yashsingh1/xdaforums huggingface dataset:
[EVO 4G Android Development] david279:
you can unyaff your data.img in your nandroid and dig thru watever you want.
[EVO 4G Android Development] mpa4712:
*grumble* going to compile it now....*grumble*
[EVO 4G Android Development] Cordy:
lol or do that so much easier huh!
[EVO 4G Android Development] mpa4712:
looking at my boot.bin from 6/20, I don't *think* the signature is in it. However, I will let Red confirm that since he knows exactly what to look for.

I've only dealt with rsa encryption using openssl, in a full screen terminal, not a tiny hex editor.

There are some fw files in the wimax directory that are worth a look too though.
[EVO 4G Android Development] Cordy:
That was the reason I asked, I as well as others have looked through the Boot.bin before. I also looked through all the firmware files. Interestingly there is a default firmware and that a manufacturer firmware I'm guessing one to fall back on the other. You're mac is in the Boot.bin as well as wimax_properties. If these files stored the keys great, but either way they'd have to be changed on the actual firmware.
[EVO 4G Android Development] mpa4712:
Interestingly enough, my boot.bin from my broken wimax is about 10kb smaller than my boot.bin from my nandroid backup that had working wimax.

Clearly there is something in that file that the other one does not have. I do think the rsa keys need to be stored somewhere though. I really do not believe the phone does on the fly encryption/decryption with them from the wimax partition.

If they come in an actual file, red will be able to extract the wimax.img he made and look.
[EVO 4G Android Development] Cordy:
you know for something that obvious I never noticed that. I never ran a diff on them. I just scanned through it to see if there was anything that struck out as being different and I stopped when I saw the different MAC's
[EVO 4G Android Development] mpa4712:
I just went through the two boot.bin files and I'm pretty sure the keys are not in there. However, there are plenty of files that get overwritten on every boot, so I'm going to go through all of them. A 1024bit key should stick like a sore thumb if it's in plain text..
[EVO 4G Android Development] Geniusdog254:
How can I tell if my keys were effed up? I'm currently out of 4G coverage and will be for the next week or so, but I'd like to get it fixed.

I know it was broken because my MAC was changed, I've fixed everything, my boot.bin is the same as pre-screwup as is wimax_properties, everything appears to be working fine, but I can't tell without coverage.

I just wanna know if I messed my keys up too, but I'm not sure whether I did or not?
[EVO 4G Android Development] mpa4712:
From what we know, if you ever had a messed up MAC then your keys are also gone.
[EVO 4G Android Development] Andy S:
Is that amon_ra's recovery tool, and if so, is that the "partition SD" option?

Tried the second command above a couple of times and it tells me that the file exists (see the code quote above). It doesn't give me the WIMAXRAW.BIN that's around 12MB at all when I do the second dump.

I'm going to do it from the settings menu and see what happens. Thanks.
[EVO 4G Android Development] redsolar:
Like aph said, reformat it with Evo. Also, make sure you are not trying to save to a file that already exists, as fastboot doesn't behave well trying to overwrite. Also, it requires an 8.3 file name format.

Partition SD should work. If I were you I'd make some 512MB into ext3 too just in case you eve decide to use app2sd.
[EVO 4G Android Development] aph:
I put the PC36IMG.zip in the first post of that thread into the root my SD card, bootloader rebooted, applied the update, and then rebooted into recovery. Ran "adb shell" and the same "nandroid-mobile.sh -b" command and got the same "mtd: MEMGETBADBLOCK returned 1 at 0x003c0000 (errno=0)" error.

