Root Team ItsOnKyo

TechDad378 · Sep 18, 2014

This is for the sole purpose of putting clockworkmod on the Rise. In order to do so the bootloader will need.to be unlocked.

In order to post on this section you will need to list the top 3 tests you did while attempting this feature. If you have not tested this device list 3 things which will qualify you, to contribute to this post.

If you cannot follow above, your post will be deleted. It may sound harsh but this phone missing these features has gone on long enough.

With that said let's get to it. Here is what I know and done with this phone in no particular order.

1. I made a very informative tutorial for rooting the Rise. Just search Google for "Kyocera Rise Root" its ranked #1.

2. The tutorial can root other Kyocera devices as well.

3. I was able to determine that the Xposed framework works on the Rise.

4. The boot loader is loaded on the device by using u-boot.

5. Was able to compile a clockwork mod from builder section of the cwm site which was successful according to CWM.

6. Installed the CWM but it will not run on the device. Though the device boots normally but no recovery is found. I can revert back to original recovery and the device will work as normal.

7. The boot loader works off an absolute address. When the address is changed it will cause the device to reboot automatically. When the device cannot resolve the address change it will cause the dreaded bootloop.

8. The device uses secureboot. This was put in place by the manufacturer in order to protect their proprietary.

9. Secureboot is tough to crack but it can be bypassed by putting CWM in the memory cache. The memory cache is flushed somewhat on reboot but it can be altered to keep the CWM. The device would have to be tricked into looking for the boot loader from the cache.

9. A good understanding of u-boot will help, as well of knowledge about secure boot.

10. Will be able to reproduce install file, generic driver and CWM if needed.

Are you up for this task? Post below and welcome to "Team ItsOnKyo"...

rbheromax · Sep 18, 2014

TechDad378 said:
This is for the sole purpose of putting clockworkmod on the Rise. In order to do so the bootloader will need.to be unlocked.

In order to post on this section you will need to list the top 3 tests you did while attempting this feature. If you have not tested this device list 3 things which will qualify you, to contribute to this post.

If you cannot follow above, your post will be deleted. It may sound harsh but this phone missing these features has gone on long enough.

With that said let's get to it. Here is what I know and done with this phone in no particular order.

1. I made a very informative tutorial for rooting the Rise. Just search Google for "Kyocera Rise Root" its ranked #1.

2. The tutorial can root other Kyocera devices as well.

3. I was able to determine that the Xposed framework works on the Rise.

4. The boot loader is loaded on the device by using u-boot.

5. Was able to compile a clockwork mod from builder section of the cwm site which was successful according to CWM.

6. Installed the CWM but it will not run on the device. Though the device boots normally but no recovery is found. I can revert back to original recovery and the device will work as normal.

7. The boot loader works off an absolute address. When the address is changed it will cause the device to reboot automatically. When the device cannot resolve the address change it will cause the dreaded bootloop.

8. The device uses secureboot. This was put in place by the manufacturer in order to protect their proprietary.

9. Secureboot is tough to crack but it can be bypassed by putting CWM in the memory cache. The memory cache is flushed somewhat on reboot but it can be altered to keep the CWM. The device would have to be tricked into looking for the boot loader from the cache.

9. A good understanding of u-boot will help, as well of knowledge about secure boot.

10. Will be able to reproduce install file, generic driver and CWM if needed.

Are you up for this task? Post below and welcome to "Team ItsOnKyo"...

I'm in. Still have my hydro. Same device essentially. I'm think I'm qualified enough....

modhatter6811 · Sep 18, 2014

rbheromax said:
I'm in. Still have my hydro. Same device essentially. I'm think I'm qualified enough....

I know you're more than qualified.

My wife has an old rise that we no longer use, and I'm more than willing to risk bricking it. Count me in as well. Lets do it!

rbheromax · Sep 18, 2014

Do u think kyocera event could be used too? I have one of those too

cooldudezach · Sep 18, 2014

rbheromax said:
Do u think kyocera event could be used too? I have one of those too

Yeah, same hardware. I have an event or two, same with the hydro, and a number of Rises.

