yashsingh1/xdaforums huggingface dataset:
[XPERIA X10 Android Development] senthilpgv:
Please help me to resolve x10 flashing Feralab

Default Please help me to resolve x10 flashing Feralab

--> Xperia x10, flashed with 2.3.3

--> Rooted , installed xrecovery

--> Locked boot loader

Steps followed to install FeraLab v29

-------------------------------------------

1. Booted into xRecovery

2. Install custom ROM

3. Chosen FeraKernel.zip

Failed on certification issue

then Installed CMW recovery, Could not flash ferakernel

Tried to flash Feralab v29 ROM it works, but stays in SE logo in 1st reboot..
[XPERIA X10 Android Development] jerpelea:
is hsql

found this

org.hsqldb_1.8.0.11.jar

an hsql local server is started at phone update

and i think that we can connect to it

and extract files

:d

lets see
[XPERIA X10 Android Development] HunteronX:
Good luck!
[XPERIA X10 Android Development] ZenithUK:
I'm probably showing my ignorance here, but what do the options under...

Service Menu > Service Tests > Security

...mean?

SEMC [Key OK][Active]

VIACCESS [Key OK][Deactive]

CMLA [Key OK][Active]

MARLIN [Key OK][Deactive]
[XPERIA X10 Android Development] pakraider:
Here's an idea...

set up your phone to connect to the internet via WiFi to a computer acting as a wireless access point (perhaps in adhoc mode).

Run Wireshark on the PC and sniff the packets going back and forth between the phone and the SEUS server, and you should be able to pick up hopefully what is going on; maybe some handshaking hopefully in clear text and not encrypted.

If the X10 can't connect in adhoc mode, then you could use a regular wireless access point and hook up your PC running Wireshark to that access point (or to a wired hub that shares a connection with the router), put the PC is promiscuous mode, and sniff the packets that way.
[XPERIA X10 Android Development] hoss_n2:
a link for this email please ,and does that mean that there will not be any root at all
[XPERIA X10 Android Development] Murch:
Has anyone checked if this method is possible?:

hxxp://code.google.com/p/android-roms/wiki/Obtain_Root
[XPERIA X10 Android Development] san1 x10:
This information may help someone here

when i updated firmware to 21 i saved this log from DaVinci Service Client v22.73

:>>>>>

...

Script initialization. Please wait...

Loading S1 Loader... OK

20091222 15:39:00 S1_LOADER R4A024 1226-2250

Memory Stick: 8GB

Opening TA...OK

Reading TA Please Wait...OK

Closing TA...OK

Opening MiscTA...OK

Reading TA Please Wait...OK

Writing TA Data...OK

Writing APP-SW/amss_fs.sin...OK

Writing APP-SW/apps_log.sin...OK

Writing APP-SW/amss.sin...OK

Writing APP-SW/fota0.sin...OK

Writing APP-SW/fota1.sin...OK

Writing APP-SW/recovery.sin...OK

Writing APP-SW/dsp1.sin...OK

Writing APP-SW/boot.sin...OK

Writing APP-SW/cache.sin...OK

Writing APP-SW/preset.ta...OK

Writing FSP/system_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.sin...OK

Writing FSP/userdata_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.sin...OK

Writing TA Data...OK

Starting Advanced Section...

Closing TA...OK

Shutting Down...OK

Your X10 Has Been Successfully Updated!

Execution Time - 00:07:47

Done! )))))

____________________________________________
[XPERIA X10 Android Development] Davindy:
This is for the Dream....
[XPERIA X10 Android Development] Davindy:
When running SEUS it says I have the current version but then still proceeds to download the most current software (in case the phone is corrupt I guess?) when it connected to SE servers I was able to capture this (file attached) using a packet sniffer....

Not sure if it helps root, but it does show the path where the latest update comes from, maybe someone can find an older version or dev version on the servers some how?