Did I do something wrong? I noticed "fastboot oem h" has many more commands now:

F:\Evo 4G drivers\android-sdk-tools\tools>fastboot oem h
... INFOcommand list
INFOmb
INFOmh
INFOmw
INFOew
INFOeh
INFOeb
INFOmmu
INFOram_test
INFOjump
INFOtest
INFOsdtest
INFOeraseconfig
INFOwriteconfig
INFOreadconfig
INFOwritesku
INFOreadsku
INFOrflash
INFOtflash
INFOblock_test
INFOpartition_test
INFOrbchk
INFOerasesd
INFObtrouter
INFOtick
INFOheaptable
INFOemapi
INFOemapiTest
INFOemapiCountryID
INFOemapiWlanMac
INFOemapiSetDefCal
INFOemapiReadCal
INFOlr
INFOimgcrc
INFOresetautoimage
INFOresetpreferdiag
INFOresetRUUflag
INFOwriteserialno
INFOreadserialno
INFObattcheck
INFOgotofastboot
INFOgotohboot
INFOwritemid
INFOusbtestmode
INFOeraseWifiFlash
INFOerase
INFOreadmbserialno
INFOlistpartition
INFOerasebcid
INFOwritebcid
INFOreadbcid
INFOfmrouter
INFOresetuP
INFObdaddress
INFOwMfgTp
INFOrMfgTp
INFOemptypagecheck
INFOsaveprt2sd
INFOsavemem2sd
INFOsavefb2sd
INFOemapiInit
INFOemapiChannel
INFOemapiRate
INFOemapiRateset
INFOemapiCountry
INFOemapiTXpwr1
INFOemapiPkteng_start
INFOemapiPkteng_stop
INFOemapiOut
INFOemapiFqacurcy
INFOemapiCrsuprs
INFOemapiUp
INFOemapiDown
INFOemapiMpc
INFOemapiCounters
INFOemapiVersion
INFOemapiEtheraddr
INFOemapinRate
INFOwimaxinfo
INFOwimaxid
INFOwimaxcmd
INFOwimaxuartcmd
INFOwimaxhelp
INFOwimaxrmac
INFOwimaxpower
INFOwimaxinit
INFOwimaxwmac
INFOwimaxdelca
INFOwimaxdelcb
INFOwimaxread
INFOwimaxwrite
INFOwimaxerase
INFOfl
INFOloaddiag
INFOlnb
INFOinit_a1026_fw
INFOcheckKeyCard
INFOgpiow
INFOgpior
INFOmddiw
INFOmddir
INFOclock
INFOi2cr
INFOi2cw
INFOulpi
INFOchangeCid
INFOread_l2_acc_fuse
INFOemmc_boot
INFOkeytest
INFOheap
INFOboot
INFOreset
INFOpowerdown
INFOrebootRUU
INFOheap_test
INFOrtask
INFOtask
INFOenableqxdm
INFOgencheckpt
OKAY [ 0.111s]
finished. total time: 0.111s

F:\Evo 4G drivers\android-sdk-tools\tools>

Is there another way I can backup the wimax partition? I noticed someone posted "fastboot oem saveprt2sd wimax -n wimax.bin", will that work?
[EVO 4G Android Development] aph:
Crap, now my phone boots only directly into Fastboot USB. I can reboot from there, go back to the bootloader and reboot, or go to recovery and reboot, but it always goes back into the Fastboot USB. How can I fix this?

I saw in that thread step 3 says "For those experiencing being stuck in bootloader, you can boot into recovery, flash your current ROM again, (without data wiping) OR just restore a nandroid backup." But won't a Nandroid restore screw up my wimax partition since it never got backed up correctly?

EDIT: Well, I temporarily "fixed" this by reflashing the PC36IMG.zip that came with Amon_RA's recovery in Regaw's thread. Unfortunately I lost all my data (and root, which I got back by using the recovery to flash 2.2-root.zip.) And when I updated with the PC36IMG.zip in Freeza's thread to restore the fastboot commands I got back in the bootloader loop.

