yashsingh1/xdaforums huggingface dataset:
[EVO 4G General] Neotelos_com:
That is standard for all Evo's, what we want is a custom recovery.

Basically, a recovery in which we can access NAND using adb.
[EVO 4G General] bcnice20:
O I thought maybe this would enable us to flash the ENG hboot
[EVO 4G General] Neotelos_com:
Can't do much until we know how toast made him ROM validate, etc...

I messaged him, but no response. :(
[EVO 4G General] bcnice20:
Pretty sure he's hard at work getting 2.2 functional is it as easy as renaming it to pci32.img or w.e his original rooted Rom is named

Pure speculation here but could the android recovery be modified while in the original recovery
[EVO 4G General] joeykrim:
from his post, i dont think toast did anything to make his PC36IMG.zip validate. it was a leaked userdebug RUU.

staying on topic with NAND protection.

while in original recovery, we don't have access write access to recovery. seems the userdebug RUU we have only NAND unlocks /system ...
[EVO 4G General] bcnice20:
Yea but in saying trying to unlock the android system recovery while in the stock HTC recovery or are they essentially the same image
[EVO 4G General] joeykrim:
EDIT: proper HTC stock recovery loading procedures - http://xdaforums.com/showthread.php?t=696642

have you booted into the stock HTC recovery? there is no ADB access. feel free to try! without ADB access, we only have the apply update.zip option which i've read on here requires HTC keys to sign an update.zip ...

with stock HTC recovery, our only method is to attempt to get an update.zip flashed. would have to look into HTC signing keys or a method to bypass/duplicate?

not sure any of this will even unlock NAND protection though ... just allow us to flash an update.zip .

its hard to determine in the stock HTC recovery is anything is NAND unlocked because we can't access anything ...

userdebug RUU provides root ADB access and /system write access in recovery mode plus allows a custom recovery to be temporarly loaded as a patch which allows unsigned update.zip files.
[EVO 4G General] cteneyck:
is the shell avialable in fastboot...

I was wondering if NAND would be unlocked if you did

./adb shell

$ fastboot oem boot

then root the oem and see if it will let you flash the recovery. just a thought
[EVO 4G General] joeykrim:
this has been posted in other threads here and google I/O EVO owners stated it doesn't work ... don't have my USB cable with me but maybe somebody can look at this again?
[EVO 4G General] cteneyck:
i know that they said there was no way for adb access in htc recovery. just wondering about fastboot. i don't have a evo or i would try this myself
[EVO 4G General] toastcfh:
yes u can fastboot. but only fastboot htc signed zips and basic fastboot commands. nothing thats gonna blow ur mind though.
[EVO 4G General] joeykrim:
sure would be nice to be able to have htc keys to sign zips ...

is there anything else in fastboot mode which has been exploited in the past? any ideas for methods to exploit it now?
[EVO 4G General] toastcfh:
we dont have htc keys and they have yet to be leaked. if we did there would be no need for custom recoveries. im thinking the only way around this is a nand or hboot type exploit. if we can trick hboot or see how it unlocks recovery then were set. in theory*
[EVO 4G General] extrafuzzyllama:
i am a complete noob at rooting process

but i just wanted to know what exactly is needed to be able to have a recovery menu and full access like using root explorer to be able to delete system files from android like the sprint hero?
[EVO 4G General] david279:
read the first sticky....How to root:rolleyes:
[EVO 4G General] extrafuzzyllama:
I did read it but with that root method will I be able to flash a recovery menu like the amon ra for the sprint hero and use root explorer to write to the system folder to add or remove apks
[EVO 4G General] phinnaeus:
We haven't gotten to that stage yet. There is a thread in General (I think) about how to mount system and remove any crapware you want. The reason this thread exists in the first place is because NAND is locked and we cant write a proper recovery to the phone. It's not really the proper place to be asking these questions.
[EVO 4G General] joeykrim:
unfortunately, both of these, NAND and hboot are new structures to me since my previous phone, the samsung moment has neither.

toast, you're answers always lead me to more questions, which is good cuz it means they're both technical and detailed, thanks.

hopefully i won't sound too n00bish with these questions. if anybody has any experience or knowledge, i'd be great to hear what you think in response.

