yashsingh1/xdaforums huggingface dataset:
[G2 and Desire Z Android Development] obra:
unlock techniques that don't work.

My G2 showed up this morning.

Mostly, this recapitulates earlier comments but might save a few of you a few minutes:

* rageagainstthecage does not work. ADB never comes back

* freenexus doesn't work

* Universal Androot (softroot only tried so far) does not work

* The device's adb support isn't online from within recovery mode

* fastboot oem unlock doesn't work
[G2 and Desire Z Android Development] theglock:
nice work obra
[G2 and Desire Z Android Development] dthadamaja:
Is there any chance that when ADB dies, the computer is just not recognizing the device? I've had instance where using my G1 when running the phone in fastboot mode or such that the computer was not recognizing it. I then had to reinstall usb drivers during that instance as well.
[G2 and Desire Z Android Development] dyndragon:
Negative, at least, I don't think so. When adb failed to recognize the device, I un/replugged, un/reinstalled drivers, restarted PC, etc etc. I also tried disabling and re-enabling USB debugging on the phone, but all to no avail. ADB would only come back after I power cycled the phone.
[G2 and Desire Z Android Development] uplinked:
Just got my G2 in the mail, can't wait to have it rooted. Never rooted an android device manually (used the gui apps in the past), but I'm a coder and I've been visiting XDA for years, very familiar with adb and such, is there anything I can do to help? Run some tests or something for you? I'd love to contribute to making this happen before launch day :)

EDIT -- posted this after reading page 1, did not realize there were 5 more pages
[G2 and Desire Z Android Development] sino8r:
I just got mine. Let me play with it for an hour or two and then I'll see if I can get adb to work. Are the drivers set up under device manager when you guys are try to connect to adb? what I mean is... is anything not recognized?

Have you guys tried the drivers for HTC (if there are any yet) or pdanet drivers? Just some ideas while I get my head together...
[G2 and Desire Z Android Development] tubaking182:
I ran into the same problems on as the rest on the root methods from devices past, with the new recovery they must have patched the holes, and in bootloader the phone is not seen on my comp(win7x64) didn't think to try ubuntu but I would guess same result(someone want to confirm?).

Other than that we may have to wait till the big boys drop in and help, we might have to spoof sig in bootloader and flash a rooted rom that way
[G2 and Desire Z Android Development] tubaking182:
The g2 was seen as offline while in recovery, not seen in bootloader/fastboot although phone knows when it's on usb in fastboot. And seen fine in the actual OS as being a device
[G2 and Desire Z Android Development] sino8r:
I wonder how that guy got the G2 rom to flash on his desire z? I guess the desire z has 3e recovery too...
[G2 and Desire Z Android Development] sino8r:
as long as it can see it in recovery... we should be good.
[G2 and Desire Z Android Development] tubaking182:
Since the build we have is flashed through bootloader it has HTC sig on it and so he was prolly able to flash because it has the sig and a higher build number, if we can get the shipped build from the desire z(signed by HTC) then we may be able to flash that over. New devices take too long to root, I was spoiled with the vibrant
[G2 and Desire Z Android Development] tubaking182:
Tried quite a few times to get seen as in recovery but it doesn't seem to want to work, it's funny because the phone claimed to be flashing the shipped build but nothing changed, and the hboot was different in the shipped rom vs what is on the build now. I will look into more ideas later tonight and try to come up with a way to turn s-off or get device in adb in recovery
[G2 and Desire Z Android Development] obra:
fastboot

I haven't seen mention on this thread yet of the OEM Fastboot commands on the G2:

astboot oem h

... INFOcommand list

INFOkeytest

INFOheap

INFOboot

INFOreset

INFOpowerdown

INFOrebootRUU

INFOheap_test

INFOrtask

INFOtask

INFOenableqxdm

INFOgencheckpt

INFOlist_partition_emmc

INFOload_emmc

INFOcheck_emmc

INFOcheck_emmc_mid

INFOread_emmc

INFOget_wp_info_emmc

INFOsend_wp_info_emmc

INFOget_ext_csd_emmc

INFOget_sector_info_emmc

OKAY

Some selected output:

root@puppy /tmp # fastboot oem get_sector_info_emmc

... INFOAvailable eMMC Sector = 4407295

OKAY

root@puppy /tmp # fastboot oem get_wp_info_emmc

... INFOeMMC write protection group size = 16384

OKAY

root@puppy /tmp # fastboot oem list_partition_emmc

... INFOindex, type, start, num

INFO0, 0x4D, 0x1, 0x3E8

INFO1, 0x45, 0x3E9, 0x80

INFO2, 0x46, 0x469, 0x2328

INFO3, 0x5, 0x2791, 0xFFD870

OKAY

root@puppy /tmp # fastboot oem send_wp_info_emmc

... INFOInvalid parameter

INFOcommand format: send_wp_info_emmc [wp_start] [CMD31?]

