yashsingh1/xdaforums huggingface dataset:
[Wildfire Android Development] warriorvibhu:
Martin dude i am counting on you being a programmer you are more likely to make it happen .. i promise to help once i am done with my exams and if this is still not rooted by then.. i downloaded android emulator and tried creating my first ROM seems to be goin good..ROOT IT MAN..PAUL from Modaco seems to have given up on this..
[Wildfire Android Development] MartinEve:
Hi all,

Ok, first up: I apologise that I will only be on here sporadically; I'm away from home visiting parents in-law and have only occasional internet access (not even 3g coverage!)

However, I have got further.

I have modified the trickery exploit and have succesfully gained root access. I have a shell with root privileges.

However, this is not the end of the story.

Even remounting /system/bin with rw permissions is doable, but when I go to copy anything inside /system/bin I am instantly presented with an "out of memory" error at the shell and "df" then indicates that /system has 0kb free (even though seconds before it told me there was plenty of space)

I am going to try to see what I can do to free up space to get the su executable into /system/bin folder. If anyone has any ideas on what could be causing this (ie. is it really disk full or some other layer of protection), I'd really appreciate it.

To those who messaged me asking for source, I'm afraid I can't post it up at the moment -- this is being written from a net cafe and my laptop isn't wired up -- but as soon as I am back, next Monday, I will post it up. I hope, though, that by then I'll have a full root technique which will survive phone reboot.

Best,

Martin
[Wildfire Android Development] kiljacken:
I can fix that problem when HTC releases the wildfire kernel source... The problem is HTC's nand protection that can be bypassed with a kernel module :-)
[Wildfire Android Development] fishb00n:
great news

thank y'all so much for your efforts!
[Wildfire Android Development] MartinEve:
Ok, well that's great news!

As I said, can't post the full source because would involve re-typing the whole lot, but, essentially, I have modified the location in which the setuid binary "rootshell" is dumped to be the sqlite_stmt_journals directory, rather than /system/bin and then changed it so that the application exits at that point, rather than indefinitely looping. I also removed the code that mounts /system/bin as rw.

Once this is compiled and run, the exploit will dump a "rootshell" executable that you can use to get a root elevated shell.

Can you give any more specifics on the nature of, and the means by which we can bypass) the NAND protection?

Can we not ask HTC for the kernel source? (given that it's, clearly, GPL...)
[Wildfire Android Development] xarnze:
Given that both the evo and wildfire are produced by HTC, would the nand protection not be similar?

In any case maybe the method used for bypassing the nand protection of the evo could be a starting point, the method for the evo is here xdaforums.com/showthread.php?t=701835
[Wildfire Android Development] kiljacken:
I don't understand the nand unblocker myself, but we used it for rooting the HTC Tattoo :-)

And you could also ask HTC to release their wildfire kernel :-)
[Wildfire Android Development] Dr_Death:
when i run the exploit on my wildfire device i got Syntex error:

but it executed fine on my Fedora box:

for the "/system/bin" issue, why don't we change the path to something else and add the path to the env "$PATH"
[Wildfire Android Development] kiljacken:
Because the path variable is reset at boot by init.rc... The only way to overcome that is with a custom boot image :-)
[Wildfire Android Development] Dr_Death:
Thanks Matrin, I am new to the android world, i didn't know about android NDK LOL

i set ulimit to unlimited, but didn't get the dumped core file!

yes /system remounted as read/write after execute the exploit :)
[Wildfire Android Development] harmohn:
Martin, ....HTC dropped the kernel source! - your letter have anything to do with that ;)
[Wildfire Android Development] quemmy:
So can i root it safe? Sorry for bad grammar
[Wildfire Android Development] MartinEve:
Drdeath - you have a directory called exploid inside sqlite_stmt_journals look 1 level up.

Yes I wrote to HTC today. Seems we can now compile kernel modules!

Best,

Martin
[Wildfire Android Development] Trism:
Ooooh this is exciting! Progress is a wonderful thing :)
[Wildfire Android Development] MartinEve:
Hi,

Can someone chuck me a link to the NAND unblocker module (source code, obviously) so I can play around with getting it to work on Wildfire, please?

