yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] zifnab06:
Also, a few other things to check (if we haven't):

Fastboot (Doesn't Work)

Create a GoldCard (http://xdaforums.com/showthread.php?t=572683)

Exploits (we can always wait for someone to find a new one, or try and use one against dmagent)

SPL Hack + GoldCard (http://xdaforums.com/showthread.php?t=548218)

Find a way to sign our own, custom .nbh file, and flash (http://xdaforums.com/showthread.php?p=4780214)

I'm going to start playing around with the goldcard idea right now.

If we can't find anything, look at other "root status" threads throughout the forum. It might give us some ideas.
[Droid Eris Android Development] binny1007:
I don't beleve that would work, you are refering to.*228 correct. In order to flash a new spl we would need a soft spl, I know for wm there is a program called jump spl that allows a temporory right situation to load a new unlocked unsigned spl.
[Droid Eris Android Development] binny1007:
Before you load a spl or a recovey img make sure it is one for our device.
[Droid Eris Android Development] zifnab06:
The goldcard method works. I'll try flashing my boot.img mod in a second.

Edit: We have a working goldcard. What we can do with that, I'm not sure. But, we can make one :D Flashing custom images doesn't check for it, but we could flash a custom SPL (and the SimLock option does something now, not sure what. ) The instructions above still work with the Eris for creating a Goldcard .

One more update. I've sent PMs out to a few people who've made custom SPL's before. Essential, a custom SPL would allow us to bypass the CID (Carrier ID) Signature check when trying to load a custom ROM. Mostly, loading ROMs without root access to get root access (if that makes sense). If this will work, I can take apart the system.img and add a su program for root access we can actually get to and use. And, take out the ro line and make / rw instead of ro (which is just nice all the way around). If only there was a Droid Eris dev phone, we could just use the spl for that phone instead.

Our problem earlier with the autosign is it is created to sign everythign with a testkey (I think anyways). The signatures don't match up. But, with a custom SPL made to use that testkey, everything should line up and we should be able to flash our own ROMs. Yay :D
[Droid Eris Android Development] zifnab06:
Just to put this up:

The SIMLOCK option in the bootloader works with the goldcard inserted. Output is as follows

And I'm hoping its safe to assume the Eris isn't a modified hero, but actually the HTC Desire? (Bootloader says DESIREC XC SHIP S-ON)
[Droid Eris Android Development] weiln12:
Tried this...

I tried this already. Now, I don't have a SPL to replace the current one so I couldn't try, but when I popped the battery out after SPL Unlocked had been displayed, fastboot still showed "S-ON" which I believe means security is on. Now, that may not mean it can't be flashed, but I assume it does, and I don't have a replacement SPL to flash anyway.
[Droid Eris Android Development] binny1007:
SWEET you are the man we are now one step closer, and that is a huge step closer. Great work, can you post how you got the gold card to work. Step by step
[Droid Eris Android Development] zifnab06:
http://xdaforums.com/showthread.php?t=572683 has the instructions. I'm on android-root.

And just found out this:

So, its a null route. meh.
[Droid Eris Android Development] binny1007:
Well here is my thought we could try and grab hboot from the Sprint Rom and put that on our device, than we would be able to push a custom recovery img via adb. The only prob bieng is that it would Chang our device id, or we might even be able to flash the whole Sprint Rom and get root than mod the VZW Rom and apply it as a custom update, if we can flash the Sprint Rom and get root than its game over we can mode all the VZW Rom and flash back using the same method they use to flash customroms. Does that make sence. Once I'm done with work ill try it but it won't be till later tonight.
[Droid Eris Android Development] apreichner:
Well I'm not sure if it's the same or different on Android devices than it is on Winmo devices, but I'll put in my two cents.

A Goldcard on Winmo devices temporarily SuperCIDs your device which allows you to bypass the signed image protocol allowing you to flash custom ROM images. It also allows you to flash images of a different IPL/SPL which is why Goldcard's are often used when your phone is bricked with a messed up IPL/SPL. A CID lock is the other name for the device checking for a signed certificate on the ROM NBH, if the device is SuperCID in some way or another (USPL, HardSPL, Goldcard) then it is able to flash ROMs without a signed certificate.

