yashsingh1/xdaforums huggingface dataset:
[Sharp Aquos Crystal] QuickNET Tech:
So I assume, from the quoted text, you have tried mounting /system as rw while in the temp root shell session?
[Sharp Aquos Crystal] TechInMD:
Yes. I tried using the mount command both directly from the root shell prompt plus I tried using busybox to mount also. There seem to be slight variations between them. Also, not sure if it is relevant but I attempted it both through adb and in terminal on the device. I can get to the root prompt but not further.

Sent from my 306SH
[Sharp Aquos Crystal] davidave:
lets move on guys.. hehe. .

besides models released from May 2015 onwards are now subject to sim unlock / free the phone..

I also gave up already on this phone since Aquos Crystal 2 is there now and subject to sim unlock after 180 days in Japan. :)

Its just that its a pain the ass that some greedy people in HK, China and Russia where their unlock method to the phones are still "secret" jeez
[Sharp Aquos Crystal] onroP89:
if ur good a something, never do it for free.

And its down to 250€ for a unlocked phone, thats fair. If you compare the the price to the 306SH, ya than the 305SH looks expensive.
[Sharp Aquos Crystal] :
It's cool when someone comes around and can provide assistance with a device. Kudos to them, but to further progress development sometimes mean sources are needed to dig deeper. Lets go back to TWRP for example, many years ago TWRP was not open source. In fact due to this very reason TWRP almost fell off the map and became non existent. At one point you could say that the TWRP project took a long "vacation". Next thing we knew as a community, Dees_Troy was back along with some soldiers to help him out and TWRP was released to the public. Due to it's release as open source TWRP took off and development is booming.

Just painting a picture here :)
[Sharp Aquos Crystal] DaemeonZane:
In the case of [MENTION=1713470]tewilove[/MENTION], I doubt sincerely that he'll release anything until he has a complete fix. Which means that nothing's coming, guys.

I say wait until you can afford to switch to something Samsung or HTC and forget this piece of crap ever existed. I've exhausted every penetration avenue I know of, including a few I didn't know about until I researched them, and I'm no closer than I was when I used temp root to dump files.
[Sharp Aquos Crystal] onroP89:
Or just use the Phone as Phone, i dont really need root to use a phone.

Its just nice to have but not needed. At least for me and 90% of the phone users around the World.

Dont get me wrong, i would root all my phones if possible, but if its not possible im ok with it.
[Sharp Aquos Crystal] loonbg:
too bad bcs have ppl like me that they can't use phone as phone bcs in Europe we don't have cdma... the only way that I can try is to mod os or add other custom firmware who is modded to enable gsm module.. but for now is one dream...
[Sharp Aquos Crystal] onroP89:
Im form Germany, just buy the Japan Version, 230€ and you have ur Phone, carrier unlocked!

There are 2 Version of the Phone

305SH = Japan GMS, Version locked to Softbank

306SH = US CDMA Version, not even clear if the phone has a GSM Modul
[Sharp Aquos Crystal] powercamg4:
Thank god there is some life left in this device. I though i was going to be a iPhone user forever.
[Sharp Aquos Crystal] DaemeonZane:
I used to be a Level 2 at AppleCare. Take it from me, Apple is evil, and it sucks.
[Sharp Aquos Crystal] powercamg4:
Im sure they are just like Google and Microsoft, its not even possible to contact someone there.

If this device doesn't get perm root at least i can use my Windows Phone sense now its possible to run android on it
[Sharp Aquos Crystal] DaemeonZane:
The likelihood of this device getting a permanent root, at this point, is even less than your odds at winning a multi-million dollar powerball jackpot. Most of the folks that are smart enough to make it happen gave up, and [MENTION=1713470]tewilove[/MENTION] has been incommunicado since his rant at myself and [MENTION=6367467]SHM[/MENTION] a couple weeks back.

The truth is, Sharp's security model is even more locked down than what we were deploying when iOS first hit the market. The double layer of security, both kernel level and at the hardware level, make this damn thing almost impossible to get at using any of the standard hacks that one would normally employ. The only reason temp root works is because [MENTION=1713470]tewilove[/MENTION] was able to disable the Miyabi protections and allow us to write to a temp directory. The issue is that it's not installed into the place where it's needed to have apps like SuperUser and so on get at it, and once you reboot the device it's deleted along with the rest of the temp files in the directory.

