yashsingh1/xdaforums huggingface dataset:
[Hero, G2 Touch General] sambartle:
Can anyone confirm if the HTC music player app as part of sense can display the embedded art in MP3 files?

I have a very organised collection.. and all the MP3's have (one piece of) embedded art which works in Media Player, and on my iRiver MP3 players with Rockbox..

But on my Hero.. no art is shown.

I understand it should be.. can anyone shed any light on this?

(I'm on Modaco 3.1, but the same thing happened with the Stock ROM as well so I suspect it's somethign I've done wrong.)

All the tags are perfect and all the art was added with mp3tag which seems to be recommended for this job by a quick google..

I've run out of ideas!
[Hero, G2 Touch General] henky92:
try this: download and install itunes, if you're not on mac.

then obviously, import all of your music

tell me if itunes shows your cover art so I can help you further
[Hero, G2 Touch General] harrisonbc:
Works on Mine

My Missus is the Queen of MetaData and has an immaculate set of MP3s together with Album Art etc.

It's all displayed correctly on mine (Modaco 3.1)

Sorry it's not a solution but it may help in fault finding.

Brynn
[Hero, G2 Touch General] sambartle:
Yes the art is all visible in iTunes.

It's weird.. I've actually found a few tracks where it does work.. but they are identical to other tracks where it doesnt.

It seems to prefer smaller artwork, in an exact square shape.. but even changing other tracks to that doesnt guarantee it will be shown.. which is more annoying!!
[Hero, G2 Touch General] craig0r:
I can't help you with making it more automatic, but a program called Album Art Grabber is in the Market and it works wonders. Someone here on xda made it, although I can't recall who. They should be able to shed some light on how Android accesses album art.
[Hero, G2 Touch General] withoutwings:
Or, having AlbumArt.jpg in the same folder as the music should do the trick!

There are some free PC-based utilities to get these as a batch-job for you I think, but I use script in Amarok (CopyCover2) which stores the playing album's image there for me.
[Hero, G2 Touch General] brummiesteven:
Download a tagger (Sorry I can't suggest anything I'm on linux) that allows you to view both ID3v1 and ID3v2 tags (there is one, I used to use it but I don't remember the name).

If you're using ID3v1, copy them over to ID3v2 or viceversa.

This may solve your problem, chances are your music is tagged with ID3v1 and Hero only supports ID3v2.
[Touch Pro2, Tilt 2 Windows Mobile General] Caio:
Hello to everybody,

one person ask me this question today: like the call counters (incoming and outgoing), that are independent from the ROM and didn't forget their values when you flash a new ROM, is there a counter o something similar on our phone that collect information about the flashing process (how many times, when, etc.)?

thank you
[Touch Pro2, Tilt 2 Windows Mobile General] DaveShaw:
I very much doubt that sort of thing could be added to the firmware of the device. Maybe the android guys can come up with something like that, but I doubt we'll ever see it on Window Mobile.

Just my 2'c.

Dave
[HD2 General] hotrodder:
Hi all, Is it possible to pair a leo with 2 devices at once, say one as a headset and use the other to control the phone (access phonebook information, initiate calls etc). I have a JVC AVX 77 head unit in my car with bluetooth, and i have problems with actually initialising calls, however I am building an in car PC with bluetooth and im interested in using the PC to initiate the calls, and the head unit as purely a headset? Anyone know if this is doable?
[HD2 General] hotrodder:
Anyone know?
[HD2 General] Audio Oblivion:
i dont think its doable... not at the same time.
[HTC Excalibur] TheRealCod3r:
I'm going to buy the S620 in a few days and I have a couple of questions. So, what better place to ask then here. :)

The phone has the original WM5.0 on it, and I want to upgrade to 6.5. Should I? A lot of people say that the battery runs out in a flash.

