Goal: S-off HOX (TEGRA3)

Search This thread
By:
Advanced…
nitrous²

nitrous²

Senior Member
Jun 4, 2010
1,741
1,005
The Grid
feraay said:
Da fehlt a piece
Correct link pls

Gesendet von meinem HTC One X mit Tapatalk 2
Click to expand...
Click to collapse

Ok, this is strange. The link doesn't copy correctly. You know what, go to the second post and you'll see a part where Xmoo sais "had the chance to play with a blalalala". At the end of the sentence there's a link. If you use Chrome on pc open the second post >f3 > and type "had the chance" and you should find the link.

Sent from my HTC One X using xda premium
 
Last edited:
F

feraay

Senior Member
Dec 30, 2011
258
92
Thx sounds good

Ok you are not able Tod Boot but as you say you can install newer hboot for your cid er change cid i dont know
U have a s off device than you can do all i think ^^

Gesendet von meinem HTC One X mit Tapatalk 2

---------- Post added at 10:17 PM ---------- Previous post was at 10:13 PM ----------

tomorrow morning I'm going to buy into a market and electro me a otg cable and the sandisk card reader

I try it FU.. s - off

Gesendet von meinem HTC One X mit Tapatalk 2
 
  • Like
Reactions: Mr_S
nitrous²

nitrous²

Senior Member
Jun 4, 2010
1,741
1,005
The Grid
feraay said:
Thx sounds good

Ok you are not able Tod Boot but as you say you can install newer hboot for your cid er change cid i dont know
U have a s off device than you can do all i think ^^

Gesendet von meinem HTC One X mit Tapatalk 2

---------- Post added at 10:17 PM ---------- Previous post was at 10:13 PM ----------

tomorrow morning I'm going to buy into a market and electro me a otg cable and the sandisk card reader

I try it FU.. s - off

Gesendet von meinem HTC One X mit Tapatalk 2
Click to expand...
Click to collapse

You need an external powered otg cable. A standard otg cable won't work.

Sent from my IdeaTabA2109A using xda premium
 
F

feraay

Senior Member
Dec 30, 2011
258
92
Sure ?
He did it with a normal otg cabel

Gesendet von meinem HTC One X mit Tapatalk 2
 
F

feraay

Senior Member
Dec 30, 2011
258
92
I will get the same sandisk micromate think it will work ? Or i need a y USB to flash diag file for cid ?

The say u need it for goldcard flash i buy a micro USB y cabel and the sandisk card reader that must work

Gesendet von meinem HTC One X mit Tapatalk 2
 
Last edited:
nitrous²

nitrous²

Senior Member
Jun 4, 2010
1,741
1,005
The Grid
Ok, it has to be an OTG Cable in any case! A standard Micro USB Y cable won't work. Now it depends on the sdcard reader if it has to be external powered or not. If it doesn't work, you can build your own powered OTG cable. I'll find the xda link and post it. It's really easy! :D

Sent from my HTC One X using xda premium
 
cjoliver

cjoliver

Senior Member
Aug 3, 2009
172
320
Pretoria
Hi guys,

I'm just spit-balling here, but have anybody thought about getting in contact with NVidia. This is there chip-set, surely they have a way to boot it of another form of storage or another way to get it into APX or whatever mode they use to test the hardware.
 
nitrous²

nitrous²

Senior Member
Jun 4, 2010
1,741
1,005
The Grid
tessut said:
On jb there is no need of an otg cable with external power

Sent from my HTC One X using xda premium
Click to expand...
Click to collapse

In bootloader moder YOU NEED an external powered one! The OS version and hboot version doesn't matter! Yes, if you're in the OS there's no need for additional power but this is not what we're talking about.

Sent from my IdeaTabA2109A using xda premium
 
Thunder07

Thunder07

Inactive RC / RD
Sep 22, 2007
1,541
2,415
People, this is a discussion thread and not a support thread...
someone attempting something doesn't need your good lucks & +1..
by doing that you're just making each useful information posted by someone threadS apart,
thanks.

dibdab214 said:
I know the video above is not s-off but would that method work for flashing different ruus. I.e. in my case I have an o2_001 branded cid. Could I bypass the check and flash another region and update the hboot?

Sent from my HTC One X using xda app-developers app
Click to expand...
Click to collapse

i've answered that back a page or 2 ago...

thunder07 said:
however should it(goldcard) work... it will solve 2 problems, 1) it will mean we can flash another CID's Firmware.... which will solve everyone's wait for the carrier to release the new hboot for JB,
i wanted to attempt this but never got arround to getting a OTG cable
2) should some find a hack that's only for a certain CID or superCID, e.g: leaked diag, this will allow it to work for everyone
Click to expand...
Click to collapse
 
  • Like
Reactions: clyder, dibdab214 and nitrous²
Thunder07

Thunder07

Inactive RC / RD
Sep 22, 2007
1,541
2,415
nitrous² said:
Tried that. It gives me the same error as by flashing in fastboot mode. Although in RUU mode you can flash any file onto the device, hboot is still checking for correct signature.
Click to expand...
Click to collapse

this is the way RUU.exe works, as the exe is not more than GUI for adb & fastboot
normal RUU flashing requirement apply... locked bootloader

starbase64 said:
Hi,

don't work here :(
Bootloader says "Signatur check ok" and then "Please plug off USB"
cheers

starbase64
Click to expand...
Click to collapse

star, be more specific,
did you try flashing your own rom.zip, that of a different CID or flashing a DIAG.zip
with or without goldcard... and so forth...
plus did you have a control, where you attempted a scenario that works before going for one that doesn't??
 
