yashsingh1/xdaforums huggingface dataset:
[G1 General] ch33syguy:
I've been looking to replace my Dream with something rootable, and in the process, came upon this (androidpolice.com/2010/04/28/htc-desire-root-instructions-apps2sd-now-live/) method for rooting the HTC Desire, which is incidentally the same method for rooting the HTC Legend, both of which have perfect SPLs. After downloading the included linux distro, and taking a peek inside the step1 and step2 scripts, I found something very interesting:

Step1.sh

echo Desire Root Step 1
echo
echo Erasing cache and rebooting in RUU mode...
echo
sudo ./fastboot erase cache
sudo ./fastboot oem rebootRUU
echo
echo About to start flash...
sleep 5
sudo ./fastboot flash zip testimage.zip
sleep 5
sudo ./fastboot flash zip testimage.zip
echo
echo Rebooting to bootloader...
echo
sudo ./fastboot reboot-bootloader
echo
echo Step 1 complete - now use the bootloader menu to enter recovery mode.
echo
echo To do this, press the power button, wait a few seconds, then use the volume keys and power button to select the RECOVERY option.

Step2.sh:

echo Desire Root Step 2
echo
echo Pushing required files to device...
echo
sudo ./adb push files /
sudo ./adb shell busybox --install /sbin
echo
echo Pushing update file to device sdcard - this may take a few minutes...
echo
sudo ./adb shell mount /sdcard
sudo ./adb push rootedupdate.zip /sdcard
echo
echo Now wipe and apply rootedupdate.zip from the recovery image menu.
echo
sudo ./adb shell /sbin/recovery &

I am new to all of this, but it seems that someone who knows their way around the OS a bit more could simply find out which files need replacing, and the same method could work for the Rogers Dream.
[G1 General] XBrav:
Yeah, I checked that out.

Basically, HTC puts a signature on all their files that, as far as I know, nobody has reverse engineered yet. If this signature fails, it can only be bypassed by disabling the security flag (which is what JTAG does). If you have an old HTC ROM, it will pass this check. However, there is a latter version check that checks the file's build version. If it is less than the current one, it fails. If you hex edit the version number, it fails the signature check.
[G1 General] ch33syguy:
The thing is, though, the Desire root bypasses the signature and version number checks somehow, otherwise you wouldn't be able to flash a rooted ROM.
[G1 General] XBrav:
If there's one unique thing between phones, it's that the Dream is always issued an NBH file in their RUU updaters. All the other phones receive signed .zip files. Here's what happens in my RUU USB mode with files that are and are not signed by HTC:

signed, but older:

Error 43 main version fail

unsigned:

Error 12 signature fail

These can both be bypassed if the security flag in memory is disabled. As far as I know, the other SPLs are letting the roms pass because people have acquired the overseas ROMs for their respective phones that have a newer build date, but the older SPL. After much research, no builds for the Dream are newer than 1.89.631.1. This is because every other carrier in the world (no joke) gives their users OTA updates.

As funny as it is, they disabled OTA updates on this build, however, the certificate files are still in the phone. The only way I can see us rooting via a new method is discovering a flaw in the kernel running on the phone. The kernel source files (Thank you HTC :) ) can be located at http://member.america.htc.com/download/RomCode/Source_and_Binaries/dream_9af60ed4.tar.bz2

I am by no means a linux expert, so I cannot invest the time to look for shell-level exploits to gain a root session.

I do have an idea on rooting, but first I need to obtain an HTC serial line to test.
[G1 General] ezterry:
HTC seems to have 2 archive formats for combining the partition images for an RUU update

1) the nbh files

2) zip files with a special header

both formats have an optional signature (required S-ON spls) in the first 0x100 bytes; Here is a signed version of the SHA1 sum of the rest of the file.

* the nbh file has offsets/CRC32 checksums/device its intended for/rom version/region in the rest of the header; followed by raw partition data

* the rest of the zip file is a zip file with a file for each partition included.. (the zip format includes CRC32 so no reason for HTC to add it again) a android-info.txt file contains the intended device/rom version/region ect

The SPL on the rogers dream can understand both formats.. but XBrav mentioned we know of no signed file with the correct device/version/access to root yet.. (region can be bypassed with gold card)

-------

Your Desire example is just manually flashing a partition zip file in the same way the rru application does.. the RRU they are flashing apparently is not rooted; however contains a recovery image with adb access to the recovery's root; from there they mount /system and inject the executables required to give the phone root.

