yashsingh1/xdaforums huggingface dataset:
[EVO 4G Android Development] mpa4712:
Looks like the guys over at unrevoked have come to essentially the same conclusion as we have, the updates to wimax have borked the wimax partition to a point of now return (unless of course you have a backup of the wimax partition!).

At this point, what course of action are you guys going to take? For me, personally, I don't know if losing wireless tether in order to get a new phone that can't be rooted is worth it. I think that functionality to me is more useful than the 4g.

I still find it hard to believe the wimax partition is the only place that has some sort of copy of the keys though.
[EVO 4G Android Development] Geniusdog254:
I noticed that same thing. I got a copy from a buddy and it doesn't work.

It's not a signal problem since we were downtown in the heart of St. Louis. Sure enough, he turns his off, mine works, I turn mine off, his works.

Damn. Looks like im gunna swap before my store starts getting them with the .47 update
[EVO 4G Android Development] Cordy:
It's good to see an update on this even if the news is not so good. I went ahead and went to my local store myself today after I put my phone back to stock. They didn't have any so the local repair store went and ordered me one which I should be getting in on Monday. Hopefully it'll either be stock or the 1.32.651.6 OTA. If not guess I'll be stuck without root until the community can figure out a way to root the latest OTA. If I am so lucky first thing I'll be doing once I root my phone is make a backup of my WiMax partition. It'd be wise for everyone to do this. Unlike some of Sprint's other phones, the Evo is a flagship device. I'm quite sure this won't be the last of the updates for the device either before or after the Froyo update.
[EVO 4G Android Development] mpa4712:
What reason did you use when you returned your phone? Didn't start with 'so I broke my phone flashing my wimax partition...' did it? :D
[EVO 4G Android Development] Cordy:
lol indeed I did not. After of course returning my phone to stock and then updating it to the latest OTA first (while dying a little inside as I did it) I simply went to the Store told them my Evo would no longer connect to 4G after the latest OTA. Told them I spoke to tech support they couldn't help and recommended I returned the phone while within my 30 days for another one. They didn't have any so they referred me to the repair store. I went told them the same thing. They were actually a bit more receptive than the corp store. It was a very interesting experience waiting there for them to check my phone. Nonetheless they checked it saw it wouldn't connect and then ordered me a new phone no hassles. They also stated the replacement would technically be a new phone as they don't have refurbs yet. So now I patiently wait.
[EVO 4G Android Development] mpa4712:
Did you get your phone from a Sprint store to begin with? Mine is from walmart.com..

and are you in an official 4g area?
[EVO 4G Android Development] Cordy:
Yes and Yes. Which is funny cause they asked the same thing. I do believe their policies are different if you purchase from someone other than them. I believe the corp store will tell you to go back to the store. The repair center will probably at least look into it for you.
[EVO 4G Android Development] redsolar:
I have a few more ideas i will try, but it'll have to be tomorrow. I'll keep this updated.
[EVO 4G Android Development] amw2320:
Thanks for the info. Luckily I was busy over the last couple of days or my 4G would have been hosed. Just made a backup.

By the way. The fastboot -a command would not work, it gave me an error after about 8mb of copying and wouldn't make a raw file (maybe because I'm using and old linux version of fastboot).

What was the point of the full partition dump?
[EVO 4G Android Development] jrmithdobbs:
To see if the keys were still on the partition since the newer (broken) image that gets flashed is smaller. Everyone who's looked say they're not, though. :(
[EVO 4G Android Development] redsolar:
I am not convinced that's a "raw" partition dump in the "dd" sense of word. We still have a shot at it with a full copy (using dd), if we figure out a way to do it.
[EVO 4G Android Development] redsolar:
I have attempted to create a self-signed certificate using a private RSA key from another phone, and as I expected, it didn't work.

In the process, I discovered that keys are 2048 bits, and a few other bits of information:

Data below is from a

Valid

certificate

Certificate:
Data:
Version: 3 (0x2)
Serial Number:
<redacted>
Signature Algorithm: [B]sha256WithRSAEncryption[/B]
[B][COLOR="#ff0000"]Issuer: C=TW, O=HTC Corporation, OU=WiMAX Forum(R) Devices, CN=HTC[/COLOR][/B]
Validity
Not Before: Apr 22 00:00:00 2010 GMT
Not After : Apr 22 23:59:59 2030 GMT
[B]Subject: C=TW, O=HTC Corporation, OU=WiMAX Forum(R) Devices, CN=<phone lower case mac with no punctuation> PC36100[/B]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (2048 bit)
Modulus (2048 bit):
<REDACTED>
Exponent: 65537 (0x10001)
X509v3 extensions:
[B] X509v3 Key Usage:
Digital Signature, Key Encipherment[/B]
X509v3 Authority Key Identifier:
keyid:[B][COLOR="Red"]F2:7A:04:6F:E6:19:94:10:55:62:C2:1F:58:FA:EB:63:21:C2:9D:83[/COLOR][/B]

