yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] jmanley69:
qmat hasn't been updated in a loooooong time (thanks china!) have you tried yang from the link I posted? If it's not up to date, you should be able to modify the source to work for your device.
[Droid Eris Android Development] chuckz07:
Compiling NBH for android. This is how I've been trying it...

Download QMAt 5.06 This version only runs for 10 minutes at a time, but is plenty of time for what you need to do.

Goto Firmware Forensic/HTC/NBH Create Tool

Look to the right of the screen and you will see a selection mark box that says 'Generate Android Image', check that.

In the pull down menu above that I've been choosing 'MAGIC' as the device. There are only 2 android devices in the list. Dream being the other on.

The process for the files, and you will see this, is very simple. Make sure you have the rom.zip unzipped somewhere for easy access. It is pretty much fill in the blank.

I just found out all the phone data (Lower right corner) can be changed manually. So I tried on my last attempt and it seemed to have taken. But I did get a signature error and installation failed. I feel that this is a closer step, because the amount of time before the fail was increased prior to the first nbh I built. Anyway...

Press the 'GENERATE NBH' button to create. It will ask for a file name, I've been using 'PB00IMG.nbh' as the name. (Make sure the 00 is zero zero, earlier I made the mistake of using OO as in OH OH)
[Droid Eris Android Development] chuckz07:
No, trying without
[Droid Eris Android Development] chuckz07:
No but I will go look at that right now. I feel as though I need something here, and of course a slight break from this. So, the reading there wouldn't hurt for knowledge
[Droid Eris Android Development] binny1007:
Can you upload the one that failed the Sig check and I will try it on my gold card
[Droid Eris Android Development] jmanley69:
I think the whole point of making an nbh, is to use it with a goldcard.
[Droid Eris Android Development] chuckz07:
Ok, I'll upload hang on
[Droid Eris Android Development] chuckz07:
Here you go. Just unzip and install to SD. Boot into hboot. This is only the recovery.img from the MR1 Update rom. It is a starting point you could say.
[Droid Eris Android Development] chuckz07:
Very valid point. My head hurts from all this in the past couple days. I still have my GoldCard readily available on another SD. But binny can try what I uploaded and we can go from there.
[Droid Eris Android Development] jmanley69:
Also... if you're not worried about bricking your phone, you could install the hardspl which should allow you to load the nbh. It may brick your phone because it may be written for the G1 only... I really have no idea... I'm just throwing that out there for ya.

I saw that Best Buy is offering the Eris for $50.00... I should go get one just so I can help you guys and then return it within 30 days.
[Droid Eris Android Development] rigamrts:
spl's are really risky lets just get past the sig check. no need to sacrifice a phone.
[Droid Eris Android Development] jmanley69:
That may be the point.... I don't know much about goldcard, but it seems like the point is to install a valid ROM with a different CID. If that's the case, it still has to be valid and HardSPL bypasses the signature check.
[Droid Eris Android Development] chuckz07:
Alright, so I built yet another NBH using the recover-RA=Hero 1.5.2 and flashed using my gold card. It failed the signature check too! I won't throw my phone but I'm gonna go find the cat!
[Droid Eris Android Development] chuckz07:
Seems I can't type right either.
[Droid Eris Android Development] binny1007:
Did not work with the gold card.
[Droid Eris Android Development] chuckz07:
Can anyone tell what the .nb0 file is used for in the rom.zip?
[Droid Eris Android Development] chuckz07:
I wonder how hard the next android device is going to be to crack?
[Droid Eris Android Development] binny1007:
well either i am not doing somthing right or its just not ment to be. I have been trying all morning and no luck, i am pretty sure that if we could downgrade to a lower bootloader than we could at least flash a recovery image and get root that way, like i said worst case I screw up my phone and take it in and get a replacment. I think I am screwing up the gold card creation, i dont have a sd card reader so i am doing it all with the phone attached, if some can try this out that would be great if not i think i am tapped out for ideas. And from what I understan if you make the gold card right than you should be able to downgarde to any rom, it bypasses all checks. look here

http://xdaforums.com/showthread.php?t=572683

I dont know its just a idea, i think this may be our best bet for now, and the bootloaders should be the same in theroy it just might change your device id. But if we get root than once a RUU comes from verizion than we should be able to to flash back if needed.
[Droid Eris Android Development] Videofolife13:
Do me a favor and post the steps/commands/ everything you are doing and maybe that'll make it easier for me to help out
[Droid Eris Android Development] binny1007:
I am following the instuctions to make a gold card to the letter, everything seems to work fine instead of flasing the GSM rom, i am using the Sprint rom.

