yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] Francisco00:
Get the CID from the G1 itself.

Don't use a card reader. Some card readers will report a fake CID value.

Use your G1 instead. Install the console application to your G1, and check the SD card directly:

(FROM THE G1 CONSOLE!)

(notice the end of the path of the dir might be different for you!)

cd /sys/class/mmc_host/mmc1/mmc1:8fe4

cat cid > /sdcard/cid.txt

If you using Linux to run QMAT, make sure you have a Wine version that does display the drop down menus. Wine "stable" did not allow me chose "Dream" as model for the Goldcard generation.

See this post for all details: http://xdaforums.com/showpost.php?p=3387344&postcount=135
[G1 Android Development] 66Claude99:
stuck with the downgrade

ok, I am somewaht stuck in the middle of the process.

- I retrieved the cid

- reversed the cid

- got the .img

- zeroed sd card using dd under cygwin

- formatted sd card under DOS FAT32 4096

- used dd under cygwin to write .img to the sd card

- added DREAIMG.nbh to sd card

- bootloader quit displaying 0028002 not allow (from that I conclude, there must be an error with the .img, either not accepted or not peoperly written to sd card)

I thought of two possible issues:

1) 2gb san disk sd card shipped with my German G1 causes problem (as described earlier in the thread)

2) something went wrong when using dd to write img to sdcard. Even though it says 384 bytes copied, i suspect that the sdcard is not properly mounted. Sd card is named SDB, after dd in cygwin under devices, I find a 384bs file named SDB. HOwever nothing visible on the sd card under win?!

Any help appreciated!
[G1 Android Development] oLRi:
I used the G1 Console, but i want to compare the CID from the G1 Console with the one from the Cardreader / Linux, but i still got no idea how to read it with Linux and a cardreader. I know that this method may report a wrong CID, but its only for testing purposes :)
[G1 Android Development] 66Claude99:
using discover file browser, you can easily browse to /sys/class/mmc_host/mmc1/mmc1:xxx. In that folder you find a cid file. Send that file as email attachment. Once received, just open the cid file with wordpad/editor.
[G1 Android Development] Murphy2712:
"Model ID incorrect"

I've a French HTC Dream and when I try to flash it (with or without the goldcard) it keeps saying me : "Model ID incorrect"

I've tried RC7 and RC29.

Is it a goldcard issue or do I need an other RC image file ?
[G1 Android Development] Francisco00:
The goldcard should never be visible from the regular OS.

You are (probably) not writing the goldcard image properly.

1. Check the command you used, and make sure you are writing it to the correct device (honestly I wouldn't know how to tell you for sure how to do that from Cygwin).

Once you are sure that you are writing to the right device.

2. Write to the device (not that you don't write to /dev/sdX1 but to /dev/sdX).

3. Read back from the device, and compare to the file you had:

3.a check the length of the file you had:

ls -l goldcard.dream.img

-rw-r--r-- 1 root root 384 2009-02-27 23:28 goldcard.dream.img

(size is 384!!)

3.b read from sdcard:

(untested!)

dd if=/dev/sdX of=goldcard.img.2 count=1 bs=384

(actually using

% head -c 384 /dev/sdX >! goldcard.img.2

should also work )

3.c compare

diff goldcard.img.2 goldcard.img
[G1 Android Development] zakaria59:
very thanks my herald now it's alive
[G1 Android Development] Murphy2712:
"Main Version is older!"

I've regenerated a goldcard and now it "seems" better, the message when I try to downgrade (with RC7 or RC29) is :

"Main Version is older!

Update Fail !"

In the pdf manual, the product number is DREA200.

It seems that the hardware is different and fastboot protected.
[G1 Android Development] thephoneguy65:
Can someone help me, I have been trying to days to get this working...

I am up to the point where I insert my SD card into my laptop cardreader.

How do I know which /dev/sd? is my SD card?

I am guessing it is /dev/sdc1, but what's the difference between /dev/sdc and /dev/sdc1. Which one of those do I dd the image to?

Most importantly how can I tell which sdx is my card and which one is the harddrive or other drive?
[G1 Android Development] emms007:
the difference between /dev/sdc and /dev/sdc1 is that the first one is the whole disk and the other one is the first partition on the disk.

