yashsingh1/xdaforums huggingface dataset:
[XPERIA X1 Q&A, Help & Troubleshooting] spikegotti:
movies by axxo played with core player, plays the same way it would on your pc, awesome... when i want a movie on my device, i only download by axxo

i never had playback issues before either
[XPERIA X1 Q&A, Help & Troubleshooting] Zeyn Karim:
Video Crisis Solved Finally!!!

So guys, after all this time ive done it! ive just watched a clear movie 800x480 using touch hd video encoder and wmp! turns out it was my rom all along! im now using the evilash leo rom so fast,so smooth,though couple bugs but easily fixable! and now im playing movies!!!!!!!!!! So thanks to everyone for the advice once again im lovin my xperia!
[XPERIA X1 Q&A, Help & Troubleshooting] raduci:
Any news on this ?

I have tried to play some of the videos recorded with my Nokia E90 and the Xperia failed miserably. The videos are in mp4 format and I have tried to play with the included media player.
[XPERIA X1 Q&A, Help & Troubleshooting] altae:
Mp4 does not equal Mp4. In order to be played smoothly on the X1 it has to be the h264 avc codec. Use projection's converter. This way you won't have to mess around with all the possible settings.
[Windows Mobile Development and Hacking General] marsel martin:
I am wondering what's and why the file qtek.rom is in the cfg directory of mkrom.
[XPERIA X10 Android Development] jerpelea:
please remove this thread
[XPERIA X10 Android Development] jerpelea:
kernel source & tools

please remove this thread
[XPERIA X10 Android Development] jerpelea:
Progrss Sumary

1.dumped system.sin - ok

2.dumped root.sin - ok

3.dumped recovery.sin - ok

4.analise loader.sin - ok

5.created custom rom - ok (just recontructed dumped se rom)

6.flash tools for signed files - ok (now you can unbrick your device)

7.investigate recovery.sin - ok (is almost same as boot.sin)

8.developer loader.sin - searching (esential for unsigned files)

9.flash unsigned files - no (esential for root and custom roms)

Tested

1.all key combinations at boot

-left key during boot - safe mode

-right key during boot - 5 seconds into flash mode

2.service menu - in lock screen Menu, Back, Back, Menu, Back, Menu, Menu, Back

3.flashed boot.sin as recovery.sin - phone boots normaly and in safe mode

4.flashed broken recovery.sin - phone does not boot(! appears in yellow triangle)
[XPERIA X10 Android Development] jerpelea:
tutorials & scripts

rip_loader_cert.sh

dd if=loader.sin bs=1 skip=54 count=446 > S1_Loader_Root_f851.cer

dd if=loader.sin bs=1 skip=503 count=128 > loader.hashRSA

dd if=loader.sin bs=1 skip=631 > loader.bin

extract-ramdisk.sh

dd if=boot.sin bs=1 skip=4916769>ramdisk.gz

mkdir boot.sin-ramdisk

cd boot.sin-ramdisk

gzip -d -c ../ramdisk.gz | cpio -i

rip_boot_cert.sh

dd if=boot.sin bs=1 skip=1272 count=438 > S1_SW_Root_ac120.cer

dd if=boot.sin bs=1 skip=1713 count=128 > boot.hashRSA

openssl asn1parse -in S1_SW_Root_ac120.cer -inform der

openssl x509 -in S1_SW_Root_ac120.cer -inform der -text

openssl x509 -in S1_SW_Root_ac120.cer -inform der -pubkey -noout > S1_SW_Root_ac120.pub

openssl rsautl -in boot.hashRSA -out boot.hash -inkey S1_SW_Root_ac120.pub -verify -pubin

openssl asn1parse -in boot.hash -inform der

rip_boot_cert2.sh

dd if=boot.sin bs=1 skip=2088 count=438 > S1_SW_Root_ac120b.cer

openssl asn1parse -in S1_SW_Root_ac120b.cer -inform der

openssl x509 -in S1_SW_Root_ac120b.cer -inform der -text

openssl x509 -in S1_SW_Root_ac120b.cer -inform der -pubkey -noout > S1_SW_Root_ac120b.pub
[XPERIA X10 Android Development] jerpelea:
LOGS

reserved for future use
[XPERIA X10 Android Development] krazyd007:
So flashing one of these roms with setool should work and therefore give us root access if so i will do it now.
[XPERIA X10 Android Development] funfobia:
no krazyd007 those are original from decrypt from SEUS

