yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] Videofolife13:
I do. I have two command prompts. One that is running fastboot and booting boot.img. I have a second one that I'm trying to run adb commands (devices, shell), but my device isn't showing up under adb in my second command prompt window.
[Droid Eris Android Development] jmanley69:
ok... that means it didn't boot.... I think somebody said it took up to 5 minutes for it to boot something (or error out), I'm sure it's been that long... Try this... do the boot command, go make some coffee... pet the dog... check the mail... take out the trash... come back and see what's going on. It may be fruitless, but at least then you'd know.
[Droid Eris Android Development] Videofolife13:
Doing that right now. Should I be booting the boot.img off my computer (it's in my tools directory for SDK), or should I try booting it off the sdcard or something?

edit: Waited ten minutes and got nothing. it didn't fail, and I couldn't get adb to recognize the device.
[Droid Eris Android Development] binny1007:
Do fastboot boot boot.img start the ruu go through all the steps and hit cancle when you get to the end you should get boot.....okay
[Droid Eris Android Development] chuckz07:
fastboot boot ... boot from flash, not from phone memory. If I am understanding that correctly, we have to first 'fastboot flash' then fast 'fastboot boot'.

Originally posted by zifnab06 (#706)

http://xdaforums.com/showthread.php?t=544409
[Droid Eris Android Development] jmanley69:
You can't flash an unsigned image. You may be able to download (into memory) an unsigned image and boot that... that's what we're trying here.
[Droid Eris Android Development] Videofolife13:
tried

fastboot download boot.img

and couldn't get it to download

I tried doing the run the Ruu after trying

fastboot boot boo.img

in oem-78 mode (For lack of a better phrase.) I couldn't get it to boot. How far into the Ruu do I cancel it? There are two prompts that come up, then it verifies the phone. Do I cancel before it tries to verify, or is there another prompt after that?
[Droid Eris Android Development] binny1007:
Let it verify than cancle it
[Droid Eris Android Development] binny1007:
If I made a debug serial cable do you guys thiink that would help
[Droid Eris Android Development] Videofolife13:
AS the RUU was verifying, I got

booting... OKAY

So I tried to adb shell into the phone

C:\android\tools> adb shell
adb server is out of date. killing...
*demon started successfully*
error: device not found

C:\android\tools> adb shell
error: device not found

So...
[Droid Eris Android Development] jmanley69:
This means that you're using 2 different version of adb... one that's running in the fastboot window, and 1 that's running in that window. Chances are when you ran the adb shell one, it cancelled the fastboot one.
[Droid Eris Android Development] binny1007:
That's were I get stuck too, but I wonder why the ruu triggers it to go boot okay?
[Droid Eris Android Development] jmanley69:
The RUU most likely has it's own boot image.

Ok... you when you try to fastboot boot boot.img, it hangs... what happens when you fastboot boot recovery.img?
[Droid Eris Android Development] Videofolife13:
I'm wondering if the adb we have and the adb the RUU comes packaged with are different and interfering. Maybe if you take the adb out of the temp folder that the Ruu makes and shut the RUU down, then replace the adb you usually use with this new adb and run the whole process we've been trying again, it would be more agreeable. Maybe?
[Droid Eris Android Development] Videofolife13:
What recovery.img do you want me to try? And in oem mode?
[Droid Eris Android Development] jmanley69:
So... let me understand something about your guys and your fastboot... the SPL on your phone is not perfected? On the Sprint Hero, if you boot into fastboot, and try to do anything from the android SDK's fastboot utility, you get "FAILED (remote: not allow)" - this means you have a "perfected" SPL. You guys aren't getting that message? and you didn't load an engineering spl?
[Droid Eris Android Development] moggles:
I get that message unless I use the oem method. I couldnt find an engineering spl for the Eris is there one for it?
[Droid Eris Android Development] Videofolife13:
Same. I can't even get fastboot to reboot unless I'm in oem. I can get fastboot to recognize the device, though.
[Droid Eris Android Development] zifnab06:
jmanely:

We found essentially a "test mode" on the phone. When the ruu runs, it boots the phone into "oem-78". Then, if I understand everything right, it uses fastboot commands to flash the phone. So essentially this oem-78 mode has fastboot access.

If I were you guys, I'd figure out what the oem commands do. fastboot oem h lists all of them. fastboot oem boot does something. they aren't documented well, but it might be the answer.

Try fastboot boot boot.img, followed by fastboot oem boot. See what happens.

