yashsingh1/xdaforums huggingface dataset:
[G2 and Desire Z Android Development] hendusoone:
Here's some logging from my last boot. Not sure if this is helpful to anyone, but it might have some fun bits of info. This is taken from /devlog/kernel_log : http://pastebin.com/LeDWUCx4
[G2 and Desire Z Android Development] southeastbeast:
Some of this isn't making sense. In /system/app maps & facebook and other apps are preinstalled but updatable by market.

So there has to be a way to toggle permanent writing and/or update signature.

EDIT: maybe not because the only one that was pre packed and updated after turning on was adobe flash and its in /system/app and /data/app
[G2 and Desire Z Android Development] Algernon:
It would be interesting to compare this against a log where changes have been made to /system using the Temp Root.

Edit:

This looks interesting:
[G2 and Desire Z Android Development] southeastbeast:
I've done temp root. How do I log and what sort of changes? Mount /system as rw and rm amazon mp3 would be enough?
[G2 and Desire Z Android Development] hendusoone:
The base app is installed in /system/app. After downloading an update for a system app from the market, the update is placed in /data/app. The update is never written to /system/app.

RE: My logging. That reboot was done after a temp-root, so what you'll need is a log that was done with a clean non-rooted system. I'll generate one of those now... will take a few min.

EDIT: Here's the non-temp-rooted boot log: http://pastebin.com/Fednfh1n
[G2 and Desire Z Android Development] mia9318:
just a thought when we used to make robots we used to use reprogrammable chip sets and one time programing chips but if we wanted to change the system process on the locked chip we would use a special code like e/: the drive write code and the input info we wanted to change. if you got the rom for the g2 look for pattern similarities and unusual locations that normally arent used and you might find what we need. just a thought
[G2 and Desire Z Android Development] southeastbeast:
Is tmpfs such a location?
[G2 and Desire Z Android Development] ace42588:
[ 8.499877] mmc0: No card detect facilities available
[ 8.500457] mmc0: Qualcomm MSM SDCC at 0x00000000a0500000 irq 98,0 dma 8
[ 8.500610] mmc0: Platform slot type: MMC
[ 8.500823] mmc0: 4 bit data mode disabled
[ 8.500946] mmc0: 8 bit data mode enabled
[ 8.501068] mmc0: MMC clock 144000 -> 50000000 Hz, PCLK 96000000 Hz
[ 8.501281] mmc0: Slot eject status = 0
[ 8.501434] mmc0: Power save feature enable = 1
[ 8.501647] mmc0: DM non-cached buffer at ffa0d000, dma_addr 0x2ac85000
[ 8.501770] mmc0: DM cmd busaddr 0x2ac85000, cmdptr busaddr 0x2ac85300
[ 8.502716] mmc1: Qualcomm MSM SDCC at 0x00000000a3000000 irq 96,0 dma 8
[ 8.502838] mmc1: Platform slot type: N/A
[ 8.503051] mmc1: 4 bit data mode enabled
[ 8.503173] mmc1: 8 bit data mode disabled
[ 8.503295] mmc1: MMC clock 144000 -> 50000000 Hz, PCLK 96000000 Hz
[ 8.503540] mmc1: Slot eject status = 1
[ 8.503662] mmc1: Power save feature enable = 1
[ 8.503875] mmc1: DM non-cached buffer at ffa0e000, dma_addr 0x2ac86000
[ 8.503997] mmc1: DM cmd busaddr 0x2ac86000, cmdptr busaddr 0x2ac86300
[ 8.504760] vision_sdslot_switchvdd: Disabling SD slot power
[ 8.505126] mmc2: Qualcomm MSM SDCC at 0x00000000a3100000 irq 100,0 dma 8
[ 8.505340] mmc2: Platform slot type: SD
[ 8.505462] mmc2: 4 bit data mode enabled
[ 8.505676] mmc2: 8 bit data mode disabled
[ 8.505798] mmc2: MMC clock 144000 -> 50000000 Hz, PCLK 96000000 Hz
[ 8.506011] mmc2: Slot eject status = 0
[ 8.506134] mmc2: Power save feature enable = 1
[ 8.506286] mmc2: DM non-cached buffer at ffa0f000, dma_addr 0x2ac87000
[ 8.506500] mmc2: DM cmd busaddr 0x2ac87000, cmdptr busaddr 0x2ac87300
[ 8.506622] mmc2: Polling status mode enabled

[ 8.660003] mmcblk0: mmc0:0001 SEM04G 2.10 GiB

whats mmc1?
[G2 and Desire Z Android Development] mia9318:
i suck at programming whats tmpfs
[G2 and Desire Z Android Development] aacrabtree:
So this may be a completely stupid suggestion, I'm not too experienced in anything necessary for developing a root method. Has anyone tried something similar to what had to be done to root the LG Ally? I had that phone for about 2 weeks prior to getting my G2, and (before Unrev0ked came out) to root, you had to first soft root, then flash a custom recovery, then basically re-flash the recovery from command line in recovery, and then reboot and root would stay.

