yashsingh1/xdaforums huggingface dataset:
[G2 and Desire Z Android Development] MetalSearGolid:
Actually for some reason I was talking about running a data recovery on the phone memory, not the sdcard (I thought update.zip would have been saved on the phone rather than the sdcard, which is not the case I think). Anyways, there's no reason I couldn't run a recovery via usb while the phones mounted, but alas, I am computerless for the day. :mad:
[G2 and Desire Z Android Development] texasaggie1:
Permanent

This not only patches but it also makes permanent changes to nand. Trying to exploit that is the most obvious thing to do.
[G2 and Desire Z Android Development] adwinp:
Those of you who idle around in #g2root have probably come across suggestions of somehow compromising the private keys, now here's some lecture for you, especially the section on "Firmware block descriptions - Boot stub"

This pertains to chromium, but most parts are generic and are valid for android as well.

http://www.chromium.org/chromium-os/chromiumos-design-docs/firmware-boot-and-recovery
[G2 and Desire Z Android Development] angryPirate12:
Based off that, it would make getting root much simpler than what its proving to be. As an exploit could be used to force the keys available or capture-able, which makes it less secure than what its proving to be.

After reading up on a lot the stuff involved with the device itself, I'm beginning to think the issue itself lies inside the NAND. The NAND has a integrated controller to block errors and protect the internal software from unsafe code, and it does this actively. The key is to figuring out how the integrated controller works, which hardware/driver level work is above my skill level.

There is even an off chance they use something as simple as that EEPROM inside the NAND as a means of security. But this just my theory, going to do some reading, and see about how I can contribute through reverse engineering what I can.
[G2 and Desire Z Android Development] Ted417:
@angryPirate12 Well if you want to help out on reverse engineering, you can go here: http://tjworld.net/wiki/Android/HTC/Vision/HbootAnalysis

I think that guy has done a lot of work on looking through the G2 code. So big props for that guy. He might even be the one to permaroot the G2.
[G2 and Desire Z Android Development] angryPirate12:
I will read over what he's done and see where I can help, thanks for the info.
[G2 and Desire Z Android Development] Ted417:
Root almost completed

Mr. TJ from tjworld.net has successfully found the command to switch the S-ON to S-OFF. He's going to hold off though so he can check that it's completely stable.

If you want to follow this guy's workings on the G2, just follow his website here: http://tjworld.net/wiki/Android/HTC/Vision
[G2 and Desire Z Android Development] sheek360:
Whoa.... can't w8

Thnx 4 the update!
[G2 and Desire Z Android Development] androidcues:
is this the same guy as IntuitiveNipple? woot!
[G2 and Desire Z Android Development] Joeball88:
wicked awesome. I'm a D-Z user and if the G2 gets perma-root, I'm pretty sure the same procesure will work for the Z. weeeeee. Going to check out his website and progress.
[G2 and Desire Z Android Development] thatruth132:
23:02	IntuitiveNipple	I just got a GPIO dump for every GPIO
[G2 and Desire Z Android Development] starkruzr:
Can someone post a quick summary of what S-OFF and S-ON mean?
[G2 and Desire Z Android Development] havikx:
lol at this post.
[G2 and Desire Z Android Development] xile6:
S = security

Basicaly only flash update.zip that r sign by htc

Off would be flash any update.zip means custom roms
[G2 and Desire Z Android Development] androidtoy09:
I think it means NAND lock or unlock. :D please don't flame me..i'm just a noob. :p
[G2 and Desire Z Android Development] simobile:
What is S-OFF ?

(Quotes from original AlphaRev website)
[G2 and Desire Z Android Development] xile6:
Just wanna get all this right. But this

Will be a code that is ran on the phone. Then you reboot into hboot and the nand is unlocked? Or will this be jtag?
[G2 and Desire Z Android Development] garok89:
run command

reboot

????

profit
[G2 and Desire Z Android Development] starkruzr:
Yeah, thanks for this.