Now don't take my word for it... It may be completely different on your Android devices verses my Winmo device, but I wouldn't give up on the idea just yet.

EDIT:

The instructions on that Goldcard post even say bypassing the RUU/SPL CID check. Since RUU = Signed Image, I think it will allow us to flash custom ROMs, assuming the Goldcard really works on our device. Although, before I would attempt to flash a Hero ROM, I would attempt to get a Droid Eris ROM dump, and start by creating a custom ROM of sorts, which simply provides Root.

EDIT 2:

I guess you could try a Hero ROM. I was under the impression for a little while that the Hero and Droid Eris had a different processor for some reason. I was mistaken. Although, the kernel may be different... My friend who owns a HTC Dream says that some versions use a different kernel with a different SPL. And if you flash an incompatible SPL, it'll brick the device. And he says that even a Goldcard cannot unbrick a bricked Dream. So essentially, if the flash fails, it fails permanently.
[Droid Eris Android Development] zifnab06:
I'll have a custom rom up in a bit. (probably just with rw access on the / partition....i have that done already).

Edit: I'm worried about the whole "flash a hero rom" the hero is the HTC (dream?) and the eris is the HTC Desire. I'm worried that changing the name might have meant something else changed as well (Hero GSM And Hero CDMA are both an HTC Dream.)

And so everyone knows: The droid exploit DOESN'T work. I played around with it some, and its a no-go as well. Sadly :(
[Droid Eris Android Development] apreichner:
No the Hero is not the HTC Dream. The Dream is the G1. The Hero, is the HTC Hero. I was just reflecting on how it was on the HTC Dream if you screwed up, just a word of caution. But, I truly believe we hit it big with this Goldcard idea.
[Droid Eris Android Development] binny1007:
Anything from Sprint should work for us and a custom Sprint Rom might even be better cause it prob will not modify the carrier files.
[Droid Eris Android Development] binny1007:
If any one wants to make a Rom I will give it a try just upload it somwere and ill load it up.
[Droid Eris Android Development] apreichner:
Well it may use a different Kernel which could mean a different SPL which could permanently brick the device. If you want to give it a try, go for it, but I wouldn't risk it. Maybe someone with an accidental damage warranty on the device want to give it a try?

Remember the Droid Eris is technically the HTC Desire, while the Hero is the HTC Hero. Who knows what implications that could cause.

My idea: Take the update and modify it similar to the Droid method, and then use the Goldcard to bypass the signed certificate checks. Could work.
[Droid Eris Android Development] binny1007:
Yea I think I will try the update that was modified the other day. And see if that works.
[Droid Eris Android Development] binny1007:
No I'm gannah wait till I get home and have my computer so I can flash back if I have problems
[Droid Eris Android Development] jmanley69:
If you need to have the whole ROM to use the goldcard method, then use the customized ROM from the RUU - the one where you guys replaced recovery.img with the one I made. That way, everything is built for your phone, but it has a recovery image that will allow you to apply update.zip (which I still have waiting for you), that unlocks everything for you.
[Droid Eris Android Development] binny1007:
Can you upload the whole Rom zip with your recovery in it and I will try it. I'm not by my compuer but I have my gold card and I can try to do it from my sd card
[Droid Eris Android Development] zifnab06:
I think it was linked earlier.

http://www.softwaresystems.com/rom.zip

Just 404'd now
[Droid Eris Android Development] jmanley69:
lol I'm not at my computer either. Do this... Download the RUU, run the setup, find the rom.zip in your temp directory. I'll see if I can't put up the recovery.img again someplace and post the link here. Then, you'll probably need to resign it like before, but if what you say about the goldcard not checking the validity of the signature, the test signature should be fine.
[Droid Eris Android Development] jmanley69:
That's a web server without much bandwidth, so I took it down when it didn't work. Not to mention, it includes copy protected material that belongs to HTC, so we don't want to get into a legal situation.

