yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] crisp82:
I get this:

C:\Documents and Settings\Chris\Desktop\android-sdk_r04-windows\android-sdk-wind

ows\tools>adb shell mount -a

C:\Documents and Settings\Chris\Desktop\android-sdk_r04-windows\android-sdk-wind

ows\tools>adb shell df

Filesystem 1K-blocks Used Available Use% Mounted on

tmpfs 48980 0 48980 0% /dev

/dev/block/mtdblock4 81920 30196 51724 37% /cache

/dev/block/mtdblock3 92160 57224 34936 62% /system

/dev/block/mtdblock5 302848 72784 230064 24% /data

/dev/block/mmcblk0p1 7397628 376156 7021472 5% /sdcard

/dev/block/mmcblk0p2 351423 77280 255393 23% /system/sd

C:\Documents and Settings\Chris\Desktop\android-sdk_r04-windows\android-sdk-wind

ows\tools>adb shell ls -la /data/

drwxrwx--x 1 1000 1000 2048 Mar 31 21:19 .

drwxr-xr-x 15 1000 1000 0 Mar 31 21:20 ..

drwxrwxrwx 1 0 0 2048 Mar 31 18:44 DxDrm

drwxrwx--x 1 1000 1000 2048 Mar 31 17:05 anr

drwxrwx--x 1 1000 1000 2048 Mar 31 21:19 app

lrwxrwxrwx 1 0 0 22 Mar 31 18:44 app-private -> /system/s

d/app-private

drwx------ 1 1000 1000 2048 Mar 31 18:44 backup

drwxrwx--x 1 1000 1000 2048 Mar 31 17:03 dalvik-cache

drwxrwx--x 1 1000 1000 2048 Mar 31 18:44 data

drwxr-x--- 1 0 1007 2048 Mar 31 18:47 dontpanic

lrwxrwxrwx 1 0 0 11 Mar 31 18:44 drm -> /data/local

-rw-rw-rw- 1 0 0 105 Mar 31 17:04 fix_permissions.log

-rw-r--r-- 1 0 0 11276 Aug 1 2008 fix_permissions.sh

drwxr-xr-x 1 0 0 2048 Mar 31 21:19 lib

drwxrwx--x 1 2000 2000 2048 Mar 31 18:44 local

drwxrwx--- 1 0 0 2048 Mar 31 17:03 lost+found

drwxrwx--t 1 1000 9998 2048 Mar 31 18:45 misc

drwx------ 1 0 0 2048 Mar 31 18:49 property

-rw-rw-rw- 1 1013 1000 2 Mar 31 20:36 pvcodec.txt

drwxrwxr-x 1 1000 1000 2048 Mar 31 21:17 system

drwxr-xr-x 1 0 0 2048 Mar 31 18:45 system-framework

drwxrwxrwx 1 1018 1018 2048 Mar 31 18:44 wimax

C:\Documents and Settings\Chris\Desktop\android-sdk_r04-windows\android-sdk-wind

ows\tools>adb shell ls -la /system/

drwxr-xr-x 1 0 0 2048 Mar 31 21:20 .

drwxr-xr-x 15 1000 1000 0 Mar 31 21:20 ..

