scotty85

so i was reading on "unrevoked"s root wiki(public:forever [RootWiki]) about packing up your own files to flash in hboot,and it got me to thinking why can we not do something like this for the eris?

the page says this:
How do I create a unsigned zip to flash in HBOOT?
Zip the file that you wish to flash (usually named something like BOOT.IMG, SPLASH1.NB0, RECOVERY.IMG, …) up along with an appropriate android-info.txt into a file named either PB31IMG.ZIP (for Incredible) or PC36IMG.ZIP (for Evo), and place this file on the root of your SD card.

now obviously,we would need to rename the zip "PB00IMG" for the eris to find it. i downloaded the gscript.zip from the rooting for dummies thread and located the "recovery" disc image file.

could we put that in a zip along with the appropriate text file and flash via hboot? if so,what does the text file need to say? ive looked at the text files on the PB31IMG zips i have for my inc,and theres not much to em... does it need to say something specific? or is it just info for the user?

your thots? has it been done? if not its hard to understand why not,unless it for some reason wont work on the eris.

thanks for any info or insight

__________________
The Delivery Guy
If someone has helped you,please click the THANKS button on that post.
Please post questions so others can benefit from the answers.
follow me on twitter @scotty1223

scary alien

Scotty,

Interesting idea ...you thinking of making / doing this for the trackball-optional recovery?

Since my Eris is my "playground" , I decided to give this a try...

At first, I tried to build a .zip that was flashable from Amon_RA (using my trackball-optional version, of course ).

I decided to use eu1's newest FlashBack21.zip as my base. I deleted all of the files that weren't relevant and updated the update-script file so it would just flash the recovery.img file.

Well, my first attempt failed because it wasn't signed. So, I found out how to sign files with SignApk.jar (How to Sign Android APK or Zip Files | All About Web & Mobile Application Development) and retried a signed version in Amon_RA.

He still didn't like it (even though it passed my AFV jar-verification test ). So, I must be missing something else (maybe the certificate is wrong? IDK).

So, I backpedaled and used what you first suggested. I looked at the "leaked" 2.1 ROMs for their format and they were indeed as simple as the unrevoked site implied and their example .zip files revealed. So, I packaged-up one with the android-info.txt file from the base root ROM and included the base Amon_RA 1.6.2 recovery image (since I already had the trackball-optional version installed). I booted in HBOOT and flashed my special PB00IMG.zip, rebooted, and then shutdown back into recovery.

It worked .

So, just to make sure, I built a new PB00IMG.zip with the trackball-optional recovery.img and reflashed.

Still golden!

So, great idea. A lot of fun. A little scary. And I learned a lot.

Thanks for the cool post!

I could post-up the files somewhere, but this was scary-enough for me. Also, if you do this, be sure to triple-check your MD5 sums to compare the files before and after you transfer them to your phone so you don't get a bad recovery flash.

Cheers!

P.S. waiting with very baited-breath for eu1 to weigh-in on this (I know this is cake for him, but I'm still learnin', ya know ).

__________________
androidforums Site Rules/Guidelines

[App] AFV (Android File Verifier) - file checksum (MD5, SHA1, etc.), signed jar / .zip verifier, and Nandroid backup verification
[App] BattMonX - display battery state via LED indicator & status bar icon
[App] Android Root Toolkit (beta)

Last edited by scary alien; March 19th, 2011 at 11:05 PM.

scotty85

awsome! thats pretty slick that it worked. i was just gonna try it myself,but i cant open the root rom to steal its android-info.text file. did you change anything it said? without question i was workin up to the track ball optional version! but since you said it assumed that the regular recovery was allready present to get it working,i wasnt sure how easy it would be... take small steps,ya know! so after you flashed the regular recovery,what did you have to do to build the trackball optional zip? can you just pull the recovery image out of your gscript.sa file? or is there more to it than that?

now i just need to figure out how to get an android-info.text file out of something... id love to have my own tracball optional recovery in PB00IMG waiting on the sidelines in case i need him

i guess we are lucky in that nothing really ever happed to our recovery to need it. in both the incredible and droid 1 forums i see folks get stuck on occasion without bootable roms or functioning recoveries. since it is not cus*****y to use clockwork or rom mamager with the eris, i guess it just doesnt get screwed up

since it works are you going to upload it somewhere for folks to use?

again im pretty tickled that it worked... and im glad you had fun messin with it!

bobcat331

Whew, pretty knowledgable for a delivery guy. I guess I need to stop playing on my phone and on here all the time and start back playing with eclipse and sdk on my linux machine. You're making me jealous.