Here is a short off-the-top-of-my-head list of stuff I've done:

1. First to really start any in-depth testing for getting CWM on the Rise

2. Identified the partition information

3. Successfully built and ran version of CWM temporarily
(also ran other peoples builds to confirm, only on Sprint/PM Rise)

4. Bricked upwards of 5-10 Rises performing tests >.>

cooldudezach · Sep 18, 2014

Also, bringing my collection of phones to work today and will test them out

(I work at my college in the computer lab, closing shift, so it's always pretty dead.)

rbheromax · Sep 18, 2014

Just a thought.....
Usually decides with emmc use LK boot loader from Qualcomm (little kernel)
NAND devices use u-boot
I think we might be using LK
Both projects are open source so that's good for us.

cooldudezach · Sep 18, 2014

rbheromax said:
Just a thought.....
Usually decides with emmc use LK boot loader from Qualcomm (little kernel)
NAND devices use u-boot
I think we might be using LK
Both projects are open source so that's good for us.

Oh, we use LK for sure.

Also, just went through my LBOP (little-box-of-phones) and, to my horror, I'm missing at least one event and any hydros I have, plus at least one or two rises. :thinking:

Hopefully I can find them before I leave for ATL tomorrow night lol.

But, currently my inventory of Rise-based hardware is:
1x VM Rise (1.004VM)
1x Sprint Rise (unknown, because somebody removed important APKs)
1x VM Event (1.005VM)

TechDad378 · Sep 18, 2014

OK welcome fellas! Seems we seem to be floating in a few different directions here. I suggest we stay focused on one thing until each process is broken down.

Here's what I mean....
We need to first focus solely on the rise. This way, once one device is solved, the rest will follow. I say this because reading through the source code for the rise, it was designed for the devices C5155 - C5170. Since its stated in the source this means the rise will be the perfect starting point.

I agree there are a few different ways to install bootloader for other devices which have a potential to work well with the correct tweaks. But before we go ahead and start testing the loader we new to focus on how it would work off the memory cache. I know everyone is ready to dig deep into this but we need to prepare aka brainstorm first.

I chose to put this info on the forum in case someone may have any additional info to add thats viable.

With that said, can we all agree on working with just the rise for now? Then let's breakdown how we think the memory cache works on the rise.

rbheromax · Sep 18, 2014

OK well do we know for a fact that it flushes on reboot?

TechDad378 · Sep 18, 2014

From what I can make out of the memory, here are some thoughts...
Secureboot is very tough to crack since its hard-coded on the rise. At this time the way I think we can bypass Secure boot and install a boot loader is by storing in on the memory cache.

This process should work with the correct tweaks. The reason I believe this is because the Xposed Framework works on the Rise. Xposed runs off the memory cache which means a stored boot loader can work as well.

The memory has an absolute address of 512kb. It seems the address is added at the beginning and end of each sector while the phone is loading. They put a padding of 1mb on the memory cache since there is no way of knowing how big the cache would be at any given moment. This padding seems like a good location to insert the boot loader.

Now the problem is that during reboot the memory is flushed to a certain point which I can figure out where that point is located. Since I am not sure what is the absolute address.

Another approach is on the while the address is shuffled during boot. Looking into the way u-boot works seems there is a point where an empty sector loads with just the absolute address. If we can somehow insert the boot loader into the empty sector the memory cache can be used as a backup location...

Any thoughts?

@Rbh what's up? Looks like you been ready for this and yea I already knew you qualified.
But the fact part of the memory flushes is that modules from Xposed would disappear on reboot yet the framework and other modules would always stay? The modules worked fine even after reinstalling. Which is why parts of the memory is flushed.

cooldudezach · Sep 18, 2014

TechDad378 said:
From what I can make out of the memory, here are some thoughts...
Secureboot is very tough to crack since its hard-coded on the rise. At this time the way I think we can bypass Secure boot and install a boot loader is by storing in on the memory cache.

This process should work with the correct tweaks. The reason I believe this is because the Xposed Framework works on the Rise. Xposed runs off the memory cache which means a stored boot loader can work as well.

The memory has an absolute address of 512kb. It seems the address is added at the beginning and end of each sector while the phone is loading. They put a padding of 1mb on the memory cache since there is no way of knowing how big the cache would be at any given moment. This padding seems like a good location to insert the boot loader.

