Root What's up with Drive?

EarlyMon · Jun 24, 2014

We're supposed to get some kind of freebie yeah, like 50 GB for 2 years or something?

How does that work? How do I get started?

And what's this I hear about needing to lock my phone again to get it? :confused:

Chief YYZ · Jun 24, 2014

It's supposed to just pop up in your drive with an opportunity to redeem it. HTC offer has a disclaimer saying it's not available to developer editions or anyone who unlocks their bootloader.

However, this has reportedly worked.

[how to] lock/unlock your bootloader without htcdev(s-off required) - xda-developers

Just performed on my M8 and got the Google Drive promo. Thanks to all that put their time in this. Greatly appreciated

-------------------------------------------------------
Edit with actual answer:

This thread gets long winded, though very interesting and enlightening reading, and since I don't think these are actually posted all together in one place, I put what seems to be the final solution [post=6627964]here[/post]

EarlyMon · Jun 24, 2014

Oh for crying out loud.

I didn't take the Drive promo when I got my phone because I was pressed for time and expected it to be like the chicken dance I had to do to get Dropbox 2 years ago.

So - I have to flash the stock firmware, lock my bootloader and then what? Get Drive from the Play Store?

Obviously, I'm on Viper.

Chief YYZ · Jun 24, 2014

LOL, I'm not sure, I haven't looked into the details hard enough. Was hoping YOU would know!

Is it possible to change the bootloader to locked without reflashing anything? Scotty's method forces a change through adb commands. Couldn't you just lock, reboot, redeem, unlock, without doing anything else? It seems it only checks the flag to see if you're locked as opposed to unlocked/relocked. Hope HTC DEV doesn't tell them...

EarlyMon · Jun 24, 2014

HTCdev only knows that I got the token, not if I applied it.

So - all of the runtime checks have to work.

I think this is going to be straightforward enough.

I just don't want to do it because of the trouble - but - I'm going to.

EarlyMon · Jun 24, 2014

I installed Drive.

Ok, so I'm basically going to -

fastboot erase cache
fastboot oem rebootRUU
fastboot flash zip (A signed firmware payload)
fastboot reboot

Perform the scotty lock:

adb shell

su (if needed to get a # prompt)

echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796

Then turn off SuperSU (I decided to override that Superuser in Viper with SuperSU) so there won't be root (that works aok with Wallet).

Then try to redeem Drive.

Then do the scotty unlock -

adb shell

su (if needed to get a # prompt)

echo -ne "HTCU" | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796

Turn on SuperSU.

Reinstall TWRP.

Reflash my HK package.

And if that doesn't work, lather, rinse, repeat with the stock rom.

I am not going to apply an RUU to get a Google Drive freebie. I've never applied an RUU and I'm not going to start now just because they want to control their offer after the fact.

I am s-off. This is how I roll.

Thanks Chief for letting me know, and thanks scotty for pulling up the lock trick!

Granite1 · Jun 24, 2014

I assume this worked?

I did the same thing when I got mine. Already had everything downloaded and unlocked the bootloader before I even knew we had the 50GB. Took a couple days to run Firewater, but by that point the damage was done.

I'd rather not go through all the gibberish if it won't work.

EarlyMon · Jun 24, 2014

Granite1 said:
I assume this worked?

I did the same thing when I got mine. Already had everything downloaded and unlocked the bootloader before I even knew we had the 50GB. Took a couple days to run Firewater, but by that point the damage was done.

I'd rather not go through all the gibberish if it won't work.

I'll let you know.

Bet I have to flash a stock rom regardless.

Then comes the unlock, that's going to need a temp root or something to get the su step to work.

I'll post my steps when done.

EarlyMon · Jun 25, 2014

I think it's important to read through my steps all the way to the end before picking up and doing a thing.

