yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] chuckz07:
This may be good, I was just fixing to go figure out how to sign files. So none of the links, even though I haven't gone to them yet, will be worthless. Thanks!
[Droid Eris Android Development] apreichner:
And apparently it uses a Base64 encoding scheme for a MIME transfer. See here: http://en.wikipedia.org/wiki/Base64 .
[Droid Eris Android Development] punk.kaos:
That won't help. RSA is a two part key. We're missing the signing half of the key. the ota keys that are on the phone are the decrypting half of the key.
[Droid Eris Android Development] chuckz07:
I was just reading that but also read that in some cases the keys are identical and they just check each other. I doubt this is the case though!
[Droid Eris Android Development] apreichner:
It's amusing Wikipedia defines the decrypting algorithm as the Private key and the Encrypting as the Public key... So it appears we have the secret to the Private key, but still can't find the Public key. Go figure.
[Droid Eris Android Development] chuckz07:
on another note, do you think HTC has 2 sets of keys? 1 for OTA and a completely different for manual.
[Droid Eris Android Development] chuckz07:
Could this help?

SHA1 :	50CB21D1B3ECB6F65FDE341A6CF1F1CA3A11BBD8

SHA224 : 5554EFD6D74B578B65168E453C9F7DC68A99B3869C1BADFE6068804812010000

SHA256 : D245E4B60326D4ED11D363AD57D05CAD0C7A6E2B22FA596AEDB2A1118D55DC64

SHA256-HTC : EFD71982A312D48B49DA585B796EB9F7580CB6B09D68493219CF9BC2740D057D

MD4 :	8A3E852D6159DC80B1D087F9DEEDFC1F

MD5 :	FF4F6A86AF611A8DF0E5E756D3B43037

CRC16 (0x1189) : F0A6

CRC30 (Block: 0x1000, Page: 0x200) :	1A1644EE

CRC30 (Block: 0x2000, Page: 0x400) :	3B804C3B

CRC32 (0xEDB88320) :	D2B0D306

CRC32 (0x04C11DB7) :	F8E178E4

CRC32 HTC (0xEDB88320) :	E22E7513

ECC Reed Solomon (parity 10) :	CE08B23A0D276510A0B3

ECC BCH Micron 3 byte :	DCDC00

ECC Hamming Toshiba (8 bit - 0x200 bytes) :	F33C0F

ECC Hamming (8 bit - 0x200 bytes) :	30FC3F

ECC Hamming (16 bit - 0x200 bytes) :	0CFF0F
[Droid Eris Android Development] apreichner:
Where did you find those?
[Droid Eris Android Development] chuckz07:
Are they worth anything to us for gaining access?
[Droid Eris Android Development] apreichner:
That might depend on where you got them from....
[Droid Eris Android Development] chuckz07:
I hashed the releasekey.x509.pem with qmat
[Droid Eris Android Development] zifnab06:
That's the sha1 combined with the rsa. Simply put, if you want to make a recovery image with that key, it would be completely guess and check. And as I sad earlier, the chance of that ever happening would be so infinitesimally small....

SHA-1 was designed to be different for every file. While it is possible two could be the same............Good luck! You have a better chance becoming president, a professional athlete, winning the lottery, being hit by lightning, contracting the human version of mad cow, and dying from a dogbite all on the same day. (If anyone cares, this works out to a 1 in 4.612608x10^37). While its competely possible, its just very very improbable. And, the chance that that image that matches this would be usable.....it would never happen.
[Droid Eris Android Development] binny1007:
Hahaha ok ill just drop that one.
[Droid Eris Android Development] ibegary:
So I noticed the CLIQ has been rooted. Any validity in their methods that could apply to ours?
[Droid Eris Android Development] punk.kaos:
No, that hack relied on Motorola specific firmware. No good since the Eris is HTC.
[Droid Eris Android Development] wasupwithuman:
could this exploit work?

Linux Kernel KVM 'kvm_dev_ioctl_get_supported_cpuid()' Integ

by Carol~ Moderator - 11/6/09 7:38 AM In reply to: VULNERABILITIES \ FIXES - November 6, 2009 by Carol~ Moderator

Linux Kernel KVM 'kvm_dev_ioctl_get_supported_cpuid()' Integer Overflow Vulnerability

Bugtraq ID: 36803

Class: Design Error

CVE: CVE-2009-3638

Remote: No

Local: Yes

Published: Oct 23 2009 12:00AM

Updated: Nov 06 2009 08:07AM

The Linux kernel is prone to an integer-overflow vulnerability that affects the Kernel-based Virtual Machine (KVM).