The reason I asked was that supposedly someone posted pics of a G2 with S-OFF and multiple people posted that it was totally useless, so I figured that whatever "S-OFF" was, it wasn't an end to the NAND lock.
[G2 and Desire Z Android Development] ZeroSX:
The reason they posted it was useless was that it was a dev phone and came pre-unlocked.
[G2 and Desire Z Android Development] brownboyrx:
obviously when codez is released it will be an epic day for g2 and desire-z users!:D
[G2 and Desire Z Android Development] garok89:
im a DHD user....same command should be viable tho
[G2 and Desire Z Android Development] sheek360:
What does that mean?
[G2 and Desire Z Android Development] simobile:
He knows what all the general purpose input-outputs are on the phone. Every chip has it's pins either tagged input or output or sometimes both. If he can control these pins then he can send commands to them. One we are really interested in is the one that can either be set to lock or unlock the NAND. Really barebones explanation so those of you that are way more technical please forgive but some just want a simple definition.
[G2 and Desire Z Android Development] brownboyrx:
i sure hope so! im sooo waiting on this to come out
[G2 and Desire Z Android Development] sheek360:
Thanks! Appreciate it
[G2 and Desire Z Android Development] brownboyrx:
wouldnt this be done through jtag first since you have to physically connect to the phone and and send commands??
[G2 and Desire Z Android Development] veritasaequita:
its cool man, havikx was just giving a quick example of how to or not to be a douchebag on the xda forums as you can plainly see from his well prepared statement he was showing you the "to be" execution of the example. :)
[G2 and Desire Z Android Development] Ted417:
From analyzing his webpage... I read that switching the S-ON to S-OFF was accomplished by running some commands on an "hboot console"... I'm still n00bish with my G2 even though I've had a G1 since about 2 years ago... what is an "hboot console"?... if anyone can get [into] an/the hboot console, then switching the S-ON to S-OFF should'nt be that hard if you link up all of his posts together. I'm not a dev... I'm a themer... So I know that I can't possibly do anything to help out on rooting the G2... All I can do is keep all you guys updated with all this stuff :)
[G2 and Desire Z Android Development] starkruzr:
I'd imagine that having a phone with S-OFF would be helpful if only because it would be easier to explore the device for vulnerabilities.
[G2 and Desire Z Android Development] sheek360:
Its very appreciated! Thnx
[G2 and Desire Z Android Development] Naimand:
I believe that S-OFF would allow us to flash things without the release keys if I'm not mistaken. Having the S-OFF will allow us to use test keys thus allowing us to flash custom roms and themes.
[G2 and Desire Z Android Development] xile6:
Yes u r right but all we can do now is sit and wait tell he relases all his findings/working script or app
[G2 and Desire Z Android Development] naria01:
Don't count your chickens before they hatch ;)
[G2 and Desire Z Android Development] starkruzr:
Really the most important people to get this unlock in the hands of are Cyanogen and the other ROM devs. If the guy who has made some progress on this wants to share, IMO it should be with them. I can wait if necessary,we all can since there are no G2 ROMs yet.
[G2 and Desire Z Android Development] brownboyrx:
I agree, mainly devs like chris soyars and chiefzreloaded. These guys plainly know nand unlocking like the dev who has committed his time to g2 root. We can only sit back and wait, ports are waiting already especially since we desire HD rom works on g2, custom roms will follow.
[G2 and Desire Z Android Development] sovereignty68:
There are plenty of chinese ROM for G2 with S Off available. People in China were able to access HTC mega sim or so called white sim to turn off hboot security on G2(not desire z), and they developed several custom roms with Chinese languages for G2.
[G2 and Desire Z Android Development] Cel1084:
I believe that is the other G2/Magic/Mytouch3g. Feel free to correct me if I'm wrong. Its hard to tell without a link.
[G2 and Desire Z Android Development] cmstlist:
The "G2 Touch", as it was marketed in parts of Europe and Asia, was the HTC Hero. If any of those posts about Chinese G2 ROMs are dated older than a month or two ago, they are most certainly referring to the Hero.
[G2 and Desire Z Android Development] thatruth132:
show proof
[G2 and Desire Z Android Development] rhcp011235:
Oh god.

Proof has been posted 20 times already. I showed proof. You can buy the HTC card for 2500 USD.

and use it on 500 G2's.

Get off this topic. its useless. no one here is paying 2500. NEXT!
[G2 and Desire Z Android Development] LGSilva:
So if we find 500 people willing to get their G2 unlocked for $5 we could get this card?
[G2 and Desire Z Android Development] rhcp011235:
Again, move off this topic.

No one is going to send their $600 USD phone to some inet hacker.

just be done with it. its not new. its been around for ages.

