yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Well...congratulations ;)

Folks, might this be helpful?

https://blog.quarkslab.com/analysis-of-qualcomm-secure-boot-chains.html

https://www.emergingdefense.com/blog/2019/5/20/how-to-put-a-qualcomm-phone-into-edl-mode

People, I had an idea! Look here:

https://www.verizonwireless.com/support/knowledge-base-200052/

From the previous page, it looks like Verizon allows for enabling fastboot!

I tried chatting with them or getting a contact, but it looks like they require you to be their customer to listen to you. Can you find a way to contact them and kindly ask for a fastboot enable solution for Palm PVG100? Is there any user of this forum able to help us (possibly somebody who is currently using Verizon as a provider)?

https://www.verizonwireless.com/support/contact-us/
[Android Q&A, Help & Troubleshooting] bensdeals:
All those GitHub links are dead. Please advise.

Also what is the root.zip with a file names root in it? Is that the APK or something else (no extension).

Thanks again. Very exciting stuff.
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Hi, bensdeals

unfortunately arpruss removed his repository from github:

https://xdaforums.com/showpost.php?p=80702567&postcount=164

Luckily another user, which I thank a lot (ilikenwf) has a mirror of what has been done so far:

https://xdaforums.com/showpost.php?p=80702567&postcount=167

The root.zip file contains a file with no extension, which is not an apk package, but an executable compiled for the architecture of the CPU and for the operating system that PVG100 has.

Here's how to run the "root" file inside the package:

On windows open a CMD shell in the folder where "adb.exe" and "root" files are, then:

adb push root /data/local/tmp

adb shell

chmod +x /data/local/tmp/root

cd /data/local/tmp

./root

See below what you get (notice the # sign, meaning root user as opposed to the $, meaning regular user):

adb shell

Pepito:/ $ chmod +x /data/local/tmp/root

Pepito:/ $ cd /data/local/tmp

Pepito:/data/local/tmp $ ./root

MAIN: detected kernel version 3

MAIN: starting exploit for devices with waitqueue at 0x98

PARENT: soon will be calling WRITEV

CHILD: Doing EPOLL_CTL_DEL.

CHILD: Finished EPOLL_CTL_DEL.

CHILD: initial portion length 0x12000

CHILD: task_struct_ptr = 0xffffffc059c51980

CHILD: clobbering with extra leak structures

PARENT: clobbering at 0xffffffc03d8db4a0

CHILD: Doing EPOLL_CTL_DEL.

CHILD: Finished EPOLL_CTL_DEL.

CHILD: wrote 69688

PARENT: readv returns 69688, expected 69688

PARENT: clobbering test passed

CHILD: clobbered

PARENT: writev() returns 0x13008

PARENT: Reading leaked data

CHILD: task_struct_ptr = 0xffffffc066664000

CHILD: Finished write to FIFO.

PARENT: leaking successful

MAIN: task_struct_ptr = ffffffc059c51980

MAIN: stack = ffffffc066664000

MAIN: Clobbering addr_limit

PARENT: clobbering at 0xffffffc066664008

CHILD: Doing EPOLL_CTL_DEL.

CHILD: Finished EPOLL_CTL_DEL.

CHILD: wrote 69648

PARENT: readv returns 69648, expected 69648

PARENT: clobbering test passed

MAIN: thread_info = 0xffffffc066664000

MAIN: should have stable kernel R/W now

MAIN: searching for cred offset in task_struct

MAIN: search_base = ffffffc000000000

MAIN: searching for selinux_enforcing

MAIN: setting root credentials with cred offset 670

MAIN: UID = 0

MAIN: enabling capabilities

MAIN: SECCOMP status 0

MAIN: disabled selinux enforcing

MAIN: no whitelist, so all callers are welcome

MAIN: root privileges ready

MAIN: popping out root shell

Pepito:/data/local/tmp #

Does this help?
[Android Q&A, Help & Troubleshooting] bensdeals:
Thanks, that does work in achieving root. Question, you indicated modifying any system files would brick the device. Without an app to grant root access to other apps (supersu), then there isn't much we can do. Have you attempted to do anything else besides running this script?

... About your unlocking bands via editing nv data. Once you have root you can use the Network Signal Guru app to see if you have unlocked the bands. This doesn't necessarily mean those bands will work.
[Android Q&A, Help & Troubleshooting] StormSeeker1:
I'll have a look at the Network Signal Guru app, thanks. About that warning, it wasn't me writing it...and I'm a bit worried of trying modifying the system without having any ROM to reflash in case of brick (nor a working way to perform the flashing)...is there anyone who can help us with this?