[B] X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.24757.1.1[/B]

Signature Algorithm: [B]sha256WithRSAEncryption[/B]
<REDACTED>

Parts in Bold are the important parts, not common for traditional SSL certificates. Parts in Red are ones that require HTC key to sign. Without it, Issuer and Subject as well as Authority Key Identifier and Subject key are the same (which is normal for Self-signed certs)

With a key like that in place, 4G scans, detects, and attempts to authenticate to WiMax, but fails, and keeps scanning, likely because it fails a trusted key check. There are no crashes, which happen when the key is completely absent.
[EVO 4G Android Development] Geniusdog254:
So basically, we're effed?
[EVO 4G Android Development] mpa4712:
Unless someone is really good friends with a Sprint engineer who can regenerate these for us.

At 1024bit, this was nearly impossible, 2048bit we will need a couples years and access to NASA's super computers to break the algorithm.

Still, It seems odd that the wimax flash files are only about 7.5mb, while our dumps are 12mb..
[EVO 4G Android Development] Geniusdog254:
Ouch.

And I think the difference comes because there is some free space in the partition. When we dump with the -a command to copy even blank bits, we get the full ~12mb partition, but if we dump it without the -a command, they are ~7-8.5mb, which matches a real update.
[EVO 4G Android Development] mpa4712:
My regular dump was actually 8.8mb, yet I didn't see any mention of the RSA keys in my hex editor.
[EVO 4G Android Development] yous1200:
Red Solar,

Just wondering what your gut feeling is, is this something that can eventually be solved or should we start thinking about exchanging our phones?

Thanks.

Sent from my HTC Evo!
[EVO 4G Android Development] redsolar:
FWIW, dump sizes vary even on working phone. 2 of the phones I have dumped about 8.6 MB, and one 7.6 MB. Full partition is still the same on all of them, 12MB, likely for "future enhancements"

The rsa keys are just stored as plain text so if they are not there that just means they were overwritten, still I think we need to try a full raw dump idea (dd style) but need to know how to do it
[EVO 4G Android Development] redsolar:
I'm out of ideas at this point. If anything else comes to my mind I will add, but it doesn't look too promising.
[EVO 4G Android Development] peanutplanters:
So if I've read this thread correctly, having a Nandroid backup of when my 4G DID work will still not allow me to extract my RSA keys?
[EVO 4G Android Development] mpa4712:
100% Correct.
[EVO 4G Android Development] AssassinsLament:
Are these NSA keys stored anywhere on the data or system nandroid images?
[EVO 4G Android Development] mpa4712:
If they are, no one can find them. I looked all over the place and wasn't able to find any reference to them anywhere. I think they are simply written directly to the wimax partition.
[EVO 4G Android Development] jrmithdobbs:
So what is the best way for us to make sure we have a good, reastorable, backup assuming 4G is currently working?
[EVO 4G Android Development] mpa4712:
Look at the very first post here with the directions on how to make a dump of your wimax partition. Do both parts. Not only is that the best option, but it's quite literally the only option.

Put your backup in a safe place!
[EVO 4G Android Development] jrmithdobbs:
Has anyone actually confirmed being able to restore such a backup to the same phone and have working wimax afterwards, I guess is what I'm asking.
[EVO 4G Android Development] mpa4712:
Red was able to restore a backup from a working phone to a phone with a bad wimax mac and have the phone work as it should.
[EVO 4G Android Development] redsolar:
^^ What he said.

Using fastboot seems to be the only option for now.

This post is also talking about using cat which works without using fastboot and without rebooting the phone (root still required), however, the dump is not binary safe. Doing a bit comparison yieds different result, likely due to codepage interpretation by cat vs fastboot commands being a true binary copy.

cat also provides exclusively a full partition dump, whereas fastboot can backup "data only" (safer to flash using flash_raw_image()) and "full dump"

I am still looking for a way to use dd to do a block dump (which is the only remaining idea i have to retrieve overwritten keys), but i don't seem to have much success there.
[EVO 4G Android Development] nefas110:
Hey red,

Why does your new_wimax.zip include a wimax_25641R01.img in the fw folder? Since the flashed image comes from /sdcard...