drwxr-xr-x 1 0 0 2048 Mar 31 21:19 app

lrwxrwxrwx 1 0 0 15 Mar 31 21:20 bin -> csys/system/bin

-rw-r--r-- 1 0 0 3562 Aug 1 2008 build.prop

drwxr-xr-x 1 0 0 2048 Mar 31 21:19 csys

lrwxrwxrwx 1 0 0 21 Mar 31 21:20 customize -> csys/system

/customize

lrwxrwxrwx 1 0 0 15 Mar 31 21:20 etc -> csys/system/etc

lrwxrwxrwx 1 0 0 17 Mar 31 21:20 fonts -> csys/system/fon

ts

lrwxrwxrwx 1 0 0 22 Mar 31 21:20 framework -> /data/syste

m-framework

lrwxrwxrwx 1 0 0 9 Mar 31 21:20 lib -> /data/lib

drwxr-xr-x 1 0 0 2048 Mar 31 21:18 lost+found

lrwxrwxrwx 1 0 0 17 Mar 31 21:20 media -> csys/system/med

ia

drwxr-xr-x 1 0 0 2048 Mar 31 21:19 modules

drwxrwx--x 7 1000 1000 1024 Mar 31 18:46 sd

drwxr-xr-x 1 0 0 2048 Mar 31 21:19 usr

lrwxrwxrwx 1 0 0 16 Mar 31 21:20 xbin -> csys/system/xbin
[G1 Android Development] stevetigersix:
Cool I'm keen to run Vega legend with your patch so keep up the great work bud v. Appreciated, would the glitches have anything to do with my spl and flashing the danger rom ,n00b speak there lol
[G1 Android Development] Firerat:
well, everything looks like its there, with the correct permissions

I can see maybe three different installs?

are you having problems with other ROMs or just this?

Does a Full wipe, repair ext help?
[G1 Android Development] crisp82:
Haven't tried an ext repair. In my limited understanding, I thought this removed the need for the ext?
[G1 Android Development] Firerat:
you have apps on your SD

Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 48980 0 48980 0% /dev
/dev/block/mtdblock4 81920 30196 51724 37% /cache
/dev/block/mtdblock3 92160 57224 34936 62% /system
/dev/block/mtdblock5 302848 72784 230064 24% /data
/dev/block/mmcblk0p1 7397628 376156 7021472 5% /sdcard
[B]/dev/block/mmcblk0p2 351423 77280 255393 23% /system/sd[/B]

what does

adb shell getprop ro.hardware

output?
[G1 Android Development] crisp82:
'sapphire'
[G1 Android Development] Firerat:
well, apps2sd should be skipped

and you still have problems after a full wipe?
[G1 Android Development] crisp82:
Yep. Just trying to install the King Klick DroidEris ROM with ext partition, then apply your update.

Am I right in thinking that your cache hack will increase performance on a mt3g?

EDIT: That didn't work : (

I/Process ( 2735): Sending signal. PID: 2735 SIG: 9

I/ServiceManager( 2709): service 'telephony.registry' died

I/ServiceManager( 2709): service 'entropy' died

I/ServiceManager( 2709): service 'netstat' died

I/ServiceManager( 2709): service 'clipboard' died

I/ServiceManager( 2709): service 'batteryinfo' died

I/ServiceManager( 2709): service 'usagestats' died

I/ServiceManager( 2709): service 'SurfaceFlinger' died

I/ServiceManager( 2709): service 'power' died

D/BootAnimation( 2744): SurfaceFlinger died, exiting...

I/Zygote ( 2714): Exit zygote because system server (2735) has terminated
[G1 Android Development] jcarrz1:
extremely similar to my post on this page. happens on Danger SPL and Engineering, with the respective builds, as well as Danger with all of the King builds (eris, legend).
[G1 Android Development] crisp82:
I used the 1 click root in Unlockr, but don't think I have added DangerSPL. I have HBOOT-1.33.0007 (SAPP10000)
[G1 Android Development] jcarrz1:
no, but even with that spl I'd have the error too. Repairing EXT made it work ONCE, and once only... ima try a new SD card.
[Droid Eris Q&A, Help & Troubleshooting] composerdude:
Hey guys,

I've done some dev on *NIX before, including writing ways to sign my own packages using encrypted hashes and the like. Does anyone know the method that HTC is using to sign the zip files?

The reason that I ask is because I'm interested in trying my hand at reverse-engineering the signature. I am sure some of you guys have already done some work in that area, and I'd rather not repeat someone else's effort if y'all have already taken steps to break the signature. My CSI teacher told me to never start from scratch if someone else has already done good work. It's insulting to them, and makes more work for you.