__________________
THE PLUMBER
HTC Rezound - Scott's Developer Edition 1.2 S-OFF, HTC Incredible - ICS Aokp build 26
HTC Eris - Condemned CM7 V 23 R.I.P., HTC Eris - GSB v4.4-full_ODEXED_CM7.2.0, ViewSonic Gtablet - TnT
Do you have questions about the forum? Click here: http://androidforums.com/faqs/.

scotty85

you got me beat there! im a simple delivery guy that knows nothing of linux i just got this idea cause its allready been done for then dinc... ive got recoveries on the puter just in case this is a big reason i like htc phones. you cant install things in hboot on moto devices... you have to use rsd lite to install sbf files,wich is a lil riskier and more of a PITA

our next step is to become good at adb,BC

bobcat331

I'm game. If your watching Scary be prepared for a question or two.

scotty85

*giggling and clapping hands* i got it to work,also

i borrowed the AAInfo text file from the 5th OTA( [HTC ROMs] Consolidated HTC Eris RUU/OTA/ROM URLs - xda-developers ) and packed that up with the 1.6.2 disc image. flashed clockwork in rom manager () and booted into it. made a backup and rebooted.just case i then plugged in my lil buddy and moved my zip over and renamed it PB00IMG. power off,vol - and power into hboot... i saw the blue bar over on the right and then it finished. never did ask me if i wanted to update. is this something to do with the text file? anyway,lookin at the typical hboot screen i thot "hmm did it work?" pushed vol + for recovery and sure enuff it went right to good ol' amon RA so then i made up another one with the trac ball optional version(thanx again scary ) transfered it over,power off,vol - and power into hboot,blue bar zip!(goes fast image is small ) and vol + for recovery BAM! back to good ol faithful tracball optional recovery.

question now is do we need to do the 1.6.2 first? or can we just do the tracball optional right off the bat? hmmm maybe flash clockwork 1 more time and check that out edit: yup,flashed clockwork again,and installed tracball optional imediately from hboot. dint need to install regular 1.6.2 first(thanks again,scary)

im excited. maybe this scenario is not that likely,but your phone could now be in a pretty bad state,almost a brick with no recovery and no working rom,and as long as your S-OFF and can still get into hboot you can flash a recovery. you can then flash a rom,or restore a backup and get your phone back. neato!

so now the gears are turning,and the smoke is rollin out of my ears im wondering... can we remove everything but the S-OFF bootloader from the root rom? that way folks could flash that real easy in hboot and get S-OFF without having to do the scary battery pull,or install the whole update and have to re-root?

your thots? i think its alot safer to have the S-OFF bootloader,and it would be great if there was an easy,not as scary way for folks to get it

Last edited by scotty85; March 20th, 2011 at 08:25 AM.

scary alien

Nope, I just copied the android-info.txt file from the base root ROM. I am thinking that there might be HBOOT version issues depending on what HBOOT version you actually have. I would think that in that case you would just match / update the android-info.txt file to the corresponding 2.1 leak ROM (I used the base root ROM since that's what I flashed to get root in the first place). But you might get the "main version is older" error (I think, eu1 would have to weigh-in on this) if you try to use this and your Eris was flashed with the v3 2.1 leak. Or maybe it doesn't matter...I don't know .

I just built a PB00IMG.zip out of the android-info.txt taken from the base root ROM and a copy of the trackball-optional recovery.img I already had on my PC (I built it ya know so I didn't have to extract it from the gscript-sa.zip files ). It was actually very simple.

The base root ROM is available here:

Android ROM Site

I'm sure the other PB00IMG.zip files for the various 2.1 leaks are out there too (I know eu1 has published their locations before...I just don't have it handy at the moment).

lol...my trackball still works just fine. Of course, I never kept it in my pocket or anything. Its always been in the leather case that I bought for it.