Now the problem is that during reboot the memory is flushed to a certain point which I can figure out where that point is located. Since I am not sure what is the absolute address.

Another approach is on the while the address is shuffled during boot. Looking into the way u-boot works seems there is a point where an empty sector loads with just the absolute address. If we can somehow insert the boot loader into the empty sector the memory cache can be used as a backup location...

Any thoughts?

@Rbh what's up? Looks like you been ready for this and yea I already knew you qualified.
But the fact part of the memory flushes is that modules from Xposed would disappear on reboot yet the framework and other modules would always stay? The modules worked fine even after reinstalling. Which is why parts of the memory is flushed.

Just so I'm not going crazy, what is the difference between u-boot and LK? Are they part of one-another or are they separate bootloaders?

rbheromax · Sep 18, 2014

Iirc They are separate projects for different flash based devices (nand vs emmc)
I don't think we need a mem cache hack but rather a secure boot hack. I did talk to djrbliss a while back about this, he said Loki would not work for us. I think because the flaw wasn't in the code yet. I'm sire its there just formatted differently. I think we should explore that since its something already documented and easy to work toward. Something similar to loki

cooldudezach · Sep 18, 2014

rbheromax said:
Iirc They are separate projects for different flash based devices (nand vs emmc)
I don't think we need a mem cache hack but rather a secure boot hack. I did talk to djrbliss a while back about this, he said Loki would not work for us. I think because the flaw wasn't in the code yet. I'm sire its there just formatted differently. I think we should explore that since its something already documented and easy to work toward. Something similar to loki

Okay, I thought so. We def. have LK though.

I'll second the secure boot hack, although I don't know how to help with it yet.

rbheromax · Sep 18, 2014

read up:
Azimuth Security: Exploiting Samsung Galaxy S4 Secure Boot

Dan explaining how he did it ^^

https://www.codeaurora.org/blogs/little-kernel-based-android-bootloader

How Kyocera disabled fastboot^^

https://gitorious.org/embedded/lk/source/742f31efdcca153d46e2908ab69ad57374fc616a:

Oldest source for LK I could find. Last commit in 2010 which is around the time the Snapdragon S1 (qsd8k) came out, and Qualcomm was about ready to release the Snapdragon S2 (msm7x30). We are the Snapdragon S2, so I think this may be close to the source that Kyocera was playing with. I'll dig a lil more to see if I can find some good repo's of LK. Thank god its open source

cooldudezach · Sep 19, 2014

TechDad378 said:
With that said, can we all agree on working with just the rise for now? Then let's breakdown how we think the memory cache works on the rise.

So, which version of the Rise do you intend to work with?

Sprint / VM are the same model #: C5155
PM is a different model #: C5156

Sprint / PM can both enter into fastboot, and temp boot with fastboot boot
VM cannot do either.

rbheromax · Sep 19, 2014

i think we'd be looking at the VM version

cooldudezach · Sep 19, 2014

rbheromax said:
read up:
Azimuth Security: Exploiting Samsung Galaxy S4 Secure Boot

Dan explaining how he did it ^^

https://www.codeaurora.org/blogs/little-kernel-based-android-bootloader

How Kyocera disabled fastboot^^

https://gitorious.org/embedded/lk/source/742f31efdcca153d46e2908ab69ad57374fc616a:

Oldest source for LK I could find. Last commit in 2010 which is around the time the Snapdragon S1 (qsd8k) came out, and Qualcomm was about ready to release the Snapdragon S2 (msm7x30). We are the Snapdragon S2, so I think this may be close to the source that Kyocera was playing with. I'll dig a lil more to see if I can find some good repo's of LK. Thank god its open source

Who wants to crawl through IDA Pro to reverse engineer the bootloader for a security exploit? Any good tutorials on the topic that I could peruse through whilst on vacation next week? (Yes, I'm being lazy and not googling because I'm sick and at work.)

edit:
removed for reasons.

rbheromax · Sep 19, 2014

cooldudezach said:
Who wants to crawl through IDA Pro to reverse engineer the bootloader for a security exploit? Any good tutorials on the topic that I could peruse through whilst on vacation next week? (Yes, I'm being lazy and not googling because I'm sick and at work.)