Steps -

0. Create a nandroid backup.

1. Download untouched firmware from post 18, here - M8 updates on the wayy!! - Page 2 - xda-developers - CONFIRM MD5 ok

2. Restore nandroid of pure stock system that you made before ever modifying anything other than to unlock the bootloader and install TWRP.

3. Clear cache and Dalvik.

4. Reboot.

5. Verify that it's stock. Most important part - see Google Drive offer at top of Blinkfeed. Do not touch.

6. Install SuperSU on stock rom.

7. Turn off SuperSU.

8. Get Root Checker from the Play Store - verify that you don't have root.

9. Turn SuperSU back on - verify with Root Checker that you're rooted.

10. Turn off SuperSU.

11. fastboot usb

12. Do:

Code:

fastboot erase cache
fastboot oem rebootRUU
fastboot flash zip 1.54.651.10_firmware_ota.zip
fastboot reboot

13. Verify that it boots and you're not screwed.

14. Turn on SuperSU, verify with Root Checker.

15. Do:

Code:

adb shell

su  (if needed to get a [B]#[/B] prompt)

echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796

16. Turn off SuperSU.

17. Reboot.

18. Discover Google Drive is not happening.

19. Discover that bootloader says TAMPERED - LOCKED - S-ON

20. Turn on SuperSU

Code:

adb shell
su
echo -ne "HTCU" | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796
exit
exit
adb reboot bootloader

21. Bootloader says 3.16, TAMPERED - UNLOCKED - S-OFF

22. fastboot flash recovery long-twrp-name-lol.zip

23. HBOOT followed by RECOVERY

24. See TWRP. See TWRP run.

25. Reflash hk s-off payload to ensure that firmware payload is there.

26. Wipe cache and Dalvik.

27. Restore nandroid from Step 0.

28. Light up a Camel and wonder if you ought not have flashed the entire OTA so that all the pieces matched rather than just the firmware bits of the OTA.

29. Consider doing that. Another time. Wonder to yourself if Google Drive is really worth it.

30. Enjoy your phone exactly as it was just over one hour ago.

31. Wonder if scotty is shaking his head or get red marks from the facepalms.

32. Laugh ass off.

33. Walk funny due to loss of part of ass. Rejoice in not only being s-off but now also ass-off.

Granite1 · Jun 25, 2014

EarlyMon said:
I think it's important to read through my steps all the way to the end before picking up and doing a thing.

Steps -

0. Create a nandroid backup.

1. Download untouched firmware from post 18, here - M8 updates on the wayy!! - Page 2 - xda-developers - CONFIRM MD5 ok

2. Restore nandroid of pure stock system that you made before ever modifying anything other than to unlock the bootloader and install TWRP.

3. Clear cache and Dalvik.

4. Reboot.

5. Verify that it's stock. Most important part - see Google Drive offer at top of Blinkfeed. Do not touch.

6. Install SuperSU on stock rom.

7. Turn off SuperSU.

8. Get Root Checker from the Play Store - verify that you don't have root.

9. Turn SuperSU back on - verify with Root Checker that you're rooted.

10. Turn off SuperSU.

11. fastboot usb

12. Do:

Code:

fastboot erase cache fastboot oem rebootRUU fastboot flash zip 1.54.651.10_firmware_ota.zip fastboot reboot

13. Verify that it boots and you're not screwed.

14. Turn on SuperSU, verify with Root Checker.

15. Do:

Code:

adb shell su (if needed to get a [B]#[/B] prompt) echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796

16. Turn off SuperSU.

17. Reboot.

18. Discover Google Drive is not happening.

19. Discover that bootloader says TAMPERED - LOCKED - S-ON

20. Turn on SuperSU

Code:

adb shell su echo -ne "HTCU" | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796 exit exit adb reboot bootloader

21. Bootloader says 3.16, TAMPERED - UNLOCKED - S-OFF

22. fastboot flash recovery long-twrp-name-lol.zip

23. HBOOT followed by RECOVERY

24. See TWRP. See TWRP run.

25. Reflash hk s-off payload to ensure that firmware payload is there.

26. Wipe cache and Dalvik.

27. Restore nandroid from Step 0.

28. Light up a Camel and wonder if you ought not have flashed the entire OTA so that all the pieces matched rather than just the firmware bits of the OTA.