I've uploaded the trackball-optional version of the HBOOT flashable file here:

https://sites.google.com/site/scaryalienware/downloads

All due cautions / disclaimers apply of course . Just be sure you double-check the MD5 checksums.

Yeah, it really was pretty fun... There are obviously now several ways to get the custom recovery image flashed, some easier than others. Its nice to know what options there are and how things work. Even though my first attempts at making the Amon_RA flashable .zip didn't work, I had fun trying and learned a lot while doing it (I still think that option is possible too...I'm sure I just have something wonky and not setup right).

Cheers!

scary alien

Hey, no problem... There's actually a ton of adb tutorials and information out "there" too.

scary alien

lol...I've (wait, you've created (yourself!)) a monster! !

It was pretty simple, eh? Glad you got it to work. Pretty cool, eh?

You don't have to have the 1.6.2 recovery installed "first" (not sure what the first context is...). The trackball-optional recovery that I built is pretty much some tweaks to the recovery.c code to recognize the other key presses and was packaged-up using the files that comprise the original 1.6.2 Amon_RA custom recovery for the Eris. Now that was a fun/cool project...I learned a ton from that one, lol.

As far as the rest of your questions go, you have now entered the erisuser1 zone, lol . I could conjecture, but I'm pretty sure I'd be wrong . I'm sure he'll weigh-in at some point and disperse all the fog from the questions posed here .

Cheers!

scotty85

ill be waiting to hear what he has to say for sure!

one final question... with your PB00IMG did it ask you to update? or just do it like mine did?

scary alien

Yeah, mine did ask me if I wanted to update. Gotta be a difference in HBOOT versions (my phone's downstairs at the moment otherwise I'd post what the version number is... If I remember later, I'll update this post).

Cheers!

bobcat331

I know but it's good to someone if a problem arises that experience can answer.

scary alien

No problem, I'm happy to help . adb itself is easy, its usually the USB connectivity that hangs you up.

My biggest gripe is that the newest Android SDK separated the adb.exe from the ddms.bat in different directories. Yeah, I know, I could make update my PATH... (I'm just stubborn ).

Cheers!

scotty85

BC if were patient we might not need to become adb experts. one of the threads said unrevoked was working on a root also. altho i still want to play with it,just for fun. i want to put my eris back to stock and reroot him the old school way

id like to know whats going on and understand the conversations when folks are talkin about it.

back to the other topic,my hboot is the 1.49.2000

not that it really matters if it asks to update or not,i guess... just after one flashes it,one needs to delete the file,rename it, or hide it inside another folder so it doesnt reflash it every time one wants to go into hboot

on my dinc i keep RA_GNM and 2 versions of clockwork hidden in folders on the sd card case i need them and cant get to my puter to move the files over. hard to imagine id really ever need them,but you never know. i hid my tracball optional recovery in another folder,just in case

scary alien

lol...by the way, I'm an idiot!

Of course my HBOOT version is 1.49.2000 (S-OFF) since I originally flashed the base root ROM.

Its just been so long since the bootloader version was relevant to rooting the Eris, I forgot.

Cheers!

scotty85

heres another interesting bit of info... i downloaded and flashed your PB00IMG recovery and was asked if i wanted to update i pushed the tracball to tell it yes.

so now,is it the text file that causes this? im sure we used the same disc image

edit,i just tried it again to be sure... "yes" is the only option. i couldnt figure out how to "no dont update"

Last edited by scotty85; March 20th, 2011 at 10:06 AM.

scary alien

lol...compare the android-info.txt files and see what's different...(I guess).

Wait, let me reference my copy of the HTC Eris bootloader source...

...whoa! had you going for a second didn't I?

scotty85

i did that... got no idea what im lookin at

android-info from your PB00IMG:
ModelID: DESI****
ModelID: PB001****
ModelID: PB00100
CIDNUM: 11111111
CIDNUM: VZW__001
hbootpreupdate: 3
MainVer: 2.19.605.1

AAInfo from mine:
TaskID : 171507
Project : DesireC
SKU : VERIZON WWE[605]
ROM Ver : 2.41.605.6
Customization Id : N/A
RCMS Id : 42

just for the heck of it,RA_GNM 1.8,1 for my dinc(wich does ask me if i want to update and give a "no" option,lol:
modelid: PB3120000
cidnum: VZW__001
mainver: 3.26.605.1
hbootpreupdate:3

scotty85

scary alien

Wow, they are really different...I have no idea...

