yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] Dradien:
I've gotten two Eris's into recovery, each with a different panel, one with the Melfast, and one with the SYN. I don't think touch panels matter too much.
[Droid Eris Android Development] graphitedv:
Both of my successful roots were Synaptic (SYN) touch panel models.
[Droid Eris Android Development] BlazinDANDAMAN:
Damn...not working for me...

I get the phone reconized in device manager when in Fastboot. Then I do the timing thing and get the black screen with the triangle everytime! Damn...

Any sugestions? I'm on WinXP...
[Droid Eris Android Development] tereg:
I got the phone in the mail today. Therefore, I will be planning to broadcast from http://www.tinychat.com/leakroot tonight attempting to root this other phone.

I will be recording this, but you are certainly more than welcome to as well.
[Droid Eris Android Development] bftb0:
That's exactly what the hack does, but without ejecting the SD card. The /sbin/recovery program on the phone validates a signature tacked on to the end of the update.zip file, and then makes the mistake of closing the file and re-opening it. That's the whole point of over-writing /sdcard/update.zip - Linux lets you overwrite files that are in use by other programs by keeping a copy around for the process(es) that already have the file open. In essence, there are two (or many!) versions of the "same file" on the phone at the same time, depending on when a process opened it. The mistake the Android folks made here is that they should not have closed the file and re-opened it; that allows an interloper to slip a new one in place while the first one is being validated.

I can't see how yanking the SD card would make the timing of the 2nd race in this exploit easier. It's sort of a moot point, anyway, because the 2nd race is far easier to win than the first one - all you have to do is put a HUGE file on the card for the initial validation - for instance, Eris people could use the OTA-2.1 file, rather than the file provided by the Slide exploit, because: (a) its big - 70 MB, and takes 45 seconds to read off the SD card, and (b) if somebody managed to get the timing wrong, it won't run anyway.

Practically everybody that fails at this method fails because they can not win the first race, though. For them, the 2nd race doesn't even matter.

bftb0
[Droid Eris Android Development] g19max1:
@bftb0

Have you tried that?
[Droid Eris Android Development] bftb0:
that what?
[Droid Eris Android Development] refthemc:
I think he meant the Big File Second race you were talking about
[Droid Eris Android Development] turbo2001rt:
Why is device manager flickering? Does this mean pull the battery?
[Droid Eris Android Development] tereg:
I'm in http://www.tinychat.com/leakroot right now, going to be recording shortly

If you want to view my desktop while I do this, please go to http://logmein.com/express and put in code 115 825 418
[Droid Eris Android Development] dro10:
when i type in any command like loop or android-sdk-tools it says it not recognized as a internal or external command operable program or batch file. what is going on with it
[Droid Eris Android Development] g19max1:
Yes. I'm curious about it.
[Droid Eris Android Development] aldroid:
I threw in "The Towel" after buying PNY nat geo,using stock card,even Moto Droid card... what a shame I got my old lady stuck on this crappy leak .. good luck guys :(
[Droid Eris Android Development] bftb0:
I can't win the first race, so that means I can't even try the second race.

But I am pretty confident in what I said there - any "update.zip" (OTA files) from HTC/VZW will work. The contents of the FIRST "update.zip" file are unimportant to the method - since you are trying to replace it, clearly it doesn't matter what it's contents are; the only thing that matters is that it passes a verification check - you have to be using an HTC-signed file for that.

So the suggestion to use a "big one" just gives you a bigger window in time to replace that file with the one that matters (the second .zip file that overwrites the first "update.zip" file).

That's why the Incredible rooting team said "this should work for any 2.1 phone" - they were specifically talking about this 2nd "race" (overwriting update.zip) - which really isn't a race at all if you have a large, validly signed file to start with.

bftb0

Is anyone that wins the first race actually having problems with the 2nd one?
[Droid Eris Android Development] jdog94:
ok i need help i got my device detected and got into recovery

when i got to xxx KB/S (x bytes in xxxx.xxxs) it would be xxx KB/S (0 bytes in xxxx.xxxs)

then adb push update.zip /sdcard i got a signiture error
[Droid Eris Android Development] jdog94:
well i did it again and now i have root ......

i have been doing this for days the only thing i did tonight and tonight it worked

is i did it in airplane mode
[Droid Eris Android Development] :
jdog94, does that mean you selected Airplane mode before you went into recovery and rooted? Please elaborate, thanks.
[Droid Eris Android Development] jdog94:
yes i selected airplane mode then pulled battery switched to my pny card and followed the directions 1001 1002 1003 1004
[Droid Eris Android Development] ncwildcat:
I can't get the timing right - on PNY card now and in USB debug and in airplane mode - still failing.

