yashsingh1/xdaforums huggingface dataset:
[G2 and Desire Z Android Development] funkadesi:
+1 for HTC and T-Mo for giving us a REAL challenge....
[G2 and Desire Z Android Development] chaoticaffinity:
What if its something simple like making the exact same write x times in a row. The first time triggers the write protect. The second time lets the system know it should get ready to make the change and the third time it changes.
[G2 and Desire Z Android Development] lbcoder:
How about recovery? Since recovery theoretically must be able to make permanent writes? Is recovery also protected? How about boot, is boot protected? Misc *can't* be protected, nor can cache (write protect would defeat their purposes), and between misc and cache, it should be possible to write an SPL....

Did somebody say they had an engineering SPL from somewhere? It might have been from that leaked dump or something.... An engineering SPL should be able to boot an unsigned recovery or boot image.
[G2 and Desire Z Android Development] fastludeh22:
app root

I'm sorry if this is already known, as I haven't been able to read this entire theard yet, but I promise I will tonight. With that said:

I have root for apps like titiaum backup, and setcpu, etc...

If this is known how to do ignore me, lol. If not ill post up steps. We WILL break this thing open!
[G2 and Desire Z Android Development] lbcoder:
Unlikely. This would be more complicated to write and would require a second CPU (the radio core?) to overlook it. Very wasteful.
[G2 and Desire Z Android Development] digikid:
Ok, I had issues before I left. I will work on this when I get home from work. Sorry for the wait.
[G2 and Desire Z Android Development] ace42588:
was anyone ever able to look at hendusoone log dumps? what was mmc1? mmc0 is the nand and mmc2 is the sd card. in the log mmc0 is later identified in the log as being 2.1gb, mmc1 isnt really identified as anything, and very well could be nothing. seems strange to skip mmc1 in favor mmc2 for the sdcard.

anyone know of any hardware engineers? using an fpga to sniff and interpret the emmc lines would tell us exactly what was going on, but doing so would require a metric **** ton of skill with the board
[G2 and Desire Z Android Development] scrapin240:
called TMo and the reps are like we are not aware of anything that can prevent root (they first said it will void your warranty, etc.) but said that they have not heard anything bc all the reps root their phones.

I think the best thing is for everyone to return their phones and state this as a reason and that will pretty much stop the madness.
[G2 and Desire Z Android Development] Superfrag:
I don't think TMo has anything to do with it ; If this is true, the fault lies with HTC..
[G2 and Desire Z Android Development] LxDroid:
"ChrisSoyars: http://bit.ly/d7sL1n need I say more?"

4 minutes ago via TweetDeck

**Edit** It was fake
[G2 and Desire Z Android Development] Jrbourque:
chrissoyars just posted a screenshot of custom recovery on g2 on his twitter

http://img692.imageshack.us/img692/7089/whatrootkit.jpg

Edit: Damn you lol you beat me
[G2 and Desire Z Android Development] hansalvato:
if this is in the desire z and HD then this is and htc thing
[G2 and Desire Z Android Development] Superfrag:
Owned. ****ing awesome.
[G2 and Desire Z Android Development] legendary1022:
Team Douche is the ish. Hopefully it doesn't reflash on reboot though. The best are working at it, trust me, we will have root in a bit I believe. Now for HTC to release the source code so cyanogen will do his magic and get us CM6
[G2 and Desire Z Android Development] jeremyz:
I'm a hardware engineer with a couple extra FPGAs that I could put to use. I'm just not all that familiar with Linux, which makes it difficult...
[G2 and Desire Z Android Development] Superfrag:
Err..

http://twitter.com/#!/ChrisSoyars/status/26560334096
[G2 and Desire Z Android Development] xile6:
Eta on clockworks?
[G2 and Desire Z Android Development] ScottGood:
Also Said its a joke
[G2 and Desire Z Android Development] Superfrag:
Dude, that was just a screenshot loaded in Gallery. Chris trolled us..
[G2 and Desire Z Android Development] dthadamaja:
doh

yea....I got owned
[G2 and Desire Z Android Development] Bumble-Bee:
Its an image loded in gallery ... NICE !
[G2 and Desire Z Android Development] konrad1337:
Here is the boot and recovery imgs if still needed

http://db.tt/QjykG3F
[G2 and Desire Z Android Development] Algernon:
I would guess that mmc1 is the second, "hidden" partition on the iNAND. According to the data sheet, the iNAND supports split, independently addressable partitions with various levels of programmable read/write protection.