OKAY

So, it's far past time for me to get to sleep, but I have a sneaking suspicion that some of you might have fun with send_wp_info_emmc
[G2 and Desire Z Android Development] Eraknelo:
Has anyone got the chip model, and SanDisk customer support number? I can give it a try... I'm usually very good at talking people into such stuff :P Private phone numbers ftw.
[G2 and Desire Z Android Development] Bavilo:
SanDisk SDIN5C2-4G 0352S0S07A

North America Technical Support

1-866-SANDISK (726-3475)

8am - 7pm Pacific Standard Time

11am - 10pm Eastern Standard Time

CLOSED Saturdays and Sundays
[G2 and Desire Z Android Development] funkadesi:
I wouldn't expect TRs to know anything know much about nand flashes and overwrites.... but it doesnt hurt to try....

Whoever plans on calling must NOT portray themself as a "hacker" they need to be clear about themself and say that this is more of a "Project" for an engineering class? lol :p
[G2 and Desire Z Android Development] grennis:
So is there where the missing 2GB went?
[G2 and Desire Z Android Development] whywhy1:
Ok well i removed it then, sorry guys.
[G2 and Desire Z Android Development] ericmk84:
Old. Chris was just trolling.
[G2 and Desire Z Android Development] Algernon:
There's some really interesting stuff there. The get_ and send_wp_info commands seem to relate to these commands from the CSD register:

[Parameter] [CSD Slice] [Description] [Value] [Width]

WP_GRP_SIZE [36:32] Write protect group size 11111b 5

WP_GRP_ENABLE [31:31] Write protect group enable 1b 1

I wonder what would happen if you set CMD31 to 0 (the answer could very well be "make your phone a paperweight").

The output from get_ext_csd_emmc would be interesting to see as well. There's a lot of (possibly useful) info in the EXT CSD register. I still think that
[G2 and Desire Z Android Development] digikid:
someone already called:

http://xdaforums.com/showpost.php?p=8492671&postcount=514

Also, someone posted the boot.img and recovery.img from the g2. ;)
[G2 and Desire Z Android Development] lbcoder:
You know what people? You need to THINK before posting stupid crap like this. NOBODY SUGGESTED THAT ANYTHING MEANT THAT ROOTING WAS IMPOSSIBLE!!!!
[G2 and Desire Z Android Development] lbcoder:
Right. Nobody has pointed that out because it is NOT CORRECT. The nand *IS* being written to. IN A DIFFERENT PLACE THAN YOU WANT!!!!
[G2 and Desire Z Android Development] lbcoder:
NOTHING IS REWRITING ANYTHING!!!!

Your ROOT WRITES are just going somewhere else!!!!
[G2 and Desire Z Android Development] digikid:
This might be a stupid question, but i'm trying to get my head around this....

When you install a program to the phone (not the sd card), it's also writing system files, is it not? So how is it the programs are still there, and workable, when rebooting?
[G2 and Desire Z Android Development] lbcoder:
How many times do I have to spell it out?

Nothing is being read only at boot time. Nothing is being copied. The data you see is what is really there on the nand. IT IS WRITE PROTECTED, and writes are REDIRECTED to a secondary location so that you can still read them!
[G2 and Desire Z Android Development] ace42588:
were jtag points ever confirmed on the board? a total nand dump would be nice
[G2 and Desire Z Android Development] lbcoder:
Ding ding ding ding ding!!! :eek:
[G2 and Desire Z Android Development] ace42588:
digikid, apps are getting installed to /data, which is not protected
[G2 and Desire Z Android Development] lbcoder:
No it isn't. There are very few references to rmt_storage. Most are about the htc vision, the others are with respect to other hardware with similar problems.
[G2 and Desire Z Android Development] lbcoder:
That is precisely HOW we are looking at it. The problem is that all the dummies keep on reading the "technical articles" (all of which are written by morons who can barely turn on their iJunk) and coming back with the nonsense, spamming this thread.
[G2 and Desire Z Android Development] lbcoder:
... more like a few CENTURIES...
[G2 and Desire Z Android Development] biosehnsucht:
Some of these may be useful in unlocking the flash.