One question - when I get to hboot (right before the timing step I keep failing) the phone is still shown in device manager under Android Phone / Android Bootloader Interface. Is this good that I can still see it in hboot?
[Droid Eris Android Development] jdog94:
what do you mean you keep failing
[Droid Eris Android Development] ncwildcat:
I mean that I can't get the phone to be recognized in recovery - the counting step. I bet I have popped this card and battery over 200 times
[Droid Eris Android Development] jdog94:
i had the same prob but when i went to airplane mode i had it twice in 10 min counting 1001 1002 1003 1004 not real fast
[Droid Eris Android Development] Captainkrtek:
You got root?

Sent from my rooted eris, CELB 2.7 Rom
[Droid Eris Android Development] jdog94:
yes i got root airplane mode was the only thing i did different tonight
[Droid Eris Android Development] ncwildcat:
I will try again tomorrow. Wife hates the phone now...hoping once or if I can get root that she will feel different. Plus...she misses lots of calls because phone does not ring sometimes
[Droid Eris Android Development] lukaro:
For what its worth I've been half heartedly working in this with a 4tv san-disk card with no luck. I'll get and try with the pny card tomorrow. I'll be sure to try without airplane mode first then with. I'll report back if it helps.
[Droid Eris Android Development] nesgodawg:
Alright, been at this for the last couple hours with a few different cards.

PNY 2gb that everyone loves... no dice

stock Eris 8gb car... again no dice

Tried a PNY 4gb and again... no dice.

This whole process is making feel like a failure. :confused:
[Droid Eris Android Development] dawynkoop:
+1 lol, I know how you feel
[Droid Eris Android Development] jdog94:
be sure you are in airplane m0de seemed to help me
[Droid Eris Android Development] dawynkoop:
I've tried believe me, with 3 different SD cards, formatted every way possible, and using a stopwatch to try every quarter econd from 1 to 10 seconds.
[Droid Eris Android Development] nesgodawg:
I did that too! I'm also a musician, so I'd like to think I know a quarter second from a half a second from a full second.
[Droid Eris Android Development] Jp50:
just isn't working. followed this to a t and even nailed the count from the video and the mp3.

it just isn't happening. Im thinking that certain devices just won't root like this.

how long should we wait before the HTxxxxxxxx comes up in recovery? is it instant? or does it take a few loops for it to pop up? maybe i'm ending the loop too soon? Please someone who has rooted answer this question
[Droid Eris Android Development] tereg:
So, one person who recorded the session ended up having a bad video, and he contacted another person who also recorded the session and checking with him to see if his is any better.

So, in the worst case scenario where both are unusable, I'm going to record another video tomorrow afternoon with just the person who is recording it, record the video in a good quality format, and break it up into the tutorial steps.

That is, if the video that was recorded tonight isn't good enough quality.
[Droid Eris Android Development] tereg:
Here is a dd image of my sdcard in a 7zip archive

http://www.multiupload.com/OT7SH4XNBP
[Droid Eris Android Development] amichalski1:
I have 7zip installed on my computer. How do I burn the image to an sd card?
[Droid Eris Android Development] bigwilly90210:
i was wondering that too... oh well. I'm working on using the PNY 2gb Class 4 from the tutorial. I had a couple of extra Wal Mart gift cards so i picked it up for $1.50. :D Tried for the last two days using a 8gb Kingston Class 4 and a 2gb SanDisk Class W/E and neither of those worked... about to give up when I saw it was available in store near by. Went and got it at 2 a.m. my time. :P ha. Interesting people at walmart at 2 am...

will report if any success.
[Droid Eris Android Development] amichalski1:
I figure it out. Just burned using Nero. I'll see if this works.
[Droid Eris Android Development] ericFuels999:
You can't "burn" an image to the sd card in the same sense as a CD.

You'll need to use a unix utility called dd

(Wikipedia link): http://en.wikipedia.org/wiki/Dd_(Unix)

It's found in either Linux or Mac terminals, and there might be a ported version for Windows, but you'll have to look that up because I'm not sure myself.

