AlphaRevX is now in Public Beta!
Code:
[U][B]Update 05/04/2011 - Where we are so far...[/B][/U]
I thought I had better update this post, to let people know where we have got to and what we have tried, in case any developers want to join the fight. This will be a little technical and not explained step by step, there is a Q&A if you want to learn more about the goings on.
First off, the 'team'. Below is a list of people currently working on trying to get root, pm any one of us if you want to help. When I say what to help, please don't just PM saying "I want to help, I have no technical knowledge, what can I do?" We have plenty of testers, what we need is technical insight.
l0st.prophet
bin4ry
timbo007up
hawkysoft
Soctty2 was providing a lot of contributions in the early stages but we haven't heard from him in a couple of weeks, so don't contact him directly.
Where we are at at the moment. We can obtain temproot via the psneuter exploit, which allowed bin4ry to attempt to modify the wpthis exploit to allow us to load an S-OFF HBoot which was supplied by an anonymous benefactor. Unfortunately that didn't really amount to anything despite our best efforts, so he has now turned his attention to the kexec method of running a custom kernel, to see if that gives us an in.
[U][B]Started 05/03/2011 - The race begins...[/B][/U]
I am trying to root the Incredible S as no developers appear to have picked it up, but I am pretty new to this and was hoping for a little help. I have tried SuperOneClick and it appears to give some sort of temp root (although SU force closes and the test command fails, it does write to the system partition) and rebooting removes it all.
I am little lost where to go from here, although someone suggested using and older version of SOC and checking the log files, I will let you know what I find.
[SIZE=3]
[/SIZE] [SIZE=4][COLOR=Blue][B]Frequently Asked questions[/B][/COLOR][/SIZE]
[SIZE=3][B]Temproot and Permaroot - What's the difference?[/B][/SIZE]
First, let me explain root access. Root access, superuser or su (all the same thing) is basically an admin account for Linux. It gives us permission to to access commands that normally couldn't be accessed, and to write information to partitions that normally couldn't be written to. On older devices (such as the Hero), once we had root we could write to the /system and /recovery partitions, and flash custom ROMs. In the case of the IS (and every HTC device since the desire), this isn't true. Getting root access is quite trivial and no where near as useful, because the internal flash memory (NAND or eMMC) is locked down and it means we everything we 'write' to the system (or any other protected partition) is lost on reboot because it is a non permanent change. In short, this stops us from flashing custom ROMs and recovery. This is a problem for any devices that are shipped with the Security flag on (S-ON). To get Permaroot, and the ability to flash custom ROMs, we need S-OFF.
[SIZE=3][B]So what's this S-OFF then?[/B][/SIZE]
Since the Desire, HTC have been securing their phones better than before by locking the internal flash memory (NAND or eMMC) to stop it being written to, unless the file being flashed is signed by a private key only known to HTC. This is controlled by a flag (@secuflag) and is identified as the device being S-ON. Telling the HBoot the device is Security Off (S-OFF) stops this check for the key, and allows us to write anything to any partition, which is what we are aiming for.
There are actually two levels of S-OFF. The Bootloader (HBoot) and the Radio. Getting S-Off on the HBoot gives us everything we need, but doesn't actually turn off the @secuflag which is set in the radio. What it is possible to do is to flash a HBoot that believes the Radio is set to S-OFF, as the HBoot is responsible for setting that flag. Once the HBoot on the phone is S-OFF, we can write to all the partitions and basically do whatever we want, but it is possible to go one step further. Flashing a radio that is S-OFF and actually setting the @secuflag off gives 100% total access to every part of the phone and it's software, as it becomes network unlocked allowing to you to use any SIM and also allows you to flash a ROM from any carrier (known as Super CID). It also makes it nigh on impossible to permanently loose root no matter what you flash. Once you have radio S-OFF, it makes it much easier to flash new HBoots and ROMs even if you flash something that is locked down tight.
Setting the Radio to S-Off is not necessary, and gaining S-OFF on the HBoot is more than most people will ever need. Radio S-Off is just the last step of the puzzle, but it is worth noting the only points you can permanently brick your phone is flashing a radio or a HBoot, if either of these go wrong you will end up with a shiny expensive paper weight so there is risk involved.