29. Consider doing that. Another time. Wonder to yourself if Google Drive is really worth it.

30. Enjoy your phone exactly as it was just over one hour ago.

31. Wonder if scotty is shaking his head or get red marks from the facepalms.

32. Laugh ass off.

33. Walk funny due to loss of part of ass. Rejoice in not only being s-off but now also ass-off.

Ok, if I read this correctly, I need to follow #32 repeatedly.

Then #33 to the bedroom to es'plain to wife why I've woken her by following #32.

100% nailed it!

PS, I'd like that post twice if I could!

EarlyMon · Jun 25, 2014

And yes, I successfully flashed boot, hboot, recovery, radio and rcdata, according to the console.

And I definitely had root for the echo to dd commands.

Not sure how I managed to flash hboot and not change my version number. :dontknow:

Granite1 · Jun 25, 2014

Did the latest Firmware update the Hboot?

I forget if the number was changed on this one. Have to research.

EarlyMon · Jun 25, 2014

Granite1 said:
Did the latest Firmware update the Hboot?

I forget if the number was changed on this one. Have to research.

According to my console, I successfully flashed an hboot with that payload.

EarlyMon · Jun 25, 2014

Here's my console (note, not Windows, so don't let the ./ at the beginning of any commands sweat you) -

Code:

staypuft:sdk-tools EarlyMon$ ./fastboot oem rebootRUU
...
(bootloader) Start Verify: 0
OKAY [  0.023s]
finished. total time: 0.023s
staypuft:sdk-tools EarlyMon$ ./fastboot flash zip 1.54.651.10_firmware_ota.zip
target reported max download size of 1830711296 bytes
sending 'zip' (43993 KB)...
OKAY [  2.336s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) shift signature_size for header checking...
(bootloader) zip info parsing...
(bootloader) checking model ID...
(bootloader) checking custom ID...
(bootloader) start image[hboot] unzipping for pre-update check...
(bootloader) total_image_number=5

(bootloader) start image[boot] unzipping & flushing...
(bootloader) [RUU]UZ,boot,0
(bootloader) [RUU]UZ,boot,10
(bootloader) [RUU]UZ,boot,21
(bootloader) [RUU]UZ,boot,32
(bootloader) [RUU]UZ,boot,43
(bootloader) [RUU]UZ,boot,57
(bootloader) [RUU]UZ,boot,70
(bootloader) [RUU]UZ,boot,81
(bootloader) [RUU]UZ,boot,93
(bootloader) [RUU]UZ,boot,100
(bootloader) [RUU]WP,boot,0
(bootloader) [RUU]WP,boot,99
(bootloader) [RUU]WP,boot,100
(bootloader) ...... Successful
(bootloader) current_image_number=0

(bootloader) start image[hboot] unzipping & flushing...
(bootloader) [RUU]UZ,hboot,0
(bootloader) [RUU]UZ,hboot,56
(bootloader) [RUU]UZ,hboot,100
(bootloader) [RUU]WP,hboot,0
(bootloader) [RUU]WP,hboot,99
(bootloader) [RUU]WP,hboot,100
(bootloader) ...... Successful
(bootloader) current_image_number=1

