out lol.
[Sharp Aquos Crystal] tewilove:
WP is defeated! Starting another thread soon.
[Sharp Aquos Crystal] uberlaggydarwin:
Congrats.
[Sharp Aquos Crystal] :
Looks like I will be able to build TWRP after all. [MENTION=5314976]uberlaggydarwin[/MENTION], I am not aware if you have any plans on releasing a custom recovery or not, but since my wife does not use this phone anymore our daughter uses it to play minecraft and few other things so I might get around to making a release once I do what I got to do on the wife's ex phone to make it a little more kid friendly. If you are going to release one then let me know so I don't stack up on you and cause confusions on here as some will begin asking which one to use lol.
[Sharp Aquos Crystal] bobasik:
How unlock 305sh? Please HELP.
[Sharp Aquos Crystal] QuickNET Tech:
+1 except my phone freezes and I have to force it off.
[Sharp Aquos Crystal] enki7:
Have you tried with v4?
[Sharp Aquos Crystal] QuickNET Tech:
I cannot pull kernel.dump, the command prompt says "remote object '/data/local/tmp/kernel.dump' does not exist". The file does not show up in the folder with my adb files.
[Sharp Aquos Crystal] loonbg:
what i seen is that your version is "Currently support" bcs is version "KVT49L"
[Sharp Aquos Crystal] Xtensensed:
Hi, Please note that despite having the same build id the kernel version for the device may not be the same. The kernel patch that tewilove is currently using is KVT49L From SW300 I believe. If you have a different firmware version you need to dump your kernel and post it here for wpoff to work properly. Once you find the appropriate kernel patch after, wpoff would work properly.
[Sharp Aquos Crystal] enki7:
Yep, I think my firmware is the last one, updated in July/2015.

But i didnt tested yet.

If it fails, I will try to dump it and post here.
[Sharp Aquos Crystal] Xtensensed:
Hi Here is the Kernel dump for SW version: SA300
[Sharp Aquos Crystal] enki7:
My kernel is 3.4.0

Build Number = KVT49L

01

SW version= S7232

So it is NOT the version worked by tewilove, it is the updated one.

When I try to tempo root, I see this:

[IMG="trying to root"]http://i.imgur.com/tqkDUh9.jpg?1[/IMG]

So, no temp root, then no WPOFF.

How can I dump my kernel?
[Sharp Aquos Crystal] irishobo:
+1 on this kernel, build, and SW version.
[Sharp Aquos Crystal] Xtensensed:
Make sure that execute all commands properly and have all files on your phone, looks like your temp root is missing some files, put all files on the phone and then chmod 777 to root, after, see that you run root again with -q. Then it would work. Use adb pull command within the temp root, don't exit and then run. Then paste your kernel dump here.
[Sharp Aquos Crystal] enki7:
Nope, stil without temp root.

I got temp root when I had another 260sh, without the update, so I know how it is...

I tried with 777, the same happened, no temp root.

[IMG="fixed"]http://i.imgur.com/AL0iCpT.jpg[/IMG]

Probably they fixed this exploit in the July update.

So I cant get the Dump file without the temp root?
[Sharp Aquos Crystal] tichs:
make sure you use the latest version, and reboot your phone

---------- Post added at 02:56 AM ---------- Previous post was at 02:50 AM ----------

I am sucessfully fully rooted with the SW SA300 Version from xtensensed.
[Sharp Aquos Crystal] enki7:
It is exactly because I am not SW SA 300.

I am S7232 :D
[Sharp Aquos Crystal] frank.floripa:
I have the same problem

My kernel is 3.4.0

Build Number = KVT49L01

SW version= S4081

shell@SG306SH:/ $ chmod 755 /data/local/tmp/root

chmod 755 /data/local/tmp/root

shell@SG306SH:/ $ /data/local/tmp/root

/data/local/tmp/root

+ prepare

kconfig = 00000003

kflag = 00000000

+ spray

***************************************************************************

********************

+ gather poison

0xb5c00000

0xb4c00000

0xb3c00000

0xb2c00000

0xb1c00000

0xb0c00000

0xafc00000

0xaec00000

0xadc00000

0xacc00000

0xabc00000

0xaac00000

0xa9c00000

0xa8c00000

0xa7c00000

0xa6c00000

0xa5c00000

0xa4c00000

sk_stamp offset = 958e88

skc_reuse offset = 0xa5558d4f

skc_prot offset = 0xa5558d5c

+ trigger

+ gooood

+ 15 partition(s) unprotected

+ 13 MIYABI function(s) patched

+ 2/2 kernel patch(es) applied

shell@SG306SH:/ # /data/local/tmp/wpoff --unprotect-all

/data/local/tmp/wpoff --unprotect-all

/system/bin/sh: /data/local/tmp/wpoff: can't execute: Permission denied

126|shell@SG306SH:/ # exit
[Sharp Aquos Crystal] tichs:
This is very simple, you need to set permissions 0777 to wpoff too!.
[Sharp Aquos Crystal] wangxiantaoye:
s4081 failed

View attachment 3475202
[Sharp Aquos Crystal] tewilove:
I'll make another one working with all known versions later. Patient.
[Sharp Aquos Crystal] enki7:
Really thanks, man!