Thanks :D
[Droid Eris Android Development] rigamrts:
anybody seen these before. i was trolling around the temp dir seeing what i could find and error 155-159 image error caught my eye. it says something about filesize checking in the ruu any ideas.
[Droid Eris Android Development] binny1007:
Jman plug your phone in and do "adb reboot oem-78" this is the screen that we are working from. And yes we have a perfect spl, it sucks, silly HTC.....
[Droid Eris Android Development] zifnab06:
Wait, when did we get a perfect spl? And where did you get it from? (I thought that you couldn't do anythign with spl's without root)
[Droid Eris Android Development] binny1007:
Hmmm..... I wonder, do you guy think the ruu and the device talk to each other sort of like a double check method and upon conflict one will win. Is there a way to log or sniff exactly what takes place when you run the ruu. And this could be why we are getting Hung up with the oem fastboot commands. Because the device is waiting for some kind of signal from the ruu. Just a thought I mean I have not even been able to flash the untouched rom.zip so. We must be missing something that the ruu does to validate the whole procses
[Droid Eris Android Development] Videofolife13:
Here is what I get when I do fastboot oem h:

fastboot-mac oem h
... INFOcommand list
INFOkeytest
INFOheap
INFOboot
INFOreset
INFOpowerdown
INFOrebootRUU
INFOenableqxdm
INFOrtask
INFOtask
OKAY

Key test tests to make sure the Power, call, vol up, vol down and action (Trackball) are working. What else can we find out?

One more thing:

fastboot-mac oem boot boot.img
... INFOsetup_tag addr=0xA0000100 cmdline add=0x8F06718C
INFOTAG:Ramdisk OK
INFOTAG:smi ok, size = 32
INFOTAG:hwid 0x0
INFOTAG:skuid 0x21E01
INFOTAG:hero panel = 0x4
INFOTAG:engineerid = 0x0
INFOSAMSUNG_512MB_FLASH_256MB_RAM_DUAL_DIE_ID
INFOSAMSUNG_512MB_FLASH_256MB_RAM_DUAL_DIE_ID
INFOTAG:mono-die = 0x0
INFODevice CID is not super CID
INFOCID is VZW__001
INFOsetting.cid::VZW__001
INFOserial number: HT9ATHG01420
INFOcommandline from head: no_console_suspend=1 console=null
INFOcommand line length =407
INFOactive commandline: board_desirec.disable_uart3=0 board_desi
INFOrec.usb_h2w_sw=0 board_desirec.disable_sdcard=0 diag.enabled
INFO=0 board_desirec.debug_uart=0 smisize=32 androidboot.baseba
INFOnd=2.32.40.11.09 androidboot.cid=VZW__001 androidboot.carrie
INFOr=COMMON androidboot.mid=PB0010000 androidboot.keycaps=qwert
INFOy androidboot.mode=normal androidboot.serialno=HT9ATHG01420
INFOandroidboot.bootloader=1.46.0000 no_console_suspend=1 consol
INFOe=null
INFOaARM_Partion[0].name=misc
INFOaARM_Partion[1].name=recovery
INFOaARM_Partion[2].name=boot
INFOaARM_Partion[3].name=system
INFOaARM_Partion[4].name=cache
INFOaARM_Partion[5].name=userdata
INFOpartition number=6
INFOValid partition num=6
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
INFO0
ERROR: usb_read failed with status e00002ed
FAILED (status read failed (No such file or directory))

And after that, it booted up the system normally...
[Droid Eris Android Development] jmanley69:
"perfected" spl is what was shipped on your phone... it's perfected in the eyes of HTC and Google... not you... that means, they've locked it down from you to have access.

If you look in the saphire group, Amon-Ra posted instructions on loading an engineering SPL through the goldcard. Somebody asked if they could put that on the Magic as well... maybe try and PM Amon-Ra and ask him if the same SPL can be put on your phone.
[Droid Eris Android Development] rigamrts:
when you run the ruu in the temp dir there is a file called ARUwizard.ini

inside that file is a log creation command. by default it set to 1 to only log errors as they happen but if it is set to 2 then it should ive me a full log brb going to try it
[Droid Eris Android Development] binny1007:
How did you get it to boot? Did you just let it sit there forever
[Droid Eris Android Development] rigamrts:
if you were talking to me i'm just running a plain jane update no adb or fastboot saw the file while extracting stuff just changed the log settings here's crossing my fingers.
[Droid Eris Android Development] binny1007:
Did you use fastboot and adb from the ruu? I'm so confused on how you did that.
[Droid Eris Android Development] chuckz07:
Ont the 'getvar' side guys, last night I tried 'fastboot getvar security...and the response was security - ON'. Am I safe to assume this is the security that we are trying to bypass? Or could this another security feature on the phone?
[Droid Eris Android Development] binny1007:
No I was reffering to videos post it looks like he booted the img from memory.
[Droid Eris Android Development] rigamrts:
none of the above just the ruu but hey i've got a 15 k log file compaired the the 1k's it's generated in the past let open it up and see whats inside.
[Droid Eris Android Development] chuckz07:
In the temp directory file, where you get the rom.zip is the ARUWizard files. Basically, if you save that whole directory before it deletes itself you can run the wizard without the .exe.