Last edited:
nitrous²

nitrous²

Senior Member
Jun 4, 2010
1,741
1,005
The Grid
thunder07 said:
ok, i see what you did... with the RUU
but have you done anything with sdcard?? with OTG?
Click to expand...
Click to collapse

I have the bad feeling that we got our wires crossed :D

So, what I did with the sdcard and the OTG-Y-Cable on "RELOCKED" and "UNLOCKED" bootloader;

a) Put DIAG onto the root of sdcard> plugged it into the female end of OTG-Y-Cable> plugged it into the one x> plugged the male end to psu> rebooted into bootloader and got the error message.

b) Put DIAG onto the root of sdcard> plugged it into the female end of OTG-Y-Cable> plugged it into the one x> plugged the male end to psu> rebooted into "red fastboot" with adb reboot oem-34 and got the error message.

c) Made a goldcard out of the sdcard> Put DIAG onto the root of sdcard> plugged it into the female end of OTG-Y-Cable> plugged it into the one x> plugged the male end to psu> rebooted into bootloader and got the error message.

d) Made a goldcard out of the sdcard> Put DIAG onto the root of sdcard> plugged it into the female end of OTG-Y-Cable> plugged it into the one x> plugged the male end to psu> rebooted into "red fastboot" with adb reboot oem-34 and got the error message.

-----------------WITH USB-STICK-----------------

e) Put DIAG onto the root of usb stick> plugged it into the female end of OTG-Y-Cable> plugged it into the one x> plugged the male end to psu> rebooted into bootloader and got the error message.

f) Put DIAG onto the root of usb stick> plugged it into the female end of OTG-Y-Cable> plugged it into the one x> plugged the male end to psu> rebooted into "red fastboot" with adb reboot oem-34 and got the error message.

g) Made a goldcard out of the usb stick> Put DIAG onto the root of usb stick> plugged it into the female end of OTG-Y-Cable> plugged it into the one x> plugged the male end to psu> rebooted into bootloader and got the error message.

h) Made a goldcard out of the usb stick> Put DIAG onto the root of usb stick> plugged it into the female end of OTG-Y-Cable> plugged it into the one x> plugged the male end to psu> rebooted into "red fastboot" with adb reboot oem-34 and got the error message.

i) Made a bootable usb-stick out of the usb stick> Put DIAG onto the root of usb stick> plugged it into the female end of OTG-Y-Cable> plugged it into the one x> plugged the male end to psu> rebooted into bootloader and got the error message.

j) Made a bootable usb-stick out of the usb stick> Put DIAG onto the root of usb stick> plugged it into the female end of OTG-Y-Cable> plugged it into the one x> plugged the male end to psu> rebooted into "red fastboot" with adb reboot oem-34 and got the error message.

It was a hell of a work, but at least no one has to do it as it's not working with the goldcard method. It won't work because goldcards are meant to work on QUALCOMM devices. Why are we still talking about them? Even on the S-OFF development thread it has been proven as non working...

---------- Post added at 12:54 PM ---------- Previous post was at 12:51 PM ----------
feraay said:
Lets try the Asus transformer thing

When i unterstand right they write, a blob, File to Access ebt Partition in nvflash and just Format this Partition so just Flash open bootloader and ready

But When this work u May have a Device without bootloader


Asusguy: I've tried to use nvflash --format_partition 4 (in my case is the ebt partition)
I dont know any nvflash command But format Partition 4 Sounds easy


The thing is all other stuff like downgrade hboot goldcard diagfile tried since 9 month
Never worked, But nvflash Never really tried
I know its easy talking But we have lost our goal running in circles since 4month


Gesendet von meinem GT-P7100 mit Tapatal
Click to expand...
Click to collapse

This would be useful if our bootloaders weren't unlockable, but thank god we have HTCdev (*sarcasm*). The ASUS had to get ONLY and unlocked bootloader, they don't have S-ON/OFF problem and thats what the blob/nvflash thingy is all about. It just unlocks the bootloader of th TF series. It won't help us achieving S-OFF.
 
  • Like
Reactions: Actura, myself11 and Thunder07
F

feraay

Senior Member
Dec 30, 2011
258
92
Yes sure but they Are able to touch ebt partition Directly?