Will wait for your next release jerpelea keep your work on.

I will try flash your mod until my X10 root!

Cheer!
[XPERIA X10 Android Development] mobilezonerm:
i will also wait for a working boot.sin :)

(i think that the problem is in internals flash file signature ex; security hash,crc control or a bit mismatch, if u know the engine of setool it flash the firmware,original and decrypted, whit online signature, but i hope that also every single file on firmware has his "signature")
[XPERIA X10 Android Development] instigator008:
Re: DECRYPTED X10 ROMS and TUTORIALS - DEVELOPPMENT ONLY

What I take away from all this is that nothing has actually been successfully rooted. Please correct me if I am wrong. Twitter and blogs are going nuts with "x10 rooted" stories but it looks to me that that claim is premature at best. No disrespect meant just trying to clarify.
[XPERIA X10 Android Development] ceyad:
also waiting for working boot.sin

just info:

setool update v1.07

- memory consumption decreased while flashing x10 phones.:)
[XPERIA X10 Android Development] hoss_n2:
it seems that rooting is going far from us again
[XPERIA X10 Android Development] krazyd007:
Yes but did you not read what he said in my topic. ;)
[XPERIA X10 Android Development] carinoxx:
Thanks for your job Jerpelea...

Custom ROM are going to be multilanguage??
[XPERIA X10 Android Development] jerpelea:
a lil info for you :d
[XPERIA X10 Android Development] lifeflayer:
Hmm so it ended up being 1024bit RSA instead of 2048bit RSA. Will it do the bruteforce attack when you flash like the old old SE-TOOLS with k790a era phones?
[XPERIA X10 Android Development] jerpelea:
a lil more info for you
[XPERIA X10 Android Development] jossgray:
i dont think so, the only known method to crack 1024bit RSA is to have access to the system with the private key, and a big computer cluster.
[XPERIA X10 Android Development] biktor_gj:
It would take ages to bruteforce the signing...

I was wondering on another approach...

1) How does this things get the flash over the air? It can do software updates from the phone itself. Anyone, who hasn't debranded their phone (so it still updates through SEUS) could check where it goes and what does it get?

2) We still have the install server, drm inter process communication server, and some kernel modules running as root interacting with the userland (touchscreen, keyboard)... maybe there's a hole there and we haven't seen it? If we can get root access we can rip the entire flash chip to a file then find where to patch the bootloader so it doesn't need signing... anyone knows ARM asm?
[XPERIA X10 Android Development] jerpelea:
can be done after we find jtag pins and we need 1000+ usd hardware
[XPERIA X10 Android Development] lqbweb:
i suppose any cron should be running (alarms, and system stuff), that's very nice idea, at least to try, although i suppose SE took care of that :( ... a shame tomorrow i have an exam :(
[XPERIA X10 Android Development] McKebapp:
Re: DECRYPTED X10 ROMS and TUTORIALS - DEVELOPPMENT ONLY

K, just wasn't sure about that. ;)
[XPERIA X10 Android Development] biktor_gj:
There's no cron working on here, alarms are managed through the framework api, as pretty much everything else..

We still have drm ipc process, wich runs as root. It would be reeeaallly nice to use the drm process to crack the phone (I'd love the irony ;))

Oh, and we also still have the install server wich also runs as root, or even the dalvik vm...