Where are you folks at with breaking the signature? Is the method known (i.e., is it based on files inside the zip, is based on the bits of the zip, is an additional hash or added metadata, etc)? I would really appreciate any feedback on this if you have the time.

EDIT: For those of you who are leakers or users et. al. DO NOT get any hopes up about this thread. I'm just getting started and this idea could fizzle within minutes of you reading this particular sentence. Anyone posting, please focus on practical suggestions or comments such as sickbox's initial comment below. Thank you!
[Droid Eris Q&A, Help & Troubleshooting] thawkth:
I've wondered about this since the beginning.

I understand just how complex signing can be (to some degree, I'm not a math guy but I understand scale).

My thought though is we can utilize several tools to make this process possible - though I have no idea how to implement most of this to make this possible. Maybe I'm nuts, but here goes...?

- We now have what, three or four different HTC signed images in the wild with another on the way (OTA). Would it be possible when trying to reverse the sig to utlize the differences between the packages to narrow the cope a bit?

And next

- Using GPUs to process data like this has been shown to be exponentially more efficient and effective than CPUs. What would it take to use some of our awesome GPU power ( a la CUDA) to attempt this task?

Lastly:

- Can we break up the processing required among several of us to speed things further?

I know this has probably been thought of before and discarded for good reason, but I guess the more ideas the merrier.

I'm no CS guy, but I would love to help! I'm one of those unfortunate leakers but rather than whine I'm looking for ways to help. Reversing the HTC key would make life sooo easy. Who knows, maybe they'll use the same key on the next few phones?
[Droid Eris Q&A, Help & Troubleshooting] composerdude:
Pretty much why I'm asking NOW is because I have enough packages for me to examine and compare and test against. I'm not the best or the most experienced at it, but this kind of thing is fun for me and fits into my spare time. When I have spare time.
[Droid Eris Q&A, Help & Troubleshooting] sickbox:
It's not the signing we need to know how to do its the cryptographic key that they use to sign their packages that we need. The private key changed with the last bootloader so even if we cracked the key before the couple hundred years it would have taken us to crack the one used for 1.5 we would have to do it again now for 2.1 stuff.

Just look around for test signing and such and you can find the test key that people use to sign stuff as well as the method used to sign the package.

As far as getting the key... you will have to know someone from HTC who would risk their job to get you a copy of their private key.
[Droid Eris Q&A, Help & Troubleshooting] composerdude:
Greetings Sickbox,

I guess my intention isn't clear. I want to be able to sign packages regardless of what key HTC uses. We have a signature, and we have keyhole. I've noted that the behavior on my Eris is that the signed packages check out just fine each time no matter what version I'm trying to flash (obviously, cannot downgrade, I know, but trying to downgrade still passes the signature and it is the version that fails). So what I would like to do is reverse engineer the signature not necessarily to find the key, but to discover how to create keys. I have 4 different packages, and two test keys that I can examine.

I'm only wanting to know if someone knows how the packages are signed so that I can eliminate looking at all the signing methods. In my research so far, I haven't been able to google, bing, or yahoo anyone who knows what method is used to sign the HTC official packages.

That help, Sickbox? Thanks for your input, I really appreciate it.
[Droid Eris Q&A, Help & Troubleshooting] thawkth:
So the intent is to reverse engineer the key correct? Then we can sign whatever we want...

Or are you trying something else?

Just want to see if we're on the same page.
[Droid Eris Q&A, Help & Troubleshooting] sickbox:
1234567ten
[Droid Eris Q&A, Help & Troubleshooting] composerdude:
I don't necessarily want to reverse engineer the specific key that HTC used to sign any one package, but rather the template for the keys. A prime example of this kind of key decryption would be DeCSS written by DVDJon. He quit trying to reverse engineer the keys used to encrypt DVDs and reverse engineered the decryption of DVD signatures.

I'm not using technical terms for the following, but basically when you sign or encrypt something, the key used is not found within the package or signature, nor is it in the program used to verify the signature or decrypt the package.