I'd try it myself, but I have no experience in anything other than following other people's instructions (PS, thanks to everyone who actually knows how to do this stuff and makes tutorials, you make the Android experience worthwhile). If this isn't just inanity on my part, and someone knows how they could try it, but doesn't want to try it on their phone (or doesn't have one), let me know and tell me how to do it, I'm willing to try.

Thanks to everyone for all the hard work!
[G2 and Desire Z Android Development] grankin01:
[/QUOTE]htc likes to give bootloader updates; it is just a matter of finding how ota are giving signals to the csd to enable write[/QUOTE]

This gives me an idea. IF an ota update surfaces before root is achieved on this device that may be fairly easy to figure out. If the ota is able to be downloaded through eth0 (wireless card) then we could set up a packet sniffer on a computer and have it log all the traffic between the g2 and ota server. Somewhere in that com link there would have to be a security bypass of some sorts to access the pertinent parts of the system and its hiding places within the device.

This should work, in theory anyway. At the very least it would give us some interesting info. ;)
[G2 and Desire Z Android Development] teferi:
no, that wouldn't get you anything. the protocol for OTA updates on android is for the system to download the update to /cache or /data or misc, write a command file for recovery telling it to flash it, and then reboot into recovery. the bootloader doesn't set the write-protect bit (which is probably per-power-on) when booting into recovery. recovery reads the command file (which has a very limited set of commands; see recovery.git in AOSP), verifies the update signature, applies the update, and reboots.
[G2 and Desire Z Android Development] grankin01:
teferi, good point. Sounded to easy anyway. :)
[G2 and Desire Z Android Development] grankin01:
Could we not pick something useful up from sniffing while it wrote the command file for reboot and maybe write our own based on that info to trick the system into "forgetting" the security checks and verifications. Or is it simply running a script to execute an already present file in the ota package?

Not a programmer just worked with comps for around 25 years.
[G2 and Desire Z Android Development] teferi:
no, again, the command file format is a) completely documented on AOSP and b) very limited. there's no secret handshake between system and recovery. system just gives recovery a path to an update file; recovery opens it and does the sig check itself.
[G2 and Desire Z Android Development] HamNCheese:
My guess is that reversing the mechanism that writes persistant data from the OTA to read-only partitions may give us some insight as to how *we* can defeat the write protection from userland.
[G2 and Desire Z Android Development] grankin01:
That's cool teferi. Just kinda trying to set a different jumping board for ideas up. :)
[G2 and Desire Z Android Development] osho741:
wow too bad this cant be as easy as a backdoor much like the ones that are used in BIOS when someone sets a password on it lol
[G2 and Desire Z Android Development] grankin01:
Kinda what I was getting at but I guess I was comparing them too much to computers.
[G2 and Desire Z Android Development] osho741:
ok this is probably a stupid idea mostly because i dont know much about programming but what about writing a piece of code that tries to brute force hack the signature with like some kind of rainbow table or something?
[G2 and Desire Z Android Development] bentglasstube:
I don't think any phone has the computing power to make that feasible.
[G2 and Desire Z Android Development] southeastbeast:
Even on a computer to crack stuff like wpa requires some major power a la cuda and/or distributed computer power.
[G2 and Desire Z Android Development] djdant:
Kinda O.T but I called T-Mo about my data issues and they're saying a OTA is gonna come a week after inital launch, not sure how true that is, but if that comes will that help you guys?
[G2 and Desire Z Android Development] :
You should build a gui interface in visual basic to track down the perps ip address.
[G2 and Desire Z Android Development] cumminbr:
Just a question, but why do we need permanent root? Since you already have the scripts and processes for a temporary root, why not just make a program that does it for you and have a 1-click temp root or have it run on startup?
[G2 and Desire Z Android Development] gee one:
Is there anything that is signed and flashable? I saw some rom dumps, but I didn't see how/where the sigs are included.
[G2 and Desire Z Android Development] philosophics:
I put my 8gb class 6 micro sdhc in before I even turned the device on for the first time so let's debunk that now.

Back on track, please...