They Are able to Backup unlock token and factory settings

You should also back-up your unlock token and your device’s factory generated configuration by using the following two commands:-
$ nvflash --resume --read 14 factory-config.img
$ nvflash --resume --read 7 unlock-token.img

Gesendet von meinem GT-P7100 mit Tapatalk 2
 
Last edited:
xmoo

xmoo

Retired Recognized Developer
Aug 19, 2006
5,450
1,803
34
Eindhoven
www.Mohammad.Moghtader.net
Uploading the full 1.23.997.0 DEBUG ROM.
This one is locked to SuperCID and includes 0.31 MFG HBOOT.
Hope this ROM can help you guys.

Ps. Please don't share it with the big public because these DEBUG ROMs are very rare and easy to trace.

Link will be available till sunday night: down
 

Attachments

  • src1.jpg
    src1.jpg
    503.3 KB · Views: 875
  • src2.jpg
    src2.jpg
    19.8 KB · Views: 729
  • src3.jpg
    src3.jpg
    29.3 KB · Views: 701
Last edited:
  • Like
Reactions: Daekin, Synoptex, clyder and 12 others
nitrous²

nitrous²

Senior Member
Jun 4, 2010
1,741
1,005
The Grid
What are the chances of bricking ıf I attempt to flash this rom through sdcard? Will it even be flashable?
 
pandaball

pandaball

Inactive Recognized Developer
Oct 18, 2011
2,388
1,735
I suppose we could pull hboot.img off the zip and look at it in its raw assembled form. Someone with reverse engineering experience (like Ralekdev who reverse engineered the Verizon SGS3 bootloader) could then find an exploit to get around or disable s-on/s-off security by disassembling or decompiling the hboot.
 
  • Like
Reactions: lenthele
Thunder07

Thunder07

Inactive RC / RD
Sep 22, 2007
1,541
2,415
pandaball said:
I suppose we could pull hboot.img off the zip and look at it in its raw assembled form. Someone with reverse engineering experience (like Ralekdev who reverse engineered the Verizon SGS3 bootloader) could then find an exploit to get around or disable s-on/s-off security by disassembling or decompiling the hboot.
Click to expand...
Click to collapse

if it was that easy someone would have done it.... ages ago..
as all RUUs OTAs contained a hboot image :/
but if you're in touch with him, it wouldn't make things worst if we have someone experience is that field to help.
 
xmoo

xmoo

Retired Recognized Developer
Aug 19, 2006
5,450
1,803
34
Eindhoven
www.Mohammad.Moghtader.net
thunder07 said:
this is why we need a goldcard... for things that need superCID or of a different CID than your own.
plus i dont think superCID can downgrade but it would be class if someone can correct me...
also the mainver is MainVer: 1.23.997.0 which is lower than any released HOX phone.. 1.25/26 was the oldest i think
which means flashing that would count as a downgrade, which yet we cant do (s-off)

back to your question... this isnt flashable without s-off...
well you could make a custom rom zip out of the img and flash it like that...
but it probably wont boot without the older hboot :/
Click to expand...
Click to collapse

HOX came shipped with 1.19 in asia.

It looks like the partitioning changes on every release or some get shown on TEST Roms which on Release Roms the partitions are hidden and renamed.
 
  • Like
Reactions: Synoptex, myself11, nitrous² and 1 other person
You must log in or register to reply here.

Similar threads

xmoo
  • Locked
[S-OFF]Development
Replies
4K
Views
1M
orb3000
orb3000
Diamondback
  • Locked
Jelly Bean (JB) for the HOX - OTA/Information/Update/ETAs/etc
Replies
3K
Views
970K
orb3000
orb3000
hamdir
HTC Flagship 2012 - HTC One X (Endeavor) - Tegra 3 - Mega Information Thread
Replies
20K
Views
3M
hamdir
hamdir
m0narx
[ROM][05.06] Team Venom presents: ViperX 4.1.1 - welcome to the future
Replies
26K
Views
4M
izzulhafiz
izzulhafiz
hasoon2000
  • Locked
  • Poll
[TOOL] HTC One X (Tegra3) All-In-One Toolkit V2.5 [7-12-2013] [PERMROOT][Noob-Proof]
Replies
608
Views
638K
kinfauns
kinfauns

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 69
    TripNRaVeR
    TripNRaVeR
    I have gained access to some neat tools!

    The tool is also able to boot into diag58, currently i'm running it userspace and can freely set everything i want. I tried entering diag58 but it was waiting on modem. Going to try to read the secure key, it has basicly acces to everything.


    BBVVcZiCEAMtjoX.jpg
    View
    56
    TripNRaVeR
    TripNRaVeR
    Got this key out of the 0.40 hboot


    0x15d15b4fb63ee0b
    View
    50
    TripNRaVeR
    TripNRaVeR
    And another thing that also belongs here, have full acces to my device right now during APX mode.

    http://xdaforums.com/showpost.php?p=37133727&postcount=4973
    View
    43
    TripNRaVeR
    TripNRaVeR
    Update on fuse protection:

    https://github.com/TripNRaVeR/tripn...mmit/87a0a9df1335a33cfe509e12eca697c8c5eaa82a
    View
    38
    nitrous²
    nitrous²
    IHTC One X+ Infos will be adapted to this as soon as possible.