edit: maybe its the "hbootpreupdate" entry?

scotty85

maybe? or maybe its just the way our bootloader works?

i just modified your android-info file to contain the same 4 items that the one for my dinc has,so now it looks like this:

ModelID: PB00100
CIDNUM: VZW__001
hbootpreupdate: 3
MainVer: 2.19.605.1

tried it again,and same deal,do you want to update? yes or pull battery oh well im still tickled pink it works!

still looking forward to EU1s thots on the S-OFF bootloader posibility

Last edited by scotty85; March 20th, 2011 at 10:50 AM.

erisuser1

Indeed you did.

I haven't read this thread through thoroughly, but I'm wondering if your successful result is only because you guys are using a S-OFF bootloader.

It's easy enough to test, with only a small risk involved - flash the phone completely back to a 2.1 HTC stock, including putting either the 1.47.0000 or 1.49.0000 S-ON bootloader in place ***, and then attempt to use your fudged PB00IMG.zip file. (I suppose you could even leave a rooted ROM in place on the phone, and flash the custom recovery via a root shell and the flash_image program (old skool style), but having a stock ROM means you can use OneClick or Dummies or ...)

Does the .zip file you create have the strange lead-off of 256 bytes as the genuine PB00IMG.zip files from HTC do?


eu1

*** It might be a good idea to flash the "misc" partition with jcase's "Flash any RUU" patch before you run this experiment, just to make sure that you have the maximum flexibility in re-rooting your phone (should something go wrong). You can use ErisMiscReset_v0.9.zip for that - find it in this XDA post

__________________
Please don't send me PMs - post your questions so others may benefit from any answers given.

scary alien

lol...I must admit to having a little chuckle while writing that, know that someone will (like I have in the past ), Google the search string "HTC Eris bootloader source" and will get excited for a second... (I'm a bad puddy-tat sometimes).

Well, I do remember some discussion early-on when the 2.1 leaks came to light about a 256-byte header...weren't they low-values? I can't tell you if these are weird or not since I never really looked at them before, but here's a snippet of three PB00IMG.zip files:

Can you tell from that?

Cheers!

erisuser1

Kinda yes kinda no.

I just downloaded it from your link and took a look; it's not there (which is sort of what I expected).

FYI, octal 240 is only 156 bytes - you would need to dump the first 17 lines of 16 bytes to see the "PK" ( = hex 0x50 0x4b ) "magic number" signature that is the demarcation of the beginning of ZIP file archive. That would occur at byte 256 (offset 0x100 or octal 0400) of a "real" HTC PB00IMG.zip file.

Also, it is easier if you use "hexdump -C" instead of "od -h", because then you don't need to worry about byte swabbing interpretation issues (big-endian vs. little-endian).

If you do something like "hexdump -C PB00IMG.zip | hexdump -C | head -17" on a real HTC PB00IMG.zip file, you will see that the actual zip archive begins at byte offset 256 - the first 256 bytes of the file appear to be an HTC-specific signature of some sort - presumably cryptographic, as it is not the same between different HTC PB00IMG.zip files.


Anyway - the bottom line is this: my conjecture is that you are seeing the result only because you are using a S-OFF bootloader. It has all security turned off, hence the S-OFF designation.

I suppose I would be happy to be proved wrong, but there are extremely practical reasons why it is unlikely that you will find that to be the case: the foremost being the prevention of flashing corrupted or truncated PB00IMG.zip files.

eu1

scotty85

EU1,thanks for your replies. i never imagined that our little experiment here would work with the S-ON bootloader,sorry if i somehow gave those impressions.

what i am wondering is if we can modify the root PB00IMG file so that all it does is install the S-OFF 1.49.000 bootloader? basically remove all files except that wich installs the bootloader?

it would then be easy for folks to get the S-OFF without the battery pull,or having to install the whole update and then re-root. it would be alot less scary,and i presume,low risk?

i still cant open the root PB00IMG file all i get is a "the compressed(zipped) folder is invalid" error message,so i cant even attempt to modify it.

if you or scary wants to whip somethin up to only flash the S-OFF bootloader,id be happy to be the guinea pig to test it

Last edited by scotty85; March 20th, 2011 at 04:09 PM.

bobcat331

I too would be a guinea pig on my 2nd phone. Both of my phones are 1.49.0000 S-ON.