Needless to say the rogers stock recovery has no adb access that I've found.. so I don't know how to do the same trick.
[G1 General] ch33syguy:
Damn, well thanks for the insight terry and xBrav. At least the Legend is only $350 outright from Virgin :P
[G1 General] ckong1:
anyone know where to buy a JTAG adapter for less than $71.95? That's not far from how much I paid for the phone.
[G1 General] asb123:
we need to purchase a 30day plan with the phone though right? so the cheapest it can come is $375

right? or can we buy it with no plan whatsoever?
[G1 General] lbcoder:
Costs about $0.15 -- all you need is a 74hc245 and some resistors.
[G1 General] kiziki:
Mtn htc dream/rogers dream

ok, so now i am desperate....

Through research, i found out that the phone is the same as the Rogers dream... so i hope this is an appropriate place to post....

i have read and read and followed instructions in all the forums that google can generate using different keywords and everything about the issue. so i have totally exhausted the options i got.(about 2 months now trying out different rooting methods...none have worked)

My phone is the SouthAfrican mtn HTC dream with the so called perfect spl 1.33.0010 SPL.

firmware version 1.5

baseband version

62.52s.20.18u_3.22.20.17

kernel version

2.6.27-9af60ed4

u70000@android-x01

build number

1.86.421.1 146733 cl#47295 release-keys

hboot info is as follows:

Dream PVT 32B SHIP S-ON d

HBOOT- 1.33.0010 DREA20000

cpld-4

radio - 3.22.20.17

jun 2 2009

ok now when i install flashrec, on the top corner it claims that my device is a

i hve tried the fastboot method of rooting, but my attempts end when cmd give a remote- not allow error

so i have tried using the method above. i have successfully installed flashrec, backed up my existing image, no problem. so at this point i am supposed to shut down the phone and reboot into recovery, by holding the home button when powering up.

i tried using the reboot into recovery using the button provided in the new flash rec but nothing happens.

when i restart the phone while holding the home button, the HTC DREAM logo comes up and just freezes there. i have held the button for up to 5 minutes, nothing, i have also left the logo on for almost half an hour and nothng seems to happen.

Please help me out anyone? this phone is pretty lame as stock especially for the amount you pay for it..
[G1 General] Tyler101:
porting spl's

couldnt someone just port an SPL from say like the Magic or something. because i suppose if we can port ROMs we can port SPLs. tell me what you think =)
[G1 General] beav_35:
Flashrec should say that your phone is 32A even though it it 32B. It says this because you have an EBI1 radio and incorrectly assumes that your phone is 32A. It should really say EBI1 instead of 32A.

You have a perfect SPL so the fastboot method of rooting will not work.

Flashrec will work on your phone unless the exploit that it takes advantage of has been patched. I have not heard of any providers patching 1.5 other than Rogers.

Try using this guide:

http://wiki.cyanogenmod.com/index.php/Full_Update_Guide_-_Rogers_Dream_EBI1_to_CyanogenMod

The hanging at the logo makes me think that your recovery is not compatible with your radio version. You need to use Amon_RA's "R" recovery for EBI1. (ex. recovery-RA-dream-v1.7.0R.img)
[G1 General] beav_35:
The "Danger" SPL is a port of a SPL from the Magic. The problem isn't that we need a SPL it is that we need a way to flash the SPL onto the phone.
[G1 General] kiziki:
Mtn south african dream rooted!!!!

I raelly need to give you a hug my friend!!!!!!!!!!!!!! thank you so much!!! you have ended my search for root after one and a half futile months... the problem was that i had been using the od recovery image version 1.6x!! apparently it is not compatible with the mtn dream!! MTN USERS BE SURE TO USE V1.70!!!! it works....:D:D:D:D:D:D:D:D:p

so now that i have root.. can you please tell me which roms are safe for the phone that will not brick it? cause i am told that the G1 roms might brick it.

