yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] jmanley69:
possibly the goldcard wasn't configured correctly? But, you should be able to just put the rom.zip on the goldcard and apply that.

You may also be able to just package up boot.img from the sprint ruu and apply that only. Since asroot2 relies on a bug in the kernel, we just need the phone to boot.
[Droid Eris Android Development] jmanley69:
Here's the Sprint boot.img... try using fastboot oem that came with your RUU and try booting with this boot.img
[Droid Eris Android Development] FireSokar:
as much as i want to ill just wait for someone else to guinea pig it :D
[Droid Eris Android Development] woffordk:
Trying now, all along I was creating the goldcard incorrectly. Goldcard works now per the cell south thread. downloading RUU from sprint. More to come soon.
[Droid Eris Android Development] markachee:
Thanks, I just didn't want to derail this thread as it didn't seem like something that would benefit you guys much.

For us, the GoldCard only bypassed the CID check (whatever C stands for... carrier, custom, customer, etc), and not the Device ID. I don't think it will bypass a Device ID check. It for sure won't bypass the bootloader version check, which is why it wouldn't work for us until we got the latest Sprint RUU.

It may be worth a try for you guys with the latest Sprint RUU. Especially since if it does work, you have images from your RUU to use.
[Droid Eris Android Development] laxattack:
I think someone should seriously follow the instructions to the letter with the cellular south guide and see what comes of it :-)
[Droid Eris Android Development] markachee:
If you want to do essentially what the RUU does without erasing your data, from the RUU folder, you can just run:

adb shell reboot oem-78
...wait...
fastboot flash zip rom.zip

That way, if it fails any checks while flashing, it won't have done whatever user data wipe it does normally. ( http://www.suphammer.net/Hero/RUU )
[Droid Eris Android Development] woffordk:
Doesn't work. Won't bypass model ID check.
[Droid Eris Android Development] FireSokar:
Will the gold card allow you to install a eris boot.img that was modified to superboot ?
[Droid Eris Android Development] jmanley69:
again. No.
[Droid Eris Android Development] jmanley69:
However, a properly configured and working goldcard may allow you to put the rom.zip on the sdcard and apply it.

To be clear. That does not mean using fastboot, and that does not mean using the Sprint RUU executable.
[Droid Eris Android Development] FireSokar:
Back to square one :/ im debating about going to sprint to get a hero instead, still under my 30 days
[Droid Eris Android Development] binny1007:
I have tried it. And there id no way around the device id check I tried doing it straight from the sdcard and it still did not work. But who knows maybe my gold card was not working, it passed the simlock test, but feel free to try.
[Droid Eris Android Development] ataranine:
If I have to rip my damn phone apart and take one for the team, I will! For the sake of root!
[Droid Eris Android Development] binny1007:
I need the help of a hex guru. Here is what I am thinking, if we can erase the recovery.img or the boot.img and than insert our own we might be able to flash from there, after many hours of digging through the Rom.zip I found out some stuff if a signed .zip gets pushed to the device it does not check each img individually . The signiture is hidden in extra code in the zip file so, what I thinking if we can remove the boot img from the zip with a hex editor than put our own boot img in than we should be able to flash it. I will post more details in a bit but I am using my phone right now.
[Droid Eris Android Development] ataranine:
I have a hex editor. :P I'm not a cracker or anything but I was looking through code curiously. which file were you checking out, exactly?
[Droid Eris Android Development] binny1007:
I guess you could start by just trying to remove the boot img open the signed zip and look for the boot img try and remove the code and than try to extract it and see if you you removed it.
[Droid Eris Android Development] FireSokar:
There may be another way around it. unpack and repack the the zip the compare the two files. Whats different will be timestamps and the signature. if you set your system clock to the exact time as the original that will rule timestamps out. should only leave a few bytes for the signature. rip the signature and either apply it back over by hex or similar. Dunno which way would be easier your way or this way.
[Droid Eris Android Development] FireSokar:
Binny can you please post the code that needs to be changed in boot.img how many lines need to be changed, and from what to what.
[Droid Eris Android Development] FireSokar:
Binny I found where it starts in the zip just send me a "hacked" boot.img and ill place it in the zip.
[Droid Eris Android Development] FireSokar:
Dont know why i cant edit posts but anyways if you can abse if off the newest update binny that will work so when i hex it in to that one itll just update the os at the same time.
[Droid Eris Android Development] binny1007:
There is one atteched somwere in this thread that jman posted, if you look at the attachments you will find it (click on the little paper clip by the post)
[Droid Eris Android Development] FireSokar:
Ok, ill start looking back I did manage to find the start and end of the file, also the exact compression of the file used to zip it. easiest way is to open the rom.zip, then zip the boot.img with winrar @ normal zip compression name it rom.zip, then open that zip in winhex and it matches identical. Im going to try with your boot.img if i can find it.
[Droid Eris Android Development] binny1007:
Here it is http://xdaforums.com/attachment.php?attachmentid=259006&d=1261399759
[Droid Eris Android Development] binny1007:
Also make sure you keep the PK........ (somthing).... in from the origanal file in there that part must match the very bottom of the .zip file.
[Droid Eris Android Development] FireSokar:
The Pertains to the zip file it was compressed under. It should be changed to the new file. I simply replaced the file over the other file in this. Everything in the zip replaces everything from the old zip. I have a test one for you to try, winrar gives an error because it is a modified zip and it wants to recalculate it (this will remove the key) so this is our only hope im uploading then will send you the zip once done.
[Droid Eris Android Development] FireSokar:
Check your message * Keeps fingers crossed *
[Droid Eris Android Development] crax0r:
Does anyone know if changing the value of console to 1 instead of null will make a difference? Should we try it? I changed the value to 1 so if anyone would like to try it, I got it.
[Droid Eris Android Development] punk.kaos:
How did you do that? If you can change that you can likely change the init, which might lead to root.
[Droid Eris Android Development] FireSokar:
he changed the .ini file for the setup program.
[Droid Eris Android Development] jmanley69:
That's the thing. The Cell South Hero is going to be a different device. The Sprint is HERO200, I'm not sure exactly what the Cell South Hero would be, but every carrier gets their own device ID so that RUU's only go on the right device (and other things).