What it looks like we need to be concentrating on are the CSD Register and the EXT_CSD Register. Pages 21-24 in that data sheet lists the parameters of the and what bits in the register control what.

I don't really know what I'm doing and they're are not for Android, but maybe there's some clues in these Linux drivers:

http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/drivers/mmc/core/mmc.c

http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/include/linux/mmc/mmc.h

http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/drivers/mmc/core/mmc_ops.h
[G2 and Desire Z Android Development] Byzogiz:
Considering the overwhelming demand (they can't keep 'em in stock), I doubt returning the phone and trying to make the market speak will change HTC's mind. I was gung-ho about using this phone to replace my aging G1 (that's screaming with Froyo), but now I'm not so sure.

Also: if the T-Mo reps root their phones, are there any who frequent this board who can offer us some insight? Or do they have special G2s?
[G2 and Desire Z Android Development] mytharak:
This whole thing kinda reminds me how the G1 would flash a recovery image file stored somewhere in /system on boot if the file existed.

I wonder how it's doing it this time. Could it be on a hidden nand partition only the bootloader has access to?

I'm just guessing, but I think once the first OTA is out then we can get somewhere.

They have to have made it so they can pust out updates. If they can update it, we will be able to as well.
[G2 and Desire Z Android Development] Bavilo:
Well I don't it will be as easy as it sounds...They have signatures....we don't :D
[G2 and Desire Z Android Development] digikid:
This is going to sound very noob, so I'll give you time to lol before beginning my question:

..............

..............

..................

.......................................

What are you guys using to dump the system? I've been out of this for a while and I'm just trying to get stuff together so it doesn't take me forever later. Thanks!
[G2 and Desire Z Android Development] Anderdroid:
Dump the system folder? adb pull?
[G2 and Desire Z Android Development] paulobrien:
Don't forget the ship ROM in zip format is doing the round. Much better using that than a dump.

P
[G2 and Desire Z Android Development] digikid:
for a partition, not the OS. Argh...Time to read up again. I feel like such a noob. >.< Good thing I have some time. lol
[G2 and Desire Z Android Development] vi5in:
Hey guys,

Just got my G2 yesterday. I'll be happy to help in whatever way I can. First time trying to root a phone. I've been using CM6 on my MyTouch so I have experience flashing and restoring from images.

Perhaps someone who is pretty familiar with this thread can consolidate all the information and make a sticky at the top? Perhaps with what has been tried, and what has been successful, and what is needed next?
[G2 and Desire Z Android Development] konrad1337:
Pretty sure this is what you are talking about...
[G2 and Desire Z Android Development] digikid:
I get it, that is the dump command. ok, I played with the sdk...I will do it live on my phone at home after work.
[G2 and Desire Z Android Development] scrapin240:
ur probably right, but they were talking about their other android phones, not their g2s.
[G2 and Desire Z Android Development] ws.itguy:
Not true. Many ended up returning their Droid X's and I think that's why their "resale" value (if traded in to Verizon) is less than an Eris and definitely less than an Incredible.

The only vote the consumers have is with their wallets. Make a stink about it when you return it to the manager. The noisy assed Sunchips bags are finally being changed due to a small drop in sales :)
[G2 and Desire Z Android Development] konrad1337:
Np, glad I could help. I'm learning even more during this whole process too.
[G2 and Desire Z Android Development] Alcoholic:
Which is the biggest disappointment for me. I love my HTC phone because of it's ability to be hacked. It's what differentiated HTC and other manufactures.

Unacceptable HTC :mad:
[G2 and Desire Z Android Development] hansalvato:
LAWSUITS FTW!haha jk
[G2 and Desire Z Android Development] grankin01:
Don't give up. Anything electronic can be hacked whether physically or logically. Hell, a toaster oven could be hacked and made to do whatever it is you do with a hacked toaster oven.:rolleyes:

Plus, the "big dogs" are getting their hands on these devices now so it shouldn't be too much longer.:D
[G2 and Desire Z Android Development] hansalvato:
ive modded my toaster with a tegra 2 1 gig of ram 9.7 inch display but most amazing of all it knows when to stop so it doesnt burn my toast :)
[G2 and Desire Z Android Development] lbcoder:
I'll take a look at that and hopefully something will be interesting to look at.

Thanks.