I've just installed the Network Signal Guru app...but it looks like it requires root privileges, do you confirm? Also, how should I use it to get the LTE bands I'm using? Is it part of the free functionalities? What are paid functionalities?
[Android Q&A, Help & Troubleshooting] bensdeals:
It gives you the ability to disable active bands.. what it will do for you is tell you if you did successfully unlock and enable a band. You can then disable all the other bands with th tool. All via the free version with root.

Not sure if you can run it after rooting from the adb shell with root or what is consider problematic towards bricking your device.
[Android Q&A, Help & Troubleshooting] deadman96385:
The context of that fast boot was an older Qualcomm feature which put your phone into a hibernation state so that it would boot quicker it isn't releated to the bootloader fastboot. Also to answer your question about the alcatel driver that is just what windows picks the driver to be by default when it sees one of the many qualcomm debug modes..
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Thank you for clarifying; anyway, about the drivers, when you set the USB mode on the phone after connecting it to the PC, you have the option to connect it as a virtual CD drive, containing the drivers, so drivers (I don't know which ones) come from the phone itself (maybe this is unusual, but that read-only emulated CD partition exists on this phone).
[Android Q&A, Help & Troubleshooting] deadman96385:
That is used fairly often normally it's a setup exe to install them. Which depending on if it contains a driver for the mode your in it would override the Alcatel branded one which in reality is just there because both Alcatel and palm are TCL brands now.
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Very informative, thanks.

Anyway...is anyone of you guys attempting anything on this phone or have all of you given up?
[Android Q&A, Help & Troubleshooting] deadman96385:
Yeah I just ordered a used one got a few things to try. I think I have the firehose for the device but will see once mine arrives next week.
[Android Q&A, Help & Troubleshooting] freezex:
I grab the two programmers from github, and both of them get stuck, does it mean they are not fit verizon pvg100 ?

info

PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -info
Version 2.15
SerialNumber: 0x8decbxxx
MSM_HW_ID: 0x0006b0e1
OEM_PK_HASH: 0x073e81231dae45ba5575083feeccbaf85323b393e43e029e8ea5a683ecc3b6c6
SBL SW Version: 0x00000000
Status: 0 The operation completed successfully.

PEPITO.bin

PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -f .\PEPITO.bin -d devinfo -o devinfo.img
Version 2.15
Downloading flash programmer: .\PEPITO.bin
Successfully open flash programmer to write: .\PEPITO.bin
Waiting for flash programmer to boot
Dumping data to file devinfo.img
Dumping at start sector: 0 for sectors: 0 to file: devinfo.img

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="logbuf@0x08077B20 fh@0x08074988" /></data>
<?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" MinVersionSupported="1" MemoryName="eMMC" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="1048576" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" Version="1" TargetName="8937" /></data>
Using 99 bytes from mbuffer
<?xml version="1.0" encoding="UTF-8" ?><data><log value="logbuf@0x08077B20 fh@0x08074988" /></data>me="eMMC" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="1048576" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" Version="1" TargetName="8937" /></data>
Connected to flash programmer, starting dump
<?xml version="1.0" ?><data>
<read SECTOR_SIZE_IN_BYTES="512" num_partition_sectors="1" physical_partition_number="0" start_sector="1"/>
</data>
EFI PART
<?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" rawmode="false" /></data>

Pepito_VDF_NPRG.bin

PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -f .\Pepito_VDF_NPRG.bin -d devinfo -o devinfo.img
Version 2.15
Downloading flash programmer: .\Pepito_VDF_NPRG.bin
Successfully open flash programmer to write: .\Pepito_VDF_NPRG.bin
Expecting SAHARA_END_TRANSFER but found: 0

!!!!!!!! WARNING: Flash programmer failed to load trying to continue !!!!!!!!!

Dumping data to file devinfo.img
Dumping at start sector: 0 for sectors: 0 to file: devinfo.img

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Hi, freezex, can you please point me to where to download those two programmers? I've failed finding them for pretty long

---------- Post added at 08:06 AM ---------- Previous post was at 08:04 AM ----------

Great news!

