Root Interesting "Security" on Commando

[getitnowmarketing]

I have some good & bad news for commando development.

I have made and tested a perfectly working recovery for commando. It was a pita too as I had to alter the framebuffer driver to even get the recovery UI to display properly. The bad news is due to hopefully an unintentional engineering flaw in commando I don't feel comfortable releasing it currently.

NEC of course has fastboot blocked on the device and its a Code Aurora Foundation source device using "little kernel bootloader". The fault lies in the bootloader as it seems there is NO hardware key combo to boot recovery from a powered-off state (I also tried every key combo on it and verified from an inside source that there is no alternate hard-reset method). This bootloader is not capable of being updated via OTA so they can't easily "fix" it. The only way to boot into recovery is to call recovery from inside the OS via adb reboot recovery, a reboot binary, or to send the boot recovery intent like an ota update does. What this means is if you use this custom recovery and tinker/flash something to your phone that makes it unable to boot into android you will be software bricked and unable to recover. This also means that if you get pin/gmail account locked out of your stock phone and thus can't get into the settings menu you will also have no way to recover. To deepen this "security" NEC has also disabled the select/enter key in stock recovery meaning if a gmail locked stock phone user could issue "adb reboot recovery" they would be unable to even select the wipe data/factory reset option.

You know the more I think of it I'm nearly 100% certain this was no accident and is the most unusual "security" I've ever seen a company use on an android. Kudos to NEC for really thinking out of the box on this one!!

I'm hoping some of you users might find a hardware key way to boot recovery. In this current state I think it may be too dangerous to unlock for the masses the ability to flash custom roms & kernels.

Anyone who just wants to root the phone psneuter works flawlessly on it.

 

[baldrob]

Good to have some confirmation on the not being able to boot into recovery from a powered off state. I drove myself nuts for about an hour trying all the possible combos. I also ran into not being able to select anything when I booted into recovery from rom manager. What I don't get is what's the point of a recovery that you can't make do anything?

I'm guessing that NEC has a program similar to RSDlite or odin to restore software bricked phones. Looks like development is going to hinge on whether or not it's made available to us.

 

[getitnowmarketing]

Good to have some confirmation on the not being able to boot into recovery from a powered off state. I drove myself nuts for about an hour trying all the possible combos. I also ran into not being able to select anything when I booted into recovery from rom manager. What I don't get is what's the point of a recovery that you can't make do anything?

I'm guessing that NEC has a program similar to RSDlite or odin to restore software bricked phones. Looks like development is going to hinge on whether or not it's made available to us.

The enter/select key in stock recovery is not needed for an ota update as that is all automated. I guess that was all they intended anyone to do. I wouldn't hold your breath on a PST type tool for flashing surfacing either.

 

[rjglenn]

This morning I was shopping at the local Wal-Mart. When I got to the car I pulled my phone out of my pocket and it was in recovery mode. The little box w/ the arrow & the Android guy, plus a menu...

I know, it's the internet - no pictures means it didn't happen but...

Anyhow, by using the volume buttons I was able to scroll up and down through the selections but I could not select anything and ended up doing a battery pull to get it to reboot. When the phone was rebooted it had been wiped/reset.

The phone was on and the screen was locked when I put it in my pocket. I'm connected to an exchange server that has a screen lock configured as part of the security settings.

The phone is rooted with some of the carrier apps removed and had the ADW launcher installed.

So far I have not been able to duplicate this.

So, anybody have any idea how I got it to go onto recovery?

 

[buddyisonfire]

Man, I was really hoping to install some custom ROMs on this phone, but I guess that wont be happening anytime soon. I've been an iPhone/AT&T customer since day 1 and followed the jailbreak scene from the beginning. Just switched to Verizon today and got the Commando. I was really looking forward to getting into Android modding so hopefully some progress will be made on this soon. I'd love to help, but I'm not much of a developer. My skills are in the graphic department so if anyone needs help there in any way let me know. getitnowmarketing, if you make any progress I'd love to donate to you. I'd really like to see Cyanogen ported to the Commando, but that seems like a stretch. If there's a places with more current info for the developement status of the Commando I'd appreciate it if someone could point me there. I've been googling for hours and, sadly, this was the most promising thing I could find.

 

[un1ocked]

wow, a phone without a software "backdoor"... really dissapointing
how can we hope for a gingerbread

 

[mtnbikerfred]

There is hope.

http://www.casiogzone.com/commando/

Click on specs. Notice the the button that says "Download GPL"

 

[bigdanmeys13]

What would one do after obtaining this information?

 

[Rafael]

In that GPL is a text file that reads: (May as well be Greek to me)

This document describes how to build a build for the C771. Please follow the steps below to complete the Build.

