yashsingh1/xdaforums huggingface dataset:
[EVO 4G Android Development] skiz0frenik:
I don't know if this was brought up before or not but there is a tool for a usb wimax modem to update the certificate on it. I wonder if this can be hacked to generate a certificate for the evo or if sprint will release something similar on the device like update profile and update prl to recreate the cert on the phone. It just seems dumb to not allow this cert to be recreated in the event something does happen to it with an update.

The last item on this page is the tool:

shop.sprint.com/en/software_downloads/mobile_broadband/sprint_u300.shtml
[EVO 4G Android Development] ViViDboarder:
Good find!!! I'm wondering... does anyone have this device?

If we can't reverse the actual EXE I was just thinking of something that might be interesting to try.

Check to see if it says you have a working certificate

Back up that certificate.

Change the WiMAX MAC address to that of a broken EVO

Check to see if it says you need a new certificate

See if it will download/generate said certificate

Move that downloaded/generated certificate to the broken EVO

Restore original certificate
[EVO 4G Android Development] ViViDboarder:
Still nobody here have this USB thing? I'm dying here! :( Is there a cheap one on eBay? If I got one, even without a contract, it should still, in theory, have valid keys, right? (Lots of ,'s :D)
[EVO 4G Android Development] AssassinsLament:
I just tried a donor wimax image from a phone that no longer has service and it did not work.

I then tried a donor wimax image from a working phone, and that worked fine. Conclusion is that I think Sprint can blacklist a wimax certificate too.

That means getting donor wimax images from disconnected/bad esn phones most likely won't work, and that probably includes usb wimax modems also.
[EVO 4G Android Development] ViViDboarder:
Well that sucks. So I'm SOL until Best Buy gets more EVOs in stock. I wish Sprint would just re-provision the phones. It'd save me time and save them money.

Sent from my EVO 4G using the XDA App.
[EVO 4G Android Development] AssassinsLament:
Yep, and it's not even that hard to do.

There is a built in fastboot oem command that writes both the crt and pvt data into the wimax image.

fastboot oem lnb <.cer filename> wimax_cacer
fastboot oem lnb <.pvt filename> wimax_capvt

This could easily be done if they gave us valid .cer / .pvt files or at the service center. No more than 5 mins.
[EVO 4G Android Development] ViViDboarder:
Oh man... That sucks hard.

I guess I can kind of see why they'd be hesitant to send us these files... but they could do what they did with the USB modems. Give us a utility that gets your mac address, fetches the auth files, then takes care of them.

This sucks. Oh well. I'm on CM6 which doesn't have WiMax anyway. :)
[EVO 4G Android Development] bigbiff:
Any ideas on how to get these files? :D

Anyone brave enough to call Sprint and ask for them?
[EVO 4G Android Development] d j a:
I have one..

My EVO's 4G is eff'd, and I have a 4G USB adapter...what do I need to do? I'm willing to help out if we can get this thing fixed.

I wonder if I could i use the info from my adapter to fix my EVO? ;-)
[EVO 4G Android Development] ViViDboarder:
Can you PM? Try to PM the OP and see if he can help you find a way to pull those keys.

If you can do that then we can try the idea I had to generate keys for existing phones by swapping the mac addresses.
[EVO 4G Android Development] bigbiff:
Alright, I will wait a couple of days before returning just in case you geniuses come up with something. :D
[EVO 4G Android Development] ViViDboarder:
Hey, I PM'd you. Send me an email and we'll see if we can get something to fix our phones.
[EVO 4G Android Development] d j a:
Email sent. For any dev's reading this, I have a working U301 3G/4G adapter & live in a 4G area...willing to futz around with this thing if we can maybe fix this issue.
[EVO 4G Android Development] ViViDboarder:
I have the email of one of the Unrevoked devs. So we can work with him on it if you'd like.
[EVO 4G Android Development] TeknoJnky:
there are a number of articles linked below that might be of interest.

http://wimax-made-simple.blogspot.com/

In particular:

ss means subscriber station.

there are 2 keys, the unique key for the device, and the manufacturer public key.

If it were possible to generate a new unique key, find/add HTC's public key, and then get sprint to update your account to authorize your new key, it might be a way to unbrick those with fubar'd 4g.
[EVO 4G Android Development] ViViDboarder:
Yea, I don't think it's possible for us to just generate these keys considering that would defeat the whole purpose of them being encryption keys. :p

My hope is that the tool that Sprint build to authenticate the 4G modem will work if we swap our EVO's MAC address to the modem and then run the tool. Then my hope is that we can pull the keys that Sprint generated for us and drop them back on our EVO.
[EVO 4G Android Development] TeknoJnky:
If sprint would actually update your account to reflect a new unique key, I wouldn't think it matters so much as long as its a valid x509 cert.

ie you would have to purchase one from verisign or whoever.
[EVO 4G Android Development] ViViDboarder:
Right, but that would be a major social engineering project. How would I get sprint to validate my new key?