Forget about it.
[G2 and Desire Z Android Development] xile6:
First anyone that devs on the "new g2" call it htc vision or desire z. Those roms ur talking about r the hero or my touch
[G2 and Desire Z Android Development] Veggies:
I'm curious I got fastboot oem unlock to say it did its thing and then the device shows up as ?'s untill I pull the usb and plug it back in. Before I ran fastboot the device showed right. Any thoughts. And did anyone else ever get that result :/

I know oem unlock didn't work earlier but then it was with an err msg.
[G2 and Desire Z Android Development] decayed.cell:
Looks like they started selling S-Off Desire Z's on Taobao already:

http://item.taobao.com/item.htm?id=8004659620
[G2 and Desire Z Android Development] adp21:
mother of god. how did they do it??? and is it legit (i.e. is it really s-off'd and can load custom roms etc?

arrggg - this is what makes me mad!!!

I paid like $650 for the darn phone (incl. unlocking) so that I can use it here in SGP

I can't even load custom rom's - have to wait for it for who knows how much longer. what a POS phone!!

I may even consider selling my G2 and getting one of these S-off'd D-Zs..its like $600 which is well worth it, given that I have already spent way over that for a locked G2....
[G2 and Desire Z Android Development] JustSayTech:
Listen how about we get all the files we can

Old sd card files

New sd card file

Full dump of the whole device

Stop arguing which part is better to get and get everything, that way we can't say we didn't explore every possibility

Now cease the arguing and give this man instructions on how to get us every file we possibly need, pronto
[G2 and Desire Z Android Development] amack10:
Listen u guys really need to read the thread before posting. If u notice a few posts above you rhcp has alredy posted how they do it and its been explained before even youtube it. They are using a special gold card sim that unlocks the boot loader its $2500 then they use it on a bunch of g2 and sell them unlocked at an unreasonably high price to make a profit. And if you were to go about a few pages back from everything I've read and am understanding were on the verge of root.
[G2 and Desire Z Android Development] cmstlist:
Well hey, progress is progress. A gold card SIM is only worth $2500 if the information required to create one cheaply has not yet been widely disseminated. I suspect that within 1-2 months' time at most, that information will be widely available, and it won't even be worth a dollar.
[G2 and Desire Z Android Development] shizenyasuya:
anybody know where to find a dump of that system image? i'd really like to find a good chinese handwriting input method for the g2.
[G2 and Desire Z Android Development] shizenyasuya:
i may be beating the dead horse here. but if this gold sim card or white or whatever special color it is, is really capable of unlocking and turning off the nand lock. i'm with the guy who said we shoudl all get together and buy one for a dev. if we could find a dev willing to figure out how to copy the sim card (sim card reader and writers for pcs arent expensive) he/she could basically dump an image of this sim and we could all make our own gold cards on blank sims with the files provided. i'd totally be willing to pay 1/500th of the cost. hell, even 1/250th to get a gold card into the hands of a trusted dev on xda... so.. what exactly are our numbers? how many of us are there and how much is each person willing to pay? we've already started a fund for full nand unlock and root. i guess this is kinda the same thing.
[G2 and Desire Z Android Development] shizenyasuya:
the ammount they want isnt actually that unreasonable. its about 590 usd... i paid full price for my phone so after tax it cost me 550ish its only 40 dollars more for a fully unlocked device. that sounds like a bargain to me. but yes now that im in the bought and paid boat, i would really just like for us to come up with a hack... show htc that they can try to lock us out of our devices, but we will always find a way around it.
[G2 and Desire Z Android Development] OzJD:
Mmmm

http://www.youtube.com/watch?v=nLFqGKzrtyg
[G2 and Desire Z Android Development] ZeroSX:
/emo.

Hope our devs figure this out, nice to know it CAN be done, sad to know I can't do it atm without a 2500 dollar investment.
[G2 and Desire Z Android Development] SupremeBeaver:
why are all you people talking about this gold sim method? I thought there was a breakthrough yesterday where the devs found out how to turn s-off?
[G2 and Desire Z Android Development] shinkinrui:
Trying to follow this a little with my limited knowledge.

Now, am I just crazy or does his wiki already have all the information for someone with a linux system and a command line to already attempt to turn the S-OFF? If you follow the steps I've copied below, it seems to say you can:

1) Connect to HBoot with a /dev/ttyUSB[x] command

2) Issue a "rtask C" command to the HBoot to mount a USB interface to the radio

3) Use another /dev/ttyUSB[x] command to connect to the radio

4) Issue a "AT@SIMLOCK=7,0" command to set S-OFF.

So ... if that's the case, why hasn't anyone tried it yet? Am I missing something? I must be missing something. Someone set me straight, lol!