As much as it pains me to do so, I believe that [MENTION=1713470]tewilove[/MENTION] had a point when he said that the OTA updates must be attacked for it to work, but he hasn't been willing to share his methods since he reported almost 95% completion in decrypting said OTA. So, my friend, my advice to you is to stick to Android, but move to an HTC, or perhaps a Samsung device, as the development of ROMs, and rooting, is much easier and much more prevalent than it is with Sharp devices. Just a thought.

---------- Post added at 08:46 AM ---------- Previous post was at 08:39 AM ----------

Truth be told, the device looks pretty, but it loses service programming too easily. I either lose MMS every other reboot, or I lose LTE. It hasn't been consistent since I got the damn thing, and that includes the first one, whose internal battery (which you cannot remove) decided to crap out on me two weeks after I bought it brand new. Had I been in the position to buy anything else, I would have. Sharp doesn't support development on their devices, and they refuse to answer any questions regarding the security (even when I posed as a member of the press and told them I was doing a write-up on the device). Without dedicated and time consuming hacking, this phone will likely remain unrooted and uncustomized, at least in the foreseeable future.
[Sharp Aquos Crystal] salmanaman:
I just received a new software update message on my 306sh. Anyone else? Should I update?
[Sharp Aquos Crystal] salmanaman:
Here's the pic.
[Sharp Aquos Crystal] DaemeonZane:
I can confirm that I have the same update. I'm going to see what I can do to intercept the package, instead of installing it, but I don't see how it could hurt. I'm trying to locate a changelog on it now.
[Sharp Aquos Crystal] salmanaman:
Update applied. Still on 4.4.2 however, the phone seems a lot snappier.

I don't see any differences other than that.
[Sharp Aquos Crystal] salmanaman:
Here's the phone info after applying the update.
[Sharp Aquos Crystal] Anili9082:
Amazing work...
[Sharp Aquos Crystal] DaemeonZane:
I'll download in a bit, then, see what I can do with the update. I'll check in after it's done.

I'm still setting up a Linux environment so I can get a better crack at intercepting the data.
[Sharp Aquos Crystal] :
Hopefully it fixes a lot of bugs. My wife's phone has so many issues you would think the Rom being used on the device was merely a "Preview".
[Sharp Aquos Crystal] wangxiantaoye:
It could be fix the cvn-2015-3825
[Sharp Aquos Crystal] DaemeonZane:
Not that the exploit is doing us any good with phone that's got more protection on it than an Army Black Project.
[Sharp Aquos Crystal] :
Off topic but curious if you have ever come across something like this before on a device:

So here it is, lets say you flash a custom recovery to the recovery partition, then boot to that custom recovery and all is well with the universe, but you reboot and later go back to find that it's gone. Somehow the stock recovery is there. Universe is confused.

Here is the kicker... You dump the recovery from the recovery partition and unpack it to find that it is in fact the custom recovery o.O !

Yet, the stock recovery is showing up?

*head explodes*

New universe is born:

How would the stock recovery boot up when a recovery dump reveals that it's the custom recovery written to the partition lol?

Oh so sneaky.
[Sharp Aquos Crystal] loonbg:
tewilove post in first page his work on fota update.. if some one is interested and have skill at this can seen it.

I make fast look at his code and it look like fota decrypt and encrypt is done but some parts like flash cursom fota look to be not ready yet.. For progress and what need to be done [MENTION=1713470]tewilove[/MENTION] can answer if he want :)
[Sharp Aquos Crystal] DaemeonZane:
That's weird, but not unheard of. Some stock ROM's still force boot the stock recovery. I've seen it before, and usually use fastboot to push the recovery, then use adb to boot it. Usually that works, unless you're on a crappy device like ours that simply refuses to allow fastboot access, even though the device clearly supports fastboot.

Here's a snippet on it for another device where they were having this issue: http://android.stackexchange.com/a/110632

---------- Post added at 03:19 PM ---------- Previous post was at 03:11 PM ----------

I see [MENTION=1713470]tewilove[/MENTION] has updated his FOTA cracking pastebin post today. He's made some great progress, I just wish he would share his information. "DON'T ASK FOR UPDATES" is kind of like saying "I'm only doing this for me, screw the rest of the community."

