yashsingh1/xdaforums huggingface dataset:
[G2 and Desire Z Android Development] defconoi:
can we get a dump of the bootloader? Also what can we do to monitor the bootprocess before the linux kernel? Can we dump the memory?

seriously we need to find a way to replace the bootloader with an open version if at all possible, htc/motorola are on the right track in screwing us all over. Maybe we can open up there devices since they all refuse to

It'd be badass if we could create a type of bios/bootloader level rootkit

idea: we need some ppl to social engineer HTC into giving us more information :)
[G2 and Desire Z Android Development] damnoregonian:
you have it completely backwards.

rmt_storage exists because the radio can't talk to emmc.

it's used so the radio can store it's efs in partitions 13 and 14. they have been dumped, save commands have been issued to the radio, and they fail if rmt_storage is killed.
[G2 and Desire Z Android Development] Zak Jones!:
I'm sure there's a lot of people (like me) watching this thread that don't know enough to contribute technical knowledge, but own a G2.

I'm sure there's a lot of contributors, or at least a couple, who don't have G2s yet.

If you guys post ADB commands and instructions and such for us, we'll reply with whatever it was you needed. :)
[G2 and Desire Z Android Development] hiko36:
Has anyone thought about the mytouch slide method where we faked it through with a legitimate update.zip and then once the keys had verified pushed an alternate update.zip to the phone via adb?

Edit: Only reason I haven't tried this is because I'm at work and don't have ADB. I'm also not sure what files we would use to 'fake' it. Just tossing out an idea.
[G2 and Desire Z Android Development] cmstlist:
I suspect this wouldn't work. The exploit in question was able to root test builds of Froyo for the N1 (all the FRF builds up to FRF85B - this is how I rooted mine), but it was fixed after the OTA upgrade to FRF91. So I'd bet that this is fixed on the G2's version.
[G2 and Desire Z Android Development] linkmaster_6:
This is probley gonna be a stupid question but if we cannot get root to "stick". How is HTC/ T mobile gonna get a update to "stick". Wont their own update get rolled back?
[G2 and Desire Z Android Development] cmstlist:
An HTC/T-Mo update would send the phone into recovery mode to apply a signed update file. The recovery partition would recognize the update as legit and allow the real system partition to be modified permanently.
[G2 and Desire Z Android Development] gee one:
What exactly has to match for the recovery to accept the update? I can see that there are some public keys, but I think they come with the update, not the phone.
[G2 and Desire Z Android Development] VValdo:
Please check the wiki, which discusses how OTA is thought to work.

That said-- assuming it works like all other OTAs, the thing that has to match is the signed update.zip image. If you don't know what that means, go read about digital signatures.

W
[G2 and Desire Z Android Development] jeregrine:
The current status of all our work is kept up to date in the wiki.

We currently have nothing easy to test, just be paitent everyone is working very hard.

Also if the forum mod could put the wiki link into the top level sticky.

Thanks!
[G2 and Desire Z Android Development] gee one:
These all appear to be public key signatures, so as long as the signing key matches the public key in the update, then the update should pass verification, no?

I think we might have to rewrite and resign the hashes on the parts that we can't compile from source, but what would stop us from signing everything with the testkeys and then flashing the update?
[G2 and Desire Z Android Development] krayshunist:
The recovery doesn't accept test keys. Read the wiki, people.
[G2 and Desire Z Android Development] gee one:
The question I was getting at is what signature does the update.zip have to match? The ones in the update itself or are there a set stored permanently on the phone that the signed hashes are compared against?
[G2 and Desire Z Android Development] hiko36:
I found this while mucking around in /system. Seems relevant.
[G2 and Desire Z Android Development] gee one:
That's HTC's public key- My theory is that the OTA will have to match those keys for the update.zip file. There are other sigs in the update file that, presumably, the image files have to match.

Would we be able to insert our own OTA keys or would they be "refreshed" by the eMMC before the phone goes to recovery?
[G2 and Desire Z Android Development] hiko36:
That was kind of the idea I was floating last night. Seems to me that we should be able to root the G2 the same way the slide was rooted. Couldn't get a definitive answer, though.
[G2 and Desire Z Android Development] xile6:
Just throwing this out there but can someobe take the ota key and sign an update with it? Then flash and see if it takes? Id do it but not at my pc, but if no one trys ill do it n the moring
[G2 and Desire Z Android Development] grennis:
Sure, no problem. Can you break public key cryptography by morning?
[G2 and Desire Z Android Development] xile6:
Did not know that. some how some were everything got lost in the forum :P but yea i thought that he found the commands but didnt run them in fear or bricking. but

thanks now i know
[G2 and Desire Z Android Development] bsnelson:
If the developers were smart (and I hope they weren't :) ), they would have coded a "challenge-response" mechanism that controlled access to unlocking the NAND. It could be a simple, breakable challenge (much like some hard drives used to use), or it could be a who-knows-how-many-bits RSA based challenge that is computationally impossible to break. This would allow authorized software to unlock and update (i.e. a legit signed update) the device, but keep us out.