What does "fastboot oem get_ext_csd_emmc" output?

That will help determine what if any write protections are enabled at the emmc level.

edit: *facepalm* That's what I get for not refreshing the thread before posting, Algernon said the same thing about get_ext_csd_emmc pretty much. I spent the last hour + going through the emmc spec and emmc device (flash chip) docs, trying to see what could be gleaned from the output already provided. And getting distracted. lol

edit2: how do you put the G2 into fastboot? I don't have one yet, but I keep googling and just getting all this stupid stuff about the "fast boot" feature of the desire z ... sigh
[G2 and Desire Z Android Development] igashu:
I know these are the interwebs, but would it be possible to make a concerted effort to keep this thread relevant and under control by limiting the (quite frankly, unbelievable) number of new posts that all follow the format:

I know that everybody is anxious for a quick solution (myself included), and I say this not to be a jerk, but to try to prevent this thread from continuing on its current heading toward becoming a 300+ page monstrosity, obscuring any useful information that might actually be contained therein.
[G2 and Desire Z Android Development] lbcoder:
No, YOU have it backwards. Jtag is the tool that lets you talk to the 747's computer to ASK it why it isn't working and tell it to work!
[G2 and Desire Z Android Development] Disconn3ct:
They aren't going to a remote location - they are being cached, likely by the modem processor. (Take a look at http://google.com/codesearch/p?hl=en#9jNWu_T77aQ/Documentation/arm/msm/rmt_storage_client.txt)

If they were being written, they would persist during a session/until reboot. It is trivial to show that does not happen - cat /dev/zero > /system/zero and before it fills the partition, you will have pushed out all your other /system changes. (And linux will start throwing ext3 errors)
[G2 and Desire Z Android Development] lbcoder:
As I tried to point out... if you have write access to the MISC partition (you do), and write access to the CACHE partition (you do), then you can trigger an SPL UPDATE that bypasses update.zip signature check!

So if you have an ENGINEERING SPL, which somebody said they did, then you CAN WRITE IT using this trick.
[G2 and Desire Z Android Development] bluebl:
What if? (SSD HW)

What if the internal SanDisk SSD Controller has the following properties:

1. Always exposes a certain partition as read only (HW RO for anything outside the chip).

2. Has a hidden, completely non accessible, flash area of the same size as above, used mainly for updated image of that partition.

3. Has an internal bit specifying which of the above is exposed (ro) and which is inaccessible from the outside (even using jtag), over identical external address range.

4. Toggles this bit following a valid cryptographic check of inserted new image.

5. Is extremely low on internal RAM, therefore required to use a symmetric key (hidden on flash, inaccessible from outside the chip) rather than PKI, and calculate the hash on the fly as the new image is being read into the hidden area using dedicated protocol.

If the above is true, the following is probably correct:

1. To defeat this system one would have to find a bug at the SSD Firmware.

or:

2. Gain access to said symmetric key and reverse engineer the verification procedure.

and:

3. Cannot defeat it by reverse engineering the SSD HW protocol or by replacing the Android kernel as it's NOT security by obscurity.

Also, if the above is true, the overlay file system might either be controlled by the Android kernel, or might be another feature of this SSD. On Either case, wiping it only requires wiping the index ("FAT" area or equivalent), or resetting the index, or even nothing at all if the index is exclusively at the kernel's RAM, zeroed upon reboot.

Also, might be unrelated, I recall that one well established hash mechanism was partially defeated not by cracking the key, but rather by adding some (not extremely large amount of) data at the end of the block to achieve any specific required hash signature.

Just a thought...
[G2 and Desire Z Android Development] nolsen311:
What do you base this point of view on?

#teamdouche is (of course) interested in rooting the G2, at least a few of them are T-Mobile subscribers and would be interested in the official successor to the G1, as many of us are.

If you follow their twitter, or check the IRC channel occasionally you'll see what I'm talking about...just because they haven't taken out full-page ads declaring their intentions doesn't mean that there's a lack of interest.

