Q: Rooting and ROM signing - myTouch 3G, Magic Android Development

Rather than providing static ROM's in the hope that they fit, I wonder if it would be possible to make a wizard that extracted the specific existing ROM from a device, modded the permissions, and then flashed it back again. What exactly is changed in a ROM image in order to gain root?
Which leads me to another question. Most of the ROM's appears to be signed, such as to be flashable by production SPL's. Is it correct to assume that these are indeed signed, but with a private key. Or is the SPL checking that it's a Google certificate? I'm not sure I understand why a dev SPL is needed to flash back a Nandroid backup but not i.e. a Hero ROM. Couldn't you just sign the Nandroid backup? Unless of course we're talking two very different flashing/restore techniques here?

Related

Revert Flashed ROM to Stock?

Hi guys,
I have a touch pro with a few issues (the same as everyone else) and I want to try a few things out in order to try and fix it. I just need to know I can revert it back to its original state if I need to...
This is my first Windows Mobile device, I have flashed hardspl to the device as the thread gives instructions on how to flash back, I'm just a bit concerned about restoring the original rom if I change it; The wiki has a few stock roms available, but it seems they include the SPL which I've read wont work correctly with hardspl installed. I've backed up the rom using pdocread, can I flash it back with pdocwrite without any issues? Obviously if I reconstruct it to flash back, it wont have the HTC signature so if I put the original SPL back on I will have a brick.
I'd like to mess around in the kitchen but need a way to revert it back to retail. How is this usually done?
Thanks.
Simply flash your chosen stock ROM (from the wiki as you pointed out). This will not overwrite your SPL. Hard SPL simply enables you to flash any ROM, stock or otherwise. There is a Stock SPL that you can flash for warranty purposes in post #1 of the HardSPL thread.
Caind said:
Hi guys,
I have a touch pro with a few issues (the same as everyone else) and I want to try a few things out in order to try and fix it. I just need to know I can revert it back to its original state if I need to...
This is my first Windows Mobile device, I have flashed hardspl to the device as the thread gives instructions on how to flash back, I'm just a bit concerned about restoring the original rom if I change it; The wiki has a few stock roms available, but it seems they include the SPL which I've read wont work correctly with hardspl installed. I've backed up the rom using pdocread, can I flash it back with pdocwrite without any issues? Obviously if I reconstruct it to flash back, it wont have the HTC signature so if I put the original SPL back on I will have a brick.
I'd like to mess around in the kitchen but need a way to revert it back to retail. How is this usually done?
Thanks.
Click to expand...
Click to collapse
Upload Part01.raw and Part02.raw somewhere and i will reconstruct for you into NBH file ready to flash
Cheers

