yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] jmanley69:
and cheese... right? ... definitely cheese! (not making fun... I LOVE cheese...)

Seriously.... cheese.
[Droid Eris Android Development] binny1007:
Ha ha me too and my girlfriends parents own a cheese factory :) yummy cheese....
[Droid Eris Android Development] zifnab06:
jmanley69: The file we'd need is /etc/fstab. Only problem is, we don't have one. Everything happens in init.rc.

/system/etc/security/otacerts.zip has a file named releasekeys.x509.pem. What is this?

Just so everyone knows, this is the output for ls in /system/bin. All these commands can be run as root, if we can find a command that doesn't require root to run.

dumpcrash
am
dumpstate
monkey
itr
pm
input
svc
ssltest
fillup
dhcpcd
linker
debuggerd
hostapd_cli
logwrapper
ping
sh
hciattach
logcat
sdptool
servicemanager
dbus-daemon
debug_tool
dvz
flash_image
hcid
htclogkernel
mountd
installd
qemud
toolbox
radiooptions
hostapd
id
ifconfig
iftop
ioctl
kill
insmod
ln
log
mkdir
ls
lsmod
mkdosfs
mount
mv
netstat
notify
printenv
ps
reboot
rmdir
rm
renice
rmmod
route
schedtop
setconsole
setprop
sendevent
smd
sleep
sync
stop
start
top
umount
vmstat
wipe
watchprops
cat
chmod
cmp
date
df
dd
getevent
getprop
dmesg
hd
netcfg
dumpsys
playmp3
service
sdutil
rild
dalvikvm
dexopt
surfaceflinger
app_process
mediaserver
system_server

Edit - something kinda funny for you guys. I was playing around with my "phone" when I got a # terminal. I didn't understand what was going on, got really excited, tried remounting /system as rw, and IT WORKED!

I thought i had it rooted. Then I realized the emulator for the sdk was still running. Posh.

Another note - besides my stupidness. jmanley: The file that controls the sdcard is called mountd. Its a daemon that sits there and if a card is present, it mounts it. The .conf file is in /system/etc/mountd.conf.
[Droid Eris Android Development] zifnab06:
I have one last idea. How would we go about mounting the internal flash on an external machine? Mount the eris's flash memory on a linuxbox?

Thanks.
[Droid Eris Android Development] jmanley69:
Yeah... I saw the /etc/fstab also.

Too bad mountd.conf is under /system... that's ro, so we can't do anything with it like I would want.

Anything in /proc ?
[Droid Eris Android Development] jmanley69:
Sure... if you build a jtag.
[Droid Eris Android Development] binny1007:
Here is something fun to try, I got really excited for a sec... well when I said make a batch file what I wanted to do was try and push the custom recovery right at the moment it unzips the stock recovery thus over writing the stock and bypassing the Sig check. What happend got me so excited for a bit. I rebooted to oem and than did flash Rom.zip opened another cmd window and had flash recovery recovery.zip, Rom.zip failed the first time so I ran it again and it started flashing just when it was about to flash the recovery I pushed the custom one, and all of the sudden the comands that were out putting from the flashing jumped from one window to the other window.... I thought It worked. But nope.... if you want to try it its pretty cool trick but that's about it, just a trick.
[Droid Eris Android Development] zifnab06:
jmanley: from what i've seen with jtag's, it would involve destroying the phone :( I'm guessing there isn't a way to do it through the port on the bottom of the phone :{
[Droid Eris Android Development] jmanley69:
If done correctly, jtag will not destroy your phone. It will certainly void your warranty (rooting does not do that) since you have to disassemble your phone.