---
1. Download the Base environment from Code Aurora Forum (CAF) found at https://www.codeaurora.org/

The Manifest File is as follows:
https://www.codeaurora.org/contribute/projects/qaep
<Release on froyo_pumpkin branch>
November 12, 2010 M7630AABBQMLZA203002 msm7630 froyo_pumpkin M7630AABBQMLZA203002.xml

$ repo init -u git://codeaurora.org/platform/manifest.git -b froyo_pumpkin -m M7630AABBQMLZA203002.xml
$ repo sync

2. Overwrite the C771's open source environment with the environment downloaded in Step 1.

3. Add the (JDK) Java Development Kit's path to the environment variable PATH.
example: $ export PATH=<JDK's install path>/bin:$PATH

4. Run the commands below:

 

[rickyblaze]

I sent a request to NEC Casio about letting out the boot loader code and this is what they sent me:
Rick,

The phone was made to Verizon specifications and unfortunately, we do not have the information you are requesting. Sorry for any inconvenience that this may cause you. Customer By Web Form (Rick Knapp)09/12/2011 10:23 PMI was wondering if NEC Casio would follow suit along with HTC and give their customers the ability or program to unlock the bootloader for the C771 Commando. This is a wonderful phone but could be made so much better by giving customers a way to create and load their own rom. There are several out that would fill the bill but to date no body has a way to load them onto this phone as their is no hardware keys programmed to get into boot. Any help I'm sure would be appreciated by the many people who want to make a great phone even better

So if they are telling the truth why would they release the GPL down load with the info in it telling us how to manipulate the code with out a way of flashing it ??

 

[bduemig]

So if they are telling the truth why would they release the GPL down load with the info in it telling us how to manipulate the code with out a way of flashing it ??

It may not be a truth issue, but a legal issue. they may not be allowed to release per contract with Verizon!!

 

[rickyblaze]

Yes you are probably right. On my second contact I asked them why they would make the GPL available and the response was " It is for developers to make apps and such" It still has to be flashed and they still have to have an unlocker. Oh well I tried

 

[Louis Tully]

the only security when i go commando is my pants

 

[canyon man]

I have some good & bad news for commando development.

I have made and tested a perfectly working recovery for commando. It was a pita too as I had to alter the framebuffer driver to even get the recovery UI to display properly. The bad news is due to hopefully an unintentional engineering flaw in commando I don't feel comfortable releasing it currently.

NEC of course has fastboot blocked on the device and its a Code Aurora Foundation source device using "little kernel bootloader". The fault lies in the bootloader as it seems there is NO hardware key combo to boot recovery from a powered-off state (I also tried every key combo on it and verified from an inside source that there is no alternate hard-reset method). This bootloader is not capable of being updated via OTA so they can't easily "fix" it. The only way to boot into recovery is to call recovery from inside the OS via adb reboot recovery, a reboot binary, or to send the boot recovery intent like an ota update does. What this means is if you use this custom recovery and tinker/flash something to your phone that makes it unable to boot into android you will be software bricked and unable to recover. This also means that if you get pin/gmail account locked out of your stock phone and thus can't get into the settings menu you will also have no way to recover. To deepen this "security" NEC has also disabled the select/enter key in stock recovery meaning if a gmail locked stock phone user could issue "adb reboot recovery" they would be unable to even select the wipe data/factory reset option.

You know the more I think of it I'm nearly 100% certain this was no accident and is the most unusual "security" I've ever seen a company use on an android. Kudos to NEC for really thinking out of the box on this one!!

I'm hoping some of you users might find a hardware key way to boot recovery. In this current state I think it may be too dangerous to unlock for the masses the ability to flash custom roms & kernels.

Anyone who just wants to root the phone psneuter works flawlessly on it.

please please
dew to my battery status bar not working properly, i was modding with metamorph and my battery died. i did save a backup with rom mangier so what i was hopping is to use this program or any program to access my backup and save my phone. i have had it for about 6 weeks.

 

[Rafael]

Anyone else notice the four test points under the rubber covers which are concealed by the battery cover?
They look similar to the antenna connector on my original Moto Droid.

The rubber covers pop off with a small instrument.

 

[rjglenn]

please please
dew to my battery status bar not working properly, i was modding with metamorph and my battery died. i did save a backup with rom mangier so what i was hopping is to use this program or any program to access my backup and save my phone. i have had it for about 6 weeks.

I am afraid you are pretty much screwed. I am assuming you are stuck in a bootloop. If you are familiar with adb commands, try this:

From the off state connect your phone to your computer. On your computer go to the folder that has your adb stuff.

Power up the phone and meanwhile type:

adb wait-for-device reboot recovery

This will boot your phone into recovery. There will be the familiar triangle with exclaimation mark. Press the home button to toggle to the recovery menu. You can use the volume up/down key to scroll through menu.

Here is the problem, that's all you can do. There is no known button press to actually select any of the functions on the recovery menu; none, zip, nada! ADB won't do anything either while in recovery. The fastboot and the bootloader commands do nothing.