If the goldcard method does work for you guys, then we can post recovery.img someplace and instructions for the end users to download the RUU, extract the rom.zip and do the stuff they need to.
[Droid Eris Android Development] zifnab06:
I have a webserver with unlimited bandwidth as of about 10 minutes ago. I'll start rehosting everything we use if that works. I was tired of using mediafire :(
[Droid Eris Android Development] binny1007:
Just so everyone knows the gold card wipes all your carrier settings and your a key, so I would not recommend playing with it till we figure it out. I don't mind calling VZW to re athenticat my phone its just a pain in the butt
[Droid Eris Android Development] apreichner:
I usually just use Windows Live Skydrive or 4Shared. Although I guess it would be kind of ironic using Microsoft's servers for your Android stuff.
[Droid Eris Android Development] ataranine:
Well no one uses it for Microsoft's stuff. xD
[Droid Eris Android Development] apreichner:
Well I'm hoping to see some good news when I get back from work later tonight! Good job on everything you have done thus far!
[Droid Eris Android Development] binny1007:
Well guys I think we may need somthing official.... I'm getting signeture errors. :(
[Droid Eris Android Development] jmanley69:
Yeah... I think the goldcard method was only to apply a previous ROM in the case where people's firmware was beyond the exploit for the GSM Hero, and an RUU wasn't available.

They would use the goldcard method to load an earlier ROM, then hack the phone, then upgrade as they see fit.

Keep an eye on the site I posted yesterday, If there's something, it'll be there... You want to probably avoid exploits specifically for the x86, x64, intel, etc... platform (since we have ARM). You want to look for "local" exploits over remote, and you don't need any oops or denial of service exploits. You're looking for local escalation of privileges.
[Droid Eris Android Development] Videofolife13:
I was really hoping the GoldCard would give us the goods. I wonder how long will this thread get before we get root.

Just to verify, did you try an update.zip or...? It seems to me the way to do it would be to:

1. Make a Gold Card

2. Start the Ruu up

3. Replace their rom folder with the modified one

4. And run the Ruu.

I don't know that this would necessarily have a different/better outcome. I also saw that zifnab06 had some luck originally titling our Update.zip as PB00IMG.ZIP. Check out post 275. It seems that everything worked until the phone verified the update. Maybe since we have a Gold Card, it won't care? Just thinking.
[Droid Eris Android Development] chuckz07:
While we all dwell upon a new root way for the ERIS, look at this S**T...

http://sfbay.craigslist.org/eby/ele/1508759344.html

Sorry for the brief sidetrack, just pisses me off is all!!!
[Droid Eris Android Development] chuckz07:
On another note, anyone have any luck finding the ERIS Shipped ROM? I have searched but had not luck yet. Am I wrong in feeling that the MR1 Update is not really a complete ROM package?
[Droid Eris Android Development] jmanley69:
Don't let it upset you too much. This guy is just creating headaches for himself. none of his customers will be able to take updates in the future... all of them will be harassing him to fix their phones.

I used to program directtv and dish cards for close friends and just the four I did made me nuts. I couldn't imagine doing it for countless strangers.

Just think about how many paying customers yell at the mobile carriers when something goes wrong. This guy will get his own kind of justice.
[Droid Eris Android Development] ataranine:
I would like to think it was a complete ROM since it was so big, could I be wrong? Most likely. :P
[Droid Eris Android Development] jmanley69:
Mr1 is a complete ROM package. Not a patch.
[Droid Eris Android Development] chuckz07:
I understand all you wrote. But adding to yours, you did it for 4 of your friends. You didn't advertise. Not to mention, I'm sure you informed them of any/all downsides. This guy didn't even have the balls to mention it voids the warranty. Let's face it, the number of people who do not know about this site or others like it are not outweighed by the rest of us who do.
[Droid Eris Android Development] chuckz07:
Ok, then sorry for asking. How do I dump .img files? Do I simply use the yaffs program with adb or do I need to get a little more proficient with Ubunto?

***Note to self, get proficient with Linux before the release of Android 5.0***

Sorry, thinking out loud.
[Droid Eris Android Development] chuckz07:
Some more community thoughts...

1. HERO was able to root because basically a backdoor was found. Could it be possible that the programmers noticed this and made sure all backdoors were closed before release?

2. I was bored last night so I looked at every file (just in notepad) from the RUU. I saw some files that had VeriSign language in them. Is it possible that that is what they used to sign the package or could it be what was also used to sign the files? Is verisign even a cryptographic signing?