Are we sure that sdcard is mmc2 and not mmc1? I haven't seen any mmc2's in anyone's command outputs, and I would suspect that it should be visible in something... if mmc1 *is* the missing space, then that is a very good sign.
[G2 and Desire Z Android Development] lbcoder:
Please don't fall for the marketing nonsense about having a hard time keeping them in stock.. it is 100% artificial, exactly the same way as the fruit company does it.
[G2 and Desire Z Android Development] jtc442:
Here is an email directly from HTC a few minutes ago.

"I understand how important it is to know the extent you can customize your device to and I appreciate your interest in software and development. HTC is not aware of any Root Kit or Blocking feature on the G2. It is quite possible such a feature was added by Google or the Carrier. Please be aware that third party roms even on our older devices do void the warranty on a phone and we can not support them. The only thing we would be able to do is direct you to some of the feedback sites and our support forums located at http://www.htc.com/ us/. We can only support the ROM that came on the device or updates provided at carriers request for a device."
[G2 and Desire Z Android Development] lbcoder:
That is a total load of horse crap since tmobile doesn't even have access to the hardware. It is 100% programmed by HTC.
[G2 and Desire Z Android Development] vabovyan:
Timestamps on recovered files

What are the timestamps on recovered files? Are they same as old one or they are more current? If time stamp is current this means it may runs script to recover deleted. I don't have G2 to test.
[G2 and Desire Z Android Development] ace42588:
lbcoder, here is my source for the mmc1 subject. this is from hendusoone's logs
[G2 and Desire Z Android Development] jtc442:
Just letting y'all know what they said, exact quote.
[G2 and Desire Z Android Development] lbcoder:
Anybody have an idea what this means:

#
# Create a remote storage service in recovery mode if eMMC booting
#
service rmt_storage /sbin/rmt_storage /dev/block/mmcblk0p13 /dev/block/mmcblk0p14
user root
disabled

on property:ro.emmc=1
start rmt_storage

Sure looks suspicious to me.....

That's from RECOVERY

And this:

devwait emmc@system
exec /system/bin/e2fsck_recvy -p emmc@system
mount ext3 emmc@system /system ro data=ordered
...
service rmt_storage /system/bin/rmt_storage /dev/block/mmcblk0p13 /dev/block/mmcblk0p14
user root
disabled

This is from BOOT

WTF is this "rmt_storage" service?

I'm thinking that this might be as simple as killing rmt_storage and setprop ro.emmc=0..... Anybody want to try that?
[G2 and Desire Z Android Development] Nikropht:
Hmm.. did anyone notice the "Slot eject status = 0" diff between mmc0, mmc1 and mmc2?
[G2 and Desire Z Android Development] donboyfisher:
Looking at the dump listed above, the mmc1 has the line:

[ 8.503540] mmc1: Slot eject status = 1

while the mmc0 and mmc2 dont.

If mmc2 was the hidden area, then perhaps its being treated like a removable section of memory and access to it being controlled by simply forcing the value of the variable specifying whether its ejected or not.

If the area registered as being ejected, then the phone may simply make no attempt to access it.
[G2 and Desire Z Android Development] lbcoder:
Here's the good stuff...

on boot
setprop ARGH ARGH
[G2 and Desire Z Android Development] ace42588:
i wouldnt get too caught up with the mmc stuff now that lbcoder found that reference to a rmt storage service. besides, if mmc1 was the hidden area, why is it set as 4 bit while everything else is 8? also, the eject status is just if the hardware can detect a card eject, i dont think its saying whether or not it is ejected.
[G2 and Desire Z Android Development] lbcoder:
Right. One step at a time. rmt_storage could very well be related to that mmc1. Maybe. Or maybe not. The first step is to get a persistent root.... which means that somebody who actually HAS this device has to try out.

Note that it may be necessary to setprop FIRST, and *then* kill the rmt_storage service. Would be nice if this is all it takes.
[G2 and Desire Z Android Development] hendusoone:
The kernel boot logs I posted were from that devlog partition. It is mounted at /devlog - has rotated system and kernel logs (old ones are gzipped). I didn't bother with the system logs, since they were mostly full of touch events. Can't adb pull directly from that directory, but you can use a root shell to copy the files somewhere else and then adb pull.
[G2 and Desire Z Android Development] grivad:
I think you and I interpreted the same message from HTC completely differently. That, to me, sounds like the G2 (an HTC-manufactured device) does not have a hardware feature to prevent rooting or modification, and that the prevention is being done via software potentially developed by the carrier. That is all.
[G2 and Desire Z Android Development] lbcoder:
... and since the carrier doesn't have access to the hardware, they couldn't have. Not without the manufacturer's knowledge.