PS :

i opted not to install the radio rom for now as the one i have has been working perfectly...
[G1 General] beav_35:
After you have your custom recovery installed you should flash your SPL. Then for a ROM I would flash the latest CyanogenMod with bcrook's port. Everything is explained in the guide that I linked to.
[G1 General] Tyler101:
So what you're saying is that we need to rewrite the file so that hboot recognized it as a newer file version so it will flash not knowingly downgrading the software? What about through stock android recovery like press alt+l to bring up the words then flash the update.zip? :D
[G1 General] kiziki:
Remember to do a full wipe before installing cyanogen

thank you so much. this process worked flawlessly with the correct recovery image. it seems that the V1.6 of th recovery linked to one of the wiki guides does not work with this phone. so if anyone else is having a similar proplem, ie your recovery mode does not open up and the phone freezes on the logo, try out the v1.7 recovery from the link provided in the earlier post.

also the slight hiccup i came across is that after flashing the new rom, it would not load and was getting stuck at the cyanogen startup where there are alot of colourful lines on the screen and it looped there.

this was fixed by doing a full wipe and then reflashing the rom.. hehe i thought i was half bricked!! but it booted after a wipe.

Happy flashing all of you!!

Last question to send me out of N00bville, i have radio 3.22.20.x and spl 1.33.2005 according to HBOOT. what must i look for when i am looking for a new rom to flash? can i flash any? or is there a guideline?

;)

thanx alot in advance!!!
[G1 General] lbcoder:
Having a 3.x radio, you need to use "EBI1" roms. Some roms come with optional ebi1 boot images -- this you would have to write separately from the rom itself.

Alternatively, you should be fine writing a 2.x radio to the thing (but NOT a 1.x!)

Note: use FASTBOOT and NOT RECOVERY if you want to write a new radio.
[G1 General] ezterry:
Just remember you must use fastboot to flash between 2.x or 3.x radio.img files (either direction)- as well as update the recovery image to match.. if the radio is in a zip file unzip the file.

(Well you can merge flash_image and an update.zip. .. but its easy to miss a step and brick the phone so please just use fastboot its easier and if you forget something with fastboot you can just try again)

If your wondering what is better.. from a Linux perspective it's the same.. and only trial and error will tell you which radio image is best calibrated to your carrier.
[G1 General] beav_35:
I would not bother flashing a 2.x radio unless you are having problems with reception or something. Why mess around with something that works just fine? You need to look for ROMs that are compatible with 32a old radio (3.xx). Most 32b ROMs have a port file that will make them work with 32a. Most ROMs nowadays (eclair) are based off CM and there really aren't many differences between them.

edit: What lbcoder said is correct. You do need EBI1 roms/ports but most of them are labeled as 32a "old radio". (ex. merlos SuperE port)
[G1 General] asb123:
http://xdaforums.com/showthread.php?t=634845

will help out a lot of you
[G1 General] kiziki:
Success

Thanx so much guys. this is just about the most helpful forum i have ever joined. i hold the same opinion as beav there as i get exceptionally good receiption with my 3.x radio and i dont want to mess it up i guess its the one thats properly matched for my south African carrier, so ill look for ported roms and check which one is best. again thank you so much. :)
[G1 General] TrainAss:
Ok, I'm a little confused and just want a bit of clearification. Was an HTC Dream with a "post-911 update" rooted?
[G1 General] XBrav:
Was this specific update rooted? No. There are currently no exploits that can give local root access.

There is a method that is unblock able, but involves some hardware hacking, disassembly of the phone, soldering, etc etc.

To put it simply, there is no "software-alone" root method for this device with the build 1.89.631.1

*EDIT*

That is no longer the case, though it was at the time of posting :)
[G1 General] TrainAss:
Ok thanks for clearing that up for me.
[G1 General] zerokenshin:
HELP!!

does anyone know where i can find a proper rogers htc dream rooting guide
[G1 General] XBrav:
How To Root Your HTC Dream

I wrote this one, enjoy!
[G1 General] TrainAss:
this should help

This may help you
[G1 General] canuckkat:
This is not true. I have root access on my phone that has the Rogers 911 update. I can't flash the "perfect" SPL for some reason, but other people have been able to and I definitely have flashed my recovery.

No JTAG required.

CyanogenMod guide: http://wiki.cyanogenmod.com/index.php?title=Full_Update_Guide_-_Rogers_Dream_911_Patched

xda thread: http://xdaforums.com/showthread.php?t=733128
[G1 General] XBrav:
Sorry, forgot to update my post. At the time, it wasn't rooted. Thanks!
[G1 General] twistedR:
Stuck while trying to exploid

I just got my hands on a Rogers Dream (Post 911 patched)

I have been trying to root it for quite a while now. But everytime I run

./exploid

from the adb shell I get the following message and nothing else

[1] + Stopped (signal) ./exploid

I read that I should just run the command again but when I do that all I get is

[2] + Stopped (signal) ./exploid
[1] + Illegal instruction ./exploid

or

[1] + Illegal Instruction ./exploid

I am running windows 7 64bit and cannot proceed until I run exploid.

