[DISCUSSION][SOLVED] ROOTING G2 Vision T-mobile

Status
Not open for further replies.
Search This thread

testing567

Senior Member
Nov 18, 2008
163
2
Ok sounds like you are all on the write track . But i was wondering if we could maybe trick the system by getting root then changing the root id or the root pw to prevent the system from over writing the changes that we make . Kinda like if we hacked into a pc and then locked out the admin user account ?

Can this work? The way I understand it from reading this thread, the changes stay in cache and the changes revert when the cache expires. Even if we could mark the changes we want as "protected" in the volatile cache somehow, it would still revert when powered off.

Am I understanding the situation correctly?
 

Disconn3ct

Senior Member
Nov 5, 2008
439
157
Washington, DC
andblogs.net
Ok sounds like you are all on the write track . But i was wondering if we could maybe trick the system by getting root then changing the root id or the root pw to prevent the system from over writing the changes that we make . Kinda like if we hacked into a pc and then locked out the admin user account ?

This isn't a pc. There is no root password. This has zero to do with what is going on.


For the sake of not drowning the thread in reposts and red herrings:

If the phrase "I don't know if anyone has tried this..." appears in your post, stop. Read the thread. Reconsider your post. Your post should no longer have that phrase and wont waste space.

If the phrase "I don't know, but..." appears in your post, stop. Find out. The interwebz is amazingly useful for learning things. Reconsider your post. Your post should no long have that phrase and you will sound knowledgable and educated.

If you don't have any idea how an exploit is supposed to work, please don't suggest it. Look it up. If it sounds applicable to the G2, proceed to share.
 

bled82

Senior Member
Nov 14, 2009
303
28
Fort Worth
Samsung Galaxy S10 5G
Ok thats what i thought but as you can tell i dont know much about programing i do tech support so just pulling from what i know . I have read all the post or at least 90% of it and from what i can tell its over my head about 40 pages back lol . But if you need any help I hav a G2 that has not been modded with the temp root yet and i am able to follow directions to pull info that is needed if you provided directions . So let me know if i can help if not ill just sit back and read and wait like all the other none programmers . Thanks for all the hard work guys . :cool:
 

mrozzeh

Senior Member
Mar 16, 2010
97
7
Ok thats what i thought but as you can tell i dont know much about programing ...

No offense, but that should have been reason enough to not post in this thread. The only way for any real work to happen is to keep the SNR high enough so real information can actually flow.

I'm just going to say this once, even though I'm going to be completely ignored. Looking into eMMC standards and hardware specifics of the chip is a complete waste of time. Put your efforts into the bootloader and rmt_storage, where the solution is actually going to be found.
 

havikx

Senior Member
Feb 4, 2009
494
61
great work so far guys!

did any1 see on androidcommunity front page tmo responded to g2 being un-rootable? has any1 heard anything on how CM feels about this? or if he's paying attention? i know 6.1 is coming...
 

slayerdork

New member
May 2, 2010
4
0
cyanogen hasn't said anything on t-mobile's response, but ChrisSoyars the project manager of CyanogenMod did respond on twitter by asking for the source code, which is required under GPL licensing.

ChrisSoyars twitter post goo<dot>gl/UiUU
 
Last edited:

Disconn3ct

Senior Member
Nov 5, 2008
439
157
Washington, DC
andblogs.net
I'm just going to say this once, even though I'm going to be completely ignored. Looking into eMMC standards and hardware specifics of the chip is a complete waste of time. Put your efforts into the bootloader and rmt_storage, where the solution is actually going to be found.

Bootloader, maybe. (Or a recovery exploit to flash or modify the image.) However, those areas are pretty well tested at this point, after being exploited on so many other devices.

Since it is set poweron-ro, being able to reset the emmc (even just once) to disable the ro flag would be enough to root it. The chip is accepting and dropping writes. We need to get that to stop (reset the chip) or to never be enabled to begin with (alter bootloader or subvert recovery.) It cannot be disabled without an emmc reset/powercycle.

I disagree that that is a waste of time, unless you have some knowledge that we've all missed. (And if you look at rmt_storage, it has nothing to do with this - it is how the modem cpu talks to the app cpu to get access to mmc. Wrong direction entirely.)