Thx
[EVO 4G Android Development] redsolar:
I never tested the script without it, so i am not sure it works any other way. I know flashing it that way works, and I am not going to test it to brick the Wimax again :)
[EVO 4G Android Development] nefas110:
Cool, thx. I was just really confused :)

Have you gone through and done "fastboot oem saveprt2sd" for other partitions?

I'm learning there are a bunch of hidden partitions in android:

Wish nandroid was a more complete backup tool so this crap wouldn't happen...
[EVO 4G Android Development] redsolar:
I haven't, no. As of now, it appears that wimax is the only partition that has some unrecoverable sensitive information on it in the face of RSA keys.

I think a better solution is a comprehensive raw backup/restore tool. Let nandroid do the job it already does well.

I think as more WiMax devices surface, support for this is iminent too (as I am positive TLS authentication is here to stay), it's just EVO is the only 4G phone out in the wild in quantities for another little while till Samsung Galaxy hits. And who knows if Galaxy will even be rootable - although I have to say I was amazed how fast the hobbyists cracked the evo open :)
[EVO 4G Android Development] nefas110:
Yeah. Well great work digging into this stuff so we know what to expect now.
[EVO 4G Android Development] redsolar:
Based on your suggestion, i did a full dump of all partitions too.

Interestingly enough, some of the blocks on system said they were bad. I sure hope that doesn't mean the flash in the phone is bad - that wouldn't be good.
[EVO 4G Android Development] nefas110:
Hm, you should do it with your other evos (non-rooted?) too and see what happens.

I actually haven't unlocked NAND on my phone cuz I've been too busy and having fun watching the world cup from my pocket. So I didn't mess with it yet. This is priority number 1 once I do that.

Edit: duh, can't do that without root...
[EVO 4G Android Development] Geniusdog254:
All flash memory has some bad blocks. It would be unfeasable to create ALL the chips without a single bad block, so that is normal.

The NAND is just programmed to write around them.
[EVO 4G Android Development] redsolar:
Right, however since fastboot oem savepart2sd is only supposed to read the data-containing blocks (unless -a is specified) it makes me wonder :).

I'll have to check the other phones to see what they say...
[EVO 4G Android Development] Geniusdog254:
I think I get what you're getting at...

Since the bad image we flashed wasn't the full ~12mb, it only overwrote some of the blocks, so the ones that had our keys may still be there.

Am I onto what you're saying here or am I way off?
[EVO 4G Android Development] redsolar:
Nah, thinking more that if the data blocks that show up as bad are supposed to be filled with data... then there may be issues with files sitting on /system down the road. No other partitions showed any bad blocks.

This is a replacement phone too. I am currently doing the dump of the partitions after patching up to 1.47-based DamageControl ROM to see if that has changed, since /system is formatted in the process.
[EVO 4G Android Development] SanjuroMakabe:
fellow experts, I need some explanation after reading too many threads on 4G issue and trying to fix my own problem:

wimax partition dump and data dump - I have the "-----BEGIN RSA PRIVATE KEY-----" block, but I don't see a corresponding public key block

my wimax data dump is 7.5mb, while the partition dump is 12mb like everyone else

the wimax data dump shows MAC as 00:18:XX:XX:XX:53, but my device MAC is 00:18:XX:XX:XX:54. The partition dump has both 53 and 54. All other files on the phone shows MAC as being 00:18:4XX:XX:XX:54.

I started with the phone on launch day, rooted via toast's pt1 and pt2, went back to the stock RUU at 1.32.651.6, used unrevoked for a bit, took the OTA to 1.47.651.1, and rooted via the flash exploit to whitslack's stock rooted 1.47.651.1

My 4G connects, does speed test just fine. It loved to drop (dropped less after the MSL unlock + idle timeout fix). However when I am connected to wimax and hit a site, there is a long delay between my hitting a link to when the page start loading (it does load quite fast).

What is the deal? Is it how 4G is supposed to work and I'm just being paranoid?
[EVO 4G Android Development] redsolar:
Look for BEGIN CERTIFICATE - this will be your public key. Both are equally important to backup.

It varies by phone. I had 3 different values so far. 7.5, 7.6 and 8.5-8.6 MB.

