yashsingh1/xdaforums huggingface dataset:
[G2 and Desire Z Android Development] waffle iron:
The easier way would probably be to use something like the SD to microSD extender from www<dot>aptolink<dot>com/products-extender-cards with two SD cards and a swap. It would probably take someone with a reasonable understanding of how the FAT/FAT32 driver works in recovery and the construction of two specially crafted SD card images. Then all you need is the timing for a switch. The only caveat is I'm not sure how the insertion detection works. Might need more specialized hardware.

Other stuff I've found: www<dot>alibaba<dot>com/product-gs/339128919/Micro_SD_Cable_with_extension_cable.html

www<dot>bplus<dot>com.tw/ExtenderBoard/TFEX.html
[G2 and Desire Z Android Development] bentglasstube:
Bear in mind that the SD card rests behind the battery so if you are going with that type of attack, you will have to also rig up some wires to keep the battery connected while the SD card is exposed.
[G2 and Desire Z Android Development] Disconn3ct:
Nothing get wiped on reboot. It never gets written to begin with. So as soon as you reboot, there -are- no changes. (Or as soon as you dump the caches.)
[G2 and Desire Z Android Development] Corylulu:
Yeah, I tested this, You can actually fit a cable under there because the battery doesn't have to be completely flat for it to get a full connection. It can be at a 35 degree angle out and still boot.
[G2 and Desire Z Android Development] lbcoder:
Don't anyone be too worried about the physical location of the battery and the sdcard. Wiring is the least of things to be worried about, and the SIMPLEST to work around if/when it becomes necessary.

Question: If the phone is plugged in and RUNNING, does unplugging the battery cause it to shut down? Or will it keep running?

(note: I know that it won't START without the battery being plugged in, don't know about keeping on running....)

Also note: running an update with the battery disconnected may not be the safest idea. Certainly wouldn't want to overwrite SPL or RADIO like that since you stand a significant chance of destroying stuff. Break a system update and you aren't badly off since you can just run it again.

Another question: do we have access to an engineering/s-off SPL for this phone or not? Someone in the other thread suggested that we do... http://xdaforums.com/showpost.php?p=8421494&postcount=213

** this is the SPL from the PRERELEASE ROM that came out some weeks ago that they are referring to.

That being the case, and since CACHE and MISC *must* be writable, it should be possible to trigger an SPL update from a TEMPROOT. In any event, the linux kernel from the running system *MUST* be able to write CACHE and MISC! Otherwise there would be no point in these partitions at all!
[G2 and Desire Z Android Development] Disconn3ct:
We don't have a signed update for the leak.
[G2 and Desire Z Android Development] Corylulu:
it turns off immediately if the battery is taken out, regardless of it being plugged in. Just tested.
[G2 and Desire Z Android Development] lbcoder:
That's the beauty of attacking the misc and cache partitions! Unless something has changed from previous devices, it doesn't NEED to be signed. The signature check happens BEFORE the cache and misc partitions are set up!

The way an hboot update works is like this;

1) check signature on update.zip containing hboot.img.

2) IF the signature check PASSES, then run the update-script within the update.zip

3) The update-script contains the single line "write_hboot_image PACKAGE:hboot.img".

4) hboot.img gets written out to the CACHE partition

5) MISC partition's command field is set to "update-hboot", argument set to format cache.

6) reboot into update-hboot mode

7) contents of CACHE partition are copied into HBOOT partition

8) MISC partition's command field updated to "boot-recovery"

9) reboot into recovery

10) recovery reads argument field, initiates format cache, clears the command field

11) reboot.

Now this procedure will work for DREAM/MAGIC/etc., I can't say that it will work for VISION, but it *might*. All it depends on is in getting the right data into the cache and misc partitions, and it should be possible to do this from a running temproot system!
[G2 and Desire Z Android Development] fastludeh22:
dont worry about the battery folks. someone just get me something to flash!!!

i tried swapping sdcards in fastboot. as soon as it detects card out it stops loading. it does a second check after reboot from radio also. seems though the phone doesnt hold all of the update. when it gets to system, it says unzipping for a few seconds before flashing. maybe a system image w/su binary in it do it?
[G2 and Desire Z Android Development] lbcoder:
I don't think that a physical swap of the card could actually work. Even if you held the insert switch down while doing so. Reason is that it will need to be able to keep reading the original file WHILE you are swapping out the file for the new unsigned one.... which means that you would have to actually perform the swap much much faster than is humanly possible. The trick that the ADB shell would offer is the ability to replace the file without deleting the original by deleting just the hardlink from the original file.... or whatever MS likes to call it it in fat.

