Root Porting ClockWorkMod to the Kyocera Rise

OverByter · Oct 17, 2013

That's ridiculous, Kyocera is the only one who would have that information, the carriers certainly don't. :rolleyes:

OB

mel4787 · Oct 17, 2013

ik. seems to me that they dont want that type of power to us. hmm is there a way to build cwm to match the checks the bootloader goes through? im wondering on that.

rbheromax · Oct 17, 2013

guys lets not be foolish. why would kyocera help desk have secret unlock codes to just give out??? come on.....be logical. only the developer team that works for them would have it. I am about to get in contact with one of their devs (I have his name and email) and see if he can leak the info for us.
wish me luck

mel4787 · Oct 17, 2013

Let's hope he does give that out

lnr4e · Oct 17, 2013

Good luck

kman9637 · Oct 17, 2013

mel4787 said:
just got an email from kyocera and this is what they said:

Let me share you a little piece of information that most of our customers does not know. The main reason on why we don't provide the codes to unlock the bootloader of the phone are that we as agents, we don't have access to that information at all in our system, and the other main reason is that we only manufacture the phones based on what the service providers request the phone to be.

So, unfortunately I am not going to be able to assist you with the unlocking part for the bootloader on the phone.

how can we go about this with the bootloader if they dont have that type of info in their computers or is it another run around?

I also got an email from Kyocera earlier

Thank you for contacting Kyocera Communications Inc. This message is in response to your email regarding the information about the bootloader unlock.

Let me share you a little piece of information that most of our customers does not know. The main reason on why we don't provide the codes to unlock the bootloader of the phone are that we as agents, we don't have access to that information at all in our system, and the other main reason is that we only manufacture the phones based on what the service providers request the phone to be.

So, unfortunately I am not going to be able to assist you with the unlocking part for the bootloader on the phone.

The service providers wouldnt request it to be locked (they probably think of other networks).

imma call and ask for the manager at some point. but honestly, the agents are liars in my opinion

mel4787 · Oct 17, 2013

Idk if the manager will do or say anything of their phones. They may lie to u on this as well.

cooldudezach · Oct 18, 2013

mel4787 said:
remember if you do try you could end up with a brick. and the extra security we cant even find in these phones. i wonder how these companies add security to these phones. if i knew how they did that then i could say something more on this. its not like we can build a bootloader from the ground up and flash it with adb

Well, we could build a bootloader, but it would take even longer than it would take to decompile the existing bootloader.

kman9637 said:
If somebody feels ballsy they could overwrite the bootloader partition with another bootloader and pray to the tech gods it somehow manages to start up. Im running out of ideas.

It's been done, the phone was bricked. Not exactly sure why, probably because the bootloader is essentially split up onto different partitions, but only one partition was flashed.

mel4787 said:
ik how you feel. its just the security thats the true problem. we have root and can do what we need it to do. we just need to find someway to decrypt the security whych no one has found yet.

We know where the security is, basically. It's in the bootloader. What's happening is there is the boot/recovery images are being checked against Kyocera's signing keys using RSA encryption. We could *possibly* decompile the bootloader enough to find said keys, but there is no guessing how long that would take. It could take a couple days if we got lucky, or it could take months of meticulous decompiling.

kman9637 said:
The service providers wouldnt request it to be locked (they probably think of other networks).

imma call and ask for the manager at some point. but honestly, the agents are liars in my opinion

I'm not sure if you meant would or wouldn't, but the carriers do request it to be locked/not locked/encrypted/whatever. Either that, or they do it themselves.

mel4787 said:
ik. seems to me that they dont want that type of power to us. hmm is there a way to build cwm to match the checks the bootloader goes through? im wondering on that.

Not that I'm aware of. I've heard of an exploit that causes the bootloader to skip the hash check when it loads the boot/recovery image, because there is a buffer overflow or something in the image header and then proceeds to boot normally. Not that we could really do that here in any case.

mel4787 · Oct 18, 2013

well i say build a bootloader that mimics the kyocera bootloader. but how many partitions are in the bootloader? we may need to decompile that to find the keys. it might be the only way. most of us have the patience for that. ik i am patient.

cooldudezach · Oct 18, 2013

mel4787 said:
well i say build a bootloader that mimics the kyocera bootloader. but how many partitions are in the bootloader? we may need to decompile that to find the keys. it might be the only way. most of us have the patience for that. ik i am patient.