Here's the relevant stuff, copied from his website:

From "wiki:Android/HTC/Vision/HackingNotes"

From "wiki:Android/HTC/Vision/HbootAnalysis"

Finally, from his latest Status update:
[G2 and Desire Z Android Development] OzJD:
It doesn't work, there's something blocking the access... You get ERROR, same is said for changing CID at present.
[G2 and Desire Z Android Development] xdviper:
The dev hasn't tried turning S-OFF yet, he wants to map out all instructions before he bricks the device just by running that command.

Unless otherwise stated in the IRC, that it doesn't work.

I'm hoping it does and plus even if we do end up buying the gold card and the S58 file, we need a sd-card and a empty blank simcard, how many people know or have equipment to reprogram/write to a simcard?

And just like one of the members said above, not a lot of people are going to send their phone to someone to have security off.

And also, that youtube video, by using that goldcard, it unlocks the baseband as well? If so then 2 birds with 1 stone!
[G2 and Desire Z Android Development] starkruzr:
Why is the "gold card" $2500? What does it actually do? Can't we just dupe it somehow?

More importantly, can we get an S-OFF handset in Cyanogen's hands?
[G2 and Desire Z Android Development] Cel1084:
A blank simcard and an USB simcard reader/writer is readily available on ebay for around 5- 10 dollars. :D

Not that it matters, it would seem like cheating if it was achieved that easily after all this wait.
[G2 and Desire Z Android Development] xile6:
I doubt you can just clone the smart/gold card. If you could they would be cheaper because of people selling clones.

Butback on track, we just gotta wait till the infromation / his work is released. And then we can go from there either it wil work or we will have to look for something else. But I have hopes n this becuse htc knows the command to unlock it we just gotta find it
[G2 and Desire Z Android Development] vipero07:
Did no one else notice in the youtube video the guy swapped out the SD card as well? I believe he is lying about the SIM rooting bit, and the truth is he has the code to do so (on the SD card). I could be wrong. Additionally the video isn't really proof of anything it could have been rooted before hand, and everything he does in the video is just for show / misdirection. Either way it will be rooted fellas, just be patient, look at how long some other handsets took to root. This is exactly why I've not purchased my G2 yet... the G1 is still running, and I like having my phone customized the way I want it.
[G2 and Desire Z Android Development] Novek:
That's the same thought that I had while watching that video... :p

On Topic... I really believe we'll have perm root this week, as the progress from TJ has been very nice this weekend!! :D
[G2 and Desire Z Android Development] xdviper:
Oh yes, That's what I want to hear. Progress has been going good, and look Motorola put eFuse on the droid X, and it's been partially* rooted and their still working on it. Lets not let that kind of **** deter us away. We WILL get root on this phone!:D

And also, in the video, he didn't go into recovery and show us "S-OFF" he just booted right in with a foreign simcard and got service.
[G2 and Desire Z Android Development] luis86dr:
When there's a will there's a way. This phone will be rooted, and once it is it will open a lot more options for other emmc locked android devices. Unless htc gets a grasp of us finding out and switch things up. Either way once this phones rooted I'm breakin out my jack daniels n takin a shot for all of us!

[G2/HTC Vision]
[G2 and Desire Z Android Development] androidtoy09:
I prefer Jack Gentlemen. Much smoother. Lol Get your shot glasses ready
[G2 and Desire Z Android Development] xdviper:
If they do, they'll pull another Apple. They will ship out the later G2's with updated firmware and patch up that hole.

Just like the 3GS, when it was first released they knew that there was a hardware hole and could be used to jailbreak, but then they fixed it up a month or two after shipping new revisions.

A shot of Patron from me, to you guys as well!
[G2 and Desire Z Android Development] mpmilestogo:
When I bought the HTC Magic in India as my first Android phone it came with no market, gmail, etc. No experience applications at all because Airtel locked things. Within 1 month I had a custom ROM loaded and XDA had given me the tools. I think we should strive for the most widely available, free, and extensible method to go to S-OFF. I think TJ will do his diligence on his path and when he's ready he will publish his findings. I'll take a large Bottle of Sam Smith's Pale Ale.

Thanks for offering :-)
[G2 and Desire Z Android Development] K900:
Not that G2, dammit!

