yashsingh1/xdaforums huggingface dataset:
[EVO 4G Android Development] CYBERxNUKE:
im not sure this would work, doint it OTA.

the phone still checks signature.. and im sure all other updates will have updated sig in order to update.

the phone checks the firmware sig, so OTA only delivers the zip/update.
[EVO 4G Android Development] Mudkip:
http://www.wireshark.org/download.html
[EVO 4G Android Development] swatspyder:
I'm not familiar with placing a wireless NIC in promisc mode within windows. But in linux it can be done very easily.

Ubuntu - sudo apt-get install aircrack-ng wireshark

$: ifconfig #Find your wireless NIC, it might be wlan0.

$: sudo airmon-ng start wlanX #(X=0, 1, etc.) This will open virtual interface mon0 for monitoring.

$: wireshark #Might need to run under sudo. Try without first.

Select mon0 in the interface list. It will start logging all traffic from your wireless NIC. Save the file when you are done with receiving a response that there is no update available. The packet capture file can then be uploaded and viewed by us or by you. Just don't login to any webpages when you run it or you will log those packets too...
[EVO 4G Android Development] EtherealRemnant:
Aircrack doesn't work with my particular Broadcom chip. Bcm4322 I believe.
[EVO 4G Android Development] swatspyder:
$: sudo ifconfig wlanX down #Doing this might not let you place wlanX into monitor mode, if so, just bring it back up and try it again. You might have to disable network manager though. Right click on the network icon and uncheck "enable networking."

$: sudo iwconfig wlanX mode Monitor

$: sudo ifconfig wlanX up

$: wireshark #Use sudo if you can't see any interfaces.

I will be back on here later today (around 1200hrs)... Currently 0100hrs PST.
[EVO 4G Android Development] joeykrim:
this is describing the OTA .zip file as was posted earlier. these files can be seen inside of the OTA .zip (CERT.RSA, CERT.SF, and MANIFEST.MF). I think only the CERT files are encrypted, not positive.

either way, we give up the 256 byte unidified chunk of data on the PC36IMG.zip file only to take on this type of signing inside of the OTA .zip.

Using adb logcat and hitting the check update now button under HTC Software Update, it prints out in logcat which server its going to, ip address and i think port? and I remember seeing it print a bit of data on the type of response it receives.

Even if we were able to setup a machine on a local lan with that address, check over Wifi and simulate that communication, the .zip file we pushed to it would probably need the type of signature described above inside of the .zip file.

Maybe the OTA update portion of the bootloader doesn't verify? Maybe the OTA update portion of the bootloader will accept android developer test keys like the user debug PC36IMG.zip recovery.img but I doubt it...

I don't mean to sound like a downer but just want to make sure we are holistically looking at all steps of the process. I very well could have misread, misunderstood or be wrong on any or all of what ive just typed!
[EVO 4G Android Development] SteelH:
Man this is going to suck royally. I am awaiting my replacement EVO cuz mine got smashed buy some drunk ahole. If I get one with this newest FW I'm gonna be super pissed.
[EVO 4G Android Development] Mikesus:
Ok, maybe we are looking at this wrong...

We need to determine what is making it think that it is OLDER. If we can fake it out to think that it is newer... Is there a way we could change the version number?
[EVO 4G Android Development] Mikesus:
Realized I was a bit brief...

IF we can get the old file to pass off as a newer file, we could flash backwards and use the older exploit to gain root again and then apply the newer "safe" update.
[EVO 4G Android Development] webs05:
Have you read any other comments in this thread? This is what everyone is trying to do and is already discussing.
[EVO 4G Android Development] numus:
You can't.. anything you to modify the update in any way (such as change the settings to make it think this is a newer version) will cause the digital signature to not match...
[EVO 4G Android Development] Mikesus:
Sorry, it looked like they were trying to mod the new zip, not the old zip...
[EVO 4G Android Development] Mikesus:
No I made sure to ignore em so you could be witty.
[EVO 4G Android Development] jrmithdobbs:
This is pretty much a dead end. RSA encryption is not going to be broken to root a mobile phone, it's just not going to happen.

What we need is a way to obtain root inside of android long enough to find a way to flash mtd-eng.img again so we can downgrade.
[EVO 4G Android Development] numus:
Question is, how does the phone get the OTA package.. Does it download the entire zip as 1 file, or does it download the RSA files from a specific server, and uses the RSA file to access a secure server were it downloads the rest of the package and builds the zip file on the phone?
[EVO 4G Android Development] Mikesus:
Or if we could find a way to replace during load (i.e. 3 card monty hack)

Let it get past validation and before load swap the file out, but with sd locked, that is not even likely.