And, since I'm completely new to flashing WM devices, a complete newb can some please give me a link to a idiot-proof guide for flashing? Or some guides on the web, I would really appreaciate it.
[HTC Excalibur] stylez:
Any ROM is better than stock since 6.1 & 6.5 have never been officialy released for Excalibur.

Regards how?

Please take your time to have a good read of the sticky as pretty much everything is covered. ;)

Have fun with new phone :)
[HTC Excalibur] normelmagdael:
very well said!
[HD2 Windows Mobile 6.5 ROM Development] mon_money:
My hd2 bricks after i tried uninstalling hspl with the help of stock rru_signed.nbh file. it is not working now. just a traingle with ! this coming.

any help.. hd2 i have is a vodafone uk stock rom.
[HD2 Windows Mobile 6.5 ROM Development] tictac0566:
You must use a vodafone stock ROM then - the 1.66 HTC ROM flashes the stock SPL

which does not fit your CID, therefore you get the triangle.
[HD2 Windows Mobile 6.5 ROM Development] mon_money:
thx for replying.

I had stock rom 1.48 before and then i installed HSPL so that i can install Stock 1.66 wwe rom into my hd2. It was a successful action. Rom installed and worked correctly without any problem.

But problem arise when I tried to uninstall the HSPL to original spl. I renamed the 1.66 rom .nbh file to LEOIMG.nbh and converted the card format into fat32 also.

when i inserted the card into hd2 and turned it on whilst pressing down volume button. its started into boot loader program and den asked me to press power button to start the process.

And then it ended with an error.. 00028002 NOT ALLOW something like that. which is for Invalid vendor ID..

Please help..

how to return to original spl with the latest 1.66 wwe rom.

thx in advance..
[HD2 Windows Mobile 6.5 ROM Development] EddyOS:
don't think you can, HSPL has to stay on...could be wrong though...

why do you want to take it off?
[HD2 Windows Mobile 6.5 ROM Development] tictac0566:
Actually, you did everything correctly... except that you should use the stock ROM for your device, which is vodafone branded, isn´t it?

BTW, did you check the SPL version already? Because it might be already back to stock SPL, but then, you won´t be able to flash an original HTC ROM.

Being back at stock SPL (with vodafone CID) and trying to flash/launch an official HTC ROM on the branded device results in what you write!
[HD2 Windows Mobile 6.5 ROM Development] mon_money:
Hmm.. is there any harm if i don't remove HSPL??? as m still trying to make my HD2 working..

error coming is 00028002 NOT ALLOW
[HD2 Windows Mobile 6.5 ROM Development] tictac0566:
Get the original 1.43 vodafone UK ROM from here, and repeat what you did.

Follow the first link, select 1.43, then obviously the vodafone ROM.

EDIT PS:

In case you want to keep the stock SPL, but upgrade to the 1.66 HTC ROM, you must do this using SSPL (search for this here in the forum).

As of today, there is no other way of getting the stock SPL back than flashing your original ROM.
[HD2 Windows Mobile 6.5 ROM Development] mon_money:
BIG thank you .. it is working now with the stock 1.43 rom.. and yes u are right.. it was showing me again 1.42 spl after uninstalling the HSPL. :D

u saved my hd2.. thx once again for ur great help.. :D
[HD2 Windows Mobile 6.5 ROM Development] Ibb1982:
Hi

Thanks for the link, however the 1.43 ROM is corrupt, I have tried downloading several times. I try to extra the RUU_Signed.nbh with winrar but it fails, the 1.66 and 1.72 Vodafone ROMs extract fine.

Basically I am trying to restore a Vodafone HD2 to stock ROM+SPL, reason being the phone they sent on an insurance replacement is rubbish e.g. the touchscreen isn't responsive. I tried changing to a custom ROM also Vodafone 1.66 and 1.72 to see if the problem would be fixed but it didn't help.

Now I just need to send the phone back for another replacement.

Does anyone have an alternative link for this 1.43 ROM?
[HD2 Windows Mobile 6.5 ROM Development] chrisukhd2:
I am having a similar issue.