    Names for the devices are:


    Model ID: PM35110
    Model Name: S728e
    aka One X+



    Model ID: PJ46100 aka
    Model Name: S720e
    aka One X    ​



    So as the title says, we're facing the problem of not having S-OFF yet, although the One X (S720e) has been released nine months ago. The One X+ is newer but since it has the same processor family, it's accountable to this project. It's possible to unlock the bootloader via HTCdev but it doesn't gives us S-OFF. The Unlock via HTCdev gives us only partially control over Bootloader and Recovery. Since it's release date, some great Devs including Xmoo, Football, Mike1986 and more tried to disable the security check. Unfortunatly without a solution for the masses. Also the One X+ (S728e) is relatively new on the market, so THIS is maybe the first thread in the world regarding S-OFF on the S728e Unlike on other HTC phones, on which hardware solutions like the XTC-Clip, or software solutions like revolutionary or any similar software did the job, on the One X they're not going to work. At the moment the only known method is the official HTC's way.

    Ways to set the devices S-OFF​
    Ways%20to%20set%20the%20S720e%20S-OFF.jpg


    --------------DIAG + JAVCARD Route--------------​

    Infos I could gather. At the moment these infos are only valid for the S720e:

    monx® said:
    Basically u need adb/android SDK before proceed.

    [WITH ROOT ACCESS]
    [+] Dump/copy boot.img
    Code: 
    Command prompt :
> adb shell
> su
> dd if=/dev/block/mmcblk0p4 of=/sdcard/boot.img
    More partition/img availabe to dump. Will update later.

    [WITHOUT ROOT ACCESS]
    Currently only /system is usable

    1) Android SDK (just need adb)
    2) Download busybox
    3) Command prompt :
    > adb push busybox /data/local/busybox
    > adb shell
    > cd /sdcard/
    > chmod 755 /data/local/busybox
    > /data/local/busybox tar cvf sysdump.tar /system
    4) Ignore tar: error exit delayed from previous errors'. Is done correctly.

    ----------------------------------------------------------------------

    Just finished dumped my semi-virgin One X system partition from SEA WWE stock ROM :D.
    The file would be OneX_SEA_WWE_1.26.707.2_SYSTEM_DUMP.zip 558.3 MB :eek:
    Click to expand...
    Click to collapse


    Radio (The Radiomodule on S720e is an Intel X-Gold 626 chip [XMM6260]) location (xmoo's post Radio) Documentation of the Radio chip and direct download:
    xmoo; said:
    Mike found out Radio is probably: \system\etc\QUO_6260.fls.clean
    7.96MB

    Commands located in QUO_6260.fls.clean
    CALIB_NVM
    DYNAMIC_NVM
    STATIC_NVM
    SEC_DATA
    PSI_RAM

    If I could believe the following:
    Found the same commands in a datasheet: "MSM3000Qualcomm, Inc.MOBILE STATION MODEM"
    http://www.datasheetarchive.com/MSM3000-datasheet.html

    So guess we got the Radio located!
    Click to expand...
    Click to collapse

    Possible Hboot location (blubber's post Hboot):
    blubber; said:
    xmoo; said:
    How do you know this?

    /EBT does not excist on my phone.


    mmcblk0p2 -> /dev/block/platform/sdhci-tegra.3/by-name/WDM
    mmcblk0p16 -> /dev/block/platform/sdhci-tegra.3/by-name/DUM
    mmcblk0p17 -> /dev/block/platform/sdhci-tegra.3/by-name/MSC
    mmcblk0p20 -> /dev/block/platform/sdhci-tegra.3/by-name/PDT
    Click to expand...
    Click to collapse

    of course it does not exist as i have written a few times before!
    it is not accessible with a stock kernel!

    i know it is there:


    Code: 
    130|root@android:/ # hexdump -C /dev/block/mmcblk0|grep EBT                    
000000e0  03 00 00 00 00 00 00 00  04 00 00 00 45 42 54 00  |............EBT.|

    and the EBT partition does contain the bootloader!
    Click to expand...
    Click to collapse


    CID Check needs to be bypassed (xmoo's post CID check)
    xmoo said:
    Guys, the diag files have "CIDNUM: 11111111" in it.
    Can't change it cause the file gets corrupted.
    So only way to boot it up is by passing the CID check.

    This is were the Smartcard or Goldcard comes in.
    We tried the one from http://psas.revskills.de/?q=goldcard with no success.
    I remember for some devices you had to change 00 to 11, or something like that.
    Maybe this has to be done for this device aswell. Also I remember something that SDHC cards were not supported, or they are... been a long time ago.
    So your help is need.

    Create a goldcard which works.