Also, the first few times of trying to find the exact right configuration (without a diagram from HTC) for the jtag... you could most certainly fry your phone. If your voltages are off, or you aren't using a buffer on your communication port then you can fry your phone... So... when I say "if done correctly" basically what I mean is... If HTC gives you a cable, or the specs to make one exactly correct, and you have the correct tools to open your phone, and the program to interface with the jtag.... you can do it very easily. But.... If you had all that... You'd be working for HTC, and you could sign your own custom update to root your phone.
[Droid Eris Android Development] 87jason:
So I will take it we have hit a brick wall...
[Droid Eris Android Development] redman213:
I hate those...
[Droid Eris Android Development] 87jason:
So what do we do now not to be impatient or anything...
[Droid Eris Android Development] apreichner:
Pray... And possibly make religious sacrifices on the altar of Eris Root.
[Droid Eris Android Development] 87jason:
I will sacrifice this stray cat that keeps sneaking in my garage and sitting on my car at night...
[Droid Eris Android Development] chuckz07:
Getting ROOT after buying the ERIS wasn't a guarantee in your contract. If you are getting impatient, that is something you will have to work on. ROOT is being a PITA right now. How do you think the one's who are actually doing the leg work feel?
[Droid Eris Android Development] apreichner:
*Goes back and looks at contract* ........ Crap you're right.......
[Droid Eris Android Development] 87jason:
Well I have been tryin everything I can but have come up with no better results then everyone else. That is why I haven't posted any results no reason to take up space and I know there was no guarantee in the contract to be able to root this isn't my first throw down with hacking a phone ...
[Droid Eris Android Development] ataranine:
So no one ever told me if the build.prop file could be of any use..
[Droid Eris Android Development] jmanley69:
No brick wall yet... you guys were supposed to be waiting to hear from Amon-Ra about the SPL. right? somebody PM'd him?
[Droid Eris Android Development] binny1007:
Yup no brick wall I acually think that we are doing pretty good we will get this thing rooted eventuality... Google is you friend, just keep searching and keep trying new things.
[Droid Eris Android Development] jmanley69:
If nothing else... you guys are learning everything you can about your phones so when you finally do root them, you'll be more of an expert than mots people with android phones.
[Droid Eris Android Development] markachee:
careful with the "fastboot oem" commands... somehow i botched access to my sdcard playing with it...

Though I guess it could be unrelated. Off-topic so I don't want to try to diagnose this too much in this thread, but just since I mentioned it: Getting a constant "Removed SD Card" notification. The data seems to be there because I popped it in my camera and could get to the DCIM directory, but nothing else. Put a different card in the phone and still just the notification. That's what makes me think I've just disabled it somehow playing with those commands.

Edit: ha... if you played with the oem enableqxdm command and can't access sd card, here's the fix:

adb shell reboot oem-78
fastboot oem enableqxdm 0
fastboot reboot

though I have some interesting "qxdm_[timestamp].dm" files on my sdcard now... from what i've seen i guess it's radio debug messages
[Droid Eris Android Development] punk.kaos:
Sweet, I'm glad you posted that. I realized this morning that my SDcard wasn't working, and hadn't yet related it to playing with the qxdm command. :)
[Droid Eris Android Development] wasupwithuman:
1st. I have a hero not a eris, but i was thinking.

not sure if anyone has tried this but you guys do have the official update from verizon, right? I take it you all have tried to modify it to flash something else in which it detects that the zip has been changed and it errors.

but what if the signature on the update is connected to the size of the update? so when you guys change the update with your own stuff its a different size then what the signature says it will be. have you guys tried to modify the update but keep it the exact same size? maybe create dummy files, so that it comes out to be the same... once again not sure if anyone has tried it, but yeah...

sorry if i sound stupid...hahaha
[Droid Eris Android Development] rigamrts:
there a file check for oversized files in the ruu but mainly we have a sig check problem. if you look in one of my post one of the ruu error codes is a filesize check errors 155 -159 image flie size larger than flash rom size but i think that's mainly a ruu check not a phone check cause rom updates always get bigger so filesize is not the only defining factor. but it's a thought.

i also think cause it scans the header files and a few other checks before installing there might be info we're missing when we create our custom roms.
[Droid Eris Android Development] 87jason:
this is just a thought but dont some of the themes, or theme programs that you have to have to run themes. do they have any kind of root access beings that like ahome allows the sreen to go to landscape while on the homescreen. its just an idea cause if they do like ahome works on multiple well about every phone and if they have to to have root access would there be a way to find out how its able to do that just a thought.
[Droid Eris Android Development] binny1007:
Anybody look into super cid it seems like a pain but it may work, here is the link and yes I know its for gsm but I guess the source is inclued so we could modify it for our device.

http://xdaforums.com/showthread.php?t=559806
[Droid Eris Android Development] binny1007:
Is it possible to change the sha1 digest on a file, and if so how do you do it, prefably in windows? Or if you know how than let pm me. I have a experiment I want to try.
[Droid Eris Android Development] zifnab06:
To answer a couple of questions i saw earlier:

The rom.zip is signed by HTC's Privatekey which is RSA. Meaning its hard to break. And its dependant on the SHA1. So, changing anything in the rom.zip file or update.zip file mean we'd have to resign the image, depending on the new SHA1, with HTC's privatekey. Mostly, it won't happen.