I am trying remove HSPL, I have copied the .nbh file over to the SD already formatted as FAT 32 - I'm using my original ROM.

(RUU_Leo_HTC_WWE_1.48.405.2_Radio_Signed_15.28.50.07U_2.05.51.05_2_Shp )

Also tried with ( RUU_Leo_HTC_WWE_1.43.405.1_Radio_Signed_15.26.50.07U_2.04.50_22_2_Ship )

When I start with volume down pressed, I get a message saying " Upgrade ROM code error please try again " then the multi coloured screen with SPL-1.42.0000 XE.

Please help, I fear I have broken my phone ...
[HD2 Windows Mobile 6.5 ROM Development] samsamuel:
Then your phone is probably provider rom locked.

HSPL is already removed, which is why the WWE roms don't work. You need to find your provider released rom, or (far easier) run hspl2, choose 1.42.hspl, flash either of teh roms you mentioned above by USB, run hspl2 again, choose 1.42.0000 and done.
[HD2 Windows Mobile 6.5 ROM Development] chrisukhd2:
samsamuel

Thanks for the reply.

I can't use HSPL2 as the phone doesn't sink to my PC as it's stuck on the tri colour screen. Unless there is a way of doing this from the memory card.

I'm pretty sure my stock ROM was 1.43, which I have downloaded but can't re flash?.

I guess I need to download a 1.42 O2 ROM from somewhere?
[HD2 Windows Mobile 6.5 ROM Development] ClydeB1:
No need to sync to pc. In bootloader, connect usb cable - when USB shows on the screen then run HSPL2 ;)
[HD2 Windows Mobile 6.5 ROM Development] samsamuel:
pre - and indeed - cisely
[HD2 Windows Mobile 6.5 ROM Development] chrisukhd2:
OK this is using the 1.48 ROM

Used HSPL2 and hacked to 1.42.hspl, pressed power to start update image, and the ROM loaded but then goes back to the tri colour screen again. So I ran flashed through USB 1.48 ROM and got " Invalid Vendor ID " ?

I tried HSPL2 again to hack to 1.42.0000 and then re-flash through USB and got " invalid vendor ID again "

I even tried with HSPL I had before and the same result.

Argghhhhhh

What can I be doing wrong here ?
[HD2 Windows Mobile 6.5 ROM Development] chrisukhd2:
Working now :)

I downloaded the latest O2 ROM 1.72.0 etc and it's working now.

Thanks again guys, you helped me a lot :)

Once more thing my phone now say's it has SPL-1.66 - I guess when unlocking using HSPL2, I now need to choose 1.66.000?
[HD2 Windows Mobile 6.5 ROM Development] jigners:
1. download stock ROM

2. unpack/unzip and place ruu_signed.nbh and ROMUpdateUtility in sd card

3. make sure you have >50% battery life

4. with the device turned off, put sd card in

5. enter boot loader, device will automatically detect ROM file in sd card and

then will install this, it will install stock spl as well so hspl will be removed
[HD2 Windows Mobile 6.5 ROM Development] samsamuel:
sounds like you tried to flash over sd card, which as any fule kno first thing it does is resets the spl, so hspl is no longer installed so the rest of the flash fails.

because its .0000

used sd card again eh? :)

1 - boot the phone to bootloader. (Three coloured screen)

2 - run hspl2, choose whatever spl you like SO LONG AS it ends HSPL.

3 - when the phone reboots, keep volume down pressed to re enter bootloader

4 - run your rom flash over USB

5 - phone should now boot normally.

6 - if you now want to remove hspl again, re run HSPL2 and choose the spl you want, ENDING IN .0000
[HD2 Windows Mobile 6.5 ROM Development] chrisukhd2:
samsamuel

Yes Doh - I was flashing from SD and then trying to flash through USB. It all makes sense now. I got around it though by using the new O2 ROM that's just been released so I didn't need to unlock to bring my phone back to life.

