yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] Videofolife13:
In relation to the "anycut" comment, two applications I found that may be of interest are "Testing" and "HTC FTP Test"

"testing" Has Standard battery info in it, but also a place for phone info. This includes "Toggle Ciphering", "turn off radio", "Update/refresh SMSC", "Toggle on DNS Check" and "Toggle CDMA Lab Mode" Maybe one of these will be of interest to someone.

"HTC FTP Test" is exactly what you think it would be. Not sure what one would do with it, but there is a "UL/DL Switch" (I assume upload and download", a "Start" switch. When you press menu, you can choose what ftp port you connect to. This may also be some help to someone if they want to experiment.

Have fun, hopefully I can come back to help soon, but I've been busy lately. Still rooting for everyone.
[Droid Eris Android Development] zifnab06:
Ignore this post. I'm an idiot (most of the time)
[Droid Eris Android Development] zifnab06:
Does anyone know if the .img files contained in the rom.zip/update.zip are signed? Or are just the zip files signed?

Thanks
[Droid Eris Android Development] obelisk79:
I don't think img files are signed. Just zips/apks...
[Droid Eris Android Development] binny1007:
I just found somthing interasting if you do the update witch I did by accident there are some new options in the bootloader one is clear storage and the other is a simlock option and when you run it, it tries to mount the sd card for somthing? Don't know if this will help at all but maybe.
[Droid Eris Android Development] zifnab06:
--/WARNING\--

This COULD brick your phone theoretically. You have been warned

ok, so here is my question (which I cant try for some stupid reasons)

can you get a recovery.img (maybe the one that jmanely put up earlier) and reboot your phone in recovery (hold send, press end). plug it into your computer while in recovery, and using the modded recovery.img use fastboot to flash it to the recovery partition?

I think the command should work like this:

fastboot flash recovery recovery.img

I think you might need the partition name though instead of recovery. type mount at the terminal maybe to find out what the /dev/xxx is for it. i don't have my phone on me righ tnow, otherwise I'd try.
[Droid Eris Android Development] binny1007:
I've tried that and with our versions of hboot they have disabled adb commands so that way is a no go.
[Droid Eris Android Development] jmanley69:
You cannot edit init.rc... it's part of boot.img. so, without root, you cannot replace boot.img.

You may (and I stress this MAY NOT) be able to access /system while it's rw during that brief second. However, the only way to access it would be through adb (which is adbd and I'll cover that in a minute)... 1) adbd may not be running at this moment, and 2) adbd in the release version of android doesn't give you root (that's why you need to edit init.rc to give you that access). So... assuming you could access the phone through adb for the brief instance while /system is rw, if you were root, you could modify /system and chmod sh to make you root. However, since /system/bin only gives w permission to root, you MUST be root to do this, and if you're root, it doesn't matter if you grab the phone at the second /system is mounted rw.

adbd is the daemon that listens for adb. without it running, you cannot do adb shell, or adb pull or adb push or adb anything. If the phone doesn't have this running, you cannot connect to it through adb... period. And... if init.rc hasn't setup the environment variables that tell adbd to run as root, then you can't get in as root anyway (I've tried this on the CDMA Hero before the exploit was found). The Samsung Moment had an issue where adbd was running during the "test mode" and it was running as root (the fact that /system was mounted rw was irrelevant, as root you could have remounted it rw anyway). Your phone does not have a "test mode" that sets up these conditions.

Good thought, but without root access, you can't replace the recovery image on your phone at all... even with something that "looks" like an official recovery image. If you could, you wouldn't be in this situation.

I know it's discouraging, but if it weren't for the exploit that was released in September, the CDMA Hero wouldn't be hacked either. People are always trying to find holes in Linux... every hour of every day... Be patient and a new exploit will be released.

I understand you guys don't know programming enough to scour the kernel code and find these exploits, but I guarantee you that people are doing that very thing every day. The peace of mind is... Now that we have an RUU from before an exploit was released, you can always flash your phone with that (even if you've taken updates), then root your phone, then apply any future updates as you see fit (keeping root the whole time).
[Droid Eris Android Development] markachee:
jmanley, could you compile a full featured netstat command? could maybe give us a better idea of what ports are open.