That's what I would have done, and while I have been a software engineer for 21 years, I'm not an expert in this area.

Brad
[G2 and Desire Z Android Development] starkruzr:
I hope it's something more like "we just don't have it set in the right mode" than a 2048-bit RSA response.
[G2 and Desire Z Android Development] brendanmurphy:
If its the 2048-bit RSA route Perm root will never be obtained. Milestone users have been trying to unlock the bootloader for months with no luck
[G2 and Desire Z Android Development] naria01:
If thats the case, then bye bye G2 and HTC...
[G2 and Desire Z Android Development] MacDegger:
If it's a key ... shouldn't the official ruu's and the two OTA updates not also be carrying that key?

If I had way too much time, the soldering skills and a couple of spare DHD's, I think that reading the memory of a DHD as it's updating (and comparing that to the second update) would be quite enlightening.

I wonder if that could even be done, or if the combination of lag, error and voltage difference introduced in the system would screw things up ...
[G2 and Desire Z Android Development] adwinp:
He's loading DIAG.zip from that sdcard.
[G2 and Desire Z Android Development] DocNinja:
They've done it. Writing to system is persistent.
[G2 and Desire Z Android Development] SupremeBeaver:
how do you know?
[G2 and Desire Z Android Development] thatruth132:
we have root , i repeat we have root
[G2 and Desire Z Android Development] naria01:
if you go to #g2root on freednode IRC webchat, you would see for yourself
[G2 and Desire Z Android Development] Novek:
Wonderful!! Now we just need some ROMs, and I'll guess cyan will be first... :D
[G2 and Desire Z Android Development] userfriendlyme:
Rooted yes!!!!

Congrats to all the hard work put into rooting this phone. It was def fun to watch on IRC how it all went down.
[G2 and Desire Z Android Development] unforgiven512:
I just creamed my pants.
[G2 and Desire Z Android Development] jjlean:
Is the conversation posted in wiki?... Good job guys!
[G2 and Desire Z Android Development] userfriendlyme:
yes its in the logs for 11/9
[G2 and Desire Z Android Development] androidcues:
Now we can get on with our lives mine was on unwritable hold.
[G2 and Desire Z Android Development] PlatinumMOTO:
This thread should have a big huge T H U N K title next to it!
[G2 and Desire Z Android Development] sheek360:
grats and huge thnx to all the devs
[G2 and Desire Z Android Development] KiNG OMaR:
BONER!!!!!!!!!!!!!
[G2 and Desire Z Android Development] worldestroyer:
Wonderful work, thanks to all the devs
[G2 and Desire Z Android Development] philicibine:
+1
[G2 and Desire Z Android Development] carlosmontanez:
Great Job to all those that contributed to the rooting of the G2! You guys ROCK!
[G2 and Desire Z Android Development] kevdawg:
Congrats guys! This is fantastic news!
[G2 and Desire Z Android Development] thugjedi:
wow just got this phone was little worried about this i knew it would it fixed soon but damn. it was between this and the mytouch 4g and hd7 couldn't be happier
[G2 and Desire Z Android Development] segelfreund:
Thats Great News.

Many Thanks to all def´s.
[G2 and Desire Z Android Development] valve90210:
Where can I find the wiki?
[G2 and Desire Z Android Development] Noyabronok:
I found this log of the channel conversation http://irclog.netripper.com/?chan=G2ROOT. I'm going through it now to confirm, but I'm a little worried because the channel status says "no perm root yet" when I logged in just now.

Edit: Here's a juicy quote I just found in there:

13:06	gartral|p	Whha.. we have permaroot?

13:06	scotty2	yes

13:06	scotty2	we do

13:06	scotty2	45% of the time.
[G2 and Desire Z Android Development] noodles2224:
I also went through it but it doesn't say anything that they have gotten it..
[G2 and Desire Z Android Development] userfriendlyme:
:)

most certianly does i would read more carefully.
[G2 and Desire Z Android Development] touchpro247:
[09:02] <scotty2> i still can't believe we could have had this a month ago.