It starts to flash and than it gets to updating signiture and boom

DEVICE ID ERROR!!!!!

So either I am not able to make the "gold card" right, or it does not work, cause the way I understand it, is if I make it right than i should be able to flash any rom. Or maybe this is only for GSM. any thoughts
[Droid Eris Android Development] Videofolife13:
Device ID Error makes sense. That exploit, from what I understand, only uses different Hero bootloaders. Ie. if you used it on the Dream, you couldn't flash a Hero bootloader. Maybe it's working here in a similar way.
[Droid Eris Android Development] binny1007:
yea I just read that the "gold card" does not bypass hardware checks :( so back to the drawing board....

Does anyone know of a way to downgrade the bootloader on a cdma eris or hero? i think all we would need is to flash back to a older version of HBOOT. Also I am trying to get ahold of the VZW RUU I was told that the reps in store have a copie of it, so i might go in there and see if they will hook me up with a copie. But I am not holding my breath. Unless anyone who works at a VZW store wants to share?
[Droid Eris Android Development] binny1007:
i dont know if this helps or not but i found this today?

http://www.tsirogiannis.com/uncategorized/linux-kernel-2-42-6-sock_sendpage-local-root-exploit/

and

http://securityreason.com/exploitalert/7071

could any of these work
[Droid Eris Android Development] binny1007:
one more

Linux Kernel 'pipe.c' Local Privilege Escalation Vulnerability

http://securityreason.com/exploitalert/7444

I dont really know what i am looking for so could somone tell me if i am on the right track?
[Droid Eris Android Development] Videofolife13:
A different idea... I'd like to know what the Hero users have set as the value of their /proc/sys/vm/mmap_min_addr. Is this not the file that the asroot2 exploit relies on? Please, someone, shoot me down if this totally incorrect.
[Droid Eris Android Development] Videofolife13:
So, here's the deal: Maybe I'm onto something, maybe I'm just an idiot. From what I understand about the asroot2 exploit, is that the vulnerability has been patched on the Eris as well as the Cellular South Hero. It seems that the only thing standing between us and a root is the file mmap_min_addr which can be found in /proc/sys/vm/. I believe that we can do an EXTREMELY simple work around to achieve root.

Step 0: Open up terminal (Mac or Linux) or a Command Prompt (Windows) and cd into the tools directory of your sdk

Step 1: Pull mmap_min_addr via adb

adb pull /proc/sys/vm/mmap_min_addr dump

This will put mmap_min_addr into a folder "dump" on the root of your computer

Step 2: Copy the file and rename the copy something else, so you have it as a back up. Open it in a text editor and change the number to 0 in the original file.

Step 3: Push it back onto your phone.

adb push (Location of edited mmap_min_addr. If you did the command prompt above, it should be "/dump/mmap_min_addr" without the quotes, of course) /proc/sys/vm/

That should overwrite your current mmap_min_addr.

Step 3.5: If it doesn't copy over, delete mmap_min_addr from /proc/sys/vm/ and then push your new one.

Step 4: Run the asroot2 exploit and pray.

Now, if this doesn't work, I encourage you to push your original file back to the phone. I don't think that this will cause any adverse effects, though. I will try this out tonight when I get a chance, but it won't be til midnight, more than likely. Good luck to ya'll.

-Video
[Droid Eris Android Development] binny1007:
how would i delete the the file it wont let me copy it
[Droid Eris Android Development] binny1007:
Never mind I figured it out and I get permission denied. Is there any other way to replace the file?
[Droid Eris Android Development] binny1007:
Double post
[Droid Eris Android Development] Videofolife13:
Crap. I can pull files from the folder, but can't push them. And we're stuck...