In any case though, if you have a vision, please try out my suggestion from a couple of posts back to see if it can be used to make persistent changes to the system partition. Note: I suggest creating a NEW FILE rather than modifying existing files -- in case it actually works.
[G2 and Desire Z Android Development] pconwell:
Anyone see this from http://gorumors.com/how-to-root-t-mobile-g2/2755777 The article says this was on XDA, but I haven't seen it (but I could have overlooked it)

Step 6 : Here, navigate to the Android ADK -> Tools folder and enter the following commands

adb push rageagainstthecage-arm5.bin /data/local/tmp

adb shell

cd /data/local/tmp

chmod 0755 rageagainstthecage-arm5.bin

Step 7 : Now, on the G2, launch the terminal emulator application and type these commands

cd /data/local/tmp

./rageagainstthecage-arm5.bin

exit

Step 8 : You will now see a message that reads, “Forked #### childs.“. Here press the enter key

Step 9 : If you are on the $ prompt, type ps and confirm that you see a message that says it cannot be forked

Step 10 : Use the back button to exit the terminal emulator app. Launch any application on your G2 and launch terminal emulator again. Hit ‘Force Close‘ when prompted

Step 11 : Launch terminal emulator one more time. You can now see the root shell.
[G2 and Desire Z Android Development] xyrcncp:
It's the thread right before this one!

[GUIDE] Instructions to Root G2 [Temp Root]
[G2 and Desire Z Android Development] lbcoder:
Got a real bright light here I tell you... YOU ARE IN ONE OF THE THREADS THEY ARE REFERENCING!!!!

Root HAS been found. It just doesn't stick!

Note that that second thread only SUMMARIZES what was developed in THIS thread.
[G2 and Desire Z Android Development] arich:
My background is palm and iPhone hacking but if there's a basic introduction I can go through to start understanding the Android system I'll gladly try any of this on my phone.
[G2 and Desire Z Android Development] pconwell:
Lolz. I told you I looked, I just overlooked it in my excitement. I just got mine in the mail so I don't have time for all this reading nonsense.
[G2 and Desire Z Android Development] lbcoder:
As I already said....

setprop ro.emmc=0

and then kiill the rmt_storage process!

First you need to temp root, then do that stuff, then mount -o remount,rw /system, then echo "123">/system/abc, sync, and reboot.

When it comes back, check if the file "abc" exists and has the contents "123". If it does, then success has been achieved.
[G2 and Desire Z Android Development] ace42588:
rmt_storage might be a red herring. i found references for it in other places that seem highly unlikely to be involved with our write issues

references:

http://pastebin.com/V7qtrexR

http://github.com/koush/android_vendor_huawei_pulse/blob/master/init.qcom.rc
[G2 and Desire Z Android Development] Nikropht:
Comparing the dmesg from the galaxy shows mmc0-2 also...

http://sven.killig.de/android/Galaxy/dmesg_host.txt
[G2 and Desire Z Android Development] f231f:
twitter.com / cyanogen
[G2 and Desire Z Android Development] FRSP:
As mucking about with a mounted partition behind the kernel's back would seem likely to cause odd problems, this would strongly suggest that the un-doing is occuring with something running on the application processer in either kernel or user mode, not something being done by the baseband processor. Also note that it's generally discouraged to access real files from the kernel (though there's that web page that says effectively, now that I've told you not to, here's how you can) however whole partition substitution might be a possibility.

You might be able to approach this by eliminating possibilities - for example, do a temp root and the "stop" the android runtime (likely not the culprit, but anyway) and see if the changes are undone after a few hours. If they still are, trying killing off various other things (and leaving something watching to make sure they stay dead) and see again. Even just watching a file to see when it changes back and figuring out everything that was running at that time could be a clue - a privileged process with a high pid indicating recent start would be particularly suspect). Don't forget to grab a dmesg too.

Something I've long wondered about is binary analysis of kernels for which source hasn't yet been released for license compliance. Since you have 99% of the source from upstream, plus a lot of exported symbols, I wonder if it might be possible to identify the known, standard parts of the binary and thus isolate vendor customizations for dissasembly and study.
[G2 and Desire Z Android Development] lbcoder:
The first reference you gave is really interesting... it says that it is a dump from.... init.vision.rc. You know what that means?

