yashsingh1/xdaforums huggingface dataset:
[myTouch 3G, Magic Android Development] Jrbourque:
you would try to flash the nbh files or the ruu files. gold card works its our imgs or files that we are trying to flash dont work
[myTouch 3G, Magic Android Development] ScottC:
T-Mobile and HTC obviously put a lot of effort into having this thing locked down. ****ty move if you ask me :(

With the possible exception of tethering, there really isn't any other reason for them to do this.
[myTouch 3G, Magic Android Development] zambezy:
Is there any way to change the file version... Can some one open the RUU or NBH and read it... Even if it is fake version just higher than the curent one on the phone...

We need to find a way to flash any image on there just to get the SPL open....
[myTouch 3G, Magic Android Development] Jrbourque:
what do you mean change file version? at this point its not really possible to play with the imgs or anytihng because then we have to resign it and we dont know how to sign with release keys
[myTouch 3G, Magic Android Development] zambezy:
To what extent does the key signiture protect the file. It is just algoritmic representation of certain values in the file its self. Yes if the version section is part of that encription then it would not work but who knows it might be a back door...

I think that is how they cracked the original HTC Touch... It updated the SPL first with unlocked one.

The question is how much of that file is locked down by the encription key. I dont have any of the files right now but I guess that is where the efforts need to be. You will not find a clean entrance in that SPL if they locked it down.
[myTouch 3G, Magic Android Development] aron7awol:
The entire NBH is hashed and signed. There would be no reason to exclude the SPL from the hash.
[myTouch 3G, Magic Android Development] victortung:
I can try any nbh right?
[myTouch 3G, Magic Android Development] Jrbourque:
sure not saying it will work lol
[myTouch 3G, Magic Android Development] zambezy:
Does anyone have the 0006 SPL for the 32B board...
[myTouch 3G, Magic Android Development] boosted22:
first let me say that the work you all do is great. I have been following this and the other root threads here on xda since I preordered the Mytouch. I got into this not too long ago when i heard about the hero rom on the g1 and got that done with the help of the tutorials here on xda. anyway i just did some searching and i am sure that you have all already seen this but just wanted to put it out there just in the event that it was overlooked or missed. would this in anyway work for the Mytouch?

http://kuba.fm/tag/flash/
[myTouch 3G, Magic Android Development] zambezy:
It seems to be the normal Fastboot method that is described here.... It would not work on the perfect SPL's

Has anyone attempted to flash using the HTC tool? not the ADB command shell.
[myTouch 3G, Magic Android Development] :
nope...this is the perfected spl that sufferes from complete lockdown until further notice. the magic root that was provided previously only works on "non-perfect" spls......
[myTouch 3G, Magic Android Development] Amon_RA:
I think that it's not only the perfected SPL but also the S=ON, so a combination of both. I'm almost sure that a perfected SPL with S=OFF can be flashed with a goldcard. The S=ON/OFF is not part of the radio nor the SPL.
[myTouch 3G, Magic Android Development] :
yessir... that is correct, although, if you watch that hero rooting video floating around on youtube, its got an S=ON spl and they can still boot the mod'd recovery image...ODD>......
[myTouch 3G, Magic Android Development] XsBones:
Surely this hope for rooting.
[myTouch 3G, Magic Android Development] Evervoid:
I really hope it's possible to root the mytouch, I just bought mine today and thus I'm hoping to get access to this side of the world with it too.
[myTouch 3G, Magic Android Development] Jrbourque:
I think they still have their fastboot tho
[myTouch 3G, Magic Android Development] wicked_beav:
I just got a myTouch 3g and it is my first Android phone, so I am new here. I was a WinMo user previously. Now I have a question the Rosie/Sense UI... is the only way to get it by a custom ROM, I know we don't have root yet but I'm wondering if that's the only way. The reason I ask is just like on WinMo, TouchFlo has been ported to other devices, couldn't the Rosie/Sense UI just be ported as an app to install over Android? If, not what would the reason be why we wouldn't just be able to install it as an app? Like I said I am new to Android, so the inner workings aren't as familiar to me as WinMo.
[myTouch 3G, Magic Android Development] Smokuevo:
first of all this is about rooting the device and not about what u can have.. and you can install hero rom once its rooted. u cant just add the rosie UI on top of google build of cupcake. u need a complete hero(htc build rom)
[myTouch 3G, Magic Android Development] zambezy:
Looks like some one has been able to override the 0006 SPL...

