yashsingh1/xdaforums huggingface dataset:
[EVO 4G Android Development] jrmithdobbs:
5) pppd's config (both commandline and file based) parsing is entirely too sane for this to be workable attack vector. (Limits word lengths to 1024-1 characters and only parses a word at a time.)

Most of the code I've looked at so far seems to fall under this, actually, I'm not so sure this is viable.
[EVO 4G Android Development] elegantai:
I assume there is no way to apply a kernel patch without root permissions?
[EVO 4G Android Development] Minigtr:
its my understanding you need rw access to do this....in other words i dont believe so
[EVO 4G Android Development] Vinny75:
which makes me wonder, given this text from GPL v2

Is HTC still in violation of the GPL if everyone can't install the built kernel?
[EVO 4G Android Development] Geniusdog254:
I doubt that'll happen, but at the same time, let's face it: HTC could lock these down completely if they wanted, and if they really wanted they could have shut down XDA years ago. They are letting us get away with this, but most likely they contractually have to try and keep the phone locked down since Sprint doesn't want us tethering.
[EVO 4G Android Development] nebenezer:
Those of us who root and enhance our user experience make up a very small percentage of Sprint's customers. Most if their customers probably shudder at the thought of hacking into root and are more than content with stock equipment.

If Sprint or HTC embraced the dev community and it started to get more mainstream attention not only would they have a bunch of customers bricking phones, the general public might form the perception that the phones are complicated and you need to be a phone geek to really use them.

I think its possible for the right (person/people) to develop relationships with these companies ;)
[EVO 4G Android Development] elegantai:
Lol, wow. It would seem so according to that statement. Unless there is a way to apply a kernel patch without having root and then I would have to imagine there is a way to obtain root if you can perform a kernel patch :D

If only we had some leverage with this! lol
[EVO 4G Android Development] gx1400:
and we digress...
[EVO 4G Android Development] gx1400:
I wonder, are there any openings or vulnerabilities with some of the HTC software like HTC Sync? I assume to be able to do a wired tether, Sync may have some kind of pseudo-root access built in?

/random thoughts of a new comer
[EVO 4G Android Development] imf:
I have an OTA updated evo (I just got it) (no engineering hboot, up the creek, etc). I was able to extract the rom.zip from the 1.47 RUU floating around, put that on an SD card and bypass the check.

I built an "adapter" out of an old cd-rom analog audio cable (4 pins, same spacing as the battery connector) to allow the battery to be present and hooked up, but the SD card slot still accessible. Basically, using one of the plastic connectors from the audio cable as a sleeve to hold some stiff wire between the contacts and the pins on the battery. It works semi-ok.

I was not confident enough in my "adapter" to actually swap card and flash.. as it would have to work continuously for several minutes.

Granted it doesn't do a lot of good to flash the same ruu as I already have, however this swap method was what worked on one of the other android phones.

Since hboot 79.000 doesn't seem to mind swapping the SD cards (it can deal with it, it seems) I thought I would ask if anyone has actually tried this before I risk it and say yes to the flash. Or spend the time to build a real adapter that I don't have to hold together manually.

I also thought it was a bit encouraging that rom.zip from the 1.47 RUU exe was flashable from the SD, even if it is the same locked/OTA rom. I hadn't seen anyone else on here do anything with that yet.
[EVO 4G Android Development] elegantai:
well I would surely say to have a rig you don't have to hold together by hand. That makes me itch with nervousness just thinking about it!!!
[EVO 4G Android Development] joeykrim:
the goal is lower the main version number so we can flash the previous eng or user debug builds.

its great you built an adapter, but flashing a current build doesn't help because you're just reloading the same system we arent able to bypass (verifying the posted flash method now)
[EVO 4G Android Development] joackie27:
Any of you guys check this thread out already?

http://xdaforums.com/showthread.php?t=718889
[EVO 4G Android Development] joeykrim:
yea, it works.

only prob is with the current directions and setup, have to downgrade back to userdebug/eng build RUU which downgrade the radio and wimax along with the system software ... but it works!
[EVO 4G Android Development] RevAtB:
And Then....