Sent from my HDfied HTC Desire
[G2 and Desire Z Android Development] mpmilestogo:
Right. I got that one. Just offering a bit of historic perspective from some years ago. Sorry.
[G2 and Desire Z Android Development] stevencpoynter:
It

Its cool dude, I remember my g1 days. I was like "cool! What the hell is android?" Lol
[G2 and Desire Z Android Development] d0nkey:
That's alright! Let's just keep posting useless crap in this thread so that we never get and legitmate updates about the actual ROOT progress.

There is a reason that actual root info is not posted in here often. There are 50 replies after every 1 legit post saying "OMG THIS IS AW3SOME! I CAN HAZ ROOTZ SUMDAZE!!1!" and "+1"

So.. ****ing.. frustrating

/rant
[G2 and Desire Z Android Development] havikx:
agreed.

has any1 tried the S-off command yet on their g2 or is every1 scared of brick?
[G2 and Desire Z Android Development] l1nuxfre4k:
UPDATE:

Tried on Desire HD now,

The command from here:

http://tjworld.net/wiki/Android/HTC/.../HbootAnalysis

Does nothing on the Desire HD.

It accepts the command but nothing.

Update:

When u do it you get an ERROR that's all that comes up
[G2 and Desire Z Android Development] Novek:
Agreed... But did your post make the thread cleaner? Or this one?

We all should know by now that the actuall discussion on perm root is done on irc, and not here on xda. Xda used to be the place for devs to share ideas, knowledge, test code etc, but has now evolved (devolved?) to be a place to post apps/finished work/work in progress for BETA's etc...

Just face it... xda isn't the developers playground anymore :(
[G2 and Desire Z Android Development] ChiefzReloaded:
"+1" lmao kthnx o_O
[G2 and Desire Z Android Development] l1nuxfre4k:
a mod should come and clean it up i would agree :=)

Anybody got suggestions how to work around my fault? :p

it didnt brick my phone but it only gives me ERROR nothing else :S
[G2 and Desire Z Android Development] luis86dr:
A little excitrment and people are getting bashed for it? Are you serious ? Its topic related so if you don't like it why don't you apply to become a mod and clean up the forum to your holy likings. Else go to home depot, buy some wood, and build a damn bridge n get over it. People have the right to be excited. Yeah we should stay on topic but do not knock people for getting excited. That's my say. Don't like what I gotta say. Don't read my damn posts then.

Edit: yes this is at you donkey

[G2/HTC Vision]
[G2 and Desire Z Android Development] havikx:
i'm not sure what you are trying as the page you posted prior isnt valid.
[G2 and Desire Z Android Development] Macrophage001:
Just felt like re-stating this earlier post because of curiosity and to try and get things back on track. :D
[G2 and Desire Z Android Development] l1nuxfre4k:
what u mean? lol

im following these http://tjworld.net/wiki/Android
[G2 and Desire Z Android Development] starkruzr:
Several have tried, it produces "ERROR." By itself I don't think it's going to get us anywhere.
[G2 and Desire Z Android Development] havikx:
i dunno who the dev is or anything like that. i just read somehwere he had the S-off command pinned down, he just didnt want to run it cuz he was scared he was gunna brick his phone so he is doing more research into how the security works.

any1 gots lots of moneys or a spare g2 they dont need? :D
[G2 and Desire Z Android Development] l1nuxfre4k:
thats what i just did with my Desire HD!

Because they are very similar in the bootloader and there it should be the same commands,

the guy you mean is

http://tjworld.net/wiki/Android

that guide i followed,

he was afraid of running it because he sad he might brick it,
[G2 and Desire Z Android Development] shizenyasuya:
I've been thinking about trying it, but i want to do it step by step to make sure im not doing anything wrong. im not affraid of bricking (i'll just return it and say i dunno what happened) but i'd hate to brick it without actually doing the right things to confirm or de-confirm this method. also this method has apperently been attempted on a desire hd and it just gave an error message.
[G2 and Desire Z Android Development] havikx:
wow. frustrating, i can imagine.
[G2 and Desire Z Android Development] xile6:
Yea a step by step would be good. I know there is alot of people that wouldnt care about bricking. Even some that.just got the phone and wouldnt care anout returning it right back
[G2 and Desire Z Android Development] starkruzr:
Guys, by itself the command that sets S-OFF doesn't work. We know this; multiple people have tried it. There is more work to be done here. Stay tuned.
[G2 and Desire Z Android Development] ZeroSX:
I think its more tmo trying to cover their ass in that restoring the entire os to a fresh out of box experience in the offchance its legitimattely corrupted is better than having people whine about their amazon mp3 app being missing. They're trying to make it idiot proof, which screws us.