3. What is the data1.cab file for in the other temp folder that gets dumped when you execute RUU? It is in the Disk1 file folder.
[Droid Eris Android Development] apreichner:
Just talked to my friend who is a lot smarter at these things than I am... The Goldcard if functioning properly, should bypass signature checks, even on the Android device. So therefore, I believe, the Goldcard was not working. I don't think we should throw Goldcard off the list of items to try.
[Droid Eris Android Development] markachee:
Just throwing an idea out there...

The GoldCard should bypass the CID/signature check done on the phone, right?

With that in mind, shouldn't what we were doing earlier (modify the images while the RUU is running before if actually flashes them) work if we have a GoldCard? Or does the RUU executable do it's own check right before flashing?

If it's not doing its own check, but actually communicating with the phone to check, shouldn't having a GoldCard make that method work?

-----

Something else I don't understand, if the old RUU's have a valid signature, why did they need a GoldCard to use them? Am I misunderstanding what the GoldCard does? I thought you could run the older RUU's that were valid as is.
[Droid Eris Android Development] jmanley69:
oh my... that made me laugh really really really lots! it's not really a backdoor, it's sloppy programming. The Linux Kernel (and most things open source) are filled with sloppy programming... that's the beauty of it for us (the ones trying to find the holes). The flaw found in the Hero kernel (and ALL kernels prior to October/November) existed because the variables passed in were not verified prior to use (lazy sloppy programming). The kernel is filled with such flaws, and that's why there are boards all over the interwebs showing new exploits every day.

It's possible (but very unlikely) that the image files are signed. However, it's not necessary because the signature is in the last 256 (actually starts 262 bytes from the end and doesn't include the last 6) bytes in the zip file. What happens during the signing is that the zip file is hashed with the private key from HTC. That creates a 256 cipher which is appended to the zip file. If anything changes inside the zip, the cipher breaks and validation fails. If the cipher doesn't exist, validation fails. Therefore, it's not really necessary to sign the files within the signed package.

Since this is a 256 cipher, you can forget trying to "crack" it unless you plan on having your great great great great great grandchild deliver the hacked zip to your phone. Without the private key, hash method (which actually shouldn't be too difficult to figure out since the verification program is open source), salt, and seed... there's no way you're going to crack it in our lifetime unless you employ every computer in the world in a distributed computing network. (not to try to discourage you... just saying... go the easy route).

Data1.cab is part of the Windows setup files. A cab file is basically a compressed file of all the pieces of the setup. Within data1.cab is rom.zip, all the stuff in the temp directories... setup files... etc. Setup.exe will extract data1.cab and do what it needs. In the RUU for the Sprint Hero, data1.cab actually includes a recovery image and that's what I was hoping to find with the Eris RUU (but it wasn't there). I believe that the Sprint RUU will push the recovery image onto the phone to guarantee that the RUU applies correctly (i.e. you don't have a custom or corrupt recovery image).
[Droid Eris Android Development] jmanley69:
If you follow the threads on the goldcards, you'll find that they don't always work, and if your sd card isn't working properly, you will need to purchase another. I think that I remember reading that people have bought a kingston??? from Best Buy, and it worked.
[Droid Eris Android Development] Videofolife13:
And the plot thickens. I'd be willing to get like a 2GB kingston to give all this a shot. I'm sure they're really cheap right now, it being the holidays and all. But, I don't want to put a bunch of work into it if we don't have much faith in it working...
[Droid Eris Android Development] apreichner:
I currently have an SD card that i know would work, but I don't own a Droid Eris, my brother does, and I don't think he would want to try it.

With that being said, I think we should get multiple people trying the goldcard method with different ROMs before we completely rule it out. I know SDHC cards aren't very friendly with Goldcard methods as the bootloader has a hard time reading them sometimes.
[Droid Eris Android Development] apreichner:
Don't get an SDHC card. Get an old-fashioned 2GB SD Card. I think the driver support for SDHC is loaded with the rest of the OS, so the bootloader may not be able to use it.
[Droid Eris Android Development] zifnab06:
It's pretty easy to tell if you have a working goldcard. Boot up the recovery mode, hit "bootloader", then "Sim Lock". If you get an error, your goldcard is a dud. If it works, you have a valid goldcard. Just something I found out playing around with everything.