Then you go here http://xdaforums.com/showthread.php?t=715915

and start again...

It works, you have a fully rooted, eng hboot, RA recovery, current radio/wimax 1.47.651.1 system.

VIOLA!!!!
[EVO 4G Android Development] joackie27:
So basically what you're saying is that it does not directly root the OTA. What it does is allow you to downgrade to an older firmware and then apply the current exploits for that firmware.
[EVO 4G Android Development] joeykrim:
not sure this part is true

yea
[EVO 4G Android Development] wallacesh954rr:
i told the sprint chick that it was a gift and i would like it as un-opened as possible, she actually gave it to me un-activated,(although the sprint side of the account was set up in-store, xfer number, etc) with all the sticky plastic crap all over the phone still. all she did was log the numbers on the box and power it up to make sure it worked, got home and had to activate it myself. this was before i knew anything about this OTA update, so it was a sincere request, but it worked for me...
[EVO 4G Android Development] webs05:
I just posted the question and so far results seem positive. Someone just replied to me stating they were able to follow the other link and go back up. I don't have another confirmation and I haven't tried myself, so I can't say for certain. But it looks like this method will allow someone to get to the same point others were able to.
[EVO 4G Android Development] SteelH:
Yes. I went back with mine from 1.47 to 1.36 i believe, then updated the root safe radio,wimax, and 1.47 roms off the xda forums. Works great, all up to date.
[EVO 4G Android Development] posguy99:
No. You have been provided with all the tools necessary to install it. It's the device itself that's stopping you from installing it, not a lack of the necessary toolchain.

This is one of the things that GPL v3 tries to prevent.
[EVO 4G Android Development] Vinny75:
We have the toolchain to build it but not install. Install would mean on the device, where else would you install it? Just getting a zImage is not installed, it is part of the build process. I think V3 tries to clarify that but it was the intent all along.
[EVO 4G Android Development] StevesDesigns:
Just a random thought....

Is there maybe a ## Sprint code whatever that can be used. Maybe in the MSL or something.

Yeah, Im new to the CDMA/EVDO stuff.

But just a thought... Take it as needed...
[EVO 4G Android Development] flyingwolf:
That can be used for what?
[EVO 4G Android Development] StevesDesigns:
I dont know... Like I said, just a thought...

But found this too...

http://www.goodandevo.net/2010/07/htc-evo-4g-kernel-source-now-available.html
[EVO 4G Android Development] flyingwolf:
Yes, but a thought for what? For rooting the OTA locked phones? thats already been done, hence this post.

What would your idea be referencing?
[EVO 4G Android Development] StevesDesigns:
The thought was could changing the data settings or msl settings make the phone more accessible. Could changing those settings from the get go keep the phone from being OTA'd in the first place. Could changing those settings unlock the tethering?

I don't know enough about the platform to offer specifics. I designed and flashed winmo roms with a lot of learning from this site. I have lots to learn about Sprint and Android. So bear with me, ill catch up...
[EVO 4G Android Development] Cursed Pirate:
I guess Thats IT!!

I have read every post from start to finish and as soon as I saw the post about checking Toasts thread everyone stopped. So I am assuming the concept is the same 1 I created for the Motorola Droid on Droid Mod and Ultimate droid web site. We r just reverting the fone back to an older version firmware and then rooting and updating with the root. Just seeing if I understand this is what was described. :confused:
[EVO 4G Android Development] joeykrim:
i'll update the OP.

the flash lite exploit allows root access to be gained in order to flash the misc partition and downgrade the main version number allowing our previous leaks of the Eng RUU to be applied.
[EVO 4G Android Development] brucejg:
Has any progress been made on rooting phones with this OTA release? My phone came this release and I want to root it!
[EVO 4G Android Development] rjmjr69:
WOW really? SEARCH
[EVO 4G Android Development] joeykrim:
Please see the OP - quoted below for your convenience.