This is the reason why I suggested a FAKE sdcard that is actually a running program. The first time the file reads, feed it the signed zip, the second time the file reads, feed it the unsigned zip.
[G2 and Desire Z Android Development] Disconn3ct:
If its that simple I'm gonna cry :)

Lemme see if I can give it a quick test.
[G2 and Desire Z Android Development] fastludeh22:
ya def not fast enough to switch while loading, but on first load it asks u if you want to update or not. if you change sdcards right then, then say yes it still flashes. 1st bootloader, 2nd radio, then reboots. it checks again after reboot before flashing recovery, but doesnt pause to ask u if u still want to update, making it impossible to do the phisyical swap for recovery. but the bootloader maybe. im willing to try swapping once it starts flashing if someone has a mod system.img with su in it. i have about 3-4 seconds from when it starts before it starts unzipping system, recovery is instant after 2nd check
[G2 and Desire Z Android Development] lbcoder:
EXPLOIT EXPLOIT!!!!

In theory!

Two identical SDCARDS. Copy the signed update.zip (recompress it using STORE zip algo -- no, this won't break the signatures) onto one of them. Duplicate it to the other sdcard via DD. Manually EDIT the SPL in the second one so that it is laid out exactly the same over the card. You say that it ASKS you AFTER verifying the signature? Hold down the switch in the sdcard socket, switch cards, confirm, flash SPL, DEFEATED!

Note: my idea about setting up the misc and cache partitions isn't supported by the froyo recovery system. This is not to say that it won't work, just that froyo doesn't use this method. It depends on some luck -- if the SPL still has that firmware update routine implemented or not. IF IT DOES, this would work. If not, then it won't work. bootable/recovery/firmware.c from ECLAIRE is the relevant code for that attack.
[G2 and Desire Z Android Development] fastludeh22:
you obviously havent been reading. look about 1 page/5 posts back, lol

lb, you have gtalk? im about to pm u
[G2 and Desire Z Android Development] Corylulu:
battery is not really an issue, it can be rigged, and you can even open the battery to a 80 degree angle with no problem, giving you PLENTY of room to switch the SD card. I'll take pictures in a minute of how much you can actually move the battery out of the way while it still getting power.
[G2 and Desire Z Android Development] fastludeh22:
thats been handled, for now at least. you wouldnt want to lose power during a flash...

http://xdaforums.com/showpost.php?p=8605584&postcount=118
[G2 and Desire Z Android Development] bled82:
If you can recompress without breaking the sig why not just use one sdcard with a modified update/rom or whatever ?
[G2 and Desire Z Android Development] Gr8gorilla:
because if you change anything in the zip, the sig check fails. compressing and uncompressing does not change the value of what is in the zip.
[G2 and Desire Z Android Development] bled82:
Oh yeah sorry i knew that , thought he was saying he had a program that would let us mod the files and keep sig , my bad . Has anyone seen a download link for the OTA or any sold proof its been pushed out ????
[G2 and Desire Z Android Development] fastludeh22:
unfortunately not yet. it seems that even though it acts like its pulling from sdcard i no longer think it does. it must pull from a cache file. i swapped the signed one, for the test build leaked a little back and when flash was done, no radio or spl change. if we only knew where on the phone it uploads to and a way to access that...

a wire came loose after flash and phone wouldnt boot,so i took it all off and put battery in to see if all was ok. it is.

im gonna try some more of this later, but if i had that ota to play with also, i have some more ideas...
[G2 and Desire Z Android Development] renn9420:
Like I suggested in my first posts that a dev found a way to jailbreak an iphone at boot so that no matter what ota update the iphone stayed jailbroken. Obviously the G2 isn't a sorry piece of equipment like an iphone ( Android Rocks) but it is possible to root boot but the question is how? Maybe the same method?
[G2 and Desire Z Android Development] grankin01:
I am sending my g2 back due to a z hinge problem so I am more than willing to use this one as a test bed. I will have about three days to do so though.