Oh, guys, can you lend me a hand? I've just managed to install Android Studio, SDK, NDK, Cygwin, JDK and Gradle and I've managed to create a first hello world project in native code (C/C++) please have a look at the attached picture. The project is able to install on the Palm PVG100 and to display the Hello World message.

Now, what should I do to compile arpruss's files? How do I get the "root" executable file provided by greatjack1 if I want to compile it on my own?
[Android Q&A, Help & Troubleshooting] deadman96385:
The VDF one is designed for the vodafone variant so that one will not work for you, the first one looks like the phone accepted it. I haven't used that tool before so not sure why it isn't working.

He got them from my firehose collection org

https://github.com/programmer-collection/alcatel/tree/master/Pepito
[Android Q&A, Help & Troubleshooting] StormSeeker1:
OK, deadman, I tried to do the following:

download EDLBackupRestoreTool

extract it

set the config.ini file content to the following (see attached screenshot for reference):

# Set QDLoader COM port here, as retreived from Device Manager

COMPort=com4

# Set Firehose loader here. Can be a path relative to the BackupRestoreTool script.

# This is taken from Mi A1 Fastboot package.

FirehoseLoader=bin\PEPITO.bin

# Set maximum transfer speed.

# Default of 16384 is the highest possible.

# Lowest possible is 4096 (I think).

# Be sure to use multiples of 1024 for best results.

# Reducing this may help with reliability and prevent freezing during transfer,

# at the expense of taking longer.

TransferSpeed=16384

set the partition_list.devinfo.txt file content to the following:

# Only devinfo partition

devinfo

modem

fsc

ssd

sbll

sbllbak

rpm

rpmbak

tz

tzbak

devcfg

devcfgbak

dsp

modemstl

modemst2

DDR

fsg

sec

tunning

traceability

simlock

redbend

splash

aboot

abootbak

boot

recovery

system

vendor

cache

persist

devinfo

mise

keystore

config

oem

limits

mota

dip

mdtp

sysefg

mefg

cmnlib

cmnlibbak

cmnlib64

cmnlib64bak

keymaster

keymasterbak

apdp

msadp

dpo

logdump

fotadata

userdata

cmd to the extraction folder

run BackupRestoreTool_debug.cmd

choose 1) Set partition list file [list of partitions to backup]

I get this: Current = partition_list.devinfo.txt

choose 2) Backup all partitions from partition list file

I get this: [#] Enter folder name or full/relative path to store the backup [must not already exist]:

I enter this:

C:\Q

I get this:

[#] Dumping "devinfo" to "C:\Q\devinfo.img"...

[!] An error occured. BACKUP IS INCOMPLETE.. Check device connection and COM port is correct.

See log.txt for details.

The log.txt files has this content:

Version 2.15

Failed to write hello response back to device

Did not receive Sahara hello packet from device

!!!!!!!! WARNING: Flash programmer failed to load trying to continue !!!!!!!!!

Dumping data to file C:\Q\devinfo.img

Dumping at start sector: 0 for sectors: 0 to file: C:\Q\devinfo.img

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="16384"/></data>

Status: 6 The handle is invalid.

OK, I HAVE SOME NEWS:

I closed all QPST and eMMC Software Download programs and this time I didn't use eMMC Software Download to put the phone into download mode, BUT I set it to EDL from the recovery option.

This time, when I use BackupRestoreTool_debug.cmd to try to backup a partition (I chose a small one, "fsc", which is 1024 Bytes), The BackupRestoreTool_debug.cmd tool does not exit, BUT it hangs for a lot of time, saying "[#] Dumping "fsc" to "C:\Z\fsc.img"..."

What do you think?
[Android Q&A, Help & Troubleshooting] tc.chen:
seeking methods to open other lte bands from taiwan

hello stormseeker & guys,

i'm a new user of xda and pvg100(us unlocked version)/pvg100e(hk version) from taiwan.

also need to open other lte bands of pvg100 to suit 4g bands in taiwan, or it only stays in 3g signal..

could i shyly ask that if anybody succeeds in the "root.zip" version on pvg100?

and anyone opens lte bands other than default ones and works well after rooting?

in return of your replies, i would like to provide a tool for changing lte bands in apac area:

search "qtrun technologies" on google play (xda doesn't allow new users to post url)

many ppl have changed lte bands on different phones. (read from many blogs)

many thanks for your reply, seeking the method to open other lte bands.....
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Hi, buddy, welcome to XDA :) I can confirm the TEMPORARY root method enabled by "root.zip" works, but I don't know how to enable new LTE bands; I've changed them in the NonVolatile memory via QXDM, but I still see only 3G icon...