The problem is how to attack this. I guess an specially crafted data packet to the drm and it could crash if we find some buffer overflow, but actually doing it is a veeery different idea...
[XPERIA X10 Android Development] Bin4ry:
Hey i made a new thread and a PayPal Acc for donations to root of X10 (NOT FOR BOUNTY!)

please everyone of you who is developing on X10root contact me per pm so that i can split the donations to all of us.

Regards

-Bin4ry
[XPERIA X10 Android Development] lqbweb:
14 Vodafone ES version here (99% sure):

http://www.megaupload.com/?d=65DRNVQN
[XPERIA X10 Android Development] frostdream:
Re: DECRYPTED X10 ROMS and TUTORIALS - DEVELOPPMENT ONLY

Hello all.

If this can help, I've the .14 firmware (fr debrand).

Anyway thanks to all dev for your hard work!

-------------------------------------

Sent via the XDA Tapatalk App
[XPERIA X10 Android Development] Vilam:
T'es Français ?
[XPERIA X10 Android Development] Vilam:
In witch directory/files is situated the su password ?

Can someone upload it ?

EDIT : Why the hell those guy made a custom room ? :

http://anonym.to?http://jbbs.livedoor.jp/bbs/read.cgi/computer/42652/1273828930/334
[XPERIA X10 Android Development] frostdream:
Re: DECRYPTED X10 ROMS and TUTORIALS - DEVELOPPMENT ONLY

Yes vilam, i'm french :-)

( i don't junk this topic anymore :-) )

-------------------------------------

Sent via the XDA Tapatalk App
[XPERIA X10 Android Development] McKebapp:
I've just wrote a little with my friend -skunk-.

He told me, that it would be easy to determine VCC and Ground.

But it won't be that helpful.

Without any Information to the ICs, that are connected, there is no chance to determine the correct data links.

This night, I'll search a little to find the connected ICs.

Does anybody already have a Level 2 and / or 3 Service Manual?

That would make things a lot easier. :D
[XPERIA X10 Android Development] Vilam:
I'm really sorry :S

So, what about the su password, any idea where it could be located anybody ?
[XPERIA X10 Android Development] lqbweb:
should be on /etc/passwd but that doesnt matter, it's encrypted
[XPERIA X10 Android Development] Vilam:
I don't really care about of the encryption or not.

I can't find this, can somebody upload it ?

Thanks :)
[XPERIA X10 Android Development] thermoska:
there is no /etc/passwd (at least in my device) and since many years the passwords are stored in /etc/shadow not in passwd, there you can only find out usernames, homedirectories and so on ..
[XPERIA X10 Android Development] Vilam:
Too bad^^

Look at this :

http://xdaforums.com/showthread.php?t=678598&page=26
[XPERIA X10 Android Development] MarylandCookie:
I think the information you are after is probably in a hidden partition. :confused:
[XPERIA X10 Android Development] thermoska:
I do not know if there is something higher than / (the root directory) in android

in unix there is not.

why i have to read the theard you linked ?

I have been read the last two pages and realy have no idea what you are trying to tell me

I cannot look via pc to internal phone memory only to sdcard. I checked it with astro filemanager
[XPERIA X10 Android Development] Vilam:
So, forget about my link, it was for everybody here.

So, is there somewhere a cunstom room for the x10 ?
[XPERIA X10 Android Development] carinoxx:
http://xdaforums.com/showpost.php?p=6659204&postcount=295

Maybe you mean this...
[XPERIA X10 Android Development] Vilam:
Yes, thanks, is it unsigned ?
[XPERIA X10 Android Development] carinoxx:
I think we are on ther right way, now we can flash, maybe not unsigned but a weak ago we cant...

Good News...
[XPERIA X10 Android Development] carinoxx:
I think not... :(
[XPERIA X10 Android Development] titom78:
We can flash for more than one week and without this commercial software.
[XPERIA X10 Android Development] biktor_gj:
There's no /etc/passwd or /etc/shadow, simply because android doesn't use them.

