yashsingh1/xdaforums huggingface dataset:
[G2 and Desire Z Android Development] hobbit19:
Has anyone tried the thread off MSU and whether the read /

write memory modem?
[G2 and Desire Z Android Development] Dalamak:
I haven't read every post lately, but with my daily glancing, I have heard no mention of advancements or failures on the Jtag side. I know we had at lease one Dev with a torn down Jtaged interfaced G2
[G2 and Desire Z Android Development] philosophics:
Entirely differnt topic JTAG is.

Yes, it's a method of rooting but usually last resort...
[G2 and Desire Z Android Development] shinkinrui:
Hey guys, I know nothing about all this, so forgive me if this is meaningless.

Someone recently discovered that typing the word "stop" and pressing enter on the hardware keyboard from a lot of different text entry boxes(for instance, the messaging app, a market search, or even the autosearch that pops up when you start typing from the home screen) will actually run the command and stop all processes. The phone will then freeze and stay frozen until a battery pull or typing the word "start" and pressing enter. Does this mean a bug similar to the one that first got the G1 root exists on the G2? Could this somehow be used? Note that this happens on my stock G2, I haven't even gotten temp root on it at all yet.

Someone posted a logcat of what happened when they typed "stop" and pressed enter in the stock messaging app:

http://xdaforums.com/showpost.php?p=8921453&postcount=13

EDIT: I even just confirmed it works from the lock screen(open keyboard, press lock button, press lock button again to display lock screen, type "stop" on keyboard and press enter). So it appears to be from any stock app.
[G2 and Desire Z Android Development] KiNG OMaR:
this really is interesting... when I type start it does a soft reset...
[G2 and Desire Z Android Development] xile6:
Someone try this stop command then do and adb push to system. Then start command. And tge reboot to phone to see if it sticks. I woyld try but I just woke up and tge pc is way over there and off
[G2 and Desire Z Android Development] connoisseur:
Unless I'm totally wrong, it probably won't because all stop start does is control the dalvik engine. But definitely worth a try... I'll try it as soon as I'm done here (working).

You can accomplish the same thing by running the stop command on adb. The cool thing here is that the keypresses seem to be mapped to terminal like the g1 was in rc29.

Maybe we can use this as another exploit?
[G2 and Desire Z Android Development] scrizz:
doesn't work here.....
[G2 and Desire Z Android Development] fastludeh22:
Works from stock mess app, even on sdcard rom here. This would be great if we didn't have temp root, could prob find a way to temp root from here. Here is the problem, the chip is power on write protect, so even from a root prompt, you can't write changes.this is something the g1 didn't have, so made this the easy way in...

Not saying no one should try it, I would play around but I'm currently headed home, but 6 hrs away. Just don't get your hopes up....
[G2 and Desire Z Android Development] fosormic:
Memory partitioning?

Hey guys, was thinking about the odd partioning of the memory. What has been speculated so far is that it may be for future expansion or whatnot.

Well, reading from the research that has been done, the memory chip can be put in reado only on a part by part basis (from post #1: Specific segments of the iNAND may be permanently, power-on or temporarily write protected. Segment size can be programmed via the EXT_CSD register).

I also saw mention that the way the writes to memory are being kept until rebooting by means of the Linux caches. Now that makes a lot of sense, but then... how big are the caches??? If I start writing too much do I start to lose things I have written? Are the caches the same size as the write protected memory ....!? I mean, do we have enough RAM to cache a lot of writes to the protected area or am I missing something?

So, what if the "missing" memory is being kept Write Enabled and being used as this cache to the file system? I know proving or disproving so leads no further on the ultimate objective, but if it can be proven, then might shed some insight on what is going on... Imagine if we could for example use the Write Enabled enabled part as the File System and simply ignore the Write Protected part? It is wishful thinking but would be fun.

If you made it this far reading this, well thanks for doing so. Have a great Sunday now.
[G2 and Desire Z Android Development] janus zeal:
Tried this and couldn't get passed the read only fs on /system. umount -f didn't let me unmount.

Edit: Also saw this in logcat: E/Tethering( 1439): active iface (usb0) reported as added, ignoring

lol.
[G2 and Desire Z Android Development] fearedbliss:
Speaking about how much memory is in the cache.. maybe we can continuously write random data to the memory until there is an overflow. From there we can try to inject data specifically targeting to disable the write protection.