If I can do nothing with the signatures of the Eris roms, it's no waste to me. I have fun with this because I want to design an open source DRM system someday. *Sigh* dreams.
[Droid Eris Q&A, Help & Troubleshooting] sickbox:
Try these. I'm still not sure if I fully understand your question but this as much as I could come up with.

Found by searching "android signing" & "android sign rom" on google if you wanna see what else might come up.

http://developer.android.com/guide/publishing/app-signing.html

http://androidforums.com/developer-101/8665-how-signing-roms.html
[Droid Eris Q&A, Help & Troubleshooting] composerdude:
Hmm... maybe I was being too specific when looking for "htc sign rom" and "eris htc sign rom," etc. I'll see what I can cull from those broader searches. Thanks for the tip, sickbox.
[Droid Eris Q&A, Help & Troubleshooting] sickbox:
np

34567ten
[Droid Eris Q&A, Help & Troubleshooting] bftb0:
You might have noticed that there is a little bit of confusion in the posts here when "signing" is brought up; there are two completely different signing methods in use.

The first applies to applications (.apk bundles), "update.zip" files (which could be used with Amon_RA's recovery), and OTA-delivered update files. The distinguishing feature of these .zip files are: 1. They have a META-INF folder in them with two Manifest files and a RSA public key file, and 2. there is nothing "unusual" about the zip file itself. (The contents of the zip file are signed, but the whole zip file is not.)

The second type is the "rom.zip" files buried inside the MR1/MR2 " RUU" updates. These files, when renamed to PB00IMG.ZIP, can be used with the bootloader to update the phone. The distinguishing feature of this type of file is that: it has a mystery blob of binary data at the front of the zip file - 256 bytes. The rest of the file is an ordinary .zip file, and if you unpack it you will find that there are no manifests, no META-INF file, and no public key certs. (In this case, the entire zip is signed, but none of the individual content files are.) I think it is this second type of signing you were referring to in your posts, but honestly I am not certain.

The first form of signing is perfomed with a java tool called "jarsigner", and its behavior is well understood: it creates the first manifest file by computing SHA-1 hashes for every file to be included in the .zip archive. Then, it creates a second manifest file which shadows the first one, and for each SHA-1 hash value, it "signs" them using the signer's private key. In this 2nd file, it also computes the hash for the complete (1st) manifest file, and signs that hash. In any event, what I mean by " well understood" is that this is just a standard use of RSA public key cryptography, using widely deployed Sun Java tools. Break it and you will have made quite a name for yourself.

Now, as for the 2nd type of file - rom.zip/PB00IMG.ZIP, I have not seen anyone (yet) describe the format of that MIC (Message Integrity Check) 256-byte blob. I poked at it a little, but certainly not exhaustively.

If you want to add to the knowledge here, try and discover what the "format" of that MIC is. I suspect that even if you do that, you will find that the sig uses exactly the same PK tools that are already built in to the bootloader - from the standpoint of practicality, it really doesn't make any sense why HTC would " roll their own" when they already went to the effort of coding RSA tools into their botloader(s).

bftb0
[Droid Eris Q&A, Help & Troubleshooting] composerdude:
Hey bftb0,

You answered my question PERFECTLY. Nobody I've spoken with elsewhere has yet brought up the RSA encryption that's already built into it. You're probably only second guy to mention it, beyond some dude in an IRC somewhere (and I think he was drunk at the time).

Knowing that it is just additional bits on the zip, has anyone thought off hacking it off and paring it to another zip in an attempt to "sign" the zip (I've done this successfully with various signed ISOs)? Also, the public key could be arrived at, given two factors, 1. The same key was used for all Eris 2.1 packages; and 2. The "blobs" of data can be sufficiently compared and I have enough computing power.

Thank God I may be getting an intel I7.

Or I'll just borrow my friend's PC.

I hope I'm not just blowing steam, because it would suck to get working on this and then find it's impossible. But they say that about a lot of key encryption schemes. LIKE RSA on Blu-Ray.

