yashsingh1/xdaforums huggingface dataset:
[Sharp Aquos Crystal] turkbot:
So you need a clean back up to restore?
[Sharp Aquos Crystal] irsuv:
Actually, I need to root for the first time
[Sharp Aquos Crystal] turkbot:
Download the app and install
[Sharp Aquos Crystal] QuickNET Tech:
Wait... You were able to write to system? I have it mounted as rw, but can't write to it.
[Sharp Aquos Crystal] :
I haven't downloaded it. But I saw the attachment earlier.

---------- Post added at 02:57 AM ---------- Previous post was at 02:55 AM ----------

Working on updating TWRP for another device since it's getting 5.1 soon. Currently preoccupied.
[Sharp Aquos Crystal] wangxiantaoye:
no,its tmp too,and just cp just once,it renew after reboot.

View attachment 3364533
[Sharp Aquos Crystal] QuickNET Tech:
So your saying that you were able to push the files but they're deleted after a reboot?
[Sharp Aquos Crystal] wangxiantaoye:
yes
[Sharp Aquos Crystal] QuickNET Tech:
Thanks for the clarification. No offense meant, but the english was a little jumbled and I am not the best at trying to figure out that kind of stuff. Are you using Google translate? From what I know, it is quite poor in translating english to asain dialects and vis versa.
[Sharp Aquos Crystal] wangxiantaoye:
nono?i come from China?and not good at ?but i can get your mean?
[Sharp Aquos Crystal] TechInMD:
Sorry I never got back ty yesterday. I have not had a chance to attempt to modify any files in system. I have the latest SuperSU and I see that there are binaries for several different architectures available. From what I could gather online this Snapdragon 400 is armv7. Could someone confirm or deny this? If it is the latter could you provide clarification?

I also saw another tutorial for a different device where someone used dd to write a TWRP.img to .../by-name/recovery and I am wondering if this could work here. This 306SH is my primary device and I am afraid of either bricking it, or risk not being able to perform a factory reset if things don't pan out.

Sent from my 306SH
[Sharp Aquos Crystal] :
Yes, it will work. As long as you have root access to overwrite the partition.

dd if=/sdcard/boot.img of=/path/to/boot_partition

* replace /path/to/boot_partition with the actual correct path.

Much easier with this method then having to use a computer. Especially if a computer isn't near by.
[Sharp Aquos Crystal] TechInMD:
Another thing that I have discovered with the rw system is you can perform 1 write to the partition before it starts giving a read only error again. And yes that change reverts once rebooted.

EXAMPLE: I remounted system as rw and copied su to /system/bin. At that point I was not able to copy another file to the partition or chmod the su binary without getting ro error. Could not remount the system until reboot, which at that point the su binary was gone and I was back to square one.

But, I ran temp root, copied su to /data/local/tmp/ and performed:

chmod 555 su
./su

This changed the prompt from:

u0_a109@SG306SH:/ #
to
root@SG306SH:/ #

So it appears to be executing su without issue but I am still unable to install su into /system/bin/ and invoke su from that location.

---------- Post added at 01:16 PM ---------- Previous post was at 01:12 PM ----------

[MENTION=6367467]SHM[/MENTION]... do you know which version of TWRP would be acceptable for this device?
[Sharp Aquos Crystal] QuickNET Tech:
Shouldn't matter. The newest version should work fine as long as it is adapted to our phone.
[Sharp Aquos Crystal] :
The latest version of TWRP but TWRP has not been built for this device. A dev will need to build a device tree, download the Omnirom source accordingly, then make a build and write the TWRP recovery to the recovery partition. With TWRP implemented then it would open up way more doors. I don't own this device though, my wife does and she isn't wanting to hand it over so I can test out this root method and detemine if building TWRP is worth it or not. Let alone if installing TWRP once built is currently feasible.

---------- Post added at 07:05 PM ---------- Previous post was at 07:03 PM ----------

If I had access to the device I could easily make my determinations and also build TWRP.
[Sharp Aquos Crystal] QuickNET Tech:
[MENTION=2614663]shabbypenguin[/MENTION] didn't you say your wife has this phone?
[Sharp Aquos Crystal] kentrey:
Would I be able to install and run a Wi-Fi tether app if I did this?
[Sharp Aquos Crystal] :
Try and see what happens.
[Sharp Aquos Crystal] loonbg:
it look like this example:

dd if=openrecovery-twrp-2.5.0.2-jfltexx.img of=/dev/block/mmcblk0p21

where we will know who is boot_partition for this device ..?