Note - I have no idea what this does, but it seems to check for a goldcard, and asks for some file if it works. Output should look like what I Posted earlier.
[Droid Eris Android Development] apreichner:
Well have you tried flashing a ROM with your Goldcard as of yet? And I'm still not sure I see the point of a Goldcard if it only allows you to flash an older version of an official RUU. You can flash an older version of an official RUU without a Goldcard.
[Droid Eris Android Development] chuckz07:
Thanks jmanley69 for the replies. Although my questions may have made me sound like a dumba$$, I really am not (mostly).
[Droid Eris Android Development] apreichner:
If anyone on this forum has a protection plan on the phone, I think maybe we should try flashing the Hero RUU via Goldcard. It might be that the goldcard still somehow requires an official ROM, but not necessarily from the same device. Idk why that would be, but who knows.

Also check this thread to verify you use the same general steps:

http://xdaforums.com/showthread.php?t=485364

One thing I found from that page is this:

- Micro SD card formated FAT32 (128 MB to 2 GB), Sandisc cards may not work (but worked for me).
[Droid Eris Android Development] rigamrts:
goldcard was the main method of loading roms onto the dream before they found recovery and how it worked. so yes goldcards should in theory be able to load any rom we want.
[Droid Eris Android Development] markachee:
Did they have to craft their own RUU's for this? Or is there a way to just flash an image not in an RUU with a goldcard?
[Droid Eris Android Development] apreichner:
I'm pretty sure you have to still use an NBH ROM image still. I think what he meant was, ROM cooks were able to get a dump of the Dream and create custom ROMs with all of the required drivers. However, since these were custom ROMs and not CID signed, the only way to flash them (at the time) was to use a Goldcard. Which is why I think that if the goldcard is functioning properly, we should be able to flash a custom ROM.
[Droid Eris Android Development] 87jason:
Im new to the android world, but im not dumb by any means i will help with whatever is needed just tell me what to do i will use my phone as a test dummy. Im ready to have this thing rooted.
[Droid Eris Android Development] apreichner:
If you own an SD card that is less than 2gb try to create a goldcard. http://xdaforums.com/showthread.php?t=572683 . Once you're done with that, if someone would post the custom RUU with the modified Recovery.img, try to flash that.

If you want to try it, you can try to flash the Hero RUU to your device. No one has tried this yet, and it's possible that it could permanently brick your device. I'm pretty sure it would be covered under any accidental damage warranty though if you have one.

PS: I take no responsibility for any bricks.

EDIT:

For anyone attempting to create a Goldcard, make sure format it properly. The best way to format is to connect it through a card reader and do the command:

format F: /FS:FAT32 /A:4096

*F: being the driver letter of the SD card.
[Droid Eris Android Development] chuckz07:
My 2 cents in question form. If the phone bricks, can't you still re-boot into bootloader then run the MR1 Update? I ask because coming from a TP1 & TP2 and cooking/flashing many ROMs, it was possible to reload working or shipped rom from bootloader. BTW, I own a 256 MB card, it is in my old Curve.
[Droid Eris Android Development] apreichner:
I have no idea. There's always possibility of permanent bricks. Give the 256mb card a try. Here's what I'm thinking though... If the Goldcard even begins to flash the Hero RUU, we proved that we can flash virtually any ROM image. It's ideal to me because the exploits exist in the Hero image, and we know it's a perfect ROM. Whereas the ones we may have created thus far are not good, so the problem may be in the ROM itself and not in the goldcard. If someone wants to give it a try, by all means, go for it. But I don't take responsibility if something goes wrong.

ALSO: IF, and it's a big if, the Hero RUU works on our device and does not screw it up. That means we can flash custom ROMs made for the Hero.
[Droid Eris Android Development] chuckz07:
Well crap, mine is Sandisk but will still give it a try.
[Droid Eris Android Development] 87jason:
Ok well all i have is a 4gb sd my oldlady has my 1gb in her blackberry, and i take it the 4gb card is not going to work. And as far as the hero going to change all the carrier nonsense, or are we just hoping that say it did work then we have a window since the sprint hero is rooted ...