Attackers can exploit this issue to execute arbitrary code with superuser privileges. Successful exploits will completely compromise affected computers.

Versions prior to Linux kernel 2.6.32-rc4 are vulnerable.

Solution:

Updates are available.

http://www.securityfocus.com/bid/36803/references

http://www.securityfocus.com/bid/36803/discuss

I know KVM stands for Kernel Virtual Machine, does this apply to android
[Droid Eris Android Development] wasupwithuman:
here are some links to some kernel exploits in linux dated after the release of the droid eris, maybe one of them will help. They are in order from newest to oldest:

http://secunia.com/advisories/37658/

http://secunia.com/advisories/37590/

http://secunia.com/advisories/37435/

http://secunia.com/advisories/37435/

http://secunia.com/advisories/37296/

http://secunia.com/advisories/37233/
[Droid Eris Android Development] wasupwithuman:
sorry double post.
[Droid Eris Android Development] jmanley69:
DoS, and it's a vulnerability in ext4

These are all DoS... which is not what you want. You want privilege escalation.

Also, you may see "execute privileged code", that's not what you want unless you have the machine code to make a shell, or run a command... the machine code must be for your processor ARM, or it won't be recognized (and hence, not run).
[Droid Eris Android Development] markachee:
http://secunia.com/advisories/37658/ - ext4, nope

http://secunia.com/advisories/37590/ - maybe? 1 doesn't sound like it would get us root. 2 uses a null pointer dereference which our phones are protected against. But 3 seems feasible?

http://secunia.com/advisories/37435/ - maybe?

http://secunia.com/advisories/37435/ - dupe

http://secunia.com/advisories/37296/ - 2.4.x, we're looking for 2.6.27

http://secunia.com/advisories/37233/ - 1 null pointer dereference. 2 null pointer dereference. 3 just an information disclosure.

So 2 maybes in there, but these are just vulnerabilities. We'd have to find where someone has written exploits for them, and like jmanley said, they'd have to be (changed to be?) specific for ARM.

Is the source available for asroot2 and wouldn't that be helpful for changing exploits we find to ARM? Or is the payload significantly different between null pointer dereference and buffer overflow exploits?
[Droid Eris Android Development] zifnab06:
I have this odd idea we need to find someone who knows ARM machine code. I have a teacher back at school who might be able to help, if we don't have this rooted by the 13th (when we go back). I'll ask him :D

Thanks,
[Droid Eris Android Development] bottlecap:
Bunny speaks for all of us.
[Droid Eris Android Development] zifnab06:
OK. So this is pretty simple. Let's leave the "OMG ERIS ISN'T A HERO" stuff alone for a while. Theres this little icon I like using with trolls ( if no one knows what i'm talking about). Lets just leave it alone and try and get this project done.
[Droid Eris Android Development] bottlecap:
I know I'm new to the game, but what if we took a normal USB keyboard, and spliced a mini USB connection to it? Has this been tried? I have a USB keyboard I'm not using and will sacrifice a cable to give this a whirl.
[Droid Eris Android Development] Videofolife13:
...? You don't need a physical keyboard to use that menu. They gave you a track ball for a reason.
[Droid Eris Android Development] zifnab06:
We found this menu along time ago. Press (either menu or home?) and the power button. That will bring it up. We were trying to push the update.zip files wrongly. The menu didn't help at all though.

Funny story - The first two weeks I had my phone, I thought the trackball was a button. I didn't realize it was a trackball. Ha.

I had one more idea. The instructions a few posts back about a super-CID, I'm going to order the stuff as soon as I get back to school (the 13th, so a while off) and make that serial cable. That was kind of what I was looking for earlier. It would essential create the debug port someone was willing to take their phone apart to find (either binny, videofolife, or c07). It might be more difficult, but I have this idea if we can get it rooted through that, I should be able to get something done with ARM code to permanently root the device. We shall see though :D

So, just another explanation. With C, we are limited to what we can do because of the libraries that are on the phone. All of those libraries essentially compile into arm code using the android NDK. (Native Development Kit). So, even if we don't have the required libraries, the ARM code will still function.