Please Help,
[G1 General] Marco1999:
Hey,

I have exactly same trouble....so I tried a different exploid file, it at least runs for a bit then stops also......I don't think the exploid file is working on our phone.....hopefully we'll get help.
[G1 General] Droidzz:
Hey why don't you just do it the SuperOneclick way? I have a HTC Magic 32b, and i just recently rooted and flashed a custom rom on my phone (my first time) and i used that method and it worked perfectly fine. All you have to do is plug your phone into computer, and click root, and it does everything else by itself & boom you have root access. Hope i helped thanks :)
[G1 General] ezterry:
In part because if you ignore some details as most do when using super one click.. The firmware on the rogers dream (with an ebi1 radio) will cause the user to have a brick when they install something expecting an ebi0 firware.

There are ways to get superone click to work.. but that's only because it has exploid included.

Now since you have a 32b device with an ebi0 radio... and not a 32b device with an ebi1 radio please be sure you know what those potential traps are before giving advice.

Now to those having problems try:

1) reinstalling the e911 update from the nbh file

2) run exploid as directed on the xda wiki and make sure you provide all your output (ie copy both the commandline and error from the terminal/command window)

Also exploid never runs long, it just sets up the hack and exits.. usually if you unplug the usb wire, and plug it in again [this actually runs the exploit] you will be able to continue the process.
[G1 General] Marco1999:
Hey twistedR, I got it to work. I downloaded another exploid file and it ran perfectly, now I just have to find out which one it was as I have looked at too many posts. The size of the file is just over 11K and the root password is secretlol (if that helps)
[G1 General] Marco1999:
I think this is the exploid file....under preparations....part 3

http://xdaforums.com/wiki/index.php?title=Rooting_HTC_Branded_EBI1_Dreams
[G1 General] Biker1bob:
DRE210?? want AWS so I can use WIND

Hey all,

So I have a ROOTED HTC dream - I think when I rooted the guide I used from here returns the firmware to G1.

But my question is..

The Rogers handset from factory does not have the AWS bands available only the Tmobile G1

When rooted and running Cyanogen 2.2 do I get access to AWS? I have an AWS provider up here I would like to use the phone on?

Thanks

James
[G1 General] ezterry:
The physical radio and not the software determines the bands the phone supports..

If 3g or 2g seems slow after installing a custom rom you may wanyt to look ups some ro.ril settings in the build.prop to match your carrier.. but otherwise the phone will still use the same frequencies.
[G1 General] Biker1bob:
Thanks for the reply..

But I have seen else where where people say even after an unlock the ROGERS HTC DREAM cannot work on the wind network because it did not have the AWS Bands.

Now I have no idea if Rogers added 850/1900 to the radio? or removed the 750/2100 which is what I need... is there anyway to know?

I have been searching forums.. is there any place good to find all the network settings for wind?

I have the phone ready to try.. just need to figure out what I need to do to see if it works.. I need a phone really.. not data.. phone and txting is what this will be for.

James
[G1 General] ezterry:
An unlocked rogers dream will never work on wind mobile... Just as an unlocked t-mobile dream even running the rogers official firmware can never have 3g service on Rogers.

My point is it has nothing to do with the radio firmware or rom, it has to do with the physical radio for 3g is tuned to 850/1900MHz on the rogers dreams.. and wind mobile only has 1700 AWS. (Its likely the rogers dream can support AWS but it can't support 1700MHz)

Basically a Wind sim in the rogers dream will only roam on the rogers 2g network.

(Remember these are the bands for both data and voice, so just because you use voice only won't change things)
[G1 General] esmith:
There is NO border fee if it's marked as a GIFT and technically IT IS a gift.
[G1 General] i<3andr0id:
I have to disagree with that. I have bought MANY high priced electronics that have to cross the American/Canadian boarder and have asked them to be tagged as gift. They ALWAYS get hit with duties.
[G1 General] AverageCanadian:
I am still crossing. I meant the fee the Canadian side charges me to get back into Canada :) $3.75 I think.

edit: I don't mind eating some of the cost like the border fee, and if need be driving to T.O./Hamilton, I just don't want it to add up to too much which is why I think the $620 USD is a good amount. I might end up making a few dollars or eating a few dollars depending on exchange rate and shipping cost at the time. I just want to make sure it's not going to cost me too much.
[G1 General] i<3andr0id:
lol, you shouldn't have to EAT any costs. no one should be out any money other than those of us who have donated. We're doing this as a community effort, so yes 620 USD is a good amount.
[G1 General] haykuro:
If you'd like I can toss in a bit of money for gas / food? How much are you looking at in those subjects?
[G1 General] esmith:
Your literally the ONLY person I have EVER heard of having to pay duty on a GIFT...