IDs are there simply to avoid apps messing with the core services (i.e. dalvik vm) and devices. That's what the dalvik machine is for (making apps work in a closed environment and interact at a user level with the kernel through the framework api, wich is running on the dalvik vm).

There are some declared ids on the init files, such as 'system', 'bluetooth', 'accel' and some more. But there are there to give some parts of the system more privileges (for example, to be able to turn the wifi on from the settings app). All the rest ids are done on the fly when an application is installed, and all the data generated on /data goes with the same uid and guid to let the application access its config files. There are no passwords file anywhere, so you won't find them anywhere (neither on a hidden partition, you would NEED to see the passwd file for the system to be able to validate your login on a typical unix system)

Regards!
[XPERIA X10 Android Development] thermoska:
biktor_gj

thanks for explanation,

Since now I had no idea that there are so huge diferences between unix and android system.

I have a question, just to be sure if I understands it correctly...

a)For now is you know flash the phone, but the problem is that you can flash only signed firmware ? right ?

b)firmware comes to you from SE already signed so there is no chance to get the private key, right?

c) I do not even think about bruteforce attack, takes too long time , right?

d) what exactly checks the signature ? a part of firmware ? or a part in some microprocesor program ? the file which checks firmware comes together with phone ? or it is internal and cannot be changed ?

e) what about to use some exploit ? it will give you at least temp root rights till you do not turn off the phone, then make some changes or patch the os

to have root rights?

I saw file default in / , first line in file is

ro.secure=1 what about to change this ? does it gives you root rights permanently ? I know that for now it is not possible, but after exploit attack maybe ?

I tought about the jtag pins, spoke with my friend. It is so complex and hard, I do not think that it is the right way.

Also correct me if I mistaken, but rooting the phone via pins is not realy user friendly, and not possible to almost everybody .

Sorry for my ENGLISH, it is not my default lang :-D

I really know that my knowledge is far away from yours , but I wanna be usefull somehow , and also I WANT THIS F******G ROOT ON MY FOKIN PHONE. :-D
[XPERIA X10 Android Development] Bin4ry:
To be short:

a) right

b) right

c) right

d) signature is checked by loader. Loader can be flashed but must have signed with actual signature. We are not able to overflash it atm.

e) exploits are fine yeah. But SE did a good job. All known exploits are fixed.

ro.secure will give us root on terminal and adb shell but we cant change without root.

JTag would only be first step. And you're right this is not user friendly.

Sorry for being short and a little rude. But all your questions was answered before.

Regards

-Bin4ry
[XPERIA X10 Android Development] McKebapp:
Apropos JTAG.

No good infos from here yet.

Datalines aren't visible due to a multilayer PCB.

I'm still a little inhibited in beeping the lines out.

Just too afraid to shorten my beloved phone :o .

Right now I'm searching for the Service Manuals.

@the Guys with an EMMA account: Do you have the SM already?
[XPERIA X10 Android Development] lqbweb:
disassembling the phone and taking continuity on jtag lines we could identify with pin is each one... but anyway we have to "break" a phone, most probably when we play with the jtag reflashing bootloader and so on we haven't the "protection" of the bootloader, since it's flashed.... although maybe we can use jtag to get root or maybe just to reflash those segments with the "ro" bit disabled...
[XPERIA X10 Android Development] McKebapp:
That's exactly, what I've been talking about in my post before :D

*justscrewingthatthingbacktogether
[XPERIA X10 Android Development] xanfia:
There are "just" 16 possibilities for knowing which pin is TMS, TCK, TDI & TDO, because Vcc and Gnd are trivial. Then, we will see all devices connected to the daisy-chain. However, if we directly change memory values (that's what I suppose we will find), we will have the same problem as before: the initial bootloader sign verfication. So, every change we could make via JTAG is the same than using FlashX10 java application.