Thank you so much bftb0
[Droid Eris Q&A, Help & Troubleshooting] bftb0:
Don't read too much "encouragement" into my post; I responded in order to shed some light on the way that HTC is doing things, and that's about all.

If you think about it carefully, you will understand that the manifest-signing operation gives you hundreds, if not thousands, of individual plaintext/crypt-text pairs that are all signed with the same private key. That doesn't mean that a known-plaintext attack is easy, though.

The EFF commissioned a project a couple of years back where they built custom hardware that would brute-force key searches for short keys- 256 bit keys IIRC. The machine they built was a parallel processor built from fpgas/DSPs, and it could recover keys in a few days. Their budget for that was in the low 100,000s. Offhand, I don't know what key length HTC is using, but I doubt it is 256 bits.

I don't recommend you spend any cycles trying to brute force a key recovery.

bftb0
[Droid Eris Q&A, Help & Troubleshooting] composerdude:
Dude, I was so encouraged that I want to rip open my PS3 and put it to work RIGHT NOW.

Not really. I'm too lazy-assed to spend much time brute forcing it. I'd rather pick it apart and see if there's anyway to mimic the signature. Your advice that it may be RSA based is more exciting in that it helps me know what I may be dealing with. I hope to pick at the binary data appended to the signed roms either tomorrow or next weekend.

And thats what I appreciate.
[Droid Eris Q&A, Help & Troubleshooting] WithinRafael:
I'm not sure what you're trying to do. You either brute force the private key, using various bits of super-math (e.g. elliptic curve cryptography?), or you give up and move on -- perhaps looking at patching the subsystem responsible for validating signatures (dangerous for production use).

There are no "mimicing" possibilities and swapping blobs/zips around is just silly. You should spend your time elsewhere, like reading up on how public-key cryptography works. :rolleyes:
[Droid Eris Q&A, Help & Troubleshooting] composerdude:
Thanks WithinRafael,

I think some of what I've written above shows I'm researching public-key cryptography. I really appreciate your thoughts, and it became clear by the end of sunday that the signature is specific to the package. Without me doing much work, mostly research. RSA is a load of work and I do not want to mess with trying to crack that.

I recently became interested in trying to turn S-off. Someone recently gained RW access to NVRAM, and I'm hoping this weekend to move on as you mentioned. Thanks for the good discussion, guys!
[Droid Eris Q&A, Help & Troubleshooting] jamezelle:
with a pen....duh :p j/k
[Droid Eris Q&A, Help & Troubleshooting] DarthMowzy:
Anyone have a supercomputer? ...lets brute force it.

Is there a way to check if a rom passes the signature test without trying to load into the phone? Can we check if the signature passes on a computer?

If so we could sign it with all possible keys and see which one passes.

Is this frowned upon and shouldn't even be discussed? or would it just take too long to do? ... or is it just not possible to check the signature on a computer?

... or all of the above?
[Droid Eris Q&A, Help & Troubleshooting] nindoja:
We can check the signatures based on what is stored in the Manifest file inside the PB00IMG.zip file.

It is possible to brute-force it but it would take years to do so it isn't really worth the effort.
[Droid Eris Q&A, Help & Troubleshooting] Raziken:
Q: How does HTC sign their files?

A: With a Pen

aka AES-Ecryption.
[Droid Eris Q&A, Help & Troubleshooting] har0ld:
Hi

How is this going? Have you made any progress on this so far or have you chucked it in the too-hard basket?

The reason I ask is that I am interested in what you have been trying to accomplish.

So far all I have been able to find out about the HTC ROM files is that if one byte anywhere in the file is changed, the varification will fail when trying to flash.

This leads me to believe that the Blob at the start of the file also has a hash check in it too.

What's your thoughts??
[HD2 Windows Mobile 6.5 Themes and Apps] clarkseth:
Hi,

i've problem with the application TT7, because when i try to install it, after, for incompatibility problem, the *.cab delete the Bluetooth interface. There are others post about this, but they're too old, and not all are with QWGA version, and all links for dowload it are expired, could you help me please?