The IP that all these connections were made to was:

198.87.182.138

The rest is in the attached picture
[XPERIA X10 Android Development] Davindy:
So after doing some more captures, I was able to download 4 files directly from SEUS servers

All files are just long strings of characters, 3 of them were .bin files, and one was a .ser file.

The three bin files were 56KB, 15.8MB, and 109MB, if anyone wants these files to see if they are signed or has any idea of how these might help let me know and I'll post them somewhere.......
[XPERIA X10 Android Development] biktor_gj:
56Kb could be the bootloader, 15mb the kernel+initrd and 100mb the system image. Please upload them somewhere (rapidshare, megaupload, 2shared or such) so we can take a look!

Regards
[XPERIA X10 Android Development] Davindy:
Here are the files

http://rapidshare.com/files/386832812/13150273_277309632_O68X-7KTdAKziS9rJTCR6P8t.ser.html - .ser file

http://rapidshare.com/files/386832814/277196791_xjzBnD68BkXbe5-9oSZvdZYK.bin.html - .bin file 57kb

http://rapidshare.com/files/386832815/277286592_Gt1AVgPBdPLmUb06JefljH5b.bin.html - .bin file 16MB

http://rapidshare.com/files/386832819/277307278__ojZIf6RxVVPDtE3K88bNPoz.bin.html .bin file 109MB

What do you use to view these files?
[XPERIA X10 Android Development] sarky1:
.bin files are images. You will have to extract them..

.ser file is a serialization

I would imagine you can view this with Eclipse or something. I opened it with an editor your able to read what its doing via that.
[XPERIA X10 Android Development] biktor_gj:
Just for your information, SEMC Flash device is the same as in other sony ericsson phones, it reports itself as 0fce:adde (vendor ID:Device ID). So maybe we can flash the phone using SETool, XS++ or something like that... anyone knows about 3rd party flashing software wich lets you flash unsigned images? Some source code? :) (that would be too good)
[XPERIA X10 Android Development] sarky1:
Is there not some low level software that checks the signing at boot?

I thought this would be the standard for devices???
[XPERIA X10 Android Development] instigator008:
SETool does not currently support the X10. A compatible version is on its way apparently.

-------------------------------------

Sent via the XDA Tapatalk App
[XPERIA X10 Android Development] MarylandCookie:
You could try the Blobfs method? :confused:

h ttp://support.setool.net/showthread.php?2029-Flashing-X10-Sucsess

:confused: (getting there..)
[XPERIA X10 Android Development] tiggerbcn:
One thing you can flash with Davinci the X10, maybe they would know how to root the X10 with your program?
[XPERIA X10 Android Development] MarylandCookie:
Laser's official post confirming x10 flashing:

h ttp://forum.gsmhosting.com/vbb/f473/setool-news-update-version-v1-06-a-999565/
[XPERIA X10 Android Development] HunteronX:
It seems to flash a recovery image too - PROCESSING: recovery.sin

FILE FLASHED OK

and maybe bootloader too -

PROCESSING: boot.sin

FILE FLASHED OK

source: http://forum.gsmhosting.com/vbb/f473/setool-news-update-version-v1-06-a-999565/
[XPERIA X10 Android Development] biktor_gj:
Now how to open .sin files? system partition (for example) doesn't have a similar header to any .img that I have seen, and unyaffs2 can't seem to unpack it either...
[XPERIA X10 Android Development] StripLV:
I viewed this:

http://forum.gsmhosting.com/vbb/f473/setool-news-update-version-v1-06-a-999565/

http://support.setool.net/showthread.php?2029-Flashing-X10-Sucsess

can please anybody explain to me what this is? I dont understand that at all.