There has to be a way to break the chain of trust...
[EVO 4G Android Development] webs05:
If card monty hack was feasible would we need to load the file from SD? Why not just use ADB to push it right at the correct time in a separate term window. It would need to be pushed before the RUU was able to.
[EVO 4G Android Development] joeykrim:
according to the log of the RUU and the manual steps I followed above it goes like this:

.zip file on the host computer

phone reboots into RUU mode

push .zip file to the phone

phone stores .zip file somewhere?

phone validates .zip file

phone flashes .zip file

since the validation is all done on the phone, we would need a way to swap the file out on the phone after validation before flashing?

i agree with you 100%!

in my opinion, this would be the best method. basically, this is what unrevoked did in their first root exploit on /system/bin/hstools which has been patched.

if we're able to exploit a binary to obtain root access, even temporarily, flash mtd-eng.img to misc partition using flash_image is DEF our best bet.

the key here is to find something exploitable which is definitely the most difficult part ... we could start with a list of binaries which are suid?
[EVO 4G Android Development] numus:
That is the process for RUU.. What is the process for OTA... Would it be possible to use the adb loop method from the incredible X to pause the phone from actually installing the OTA after reboot?
[EVO 4G Android Development] Sirchuk:
Hey guys,

Just wanted to thank everyone for continuing to work on this. It's awesome to look in on the posts and see everyone hashing different ideas back and forth in order to get this working. If only they had this forums dedication at the BP oil spill, maybe they would have it contained by now. :D
[EVO 4G Android Development] bpdamas:
Wow. I read through all 14 pages and am starting to get what is going on here. Is there anything someone new to android/htc can do to help or is it just best to sit back and wait?

I cam from palm>windows mobile>webos and did modifying/hacking on each. If there is nothing an average tweaker can do then by all means, keep on trying to figure it out.

On a sarcastic but semi-serious note. Has anyone tried and contacting HTC to see if they will give you guys the appropriately signed files so these methods can work? Is this even possible? I mean, I think HTC/Google would hopefully understand the openness of a developer community is always good for progression of a software platform. This is probably just me being overly optimistic.
[EVO 4G Android Development] webs05:
If you can contribute in anyway in terms of progressing what others are working on or trying something new everyone will be totally open to this. But it seems at this point we need people that can help do packet captures of OTA data over wireless or people that can help find binaries with vulnerabilities.

You can try social engineering HTC or just flat out asking, but I highly doubt that will do any good. There is a reason HTC has this much security on the device and I bet Sprint asking for it is one big part of that.

Along that note, there are some devs asking HTC for source at this thread, but that is as far as anyone has gone in contacting HTC.
[EVO 4G Android Development] jrmithdobbs:
This would be a great start. Can someone with a rooted stock 1.47 provide such a list?
[EVO 4G Android Development] sonwon:
I am not trying to start an argument but I am use to challenging authority. :)

Why can't we break the RSA encryption? What encryption was used for DVDs, that was broken? Maybe that developer would lend us some tips on how to crack the header file?

Disclaimer, I don't claim to know what I am asking. :rolleyes:
[EVO 4G Android Development] davidlightle:
RSA security is part of the backbone of internet banking and commerce. If it were easily decrypted, monetary transactions would be insecure.

This is one of the fears of quantum computing, that calculating primes (the basis of RSA cryptography), will become trivialized and we'll have to re-address securing most everything.

It isn't so much impossible as unreasonable. The amount of time to crack such a key grows exponentially with the size of the key, and the size is often selected in a manner akin to "by the time it could be cracked, we'll have already moved on and the crack will be moot." (With transactions, they have to complete so fast or they would be rejected, etc.; in this case, a new OTA/phone could be available before then)
[EVO 4G Android Development] davidlightle:
In /system/bin:

-rwsr-xr-x root shell 151760 2008-08-01 07:00 pppd
-rwsr-sr-x root inet 5636 2010-07-01 21:44 hstools
-rwsr-sr-x root inet 134872 2008-08-01 07:00 ip
-rwsr-sr-x root shell 5632 2010-07-01 21:44 reboot

In /system/xbin:

-rwsr-sr-x root root 22128 2008-08-01 07:00 su
[EVO 4G Android Development] SteelH:
I assume using a nandroid backup from a rooted phone on a non-rooted phone won't solve this either...?
[EVO 4G Android Development] davidlightle:
I'm pretty sure you have to be rooted to use nandroid restore.
[EVO 4G Android Development] Varo210:
I was wondering the same thing, but how would you move the file onto the unrooted phone?
[EVO 4G Android Development] numus:
What are the applicable arguments for reboot? i know adb allows reboot and reboot recovery.... is there another argument we can exploit possibly?