This has been resolved by using the flash lite exploit to gain root access allowing the misc partition to be flashed with a downgraded main version number which allows the old leaked Eng RUU we have to be flashed!

GUI for how to root

http://xdaforums.com/showthread.php?t=720565
[EVO 4G Android Development] brucejg:
Well, I tried that and still got the same message, "Main Version is Older."
[EVO 4G Android Development] edufur:
Has anyone tried goldcard? If so, what happens? I have a goldcard built but am afraid to try.
[EVO 4G Android Development] rjmjr69:
Huh what is a gold card
[EVO 4G Android Development] driguez:
A special card which gives the owner of the phone sorcerer powers.
[EVO 4G Android Development] edufur:
Yes, and I have the card constructed, but am afraid to try it.
[EVO 4G Android Development] rjmjr69:
Ok is this a joke? Wtf is a gold card besides my credit card lol
[EVO 4G Android Development] dstorm:
http://sites.google.com/site/roothtchero/goldcard-2
[EVO 4G Android Development] edufur:
More importantly:

http://www.knowyourcell.com/htc/htc-evo-4g/evo-4g-guides/463925/how_to_root_the_htc_evo_4g.html

It HAS been done before. I just don't know if it has been done since 2.2, and/or what the outcome was.
[EVO 4G Android Development] joeykrim:
best root method for froyo - use the exploit developed for the droid 2 at http://c-skills.blotspot.com.

http://xdaforums.com/showthread.php?t=765496
[EVO 4G Android Development] noiddroid:
I'm in the same basket I just got my evo on Friday Nov 5 and after searching all threads seem to end in august and what is the 1.47 number I've checked the sys info and I don't have the 1.47 version any where is some one working on a root for the new ota update?
[EVO 4G Android Development] joeykrim:
as i dont see them downgrading software on any EVO, anytime soon, its inevitable at some point in the future they will be shipped with the update preloaded ...

my concern is less when this point occurs in time and more with how we resolve its prevention of obtaining root!

hex editing .zip files with htc signatures is def not my strength. wish we knew more bout how htc packages these .zip files.
[EVO 4G Android Development] scottspa74:
Ok, I didn't do the OTA for fear of something like this. I hadn't rooted yet I'm totally new to Android but came from WinMo and was hopin to fully understand pro/con and fundamentals of root before trying.

Long story short, I have no OTA update done yet, and if anyone needs me to check anything or post any info on old version (at least any info I have access to w/o root), let me know if I can help in any way. Subscribing now.

Scott
[EVO 4G Android Development] mrpuffin:
probably found it already but this should help if you havn't

http://xdaforums.com/showthread.php?t=714255
[EVO 4G Android Development] firefoxinc:
Subscribing as well. I have a evo with the new bootloader and a corrupt rom :<
[EVO 4G Android Development] webs05:
For sure. I was just trying to give some temporary relief to people that might be getting phones without either OTA (I would imagine they would all come with .6 now at this point). I realize my comment is not a fix but a bandaid. Which for some people might be better than nothing at this point.
[EVO 4G Android Development] webs05:
That just takes you from one rooted stock to another. I guess if allows us to flash the original non rooted stock than it would allow people with newer phones or those that applied OTAs to root. Worth a shot. Anyone?
[EVO 4G Android Development] joeykrim:
doesn't work as i posted in the OP.

flash_image cant write to the partition w/o being run as root. otherwise this would be a great method to reset the mainver in the misc partition which is holding us back!
[EVO 4G Android Development] EtherealRemnant:
They told me they will have it swapped and ready to go when I arrive. I can't get them to NOT flash the update. I even threatened to return the phone and cancel my contract and they still wouldn't budge.
[EVO 4G Android Development] joeykrim:
im right here with ya. ive seen you post in the 30 fps crap issues thread. hope you're able to help devote some time in this direction!
[EVO 4G Android Development] unknown_owner:
Unfortunately, I'm not even an amateur in this field. I was trying to use a little of my knowledge on computers and permissions to see if it would help. I have not delve into the work of linux and android. I'm just the normal free-loader like even one else.