It would be interesting to see if the Rooting procedure would work now.
[myTouch 3G, Magic Android Development] aron7awol:
No we just moved from .0006 perfect SPL to .0007 perfect SPL. We aren't there yet...
[myTouch 3G, Magic Android Development] mykenyc:
So basically this is living proof that gold card works 100 percent so like everyone is saying we need to upgrade to a non-perfect spl and we're good to go.
[myTouch 3G, Magic Android Development] zambezy:
So the 0007 Is Perfect SPL also..

Can you fake the SPL version in the file its self and down grade to 0004????
[myTouch 3G, Magic Android Development] aron7awol:
We know that the downgrade protection is controlled by the device, not the SPL, so we can forget about downgrading.

All known 1.33.0006, 1.33.0007, and 1.33.0010 are perfect SPLs.

All known 1.33.0008 and 1.33.0009 are SPLs that support fastboot.

MainVer 1.88 ---> SPL 1.33.0006 (MyTouch stock)

MainVer 1.89 ---> SPL 1.33.0007

MainVer ???? ---> SPL 1.33.0008 ???

MainVer ???? ---> SPL 1.33.0009 ???

MainVer 2.17 ---> SPL 1.33.0010

Notice a pattern? Doesn't it seem possible a ROM exists with a MainVer > 1.89 with a 1.33.0008 or 1.33.0009 SPL? We better hope so...
[myTouch 3G, Magic Android Development] zambezy:
I know that the system would not let you downgrade but if the system is seeing a file with 1.89,0007 It would let you flash it even though it would be an older file 1.8x,0004. Its just a mater of finding where in the file that information is held and what checksums are in place to verify it.

compare the 0006, 0007, and 0004 files in hex editor and see what areas differ and we can concentrate on those...
[myTouch 3G, Magic Android Development] aron7awol:
This is not directed solely at you, zambezy:

Guys, please stop suggesting we modify NBHs or anything inside them. We cannot modify any of these. If we change anything, we need to re-sign. We cannot re-sign. We don't have the release keys.
[myTouch 3G, Magic Android Development] texasaggie1:
Please Upload! :)

Hey, if you got it, please upload it. I will try to manually flash it.
[myTouch 3G, Magic Android Development] texasaggie1:
Can't we do all of that using QMAT?
[myTouch 3G, Magic Android Development] :
no qmat is not a substitute for having release keys....
[myTouch 3G, Magic Android Development] texasaggie1:
:)

Thanks for the clarification
[myTouch 3G, Magic Android Development] Amon_RA:
Downgrade is controlled by the S=on/off.
[myTouch 3G, Magic Android Development] zambezy:
If we can not modify those files we cant get different SPL. I dont see how this will be possible in any other way.

Is it possible to get the S=ON/OFF changed in any way...
[myTouch 3G, Magic Android Development] aron7awol:
The only way this is possible is to find a ROM with a MainVer > 1.89 with a 1.33.0008 or 1.33.0009 or other fastboot SPL.

We don't yet fully understand what controls whether a device is S=ON or S=OFF. I can't say yes or no, but if I had to guess, I would say no, we can't change it (easily).
[myTouch 3G, Magic Android Development] Amon_RA:
S=ON/OFF is probably a setting in the Qualcomm chipset, just like the frequency bands. These can be changed if you have the necessary tools (it's probably just an AT command).
[myTouch 3G, Magic Android Development] zambezy:
It seems to me that such rom doesn't exist and would not be released...