This might not make any sense or have any purpose but maybe this could be an idea.

I wanted to install angrybirds but it wouldn't install. The same thing happened with neocore. I found this to be very confusing cause I saw others with these same apps installed on the same device.

I actually unmounted the sdcard and tried again to find that it worked. Remounted sdcard and everything was gravy.

Is there a possibilty that this ...idea... can/needs to be implemented?

Sent from my HTC Vision
[G2 and Desire Z Android Development] bled82:
question

i won a g2 from tmo and wondered if it was the same as every other one here is a screen shot of the about screen .
[G2 and Desire Z Android Development] philosophics:
Looks just like mine...

Sent from my HTC Vision
[G2 and Desire Z Android Development] smjfosho:
would flashing a custom recovery through clockwork when temporarily rooted help at all? when we have a custom recovery of course.
[G2 and Desire Z Android Development] bled82:
ok thanks was going just hoping there was some thing in the rom that might have helped i did not think it was .
[G2 and Desire Z Android Development] ChainsDD:
Has anyone considered the possibility of a system.img that's being unpacked on boot? The root filesystem on our phones is unpacked from boot.img every time the phone is booted which is why there's trouble with the SGS and people rooting it by placing the su binary in /sbin...

Back on topic, the root filesystem can be changed at runtime, but reboot, and it all goes away. That's what sounds like is going on with the G2, but I don't have one to mess with.
[G2 and Desire Z Android Development] flarbear:
Some people (particularly over in the T-Mobile forums) are quoting this post and pointing to the 4407296 number as being proof of a 4G chip and that this means it is somehow accessible to the kernel. I just wanted to clarify that that number is probably simply reporting the size of the mmcblk0 partition in 512-byte blocks since that number happens to be exactly double the number that /proc/partitions reports. Is that a fair assessment of these numbers?

In other words, the only confirmation we have of the 4GB part is the partial teardown that found it and these numbers are simply further ways to confirm that the system only sees 2.1-ish GB of it. Correct?
[G2 and Desire Z Android Development] thrice43:
Hey guys, a long time xda-lurker here. I wouldn't be surprised if somebody already took a look at this but just in case...

I found this in /system/etc/permissions/platform.xml

I'm guessing that if the user can log with an id that has rw access it can maybe make the root stick. I dunno, worth a shot.
[G2 and Desire Z Android Development] uta8111:
I'd like to obtain clarification on a couple of points. What exactly is being rewritten on boot? That is, will any changes to kernel-related files "stick" after booting using the current "temporary root" procedure, or are all such changes lost? Similarly, will user application programs that require root (Titanium Backup, etc.) function properly in temporary root mode?

Summary then, other than the ability to run cyanogenmod or other custom roms, what root-level functionalities are lost when temporary rather than permanent root is enabled?

Thanks.
[G2 and Desire Z Android Development] teferi:
Recap: *All* writes to /system (after you remount it rw after getting temporary root) are lost on reboot (and sometimes even sooner; I find that after twelve hours or so, something goes seriously funny with files I've written to /system after rooting and often end up rebooting) right now. This seriously inhibits our ability to do anything interesting with the device.
[G2 and Desire Z Android Development] thrice43:
I know that it's lost on reboot, but how does the system know what files to keep on reboot and what to delete, there has to be some kind of permission or tag that is set which allows the system to know that "oh okay, the user installed this application or program so it will not get deleted on reboot."
[G2 and Desire Z Android Development] funkeee:
If the bootloader initiates a recovery and rewrites, is it possible to determine the address blocks its looking for and spoof them from temproot or otherwise?

I did find this patent that refers to an MBR doing the dirty work. Perhaps it could be of some use, though details are sparse and I don't know much on the subject.

http://www.freepatentsonline.com/6691213.pdf

Edit: Thrice43, that is a beautiful xml file if I've ever seen one.

The groups INPUT and DIAG look quite promising.
[G2 and Desire Z Android Development] thrice43:
Thanks! Hopefully it can be of some help to anyone out there. I may not be a pro at these kinds of things but the more I mess with adb the better i get at it. I'm sure it'll do me good either way in the long run

Edit:

Once again, I'm not sure if this is useful or not but there's a zip file containing a key for ota updates in /system/etc/security/otacerts.zip. I know that this file is in every w/ android but maybe it can be used to flash a update.zip but once again I'm not sure
[G2 and Desire Z Android Development] rUsTyRuSs:
I don't know if this helps, and I'm sorry if I'm giving useless or known info, but I used temp root then deleted amazon mp3. Verified it was gone. Rebooted, and it was back as if never deleted. Tried with 2 more apps and had the same outcome. Something is definitely checking and reflashing any changes. I also put a custom notification ringtone in system/media/sounds/ notifications and that is gone too. I hope this helps.