    Remember to test it like this: http://xdaforums.com/show....php?t=1714056

    Thank you.
    Click to expand...
    Click to collapse

    Partiton list (Football's post Partition list)
    Football said:
    After intensive digging in some stuff I have found this. This is whole partition list for One X with all addresses and lengths of partitions...
    Code: 
    [partition]
name=BCT
id=2
start_location=0x00
size=0x400000

[partition]
name=PT
id=3
start_location=0x400000
size=0x200000

[partition]
name=EBT
id=4
type=bootloader
start_location=0x600000
size=0x400000

[partition]
name=DIA
id=5
type=bootloader
start_location=0xA00000
size=0x400000

[partition] (Board Information)
name=BIF
id=6
start_location=0xE00000
size=0x200000


[partition]
name=GP1
id=7
start_location=0x1000000
size=0x200000

### WLAN firmware ###
[partition]
name=WLN
id=8
start_location=0x1200000
size=0x600000
#filename=wlan.img

### WLAN Data + MFG Data ###
[partition]
name=WDM
id=9
start_location=0x1800000
size=0x200000
filename=WDM.img

### Radio Calibration Data ###
[partition]
name=RCA
id=10
filesystem_type=ext3
start_location=0x1A00000
size=0x600000

### Linux Kernel OS ###
[partition]
name=LNX
id=11
start_location=0x2000000
size=0x800000
filename=boot.img

### Recovery ###
[partition]
name=SOS
id=12
start_location=0x2800000
size=0x800000
filename=recovery.img

### PG1FS ###
[partition]
name=PG1
id=13
start_location=0x3000000
size=0x1000000

### PG2FS ###
[partition]
name=PG2
id=14
start_location=0x4000000
size=0x1000000

### PG3FS ###
[partition]
name=PG3
id=15
start_location=0x5000000
size=0x1000000

### Software Info ###
[partition]
name=SIF
id=16
start_location=0x6000000
size=0x400000
filename=SIF.img

### Splash1 ###
[partition]
name=SP1
id=17
start_location=0x6400000
size=0x400000

### Reserve1 ###
[partition]
name=RV1
id=18
start_location=0x6800000
size=0x1C00000

### System ###
[partition]
name=APP
id=19
filesystem_type=ext3
start_location=0x8400000
size=0x50000000
filename=system.img

### Cache ###
[partition]
name=CAC
id=20
filesystem_type=ext3
start_location=0x58400000
size=0x14000000

### Internal SD ###
[partition]
name=ISD
id=21
start_location=0x6C400000
size=0x650000000

### Userdata ###
[partition]
name=UDA
id=22
filesystem_type=ext3
start_location=0x6BC400000
size=0x89400000
filename=userdata.img

### Memory dump ###
[partition]
name=DUM
id=23
start_location=0x745800000
size=0x200000


### MISC Partition ###
[partition]
name=MSC
id=24
start_location=0x745A00000
size=0x200000

### Radio File System ###
[partition]
name=RFS
id=25
start_location=0x745C00000
size=0x600000


### Develop Log ###
[partition]
name=DLG
id=26
start_location=0x746200000
size=0x1600000

### PDATA for MASD ###
[partition]
name=PDT
id=27
start_location=0x747800000
size=0x200000

[partition]
name=GPT
id=28
type=GPT
start_location=0x747A00000
#size=0xFFFFFFFFFFFFFFFF
size=0x200000
    Click to expand...
    Click to collapse


    Mike1986's Partition Info (mike1986's post One X Partition Info)
    mike1986. said:
    This thread's content might brick your device.
    This is not a ROM thread, so I'm not going to answer again and again and again the same questions over and over and over again.
    You can't read - quit this thread now. You can read but you can't understand more or less simple things - quit as well.
    You can read and you understand things, but you are too lazy to read the whole thread before asking the question - watch this first. And quit.    ​

    This is what we know so far:

    Partitions1.png


    Some conclusions:

    1. It's very nice to see that finally someone separated "internal sd card" from userdata partition. So it's no longer linked to /data/media, as it used to be on Asus Transformer, Transformer Prime, Galaxy Nexus etc. but it's a separate partition now - mmcblk0p14. Basically the biggest benefit from that is that now formatting userdata partition will no longer erase virtual sd card content.
    2. It seems that NFC and WLAN deep settings are stored on separate partitions: mmcblk0p1 (wlan) and ? (NFC).
    3. There is a 5th PHYSICAL core, but it's invisible to the system. Android only sees the 4 main cores. The 5th companion core is not controlled by Android. Tegra 3 architecture itself handles the load balancing between the main cores and the companion core. (Thanks to Diamondback)
    4. There is no radio.img in current RUUs.