About the tool you mentioned (is it Network Signal Guru?), in this page (https://m.qtrun.com/en/product.html) it clearly states:

Q: Can you changed the band capacities of my cell phone. My cell phones are from other countries and the band capabilities are not so good, and I want more band support. Could NSG do that?

A: NSG cannot provide this kind of feature and we don't change the band capabilities. It's different among different phones, so it's dangerous and once failed, you will lose all of the band capabilities of certain radio technology. And it's very difficult to recover.

So I don't understand what you mean when you say "i would like to provide a tool for changing lte bands in apac area"...this looks false, no?
[Android Q&A, Help & Troubleshooting] tc.chen:
now i know that the two apps are the same.

i'm sorry to provide a useless information.

i'll keep searching the method of changing lte bands and following your work.

hope you find new methods.
[Android Q&A, Help & Troubleshooting] j.bruha:
With all this in mind, it sounds like at the very least ADB commands will work with the temporary root. Would it be possible to enable tethering by pulling the build.prop, modifying the entitlement line, and then pushing it back to the device? This is going back several years in Android's modding history, so I'm not even sure if this is still viable.

When I activated my Palm with Verizon, I was advised the provisioning was active for hotspot, but the phone itself seems to lack the software feature to do it, and 3rd party apps do not work in enabling it with their settings shortcuts.
[Android Q&A, Help & Troubleshooting] deadman96385:
From reading what others have said and my experience dm-verity is on so if you modify system then that will cause the system to stop booting with a dm-verity red error that can only be fixed by flashing stock system which as of right now isn't possible.
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Can you please explain exactly what is "a modification of the system" from verity point of view and where to look to understand without any doubt if verity is on?

Also, is this doable:

https://xdaforums.com/android/software/universal-dm-verity-forceencrypt-t3817389
[Android Q&A, Help & Troubleshooting] StormSeeker1:
I took a full live backup of the 32gb phone internal memory

Hi, guys, I TOOK A FULL LIVE BACKUP OF THE 32GB PHONE INTERNAL MEMORY.

There is a free software (and other paid ones) to mount the partitions on Windows; please have a look:

https://www.osforensics.com/tools/mount-disk-images.html

Anyway, I'm unable to explore most of them, maybe because they don't have a specific filesystem type or they have ext4 filesystems which windows doesn't support.

BUT there is a FAT16 partition, called "modem". I mounted it and I've accessed it. It has .mbn files inside!

Maybe some of those .mbn file or inside other partitions can be used for flash programmers, no?

Anyway, in that modem partition there are also folders with details for many phone provider companies, so maybe there is info for using other 2G or 3G or 4G bands...please have a look at the attached screenshots.

Folks, do you know of a way to explore all the other non-FAT non-NTFS partitions?

PS: if you are interested in how I was able to take the full memory backup, I can explain (no problem, just let me know).

To make it short, I used netcat in client/server mode to pipe linux "dd" command "block0" output to a file on the PC (I had tried with an OTG adapter and issuing the commands directly on a terminal emulator on the phone touchscreen, but then the phone doesn't recognize NTFS nor exFAT nor ext4 partitions, which are the only ones able to contain a 32GB image file; I had also tried splitting the file on the fly with gzip piping, it worked, but then the process was too slow and the 800mAh battery of the PVG100 drained faster than the backup process and if you connect a pendrive with an OTG adapter to the phone, then it cannot stay connected to a power source).

This method and a lot of interesting phone hacking ("forensics") stuff is contained in this book:

https://books.google.ru/books?id=9oVcDgAAQBAJ

Some pages are accessible on this google link, or you can buy it, but there are places on the web where the file is available ;)

https://1337x.bypassed.life/torrent...sics-Advanced-Investigative-Strategies-gnv64/

OK, THIS DID THE TRICK TO BROWSE PARTITIONS ON WINDOWS:

https://www.diskinternals.com/linux-reader/

Well...at least that software browses ext4 partitions, but how can I browse files inside the other partitions (which the "parted" command shows with no type of filesystem formatting)?
[Android Q&A, Help & Troubleshooting] StormSeeker1:
What does temp-root actually mean?

Hi, guys, I see that nobody is writing anything here, I hope deadman will let us know as soon as the phone gets delivered to him...

In the meanwhile, can anybody please let me know how to really get TEMPORARY ROOT ON THIS PHONE?