Best,

Martin
[Wildfire Android Development] casiocas:
Do you think this one?

h_t_t_p_:_//developer.htc.com/
[Wildfire Android Development] kiljacken:
Here is the HTC Tattoo version:

#include <linux/module.h>

#include <linux/kernel.h>

#include <linux/delay.h>

#include <linux/errno.h>

#include <linux/io.h>

int __init unprotect_nand(void)

{

int* addr;

printk("Hack: unprotecting Tattoo system partition\n");

addr = ioremap(0xA0B00000, 0x1000);

if (addr) {

printk("NAND protect value 0x%X\n", *addr);

*addr = 0;

iounmap(addr);

}

printk("Done - now be extremly careful!!!\n");

return 0;

}

void __exit unprotect_nand_exit(void)

{

printk("unprotect nand modukle exit!\n");

}

module_init(unprotect_nand);

module_exit(unprotect_nand_exit);

MODULE_DESCRIPTION("Tattoo hack - enable write protect");

MODULE_AUTHOR("bool_s");

MODULE_LICENSE("GPL");
[Wildfire Android Development] MartinEve:
Thanks very much for this; that's extremely helpful.

So basically, what that code does is to map 1000 bytes worth of bus memory from 0xA0B00000 into the addr variable.

It then writes the value it found at that address to the console.

Finally, it assigns the value at that address to 0, presumably thereby disabling NAND protection.

My concern is that there is no guarantee that the address of NAND protection is the same across devices. However, messing this up via experimentation shouldn't result in any bricking. (That's not a promise, just my thoughts)

I think that I'm going to have to have a concerted read through the kernel source to try to work out where the NAND protection lurks. If it gives me an outright memory address, then we're sorted. If not, then it might be a matter of trial and error (probably resulting in an unstable device, but hopefully stable enough to copy an su binary before it crashes ;))
[Wildfire Android Development] Dr_Death:
Martin, ooops my bad, now I am root.

thanks buddy, YOU ARE THE MAN :cool:
[Wildfire Android Development] MartinEve:
No, not yet; have patience, I feel we're getting close.
[Wildfire Android Development] MartinEve:
Hehe; glad to hear it worked :)

If your /system is being remounted rw, I take it you aren't using my modified exploit (which doesn't do that portion anymore -- no point until NAND unblocked). Be careful; attempting to write anything to /system results in instability and swift reboot -- somewhat annoying ;)
[Wildfire Android Development] Dr_Death:
/system is mounted "rw", but i think i didn't restart by device from yesterday when i tried the original exploit LOL

I notice the NAND protection while trying to rename some font files.

that about this tutorial to unlock NAND protection: http://xdaforums.com/showthread.php?t=701835

isn't it the same protection mechanism in the wildfire?
[Wildfire Android Development] kiljacken:
That method involves flashing of a custom spl made for the evo, so i don't recommend you to follow this as it could brick your phone beyond repair...
[Wildfire Android Development] MartinEve:
Absolutely; this would be a distinctly bad idea!

I think a better, or at least safer, path is to attempt to use the Tattoo kernel module, which I am attempting to build as we speak.

Does anybody who has used this on the Tatoo have a sample of the output produced when the module is loaded? This would enable us to search for a similar memory pattern on the Wildfire.
[Wildfire Android Development] MartinEve:
An interesting point about the source that HTC have released...

2.6.29-534e5f81 is the version (from directory name) on the website

I think most people are running:

2.6.29-4266b2e1
[Wildfire Android Development] Sidewindr:
that is easy to get around, just change the kernel version number in the source. I doubt there is significant differences to make modules incompatible between the 2 versions ;)
[Wildfire Android Development] MartinEve:
Yes, I thought that too.

Does anybody have a good guide for compiling kernel modules, my time today is running out to give this a go!

Martin
[Wildfire Android Development] Dr_Death:
The Linux Kernel Module Programming Guide
[Wildfire Android Development] MartinEve:
Guide for compiling kernel modules + progress report

Ok, for the record, if anybody wants to quickly compile a kernel module for Wildfire, here's my recommendation:

1.) Grab the kernel source

2.) Whack your kernel module code into drivers/hid/hid-dummy.c

3.) Pull the config file off the device and into the root kernel dir:

adb pull /proc/config.gz config.gz
gunzip config.gz
mv config .config

4.) Edit .config to replace the defaults:

CONFIG_LOCALVERSION="-4266b2e1"
CONFIG_LOCALVERSION_AUTO=n

5.) Setup your environment (replacing the path with the path to your android NDK):

export CCOMPILER=~/android-ndk-r4b/build/prebuilt/linux-x86/arm-eabi-4.4.0/bin/arm-eabi-

6.) Build the module:

make ARCH=arm CROSS_COMPILE=$CCOMPILER modules

7.) Push the module to the device:

cd drivers/hid
adb push hid-dummy.ko /sqlite_stmt_journals/kern.ko

8.) With rootshell (see above), load the module:

./busybox insmod ./kern.ko

Now, as regarding actually using a kernel module to remove NAND protection, so far, little luck.