For what is the SE tool (1.06) needed?
[XPERIA X10 Android Development] instigator008:
Looks like a method to install and sign custom roms.
[XPERIA X10 Android Development] instigator008:
Wonder if this could flash a dev firmware...
[XPERIA X10 Android Development] sarky1:
Do we have dev firmware?
[XPERIA X10 Android Development] instigator008:
I think there are dumps around.
[XPERIA X10 Android Development] ZenithUK:
<Michael Winner> Calm down! It's only a forum! </Michael Winner>

Just to clarify the last few posts, SEtool team have a method for flashing signed firmwares onto the X10 that doesn't use PC Companion. It does not mean that they have rooted the phone. The method they use simply applies alternate ROM versions without using SE PC Companion.

I get the feeling that SE have been watching HTC try to get a "Perfect boot" or "Perfect SPL" and then done something similar. They've closed most of the usual points of attack and are using a partition layout that people aren't familiar with. It's obviously now up to people with far better experience than me about these things.
[XPERIA X10 Android Development] GSeeker:
thanks mate!:o
[XPERIA X10 Android Development] HunteronX:
Is there anyway that Roms could be patched with a hex editor and flashed? This happened with my old SE w850i phone, and the phone partition layout seems to be similar too.

But now a bootloader can be flashed as well etc.
[XPERIA X10 Android Development] zephyrix:
Bootloaders and patched roms could always be flashed.

We've already tried patching the rom and flashing it.

Again, the roms are signed so ultimately they fail.
[XPERIA X10 Android Development] feis:
We have a root! Not done yet, but almost:D

http://xdaforums.com/showthread.php?t=681886
[XPERIA X10 Android Development] jerpelea:
i dont want to reclaim the bounty unless root can be easily achived by everybody
[XPERIA X10 Android Development] tramuyo:
It is easy. To understand X10 files, you have to get back to old SE PDA's (P900, P910, P1) since its the same thing to flash... And if they work with S1 commands, they're a bunch of low/mid-class phones (pheww.. at least they arent A2) so it will be a little easy to hack

I dont have X10 :( cannot experiment... Anyway, will tell you more s00n :)
[XPERIA X10 Android Development] krazyd007:
I have an SETool box but no x10 :(
[XPERIA X10 Android Development] Ganii:
I have an SETool box and get X10 from my friend

to test something :D
[XPERIA X10 Android Development] Fallen Spartan:
I've temporarily stuck this thread. Hopefully it will make it easier for new users to see
[XPERIA X10 Android Development] funfobia:
So krazyd007, i just saw your thread with the_laser in SETool support forum.

Then there is no go on this one? boot.sin will not flash, right?
[XPERIA X10 Android Development] krazyd007:
Yes that is correct take a look here

it seems as though flashing the boot.sin isnt going to work. http://support.setool.net/showthread...flash-boot.sin
[XPERIA X10 Android Development] HunteronX:
Try flashing it with the new V1.07 version - apparently there was a major flashing bug.

Changelog -

v1.07

- fatal flashing bug fixed.

odm phones, pda phones was affected.

greatly sorry for inconveniences.

- memory consumption decreased while flashing x10 phones.

http://support.setool.net/showthread.php?2111-HELP-V1.06-CAN-T-OPEN!!!

Rapidshare link from this webpage is here:

http://rs606.rapidshare.com/files/388750093/v1.07.rar
[XPERIA X10 Android Development] VMaxFuture:
From Zephyrix -

If we can crack the loader for this and modify the firmware files directly, then it's simply a matter of changing ro.secure=1 to ro.secure=0 in default.prop inside the bin, then flashing.

FILE_277196794_1264160195000_1264061951000_2771967 91_87559_INFILE_LONGTERM -> S1_QSD8250_eSheep_Loader_1226-2250_LIVE_AID0x0001.sin

FILE_277286594_1270622078000_1268290408000_2772865 92_16629674_INFILE_LONGTERM -> APP-SW_RACHAEL_GENERIC_1227-4612_S1-SW-LIVE-AC12-0001-S1-PARTITION.zip

FILE_277307282_1269857081000_1269855077000_2773072 78_114482261_INFILE_LONGTERM -> FSP_X10a_ROG-CA_NAM1_1233-6929_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.zip

In that part how do you decode SEUS Files? can you said me please?
[XPERIA X10 Android Development] jerpelea:
seus uses HSQL to store flash files

do your magic ;)
[XPERIA X10 Android Development] Davindy:
Are the files signed by the SEUS app after downloading from SE servers?