Like I said, it would be quicker to decompile the bootloader to extract whatever the bootloader is using to check the hash of the images. This process is difficult at best, and very time consuming. If we had the keys, we could sign custom images to our hearts content. Of course, this is assuming it is possibly to extract the hashing method from the bootloader through decompilation.

mel4787 · Oct 18, 2013

yeah you're right. i just want these phones potential to be put to the test of performance. plus be updated to jelly bean. imma look into rsa signature to see if i can find something in it

rbheromax · Oct 18, 2013

does anyone know what this file is?
http://dev.dtalley11.com/rbheromax/qcattest.crl

it is SSL/TLS CRL (file type)

edit: and yes this is for the kyocera rise. it is on geotrust.com website hidden

dtalley11 · Oct 18, 2013

rbheromax said:
does anyone know what this file is?
http://dev.dtalley11.com/rbheromax/qcattest.crl

it is SSL/TLS CRL (file type)

edit: and yes this is for the kyocera rise. it is on geotrust.com website hidden

I get a 404. Are you sure it's in your ~/share folder?

I have not had the time to read through everything, but from what I read there still seems to be a bit of misunderstanding, so I'll try and get everybody on the same page.

A. The bootloader is unlocked
Yes/No... it's "Unlocked" on certain carrier's phones (the sprint version for example) but not on others, and it's not even really unlocked it just allows us to temperately boot an boot image without the image ever touching the emmc (Right from usb to ram)

B. X exploit will work? No? How about Y?
I doubt any known exploits will work at least as they are. rbheromax has done a great deal of research on this and isn't just saying that we'd have to decompile the bootloader just to get rsa keys. This sort of thing is why workarounds are used. As soon as I get my 3rd rise I'll get back into hacking it and see if I can get 2nd-init to work. To the end user who just wants Cyanogenmod, they will not know the difference between 2nd-init and a truly unlocked bootloader.

That being said, it's awesome that you guys are hounding kyocera on this, it's the best way to get the bootloader unlocked and even if we get a work around, an unlocked bootloader is always better. I bricked my 2nd rise by flashing sprint firmware to the VM rise.

rbheromax · Oct 18, 2013

dtalley11 said:
I get a 404. Are you sure it's in your ~/share folder?

I have not had the time to read through everything, but from what I read there still seems to be a bit of misunderstanding, so I'll try and get everybody on the same page.

A. The bootloader is unlocked
Yes/No... it's "Unlocked" on certain carrier's phones (the sprint version for example) but not on others, and it's not even really unlocked it just allows us to temperately boot an boot image without the image ever touching the emmc (Right from usb to ram)

B. X exploit will work? No? How about Y?
I doubt any known exploits will work at least as they are. rbheromax has done a great deal of research on this and isn't just saying that we'd have to decompile the bootloader just to get rsa keys. This sort of thing is why workarounds are used. As soon as I get my 3rd rise I'll get back into hacking it and see if I can get 2nd-init to work. To the end user who just wants Cyanogenmod, they will not know the difference between 2nd-init and a truly unlocked bootloader.

That being said, it's awesome that you guys are hounding kyocera on this, it's the best way to get the bootloader unlocked and even if we get a work around, an unlocked bootloader is always better. I bricked my 2nd rise by flashing sprint firmware to the VM rise.

oops, wrong link

http://dev.dtalley11.com/rbheromax/qctattest.crl

and im looking to make something like loki (but not loki) for our devices. I skimmed thru ALL the partitions you dumped and noticed quite a few are zero'd out. there has to be a reason for that. also there isnt a fastboot function in aboot where it is supposed to be so i think the no fastboot thing is even deeper than we thought. The guy i was supposed to email, I somehow lost his email and he has been off the radar since late June. He holds several patents for Kyocera device specs?? and signed off on the bootloader. As soon as I can find the source kyocera used (im very very close)
to make the bootloader, I can read the clear text and make an exploit.

dtalley11 · Oct 18, 2013

rbheromax said:
oops, wrong link

http://dev.dtalley11.com/rbheromax/qctattest.crl

and im looking to make something like loki (but not loki) for our devices. I skimmed thru ALL the partitions you dumped and noticed quite a few are zero'd out. there has to be a reason for that. also there isnt a fastboot function in aboot where it is supposed to be so i think the no fastboot thing is even deeper than we thought. The guy i was supposed to email, I somehow lost his email and he has been off the radar since late June. He holds several patents for Kyocera device specs?? and signed off on the bootloader. As soon as I can find the source kyocera used (im very very close)
to make the bootloader, I can read the clear text and make an exploit.

Lets hope he forgets about that NDA he signed as well, huh?