EDIT 2: Cooking my own PC36IMG.zip by removing the hboot .93 img, replacing it with the .76 image and reflashing, worked! I have the extended hboot functions. However, after all that I still get the "mtd: MEMGETBADBLOCK returned 1 at 0x003c0000 (errno=0)" error.
[EVO 4G Android Development] Andy S:
Ah, I see what the problem was (after I got my SD fixed). If you do the first two items above you first get a "wimax.bin", then the second command with the "-a" also tries to write the exact same file name, NOT the WIMAXRAW.BIN 12 MB file the last instruction has you moving from the card. So shouldn't the second dumb line above read:

Otherwise, you're dumping the same exact file name?
[EVO 4G Android Development] redsolar:
Bad blocks are normal. As long as you have you certificates handy and safe, you should be ok
[EVO 4G Android Development] aph:
Interesting, I hadn't heard that before. Thank you for the explanation and dealing with my obscenely long posts. :)
[EVO 4G Android Development] gimmetaffy:
Can someone please clarify this for me. When I preformed the grep RSA /dev/mtd/mtd0 I get the following:

RSA-REQUEST

RSA-REPLY

RSA-REJECT

RSA-ACK

RSA-1024

RSA-REQUEST

RSA-REPLY

RSA-REJECT

RSA-ACK

RSA-1024

RSA

ReRSA

RSA requests

RSA replies

-----BEGIN RSA PRIVATE KEY-----

-----END RSA PRIVATE KEY-----

#

Should I also get a BEGIN RSA CERTIFICATE? or am i good? I never got the bad MAC address, but I was concerned because as I drove through LA 2 weeks ago my 4g just searched.

thanks,

Danny

EDIT: I'm sorry guys, after some more searching I believe I can come to the conclusion that my keys are intact. I'm sorry for adding junk to the thread.
[EVO 4G Android Development] aph:
It's "BEGIN CERTIFICATE" and "END CERTIFICATE", no "RSA".
[EVO 4G Android Development] mike_diako:
Thank you, thank you, thank you! I finally was able to get my 4G working again with the second zip posted running Fresh 3.2.0.0.
[EVO 4G Android Development] Sed8ing:
When I do the grep command this is what turns up... I think it means I am not getting 4G back because due to a mixup i do not have my total equipment protection and therefore cannot return my phone for a new one...

RSA-REQUEST

RSA-REPLY

RSA-REJECT

RSA-ACK

RSA-1024

RSA-REQUEST

RSA-REPLY

RSA-REJECT

RSA-ACK

RSA-1024

RSA

ReRSA

RSA requests

RSA replies

#

Any help or any other place to turn would be much appreciated!

Edit: Most annoying part is that I lost the 4g prior to being rooted when I did the HTC OTA update to .3 and then to .6...not sure when in those few days i lost the 4g but definitely lost it during that time.
[EVO 4G Android Development] ajk511:
When I open a command promp it starts out in

C:\Users\Dad>

When I enter "fastboot oem h" I get 'fastboot' is not recognized as an internal or external command, operable program or batch file.

I followed the OP to a T up to this point. Is there an assumed step I am missing?

P.S. if this is a really stupid question I apologize, flame away but please help me figure this out.
[EVO 4G Android Development] kf2m:
That is exactly when you lost 4G. Yeah your keys are history time for a new phone.

Now with that said, you can get it replaced under warranty provided that you unroot your phone and bring it to the current level of OS. Call Sprint support and go through the motions. Tell them that you took that early update, then the actual update. Eventually they will determine that your phone is hosed (easier when you are in an actual 4G service area). Now if that doesn't work call HTC Support, mentioned that you talked to Sprint Help, and the issue wasn't resolved. Again go through the motions, and hopefully this time around HTC says yup your phone is hosed. Now they may offer to do a warranty exchange. Don't. Get your case#, and kindly thank the support person. Now haul ass to the Sprint store(Not BestBurn, or Radioless Shack). Tell them that you talked to both Sprint Help, and HTC. Give them the whole support story. Hand them the case#, and you should be on your way to getting a replacement phone. Failing all that.. Well you're screwed. Sorry.
[EVO 4G Android Development] Sed8ing:
Well... thank you for the response and yes... I suppose I will try getting things replaced eventually.... right now ok with out 4G (although I do live an an almost official 4G area) but one of the local stores is wholly unhelpful as they basically denied the problem was aproblem when i originally went to them before i rooted the phone.