EDIT: By .exe I am referring to the self extracting file you got from PCDPhones
[Droid Eris Android Development] zifnab06:
I'd assume so, yes.

export security OFF

would be the command line to disable it. Good luck getting it to run though.
[Droid Eris Android Development] Videofolife13:
It booted,but not the boot.img. The boot.img failed a check, so I got booted (pun) into the normal system.
[Droid Eris Android Development] binny1007:
Yea I know I have had it saved on my desktop since the day the ruu came out
[Droid Eris Android Development] chuckz07:
Hey, you said your were lost...:D
[Droid Eris Android Development] binny1007:
Ok.... but how did you get that far, and if you have a gold card and you run simlock than try it all the cid locks should be removed, maybe making it able to boot from memory?
[Droid Eris Android Development] rigamrts:
hope this helps guys

i ran it as a regular update nothing special. i ran the ruu without the phone attached then when the file appeared in temp i did a quick mod to it saved it to my docs then pasted it into the temp dir cause you cant save directly to temp. pluged my phone in and let it run.
[Droid Eris Android Development] binny1007:
Haha not that lost.... or wait maybe I am....
[Droid Eris Android Development] zifnab06:
From what I've heard, goldcards for android work a little differently from winmo. They only unlock the CID, not let you flash w/e image you want. So the image still needs the HTC Privatekey + sha1 signature.

And, images have the same privatekey+sha1 signature on newer versions of fastboot.

Jump on irc.freenode.net, room #eris-root. I'll be there for who knows how long (probably forever)
[Droid Eris Android Development] rigamrts:
the log is up on the thread for those who want to take a look how a full update works successfully.
[Droid Eris Android Development] binny1007:
Can anyone make a batch file that mimicks the ruu, one it passes the Sig check maybe we can run our own cammands.
[Droid Eris Android Development] Videofolife13:
After looking at the log text, here's an idea:

1: Get a custom rom.zip we want to flash and the original one that came with the RUU.

2.

adb shell reboot oem-78

This, as we know, takes us to RUU mode. You can verify this by:

fastboot -s (Your Serial Number) getvar boot-mode

3. Erase your cache:

fastboot -s (Your Serial Number) erase cache

5. Next, flash the ORIGINAL rom.zip. This should fail. (That's good) Use

fastboot -s (Your Serial Number) flash zip "Original\Rom\location\rom.zip"

5. The original rom.zip seems to try to do an hboot preupdate. Not sure what that means, but even the RUU fails to flash the first time. Verify that you are in RUU (hboot preupdate) mode using:

fastboot -s (Your Serial Number) getvar boot-mode

6. If that works, then you should be able to

fastboot -s (Your Serial Number) flash zip "Custom\Rom\location\rom.zip"

This is based off the fact that the RUU runs the rom.zip through twice. The first time is to force an hboot update. The second time is to actually flash the rom.zip. I hope this makes sense.

Notes: The custom rom will still need to be signed. I can't do that, so I'm hoping someone can throw one up for us...

(Your Serial Number) = Your Serial Number, no parenthesis. Cool? Cool

Oh, and I take no responsibility for anything bad happening, although, worse that could happen would be you have to do a full restore of your device.
[Droid Eris Android Development] rigamrts:
the most intresting parts that i see in the log are these. you guys migh be able to spot more
[Droid Eris Android Development] punk.kaos:
If someone can post the recovery.zip with our kernel in it and the oem rom, I'll give that a shot and see what we come up with.
[Droid Eris Android Development] Videofolife13:
First post on this page is the recovery.zip:

http://xdaforums.com/showthread.php?t=584352&page=58

I suggest renaming it rom.zip to stay consistent with what we're doing.