Let me know and I will try whatever. :)

Not trying to bog down the thread just figured I would offer. :)
[G2 and Desire Z Android Development] rune222:
I may feel stupid in a second, but what if you ran a directional switch from the phone with leads running from two different micro sd cards, so it could be an instanst swap with a flip of a switch that the phone wouldn't notice.
[G2 and Desire Z Android Development] shograt:
Mainly because switches capable of switching at millisecond speeds are crazy expensive... and adding into it, how do you know the precise instant? And then there's device ID's. At least, I'd assume there's a card identifier per card.
[G2 and Desire Z Android Development] grankin01:
Provided you had the right switch (I think) you should be able to hex edit the physical layer of the card to fool it into thinking they are the same. Correct me if I'm wrong but I think that is kinda what you are doing when you make a gold card.
[G2 and Desire Z Android Development] whgarner:
what you may need

if trying to change cards while booting you may need one of these

http://www.aptolink.com/products-extender-cards

or

http://www.ameri-rack.com/APA-TFC1m.html

will need to be flexible

bill g.
[G2 and Desire Z Android Development] lbcoder:
The signature isn't on the entire file itself. It is on each individual file withIN the zip.

If that were not the case, then the ACT of SIGNING the zip would itself break the signature.
[G2 and Desire Z Android Development] lbcoder:
@ everybody thinking about high speed switched... not necessary, not helpful.

I believe that we may be running up against linux cache. The ADB attack that changed out the file worked because it updated the filesystem in a sane manner -- by using the proper filesystem driver and modifying the filesystem from the running/controlling kernel. That means that the caches will be expired and the filesystem pointers updated while the sig check runs wrt the OLD file pointer.

Can anybody think of a way to trick the kernel in recovery into dropping its caches?
[G2 and Desire Z Android Development] cyanogen:
Its a whole-file signature which is appended to the end of the original zipfile.
[G2 and Desire Z Android Development] eck0728:
Why not use rageagainstthecage since its a memory hack and gives you temp root maybe you can edit the write protect partition.
[G2 and Desire Z Android Development] adwinp:
You can write a script to flush caches automatically every x seconds

echo 3 > /proc/sys/vm/drop_caches
[G2 and Desire Z Android Development] Disconn3ct:
That is great - how do you get it to run in recovery, where we have no access?
[G2 and Desire Z Android Development] fastludeh22:
I agree with u partly. I also think we are dealing with cache in Hboot/RUU updates, but in different ways. In hboot, it acts like the file isn't there if it isn't signed. If it is, it loads it to cache then asks if u want to flash. In a RUU update it loads the file first, then checks it, so don't see a way of tricking that.

If we had a way to push the file in hboot right after sig check, like the adb trick, it should work. A high speed switch, or your idea of emulating a sdcard may work at this point also. It seems when I tried to manually switch at this point I had a good second with no sdcard in before it quit trying to load.

If we had a way of knowing where its stored, then a way of replacing the cache, maybe that would work?

I THINK recovery is different though. It seems as soon as u hit update, it checks sig and then flashes. It could be loading to cache, but still the check is first. I think this is why the adb trick worked, and why adb is now locked out of recovery.

Differnt angle I was wondering about. You can fastboot boot using a temporary kernel before flashing it to the phone, would this help in anyway. Or maybe even better, can we boot recovery this way, enabling adb?
[G2 and Desire Z Android Development] lbcoder:
If you could fastboot boot, you could fastboot boot a custom recovery. HOWEVER, I think I read somewhere that s-off SPLs will only unlock the storage when it is ACTUALLY booting from the recovery partition -- otherwise another angle to attack this with would be to load a modified recovery by running init.

There could actually be an SPL-initiated write block happening here, leaving us with two options; hack recovery, or somehow replace the SPL.
[G2 and Desire Z Android Development] Carloswithac:
Looks like HTC released the kernel source.

T-Mobile G2 Kernel Source - http://member.america.htc.com/download/RomCode/Source_and_Binaries/vision-2.6.32-g814e0a1.tar.gz
[G2 and Desire Z Android Development] whywhy1:
HTC Desire Z - Froyo - 2.6.32 kernel source code.

I guess this for our G2 also?
[G2 and Desire Z Android Development] paulobrien:
One click temproot here.