If it won't work this way, what about taking a sdcard from an already rooted phone that already has the files in the location that you need them?
[EVO 4G Android Development] joeykrim:
appreciate the effort and thought.

this won't work because all files on the sdcard remain in /sdcard and are not mounted to any other location on a stock system. plus their user id and group id are all reset when its mounted
[EVO 4G Android Development] EtherealRemnant:
I've got three classes starting on Monday and a full time job but I'll see if I can figure out where the lock is coming from on the bootloader. The problem is that I'm very wary of flashing the bootloader and bricking it.

With OS X, we just reboot and tweak things, burn another DVD, reboot... but if you screw up the bootloader, you're hosed.

So you said that HTC's zips will open with 7zip but not Winzip? I noticed they wouldn't open with Winrar either... I'm going to have to take a look at the zips for the first RUU and the newest.
[EVO 4G Android Development] joeykrim:
basically, the MainVer number is holding the hboot back from flashing the older userdebug and eng build PC36IMG.zip. we've previously changed that mainver by flashing mtd-eng.img to the misc partition using flash_image. if we can get that to work, its one method.

the other approach is to work around the MainVer number. if we're able to create our own rom.zip/PC36IMG.zip, which does open in 7zip, we can set the MainVer to whatever we want in the PC36IMG.zip. I haven't seen any research yet on how exactly these .zip files are *signed* by HTC or wrote with some kind of checksum. this would also be another avenue of research ...
[EVO 4G Android Development] EtherealRemnant:
That's what I'm going to take a look at... But I need an HTC signed .zip for the new update. Do you have one?
[EVO 4G Android Development] 2002wrex:
i don't know if this is a viable solution to help anyone, but what the hell? it is my understanding that if you do the second part of toast's root method you are able to flash older roms/images. backflashing, or something like that.

the only way i can see to do this is to partition the sd card and possibly root via an sd card reader, versus using a shell. forgive my lack of knowledge, as i am a winmo user, and if this is what i can come to expect of htc/android/linux i will definitely be staying a winmo user...
[EVO 4G Android Development] 2002wrex:
i lookaed all over the place last night hoping to flash/recover from bootloader mode. all the ones i could find were NOT htc signed. everytime in the ruu that i got to the updating signature part of the ruu, it would just crash and say the ruu was a wrong version.
[EVO 4G Android Development] numus:
I wasent given the option to NOT do OTA. so this sucks.. just got it today and already cant root it :(
[EVO 4G Android Development] CYBERxNUKE:
Ok, spent all last night trying to get evo to downgrade. Tried

Bootloader with all 3 leaked ruu.

Hboot

Fast boot

Recovery. Which says phone is offline.

I tried hexing out the signed .zips for all 3 extracred roms.zip from the ruu.

I know we have to have a specific structure for the zip.rom in the ruu and have noticed all files are .img.

Most of the custom roms are in folders.

So im thonking in order to make a custom rom for ruu we need to gey system, recovery, boot, amd all other partitions as img and have tje correct file structure in the zip files for .ruu.

The ruu opens up the zip amd reads the version number from various locations in the img.

I have compared all files sizes and the rom seems to be the only one difference. I only browsed.

But I did change The system.img version. But I did not sign the .zip and I did compress it and also stored it.

Still a bit sleepy, and getting ready to go out drinking.