[please don't take this as a full-on attack, I'm just trying to point out how silly a lot of the cliques are getting to be]
[G2 and Desire Z Android Development] ace42588:
its not a ssd, its plain'ol nand. hardware presents the nand as mmc. there isnt really ssd firmware per se. okham's razor and the laws of manufacturing suggest that might be a bit too complicated. if your right though, i'll give you a cookie

is there a precedent of emmc's that block certain areas from jtag? if thats the case, a more intense hardware attack could be done by sniffing the bus lines for the emmc
[G2 and Desire Z Android Development] lbcoder:
Nice stuff.....
[G2 and Desire Z Android Development] lbcoder:
It isn't to the system partition. It is to the userdata partition, which is not cursed.
[G2 and Desire Z Android Development] InGeNeTiCs:
I know what jtag is, but how many android devices have been unlocked/modified via jtag compared to using previous methods. I'm not saying it won't work, I'm just saying it seems more logical to fully explore tried and true methods before moving onto something else.
[G2 and Desire Z Android Development] ace42588:
honestly, jtag is more tried and true by just about every other embedded device, it just so happens we have exploitable software, negating the need to crack open the device. most people see that as a daunting task
[G2 and Desire Z Android Development] bluebl:
I was using the term SSD as a placeholder for this system of a chip, which my be more complex than some might think. Wear-leveling alone already requires non-negligible algorithmic and processing capabilities. Given the money payed for it, it might be worth adding said ro/updating capabilities, though it's hard considering the extremely limited (since expensive) ARM controller RAM, hence the possible trade-off of symmetric key...
[G2 and Desire Z Android Development] lbcoder:
They ***DO*** persist until you reboot. That is why root only dies WHEN YOU REBOOT!

And the only error you'll get by writing a file to a filesystem is INSUFFICIENT SPACE!!! Which it WILL do! There won't be any kind of crashing, and the FACT that there is no crashing PROVES that it isn't a volatile cache! A volatile cache will EITHER eat up your RAM (doesn't), or eventually FILL UP AND CRASH (doesn't).

If you want to CRASH the thing (and prove that you haven't thought this through), try "dd if=/dev/zero of=/dev/block/mmcblk0p25". That'll definitely crash it because this WILL wipe the system partition (rather than just filling up the available space like your experiment that didn't prove anything).
[G2 and Desire Z Android Development] ace42588:
suppose it was non-negligible processing, its still designed for that specific algorithm and its industry standard. the emmc was purchased in bulk; its possible that htc had it custom manufactured just for them, but again, it seems unlikely.

not trying to harsh your groove, but i disagree with your suggestion
[G2 and Desire Z Android Development] chaoticaffinity:
The JEDEC spec for EMMC has some interesting things to say about CMD31

CMD30 adtc [31:0] write protect

data address

R1 SEND_WRITE_PRO

T

If the card provides write protection fea-

tures, this command asks the card to send the

status of the write protection bits.

Note 2

CMD31 adtc [31:0] write protect

data address

R1 SEND_WRITE_PROT_TYPE

This command sends the type of write pro-

tection that is set for the different write pro-

tection groups.

Note 3

NOTE 2. 32 write protection bits (representing 32 write protect groups starting at the specified address) followed by 16 CRC

bits are transferred in a payload format via the data lines. The last (least significant) bit of the protection bits

corresponds to the first addressed group. If the addresses of the last groups are outside the valid range, then the

corresponding write protection bits shall be set to zero.

NOTE 3. 64 write protection bits (representing 32 write protect groups starting at the specified address) followed by 16 CRC

bits are transferred in a payload format via the data lines. Each set of two protection bits shows the type of protection

set for each of the write protection groups. The definition of the different bit settings are shown below. The last (least

significant) two bits of the protection bits correspond to the first addressed group. If the addresses of the last groups

are outside the valid range, then the corresponding write protection bits shall be set to zero.

“00” Write protection group not protected

“01” Write protection group is protected by temporary write protection

“10” Write protection group is protected by power-on write protection

“11” Write protection group is protected by permanent write protection

Table 25 — Block-oriented write protection commands (class 6) (continued)

CMD

INDEX Type Argument Resp Abbreviation Command Description

But I think we need a way of implementing CMD 29

CMD29 ac [31:0] data address

1 R1b CLR_WRITE_PROT If the card provides write protection fea-

tures, this command clears the write protec-

tion bit of the addressed group.
[G2 and Desire Z Android Development] lbcoder:
Do you know what SSD means? Solid State Disk. And keep this in mind; it isn't just "plain old nand", its MMC. It most definitely *DOES* qualify as an SSD. Just rather than SATA or SAS, its an MMC SSD. Its still an SSD.
[G2 and Desire Z Android Development] cmstlist:
Deep breaths, deeeeep breaths.