[09:04] <g2man> topic says no perm root yet

[09:05] <g2man> :(

[09:05] <scotty2> lol

[09:05] <scotty2> it's technically correct

[09:05] <scotty2> i don't think anyone has copied busybox and su to system yet

[09:06] <tmzt_dg2root> rooted

[09:06] <tmzt_dg2root> $

[09:06] <tmzt_dg2root> non OTA confirmed with scotty2's module

[09:06] <scotty2> OTA confirmed with mine

:D
[G2 and Desire Z Android Development] MERKJONES:
[06:13:27:AM] * stridger changes topic to 'T-Mobile G2 Root | Read This FIRST: http://is.gd/fYL39 | PERM ROOT CONFIRMED! | Keep it Legal | Wiki http://goo.gl/aXNr | ThinkTank http://goo.gl/2xKr | Channel Logs http://goo.gl/lUYSX | Kernel Source http://is.gd/g1Fhc | OTA, GPL, General & Dev Chat #G2-DEV | It's not a ****ing rootkit! Any Question check the WIKI first!'
[G2 and Desire Z Android Development] steviewevie:
I've only skimmed through the logs, so have probably missed a lot of stuff, but it sounds to me like they've managed to write to the eMMC, but still have a load of work to make it easy/repeatable.
[G2 and Desire Z Android Development] userfriendlyme:
they've already figured that out also. its been made more stable and works its been repeated this def works.
[G2 and Desire Z Android Development] theartar:
If anyone doesn't want to wade through the whole log, skip to 12:03.

Big high five to all those who did the dirty work to make this happen. :D:D:D
[G2 and Desire Z Android Development] steviewevie:
Cool, I subsequently saw my interpretation was a little out of date.

Here's some stuff from the log summary :
[G2 and Desire Z Android Development] droidgren:
This is the interesting part. It's proably posted, but it's so epic so I post it again :)

12:03	scotty2	hahahahahha
12:03	scotty2	****ing rooted
12:03	scotty2	now i smoke
12:03	wootty	Done it?
12:03	scotty2	yep
12:03	scotty2	we're gold

13:03	scotty2	# cat /proc/mounts | grep system
13:03	scotty2	/dev/block/mmcblk0p25 /system ext3 ro,relatime,errors=continue,data=ordered 0 0
13:03	scotty2	none /system/etc tmpfs rw,relatime,gid=10072 0 0
13:03	scotty2	none /system/bin tmpfs rw,relatime,gid=10072 0 0
13:03	scotty2	/dev/block/mmcblk0p25 /mnt/debian/debian/mnt/system ext3 ro,relatime,errors=continue,data=ordered 0 0
13:03	scotty2	# ls -l /system/test
13:03	scotty2	-rw-rw-rw- root root 0 2010-11-09 03:00 test
13:03	scotty2	# uptime
13:03	scotty2	12:03:02 up 4 min, load average: 2.73, 2.15, 0.98
13:03	tmzt	okay, forget remove, how do you suspend mmc like you were doing?
13:03	scotty2	that's the best proof i can give atm
13:03	scotty2	i've booted like 5 times
13:03	HomerSp	Mmm
13:03	scotty2	trust me
13:03	scotty2	file's still there
13:03	scotty2	:)
13:03	HomerSp	Proof enough for people who understand
13:03	scotty2	so ya - i'm 100000% sure wp is off
[G2 and Desire Z Android Development] funkadesi:
my question is that, did the source code released by HTC had a big play in this accomplishment?

If so, I think we can give a tip of the hats to HTC as well...

Just saying..
[G2 and Desire Z Android Development] rUsTyRuSs:
.............. Seriously!?!
[G2 and Desire Z Android Development] PlatinumMOTO:
No way because scotty and half the devs from #g2root already reverse engineered it 2 days before the code was released.
[G2 and Desire Z Android Development] starkruzr:
So, some burning questions that remain with me:

1) can this be used to flash a new recovery?