Or... do I remember there being a way to install busybox without root? would that include a better netstat?

(IPs edited)

$ netstat
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:9734 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:16650 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:7890 0.0.0.0:* LISTEN
tcp 0 0 10.x.x.x:41853 209.x.x.x:5228 ESTABLISHED
tcp 0 1 10.x.x.x:53876 74.x.x.x:443 CLOSE_WAIT

I was thinking we'd try to buffer overflow adb, but I'm guessing since it doesn't run as root, that wouldn't help, right?
[Droid Eris Android Development] Videofolife13:
Wow, thank you for being so kind to us new kids...

Like it was said above, we're just here because it's a well known fact that xda is one of the best places to find information on root, roms, etc., and we're just hoping some people will help us out/point us in the right direction. It's the general hope of myself, as well as, I'm sure, many others, that by posting on this forum, people who have the device and the know-how will come and give us that push we need.

-Video
[Droid Eris Android Development] nelson8403:
http://74.125.93.132/search?q=cache...ication+site:htc.com&cd=1&hl=en&ct=clnk&gl=us

http://www.htc.com/us/product/herosprint/specification.html

it's the exact same in every way.. not a little better CPU, it's in the same boat as the Cell South Hero.. if we get root for the Cell South it should work on the Eris, right now there's a lot of focus on the Droid, and it may or may not work on the Eris.. but i can't imagine they'd have a new forum for a phone that's the same
[Droid Eris Android Development] Videofolife13:
http://xorl.wordpress.com/2009/08/18/cve-2009-2692-linux-kernel-proto_ops-null-pointer-dereference/

So, this article I posted, on further reading, is the same exploit used in flashrec. Asroot2, the exploit for the Sprint Hero seems to be an updated version of that. Since we, Eris users, can't use asroot or asroot 2, I tried both, maybe we need to reinvent it. Do I hear an asroot3? Haha. Anybody else find anything out?

-Video
[Droid Eris Android Development] asrebel:
I think we all know that Verizon's version of the HTC Hero is the Eris, and that the hardware specs are basically identical (there are some minor differences such as a proximity sensor, etc.)

I think the point is that they are different phones when it comes to the OS rev/patches, "drivers", etc. For example the vulnerability on Hero has been "fixed" on the Eris.

In addition, we have no way of knowing whether Sprint will patch the current vulnerability (in their future MR's). We also have no way of knowing whether whatever exploit eventually "cracks" the Eris would necessarily work on the HTC Sprint Hero code at that time either. Yes, I understand the underlying OS vulnerability, but assuming that both carriers are going to deal with it and in a relatively similar time frame seems a little far-fetched, especially since Sprint apparently had many of our "fixes" at least weeks (if not months) ago (see manufacturing date and code on eris).

Personally I don't have a problem with this thread because there is obviously a lot of items that will apply to both forums. In addition, I also don't see anything wrong with cross-communication, but I think long term it would be nice to have a separate forum for the Eris too.
[Droid Eris Android Development] Videofolife13:
Sprint's update didn't patch the asroot2 exploit. Damn. That could have been our way of getting back into the root race as we'd all be looking for a similar exploit. Oh well
[Droid Eris Android Development] binny1007:
Haha I was hoping for that too. I wonder if we mod the update files to put the exploit on our eris. I mean it might work. What do you guys think.
[Droid Eris Android Development] johnsongrantr:
shame on both of you.... wishing us unrootable for your own gain... tisk tisk
[Droid Eris Android Development] Videofolife13:
Haha. Sorry, bud. I had a moment of selfishness there.

Please explain further...