Using adb during power up before the loop starts you can do most anything adb will do except delete, save, or rename any of the system files.

You will not be able to make or restore any nandroids, apply any update.zip's, or any other cool stuff.

Sorry to be the bearer of bad news - my screw up cost me about $478 because I had to buy a new phone...

If you do figure out a way to do any of this, please post back because there are many who would love to be able to have a working recovery to do more stuff.

 

[canyon man]

I am afraid you are pretty much screwed. I am assuming you are stuck in a bootloop. If you are familiar with adb commands, try this:

From the off state connect your phone to your computer. On your computer go to the folder that has your adb stuff.

Power up the phone and meanwhile type:

adb wait-for-device reboot recovery

This will boot your phone into recovery. There will be the familiar triangle with exclaimation mark. Press the home button to toggle to the recovery menu. You can use the volume up/down key to scroll through menu.

Here is the problem, that's all you can do. There is no known button press to actually select any of the functions on the recovery menu; none, zip, nada! ADB won't do anything either while in recovery. The fastboot and the bootloader commands do nothing.

Using adb during power up before the loop starts you can do most anything adb will do except delete, save, or rename any of the system files.

You will not be able to make or restore any nandroids, apply any update.zip's, or any other cool stuff.

Sorry to be the bearer of bad news - my screw up cost me about $478 because I had to buy a new phone...

If you do figure out a way to do any of this, please post back because there are many who would love to be able to have a working recovery to do more stuff.

hello thanks for the info

sorry i have not used adb i did download the app and i just couldn't get it to work

i told verizon what had happened and they told me my manufacture warrenty was voided do to i broke my screen... i am going to contact casio or another refurbishing company and see if they can flash my filmwhere.

another thing i cant get my comp to recognize my phone, this might be because my phone will not stay off

i love playing with linix os and stuphh and would love to try and get the recovery to work thanks for all the help

i do have another casio commando on the way if anyone can help me it would be much appreciated

and my sd card in or out will change things on the boot up loop is there any suggestions on that.

something like rnds would be fricken wonderful and would save my life

 

[amitydawn]

Whatis psneuter? What is rootin
g? I want to use my easy tether app. Computer will not does not find driver

 

[cbreze]

Whatis psneuter? What is rootin
g? I want to use my easy tether app. Computer will not does not find driver

I use easy tether just fine and unrooted. You need to install the drivers since Verizon/Casio left them off. There's a thread about it.

 

[bradenfontaine]

i guess this is in military spec as well? MUAHAHAHA..... (crying inside)

 

[deples]

I have one casio screen locked with gmail account,
same, I have not been able to resolve it.

 

[bennjammin]

This morning I was shopping at the local Wal-Mart. When I got to the car I pulled my phone out of my pocket and it was in recovery mode. The little box w/ the arrow & the Android guy, plus a menu...

I know, it's the internet - no pictures means it didn't happen but...

Anyhow, by using the volume buttons I was able to scroll up and down through the selections but I could not select anything and ended up doing a battery pull to get it to reboot. When the phone was rebooted it had been wiped/reset.

The phone was on and the screen was locked when I put it in my pocket. I'm connected to an exchange server that has a screen lock configured as part of the security settings.

The phone is rooted with some of the carrier apps removed and had the ADW launcher installed.

So far I have not been able to duplicate this.

So, anybody have any idea how I got it to go onto recovery?

There is a hardware/ button/ key combo to reset the phone. When you hold the power button and let go the phone does a quick vibrate and starts to turn on. Then the screen shows the "GzOne" logo. While in this state the led light turns red for 2 seconds. In thes two seconds press the volume down, power, and camera. (It doesn't matter in what order you press them just as long as you press all three of them before the red led light goes off.) You have little time to do this so my hint is to keep your fingers on all three buttons at the same time while waiting for the red led light to turn on.

Doing this will bring up in white letters the option to wipe and reset your phone - ........"Press power button to continue"... or something like that. after pressing the power button once another option comes up in yellow letters. This is a conformation page I believe. Not completely sure what this one says but, - ......."Press power button to factory reset"... or something like that.

Doing that will reset your phone to factory reset and wipe all of your data and take your phone number off.

I did this to my phone (BUT since I have a rooted phone and I have recovery) it brought up the recovery menu.

That's how you can access the recovery menu with hardware button combo. I am not sure if it still factory resets the phone even after going into recovery but i am still testing that theory.

TIP: In the recovery use the volume rocker to scroll the menus and the menu button to select for those of you who didn't know.

WARNING: accessing the recovery this way may reset your phone make sure you have backed it up.

rjglenn I think this is how you got into the recovery and your phone was reset. But if this is what happen I'm confused on how it happened while the phone was in your pocket unless you have some kind of pocket troll in your pocket resetting your phone to just make you mad.

Hope this helps for anyone.

 

[Willster419]

Accessing the custom gnm recovery this way does not reset the phone