P
[G2 and Desire Z Android Development] paulobrien:
It's useful to those of us that are working to get root, but fair dues!

P
[G2 and Desire Z Android Development] Denkai:
Back to discussion:

What would it take to edit the SPL and where is that stored?

sent from my POS Cliq using the XDA App
[G2 and Desire Z Android Development] lbcoder:
No need to modify the SPL -- we HAVE an engineering SPL. The problem is figuring out a way to install it.

SPL is located at /dev/block/mmcblk0p18

Problem is that it is write protected same way as the system partition.
[G2 and Desire Z Android Development] Denkai:
Has anyone ever modified hboot or the fastboot of any htc android phone?

sent from my POS Cliq using the XDA App
[G2 and Desire Z Android Development] bled82:
Any way to check if that would allow access to adb in recovery with the eng spl ?
[G2 and Desire Z Android Development] dubbeld00:
Yes, http://alpharev.shadowchild.nl/

Btw, (and I'm sorry if I missed it) what differs from the G2 protection versus the HTC Desire?
[G2 and Desire Z Android Development] maxawesome:
Auto-restore service?

Ok so I got my wife a shiny G2, and in setting up Paul's VISIONary app, and enabling debugging, I noticed there's a menu option in settings to view Services.

So I looked, and there's an "Auto-Restore Service".

Is this having some kind of impact on root attempts? I mean I would hate for it to be something as silly as this holding us back from full root.

Can anyone confirm?
[G2 and Desire Z Android Development] flip3547:
Is this method possible in this situation or completely different?
[G2 and Desire Z Android Development] xile6:
If your talking about under Privacy settings. Then no. That is for saving your app data /settings to online.

There is a menu for running services which is just the apps that are loaded

Other then that i haven't see any kind of auto-restore settings can you tell me were you see this at?
[G2 and Desire Z Android Development] Disorganise:
If I've understood the two threads and the wiki correctly, then damnoregonian has shown that the radio somehow plays a part in the boot process to set the write protect.

Would setting the radio to 'flight mode' effectively turn it off and prevent it interfering on reboot?
[G2 and Desire Z Android Development] xile6:
that has nothing to do with it. Flight mode is different from the radio that we are talking about.
[G2 and Desire Z Android Development] flip3547:
I know nothing about nothing but after reading logs for 5 or 6 days I'm seeing alot of the same terms being used, so anyways, by googling around I came across some emails. Does anything here help? If it does, I'll try to find more.

http://www.mail-archive.com/linux-mmc@vger.kernel.org/msg01512.html
[G2 and Desire Z Android Development] Corylulu:
Thats actually kinda interesting. From what I read, I don't think it helps us too much from what we already know via reverse engineering, but interesting none-the-less
[G2 and Desire Z Android Development] rbrahmson:
NEC clear EMMC documentation may shed a light

I stumbled upon NEC's Application Note Multimedia Processor for Mobile Applications EMMC Interface (see http://www2.renesas.eu/_pdf/S19904EJ1V0AN00.PDF)

I am not claiming that this is an identical interface, but on the slight chance that it is not that far from the one used on the G2, I thought that referencing it here might be helpful given the clear flow diagrams and examples provided in this document.
[G2 and Desire Z Android Development] maxawesome:
Menu > Settings > Application settings > Running services > Auto-Restore Service

Then you just select Auto-Restore Service and stop the service. It won't restart on its own, and it hasn't restarted on its own in like 4 reboots now.

I notice that this service IS NOT running on my Nexus One.

However, I also noticed that in those 4 reboots, each time I still had to run VISIONary to regain root. Maybe this would allow folks to uninstall bloatware, though? I haven't tried that yet.
[G2 and Desire Z Android Development] xile6:
Not in my phone maybe its an app you installed, but I dont believe that has to do with getting prem root. Sorry
[G2 and Desire Z Android Development] xspeed9190:
Not on mine either
[G2 and Desire Z Android Development] starkruzr:
Why would they have to fix a rooted phone? It's easy to prove that a phone's been rooted and such an action obviously violates the software warranty. If I've bricked my phone because of something I did while rooted that's obviously on me and not HTC/Moto/whoever.
[G2 and Desire Z Android Development] krayshunist:
That's a part of the T-Mobile app for backing up your crap (that already should be backed up by Google, anyway). It has absolutely nothing to do with any root on any phone. Read the wiki.
[G2 and Desire Z Android Development] defconoi:
IDEA