I owe you some GOOD KARMA :)
[Sharp Aquos Crystal] frank.floripa:
you need to set permissions 0777 to wpoff

adb shell

$ chmod 777 /data/local/tmp/wpoff

$ /data/local/tmp/wpoff --unprotect-all
[Sharp Aquos Crystal] irishobo:
Build Number: KVT49L

SW: S7232

Tried version 4.2. Still unable to gain temporary root #. Just seeing $ after ran.

D:\>adb push root /data/local/tmp

7107 KB/s (227332 bytes in 0.031s)

D:\>adb push consumer /data/local/tmp

6457 KB/s (206540 bytes in 0.031s)

D:\>adb push busybox /data/local/tmp

3300 KB/s (1109128 bytes in 0.328s)

D:\>adb push wpoff /data/local/tmp

1104 KB/s (17672 bytes in 0.015s)

D:\>adb shell

shell@SG306SH:/ $ chmod 755 /data/local/tmp/root

chmod 755 /data/local/tmp/root

shell@SG306SH:/ $ chmod 755 /data/local/tmp/wpoff

chmod 755 /data/local/tmp/wpoff

shell@SG306SH:/ $ /data/local/tmp/root

/data/local/tmp/root

+ prepare

kconfig = 00000003

kflag = 00000000

+ spray

******************************************************

********************

- fixed

1|shell@SG306SH:/ $ /data/local/tmp/wpoff --unprotect-

/data/local/tmp/wpoff --unprotect-all

255|shell@SG306SH:/ $ /data/local/tmp/wpoff --dump

/data/local/tmp/wpoff --dump

255|shell@SG306SH:/ $ chmod 777 /data/local/tmp/wpoff

chmod 777 /data/local/tmp/wpoff

shell@SG306SH:/ $ /data/local/tmp/wpoff --unprotect-al

/data/local/tmp/wpoff --unprotect-all

255|shell@SG306SH:/ $ exit

exit

D:\>adb shell getprop ro.build.display.id

KVT49L

I would dump for you but cannot gain temp root to do so.
[Sharp Aquos Crystal] enki7:
As my fellow above with the same SW version than me, the result is the same too...

Cant get temp root, just $ with 4.2 .
[Sharp Aquos Crystal] wangxiantaoye:
it is worked for me with 4.1 on s4801

D:\MacBook_Air\Desktop\手机\手机驱动\306SH_v4.1>adb shell

shell@SG306SH:/ $ /data/local/tmp/root

/data/local/tmp/root

+ prepare

kconfig = 00000003

kflag = 00000000

+ spray

****************************************************************************************************

+ gather poison

0xb5cfd000

0xb4cfd000

sk_stamp offset = 786508

skc_reuse offset = 0xb54833cf

skc_prot offset = 0xb54833dc

+ trigger

+ gooood

+ 15 partition(s) unprotected

+ 13 MIYABI function(s) patched

+ 2/2 kernel patch(es) applied

shell@SG306SH:/ # /data/local/tmp/wpoff --unprotect-all

/data/local/tmp/wpoff --unprotect-all

shell@SG306SH:/ # /data/local/tmp/wpoff --dump

/data/local/tmp/wpoff --dump

CARD SIZE: 00e90000

WPGR SIZE: 00004000

00000000: 0000000000000000

00080000: 0000000000000000

00100000: 0000000000000000

00180000: 0000000000000000

00200000: 0000000000000000

00280000: 0000000000000000

00300000: 0000000000000000

00380000: 0000000000000000

00400000: 0000000000000000

00480000: 0000000000000000

00500000: 0000000000000000

00580000: 0000000000000000

00600000: 0000000000000000

00680000: 0000000000000000

00700000: 0000000000000000

00780000: 0000000000000000

00800000: 0000000000000000

00880000: 0000000000000000

00900000: 0000000000000000

00980000: 0000000000000000

00a00000: 0000000000000000

00a80000: 0000000000000000

00b00000: 0000000000000000

00b80000: 0000000000000000

00c00000: 0000000000000000

00c80000: 0000000000000000

00d00000: 0000000000000000

00d80000: 0000000000000000

00e00000: 0000000000000000

00e80000: 0000000000000000

shell@SG306SH:/ #
[Sharp Aquos Crystal] soudara:
it's possible for 303sh mini ?
[Sharp Aquos Crystal] wangxiantaoye:
I cant get supertsu work on my temp rooted 306sh.How can you got full root?Supersu display 'not install su '
[Sharp Aquos Crystal] :
Installing the SuperSU application won't suffice. The necessary files such as su itself must be placed on your device in the correct path so that SuperSU can not only find it but use it for root privileges such as updating the su binary and other things as well. No SU and SuperSU apk is useless.
[Sharp Aquos Crystal] QuickNET Tech:
Temp root v4.2 still doesn't work for me on the newest software version.