yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] ataranine:
Happy Birthday. :)
[Droid Eris Android Development] rigamrts:
happy birthday hope you have a good one i'm 34 don't even pay attention anymore. my big birthday/christmas present was my eris. it's about the only time i can talk my wife into getting me a new toy to play with.
[Droid Eris Android Development] ataranine:
At this point I'm just screwing around ...unpacking the RUU MR1 file..

I have no idea if this would be useful to anyone, I just wanted to toss it up.

I have access to the .cab file, which is like 100MB, but I can't for the life of me extract it, open it, or do a damn thing with it, even with Alpha Zip or anything.
[Droid Eris Android Development] rigamrts:
is that the ini file out of the installer temp folder? cause this probably wont help. i saw installshield in there thats why i ask.
[Droid Eris Android Development] FireSokar:
CTRL Alt Delete right click on adb.exe and open file location, copy all files in directory... you just extracted the update not that hard... its whats inside the rom folder that will need to be modified not the rest, thats just for the exe etc
[Droid Eris Android Development] ataranine:
I know but no matter what extraction program I use I can't get into the exe file.
[Droid Eris Android Development] binny1007:
You won't be able to the .zip is signed with HTC's privet key you can extract it but you can not just open it up and modify it. I use 7zip and I can extract it fine, but as soon as you extract it you loose the key that HTC signs it with.
[Droid Eris Android Development] stevey500:
I extracted the install EXE on my mac using FileJuicer

It extracted a zip file that's about 116mb... but no archive app I've got will open it correctly, even every unix unarchiving software built into os/x won't do it. Maybe FileJuicer could have recognized the ROM file as a zip file and gave it the wrong extension, but yes, this installer containing the ROM for the eris is a bit stubborn.

This is my first post on the forum, yes, Hi! I'm usually Steve500 on other cellular/etc forums.

I'm up for helping out in getting the eris rooted, I have one coming fedex today.
[Droid Eris Android Development] binny1007:
No its a zip file see my above post about it. And welcome hope you like it here at xda.
[Droid Eris Android Development] ataranine:
Wish someone could get back to us on whether or not that exploit works.
[Droid Eris Android Development] JTF2007:
Is there any way to modify/replace a file without extracting or decompressing the zip file? If we are able to do this, maybe the signature won't be broken.

Is there a way to replace the file we need while the RUU is extracting the "signed" zip file? Maybe swapping during extraction will gain root access.

Or, if during the extraction process there are 2 files with the same name trying to go into the same folder. Is there a way that the "correct" file can be chosen to replace the "incorrect" file?
[Droid Eris Android Development] zifnab06:
I guess this has been posted about a million times.

YOU CANNOT MODIFY THE PHONE'S ROM AND LOAD IT TO THE PHONE WITHOUT THE PHONE BEING ROOTED.

WE NEED HTC'S PRIVATEKEY TO DO SO.

We would have to break the RSA encryption. Which hasn't ever been done (to my knowledge).
[Droid Eris Android Development] apreichner:
I'm making a proposition to one of my mod friends to try and get us a HTC Droid Eris forum, or at least a sub-forum. Maybe this will help you get some more people into the game.
[Droid Eris Android Development] Videofolife13:
So, a scary thought crossed my mind a couple of minutes ago. Let's say, for all intents and purposes, that we get this thang rooted. (Fingers crossed) What happens when we need to "reactivate" our phone? What do I mean? Story:

I reset my phone to factory settings. I then proceeded to follow all necessary setup instructions that the Eris prompts. It said that my phone was registered and everything was fine, too bad it wouldn't make calls/send texts/get on the browser. I had to call Verizon and then pushed some information onto the phone, or network (not sure), when the phone was off to get it up and running again.

So what happens when they start getting lots of phone calls asking them to "reactivate" these phones? Are they going to deny us service? I mean, with a GSM phone, it doesn't matter because you just slide the SIM in and it works or it doesn't. Here, you have to have it activated by Verizon. They might catch on and deny our activation. Even worse of a scenario yet, my phone is the only phone that will have this problem. ;) Haha.

Just something for everyone to think about as the project pushes forward.