One more piece of homework for someone, I need to leave for a while and get some Christmas shopping done. Can someone look into what processor the phone is running, and see if you can find a list of ARM instructions for me? And also possibly a native android memory debugger. I have an idea, but it might take some time. I had an 8052 assembly class last semester, and I mine as well use it now and learn another assembly language :D You guys rock!

Mostly, it involves compiling the source code for the adbd process into ARM, and seeing what I can do with it once its running. And, see if I can code everything that I want to do onto the almost 60times faster processor on here. At least it's only single core'd.....

Edit - just a note. This would require essentially writing a program that would run right alongside adb, and as soon as (if I undertand how it works) a shell is initiated, grab the shell and change the GUID it is running from. It shouldn't be too terribly difficult. I just don't know what I need to know to get it to work.

Edit 2 - One more note. From what we did in class, I think it SHOULD be theoretically possible just to write an interrupt routine that gets run first on the processor, and time it (if this is even possible) to load up a copy of the terminal INSTEAD of the adb shell one. And it MIGHT be possible to get root with it. But, at the moment, I'm completly guessing, kind of going at it out in the open. I know editing ram values WOULD be fairly simple though, ergo the native ram debugger :D

Edit 3 (last one i promise) - One more idea. Possibly a mount rewrite? And just take out the portions of code that require superuser stuff. Once again, i'll look into it tonight

Thanks everyone!
[Droid Eris Android Development] apreichner:
Alright I attempted to do some of this homework for you. I went on HTCs website and found the tech specs on the Droid Eris, and it is indeed the same as the Hero CDMA. It is the Qualcomm MSM7600 528mhz. (Source)

Did a bit of Google searching on the processor and came up with the PDAdb website, and came up with the information on the processor. And apparently it uses an ARMv6 instruction set. (Source)

Did some more Google searching on the ARMv6 instruction set and I came up with some interesting stuff. The first link below is the whole Architecture manual on the ARMv6. The second link is an Instruction set for the ARM series processors. There is a table of different ARM processors at the bottom where you find ARMv6.

- http://www.arm.com/pdfs/ARMv6_Architecture.pdf

Architecture Manual

- http://infocenter.arm.com/help/topic/com.arm.doc.qrc000/QRC0001K_UAL.pdf

ARM Instruction Set

After that I did some quick looking for a native debugger, but so far only came upon information on the Android developer page. I don't know if this is much use for you.

- http://developer.android.com/reference/android/os/Debug.html
[Droid Eris Android Development] rigamrts:
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.faqs/ka10836.html

here a link to the evaluation arm tools we can try these out.
[Droid Eris Android Development] ataranine:
There's no way I can downgrade my phone back to the Firmware that came with it? My phone's been acting stupid ever since the update and I don't thing a Factory Reset has reverted it back.

By the way I noticed that it says SPL unlocked as well as a few other messages when it's activating after the Factory Reset.. what's that about?
[Droid Eris Android Development] binny1007:
Just standerd VZW programing it just rights the carrier info in the spl nothing we can use really.
[Droid Eris Android Development] ataranine:
Yeah I figured I was just curious what it meant.
[Droid Eris Android Development] ksuviper:
i'm with you man. mine was more stable before the update and my data speed were twice as fast before the update.
[Droid Eris Android Development] ataranine:
yeah seriously this thing is going back to the store soon lol, if it doesn't get rooted that is. I'll wait til maybe Mid-January.

I know these guys are working hard I'm just saying.. I hope it gets done soon so I can flash a better rom to it.
[Droid Eris Android Development] ksuviper:
i was thinking about going to the store or calling them and seeing if they had a copy of the stock firmware to flash my phone with. they probably won't want us doing that so it may be a waste of time.
[Droid Eris Android Development] zifnab06:
You rock! I'll start looking/programming soon. First, food.
[Droid Eris Android Development] binny1007:
Ok I was doing some digging in hboot with a hex editor and I found some intresting stuff. One this version of hboot has reference to lots of different carriers to include tmobile and I also found reference to different devices..... so I'm not sure what that means but it may mean that hboot is cross compatible. Were was that nbh with the engenring spl on it.
[Droid Eris Android Development] chuckz07:
I did soemthing last night, not sure if it was anything or just a fluke. Let me explain. I followed the HERO modified recovery instructions again, but I changed one step.