Maybe more ill try some other stuff tonight.
[EVO 4G Android Development] joeykrim:
OTA .zip files aren't signed the same way PC36IMG.zip files are. the PC36IMG.zip files have the extra 256 bytes of data which the bootloader needs.

the PC36IMG.zip files i have stored here

http://www.joeyconway.me/evo/troot/ud-PC36IMG.zip

http://www.joeyconway.me/evo/troot/eng-PC36IMG.zip

the stock RUU s have rom.zip files setup the exact same but i dont have the urls memorized ... let me know if you need those too.

a friend, peepsalot, has pointed this out

<peeps> joeykrim, zipinfo utility in linux tells a secret: warning [ud-PC36IMG.zip]: 256 extra bytes at beginning or within zipfile

joeykrim@SDX:~/evo/stock$ zipinfo ud-PC36IMG.zip

Archive: ud-PC36IMG.zip

Zip file size: 176199552 bytes, number of entries: 13

warning [ud-PC36IMG.zip]: 256 extra bytes at beginning or within zipfile

(attempting to process anyway)

to get up to speed on zip file structure layout: http://en.wikipedia.org/wiki/ZIP_(file_format)#Structure
[EVO 4G Android Development] EtherealRemnant:
Interesting.

2C 4A 8B 6A B8 3C C9 63 B0 B4 94 FE A9 ED 92 69 58 69 FB 87 E3 02 DD 27 DC A3 EE CA EF 21 3C 3B 54 42 C5 EE 5E 8B 79 0B B4 98 A0 FA 16 34 62 7D 79 5E CE 58 9E B6 25 55 9E 80 E3 39 96 1C 8C E3 65 D6 10 96 91 37 F3 3F CB 52 E7 25 C9 5B A4 A5 68 3A FF 4E F9 94 78 BF A7 0D 38 7B 24 FA F3 EF D0 F8 BC A6 36 A4 5A 20 98 AC 80 BF 0E 28 5A 6B 65 61 A2 77 38 B2 E9 68 E6 1E 92 89 40 8F DD C2 01 25 2A 6A B4 EE 41 04 F2 E2 A6 A3 31 CE 66 B9 47 72 76 95 45 1E 99 C4 97 A7 49 11 76 9B ED 53 05 2B 09 BE 7C 47 8C 2C 16 55 DD BD 13 7D 9B E3 E7 94 1F 7C F0 27 31 C9 B7 F3 71 F5 12 BC CE 16 CE 9F 1B 3D 9A EE 47 B2 75 D7 C8 AD D4 19 6C 30 E2 CB 33 C3 BC 7C 8A 4D 77 D9 C5 61 07 17 7F 38 6B CC E1 4D 83 C2 8F 20 71 AC 98 CA 8A 6A F7 B0 8A E3 3B 5C 8A 07 1E DD 35 37 D7 6F 38 7E 45 A2

That is what prevents the first image from being opened in WinRAR. With that removed, it opens in all archivers.

In the ud-PC36IMG.zip, the code is:

90 EE 01 23 61 44 13 86 F0 7C CA F5 99 7A 2D D6 65 71 A4 08 47 02 F4 89 E4 AD 86 A3 4C BB DC B0 8C 81 C9 79 BE 31 B0 EE 7C 75 29 BD 9F B6 72 B9 FC A5 81 F1 54 E9 B5 83 0F C8 FC 7A C9 43 2D A3 D9 0D 40 02 12 95 FA 02 50 9F E2 70 48 FE 31 13 39 B7 3B CA CB 9C D9 3E 6F 4F 25 3C 05 92 27 F4 D3 7E 15 FA 03 89 21 7A 4A 12 BC 06 0D A0 DA 7F ED 10 12 32 14 0D E8 FB 85 22 7A 6F CB 0C D2 CB DB 75 DD 69 1C 4D 08 58 5F 8D 9E DF CD 28 3A B9 EF DD 1B 93 06 88 16 BC 86 93 E1 51 03 C0 12 3D 94 71 03 E5 DE 88 DC 45 5C AC 70 52 AB 19 D1 F9 BD 87 A9 1E 10 13 BD 17 CB E4 EB DC EA 30 6E C8 4E 26 0D AC C8 F3 02 69 68 ED 6B 4F A4 4C FD B8 87 34 65 E3 B9 58 F5 E9 90 C3 5D 1F 4A 78 D1 AD D5 98 B4 55 82 76 0A 0F CB 98 83 73 53 ED 16 96 AA AF 49 66 F1 DB B8 AE 63 00 F3 7E E6 F7 32 B2

Once those two sets of code are removed from the respective files, the archives not only open properly but they fully extract.