Reverting from Modded firmware to stock firmware

Hi there,
Sorry if this thread is redundant, but it seems the topic is always buried within other threads versus focusing on it. Then again, maybe it's a simple answer and needs no focus.
I had some quick questions before I mod my G1, and know it has been touched upon, but just want to make sure.
Once your phone is modded and using the test keys, then is it currently impossible to ever go back to an official firmware update without the need to resign it with the test keys?
I guess I am curious if Google ever did force a 'test key' OTA update that took away root (or worse), then would we be stuck at that version until someone finds a way to flash the device via other means? Even if we had root, would we ever be able to revert back without having Googles private key?
Also, with the new modded firmware will we be able to install older revisions (i.e. go back to an earlier modded release candidate? say RC32 to RC30)
Thanks,
olsk00lz
If you're that worried about Google signing an update with the test keys (which, FYI, would be a horrible idea, as the devices that have the official keys would freak and couldn't update), then do this:
Make your own keys (it's not too hard, I'm sure JesusFreke could help), sign the modded RC30 yourself, and update to that. There's nothing Google could really do to stop that, except somehow make an update that didn't require signing. If they did that, we could just make our own update that didn't need signing, which wouldn't even require root access anymore.
Makes sense, but questions still remain. More out of curiosity.
- If you wanted to sell your phone as stock or something later and wanted to revert back to "enable OTA"... is there anyway to do this?
* May not be possible without a private key???
- If you are using the test keys, or your own keys, then can you install any firmware. a) revert from a modded RC32 to a modded RC30 with google test key, or b) switch from a modded RC30 (goog test key) to a modded RC30 (your own key)
* Should be possible if you have both public/private keys??
Also, anyone see an impact with the new fingerprint being sent back to google, I have seen suggestions to create a new entry in your host file to prevent this.
Thanks !
oldsk00lz
Yes, you can go back to stock updates.
You can grab the recovery image from one of the official updates and flash it in the same way you did to get the modded one, and then apply the official update.
oldsk00lz said:
Makes sense, but questions still remain. More out of curiosity.
- If you wanted to sell your phone as stock or something later and wanted to revert back to "enable OTA"... is there anyway to do this?
* May not be possible without a private key???
- If you are using the test keys, or your own keys, then can you install any firmware. a) revert from a modded RC32 to a modded RC30 with google test key, or b) switch from a modded RC30 (goog test key) to a modded RC30 (your own key)
* Should be possible if you have both public/private keys??
Also, anyone see an impact with the new fingerprint being sent back to google, I have seen suggestions to create a new entry in your host file to prevent this.
Thanks !
oldsk00lz
Click to expand...
Click to collapse
Yes, you would be able to reflash the official keys, so that it'll OTA update again. You should have backed up your keys before you flashed (I'm not sure if the guide on the forums tells you to do this, it probably doesn't, so you shouldn't follow that exactly).
You probably won't be able to go from modded RC30 to official RC30. The updater would probably disallow it because it is the same version. I think you'd have to modify the modded to RC29 (although, there's probably a build number that it uses somewhere, I doubt they use the RC identifier we do for update checking).
If you were to resell the G1, just reflash the normal keys. When the next update comes out, he'll be back on stock.
Gotchya.... Thanks!
I think your question has already been pretty much answered, but let me clarify the details
There are 2 ways you could apply an "official" update over a modified one:
- You can resign the official update with the keys used by the modified recovery image.
- You can re-flash one of the official recovery images, and then apply the official update without having to re-sign it. The updates themselves contain the recovery image for that version (look for recovery.img). So you could extract that file, flash it onto the recovery partition, and then apply the update.
hey J.F. correct me if im wrong...
But you included the goog signed recovery.img in the androidmod.zip so you could just refollow the directions in the package to go back to a goog signed G1.
At least that's how I understood it.
Bhang
Your missing out on something important here.. when most of the population will have been upgraded to a non rootable firmware your rooted g1 will be worth n time its original value. Why on earth would you sell it locked for 1/2 of the original price???!!!
bhang said:
But you included the goog signed recovery.img in the androidmod.zip so you could just refollow the directions in the package to go back to a goog signed G1.
At least that's how I understood it.
Bhang
Click to expand...
Click to collapse
No, I included the RC29 boot image (not the recovery image), which was just a convenient "known good" boot image I had laying around at the time when I packaged it up.
You'll need to get an official recovery image from one of the official updates. It's called recovery.img, and is in the system folder in the zip file.
mrboyd said:
Your missing out on something important here.. when most of the population will have been upgraded to a non rootable firmware your rooted g1 will be worth n time its original value. Why on earth would you sell it locked for 1/2 of the original price???!!!
Click to expand...
Click to collapse
No, it won't. As it's been said before, I did quite a bit in the PSP scene for hacking/homebrew. A rooted G1 won't sell for much more than an unrooted one, if its at all higher.
New exploits will be found, and I won't be shocked if eventually Google just opens it up.
I gotta say, this one may be up in the air.... until hardware competition comes out that is. How many UNIX/Linux-heads out there will find out that you can have Debian or some other cool stuff that just doesn't work on a standard G1? I haven't even looked at what O/S PSP can run, but think you will still have to code with there libraries, no?
I think once we are able to tighten down root with actual logins, and make the modded phone more secure, some of the worriers will have wished they had a modded phone. Okay, I am sure other exploits will be found some day... I have enjoyed watching the community get as far as it has.
So... anyone want to buy my modded RC30 G1 for $1500.00 USD?????? Any takers?? (Okay, I think I can concede that even if there is a profit or not on ebay, it probably won't be much of a markup unless you reach the right target audience.)
-oldsk00lz
Reverting from Modified RC30 to official (updated to NBH method)
Update 1/13/2009:
Reverting via the RC29/RC30 NBH files is a more straightforward method. Download those files here.
The original update.zip method is deprecated in favor of the NBH method. I am removing the update.zip files from my server space. Text remains for historical purposes.
These are update.zip files for taking a G1 with MODIFIED RC30 or any other G1 with test key signed recovery partition (e.g. white developer G1s) back to official firmware. You have the option of RC29 or RC30. These will install official ota firmware.
As usual rename to update.zip, dump into sdcard and reboot G1 into recovery.
MOD RC30 --> OTA RC29
Download (Root bug still enabled)
MOD RC30 --> OTA RC30
Download (No root access. Can still downgrade using NBH)
Hopefully this will help for folks who want to revert to official firmware from the xda-dev modified firmware or have a white developer G1 and want to update it but aren't getting ota updates.
jashsu said:
.... or have a white developer G1 and want to update it but aren't getting ota updates.
Click to expand...
Click to collapse
Maybe I'm not understanding ... is there a 'whit developer G1' ? Where can we get them?
Thx
This will VERY RARELY be needed. If you were not sent to this thread to download this because of a major problem, you should probably ignore this. These are for worst case use only.
Those who need these will know and be looking for them already (so now they can find them )
Help - is my phone bricked?
tried converting back to official RC30 from JFv1.31.
downloaded the ota-rc30-testkey-noassert-update.zip, renamed it update.zip, put it on SD card, Home+Power into recovery mode, it comes up with the red, green, blue screen and then it quickly displays the message 'No Image File!' and then goes back to red, green, blue screen displaying the following text:
DREA100 PVT 32B
HBOOT 0.95.0000
CPLD-4
RADIO-1.22.12.29
Sep 2, 2008
Serial0.
Pls help....
The RGB screen is the bootloader screen, not the recovery screen. To revert using the bootloader screen, you need the NBH file, not the update.zip file. Get the RC30 NBH here.
jashsu, thanks for the quick reply
but that is what I had attempted earlier, but that failed. Sorry, I should have mentioned that.
When I tried the DREAMIMG.NBH file, the bootloader did find the image file, and it showed me the progress bar, the progress bar goes all the way till the end, but none of the steps had ok next to it at the end and it said Update terminated update failed.
that is when i tried doing it this other way.
EDIT
OK, never mind, for some reason when i re-attempted the .nbh method, it worked this time. i re-downloaded the file from the site you linked to this time, maybe the 1st attempt file was corrupt in some way.
Thanks again...!
KG
this is good to know, that way when the official cupcake comes out, I can upgrade!