The phone checks all .img files before they are flashed. So, even if we did manage to get a rom.zip or update.zip to upload to the phone with the RUU, we'd still need to have the image file signed. Which we can't do. Becuase we'd need the privatekey.

Binny: THe SHA-1 is completly dependant on what is in the file. The best way I can think to explain it would be if you had a barrel of different foods. You could show someone the barrel, and say this is what I have, or you could right down a brief summary of whats in the barrel, and show them that. The sha-1 is the second one. If you change anything in that file, it looks at it and notices something is different, ergo a new sha-1. (http://en.wikipedia.org/wiki/Sha-1 explains it alot better than I could).

So, unless we can make a new file, which has the exact same sha1 as the original (which, theoretically is possible, but its entirely more likely that you will be runover by a monkey driving a carriage pulled by a teamof elephants next time you cross the street), that route is out.

Oh ya, and +rep to anyone who can find me a carriage driven by a monkey pulled by elephans ;D
[Droid Eris Android Development] zifnab06:
Woops, double post. I'm on 256k for a while, its really slow and I thought it might have died. As I said, woops :D
[Droid Eris Android Development] binny1007:
Boo is there a way to spoof it or modiy it with like a hex editor
[Droid Eris Android Development] zifnab06:
The phone recalculates it with every file it uses, hashes it against the privatekey, and checks to see if it matches the value in META-INF. The reason autosign didn't work, its designed for the engineering-bootloader, which checks agianst a key we have. If we had the privatekey,, it would be easy. But we don't.

So, we'd have to change the phone's recalc method. Which we can't do without root :(
[Droid Eris Android Development] zifnab06:
Edit again -

Sorry for the double posts. I think my network is having some packet loss problems :( It seems like I'll post something, and it'll won't post. So I'll hit post again. And then, a while later, I have two posts. I'll start reseting things and seeing if I can fix it. I'm on winter break, and our internet at home is only 0.25MBPS.....way too slow. Boo.
[Droid Eris Android Development] zifnab06:
You are a genius of sorts. I'll start working on it.

<rambling>

I'm going to go into some stuff here. Just some thoughts related from what I know of iPhone hacking (thanks go to geohot and the dev-team, most of this I picked up from you guys and your various blogs/twitter posts/etc)

The iPhone has a mode called "DFU". The thoughts are either Device Firmware Upgrade mode or Debug Firmware Upgrade mode. It wasn't well documented, but it works well for downgrading. During this phase, the iPhone checks to see if the firmware is valid. Using some RAM hacks, they found a way to disable the firmware checks, allowing their modified firmware to be loaded. Essentially, breaking the phone out of jail (jailbreak). They used this before the appstore to install apps, and after the appstore to do the same. There was one thing that you'd have to do to upload your custom firmware, called "pwning" (bad terminology imo). It was the process to mod the nvram and phone itself to allow custom ispw's to be installed.

I'll look into the serial cable. If its debug, we might be able to mount a drive over it in linux, and mod what we want. Its just a thought. The other thing we might be able to do is drop our own payload somewhere on the phone (preferably /system/bin) that would run itself as root (all other drives but /system are mounted with a nosuid (i'm assuming no super user id, so root can't be established from there). Or just follow the link above and remove security :D

Who knows. </rambling>

edit - AT commands in that post! They look familar! YAY!
[Droid Eris Android Development] markachee:
Back to the buffer overflow idea someone mentioned a while back.

The "fastboot oem" command seems to pass the trailing parameters on to the phone to process. I figure if this part is written by HTC, maybe it has some vulnerabilities of its own. Just playing with what little I know about buffer overflows...

This is using the "fastboot.exe" that came with the (in this case, Sprint) RUU. And I'm using all zeros as the "command" to send.

First of all running "fastboot " followed by a large number of characters (i tried up to 1024), does as expected, which is to give the list of valid commands.

Running "fastboot oem " followed by:

up to 59 characters gives "Command error!"

60 characters causes something somewhere to hang.