The fact the TMO is not doing any updates to their phone is scary because it would be outdated in few mounts when Dounut comes out.

I might just return my phone and buy Rogers Magic and go to ATT.... I might be able to cancel my contract. If TMO can play these games Im not going to give them my money.
[myTouch 3G, Magic Android Development] mr_black03:
I am not super excited about this but you cant say that tmobile is crap and go over 2 AT&T do you realize how much they screw ppl and this is not the only time any carrier has tried to keep a user from modifying a phone...can you say iPhone? VZW and AT&T are the worst in this department tmo is usually a bit more liberal w/ their hand sets, pretty much once an exploit is found they will not patch it. They cant release a phone that is completely open. No carrier in the US has or will, its the american way.
[myTouch 3G, Magic Android Development] mykenyc:
Yea glad i got this for free hopefully its hacked before the bb 9700 come out or im going to replace this :( .. i love android but had it for 3 wks so far and getting bored i love to hack my phones...
[myTouch 3G, Magic Android Development] Jrbourque:
anyone happen to know what spl is dropping with hero?
[myTouch 3G, Magic Android Development] texasaggie1:
If it's an AT command

If it's an AT command then we could get root, right? Security=off means the spl can be flashed, correct?
[myTouch 3G, Magic Android Development] aron7awol:
1.76.0004

See here: http://myandroidblog.wordpress.com/2009/08/03/htc-hero-root-access/
[myTouch 3G, Magic Android Development] :
so do we have any other plausible options? im ready to go...mytouch in hand....
[myTouch 3G, Magic Android Development] rockin_mod:
I second

I second this except i have a baby on the way so i can only get ya'll $25. I'm down for the ppl, thank you all. And hey can we not have arguing here please. Let the immature be immature and the mature just laughing :D
[myTouch 3G, Magic Android Development] :
right, ... now... what can we try to root ideas??
[myTouch 3G, Magic Android Development] jashsu:
Same idea as how RC33 was rooted back in the day... find someone who works for a HTC repair facility to leak a MyTouch-compatible NBH file with root access. Most likely candidate would be a Google Ion NBH.
[myTouch 3G, Magic Android Development] :
you know anyone Jashsu? I started a thread about finding an ION nbh but its gone cold...
[myTouch 3G, Magic Android Development] Jrbourque:
i talked to haykuro and he said if we can get that it will give automatic root and ive posted on AC and tmobile forums lol nothing
[myTouch 3G, Magic Android Development] Jrbourque:
would this help? scroll down and it has google ion images not sure if its what we need tho

http://andblogs.net/2009/05/ion-update-available/

edit.. nvm dont think thats what we need
[myTouch 3G, Magic Android Development] terminatorxman:
SDK ADB does not recognize my mytouch

SDK ADB does not recognize my mytouch.

My ROOTED G1 is recognized but my mytouch 3g shows device not found error?? Is there another driver???
[myTouch 3G, Magic Android Development] :
not sure if the signed ion update would be accepted by mytouch, willing to try...standby.