Basic kernel modules will load fine; messages are going into dmesg succesfully.

However, this line:

addr = ioremap(0xA0B00000, 0x1000);

is causing the device to reboot. Any ideas?
[Wildfire Android Development] Dr_Death:
sorry i didnt understand this part.

I found only one kernel module

do you mean to add it to hid-dummy.c, like this:

:confused:
[Wildfire Android Development] MartinEve:
Hi,

What I meant was that, when I issued the make modules line, I noted that hid-dummy.c was included in the compilation run.

I therefore deduced that I could put my module code in there and it would be compiled.

In essence, I am saying that the quickest way to get a module compiled (because I couldn't figure out the proper way ;)) is to remove all code from hid-dummy.c and replace it with your own. You will then get hid-dummy.ko once compiled.

Best,

Martin
[Wildfire Android Development] entarion:
Hi guys, how ready Root at the moment?

In Russia we are waiting your results. Our Wildfire hope for you))

Good luck in your work.

Sorry my Google Translate =)
[Wildfire Android Development] adeadrat:
in moskva russian wildfire roots you!

btw martin I dont understand a thing what you are saing ;) how far have you come with the root ? ;P
[Wildfire Android Development] Dr_Death:
thanks Martin, i load the kernel module and my device rebooted, but not sure if the module loaded successfully before the reboot.

dmesg show nothing about kern.ko, but there is this message:

is it related to the kern.ko or this is somthing else.

lsmod, just show "bcm4329" module:

BTW /sqlite_stmt_journal become empty after the reboot, is it normal?

Thanks,

Dr.Death
[Wildfire Android Development] MartinEve:
Sadly, the module is not loading. The ioremap() call is crashing the device. I suspect this is because it is trying to access either non-existent or protected memory. As I said earlier, this could be because the address is different on the Wildfire. Conversely, it could be another protection mechanism.

The module will load if you remove the ioremap calls (ie. it's not a problem with using busybox to insmod under root).

It is normal for the sqlite_stmt_journals directory to be cleared; it is a temporary filesystem mounted by init.rc on each reboot.

Not there yet I'm afraid. We have Stage 1 soft-root in which we can get a root shell, but we are currently unable to persist the su binaries owing to protection systems surrounding the flash memory.

I think I might go speak to the unrEVOked guys to see if they can shed any light on unlocking the NAND.
[Wildfire Android Development] MartinEve:
Just so you know - I've formulated a way we can use the soft root to run apps and will try to implement next Tuesday.
[Wildfire Android Development] danne_jo:
http://xdaforums.com/showthread.php?t=753571

I have med 2 roms, one rooted and one nonrooted.

If the recovery works then it would be soo cool :) im unable to test, i dont own a wildfire. only desire and tattoo.

The roms are signed and maby they work flashing via fastboot as an update.zip if you rename my rom to update.zip but then its harder to restore phone. maybe an ruu.exe will resore it?

Its up to you if you wanna try.

Regards Daniel
[Wildfire Android Development] MartinEve:
Verdict over at modaco seems to be that these fail signature verification. Doh!
[Wildfire Android Development] MartinEve:
Ok, so I haven't yet managed to crack NAND, but I've got a way that we can get root to enable running applications that need it.

See: http://blog.martineve.com/htc-wildfire-stage-1-soft-root

Has full instructions, source code + binaries.

This will get, via sneaky means, a "su" binary into /system/bin

It won't, however, survive a reboot.

Hopefully in the near future I will make an application that you can run to do this all automatically.

Meanwhile, spread that link around :)

Best,

Martin
[Wildfire Android Development] Dr_Death:
nice work Matrin, if you create "binmount" and "newbin" under "/data/local/" then everything will be in place after the reboot!
[Wildfire Android Development] MartinEve:
This is true but, sadly, we still have to recreate the Su binary because data is mounted with nosuid.
[Wildfire Android Development] manups4e:
MartinEve when I follow your guide for the soft root, in the point that i have to execute "./exploid" I get an error that says "./exploid: Permission denied"...what can I do?
[Wildfire Android Development] MartinEve:
That sounds to me like you haven't properly copied the exploit to the device, or you are in the wrong directory. Type pwd and ls and post the results..
[Wildfire Android Development] manups4e:
pwd shows /sqlite_stmt_journals and ls shows exploid su superuser.apk and busybox

I don't know if it care or not but i'm using windows 7 x64
[Wildfire Android Development] web2010:
simply do chmod 755 exploid or chmod 777 exploid

then you can execute exploid :)
[Wildfire Android Development] MartinEve:
Hmm. Try chmod 744 ./exploid and then try ./exploid again.
[Wildfire Android Development] manups4e:
thank you very much!! you're great!! :D

but i get another error with the command ./busybox cp ./superuser.apk /data/app..

the error is :

"./busybox cp ./Superuser.apk /data/app/

cp: can't stat './Superuser.apk': No such file or directory" but i've got the .apk file in the directory..
[Wildfire Android Development] MartinEve:
It's case sensitive - I think your apk file has a lowercase s.