On another topic, how is the compiling going/where are we on it?
[Droid Eris Android Development] jmanley69:
CDMA and GSM function completely differently... with GSM, you take the SIM card out and place it in a new phone. That SIM card has all the programming to tell the phone how to connect to the network and the phone passes the card's unique identifier to the network. With CDMA, everything is based around the ESN. With Sprint, you can do an ESN swap online (through the customer portal on their website). I don't know if Verizon has something similar, but what happened to you is not uncommon.

I've purchased phones and devices and the sales rep enters the ESN into the system incorrectly. It sounds like that's what happened to you. When you called Verizon, they basically did an ESN swap, and that's why they had you power cycle the phone (to allow their system time to provision the change and then force the towers to reconnect to your ESN under your account, and then allow your phone to pick up the correct OTA configuration on next boot). The phone companies cannot do anything to your phone remotely while it's off - that's completely impossible, so they didn't send anything to your phone.

Unless you change phones or move this phone to another account, there will be no need to call Verizon again. Once the correct ESN is attached to your account for that phone, and the phone has the correct phone number and MSID, it will forever work. Resetting the phone, factory reset, RUU, anything like that does nothing to the actual ESN that's burned into the radio (I use burned loosely because it can be changed with the correct software under the correct circumstances, but not by any method discussed her, or any method that any consumer has easy access to).

Hope this eases your fears.
[Droid Eris Android Development] Videofolife13:
Thank you for the information. :)
[Droid Eris Android Development] apreichner:
I had a moderator friend of mine send a request to the admin for a Eris sub-forum, so it should only be a matter of time now.
[Droid Eris Android Development] greemthumb:
that is a known issue with the droid eris and will be fix in the update on the 11th. here is the link to see for your selfs: http://http://phandroid.com/2009/11/09/htc-droid-eris-ota-update-coming-too/ its on page 6
[Droid Eris Android Development] zanef7:
I found out about this issue the hard way, but unlike in his story Verizon wouldnt help me. I have the Droid Eris on Page Plus wireless (pre paid)

When I hard reset it, it of course did not work correctly, I went into the store and since I didnt have a VZN acct. they wouldnt help me... Long story short, it hadnt been working for 2 days since I restarted it, while I was in VZN sotre arguing with the workers my phone suddenly was able to make and recieve calls, and no one did anything... I think it autoomatically set itself up on the network after about 48hrs of non functioning.

(I even printed those papers stating the problem and took them in, but the customer service rep would not even call to try helping)

Am I going to recieve the update on the 11th since I dont really have VZN service?
[Droid Eris Android Development] aeroterp:
Why can't you take the Sprint RUU and flash the Eris to the stock sprint ROM and then root from there?
[Droid Eris Android Development] Videofolife13:
The RUU does a device check so it can't flash the Eris.
[Droid Eris Android Development] rcklss1:
eris

ajones2729.... just wanted to thank you for not being a d*** and realizing these are the same phones.....

Hero CDMA- qualcomm 7600 528mhz

512 rom 288 ram

3.2" screen hvga

5mp camera

1500mah battery

HTC DROID Eris- qualcomm 7600 528mhz

512 rom 288 ram

3.2" screen hvga

5mp camera

1500mah battery

those specs are from htc's website..... maybe the hero has android 1.6 now instead of android 1.5 the eris has...

also you guys keep saying goto the eris post area there isn't one..... if there is please post a link... Ive been part of this forum for a while now from my Touch pro 2(rhodium) and Imagio (whitestone). when the rhodium came out it had its own forum already on here but the whitestone did not and i (among many others) was constantly on the touch diamond 2 and blackstone forums receiving help with no gripes (because i didn't "BELONG" there).... We are all here to help and be helped and because this is a hobby for most of us ( modding, hacking, etc.)..... sorry if you dont like this post but hey freedom of speech... think before you talk
[Droid Eris Android Development] rcklss1:
thanks to the others too who realize that this is the same damn phone
[Droid Eris Android Development] Kcarpenter:
I am not trying to be a butt head here, but this is a community of people with similar interest.

I WANT ONE OF YOU WHO KEEPS SAYING GO TO THE IRIS BOARD TO GIVE ME A FREAKING LINK TO IT!

GOD! PLAY NICE YOU BUNCH OF 5 YEAR OLDS!