Also i find that when i enter in our TWRP it show this "android system recovery <3e> KVT49L" its like this from OnePlus One

and here is Img https://www.androidfilehost.com/?fid=23487008491963229
[Sharp Aquos Crystal] Codingale:
I'm sorry I don't quite follow what's going on in this thread quite but is there anything I can do to assist in getting a universal root method?

Here's the build I have.

Linux version 3.4.0 (nbproj@TGX33001) (gcc version 4.7 (GCC) ) #2 SMP PREEMPT Wed Apr 8 02:23:04 JST 2015

Device screen:

Due to the new user limitation I must attach it instead of embedding it nicely.​

I really want to have a universal root for this device so everyone can get it rooted. I can provide info and test things assuming there is a way to revert it back if a issue should arise such as bricking the device (which I've never done and don't plan on doing)
[Sharp Aquos Crystal] loonbg:
thanks for update tewilove

when i try to flash it with other recovery.img (dd if=/data/local/tmp/recovery.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery) phone is restart at end and when i enter in recovery it is same as old...

maybe me doing something wrong .. or write protection block .?
[Sharp Aquos Crystal] :
If you are pulling your recovery image and then writing back your recovery image then of course it would still be the same (its the same recovery image).

If you are attempting to write over your partition with a different recovery then I would highly suggest you stop now.

You cannot just grab any recovery image and install it. The image must be designed for your device.

However, you could possibly find a TWRP built for another device based on the same SoC and port it. But I will say do not do it if you have no idea what you are doing in that area.

With that said, I suggest people stop attempting to modify their device until a custom recovery is properly made up for this device and so that the user can use that custom recovery to make a proper backup and restore with that backup should a user modify something and it throws them in either a boot loop or soft brick.

Last thing a user will want is to screw something up and not be able to properly fix it manually because they do not have the know how and learn that a custom recovery isn't currently available to make the process easier on a more automatic playing field.

Be smart about this people.
[Sharp Aquos Crystal] loonbg:
what about write protection ? If we make custom recovery based on this from device we can flash it

with dd but after restart all changes will disappear right ? if yes this mean for now flash img recovery is not solution ..
[Sharp Aquos Crystal] :
If you users are able to write back to the partitions such as boot then maybe attempt to create a "superboot".img

In lamen terms, you unpack the boot.img and add supersu into the ramdisk. Make some changes to some files such as init.rc. Then if modified properly, repack the ramdisk, build the modified boot.img, and write it to your boot partition.

This trick is old school but back in the day it would allow you to gain root properly the moment you boot up.

Not sure if anyone here has the know how on doing something like this but if they do, I would recommend trying it out. The method still works today. Just nobody really uses it anymore lol.

---------- Post added at 11:12 PM ---------- Previous post was at 11:01 PM ----------

If you have a custom recovery then write protection isn't necessarily an issue if such changes are being made while within the recovery.

But, this is Sharp we are talking about, hence why I do not own this device. I do not spend money on companies that show no support for development. They can go out of business for all I care and it would not bother me.

Personal opinion, I normally stick with HTC devices. Everyone has their preferences though.
[Sharp Aquos Crystal] gogoduck:
Keep up with your development! Great work!
[Sharp Aquos Crystal] tewilove:
GUYS PLZ TAKE A LOOK AT ANOTHER POST BY ME TALKING ABOUT SHARP IN THIS BOARD. You seem to be not understanding what power on write protection is described in eMMC docs.

Any attempt to modify system/boot/recovery is useless after booting into Android.
[Sharp Aquos Crystal] QuickNET Tech:
Thanks for the heads up, it saves us time and effort we can put elsewhere.

EDIT: What else do we know is protected by power on write protection?
[Sharp Aquos Crystal] tewilove:
We should find a way to set FOTA flag since after OTA Android is doing odex. At this point system is rw.
[Sharp Aquos Crystal] colordancer:
Exactely! I'm doing the reversing job of FOTA process including communications with fota_daemon socket. But currently I'm stuck with analyzing the IPL file as I'm not familiar with its structure. So if you could give me some IPL/bootloader references, that'll be very appreciated.
[Sharp Aquos Crystal] tewilove:
I'm not familiar with it, too.
[Sharp Aquos Crystal] wangxiantaoye:
FOTA is encrypted by redbend, I have the first two OTA packet.
[Sharp Aquos Crystal] :
That's actually pretty dang smart. I never thought to do that in the past.
[Sharp Aquos Crystal] colordancer:
Whether it's encrypted or not is decided by configuration. But i don't think that's the point. Even if the downloaded FOTA file is encrypted, it'll be decrypted while writing to the disk. I believe the key point is how the written IPL file is loaded/run by cpu.
[Sharp Aquos Crystal] wangxiantaoye:
That's right. But original recovery will have an decrypted progras.
[Sharp Aquos Crystal] tewilove:
SHARP recovery seems to only handle master clear. Take SH-01G as example, fota is likely being handled in sbl1.
[Sharp Aquos Crystal] wangxiantaoye:
I have an idea that the virtual FOTA server. As follows, find a WLAN with a laptop, a laptop router, and then open the notebook to open the IIS service, modify the host file to the FOTA address host to the local 127.0.0.1. Then put the root package in the IIS root, but there is a problem with the signature problem.. Another way is to analyze the first two times log OTA, fictional OTA updates such as s4801 to s4802, but or above, signature verification issues need to be resolved.