Edit: Standard Linux users can use a command called "echo" to edit files that are normally read only, like this one. Does Android have anything similar?
[Droid Eris Android Development] binny1007:
Check this article out which shows some ways to bypass the nmap_min_addr mitigations

http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html

maybe this could help?
[Droid Eris Android Development] Videofolife13:
Good literature, but I have absolutely NO idea on how to execute it.
[Droid Eris Android Development] binny1007:
hahaha me niether my linux now how is slim to none, im just good at searching the net.
[Droid Eris Android Development] Videofolife13:
Edit: So, I did some more searching. Here is what I found:

"In case it isn't obvious what kind of security I'm talking about: You don't give an interactive shell CAP_SYS_RAWIO, but rather give a program CAP_SYS_RAWIO and give principles permission to execute the program. The program should exploit the capability only to do very specific things, and might do some further permission checking, maybe based on which device you're accessing. Or, give a daemon process CAP_SYS_RAWIO and send it socket messages. The daemon authenticates you and does your bidding only against devices you are authorized to do raw I/O to."

So it seems to me that we need to just edit the asroot exploit to include CAP_SYS_RAWIO and then it won't matter the value of mmap_min_addr because it over rides it. :) Hopefully I'm on the right track here... Anyone that can help/point out my mistake, it's appreciated.

-Video

Btw: I hope there aren't any hardcore linux/android users out there checking in on this thread and laughing at us. Haha
[Droid Eris Android Development] binny1007:
Well if there are I hope they chime in and tell us if we are on the right track. And how would I modify that on a Windows pc?what programs would I need?
[Droid Eris Android Development] binny1007:
Or could we use that to push the mmap_min_addr from the Sprint Rom or the one we made with the null address? From what you stated it sounds like it might be possible, again I am not sure how to do that but its just a idea.

i made a new thread in the Development section to see if we can get some more help here is the link

http://xdaforums.com/showthread.php?t=587952
[Droid Eris Android Development] binny1007:
Help finding a way to root the Eris

So the current method does not work we have established that, and it appears that between Videofolife13 and I we my have found somthing that would help. But i think the problem is that we are not linux experts, so can some developers chime in and give us a hand with this, maybe help with compling and i would be more than happy to test things out. Allright so here is the link to the blog post

Bypassing Linux' NULL pointer dereference exploit prevention (mmap_min_addr)

http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html

It explains a possable way to get root using CAP_SYS_RAWIO and i think this is a example of the code http://www.grsecurity.net/~spender/exploit.txt

Here is what Videofolife13 found

So can anyone help with this, I mean this may be a way to root all devices after they patch the hole that is currently being used, so i guess all if this works it would help us all. Allso is there a way to push the older version of (mmap_min_addr) like the one from the sprint rom, without root, or a way to edit it on the device?

Thanks for the help

Mike
[Droid Eris Android Development] jmanley69:
You don't want to use that one... it won't load on your phone anyway. That one has the kernel from the GSM Hero.

The Recovery I gave you is Amon Ra's 1.5.1, but with your kernel... when you finally get into your device, use the recovery I gave you and you'll be golden.
[Droid Eris Android Development] chuckz07:
Ahh Hah, trying again then. This time I'm back to the whole thing and not just the recovery
[Droid Eris Android Development] rigamrts:
depends if they leave a big gapping hole like they did with the droid then not hard at all. if they lock it tight like they did the eris they huston we got a problem
[Droid Eris Android Development] jmanley69:
like I said before... Linux will NEVER be air tight. it's just a matter of time to find the hole... or until somebody gets the right SPL on the phone... or some disgruntled HTC employee signs the update... or whatever. Just a matter of time.
[Droid Eris Android Development] chuckz07:
Tried a few other things with nbh, all left me with the droided middle finger.
[Droid Eris Android Development] chuckz07:
Maybe we need a Platinum Card?

Just a little off track humor to calm the atmosphere
[Droid Eris Android Development] ataranine:
Nah I hear the Master Card can do ANYTHING.
[Droid Eris Android Development] rigamrts:
we could allway get amex plum card and really do what we want till the bill comes in LOL!!
[Droid Eris Android Development] binny1007:
Here is another website for exploits

http://www.exploit-db.com/
[Droid Eris Android Development] rigamrts:
now i can fark with my friends pc with all these windows expliots
[Droid Eris Android Development] binny1007:
Did we try this one allready and if not could somebody compile it for us.

http://www.exploit-db.com/exploits/8673
[Droid Eris Android Development] rigamrts:
that an old milw0rm.com exploit might be patched.
[Droid Eris Android Development] jmanley69:
This would work, you probably have to do some fixup to it though.