If you have access to a Linux machine, pull up a terminal and type:

sudo dd if=/dev/zero of=/dev/*mount point of your card*

to first zero all the bits on the card.

Then,

sudo dd if=/dev/sdcard.img of=/dev/*mount point of your card*

where "sdcard.img" is tereg's image file

This is going to be a little more advanced for some people, but hopefully experienced users can give this a try and report back. I personally have written tereg's image to my PNY 2GB and have had no luck pulling up recovery after ~5 tries. I'm turning in for the night, but I'll report back later if I finally get it.
[Droid Eris Android Development] bdt1995:
The windows port of it DOES NOT work. Im downloading a ubuntu live cd right now and im going to test this.

To 99% of the people here, DONT TRY THIS UNLESS YOU KNOW WHAT YOU ARE DOING as of now, we are just testing it, we dont know if even does anything. It could do absolutely nothing, which is probably the case.
[Droid Eris Android Development] theboo7:
posted on tiny chat

[3:08] theboo7: IT FINISHED

[3:09] theboo7: official guide to get teregs SDcard on WINDOWS

[3:09] theboo7: http://pastebin.com/Byp1qTUJ

[3:16] theboo7: http://i.imagehost.org/view/0637/dd

[3:17] theboo7: http://pastebin.com/rdQwL5nR HAS PIK LINK

use last pastebin

TUT for flashing Teregs SDcar to yours in WINDOWS vista and 7

idk about xp

http://pastebin.com/rdQwL5nR
[Droid Eris Android Development] Apollo089:
I have tested this as well with little success. Tried ~10 times last night after imaging my PNY card. No ADB in recovery still...
[Droid Eris Android Development] adrenalinerush12:
No luck still..
[Droid Eris Android Development] amichalski1:
I also flashed the sd card image, and still no luck here. Used Linux, and windows 7 with no luck.
[Droid Eris Android Development] natbet:
Does anyone else get E:Can't open /cache/recovery/command when they are in the recovery screen and press volume up+power button after a failed attempt.
[Droid Eris Android Development] bigwilly90210:
I'm curious, exactly what is that sd card image supposed to be? I thought we had to have it formatted... do we keep the steps the same for trying to flash it (e.g. the card pop race)? I tried it all last night till like 5 this morning and nothing. Device manager keeps going crazy, the loop seems to pause, then... nothing. :P oh well. i can wait. Hope this gets a little more stable! Good luck guys!
[Droid Eris Android Development] ericFuels999:
The SD card image represents tereg's card at the lowest level. In other words, it accurately represents the state of every single byte on his card, so writing it to your own card should theoretically give you the "same" card as tereg's. Unfortunately, it can't account for the minute hardware differences between our SD cards, and this may in fact be on of the reasons tereg is consistently successful.

I think waiting is a good idea. Trust me, people are testing this theory, including me. :D
[Droid Eris Android Development] Jasonson:
I'm new to the forum. First post. Anyway Im having trouble running the loop.bat in cmd prompt. i tried finding the souce batch file in my android-sdk-windows\tools folder but couldnt. help please :\
[Droid Eris Android Development] Zalatorisaurus:
Did you download Tereg's sdk or did you just download it from the android site yourself?
[Droid Eris Android Development] djg57:
Yes, this is normal
[Droid Eris Android Development] cptkrush:
for cryin out loud this DD process takes for ever. I hope it's at least a tiny bit helpful.
[Droid Eris Android Development] refthemc:
http://xdaforums.com/showthread.php?t=700665
[Droid Eris Android Development] Kionei:
I tried numerous times to do this with the stock card but got no results. I went out and purchased the National Geographic PNY 2GB and go to recovery mode on the third try.

At this point I can see the device in adb. Step 10 says to push Power and Volume up to get a menu - which I do. It then reads to select Apply update.zip. Mine says Apply sdcard:update.zip - a minor point I know, but a difference I noted.

Anyway, when I try to run adb push ota.zip /sdcard/update.zip I get an error:

failed to copy 'ota.zip' to '/sdcard/update.zip': Permission denied

I've rebooted the phone and did step 9 a couple more times, but I get the same results. Any ideas?

I noticed one user switched out for a second time with the files already copied over to them - I'll try that when I get home.

Anyway, thanks for work to see this done.
[Droid Eris Android Development] cptkrush:
tereg had this issue last night, it basically means the SD card wasn't mounted, you have to keep getting it into recovery until it does unfortunately. You could try the file swap as well.
[Droid Eris Android Development] bftb0:
Files on the PC? or files on the phone? If on the phone, where are these files exactly?