Off Topic:
Hey, rb, how's the work going over in the ZTE threads? I need to bet back over there, but I'm just now getting back into the swing of things again. I finally played Minecraft for the first time in months the other day, which is huge for me XD Also, I'm here lol. I don't want to jump back in over there just yet, too much to catch up on for me at the moment. It's on my list atm though. I also went through my ZTE stocks cuz they were in my LBOP too. I have:
2 Imperial, 1 Awe, 1 Mustang (wont poweron/charge, broken screen), 2 source (never did send jtx-whatshisname one >.>), and like, 7/8 Warp 4g's

I dont want to have to do it, although I wouldn't really mind as I have nothing to do anyways. If someone can send me aboot I'll see what I can come up with. Something tells me there is a lot to find inside that little partition. More than we think we know.

N dude! send me a Warp! lol
lets keep the off topic stuff in PM's

cooldudezach · Sep 19, 2014

rbheromax said:
I dont want to have to do it, although I wouldn't really mind as I have nothing to do anyways. If someone can send me aboot I'll see what I can come up with. Something tells me there is a lot to find inside that little partition. More than we think we know.

N dude! send me a Warp! lol
lets keep the off topic stuff in PM's

I'll look into getting aboot for you.

EDIT: Got it! Also, it is NOT a zip, so remove the .zip extension. It was the quickest way for me to attach it. The school computers dont let me right click, so I couldn't actually zip it

EDIT2: I'm going to leave this here:
http://androidforums.com/rise-all-t...on-kyocera-rise-stock-images.html#post6152366
It's my list of partition names I put together (after many tedious hours of pooling through my hex editor!) from the compilation thread.

mel4787 · Sep 19, 2014

wait someone mentioned xposed and it used the memory block. hmm more interesting to see a backup bootloader to be ported into the memory block. that means we can build a module to access the bootloader while having a backup bootloader in case something happens

cooldudezach · Sep 19, 2014

mel4787 said:
wait someone mentioned xposed and it used the memory block. hmm more interesting to see a backup bootloader to be ported into the memory block. that means we can build a module to access the bootloader while having a backup bootloader in case something happens

I'm not sure exactly how it would work, but I can probably guarantee you it wont be a 'module' that is run via xposed. It would be a bootloader that is placed into memory cache that is ran upon startup, or something along those lines. Somebody correct me if I'm wrong.

However, I don't think that is the route we will/should pursue right now.

rbheromax · Sep 19, 2014

ok
downloaded aboot
ran strings on it, one that caught my eye out of the MANY.... "openssl LK"
when you google that, you see this repo:
https://github.com/RonGokhale/android_lk_bootloader/

its been patched up to msm8974 which is recent
i think we should run with that repo for vulnerabilities

rbheromax · Sep 19, 2014

https://github.com/jcsullins/moboot/commit/cd98d4709d277db0ff4e2164196df9a25c165c94

this commit is the important one!

alot of the function strings match aboot
especially the ones about signing the kernel
i think this is possible

modhatter6811 · Sep 20, 2014

rbheromax said:
https://github.com/jcsullins/moboot/commit/cd98d4709d277db0ff4e2164196df9a25c165c94

this commit is the important one!

alot of the function strings match aboot
especially the ones about signing the kernel
i think this is possible

I think you just struck gold.

Root Team ItsOnKyo

Well-Known Member

Android Expert

Android Enthusiast

Android Expert

Android Enthusiast

Android Enthusiast

Android Expert

Android Enthusiast

Well-Known Member

Android Expert

Well-Known Member

Android Enthusiast

Android Expert

Android Enthusiast

Android Expert

Android Enthusiast

Android Expert

Android Enthusiast

Android Expert

Android Enthusiast

Attachments

Android Enthusiast

Android Enthusiast

Android Expert

Android Expert

Android Enthusiast

BEST TECH IN 2023

Smartphones

Best Android Phones

Upcoming

Best iPhones

Upcoming

Tablets

Best Tablets

Upcoming

Laptops

Best Laptops

Upcoming

Televisions

Best TVs

Upcoming

Game Consoles

Best Game Consoles

Upcoming

Wearables

Best Wearables

Upcoming

Smart Home

Smart Home Tech

Upcoming

Similar threads