Sucks to be you in that aspect...

I send stuff all the time and never once has either side had to pay.... must be a certain amount or something...
[G1 General] i<3andr0id:
*puts on his best AverageCanadian voice*

Well, I like to eat steak. Sirloin, really. Drenched in caviar.

I also drive a car that gets .5 km per liter.

so.....

*god i'm bored*
[G1 General] i<3andr0id:
yes, I suppose it does.

Also, must be difficult not to be able to comprehend the fact that we have already decided that we are sending this package domestic U.S. Must "suck" as well.

btw, would you rather risk getting haykuro hit with taxes?
[G1 General] AverageCanadian:
lol, yeah what you said...

No but seriously I think the $620 USD should cover all expenses. We'll know more when the total gets closer to $600. The Canadian dollar has fluctuated a fair bit in the last month so it will depend on that. If haykuro can do a EMT after he's recieved the phone instead of paypal that would save ~$18 USD, however I'm not positive that you can send an EMT from a US bank account to a CDN customer.
[G1 General] SpEnTBoY:
Ok people we need to get the word out to keep this momentum!! WE all know we're interested, now we need other people who we might know to join the forum or at the least, contribute to the cause!!

TELL YOUR FRIENDS!! (with Rogers HTC Dreams) :p
[G1 General] SpEnTBoY:
Just as a heads up, I show replacement costs of the phone to be $649 CAD ... any chance whoever is buying the device can get us a better deal? ... maybe if we got $620USD there would still be enough left over to easily cover travel/food/peoples time? Just curious. I'd hate to think anyone would really have to 'eat' any costs as well (I know it was mentioned earlier) ... this is just testament to how the Open Source and 'like minded' communities can pool together!!

:D I'm get'n all misty over here :p
[G1 General] i<3andr0id:
I bought my HTC Dream from Best Buy out right, without contract for 599.99 + tax (677.98)

AverageCanadian and I are trying to find posts and stuff so that we can explain to other people on other forums who Haykuro is, what root does, and why they should want to donate.

I've PM'd H. so that he can "blow his own horn" concerning his accomplishments, but I doubt he'll see it as he mentioned last time his unread PMs were at 111. Anyone who can help provide the information we're looking for, please PM me or post to this thread.

gettin' all misty eh? hehehe.
[G1 General] esmith:
I've shipped two phones to the US from Canada in the last month, both that were gifts and marked as gifts and no one got charged any taxes...

Anyways someone is doing something wrong if anyone ever had to pay taxes on a gift that's mailed... and it's not me since the receiver has never been charged anything.

Moving on.... how much money are we at now?
[G1 General] i<3andr0id:
you are the jesus of sending things across the boarder. all hail.

current rogers fund: $256.83

source: www.twitter.com/haykuro
[G1 General] haykuro:
Maybe if we spread the word to more AT&T users it could get interesting.. ;)

if we got it rooted, AT&T users would be happy as well (unlocked, you can use the 3G bands, so we can be looking at the first rooted AT&T supported android device :))

current funds: $285.66 USD .. $324.03 CAD (according to http://www01.wolframalpha.com/input/?i=$285.66+USD+=+?CAD)
[G1 General] i<3andr0id:
I'm sure it would! Thing is, it's a lot to throw at someone. You'd have to explain spectrum for 3G that T-mobile uses, that Rogers uses, and that AT&T uses.

Even when you did that when they realize that they would be donating to get the phone to you, they'd ask why. We'd have to explain root and what it does, yada yada yada...

At that point they'd probably, or would have already asked do I need to root it to unlock it? Answer is no, imei is all you need to unlock. Just like the T-mobile G1.

If anyone wants to go ahead and post in AT&T forums I'm alllllll for it, but it just seems like A LOT of explaining and from my experience when you have to explain a lot and then at the end you say "donate" people are a little leary.:(

We're pretty much half way there and it's been only a few days right? I think we can do this. Someone needs to hop onto other android forums. Maybe I'll do that now.