All good, the phone still kicks ass with or without the 4G... realistically, i am usually on wifi or in areas that don't have 4g anyway.. so be it...i will get an upgrade to the next generation EVO in a year when the 4G is country wide!
[EVO 4G Android Development] ViViDboarder:
So I got a new phone from BB finally. Still having trouble connecting to 4G, so that sucks. Is there a way to check my WiMAX certs unrooted?

I haven't rooted the new phone yet because I'm waiting to be sure it totally works.
[EVO 4G Android Development] redsolar:
What are the symptoms ? What software versions are you on?

Don't know a way to check without root. Why not root anyway? Van always unroot after all
[EVO 4G Android Development] ViViDboarder:
So I was good. I guess my signal here was weak. Went elsewhere and got full 4G bars on my new EVO. Awesome!

I'm going to root but I wanted to make sure I wasn't going to have to bring it in first just for simplicity.
[EVO 4G Android Development] aph:
This won't work, the key is matched to the MAC ID and they don't work unless active on a Sprint account.
[EVO 4G Android Development] aph:
Yes, search for Wimax Keys Checker by joeykrim on the Market. I don't think it needs root.

If it does (unlikely since I don't see it in the description), you can use the temp root which is a normal program you download to the phone and roots you temporarily until you reboot. I've seen it on this forum.
[EVO 4G Android Development] dondochaka:
I had a lot of issues in the CM7 nightlies were I was getting "bad return status," etc. I couldn't connect to Wimax. I flashed Fresh 3.5 and 4g worked--I flashed back to CM7 and it worked there too.

Updating the nightlies again, I seem to have lost it... again. I tried flashing fresh again to no avail.

I have my keys, I have a nandroid and a wimax.img from when it was working, which flashing to doesn't work, and I reset to stock... it still doesn't work.

Am I really SOL? I don't have access to another Evo I can try this with :(
[EVO 4G Android Development] redsolar:
I just thought of another place to look. Since the partition is about 12mb and only about 8.5 are written when we have correct data on it and only about 7.5 with a hoses image file..... with enough luck the full dump of a partition will contain untouched keys, as they are at the very end of the code otherwise.

I am not at the pc right now but as soon as I am, I will see if I can confirm this hypothesis.

I would recommend that everyone puts any flashing on hold for the time being or at least backup your raw wimax partition with -a switch
[EVO 4G Android Development] Sid6_7:
Thanks

Hey Red! Just wanted to say thanks for taking the time to try to fix this thing. And to the others that are joining in the cause. Much appreciated..... :)
[EVO 4G Android Development] mpa4712:
Quite possible. It's worth a look.

I think they get written durring boot to somewhere else on the phone, and I'm thinking it's an xml file. I just went through about 60k lines of code for the fw files, the boot.bin, and other files in /data/wimax and I dno't think either of those have it.

I know there are two xml files I'm missing other than macid.tree.xml. but I can't seem to recall where they are.
[EVO 4G Android Development] redsolar:
I am guessing that keys are never written to any place that would be easy to pick. Otherwise it would be a pretty bad security practice. At least that's how I would do it hehe. Anyway, I'll be at a pc on an hour or two to do some more looking into it unless someone is going to try before me.
[EVO 4G Android Development] mpa4712:
Red,

Can you compare the keys you have to the keys in:

/system/etc/wimax/sequansd/DefaultTree.xml

Time for a beer.
[EVO 4G Android Development] redsolar:
Not the same :(

Cheers!

The other bad news - my complete partition dump does not contain the keys either. I'll see if i can do a block dump as well, maybe that will work
[EVO 4G Android Development] redsolar:
Do a dump of your wimax partition, and open it with a text editor.

Look for "-----BEGIN RSA PRIVATE KEY-----"

If it exists, you have the keys, if not - you don't.
[EVO 4G Android Development] jrmithdobbs:
One thing we've definitely learned from all this is that we need our evo custom recoveries to start having quick&easy ways to backup an entire raw dump of the wimax partition.
[EVO 4G Android Development] Geniusdog254:
Thanks for the tip, but I can't get the partition to dump? The bootloader runs the command fine and says everything was written, and if I try to run the command again with the same file name, it returns an error about the file already existing.