is there any source code for NAND control or hboot? even for previous phones or models? is it possible to compile our own hboot? how does the SPL fit in with hboot? does one boot before the other? which one hands off to which? or they different names for the same thing? at what points are we able to access NAND? are we able to reverse engineer or decompile the current userdebug RUU which unlocks the /system partition?
[EVO 4G General] Shidell:
Great questions, Joey. :)
[EVO 4G General] cj10488:
Has anyone tried contacting Cmonex or Olipro on help with unlocking the phone.. Both were great at reverse engineering the SPL on HTC WM phones. I am not sure if either have experience with android but they sure do know HTC LOL

James
[EVO 4G General] Techknowfile:
umm... i can write to /system in my phone.
[EVO 4G General] bcnice20:
From within android or the recovery everybody can write to system in recovery
[EVO 4G General] Techknowfile:
lol, the idea was to give someone a heart attack... not get a punctuation-less response that needs to be read through twice to understand.
[EVO 4G General] joeykrim:
i'm still hoping to be able to gain some answers to my questions, quoted above. it would be helpful to gain more productive resources related to this cause.

currently, we have many more questions than answers. we all benefit when working together and all help is appreciated.
[EVO 4G General] willy900wonka:
You could always make the locked NAND designer shudder, just smali the recovery code and write a su apk which takes live changes and stores them into the NAND storage used at boot. Just like recovery does only made active by running the apk. could even be a shutdown driven process.
[EVO 4G General] joeykrim:
NAND unlock of /recovery and /system thru OTA .zip

i finally had some time last night to start looking around and messing with the flashing process on the EVO.

the guides and all the RUU .exe and zip files have made it very easy! thanks to all the devs here!

in a separate effort, i've been trying to get the OTA update to apply on top of the PC36IMG.zip (userdebug RUU with test-keys).

while tearing apart the OTA to find whats holding it up from applying, i came across the method it uses to flash recovery.

now whats interesting, and where im not clear on, in normal android mode, the OTA downloads (once i modified /system/build.prop), verifies against /etc/security/otacerts.zip (which i grabbed from stock 1.31.65.1) and then asks to install now or later.

if install now is selected, somehow it tells the phone to go into a special mode on reboot, where it boots straight into applying the update (with NAND unlocked for /recovery and /system). i'm not sure how this process happens?

inside of the OTA .zip it contains 50+ system patch files, updater-binary, update-script, radio.img and a firmware.zip.

inside the firmware.zip i was surprised to see recovery.img which has a different hash value than 1.31.651.1 recovery.img. The importance of all this is the OTA .zip method has access to NAND unlock /recovery and /system.

would there be anyway to modify this OTA .zip before the phone reboots to apply or flag it to reboot into OTA recovery mode and insert a modified OTA .zip with a custom recovery? i can't find where it does a hash check on the .zip before applying? could the firmware.zip be pulled out of the OTA .zip and applied separately? do we know how to put the phone into the OTA recovery mode update process?

once again, just another idea off the top of my head with probably more questions than answers, but i was glad to see another method outside of the PC36IMG.zip and the RUU.exe which NAND unlocks /recovery and /system which might have some potential to be exploit?
[EVO 4G General] KyleCole90:
@Joey Wow great piece of information you have found. I was actually going to look into the OTA also.
[EVO 4G General] joeavery2:
OK I've been giving this some though and I think I'm not totally understanding the stages and what is locked.

So in the boot loader we can fastboot but it is restricted.

In recovery we can adb but /system but since we are already in recovery we cannot write to it, meaning we need to write the recovery whilein hboot,via fastboot.

Does that cover it? Or can someone further explain it.

On a similar note I'm wondering two things. A) what if we just rename /system to /system_ or something.

B) the other is doesn't the OS write to /system when you install new apps? /system/app
[EVO 4G General] maejrep:
Wow, 6 pages... I really need to catch up :X

But looks like there's some general confusion, so let's try to answer some questions first..

1) Our userdebug RUU allows recovery to write to /system... that's actually not fully correct, because even the stock recovery is able to write to /system (otherwise a legitimate HTC update.zip would be out of the question!). What userdebug does is it gives us access to adb, with root. That is what allows us to overwrite the recovery files (NON-sticky), and flash our own custom update.zip

2) hboot is the bootloader; it is what sets the mtd4 "read-only" vs "read-write" flag. It sets that flag to "read-write" when going into recovery, and sets it to "read-only" when booting to system. The best way to get write access to /system is to get an engineering hboot (which we have, but .. until a recent development, have not been able to flash successfully)

3) The RADIO is what flashes a) new radio.img, and b) hboot.img. You cannot flash hboot from recovery

4) We know that hboot.img CAN be applied via update.zip, just like anything else. However, we've discovered that when it actually tries flashing the hboot.img, it fails some sort of check, and refuses to flash it because (presumably) it's an old version. On the Hero, we were able to flash an engineering hboot with a small update.zip that contained a NEWER engineering hboot.img than what was on the phone, and that allowed it to flash successfully.

