yashsingh1/xdaforums huggingface dataset:
[G2 and Desire Z Android Development] gee one:
Do we have anything that is signed with the release key?

Also, how much do we know about how they are signed? SHA-1? MD5?
[G2 and Desire Z Android Development] alansj:
I'm guessing that it just means that the build was signed with the release keys.

The actual release keys are probably 2048 bit RSA:

http://pdk.android.com/online-pdk/guide/release_keys.html
[G2 and Desire Z Android Development] fastludeh22:
its been years since id did an ota (rc-33, lol). from what i remember it dl's to a cache partation. then reboots into recovery and applies it. which brings me to my thought.

we suspect that this is a software issue right now, right.

we know that recovery has its own kernel, and i think its own partation.

so if we have temp root, why not flash a custom recovery from root shell in terminal, then reboot recovery and flash our test signed rom. thoughts?

sounds to simple to work, thats why it should ;)

id be willing to try if the recovery is made by one of the big two, ie amon_ra or clockwork (koush i think)
[G2 and Desire Z Android Development] aacrabtree:
I haven't heard if either of them are working on making a recovery for it yet. Will it (probably) brick my phone if I try to use a recovery from a different phone? Because I was thinking that something similar to this could work as well.
[G2 and Desire Z Android Development] KiNG OMaR:
partition*

But thats a good idea... Worth a try!
[G2 and Desire Z Android Development] fastludeh22:
do NOT flash one from a differnt phone. best case it will still boot the os with no chance of recovery if u screw anything else up. or worse tmo sends an ota out and it bricks trying to enter recovery... (pure speculation)
[G2 and Desire Z Android Development] dcman008:
Recoveries are in the works, look a few (~10) pages back.

As of right now we still can't write to the recovery partition.

Flashing a recovery not built for your phone will for sure kill your recovery and most likely your phone.(if it stuck)
[G2 and Desire Z Android Development] HamNCheese:
a) it's been tried with Desire-Z roms

b) the signatures are not interchangable

c) the bootloader checks the version

d) you cannot revert to earlier versions (even with correct signature and model)
[G2 and Desire Z Android Development] aacrabtree:
Damn, that's what I was afraid of. If I had even the slightest idea how to write a recovery image, I'd do it, but I have more of an inkling how to build a functional interstellar spaceship than I do for writing a recovery image. This is why I really want to learn more about all of this stuff. I know enough that I can generally flash ROMs and recoveries and all that jazz without needing a guide (except in the cases where they're way weird), but beyond that, I don't know much. Really wish I could contribute more :S
[G2 and Desire Z Android Development] pconwell:
Not impossible, but I would be surprised if it was that easy.

For the other phones (Dream, Nexus) yes, but not for the Vision - at least not as far as I know. RSA seems to be the going theory for the signature encryption. I would speculate that each device uses a different key, so cracking the dream key, for example, probably wouldn't help us. But, we could atleast start practicing cracking the dream key so we know what we are working with when the time comes.

EDIT: I have never really paid attention to the signature encryption because it never came up, but it should be pretty easy to know what we are working with because I would *think* that the encryption is the same whenever you sign your own .zips (the directions are all over the internet). So, if we already have the java used to sign, we should be able to figure it out pretty easily. Next, we would just need everybody to start brute forcing the hash until someone gets the key. I can look at it more when I get home.
[G2 and Desire Z Android Development] digikid:
I got the images. How do I open the devlog img to see if it has sensitive info? I hope this is a good first time contribution! :D
[G2 and Desire Z Android Development] kingklick:
treat the recovery.img like a boot.img to open it

EDIT: posting it now
[G2 and Desire Z Android Development] digikid:
that doesn't tell me much. :/
[G2 and Desire Z Android Development] kingklick:
here, I unpacked the recovery.img for you

The unpacked recovery files are in this folder uploaded here

And the Recovery's kernel is uploaded here
[G2 and Desire Z Android Development] digikid:
thank you, but someone requested the devlog as well, but said there might be sensitive info in it. I want to check before posting...how do I do so?
[G2 and Desire Z Android Development] Dalamak:
If you need a donation for the cause , I'm always willing to throw a few sheckles in the kitty
[G2 and Desire Z Android Development] jfwfreo:
I dont know that much about the G2 specifically (nor do I have one) but I do know a bit about computer security, linux and mobile phone stuff in general. I read the entire thread and I have some points/questions/ideas to add:

Assuming HTC got the security right (and there is no reason to suspect that a company thats been in this space as long as HTC has doesnt know how to implement security) there is no point in attacking the signatures or the secret HTC signing keys.

Unless someone invents a working Quantum Computer, cracking RSA is impossible.

Has someone taken their G2, booted it up normally (no root), dumped the dmesg/kernel logs, rooted the phone, changed /system, rebooted, dumped the dmesg/kernel logs again and compared the 2 logs?

Has anyone done a dump of every partition on the flash (i.e. /dev/block/mmcblk*) via dd or similar, modified /system, then redumped the partitions and compared the results?

There are 4 possibilities for where the data goes:

1.real /system location on the flash (which is restored to stock on startup)

2.another place on the flash via a redirect in the kernel (which is then blown away on startup)

3.non-persistant storage (which if its not implemented as a regular ramdisk wouldnt show up in the mount points list)

or 4.Storage on the flash that is blown away by the flash on startup (i.e. a special "write this to this logical block on the flash but on startup, replace it with the original physical block" feature)

If a compare of the flash before and after a change is carried out and the system partition has changed, that means its either #1 or #4. If its #1, you just need to find the code (which may be in the bootloader) that restores /system. If its #4, it should be possible to find the kernel code thats doing it and patch it in memory to use the normal "write to flash" command and not "write to flash but throw it away on next reboot" command.

If a compare shows that something other than the one mounted as /system has changed, that indicates that its likely #2 and you can find the code that blows the contents of that partiton away (which may be in the bootloader) or you can try and find the kernel code responsible for the redirect.

If a compare shows that none of the flash blocks have changed, that means its either #3 or its #2 but writing to a piece of flash other than something that appears as a /dev/block/mmcblk* device. If its writing to Flash, you can find out what code is blowing that data away. And whether its writing to Flash or RAM, you can find the kernel redirect code responsible.
[G2 and Desire Z Android Development] philosophics:
This might sound really stupid and/or obscure...

My uptime is a few minutes under 2hrs. I did the temp root method right away. I really don't know why I wanted to go to the terminal emulator about 3 minutes ago, but I did (I think it was cause my device seems slower and I wanted to run fix_permissions (hahaha)

Really trying to replicate the steps cause I can't remember what went on due to a dog freaking out in my house so my attention was diverted but I ended up running the root.sh again. It tells me that superuser.apk does not exist.

Is the device rewriting on the fly?

Sent from my HTC Vision
[G2 and Desire Z Android Development] digikid:
So what are these keys for? Are these the auth keys?

{64,0x577ec62d,{2810480219,4186700531,1823894669,2513715705,4153867336,4124551093,3129515677,2423126444,1781150696,2626008457,666670741,487309695,452404508,69624420,1316235642,2324922162,833543125,1215385165,3372099962,3392031474,1557537309,676619178,3201704614,528591289,6636213,1565812340,4220322031,3818493582,280674000,3303391626,2027870923,2236731252,3583918027,223739661,2940945476,2875594439,4062898694,2719442315,699753649,2013973976,2192335685,338301009,1140659958,1930251392,739378298,1263065537,2876129587,2960471289,4088074100,3505897398,2279484127,2373586314,862620422,1423129534,3673377403,1098824445,3116678852,1855595493,1089532439,3309632765,735920552,406848061,805618841,3497897263},{2585754692,195335701,2166818278,1038531236,3523992022,633207686,1843127831,1043036066,2156835674,2285260634,3721982830,2409669584,364481167,1664325216,1113263783,1792486156,3603524720,1991870620,3839172335,314705227,504805020,3009026600,2032050404,3496758153,2417001679,3905307430,3517119248,752226784,3624656964,1837918048,3453507000,3981064523,1261770351,2072553380,347409120,3597376432,1487334618,1957761398,1470799389,3406373216,215943239,696691580,2701633035,3473465463,4080399987,888806354,2025071076,2767518901,1984822690,2416090920,3211505736,143174032,1769962666,4073745216,1796631148,1071469780,897189869,1969070504,255995517,157881639,3922465600,199760667,4150807092,329092552}}
[G2 and Desire Z Android Development] southeastbeast:
Temp root does not add superuser.apk which is why it was included in the rar file that contained rageagainstthesomething. U would have to mount the partition for rw then add superuser.apk to the appropriate location.
[G2 and Desire Z Android Development] philosophics:
But the temp root has worked with no problems up until now.

That was the first time I saw the error when executing sh /data/local/tmp/root.sh

And I have (like many) have gone through the temp root steps plenty of times by now...

Besides, superuser.apk should be in /data/local/tmp like the other files if steps were followed correctly for temp root.

I'll move this topic to the temp root thread now....

Sent from my HTC Vision
[G2 and Desire Z Android Development] pconwell:
Well, I'm not sure if it applies here (I'm not a lawyer), but US law only allows a maximum of a 512 bit key encryption to be exported from the country. However, it seems that the images used in the US are different from those overseas, so it might or might not apply.

My point being, depending on how the law applies, the release-keys could have a 512 bit encryption, which should be much easier to crack that 2,048 bit.

(Also, I could be wrong, but I think RSA RC5 has a MAX of 2k bit).
[G2 and Desire Z Android Development] grankin01:
Is there anything comparable to gparted for android that we could run after temp rooting to gain access/change partitions?
[G2 and Desire Z Android Development] Jrbourque:
When I had g1 and mytouch and did a lot of ext on sd there was gparted built into a recovery

Sent From My iPhone Eating G2
[G2 and Desire Z Android Development] grankin01:
Unfortunately in this case we would need a standalone version of gparted.
[G2 and Desire Z Android Development] PsychoI3oy:
koush asplained that the recovery.img in out/target/product/vision on a CM build is indeed clockworkmod recovery for the device.

so here it is.

(again, untested, unsupported, etc.)
[G2 and Desire Z Android Development] kingklick:
very cool

SO HYPTHETICALLY SPEAKING:

One would flash this recovery using the flash_image binary? ;) ;)

assuming it can not be flashed in rom manager just yet
[G2 and Desire Z Android Development] PsychoI3oy:
knock yourself out
[G2 and Desire Z Android Development] pconwell:
I'm pretty sure this is the first thing that was tried. Give it a shot and let us know.
[G2 and Desire Z Android Development] ctso:
missed you at the BBQ, if you can get it to flash using flash_image, i'll buy you a beer. But you won't. :(
[G2 and Desire Z Android Development] sino8r:
So if the recovery works (flashes okay), all we need is a proper eng. Build to flash and then a moddified stock image with busybox/su built in, right?
[G2 and Desire Z Android Development] pconwell:
Well, time will tell, but my understanding is that if recovery works, all we would need is a working rom.

BUT recovery is almost def not going to work this way.
[G2 and Desire Z Android Development] pconwell:
twitter update:

Chris Soyars

We're not going to disclose anything until it is rooted, got our best hardware man on it (@jeagoss).

1 minute ago

Chris Soyars

Breaking G2 News: We understand the gibson, time for some JTAG action.

7 minutes ago
[G2 and Desire Z Android Development] Superfrag:
http://twitter.com/#!/ChrisSoyars/status/26620254630

http://twitter.com/#!/ChrisSoyars/status/26620175432

I hope he's not trollin' :P
[G2 and Desire Z Android Development] Aphotix:
I'm hoping he already got the trolling out of his system
[G2 and Desire Z Android Development] funkeee:
@jfwfreo

Post temproot boot time is almost the same as regular boot. If it was doing a large rewrite it would take longer. #2 seems likelier. Has anyone posted bootlogs to compare?

Regarding the gparted comment, I suspect we would have to bypass the bootloader and boot straight into gparted.

Can we spoof an ota update? Maybe add some dependencies to prevent the boot loader from deleting things? Or perhaps we can replicate this partition on the sd and use some symbolic links to trick the boot loader or kernel into doing its dirty work on the sd where we can spy?

What about this patent for accessing a protected partition by spoofing addresses? I posted it before but I don't know if anyone got a look.

http://www.freepatentsonline.com/6691213.pdf
[G2 and Desire Z Android Development] InGeNeTiCs:
So let me get this straight...there isn't a method of sustaining root after a reboot, but this person claims to be accessing the system via jtag? This seems either backwards, or bs.

Isn't attacking this issue via jtag sorta like taking apart a 747 with a screwdriver?
[G2 and Desire Z Android Development] philosophics:
It would be really funny imo, if team douche not only rooted but threw a stable CM6 ROM on the G2 within a week after initial release of device. And to top it off, the stable release they put out for it would be 6.1

This could be a possability due to another possability of them having intimate time with one another (DON'T take that the wrong way) and the device during the android bbq...

(This is a CM addict's dream)

Is this what's really going down?

If so, I might as well ban myself now for what I would say (No, not really)

Anyways, back to the topic at hand...

Sent from my HTC Vision
[G2 and Desire Z Android Development] sino8r:
I have to be honest here... I don't understand half of your posts. What does team douche have to do with rooting? They work on cm roms no root or recovery besides eugene and cr who helped root the mts. But they don't even have the g2 nor have shown much interest in rooting it, which is unfortunate but whatever. You need to stop talking out of your ass. I've seen you post stuff like let's get back on topic but at the same time, you spout off nonsense. Please take your own advice. Not trying to start stuff but its kind of hypocritical.
[G2 and Desire Z Android Development] Jrbourque:
But he's right multiple people from team douche are working on root for g2 ..soooo yeah lol ...but ur right about the topic thing for sure

Sent From My iPhone Eating G2
[G2 and Desire Z Android Development] philosophics:
No worries. Text is misinturpreted a lot in society today. I'm not talking out of my ass, I was being hypothetical and they do have interest or thay wouldn't be trying to get CM on it (just sayin) They all talk to one another to solve problems so, in theory, why would this be any different?

It was kinda sorta on topic with the thread but at the same time digressing, I do apologize but there are others who do the same. Yes, I do ask to stay on topic but 5 posts later...

Really not trying to start anything here. The questions I ask, to me, are viable. I have run into some weird things with terminal emulator so I asked to see if maybe it would spark an idea.

Again, tryin to stay on topic here. Maybe its best to stay on the sidelines because I don't have anything to give in the matter, but don't put up a post stating that you agree with that idea either...

I'm only tryin to get a better understanding about the device, I'm not a noob without knowledge of a search tool...

Please don't take that as I'm being an ass. Like said before, I really don't mean tobe a nag about it or sound like either...

Sent from my HTC Vision
[G2 and Desire Z Android Development] kludgineer:
You missed his follow up to his first post. He corrected it to say that they have root, but won't say more until it is nand unlocked.

See: http://twitter.com/#!/ChrisSoyars/status/26620254630
[G2 and Desire Z Android Development] sino8r:
Well, we have root too. So what? What. In the world is he talking about, I wonder?
[G2 and Desire Z Android Development] Jrbourque:
Paul is waiting on his g2 ,and I'm hoping its not jtag,sucks cause g2 will go back next Friday if its jtag and will have to get a vibrant...which I would rather keep g2 and I thought recovery was tried already but gets wiped?

Sent From My iPhone Eating G2
[G2 and Desire Z Android Development] pconwell:
Maybe I don't know as much as I think, but I don't really see the risk I guess. Worst case scenario, you cannot access recovery, but that should be fixable by flashing the stock recovery back. I mean, flashing a 'broken' recovery shouldn't affect the /system any.

This is all assuming you can even flash a custom recovery in the first place.
[G2 and Desire Z Android Development] obra:
I know this is hopelessly naive:

Writes to /cache are persistent across reboots.

Like any well-behaved android device, recovery mode reads and acts on /cache/recovery/command

Are there previously-known exploits that abuse /cache/recovery/command?
[G2 and Desire Z Android Development] pconwell:
Well, I was referencing the flash_image script from ADB. So, if you can use f_i to 'break' recovery, you should be able to use f_i to fix recovery. ADB doesn't care about /recovery, so it shouldn't matter if you break it or not as long as the phone still boots - which is should even with a broken recovery. That's assuming f_i will even work the way we want it to in this situation.
[G2 and Desire Z Android Development] Ryanmo5:
Everyone needs to stay on topic and stop posting nonsense. Read the first post, this isn't for general chit chat.
[G2 and Desire Z Android Development] kludgineer:
oops... deleted duplicate post.
[G2 and Desire Z Android Development] damnoregonian:
can't break recovery.

can't break anything.

writes never commit to the protected sections of the emmc. this can be verified by dd'ing all the garbage you want all over them, rebooting into hboot and doing an image crc. they never change. you will also notice that if you try to splat garbage (i used /dev/random) all over recovery, the write speed will be dismally slow. every single write is failing, and htc is squelching that error. very naughty.

the part that is so spectacular about this, is the shadowing going on.

typical failure mode for a block device having failed a write is to read back the old or corrupt information, not the new information. i suspect we will see some devilry in the mmc kernel code when htc releases it.

until someone can try interfacing with the emmc chip directly and disable write protection, the only vectors for attack are through recovery's cache communication mechanism and perhaps some sort of signature verification flaw in the bootloader.
[G2 and Desire Z Android Development] The_Forastero:
Hi guys. This might be A BIT off subject here or maybe not, depending how you see it. I've known this forum since you guys rooted the G1. I was one of those who pre-ordered it. You guys are amazing! Now, again you're doing your stuff and this is awesome.

Like I said, this might be off a bit because this may or may not be helping the project directly. However, I'd like to offer the little I can contribute. You guys can upload whatever files you need to exchange to my humble small site files.foraster.us I made it aimed at serving a small gaming community I used to belong to. Some sort of rapidshare or megaupload so to speak, but with one thing in mind: simplicity. Specially for those who have never used a file sharing site or even those who have, but don't have a premium account and have to wait the annoying min or so. It does have a delay of only 3 secs, but it's only for security reasons. Now, I'm personally inviting all of you to use it as you need it. I really want to contribute to this somehow. May the G2 be rooted soon.

files.foraster.us

Yours truly,

The_Forastero
[G2 and Desire Z Android Development] tubaking182:
it's really just me being picky, i seem to always want the phone to do everything, but i want it smaller. i want all the features of the big boys, and a keyboard, and awesome speed, and tethering, but i don't want a huge ass screen, i thought 3.7 would be the perfect size, but i find myself readjusting the phone in my hand to reach the far edges of the screen, the mytouch slide doesn't require me to adjust.

and the keyboard will take some getting used to, but i know that's me being picky because i hated the mytouch slide keyboard when i first got it, first thing i did was remapped a few keys to match what i was used to on the G1.

not really sure i like capacitive buttons, i much prefer actual buttons for the same reason i need a kb, i like the tactile feel of the buttons versus guessing that it worked. and i know there's the haptic feedback but it wastes battery power as well as annoys my hands whereas the buttons don't.

like i said mainly me being way to picky about my phone, i need to suck it up and realize this will be the best android device with a full physical kb for a while
[G2 and Desire Z Android Development] sino8r:
I remember I felt the same way with my TP2. The screen was so big... it felt as if my fingers were doing joga to reach the top of the screen, lol! You do get used to it after a couple of days. I was wondering myself about the capasitive buttons and how annoying they would be. Oh well... it could have much worse problems/dislikes like the slide, vibrant, etc...
[G2 and Desire Z Android Development] sino8r:
yeah, I know what you mean. as far as the future goes, the MTHD looks okay but it won't be any different from the G2 besides it's uglier, no qwerty kb, .3" bigger screen and a FFC. I don't think I'll get another My Touch product. Development seems to be difficult on the new espresso sense ui and they aren't that popular among developers. Plus the plastic look sucks. I'm not really into whether my phone is attractive looking or not but teflon/aluminum is much more solid, imo. I'll stick with the G series for now on. much more developer-friendly.
[G2 and Desire Z Android Development] nabzilla1990:
tweeted this forum to cyanogen and paul O brien hopefully get them involved hope to root mine as soon as i get it today
[G2 and Desire Z Android Development] Gr8gorilla:
Has anyone downloaded and tried the Unrevoked 1 click root for HTC phones?
[G2 and Desire Z Android Development] highvista:
Any chance the "rageagainstthecage" exploit would work? It roots the Nexus One with 2.2.1 (build FRG83), the most current release.

http://xdaforums.com/showthread.php?t=792016
[G2 and Desire Z Android Development] epeets:
i would try a few things but i dont feel like bricking my new G2 (arrives tomorrow).
[G2 and Desire Z Android Development] dyndragon:
I'm trying it now, but it does not seem to work. after running rageagainstthecage, and restarting ADB, adb dies on the phone. I have to power cycle to get it back. I'mma continue trying, but no luck so far.