I believe this tool must take care of that for the 4G modems.
[EVO 4G Android Development] TeknoJnky:
I don't know, maybe it is as simple as calling them up and reactivating your phone? If not, you might have to escalate to an engineer or whoever has access to that information and knows how to update their system.

If this tool can regenerate the original keys, that would be awesome. But if not, then all I am offering is another possible way.
[EVO 4G Android Development] ViViDboarder:
Yea, it's worth a shot. I tried asking sprint to do something similar when I was in store, but they had no clue how they would even go about that.
[EVO 4G Android Development] bigbiff:
Did you call sprint yet?
[EVO 4G Android Development] deonjahy:
Ok so I got the Boot.bin file after doing a nandroid restore now how can I put the keys into the other wimax.img file that I just got through editing with hexedit? My wifes phone can not connect to 4g anymore Now while mine is connected and I followed the tut exactly so I guess each key can only connect once no matter what the mac says?
[EVO 4G Android Development] deonjahy:
Could you just do ##3282# then select edit mode then data profile then menu and reset which would restart your phone and do the hands free activation?
[EVO 4G Android Development] kmartburrito:
ok, so I'm going to throw another scenario in here that I'm seeing with my WiMax issues.

I've not been able to use 4G since I've flashed a custom ROM after NAND unlocking. I've used Fresh's roms primarily, but have tried a couple others. 4G does not work on any of them, it simply just does not ever see that a 4G connection is available.

I've done what most others have tried, ensured my MAC address is fine, updated to the latest wimax radio, looked at dmesg and wimax_mtd. All settings look correct.

Thinking I fried my 4G radio this week, I used Whitlock's method of starting over. I flashed his PC36img.zip image, rebooted, and no wimax. I then thought I was seriously effed. Wanting to try one more thing, I broke out my original PC36img.zip from when I NAND unlocked, and flashed that one. To my surprise, I can now again see that 4G is available, although it won't connect, it just says "trying to connect" and then repeats the cycle. I know I have to change the sleep property, so I can handle that. Here's where it gets weird though.

Flashing a custom rom, Fresh's 3.1.0.1 for example, doing nothing else, 4G will no longer work, which is what I've been seeing. Then I thought maybe I needed to update to the newest wimax since it was FroYo. Still no go. After that, I restored a nandroid backup to the PC36img.zip image, and was able to get the "4G connection is available" message again, with the latest wimax radio and updated prl.

What the heck do you think it could be? No one seems to have a similar situation as me, and no one seems to know anything about 4G. I'll also do anything I can to assist!
[EVO 4G Android Development] sdc177:
kmart- Did you ever delete the wimax xml file so it would regenerate?
[EVO 4G Android Development] kmartburrito:
I did see that also, in this post:

http://xdaforums.com/showpost.php?p=7032384&postcount=182

I did try it, but since you're familiar with it as I can see, what's the significance of doing this step, and when is the appropriate time to do it?

Should I complete that step after installing the custom rom and rebooting? Do I do it before or after updating the wimax radio and provisioning/prl updating? Thanks a bunch for the clarification.
[EVO 4G Android Development] sdc177:
Unfortunately I can't offer the technical explanation but it helped me. I think you do it after rom/radio/reboot but before profile/prl. I know flipzmode was advocating this so that may help you research (don't do anything solely on what I say).
[EVO 4G Android Development] bigbiff:
Just wanted to let you guys know that it is recommended you warranty/insurance and get a new phone if you lost your RSA certs. Poor implementation by HTC for storing RSA certs is the blame. Got this from a good source on freenode #htc-evo.

I did the insurance route because we have no "official" 4g service to get warranty here.
[EVO 4G Android Development] ViViDboarder:
Yea, that's what I'm doing... I got mine through Best Buy so I have to wait for them to get them in stock.