61 - 83 characters gives "(command too large)"

84 or greater... haven't figured out the pattern here. Sometimes you still get "(command too large)". Sometimes fastboot.exe immediately crashes. Sometimes you get "waiting for device" and then it crashes. Sometimes you get "waiting for device" and it just hangs.

I don't know much about buffer overflow exploits, but I would think 60 is the magic number where an overflow may be happening on the phone itself. Also I think that when fastboot.exe crashes it's an overflow, but on the PC side of things, so doesn't really help us.

At the same time, there may be a way to overflow something without going through fastboot.exe, but I couldn't find any "fuzzers" (google it, i had to, ha) that were for hitting a connected device. They were usually either file or network based.

Not sure if there is really anything to go on here or not. May try to learn some more about it later and see if I can keep going with it.
[Droid Eris Android Development] zifnab06:
So, I just realized something

When we made the goldcard, the SIMLOCK option showed up. It asked for an AMSS when we ran it in the fastboot bootloader thingy. Can someone look into what an AMSS is? In the post with the hero security stuff, it has somethign talking about SIMLOCK. Usually, I would see that and assume it was just talking about a lock placed on the phone so a certain carrier's sim would be the only one that would work. Now i'm wondering if it is something else, like the security system on the phone.

???

Just a thought. Lets look into what AMSS is next.
[Droid Eris Android Development] markachee:
the "rtask" command looks familiar too. it's an option under "fastboot oem"

I can't have my phone off right now but what if we boot into oem-78, and then run "fastboot oem rtask b" and see what it does.
[Droid Eris Android Development] jmanley69:
the fastboot daemon source should be in the android sdk... shouldn't it?
[Droid Eris Android Development] jmanley69:
Try the command, and see if the regular fastboot in the android sdk works to boot the phone off of your own image (after "security" is disabled)
[Droid Eris Android Development] tkirton:
It's a DesireC (CDMA Desire). Someone's Flashboot dump actually says that (it's somewhere in this thread...)
[Droid Eris Android Development] apreichner:
I did a little investigating for you. Apparently AMSS is the Baseband Firmware. And apparently in the OS Update it should have a couple folders. (Source) Also check the replies on that post, there seems to be even more information regarding to fastboot and replacing images using it.

amss

cache.img

kernel

recovery

system

After that I did a quick Google search on Baseband firmware and came up with this forum post, which seems to be filled with info on it.

Sorry I can't be of any further help as I do not own the phone, and I'm not as smart as some of these people here.
[Droid Eris Android Development] rigamrts:
actually i knew at the time i wrote that the bootloader said desire i just did not want to give someone bad info at the time cause i was not sure. then someone else while i was writing either before or after my post said it was the desire. i just said it was a hero like device to be safe.
[Droid Eris Android Development] chuckz07:
Just out of curiosity, does anyone know how to create or even re-create a RSA+SHA1 key?
[Droid Eris Android Development] punk.kaos:
Sure, Openssl under Linux can do it. And there's a key util in the SDK, though I don't remember where off hand. I'll look it up in a sec.
[Droid Eris Android Development] rigamrts:
rsa is private key encryption so cracking htc's rsa is impossible without thier key.

here's a google search for sha1 genorator

http://www.google.com/search?hl=en&source=hp&q=sha1+generator&aq=1&oq=sha1&aqi=g10
[Droid Eris Android Development] chuckz07:
Thanks, while waiting for an answer I went searching and reading. It was only after posting the question that I realized the SHA1 can be basically 'gotten' with a simple program. But the rsa, well different story. Again thanks, I am going to read what you linked me too anyway!
[Droid Eris Android Development] chuckz07:
Twas a few nights before Christmas...and me all snuggled in my bed, while visions of 'ADB SDK string codes' danced through my head. As I rose from my bed to see any new posts, I prayed in the seasonal spirit..."LET THERE BE ROOT"!

Sorry guys, just boredom at work here.
[Droid Eris Android Development] zifnab06:
The fastboot IS in the google source. The problem is, all of the oem commands are written by HTC. So, its not in the source. Its undocumented.