Now after that rant, HELP EACH OTHER OUT! WE ARE ALL HERE FOR THE SAME REASON!!!!!!
[Droid Eris Android Development] rcklss1:
check the specs

while this phone mya be branded the desire/eris for all intents and purposes its the same hardware and software.... nothing different other then verions bloatware and sprints bloatware separating them.... the only reason the hero got rooted so fast was the exploit in the software which was fixed before coming to verizon....
[Droid Eris Android Development] obelisk79:
Are you guys arguing or trying to root this thing... get back on topic.
[Droid Eris Android Development] rcklss1:
we try to stay on topic but then someone comes along and tells us to get off the hero forum with our Eris
[Droid Eris Android Development] Orangeandblue302:
I'd just like to say, as a Sprint Hero owner, I hope u guys achieve root soon! Don't let the haters stop you from posting. If the mods havent closed ur thread then obviously no one minds if u post here. Eff all the people who say otherwise.

Cheers!
[Droid Eris Android Development] oxeneers:
The Eris actually has a smaller battery than the CDMA Sprint Hero. Hero is 1500mAh and I think the Eris is like 1200 or less.
[Droid Eris Android Development] seankk:
...

i talked my buddy and his wife into getting the Eris and they both are interested like other VZW customers about rooting, i dont understand why anyone complains about anyone posting about the Eris which is (CDMA) as we all know and ur posting under the Hero CDMA portion, but i agree a sub forum or to get crazy in the hero section break it down GSM then CDMA by carrier, but sumone sed were all here to solve or to learn so lets work together iv been on this brd for almost 5 years when i was modding my iPaq and all my win mo fones and its a great source of info and not petty **** lets keep it that way...and many thanks to ALL the DEV's.
[Droid Eris Android Development] Videofolife13:
Taking a page out of droid-devs wiki, here are some exploits that may be open to us as of now. Still doing some research, but maybe another jumping off point to get some interest back.

1: Pipe.c exploit

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3547

Remains unpatched, although mmap_min_addr is keeping us from exploiting. (we knew this...)

2: current->clear_child_tid pointer

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2848

ps. Is having the config.gz and release keys helpful or...?

Is there anybody out there?

-Video
[Droid Eris Android Development] binny1007:
ok so after many hours of searching i found this could this still work?

http://www.milw0rm.com/exploits/8478
[Droid Eris Android Development] binny1007:
Nope the way I understand it is the ruu checks the .zip to make sure it is good than it pushes the .zip to the phone witch will do anouther check to make sure it is good than it extracts the .zip and may or may not check each file in the .zip to make sure they are authentic. Some one correct me if I am wrong.
[Droid Eris Android Development] rigamrts:
just to add how this works.

the eris checks 2 things when verifying the sig on a zip

1. the rsa private key which we dont have and never will before we can use an eploit hack

2. it also checks the the image files contained in the zip to make sure all files are correct based off of the sha1 algorythem which we can create but without the rsa key we're stuck with doing an exploit only hack to get root level access.

once we crack the zip and inject our own img file into the zip we break the rsa encrytion and the sha1 which needs to be reinprinted into the zip so we can use our newly created rom.zip. which with sha1 we can create our own but rsa is another monster. so no amount of searching the image files or the zip itself will give us the rsa key we need. since the rsa private key is wrtten in 128 bit encrytion based off of a keyword or password created by HTC which we don't have.

to understand how private key encrytion works you have to do research on the subject. but to tell you why it's so good is. when private key first came on the maket the nsa nearly shat thier pants and begged congress to outlaw it cause it would hamper thier codebreaking by months or years based on how complicated the keyword was. so if the nsa wanted rsa killed before it started then you know none of us are going to get the right keyword before an exploit is found.

the nsa even went so far as to try to get a backdoor put into private key encryption but congress shot that down too saying they did not wan't big brother snooping around thier personal business in the name of national security and that was before and after the 9/11 attacks.

hope this helps expalin things
[Droid Eris Android Development] zifnab06:
Can someone make a few computer spikes? Maybe if we jam them in the phone just right, it will root itself.....