If you read through this thread (granted, not an easy task) you'll see reports that after the phone has been on for some time, some users are seeing some changes to the system partition during temp root start to revert in unpredictable ways. It seems that a reboot is not the only trigger for reset of the system partition.

So no, the changes don't necessarily persist all the way until a new reboot. A reboot always results in a full reversion, but some conditions may lead to partial or full reversion without even needing to reboot the phone.
[G2 and Desire Z Android Development] Disconn3ct:
..er, "only" is INCORRECT.

...yes, yes it does. Try it.

Try it. Or read the rest of the thread, where people have said things like "after reboot or about 12 hours". (Hint: we tried it last night.

# yes > yes.txt

yes: No space left on device

# grep -r mmc .

grep: I/O error

..because the earlier writes are -gone- and linux wasn't expecting that.)
[G2 and Desire Z Android Development] bluebl:
No offense taken. Let's just say that I know for a fact that technology very(!) similar to the one I suggested exists for some years now in more than few SanDisk products that retail at less than 1/10 the price of the G2. Open your mind.
[G2 and Desire Z Android Development] lbcoder:
12 hours? So you're looking at a time delay force wipe of the temporary space. That doesn't change anything. Fact is you can write 100 MB, and read it back and its still there without consuming RAM, and you don't have that large of a cache.
[G2 and Desire Z Android Development] Disconn3ct:
The test I quoted was not 12 hours. It was minutes. (The earlier poster on the thread said "about 12 hours".) Either contribute - by testing it yourself - or stop talking about it. You're determined to keep your pet theory, but it doesn't match verified (and verifiable) behavior. Move on.
[G2 and Desire Z Android Development] grankin01:
Calm down bub. I meant if we could stop the constant writes by the system to "correct root" it would cut down on the amount of writes total that the nand sees thereby making the nand physically last longer. One incentive for root and stability/integrity.

I agree that a lot of these posts have been useless and repetitive but you have made almost as many posts flaming people as you have useful ones. Get over yourself and stay on topic. Remember its your blood pressure not ours.
[G2 and Desire Z Android Development] Disconn3ct:
I had a thought - this overlay/cache mess doesn't exist to stop hackers. The emmc write protect does that just fine. So what problem are they solving using r/w ext3 instead of a r/o ext2 (or whatever else..)?

That lead to 2 tests we should run. (And I'll get them going on mine when it finally shows up.. 'out for delivery' whee.) The first is simple - save busybox somewhere you can run it (NOT on system if possible). Create a file on /system with known content (the quick brown fox or whatever.) Then dd if=/dev/zero of=/system/zero bs=1M count=1. Check the known file content. Repeat until the first file becomes gibberish. Count up the number of runs, and you have (very roughly) the cache size.. (hmm. It is data=ordered, so maybe that gives you 1/2 cache size since it gets written to journal, then to fs..?)

The other test is a little more involved - without saving anything extra to /system (unnecessarily), use inotify to see what the system is changing. There has to be a reason it is rw and overlaid, seeing what files are being altered should help to answer that..
[G2 and Desire Z Android Development] GrkEngineer:
Enhanced Write Protection

Not sure if anyone saw this other post. Sorry if I missed it earlier in the thread. Perhaps the write protection we're seeing is the "power-on" version. The below text states that portions may be permanently or power-on or temporarily write protected. Not sure if this info combined with the CSD fastboot commands could lead to something.

http://xdaforums.com/showpost.php?p=8457966&postcount=6

From the whitepaper for SanDisk SDIN5C2-4G 0352S0S07A.

2.9. Enhanced Write Protection

To allow the host to protect data against erase or write, the iNAND supports two levels of write protect command10:

• The entire iNAND (including the Boot Area Partitions, General Purpose Area Partition, and User/Enhanced User Data Area Partition) may be write-protected by setting the permanent or temporary write protect bits in the CSD.

• Specific segments of the iNAND may be permanently, power-on or temporarily write protected. Segment size can be programmed via the EXT_CSD register.

For additional information please refer JESD84-A441 standard.
[G2 and Desire Z Android Development] krayshunist:
Your idea of angle of attack is therefore to write a flasher that authenticates with the SSD by generating the correct hash signature and writing a recovery with the same ability as the flasher, reboot into the recovery, turn off the write protection entirely, and flash our rooted system image.