Maybe that's just me. I realize the guy's probably deluged by idiots asking "wheres is teh rootz" but Jesus, man, some sort of progress reports would cut that down to nothing, almost.
[Sharp Aquos Crystal] TechInMD:
Hopefully they addressed the issue outlined in CVE-2015-1474 related to the GraphicsBufferOverflow issue affecting libui.so. I have a corrected version of it but without root I cannot fix it myself. But, this IS sharp we're taking about so that is wishful thinking.

Sent from my non-rooted 306SH
[Sharp Aquos Crystal] irishobo:
The update has fixed my MMS problem. I have tested several times.
[Sharp Aquos Crystal] TechInMD:
I think I might hold off on this update in hopes that an OTA hack will surface. I'm pretty sure that is unlikely with all the head-butting. When did this community turn into people working against each other?

Sent from my non-rooted 306SH
[Sharp Aquos Crystal] DaemeonZane:
Well, after trying that Msl crap and taking the update, my phone can't get any voice or data programming. I attempted manual programming and it won't take it. I'm sending it off and getting yet another (this replacement makes my third in just a month), in the hopes that somehow, some way, a root method will be figured out. I highly, highly doubt it, but if Donald Trump can emerge a frontrunner in a Presidential campaign, anything is possible. Stay tuned, folks, for all is not yet lost.

On a side note, I understand that the awesome [MENTION=2376614]jcase[/MENTION] was, at one time, willing to work on this device and quit. Anyone know why? If you're listening, JCase, I'd be willing to throw together funding assistance for your help in working out the eMMC issue.
[Sharp Aquos Crystal] jcase:
i have one

we have something for it

but not complete

life is busy

dont ask for etas, if ever

i suck at poems
[Sharp Aquos Crystal] DaemeonZane:
Didn't intend it to be an ETA request, [MENTION=2376614]jcase[/MENTION]. I was under the impression you quit. Before I send this device back, since I took the update, is there anything you'd like from it? I uploaded the aboot, recovery. IMG, and such to this thread, but anything any of us can do to help, I'm sure we as a community wouldn't mind doing it. Have fun and good luck.
[Sharp Aquos Crystal] jcase:
npoe, i bought one
[Sharp Aquos Crystal] DaemeonZane:
Awesome. Well, I'm just glad you didn't give up on us, bro. I've seen your work all over XDA, and I know your Android Kung-Fu is strong. Thanks again for staying with us.
[Sharp Aquos Crystal] compuguy1088:
I apologize that I never got around to shipping my Aquos (I've been out of town, and life has gotten more hectic for me). I'm still willing to help/test anything out if needed.
[Sharp Aquos Crystal] DaemeonZane:
I just off the phone with Sprint, and apparently the Aquos is on backorder. Since this phone has been such a painfully frustrating pain in my ass, I'm switching to the G3, and writing off the Sharp.

Good luck to all, I hope [MENTION=1713470]tewilove[/MENTION] and [MENTION=2376614]jcase[/MENTION] help get you all sorted out. It's been interesting, but having a phone without a removable battery that can't keep service programming worth a damn, not so much lol
[Sharp Aquos Crystal] TechInMD:
Backorder... that means that they are pumping out these aesthetically-pleasing pieces of garbage.

Sent from my non-rooted 306SH
[Sharp Aquos Crystal] QuickNET Tech:
I am thinking of switching to the G3 when I get a little extra cash. I am curious, do you know if it is rootable on the newest firmware version?
[Sharp Aquos Crystal] :
It has TWRP so odds are it is.
[Sharp Aquos Crystal] uberlaggydarwin:
eh, having fun?

[MENTION=2376614]jcase[/MENTION] is a incredibly smart guy and a friend of mine but he's not the only person around.

wp can be beat, it's hard

it's not a impossible feat

maybe not a public release

bootloader exploits will do

or permanent root too

or custom roms too

no eta, or no betas

don't be fools

the tool may not be public.

but it's possible. don't lose hope!

I probably won't publicly release this tool (desharpwp) to the general public because bugs are valuable and i spent a lot of time on this, this is just to say there are vulnerabilities like all systems...

firmware dumps and rhyming help welcome though!

ordered more devices yesterday to my home in Australia.
[Sharp Aquos Crystal] QuickNET Tech:
???

The link...

The picture...

MY EMOTIONS...