(bootloader) start image[recovery] unzipping & flushing...
(bootloader) [RUU]UZ,recovery,0
(bootloader) [RUU]UZ,recovery,6
(bootloader) [RUU]UZ,recovery,12
(bootloader) [RUU]UZ,recovery,18
(bootloader) [RUU]UZ,recovery,25
(bootloader) [RUU]UZ,recovery,32
(bootloader) [RUU]UZ,recovery,37
(bootloader) [RUU]UZ,recovery,53
(bootloader) [RUU]UZ,recovery,62
(bootloader) [RUU]UZ,recovery,68
(bootloader) [RUU]UZ,recovery,74
(bootloader) [RUU]UZ,recovery,81
(bootloader) [RUU]UZ,recovery,87
(bootloader) [RUU]UZ,recovery,93
(bootloader) [RUU]UZ,recovery,99
(bootloader) [RUU]UZ,recovery,100
(bootloader) [RUU]WP,recovery,0
(bootloader) [RUU]WP,recovery,99
(bootloader) [RUU]WP,recovery,100
(bootloader) ...... Successful
(bootloader) current_image_number=2

(bootloader) start image[radio] unzipping & flushing...
(bootloader) [RUU]UZ,radio,0
(bootloader) [RUU]UZ,radio,9
(bootloader) [RUU]UZ,radio,18
(bootloader) [RUU]UZ,radio,27
(bootloader) [RUU]UZ,radio,32
(bootloader) [RUU]UZ,radio,41
(bootloader) [RUU]UZ,radio,50
(bootloader) [RUU]UZ,radio,59
(bootloader) [RUU]UZ,radio,64
(bootloader) [RUU]UZ,radio,73
(bootloader) [RUU]UZ,radio,78
(bootloader) [RUU]UZ,radio,86
(bootloader) [RUU]UZ,radio,91
(bootloader) [RUU]UZ,radio,96
(bootloader) [RUU]UZ,radio,100
(bootloader) trying to rename MBA
(bootloader) [RUU]WP,radio,0
(bootloader) [RUU]WP,radio,36
(bootloader) [RUU]WP,radio,73
(bootloader) [RUU]WP,radio,100
(bootloader) ...... Successful
(bootloader) current_image_number=3

(bootloader) start image[rcdata] unzipping & flushing...
(bootloader) [RUU]UZ,rcdata,0
(bootloader) [RUU]UZ,rcdata,100
(bootloader) [RUU]WP,rcdata,0
(bootloader) [RUU]WP,rcdata,100
(bootloader) ...... Successful
(bootloader) current_image_number=4

OKAY [ 24.038s]
finished. total time: 26.374s
staypuft:sdk-tools EarlyMon$ ./fastboot reboot
rebooting...

finished. total time: 0.016s
staypuft:sdk-tools EarlyMon$ ./adb shell
shell@htc_m8whl:/ $ su
130|root@htc_m8whl:/ # echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796
4+0 records in
4+0 records out
4 bytes transferred in 0.008 secs (500 bytes/sec)

Granite1 · Jun 25, 2014

It absolutely flashed an hboot image. That is strange, :confused:

Open up then firmware zip and see what's in the hboot file.

I'm kinda stumped.

PS: love the staypuft name. I've been naming my machines Chewbacca since the dial up days.

EarlyMon · Jun 25, 2014

And I could just give it the whole payload - OTA_M8_WHL_K44_SENSE60_SPCS_SECURITY_Sprint_WWE_1.54.651.10_R4-1.54.651.8_release_380016e71ahqdkvif4wkws.zip

But - new bootloader or old bootloader - the echo to dd is not putting hboot into a untampered state, although, it did definitely set the bootloader to locked.

I'm guessing that tampered flag is the problem.

EarlyMon · Jun 25, 2014

Code:

staypuft:sdk-tools EarlyMon$ unzip 1.54.651.10_firmware_ota.zip 
Archive:  1.54.651.10_firmware_ota.zip
warning [1.54.651.10_firmware_ota.zip]:  256 extra bytes at beginning or within zipfile
  (attempting to process anyway)
  inflating: android-info.txt        
  inflating: boot.img                
  inflating: hboot_signedbyaa.img    
  inflating: radio.img               
  inflating: rcdata.img              
  inflating: recovery.img

And also, what hboot is it?