If they are, then we could trick SEUS into pulling the files from our own server and then sign them....

I've downloaded the bin files directly off SE servers before SEUS touches them, can someone take a look and see if these are signed or not since they have never been touched by SEUS.....

Files are here: (downloading no longer works)

http://xdaforums.com/showpost.php?p=6468013&postcount=65

Does someone know where I can put these files so they can be downloaded more than 10 times?

Or can someone tell me how to check if these are signed or not?
[XPERIA X10 Android Development] balsat:
Send me a link to the file, and i will host it!
[XPERIA X10 Android Development] HunteronX:
You can host them on 4shared.com for free
[XPERIA X10 Android Development] Davindy:
Ok I posted the files again on Mediafire, I think they allow unlimited downloads for less than 200MB so we should be alright, but if someone wants to host these files that would be great..

http://www.mediafire.com/?ym2uyzctvaz - .ser file 27k

http://www.mediafire.com/?qmodbo4nadm - .bin file 56k

http://www.mediafire.com/?z1zz234zzyt - .bin file 15MB

http://www.mediafire.com/?4h31n3ifnbg - .bin file 109MB

These files were downloaded directly off SE servers before SEUS touches them, I found the site and file information by using a network monitor to see where SEUS connected to download files.

All files were stored under this link, but you can't browse files, I was hoping to find an older version with less exploits patched on an older X10 kernel.....but no luck.

hxxp://ma3.extranet.sonyericsson.com/ns/usdoe1/1/script/synch/
[XPERIA X10 Android Development] dikidera:
Hi,

I do not own the Xperia, but i own the Satio...we from the satio community are also trying to flash the satio just like you guys.

if SEUS can flash the phone without any "dongle" then so can SETool. I tried cracking it, but it has Themida protection and could not touch it.

I am looking forward to any method you guys might find ;)
[XPERIA X10 Android Development] balsat:
About 24 min. from now, the files can be found here also.
[XPERIA X10 Android Development] Davindy:
So did anyone find anything out with these files? Are they signed? Can someone tell me what tool to use to check if these are signed?
[XPERIA X10 Android Development] Phantasm4489:
That would be insane if they were. The whole point in signing stuff is that you keep the signing key private. If you provide people with the ability to sign stuff then your security is non-existant. SE would not be so stupid.
[XPERIA X10 Android Development] jerpelea:
teke a look here ;) in post 4

http://xdaforums.com/showthread.php?t=683793
[XPERIA X10 Android Development] Phantasm4489:
Not sure what I am supposed to be looking at in post 4?
[XPERIA X10 Android Development] biktor_gj:
You're looking at the public key used for signing the .sin images
[XPERIA X10 Android Development] HunteronX:
Doesn't that mean we should be able to sign the .sin files using this, and flash them with setool? If so, why are people having problems flashing the rooted boot.sin?
[XPERIA X10 Android Development] jerpelea:
no

we need also private key
[XPERIA X10 Android Development] mimok:
We can see that SIN file is signed with a private key and the public key is provided to verify the signature. However, if SE correctly do its job, the public key is also signed by the privae key of a certificate authority (more informaton here: http://en.wikipedia.org/wiki/Public_key_infrastructure).

In consequence, I believe that SIN file public key is authenticated by the phone before using it. certificate authority public key must be stored and protected into the phone. If it is not the case we can sign the SIN file with our own private key and add our public in the SIN file. But if we can do that SE is really really dumb and they should fire their security engineer.