Now, it's possible that the Cell South Hero is HERO300 or something, and the RUU looks for HEROxxx.
[Droid Eris Android Development] FireSokar:
Injected Jmanley's modified boot.img into the .zip using winhex dead end road, it still fails the image check. Good news is i put the update on my phone tho :D
[Droid Eris Android Development] jmanley69:
Yes, you've changed the signature of the zip as a whole by changing something within it. Even with a hex editor. That's what those signatures are there to protect against.
[Droid Eris Android Development] tbaker077:
I tried Sprite backup, and for the most part it does what you are looking for. However, the software last I remember is still in the beta stages so improvements are still needed.
[Droid Eris Android Development] FireSokar:
Never took note of the 1.16 build number does it appear like this:

1.17.605.1 CL104882 release-keys

The part im curious about is the release-keys is that on the 1.16 (Dec11) update?
[Droid Eris Android Development] markachee:
Well actually the CS Hero and the BC Hero have the same Device ID as the Sprint Hero. (Either HERO200 or HERO20000, i've seen both.) That's the only reason we were able to apply the RUU.

However, The CID is different between the three, but we were able to override the CID check with a GoldCard.

I don't think you guys need to waste much or any time with the Sprint Hero RUU, or any Hero RUU really. If you can find something else that matches whatever your Device ID is, that would maybe be the way to go. Though, keep in mind it would need to be something that has either a non perfected SPL, or is vulnerable to some exploit.
[Droid Eris Android Development] punk.kaos:
Ahh, I thought he meant the kernel command line. :(
[Droid Eris Android Development] binny1007:
This sucks but I do have to say good job HTC/Google they have really locked us down, for now. If we could just change one file we would be good. Ok back to searching the web.
[Droid Eris Android Development] FireSokar:
Is anyone here talented enough to Force the RUU to pause, so we could swap in the replacement rom file after it does the checks? just a simple click to pause RUU would work.
[Droid Eris Android Development] binny1007:
Not going to happen once it gets pushed to the device the phone takes over and does everything automatically.
[Droid Eris Android Development] punk.kaos:
Here's a thought. Fastboot -c will let you change the kernel command line. Has anyone tried to boot the signed bootloader with different command line options? Say load an alternative ramdisk from somewhere else?
[Droid Eris Android Development] aka_word:
Man, you all are dedicated. I just said f--- it. I've never owned the same phone for more than 90 days anyway.
[Droid Eris Android Development] FireSokar:
Before it gets pushed to the phone is when its checked, the zip file once altered is only edited @ the end of the file. If you pause the exe once it checks you could swap it in-time before it reaches 20% to accomplish it.
[Droid Eris Android Development] jmanley69:
If you find the command, I'll slap together a ramdisk.
[Droid Eris Android Development] punk.kaos:
try init=/system/bin/sh