    Download firmware for HTC One X (PJ4610000)

    Firmware from 1.28.401.9 RUU
    --- MD5 checksum: 83375DF988C86E92417AA8949012A1C2 *PJ46IMG.zip ---

    Supported devices:
    --- CID's added by users requests are marked with green color ---
    cidnum: HTC__001
    cidnum: HTC__E11
    cidnum: HTC__203
    cidnum: HTC__Y13
    cidnum: HTC__102
    cidnum: HTC__405
    cidnum: HTC__304
    cidnum: HTC__032
    cidnum: HTC__J15
    cidnum: HTC__A07
    cidnum: HTC__016
    cidnum: HTC__M27
    ​

    Why it's better then full RUU:

    1. It doesn't contain stock recovery
    2. It doesn't contain stock, non rooted system
    3. It doesn't contain secured boot.img
    4. It wont wipe your data partition
    5. It's much smaller :D

    PJ46IMG.zip content: [UPDATE: 25.03.2012]

    android-info.txt - updated [20.04.2012]
    bct.img - updated [25.03.2012]
    rcdata.img - updated [20.04.2012]

    How to flash:

    1. Check your CID using fastboot getvar cid and MID using fastboot getvar mid
    2a. If your CID and MID are supported by default, navigate to point 3.
    2b. If your CID or MID is not supported by default, do this: (you do it at your own risk)
    2c. Open PJ46IMG.zip (don't extract it)
    2d. Open android-info.txt in text editor
    2e. Add your cidnum: or modelid: to the list, save file and close archive
    3. Place PJ46IMG.zip on your SD card
    4. Boot your device holding power button + vol down button
    5. Follow instructions on the screen

    Additional information:

    1. Flash above firmware at your own risk!
    2. It's recommended to flash it before flashing custom ROM based on proper RUU!
    3. Unlocking via htcdev.com will change your CID number into "none".

    4. RUU variants:
    x.xx.61.x - Orange UK (United Kingdom)
    x.xx.75.x - Orange ES (Spain)
    x.xx.110.x - T-Mobile UK (United Kingdom)
    x.xx.111.x - T-Mobile DE (Germany)
    x.xx.112.x - T-Mobile AT (Austria)
    x.xx.114.x - T-Mobile NL (Netherlands)
    x.xx.118.x - T-Mobile PL (Poland)
    x.xx.161.x - Vodafone UK (United Kingdom)
    x.xx.166.x - Vodafone CH-DE (Switzerland - Germany)
    x.xx.163.x - Vodafone FR (France)
    x.xx.169.x - Vodafone AT (Austria)
    x.xx.206.x - O2 UK (United Kingdom)
    x.xx.207.x - O2 DE (Germany)
    x.xx.401.x - World Wide English
    x.xx.707.x - Asia WWE (World Wide English)
    x.xx.720.x - Asia India
    x.xx.771.x - Hutchison 3G UK (United Kingdom)
    x.xx.862.x - Voda-Hutch AU (Australia)
    x.xx.980.x - Optus AU (Australia)
    x.xx.1400.x - HTC China

    Please post here your findings, thoughts or experience with after flashing images listed above.
    Click to expand...
    Click to collapse



    Mike1986's addition (mike1986's post Addition)
    mike1986 said:
    Something more:

    /system/etc/Flash_Loader.conf

    boot_port_name=/dev/ttyACMX0
    fw_download_port_name=/dev/ttyACMX0
    baudrate=921600
    BootTimeOut=3000
    CommTimeOut=1000
    eep_normal_mode=m
    file_name=/data/modem_work/QUO_6260.fls
    #file_name=QUO_6260.fls
    #file_name=XMM6260_SIC.fls
    #log_fname=/dev/null
    log_fname=/data/modem_work/Flash_Loader.log
    Click to expand...
    Click to collapse
    also

    \system\bin\poweron_modem_fls.sh

    Line 55: /system/bin/InjectionTool -i ${backup_dir}/QUO_6260.fls.clean -o ${Injected_dir}/QUO_6260.fls -n ${work_dir} -s ${sec_dir}
    Line 55: /system/bin/InjectionTool -i ${backup_dir}/QUO_6260.fls.clean -o ${Injected_dir}/QUO_6260.fls -n ${work_dir} -s ${sec_dir}
    Click to expand...
    Click to collapse
    and

    \system\bin\poweron_modem_hboot.sh

    Line 50: /system/bin/InjectionTool -i ${backup_dir}/QUO_6260.fls.clean -o ${Injected_dir}/QUO_6260.fls -n ${work_dir} -s ${sec_dir}
    Line 50: /system/bin/InjectionTool -i ${backup_dir}/QUO_6260.fls.clean -o ${Injected_dir}/QUO_6260.fls -n ${work_dir} -s ${sec_dir}
    Click to expand...
    Click to collapse
    And from flash_loader.log

    Start downloading item 'CODE:../HW/XMM6260_V2_USB-HSIC_FLASHLESS_EDE_1.0/MODEM_DEBUG/QUO_6260.fls'' from file '/data/modem_work/QUO_6260.fls
    Click to expand...
    Click to collapse
    Click to expand...
    Click to collapse


    This is how HTC does it:


    My attempt (tried also on locked bootloader with the same output)




    Things you'll need for this trick:

    - USB OTG-Y-Cable. You can also build your own with this guide : How to make external powered OTG Cable
    - USB SD Cardreader
    - MicroSD Javacard (if you can bypass cid check, the Javacard is not needed) Xmoo said this one is used by HTC: GO-Trust® Secure microSD Java. It costs 980 US Dollars together with the SDK. Also, even if you have the Javacard you have to build the Application environment.
    - 5V+ Power supply (Standard wall charger)
    - PJ46DIAG.zip= clean S58 Data program specificly for the S720E/S728e. The correct DIAG has tot have a size of 964kb or 941kb and must contain the string "clean s58..." which can be checked with hexedit or any similar hex editor.