did not work, ota is signed by test keys, as the ion is a dev phone. question now arises....if the otas are signed with test keys, wont the NBH also be signed with test keys? if so the ion NBH would not work to reflash the mytouch....dam.........
[myTouch 3G, Magic Android Development] Jrbourque:
patiently waiting
[myTouch 3G, Magic Android Development] Jrbourque:
do you have the ion nbh or you just try to flash an update?
[myTouch 3G, Magic Android Development] :
just an update. but speculating that the nbh would be test key signed as well....
[myTouch 3G, Magic Android Development] rockin_mod:
any one look at Jrbourque's post with the links to the ion image?? Is it just an update?? If so why would we not be able to implement this?? I opened it up and looked around. One contains the recovery img. Ne one have an idea??
[myTouch 3G, Magic Android Development] :
scroll up and read my post about this. ION = DEV PHONE thus ION = SIGNED WITH TEST KEYS - no retail mytouch is signed with test keys - if it were we would have no problem flashing any rom. mytouch is signed with release keys which we dont have.
[myTouch 3G, Magic Android Development] Jrbourque:
If we have an original system dump of ion does the nbh in there?
[myTouch 3G, Magic Android Development] Breakthecycle2:
I have someone with Ion that will give us the system dump...my ONLY problem is..I have no idea what to tell them to do...lol. Can someone tell me?
[myTouch 3G, Magic Android Development] Jrbourque:
dude give me on second and i will have that for you
[myTouch 3G, Magic Android Development] Jrbourque:
message me on gtalk jrbourque898@gmail.com
[myTouch 3G, Magic Android Development] mykenyc:
i thought the system dump wouldn't work as stated on this thread?
[myTouch 3G, Magic Android Development] Jrbourque:
the update that was trying to be used was a rooted update with hacked keys. This will be the system dump of a non rooted ion. im not sure if the recovery img is in there or not but its wouldnt hurt to have it
[myTouch 3G, Magic Android Development] Dave RL:
I've tried looking at the fastboot program:

http://xdaforums.com/showpost.php?p=4291483&postcount=124

to see if there are any SPL commands that could change the security or other settings.

I was hoping that someone else had looked at what low level SPL commands are available.

(Pulled these off of the 1.33.0009 HBOOT-7201A SHIP H )

If you browse through the binary SPL you see error messages for commands like:

writebcid: Parameter Error
writemid:
writeserialno:
write config index:0x%x, value:0x%x
write pattern to ram:: addr=0x%X
Setting security bit failure

Looking through the lists of data in the SPL this looks like it could be a list of commands understood by the SPL:

ram_test
jump
sdtest
eraseconfig
writeconfig
readconfig
writesku
readsku
rflash
tflash
erasesd
btrouter
tick
heaptable
emapi
emapiTest
emapiCountryID
emapiWlanMac
emapiSetDefCal
emapiReadCal
lr
imgcrc
resetautoimage
resetRUUflag
writeserialno
readserialno
battcheck
gotofastboot
writemid
usbtestmode
eraseWifiFlash
powertest
erase
readmbserialno
listpartition
writebcid
readbcid
fmrouter
eraseEeprom
wifiDisarrayEeprom
keytest
heap
reset
powerdown
rebootRUU
task
[myTouch 3G, Magic Android Development] rockin_mod:
Have you tired ne of these commands yet? When I get home I will. Seems interesting thou. Nice!!
[myTouch 3G, Magic Android Development] Dave RL:
I think we would have to change the fastboot program to call queue_action(OP_COMMAND,... with those commands.

We would also need to figure the number and type of parameters each command takes.

I also wonder if the QMAT program allows you to send commands directly to the SPL.

If you do try any of these I would proceed with caution as some may easily brick your phone.

I will be trying this if I can sometime this week.
[myTouch 3G, Magic Android Development] majaz:
Don't know if this will help but anything is worth a try now!!

Ok I'm completely new to the android platform but from all the reading this is what I get. You need the keys from HTC because in fastboot it can't be rooted. For some reason the phone itself is locking you out from S=OFF?? It seems maybe there's some type of resistor for that type of rooting to me. Maybe a way to bypass that like they did with the psp in actually modding the battery. Like I said i don't know anything at all about android but I'm definitely looking forward to a rooted MT3G!!! I've been surfing the net and I dont know if these links will help at all but here goes.

http://www.htc.com/www/support/android/google-io-device.html

http://www.getyourdroidon.com/wiki/index.php5?title=OTA_/_Un-Root_/_Official_Builds

Again I am new so no bashing me please. I really hope maybe you can find some helpful info somewhere soon!!
[myTouch 3G, Magic Android Development] NguyenHuu:
true, BUT he isnt getting an iphone and he isnt going to verizon, he getting a magic and using it on at&t so it dont matter about the others trying to screw him. even so, the iphone is hackable and jailbroken. unlike the mytouch which isnt able to do anything yet regarding modding. so he does have a valid point about what he said.