Have you tried fdisk -l it should report all connected disks then you can easily guess which one is your sdcard on not.
[G1 Android Development] McLin:
forget it deleted....
[G1 Android Development] thephoneguy65:
What's the difference between NiceDreams and QMAT?
[G1 Android Development] free-sidux:
Hmmm... unfortunately 2.24 is worthless, as long as you don't own a WM device.
[G1 Android Development] McLin:
See post 1...
[G1 Android Development] viperbjk:
The referred "NiceDreams.zip" is in fact QMAT 4.24 and violates international copyright laws, as QMAT may not be hosted on any other hoster than http://revskills.de.

Cya,

Viper BJK
[G1 Android Development] thephoneguy65:
Can anyone confirm android rooting and QMAT work on Australia HTC Dream phones on an Optus plan?
[G1 Android Development] viperbjk:
Yep, at least for QMAT and goldcard generation it should. We are also watching all other newer devices if they still support the goldcard generation.

Cya,

Viper BJK

P.S.: Donated money from goldcard generation to keep this great forum alive.
[G1 Android Development] xtreme_protector:
Accidentally (read luckly) I came to possess a G1. Of course I wanted to be able to do a lot more than standard usage. Thus, I started looking around for methods and hit this thread. But, reading through I realized that some guys managed to reverse engineer (lots of references on the net) the HTC goldcard, and now they are asking from you money to have access to this, for whatever reason you may need it. Moreover, they get quickly even offended that someone posts their original software on the net. Again, I have to repeat myself but this is just ridiculous.

I mean no offence to them, and I respect their long nights spent achieving this. However, there is a huge difference between donating money and obliging people to pay. See one of the last P.S. from one of the senior guys :) Further, visiting http://revskills.de/ the first thing one notices is a statement that any reverse engineering of their own software will end its production. So, they are alowed to reverse engineer somebody else's software but not their own....

Well, as I do have some experience in this area, I will be looking into this. I personally find much more entertaining and easier to achieve removing PE packers than cryptography. To paraphrase someone who will be 'severely' sanctioned by the senior guys, you might have even better dreams.

I hope this will be my first and last post on the forum, or might be not.

Bye now !
[G1 Android Development] viperbjk:
You might consider that QMAT is currently programmed by only one person, and not by any team as you might think. The statement that reversing my software will stop the development is only due to the fact that qmat is a pure hobby of mine and I'm not having the time to also enharden security just because of reversers.

If you are trying to say then, oh, so just open up the source of QMAT to everyone, so we all can develop it further : Yeah, I did that and nobody helped with programming ... in fact other "reversers" just took the source for their flasher boxes for making money. That's why it turned shareware. Oh, and QMAT was never intended for any public but just for reversers of any type.

Moreover you should also consider that the new goldcard generation was never intended to be published to prevent any harm to the mobile industry and leaving the reversing community the time to reverse other ways of breaking in. Publishing the source of the algo was no option due to legal issues, that's also the reason why we had to remove qmat version 4.24, as we had to restrict the generation.

However, feel free to reverse the algorithm yourself but not reversing my software but reversing the mobiles like we did and hacking the algorithm used. I would appreciate that and you would do this community a great favour. What you may do then with the goldcard algorithm ... is solely our own decision.

Cya,

Viper BJK
[G1 Android Development] viperbjk:
News :

-------

The grand jury had a meeting. We reversers came to the conclusion that we will give out goldcard generation for G1 for free.

As we still need to restrict the algo itself to enable reversal of newer devices to come, generation of G1 goldcard image will be done online.

Earnings we did so far with QMAT registration for G1 owners will be donated (and already have), the rest will be used to buy newer devices to ensure future hacks.

Cya,

Viper BJK
[G1 Android Development] kockroach:
That's impressive that you have decided to do this. So when you say generation of the GoldCard will be done online, do you mean through a link on the QMAT homepage? Thanks!
[G1 Android Development] viperbjk:
Either it will be QMAT homepage, xda-developers itself or on one of the reversers homepages. We're figuring that out right now. I'll keep you updated.

Cya,

Viper BJK
[G1 Android Development] cmonex:
and praytell, who are we obliged to, to give away everything for free so that then other people can take it and sell it?

the rest viper already answered along with our decision to help G1 users.
[G1 Android Development] xtreme_protector:
Well, I have to post again .

First of all, kudos for grand-jury's decision...

cmonex: I wasn't asking you to give away the results of your (impressive) work for free, i.e. I wasn't hinting at the code. What I really meant is to allow anybody to USE your software, for free. Thus, I completely agree with you, regarding others making money from your work.