I DONT'T MEAN SPAWNING A SHELL WITH ROOT PRIVILEGES, I ACTUALLY MEAN "TEMP-ROOTING" THE PHONE AND BEING ABLE TO USE APPS LIKE TITANIUM BACKUP, SuperSU and BusyBox!

At this point I can even afford risking to brick my second PVG100, since I have two of them, but, please, clarify this, thanks!
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Guys, I've tried retrieving all Android properties via commands:

adb shell

getprop

This is very strange:

The phone is supposed to have a Qualcomm MSM8940 Snapdragon 435 (28 nm) processor, see here:

https://www.gsmarena.com/palm_palm-9290.php

BUY THEN WHY DO I FIND THIS PROPERTY?

[ro.board.platform]: [msm8937]

What does this mean?

Can this help us finding a working programmer file for QPST and similar physical access software?
[Android Q&A, Help & Troubleshooting] 1806:
PALM RU forum

in Russia sell Palm PVG100E_RU with different firmware and different LTE band

this is latest RU firmware info, I dont have this phone and this firmware, I have Palm PVG100 from Verizon...

[IMG="PALM PVG100E"]http://cs6-1.4pda.to/17578672.jpg[/IMG]

[IMG="PALM PVG100"]http://cs6-1.4pda.to/17578673.jpg[/IMG]
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Great, 1806 member!

Do you know of a way to flash the firmware?

Can we mix/match the different baseband versions between PVG100 and PVG100E?

Is the firmware you posted a reference to complete or is it just a delta for an update?

Thanks for clarifying
[Android Q&A, Help & Troubleshooting] deadman96385:
Well, I have succeeded! I will write up what all I did I am hoping I can simplify it.
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Deadman, I knew you were the right person to count on! That's a great news! I will try your procedure as soon as you post it! Please, also let us know if there's a way to have TWRP and a way to switch LTE bands ;)
[Android Q&A, Help & Troubleshooting] bensdeals:
Nice job. Did you use the temp root method from before to get started? Also does the is boot warning come up on each reboot or just once?

Great progress
[Android Q&A, Help & Troubleshooting] terence.tan:
A general warning to those who are modifying the /system partition:

Do not apply OTA updates if you have modified the /system partition

(or /vendor, or any other partition that updates OTA)

Palm uses Red Bend FOTA software which is a binary patch against the partitions. I think it assumes you haven't tampered with the partitions. It doesn't do much error checking. Then it blindly applies the patch.

Thus the OTA is likely to cause block-level corruption if you've modified the /system or /vendor partitions. This may cause failure to boot. Hope you've taken a backup! (Although you probably won't be able to restore your backup until someone gets fastboot or EDL/firehose modes working.)

N.B. Something as simple as "mount -o remount,rw /system" may modify your /system partition--it updates timestamps and other filesystem metadata. So be careful here!

I don't know if the above applies to deadman96385's post. It may not, but I assume it does, since the first screenshot looks like a dm-verity check...

Also in general

Do not apply OTA updates anyway if you want root access

since the next OTA update will almost certainly fix the vulnerability that allows it.
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Good advice, thanks, man, let's see deadman's guide, I can't wait for it :fingers-crossed:
[Android Q&A, Help & Troubleshooting] bensdeals:
Good advice. I have 2. One has no updates, the other has them all. So if I can't root the updated one, it's not the end of the world.
[Android Q&A, Help & Troubleshooting] deadman96385:
Wow this is great research, you are correct the firehose does work it is how I flashed my magisk patched boot.img. But I haven't been able to get it working in the normal programs (qfil, miflash, emmcdl, etc) I've been using the tcl/alcatel flasher and injecting my edited img's into so it flashes them along with all the other partitions to factory restore/wipe frp etc. It's why I've been trying to figure out why the firehose isn't working properly because my method is hacky and relies upon the flasher working which isn't a guarantee because the login could be reset (Even though its been a long time since that happened). But if i can't figure it out this week i'll release my current method so at least there will be something for people to use.
[Android Q&A, Help & Troubleshooting] StormSeeker1:
Hi, man, thank you for your work! Can you please let me know where to find the "tcl/alcatel flasher" that you and deadman used?

Thanks!
[Android Q&A, Help & Troubleshooting] terence.tan:
I haven't flashed anything. [MENTION=4222965]deadman96385[/MENTION] can possibly answer this question.