    The procedure:

    1. Put PJ46DIAG.zip on the Secure MicroSD Javacard
    2. Plug it into the USB SD Cardreader
    3. Plug the Cardreader into the female end of USB OTG-Y-Cable
    4. Plug the OTG-Y-Cable into the USB port of the phone
    5. Plug the cable onto the power supply
    6. Reboot into bootloader
    7. Once in Bootloader the file will be load by the phone and you'll land in S58 Menu. Clean S58 Data and you've successfully set your device S-Off

    And here's the problem with this method. 1. A Javacard is really hard to get. I've never saw one, no one I know has ever saw one :D 2. The Diag file can't be leaked. The ones I've attached here are useless as Xmoo said and maybe proved. I have attached them though. So anyone interested and willing to help can investigate them.

    As we know, the Diag file's for the One X can't be leaked. They're spread to choosen HTC-Repair centres, so a leak will easily be traced back. This would bring the affected people in some serious trouble. But this is interesting. These guys over on pdacentre use the official method. It's suspicious, kind of. For now, this is the only know method. It cost's around 2000 rubel (65€ | 85$) + shipping depending on your location. Of course this isn't an appropriate solution. Another thing; Why do we need a Javacard? Well, because the DIAG files will only work on devices with SuperCID (11111111) not on normal CID (HTC__XXX). So another way is to bypass the CID check.


    Rough diagram of a Javacard
    diagram_v21.jpg

    Copyright © 2011 GOTrust Technology Inc., All rights reserved.



    TOOLBOX
    The DIAG files I've linke don't have any function except from superwipe. They're only meant to be used as a test file to check if we can load such DIAG files.:
    Goal: S-off HOX+ and maybe the HOX (TEGRA3)
    Obtaining HTC One X Diag File to Manage S-OFF!!
    [S-OFF]Development
    ENG Hboot 0.03
    PJ46DIAG_4
    DIAG files of older HTC devices
    NVflashdrivers
    Radio Documentation
    TEGRA 3 Documentation. PM me for password.
    Click to expand...
    Click to collapse

    How do I know that I have the correct DIAG file? ;
    The clean DIAG has a size of 964kb or 941kb. Or look at the image above. If your DIAG is called like them it could be the correct one also. But to be really sure, do the following;
    Download any HEXeditor you can get. Open the DIAG file with the HEXeditor and search for keywords like "clean", "s58", . If you find these two strings in the DIAG file, it could be the correct one. We'd appreciate it if you could upload the file.

    "clean s58"
    1.jpg

    Known and working DIAG files for the One X

    attachment.php



    What's already been done:

    xmoo; said:
    13-04-2012 XDA.CN releases pictures showing someone succesfully has S-OFF'd his device. Tool is for sale here: http://item.taobao.com/item.htm?id=10824156715
    17-04-2012 Thread made.
    17-04-2012 We have found someone with a S-OFF device, and a newer HBOOT than the one from XDA.CN. Trying to get access to the HBOOT.
    18-04-2012 OTA 1.28 brings HBOOT 0.94.
    18-04-2012 New member with a S-OFF device is willing to help.
    s-off-hboot_HOX.JPG

    19-04-2012 HBOOT 0.43 S-OFF rfs.img received and uploaded.
    19-04-2012 RFS.img is not the correct file, searching continues...
    19-04-2012 Radio located, click here
    26-04-2012 HBOOT probably located here
    15-05-2012 NVFlash app + APX Drivers added
    12-06-2012 Tegra 3 Manual added, see here!
    16-06-2012 HBOOT 1.11 from the test-keys uploaded here!
    16-06-2012 Huge development, read more about it!
    18-06-2012 Need to find a way to by-pass CID check.
    19-06-2012 Football Partition list for One X with all addresses and lengths of partitions which can be found here.
    27-06-2012 Huhge thread clean-up and update.
    04-07-2012 Had the chance to play with a S-OFF device, read more about it here! ENG HBOOT which is used in test, is located here.
    09-07-2012 Javacard with DIAG will work, but won't be a good solution cause no one got a legit Javacard and the DIAG files can't be leaked!
    14-07-2012 Video added which shows the Javacard with DIAG method. Video can be found here.
    14-07-2012 The ENG HBOOT 0.03 that Football uploaded lost it's sign. I re-uploaded it and re-checked the file and it should be good now. You can find the new .zip here.