Second one is an interesting thing as well, it gets rooted via something called "superroot" or "quickboot", or some other weird thing, essentially, a hacked together recovery system that is used to modify the system partition. Why? Might be to get around the same thing.
[G2 and Desire Z Android Development] hendusoone:
Tried it. abc did not exist after reboot. But, I did notice that rmt_storage automatically starts again after killing it.
[G2 and Desire Z Android Development] smjfosho:
That image is fake. There is progress, but not that far yet.
[G2 and Desire Z Android Development] lbcoder:
You MUST STOP rmt_storage from starting! If you have to, DELETE the damned thing!
[G2 and Desire Z Android Development] arich:
Bro I'm so noob I've never even installed the SDK. Downloading now, I'll try what you said later
[G2 and Desire Z Android Development] hendusoone:
Righto. Just tried again, after renaming rmt_storage to rmt_storage_off. Process didn't re-start, /system/abc was gone after reboot. And rmt_storage is right back to where it was before.
[G2 and Desire Z Android Development] lbcoder:
I think it might not be possible to update the ro.emmc value on account of it being a read-only property. It might be sufficient just to make it impossible for that rmt service not to start.... or it might give errors for failed writes.

It should be possible to update recovery from root. The big question though, is to WHAT.
[G2 and Desire Z Android Development] lbcoder:
I think we're going to need a custom recovery or engineering SPL to make this actually work.

The boot/recovery images are fairly standard android recovery images. The first obvious thing to do is to rip the signature check out of the recovery and then flash it back -- then just any update.zip should be able to fix things... hopefully.
[G2 and Desire Z Android Development] smjfosho:
"ChrisSoyars: .@cyanogen there are nand unlock commands in hboot, just gotta figure out the arguments and bypass the radio checks"
[G2 and Desire Z Android Development] ace42588:
...and just a bit more about rmt_storage. somebody else clearly thought it was interesting. the last result in the search was dated yesterday and deleted. you think one of the major groups has already jumped on this, and just hasnt shared any of the work progress?

http://pastebin.com/search?cx=01330...=UTF-8&q=rmt_storage&sa.x=22&sa.y=7&sa=Search
[G2 and Desire Z Android Development] lbcoder:
Quit being whiny.

If you just go around dismissing everything that doesn't instantly pan out for you, you will NEVER be a successful hacker. Just a successful annoyance.
[G2 and Desire Z Android Development] ace42588:
didnt mean to whine, just saw a lot of work already done. thought it was interesting. trying to look at the bigger picture based on those results. any progress on removing the sig checks? also, which part was dismissive? i wanted to share what i found to see if someone else could make a conclusion based on it.
[G2 and Desire Z Android Development] FRSP:
How about the vendor kernel with an init that does nothing but load any known-benign modules, fork adbd and then sit there?
[G2 and Desire Z Android Development] lbcoder:
The problem is that what you've posted regarding rmt_storage hasn't actually had any information in it. I do believe that this *is related* to the write lock, however disabling rmt_storage might only be part of it -- for example, the part where writes to the system partition *LOOK* like they're happening, by making the writes to a... remote_storage facility.

It also appears that the system partition IS GENUINELY locked. Not permanently, but as Chris Soyars mentioned about hboot mmc lock/unlock commands.... does that not feel like it is at least related? So there you have it... locked and writes redirected.
[G2 and Desire Z Android Development] lbcoder:
That isn't quite what I mean. I mean that we need to actually build a recovery image that is compatible with the device that can actually perform normal system updates in the normal way. In other words, skip the signature check and go for the write.... hoping that the hardware doesn't have a secondary signature check.

Mind you, adbd by itself wouldn't be a bad idea either.
[G2 and Desire Z Android Development] sumomike:
I havnt read every post in this thread but I read many of them. I'm going to sound like a fanboy here but I dont think T-Mobile had anything to do with this or even had knowkedge of this lock until today. You would be surprised how things work in this industry.

Im wondering if that leaked rom can tell us anything?
[G2 and Desire Z Android Development] donboyfisher:
When its re-booting and wiping out any modifications, does that boot take longer than a normal cold-start of the phone that hasn't been modified.

I'm just wondering whether the rmt_storage routine is ( however it gets initiated ) is copying over a complete image, then running it, which I imagine would take longer than a normal boot.