We can also ponder on how we can view and maybe even delete partitions on the internal memory. Maybe there is a secondary partition that is being mounted and is being used as the cache itself. If we can manage to delete that partition, and using the memory overflow that I spoke above in combination, maybe, it can become read/write enabled.
[G2 and Desire Z Android Development] janus zeal:
[januszeal@freyr:~]$ adb shell
$ su
# mount -o remount,rw /dev/block/mmcblkp025 /system
# cd /system
# touch test
# stat test
File: "test"
Size: 0 Blocks: 0 IO Block: 4096 regular empty file
Device: b319h/45849d Inode: 47 Links: 1
Access: (0666/-rw-rw-rw-) Uid: ( 0/ UNKNOWN) Gid: ( 0/ UNKNOWN)
Access: 2010-11-01 00:45:49.000000000
Modify: 2010-11-01 00:45:49.000000000
Change: 2010-11-01 00:45:49.000000000

# reo^H
re: not found
# reboot
[januszeal@freyr:~]$

Then,

stat /system/test
stat: cannot stat '/system/test': No such file or directory

Not a big surprise I'm sure. Oh well.
[G2 and Desire Z Android Development] K900:
Don't know if someone suggested it before, but I think that it is possible to reverse engineer a RUU so that it skips the hash checks and thus we can push any files to the phone. It won't give use permanent write, but it can still help in the development

Sent from my HDfied HTC Desire
[G2 and Desire Z Android Development] renn9420:
Have to say to all of you guys that you guys are great and very commited. Most people would have given up at temp root. I am proud to be apart of this community. Thanks for all your time and effort in trying to get perm root.

Sent from my T-Mobile G2 waiting patiently for #.
[G2 and Desire Z Android Development] xile6:
The problem is nothing sticks while phone is booted up. And pushing from fastboot checks tge sign so thats a no go
[G2 and Desire Z Android Development] emi.bu:
I really have no clue if this is relevant or not, but I recall that in my hi-school years, some time in the 90's... some geniuses at my school developed a way to keep all our lab PCs clean/read-only... This was in DOS 5.1 I think...

They loaded this small piece of assembly code into an area of the disk that is not used by the filesystem. It copied itself into the very last KB of memory and instructed DOS not to report or use that section. Interrupt 21h got remapped in order to disallow certain file system actions.

The only indication we had that this thing was running was the fact that "mem" reported 639K of base memory instead of 640k. The work-around was to used a memory editor and change an instruction from a conditional jump to a nonconditional jump... effectively disabling it directly in memory.

You'll have to forgive my lack of knowledge about OSs, as this may be inaccurate or irrelevant, but, this problem reminded me of that.. Thought I'd share it.
[G2 and Desire Z Android Development] lightningtrip:
yeah, basically a "permission based shadow partition"...
[G2 and Desire Z Android Development] AustinAce:
I think now it's called freeze something. Every time you log/off is erases what was saved on the hardrive except for certain things.
[G2 and Desire Z Android Development] cmstlist:
I was involved in managing a computer lab that used that software on Windows NT. It was called Deep Freeze.
[G2 and Desire Z Android Development] janus zeal:
Deep Freeze, we've got it at work. It works the same way the emmc protection does though, the changes are never written to disk.
[G2 and Desire Z Android Development] hockeygod1225:
I have not seen this mentioned anywhere else yet so i figured i would share. I have noticed that my baseband and Kernal versions differ from a friends. mine seem to be newer than his.

Here are the differences:

His :

baseband- 12.18.60.05p_26.01.001.17.m2

Kernal- 2.6.32.17-g19ec394 Kernal@and18-2#1

Mine:

Baseband-12.22.60.09bu_26.02.01.15_m2

Kernal-2.6.32.17-g814e0a1 htc-kernal@and18-2 #1

Anyone know if this could help?
[G2 and Desire Z Android Development] renn9420:
Latest source code dropped for Desire Z and G2/Vision. Just read it on Androidspin.com