(Just kidding. I've been playing KOTOR2 lately.....found it at bestbuy for $15. only a 7 year old game :D)
[Droid Eris Android Development] R-T-B:
I think that exploit posted earlier is still probably our best bet.
[Droid Eris Android Development] powerpup118:
I've looked up more on the exploit in the kernel, and from what I've read, it's an exploit through sending packets to the kernel via a cable....

but I have no idea what cable.. I would hope USB, but if it's any other data cable then we may be out of luck.
[Droid Eris Android Development] tdavis42:
I have been paying attention to this thread out of the corner of my eye and don't know much about what you guys are doing but has anyone watched what happens when you dial *228 while it is plugged into a computer? Just curious.
[Droid Eris Android Development] ataranine:
Yeah SPL unlocked, PRL downloaded all that stuff. Apparently it's of no use to us.
[Droid Eris Android Development] redman213:
Nexus One Rooted

Yeah!!! I know like wth!!!The damn thing isnt out till next friggin week!!!!!!11

Anyways i just read the blog post on Android Central it says something about flashing SU onto the phone the first time it boots up:D. I have to go to work but can someone check it out? I'm thinking hard reset and doing superboot might work but who knows:confused:.
[Droid Eris Android Development] FireSokar:
superboot.img is for nexus one.
[Droid Eris Android Development] FireSokar:
Using this on the droid eris will not work, it is a modified boot.img Best bet is to contact paul and ask him to make one for the eris. he has done several other phones.
[Droid Eris Android Development] zifnab06:
I'm going to take apart the boot images. Does anyone know what version of Android the Nexus One is running? If it is 2.0, it might be the same problem as the droid (ie a 2.0 only exploit).

Thanks

Edit 1

nexusone.insecure-boot.img is just a normal boot.img. I can't open the nexusone.superboot.img. Linux's file command just says it is data. I know nothing about hex editing, otherwise I'd try it. I have no idea what they could have done to it, but I guess i'll look. If someone wants to try and flash it to a phone, be my guest. I can't tell you what it will do.

Also - just if anyone cares, the Nexus One's codename is the HTC Mahi Mahi. (From the init files, we have init.desirec.rc, the have init.mahimahi.rc).
[Droid Eris Android Development] binny1007:
Well it looks like they way it was rooted was just through fastboot flash boot.img but it is done through a boot screen that I have not found or we do not have. So I dint really think that it was a exploit that was used. Sadly yet another device gets rooted.
[Droid Eris Android Development] binny1007:
I just looked at the .bat and it uses "fastboot flash boot.img" so if you can find a way to boot into the boot screen that they used, than we may be able to flash from there but like I said I cant find it so I think we may not have that bootscreen.
[Droid Eris Android Development] FireSokar:
Information:

There are several superboots hes done. other phones as well. He also provided the First Nexus one rom that will be shipped on the phone, did you try comparing it to the superboot.img he provides ;) boot.img should see exactly what he changed from the shipped rom.
[Droid Eris Android Development] eroxb:
yes but i seem to remember the ds i believe, where in order to force the exploit you had to jam a paperclip in a hole, to short it out...i know it sounds extreme, but who knows:cool:
[Droid Eris Android Development] zifnab06:
That port is for flashing the HW. Verizon uses it on phones that are having problems. All CDMA Verizon phones have it. We don't have access to how to use it. I'd say its a no-go route...
[Droid Eris Android Development] eroxb:
well thats exactly my point...if there is a way to short it, confuse it, re-route its paths...like i said earlier the phone is buggy as hell (partially because they are withholding 2.0 for eris to promote the moto) so there's gotta be something!

maybe write an app that accesses as much of the phone, glitch it and hopefully trigger an exploit..anyone know if it supports tiff images?

i know its more complicated than that but you get my point
[Droid Eris Android Development] FireSokar:
Personally I feel our best bet is getting a superboot.img created. I also do not feel using the VZW backdoor will work, it will rely on the same flashing methods, just a different way in, same protections etc. Besides you would have to re-write all there tools from scratch or any knowledge.... As far as holding back 2.0 I do not believe that is the case, It's not VZW holding it is HTC holding back.
[Droid Eris Android Development] eroxb:
im just thinking extreme here.... i have done a few exploits (performed not created) on a few different systems...