BR

PS: In fact there are 24 possibilites (4!), but this doesn't contribute in anything.
[XPERIA X10 Android Development] lqbweb:
i dont think so... i think by jtag you can flash mtd's directly skiping out the bootloader protection...
[XPERIA X10 Android Development] mimok:
I don't understand why JTAG port is useful in our case.

Even if someone successes to bypass the loader of one phone using JTAG, it will not permit us to easily gain root access on any other phone.

Moreover, JTAG flashing might need some expensive tools...
[XPERIA X10 Android Development] biktor_gj:
About the pinouts, we could assume there's a logical layout, but it's a hit or miss after all. About the purpose of connecting it through jtag, it's not even close. Connecting through usb you depend on the bootloader, through jtag you talk directly to the cpu, so you can execute whatever you want. Don't forget a simple fact: we'll have to patch the bootloader so it let us flash unsigned code. And that's done by patching arm assembly code. A simple 'noop' will probably do it, when patching right instruction, but someone's going to have to do it. And when you play with bootloaders, you mess them. And when you do that the thing doesn't boot up again. Believe me, I have been there before, and I've lost quite a lot of money on devices because of that. And there you want to have jtag and a full nand backup before even thinking of start.

Because you're forgetting one thing, the nand has, at least all this:

initial bootloader

amss filesystem

amss log

radio firmware (based on linux) & bootloader

boot image

recovery image

/system fs

/data fs

/cache fs

imei & sp lock area rom

boot data rom (shutdown data, radio calibration, serial numbers...)

And probably more (or that is my guess). A single bit wrong on any of the critical area and the thing won't start. If you flash a radio which doesn't belong to that chipset, the phone won't boot up even in bootloader mode, or qualcomm diagnostics mode.

So in the end, if we have to touch the bootloader, we better have jtag up & running.

We can flash almost whatever we want with the java application, but I'm not sure we can flash the bootloader itself. When you use the x10flash app, you do this:

Boot on bootloader mode.

Start java app:

Read bootldr info​

Send a second loader (loader.sin) to the RAM, check signature, check hash, execute.​

Second loader waits for first file to process​

Files are sent, checked header, signature, and flashed​

You get out of bootloader and reboot the phone​

On next boot, bootloader checks signatures and crcs of all files, if any fail, it shows the exclamation mark.​

But, to flash the bootloader through usb, the bootloader would have to check the file before flashing it, instead of doing it on next reboot, otherwise it would risk itself to have some bad packet and render the phone unusable.

What's the conclussion of all this crap I just typed? To flash the bootloader we would need a signed loader wich lets us flash whatever we want so the bootloader allows its execution, and then a patched bootloader to leave the door open when we leave... the damn thing is... :mad:
[XPERIA X10 Android Development] xanfia:
I think you are right and that confirms Mimok point, and if we can mess correctly with the bootloader then we will have only one phone with root access...:( We must think in other ways to cut this security chain...
[XPERIA X10 Android Development] Bin4ry:
Yeah at first point. BUT if we got one phone with jtag and a dump, then we can try to flash others through usb without full-bricking it!

-Bin4ry
[XPERIA X10 Android Development] biktor_gj:
My point is, JTAG is not useful for everyone, but in my opinion, it's a necessary step for development of a way everyone can use.
[XPERIA X10 Android Development] lqbweb:
I think the same... maybe we could buy to any of you (with some experience) any x10 (maybe a broken one, or just the pcb, or a imei locked) to make those tries.......
[XPERIA X10 Android Development] extreme22:
HI I would like to help out on this Decrypting of the X10A what tools would i need and if someone can point me in the right direction

thanks
[XPERIA X10 Android Development] Frolex:
Re: DECRYPTED X10 ROMS and TUTORIALS - DEVELOPPMENT ONLY

I agree that even if this wouldnt give root access to everyone it is still major progress. Just look at the original iphone. After alot of work it was finally rooted through hardware changes, and it was only after that that root could be achieved in a simple way.