then why would you consider a blackberry? they are farrr from being hackable haha. good business tools yes, but since you say u love to hack ya phones, BBs should be at bottom of ya list.

sorry to be off topic haha.
[myTouch 3G, Magic Android Development] mr_black03:
I understand what you are saying, but ALL phones where unhackable for atleast

some

time, this phone has only been officially released for 6 days...its killin me inside a lil everyday, but i dont soley blame tmo, they are just kinda flowing the "unwritten rules" but IMHO they are the most lax.
[myTouch 3G, Magic Android Development] zambezy:
Can some of the big DAWGS chime in on this discussion and let us know if there is any progress in this.
[myTouch 3G, Magic Android Development] phreeq:
I'm holding out hope that they aren't chiming in because they're busy making progress...
[myTouch 3G, Magic Android Development] l3wish:
Amon_RA

:)
[myTouch 3G, Magic Android Development] waacow:
Are you saying Amon_RA confirmed that they rooted MyTouch?? I hope you're not kidding !!
[myTouch 3G, Magic Android Development] NguyenHuu:
that is amazing! check out his twitter to confirm it! http://twitter.com/Amon_RA
[myTouch 3G, Magic Android Development] juanavila:
I'm excited, and new!
[myTouch 3G, Magic Android Development] n3ro:
excellent....i wonder how long til a build. . .
[myTouch 3G, Magic Android Development] fearlless:
soon im sure! =P
[myTouch 3G, Magic Android Development] n3ro:
apps to sd ftw!
[myTouch 3G, Magic Android Development] team selfesteem:
Congrats to Amon_RA and company, MT3G users like me have been waiting for root for weeks! Not anymore, it seems :D.

I hope those instructions come soon. The things I would do to my MT3G.....
[myTouch 3G, Magic Android Development] xelapr:
wooohooo root!!!! hope the instructions come out soon...waiting for a while for this...thanks for your hard work and all you guys that help make this happened....:)
[myTouch 3G, Magic Android Development] lesjaw:
I hope this Root will worl for HTC Magic 32A..

Great Jobs...
[myTouch 3G, Magic Android Development] _illmatic_:
Amazing! I was on pens and needles waiting for root.:D
[myTouch 3G, Magic Android Development] savethechicken:
Haykuro just posted this link in twitter with instructions on how to do it.

Root MyTouch
[myTouch 3G, Magic Android Development] _illmatic_:
^^^ AND THERE OFF!!! Which ROM to choose now...
[myTouch 3G, Magic Android Development] Das_mobile:
Thank you all for your work with this phone! Can't wait to root mine.
[myTouch 3G, Magic Android Development] Amon_RA:
This Thread can be closed now.

Instructions can be found here
[myTouch 3G, Magic Android Development] californiarailroader:
What is Gold Card? I've flashed plenty of WM HTC devices, but this is new, is this something unique to Android?
[myTouch 3G, Magic Android Development] Mi|enko:
No. There've been goldcards for WM devices as well.
[myTouch 3G, Magic Android Development] wardobuffalo64:
I am new to this goldcard business, can someone help me with this. I have a mytouch tmobile. Terminal Emulator doesn't seem to work with the mytouch, any solutions? Thx for the help...
[myTouch 3G, Magic Android Development] mykenyc:
wow i should have never doubted anyone we all have the potential thanks guys no bb for me it is then!
[myTouch 3G, Magic Android Development] curveconcepts:
Go into the terminal emulator, hold down the menu key. The onscreen keyboard will show up. Then you can go from there.
[myTouch 3G, Magic Android Development] tzitzu:
htc sapphire