2) can this be used to permanently turn WP off?
[G2 and Desire Z Android Development] PlatinumMOTO:
@PaulOBrien: And now, G2 S-OFF. Nice.

answer to your question.
[G2 and Desire Z Android Development] Andrew_Wiggin:
So how long until we see a user friendly guide? I ask cause I'm a noob
[G2 and Desire Z Android Development] telsin:
Based on the irc logs, looks like a couple days.
[G2 and Desire Z Android Development] raitchison:
Awesome, looks like I'll be giving TMO a call this week and getting a G2 after all.
[G2 and Desire Z Android Development] Soaa-:
Props to all those involved with rooting the G2. You have my thanks.
[G2 and Desire Z Android Development] TL24:
Daaammmmnnn.... I cannot wait for the guide to be released! Big ups to all the devs who were involved in getting the G2 rooted!! I'd buy y'all a shot of Henny if I could! lol
[G2 and Desire Z Android Development] g1doobie:
Does it matter if u download the OTA? Didn't want to install it if I'm gonna have to downgrade later on
[G2 and Desire Z Android Development] userfriendlyme:
no it doesn't according to whats been posted it works with the OTA or pre-OTA.
[G2 and Desire Z Android Development] Meister_Li:
YES! Awesome! Time to retire the good ol' Milestone and get a Desire Z! Thanks a lot for your awesome work, guys! :D
[G2 and Desire Z Android Development] CBConsultation:
Awesome work. Congrats to the devs.
[G2 and Desire Z Android Development] Mikey:
Guide to permaroot: http://xdaforums.com/showthread.php?p=9109921
[G2 and Desire Z Android Development] Corylulu:
He was referring to the morning of 10/11/2110
[G2 and Desire Z Android Development] xile6:
If my friend wasnt n jail yea I could. But I maybe I got it wrong but isnt there a .pem in the ota zip? Is that not the say as the testkey.pem

Yea I know im just looking @ file name but hell im sleepy I should of been sleep and hr ago. Either way ill try some stuff n tge morning
[G2 and Desire Z Android Development] gee one:
That would require hacking the encryption, which would take dozens of years.

The OTA keys are just the public half of the key. HTC has the other, secret half that was used to "encrypt" the signature.
[G2 and Desire Z Android Development] hiko36:
So before I extrapolate any further, is the eMMC working as an equivalent to what the hypervisor on the PS3 was doing?

I was under the assumption that once we faked it with a proper update.zip, we could slide our own in there before the actual update began. Is the code verified a second time upon boot? Or am I misunderstanding something?
[G2 and Desire Z Android Development] gariak:
To "slide our own in there", we need adb in recovery. G2 doesn't have that. The 3e recovery is locked down.
[G2 and Desire Z Android Development] hiko36:
And that brings me up to speed. Thank you.
[G2 and Desire Z Android Development] cmstlist:
Has it been verified that changes to recovery *never* stick? E.g. if you temp root, try to flash_image another recovery, and then immediate adb reboot recovery, you still end up in stock recovery?

I commend the creative bunch working on this... I hope you find something substantial soon!
[G2 and Desire Z Android Development] gariak:
No one has another recovery to try, that I know of. In addition, the flash_image binary used in the past is compiled for mtd, not mcc. Also, the whole eMMC is covered by the write protection, as far as we know, so there's no reason to think it will work and I don't know that anyone's working on either one. Give me a re-worked recovery image and a recompiled flash_image and I give it a try though.
[G2 and Desire Z Android Development] renn9420:
Looking into how to jailbreak iphone through boot method and see if it can be done for th G2. Cuz no matter the ota updates the iphone receives, it stays jailbroken. Think that might be solution. Could be wrong though.
[G2 and Desire Z Android Development] Jorsher:
Hate to bring up OTA again, but... If it's believed that the update script is written before the phone reboots, why is it not possible to hijack the installation script to maybe open the NAND up for writes based on the verified ROM, but point to another ROM after the memory is set to write? Sounds way too easy, but I'm curious why it wouldn't work anyway.
[G2 and Desire Z Android Development] Flippy125:
To all the "I don't know what to do but ill help..." people... you can't do crap right now all you are doing is filling up the post and thus making it harder to read through.

To the people working on this root. The G2 has the same NAND protection all the new HTC phones have. We need kernel source before we can do anything useful
[G2 and Desire Z Android Development] funkadesi:
I was thinking the same (not a dev) but if we could get into the temp script and edit it so we can get it to point at OUR update.zip file... wouldn't that do it.

The drawback I guess is that we're gonna have to wait for an official OTA? :mad:
[G2 and Desire Z Android Development] olearyp:
Please read at least the past couple of pages of the thread. There, you will find that this discussion just happened, and it ended like this:
[G2 and Desire Z Android Development] gariak:
The OTAs are signed with release keys. Editing the OTA would require re-signing it with release keys, since any edit invalidates the signature and prevents any flashing. Cracking the encryption to make your own release keys would take longer than your lifetime. In the past, this was avoided by flashing a modified recovery that accepted test keys instead. As for why that can't happen this time, see my previous message.
[G2 and Desire Z Android Development] styles24:
Im sorry for even posting this but i have been reading these root threads, seeing people fight for pages and this is the kind of **** that starts it. ^^

For one, you are going against what you are saying by even posting this ^^,

And two, this is your first post on the subject, and what you contributed is already obvious. So you are what i like to call a double doucher. 99 cents at your local McDonalds!