I can't attach the original rom, but if you run the ruu, look in the temp folders and copy it and you'll have it.
[Droid Eris Android Development] punk.kaos:
Is there a way to extract it in Linux? I don't have any windows boxes :)

If I have to I can install windows in kvm, but it seems a waste just to extract 1 file...
[Droid Eris Android Development] Videofolife13:
http://xdaforums.com/showthread.php?t=584352&page=71 Post 705. Found it just for you. This is the original rom.zip. :)
[Droid Eris Android Development] ataranine:
I pulled a .prop file from the system folder of my phone, seems to have some pretty interesting stuff.. could it be of any help?
[Droid Eris Android Development] Videofolife13:
Default.prop? If so, it's been pulled..
[Droid Eris Android Development] jmanley69:
Seriously... how about one of you guys talk to Amon-Ra and see if the existing SPL will work on your phone. I think it's great that you guys are willing to try all these things... and I think it's even greater that you found the "oem" fastboot program which seems to bypass the security of the one in the sdk... but I'm confident that if you can load an engineering SPL or HardSPL on your phone, you can bypass all the security checks.

I think it'll save you guys a lot of headache if somebody just PM's him to see what he may have to contribute.
[Droid Eris Android Development] ataranine:
No it's called build.prop
[Droid Eris Android Development] punk.kaos:
No dice:

fastboot flash zip oem-rom.zip

sending 'zip' (23121 KB)... OKAY

writing 'zip'... INFOsignature checking...

FAILED (remote: 12 signature verify fail)

fastboot flash zip PB00IMG.zip

sending 'zip' (2000 KB)... OKAY

writing 'zip'... INFOsignature checking...

FAILED (remote: 12 signature verify fail)
[Droid Eris Android Development] Videofolife13:
Try two things for me:

1. Run the commands with the "-s (Your Serial Number)"

2. rename both to rom.zip (just to be sure)
[Droid Eris Android Development] punk.kaos:
Here's another interesting path to try....

I noticed in fastboot oem there is an 'enableqxdm' command.

qxdm is the Qualcom memory debugger. It can overwrite memory in-place.

I'm going to dig out qxdm and see what I get....
[Droid Eris Android Development] punk.kaos:
Same results as before.
[Droid Eris Android Development] Videofolife13:
Well that's frustrating...
[Droid Eris Android Development] zifnab06:
just an idea

would it be possible to boot from sd?

just a thought.

edit - jmanely: i sent a pm to him. if he sends anything back yay :)
[Droid Eris Android Development] Videofolife13:
I can't push files, or at least mmap_min_addr, into that directory for some reason. It's read only, yet data/local/ is neither read nor write and you can write asroot2 to it... Maybe that folder is write only or something, but yeah. A new mmap_min_addr cannot be pushed into /proc/sys/vm/
[Droid Eris Android Development] binny1007:
I guess what I was asking is there a way to use the cap_sys_rawio to push that file?
[Droid Eris Android Development] Videofolife13:
I don't know. I feel like that might be too much of a work around. I guess I have this image of asroot being rewritten once again with CAP_SYS_RAWIO included in it so that it can run without mmap_min_addr being 0. Does that make sense? Maybe I'm off base here
[Droid Eris Android Development] binny1007:
Yes it does very much, goodluck I hope it works!
[Droid Eris Android Development] ddowell13815:
Just wanted to let you guys know you got some fans rooting for ya'll. It seems eris customers are being left out of the community. I am just hopeful for a way to remove alot of the htc bloatware like sprint hero users can. Good luck.
[Droid Eris Android Development] binny1007:
Any luck so far?
[Droid Eris Android Development] Videofolife13:
None. But i haven't put much work into it and I probably won't be able to until tonight or tomorrow night. If anyone else wants to try, go for it. I did try putting the modded mmap_min_addr with a value of 0 in /proc/sys/vm a couple different ways to no avail, so it seems we're stuck rewriting this exploit.
[Droid Eris Android Development] binny1007:
On a diferant note I figued out how to load a Rom from the sd card take zip file with you img files in it and rename it to PB00IMG.zip and place it in the root of your sd card, reboot holding home and volume down and it will load your zip file. I am going to try a few things and report back.
[Droid Eris Android Development] Videofolife13:
So, this is where we are:

We need asroot to be rewritten to include CAP_SYS_RAWIO in it as it seems to be the only way to get anything to run. If anyone, ANYONE, knows how to rewrite it to include this, I would appreciate it. I have taken this as far as I can go and now I actually need help, not just guidance.