I'll look into the simlock stuff at some point later in time.
[Droid Eris Android Development] rigamrts:
thier using the sha1 for cataloging of the img files. when the phone checks the sig it also check the sha1 to make sure the img files are the right size and correct date. so if we inject our recovery.img when the phone checks the sha1 it give an error cause the file does not match the sha1. sha1 is easily defeatable that's why they use the rsa private key to make us work for our root. LOL!! i use md5 in my wow server and other private servers i have so hackers can't just walk in and change thing easily it's not perfect but does the job.
[Droid Eris Android Development] markachee:
This is what I assumed, but honestly haven't looked at the source yet. Will when I get a chance to switch over to ubuntu.
[Droid Eris Android Development] apreichner:
Motorola Cliq Rooted Now

I don't know if anyone has seen this or not, and I don't imagine any of this will work for us since it uses ADB and asroot2. But here's a link.

http://androidforums.com/motorola-cliq/23270-rooting-anything-everything.html
[Droid Eris Android Development] markachee:
Ahhh, I had heard Cliq root was close but didn't believe it. But that link is an old thread that went no where. I think the site is getting hit pretty hard right now but here is actual link:

http://demoshadow.com/forums/viewtopic.php?f=5&t=61

Will be looking into this to see if it or a variation of it will work for us.
[Droid Eris Android Development] markachee:
Looks like they were able to flash a recovery image using Motorola specific software, RSD Lite.

So nothing we haven't been trying to do already. RSD Lite must not require any kind of signature. Just looks like they were waiting on a good recovery image.
[Droid Eris Android Development] binny1007:
So not to beat a dead horse but there is no way to make the custom recovery img have this sha1 key, cause I think that is all it checks when applying a update zip in recovery mode.

Name: recovery.img

SHA1-Digest: A8citNuMrUIbz+Y+vclZ5WjqM5o=
[Droid Eris Android Development] apreichner:
Oh thanks for the fix. I heard from a friend that they rooted it so I tried looking around.
[Droid Eris Android Development] tkirton:
I understand. It's been a source of debate within the Sprint Hero community. Actually, if I read further into the posts, I would've seen someone else answered this question.
[Droid Eris Android Development] chuckz07:
I hope someone is around to answer this? There is an 'otacerts.zip' on our phone. Can this be helpful? How can we copy it out of the phone to look at it?

Location: /etc/security

Well, I just emailed it myself from the phone
[Droid Eris Android Development] chuckz07:
Just in case it could prove useful...Like I said I found this on the phone under /etc/security...

File inside zip is 'releasekey.x509.pem'. Someone please say this is good news, or did I cream my pants for nothing?
[Droid Eris Android Development] apreichner:
That's the location for the update signature check I think... Although removing this has been discussed here: http://android-dls.com/wiki/index.php?title=Preventing_OTA_Updates and that will just prevent you from installing the update. Maybe if it could somehow be modified to allow us to use a different update, although I'm not thinking this will work without RW access, which we wont have without root.
[Droid Eris Android Development] chuckz07:
2 thought her:

1) Build NBH using this key...Really doesn't have to be NBH, can be zip too mayebe?

2) Maybe there is somewhere else on the device (folder) where we can unzip it to that would read it when installing something
[Droid Eris Android Development] apreichner:
1. Well if you are modifying an update, it wont be an NBH, the NBH is just for flashing from SD card using Goldcard. If you managed to modify it to pass sig check, then it would theoretically work. Although, this sounds like we need an exploit to gain access to the filesystem, in which case, we might as well just push SU in there.

2. I don't think there is, from the research i've done, but I could be wrong.

EDIT:

Now I see what you mean. Build the update with the signature key. That would require a lot of work, but it might be worth pursuing.
[Droid Eris Android Development] chuckz07:
Since we already know we can't unzip and zip the rom.zip file and flash it. That is exactly what I just did, but I also dropped the key in there too. Probably won't work, because everything I have seen about the keys needs to be written in. But I'll give it a shot.
[Droid Eris Android Development] chuckz07:
Ok that didn't work. Kinda expected it though
[Droid Eris Android Development] apreichner:
This might be of some help too.

Info on the filetype.

- http://www.fileinfo.com/extension/pem

- http://www.file-extensions.org/pem-file-extension-privacy-enhanced-mail-security-certificate

- http://en.wikipedia.org/wiki/Privacy-enhanced_Electronic_Mail

- http://en.wikipedia.org/wiki/X.509

Some key words to look up are Privacy Enhanced Mail Certificate, x.509, and .PEM filetype.

Hope this was of some help to you.