You may be able to modify the payload, but you need to have the correct machine language code to create a shell on the ARM processor.

also... analyze the code... it writes a c file and compiles it. Your phone has no compiler, so you have to do something else here (like remount system, copy sh to su, chmod su, remount system).
[Droid Eris Android Development] rigamrts:
ahhh been looking at these expliots for a while. i'm starting to see the things your pointing out.

your talking bout the shelcode in the begining right? because the rest looks like php code to output responses.
[Droid Eris Android Development] chuckz07:
I'm at the point now where I am frustrated. I am starting to throw everything I can think of at my device now and nothing is working. Basically I am learning this whole process as I go, so I believe that is why I am getting frustrated. I know very little, and it is starting to show (migraine kicking in). Quite honestly, I can't be assured I am building the nbh correctly unless someone who knows for sure can look at it and say it is right. Atleast I haven't bricked it...yet!
[Droid Eris Android Development] chuckz07:
I believe cmonex or olipro could be of some help here. If anyone knows them personally, or can be in some sort of contact with them, they may be able to add some insight to the nbh ordeal. If I am not mistake, I got the qmats program from one of olipro's threads he started.
[Droid Eris Android Development] apreichner:
I think you might have more luck starting a thread in the Dream/G1 forum. The problem is, creating NBH files for Android devices is so much more complicated than cooking up an NBH ROM for a Winmo device. So I think our first order of business is to try to get an extracted Hero ROM NBH, which I haven't been able to do since I've been running into errors extracting. If anyone has anymore luck on this front let me know. Otherwise, I think we should try shooting a post in the Dream forum. I realize it is the wrong forum, but I think the more seasoned Android developers use that forum. Also we could try the main Android Development forum.
[Droid Eris Android Development] chuckz07:
I'll take a crack at the hero nbh and see what I can come up with
[Droid Eris Android Development] binny1007:
ok guys i just made and flashed a nbh file, with the origonal hboot. now my question is there a way to change a .img file to a .nb, i used duty's nbh tool and took the hboot file from the vzw rom, romoved the 0 off the nb0 and made a nbh, than i put it in the ruu and it flashed it fine, maybe if we can get the recovery.img into a nb than it might work. i attached the file for you guys, or is there a way to modify the hboot that came with our devices to allow us to flash unsigned roms?
[Droid Eris Android Development] chuckz07:
Try this...Just remove .zip at the end.
[Droid Eris Android Development] chuckz07:
Binny, couple of questions.

1. How did you create your NBH? Different from my way?

2. Are you profient in Linux? Do you have Linux readily available? I ask because from what I have been reading, the ruu.exe should be able to be successfully extracted using linux.
[Droid Eris Android Development] binny1007:
no i am not good at linux, i do have ubuntu installed on my laptop but like i said i am no good at linux. and it said it flashed, its just how can i tell? im in recovery mode and there is somthing new i can scroll with my trackball. and like i said i used dutys good nbh tool to make it. I need a custom update to see if i can now flash from the recovery menu.
[Droid Eris Android Development] chuckz07:
What do you mean 'there is something new you can scroll with your trackball'? If you are referring to the menu in 'blue', you could always use trackball (only way to select actually). Did this menu automatically appear, or did you have to press 'HOME & END' to get the menu?
[Droid Eris Android Development] binny1007:
here is the nbh i used. you sould be able to drop it in the ruu and flash away, but i think i may have found a way in, my device froze on the htc screen while flashing and i tried some fast boot commands and the seemed to work. so this is going to be my next thing to try.

start the official ruu

let the device reboot into bootloader

than kill the ruu from running

than try like hell to use fastboot commands to push a custom recovery to the device.
[Droid Eris Android Development] binny1007:
haha i allways used the volume up and down keys to select what i wanted, so maybe it did not work.
[Droid Eris Android Development] binny1007:
here this is what i used

inside there is a htc rom tool and you can change all info for our phone

http://xdaforums.com/showthread.php?t=296311&highlight=nbh*
[Droid Eris Android Development] chuckz07:
Well, I'll be able to play with your nbh but not until later this evening. (That sucks) I have to be somewhere soon.