[SIZE=3][B]What about this XTC Clip, can that help?[/B][/SIZE]
The XTC clip is a hardware device that can unlock HTC phones, regardless of the software. The device ahs been proven to unlock the Incredible S, but will require the purchase of additional hardware. We are aiming to achive full software only root, which will be free. the XTC clip will soon be available in one-off use variations for €25 if you do not want to wait for software root. Please note that the XTC clip doesn't currently allow you to revert back to S-ON if you need to for warranty purposes.
[SIZE=3][B]What about people who are getting devices shipped with S-OFF?[/B][/SIZE]
There are reports that a lot of devices coming out of China and India are shipping with the @secuflag set off. These are lucky people, and have the ability to write to the flash memory, but it can't help those of us who are S-ON. It is also worth noting that because most devices are S-ON, no one has written any ROMs or kernels for the device so they will probably have to wait until we get a way of turning our devices to S-OFF until anyone creates any software for it.
[SIZE=3][B]So, what are you doing about it?[/B][/SIZE]
Well, what we were trying to do is finding a way of telling the kernel to allow us to flash a version of the HBoot which was shipped S-OFF, thus allowing us to write to all the right partitions. All of the current exploits that allowed this to happen have been closed off, and none of them help us achieve or goal. The IS is part of a newer breed of HTC phones that are not vulnerable to any existing exploits. The only other released phone that is part of this new breed is the HTC Thunderbolt, but they have managed to get round it by downgrading to an older version of the software which is vulnerable to the older exploits. Although we have the ability to downgrade via a goldcard method (thanks to timbo007up), no one has discovered an RUU old enough to be exploitable. Bin4ry (they guy responsible for finding root on the X10) has been working with myself, timbo007up and hawkysoft trying to adapt the wpthis exploit (the one used on the G2 and DHD) to work with the Incredible S, but it appears that it cannot be done. He is now looking at the kexec method used on the X10 to load a custom kernel, to then allow us to overwrite the HBoot. This is how progress currently stands as of the 5th April 2011.
Glossary
Bootloader a.k.a HBoot - This is the piece of software that runs before anything else on the phone. It basically packages it all up, tells what to run in what order e.t.c Every computer device has a bootloader in some form or another, be it an Android Phone, iPhone, Windows PC, iMac e.t.c. The HBoot is accessible by switching your phone off, then holding down volume down as you turn it back on. The first line of the HBoot will tell you if you are S-OFF or S-ON.
Recovery - The recovery is the piece of software that allows us to write files to partitions while they aren't being used. It is the portal to allow us to flash custom ROM's and kernels. There are custom recoveries with more options than the stock such as ClockworkMod.
Superuser a.k.a su or Root - This is a user that is present on all linux distros that allows higher permissions than standard users have access to. Certain apps need superuser permissions to function, such as Titanium Backup.
l0st.prophet said:
it does write to the system partition) and rebooting removes it all.
Click to expand...
Click to collapse
That sounds like there is a form of NAND lock or "overlay" that stops you writing to the actual /system
All HTC's have a NAND lock.. you first need to disable that, before any rooting can be done.
Watching this thread closely, good luck with the quest to root
btw this is a interesting site: http://intrepidusgroup.com/insight/2010/09/android-root-source-code-looking-at-the-c-skills/
Maybe it can help you.
Thanks for the link. I guessed there was a NAND lock but when I looked at the unrevoked site, there didn't seem to to be much info on what it did, so I was reluctant to push anything. I will try and find some more info in what is involved in unlocking the NAND.
Sent from my HTC Incredible S using Tapatalk
props to you for trying....good luck
I tried unrEVOked, but the software throws up 'viva unsupported at this time'. I tried to contact the developers but they only contact through IRChat and nobody was there.
I have been trying to find out how the unrevoked guys unlock the NAND on other HTC devices, and it look like they keep their cards pretty close to their chest (understandably) and I can't get hold of any of them yet. I am looking through this thread now to see if I can find any clues
EDIT: Thought I should give an update, but it's not a good one. I can't find any documentation anywhere on how the NAND lock was removed on any of the HTC devices. There does seem to be a frustration silence on how it was achieved, every site just points back to unrevoked, who are unavailable for contact (at best I can find a twitter account and an empty IRC chat room)
As far as I can help I found out that they flash an development ruu on the DHD and then flash an s-offed radio, so the nand lock is disabled by default.
Dont know how everything's works together, and I'm a little scared to brick my phone.
I'm no Linux/Android guru and don't know everything that has to be known yet. Anyhow temp shell root can be acquired by SuperOneClick root program. but perm root has been prohibited by the NAND lock.