(Also, the "voice of reason alone in the wild surrounded by morons" tone is usually a good indicator that the following text is less reliable than it may appear. "going to be ignored" "waste of time" etc.. even if you can back it up, you are absolutely right - most people won't bother with you. And since you made a suggestion without actually contributing, later on if an exploit is found in bootloader, you can go "see! toldya!" without having ever done anything..)
 

ace42588

Member
Sep 7, 2008
32
1
the following facts are evident:
There are still multiple camps/factions with evidence for different approaches
Feuding has started to consume this thread
n00bz to the topic don't have the patients to read the whole thread

based on these facts, i humbly suggest we fork this thread.
Suggestions:
eMMC focus
whatever the hell else someone feels is important to focus on

progress stutters when people have to defend their reasoning
plus, people fresh to the subject will see a quick synopsis at the beginning and can contribute to each effort.
 

vladyman

Member
Dec 11, 2007
10
0
This thread needs moderation!

This thread is getting more and more useless. The objective should be to get root, and people keep interrupting it with uninformed questions, repetitions of outdated ideas (because they don't read the whole thread!), thank yous (which are nice, but also irrelevant at the moment), rude explanations what team douche is (which is completely irrelevant in this context!) etc. All of this is making the few people that are actually posting useful information, writing kernel modules, leave prematurely or give up on this thread.

I think it is best to stop this thread and start a new one which is moderated to remove off-topic posts. To root this phone it is NOT sufficient to have seen the Linux command line once. It is quite deep stuff so if you feel you cannot really contribute, there is no point to write anything. I have been observing this thread for a week now, without writing a single post, because people either had already mentioned what I thought or I felt that I did not have the expertise to comment on a certain post. Feel free to observe and provide information that you think is going to be helpful, like for example if somebody asks to run a certain command and you happen to own the phone.

At the moment lots of time is wasted on these useless posts and repetition of the same information to people who are unwilling to read, and would like the developers to summarize the thread for them, which is not their job!

Here is a quick summary: As it stand at the moment people seem to agree that there are hardware-related things preventing from permanent writing to the system partitions. It would probably help to have the HTC kernel sources, but I have just received a response from them that they do not expect to publish those for the next 90-120 days (emails I will post further down). As such it looks like reverse engineering for now, and it could take a while, unless somebody *really* good at these difficult things decides to help. At the moment it looks to me that whilst nobody was actually able to prove that what we see is hardware-related, T-Mobile's comment yesterday as well as some findings here make it seem very likely. As such it seems sensible to first try to start off with a kernel module to disable the write protection as has been suggested by damnoregonian and others (who I hope will come back!). The next step would then be cracking the phone open and try the JTAG route which some people are also apparently working on. As far as I understand this is basically all we know in this thread and it might make sense to start a new (hopefully moderated!) thread targeting these specific things.
 

mrozzeh

Senior Member
Mar 16, 2010
97
7
Bootloader, definitely.


Since it is set poweron-ro, being able to reset the emmc (even just once) to disable the ro flag would be enough to root it. The chip is accepting and dropping writes. We need to get that to stop (reset the chip) or to never be enabled to begin with (alter bootloader or subvert recovery.) It cannot be disabled without an emmc reset/powercycle.

It's not necessarily "dropping writes". As far as the device knows, it's accepting them perfectly to the ramfs. It's not syncing them back to the physical medium.


I disagree that that is a waste of time, unless you have some knowledge that we've all missed. (And if you look at rmt_storage, it has nothing to do with this - it is how the modem cpu talks to the app cpu to get access to mmc. Wrong direction entirely.)

If you would have looked into rmt_storage, you would have seen that it is one of the parts responsible for mounting the ramfs.

And since you made a suggestion without actually contributing, later on if an exploit is found in bootloader, you can go "see! toldya!" without having ever done anything..)

We actually have most of the unrevoked team working with the cyanogenmod team, working with the alpharev team, and a bunch of smart guys from #g2-dev. And we're miles ahead of this thread. But apparently because we don't post in this thread that's going nowhere we're noncontributing; that's cute.