Thanks in advance.
[HD2 Windows Mobile 6.5 Themes and Apps] krzyzag:
Do some search - there are plenty of posts about this issue with TT.

Tip: try to install it on memory card, take card out, factory reset, card in, shortcut to TT and you're should be ok :)

Good luck.
[HD2 Windows Mobile 6.5 Themes and Apps] clarkseth:
Yes but there is also the cub file without bt installation, if it's possible to have it, it's better
[HD2 Windows Mobile 6.5 Themes and Apps] tolosa997:
tom tom 7

i have tom tom working on my tmo hd2 with celeb voices...i cant upload its like 13mb....but go to filecrop.com or google it the file name is ttn7[1].915.9196.vga_black i uploaded the voices just paste them on the the root of sd or device...t
[Hero, G2 Touch Android Development] hanserson1:
Hello Everyone,

to all who have problems with htc sync and the legend roms on hero:

An xda user called beetleman won a legend and on the sd card was the corresponding htc sync version. This htc sync is not yet available on the htc site. It works perfectly with legend roms on hero. Here is the link which was published by beetleman:

http://www.easy-share.com/1909610034/HTCSync2.0.25.exe

Have fun!
[Hero, G2 Touch Android Development] hilwood:
txh for sharing~:)
[Hero, G2 Touch Android Development] four:
Hi, can anyone please upload to another server? i am unable to download from easy-share... thanks
[HD2 General] jgu71424:
Okay this is what happen I had files in my SD card and there was this exe file that i downloaded onto the phone it rebooted and then it stays stuck on the tmobile slpash stick together screen. Tried downloaded a different ROM to the phone but still wont work. I dont know what else to do? Should i return it back to Tmo US and what should i say? Can anyone please help.

Never mind iI fixed it thank you all for your help.... Great Community :)
[HD2 General] eenbox:
You take it back and tell them pretty much that after reboot it simply got stuck... They have lot more capabilities of fixing it quickly then you with replacing ROMs, etc.
[HD2 General] jgu71424:
i dowloaded the spl 1024 can i go back to tmo regular rom US
[HD2 General] chri55tof:
1. Did you flash HSPL ?

2. Are you a new in flashing ROMs

Turn mobile off, turn it on with volume key down. Connect phone to PC using USB cable (word : `serial` changes to `USB`), flash HSPL (if you didn`t flash it already), flash stock ROM or custom ROM (some custom ROMs require to flash radio first).

Kris

EDIT :

Sorry didn`t see some first answers. If you didn`t mess around SPL, you didn`t loose your warranty .. I would take it back to the store. If you changed SPL you can still reverse it and than take it to the store. If you don`t want to, you can follow procedure above (at your own risk).
[HD2 General] jgu71424:
Yes i did flash HSPL 1024 for Tmmo US and had a custom ROM on it. And sort of yes. Do you know where i could get the stock rom so it could back to tmo and i could return it and tell them after leaving it overnight charging with the phone completly off and turning it on in the morning it stayed at the tmo screen. Lets see what they say. But can you or someone give me the stock rom
[HD2 General] chri55tof:
try this

http://xdaforums.com/showthread.php?t=609477
[HD2 General] jgu71424:
Link for TMO US HSPL is down? hope it comes out soon.
[G1 Q&A, Help & Troubleshooting] Booker-T:
I would like to know if this will harm the phone.
[General Questions and Answers] Bishoy:
why my HTC diamond 2 windows 6.5 auto use and auto enable my data connection?

i want it to ask me first, is there is any way to do that and control it?

and when am having wifi connection sometimes it opens the data connection too!!

Kindly help
[General Questions and Answers] sunnymiu:
The reasons mainly because you have made some automatic update unintentionally. In most cases, functions needs you to enable automactic update include:

- Windows Live (force data connection even if WiFi is turned on)

- E-Mail Clients

Which in HTC Sense include:

- Weather

- Twitter

- Facebook in People tab