Still figuring out what partitions/blocks there are and what is used for what. Haven't tried the irc channels yet, will be my next step.
Good luck and ill follow this topic close and also let you know my findings.
i dont have an incredible s neither a desire hd.. but have you tried to hack the incredible s with the same method for the desire hd? they are almost similar
the desire hd trick o.0
Currently im a little scared to do it the same way, just because the IS has different versions than the DHD.
Don't have much time atm, but when I triple checked every file that is need I'm willing to try perm root attempt. Just because I'm new to this.
Currently I'm almost sure that the same recovery img can be used, but ill take a closer look this evening.
P.s tnx for the DHD rooting link.
bubby323 (the guy who rooted the inspire4G) has very kindly contacted me and offered to guide me through finding root for the IS, so once we get a chance to chat I will let you know how we get on
@timbo007up, you allready got an IS? how did you manage that?
i contacted vodafone today and they dont got any info at all about it ;/
@l0st.prophet, when you know how to exactly do this, could you tell me in private also? im willing to help writing a tool for it so it keeps hidden for BB ;-)
as soon as you 2 guys are getting there, im willing to erm sacrifice my IS for the testing period. so PM me when ur up to it!
Anyhow i tried some different methods of rooting, the one for the desire Z & HD, both dont work that well (gfree & original, but overwriting the partitions is a little scary). Altered the code somewhat, but apparently not in the way it was able to root it. Will keep on trying, and probably wait i little while till lost.prophet is up to it!
Greetings timbo007up
Let us know how things go l0st.prophet. Have decided to get this phone next week, unless some truly awful reviews come between now and then!
I will be happy to volunteer my phone if you need testing then. Titanium Backup needs root! Eventually i'll also be happy to test any custom recoveries that come out. (*hint hint* to devs watching )
+1, needing root desperately, happy to test anything you guys come up with. Good luck.
Not that I know anything but would a goldcard method help?
And you may need to find a security flaw.
::EDIT::
Just wondering, but is there even a recovery for the IS?
At the moment we are just trying to find root, recoveries and ROM's will come later. I personally just want root access. Still working on it
Hi XDA members,
I need to root a HTC One (m7) on Verizon. I have been reading threads and watching videos but I still find myself confused as to how this works. I could really use some help and I would greatly appreciate any I can get.
I need to root the device so I can gain the full functionality of the program 'ispyoo'. Some of it's features work on a stock phone. But features like facebook, text, email monitoring only work if the device is rooted. Otherwise I have no need to root the device. Would like it to resemble 'stock' yet be rooted.
Looking for the most basic, simple, and stable way to go about rooting and roming this device.
Best I have gathered is I need to unlock boot loader, root the device, and install a custom rom.... What am I missing? Any suggestions or directions to a post/video I should look at will be much appreciated.
NWhtc
NWhtc said:
Hi XDA members,
I need to root a HTC One (m7) on Verizon. I have been reading threads and watching videos but I still find myself confused as to how this works. I could really use some help and I would greatly appreciate any I can get.
I need to root the device so I can gain the full functionality of the program 'ispyoo'. Some of it's features work on a stock phone. But features like facebook, text, email monitoring only work if the device is rooted. Otherwise I have no need to root the device. Would like it to resemble 'stock' yet be rooted.
Looking for the most basic, simple, and stable way to go about rooting and roming this device.
Best I have gathered is I need to unlock boot loader, root the device, and install a custom rom.... What am I missing? Any suggestions or directions to a post/video I should look at will be much appreciated.
NWhtc
Click to expand...
Click to collapse
Verizon blocked unlocking the bootloader .. you have to use Firewater or SunShine to get s-off to unlock a Verizon One
The steps for unrooting a HTC One are:
Unlock the bootloader.
This is normally done through HTC Developer, but the person above me says that this is not possible for Verizon M7s; I can't comment as I am from the UK, but if you follow his instructions that should be this part done.
Flash a custom recovery.
ROMs are installed through a part of the OS called recovery; this is separate to the Android system. TWRP is my personal favourite, but there are others you can use.
Instructions can be found here.
Flash a custom ROM.
For most people, the next step is to install their favourite custom operating system. If you just want to keep stock like you said, you still need to flash a custom ROM, but in this case it would be the rooted stock ROM; the Verizon rooted stock can be found here, along with instructions.
Hope this helps!