Isn't the NAND write protected in stock?

While the last statement "amount of time to crack such a key grows exponentially with the size of the key" is true, a lot of people fail to account for the principle of regression towards the mean....
[EVO 4G Android Development] numus:
Wish we could have some idea abotu what is in the pipeline.. so we can possibly assist or otherwise figure out if it will work or not.. oh well doesnt look like it will be anytime soon for unrevoked :(
[EVO 4G Android Development] gmanvbva:
I'm curious. Do (local) Sprint repair shops have the ability to flash devices? Or do they have to send them off to some type of repair central center?

I know many used to be able to "back in the day" but I'm not sure if they do anything like this anymore.

Just wondering if they might have some insight into how to flash this device...

Or if there is the possibility of that info/ability to "leak" out.

I just got my Evo a couple weeks ago and was holding off on rooting until I had time to read up on it. I had previously rooted my Hero. I installed the update without a second thought about HTC removing the ability to root. I have just become accustomed to be able to root devices and use ROM's, patches, etc...

It almost seemed like carriers and Mfr's were fine with this, since it has been happening for so long.
[EVO 4G Android Development] numus:
From joeykrim OTA updated phone iwthout root

-rwxr-sr-x root inet 5648 2010-06-02 06:10 netcfg

-rwxr-sr-x root net_raw 26648 2010-06-02 06:10 ping

-rwsr-xr-x root shell 151760 2010-06-02 06:10 pppd

-rwsr-sr-x root shell 5632 2010-06-29 20:54 reboot

-rwsr-sr-x root inet 134872 2010-06-02 06:10 ip

-rwsr-sr-x root inet 5636 2010-06-29 20:54 hstools
[EVO 4G Android Development] swatspyder:
My phone from Sprint came in today. Two actually. One for myself and one for my girlfriend. They both came with the stock firmware! :eek: But I will definitely capture all traffic when I get home to see what information is sent and received by the phone.
[EVO 4G Android Development] SteelH:
Easy, just move via you PC and USB cable. I have my nandroid sitting on my PC right now, waiting for my replacement phone. I could easily put the files back on the sdcard, but if root is required for nandroid it's pointless.

Nandroid won't work to solve this, root is required. Sorry for the post, I'm sure the more experienced people already knew this.
[EVO 4G Android Development] EtherealRemnant:
The stock firmware meaning the new 1.47 or the old firmware?
[EVO 4G Android Development] sonwon:
How about decompiling the boot loader or whatever it is that loads the ROM?
[EVO 4G Android Development] toastcfh:
:/ this sux bad......
[EVO 4G Android Development] davidlightle:
Welcome back toast! Do you have any thoughts on what to do to gain root for those with the latest OTA?
[EVO 4G Android Development] xcopmanx2:
So my data wasn't working properly yesterday. So I decided to flash without a PC (was stuck on the subway) to OMJ's 1.6r. Then it was still an issue so I flashed BACK to the 05.31 radio from the 06.10 one and now I am getting that same root issue. Or maybe it was because of the Wimax radio update. I tried flashing the PC36IMG and now it says that older version crap. :( At least I still have recovery.
[EVO 4G Android Development] EtherealRemnant:
If toast says this sucks bad... I think we're in trouble.
[EVO 4G Android Development] CYBERxNUKE:
i asked a local tech if they recieved RUU's, he told me yes.

but said he hasnt recieved one for the latest update yet.
[EVO 4G Android Development] enormous:
Agreed... the only glimmer I'm seeing is whatever unrevoked keeps teasing on Twitter.
[EVO 4G Android Development] EtherealRemnant:
Yeah. Hopefully its soon. I have a friend at a Sprint corporate store and he said all the new stock has the new firmware.
[EVO 4G Android Development] unknown_owner:
I remember a post on here where someone mentioned copying a zip to cache and having it flash from there. Well I tried that with RUU but after the zip to copy, I got an error 12, same signature fail. Now I do know that at least 2 of the partitions on the sdcard are cache and I think "zip". Anyone know of any others and what they are for? The RUU copies the rom.zip to the zip partition and goes through the checking as seen in the logs I listed earlier. I found a statement online that says the cache is "Only used by OTA updates. (Not used by CM?)". Not sure if this is true.