Thanks to binny for helping the cause. We're both hoping someone will come to our aid soon.
[Droid Eris Android Development] jamezelle:
rude ass people, i tell ya!!!!:rolleyes:
[Droid Eris Android Development] ddowell13815:
just out of curiousity is there anything that stops us from loading a different rom like a windows mobile phone? do we need to root the phone to be able to put other roms and such on the eris?
[Droid Eris Android Development] obelisk79:
Just so you, know, I'm rooting for you Eris owners... nevermind the negativity of others.
[Droid Eris Android Development] binny1007:
I have tried it and no luck. I wish it would have been that easy.
[Droid Eris Android Development] chicojd:
Listen here Junior... there is NO Eris Sub-Forum created by the mods as yet... reason? Maybe it's because the Eris IS pretty much the same exact device as the Hero (CDMA)... Cool down, have a cocktail and STFU! There are folks at work here to get yet another HTC device rooted.
[Droid Eris Android Development] nindoja:
linux kernel exploits

To binny1007 and Videofolife13:

The exploits that you are referencing for linux kernels will not work on the android currently because they are written in C or C++. Currently there is only limited support for C/C++ on Android devices, and that support comes via the NDK. I have already tried to get one kernel exploit working on my ERIS and haven't found anything.

For what it's worth, I am going to post in the other thread http://xdaforums.com/showthread.php?t=587952 what I've found so far about the ERIS device.
[Droid Eris Android Development] nindoja:
I've done some early searching, and I've attached my findings.

Eris.txt shows the results of a full TCP NMAP port scan (ports 0-65535), but the results look less than promising.

ErisPS.txt is the output of the ps -e command, and any processes running as root could potentially be exploited to gain root privileges.

Hopefully in the next week/month I'll have more time to investigate this.

A few quick ideas I had for rooting:

1 - look at the HTC SenseUI apps, find any that are running as root and exploit them since they are probably not as thoroughly reviewed as the google processes.

2- take the device apart and try to find a debug port, and pull the entire contents of the device into a file. This will void your warranty, may break your phone, but could provide great insight into the applications running on the device.

2.a. If that file were successfully created, you could use a disassembler or decompiler to look at the code and find vulnerabilities that way.
[Droid Eris Android Development] binny1007:
Ok so I might take apart my eris but what would I be looking for as far as the debug port.
[Droid Eris Android Development] jmanley69:
Have you tried using the latest flashrec?

See if you can get a backup of your recovery image. If so, you should be able to write a recovery image onto your phone.

If it's true that the Eris is at heart a Hero (and please... I'm not advocating that it is or isn't in any way and I'm not trying to bring up old business... this is just a "what if")... then you could try applying Amon-Ra's Hero CDMA ROM.

Also, if you find that you can use flashrec to make a backup, I'll bet that Amon-Ra can write you up a quick recovery if you can get him the necessary files from your devices.

Then, if you can get into a custom recovery, you can design your own Update.zip that will put su in /system/app, reboot, and you've got root to your phone. From there, you can dump the boot image and make your modifications to /
[Droid Eris Android Development] binny1007:
Yes I have tried that and it does not work. Our roms have been patched and flashrec does not work, it useses asroot2, but thanks for trying to help.
[Droid Eris Android Development] jmanley69:
I wonder if you can contact the flashrec devs and work with them? maybe they can have some stuff that you can try... I think they've been doing this through all the "fixes" that get put onto the android phones to prevent rooting.
[Droid Eris Android Development] apreichner:
This may be a dumb question then... But have you tried flashing the Hero RUU NBH with the Goldcard. It seems like it should flash if the Goldcard really worked.
[Droid Eris Android Development] apreichner:
So I think if some how we managed to get an NBH for the Hero RUU, which I have been unable to do thus far as the .exe RUUs won't extract into NBH form. We MIGHT be able to flash a Hero Recovery.

Have any of you tried anything on this page... http://xdaforums.com/showpost.php?p=4898505&postcount=1 . I doubt it'll come to any use for you, but who knows. I also thought I read something about ADB with Goldcard somewhere.
[Droid Eris Android Development] binny1007:
If you get the ok on the spl let me know witch on I will gladly brick my device for the good of the community.
[Droid Eris Android Development] jmanley69:
Your other homework...

Find out if there's a file in the linux file system, that when altered, magically alters the current mount state of the existing mounts.

I don't want to say too much, but find out if that's the case.

/proc/self/mountinfo gives you the current mount points, but I don't think that editing that file will actually change the mount points. I don't know for sure though.
[Droid Eris Android Development] binny1007:
Jman I just want to say thank you from all of us outcast eris owners. It says a lot about someone who helps out and has nothing to gain, so thanks, if your ever in Madison, Wisconsin ill buy you a beer.