yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] yo9gnc:
root - continental

i have a 32b qwertz g1. wouldn`t get the DREAIMG.nbh rc7 or rc29. so ... because i didn`t get the goldcard method, i found on cyanogen`s website ( wiki http://wiki.cyanogenmod.com ) the universal androot section: this link is based on this link. it took me about 1 minute to get root on my DRC92 android 1.6

give it a try. or not. how do you consider. next ... change the recovery image, rom ... and so on :)
[G1 Android Development] amirox:
My Journey so far - no success - Why?!

Hey,

sorry to bother you with yet another reply but I just get nowhere. Please someone tell what I do wrong:

1.: On my G1 (with 1.6) I go to the Terminal and write:

$cat /sys/class/mmc_host/mmc1/mmc1:*/cid

By that I get my CID which is:

03534453553032478041303876009214

Now I reverse that to:

14920076383041804732305553445303

Now I replace the first two digits with 00:

00920076383041804732305553445303

With that last number I go to the Goldcard Generator provided here:

psas.revskill[dot]de/?q=goldcard

I get my goldcard.img sent to me.

I download it.

2.: In Ubuntu Linux 10.10 I get to the Terminal and Zero the Sdcard. The card is in the cardreader but not mounted.

cd Desktop

sudo dd if=Zero of=/dev/sda1 (note: dont know if i remember correctly here)

everythings fine

Now I put the DREAIMG.nbh on there (after mounting it again)(also tried the DREAIMG.NBH)

Pull out the Card from the Pc and plug it in the G1

3.: Camera Button + Power Button to get to tricolor Bootloader

Gray Screen appears.

Checking...

Not allow!

Thats just one of the many ways I tried to get it to work for me. Allways tried to tweak a little here, do something in a different order there...

all ended up with the same result.

Where is the F*cking error? Tried to find it for 6 hours strait today and couldnt find it. PLEASE give me a simple path I can follow - or something..

Also: does it matter if I use the US or the UK DREAIMG.nbh (.NBH)

cheers

edit: Telling the terminal in linux to: dd if=goldcard.img of=/dev/sda (instead of sda1) results in No Media found

edit2: Just read that you have to copy the files and partition on a windows machine.. true? Got none of those at hand right now.
[G1 Android Development] OpenMitko:
Hi Amirox.

I had the same problem, did everything right and "Not allow" again.

The solution for me was - another SD card (an old 1GB card I found in an old phone), Then I did again the entire CID thing, and booom it worked :)
[G1 Android Development] sparksco:
Rooting Method Obsolete

There is a much easier way now, the one click root method with universalandroot.apk, you can gain root access in less than 5 minutes

http://wiki.cyanogenmod.com/index.p...g#Rooting_Alternate:_Universal_Androot_Method

Make sure you use this .apk and not the one on the wiki and It'll work fine: http://dl.dropbox.com/u/11290772/UniversalAndroot.apk
[G1 Android Development] toyoki:
Thennnnnnnnnnnnnnnnnnnnnnnnnnnx
[G1 Android Development] deadfish:
i too faced the same problem reflash nbh file not allow errors with grey screen i followed a step which was put zip rc7 onto sd card and extract from sd card to sd card make sure its the only file on sd and you should be good to go..:-)
[G1 Android Development] Maldune:
The serial is too small, here are the numbers for one of the disks I use:

linux:

cid: 035344535530314780003210130071b9

csd: 002600325f5983c8befbcfff924040d7

date: 01/2007

fwrev: 0x0

hwrev: 0x8

manfid: 0x000003

name: SU01G

oemid: 0x5344

scr: 0225000000000000

serial: 0x00321013

type: SD

uevent: DRIVER=mmcblk

MMC_TYPE=SD

MMC_NAME=SU01G

qmat:

serial: 00710013103200804731305553445303
[G1 Android Development] infl00p:
Thanks for the tip jf, it seems that if you reverse the order of the bytes of the cid string it looks very very similar to the ids posted in the hard core way howto.

For example my cards cid looks like

03 53 44 53 55 30 32 47 80 11 22 33 44 XX XX 00

and in the howto they use a serial

00 63 00 49 8a f2 00 80 47 31 30 55 53 44 53 03

11 22 33 44 is the same as the /sys/class/mmc serial file

XX XX is the same as the hwrev, 53 44 is the oemid

I'll try again.

