5,599,616 Members 43,824 Now Online
XDA Developers Android and Mobile Development Forum

[dev] thread to attempt downgrade S-on to S-offable state. misc_version tool added

Tip us?
 
Indirect
Old
(Last edited by Indirect; 4th April 2012 at 04:10 PM.)
#121  
Recognized Contributor
Thanks Meter 2940
Posts: 2,317
Join Date: Mar 2011
Location: Florida

 
DONATE TO ME
Interesting tidbits of Hex from tz.img from 1.63 update:
hTCVer001.125.02

*HTC_MODEM_KEY



My Google Plus account
My Twitter
Shiftless evo shift developer
Nook Tablet developer-found root (here)

Quote:
Without developers this place would not be called XDA-Developers but something else, e.g Mobile Phone User Support Services For Ungrateful Nerds.
Developed on the following devices: Evo View, Nook Tablet, Evo Shift, Nexus S 4G (private), Evo 4G (private), Mytouch 4g Slide, Evo LTE, HTC One (In Progress), Moto X
 
Blue6IX
Old
#122  
Blue6IX's Avatar
Senior Member
Thanks Meter 1132
Posts: 1,771
Join Date: May 2011

 
DONATE TO ME
Oh - I got it to skip the sig check by using two computers, you need two mcrousb cords. Works consistently on windows, not tested on linux.

The device has to have already been introduced to both before starting, and should be in fastboot mode with all the right, unedited partitions from the 1.55.531.3 PG59IMG.zip file. It should be locked.

I had tacoroot installed on it, not sure if this matters?

Get the device into fastboot mode.

Plug it into one of the computers.

On the other one, have CWM 5.0.2.7 in your folder with fastboot, and rename it to recovery.img

Now, on that second computer that you are not plugged into with the doubleshot, open up the command window to the fastboot folder, and type this command:
Code:
fastboot oem boot recovery.img
...and hit enter.

It will hang on "waiting for device" I let this run for 1 minute and 30 seconds.

Then I very quickly swap the microusb on the phone from being plugged into the computer sitting there doing nothing to the one that has the command hanging there. Gotta be quick.

It then pushes the hanging command faster then the sig check can keep up, or something, and leads to the output two posts ago.

This tactic consistently produced the same results, but it failed because it overloaded with too many arguments - but it skips the sig check and tries to go ahead and just load up.

Once it fails it just moves on to the normal boot sequence and into the stock ROM, but with either a customized version of CWM or with a modified boot.img (try the same thing with fastboot oem boot boot.img - does that get us anywhere?) maybe we can use this technique to skip the sig check on a S-ON LOCKED device?

Given that it wasn't just a one-off random event we might be able to leverage it to launch an attack on the device or TZ more directly, but not with our current custom recovery - and we need to see what happens trying to fastboot oem boot a boot.img with a modified ramdisk to maybe work within the overflow limitation of this:
Code:
FAILED (status read failed (Too many links))
Nook Color: MicroSD info: Here and Here.

--> RTFM <-- | XDA Mantra - Spirit of XDA | ... Donations? Read this
 
thrice43
Old
(Last edited by thrice43; 5th April 2012 at 11:47 AM.)
#123  
Senior Member
Thanks Meter 21
Posts: 109
Join Date: Jul 2007
Location: Fort Lauderdale
I don't believe "fastboot oem boot boot.img" is the valid syntax. If you run "fastboot oem boot", the phones immediately begins to boot android. I think its "fastboot boot boot.img"? But I know for a fact its not a oem command to get fastboot to boot the boot.img. 8\

Sent from my myTouch_4G_Slide using xda premium
The Following User Says Thank You to thrice43 For This Useful Post: [ Click to Expand ]
 
Blue6IX
Old
#124  
Blue6IX's Avatar
Senior Member
Thanks Meter 1132
Posts: 1,771
Join Date: May 2011

 
DONATE TO ME
Okay, thanks. I had used that command to try to boot the recovery image and had some limited success (posted the output a few posts back) but it didn't make it there.

I am unsure the difference between fastboot boot and fastboot oem boot, but we have both on at least the 1.45.0013 hboot.

The thought on trying to use it for a custom boot.img was really for trying to use a modified ramdisk part of it to nerf trust zone, but I didn't have a chance to try before I packaged up the device and shipped it.

The device I was testing on is now in Indirect's hands, so all i've got is my original S-OFF T-Mo subsidized plan doubleshot now. Until I can get a few days off in a row I can't really keep trying because having a smartphone is a requirement for my job - so i'm trying to get another one again for strictly dev purposes like before.