Just a heads up, can't boot a recovery image like what is needed to do the superuser.apk exploit. So, I think we have systematically destroyed almost all possibilities other than a kernel exploit. Still lookin around.
[Droid Eris Android Development] binny1007:
I mean are we able modify the signed update to downgrade our roms. I am not sure how we could do that or what files we would need to replace but it might work
[Droid Eris Android Development] Videofolife13:
It's not cross compatible, from what I understand. So trying to flash our phones with the Hero firmware will not make our lives any easier. We're looking for either a bootloader exploit or a kernel exploit at this point.
[Droid Eris Android Development] binny1007:
I think I might just try and flash the Sprint ruu to my phone and and see what happens I used to use Sprint roms all the time with my 6800 and it would work fine. Worst case I take my phone back and get a new one. Wish me luck
[Droid Eris Android Development] Videofolife13:
Do it. I'm pullin' for you. :)
[Droid Eris Android Development] binny1007:
Well I have been trying to but for some reason when my phone resets into bootloader mode it no longer reconizes it..... maybe I am haveing some driver issues, I'm not sure but I am going to keep trying.
[Droid Eris Android Development] Videofolife13:
If it's in bootloader, you're using fastboot, right? Not adb.
[Droid Eris Android Development] binny1007:
Thu update utility resets the phone into a bootloader mode I am not sure what mode it is a black screen with HTC on it. If I pull out the usb cord it goes to the white screen and says ruu on it
[Droid Eris Android Development] Videofolife13:
Not sure. You let the ruu run without pulling out the usb cord?
[Droid Eris Android Development] binny1007:
Yes, this is not my first time flashing a phone. But I figured it out I needed some drivers from the HTC sync and it started to flash than I got a device id error. I think we might be stuck.... I will look more into it tomorrow.
[Droid Eris Android Development] binny1007:
Ok so I don't know if this will work but if I can downgrade the bootloader than we could flash a recovery image to give us root, I will see if making a gold card tomorrow will work, if it does than I can take the stock Sprint bootloader and put it on and than we should be able to load custom roms. I won't be able to do this till tomorrow so if anyone else wants to try it let me know how it goes
[Droid Eris Android Development] Videofolife13:
Very interesting idea. I like it. I'll look into it tomorrow as well.
[Droid Eris Android Development] Videofolife13:
Wait, I posted way too late at night and probably wasn't thinking quite right.

This may or may not be a good idea. First, the Sprint RUU might flat out refuse to downgrade your bootloader. Let's say it does downgrade it, though. Then, you don't know, for a fact, if you can flash a custom recovery.img or not. So, think long and hard before doing this.
[Droid Eris Android Development] jmanley69:
buffer overflow of adbd won't help. You're correct that since it doesn't run as root, you won't get root access. In theory (and practice if you have the correct code) a buffer overflow (in its simplest terms) causes a program to execute whatever code you want. You can then give it the code to open a shell and send that to a specific port. Now, that command will only run with the authority of the program you've compromised, and since adbd does not run as root, you won't have root. Doing a buffer overflow and passing adbd code to open a shell, will only give you the exact same prompt as you have doing adb shell.

9734 is a port for dmagent. I suggested that you try to find an exploit against dmagent... that's probably your best bet. The other ports are either applications that don't run as root, or ones that won't help you anyway.

As far as busybox, you can load the busybox for android (Google is your friend) to /data/{anything... like busybox... or local... or whatever} and do symlinks (ln) to the commands you want to implement. That will give you all of the things like ps -A, and so forth.... but they only run at your permissions, so if something is only visible or accessible to root, you still don't get it. All of the "pipe" exploits that are out there either don't work with busybox, or aren't truly exploits in your version of the kernel so that's why those don't work.
[Droid Eris Android Development] JTF2007:
I'm not as advanced as everyone here in this thread working on this but some recent searches have led to an old vulnerability in the android browser of one of the android versions.

Are there any native programs on the Eris that may not check permissions in certain modes? Maybe the HTC Sense or touch input. What about during initial setup or G-sensor calibration? Is there any point during phone operation that requires the user input to be written to the root directory or anything like this?

Keep up the good work fellas.

JTF2007
[Droid Eris Android Development] zifnab06:
Not quite. Everything that is saved by applications/users/anything is put in a certain folder, which is on its own partition. When you perform the "Restore Factory Defaults" through the phone, it formats this partition and reboots. Nothing else happens.