Maldune, thanks pal, take a closer look if you like, jf is right on spot.

linux: 035344535530314780003210130071b9

qmat:: 00710013103200804731305553445303
[G1 Android Development] Maldune:
Yeah, I just noticed it :p

I have a killer hangover so my brain isn't working as fast as normal.
[G1 Android Development] Maldune:
Tried a 1gb and a 2gb sandisk, no luck. Then tried a 8gb transcend microsd and this worked.

Thanks moneytoo
[G1 Android Development] bewerl:
I have two 2gb microSD cards. I read something out from the phones linux. Both of them are sandisk.

CID

xx xxxx xxxxxxxx Size xxxx Serial

03 5344 5355303 2 4780 009bf74d 0078fc 2GB

03 5344 5355303 2 4780 605a6c47 009112 2GB

03 5344 5355303 8 4780 20f6bb16 0087dc 8GB

CSD

002600325f5a83c93efbcfff928040ca 2GB

002600325f5a83aefefbcfff928040de 2GB

400e00325b5900003cdc7f800a4040c4 8GB

From the second Card:

Serial

605a6c47

scr

0125000000000000

date

01/2009

fwrev

0x0

hwrev

0x8

manfid

0x000003

name

SU02G

oemid

0x5344

I think the key is read out by WinCE(WMAT) is more different than only slided numbers.
[G1 Android Development] lilithpro:
I dont think the serial is the problem. Serial can be read by using CID, reversing the bytes and overwriting the first byte with "00".

Imho, the problem is the script. QMAT states that it cannot save the goldcard image for "newer" phones and in the "config"-dir there is a file named "goldcard.xml". It contains keys and there are 2 kinds of entries:

<device name="Elf">

<Key>A0ADC4A3D3C5A8A9</Key>

<Key>B4CFA5D2B3A1C5AF</Key>

<Key>C1AED2A5A8D4B2D6</Key>

</device>

<device name="Diamond">

<Key>C69085D593A9D39B</Key>

<Key>D4BB8CB6C7D09481</Key>

<Key>A7AFD4B492C4DE84</Key>

<TKey>14996D6558D079F1E82EA64CC46AE2858F673CB46B1376F7</TKey>

</device>

"Newer" Devices like the Dream contain an additional string, so i think generation is different between these older and newer. The perl script we have is essentially the same, and if it is written for elf and similar generation phones, it wont work with newer...
[G1 Android Development] bewerl:
at QMATE 424 ther is an Entry for DREAM in the goldcard.xml

<device name="Dream">

<Key>D7D5D1C1D492A5C3</Key>

<Key>92C8C1D0D5DAA1C3</Key>

<Key>CED5B798D4C1A694</Key>

<TKey>14996D6558D079F1E82EA64CC46AE2858F673CB46B1376F7</TKey>

</device>

The first three keys are different but the TKey is the same. Is this what you mean?
[G1 Android Development] lilithpro:
I mean the algorithm of the perl script could be intended for the devices without this TKey-String. So it wont work with the ones that have him, regardless of any serial numbers
[G1 Android Development] kingzero90:
I tired it the hard way. But it doesnt seem to work. Iam getting an not allowed error. I tried it the hard way.
[G1 Android Development] infl00p:
I tried again with all my microsd cards and it still ignores the img.

I won't give up with the "hardcore way", since in my case it is possible that either the dd command is wrong or the linux mkfs.vfat is missing something.

I'll try tomorrow from a windows pc at work.
[G1 Android Development] Autarkis:
I already have a rooted G1, originally US version, but I have a question. Are you sure you're supposed to write the Goldcard.img file over /dev/sde ? Forgive me if that's a stupid question, but it could also be meant for /dev/sde1 for all I know. :)
[G1 Android Development] viperbjk:
Pals ...

unluckily this should never reach the public. We didn't publish it as we are thinking it may be our only chance to get into newer devices. So please do not reverse the algorithm and publish it, or you'll have to face the consequences (HTC reacting to it, changing to rsa or aes encryption).

Don't try to use the itsme script on newer devices, it won't work.

The algorithm is different, and we (I and cmonex) spend several long nights to reverse it.

Also it won't work with cardreaders, as the serialnumber needed for the sd card can only be calculated using a activesync device that supports raw reading of serial number.

I'm willing to enable the "write to image" for linux users however for registered qmat users in the next version of qmat (4.25).

Cya,

Viper BJK
[G1 Android Development] Ceased2Be:
But how exactly can I read the serial using only my G1? Can't find a way to read the cid file mentioned...