That should give you a root shell on the screen, though you won't have any way to interact with it. Its more of a proof of concept.
[Droid Eris Android Development] jmanley69:
Here are the recovery ramdisk and the boot ramdisk... you can give both a try. If the recovery works, then we put on an update.zip. If the boot works, then we adb shell into the phone and have root (after which, we apply a recovery image, boot image, put su in system, etc, etc, etc).
[Droid Eris Android Development] jmanley69:
If it runs as root, then whey not init=/sbin/adbd
[Droid Eris Android Development] ataranine:
Holy god Jman if this works, you're a god.
[Droid Eris Android Development] binny1007:
How do we use these?
[Droid Eris Android Development] binny1007:
And I take it you use them from fastboot oem-78?
[Droid Eris Android Development] FireSokar:
So much excitement for one day. Either the phones will be hacked or about 20 users will have a heart attack today... im one so whose the other 19? binny you with me!
[Droid Eris Android Development] binny1007:
I stoped getting excited after about the 50th page, my heart can't handle it anymore
[Droid Eris Android Development] ataranine:
*raises hand*
[Droid Eris Android Development] punk.kaos:
Got a copy of the signed boot.img? Looks like I'm gonna need that as well.
[Droid Eris Android Development] Atst44:
The New Guy...

I have been following this forum since page 2. There have been many ups and downs. I have bricked 2 phones trying to learn some of this stuff (Thanks Verizon 30days...)

I just want to say thanks to everyone that has worked on this thus far. I will be donating soon, root or not. (Do I need to donate to XDA or is there a spot to donate to devs for this project?)

Your time has been very educational for me.

Thanks Guys!
[Droid Eris Android Development] jmanley69:
No donations. That defeats the whole point of "free"
[Droid Eris Android Development] jmanley69:
You should be able to get that from the RUU.
[Droid Eris Android Development] Atst44:
Sounds good too me...

If that's how you want it... OK.

I am eternally greatful either way.

Thanks again.
[Droid Eris Android Development] FireSokar:
I pulled the boot.img from the ruu just open the exe from the RUU once open ctrl - alt -delete look for adb.exe right click open file location itll be in the rom.zip
[Droid Eris Android Development] punk.kaos:
Right, I've just not figured out how to extract an RUU when I've only got Linux... I guess I'll just break down and install XP under KVM and do it that way :)
[Droid Eris Android Development] FireSokar:
Check your Private Messages
[Droid Eris Android Development] punk.kaos:
Damn, the boot.img from the RUU still fails the signature check.

That means I can't boot it with different kernel options.
[Droid Eris Android Development] FireSokar:
Would it matter that was from the newest update? let me grab you the older one.
[Droid Eris Android Development] punk.kaos:
Probably won't matter, but lets give it a shot anyway.
[Droid Eris Android Development] FireSokar:
I uploaded it, check your pm. It is different MD5 and is dated prior. So hopefully thats what was wrong.
[Droid Eris Android Development] punk.kaos:
Same result. No dice.
[Droid Eris Android Development] Videofolife13:
Hi binny. Is there any literature that goes with this? I'm sure there's someone around who will compile it for us.
[Droid Eris Android Development] binny1007:
No that was all I could find, I was able to pull netlink off my phone but I am hoping some one can help compiling this. I started a new job last week so my time is limited but ill try to search some more tomorrow.
[Droid Eris Android Development] markachee:
As far as trying this on the Cellular South Hero, is there a way to back up all the different images (radio, boot, recovery, etc) because we don't have a CS specific RUU yet and I'm guessing we might need some or all of those to get things back working again.
[Droid Eris Android Development] obelisk79:
You'd have to spoof the device ID, which is likely not easily possible and you'd still run a fair chance of permanently bricking your phone.
[Droid Eris Android Development] Videofolife13:
Post it up and we'll go from there, I guess.