OMG ?????
[Sharp Aquos Crystal] PUNK:
wow..

no hopes,no disppointments.
[Sharp Aquos Crystal] :
[MENTION=5314976]uberlaggydarwin[/MENTION], I have seen your work in the past and I know you know your stuff, but I am confused about your post. When you say you aren't going to publicly release the program do you mean the source itself or the program compiled to get the job done for deeper access into the device or both? Better to resolve any confusion now before people get antsy in here. Would be great if I could finally gain access to my wife's phone. Have every intention of building her own personal TWRP recovery so she can hack away at it once I am able to write to the recovery partition.
[Sharp Aquos Crystal] loonbg:
I don't know what he mean.. but I don't want to belive that no one from this community want to help us.. also I don't seen reason to keep exploit/program for himself.. source yes but program(compiled)?!?!

We all users who love this phone are waiting from long time (me around 7 months) for root or unlocking bootloader... nothing bad for other developers but for now only [MENTION=1713470]tewilove[/MENTION]

is help us and give us information and share hes work at public..

Also I'm not here to cry how bad are other developers who work on this device.. they have choice to do what they want.
[Sharp Aquos Crystal] :
[MENTION=1013528]loonbg[/MENTION], at this point I am not concerned who does what and how they do it. I just want to build TWRP so my wife can safely begin modifying her device to her liking. With the device as is, it's garbage. She already has a long to do list but she knows from me that you never make changes to a Rom until you can safely and appropriately return back to the last known working state. This is where TWRP will come in handy for her. Just need proper access and hacking away at her bootloader won't come from me since she doesn't have a backup device should anything go wrong and I don't wish to spend the money on a new phone. So for those willing, have at it. Just let me know when it's available so I can "lunch" the device tree inside Omni and get her the custom recovery she needs.
[Sharp Aquos Crystal] DaemeonZane:
[MENTION=6120563]Quickdraw996[/MENTION]: Stump no longer works but the lg g3 forum has an assload of stuff. Unfortunately i didn't hear the part about me getting the G3 Vigor. The Vigor is not supported the same as the regular g3. Oh well.
[Sharp Aquos Crystal] uberlaggydarwin:
I may not release any of it, i have an vested interest in breaking write protections but not for the same reasons as you. I like reversing bootloaders. I bought this device 2 weeks ago in the USA when I visited.. I have a bit to do to make it harder to reverse engineer. I simply don't know if my client will do a public release or not. It's not my choice and really I'm not super fussed either way.

Even if I was to release a binary, my bugs would be quickly ripped apart and reversed. Maybe I'll let the client do the release of the tool if they wish to because I don't want to spoil it before I get my ROI.

It was mainly to say that you should never give up 100%, good things can always come. Try to remember that secure devices are good!. It was more of "it's possible" post.

A lot of developers who have this kind of skills don't want to spend time on devices like this, bounties on XDA are so ridiculously low and unreliable that it's not worth the time investment, it's also the time/money investment to find vulnerabilities that are exploitable against modern devices.

ARM bootloader exploitation research can be expensive as one move can be fatal.
[Sharp Aquos Crystal] DaemeonZane:
Bro, all due respect, as the old adage goes, no system is secure, given enough time and resources. Skill helps, too, but you get the idea. The truth is, though, few people these days have the skill to come up with original hacks. Most would rather piggyback off of other people's work.

We've been trying to find something on this device that would disable the power on write protection, and while most have been hacking away at the FOTA updates, I've been doing what I do best: researching. Specifically , I've been reading whitepapers from some of the folks that create eMMC hardware and software. I've come to the conclusion that attacking the data housed in the eMMC directly is going to be a bit of a hassle, to say the least, but I've been trying to get the time to go over the kernel source line by line, to see if perhaps it can be disabled in some way. I'm loving the sheer amount of data out there but the lack of known bugs is disturbing. Still, as long as there's a Sharp Aquos uncracked in my household I'll keep working.
[Sharp Aquos Crystal] uberlaggydarwin:
I didn't say anything was secure in the first place.

Clue: Kernel hacking won't help you here when this protection is loaded before the kernel loads.

How I did it: I used 3 (private) 0day's chained together for an early stage bootloader and compromise the chain. Be careful these are easy to brick. I'm not going to give any more details.
[Sharp Aquos Crystal] :
Bonfire anyone? Or does one more person with false hope wish to chime in and stir up the starving zombies lol.

[MENTION=4728879]DaemeonZane[/MENTION], goodluck with your future endeavors. He is right, bootloader exploitation can and will be very costly which is why I do not full with it too much myself. I don't have the funds :-p ha!
[Sharp Aquos Crystal] Entropy512:
You won't find a solution in the kernel. Once a region is write protected after power-up, that region will stay write-protected.