Thanks in advance

CzD
[G1 Android Development] infl00p:
Nice question in fact,

the 288 bytes that are writen to the device can only go to the Master Boot Record (512 bytes). This sector is not used since we do not boot from SD.

If we write 288 bytes at the first partition it's possible that the we corrupt a part of the FAT table.

the command line syntax for the pdswrite utility is:

psdwrite [-DSKNR | drive:] [-s fileseek] filename [ cardseek [ length ] ]

more info for the itsutils
[G1 Android Development] g1-free:
Hi,

from a short look on this

it look like that t qmat serial is composed iun th follow way:

bytes 3 - 6 are reverse serial

bytes 7 - 12 are revers bytes 3 - 8 from cid

bytes 13 - 14 are revers oemid

byte 15 is byte 2 from manfid

byte 0 - 2 are maybe the time, but this is unclear.

Maybe this helps.
[G1 Android Development] viperbjk:
No !

The Card ID used for QMAT is identical to the CID.

HTC only needs the first byte to be zero.

You cannot use any card reader to get the CID, as most will only

create fake CID.

But you are able to use the CID from /dev/mmc using a console on the mobile.

Btw. the data isn't written to MBR but in raw section of sd card. See itsme descriptions and all will become clear.

Cya,

Viper BJK
[G1 Android Development] viperbjk:
Sorry Guys, I had to take down the download of QMAT due to legal issues.

New version will be released soon. Please do not host any versions of QMAT till then.

Cya,

Viper BJK
[G1 Android Development] g1-free:
Hi Viper,

you are right, have started with the serial as I lokked on the card id. :(

This is really easier, reverse the CID and make the first byte zero :D

But I would neverless say than the CID seams to be composite that way.
[G1 Android Development] raw235:
i think viperbjk is f*king right! if this method gets aviable to the large public (i.e. is posted on 10001 lame android blogs and appears in the IT-News) HTC will react with cloasing this way of getting root.

many of the readers here seem to be not interested in that, but as your G1 breaks the one or other way, and you get a replacement with this method closed you will be sad.

removing the download of QMat is the first right thing to do, removing this thread from the public search engines will be the next. We, and all other G1 users will not get any advantage when this goes to the whole public. keep it under the radar, i.e. make this thread only visible to registed users or better give the instructions out via PM.

i think, ethustiasts sould have a way to get root on there phones, all the kids and people, which dont know what "root" means at all or how it spells should not.

iam also talking to the guys at andoid-help.de to also think about it. as of now, android-help.de and this forum are the only two locations, where this information exists (as google tells me). now the admins have the power to stop HTC from getting aware of this method. please do it.

HTC would not be interested if only some geeks hack thier phones this way, but will be interested if everyone (including the people which dont know what root is) do it.

iam a great fan of information freedom, but in this case, it will be better for all if this information is not free for all.
[G1 Android Development] viperbjk:
New version of QMAT (4.25) no longer has new goldcard generation.

However, I'm willing to give special version with enabled function to those

who contribute to the forum.

Sorry, but we had to do this to ensure that all will benefit from what we got so far.

Cya,

Viper BJK
[G1 Android Development] raw235:
FULL ACK!

but the version 424-link on the 1st post is still working?
[G1 Android Development] kingzero90:
Why did you even change the link for 424? You cant generate a goldcard for the g1, atleast with the free version.

Or am i missing something?
[G1 Android Development] mcbrain33:
Sorry, but i fail to see how we all benefit if only a few selected people will be able to downgrade their european G1.

Regards,

McBrain
[G1 Android Development] raw235:
the point is... if you realy want to downgrade your G1 you have a way to do it.

this keeps all the "huh, what should i do today? hum, getting root on my G1 sounds good. i dont know what root is and what i can do with it, but everybody wants it so i want it too"-people out.

i think making this method more exclusive is right.

not for short but for long term.
[G1 Android Development] Markus31415:
Sorry I also don't understand this. I find it very ignorant to only let some people downgrade their G1.
[G1 Android Development] mcbrain33:
there is no other way for continental european users to downgrade (getting root) their G1s than the Goldcard method.
[G1 Android Development] Tuxguevara:
Yeah.... N1

Could root my german G1 :D

Worked with SD micro SD Adapter and Himalaya WM6 device...