Hopefully i'll have the second doubleshot within a few days or so and can keep picking away at this problem more directly.
Nook Color: MicroSD info: Here and Here.

--> RTFM <-- | XDA Mantra - Spirit of XDA | ... Donations? Read this
 
thrice43
Old
#125  
Senior Member
Thanks Meter 21
Posts: 109
Join Date: Jul 2007
Location: Fort Lauderdale
Quote:
Originally Posted by Blue6IX View Post
Okay, thanks. I had used that command to try to boot the recovery image and had some limited success (posted the output a few posts back) but it didn't make it there.

I am unsure the difference between fastboot boot and fastboot oem boot, but we have both on at least the 1.45.0013 hboot.

The thought on trying to use it for a custom boot.img was really for trying to use a modified ramdisk part of it to nerf trust zone, but I didn't have a chance to try before I packaged up the device and shipped it.
Np np. The difference bt the two commands I found here http://tjworld.net/wiki/Android/HTC/...otModeCommands

And also, afer reading through the sensation forums reference thread, http://forum.xda-developers.com/show....php?t=1232107, I realized the mt4gs basically has the same output in mmcblk0p6 as the sensation. Take a look and you'll see what I mean. I haven't tried yet but I'm quite sure we can unlock our phone using the same method ;D.




Sent from my myTouch_4G_Slide using xda premium
 
Indirect
Old
#126  
Recognized Contributor
Thanks Meter 2940
Posts: 2,317
Join Date: Mar 2011
Location: Florida

 
DONATE TO ME
We can unlock with that. It works just fine.

Sent from my Nexus S 4G using xda premium



My Google Plus account
My Twitter
Shiftless evo shift developer
Nook Tablet developer-found root (here)

Quote:
Without developers this place would not be called XDA-Developers but something else, e.g Mobile Phone User Support Services For Ungrateful Nerds.
Developed on the following devices: Evo View, Nook Tablet, Evo Shift, Nexus S 4G (private), Evo 4G (private), Mytouch 4g Slide, Evo LTE, HTC One (In Progress), Moto X
 
Blue6IX
Old
#127  
Blue6IX's Avatar
Senior Member
Thanks Meter 1132
Posts: 1,771
Join Date: May 2011

 
DONATE TO ME
Quote:
Originally Posted by thrice43 View Post
Np np. The difference bt the two commands I found here http://tjworld.net/wiki/Android/HTC/...otModeCommands

And also, afer reading through the sensation forums reference thread, http://forum.xda-developers.com/show....php?t=1232107, I realized the mt4gs basically has the same output in mmcblk0p6 as the sensation. Take a look and you'll see what I mean. I haven't tried yet but I'm quite sure we can unlock our phone using the same method ;D.




Sent from my myTouch_4G_Slide using xda premium
Yea, you can - i have that copied into the dev reference here:

Notable

I got the unlock codes for 4 doubleshots that way so far.
Nook Color: MicroSD info: Here and Here.

--> RTFM <-- | XDA Mantra - Spirit of XDA | ... Donations? Read this
 
thrice43
Old
#128  
Senior Member
Thanks Meter 21
Posts: 109
Join Date: Jul 2007
Location: Fort Lauderdale
Do you think unlocking the device would open up vulneralbilities to the cid? Maybe achieve supercid status to flash/exploit bootloader?

Sent from my myTouch_4G_Slide using xda premium
 
Blue6IX
Old
#129  
Blue6IX's Avatar
Senior Member
Thanks Meter 1132
Posts: 1,771
Join Date: May 2011

 
DONATE TO ME
Definitely worth checking into - I wish I could try right now, i'm waiting to hear back from someone, might be able to get another doubleshot for 275 + gas to get there and back, prolly another 80ish to 100, so if it goes through I could probably grab it next friday... ( fingers crossed )

I hate being sidelined like this when there are ideas to check out
Nook Color: MicroSD info: Here and Here.

--> RTFM <-- | XDA Mantra - Spirit of XDA | ... Donations? Read this
 
thrice43
Old
#130  
Senior Member
Thanks Meter 21
Posts: 109
Join Date: Jul 2007
Location: Fort Lauderdale
Quote:
Originally Posted by Blue6IX View Post
Definitely worth checking into - I wish I could try right now, i'm waiting to hear back from someone, might be able to get another doubleshot for 275 + gas to get there and back, prolly another 80ish to 100, so if it goes through I could probably grab it next friday... ( fingers crossed )

I hate being sidelined like this when there are ideas to check out
Damnnn 275 already sounds like a lot to pay for a device with an unknown future like the doubleshot. But I guess it just goes to show your level of dedication as opposed to mine.

Sent from my myTouch_4G_Slide using xda premium

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes