yashsingh1/xdaforums huggingface dataset:
[General Questions and Answers] trungdtran:
Dear All,

I tried to overclock my htc evo (rooted with unrevoke3) using the SetCPU app (I bought in the Market). I already disabled the perflock but it still show 998400 for max in the main screen. I have seen in youtube that one person successfully overclocked his evo to 1267200. Please advice.

Trung Tran
[General Questions and Answers] SycoKU:
Overclocking Unrevoked Forever EVO with SetCPU

I'm running an Unrevoked Forever EVO with a stock-ish ROM and I too am not able to get the processor overclocked. I created a custom frequency file from the default frequencies plus 1267000 as the highest value. I can select it with the slider but nothing happens. It maxes out on 998400MHz. What's missing here?
[General Questions and Answers] jespinola21:
I'm experiencing the same dilemma ...
[General Questions and Answers] SycoKU:
Ok. Turns out that the stock kernel is being used and is NOT capable of overclocking regardless of the txt file's contents. I flashed the smartass kernel and all is speedy now. I am unfortunately one of the ones who can only OC to 1.19 GHz without locking up. But another thing I did discover is that I have a 5 touch multitouch chip! Not sure how that helps anything but cool to test none the less.
[General Questions and Answers] m0nk33:
I'm a newb... but

You need to flash a custom Kernel...

I UNDER clocked mine... Battery life and all =)
[XPERIA X10 Q&A, Help & Troubleshooting] goothu99:
hey, stupid q, but how do i get that sent from my x10 tag after i compose an email?
[XPERIA X10 Q&A, Help & Troubleshooting] SXUsr:
Use the XDA app. ;)
[XPERIA X10 Q&A, Help & Troubleshooting] matjan:
It says so in the tag :D
[XPERIA X10 Q&A, Help & Troubleshooting] SXUsr:
:d :d :d :d :d :d :d :d :d :d :d :d :d
[XPERIA X10 Q&A, Help & Troubleshooting] SaintyUK:
Or use tapatalk :-)
[XPERIA X10 Q&A, Help & Troubleshooting] shredrex:
Guess it depends on what application you are referring to. The PDA app does it automatically I believe. I set different sigs up for Gmail, so if I send from X10 you get one sig.......from my desktop another.
[General Questions and Answers] Link89911:
Can anyone guide me along with this I was able to successfully root my droid2 yesterday now i wanted to add the FMRadio capability and i need to remount but every time i try to i get the error message "remount failed: Operation not permitted" as you can see i have the admin but it still won't remount is there something I'm missing?

C:\sdk\tools>adb shell

$ su

su

# ^C

C:\sdk\tools>adb remount

remount failed: Operation not permitted

also tried this

C:\sdk\tools>adb remount r/w

* daemon not running. starting it now on port 5037 *

* daemon started successfully *

remount failed: Operation not permitted
[General Questions and Answers] chromadroid:
I'm having the exact same issue. I'm trying to install superuser per their instructions though. adb says that the remount operation is not permitted.
[General Questions and Answers] Link89911:
Well I was able to root it and install superuser so you would think i could get back in and remount the thing.
[General Questions and Answers] ozzman54:
I just had this problem. Remount it in the shell after you do the "su" command.

Like this:

C:\sdk\tools>adb shell

$ su (make sure your phone is unlocked during this part, it should pop up asking for Super User access)

# mount -o remount,rw /dev/block/mtdblock3 /system

now you are remounted and in read-write mode...when you are done, remount again but change the "rw" to "ro".

like this:

# mount -o remount,ro /dev/block/mtdblock3 /system
[General Questions and Answers] ferret_tas:
noob stuck as well until.

I am on day 6 of having my D2 after trying all the other posts on a whim I tried to Doroot again. was going slow as ???? then changed "PC Mode" to "Charge Only" mode...Everything worked great...FM Radio works well but Only Mono with not so great reception.

Good Luck.
[G2 and Desire Z Android Development] Disconn3ct:
Seriously, actual technical discussion this time.

Continued from the other thread:

READ THIS FIRST:

What we know now:

- The eMMC supports setting a range of blocks temporarily or permanently read-only. That seems to be the case for the bootloader, /system and recovery.

(From the datasheet: Specific segments of the iNAND may be permanently, power-on or temporarily write protected. Segment size can be programmed via the EXT_CSD register.)

- The reason we can write to /system using "temproot" is that it is getting cached by linux. (Write-through, so the card is accepting and discarding writes but we are seeing the cached version only.) Flushing the cache removes all changes from system and upsets the kernel.

- Because no changes are making it to the actual flash, rebooting removes all updates. It is not being magically reflashed.

- It is not a rootkit. It is the OPPOSITE of a rootkit. Rooting it is much much more like a rootkit. Seriously.

- OTA isn't an answer. It isn't even helpful. The way it works: update.zip is downladed, and the key checked. saved to /cache, and an update script is written. it reboots to recovery. recovery checks the keys again, then runs the script to install it. there's no exploitable action there. It doesn't unlock the emmc, etc.

The eMMC security standard (pdf) and specifically, the parts applying to write protection

And the SanDisk part manual/datasheet

Some pieces of the current state are accessible from fastboot, or by mounting debugfs.

Status Blocks:

CSD and decode

Decode of EXT_CSD (via "fastboot oem get_ext_csd_emmc")

EXT_CSD (raw) while the phone is running

Some notes concerning the above

Useful flags in the security standard, specifically relating to temporarily and permanently write protecting regions of flash.

CMD29 is clear write protect. Hmmmm...

Or we might permanently writeprotect it. Or permanently -block- write protection.

Can a kernel module just reset the WP blocks? maybe (more info here) and the value should be "d00f00320f5903fffffffde0124040c8"

If we have to reset the controller, here is how

Examinations of the cache behavior, rmt_storage, etc.

If you have other updates, stick the links in the replies. Also, there is a wiki being set up.

Currently (10/9) we're looking at either resetting the part (and then reconfiguring it to get it out of boot mode - page 38 in the spec) or chewing up the bootloader.

Alternate approach by lbcoder - apply the leaked engineering bootloader as an update, convincing the system via misc that it has already passed signature validation:

Kinda unrelated, but here is HTC's response to their gpl violation. And finally, here is their possibly-accidental source code release.
[G2 and Desire Z Android Development] mattseg:
Edit: What I posted is now in the above post. Just trying to help. I have faith in you guys to get root.
[G2 and Desire Z Android Development] Disconn3ct:
CHANGELOG:

- 10-08 18:32 wiki link fixed

- 10-08 22:07 added the cache examinations

- 10-09 13:45 added the disclaimer and the currently-trying

- 10-13 10:11 add CSD decode

- 10-14 09:37 add kernel source :)
[G2 and Desire Z Android Development] vi5in:
Ah, ok this makes sense to me. Basically you are changing the time of the attack to earlier on in the life-cycle. I agree that disabling write-protection while the phone is operational (after boot) could be problematic (because we seem to have cached writes).

So what you're suggesting is that we turn off protection earlier on (in the bootloader)?

Oh by the way, there's no point writing that value (that I mentioned earlier) to the CSD register since those bits are RO.
[G2 and Desire Z Android Development] Disconn3ct:
It may be that it can't be turned off at all once it is turned on (eg if we can't get the chip back into a sane state after a reset), so it is possible that the only time we can turn it off (or rather, not turn it on) is bootloader.

The cached writes issue is easy to deal with - there is no reason to ever remount it read/write, so there are no cached writes pending. (There is a red herring from earlier - htc didn't set it up read/write, that is a side-effect of a typo in the 'root' script from the directions thread. The last line attempts to put it back to read-only, but fails because it uses android mount instead of busybox mount.)
[G2 and Desire Z Android Development] Maqr:
The wiki link is broken.
[G2 and Desire Z Android Development] olearyp:
Wiki is now here.
[G2 and Desire Z Android Development] Dreamer5:
Now im not a dev by any means.

let me see if i have this right:there is a read only file that contains the "primary" android system files and we cant modify that and it gets re applied everytime the phone is restarted.henchforth makeing the phone unrootable. now logically speaking the area had to at one point been writable, and has since been locked by a command, of which we cant find. and the mmc has a little todo with the whole process. so its safe to say that it might be one of the "key" components. just looking at the design of the phone and with what looks like a back cover sensor on the lower of the hinges on the back cover. Now the command to read the read only part of the phone is looking like what we have to get too to change where it is looking for the sys info to allow us perm root. i have a g2 and am excited on the amount of skill comming to gether to get this done.
[G2 and Desire Z Android Development] Dalamak:
Always willing to donate for a good cause, let me know if we need to get a pot going to buy someone a G2 like JesusFrekee.

Maybe HTC wants to force use inside the G2 so we void warranties. Jtag adapter, or a hardware related jumper/mod.

Someones gonna need a G2 bought by the community that they are not going to mind tearing apart
[G2 and Desire Z Android Development] PsychoI3oy:
jeagoss has already torn one apart and JTAGed it and has been poking around
[G2 and Desire Z Android Development] HamNCheese:
Sorry to dig up old info from the other thread, but I couldn't help but notice a few things here:

I think there is an interaction between rmt_storage and the actions of the radio/mmc interfering with the temp root. rmt_storage is certainly being used as a proxy to communicate with the storage in some way. Not as a ram-disk, but as an overlay to the visible partitions that are on lock-down. Your observations of free memory being clobbered by big writes to protected partitions could very well be linux caching the writes - because there's simply nothing better to do with that memory at that moment in time. However, as rmt_storage continues to communicate with other parts of the system, the trigger to flush cache as it sees fit may very well be sent through the RPC mechanism. It does not exactly explain the cache flush scenario, unless rmt_storage sends a message to clear all volatile blocks at that time. Any way you slice it, rmt_storage has a lot to do with the overlay, and probably nothing to do with the lockout.

This makes sense to me. Coming from a N1, I did the locked bootloader root via SDcard trick a few months back. This explains why HTC has blocked adb from communicating with the device while in recovery mode. The same trick would presumably work if they left it open.

So....

It seems we have some evidence that the lock happens during the early stage of the boot sequence. From here, it is likely that rmt_storage plays a role in how the overlay/cache/whatever is reverting writes over a period of time. But it does not appear to have anything to do with the security lock-out.

With no recovery vector to exploit, this leaves us with few options. I would put my money on exploiting the pre-boot process (possibly with a race condition exploit similar to what we have seen with other recent HTC devices) and either preventing the partitions from being write protected *or* disabling the security outright. I have yet to see any evidence that we can disable the write lock from userspace *or* kernelspace - only speculation.

Re-read rmt_storage_client.txt - it seems likely that this is what we are observing with the rooted units degrading over time. rmt_storage sends RPC calls, stuff happens, filesystem overlay changes disappear. Once the kernel is up, this is *the only* interface to restricted parts of the storage system.
[G2 and Desire Z Android Development] biosehnsucht:
Based on the rmt_storage_client.txt you linked, rmt_storage provides storage access to the radio / modem processor via RPC since it doesn't have any direct way to access emmc, rmt_storage doesn't sound like it's doing anything for the application (the one android runs on, we root, etc) processor.

It's not impossible that it might somehow be exploitable in some fashion but I glanced through the code and nothing jumped out at me as doing anything interesting.
[G2 and Desire Z Android Development] VValdo:
But wait- don't you remember the part when T-Mobile said that the inability to save changes is a mere side effect of HTC's security measure intended only to prevent "key operating software from becoming corrupted and rendering the device inoperable"?

And their 90-120 day delays are totally "within the requirements of the open source community", no matter what the GPL might say.

I'll keep looking here.

W
[G2 and Desire Z Android Development] HamNCheese:
My understanding is that the eMMC is abstracted since it is not yet directly supported by linux. Therefore, the radio would be the next logical choice for accessing it.

rmt_storage = remote storage. Keep in mind that we're dealing with a new SOC - it's perfectly reasonable to assume it has the ability to access eMMC on its own. RPC via rmt_storage is a likely suspect. It would also explain where the missing space went.
[G2 and Desire Z Android Development] Disconn3ct:
You have it backwards. Read the beginning of the rmt_storage doc. The radio can't access it so it makes rpc calls to linux so that linux can handle read/write for it. It is well documented. Seriously people. Stop guessing and do a little reading..
[G2 and Desire Z Android Development] The Great NY:
Subbed for updates. I'm not good at this stuff. So I'm reading trying to learn.
[G2 and Desire Z Android Development] damnoregonian:
the emmc is very directly supported by linux.

the radio does not have the ability to talk to the controller, that is why its storage must be proxied through one of its mailboxes to the kernel, and then to the userspace client.

i don't believe it's related to our root issues.
[G2 and Desire Z Android Development] burpootus:
I own a Droid X and I hope you guys have more success with the G2 than the X community has had unlocking our bootloader. In the long run though, the manufacturers will win the battle of locking devices. The answer to this problem is really to stop buying locked devices. Not much chance of that happening either. A pretty depressing picture for the time being and short term future.
[G2 and Desire Z Android Development] ohhdavid:
Its truly my belief that they do these things to prevent having to fix peoples rooted phones... android, with its open market and cross-hardware nature, are already a big risk for manufacturers but fortunately they have given it a shot (and we have rewarded that)

If you were truly passionate about having an unlocked phone, vote with your dollar and buy a dev phone like the new nexus one dev phone.

Otherwise.. pay less and work for root.
[G2 and Desire Z Android Development] schwiz:
Hah web2go is 'key operating software' ? I call BS
[G2 and Desire Z Android Development] mdayjr:
Personally.......I think htc is messing with you guys. They wanna see just how good you are. You know one of those htc devs are sitting back watching you and laughing right now. They probably put the key in a spot where you wouldn't think to look. Idk.....???
[G2 and Desire Z Android Development] Jamalia:
I'm no expert, but...

... from what I've been able to gather (and I may be way off base here, so someone please correct me if I am), the ROM is signed with a 2048-bit RSA key. Advances in computing may make this crackable one day, but the key is not likely to be broken in time for anyone to care.
[G2 and Desire Z Android Development] skyjumper:
Someone's already on it: http://tjworld.net/wiki/Android/HTC/Vision/HbootAnalysis

Really this thread is out of date. The link above and http://xdaforums.com/wiki/index.php?title=HTC_Vision#Rooting_the_G2 are where the action's at
[G2 and Desire Z Android Development] adwinp:
I was taking a look at the kernel src and noticed a few keys.

all *emmc_tags (including hboot_emmc_tag)

what about the engineerid/engineer_id keys?

Any info on the matter

There are also references to mfg_modes (didn''t find anything interesting though - factory/factory2 seem to reference to fastboot and that's it; other than that, there are only the other regular operating modes)

I have also found references to a gold card checking routine. We might try our luck there as well.

IMO, we should be searching for the key either in HBoot and/or in the kernel.

If we find what we are looking for in the kernel, that might give us a tip on what to look for in the HBoot as well.

On a side note, since the Evo also had nand locking, we could try diffing a sec-off HBoot (like the Evo's) strings against ours, which MIGHT also help.

Another idea would be to hack SPL in order to set our SYSTEM: to the USER: partition, which is unlocked for write.
[G2 and Desire Z Android Development] theqwert:
Correct me if I'm really off base here, but from what I can tell from reading the wiki:

Kernal Mod:

Resetting the write protection hit a dead end, because while it is now known how to soft reboot the chip, restart it in the way linux expects, without enabling write protection, it actually takes a hard reset of the chip to actually wipe the wp untill boot flag, and all tries so far have hard-rebooted everything BUT the emmc.

Radio/HBOOT/bootloader

Therefore, they are now inspecting the radio, HBOOT and the bootloader to see if there is an exploit to either disable the wp bit setting portion during boot, or to trick the phone into flashing an unsigned rom using the procedure that is left in to allow (signed) ota updates. A gold card has been tried with no apparent effect.

Just a quick summary for those too lazy to parse the wiki's.
[G2 and Desire Z Android Development] wilnotdie:
Yes. If memory serves me right, there is a special "gold card" per say, which allows changing the cid.

In any case, goodluck and keep chuggin away!!
[G2 and Desire Z Android Development] veritasaequita:
question fellas, is it an internal sd that is protected or the external that we drop our sd into? or is it both? thanks, veritas
[G2 and Desire Z Android Development] deliberate187:
eMMC CSD info

Here is the output I received from fastboot oem get_ext_csd_emmc on my unit... not sure if this will help or not.
[G2 and Desire Z Android Development] mikeyboc:
The new MyTouch 4G has the same 3e recovery, could there be something off of this that could help?

I have one on hand if so . . .
[G2 and Desire Z Android Development] Jrbourque:
Do you know if its locked down the same as g2?
[G2 and Desire Z Android Development] mikeyboc:
I don't. Not even sure where to begin to find out. If someone wants to walk me through anything, I am more than willing to try things out and see what we have.
[G2 and Desire Z Android Development] Jrbourque:
I sent you a pm
[G2 and Desire Z Android Development] itsmikeramsay:
Could it be?

Am I seeing what i think I'm seeing?

Did Team Douche really do it?

http://bit.ly/d7sL1n

OMG did this just make my morning? Can anyone confirm this?
[G2 and Desire Z Android Development] LickTheEnvelope:
*golf clap*
[G2 and Desire Z Android Development] TheDeadWalk:
Any confirmation?????? :D
[G2 and Desire Z Android Development] faugusztin:
He is beating you with a golf club because it is a old known fake picture :

http://forums.t-mobile.com/t5/Opera...oks-like-someone-was-able-to-root/td-p/494945
[G2 and Desire Z Android Development] itsmikeramsay:
Dang. Had my hopes up lol. I kinda figured I was out of the loop....Sucks!!!
[G2 and Desire Z Android Development] deliberate187:
I have done some thinking about this and it is entirely possible that the eMMC CSD register isn't actually set, but could actually be the bootloader setting NAND-lock-like security permissions in RAM every time the phone is booted.

If there's anyone with enough cahonas to take the eMMC off and try it in a computer with unrestricted access, then we will have our answer when the CSD registers are read into memory.

It is also entirely possible that the controller itself is hardwired into issuing the NAND lock, but much more doubtful as this would require custom investment on the part of HTC.
[G2 and Desire Z Android Development] subiespecial:
Alright guys forgive me if this has been stated but I know at least one thing I have to say is news. The part I'm not sure about is, the reason we can not root is directly connected to the roughly 3 gigs of internal memory that is missing. How its advertised with 4gigs internal but most have 1.8 or slightly more. Htc actually set aside that extra memory for dedicated app memory, completely unused memorey whereas future updates will download and install to (Honeycomb anyone?) And last but not lest a complete boot check and systems recovery. Now i know you all know it has that recovery I just wasn't sire if your aware of the fact that it is tied directly to the advertised internal storage. Maybe that will help if we can find a way to format all 4 gigs instead of just the partition we have avalible.

Next, the new MyTouch, is almost certanly going to have the same problem... just messed with one and it too only shows 1.8 internal memory instead of the advertised 4 gigs. Hopefully though whatever crack that is found for the G2 will apply to the MyTouch as well.

Anyhow if none of this is any news at all just ignore me completely please don't flame me. I'm not up on the developing side so i didn't take the time to read this whole thread I just found out some info from playing with the new myTouch as well as an HTC Rep that stopped by.

Also, the MyTouch is a damn sexy phone by far the best of the line up blows the EVO out of the water with build quality its om par with the G2 it's a bad ass phone!

Sent from my thing, you know... with the stuff and what not...? Aww whatever
[G2 and Desire Z Android Development] sundar2012:
commented on wrong thread.
[G2 and Desire Z Android Development] starkruzr:
Is it also connected to the fact that the phone only says it has 379MB RAM to work with? That's TOTAL, not free.

total used free shared buffers
Mem: 379832 373836 5996 0 4604
Swap: 0 0 0
Total: 379832 373836 5996
[G2 and Desire Z Android Development] deliberate187:
Its a good theory, but if this were true the device would take a long time to boot (would have to verify itself on boot, replace damaged files, etc. It is simply caching writes and not applying them to the eMMC. Its either something to do with the eMMC itself or the bootloader, possibly radio causing it to not write (and thus give us real root)

That said, its not entirely unplausible. Just not true in this case...
[G2 and Desire Z Android Development] renn9420:
This maybe a dumb question and I'll probably be roasted for it but sometimes its the obvious that eludes us. Has anyone tried the flash-rec.apk yet? If not I'm going to try. I know it was to gain root in 1.5 but who knows?
[G2 and Desire Z Android Development] tep065:
did it work? It would really be nice if Acoms Razor played a role in our rooting aspirations :)
[G2 and Desire Z Android Development] krayshunist:
We already know how to get root access on the G2. We just don't know how to make it last and permanently write crap to the card.
[G2 and Desire Z Android Development] renn9420:
Will try after work tonite. But need a custom recovery to flash. Wished Cyanogen and his team were able to build one for G2/Vision. Don't really care for Clockwork's recovery.
[G2 and Desire Z Android Development] grex49:
I'm wondering if all the latest HTC/Android devices will all be this hard to get permanent root access? :confused:
[G2 and Desire Z Android Development] LickTheEnvelope:
Not once this one is rooted...