There's no way you're going to change this without advanced attacks like power-glitching, or booting the device with JTAG (but modern devices have THAT protected by crypto too, or disabled in production), or desoldering the eMMC and mucking with it.

The only solution is to compromise the system before it gets write-protected - e.g. the bootloader. Bootloaders are getting harder and harder to crack. OEMs learn from their mistakes and don't screw up the next time. Look at the history of the Samsung GS3 and Note 2 on Verizon - Since Samsung had zilch as far as bootloader locking experienced, they royally ****ed up on the GS3 (I've heard from some sources this may have been intentional as Verizon forced the locking). The device did not signature-verify recovery at all, which made it pretty damn easy to compromise. In the case of the Note2 - they had a few exploits AND they also used the same hardware signing keys for secure and non-secure devices (oooops, catastrophic key management strategy ****up there)

Seriously, if you want THIS badly to run custom firmware on a device, WHY did you buy it? Vote with your wallet, buy a device that has an official OEM-supported unlock process. OEMs won't provide this if people keep on ignoring the lack of this important feature when purchasing devices. By purchasing this device, you said with your wallet that you are OK with a locked bootloader that cannot officially be unlocked.

Further edit: The earlier on in the boot chain you are messing, the higher a chance that you'll encounter a hard penalty for your actions. Even if a manufacturer hasn't explicitly put in any hard penalties into their design, bootloader corruption is for all practical purposes is a hard penalty, especially on newer Qualcomms where JTAG is getting locked down.
[Sharp Aquos Crystal] DaemeonZane:
Which is why i got rid of mine and got something i could root and mod in less than five minutes.

It was a waste if time and money, but it's all over now, for me. I think most everyone who bought the Sharp thought they'd get somewhere with it because other devices from them had been rooted, or are close to it. I had no way of finding out anything when i bought mine, and I instantly regretted it once i was able to get online and find out about it. This is why i no longer have the Aquos Crystal. It sucks balls, and is a waste of dev time for folks whose skills would be better applied to devices that are actually workable.

Sent from a potato using Kung-Fu
[Sharp Aquos Crystal] uberlaggydarwin:
Thanks [MENTION=591147]Entropy512[/MENTION] for that much more eloquent reply than I could have given.

Completely agree with the comments of supporting unlock able devices!

however: tewilove has bricked his device, i'm in contact with him. I'm also in contact with jcase often. I'd love to see some public research though from someone who is not a old player in the game :)

SHM will be happy to know that this works on the device too!
[Sharp Aquos Crystal] loonbg:
wht about ota I seen that tewilove hve sone poo

progress at this ?
[Sharp Aquos Crystal] DaemeonZane:
[MENTION=1713470]tewilove[/MENTION] made some progress on the FOTA crack, and from what I can tell, he's still working. He's been pretty closed mouth about his work, however, but I have to soften some of my earlier remarks about him and his work by saying that, based on the code that I've seen on his pastebin and whatnot that he's really kickass at what he does.

I would expect to see him releasing what he has sooner rather than later, but as he does not accept ETA requests there's no real way of knowing when that will be. JCase is also still working as well, and having seen his work on other devices, I doubt he'll give up working on it until he's got something. Either way, root is coming, but it may take a lot longer than anyone who owns an Aquos Crystal wants to wait :p

Be patient. Be hopeful. Be helpful and try not to be as much of an ass as I've been :P
[Sharp Aquos Crystal] parkerlreed:
Also will probably be just long enough for more SIM slots to fail... :( I might move back to the Aquos if it gets root/bootloader/custom ROMs but it's only 3G now so I've just been using the Moto G.
[Sharp Aquos Crystal] x000x:
these things have faulty sim slots? is it a widespread issue? b/c i was thinking of buying one
[Sharp Aquos Crystal] DaemeonZane:
[MENTION=4581984]x000x[/MENTION] Don't waste your time. It's a crap device with crap support and very little going for it. Buy a Samsung or an LG.
[Sharp Aquos Crystal] loonbg:
Best answer ... if this is real that tewilove device is briked i don't expect soon some one to find a way to

remove eMMC write protection.. and with time this device becomes older and older

Support is very bad bcs onwers of this device are not so many.. but device at all is not so bad it look inovative and for now i don't have problems with him on hardware parts .. on software is allot limited without unlocked bootloader and we can't move apps to microsd..