Sent from my T-Mobile G2/Vision patiently waiting for Root!
[G2 and Desire Z Android Development] LxDroid:
G2 by HTC (TMUS) BlueZ Source Code http://dl3.htc.com/RomCode/Source_and_Binaries/htc_G2_blueZ.zip
[G2 and Desire Z Android Development] fastludeh22:
Have him boot into fastboot by holding power and vol down. Read what hboot is, or take a pic of screen. Where did his phone come from?
[G2 and Desire Z Android Development] hockeygod1225:
Here is a picture of his hboot
[G2 and Desire Z Android Development] ZeroSX:
Nand is unlocked on his phone, do wants. Tell him not to update!
[G2 and Desire Z Android Development] pixelwix:
:O he has S Off!!!
[G2 and Desire Z Android Development] Doktaphex:
Get that ROM dumped and over to someone with some skills. :D
[G2 and Desire Z Android Development] tuzonghua:
Should probably post instructions on how to dump the ROM.....
[G2 and Desire Z Android Development] grivad:
I also noticed "System Info" as one of the options below, and lower HBOOT and Radio versions, and date at the bottom (build date?)..

What does System Info do?

Where did this phone come from?
[G2 and Desire Z Android Development] dyndragon:
1. we already know that HBOOT can not be downgraded for technical reasons.

2. Getting a dump would really only be useful for...well...posterity. Perhaps...

3. What everyone would like to know is WHERE this phone came from?
[G2 and Desire Z Android Development] xdviper:
That phone is gold to us right now.
[G2 and Desire Z Android Development] hockeygod1225:
I cannot really say where it came from.... but i have access to it until tommorow so if anyone can instruct me as to what to do or put me in contact with the people who can utilize it i would greatly appreciate it.
[G2 and Desire Z Android Development] paulobrien:
The update zip of this is actually floating around, sadly as it's not signed, it's not overly helpful. Sorry to be the bearer of bad news. :(

P
[G2 and Desire Z Android Development] hockeygod1225:
The source who sent this to me is sending be an sd card with a new update on it. He said make sure not to accept any over the air updates or manually install any as they would brick the phone. He said to install the new update that will be loaded on the sim once it arrives and it will update the device to the newest software.
[G2 and Desire Z Android Development] dyndragon:
Be sure to tell us what's on the SD card (i think you meant SD Card when you said SIM later...) before you do anything or insert it into the phone...would hate to have you lose S-OFF via that update.
[G2 and Desire Z Android Development] havikx:
Get dumped of current and updated system? Just to have around?
[G2 and Desire Z Android Development] xdviper:
Whoa, hold up... First you said "it's a friends phone" ok that kinda explains why you have access on to it until tomorrow, but then why is your source sending you a SDcard? And When is that sdcard going to get there?

I don't get it....

And also before you stick that sdcard into the phone, get that file to us. Thanks!
[G2 and Desire Z Android Development] renn9420:
Question what is the process of when let's say you update a system app from the market? Example Google Sky. It removes old system app and updates to Market app. The reason I ask then can we use that process to somehow give us perm root?
[G2 and Desire Z Android Development] cmstlist:
When you update a system app from the market, the new version resides in the data partition, and the one in /system goes dormant. It never actually modifies the system partition. If you uninstall updates from the market it goes back to the version in /system.
[G2 and Desire Z Android Development] hockeygod1225:
The device is from a friend who works for T-Mobile. He had the phone sent to him from htc to demo. It seems to be an early engineering sample. Htc is sending him the sd card and told him to run it as soon as he can. which he will not do but instead give to me. I spoke with him and he received the sd card today and will be emailing me a copy of any and all files on that sd card within the next few hours. Also what is the best way to copy the files from the phone?
[G2 and Desire Z Android Development] grivad:
Is it reasonable to assume that this update is what locks the eMMC and/or updates the HBOOT? If so, can we deconstruct this update to determine how it's locked, and therefor, how to unlock it potentially?
[G2 and Desire Z Android Development] hockeygod1225:
Thats what i was thinking and figured somebody more qualified might like to rip it apart. I should have that file sent over to me shortly.
[G2 and Desire Z Android Development] d0nkey:
Can't assume anything.

But it wouldn't hurt to have the data that is on it. Or have access to that phone in particular. Someone should get him in IRC to give him some instructions to see what exactly this phone and sd card realy is.
[G2 and Desire Z Android Development] Evostance:
Do not update that phone lol nor connect it to a network of any kind.

Can someone here give him a detailed tutorial on how to extract all the files we need please
[G2 and Desire Z Android Development] minotauri:
I PM'd you.
[G2 and Desire Z Android Development] adwinp:
It's safe to assume the "update" contains a locked hboot/radio combo.
[G2 and Desire Z Android Development] xile6:
Yea htc knews its a demo phone thats unlocked and tgey probably just caught it. But im willing to bet all that is on the card is the .zip thats we readly have
[G2 and Desire Z Android Development] franky1029:
has anybody thought to look into the GPU the way the Wii was preventing this? i dont really know if this is plausible, or how exactly the wii was protecting the system, just an idea.
[G2 and Desire Z Android Development] whgarner:
but if the phone is currently unlocked and functional with the engineering build this could be downloaded and duplicated or reverse engineered to determine how the nand was lockable and unlocked. the zip on the sdcard would lock it back up we assume. is there a way to dump the boot, recovery and rom before reupdating, and compare the differences, assuming htc did nothing more than. lock the nand on the current rom.

bill g.
[G2 and Desire Z Android Development] Veggies:
I don't remember the partition tables andam too tired to look before posting but using dd to copy the partitions

dd if=/dev/block/mmcblk0p21 of=/sdcard/boot.img

dd if=/dev/block/mmcblk0p22 of=/sdcard/recovery.img

dd if=/dev/block/mmcblk0p22 of=/sdcard/system.img

And now I realise how to do this was posted before.
[G2 and Desire Z Android Development] rhcp011235:
Which is the radio.img?
[G2 and Desire Z Android Development] Markley02:
I dont understand why everyone is so interested in the SD card that HTC has send to hockeygod. There might be a chance that it will lead us to how it locked down the phone, but even if that is figured out......ours is already locked.

I would be way more interesed in the SD card that came with the phone in the first place. From what I understand, before the phones are shipped they are updated via the sd card. After the phone updates it deletes the file from the sd card. (that is how paul is able to delete the apk's) I would try recovering the old file from the sd card which should be a signed zip with s-off. There are plenty of programs out there that can recover deleted files.
[G2 and Desire Z Android Development] paulobrien:
The device was probably always s-off hence it could flash unsigned zips.

It's a dead end.

P
[G2 and Desire Z Android Development] badgaz:
That phone is the one, it's going to destroy the matrix and set us all free. We must speak to the oracle. The prophecy was correct.
[G2 and Desire Z Android Development] jjfreak5:
But wouldn't you think figuring out how they locked it down can help figure out how to get it unlocked? I mean I'm not genius and not working on this, but it always helps me when I know how someone does something so I can figure out how to undo that...

Either way I think one of these two can help out. I will be no help as I don't have a G2 and especially the knowledge of how to unlock down a phone.
[G2 and Desire Z Android Development] MetalSearGolid:
Data recovery might not be a bad idea to try, however, I don't know of any utilites to do it from the phone or how to do it over ADB. Unless there is a way to mount / via USB onto a PC (as opposed to /sdcard), which maybe there is a way to achieve this using temp root.
[G2 and Desire Z Android Development] janus zeal:
Maybe I misunderstood, but wasn't Markley02 talking about the original SD card? What's wrong with mounting that on a computer and doing data recovery?
[G2 and Desire Z Android Development] EdTeach1680:
nothing is wrong with mounting it in a card reader, some people forget that sd cards have those... go to WLMART and get yourself the targus SDHC to usb reader.... it comes with an 8GB class 2 "mine benched at class 6" for 20 bucks and google "recover deleted files lifehacker" and bobs your uncle!
[G2 and Desire Z Android Development] xdviper:
There's a program from Priform that also makes the app CCleaner, they have a data recovery app, should check that one out

Edit: here it is http://www.piriform.com/recuva
[G2 and Desire Z Android Development] PlatinumMOTO:
easeus data recovery wizard is what I use it's really good.
[G2 and Desire Z Android Development] andre104623:
This phone is the key to getting full nand unlocked. I dont know how your friend got this phone or how it was leaked from HTC but this is the sign of hope. This phone has the ENG bootloader installed this phone was for a dev. If this phone was leaked that must mean more must be out there.
[G2 and Desire Z Android Development] paulobrien:
andre104623, with all due respect, what are you basing that on?

HTC send their test devices out S-OFF, often with engineering hboots on. That doesn't make them helpful.

We have a dump with an engineering hboot in, like I say, it's not helpful.

P
[G2 and Desire Z Android Development] andre104623:
Also just a thought can a Bootstrap method work? I'm just putting a idea out there.
[G2 and Desire Z Android Development] Flippy125:
I have recovered data for a few people before. I haven't used my stock sdcard so the sectors won't be overwritten
[G2 and Desire Z Android Development] andre104623:
I just want to be on the same page don't flame me if Im wrong the reason you cant get full root with nand is because /system is read-only and cant be flashed
[G2 and Desire Z Android Development] paulobrien:
What do you think you're gonna find on the sdcard?

At best you'll get an unsigned zip that only flashes on S-OFF devices.

Basically, you'll get this - http://u.115.com/file/t5a13b6e88

P
[G2 and Desire Z Android Development] Flippy125:
If it's the same thing its pointless, but if it isn't we can go through and see exactly what is causing the lockout (as in what commands are sent from what)

EDIT: and this is assuming they use the same SDcards and don't zero out the data before they ship

EDIT2: Our best chance is to get a whole bunch of people to attempt this method incase they are zeroing out the cards and missed a few.

EDIT3: I'm just brainstorming here now. Is there a way to boot a custom recovery from the SDcard? If so we should find a way to mount the NAND through USB
[G2 and Desire Z Android Development] starkruzr:
This thread I created is relevant to the topic, so I thought I'd link it here.

http://xdaforums.com/showthread.php?t=828210

Would you pay HTC to NAND-unlock your G2?
[G2 and Desire Z Android Development] veritasaequita:
the only files i founf in daya recovery looked like this (fseventsd-uuid) and 0USIC
[G2 and Desire Z Android Development] Flippy125:
Would you mind uploading them in an RAR? I think HTC may be reusing SDcards. I found a .plist file from doubleTwist

Here are the files I recovered: http://www.megaupload.com/?d=5KH1ZB0B
[G2 and Desire Z Android Development] veritasaequita:
sure no problem, give me just a little while to get situated from update and i will sure take care of it.
[G2 and Desire Z Android Development] K900:
Now we know that NAND is unlocked when flashing .zips with stock recovery (thanks to @PaulOBrien), might we be able to use adb in it? For example, one could make it try to flash a huge zip full of /dev/urandom, and while it is decompressed (should take long enough), try to push something with adb. That really depends on a) adb running in recovery and b) the exact time when nand is unlocked. My DHD is still on its way, so can't check

Sent from my HDfied HTC Desire
[G2 and Desire Z Android Development] Brondar1:
Google google apk exploit

Yesterday as I pushed the OTA to my phone it failed because I had used O'brian's Goggle delete program. After reflashing stock and getting the update the whole event had me thinking about somone using the patch failure as an exploit. Since the ota is looking to patch an apk that no longer exists is there a way to program and insert a dummy apk that accepts the patch and then is able to execute code to either unlocks nand or turns S-off. You bascially are executing a signed ota at a point in time where the phone will allow permanent changes. It is looking for a program which is still supposed to be there and now not finding it there has to be a hole there to fill in and gain access. I am not a programmer but just a thought...
[G2 and Desire Z Android Development] K900:
I don't get it. The update has nothing to do with apk's, it doesn't run anything but for itself. Then how are you going to inject your code?

Sent from my HDfied HTC Desire
[G2 and Desire Z Android Development] Brondar1:
the update tries to patch the google goggles APK and when it cant find the deleted APK the OTA fails. I thought if there was a way to fool the ota into finding the file it wants to patch but can no longer find, exploiting that.
[G2 and Desire Z Android Development] adwinp:
This was already discussed. You can't, since ro.secure=1 in stock recovery.
[G2 and Desire Z Android Development] K900:
The thing is IT PATCHES. To patch, it verifies the file's hash. If the hash is broken (or the file isn't there), it fails. How are you going to exploit that?

Sent from my HDfied HTC Desire
[G2 and Desire Z Android Development] K900:
So we can only push signed files? Bad...

Sent from my HDfied HTC Desire
[G2 and Desire Z Android Development] Brondar1:
I was just trying some lateral thinking. Figured there might be a way as you run Obrian's update.zip to at the same time push back in a fake google goggle update apk that will initally accept the ota patch but then executes code to turn s-off. The ota would still fail but you would have utilized the ota as a key to get in the door just long enough to do what you needed to unlock. Just a cazy idea...
[G2 and Desire Z Android Development] K900:
No. I suggested just that, that won't work. Oh, and you can NOT run native (Java) code from recovery

Sent from my HDfied HTC Desire