Code:

adb shell reboot bootloader

fastboot boot recovery-RA-heroc-v1.2.3.img ***This did nothing, but when i added oem after fastboot ($ fastboot oem...) the phone automatically rebooted on its own.

adb shell mount /sdcard

adb push recovery-RA-heroc-v1.2.3.img /sdcard/recovery-RA-heroc-v1.2.3.img

adb shell flash_image recovery /sdcard/recovery-RA-heroc-v1.2.3.img

adb shell reboot

Now I believe that is was the line 'adb shell flash_image...' that actually threw me the 'FAILED'. Now here's the fluke part, at some time last night I performed a 'WIPE' and when I had to dial *228 I had the worst reception ever. Now I could have sworn I read somewhere that when you flash SPL(?) from another compatible device that you should also flash the radio. After this, I glanced through all the 'About Phone' numers and nothing seemed different. Even the 'FASTBOOT' screen details (spl etc) numbers seemed the same. After debating on it for awhile, I re installed the MR1 Update. Shockingly enough I had excellent reception in the exact same spot. Before the update I was getting alot of static through the phone. I even called my voicemail and did *228 again and the static was there. But after the update, no static whatsoever. Is this really a possible fluke? Sorry for the rambling, getting over migraine.
[Droid Eris Android Development] chuckz07:
I saw that awhile back myself, strange huh? But also, isn't this scenario how the new upcaoming and un-announced phones got leaked not too long ago? Because someone found some referenced phones not in existance through the software.
[Droid Eris Android Development] binny1007:
Also it seems that all the carriers info is stored in the nv file, I found reference to Sprint and VZW so I really think that hboot might be cross compatible.
[Droid Eris Android Development] jmanley69:
If your question is "Could the recovery image have applied the Sprint radio to my phone?" the answer is no.

The recovery image is a completely separate partition from the regular boot image and system files. If anything had gone to recovery, it would not affect the regular phone operations.

You said the phone rebooted on its own after you flashboot oem recovery-RA-heroc-v1.2.3.img? what did it boot to? the regular boot? where you have SensUI and all that? or a recovery menu?

You got a "failed" what exactly was the failed message? permission denied or some other message?

Honestly... I don't say this for any other reason than to save you headache. You should not try to put any other recovery image on your phone than the one I gave you. The only difference between that image and any other image out there, is that the one I gave you has the kernel for your phone. No other recovery image will work on your phone and you'll spin your wheels not knowing if something actually worked or not. Although other recovery images will not brick your phone, they just won't boot... so you won't know if you've done something right or not.

As you guys get more into this stuff, you'll learn how to make your own recovery images, and you'll see that all I did was take Amon-RA's recovery image, strip out the kernel, change the default.prop to match your phone, and package it back up with your phone's kernel.

I'm serious here... forget that any other recovery image exists, or you won't know if you've done something right or not.
[Droid Eris Android Development] chuckz07:
Jman - 'FAILED - Permission Denied' was the message.

And yes, I know it wasn't for the ERIS. I was just bored and a little frustrated. I started going back to some of the things we have tried in the past just change it up a little.

On another note, I can't help but think someone at HTC is watching this thread and either saying "They are on the right track" or "They had it but did it a little wrong and now they are way off course". I am still learning as I go, and I am not scared of bricking the device because I have the manual update on my computer to recover with. When I don't know as much as some of you, I tend to try things that seem un-ordinary for the simple fact of learning something new, be it goo or bad. I am not stupid when it comes to these phones, but I definately don't know alot yet.

The migraine wasn't from the phone, I get them alot.

On a further note about the recovery.img, could you PM me or something about how to do that. I would very much like to learn that. I've been searching a little but haven't came up with too much about how to yet.
[Droid Eris Android Development] jmanley69:
No prob... it's good to learn... I would just hate to see you actually stumble on something that works, but since your phone doesn't boot into recovery, you think "hey I guess that didn't work"

Here are the resources I learned from (and often reference)

http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images

will tell you how it all works.

I tried to use the mkbootimg that I compiled inside my Ubuntu, but either it was corrupt, or I was doing something wrong. I found the one (attached) that works perfectly. Also, I've attached 2 pearl scripts that I use to split and re-assemble. Just untar all this into a directory in ubunto. My setup is... I have a root folder with these files in it, and subdirectories for each image I'm making... I keep my kernel in the parent dir also (just so I know where it is), but always copy it into my working dir before I make the image. Play around with it, you'll find your own way.
[Droid Eris Android Development] redman213:
Google RSD-Lite 4.5.7.