5) The other way to flash something is to do it via an official (signed) HTC RUU.. That's how this userdebug RUU is able to work. However, the RADIO checks the "main version" of what's on the phone and compares it to what's in the RUU, and refuses to flash it if the RUU is an old version.

6) Since RUU is done via radio (starts from hboot), it can and will reflash everything that is contained in the RUU, AS LONG AS the RUU version checks out -- that means even if the hboot.img is older, if the RUU version is newer, it WILL work.

I've been thinking about how to trick the RADIO into thinking this old ENG hboot is newer than what I already have (0.79 on the phone, 0.76 is ENG). I had already disassembled and analyzed the entire radio image, and IDA wasn't able to save the database, and then crashed, which means those 4 hours were a complete waste :( Probably what I get for having a 20MB elf binary disassembled into 200MB of ida db, from within a virtualbox VM :eek:

On the bright side, there is a way to do it (as toast has just confirmed), and it does work and gives you the ability to flash recovery, and have read-write access to /system from within Android. But it's a manual process -- and if you want to keep the most recent firmware with only the bootloader being the old version, it requires some steps that the vast majority of people probably will not be comfortable with.

So that's where we are with that :/
[EVO 4G General] joeavery2:
Thank you for the info maejrep!

I was just in Hboot and I noticed Hboot USB, do you know what that is? I know on the nexus you can fastboot and run a zImage as a temporary OS, I'm wondering if HBOOT USB does something similar.
[EVO 4G General] looneylu:
what I gather from this is that we will soon have a custom recovery for our evos????? :confused::o
[EVO 4G General] joeykrim:
wow, lots of information, read that through three times and its very good! thanks!!

leaves me with two questions:

is there any downside to having the older eng hboot than the newer non-eng hboot?

could the eng hboot file and the manual process be released for the devs who have more experience and are willing to take more risks?
[EVO 4G General] toastcfh:
I'll be releasing a part2 tutorial I hope by the end of the day. I'm leaving town tonight and won't be back till Sunday. So I wanna get this out before I head out
[EVO 4G General] looneylu:
Looking forward to this!!!

Starbucks or Dunkin????

small/medium/large or tall/grande/venti???

:D
[EVO 4G General] bcnice20:
Your the man once again and ya finally got the mod status you rightfully deserve congratulations
[EVO 4G General] joeykrim:
greatly appreciated. let me know if you need help or an extra hand!
[EVO 4G General] jcase:
http://htcpedia.com/forum/showthread.php?t=2934

Change main version, flash eng image = win?
[EVO 4G General] maejrep:
Yeah, that's how it works. The problem is then you end up with a 3-4 month old radio, nv, and wimax firmware. It may be possible to flash the newer wimax firmware, and I know it's possible to flash the new radio. But the old nv is what leaves you with an outdated pri and other values. I don't know if there's any way to flash the updated nv.img without going through the RUU process.

The weird thing is when you flash the old eng RUU, bootloader is the last thing to flash; and when you flash the newer userdebug RUU, bootloader is the first thing to flash. So that means you can't interrupt the eng one and get just the bootloader, and you can't flash the eng one then interrupt the newer one to get everything but the bootloader.

The process is pretty simple, and toast will be posting the tutorial and files for it, but the only thing you gain out of it is the engineering bootloader (which gives you fastboot and unlocks /system nand, and lets you flash a permanent recovery). If you don't need any of that, and you're okay with the non-sticky recovery, and having to make changes to /system from recovery, then there's no need to go through with the eng flash (since you do end up with an old pri).

I can confirm that most everything works anyway: wifi, wimax, tethering, etc. And instead of the standard ~8 or so "fastboot oem" commands, the engineering bootloader gives you about 40-50 oem commands :)
[EVO 4G General] _Burst_:
just heard about this via twitter. SWEET!