MAC address differential is normal. Don't ask me why - I have no explanation for why it's done this way.

How long of a delay, and how many 4G bars do you get? What happens on 3G?

Have you checked how high of a latency you have (use Speedtest app by OOKLA from market)
[EVO 4G Android Development] SanjuroMakabe:
duh its right on top of the private key block. got it

Ok so no problems here

ok

around 5sec, which feels like forever :D

I had around 0~1bar. The Overdrive 4G next to me said 10% signal strength, but managed to chug along on 4G anyways.

response is super quick on 3G, but bulk data rate is lower as expected.

latency around 150ms. down ranged from 950kbps-2500, up ranged from 65(!!) to 200

Thanks for the help!
[EVO 4G Android Development] redsolar:
Latency seems normal

Depending on the DNS server you get pushed, which varies by location where you are on 4G, it may be slower or faster. No easy way to change it, too, unless you want to edit /system files.

0-1 bars is kind low, so it could be the issue, I see similar results with 0-1 bars as well sometimes. Bars also aren't reliable enough, usually 0-1 bars means it's a bit too weak, and need to find a better palce, or down/up won't be stable, and can be all over the place.

I think the picture you are seeing is withing normal range of the conditions you have described, I wouldn't worry about it too much.

Sprint/Clear Wireless are continuously adding new WiMax towers, and with time it will become better and better.
[EVO 4G Android Development] RavenII:
I did a wimaxerase...and well, it does exactly what you think it would...it erases EVERYthing...FF:FF:FF:FF:FF MAC (Before rebooting)...00:16 Mac AFTER reboot...makes me wonder...luckily I have a virgin Evo to compare against...BUT, I would like one of you guys with an RSA key to give me the first few num/chars of it...

It really blows that Qualcomm didn't make this chip...QXDM (a newer version would have helped....)
[EVO 4G Android Development] redsolar:
I hope you did this knowing what you were doing, and had a backup (or out of desperation)

Attached is an RSA private key (as it appears in a wimax dump) from start to finish
[EVO 4G Android Development] RavenII:
Haha, yeah, I knew what I was doing...thanks for looking out though man, I've been trying to figure this wimax out for a few days now. I've done a LOT of other hacking and such but just on different forums...one of which got taken down (mobile-files), I'm not new to this by any means at all...but I appreciate the concern. I do NOT suggest anyone else do that at all...in any way...period!

BTW, the keys are different (I'm sure you knew...), BUT one observation was that they both start with MII which is an interface that you could use to control the chip, so that makes me wonder if it's related to authentication or not...

If you take a gander at the data sheet for the chip, you'll see that under "DATA INTERFACES" (second page)...MII is listed as the first one. I'm sure there's a relevance to this...just don't know how yet.

Figured out what MII is...
[EVO 4G Android Development] mackaikai:
gave up on trying to find a fix for this...got my Evo exchanged today at Sprint
[EVO 4G Android Development] RavenII:
It's not about fixing mine, its about the challenge.
[EVO 4G Android Development] redsolar:
I believe all RSA public and private keys contain the same starting strings. The reason is for sanity checks, I do not believe it has anything to do with MII that you have found. I checked a few of the pub/priv keypairs i work with, and I saw MII everywhere.

And yes, keys are different, since one is a private key (can be literally random, and phone specific), which is then used to generate the public key, which is signed by HTC at manufacturing time (and what we can not reproduce :\), and then used for authentication to Sprint WiMax servers, which issue IP addresses based on certificate's common name, which is MAC + PC36100.

Pretty smart security wise I would say, but unfortunately, wimax keys are too unprotected :\
[EVO 4G Android Development] timncantx:
we have 3 evo's at work.

1 stock ota 1.47 no wimax (hardware rev 2)

1 rooted 1.47 (latest dc rom full root) latest wimax radio wimax works (hardware rev3)

1 rooted (hardware rev2) on fresh 1.32 oldest wimax (wimax works) flash to 1.47 no wimax on old wimax radio or next 2 versions.

hope this helps..
[EVO 4G Android Development] nefas110:
Has anyone tried asking HTC/Sprint to get them back? "Dog ate my wimax keys..."
[EVO 4G Android Development] AssassinsLament:
Have you guys tried copying the certs from a known working phone, but then hex editing the mac addresses, username, and password to your normal one?

So I've read that the certs act as an encryption method for sending/receiving data, maybe it's not important in authentication?
[EVO 4G Android Development] jrmithdobbs:
Yes that's been tested. Both phones then cannot be on 4G at the same time.
[EVO 4G Android Development] redsolar:
Unfortunately, this does not work for more than one phone at a time.