---------- Post added at 02:36 PM ---------- Previous post was at 02:12 PM ----------

??????????fota?????????????WLAN???????????????????iis?????host???fota??host???127.0.0.1????root???iis?*????????????*????????????????ota?log???ota????s4801?s4802???????????*???????????
[Sharp Aquos Crystal] tewilove:
Impossible.
[Sharp Aquos Crystal] wangxiantaoye:
Jack_famous said he have a 3rd party program to get into bootloader, in development forum.

---------- Post added at 11:46 PM ---------- Previous post was at 11:35 PM ----------

We can analyze the extracted recovery or fotaclient.apk to find the way to enter the fastboot or decrypt the ota file.
[Sharp Aquos Crystal] colordancer:
I've already finished the analysis of FOTA update process and I know how to hijack the fota update package and bypass the signature verification. The left job for me is to analyze the fota file and add superuser into it. AFAIK, the fota update file is written to IPL patitition, which is a part of MSM bootloader. But I don't know the structure of IPL so that I'm not able to analyze it.
[Sharp Aquos Crystal] tewilove:
Which bootloader? sbl1 or aboot?

For this device aboot has no fastboot facility and even more, when power on WP is set is uncertain(WIP), if it's inside sbl1 then goodbye aboot.

And why attacking OTA? I believe it's AESed with fixed key&IV inside FOTA or somewhere else. But modern OTA procedure is fairly robust. It's definitely signed and have signature checked in the actual OTA handler(maybe in sbl1). Bypassing is not that easy.
[Sharp Aquos Crystal] tewilove:
Can you share some details with me? What you found is somewhat beyond my knowlege.

My thought is simple. When FOTA finishes it sets one or more flags to indicate the following procedure(maybe sbl1, tz, aboot) that power on WP is temporary disabled. So just tamper this flag.
[Sharp Aquos Crystal] wangxiantaoye:
I don't know, and you can contact with jack_famous
[Sharp Aquos Crystal] wangxiantaoye:
have you connect with jack _famous
[Sharp Aquos Crystal] wangxiantaoye:
hi，tewilove，look into this forum threat by jack_famous, http://xdaforums.com/aquos-crystal/development/sharp-aquos-crystal-306sh-root-rom-t3120442
[Sharp Aquos Crystal] tewilove:
I don't see anything but only stories. I think it's a fake.
[Sharp Aquos Crystal] wangxiantaoye:
Is there a v3 to disable miyabi and so on?
[Sharp Aquos Crystal] tewilove:
Hello, can somebody grab an OTA for me? Cos mine is up to date.

The procedure is, run this temp root to obtain a root shell, then execute OTA but not to reboot immediately.

After downloading OTA package should be at /fota/update_package.

Use

# cat /fota/update_package > /data/local/tmp/update_package

or

# cp /fota/update_package /data/local/tmp

to dump the OTA.

When it's done pull it out via adb pull /data/local/tmp/update_package.

Thanks.
[Sharp Aquos Crystal] TechInMD:
tewilove,

I have already updated to the latest software version. If I do a factory reset from recovery will it revert to the original software version... or will it still be the current software version just in a factory state?

Sent from my 306SH
[Sharp Aquos Crystal] Jesseferd:
It will stay with the updated software

---------- Post added at 08:45 PM ---------- Previous post was at 08:44 PM ----------

On my volt, we originally had to delete the laf partition, in order to expose the locked bootloader
[Sharp Aquos Crystal] tewilove:
I think it will stay the original version if you delete /fota/update_package before rebooting. But not 100% sure.
[Sharp Aquos Crystal] davidave:
so this only applies to 306SH?

I have the 305SH though temp root is working.

I'm currently thinking of a way to find the modem partition in order to lift the sim lock. any help will be appreciated tewriove
[Sharp Aquos Crystal] PUNK:
Here we go...