Please provide the name of even one file from within the /system mount point on a RUU phone which is different from what is found in the Leak-V3 "system.img" (yaffs) image - or a Leak-V3 phone. Then I will believe you.

(The "system.img" and "userdata.img" files in the .zip files can be unpacked with the unyaffs tool. (If you are a Windows-only user you will need Cygwin or a Unix VM to compile it.) As for boot.img, and recovery.img - just take their md5sums and compare to the values for the respective files from the Leak-V3 zip.

BTW, there is a way to determine this once and for all**, but it requires a phone that the owner is confident of re-rooting using the Incredible/Slide method: run the RUU, root the phone but don't touch the OS, install Amon_RA and boot to it, make a Nandroid backup, copy the "boot.img", "recovery.img", and "system.img" files from the Nand backup to the PC.

Then unpack the respective "system.img" files into two different folders (one from the phone and one from the Leak-V3 zip file) and run the following Unix majik:

mydir=`pwd`
for tree in dir1 dir2 ; do
cd $tree
touch ./md5sigs
find . -f -print | while read fnam ; do md5sum $fnam >> ./md5sigs ; done
cd $mydir
done
cat dir1/md5sigs dir2/md5sigs | sort | uniq -u

replacing "dir1" and "dir2" with whatever you used for your folder names. I think you will find that the uniq command produces not a single difference.

bftb0

** I would be happy to do this myself, but I can not reproduce the Incredible/Slide rooting method on my phone (after many days of trying) - I'm not going to risk giving up root for the experiment.
[Droid Eris Android Development] refthemc:
I'm so bored with the lack of rom updates for the Eris that I might try lol
[Droid Eris Android Development] :
Apparently the PNY 2GB MicroSD that I got didn't work either from ol' Staples (compared to two other Microsds, one my Eris 8 GB and another a lowly 1GB, which didn't work for me).

Crap, I guess you have to have National Geographic or similar cards (I could have gone to best buy as recommended) or at least ones that really get the recovery working with adb. Certainly not mine.

Hmm, maybe the microSD cards are an important variable in this experiment, in other words maybe it IS important as to which micro SD card you use for this method, contrary to what some were saying here.

:P
[Droid Eris Android Development] lukaro:
Airplane mode...

I've been at this for 2 hours the first hour without airplane mode turned on the second with... no luck yet...

Does it matter if I have a clean install of the ruu? Should I not install any of my apps before doing this?
[Droid Eris Android Development] thewanton:
nothing.. still. :/ been here since day one. this is getting depressing.

just posting to tell the devs working on this, and trying so hard to keep trying to find new ways to do this. there's still us out here that haven't gotten root yet that need a new method, or at least something to help us out here.

thanks for your time.
[Droid Eris Android Development] Realm:
something that forces the phone to be recognized in recovery
[Droid Eris Android Development] ECLIPS3:
just wanted to give everyone an FYI, tereg and I recorded a video tutorial on how to setup the phone, the pc, and going threw rooting the phone. I am in the process of editing the videos (multi part series) then going to upload them, probably for download on multiupload and youtube videos.
[Droid Eris Android Development] JAS_21:
When I start the loop, i get the message:

adb server is out of date. killing...

*daemon started successfully*

and then the loop starts.

If I run the loop when phone is booted normally, it finds it. I'm running windows7. My phone DOES show up as "android composite ADB inerface" when booted normally, and "android bootloader interface" in hboot.

Is the error normal, or do I have something not set up properly? I know a few people said they were successful with windows7, so I'm wondering if its my setup.

Are there more successes on windowsXP?
[Droid Eris Android Development] bdt1995:
Thats not an error. And its supposed to happen.

Other than that your fine theres nothing else you can do.
[Droid Eris Android Development] JAS_21:
Has anyone been able to get this on xp, who wasn't able to get it on windows7? I might try over the weekend on a xp machine.
[Droid Eris Android Development] orkillakilla:
I've been trying this the past few days with The stock 8gig card. I'm going to buy the recommended pny card today and see how that goes. I'll post my progress then.