As far as browser exploits: The browser runs under the non-root account. So, we can't gain root access with it (as far as I know).
[Droid Eris Android Development] chuckz07:
Would someone who knows about installing Linux and has a few minutes to answer such questions, please PM me. I would appreciate it kindly, thanks!
[Droid Eris Android Development] annymsMthd:
desire

I would first like to say hello to everyone working hard on this project right now. You guys are putting a lot of your time into this and as a new owner of an HTC eris I think i speak for all of us new to the Android community when I say thank you and keep up with the hard work. I just recently bought this phone and I have become really interested in getting full access to this device. I am new to the Linux community and my expertise is in Windows but from what i have seen so far from its developers I hope to learn as much as I can.
[Droid Eris Android Development] binny1007:
Grab the ubuntu Windows installer. They made it so easy a caveman could do it.
[Droid Eris Android Development] JTF2007:
What about root access when mounting/preparing the sd card? Does the folder structure have to be written to the root dir?
[Droid Eris Android Development] chuckz07:
I have that. My questions are do I need the extras ie. bison, flex, gperf, etc that this link says to aquire? If so, do I also copy them to the cd rom? This will be my first time using/trying Linux.

Oops, here's the link... http://source.android.com/download
[Droid Eris Android Development] chizzy58:
Just wanted to say Ubuntu rocks!

and also get the email notifications on the rooting project :)
[Droid Eris Android Development] SirScott:
Yes, you will need to open up a terminal window (Applications --> Accessories --> Terminal) and assuming you're using the 32-bit version, paste in the line that says:

sudo apt-get install git-core gnupg sun-java5-jdk flex bison gperf libsdl-dev libesd0-dev libwxgtk2.6-dev build-essential zip curl libncurses5-dev zlib1g-dev

You will be prompted for your password, then the system will go find those packages and install them for you. You will need a working internet connection on that machine, as that's where it will be looking. No idea if they're on the CD or not.
[Droid Eris Android Development] chuckz07:
Ok, thanks. I believe that answered my question. I have download all the required packages and they are just sitting on my desktop, I just wasn't sure if I could load them from there or move them to the cd and load from there also. Thanks for the answer!
[Droid Eris Android Development] jmanley69:
Keep an eye out here...

http://www.arnes.si/si-cert/cve/rezultati.shtml?niz=function

There's another website with exploits released as soon as they find them. From there, you may be able to find sample code.
[Droid Eris Android Development] zifnab06:
During the activation time, "SPL Unlocked" shows up on the screen.

What is this SPL? Does it have anything to do with the baseband/bootloader?

Thanks
[Droid Eris Android Development] zifnab06:
Normal Warning

THIS MIGHT BRICK YOUR PHONE

Just so you know :D If update.zip files can brick your phone, that is.

So I've got one last idea before I wait for an exploit.

Attached are two update.zip files. Can someone try them on the Eris? I'm not even sure how you update with one of these files, but if you could get it to work.....

Simple way to tell if it worked:

Write something to the / area.

Besides some stuff I played around with, the boot.img files are modified inside. They have a modified init.rc that mounts the root filesystem as normal (read/write), then does the readonly command, except mounts it as rw instead of ro. If my idea is right, we might get it.

Thanks!
[Droid Eris Android Development] Videofolife13:
First, nothing's attached... Haha

Second, what has been done that would get these to work? We've tried doing update.zip and it hasn't worked in the past?

I am interested, as always.
[Droid Eris Android Development] zifnab06:
We've tried some update.zip stuff. I forgot to upload them(link in a minute).

Simple. On the Droid, we have to do something to get it to boot from the sdcard and wipe it. On the Eris, we'd still ahve to do something in the recovery console to get it to load the update.zip.

On the G1, you had to press Alt+L to bring up a menu in the recovery console that would allow you to update from update.zip. On the Droid, you have to hold the Vol+ and camera button to bring up the same menu.

After reading, I don't think we've actually gotten the device to try and load the update.zip. All the stuff (PB00IMG.ZIP) is looking for a different signature than we have. I want access to this menu inside of the recovery console thing. If we can get it, I want to see what I can do with it. Mostly, thats it.

http://www.mediafire.com/?goyjnyglwzw

http://www.mediafire.com/?rq0nxoiwonm

Those are the files I made. Thanks :D
[Droid Eris Android Development] Videofolife13:
I Understand what you're saying. I'm trying to figure out how to come across that recovery menu. I mean, I know fastboot, and hboot looks for that PB001IMG or whatever, and recovery just displays the /!\ with a phone. So, where are these menus that all the Hero people are talking about? Why are we missing out?
[Droid Eris Android Development] zifnab06:
There would be a key combination you'd have to press on the screen with the phone and the /!\ icon. Thats how it works for the droid and G1 anyways. I've tried a bunch of stuff but can't seem to find anything.