+millions
[EVO 4G General] bcnice20:
Hmmm would there be any major disadvantages to using an older pri
[EVO 4G General] toastcfh:
not that weve noticed. but htc and sprint upgraded it for a reason. so its best we find a way to do so ourselves. until then nothing actually seems to be wrong. nothing that has been noticed at least.
[EVO 4G General] Mast3rpyr0:
a bit off topic but would this hboot.img file contain that white HTC Evo 4G boot screen that first comes up when you start the phone? ive been looking for that forever..
[EVO 4G General] bcnice20:
Didn't flipz release like custom pri update packaged into one of his 2.1 roms for the hero
[EVO 4G General] toastcfh:
yes he also looking into this with us. its gotta flash somewhere and there has to be another way to write th information for sure
[EVO 4G General] ao7996:
But now what if we want to go back to PRI 1.40_003? I tired using the Stock RUU from your Tutorial Part 1 post, but it keeps the PRI at 1.34 even after re-rooting.
[EVO 4G General] kthejoker20:
Eating popcorn.....watching....
[EVO 4G General] joeykrim:
not sure how relevant downgrading/upgrading the PRI is to unlocking NAND but then again, i just had to google what PRI means!

Preferred Roaming Index and saw issues with the ERIS and modifying the PRI ...

You mention PRI stays at version 1.34 after using the Stock RUU and even after re-rooting. From what I've gathered the eng build of PC36IMG.zip used in part 2 of root which unlocks NAND contains the PRI 1.34 downgrade. Whenever anybody runs this file, the PRI will be downgraded to 1.34. If you run the RUU and it does update everything, then run the eng PC36IMG.zip to re-root it should downgrade the PRI again.

There are two Stock RUUs released here, .1 and .6 , have you tried both of them to see if either will update the PRI back to version 1.40_003? I haven't seen anybody post anything on the dev board regarding this until now.

I haven't loaded the eng build of PC36IMG.zip (time constraints) so I'm still on the userdebug PC36IMG.zip which has PRI version 1.40_003 and just updated my PRL to 60666 .
[EVO 4G General] toastcfh:
The PRI is located in the nv.img in the PC36IMG.zips. we haven't found a way to extract or flash the nv.img yet. If we find a way to then up/down grading the PRI will be np.
[EVO 4G General] joeykrim:
perfect! ive been wondering about the NV.img file ... what partition is it flashed to?

it is so helpful to understand what all is stored inside each .img file located in a PC36IMG.zip and which partitions on the phone these image files get flashed to!

is there anyway to organize this information into one wiki page or one thread for our EVO? is there already one i missed? i only have/know parts of it but im more than happy to organize what i know ... where is the best place to put it?
[EVO 4G General] toastcfh:
Well I'm not sure where the nv.img is flashed that's part of the problem. I suspect userdata maybe but that's just a guess really. I haven't had time to test between moving/deleting threads/post, breaking up arguments, working on the kernel, answering questions, messing with creating a vendor, and being a dad. :eek:
[EVO 4G General] joeykrim:
yea, i hear ya with all the roles and their responsibilities you're handling.

evo dev board stays much cleaner now, appreciate you dealin with the forum drama, adjustin kernel source for rev 3, all your knowledge shared thru answers and idk bout the other two vendors and dad ... but sure you're doin well there too.

i appreciate your help and effort in each role but this prob isnt the best place to express it!

to help solve and organize the partition and flashing info, hopefully to help solve part of the problem (wheres NV.img go), would the best approach be create a thread in the dev board titled [Partial GUIDE] EVO Partitions and Images to Flash or something like that. I can put as much of this info as i know and hope other devs can fill in the missing blanks when they get a chance?
[EVO 4G General] toastcfh:
For sure man have at it. U could also post the wimax images from the latest ruu. As they need to be confirmed flashable to the wimax partition. Mind its Prolly best to flash these images from recovery.
[EVO 4G General] toastcfh:
FYI: cat /proc/mtd
[EVO 4G General] ao7996:
The history of my rooting:

Stock phone

OTA update

Root - Part 1

Damage's 3.0 ROM

Root - Part 2 (this is where the PRI rolled back, obviously)

Updated PRL (60662 to 60666)

EDIT - Flashed 5.31 Radio (forgot this in my initial post)

Ran stock RUU (.1, not .6) from toast's OP in the Part-1 thread (still at PRI 1.34_003, but stayed at PRL 60666)

Rooted again - Part 1 (still at PRI 1.34_003, but stayed at PRL 60666)