Nice to have such a device... ^^
[G1 Android Development] free-sidux:
how? without goldcard?

i see the window closing itself again

waited so long for this day ... :-(
[G1 Android Development] hades00:
is this what you understand under hacker-ethic?

i don't agree with you!

i'm just reading things about donate here, buy this and so on

i'm sorry, but i think this should be public for all users and i hope you will make this public !

thanks, hades00
[G1 Android Development] MontAlbert:
will this work on an aussie dream??

our version is:

dream_stg_user 1.1STG-RC8 128394 ota_rel_keys, release_keys
[G1 Android Development] kmetz:
I Agree on the point that casual rooting, from people who don't understand what they are doing, is not good.

Not because we have to protect users from killing their devices, but because it hurts the young android platform, and the competition is strong.

If rooting allows for cracked market software and everybody has an one-klick-rooted phone, android will die because of a lack of good software. Carriers and Vendors would turn away from it.

Now we have this goldcard thing. I see two possibilitys to try to "fix" it:

1) Try to keep your hand over the information and fail. "Removing" something from the internet will not work, for that it is too late. The internet is a free place, information is free, and there is bittorrent. It would only lead to nasty discussions.

2) Publish your algorithm, and do inform HTC that there is a security issue with their bootloader. I know this is against your commercial interests, but you would gain valuable whitehat credability. (Nice side effect: Hackers would be turned away from windows mobile ;) )

And the root problem is also already fixed: Google sells the ADP1, which - in my opinion - should be the only kind of android device that allows for root access in a grown up android world (mid-term). This also is a better working barrier to sort out those rootkiddies as the kind of pseudo blackhat forum elitism some denoted in this thread.

I say this from the perspective of a user and tinkerer who wants to play with his devices abilities (multitouch..), and also from the perspective of a developer who wants a platform that is fun to develop for.

As I said: The smartphone/mobile device market is a shark tank. Apple put blood in there. Android is the only vital system that is open - as open as this kind of market allows. And I'd like to see it surviving, spreading its open mentality.

BTW: I bought a copy of qmat half an hour ago, and I'll try to put an engineering bootloader on my G1, as long as I dont have an ADP1.
[G1 Android Development] viperbjk:
Yeah, I respect all of what you guys/girls are saying.

In fact, we have to stop the spreading right now to think about the options we have.

It's not about the "can I generate" or not, it's more about the "only people that really need it" and the "let's find other ways so we have one backup option".

One possible option would be that a special version of QMAT is generated and given out automatically to those who donate to this forum (hardware,software,cash).

I'm going to talk to cmonex soon about this, and we'll see.

Cya,

Viper BJK
[G1 Android Development] hades00:
i think this is a good idea!

for me, i'd like to install debian on the device (working with debian for more than 7 years)

i also have a FIC neo freerunner (gta02) and i would like to port some of the applications to the android device (and from android to gta02)

cheerio, hades00
[G1 Android Development] raw235:
Yeah, that sounds good. This was what I had on my mind when writing, that the ones who really want can get it.

For serious people, root would be some money worth, for kiddies not.
[G1 Android Development] x-poke:
ok then close or delete this thread then. there is no need to give people hope writing as a head like "downgrade, root and upgrade ANY G1/Dream (even Continental European)"! :mad:
[G1 Android Development] Autarkis:
I respect your decision, viper. The whole ethical thing, points that are popping up ... "keeping a lid on it" however... I won't work against you, but I must say, I'm a tad dissapointed.

Some things raw235 said especially:

Information should be free, unless I rule it? No, sir...

Deleting threads from other forums? I disagree...

Only for those who contribute? Who decides who contributes? Do you have to write code? Is it enough to answer threads in the forum? Far too arbitrary!

Of course I will be sad if my G1 won't be rootable in the future, for what reason ever. That doesn't mean that monopolizing information is right.

And I also disagree that you must know what root is in order to have it. A decent phone needs the capacity to do screenshots, to do proper task management. If root is what it takes, then root is needed.

All in all, I won't work, reverse engineer or publish against the interests of viper. I however strongly feel what kmetz said: Trying to stop the Internet and bittorrent is futile (and ultimately also against our greater interest I suppose), and confessing to HTC would give viper some serious creds. I'd do that. It's the right thing to do.
[G1 Android Development] ollip79:
well only germans can discuss like this.. its in the net and its only a matter of time till it ends up on some torrentsite..

root is not yet only one button click away.. so only people who seriously like to play with their phones will take the plunge..

and all the ethic talk is bull.. someone sees the possibility to make some extra bucks.. good for him..
[G1 Android Development] Autarkis:
I don't condemn people for thinking like that, but please don't call my way of thinking bull just because it's different.
[G1 Android Development] ollip79:
hey autarkis.. it was not directed at you.. sorry if came out the wrong way.. more a response to kmetz and his "worries" out the android platform.. ;)
[G1 Android Development] eldorado2705:
do we need to buy this tool, to unlock and root the device??? I mean everytime i try to save the img file on Wincesd the app says that there is not a implementation for newer devices.