Xmas list to Santa:

I WANT ROOT!!!
[Droid Eris Android Development] rigamrts:
we won't be able to do any custom flashing till we get a custom recovery on there. your on the right track tho keep up the good work but atleast your nbh is not middle fingering you.
[Droid Eris Android Development] chuckz07:
Thanks, now I don't have to find it. I'll read this, atleast what I can, before I have to leave. Maybe getting away for awhile will help me think better.
[Droid Eris Android Development] chuckz07:
Yeah yeah yeah:)
[Droid Eris Android Development] binny1007:
ok guys i got somthing big i just dont know what cammands to use but if you do what i said before and kill the ruu after it rebots i think we can us fastboot commands to flash.... i need some help here. i think i found our way in..... I HOPE...
[Droid Eris Android Development] chuckz07:
I saw a list of fastboot commands somewhere, for flashing...uhgghh
[Droid Eris Android Development] binny1007:
if what i am thinking is correct than i have just found a hole that we can use, when it goes to flash it reboots to a screen that we dont have accses to, only the ruu has accses to it, so we may be able to use this to flash our own img to the recovery partition. but i need some help here anyone who has some command line knowlage as my sucks, thus would be why i am not good at linux.
[Droid Eris Android Development] chuckz07:
http://xdaforums.com/showthread.php?t=596879&highlight=fastboot

Halfway down the first post, maybe this will help you...maybe! Atleast for the commands anyway
[Droid Eris Android Development] binny1007:
what should i try first.... i did "fastboot flash recover rcovery.img" and it returned "cannot load recovery.img"

commands:

update <filename> reflash device from update.zip

flashall flash boot + recovery + system

flash <partition> [ <filename> ] write a file to a flash partition

erase <partition> erase a flash partition

getvar <variable> display a bootloader variable

boot <kernel> [ <ramdisk> ] download and boot kernel

flash:raw boot <kernel> [ <ramdisk> ] create bootimage and flash it

devices list all connected devices

reboot reboot device normally

reboot-bootloader reboot device into bootloader

options:

-w erase userdata and cache

-s <serial number> specify device serial number

-p <product> specify product name

-c <cmdline> override kernel commandline

-i <vendor id> specify a custom USB vendor id

-b <base_addr> specify a custom kernel base address

C:\AndroidSDK\tools>
[Droid Eris Android Development] chuckz07:
Is the recovery.img in your 'TOOLS' folder? I believe that is where it needs to be, or on SDCard. Sorry, my brain is in shambles right now.
[Droid Eris Android Development] 27s:
Which recovery image are you trying to use and where are you placing it?
[Droid Eris Android Development] binny1007:
it gets stuck here
[Droid Eris Android Development] chuckz07:
And I would type in 'adb devices' first to make sure it is seeing your device.
[Droid Eris Android Development] chuckz07:
Remember what someone said earlier in the posts. Use the recovery provided somewhere in this thread. 1.5.1 is the one, 1.5.2 has diff kernal
[Droid Eris Android Development] chuckz07:
Well, I'm out of time. I'll be back later to provide some more useless (uhhh, full) information. Good luck binny, and all!
[Droid Eris Android Development] binny1007:
im using two one this one boot recovery-RA-heroc-v1.5.2.img and the one that jman made earlier.

I have tried this command "C:\AndroidSDK\tools>fastboot boot recovery-RA-heroc-v1.5.2.img" in normal fastboot and it allways returns with a error. So this is why i think we are getting close cause now it is working..... kinda

And I am putting the recovery files in the tools folder in the sdk
[Droid Eris Android Development] binny1007:
when in fastboot you use "fastboot devices" and it sees my device
[Droid Eris Android Development] rigamrts:
1.5.2 is the gsm kernal it will not work with the eris 1.5.1 is the cdma one
[Droid Eris Android Development] punk.kaos:
Ok, I know how to get it into that mode without having a gold card.

Get a terminal emulator and run 'reboot oem-78'

This got me into fastboot mode, and 'fastboot devices' shows my phone.

I'll try booting a recovery.img and see what I get!

EDIT: tried it with the PB00IMG.zip and got

fastboot boot PB00IMG.zip

creating boot image...

creating boot image - 2052096 bytes

downloading 'boot.img'... OKAY

booting...

but then it hangs.
[Droid Eris Android Development] ataranine:
How long after it started hanging did you wait?
[Droid Eris Android Development] rigamrts:
the zip binny is using is 1.5.2 it won't work with the eris. there is a 1.5.1 that is cdma that's what we need to use. i'm no good at nbh stuff but trying to learn my nbh's keep giving me the finger binny is on the right track cause his nbh passes the sig check.