As I truly respect your work, I will be the first one to donate IF you decide to make it available for anybody, and it also works :).

Cheers !
[G1 Android Development] viperbjk:
Repost due to database crash :

Free G1 goldcard image generation (beta) :

Click here to generate goldcard for free !

Just enter your cid and emailaddress, press the button "Continue" and

WAIT, only press Continue one time. It will then generate the goldcard and send it via Email.

Cya,

Viper BJK

P.S.: Some funny people try to hack my server or enter invalid emails for fun. Stop it, or we will have to take down the free goldcard generation !
[G1 Android Development] nk111:
omg! I can't believe that I paid 2 days ago... :)

anyway. Thanks for your work and for sharing your results!

regards

nico
[G1 Android Development] viperbjk:
Well, QMAT has a lot more to offer (and will offer more in the future) than just goldcard generation :)

Some people just tend to forget that :D

Cya,

Viper BJK
[G1 Android Development] mrmoor:
hey guys,

I have a german tmobile G1 with FW 1.1 and build number "kila_eu-user 1.1 TMI-RC9 128600 ota-rel-keys,release-keys". I have tried to downgrade my mobile with HTC goldcard generated with the online tool from the link posted above, but "not allowed" appears. Could it be that build 128600 is the problem?

mfg mrmoor
[G1 Android Development] bassbox:
No, i had the same build on my G1 when i did it, dunno what's the problem
[G1 Android Development] viperbjk:
Build has nothing to do with that. My guess is : wrong cid or image wrong written

Cya,

Viper BJK
[G1 Android Development] mieszko1:
Hello,

I am trying to root my g1 since 2 days.

I have no strong to make it.

I am doing in this way from this post :

1) formating SD card ( 1gb in cardreader ) in Fat32 format

2)putting SD card into HTC HD and connecting it in to ActiveSync

3)entering to Qmat 424. When I enter to Hardware Forencis -> generate htc gold card. I chose Dream in device selection , after that i click get Sd card serial from WinCe Device, after few sec I get my card Id. After that i click save the image to winCe SD. And it shows that it is saved succesfully.

4)putting out Sd from HTC HD and putting it into cardreader

5)copying dreaimg.nbh into SD card

6)power off my g1, putting in it SD card

7)when I press camera button and power button nothing happens !! :mad:

Phone is normally booting ! I dont know why I dont get color stripes screen

Can anybody tell my what the f..k is wrong ?? I am not going to give up

PLS HELP
[G1 Android Development] viperbjk:
First mistake :

- using QMAT 4.24. This version had several goldcard issues that didn't let some cids generate correctly. Furthermore we no longer support this version as it has been removed from the net due to license problems.

Use free goldcard generation (online) instead and then write the image for example using free or registered qmat 4.30 (wince sd card tools, write image) or use linux console and dd.

Second mistake :

- Power off phone. Then press and !!hold!!! camera button and also press and hold !! power on button, till you see the bootloader.

Cya,

Viper BJK
[G1 Android Development] mrmoor:
okay, i feel stupid ....

1. First I entered this on Terminal Emulator on my G1

$cat /sys/class/mmc_host/mmc1/mmc1:*/cid

and got the answer and wrote it down. "0353445355303247803095e596008b1e"

2. Now I entered on http://revskills.de/pages/goldcard.html my orginal CID (not reversed)

and got the file "goldcard.img" by mail. (thx viperbjk ;) )

3. I pluged in my android with my sdcard and formated it via WinXP to fat32

copied "goldcard.img" and DREAIMG.NBH(from the tutorial) on it.

4. I restarted my android and pressed Camera + Powerbutton. The colored screen apeared and the grey programm started and resulted " not allowed". :(

I also tried to use under Linux

$dd if=goldcard.img of=/dev/sdb1

but after rebooting my G1 the same error ocured.

and also I made a Goldcard with the reversed key wich I generated this way:

[I startd qmat 4.32 (free version) started Cryptoanalysis Tools / Crypto Toolbox and changed in the left side of the window from BenQ Siemens to HTC

entered my code frome above and reversed it. My answer was "1e8b0096e59530804732305553445303"]

but it doesent worked :(

does anybody know what to do different??

thx ;)
[G1 Android Development] mieszko1:
I do in this way. I turn off the phone and then I tried to press camera and power button and nothing happens.

When I want to generete a card on line I have to give the normal Sd number or after reverse string ??