Please help..
[G1 Android Development] Francisco00:
QMAT platforms?

Hello everyone,

I don't know how silly or not this question is (since the QMAT devs didn't actually answer it -- in any obvious place-- in their site). Anyways, in which platform does QMAT runs?

Does it require Windows Mobile? Or can it be run from a regular windows machine? Most importantly does it run on Linux?

The freely available version seems to be Windows only, however in this tread there have been references to a Linux version.
[G1 Android Development] Autarkis:
It runs on a regular Windows Machine but requires the services of a WINCE device to get to some kind of "inside information" that enables the transformation of any MicroSD card into a Goldcard.

As far as I've seen, it doesn't run on Linux.

Furthermore, the version with which the trick worked is being replaced at the moment and is not available for download.
[G1 Android Development] Francisco00:
Thanks for the information.

I had read the posts where the QMAT dev mentioned that he was pulling the functionality off.

In any case, if it ran on Linux I'd be willing to buy it, but if it really requires WinCE, then it becomes a whole different business, as I don't have any device running it.
[G1 Android Development] viperbjk:
It should also work under linux. You can grep the serial via "cat /sys/class/mmc_host/mmc1/mmc1:*/cid", reverse the hex bytes and put it into qmat to generate a image. After that I guess you can use dd to write directly to address 0x0 of the sdcard.

Decision has been taken and I will add new goldcard generation to the next version of qmat (4.26), but only available to qmat registered users to ensure that this doesn't spread too much. Donators to cmonex and me (in what type it may be) will of course get a free qmat license as usual.

Cya and thx for your respect to our work,

Viper BJK
[G1 Android Development] finran:
So... small question to viperbjk:

What exactly do you mean with "reverse the hex bytes"...

e.g: 035344535530324780022a5747008b10

do you mean just switch every binary to:

30 35 44 35 55 30 42 87....

or reverse the whole thing in the middle ... just like...

80022a5747008b100353445355303247 ?

im trying and playing around a little ... :)

thanks in advance! :)
[G1 Android Development] viperbjk:
035344535530324780022a5747008b10

would be reversed to :

108b0047572a02804732305553445303

The reversal is bytewise.

In QMAT, just use function "Reverse String" in CryptoToolBox Tab RSA

to automatically reverse it.

Cya,

Viper BJK
[G1 Android Development] finran:
Thanks for that quick answer!

anyway... it didnt work... hell its horrible... i dont have a wm device... and i would really appreciate wlan tethering and playing around with the core stuff... great device with handcuffs -.-

anyway thanks viperbjk :)
[G1 Android Development] viperbjk:
finran, what did you exactly try ?

Remember :

- generate via Activesync (works)

- generate via linux on mobile device, write raw image via dd (works)

- use any external card reader (won't work, as it cannot write/read raw sectors)

- old goldcard does not work with new devices

Cya,

Viper BJK
[G1 Android Development] buffos:
Does the full version still contain the goldcard creation option?
[G1 Android Development] viperbjk:
Yes, new version 4.26 (just released) will do.

Cya,

Viper BJK
[G1 Android Development] buffos:
The basic reason for me to get root to the phone is the ability to run apps from the sd.

If i new that the phone will have just such little space for apps, and i would never be possible to store information to the SD, then i would not buy the phone.

The phone, as advertised , never says you are limited to internal phone memory to install apps. Google might support that... but till then we are left with so little space.

Does it harm htc if people get the root in the phones? What does the company lose? The OS is free, isnt it?

The reason "common" users buy this phone, is because Android is free and can be upgraded anytime. Nowhere they tell you that you cannot do so.

Also did anyone tell them that they should not partition the EU??
[G1 Android Development] viperbjk:
HTC has to ensure that you cannot do any fraud with your phone, just like IMEI /ESN changes. Once you got root, you are able to do so. Also they have to ensure that the branding cannot be changed, as they get license payments from the providers.

Another problem is that only some parts of the htc dream are "open source".

Imho, as long as these issues aren't solved, root does harm HTC.

Cya,

Viper BJK