because the first post was about Jtag i got 2 pics few days ago

the testpoints for j-tag (all 7) can be observed very near the qualcom cpu

i didnt find the order of them yet but i'll do my best

br

http://img22.imageshack.us/i/dsc01299x.jpg/

http://img97.imageshack.us/i/dsc01300w.jpg/
[myTouch 3G, Magic Android Development] tzitzu:
i got the j-tag and the quallcom tool but well i don't have the phone for tests animore , as soom i will get one i'll start make test if i have free time , till now a brick G1 can be done

br
[myTouch 3G, Magic Android Development] Senacharim:
JTAG is a device for programming microprocessors (I do this at work). The bootloader is the very first thing a processor runs, which instructs it to everything else which will be run--like recovery console or user interface. Theoretically, if you have a JTAG and enough information about the processor/board pinout/effing everything you COULD finesse a replacement bootloader onto anything which runs via microprocessor.

But doing it right requires tons of information to which most of us do not have access.
[myTouch 3G, Magic Android Development] Breakthecycle2:
I don't have my phone with me. Can you hit me up on AIM? Breakthecycle2
[myTouch 3G, Magic Android Development] mykenyc:
oh ok slowly learning the whole android business hence my nub-ness, i thought recovery's was in all android phones?
[myTouch 3G, Magic Android Development] Jrbourque:
oh its all good, i have alot of newbness to or this would be rooted lol. but i think the recovery image should be there. lets hope so
[myTouch 3G, Magic Android Development] jashsu:
Don't bother trying to install anything but an officially signed updater in the recovery. This route has been gone over repeatedly in the past in the Dream forum by a ton of RC30 users before the RC29 NBH file was leaked. Bottom line is: until the Ion NBH file is leaked (or by some miracle you get a hold of the htc ota-keys), mytouch users who want root are sol. :p
[myTouch 3G, Magic Android Development] Jrbourque:
if we get a system dump of an ion that is not rooted does that help?
[myTouch 3G, Magic Android Development] Jrbourque:
and would this help out at all?

http://xdaforums.com/showthread.php?t=485364

or the recovery image from here?

http://www.htc.com/www/support/android/google-io-device.html#s3
[myTouch 3G, Magic Android Development] jashsu:
Possibly, if QMAT were to support Sapphire. Contact the developer and ask.

Nope. Recovery images (update zips) check the properties of the device before applying. Will not apply unless you have an Ion build installed already. System images require fastboot, which is only present in Engineering SPLs.
[myTouch 3G, Magic Android Development] donovanbrock:
Do we not have fastboot? :confused: I back+power my phone and get the SPL ->

SAPHHIRE PVT 32B SHIP S-ON G

HBOOT-1.33.0006

CPLD-10

etc...

And I run "fastboot devices" and get

HT96RP305928 fastboot
[myTouch 3G, Magic Android Development] Jrbourque:
have fastboot just cant fast boot imgs

edit....I have also messaged the dev from the other thread that i posted earlier, and will wait for a response back to see if we can use that method or not.
[myTouch 3G, Magic Android Development] Jrbourque:
and would the system dump from ion be useless then?
[myTouch 3G, Magic Android Development] DeToX-cz:
Hey everyone. Jrbourque bumped me into that so I'm now working on that. I hope solution will be soon, I just need to do some research (because I dont have MyTouch/Magic). So, wait for it guys ;)
[myTouch 3G, Magic Android Development] mykenyc:
thanks this is so appreciated here..and I'm pretty sure by all these threads you will have a lot of beer and cupcakes from donations...:D
[myTouch 3G, Magic Android Development] mr_black03:
I have a mytouch that I am willing to test on...
[myTouch 3G, Magic Android Development] DeToX-cz:
I found something. More updates on my twitter @detoxcz. It's faster to update ;)
[myTouch 3G, Magic Android Development] DeToX-cz:
Ok, just finished the tutorial, JrBourque will test it and after then I will write it there! (If it will work of course!)
[myTouch 3G, Magic Android Development] :
i can test too. let me know.