Thx
[G1 Android Development] viperbjk:
Try 008b0096e59530804732305553445303 instead.

It could also be that the cid given is wrong. Some users were reporting that the output of linux's cid is one byte wrong. Please see this thread for more info.

Cya,

Viper BJK
[G1 Android Development] viperbjk:
There is only ONE valid cid. That is a cid with label at the right side.

If you use linux, you will have to reverse the cid given.

If nothing happens when pressing the hardware keys, I have to assume you are pressing the wrong ones then :D

Remember, phone has to be off and camera button has to be pressed before pressing on button. See service manual for details.

Cya,

Viper BJK
[G1 Android Development] mieszko1:
I get CID direct from my phone by ASTRO app. it shows 6E8A0054D20802804731305553445303

after using qmat and reverse I get 0353445355303147800208D254008A6E

When I got the goldcard from online service I was trying to write it on to SD card by qmat and it also didnt work ( I tried with normal and reversed CID )

What next ??
[G1 Android Development] viperbjk:
Whatever Astroapp may be :)

008A0054D20802804731305553445303 should be the right CID, as the label is right (55534453). If that one doesn't work, maybe you're not writing the goldcard image to the first 0x180 raw sectors of the sd card. Check if partition (fat16 or fat32) is still alive after writing the goldcard image. Also make sure no other file is on the sd card except DREAIMG.NBH. If that also doesn't work, please see this thread.

Oh ... and before writing using QMAT .... did you press "get serial" before and compare if the right cid is shown (the one you used for generation of the goldcard) ?

Cya,

Viper BJK
[G1 Android Development] cmonex:
needs to be fat32. and yes check if still valid partition, some boot sector modifier tools can **** up things with goldcard.
[G1 Android Development] mieszko1:
Thanks a lot but it is not working, I did in this way which you write... No strong to make it longer but I am not giving up ;-)
[G1 Android Development] mrmoor:
it works!!!! :D:D:D:D thank you, you are godlike!!
[G1 Android Development] Hendrik212:
Hello, unfortunately I also get the not allowed error.

These are the steps I've done so far:

1) Get sd cid by Terminal Emulator (035344535530324780701ad3e0009168)

2) Generate the goldcard image online

3) write goldcard image in cygwin ($dd if=c:/goldcard.img of=j)

J:\ is my cardreader

A File named "j" appears on the sd card, I don't know if that is right??

4) Copy dreaimg.nbh into SD card

6) Put the sd card into G1 and try to downgrade -> not allowed

Thanks in advance!
[G1 Android Development] rhalff:
I can report success! :-)

I've rooted a dutch T-Mobile G1, you can just use the UK version to upgrade.

I can confirm that you _have_ to reverse the cid, so in your case the conversion would go like:

03 53 44 53 55 30 32 47 80 70 1a d3 e0 00 91 68

68 91 00 e0 d3 1a 70 80 47 32 30 55 53 44 53 03

00 91 00 e0 d3 1a 70 80 47 32 30 55 53 44 53 03

Makes for you to copy & paste:

009100e0d31a70804732305553445303

And regenerate the goldcard...

Sidenote:

I've used mac to format the sd card and write the goldcard.

The commands where:

- Insert the sd card you want to use in your G1

- Boot

- Connect the cable to the macbook.

- Mount the sdcard on OSX

- Partly unmount the card in the terminal (so it still is available but not mounted):

diskutil umountDisk /dev/sdisk1

dd if=goldcard.img of=/dev/sdisk1

- Then after this just use the diskmanager to create a fat32 partition.

So the posts about having to have a Windows CE device, wine etc. are a bit confusing. All you have to be able to do is use dd to write the goldcard.img and just any software that will enable you to write a fat32 partition.

For everything else, just look at the very first post in this thread.

Although the URL's could maybe be updated, because they are still pointing to the RC8 release and there is allready a RC9 update available:

http://xdaforums.com/showthread.php?p=3219972#post3219972
[G1 Android Development] Hendrik212:
You made my day:)

Thanks so much.

Reversing the cid solved the problem.
[G1 Android Development] Pascal257:
OK I tried this with my G1 build 123099.

I got the CID using terminal-emulator and got this:

02544d534430384738c0070a48008c96 for my 8GB SD Card.

Then I reversed it and replaced the first 2 numbers with 00

008c00480a07008c73840343344d5402

I got my goldcard.img online and placed it onto my linux-machine.