Hope that helps!
[Wildfire Android Development] manups4e:
you're incredible!! thanks! only a question: when i reboot, what must i do for reroot?
[Wildfire Android Development] AerisDies:
wokking!!! big thx Martin!
[Wildfire Android Development] MartinEve:
At present you have to do the whole thing again. I hope, next week, to make a 1 click app that will re root on each reboot.
[Wildfire Android Development] manups4e:
thank you =)=)
[Wildfire Android Development] Dr_Death:
work like charm with me, test it with market enabler, and finally i download skype LOL ;)

but still i cant copy files to /system, i wont to add font files for my language
[Wildfire Android Development] MartinEve:
Yes - as stated, this will not bypass nand protection. However, you could do the symlink and mount bind trick for the fonts directory...
[Wildfire Android Development] kingoldstyle:
So ... Buzz can be rooted without problems?
[Wildfire Android Development] tom781:
Hi great job MartinEve

why do i get this msg:

[1] Segmentation fault ./busybox mount -r -t yaffs2 /dev/block/mtdblock3

./binmount

i get it for every commend i write

i'm totally newbie and i need the root mainly to install fonts in my language.

is there an easy guide for "symlink and mount bind trick..."

thanx a alot
[Wildfire Android Development] Dr_Death:
that nand protection is really annoying, i wont to install openvpn, sshd, font :(

symlink and mount bind trick didn't work, font, openvpn, sshd they all require placing the binary files under "/system/bin, xbin, font" permanently.

all the best with stage 2
[Wildfire Android Development] inforfinfor:
Guys, will root allow me to change the rom in my phone (without ruu errors - 131, 140)? Or just uninstall app and change a logo shows during boot?
[Wildfire Android Development] Kinghuy.Tse:
Sorry,Sir...

I'dont understand some steps.(Just laugh at me:()

How to "Push all the files to /sqlite_stmt_journals/ ":confused:

And

is this line "Setup application (can we run at startup?) checks for existence of /system/bin/su" a step?

Forgive my poor English..
[Wildfire Android Development] MartinEve:
All awaiting replies: I'll try to respond later today - out and about at the moment.
[Wildfire Android Development] Kinghuy.Tse:
./exploid: not found

Why?

win7 32bit
[Wildfire Android Development] Dr_Death:
Kinghuy.Tse, you need to download android SDK (check google), it have tools to connect to you phone (adb)

go to sdk directory, you will find adb under tools, run adb will show you all the options

./adb push /path/of/file/in/your/pc /path/to/the/destination/folder/on/your/phone

you need to push all the required file to "/sqlite_stmt_journals" folder on you phone.

push all the required files to your phone, then you need to change the permission for those binary files to be executed, do:

chmod 755 exploid

chmod 755 su

chmod 755 bustbox

be soure that you are on the same directory of the exploid file.

run commad "pwd" to check your path

run command "cd /sqlite_stmt_journals" to go to "/sqlite_stmt_journals" folder

the dot before "./exploid" refer to your current location, so you need to make sour that you are in the same folder where exploid, su, busybox, Superuser.apk is which is /sqlite_stmt_journals

all the best :)
[Wildfire Android Development] Kinghuy.Tse:
Thank you Dr_Death.

And what's the mean of "Toggle your wifi on and off"?Just press the switch of phone? Does wifi represent wildfire? Or where is the button of wifi?
[Wildfire Android Development] fishb00n:
toggle WLAN on and off :rolleyes:

left button
[Wildfire Android Development] Kinghuy.Tse:
Hi,

Should I put it on or off?

And the next.. how to back at shell? Run what?

Thanks
[Wildfire Android Development] fishb00n:
maybe you should not spam the thread with useless questions and try to soft root your phone at all

when you don't even know what "to toggle" means. sorry! :rolleyes:

tog·gle - intransitive verb - to switch or alternate between two settings

so first you switch it on ... and then you switch it off ...
[Wildfire Android Development] rolks:
how can i chmod files, no console acsess?
[Wildfire Android Development] quemmy:
So is wildfire rootable(safetly)? Guyz youre pro's!
[Wildfire Android Development] rolks:
i tryed todo stsge1 softroot by this tutorial h+t+t+p://blog.martineve.com/htc-wildfire-stage-1-soft-root it dosn't work, mount permission denied. sad
[Wildfire Android Development] MartinEve:
However, since almost everybody else on here has managed it, it's actually that you suck, rather than any failing on my part.
[Wildfire Android Development] Kinghuy.Tse:
Sorry...I just wondering why the wifi is related to "Root" and now I notice that line "Try to invoke hotplug now, clickig at the wireless."