Anyway it's all working fine now with the stock 1.72 O2 ROM, just flashed with HSPL2 and re-installed the Energy ROM.

Thanks again for all the help.

:)
[HD2 Windows Mobile 6.5 ROM Development] samsamuel:
ahh good.

Its a good idea if you flash fairly regularly to do your flashing from bootloader, that way you are visually aware of your spl at every step. just get used to holding vol down as it reboots and you can do the whole thing, hspl, rom, radio, without ever having to pull the battery. just keep booting to tri colour till its done.
[Click Android Development] -bm-:
What about this one?

I have no experiences in Android-Developing, I'm just a normal long-term Linux-User.

What is about that?

http://www.milw0rm.com/exploits/8678

It's an exploit for Kernel 2.6.29 - my be this could work for us or is it patched in Tattoos 2.6.29?

I wish I would find the time to dive in the Android-SDK and cross-compiling a little bit but it won't happen until April :-(

So just for your personal motivation: There are thousands of people out there watching this forum and crossing fingers! So keep up your work and don't stop trying!

Good luck!

Bastian

Moderatoredit: Link repaired - have a nice day :D
[Click Android Development] chusen:
My fingers are crossed :)
[Click Android Development] sheik_yerbouti:
+1 :) Can't wait till the Tattoo gets rooted.
[Click Android Development] Bubisch:
Yeah, crossing fingers for you - nothing more cool than wifi tethering :D
[Click Android Development] -bm-:
Wooh, how fast it can be april...

But until now I'm even unable to sucsessfully compile the exploit. I set up a cross-compile-environment on my laptop, but all I get is:

bastian@linux-rv0l:~/Desktop> /opt/cross/bin/arm-linux-gnueabi-gcc -static -o shoryuken shoryuken.c

shoryuken.c:49:24: error: linux/user.h: No such file or directory

I don't get it, there is a user.h in the cross-compile-environment in gnueeabi's searchpath. Sorry, semes to be a job for real developers if I already got my problems before real problems begin.

And my girlfriend has innumerable methods in killing me in cruel ways if I don't pay her more attention in exactly 2 minutes. Strange. "I want to root my tattoo! Thats very important!" doesn't seem to make any differences, she arguments that I could not even have a tattoo, she sees me naked periodically and she had never seen one...

So real experts, the fields of war belongs to you!

Bastian
[Click Android Development] mainfram3:
The first step is finding the patch that closes this bug. Then, verify if has been aplied in the source that HTC released a couple days ago (very likely, since the exploit is dated from April and our kernel was compiled in November).

If it is not patched, we would need some ARM shellcode, but that is probably easily obtainable in the usual places. Worst case, we would need a ARM dev to write it.
[Click Android Development] -bm-:
I did my best to help. Because as i already said I'm not a developer I will describe what I did to prevent starting someone to work on something that could never work.

I searched for the patch that closes this hole:

CVE-2009-1527 :
Race condition in the ptrace_attach function in kernel/ptrace.c in
the Linux kernel before 2.6.30-rc4 allows local users to gain
privileges via a PTRACE_ATTACH ptrace call during an exec system call
that is launching a setuid application, related to locking an
incorrect cred_exec_mutex object.
---------

and in the Changelog for Kernel 2.6.29.3

commit 2c9ca2baf3f368a2b747124d39bf31b779eb7571
Author: Oleg Nesterov
Date: Mon Apr 27 01:41:34 2009 +0200

ptrace: ptrace_attach: fix the usage of ->cred_exec_mutex

commit cad81bc2529ab8c62b6fdc83a1c0c7f4a87209eb upstream.

ptrace_attach() needs task->cred_exec_mutex, not current->cred_exec_mutex.