There's a reason these "think tank" threads never go anywhere.
 

vladyman

Member
Dec 11, 2007
10
0
Communication with HTC about the kernel sources

I thought I'd post this here, in case people are hoping for the kernel sources to shed some light on the rooting process. I had requested the kernel sources and received the following response:

Thank you for contacting HTC Technical Assistance Center. HTC will typically publish on developer.htc.com the Kernel open source code for recently released devices as soon as possible. HTC will normally publish this within 90 to 120 days. This time frame is within the requirements of the open source community.

I thought that "This time frame is within the requirements of the open source community" this was very vague and responded

Many thanks for the quick response, but what does "This time frame is within the requirements of the open source community." mean? The GPL license requires you to provide the sources as soon as they are requested after release of the software.

I can see that if this were to go to court, then 90-120 days would be short enough for the case not to proceed, since until that time the court proceedings wouldn't start. However, given that this is a repeated occurrence with each device that you produce, this clearly is unacceptable and not compliant with the GPL license.

Could I ask your company to rethink my request and provide me with the sources now, since it is my right to receive them now. Given that you are clearly in possession of the sources and the device has been released I cannot see why it would take a further 90-120 days for publication.

Best regards.

after which I have received the exact copy of the first response. So there is clearly nothing one can do through technical support, but I don't know who else one would contact (they haven't responded to that question). I believe that they are clearly breaching GPL, but in a way which would be very difficult to follow up in court as the GPL doesn't set any time limits (though these are clearly implied). But given that HTC does this with every single device, it looks to me as if this is part of a strategy...
 

grennis

Senior Member
May 11, 2010
325
22
Hey guys, I don't know my ass from a hole in the ground, but I was wondering if anyone tried to format the D: drive? I mean my friend's cousin's roommate had a similiar problem with his coffee maker and he said he tried that and it worked. Just my contribution, I'm sure we all get this working soon!
 

Disconn3ct

Senior Member
Nov 5, 2008
439
157
Washington, DC
andblogs.net
Bootloader, definitely.
It's not necessarily "dropping writes". As far as the device knows, it's accepting them perfectly to the ramfs. It's not syncing them back to the physical medium.

mv money $(find / -name mouth)


We actually have most of the unrevoked team working with the cyanogenmod team, working with the alpharev team, and a bunch of smart guys from #g2-dev. And we're miles ahead of this thread. But apparently because we don't post in this thread that's going nowhere we're noncontributing; that's cute.

There's a reason these "think tank" threads never go anywhere.

Someone spilled a basket of names, were they yours? I'll help you collect them up and get them off the floor before someone steps in it..
 

Disconn3ct

Senior Member
Nov 5, 2008
439
157
Washington, DC
andblogs.net
I don't see anything about 90-120 days in the GPL. Is this permitted?
No.
3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
..etc
Not "someday" but "immediately, along with it."
 

mrozzeh

Senior Member
Mar 16, 2010
97
7
mv money $(find / -name mouth)




Someone spilled a basket of names, were they yours? I'll help you collect them up and get them off the floor before someone steps in it..

I'm not even going to waste time coming up with a response to that. I'll let you continue being the cute snarky guy; You sure are doing a hell of a lot.
 

scooter185

Senior Member
Jun 17, 2010
307
5
I thought I'd post this here, in case people are hoping for the kernel sources to shed some light on the rooting process. I had requested the kernel sources and received the following response:



I thought that "This time frame is within the requirements of the open source community" this was very vague and responded



after which I have received the exact copy of the first response. So there is clearly nothing one can do through technical support, but I don't know who else one would contact (they haven't responded to that question). I believe that they are clearly breaching GPL, but in a way which would be very difficult to follow up in court as the GPL doesn't set any time limits (though these are clearly implied). But given that HTC does this with every single device, it looks to me as if this is part of a strategy...

you want to contact their legal dept. Their was topic on this for the EVO a couple months ago.
 
Status
Not open for further replies.

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Has anyone considered the possibility of a system.img that's being unpacked on boot? The root filesystem on our phones is unpacked from boot.img every time the phone is booted which is why there's trouble with the SGS and people rooting it by placing the su binary in /sbin...

    Back on topic, the root filesystem can be changed at runtime, but reboot, and it all goes away. That's what sounds like is going on with the G2, but I don't have one to mess with.