So I was wondering if anybody could use fastboot to flash the OTA to the cache of a phone that hasn't gotten the OTA and capture the log. Maybe there might be something in the logs that might help someone here. Unfortunately that phone won't be able to be rooted at the moment.

Correction: there are 6 partitions:

INFOaARM_Partion[0].name=misc

INFOaARM_Partion[1].name=recovery

INFOaARM_Partion[2].name=boot

INFOaARM_Partion[3].name=system

INFOaARM_Partion[4].name=cache

INFOaARM_Partion[5].name=userdata

INFOpartition number=6

INFOValid partition num=6
[EVO 4G Android Development] joeykrim:
this has some hope in understanding how exactly the bootloader inspects the PC36IMG.zip and rom.zip files (RUU) along with the OTA.zip.

The OTA.zip seems pretty similar to how stock recovery processes update.zip files.

The PC36IMG.zip and rom.zip (RUU) are still somewhat of a mystery on how exactly it validates the files.

yup! join us in the fun!
[EVO 4G Android Development] unknown_owner:
Found some interesting info:

Hi, here is a complete list of all the fastboot commands supported by the hero. The protocol is as described here, but there are extras..

reboot-bootloader -- reboot into bootloader. Standard

reboot -- reboot. Standard

getvar -- get various specific variables. Standard, but there are new variables.

download -- download something into phone memory. Standard

erase -- erase a partition. Standard (but wont erase mfg*, misc*). Standard

flash -- flash previously downloaded data. HTC's version has various security mode dependant restrictions (e.g. checks signatures if security is enabled). Standard

boot -- boot the previously downloaded data as a kernel image. Standard

signature -- set the signature for previously downloaded data. Standard

setflag -- set a flag, implemented but does nothing on hero.

clearflag -- clear a flag, implemented but does nothing on hero.

oem -- OEM specific command.

You can download a ZIP or NBH image and tell it to flash using the partition name "zip" or "nbh" instead of a real partition name.

Here's a list of the getvar variables:

version

version-bootloader

version-baseband

version-cpld

version-microp

version-main (or "mainver")

serialno

product

platform

mid (or "modelid")

cid (or "cidnum")

battery-status

battery-voltage

partition-layout

security

build-mode

boot-mode

commitno-bootloader

version-tp

hbootpreupdate

Here are the OEM commands. Execute with "fastboot oem <command>"

keytest

heap

boot -- boots the image from flash, not the one downloaded into memory.

reset

powerdown

rebootRUU

task -- parameter "28"= format userdata, "29" = format system+userdata (only does system if security is off though)

rtask

h (or ?) -- list the OEM commands.
[EVO 4G Android Development] unknown_owner:
I also found this: The various currently defined names are:

153

154 version Version of FastBoot protocol supported.

155 It should be "0.3" for this document.

156

157 version-bootloader Version string for the Bootloader.

158

159 version-baseband Version string of the Baseband Software

160

161 product Name of the product

162

163 serialno Product serial number

164

165 secure If the value is "yes", this is a secure

166 bootloader requiring a signature before

167 it will install or boot images.

======================================

since the list of commands didn't list the "secure" as a variable, I tried the security and it was "on". I don't know a command to set a variable; I would definately try to set the Security to "off" and try to flash.
[EVO 4G Android Development] swatspyder:
1.32.651.6
[EVO 4G Android Development] marclile:
Lucky guy :)
[EVO 4G Android Development] swatspyder:
Get this... When I tell it to look for an update right now, it wont find one. And it turns on 3g when you check. Nothing over WiFi.

At the moment, I don't have any good new ideas for rooting the new firmware.
[EVO 4G Android Development] CYBERxNUKE:
just tried mine.

still only using wifi for updates.

are you doing HTC or firmware?

HTC i can do over wifi

Firmware update seems to go out over 3G.
[EVO 4G Android Development] TrevE:
guys i have no intention in reading this thread to see were progres is at all but i stumbled across this in my travels.

http://android.modaco.com/content/htc-desire-desire-modaco-com/310970/how-to-downgrade-hboot/

the mtd0 img generator says

Made first for the Desire but looks like it works for Evo 4G too :-)

i have no clue if this helps, if its been seen, or if its even relevant. if not disregard.
[EVO 4G Android Development] enormous:
It looks like they're saying you already need root to use that method...
[EVO 4G Android Development] TrevE:
yeah i wanst positive if we could flash misc partition without root. never really got too involved in this type of stuff figured id post it and the powers that be here coudl say yay or nay
[EVO 4G Android Development] numus:
Nope...