Last edited by bobcat331; March 20th, 2011 at 04:14 PM.

erisuser1

The whole point of crypto signatures is to prevent that from happening. Not specifically the bootloader, but any changes whatsoever. That protects the phone from hapless users that can't seem to download or copy files correctly without screwing up.

There are THREE different signing methods that are in use in different places:

(1) Apps (.apk files), and .jar files are signed with Sun's native "Jar" signing methods. Developer ROM .zip files are also signed this way.

(2) Update.zip files are signed on a whole-archive basis using a signature which appears in the .zip file's "comments" section - the code for this can be seen in the standard Android distribution for the "recovery"

(3) HTC uses a third method - algorithm unknown - that prepends a mystery blob of 256 bytes to the beginning of a .zip file. BTW, this is why your microsoft tools puke on it; if you unzip them with a Unix/Linux version of "unzip", it merely gives you a warning, e.g.:

"warning [Eris_LeakV3_v2.36.605.1_PB00IMG.ZIP]: 256 extra bytes at beginning or within zipfile
(attempting to process anyway)"

The first two methods are public-key crypto methods; even though the code is known, the private key(s) that are in use are unknown, and so even though the algorithm is known, it is still essentially impossible to subvert the signing method. In the third case above (the one the HTC bootloader uses to validate PB*.zip files), not only is the algorithm unknown, but presumably the signing key is unknown as well, too.

That's the long way of saying "good luck with that"

eu1

scotty85

so if i understand that correctly,even if we were able to modify htc's root rom to install only the bootloader,the S-ON bootloader would know,and not allow that update to happen?

thats a bummer.

but at least the recovery works. another good reason to be S-OFF,methinks

scary alien

Yeah, sorry 'bout that...I didn't have Ubuntu booted-up so I just grabbed some Unix utils for Windows and dumped the first part of the files (half-way expecting to see low-values at the front ). Not knowing what to look for, I figured you still might be able recognize what you were looking for even with a partial dump.

I still might run your suggested S-ON experiment you listed earlier, but I would tend to lean towards your inclination that this is all successful due to having the S-OFF setting. My interest was piqued mainly as an additional, fairly simple method of installing my trackball-optional recovery, but it sounds like there'd be too many caveats to include with the instructions, eh?

Thank you again for your insight re. this.

scotty85

not if youre allready S-OFF
1)download
2)make sure sd card is formatted FAT32
3)transfer to root of sd card and rename PB00IMG.zip( if using windows,just "PB00IMG" as windows adds the.zip automatically)
4)power off
5)power on holding vol - to enter hboot.wait for update promt
6)push track ball. wait for install to complete.
7)push track ball again to reboot

easy as 1,2,3

i think more people need to become s-off. either by installing the root PB00IMG and re-rooting,or doing the battery pull. or,if youre lucky enuff to have the S-ON 1.49.000 there is a .zip you can flash in recovery.

on my incredible, hboots are flashable as PBxxIMG files as well... am i correct in assuming that there would not be a way to flash the 1.49.0000 S-ON bootloader in hboot without losing root? if it were possible, a person could upgrade from 1.47.0000 to 1.49.0000 then flash the S-OFF .zip

scary alien

Well...I feel I should prepare you for the proper and obilgatory warning from eu1 that "flashing the bootloader is the single most dangerous thing you can do on your phone" .

We've seen tale after tale of users that are not really all that careful about following instructions to the letter... So, this makes encouraging folks to get their bootloaded upgrade to S-OFF a pretty scary proposition. eu1 actually used to encourage this (getting the S-OFF bootloader) and shortly thereafter backed-away from this advice (he more than almost anyone has dealt with the vagaries of some people's penchant for looking before leaping, if you will).

Not all are as careful (as we are? ) in the things that they do to their phone...

Just sayin'...