Can we use this? Sorry if its already been discussed.
[Droid Eris Android Development] jmanley69:
The Eris is from HTC right? so probably not. However, give it a try. the worst that happens is you have to RUU. The not-so-worst that could happen is it doesn't work.
[Droid Eris Android Development] binny1007:
Did you guys know the Eris has a wiki maybe we should put it to good use and start putting our findings on there?

http://wiki.xda-developers.com/index.php?pagename=HTC_Eris
[Droid Eris Android Development] apreichner:
HTC Desire forum Added

I sent a quick email to the admin, and I noticed today and saw the section at the bottom! We should start posting in there, I'll talk to a moderator and ask about moving this post.

EDIT:

Well it was there, now its gone.

EDIT 2:

Post was relocated from CDMA Hero to Droid Eris Android Development. Bookmarks to CDMA Eris forum should still work as there's a shortcut.
[Droid Eris Android Development] ivanmmj:
The shortcut is permanent. Have fun people. :p
[Droid Eris Android Development] rigamrts:
a nice clean forum. just don't dirty it up with nonsense or it will get locked and take off your shoes your getting mud all over the new carpet LOL!!

it's gonna be hard for people to find us from the main page cause the desire section is not there hope this get fixxed
[Droid Eris Android Development] zifnab06:
Yay! It took long enough. Thanks for the forum XDA!

I started looking into the ARM code stuff. I have no clue what's going on with it. I'll have to wait until I get back to school and have my teacher help e out with it. Maybe I'll call it undergrad research :D Just a thought.

Anyways, it looks like my idea is going to be way harder than I thought. I'll have to write some sort of code to modify what is on the stack (how programming works mostly) right before it's executed. So......

In theory, I should be able to wait until the terminal starts, start another program right alongside it, and modifies what gets run right alongside, so the shell program, adbd won't notice. The only problem with this (Where I"m having problems) is that the phone is running so much other stuff.......the processor handles i don't know how many functions at once, jumping back an forth between instructions. And finding one or two instructions out of all of them is hard, becuase it can run 528 MILLION per second (if it's got a 528Mhz processor).

Meh. If we can find another way, it would be better.
[Droid Eris Android Development] rigamrts:
put a shoutout to an old dev who used to help in the G1 forums for his help. if he declines my request it's understandable there was some beef started back when he was last here. i have a few of the old devs on my twitter so hope he'll help us out of sympothy.
[Droid Eris Android Development] wasupwithuman:
congrats on the new forum guys... umm. I was reading up on a android app called DroCap, it uses some exploit to gain root access, so you can take screen shots of your phone (similar to picme). The exploit was patched in 1.6, but aren't your phones running 1.5 that htc hacked? maybe try running it, and if it runs then you could essentially get root.

sorry if you all have already tried it. search google for ADC2 Entry DroCap Exploit for more info.
[Droid Eris Android Development] rigamrts:
nope won't work whatever it was that made drocap work has been patched in the eris.
[Droid Eris Android Development] wasupwithuman:
here is the .zip of DroCap, it took awhile to find. Let me know if it works for you.

edit: oh just read your post...that sucks.
[Droid Eris Android Development] chuckz07:
Jman - Thanks for the info and the file. I'm gonna look into it all when I have some spare time.

To all fellow ERIS members...Have a Merry Christmas!
[Droid Eris Android Development] binny1007:
Nope does not work.
[Droid Eris Android Development] tats_06:
I absolutely CANNOT wait till Eris gets rooted :D

My hands been itchin...

and MERRY CHRISTMAS TO ALL!!!
[Droid Eris Android Development] binny1007:
Merry Christmas everyone.
[Droid Eris Android Development] ataranine:
Gah what a great Christmas present it would have been eh? Sadly that would have been the only thing I got this year. :(

Damn Santa hates me...he won't even give me root access..fat bastard...see if I leave some cookies out for you. >.>
[Droid Eris Android Development] rigamrts:
hopefully the dude will answer me back and agree to kinda help us along. he's a great guy but things happened here so he might be still cross with xda.

he has the moto cliq so all he can do is guide us along.
[Droid Eris Android Development] zifnab06:
Merry Christmas everyone!
[Droid Eris Android Development] Woozy82:
Rooting the Droid Eris Solution

Okay I tried to read through 90+ pages but fell asleep twice can someone please simplify. If i missed it could some one provide link. How can I get it to connect as a com port or as a modem in order to write a prl? Thanks in advance for your hard work my friends :)