But maybe I'am wrong (or not...), i'm not an expert in x509 certificate
[XPERIA X10 Android Development] Bin4ry:
Take a look at Wikipedia for RSA. You'll see that one key is for crypting and the other (the private one) is for signing ;)

-Bin4ry
[XPERIA X10 Android Development] HunteronX:
Thanks, I understand now. :)

As we can't get the private key easily, maybe we should try to find more root exploits or do what biktor_gj said on the 'DECRYPTED X10 ROMS and TUTORIALS - DEVELOPPMENT ONLY' thread (Post #19). I don't have a clue where to start on either though... Are there any Android 2.0 or 2.1 exploits that might work with Android 1.6?

http://xdaforums.com/showthread.php?t=683793&page=2

Also from Wikipedia (RSA) - "This procedure raises additional security issues. For instance, it is of utmost importance to use a strong random number generator for the symmetric key, because otherwise Eve (an eavesdropper wanting to see what was sent) could bypass RSA by guessing the symmetric key."

Could this help?
[XPERIA X10 Android Development] xdZKu7:
...yeah, if the RSA-key was created on a Debian-system a few years back that might help ;)

I suppose there might also be other blacklists worth checking up against, but it's only a very slim chance.
[XPERIA X10 Android Development] mimok:
Unfortunately, I don't think so. I think that common tools generate sufficiently strong RSA key... Exploit may be the only way to achieve root on this phone, but X10 kernel seems to be well patched.
[XPERIA X10 Android Development] instigator008:
Maybe the different firmware versions (.14/.16 etc.) could be compared to look for exploits that SE may have patched after the phone was released.
[XPERIA X10 Android Development] jerpelea:
log for both 014 and 016

http://xdaforums.com/showthread.php?p=6514723#post6514723
[XPERIA X10 Android Development] Bin4ry:
Maybe this will work. But someone must write an exploit for it.

http://www.securityfocus.com/bid/38898/info

so who will do this ? I can't do.

-Bin4ry
[XPERIA X10 Android Development] ardf69:
I saw the kernel code. To me it's useless, the only result you can obtain is a system crash (the kernel writes not controllable data to random addresses).

Ciao Angelo
[XPERIA X10 Android Development] Bin4ry:
But the kernel isn't patched. I checked it.

-Bin4ry
[XPERIA X10 Android Development] azzam333:
Thank you for your good efforts. I wish you success.
[XPERIA X10 Android Development] ardf69:
I saw but I don't see a method to do code injection. The kernel fill some memory with some running parameter.

Ciao Angelo
[XPERIA X10 Android Development] Bin4ry:
Ah now i understand what you want to say :D

Yesterday i wrote Brad Spengler to ask if he can root the X10 (just google him).

He wants some informations and now he looks if he can do something for us. Hope he has some ideas. It would be great to have root.

Possibly if he is interested but have problems because he has no device we should buy him one.

But first we must wait what he is thinking. I'm still waiting for response after i send him the informations he wanted.

I'll let you be informed what he says.

-Bin4ry
[XPERIA X10 Android Development] HunteronX:
Could be try editing the ServiceMenu.apk to be able to remove restrictions - there are no settings available to edit, but maybe we could add some.

The reason why I think we could do this, is that we can install over system applications (I accidentally installed a Youtube for 1.5 apk over the original... :o).

Maybe we could even replace a system application with one that has root capabilities if possible, and add functionality to it to copy the busybox binary to /data/app

(I think thats the correct directory?).

Sorry if this is a load of rubbish.
[XPERIA X10 Android Development] Bin4ry:
So. Brad Spengler answered my mail today.