It's just stupid that they do it this way. They can re-provision all other parts just fine but apparently they don't even know how to use their own WiMAX. :confused:
[EVO 4G Android Development] bigbiff:
I will be dding all my partitions this time!
[EVO 4G Android Development] ViViDboarder:
Isn't using the restore exe enough?
[EVO 4G Android Development] bigbiff:
Doesn't restore everything bit by bit. Only overwrites afaik...
[EVO 4G Android Development] kf2m:
Anybody have a wrecked Evo that's rooted, and still boots that they wanna sell their key binaries before it gets sent off to insurance?
[EVO 4G Android Development] deonjahy:
Don't buy anyone's keys

They de-activate them when the line of service gets a new phone
[EVO 4G Android Development] kf2m:
Are we sure of that? I believe it is done via the MAC address. The key itself is only used for encrypt/decrypt. Industry standard is to block the mac. If some who has a deactivated phone wants to extract the wimax binaries I can hex edit to use my mac and give it a whirl. Unless it has already been done.

Sprint cant help, HTC wants to reflash/replace the phone. I don't want to lose root. Pretty much my two last courses of action is to get Verisign to recreate my key for me, or mod an unused key.

Remember this is a proof of concept thread. If it hasn't been done, you can't debunk it. I'm willing to give it a try since my 4g is hammered already.
[EVO 4G Android Development] deonjahy:
Ok but here its the thing,my wife has an evo and she was returning it to bestbuy for a replacement so I used her keys with my mac and it worked but now after we swapped out her phone my 4g does not work with her keys anymore
[EVO 4G Android Development] AssassinsLament:
Yes, I confirmed this a few pages back. I purchased wimax certs from a known not-in-service evo4g, and it did not work. I then put in my friend's certs, his service is still active, and it worked. So yes, they disable the certs if the phone is no longer in service.
[EVO 4G Android Development] kmartburrito:
I was able to fix my 4G by deleting the /data/misc/wimax/"MACADDRESS".tree.xml file several times....Even though I tried it initially, it didn't actually fix it until I deleted it three times...see my scenario below here...

I went back to the original PC36IMG.zip file, updated to Fresh 3.1.0.2, flashed new radio, updated both profile and prl, updated wimax, again updated both profile and prl.

At this point, that file did not exist for me to delete, and it still didn't work. However, when I turned it on, the file created itself, and I deleted it. I tried turning it on again, no dice. I deleted the file again. Then on the third time turning on 4G, I finally connected.

Fantastic. So...the moral of the story is that step is crucial (at least in my case) to getting it to work again.
[EVO 4G Android Development] bigbiff:
Just curious if you can do "adb shell grep RSA /dev/mtd/mtd0" and report if you get BEGIN RSA CERTIFICATE.
[EVO 4G Android Development] skantman69:
MY 4G IS ****ED NOW ALSO. On fresh latest. Out of nowhere it won't connect. I've tried it all, no dice. Guess I am going to call Sprint.
[EVO 4G Android Development] ViViDboarder:
Check to see if you have your RSA Certs. If you still have those you can still fix your 4G.
[EVO 4G Android Development] kmartburrito:
A buddy of mine gets this error message when running the backup wimax.bin command...at first it got about 5MB into the file and gave him the error, now it won't even try at all.

He's got ~5GB free on a 16GB card.

I noticed someone mentioned this same error in the Broken Wimax, fix here thread, but no one ever responded to him.

Any ideas?

He was able to dump the wimaxraw.bin just fine.
[EVO 4G Android Development] kmartburrito:
Try what I mentioned above with the tree.xml...I had to do it several times before my 4G started working again on Fresh.
[EVO 4G Android Development] raider1v1:
hey guys, this is my phone hes helping me w/. now i cant dump either of them. not sure what the deal it.
[EVO 4G Android Development] datruth585:
ok guys i like ery one else has F'd up my 4g and i found a file in my sdcard named meta-inf (no clue where it came from) which happens to have 3files CERT.RSA CERT.SF MANIFEST.MF , my guess is the cert.rsa is what it sounds like (i hope im not dat dumb) and if so how am I to write the file to my wimax partition? forgive me if this has been answered?
[EVO 4G Android Development] skantman69:
I did it I fixed my 4g. I got a warranty replacement and now it works great. Flame on......
[EVO 4G Android Development] ViViDboarder:
Through Sprint? Or did you get an extended warranty through Best Buy or something?
[EVO 4G Android Development] redsolar:
Sprint replaced mine after a few hours of troubleshooting and level 3 network tech escalation. No extended warranties involved, although I was within 30 days at the time. Just had me go into the store and get a new one. Needless to say, first thing I did was dump full wimax and put it away. Now that nandroid in Amon Ra does it anyway it's a moot point, but still.
[EVO 4G Android Development] ViViDboarder:
Did you get yours from Sprint? Or from Best Buy? I bought mine from Best Buy so I've been dealing with them lately...
[EVO 4G Android Development] redsolar:
Sprint
[EVO 4G Android Development] ViViDboarder:
Damn... Yea, Sprint seems to be pretty quick to get it taken care of. I unfortunately got mine from Best Buy. Sprint said I have to take it there and Best Buy is slow as heck getting any in stock for me to get a new one...
[EVO 4G Android Development] aph:
My wimax partititon is unharmed but I want to do this backup so I don't lose the keys. I rooted using the 2.2 method at http://xdaforums.com/showthread.php?t=765496 and I can get the root prompt (#) after an su in adb shell. However the "fastboot oem h" command only gives me about 10 lines so I can't do the backup.
[EVO 4G Android Development] aph:
Another way I found to do the backup is:

adb shell
su
nandroid-mobile.sh -b

However that gives me this error:

mtd: MEMGETBADBLOCK returned 1 at 0x003c0000 (errno=0)
Dumping wimax to /sdcard/nandroid/HT05VHL09259/full-BCDMRS12-20100905-0556/wimax
.img...mtd: MEMGETBADBLOCK returned 1 at 0x003c0000 (errno=0)
done

Everything but wimax gets backed up just fine. I searched the contents of wimax.img and found 2 keys:

-----BEGIN CERTIFICATE-----
[cert hash]
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
[key hash]
-----END RSA PRIVATE KEY-----

But no "BEGIN RSA CERTIFICATE". Are those all I need to restore my Wimax RSA key if it gets screwed up?
[EVO 4G Android Development] redsolar:
@aph make sure you have engineering mtd installed, follow the original root guide or the thread which talks about engineering mtd and full fastboot after unrevoked forever. Unrevoked forever alone does not install full fastboot access.

The 2 keys you posted are all that's required for wimax authentication since the rest of the partition is wimax firmware.
[EVO 4G Android Development] aph:
Thank you redsolar. I followed the 2.2 root guide (http://xdaforums.com/showthread.php?t=765496), are you referring to another?

By "engineering mtd" I'm assumiing you're referring to something ther than the android sdk tools. I found this by searching:

adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/mtd-eng.img

Is this all I need to do to be able to backup my wimax paritition with nandroid-mobile.sh?

Thanks, I really appreciate you pointing me in the right direction.
[EVO 4G Android Development] autoprime:
fancy seeing you here ;)

you need the engineering bootloader installed for full fastboot commands.

the original root method mentioned is here - http://xdaforums.com/showthread.php?t=701835

if you originally rooted with toasts method and then used unrevoked forever.. the eng bootloader was removed and needs to be put back.
[EVO 4G Android Development] redsolar:
That's the one, yes.
[EVO 4G Android Development] aph:
I'm everywhere, learning and helping where I can. :cool:

Seems both Regaw's root method (that I used) and Toast's use the same mtd-eng.img. Care to point me to the one I should be using? Thanks!
[EVO 4G Android Development] autoprime:
just use the one posted in the link i provided. that will give you full engineering bootloader with fastboot.
[EVO 4G Android Development] aph:
I pushed the mtd-eng.img in mtd-eng.zip from the first post at http://xdaforums.com/showthread.php?t=701835 to the sdcard and flashed it:

# ./flash_image misc /sdcard/mtd-eng.img
./flash_image misc /sdcard/mtd-eng.img
#

Then I rebooted into recovery and ran nandroid-mobile.sh, but got the same error. Here's the full log with the error highlighted:

/ # nandroid-mobile.sh -b
nandroid-mobile.sh -b

nandroid-mobile v2.2.1

Using G1 keyboard, enter a prefix substring and then <CR>
or just <CR> to accept default: fixed
fixed

Using fixed- prefix to create a backup folder

mounting system and data read-only, sdcard read-write
checking free space on sdcard
Dumping splash1 from device over tcp to /sdcard/nandroid/HT05VHL09259/fixed-BC
DMRS12-20100906-1728/splash1.img...done
Dumping splash2 from device over tcp to /sdcard/nandroid/HT05VHL09259/fixed-BC
DMRS12-20100906-1728/splash2.img...done
Dumping boot to /sdcard/nandroid/HT05VHL09259/fixed-BCDMRS12-20100906-1728/boo
t.img...done
Dumping recovery to /sdcard/nandroid/HT05VHL09259/fixed-BCDMRS12-20100906-1728
/recovery.img...done
Dumping misc to /sdcard/nandroid/HT05VHL09259/fixed-BCDMRS12-20100906-1728/mis
c.img...done
[COLOR="Red"][b]mtd: MEMGETBADBLOCK returned 1 at 0x003c0000 (errno=0)
Dumping wimax to /sdcard/nandroid/HT05VHL09259/fixed-BCDMRS12-20100906-1728/wi
max.img...mtd: MEMGETBADBLOCK returned 1 at 0x003c0000 (errno=0)[/b][/COLOR]
done
Dumping system to /sdcard/nandroid/HT05VHL09259/fixed-BCDMRS12-20100906-1728/s
ystem.img...done
Dumping data to /sdcard/nandroid/HT05VHL09259/fixed-BCDMRS12-20100906-1728/dat
a.img...done
Dumping cache to /sdcard/nandroid/HT05VHL09259/fixed-BCDMRS12-20100906-1728/ca
che.img...done
generating md5sum file...done
unmounting system, data and sdcard
Backup successful.
/ #[/SIZE]