Here we go -

Code:

puffy:sdk-tools earl$ strings hboot_signedbyaa.img | head
3.16.0.0000
SHIP
obsoleted.
obsoleted.
(etc etc etc)

So - the payload clearly has a signed hboot, it's the same number as what I had, and it flashed ok.

It's the whole lock thing I guess...

:dontknow:

EarlyMon · Jun 25, 2014

So, let's look at my partition table:

Code:

root@htc_m8whl:/ # cat /proc/partitions
major minor  #blocks  name

   7        0      67631 loop0
 179        0   30535680 mmcblk0
 179        1       1024 mmcblk0p1
 179        2     121823 mmcblk0p2
 179        3         16 mmcblk0p3
 179        4       8192 mmcblk0p4
 179        5        256 mmcblk0p5
 179        6      24255 mmcblk0p6
 179        7        256 mmcblk0p7
 179        8        256 mmcblk0p8
 179        9       2048 mmcblk0p9
 179       10         32 mmcblk0p10
 179       11       4096 mmcblk0p11
 179       12       5120 mmcblk0p12
 179       13       1024 mmcblk0p13
 179       14         32 mmcblk0p14
 179       15       1024 mmcblk0p15
 179       16      61441 mmcblk0p16
 179       17       5120 mmcblk0p17
 179       18       8192 mmcblk0p18
 179       19       1536 mmcblk0p19
 179       20      76801 mmcblk0p20
 179       21       4096 mmcblk0p21
 179       22      51200 mmcblk0p22
 179       23      15359 mmcblk0p23
 179       24       1024 mmcblk0p24
 179       25       1536 mmcblk0p25
 179       26       1536 mmcblk0p26
 179       27      20480 mmcblk0p27
 179       28          4 mmcblk0p28
 179       29        256 mmcblk0p29
 179       30         16 mmcblk0p30
 179       31       1281 mmcblk0p31
 179       32         64 mmcblk0p32
 179       33       1024 mmcblk0p33
 179       34          1 mmcblk0p34
 179       35          8 mmcblk0p35
 179       36        256 mmcblk0p36
 179       37      25600 mmcblk0p37
 179       38        256 mmcblk0p38
 179       39      30720 mmcblk0p39
 179       40         10 mmcblk0p40
 179       41      47000 mmcblk0p41
 179       42      16384 mmcblk0p42
 179       43      24576 mmcblk0p43
 179       44      90112 mmcblk0p44
 179       45    2752512 mmcblk0p45
 179       46     393216 mmcblk0p46
 179       47   26607616 mmcblk0p47
 179       64       4096 mmcblk0rpmb
 179      128   62367744 mmcblk1
 179      129   62366720 mmcblk1p1
 254        0      67630 dm-0
root@htc_m8whl:/ # exit

EarlyMon · Jun 25, 2014

And here's a hexdump of 0x8400, aka, offset of 33792 - add four zero bytes and it's writing where it's supposed to...

Code:

00008400  00 00 00 00 48 54 43 55  01 00 00 00 00 00 00 00  |....HTCU........|

I suppose I *could* repeat the whole thing and see what's really living at that address in /dev/block/mmcblk0p2 after I zero it out...

Ok - that's actually a very good idea.

That echo sequence is depending on a busybox install at /system/xbin to work like Linux echo.

If I were having some other implementation of echo, that would explain a lot.

The echo line says: -ne : meaning, no line feeds and know what to do with \x00 as a zero'd byte expressed in hex.

Probably not the isssue, but worth looking at.

EarlyMon · Jun 25, 2014

Hey Granite, if you get a chance -

Code:

adb shell
su
hexdump -C /dev/block/mmcblk0p2 
exit
exit

And copy your line that says 00008400 for me into here - with my thanks in advance.

PS - if you do this, you'll have to control-c after it seems to stop doing anything.

And if you don't want to do this - no worries, see the next post.