Moreover, the Common Name (CN) in certificate is used for issuance of IP address, and is composed of lowercase mac address + PC36100 (e.g. 0123456789ab PC36100) and is required to be signed by HTC trusted certificate. That common name is most likely used to attach the IP Address (albeit, temporarily to that phone). It is possible that if say 2 phones were in 2 very distinct locations, that the IP may be issued differently, but if Sprint did it right, it still won't be a long-term solution.

Even making up your own certificate, otherwise replicating every attribute (other than official signature) of it won't work.

Usernames and passwords are not used in any part of the authentication process. If you check logcat while enabling your WiMax, you should see the line to the likes of...

TLS is used, skipping authentication.

TLS refers to public/private key authentication, which is used in checking the validity of a phone on the network.

So there are 2 real possible (although at this moment unattainable) solutions:

Disable TLS somehow (no idea how)

Get a high-level tech to sign a private key with HTC official signature (again, really hard to achieve)

If either of the above steps can be performed, the rest is trivial, and has been discussed in this thread
[EVO 4G Android Development] seven5suited:
(First off, I really appreciate all of the hard work some of you have put into this issue. You know who you are.)

Hey guys, just thought I'd mention that I think I found a tiny error in the instructions in the first post that could mess someone up if they don't pay attention. You have both dump files being named "wimax.bin," so the second dump gives a "file exists" error. If you don't pay attention, you'll think you dumped both, but will only have one.

Also, a quick semi-noob question on the wimax issue: I did the dumps in the instructions so I would have the backup of my partition, etc., in case anything goes wrong later. I actually don't know if I screwed my wimax yet. (The question is coming; I promise.)

I checked my partition dump (the larger file) and have the "BEGIN RSA" entry with my key in it. I also checked my MAC address against what's under my battery, and it is correct. Is there any reason, after all this being correct, that my wimax wouldn't work? (It doesn't right now.) Not officially released yet here, the coverage is unreliable so far, so I won't know if it's coincidence if I don't get 4G for a while, or if I actually borked it. If it's screwed, I'll exchange the phone.

(I did the SimpleRoot OTA 1.47.651.1 Edition, then flashed Fresh, BakedSnack, and DamageConrtrol ROMS, if that helps.)

Thanks in advance.

EDIT: I am getting sporadic wimax connection, for a minute at a time, then am bumped off. It's as if I am being bumped off by someone who has my same key, but probably not... I will post my issue in a different thread, but will leave this here in case it's somehow relevant, or anyone wants to offer me some insight. :)
[EVO 4G Android Development] redsolar:
Your symptoms sound like you have an incomplete wimax firmware update. Chances are something is still missing.

The easy way to fix it:

Backup with nandroid

Follow this thread to the t (the most reliable method I found to date)

Restore your nandroid backup

At that point, you should have working 4G

If the above doesn't work:

Use Titanium Backup for root to back up your apps + data

Use Handy Backup to backup SMS + Call Log

Follow this thread to the t (the most reliable method I found to date)

Flash the ROM you had on

Restore apps + data with Titanium Backup for root

Restore SMS + Call Logs with Handy Backup

Second method is considerably slower, especially if you have a lot of apps (and don't have a Donate version of Titanium Backup), but it's likely a little more reliable.
[EVO 4G Android Development] redsolar:
I had another idea the other day.

Anyone here has a sprint 4G USB card? I wonder if that contains similar firmware with similar/same RSA key authentication. If it does, there are lots of sprint 4G cards on sale on eBay without contract (for ~$30), which could be used to borrow the keys from :P for people who can not get their phones exchanged, or otherwise.
[EVO 4G Android Development] ViViDboarder:
That's a very clever idea!! Would definitely be worth a shot huh?
[EVO 4G Android Development] RavenII:
Supposedly there's another update that released today (to fix this issue)...we'll see about that...Sprint is SO shady when it comes to owning up to certain things.
[EVO 4G Android Development] ViViDboarder:
Owning up? Sprint didn't break this...
[EVO 4G Android Development] AssassinsLament:
And where is this update? OTA?
[EVO 4G Android Development] redsolar:
Indeed. So yeah if anyone has a usb card, we can see what we can pull from there.
[EVO 4G Android Development] seven5suited:
Thank you for this! Will do and report back when I am in wimax coverage again.