Yet it's never created on my SD card. I've looked & looked but it's not there. Whats up with that?
[EVO 4G Android Development] redsolar:
Go to adb shell then

cd /sdcard

ls -l

Look in the output for the file about 8.5 mb in size, could be about 7.6 mb instead if your keys are indeed hosed.

I realized that the file names only support an 8.3 format so if you try giving it too long of a name it gets truncated and extension disappears. So for example wimaxlong.bin will become WIMAXLON

I also found that output of ls is sorted by creation date it seems, certainly not alphabetic
[EVO 4G Android Development] redsolar:
No kidding...
[EVO 4G Android Development] Geniusdog254:
Nope still nothin there. I tried ripping it with a shorter filename and there's still nothing.

EDIT: Also tried it with and without the -a operator to copy blank blocks and I still got nothin
[EVO 4G Android Development] redsolar:
Strange... It shows the progress, right. It should show the blocks (and total size) it read, and in the end report success.

On 2 evos I did a dump on, for whatever reason, it didn't like those phones SD cards, it wouldn't dump - so I just swapped the SD cards back and forth.

Maybe try backing up the SD card, and reformatting it?
[EVO 4G Android Development] Geniusdog254:
I'll just pop in another sd card real quick. And yeah it shows all the blocks and it says that it succeeded at the end, it just never shows up :confused:
[EVO 4G Android Development] redsolar:
Have you tried reading the microsd card in a PC?

Also, can you post the exact line you used with fastboot command?
[EVO 4G Android Development] mpa4712:
Let me give this a shot..
[EVO 4G Android Development] mpa4712:
bah..why doesn't the linux version of android SDK have fastboot..
[EVO 4G Android Development] Geniusdog254:
Strange. Another SD card worked just fine. Oh well. Looks like I don't have keys :(

Did you confirm that they can both work on 4G at the same time even if they have matching keys?

EDIT: Also, if both the public and private keys are stored there, wouldn't it be a piece of cake to just make our own key?
[EVO 4G Android Development] mpa4712:
I don't think there is an issue 'sharing' a public and private key. I initially thought that the keys used our MAC address when they were generated, but since Red was able to xfer them over, that idea is out the window. All they are used for is to encrypt data over 4g, nothing else.

I don't think we can generate a copy of our own. That is, if the sprint servers compare the keys to any sort of local list. It's odd that the key is stored on our phone thought. In a server environment, the key is stored at the origin, and the client is 'fed' the key to use for the back and forth. If our phones act as the server role here, which it almost seems like they do, perhaps we can generate our own.
[EVO 4G Android Development] redsolar:
If the keys are also signed by a Certificate Authority (i would think they are) then generating our keys does nothing, as they are not signed by a sprint-trusted CA. That said, I haven't checked if that's the case, or not, but some XML files do contain a CA public key (you need a private key to "sign" another keypair, so no, we can't do it on our own without somehow obtaining a CA private key)

What's important with most keypairs is security chain, from a trusted CA down to sub-CAs if any, and down to a client key.

In simple comparison, some of the strings in our keys are the same, which suggests a common CA.

I am currently dumping another phone's certificates for backup, and will test simultaneous 4G using the same keyset in a little bit.
[EVO 4G Android Development] mpa4712:
Can we use any of these commands to extract the certs? Looks like there is indeed a CA and a PVT file on there:

F:\android-sdk-windows\tools>fastboot oem wimaxhelp

... INFOWiMAX Command Usage D

scription

INFO============================================================

INFO===================

INFO<General Command>

INFOwimaxhelp WiMAX help command.

INFOwimaxinfo Read firmware information.

INFOwimaxid Read WiMAX chip ID.

INFOwimaxcmd Perform MFG test command. (type "exit" to exit

o

INFOmmand mode)

INFOwimaxrmac Read WiMAX MAC address from flash.