Last edited by scary alien; March 21st, 2011 at 08:56 PM. Reason: spelling ;)

bobcat331

What's the dummies way to get S-OFF?

scotty85

since you have the 1.49.0000 bootloader(s) the easiest thing for you would be to flash the "erisengspl.zip" in recovery.

xda link here:
http://forum.xda-developers.com/showpost.php?p=8680709&postcount=29
and a lil more info here:
http://forum.xda-developers.com/showpost.php?p=8897869&postcount=4

if that fails,the only way is to install the "root rom" PB00IMG file(linked above my mister alien).

you can let it completely install,then re-root after.

or...

you can do the "battery pull" as described here:
Visual Example: The PB00IMG.ZIP update method

basically,you start to install the root rom update,then pull the battery after the bootloader is installed it sounds scary,but its how i did it

but i think the .zip will work for you. try it and report back worse thing that happens is youre still S-ON if it fails

Last edited by scotty85; March 20th, 2011 at 06:32 PM.

bobcat331

The test phone is now 1.49.2000 S-Off. Now I'll do the DD.

* DD is now S-OFF. Like a walk in the park.

Last edited by bobcat331; March 21st, 2011 at 03:35 AM.

scotty85

bberryhill0

How do I find out which hboot I'm running? I'm going to guess that I have to boot into recovery.

* Oh. QuickBoot has a bootloader option. I'm on 1.49 S-ON.

__________________
My Eris apps

Last edited by bberryhill0; March 20th, 2011 at 11:23 PM.

bobcat331

Flashing the zip method will NOT work on the 1.47. Read the Link Scotty provided. Just looking out.

Last edited by bobcat331; March 21st, 2011 at 06:56 AM.

scotty85

1.49 should be the only bootloader the .zip method DOES work on! it defaintely doesnt work with 1.47(thats wat mine was)

what method did you use BC?

bobcat331

Boy it was way early when I posted that. Disregard.
I edited that post.

Last edited by bobcat331; March 21st, 2011 at 06:57 AM.

scotty85

oooooh,lol

erisuser1

Two things to add to this thread.

(1) Please, please, PLEASE use all digits of the bootloader version number when referring to specific bootloader(s)

1.49.0000 S-ON
1.49.2000 S-OFF

Clearly, just saying "1.49" is completely ambiguous.

(2) If there was a way to flash a bootloader with a PB00IMG.zip file that was not signed by HTC's key, it would nevertheless be a bad idea: performing very dangerous flashing operations using unsigned and unverified inputs has obvious problems when newbs are involved - look at the daily stream of folks who can't seem to get an intact ROM file to their phone's SD card.

Same goes for using S-OFF bootloaders with fastbooot, or "unsigned" PB00IMG.zip files - it is like an open invitation for disasters to happen.

eu1

brock350

How would you change it back to s -on? Incase you had to exchange it? I doubt they would look but you never know.

erisuser1

fastboot flash hboot hboot_7501a_1.47.0000_091023.nb0

scotty85

Thanks eu1. Ill have to try this. I assume this is thru adb in fastboot? Or just in charge mode?

scary alien

Scotty,

See the bottom part of the first post in this thread Amon_RA 1.6.2 Custom Recovery: trackball not required! for a mini-tutorial re. fastboot with the requisite warnings re. double-checking your MD5 sums courtesy of eu1.

As usual, flashing your bootloader requires care to make sure the file you will flash is good and that you have a full charge on your phone, etc. (waving a chicken or two around might not hurt either ).

Cheers!

scotty85

thanks scary. i hadnt realized that was down there! id used the adb part to change my recoveries,but dint notice the fastboot instructions

i have practiced switching recoveries with the fastboot method.

so what file would i need to put in my tools directory if i wanted to use the above command to revert to an s-on bootloader?

scary alien

You would need the HBOOT file that eu1 listed above, triple-check the MD5 (), put your phone in fastboot mode, and then issue the command eu1 gave from the SDK tools directory.

Cheers!

scotty85

any ideas where i would find it?

scary alien

lol...I realized a few minutes after I posted that that was going to be your next question .

I'm pretty sure it should be in one of the 2.1 leaks...lemme check my files real quick...brb...

edit 1: okay, strike that...its in the RUU, according to eu1's thread:

http://forum.xda-developers.com/showthread.php?t=686598

edit 2: RUU_MR2 is here: http://www.pcdphones.com/our-devices/products/46-adr6200vw (I'm grabbing to examine it ...)

Last edited by scary alien; April 1st, 2011 at 07:50 PM.