Russ
[G2 and Desire Z Android Development] hah2110:
So this is what is going on? http://gizmodo.com/5656921/t+mobiles-g2-rootkit-will-reinstall-stock-android-after-a-jailbreak

This is nuts. We need Cyanogen and Modaco to get on this.
[G2 and Desire Z Android Development] lbcoder:
Is it certain that this protection is at the SPL/radio/MMC level and not at the BOOT level? Has anybody actually examined the contents of the boot partition for a nasty-script?
[G2 and Desire Z Android Development] paulobrien:
I've ordered a G2 (actually, it's in the air US->UK right now) so i'll look into this ASAP.

P
[G2 and Desire Z Android Development] hansalvato:
Yessss! paul is here hopefully we can get full root soon
[G2 and Desire Z Android Development] digikid:
If I temp root my g2, where is the boot script located? I know how to read it, just don't know where it is.
[G2 and Desire Z Android Development] pardsbane:
Does anyone have evidence that the main partition is actually being flashed? It sounds really unlikely to me.

More likely I think is the use of something like aufs or unionfs to store the modifications (deletes and additions of files) to a different partition. Then, when the phone is rebooted, the separate partition is wiped clean each time.

In other words, its not that the main file system is getting re-flashed each time, changes you make get applied to another area wish is reset on boot.

I wanted to post some links to aufs and unionfs, but I guess my account hasn't been moderated yet.

I forget how to tell at the commandline to see they are in use, but it would be worth a check.
[G2 and Desire Z Android Development] lbcoder:
Those would show up when listing the mounts. They're not.
[G2 and Desire Z Android Development] tubaking182:
Try the slide method from the slide forums
[G2 and Desire Z Android Development] vdub804:
try some nexus one rooting methods
[G2 and Desire Z Android Development] mejorguille:
Try the slide root method ( Eugene says it's only for 2e recovery devices but still):

http://xdaforums.com/showthread.php?t=702973

Also the root method for the Wildfire (software only):

http://xdaforums.com/showthread.php?t=757191
[G2 and Desire Z Android Development] sino8r:
I'll start trying some various methods tomorrow. Mine was SUPPOSED to arrive today but the UPS route is not practical at all. It was rescheduled for 9/30. Damn idiots! You should see how they reroute theses packages to places that are way out of the local delivery area. Ridiculous! Sorry, anyways... I'll try the slide methods (very familiar with those) and some newer Nexus ones plus whatever else I can find that is relatively new.

****! This is a 3e recovery not 2e... hmmm.... I doubt anything that's out there now will work. We may have to come up with a new method. Well, a new one that's based on an old one, of course, but it will need some revising. This might take longer than we thought, or hoped, lol!
[G2 and Desire Z Android Development] gariak:
No good on either method. I can't get adb recognized in recovery and SoftRoot doesn't seem to work. Also tried the SDX Epic 4G method.
[G2 and Desire Z Android Development] sino8r:
Nah, non htc wont work for sure... did you try all 3 slide methods? I think there were 2-3 by the end. Hmmm.... I wonder if any other device has recovery 3e. I bet the desire z does but it hasn't been rooted yet either. Maybe a colaboration is in order ;)
[G2 and Desire Z Android Development] gariak:
Wes's SimpleRoot didn't work because there's no adb in recovery, like before.

Oddly, the exploid method fails because the sqlite_stmt_journals directory is read only. not sure if that's fixable.
[G2 and Desire Z Android Development] gariak:
Or it doesn't actually exist on the G2. That makes more sense.
[G2 and Desire Z Android Development] tubaking182:
What about the other root method for the slide? The new way.

And btw I booted to bootloader and tried to apply the other posted stock rom and it passed sig varification, but didn't apply.
[G2 and Desire Z Android Development] shad0wfire:
unrevoked uses a sense exploit, won't work

odin is samsung only

adb work just fine on mbp w/osx (don't flame me bro)
[G2 and Desire Z Android Development] gariak:
Not sure what you mean by "new" method. I can't post links to what I have tried, but I tried all three methods in the slide post linked above.
[G2 and Desire Z Android Development] gariak:
ADB works just fine on my system too. The problem is that I can't get it to work in recovery mode. Seems like timing is a factor sometimes, so I'm continuing to try.
[G2 and Desire Z Android Development] tubaking182:
ok so the exploid method won't work, but would it be possible to keep sig on the PC10IMG.zip and spoof the build number and possibly add that directory?

the slide had a way of forcing r/w access to the system and it seemed to work pretty well, what if we spoofed the sig on that and then tried exploid.

i really am just pulling **** out of my ass to try to help before i have to return this phone
[G2 and Desire Z Android Development] mejorguille:
Try the Droid 2 method, it's just over a month old so it might not have been patched yet:

http://xdaforums.com/showthread.php?t=764950
[G2 and Desire Z Android Development] oldsk00lz:
"HTC honors the G1 by providing telnet server daemon with root access!"

ummmm... okay... just DREAMing.