Signed-off-by: Oleg Nesterov
Acked-by: Roland McGrath
Acked-by: David Howells
Signed-off-by: James Morris
Signed-off-by: Greg Kroah-Hartman

So I looked for commit cad81bc2529ab8c62b6fdc83a1c0c7f4a87209eb and there is the .diff:

kernel/ptrace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -186,7 +186,7 @@ int ptrace_attach(struct task_struct *ta
/* Protect exec's credential calculations against our interference;
* SUID, SGID and LSM creds get determined differently under ptrace.
*/
- retval = mutex_lock_interruptible(&current->cred_exec_mutex);
+ retval = mutex_lock_interruptible(&task->cred_exec_mutex);
if (retval < 0)
goto out;

@@ -230,7 +230,7 @@ repeat:
bad:
write_unlock_irqrestore(&tasklist_lock, flags);
task_unlock(task);
- mutex_unlock(&current->cred_exec_mutex);
+ mutex_unlock(&task->cred_exec_mutex);
out:
return retval;
}

Then I downloaded and extracted the Tattoo-Kernel-Source from HTCs Website. The patch is small so I looked into ptrace.c by myself. And what should I say, I think HTC missed to close that hole. From HTC's ptrace.c:

retval = mutex_lock_interruptible(&current->cred_exec_mutex);
if (retval < 0)
goto out;

and:

bad:
write_unlock_irqrestore(&tasklist_lock, flags);
task_unlock(task);
mutex_unlock(&current->cred_exec_mutex);
out:
return retval;
}

If the patch would have been applied, it should be &task->cred_exec_mutex but it is still &current->cred_exec_mutex.

Am I right? Could that realy be our chance? If yes, it is on you or someone else to go one, I could only help testing things later one.

Bastian
[Click Android Development] leon1984:
The implementation is full of mutex ... The problem is that they function as a lock if a process is in a mutex, other processes can not enter.

If the root process closes a mutex (mutex_lock), the rest of the processes are kept waiting has to open the mutex (mutex_unlock). Just why we can not access to root processes with another process.And we can not get the root of the tattoo

thx
[Click Android Development] mainfram3:
Well, I think you did a wonderfull job :) I also confirm your findings, I've checked ptrace.c in the HTC released source and the patch that you refer to as not been applied.

I've long forgotten allmost everything I knew about writing shellcode and x86 asm and never had any experience with arm, but I'll try to take a closer look at this during the weekend. I hope someone else will look into it too :cool:
[Click Android Development] -bm-:
@loen1984

That is over my technical horizon... ;-)

In my limited understanding, for the exploit we need a process that already runs with root-privileges to channel in, right?

I don't know anything about Androids architecture, is there nothing running with root-privileges in the background, no process, no daemon?

@mainframe3

I don't know anybody who's firm with arm developing, I hope you do :-)

And I think we should move this in a separate thread, it has not so much to do with Coburns BusyBox hack!
[Click Android Development] leon1984:
I think that all processes in the root before running, close access to the processor, so running in privileged mode as well tell you.

Should be found in the code, when running a root process,that not close the execution of other processes.

thx

PD:Sorry for my english I'm Spanish ..
[Click Android Development] -bm-:
I think that is what happens after the posted security patch is applied, but HTC didn't do that. But I will leave that field for the experts and cross fingers...

I'm german, mine won't be much better ;-)

Bastian
[Click Android Development] mainfram3:
I really can't spend any more time with this, or my boss will probably fire me :)

Quick look at the exploit, we need a setuid program for this to work. Guess what ?

$ ls -l /system/bin/pppd
ls -l /system/bin/pppd
-rwsr-xr-x root shell 147648 2009-10-14 10:39 pppd

Also, someone else has already ported this to arm:

http://xdaforums.com/showthread.php?t=619003

I couldn't download the modified code, because of permission problems, but I contacted the author to see if he will send it to me :)

PS - Yes, we should move this discussion out of this thread :cool:
[Click Android Development] -bm-:
Then you should really get back to work :-)