Read the comments under it

Sounds like this "should" work for us but can we write to /data ?

my evo is charging so i cant attempt it
[EVO 4G Android Development] Vinny75:
could you skip the write to data and do a fastboot flash misc mtd0.img ?
[EVO 4G Android Development] TrevE:
iirc /data/local you can write to... its been forevor since i have had a non rooted phone tho
[EVO 4G Android Development] unknown_owner:
nevermind this post
[EVO 4G Android Development] TrevE:
ok nevermind this post too then :p

i just looked and the hero was rooted by pushing an exploit to /data/local. so unless something changed we can push to that isntead of /data/ it shouldnt matter to write a partition with an image file right?
[EVO 4G Android Development] EtherealRemnant:
Someone just needs to try it. I'm stuck at work slammed right now so I barely have time to type a post, much less pull out my laptop...
[EVO 4G Android Development] gamblz:
I am really new at this, but I gave it a shot....

Had no problem moving the two files flash_image and mtd0.img to data/local in ADB...

I could not chmod flash_image from terminal on the phone though...I was able to do it from ADB shell

However I can not perform the step /data/flash_image misc /data/mtd0.img

from ADB shell and terminal I get the error "error writing misc: Permission Denied"

I have no clue how I would proceed from here
[EVO 4G Android Development] fallentimm:
Can you load misc part with fastboot
[HD2 General] dubie76:
I am fairly new to the HD2. I have recently flashed the GTX Energy theme. It rocks. I also just flashed and updated my radio to 2.12

What I want to know if it's possible to update the OS? I have 5.2.21905

Can I update manila? I have 2.5

Thanks guys!
[HD2 General] :
You cannot really update, you just need to backup your cabs and data, and flash with the newer version ...

I recommend SPB backup , use it in Rom Upgrade mode, works great ....
[XPERIA X10 General] Najd Sa:
Hi all

I've been having a problem a yellow exclamation mark and I have used X10Flash_Unbrick but to no avail :(

how can i fix this so that this thing can boot normaly?

plz help me :(

thanks :o
[XPERIA X10 General] madman13:
do the debranding method that will sort it out
[XPERIA X10 General] MobileTux:
http://xdaforums.com/showpost.php?p=6514704&postcount=3
[XPERIA X10 General] Najd Sa:
thank you it worked .
[EVO 4G Themes and Apps] Tundricles:
Whats the best looking one for Evo? Preferably with sound too :cool:

I found an ok one on another site but the link was broken =\
[EVO 4G Themes and Apps] kpkimmel:
Download bootanimatoon from market has the one u want and more
[EVO 4G Themes and Apps] Tundricles:
no such app in the market when i looked
[EVO 4G Themes and Apps] kpkimmel:
Bootanimation...sorry
[EVO 4G Themes and Apps] Tundricles:
which one? theres a dozen or so boot animation apps
[EVO 4G Themes and Apps] kpkimmel:
Boot animation change...paid app
[EVO 4G Themes and Apps] Tundricles:
does it look good on the evo screen?
[EVO 4G Themes and Apps] sanjsrik:
Yes, it looks very funny. I have it on mine, Boot Animation Pro is the paid application.
[EVO 4G Themes and Apps] Project D:
Which one? :confused: There's one by Andres Schmois and another by crotalusfreak.
[EVO 4G Themes and Apps] abradfor:
OMFG!! Everyone out there, you gotta get the boot animation changer pro by Andres Schmois. It's only like 2 bucks, and has about 20 aninations, but the paid version animations are worth it! They have hands down the best boot animation ever...wait for it...the classic android....F**KING THE APPLE LOGO.
[EVO 4G General] shadowhawk2020:
I have read that Clockwork recovery doesn't properly wipe the phone, and I want to flash the phone.

Can anyone point me to directions that will help me get back to the other recovery?

Thank You,

Shadow
[EVO 4G General] theoner1:
In Rom manager scroll to the bottom there's an option to flash to alternative recovery.
[EVO 4G Android Development] Lokire:
Is there a way to possibly change the size of the status bar on the EVO (with root)? Ideally I would love to have a copy of the status bar that the Xperia X10 has. It's smaller (fits more icons) and just looks nicer to me. Seems more size-appropriate considering the large screen. I haven't really seen any overal status bar size changes with various roms, just different icons/designs.