I've seen this qctattest.crl, I think I pulled it out of one of the partitions

rbheromax · Oct 18, 2013

i forgot they gotta sign those....eh maybe it'll be like "You didnt see anything......"
this file is embedded into aboot lol which is why i thought it was weird that geotrust.com had it on their servers

mel4787 · Oct 19, 2013

2 questions,

1) i heard someone opened up their rise, is there anything in it that we can plug into to reinstall the stock firmware and,

2)about the build prop, can you change the number on the android os to mimic a past os like changing 4.0.4 to 4.0.3 in the build prop?

cooldudezach · Oct 19, 2013

dtalley11 said:
B. X exploit will work? No? How about Y?
I doubt any known exploits will work at least as they are. rbheromax has done a great deal of research on this and isn't just saying that we'd have to decompile the bootloader just to get rsa keys. This sort of thing is why workarounds are used. As soon as I get my 3rd rise I'll get back into hacking it and see if I can get 2nd-init to work. To the end user who just wants Cyanogenmod, they will not know the difference between 2nd-init and a truly unlocked bootloader.

Is there any way to figure out how exactly it's checking the images from decompiling the bootloader? If so, would we be able to use that to our advantage?

rbheromax · Oct 19, 2013

thats how the loki exploit works, it finds what is checking images, and deletes the RAM entry with replaces it, forcing booting of new kernel allowing for custom krenels and recoveries

dtalley11 · Oct 19, 2013

mel4787 said:
2 questions,

1) i heard someone opened up their rise, is there anything in it that we can plug into to reinstall the stock firmware and,

2)about the build prop, can you change the number on the android os to mimic a past os like changing 4.0.4 to 4.0.3 in the build prop?

1. I didn't find anything, I mean it might take a more trained eye then my own but I highly doubt there was anything there

2. You can, it doesn't do much good though cause the OS acts the same way regardless it's just what it tells the users and tells other apps to expect. (often messes a few things up)

mel4787 · Oct 19, 2013

Well that sums that up. I asked the first question because on bricked devices. I heard of jtag and don't know if it could be used for anything besides returning to stock. Also on other locked devices with security like this how were they exploited is there a way to look at other devices and see on things like that? How was cwm on other locked phones ported? What exploits on those were discovered

dtalley11 · Oct 19, 2013

mel4787 said:
Well that sums that up. I asked the first question because on bricked devices. I heard of jtag and don't know if it could be used for anything besides returning to stock. Also on other locked devices with security like this how were they exploited is there a way to look at other devices and see on things like that? How was cwm on other locked phones ported? What exploits on those were discovered

These ideas we have been talking about practically the entire time did not come from thin air. Exploits are not the most documented thing about android but we've been trying to run through everything that has been done on other phones. Loki is currently the newest way that I know of which works with more than 1 device. If I were to explain every exploit used, it would be a very long thread of it's own, even just the ones I know about.

Well, I have not been successful unbricking my rises, if you find a way to do so then it will be news to me.

mel4787 · Oct 19, 2013

Well I'm not gonna stop until this boot loader gets unlocked

1) is there a way to put the old 4.0.3 firmware on here via adb? If so then I have an idea.does this forum have a 4.0.3 firmware on here for the rise

2) is there a way to flash, use adb, or dd fast boot on here?

dibblebill · Oct 20, 2013

I don't know that the Rise ever had 4.0.3. Mine always had 4.0.4 when I had it. Anybody else able to weigh in on that?

daffyducknj · Oct 20, 2013

dibblebill said:
I don't know that the Rise ever had 4.0.3. Mine always had 4.0.4 when I had it. Anybody else able to weigh in on that?

Did your phone get the update from last January? If not, your phone may have been loaded with it out of the box. Depends on when you got it, I guess.

Root Porting ClockWorkMod to the Kyocera Rise

Resident Slide Rule Guru

Android Enthusiast

Android Expert

Android Enthusiast

Member

Well-Known Member

Android Enthusiast

Android Enthusiast

Android Enthusiast

Android Enthusiast

Android Enthusiast

Android Expert

Member

Android Expert

Member

Android Expert

Android Enthusiast

Android Enthusiast

Android Expert

Member

Android Enthusiast

Member

Android Enthusiast

Android Expert

Android Enthusiast

BEST TECH IN 2023

Smartphones

Best Android Phones

Upcoming

Best iPhones

Upcoming

Tablets

Best Tablets

Upcoming

Laptops

Best Laptops

Upcoming

Televisions

Best TVs

Upcoming

Game Consoles

Best Game Consoles

Upcoming

Wearables

Best Wearables

Upcoming

Smart Home

Smart Home Tech

Upcoming

Similar threads