I inserted the SD-Card into the G1 connected it with my Vista-PC and formated it fat32. Then I put it into the Card-Reader of my linux-machine and used dd to write the goldcard.img onto the card. Then I cped the DREAMIMG-RC7.zip to DREAIMG.NBH (or DREAIMG.nbh). After putting in the SD-Card into the G1 I restart it and start the flash. (CAMERA+POWER). It keeps telling me "no image file". I tried to format with linux, I tried the unreversed CID etc. It does not work for me. Maybe you see what I'm doing wrong.

/Pascal257
[G1 Android Development] rhalff:
You did copy the contents of the zip (which is DREAIMG.NBH) to the card right ?

Not something like 'cp DREAMIMG-RC7.zip <your_sdcard>/DREAIMG.NBH', because that is wrong...
[G1 Android Development] Pascal257:
yeah ok I suck hard...

Now it can read the image and keeps telling me "Not allowed".

I tried many goldcard.img (with 2 different CIDs (one from android and one from my cardreader). It didn't work yet.

greetings,

Pascal
[G1 Android Development] viperbjk:
No, it has been made out clearly that getting the CID only works using Windows Mobile 5.x/6.x device or via Linux on the Dream. WinCE (4.x) doesn't work. Getting the CID will NOT work using any external card reader (except professional ones).

Writing the image works with every tool that can write raw sectors beginning at 0x0 like dd.

Cya,

Viper BJK
[G1 Android Development] hazeline:
Failed to passby the not allowed

I downloaded the free version of QMAT and uses it to read my micro sd card id from my WM device and then i posted it to the free goldcard creater. I tried 1GB transcend, 4GB Toshiba and 8GB Sandisk. May i know what i am doing wrong here? Thank You. :)
[G1 Android Development] viperbjk:
You need to be more specific, what says the phone, how do you write the sd card etc.
[G1 Android Development] hazeline:
Oh hi, the phone just says not allow and sum number and it returns to the tri colour page. I did formatted the micro sd card before inserting it into to my htc touch, there is no problem reading the serial number out as after doing it twice, the serial number is the same. I would then remove the card and then place it into a reader to transfer the goldcard.img generated by the free goldcard app and the RC7 DREAIMG.nbh file. Lastly I would press the camera and the power button. My htc touch is app unlocked, it is running on wm 6.1. Thank you for your kind reply, I hope my problem could be solved. My firmware is stg-RC8.
[G1 Android Development] albertusman:
I have the same problem. maybe i should keep trying, but if somebody know, where is the mistake i probably do, tell me pls. I have tried downgrade to build for UK users because there is no for EU users. Would have been the problem in that?
[G1 Android Development] viperbjk:
You have to RAW write the goldcard.img and not just save it to the sdcard. Please read this thread, it has already been discussed several times.

Cya,

Viper BJK
[G1 Android Development] Max Littlemore:
I have been right through this entire thread and tried every combination. I'm still getting the "Not allow" message when I tried to load the image.

First off, here's what has worked in case someone with no access to a mac or windows pc is trying this. I have linux only.

Put the sd card into the phone

Use the usb cable to connect the phone to the laptop (the card reader in the laptop doesn't seem to format it properly).

Mount the sd card on the phone. Then unmount it on the laptop.

Format the sd card to fat32.

Unplug the phone

Open a terminal on the phone and run and run "cat /sys/class/mmc_host/mmc1/mmc1:*/cid"

Manually copy the resulting number to a text file on the laptop (could work mounting the phone on the lappy and copying, but I don't want to risk mucking with the filesystem on the sd card - does this matter?)

Here's where it gets weird. I have been using the free online goldcard generator (thanks Viper BJK) and using dd to write the bytes to the card and I am still getting "Not allow".

I have tried every combination of the bytes reversed, not reversed, first byte zeroed and last byte zeroed for both reversed and not reversed to generate the goldcard.

Anything else I might try? I'm a bit stuck.

FWIW, this is an FC8 phone bought in Australia.
[G1 Android Development] hazeline:
Thank you for finding out where i went wrong, however can someone teach me how to use Cygwin to dd the goldcard to my SD Card?:)
[G1 Android Development] viperbjk:
Only the first byte of the cid has to be zeroed. NEVER the last. There are only two possibilities what went wrong :

1. Wrong CID (sometimes linux messed CID)

2. You didn't write the image on the RAW sectors (reasons are: sda not unmounted, or writing to sda1 instead of sda for example)

Cya,

Viper BJK