Is HardSPL required for a rooted, JF phone?

I see that the last step for rooting a phone is installing the HardSPL. Is this required? I read that some people do not do this. Pros/Cons?
http://forum.xda-developers.com/showthread.php?t=455860
southsko said:
http://forum.xda-developers.com/showthread.php?t=455860
Click to expand...
Click to collapse
I read that already. My question is if its required. Per that thread
"At the current time the main benefit of this is to allow European G1s flash American NBH files and vice versa."
So since I have a US phone, whats the purpose of installing HardSPL?
its not "required" but highly suggested
HardSPL is a fail-safe so if you brick your phone and have a backup of flash memory, you can recover from it without a problem. For that reason alone it is highly recommended to have. Other than that it is completely transparent and will not affect the performance of your phone whatsoever.
Datruesurfer said:
HardSPL is a fail-safe so if you brick your phone and have a backup of flash memory, you can recover from it without a problem. For that reason alone it is highly recommended to have. Other than that it is completely transparent and will not affect the performance of your phone whatsoever.
Click to expand...
Click to collapse
Thanks for the comments, Im learning.
By flash memory do you mean your data or the actual Android OS? If a phone is bricked, could you just flash the RC33 update and be back up and running again? Since the last step for rooting the phone is installing the HardSPL, how does it help you if you brick your phone?
Not required, but I would seriously recommend you install it, otherwise you will not be able to update to newer versions of modded firmwares, only to official ones. As for your other question, it helps because it has a recovery environment built into it that can restore backups (that you can make yourself), and it will re-flash a firmware patch
HardSPL just makes it much harder to brick your phone, and includes extra goodies like Fastboot.

No-root backup possible?