What about a Flash exploit? Didn't they just patch up some security issues?

-oldsk00lz
[G2 and Desire Z Android Development] gariak:
The Droid2 method kills the adbd process somehow until next boot. Running the exploit makes the phone unavailable via adb.
[G2 and Desire Z Android Development] sino8r:
Tubaking, are you gonna get a G2 sometime or stick with the MTS? I like my slide but am really tired of a2sd and 2.2 is a bit buggy. Plus, the processor in this G2 rocks! And all that internel space will be nice to have. I really like the build quality of the G2 much better than the slide. I always wanted a nexus one but hated the lack of a qwerty kb. Now, we have one and it's new and improved! I just wanna help out as much as I can in developing this time. I have some experience in android and linux but not as knowledgable as I am in WM. We can't expect Cyanogen to do everything for us although it will be nice to have him on board. His roms make an excellent base. I'm just excited as hell! Plus, I think I took too much medicine for my headache, lol! My headaches gone and I'm hyper. First thing I want to work on (after root) is adding black bars like sense. I really don't like the plain white... sorry for the long post!
[G2 and Desire Z Android Development] gariak:
OK, got exploid executable to run by putting it in /data/local/tmp, but it still isn't giving me the password prompt. I give up for tonight. Feel free to leave other things to try for tomorrow. I'll hack my way through them.
[G2 and Desire Z Android Development] tubaking182:
if you were an ordinary everyday member i prolly would have decided tl;dr, lol jk, but seriously. i plan on getting the G2 but i currently only have access to one tonight and won't have access to it with a computer until i either get one for free, or i can afford one outright which wouldn't be possible until end of october, and even then i need to save for baby due in november.

i hope to be able to get the G2, but in using it i have already found things i don't like which may cause me to postpone buying it, but i am really tired of the slide, having no dev support on the slide is really starting to get to me. got the girl a vibrant a short while ago, and i would actually go back to G1 if i had one accessible. we will see what happens in the coming weeks.
[G2 and Desire Z Android Development] jordanjay29:
What things don't you like?
[G2 and Desire Z Android Development] spyz88:
We could really use Haykuro on this one. He could always solve problems like this. He's like superman.
[G2 and Desire Z Android Development] PlankLongBeard:
+1 On this... I just got the thing for the wife last night... then wake up to this ish, I'm like we gave up Verzion the Droidx cause of this non-sense. Well, I hope Modoco and Cyanogen get on this soon too... First the selling point of interchangeable roms from HTC, now we raped like the big red machine. Its cool tho, this is an HTC and development has that rule set straight. Its ours, not yours after we paid for it. :D
[G2 and Desire Z Android Development] Algernon:
That seems to be the case. This is from the data sheet for the iNAND:

and

http://omapworld.com/iNAND_e_MMC_4_41_IF_data_sheet_v1_0[1].pdf
[G2 and Desire Z Android Development] Algernon:
From the same SanDisk data sheet I mentioned above:
[G2 and Desire Z Android Development] lbcoder:
The boot *PARTITION* is what is needed, and recovery would be good as well. mmcblk0p22 is boot, p21 is recovery. Dumping both of those would be useful.

dd if=/dev/block/mmcblk0p21 of=/sdcard/recovery.img

dd if=/dev/block/mmcblk0p22 of=/sdcard/boot.img

There is also an interesting partition labelled as "devlog" at p28. Any luck and it might actually have a log of what's doing with the "restore" problem.

dd if=/dev/block/mmcblk0p28 of=/sdcard/devlog.img

(note: devlog *could* have sensitive information, but probably doesn't. Up to you whether you want to share it or not)
[G2 and Desire Z Android Development] lbcoder:
Keep that lecherous punk kid away from here! He never solved anything and led a LOT of people into a brick.
[G2 and Desire Z Android Development] paulobrien:
I've had a mooch through the boot image, nothing obvious there...

P