I don't think enthusiasm has increased since the first week, which sucks cause it's almost been a month. You would have thought we'd have some people really desperately trying to get the root. Instead, it's just some people who have not a lot of linux skills doing trial and error trying to get something to work. Sigh. (End short rant)
[Droid Eris Android Development] jmanley69:
As near as I can figure... place these files in /data/local, chmod 755 each of them, and then you do a

cat /dev/net/netlink

get the pid and then

/data/local/udev pid

(replacing "pid" with the actual pid)

Then, when it's done, you have a root shell. I don't know if this will really work or not though... so no warranties.
[Droid Eris Android Development] jmanley69:
Once you get root, we'll help you get the boot or recovery image and then we can extract the kernel, make a custom recovery, and you can get a nandroid backup.
[Droid Eris Android Development] Videofolife13:
Jumpin' right on it like a champ. Thank you, sir. Your compiling is greatly appreciated. *Dignified bow*

Edit: Snag already. dev/net/netlink doesn't exist... Great.

Edit (good news): netlinks are actually in /proc/*/net/ where * is a random number that I don't get. Here is what they all say

Which PID? 0, 1, 39, 61, or 93?
[Droid Eris Android Development] tdavis42:
I am pulling for you guys. I wish I knew how or had some one to show me how to work on programming because I can't learn just by reading. I can follow instructions but I don't know where to start and these are expensive to replace.
[Droid Eris Android Development] binny1007:
Try /proc/net/netlink that is the file I pulled earlyer.
[Droid Eris Android Development] binny1007:
Also if you "adb pull /proc/ dump" you will find a bunch of stuff that may help
[Droid Eris Android Development] jmanley69:
You've got me. Try each one. If you try it and get a $ type exit and try the next. The documentation in the exploit wasn't very forthcoming.
[Droid Eris Android Development] Videofolife13:
Did that. Haha. Stupid mistake on my part. I tried the exploit with all the pid Numbers in that netlink as well as the other netlinks. No dice. Maybe I'm doing it wrong. Here's what happens

1. adb push the exploit folder

2. adb shell and then chmod 0755 all three files

3.

/data/local/udev #

where # = the PID numbers I've tried.

4. It does open a shell, but it's not a root shell. I can't mount or su...

That's what I've done, for what it's worth.
[Droid Eris Android Development] jmanley69:
That days to me that this probably won't work. It didn't work in my ubuntu 9.04
[Droid Eris Android Development] Videofolife13:
Another stone unturned and another method found to be...well, not useless, but it doesn't work. Well, now what?
[Droid Eris Android Development] binny1007:
We keep looking, and thanks for the help jman, were bound to find a way sooner or later.
[Droid Eris Android Development] Videofolife13:
Good call. We've got two testers for everything at least. Haha.
[Droid Eris Android Development] jmanley69:
Let's try something a little different... somebody get the RUU for Eris from HTC.

The download link is probably something like

http:/ /member.america.htc.com/download/somethingsomething/RUU_Eris_somethingsomethingsomething.exe

You may have to ask HTC for the exact download link... maybe tell them that your phone is acting up, and you've factory restored it and everything, and a Verizon Store "know-it-all" told you that you should contact HTC and get the "Android Phone ROM Update Utility for the Verizon Eris".

Or, you can set up a script to brute force the directory until you find the name of the file
[Droid Eris Android Development] binny1007:
What number would I call at HTC to try and get the ruu
[Droid Eris Android Development] jmanley69:
best to go to HTC's website and follow the support links. They have email support too,
[Droid Eris Android Development] fdxgnd:
I'm new to the forums here. I'm sorry for posting here now, but I have to say that this is almost the most exciting forum I've ever read. I'm sitting on the edge of my chair hitting refresh every 30 seconds. Just got the wife an eris and can't wait to steal it from her. LOL. You guys are def die hard. Props and good luck.
[Droid Eris Android Development] FireSokar:
I think well root this thing quicker if I go plant it in the yard and water it... Maybe itll just grow root itself...
[Droid Eris Android Development] binny1007:
Lol don't forget to wear your sac suspenders while you do that.
[Droid Eris Android Development] redman213:
I can only imagine how frustrated you guys are. Hell I even am even though i haven't done anything. You guys should take a break and think it through.
[Droid Eris Android Development] FireSokar:
True, it is a wee bit muddy from the snow, but once it melts ill update you guys and let you know how its going...:cool: Oh well, Next idea!
[Droid Eris Android Development] ataranine:
Feck it, she's goin back to the store soon. Grabbing me a Droid.