what if we created a viral attack that's only purpose it is to gain root, even if temporarily to install an exploitable file in root
[Droid Eris Android Development] zifnab06:
The problem is, everything but /data is read only. So, we have to find a root escalation exploit that hasn't been patched on our kernel, remount everything as rw, and go from there. If we could read/write to /system, it would be easy...
[Droid Eris Android Development] eroxb:
well what about the stock apps?? you need root to remove them!! anything worth looking at there?
[Droid Eris Android Development] jmanley69:
If superboot.img is just a boot.img, then it's probably no different then the boot.img that I gave you guys already which is for your phone. If you could apply that boot.img, then you'd have root through adb, and then you could put whatever you want on the phone.

2 problems with fastboot. 1) boot.img is not signed by HTC, 2) regular fastboot is locked down because your SPL is "perfected"

RE: the exploit you guys found. Like I said, I'll look into it. I didn't have any chance today, but I should be able to take another look tomorrow.

In the meantime, I'm getting 0day exploits emailed to me every day. When I find one that would work, I'll package it up and you'll have root. Also, just because we have an exploit that may work, doesn't mean you guys shouldn't stop looking.
[Droid Eris Android Development] zifnab06:
http://xdaforums.com/showthread.php?t=609189

Thread says alot. No one is going to read through 120 pages, and I'm tired of just repeating the same ideas and why they won't work over and over.

Thanks,
[Droid Eris Android Development] FireSokar:
superboot.img is not just manilla boot.img its been edited to give you root. how is currently unknown.
[Droid Eris Android Development] redman213:
So how do we contact the dev who made the superboot.img for the N1?
[Droid Eris Android Development] FireSokar:
I've allready contacted him, hes from the UK so hopefully i'll have a message from him in the next few hours.
[Droid Eris Android Development] ataranine:
I just doubt something from another phone is going to help us. Forgive for being Cynical. :(
[Droid Eris Android Development] redman213:
That is why were asking the dev to make a superboot image custom tailored to the droid eris. Just like he did for the N1.
[Droid Eris Android Development] ataranine:
If someone could have done that already, wouldn't it have happened by now?

And if someone does, would they try to use that exploit posted earlier?
[Droid Eris Android Development] jmanley69:
"How" is very known... It's edited by editing the default.prop which is what I did with the boot.img that I gave you. hence.... it's no different then the boot.img that I already gave you except the one that I made for you is made for your phone.

I understand that some people have come in late... and I understand that there are a lot of pages to read, but it would be helpful if you guys would read through this thread to catch up before chiming in.

I can't speak for everybody, but I will no longer comment on items that have been discussed in the past 120 pages. If we spend the next 200 pages catching you guys up on things that have already been tried and discussed, the project will go nowhere. If a question goes unanswered by one of the "regulars" in this thread, please don't be offended, and please don't keep asking the question.

We welcome your help, but the efforts need to continue forward.
[Droid Eris Android Development] binny1007:
I second that if I get some time this weekend maybe I will go through and sum up the whole thread and start a new one. But that is a big maybe.
[Droid Eris Android Development] ibegary:
Just a thought, the hero and eris are almost identical other than the visual apperance and the proximity sensor.

Has anyone tried the gold card method and flashed to a sprint RUU just to see what it does?

Just a thought.
[Droid Eris Android Development] jmanley69:
Well... because even if you were able to apply the Sprint ROM, you wouldn't be able to boot. The Sprint Hero kernel and the Eris kernel are not the same, so the phone just plain will not boot (not even to recovery, not even boot without radio support... just will not boot at all).

Edit: p.s. The only reason I answered this one is because we never said "why" it wouldn't work, just that it wouldn't work.
[Droid Eris Android Development] rigamrts:
all expliots that the sprint hero had are patched. yes the gold card bypasses the cid but we've tried everything and it won't pass the sig check. there's like a hole 20 pages here where we played with goldcard and all ended in falure.

also the sprint ruu won't work for us it an insta fail everytime.
[Droid Eris Android Development] binny1007:
Hey jman can we use this to overwrite mmap_min_addr looks like the code may need to be modified a bit, but who knows maybe it work...

http://securityreason.com/exploitalert/7369