Mod is already contacted!
[Click Android Development] Bubisch:
So here you are, dudes. Dunno why the first post remains, but it does.
[Click Android Development] -bm-:
Here is the arm port, I could download the file with bubisch's help. I also uploaded it here:

http://www.fileuploadx.de/673586
[Click Android Development] -bm-:
I could'n get my fingers completly of from this (even there is many other work to do...) that day so I set up and compiled a local Android-SDK on my Laptop and crosscompiled the exploid for the Tattoo (I hope). This should be a ready-to-run binary:

http://www.fileuploadx.de/755003

Even if I want to satisfy my curiosity there is no time for me left to do it today. I will get on it again later, but if anybody wants to give it an early try feel free. Instructions how to push it on your phone in an executable directory you will find here in the second half of the first post: http://xdaforums.com/showthread.php?t=619003

In the sourcecode of the exploid there is the explanation on how to use it:

matthew@matthew-desktop:~$ while `/bin/true/`;do ./shoryuken;done
* [... much scroll removed, go make coffee, get a job, do something while running ...]
* /dev/sda1 on / type ext3 (rw,relatime,errors=remount-ro)
* proc on /proc type proc (rw,noexec,nosuid,nodev)
* /sys on /sys type sysfs (rw,noexec,nosuid,nodev)
* varrun on /var/run type tmpfs (rw,noexec,nosuid,nodev,mode=0755)
* varlock on /var/lock type tmpfs (rw,noexec,nosuid,nodev,mode=1777)
* udev on /dev type tmpfs (rw,mode=0755)
* devshm on /dev/shm type tmpfs (rw)
* devpts on /dev/pts type devpts (rw,gid=5,mode=620)
* securityfs on /sys/kernel/security type securityfs (rw)
* gvfs-fuse-daemon on /home/matthew/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=matthew)
* [ WIN! 18281
* [ Overwritten 0xb8097430
* # id
* uid=0(root) gid=1000(matthew) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),
* 44(video),46(plugdev),107(fuse),109(lpadmin),115(admin),1000(matthew)
* #

As mainframe3 posted, pppd ist setuid. Maybe we have to do something to make pppd doing something to be running if it doesn't already.

So cross fingers again everybody - this could break the wall or make us sitting back in tears.

I hope some experts could use this, I will also give it a try later on.

Bastian
[Click Android Development] -bm-:
No questions about where I got the time an what about my motivation about the books I have to read.

Just some short lines about how far I get for the rest to go further.

I pushed my posted binary to the tattoo:

adb push shoryuken /data/local/shoryuken

In that location it is executable! The rest I don't understand realy. In general: I'm able to run the program in a shell:

$ id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
$ ./shoryuken
[ WIN! 3347
Wrote shellcode 9148 line 0
Wrote shellcode 914c line 4
Wrote shellcode 9150 line 8
[ Overwritten 0xb001049c
$ rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
/dev/block/mtdblock3 /system yaffs2 ro 0 0
/dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev 0 0
/dev/block/mtdblock4 /cache yaffs2 rw,nosuid,nodev 0 0
/dev/block//vold/179:1 /sdcard vfat rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8 0 0

$id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
$

When I start shoryuken it returns what you see above without any delay. I'm not sure but shouldn't he say "WIN" when the exploit was successful? As you can see my priviliges didn't change. In his sourcecode shoryuken is run with "while `/bin/true/`;do ./shoryuken;done" That generates an endless loop, doesn't it? Or am I getting something wrong? I wonder how it might terminate somehow...

/bin/true doesn't exist on tattoo, so I generated an endless loop with "while i=1; do ./shoryuken; done"

As expected much text scrolls by on the screen, after a minute the output freezes. I hit ^C and got my prompt back, but when I ran "id" it shows that nothing changed.

So do I understand shoryukens function totaly wrong? What's going wrong and does that mean shoryuken is not working as it should because it says "WIN" every time I run it?

I already said it 5 times, but now I realy can't do anything more with my simple homeuser knowledge and will leave the field for the developers.

Good night!

Bastian