I did the same thing with the previous version of Amon RA which did not backup wimax and didn't get that error, so it's definitely the wimax causing it.

Any idea what's going on?

Could there be some confusion here because it looks like the error is related to the misc partition, but it's actually the wimax one?

Possibly something wrong with the phone itself? I have not flashed my wimax partition and would be wary of doing so given the potential for MAC ID/RSA key corruption.
[EVO 4G Android Development] redsolar:
What does "fastboot oem h" output look like?
[EVO 4G Android Development] aph:
F:\Evo 4G drivers\android-sdk-tools\tools>fastboot oem h
... INFOcommand list
INFOkeytest
INFOheap
INFOboot
INFOreset
INFOpowerdown
INFOrebootRUU
INFOheap_test
INFOrtask
INFOtask
INFOenableqxdm
INFOgencheckpt
OKAY [ 0.011s]
finished. total time: 0.011s

F:\Evo 4G drivers\android-sdk-tools\tools>

Thanks for your help, appreciate it very much.
[EVO 4G Android Development] redsolar:
Need to also do this then, if you used unrevoked forever.

http://xdaforums.com/showthread.php?t=752832

That won't have the side effects of the PRI downgrade as it does with the original root method (although that is no longer a real issue either).

That should fix the nandroid wimax backup, as I believe it uses that to backup your wimax.
[EVO 4G Android Development] Andy S:
I thought I'd try this on my recently rooted Evo, "just in case" in addition to Amon_RA 1.8.0.

I assume this should put the WIMAX.BIN and WIMAXRAW.BIN on the root of the SD card, but I don't see them. And I can't do the "adb pull" command, as it says the files don't exist. Which makes sense when I scrolled up to the results of the previous step:

C:\android-sdk\tools>fastboot oem saveprt2sd wimax -n wimax.bin
... INFOSaveImageToSD partition file name:wimax
INFOSaveImageToSD output file name:wimax.bin
INFO[SD]power_addr=0xB1400000
INFO
INFO[SD]clk_addr=0xB1400004
INFO
INFO[SD]mclk_md_addr=0xA86003DC
INFO
INFO[SD]mclk_ns_addr=0xA86003E0
INFO
INFO[SD]SDC4_BASE_PHYS=0xA0600000
INFO
INFO[SD]SDC4_BASE_virt=0xB1400000
INFO
INFOsdc_ns_reg value=0xFFF60B59
INFOsdc_ns_reg value=0xFF9E0B58
INFOCmd5 CMD_TIMEOUT
INFOsdcc_poll_status(): status=804 i=2300
INFOCmd5 polling status timed out
INFOSD: CMD5 fail, rc=2 ..
INFOsdc_ns_reg value=0xFF9E0B58
INFOSD_CMD8.resp[0] =0x1AA
INFOSD_ACMD41.resp[0] =0xFF8000
INFOSD_ACMD41.resp[0] =0xC0FF8000
INFOHC card
INFOSD card mfr_month=2010 mfr_year=3
INFOsdcc_init_memory_device done
INFOsdc_ns_reg value=0xFFF60B59
INFOcard_type = 6......................
INFOSD enable 4 bit mode
INFO Searching free data sectors....
INFO[S2S_ERROR] write_data_to_cluster fail.
OKAY [ 1.264s]
finished. total time: 1.265s

Cluster fail. Any idea what's going on? The SD card is not anywhere near full.

Thanks. Trying to learn this stuff.
[EVO 4G Android Development] redsolar:
What SD card do you have installed, and what is the format type on it ?

I have seen it happen on some poorly formatted cards before, and it was fixed after I reformatted the card in the phone or using Amon_Ra's format utility.

Have you tried dumping full wimax? Have you tried doing it to another partition? Sometimes just a reboot may be able to fix that too.