I'd like to back up my ROM (and/or data) before playing around with my Rogers HTC Magic. AFAIK, the Rogers Magic still cannot be rooted (yet). My question is, can I still do a backup?
pls help.....i wanna back up my rogers htc magic ROM too
maybe I am confused, but I did not think there was any difference between GSM Magic's. there are some myths, but they seem to be rubbish.
in any event, I would also like to do a rom backup without rooting first
colonel said:
maybe I am confused, but I did not think there was any difference between GSM Magic's. there are some myths, but they seem to be rubbish.
in any event, I would also like to do a rom backup without rooting first
Click to expand...
Click to collapse
There are different radio versions. It is a known fact that for example the Rogers Dream and Magic cannot be rooted yet. Something like a different offset in memory where the ROM (or radio?) start.
minicris said:
pls help.....i wanna back up my rogers htc magic ROM too
Click to expand...
Click to collapse
parrot5 said:
There are different radio versions. It is a known fact that for example the Rogers Dream and Magic cannot be rooted yet. Something like a different offset in memory where the ROM (or radio?) start.
Click to expand...
Click to collapse
Parrot5 is right. HTC changed som internals on latest Magic phones. If you own a PVT 32A phone with SPL .0008 or .0009, you could give a try to daldroid-recovery.img from this thread:
http://forum.xda-developers.com/showthread.php?t=523680
You should be able to FASTBOOT the image and make a nandroid backup from the modified image running from your phone's RAM (no need to flash it).
BUT BEWARE, nandroid is not able to do a full raw image dump of your original rom, so there is no known way (I'm aware of) to backup your SPL and radio rom.
Furthermore version .0009 SPL doesn't allow to use "fastboot flash" (it checks digital signature of rom files) to reflash your backup files, so don't count on the how-to which tells you to do so. That's for modded SPL from haykuro.
Someone reported they were able to flash the modded SPL to unlock the flash from fastboot feature (the modded spl doesn't check for signed images) but no dumped image for your original SPL is available so you will not be able to restore it.
I didn't flash modded SPL so search the forum for info about that (please pay attention to check for confirmation by users with your same phone, hw, spl and radio rom)
Always check if the rom you wanna flash is compatible with your phone, I confirm HTC made some changes and the git sources for Android do not reflect latest Sapphire board implementation.
Hope this helps,
Daldroid

