I have gained access to some neat tools!

The tool is also able to boot into diag58, currently i'm running it userspace and can freely set everything i want. I tried entering diag58 but it was waiting on modem. Going to try to read the secure key, it has basicly acces to everything.

Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

---

Found this:

http://a500bootloaderflash.tk/sbkcalc/

May be lcd047 could help at this point also for the HOX.

Sent from my EndeavorU using xda app-developers app

Originally Posted by MrT69

Found this:

http://a500bootloaderflash.tk/sbkcalc/

May be lcd047 could help at this point also for the HOX.

Sent from my EndeavorU using xda app-developers app

unfortunately our sbk is very much different,
" It should be a 16 character long string containing only hexadecimal characters"
our only CPUID is one number long :/
i think ours is referred to as sbk v2 as well and it's yet to be cracked.


i know guys i'm shooting down everything you're coming up with..
but i have to before someone starts a discussion & fill the thread with it...
i've been there and tried ALOT of stuff

Set odm production mode from 0x00000001 to 0x00000000 and we have what we want. How?

Well that isnt as easy as expected..

Somewhere during boot there is a check if we are in production mode or not. If we are in production mode then all locks are set. If we arent in production mode all locks are off and we have s-off.

Then we remove the check and its done. We know that the flag can be set in the fuse directory. However it requires a kernel patch, the write protection can be turned of for that section.

Where to find it?
Look at nv-tegra git, there is bootloader source and try to find it (probably htc renamed it)

Originally Posted by TripNRaVeR

Set odm production mode from 0x00000001 to 0x00000000 and we have what we want. How?

Well that isnt as easy as expected..

Somewhere during boot there is a check if we are in production mode or not. If we are in production mode then all locks are set. If we arent in production mode all locks are off and we have s-off.

Then we remove the check and its done. We know that the flag can be set in the fuse directory. However it requires a kernel patch, the write protection can be turned of for that section.

Where to find it?
Look at nv-tegra git, there is bootloader source and try to find it (probably htc renamed it)

tried that back in may, but i couldn't get the fuses to be writeable, tried this instead;

endeavoru-2.6.39-86aa44d/arch/arm/mach-tegra/tegra_odm_fuses.c

static bool fuse_odm_prod_mode(void)
{
        u32 odm_prod_mode = 0;

        clk_enable(clk_fuse);
        get_fuse(ODM_PROD_MODE, &odm_prod_mode);
        clk_disable(clk_fuse);
        return false;
        return (odm_prod_mode ? true : false);
}

Originally Posted by blubbers

tried that back in may, but i couldn't get the fuses to be writeable, tried this instead;

endeavoru-2.6.39-86aa44d/arch/arm/mach-tegra/tegra_odm_fuses.c

static bool fuse_odm_prod_mode(void)
{
        u32 odm_prod_mode = 0;

        clk_enable(clk_fuse);
        get_fuse(ODM_PROD_MODE, &odm_prod_mode);
        clk_disable(clk_fuse);
        return false;
        return (odm_prod_mode ? true : false);
}

You also need to have the vdd_fuse voltage line enabled to gain write acces, you can find the source in my kernel tree on github

Edit:
https://github.com/TripNRaVeR/tripnd...52d4ea27624646

Somehow this brings the device into APX mode when u have a ENG kernel, these bricks somehow could be usefull to gain s-off.

If we write the fuses correctly it is done.

Also for the A500 Series - but Tegra chipset.
Some interesting informations and also the links within:

http://projects.pappkartong.se/a500/

And another thing that also belongs here, have full acces to my device right now during APX mode.

http://forum.xda-developers.com/show...postcount=4973

Got this key out of the 0.40 hboot


0x15d15b4fb63ee0b

Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

---

Originally Posted by TripNRaVeR

Got this key out of the 0.40 hboot


0x15d15b4fb63ee0b

I got 2 ENG and 2 MFG HBOOTs for you as .img to play with.

Sent from my HTC One X using xda app-developers app