SA300 update package...
[Sharp Aquos Crystal] colordancer:
I have that file and you can ping me in Weibo [MENTION=5283190]colordancer[/MENTION]

As I said previously, I'm currently stuck at the point of analyzing the bootloader. So if you're interested, we might work together for rooting this mobile.
[Sharp Aquos Crystal] tewilove:
Hi, I've reversed the FOTA process, about 50% or so.

FOTA update seems to be very insecure since there appears to be no DIGITAL SIGNATURE.

I grabbed an OTA file from another SHARP device and managed to decrypt 3/4 of it. And it seems that only 2/4 of it is used in recovery(FOTA).

The left thing is to figure out the format of RedBend update and write an encryption function to pack it.
[Sharp Aquos Crystal] tewilove:
Thanks.
[Sharp Aquos Crystal] tewilove:
Decrypted part of the file.

The result looks promising, but I need to learn more about RedBend OTA package format.

Or someone know this here?

Take this if you are interested.

https://drive.google.com/file/d/0B5QYBzdG6RuybU16WmJCakFyZms/view?usp=sharing

FOTA central index.

https://drive.google.com/file/d/0B5QYBzdG6RuyOFU1YjhfaWFFdmM/view?usp=sharing
[Sharp Aquos Crystal] TechInMD:
Modem partition should be located at /dev/block/platform/msm_sdcc.1/by-name/modem

Not sure if that is the true location but I was able to perform a dd dump of the partition using that location. I am currently looking for an efficient way to manipulate the images and re-write the partitions using dd but it is not very straight forward as the different partitions use different file systems and so forth. I was able to extract the image of the system partition... now I just need to repack it and write back to the device. It surely is easier said than done.

Sent from my 306SH
[Sharp Aquos Crystal] tewilove:
Modem PBL loads and authenticates MBA, MBA loads and authenticates modem fw, then jump to modem fw.

Unless you are absolutely sure 305SH and 306SH shares the same key, don't flash modem images... Also there are many Sprint specific features in 306SH modem.

And modem is protected by power on WP.
[Sharp Aquos Crystal] tomkins0752:
[MENTION=1713470]tewilove[/MENTION] I have a SH-01G that I've been playing with since you've put out the root access file.

Do you happen to have the 01.00.05 or 01.00.07 OTA files? That way I can look into these a bit more.

Thank you.
[Sharp Aquos Crystal] adamhonghong:
I have a SH-01G with 01.00.05

Is there something I can help?
[Sharp Aquos Crystal] DaemeonZane:
Has all work ceased on getting root? I just got a pair of these the other day, without (stupidly) checking to see if root had been obtained successfully. It has a lot of potential, especially if we can also build a CWM Recovery. I'm on medical leave from my job for a couple weeks, if there's anything I can do to help.
[Sharp Aquos Crystal] :
Temp root works but it is limited. Should have saved your money. It's Sharp.
[Sharp Aquos Crystal] DaemeonZane:
I'm just getting home, and I'll try a few things. I cracked open the kernel to take a look at some of the security that's built in. Sharp having finally disclosed the source helps. I'm mainly interested in getting rid of the integrity checks, etc., gaining full root, and building a CWM image. Has there not been any real work on this POS since temp root?
[Sharp Aquos Crystal] :
Hardly. I was going to look into it myself because I wanted to build TWRP but I hated the device so much I handed it back to the wife and said no more lol
[Sharp Aquos Crystal] DaemeonZane:
It reminds me of the first efforts to root the first HTC devices, what with S-Off and all that crap. I'm getting my environment set up and I'll see what I can do. What all would you need for TWRP? Besides the stock recovery and fstab, I mean?
[Sharp Aquos Crystal] :
I have my wife's phone to use. So if I need anything I can get it from there. Wouldn't take long at all to make up the Device Tree. I just haven't bothered with it since I can't write to the recovery partition at the moment. Also, you may want to know that there is no fastboot with this device as far as I am aware.
[Sharp Aquos Crystal] DaemeonZane:
I think I may have it. I'll check in after bit. I need more beer and more nicotine.
[Sharp Aquos Crystal] :
If you can get me access to the recovery partition I will begin working on the device tree.
[Sharp Aquos Crystal] DaemeonZane:
10-4. I'll let you know. I'm sure I'll have it by the end of the week. I've got plenty of time, beer, and nicotine, and my kung-fu is strong.
[Sharp Aquos Crystal] :
Good luck, you will need it lol.
[Sharp Aquos Crystal] DaemeonZane:
So far, my efforts have been more futile than resisting the Borg... But I'm not giving up until I run out of beer and nicotine. I've been looking into the Miyabi problem, reading the code in the source, and I'm thinking we might be able to modify the eMMC/Miyabi unlock tool I saw here to handle it, if only temporarily. Who wrote it?