[Q] Explain (not with a HOWTO!) Goldcard, Bootloader, SPL, RUU, CID to me

Ok, so I'm not all that new to this rooting thing, I've rooted several HTC Magics, a Nexus One, helped out on a Legend, rooted a Hero and managed to install Android on an HTC Tytn II.
I'm getting used to the different terms about rooting and I'll recite them for you so you know where I'm at.
My Question/Request for you all is to help me figuring out what all these words mean and how they correspond/correlate/work together.
=== Things I have understood almost completely ===
Root
As in Linux, gives a user or script the permission to write to otherwise protected partitions and file systems of the handset.
Recovery
A partition(?) that manages some tasks involved with the basic building blocks of the system, such as installing/flashing different partitions/parts of the handset. Also has the ability to wipe the data-partition as well as Dalvik-cache.
Bootloader/HBOOT/SPL
A partition(?) that fires up the basic buildingblocks on the handset. Such as recovery, OS, and whatnot. With Fastboot-commands it's possible to flash partitions, as long as the bootloader allows remote writing through command-line.
=== Things I've almost completely understood ===
CID
CarrierID. This is when a mobile phone network carrier "locks" the phone to a specific network. But this also means that the carrier hands out updates to the Android-system installed on the handset? And the only way of updating a factory-state handset is by getting hold of updates from the carrier?
RUU
ROM Update Utility. Used by HTC to update their manufactured handsets. There might be other manufacturers who use this abbreviation, but I've seen it used almost exclusively in regards to HTC. There are checks being made when trying to install a RUU-package on the handset. These are/could be(?)
* Current RUU version already installed (if the RUU-package that is being installed is older, the installation quits)
* Current CID (If the CID in the RUU doesn't match the CID on the handset, the installation quits)
=== Things that confuse me ===
Goldcard
This is a modified SD card that supposedly bypasses the CID/RUU-check. Now, this to me sounds like I can install any RUU no matter what version I currently have installed on my handset and no matter what CID my handset came with.
This also sounds to me that I can potentially install a Desire RUU on my HTC Magic, if it is true that the RUU/CID-check is bypassed by the goldcard.
This also sounds to me that the requirement for a newer RUU-version of the package I'm installing is bypassed. For instance, I will, if I use a goldcard, be able to install a RUU-package with the version 1.28 on a handset that currently have version 1.31 installed?
Reverting a root
Is it as easy as grabbing the latest official RUU-update from HTC:s website and install that? Does it contain all the partitions and system-files necessary to restore the handset to a factory-state? Or will there be complications because of the root and different custom-ROM:s and custom-recoveries that are on the handset?
Shameless bump. SOMEONE has to know this. Or this is such common knowledge that there is a wikipedia article and I missed it?
If I only get an answer to my Goldcard questions I'd be real thankful.
Sounds to me like you have a very good grasp of all these things. It's nice, but rare, to see people doing their own research and learning this much before posting questions!
There's nothing i can add really but to confirm that ,yes...flashing a stock ROM will revert changes although some devices can be picky with which stock ROM is best.
As an aside, have you considered doing development work yourself, perhaps ROM building? You're obviously capable, interested and 'have the right stuff'!
DirkGently1 said:
Sounds to me like you have a very good grasp of all these things. It's nice, but rare, to see people doing their own research and learning this much before posting questions!
Click to expand...
Click to collapse
Well, thank you. I'm slowly beginning to get used to doing as much research as I can get by with and provide what I know, or at least think I've been able to conclude, and then ask a question about it.
DirkGently1 said:
There's nothing i can add really but to confirm that ,yes...flashing a stock ROM will revert changes although some devices can be picky with which stock ROM is best.
Click to expand...
Click to collapse
When you say flashing a stock ROM, would this also apply for RUU-packages? As an example; If I have an HTC Hero and I manage to downgrade it through som root-method, will I be able to run an official HTC-provided RUU to get it back to a factory state?
The only way I have been able to return my Nexus One to a factory state is by the use of a PASSIMG.zip-file, but then I would have to make sure that I am using the stock recovery. One reason for my question is that I'd also like to know if it's possible to run an RUU-package on a rooted, and/or custom recovery-flashed and/or engineering SPL-flashed handset and have it returned to a factory state.
DirkGently1 said:
As an aside, have you considered doing development work yourself, perhaps ROM building? You're obviously capable, interested and 'have the right stuff'!
Click to expand...
Click to collapse
Well, sure, the thought has struck me once or twice. I'm currently in my last months of my education in becoming a Master in Software Engineering, but at the moment I'm into getting to know more about how Android works on different handsets and how the different parts are connected to each other. I will very soon dive into Android development as it's the only really interesting area for handsets/mobile communication, that doesn't have the price of a whole Apple Macintosh to even be able to begin programming for it.
I'm sure I will get an Apple suite later on, I like the diversities of different manufacturers but for the time being I'm price conscious.
Is there anyone who knows a thing or two about Goldcards?
One of my questions in the first post was about the CID/RUU-relation to the Goldcard.
I have read from one or maybe two people on random forums, stating that the Goldcard is _only_ needed when the handset is carrier-locked. I'm very interested in getting to know more about the Goldcard and when it is supposed to be used and/or required.
Because a lot of the times when dealing with rooting HTC handset it boils down to having a Goldcard or not. But at times I hear about methods where Goldcards aren't needed. But the statements differ from "You need a goldcard" to "You only need a Goldcard when your handset is CID-locked" to "You need a Goldcard to be able to flash an RUU that is older than the one you currently have on your handset." to "You need a Goldcard if you want to flash an RUU with a different CID" to "You don't need a Goldcard at all".
Somehow I think there are some kind of specific combinations, for instance something like this;
CID-locked handset => Needs a Goldcard to be able to root
RUU-version on the handset is new => Needs a Goldcard to be able to flash older RUU-version
RUU/CID-combination is X and Y => Needs a Goldcard to be able to flash an RUU that has the RUU/CID-combination A and B
...
...
There are times when some rooting methods do not require a Goldcard at all, but it seems to me they are pretty rare when compared to those who require a Goldcard.
Someone out there should have the whole story about this and I'm very interested to know how these things work and I'm also grateful for sharing this with me.

Categories

Resources