[HBOOT] HOWTO Install an ENG hboot on your INC S

jcase · May 9, 2011

Brought to you by touchpro247 and I. (touchpro247 put his phone on the line testing this)

First off, I take no blame for anything that happens due to this. This can potentially brick your phone. If this bricks your phone, makes it unstable, kills your cat.. YOUR FAULT not mine.

Please, don't make typos in the commands.

Eng Hboots allow you to flash unsigned images, and opens up more fastboot commands. Most people do not need this. This will not [provide perm root, or un-writeprotecte the emmc chip. In fact, if you don't have s-off it won't work for you.

Requirements:
Root
radio (ship) s-off
Busybox properly installed
adb working

If you do not have busybox, you can use this app to install it https://market.android.com/details?id=stericson.busybox

Download the ENGHboot for Vivo here:
http://cunninglogic.com/android/vivo/vivo_enghboot.img

put the file on your sdcard

Follow these commands

Code:

adb shell

If you have havea $ prompt and not a # prompt, run su

Code:

su

You should now have a # prompt and can continue

Code:

busybox md5sum /sdcard/vivo_enghboot.img

If the output is NOT b1829cfb7cf5d462660a58aa5449d27c , STOP redownload the file and try again. Anything else could cause a brick. If it matches, continue.

Code:

dd if=/sdcard/vivo_enghboot.img of=/dev/block/mmcblk0p18
reboot bootloader

You should now see this, and are done.

Enjoy

rhcp011235 · May 9, 2011

Very nice.!

touchpro247 · May 9, 2011

Note: This is case sensitive and the file should be placed on the root of your sdcard.

Please just use the "THANKS" feature.

We all need to help keep the Dev threads clean.

Sent from my HTC Incredible S using XDA Premium App

bl4ckluna · May 9, 2011

very good!!

skymkk · May 9, 2011

look forward to s on～～～

tonylai2000 · May 9, 2011

Hi, Man, thank you so much, thanks for your hard working, god bless you.

SiL3nTKiLL · May 9, 2011

very nice! good how to

nawuia · May 9, 2011

need root ,s-on!!XXXXXXXX

skymkk · May 9, 2011

it is soon~!

jcase · May 9, 2011

If a way to unlock the emmc write protection is found (it is not kernel based, and wpthis will not work), then this hboot can be used to set the phone s-off.

zhaominghao · May 9, 2011

i think unlock s-on is not so far

manutd_ken · May 9, 2011

jcase said:
If a way to unlock the emmc write protection is found (it is not kernel based, and wpthis will not work), then this hboot can be used to set the phone s-off.

to oil, s-on people wait for you, thx~~~

skymkk · May 10, 2011

i think unlock s-on is not so far～～～

max-k · May 11, 2011

dump of vivo hboot after xtc-clip

Hi,
Thank you for this post.
Before trying to flash your hboot, i've made a dump of the one i've obtained after unlocking my phone with an xtc-clip.
It seems that this is the same as yours but a little bit more recent.
Version 1.09.0000.
I've uploaded it here : http://www.multiupload.com/QPS8W9RH0M
If someone is interested.

deficitism · May 11, 2011

max-k said:
Hi,
Thank you for this post.
Before trying to flash your hboot, i've made a dump of the one i've obtained after unlocking my phone with an xtc-clip.
It seems that this is the same as yours but a little bit more recent.
Version 1.09.0000.
I've uploaded it here : http://www.multiupload.com/QPS8W9RH0M
If someone is interested.

Thanks for this. Couple of questions.

How did you dump the hboot image? I actually had no idea this was possible... Also, did the hboot version actually change after you used the xtc clip? I'm not 100% sure how the clip works internally, but was under the impression that it sets the flags at the radio level, and doesn't specifically modify the bootloader.

max-k · May 11, 2011

deficitism said:
Thanks for this. Couple of questions.

How did you dump the hboot image?
I actually had no idea this was possible...

I've dumped the image using your process :
dd if=/dev/block/mmcblk0p18 of=/sdcard/vivo_hboot.img
Also, perhaps it doesn't works. I don't try to reflash it yet.

deficitism said:
Also, did the hboot version actually change after you used the xtc clip? I'm not 100% sure how the clip works internally, but was under the impression that it sets the flags at the radio level, and doesn't specifically modify the bootloader.

I'm not sure too.
Perhaps you're right.
But, if you're right, i don't know if there are any differences between my old hboot and yours.
Options in "fastboot" and "bootloader" are the same.

jcase · May 11, 2011

max-k said:
I've dumped the image using your process :
dd if=/dev/block/mmcblk0p18 of=/sdcard/vivo_hboot.img
Also, perhaps it doesn't works. I don't try to reflash it yet.

I'm not sure too.
Perhaps you're right.
But, if you're right, i don't know if there are any differences between my old hboot and yours.
Options in "fastboot" and "bootloader" are the same.

The ENG (engineering) is on top. The hboot you dumped is on bottom of the picture, it is a SHIP hboot. Meaning, unless the radio says other wise, you are s-on. It also has limited fastboot commands, and checks for signatures before flashing.

XTC clip sets s-off in the radio config, and does not modify hboot in any way.

I do not know how you determined it to be the same. Most of the time ENG hboots are older, as they are not used in production, but in testing.

deficitism · May 11, 2011

jcase said:
The ENG (engineering) is on top. The hboot you dumped is on bottom of the picture, it is a SHIP hboot. Meaning, unless the radio says other wise, you are s-on. It also has limited fastboot commands, and checks for signatures before flashing.

XTC clip sets s-off in the radio config, and does not modify hboot in any way.

I do not know how you determined it to be the same. Most of the time ENG hboots are older, as they are not used in production, but in testing.

Yep. Although, he should now be able to flash the engineering bootloader.

From the looks of it, it appears we should be able to talk to the bootloader through a USB cable with some sort of console access. I recall unrevoked's toolset doing so to temporarily disable the NAND protection long enough to flash a custom recovery. Unfortunately, these devices seem to only be booting factory signed hboot and recovery images.

We need either:
(1) As jcase said, an old ass radio image.
(2) A signed engineering bootloader
(3) A methodology for simulating the ports/diag commands that the sim unlock clip is using. And a way to send the config flags over USB.
(4) A brand spanking new vulnerability

Just thinking aloud.

jcase · May 11, 2011

I think best bet will be a new exploit to remove wp and allowed us to flash the eng hboot or set the radio s-off

Sent from my LG Revolution

max-k · May 12, 2011

jcase said:
The ENG (engineering) is on top. The hboot you dumped is on bottom of the picture, it is a SHIP hboot. Meaning, unless the radio says other wise, you are s-on. It also has limited fastboot commands, and checks for signatures before flashing.

XTC clip sets s-off in the radio config, and does not modify hboot in any way.

I do not know how you determined it to be the same. Most of the time ENG hboots are older, as they are not used in production, but in testing.

Thank-you for this explanations.

[HBOOT] HOWTO Install an ENG hboot on your INC S

Retired Forum Mod / Senior Recognized Developer

Member

Senior Member

Senior Member

Member

New member

Senior Member

Member

Member

Retired Forum Mod / Senior Recognized Developer

Senior Member

Senior Member

Member

Member

Retired Recognized Developer

Member

Retired Forum Mod / Senior Recognized Developer

Retired Recognized Developer

Retired Forum Mod / Senior Recognized Developer

Member

Similar threads

Top Liked Posts