---------- Post added at 08:08 AM ---------- Previous post was at 07:49 AM ----------

Tewilove: Looking at the source provided by Sharp for the last update, I'm not too sure it's encrypted. What progress have you made on this?

I'm trying to go through the code and see what information is relevant to the recovery make file, to see if it could be replaced with something to build TWRP as if it were the stock recovery.

I've been researching the RedBend multidelta format and I'm fairly sure it can be done, but my kung-fu is not as strong as I thought, and it's starting to give me a headache. What news on your end?
[Sharp Aquos Crystal] tewilove:
Why referring SHARP source? FOTA source is definitely proprietary.

I have decrypted 95% of FOTA update package of this device. It's a matter of time for me to build a fake OTA.

To install TRWP, there are two steps. 1. unlock bootloader, only edit one byte in aboot partition 2. write TRWP to recovery partition, this can be done in a fake OTA.

Some details of FOTA update package for this device:

1. it's consist of several segments

2. every segment is encrypted by a private implementation, it's not strong, or call it encoding is more proper

3. 1st segment is encrypted above the encoded data, an undocomented 128-bit encryption. 1st segment contains general info about segments.

4. the most important part of it is the segment containing "system" partition delta data, I have documented some in my gist here: https://gist.github.com/tewilove/04415602664d5839d073

Again, thanks RedBend, FOTA seems to have NOT deployed any digital signature.
[Sharp Aquos Crystal] DaemeonZane:
Are you using your hack of the FOTA to unlock the bootloader? Also, in regards to disabling Miyabi, have you seen the following: https://github.com/fi01/backdoor_mmap_tools ??? It purports to "Unlock MIYABI LSM for SHARP devices." I'm thinking this might be pretty damn awesome.
[Sharp Aquos Crystal] :
I just want access to the recovery partition so I can bring TWRP support and use TWRP to hack the crap out of this device. It will open up a huge door for me.
[Sharp Aquos Crystal] DaemeonZane:
Getting rid of the Miyabi BS would go a long way towards that, bro. I'm not sure how Sharp has all this...stuff...locked down yet, but I believe I've damn near gotten into the device enough to get rid of it. I'm going to try what I've found and see what I can do. If all else fails, I can always trade it in (I have full device protection, so I can always claim a f/w update screwed me.)

Sent from a potato using Kung-fu

---------- Post added at 08:44 PM ---------- Previous post was at 07:45 PM ----------

I've got an older copy of IDA Pro 6.1 and a fully legit and freshly pulled aboot.img from the latest OTA. What do you suggest? I'm even open to letting you remote in and take a poke at it, if you'd like. I also have a Kali Linux VM fully updated and ready to rock as well. I have to get up early to get some stuff done so I'm crashing out soon, but I'm open to any and all suggestions at this point.
[Sharp Aquos Crystal] TechInMD:
One thing that I discovered its if your device is not encrypted, you can power off the device, connect it to a computer and drop into adb shell. The only reason I bring this up is everyone its talking a about "power on write protection", but what if the device is not powered up? I have not had time to experiment with it, but I am throwing my 2 cents out there. I surely don't understand coding so big ups to the ones who do. If a recovery can be built for the device then my vision is to be able to dd the partition with the device powered off. But like I said this its just speculation I have not had the time to test this theory.

Sent from my non-rooted 306SH ;)
[Sharp Aquos Crystal] :
Been wanting to get IDA for linux but haven't found it yet lol. Basically like tewilove mentioned earlier. To get the bootloader unlocked. I also learned with this device that it does in fact have fastboot. But, it's being masked with download mode. If download mode can be disabled, wiped, nuked, and/or have a reenactment of Hiroshima then fastboot would become available, but it comes with a price. Download mode makes it possible to recover from a brick. With fastboot that can change it up a bit, unless TWRP exists ;). Anyways, I am occupied at the moment dealing with the TWRP source since I need to update my TWRPPORTER project to accommodate some minor changes.
[Sharp Aquos Crystal] DaemeonZane:
I've got a few files for ya

https://www.dropbox.com/sh/8vj9njadwmvc1gj/AABv5ppTg53tBCN2tUifOBnEa?dl=0

I've got the partitions by name, the build.prop, the aboot.img, and recovery.img in a folder for y'all to have a little fun with.