Edit - http://javadude.files.wordpress.com/2009/05/android_1.jpg

The menu should look like that, with a bunch of options. Only problem is, we don't have a keyboard. I'll look into the hero stuff and see what I can find.
[Droid Eris Android Development] Videofolife13:
Do it the no nonsense way. Ready?

Soft reset: Power, Call and Vol Up (maybe it flashes after you hit the soft reset.)

Try:

Vol Up

Vol Down

Call

End

Track Ball

Up, Call

Down Call

Track Call

End Call

Up Track

Down Track

End Track

Up End

Down End

Down Call End

Up Track End

Down Track End

Up Call End Track

Down Call End Track

Up Down Call End

I think that covers the majority. here we go
[Droid Eris Android Development] binny1007:
I have tried both of the updates the origanal signed failed it said : wrong digest boot.img and the other one failed verification. And once you get to the recovery screen you press power and home and that will bring up the menu, sorry I found that out a while ago I guess I forgot to mention it.
[Droid Eris Android Development] Videofolife13:
You da best, Binny. Thanks.
[Droid Eris Android Development] zifnab06:
Thanks :D That was the menu I was looking for. Well, now we know the update.zip direction is out for good. Thanks for clarifying that. Just wanted to be absolutely sure.
[Droid Eris Android Development] binny1007:
May not be out for good if you can figure out what wrong digest means and you can some how fix it or bypass it than we could use your update.
[Droid Eris Android Development] Videofolife13:
From my quick read on a couple other threads, it means that it isn't signed properly. So, do we have a for sure signing method?
[Droid Eris Android Development] binny1007:
Well the zip passes verification so I guess that means each .img file is signed too.
[Droid Eris Android Development] zifnab06:
So all I did was modify the boot.img init.rc in the ramdisk to exclude

mount yaffs2 mtd@system /system ro remount

and change it to

mount yaffs2 mtd@system /system rw remount

I just found out whats wrong. I'll have a fix up in a few (give me 10 minutes).

Edit - Not quite binny. MANIFEST.MF has a base32 SHA-1 sum of every file inside of the zip file. I'll mod it and see what happens.
[Droid Eris Android Development] zifnab06:
Round eighteen million....

And its a failure. My idea didn't work. But I did learn one thing.

All the files are "Signed" by putting their location in the zip file in the MANIFEST.MF and CERT.SF, followed by a SHA1-DIGEST. so every file is signed according to its sha1. Meaning, we have a starting point for breaking the encryption (kind of).

If its related to the SHA1, we might just be able to find the signing code and sign our own updates soon, with the default recovery app. YAY :D
[Droid Eris Android Development] rigamrts:
to give some intput on how the update loads what i saw cause i ran the update to the eris with the ruu is it does mutiple sig verifacations and reboots twice so the placing of the signed meta folder won't work anymore.
[Droid Eris Android Development] JTF2007:
You guys probably already know this by now but just in case...

To reinitialize the phone from scratch, turn the phone off, hold the volume down and send buttons simultaneously and press the end button to power the phone back on. This will start the reinitialization process.

Im guessing this doesn't do anyone any good though...just my two cents.

JTF2007
[Droid Eris Android Development] zifnab06:
My finger hurts from pulling the microSD card out too many times....i'm done for the night. Meh.

Edit - WTF is SPL? It could come in useful. Thanks!
[Droid Eris Android Development] binny1007:
Best I can tell you about a spl is I beleave it has something to do with the bootloader I think this is what does the signature checks, if we get a engineering spl I beleave it will bypass all Sig checks. Someone correct me if I am wrong.
[Droid Eris Android Development] zifnab06:
So (correct me if I'm wrong) but during the activation process, it says "SPL Unlocked". Does this mean, during this time, we could possibly go through and flash a custom ROM? Maybe, lets say, pull the battery during activation, and flash our own custom SPL, then flash our custom ROM (which wouldn't need to be signed then, if I understand the above post).

Thanks