The problem is, the code is ENTIRELY different between the two files.

Anyone have some more knowledge than me that they can shed on this? It looks like some sort of checksum?

I'm thinking we are hosed until we get a RUU from HTC. I need to see the signing bytes on the new file in order to start messing with it.

EDIT: I tried changing the main version and hboot and putting the signature back on it but the device won't take it. I'm going to mess with it some more.
[EVO 4G Android Development] EtherealRemnant:
Okay from the looks of it, unrEVOked is on the case so I'm going to drop it.

http://twitter.com/unrevoked

They say its coming soon... and they've been pretty consistent thus far.
[EVO 4G Android Development] joeykrim:
we were afraid instead of a checksum its a type of digital signature.

it is also present on the ROM.zip files instead of each RUU .exe.

here is a quick command to strip the first 256 bytes off the file so they open in winzip/winrar w/o any errors.

<peeps> dd if=ud-PC36IMG.zip of=ud-PC36IMG-stripped.zip ibs=256 skip=1

also we thought about swapping the 256 bytes between files to test but havent had a chance yet.

<ZanzDroid> dd ibs=256 count=1 if=PC36IMG.zip of=headerbytes

<ZanzDroid> joey, create the new zip, then: cat headerbytes > test.zip; cat newzip.zip >> test.zip
[EVO 4G Android Development] scotbotmosh:
I am unsure of the next step to take to gain root because of where I am at in the process....

So had the stock ROM, and I did Unrevoked 1, then I grabbed the very first OTA , is this for me? http://bit.ly/aMTjLU
[EVO 4G Android Development] webs05:
Post questions in Q/A Thread Please

This goes to others as well, please do not pose these questions in this thread. Ask them in the Q/A forum. People here are attempting to fix rooting after OTAs. We don't need a ton of questions filling up this thread.
[EVO 4G Android Development] mntbkr:
so what do you know, I feel like the luckiest SOB in town.:D Yesterday I was able to order my EVO form sprint. It said it would take 3 to 5 business days and when I checked my email this AM I had a shipping notification. Sprint actually overnighted the package and I used my connections (I work at UPS) to pick up the package from the HUB. I charged it and I turned it on and guess what? the OTA update was not installed. So... I'm going to keep it that way and figure out what I want to do as far as rooting goes.
[EVO 4G Android Development] numus:
Watch out, mine was teh same way, but then it didnt give me the option to not install it.. Just asked what my prefered download method was and didnt let me exit that.
[EVO 4G Android Development] scotbotmosh:
yup..that is what I am attempting to do...fix rooting after the OTA...
[EVO 4G Android Development] joeykrim:
after performing the official OTA from HTC, there is no known method to "fix rooting". We are DEVELOPING a method in this thread. If you have a method of exploiting root which hasnt been done yet, or an improvement on a previous root method, please post in here.

its great to hear about personal experiences, getting a new EVO, whether or not best buy, sprint, or radio shack already loaded the OTA, etc, but its not directly relevant for developing a method to exploit root access after the OTA.

Please only post in here regarding methods for DEVELOPING root access after the official OTA has been applied. NOT whether or not your phone is coming with/without the OTA or whether or not you have applied or have not applied the OTA. Please post that information in a different thread. Thanks everybody for your help and support!

the only experiment i currently have left is to copy the 256 bits off a PC36IMG.zip onto a .zip file we create and see if it flashes? give it a low probability of working, but its worth a try in our process of elimination ...
[EVO 4G Android Development] numus:
Wonder if these are related to filesize. What is the size (bytes) of each zip file in comparison to the other? Wondering if we can make an update zip, inflate the filesize to an exact byte with this hex data added to it?