Astounding to me how this phone is more secure than Fort Knox.

All you guys' hard work shall not go unnoticed, however.
[Droid Eris Android Development] FireSokar:
I think ill squat on mine for a few days, maybe ill tell AT&T im sorry re-activate my number i wont switch again, and just go buy the nexus one if its truly rooted.
[Droid Eris Android Development] ataranine:
I'll probably use the Droid til I can get the Passion. That phone will be such a beast I don't care if it gets rooted.

Hell maybe I'll stick with the Fort Knox phone til then, who knows.

But this sucker's definitely going back to the store for the problems it's having with its WiFi chip.
[Droid Eris Android Development] FireSokar:
Did you try running the update? I ran it today and it does feel faster, also hoping it fixes my random after 50 hours mb network stops working... Id stick with the eris if we could obtain root. It just seems farther and farther off in the future. If I had either 2.0/2.1 and or root id be happy. Its just these two things are so not in my hands right now :( I cant even reach out and touch them. and I refuse to go the moto way.
[Droid Eris Android Development] ataranine:
Today's update? Yes, I updated the phone. The WiFi still cuts itself off when someone calls me, like it did before. That should not happen. I'm sure it's a hardware issue. My first Eris didn't do that. At this point I don't even care about 2.1.. the new Sense looks like crap and makes me want the Droid even more.
[Droid Eris Android Development] FireSokar:
"espresso" from what ive been reading espresso will be for another phone and not the update everyone is looking for hero/eris side. If it did come out though I could see more people getting the eris because of the features. So I would assume/hope that means itll be rooted faster, once rooted id want a stock looking sense ui not that espresso crap... its blackberry to me.
[Droid Eris Android Development] ataranine:
I just don't want Sense anymore, period.
[Droid Eris Android Development] eroxb:
does anyone know what the mountd.conf file is for?

what about platform.xml

these are files i found in the root directory /etc

i seem to be able to edit these files with the phone..

platform.xml inside /etc/permissions it says:

this file is used to define mappings between lower level system user and group IDs and higher level permissions named by the platform.

be very carefull when editing this file! mistakes made here can open big security holes.

anybody know if this file will help?
[Droid Eris Android Development] FireSokar:
Disable it. It can be disabled under:

Settings >> Applications >> Manage Applications >>

3/4 of the way down you will see HTC SENSE

Press and Hold >> Launch by default >> Clear defaults

Press the home button and select Home for default android or HTC Sense to renable it, check use by default for this action on what you choose.
[Droid Eris Android Development] ataranine:
I understand that. I've done it before. All it does is change your home screen. It doesn't change that lame ass lock screen, or the Notification bar. I don't want Sense or Rosie or any of that crap, and there's no way to disable that. I went over this with someone else like 50 pages ago. :P
[Droid Eris Android Development] FireSokar:
Guess this all falls back onto the root or new phone then. I prefer root.
[Droid Eris Android Development] ataranine:
Sure does. And me spitting 100 bucks for the difference out my ass seems a hell of a lot more likely to happen. You know?
[Droid Eris Android Development] FireSokar:
I Understand, I do like certain aspects of the sense that has me stuck, my only alternative would be the hero... thinking about nexus one its to "big like a iphone" for me. Id prefer hero over that, but my eris just catches my eye. I do want the nexus one's lock screen though. Welp, good night everyone. Im off to find a way to make custom live folders... Apps, Games etc.
[Droid Eris Android Development] eroxb:
i guess nobody is gonna answer then....ok
[Droid Eris Android Development] punk.kaos:
You can't edit either of these. They're both read only.
[Droid Eris Android Development] eroxb:
well crap..got all excited when the file browser let me open files...wish there was a way to trick the phone into giving the app permission..
[Droid Eris Android Development] eroxb:
releasekey.x509.pem found this zipped up in security folder.

sry forum search sucks found it on google

did find this though

http://acs.lbl.gov/~boverhof/openssl_certs.html

http://pdk.android.com/online-pdk/guide/release_keys.html

thats all i got...probly of no use but im trying