-------------------------------------

Sent via the XDA Tapatalk App
[XPERIA X10 Android Development] lifeflayer:
since when can you flash unsigned dumps...
[XPERIA X10 Android Development] MarylandCookie:
Heres one:

http://cgi.ebay.co.uk/BOXED-FAULTY-...MobilePhones_MobilePhones&hash=item3f00474c7d
[XPERIA X10 Android Development] lqbweb:
good one, it's a shame is left only 8 hours :( we cant collect such money in that time
[XPERIA X10 Android Development] MarylandCookie:
Isnt a Serial / UART port available through the 3.5mm jack? If so this mught be a more viable option than JTAG.
[XPERIA X10 Android Development] Vilam:
There is the micro input, but I don't know what mean Serial/UART :/
[XPERIA X10 Android Development] OwLOwLOwL:
I was thinking the same thing a while ago... and on the "Upskirt shots" by McKebapp you can clearly see 5 connection pads that presumably go to the 3.5mm jack (Left, Right, Mic, Ground and one more!).

Look at the first picture in the first post in "upskirt shots" in the General section.

Worth investigating....

Regards // OwL
[XPERIA X10 Android Development] MarylandCookie:
Over at the HTC Desire development IEF and others are working on assembling a JTAG cable - they're pretty sure it runs through the headphone port, not the micro USB. Hmmm...
[XPERIA X10 Android Development] Fuzalert2k:
Perhaps the last one of them is the antenna for FM radio?
[XPERIA X10 Android Development] McKebapp:
Didn't find any chip that supports FM Radio... :(
[XPERIA X10 Android Development] biktor_gj:
Those five pins are:

Left

Right

GND

Mic

Connection detect switch

I tried all the possible combinations using a 4 pin 3.5" jack & a usb ttl serial adapter, but it didn't give me any result. I also checked the jack connector board file on the kernel and didn't see if it really is a shared serial port. I hoped for it, but didn't get any reply. Maybe you have to send some kind of command first or maybe I wasn't lucky...
[XPERIA X10 Android Development] Adolf1994:
about the JTAG thing: for the Wii the guys over the hackmii made an exploit - known as TPHack - and then extracted the keys from the console(common-key, root-key, etc)... same things: linux-based, RSA-signed(and probably more)

there is a hole on the kernel for some bluetooth thing(read on this forum), and then with root access you can get the keys

or if it possible to write the ro.secure=0 on-the-fly, while the X10 is running, then you can get root. Right?

(or I'm the most stupid person in this secure world :p)
[XPERIA X10 Android Development] hoss_n2:
stop posting sh*tty posts ,do you know the type of the radio chip in x10 or even its brand ,or you are juat saying sh*ts
[XPERIA X10 Android Development] ixemun:
you dare saying that to someone who did a contribution to the scene? what have you contributed to have any rights to say he's posting sh*ts? he dissembled his X10 just to show us the insides of an X10, someone asked if the 5th connector pad is an antenna for radio or not and he only said he couldn't find any FM chip during the dissembly, that's not sh*ty post.

the only useless sh*ty post here is yours.
[XPERIA X10 Android Development] McKebapp:
Bwahaha :D

That one was good...

Simply go to your CP and put me to your ignore list and everything will be fine :rolleyes: .

If you had used the search engine, you would have found my post in another thread:

There is no visible FM Chip.

And Qualcomms Snapdragon is not FM capable.

If FM is in another Chip --> Fine.

According to the Chips Description, there is no Chip FM capable.

And now back to topic little trolls :D
[XPERIA X10 Android Development] feis:
Dont listen to hoss_n2 guys, hes just immature brat talking rubish in every single thread, just ignore him :]
[XPERIA X10 Android Development] wacky.banana:
Guys,

Do try and keep this clean and be respectful to each other.

Appreciate your cooperation.

Thanks

WB