How about we create a loadable kernel module that automagically flashes a custom rom on boot? There have been a flood of discoveries about exploiting the linux kernel via null pointer dereferences. There are ways to install/load a new kernel without reboot: example:ksplice There are plenty of holes in this kernel, we just need to exploit them.
[G2 and Desire Z Android Development] thrice43:
Last night I had some interesting (at least to me) output from dmesg that I would like to share. I don't have the exact output with me since I'm on my phone. When I insmod scotty2 tmezg modules into my phone and ran diag_arm9 in one shell screen, ran enable_adb in another and then open up a third shell and echo 0 to all the files in debugfs vreg/ dmesg had some interesting things to say in reference to the gp# echos. It seemed like the phone was trying to disable the enable_adb, perflock, etc but kept reverting back to the changed status.
[G2 and Desire Z Android Development] istheGman:
???

"ChrisSoyars: @starkruzr g2 has already been rooted, need a #MakeItSoWeCanFlashStuff jackpot"

--twitter.com/ChrisSoyars/status/28057454349

sent from My G2
[G2 and Desire Z Android Development] xencor:
It has already been rooted, as evidenced by the several threads in this forum that give you root access. The problem, as Chris's tweet says, is that we still can't flash any custom recovery images (and therefor other roms) onto the phone.
[G2 and Desire Z Android Development] xile6:
I have not idea what that is but yea the g2 has been rooted for some time now it just doesnt stick after reboot neither do writes to the system
[G2 and Desire Z Android Development] renn9420:
This may be a dumb question but here it goes anyway. When you hold the trackpad button down and power on your device you get taken to fastboot. But it doesn't run the check like pressin volume down + power button. Instead it gives you options for bootloader - reboot bootloader - power down and something else. Can't remember, anyhoo question is what happens if you press bootloader or reboot bootloader, does it do the checks then? Can it be rooted during that check? Maybe someone tried already and I'm asking a redundant question. Thanks.
[G2 and Desire Z Android Development] renn9420:
When you select bootlloader then it does the checks. And the other option is reboot. Just asking.
[G2 and Desire Z Android Development] sino8r:
I believe they have tried flashing from fastboot already. Check the wiki G2 section...
[G2 and Desire Z Android Development] renn9420:
Thanks thought I read that somewhere. Read so many posts and articles gets a little confusing. Thank you though.
[G2 and Desire Z Android Development] nbrider:
I dont know if anyone has tried this , but....
[G2 and Desire Z Android Development] jonnybueno:
I didnt really want to, it smells bad =p
[G2 and Desire Z Android Development] Sleuth255:
hmmm. This is not good. Absolutely brilliant technique that HTC is pulling off here. In fact, the technique can be adapted to virtually any phone out there that has enough ram to write cache to important directories like /system. I'm guessing that the real reason why HTC is dragging their feet releasing the code isn't us, rather its their own competition.

ok, so encrypted bl loads kernel that exclusively cache-writes to important directories. soon to be coming to a phone near you. Ouch...To me, it looks like there are only two options:

1. What's the cipher strength employed here? ;) (not too far from reality; there are several GPU based brute techniques that can crack out a private key rather quickly). Ultimately this gets us to a signed SBF and will become the only way to flash custom kernels.

2. If you can't beat them, join them. Build a native application that re-roots the phone every time it is booted. Difficult proposition since adb can't be leveraged and the java based code environment that most of us write in doesn't give access.

Just putting the elephant on the table here... My guess is that if we don't figure this out for the G2, about a week after HTC finally releases the code, OTA bombs will be coming to all sorts of Android phones. My Dx already has the required encrypted bl.
[G2 and Desire Z Android Development] adwinp:
Good one, although the module will have to be loaded early enough before write is locked to eMMC.

Another mod of this idea would be to encapsulate the su binary into the module, which would spawn a root shell. In that case, we only have to insmod.

;]
[G2 and Desire Z Android Development] deliberate187:
The key to unlocking the eMMC partitions may lie in the hboot image. I was peeking through string consts in the file and found some interesting ones related to eMMC set attributes especially write protect attributes. I have attached the .nb0 file inside of a rar archive if anyone wants to take a crack at disassembling it. I didn't see any encryption on it.