EarlyMon · Jun 26, 2014

Ok - the hex edit via the echo to dd is working, I confirmed that with a redo of a few things - and I was mistaken.

When I do that, it shows - TAMPERED - LOCKED - S-OFF

When I set out the HTCU, it shows - TAMPERED - UNLOCKED - S-OFF

I wonder what that 01 is after the 4 bytes in question...

...maybe not the answer.

EarlyMon · Jun 26, 2014

So, I tried an older 3.16 hboot - HBOOT Downloads | firewater s-off

No soap.

I think I'll just contact HTC and ask them to give me my storage. Locked, stock and nada - this is not my problem.

scotty85 · Jun 26, 2014

Chief YYZ said:
It's supposed to just pop up in your drive with an opportunity to redeem it. HTC offer has a disclaimer saying it's not available to developer editions or anyone who unlocks their bootloader.

However, this has reportedly worked.

[how to] lock/unlock your bootloader without htcdev(s-off required) - xda-developers

just an fyi,ive put those threads here as well

http://androidforums.com/one-m8-all...bootloader-without-htcdev-s-off-required.html

http://androidforums.com/one-m8-all-things-root/841317-how-remove-your-tampered-banner.html

http://androidforums.com/one-m8-all...w-change-your-mid-without-eng-bootloader.html

em,i got your pm... it may be that drive is looking at the tampered flag. most folks have gotten it just by removing tampered and locking the bootloader.

did you enter the command to remove tampered,or just the one to lock?

the tamer flag is in p6,at 00511804 or 00511805 depending on the variant,tho any extra gibberish in that line will casue the flag to remain. a guy on another site relisted my steps with an incorect " in the command,and it wreaked all sorts of havoc- i got several PMs and had to look at and adjust the command to rewrite the 00s to fix this guys eff-up to several users phones. :mad:

the line looks like this:

Code:

00511800  68 25 32 C6 [COLOR="red"]04[/COLOR] 00 00 00 00 00 00 00 00 00 00 00  h%2

scotty85 · Jun 26, 2014

EarlyMon said:
I wonder what that 01 is after the 4 bytes in question...

i wonder that too... and have unfortunately not been able to figure it out yet. all i know for sure is that it is present on factory s off phones,and isnt of any relevance to the lock flag.

be careful here,as the "security flag" is still at 00008400(03 if your s on) so unintentionally setting something in this line could be bad :eek:

thus far,ive been afraid to replace the 01 with an 00 to see what happens,ive really no idea if the phone will freak out if it disapears(read qualcom "do not boot" mode,aka hard brick) :eek:

i first started seeing the 01 next to the lock flag in the dna.

Granite1 · Jun 26, 2014

EarlyMon said:
Hey Granite, if you get a chance -

Code:

adb shell su hexdump -C /dev/block/mmcblk0p2 exit exit

And copy your line that says 00008400 for me into here - with my thanks in advance.

PS - if you do this, you'll have to control-c after it seems to stop doing anything.

And if you don't want to do this - no worries, see the next post.

Not sure if you still need this EM, but here you go:

Code:

0000840  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0

Speaking of code, is it just me or are the

Code:

 tags broke for the forums?

I've been using the "Code" button but it inserts ([HIGH][/HIGH]) instead of CODE. :confused:

Root What's up with Drive?

The PearlyMon

Well-Known Member

The PearlyMon

Well-Known Member

The PearlyMon

The PearlyMon

Zercron Encrusted Tweezer

The PearlyMon

The PearlyMon

Zercron Encrusted Tweezer

The PearlyMon

Zercron Encrusted Tweezer

The PearlyMon

The PearlyMon

Zercron Encrusted Tweezer

The PearlyMon

The PearlyMon

The PearlyMon

The PearlyMon

The PearlyMon

The PearlyMon

The PearlyMon

Extreme Android User

Extreme Android User

Zercron Encrusted Tweezer