---------------------------------------------

Sent from my HTC Droid Eris using Swype.
[Droid Eris Android Development] Sinhata:
A thought... If all the bootloader checks the card for is general information like MID and CID, maybe we should check for irregularities in these values for the working cards in comparison to those which do not.
[Droid Eris Android Development] tereg:
I have just completed a number of tests that I will outline below, with some interesting results. I want to share these now before I continue on with some additional testing.

First test

Initial conditions: Using Windows XP. Using ECLIPS3's phone I flashed the RUU OTA, turned on USB debugging after the flash, turned off all radios, powered off the phone, used my PNY 2GB SD card, took the SD card out while phone was powered off. I used a 4-1000 cadence throughout this test

The test: With SD card out, boot into FASTBOOT, then went straight into HBOOT, began running the loop, then boot into recovery and pushed sd card in once after finishing cadence

Results: 0/30 successes

Second test

Initial conditions: Using Windows XP. Using ECLIPS3's phone I flashed the RUU OTA, turned on USB debugging after the flash, turned off all radios, formatted the card in Windows XP, used my PNY 2GB SD card, powered off the phone. I used a 4-1000 cadence for the first 5 tests, then the 6th test I missed the card completely at the end of my cadence, which ended up being roughly the equivalent of a 5-1000. So, from the 7th test on I used a 5-1000 cadence. I began doing an audio recording after the 13th attempt.

In the audio when I say "Beginning test _", I do this: pull the battery, stop the loop, put the battery back in, take sd card out, boot into fastboot, then straight into hboot, then set up the hboot -> recovery step and say "This is test _" and then press Vol Up and begin count.

The test: With SD card out, boot into FASTBOOT, then went straight into HBOOT, began running the loop, then boot into recovery and pushed sd card in once after finishing cadence

mp3 file: http://www.multiupload.com/V0EY4SN3KT

Results:

7/30 successes for a 23.33% success rate

Conclusions:

Installing the drivers seems to be unnecessary.

The SD card does not have to be in the phone when the phone is off and you're going to FASTBOOT

Therefore, you do not have to do the press SD card in and pull it out going from FASTBOOT to HBOOT

Observations:

There is something curious about extending my cadence to 5-1000

Still need to determine whether running loop.bat necessary

In one "unofficial" test in the second battery, I put the battery in the phone, which started the phone, so I ran the command "adb reboot recovery" when I knew the phone was detected. Just for fun I decided to count to 5-1000 in my head and pushed the card in after I felt the phone vibrate. That "unofficial" test was a success as well.

Is formatting the deciding difference or is it the timing?
[Droid Eris Android Development] tereg:
Doing a quick audio analysis of the successful attempts, it appears that the 5-1000 cadence for the successful attempts took approximately somewhere between 3.5 and 3.8 seconds.
[Droid Eris Android Development] thewanton:
Thanks for your hard work Tereg, soon enough you guys should have enough studies to prove what is needed and visa versa. If you could come up with a way to force the loop to recognize the phone, that'd put an end to all my (and I'm sure many others) problems.
[Droid Eris Android Development] Hatespawn:
I have been at thing thing for 6 or so hours on end. Everything works perfectly up to the first timing step with the SD card when booting into recovery. I am on vista 32-bit, using the PNY 2gb class 4(NatGeo card) and can't seem to get it right. Any advice to get this thing working?

I know I haven't posted here really but have been following you guys forever. Feel free to flame the noob=)
[Droid Eris Android Development] devlp1213:
the loop shouldn't have anything to do with it but guess we'll see lol
[Droid Eris Android Development] Burgers:
So after an unsuccessful attempt:

1) Pull battery

2) Ctrl+C to stop loop.bat

3) pop out SD Card

4) put battery back in and press send+end

5) volume down

6) run loop.bat

7) volume up

8) ~4-5-000's pop SD card in

Are these the steps you took Tereg? Appreciate all your hard work and effort :)

Nice to know we can take out the volume down + pop out SD card part.. I have to admit though, I was pretty damn good at it after all this time :D
[Droid Eris Android Development] lukaro:
windows 7

Has anyone been successful using windows 7? I've got the drivers installed and can see the phone correctly both fully booted and in fastboot but still no luck with the timing. I used a 4gb san-disk for about 150 attempts then got one of those 2gb pny nat geo cards from walmart. I've only made about 30 attempts just wondering if xp would be easier.
[Droid Eris Android Development] tereg:
Edit: I put the battery back in before I popped the SD card out, then pressed send+end. Otherwise it's the same.

I don't think that interchanging those steps really makes a difference.