    FAQ.
    What is S-OFF?
    S-OFF stands for Security-OFF
    S-OFF means that the NAND portion of the device is unlocked and can be written to. The default setting for HTC’s devices is S-ON, which means that neither can you access certain areas of the system nor can you guarantee a permanent root. Furthermore, signature check for firmware images is also ensured by the S-ON flag.

    What has already been done?
    -Tried flashing DIAG file, but with no success. File needs SuperCID.
    -Tried flashing ENG HBOOT as zip file, but with no success. File needs SuperCID.
    -Tried flashing modified DIAG file, but with no success. File needs SuperCID.
    -Tried flashing modified HBOOT as zip file, but with no success. Signature check failed.
    -Tried creating a Goldcard, but won't work. The Goldcare is for Qualcomm devices.
    -Root while phone is LOCKED, won't work. Only will work on the Qualcomm One X and One XL.
    -Ask the Chineese guy with the S-OFF tool. Won't share, cause he needs his money.
    -Tried flashing files over recovery, but with no success.
    -Tried flashing TETS and MFG ROMs, but with no success. Phone needs S-OFF because the ROMS are not sighned.
    -Tried changing CID, but won't work. Only will work on the Qualcomm One X and One XL.
    -Tried commands over ADB, but with no success.
    -Tried XTC clip, won't work.

    How Do I Know If My Device Is S-ON Or S-OFF?
    That is easy to verify. Simply boot into HBOOT (bootloader) on your device, and the text on top will show the flag status as either S-OFF or S-ON. A full root generally means S-OFF.
    s-off.jpg

    S-OFF – What And Why?
    HTC have installed a sort of security check whose level is determined by S-OFF/S-ON. Essentially, this security level is a flag stored on the device’s radio that checks signature images for any firmware before it is allowed to be written to system memory. This hinders using any custom ROMs, splash images, recovery etc., and also restricts access to the NAND flash memory. However, when security level is set to S-OFF, the signature check is bypassed, allowing a user to upload custom firmware images, unsigned boot, recovery, splash and HBOOT images, as well as official firmware that has been modified, this enabling maximum customization of your HTC Android device.

    Furthermore, S-OFF also reduces restrictions on accessing the NAND flash memory on the device, allowing all partitions (including /system) to be mounted in write mode while the operating system is booted.

    Where is it located?
    Don't know yet, here are the partitions.

    How can I flash through SD?
    Tutorial added here!

    What HBOOT status have we seen so far?
    ENDEAVORU PVT SHIP S-ON RL
    ENDEAVORU PVT SHIP S-OFF RL
    ENDEAVORU PVT ENG S-OFF RL
    ENDEAVORU XE ENG S-OFF RH
    ENDEAVORU PVT MFG RH
    ENDEAVORU XE SHIP S-OFF RH
    ENDEAVORU UNKNOWN ENG S-OFF RH

    Partition list for One X with all addresses and lengths of partitions
    Football share the full list which can be found here.

    How does HTC do it?
    They do it with a smartcard/javacard/goldcard (What ever you want to call it) in combination with the DIAG file. Proof is in the attachment.
    Click to expand...
    Click to collapse



    --------------Alternative APX MODE Route--------------​


    xmoo said:
    Hey guys,

    Please stop PM'ing me about APX Mode. I get like 10 PM's a day.

    How to get in
    Nobody really knows. The most common way has been pressing volume up and down together while device is off and then plugin USB while connected to a computer.

    How to get out
    When your device is in APX Mode, HTC fixes it in repair. Someone here on XDA PM'd me with this video and said it should work: http://www.youtube.com/watch?v=rsnl_LIgzt0
    I have not tried it myself, so just give it a try and share with the rest.

    All the other discussions about APX can be done here, please stop pm'ing me.
    Thank you!
    Click to expand...
    Click to collapse


    Alright Folks! TripNRaVer has made something rudimentary, awesome, fascinating...words can't describe....Work!! Here You go, APX DRIVERS FOR THE ONE X

    TripNRaVeR said:
    semctriplogo.jpg



    For those of you that are in APX Mode or want to mess with APX here is the modified driver for the One X.

    Now you have acces to the device again through USB.

    Todo:
    - Plug the usb cable in hox
    - Goto device manager
    - Search for APX or Unknown device or whatever it is listed
    - Choose update driver
    - Choose manually select driver
    - Select the folder where you extracted the zip file
    - Install drivers

    Use nvflash to gain acces to the device again.

    Download:
    http://tripndroid.bindroidroms.com/TripNDroid-HOX-APX-Driver.zip

    Nvflash:
    - Use nvflash binary to gain acces to the device
    - Including flash.cfg for endeavoru to use with nvflash.exe
    - Including a bct file

    http://tripndroid.bindroidroms.com/tripndroid_nvflash.zip
    Click to expand...
    Click to collapse






    PLEASE read on the threads I've linked, before you start discussion. People really did some great development.
    View

New posts