Now, as for root, you guys are doing an excellent job. If anyone can do it, its the guys in this forum. Keep up the good work, and watch out for the cornhole!
[G2 and Desire Z Android Development] scooter185:
define new. within the last month? 3 months? 6? The Evo was rooted and NAND unlocked quickly and we still have methods after various OTAs.
[G2 and Desire Z Android Development] linkage2424:
So.

The Unrevoked method works by exploiting Sense. Is there, in fact, a way to get the Desire Z rom on our G2s? I believe that went unanswered, or at least unproven.

And even if we can't, has anyone with a Desire Z tried the Unrevoked program? It's supposed to unlock NAND...

Just throwing some ideas out there.

Keep up the good work!
[G2 and Desire Z Android Development] linkmaster_6:
Another stupid suggestion. Couldnt we just move the rooted OS to the sdcard then write a script or something to boot from that?
[G2 and Desire Z Android Development] Corylulu:
If it sounds stupid or overly obvious, its probably already been thought of by HTC and XDA and already dismissed.
[G2 and Desire Z Android Development] krayshunist:
Read the wiki. You'll like it.
[G2 and Desire Z Android Development] sxytxy:
GPLv3

I am not following really closely, but, a question to whoever requested the kernel source, did you also request the signing keys for the packages?

I am not too well versed in the GPL, but, if I read it correctly, if they signed a package, then deployed it with a hardware verification, then the GPLv3 would require them to provide the signing keys to a valid request just as it requires them to provide the source code. I don't know the status of the code, (GPLv2 or GPLv3), but, I would guess that might at least be a request to make early in case its also subject to HTC's 90-120 day wait.

From the GNU faq:

Edit:

And if its possible to get the signing keys, would it be possible to get the signing keys for an older phone, which would then allow us to sign our own update packages?
[G2 and Desire Z Android Development] linkmaster_6:
Most likely. The only problem i could see with this is the read/ write speed of the sdcard. I am sure we could use symlinks to make the os read the rooted /system files and what not. We would not have to put the entire OS on the card just certain files. Then when we close the system undo the symlinks to make the controler write to the correct system

Also i didnt see anything on the wiki about going about this method.
[G2 and Desire Z Android Development] adwinp:
What about adb pushing su and Superuser.apk WHILE flashing a STOCK ROM via RUU? The eventual signatures check is in the beginning only and thus irrelevant for this procedure.

During this length process, the real SYSTEM: is unlocked, and we should be able to do anything we want during that time.

Basically, we just need to check till /system/bin/su is copied from the RUU, THEN push ours, in order to prevent overwriting by the stock one.

This SHOULD, at least in theory, allow us to have persistent root. Can anybody check that?
[G2 and Desire Z Android Development] Corylulu:
But how would you make a script that launches at boot to redirect where the system files are reading without root access to the read-only section of the block.

If we were able to redirect the boot, we would already have root.

You can't run adb, 3e recovery is locked down. I believe this was the problem.
[G2 and Desire Z Android Development] mrkite38:
That's a really interesting angle. I'm no lawyer but my reading of gplv3 says that they would be required to release any info pertinent to installing a new rom including the keys. Best part is they're bound to do so if ANY party has the ability to install a new rom. Now to check the actual license htc uses...

EDIT: Yeah, that's not gonna happen (see post below). Sorry to add to the noise.
[G2 and Desire Z Android Development] olearyp:
The Linux kernel is GPLv2, not v3 (on purpose). The Android userspace is Apache 2.0. Summary: HTC is not compelled to release the private keys.
[G2 and Desire Z Android Development] compuguy1088:
Yes, you can flash the Desire Z rom onto the HTC G2. See thread:

http://xdaforums.com/showthread.php?t=796324

Edit: Never mind. I have read through the thread, and it has only been confirmed that the desire z can flash g2 roms, not the other way.
[G2 and Desire Z Android Development] linkmaster_6:
-slaps self in face- stupid me
[G2 and Desire Z Android Development] :
Edit: Prior poster corrected post.

Please delete mod.
[G2 and Desire Z Android Development] compuguy1088:
Post has been corrected. Based on that thread, the Desire Z can flash G2 roms, but not the other way around.