Used Nandroid backup to go back to my Damage ROM.
[EVO 4G General] joeykrim:
nice, that does help. im assuing the RUU listed in toast's OP Part 1 thread is RUU .1 . we only have two RUU available to use, .1 and .6. Both should have the most recent PRI. could you try RUU .6 and see if that helps?

otherwise, from what toast has posted, we might not be able to flash the updated PRI just yet ...

i'm gonna organize what we do know into a separate thread and hope with all the developers we can gather all the information and work towards resolving this!

thanks for bringing it up cuz i wasn't fully aware of this issue before!
[EVO 4G General] toastcfh:
most likely the userdebug (root part 1 rom.zip) ruu doesnt have a new PRI in it from what i can tell. so its prolly not going to change the PRI if u flash it. u need to unroot by flashing .1 or .6 to get the newest PRI. but then ur not root. :/
[EVO 4G General] ao7996:
Yes, it'll probably be tomorrow before I can do it (work and grad school until 4:15 tomorrow), but I'll try the .6 RUU and re-root.

Good idea on the separate thread, I'll help and contribute anywhere I can (even if it's just as a test monkey).

I saw some activity in the Hero thread (i think someone even mentioned it here earlier) about a PRI issue that phone had, but i didn't read all the history to know if it was a unique problem or something that would be repeated on other hardware lines.
[EVO 4G General] ao7996:
this is the file i used to take me back to not being root (this exe, not simply re-flashing the original .1 zip)

http://xdaforums.com/showpost.php?p=6547512&postcount=1

(the .1 ruu EXE)

Before i even rooted again (after running the above executable) i was still at 1.34
[EVO 4G General] darth1289:
Older PRI not updating

Here is what I tried and it did not work. My sequence

Stock ROM

OTA update

Unrevoked root

Toast Root 1

Nand Unlock

BugsFreeBeast 0.3

Latest Radio flash

For some reason this hurt my batter life, so decided to go back to stock

RUU .6,

Did not update PRI

RUU .1

OTA .6

did not update PRI

##786# hard reset

Phone went into activation

PRL update

OTA update

Still did not fix PRI.

Am still on PRI 1.34_003 instead of 1.40_003
[EVO 4G General] Tilde88:
lol... damn i was reading up hoping to find some PRI update fix...

it will come...

and PRI is preferred roaming index...

someone here got wrong google info
[EVO 4G General] reekotubbs:
Un-rooting phone does not bring back original or newest PRI. It seems like the rcdata.img is only included in the eng-pc36img.zip.

Any way to override this.
[EVO 4G General] joeykrim:
wow, i was surprised to see this thread bumped! i used to live in this thread before we had an unlocked NAND!

yea, you quoted toastcfh from june 17th. we've learned since then the only rcdata.img file we have access to comes with eng RUU.

our options appear to be, get a leaked rcdata.img, modify our rcdata.img from Eng RUU, and/or figure out how to dump rcdata.img from a stock phone?
[EVO 4G General] reekotubbs:
I'm begging to think that stock phones don't have the rcdata.img and this was something added to the eng RUU to get full nand unlock.

But I haven't been able to get any response from toast

I'm waiting to exchange my phone now, when I get it I will be able to see if the file exist.

I think I will be doing the unrevoke3 method, which does not change the PRI
[EVO 4G General] snandlal:
Ive had every version of software on this phone and no 1.40. That pic we all saw with the 1.40 had to be a fake shot...no such version...stock phones dont have it either..we are chasin a ghost
[EVO 4G General] joeykrim:
there is a pic posted earlier where somebody hex edited their version number in rcdata.img, that could be considered a fake and might be confusing to some people.

all stock phones all come with PRI version 1.40.

edit: further, the only file have with PRI version 1.34 is rcdata.img found only in the leaked Eng RUU. The leaked Eng RUU obviously contains older versions of everything given its role in the production process.
[EVO 4G General] splink7007:
Do we know if anyone is close to rooting/unlocking nand for the newest phones out? For example: Software 1.47.651.1 and PRI 1.40_003 ...Reason I ask is I just got my replacement and im hesitant to root since the whole downgraded PRI constroversy. Is it truly that much of a benefit to have the latest PRI version?
[EVO 4G General] joeykrim:
i haven't seen any consistent and hard quantitative evidence proving the 1.40 PRI is superior to the 1.34 PRI, yet.

there is one alternative way to root which is using unrevoked's method. each has their pros and cons and this isnt the thread for it.