He wrote that it will be hart to root this device and he has no time at the moment to audit the kernel source. BUT he'll point some people he knows to the bounty. So hopefully somebody of them is willing to checkout the kernel source and write an special exploit :)

-Bin4ry
[XPERIA X10 Android Development] GSeeker:
thanks for your efforts!
[XPERIA X10 Android Development] azzam333:
thanks Bin4ry.
[XPERIA X10 Android Development] HunteronX:
Thanks! :)
[XPERIA X10 Android Development] MarylandCookie:
The Motorola rooting process refers to an exclamation mark on the screen, i am sure i have read somewhere on here someone tried flashing their x10 and bricked it and ended up with an exclamation mark. This maybe a shot in the dark but can the same principle be applied to the x10:

# until you see a triangle symbol with an ! (exclamation point)

# ... and now press both volume+ and the camera button -- you will then be presented with a menu

# Using the directional pad on the physical keyboard, highlight apply update.zip and press the select key

MILESTONE ROOT

DROID ROOT
[XPERIA X10 Android Development] sim-value:
No, this is not how the X10 works.
[XPERIA X10 Android Development] tlky:
maybe it will works! who knows

try use different combination key when on the triangle symbol with an !

but the first thing you need to do is brick the phone which i reli dont want to do it .
[XPERIA X10 Android Development] sim-value:
Guys please, people already tried everything to get into some sort of recovery, trust me there is none.

-------------------------------------

Sent via the XDA Tapatalk App
[XPERIA X10 Android Development] lqbweb:
are u working for SE?
[XPERIA X10 Android Development] sim-value:
No, but I can read :-) if you look around the forums you'll see that all key combo's have been tried and the partition layout of the phone and the Firmware files show no indication of such a thing

-------------------------------------

Sent via the XDA Tapatalk App
[XPERIA X10 Android Development] HunteronX:
Are you sure that they've all been tried - and what about the recovery.sin?
[XPERIA X10 Android Development] Bin4ry:
Recovery.sin is misterious till now :D

-Bin4ry
[XPERIA X10 Android Development] biktor_gj:
Given the size of the recovery.sin (5.4mb) and it similar size with boot.sin (5.2mb) I think (and for all I've seen I assume it's true), that recovery.sin is what is booted instead of boot.sin when you start in safe mode.

A kernel with lowered speed, a ramdisk with /data, and some scripts to override all the config wich wasn't bundled with the phone.
[XPERIA X10 Android Development] jerpelea:
same opinion here

maybe later we can build an custom recovery

testing now this...

flashed boot.sin as recovery.sin

phone boots normaly and in safe mode

flashed broken recovery.sin

phone does not boot

! appears in yellow triangle
[XPERIA X10 Android Development] HunteronX:
Ok, thanks.
[XPERIA X10 Android Development] HunteronX:
Try pressing the camera and volume + key like with the droid/milestone root method. Maybe we'll get the same result and be able to flash an update.zip.
[XPERIA X10 Android Development] jerpelea:
i think that you agreee that is an stupid thing

i think that almost all of us have already tried all possible combinations
[XPERIA X10 Android Development] Pissed_Squirrel:
He is talking about doing that combo when you have the exclamation mark. Only then was it possible to be able to flash with the zip

-------------------------------------

Sent via the XDA Tapatalk App
[XPERIA X10 Android Development] Pissed_Squirrel:
It wouldn't hurt to try it
[XPERIA X10 Android Development] ballubas:
jossgray

which rom did you flash? can you give me a link to it please?
[XPERIA X10 Android Development] instigator008:
I believe that jossgray is attempting to be humorous.
[XPERIA X10 Android Development] Bikram:
Are you kidding?? Not funny...........

If not then how did you flash???
[XPERIA X10 Android Development] Davindy:
I think it's funny how desperate people are to get this thing rooted (me included) but if the X10 was truly rooted this board would be going CRAZY!:eek:

Patience people......Bin4ry, Jerpelea and Paul will hopefully find a security hole somewhere soon, keep up the good work guys!
[XPERIA X10 Android Development] Bikram:
The pain of patience is becoming more and more with time brother.
[XPERIA X10 Android Development] krazyd007:
I dont know if this will help but here is x10 mini 3 uk firmware. ;)

http://www.mediafire.com/?4mnyz22jmmh