INFOlnb [filename] WIMAX Download WiMAX firmware from PC to dev

INFOice. (Keep original calibration data)

INFOlnb [filename] WIMAX2 Download WiMAX firmware from PC to de

INFOvice. (Overwrite original calibration data)

INFOlnb [filename] WIMAX_CB Download WiMAX calibration data fro

INFOm PC to device.

INFOlnb [filename] WIMAX_CACER Download WiMAX CA(.cer) data from

INFO PC to device.

INFOlnb [filename] WIMAX_CAPVT Download WiMAX CA(.pvt) data fro

INFOm PC to device.

INFO------------------------------------------------------------

INFO-------------------

INFO<Debug Command>

INFOwimaxpower [0:off, 1:on] Turn on/off WiMAX power test.

INFOwimaxinit Perform WiMAX intialization test.

INFOlnb [filename] WIMAX_BOOTS Download WiMAX bootstrapper file

INFOfrom PC to device.(Keep original calibration data)

INFOlnb [filename] WIMAX_APPFW Download WiMAX APP firmware file

INFOfrom PC to device.

INFOlnb [filename] WIMAX_MFGFW Download WiMAX MFG firmware file

INFOfrom PC to device.

INFO------------------------------------------------------------

INFO-------------------

INFO<Security Command>

INFOwimaxwmac [12:34:56:78:9A:BC] Write WiMAX MAC address 12:34:

INFO56:78:9A:BC to flash.

INFOwimaxdelca Remove CA(both .cer and .pvt) from flash.

INFOwimaxread Read WiMAX data from flash to SDRAM test.

INFOwimaxwrite Write WiMAX data from SDRAM to flash test.

INFOwimaxerase Erase WiMAX data in flash test. (Erase all data

INFO, include MAC,CA,...)

INFO============================================================

INFO===================

OKAY [ 0.158s]

finished. total time: 0.158s
[EVO 4G Android Development] davidlightle:
I saw those commands as well. I also see mention of cacer_1.txt and capvt_1.txt files but I've not been able to find them.
[EVO 4G Android Development] mpa4712:
If they are signed by a CA, I don't think you'd be able to move them to another phone and have them work..at least that's how it is on linux servers.
[EVO 4G Android Development] mpa4712:
Also, if they are signed by a CA, I dont' think you'd be able to change the MAC and have them work. The whole point of the CA is to verify info in the cert based on info from the server. Ours don't seem to be doing that.

Is there any chance the keys for the radio/3g and the keys for wimax are the same?
[EVO 4G Android Development] Geniusdog254:
Thats an interesting thought. God I hope so. Where could we pull the 3G keys from?
[EVO 4G Android Development] redsolar:
That would only be true if a certificate is tied to a host name. These don't appear to be, since phones have no host names. They are just a RSA pub/priv keypair, not an SSL certificate, which are tied to host names.

INFOlnb [filename] WIMAX_CACER Download WiMAX CA(.cer) data from

INFO PC to device.

INFOlnb [filename] WIMAX_CAPVT Download WiMAX CA(.pvt) data fro

INFOm PC to device.

These 2 appear to be the certificate writers, i'll need to check
[EVO 4G Android Development] Geniusdog254:
I already looked at them, they are definitely to write certs.

Did you find anything about concurrent 4G on both phones?
[EVO 4G Android Development] redsolar:
The point of CA is actually to check if they are "trusted", i.e. signed by the CA keypair. The host name validation is performed only on the client side, and is common to SSL certificates (not simple RSA keypairs)
[EVO 4G Android Development] redsolar:
Regarding 3g/4g keys. I am not sure 3g even uses keys. I believe that's based on IMEI, and not anything else. The reason 4G is keyed is because there are cards out there that work with wimax, and if it wasn't keyed, in theory anyone could break in and steal sprint's network if they could forge other things (like a MAC address and login/password)
[EVO 4G Android Development] redsolar:
Did testing on simultaneous 4G use. So far, it's a no-go, since the IP address is given the same... Looks like the certificate determines the IP address.

I am in a pretty weak 4G area now, so not sure if it's conclusive or not. I'll have to check when i am in more than zero bar area.