Need help!

To back at shell,should I run "exit" or others?

I got wrong like this "adb:not found."

If I run "exit" twice and restart adb shell, it shows "mkdir failed for binmount, Read-only file system"
[Wildfire Android Development] Trism:
OK then, I've got

./exploid: permission denied

What am I doing wrong? Everything seems to have gone well so far :)
[Wildfire Android Development] Kinghuy.Tse:
Umm...

Before you input ./exploid,

do the following to change the permission for those binary files to be executed.

chmod 755 exploid

chmod 755 su

chmod 755 bustbox
[Wildfire Android Development] fishb00n:
best quote ever :D thank you
[Wildfire Android Development] Kinghuy.Tse:
Thank you ...Everybody ;)

I success, despite I don't know how to back at shell:(

I just run adb shell dumpstate.

Is it right?

I find an interesting problem...

The device reboot itself

Forgive my poor English
[Wildfire Android Development] Trism:
Excellent, worked like a charm. Thanks dude!
[Wildfire Android Development] warriorvibhu:
Congrats martin

For achieving what you call soft root.. I request you to make a new dedicated Thread once you have that one click soft root app ready and then we will get it sticky here..

good work.. :)
[Wildfire Android Development] rolks:
on second try i sucseed i guess. only how to view have i root acsess or not?
[Wildfire Android Development] thefunkygibbon:
forgive my lack of knowledge but if we have temporary root can we not install something like clockworkmod recovery onto it so that we can install proper rooted roms?
[Wildfire Android Development] kingoldstyle:
PLS

Can i ask you guys, who just sayd tnk s this?

TO make a post, with all stept by step how to manage this root?

It will be nice a final post, where are all files and the steps how to do it? In this mode we not search all posts, to find the steps, who some times ...you don t understand... Tnk s in advance.
[Wildfire Android Development] Trism:
I'm pretty sure this is what you're looking for: http://blog.martineve.com/htc-wildfire-stage-1-soft-root
[Wildfire Android Development] rohandvora:
Did someone try rooting Wildfre using windows 7 64bit?It did not work for me.
[Wildfire Android Development] zyonee:
I did it, worked just like it was supposed to. :)
[Wildfire Android Development] manups4e:
well..for install clockworkmod recovery you need to reboot your phone..and if you reboot you lose your root..so..it's impossible... =)

forgive my bad english =)=)
[Wildfire Android Development] kingoldstyle:
Tank you very much. You are great, now i m work, i will try tonight, if i m not tyred ...
[Wildfire Android Development] adeadrat:
Thanks martin works like a charm :)
[Wildfire Android Development] MartinEve:
Just for everybody's information; soft-root 1-click coming in next 1/2 an hour or so.
[Wildfire Android Development] Dark_Balor:
wow how are you going to do it ?
[Wildfire Android Development] MartinEve:
http://xdaforums.com/showthread.php?t=757191

Enjoy :)

This makes it just 1-click once you've done the initial setup.

NB. If compiling, the exploid.c in this new thread is different to the one posted earlier.
[Wildfire Android Development] Trism:
Yep same here!
[Wildfire Android Development] MartinEve:
Right, I have to head out now, but if someone felt like taking a plunge, here's something helpful:

Here are the clockworkmod recovery images for the Wildfire:

http://koush.tandtgaming.com/recoveries/recovery-clockwork-2.5.0.1-buzz.zip

http://koush.tandtgaming.com/recoveries/recovery-clockwork-2.5.0.1-buzz.img

Can someone with experience clarify to me the usual flashing process? Some guides claim that the img has to be inside /system/ whereas others claim that running flash_image recover img is sufficient.

Obviously, it seems problematic if NAND protection will prevent such flashing, but we'll see.
[Wildfire Android Development] kiljacken:
Img doesn't have to be in /system you can flash it from anywhere :-)
[Wildfire Android Development] manups4e:
ok..but..how we can flash it? because when I write "flash_image recovery sdcard/recovery.img" I get flash_image: image not found

and via fastboot with "fastboot flash recovery recovery.img" i get infosignature fail =)
[Wildfire Android Development] MartinEve:
Does /sdcard/recovery.img definitely exist when it data not found?