Ok too hard for me
i just wait...Gesendet von meinem HTC Sensation XL with Beats Audio X315e mit Tapatalk
Runnymede S-OFF
- Thread starter fardjad
- Start date
-
- Tags
- development
Ok too hard for me
i just wait...Gesendet von meinem HTC Sensation XL with Beats Audio X315e mit Tapatalk
You are a genius where have you been all my life.. i was just about to ask if there was a manual way to do it.. i dont really trust .exe's LOL
shingers5
Inactive Recognized Contributor
mate you are a star. that was easy and painless. hboot back to 1.25 and your name can stay where it is
mate you are a star. that was easy and painless. hboot back to 1.25 and your name can stay where it is
Glad to hear you could unbrick your phone.
By the way my name is Fardjad (pronounced fær.dʒɑːd) and FARDJADB means Fardjad's Bootloader
Glad to hear you could unbrick your phone.
By the way my name is Fardjad (pronounced fær.dʒɑːd) and FARDJADB means Fardjad's Bootloader
Your name was easer to pronounce before you told us how to pronounce it
Sent from my HTC Sensation XL with Beats Audio X315e using Tapatalk 2
@fardjad , so are you looking forward for the root and recovery ?? btw , I am not a dev , but still a novice dev or a mini-dev , so I can't help much , but ofcourse I know the very basics ... adb , fastboot , bootloader etc ...
I see no need for anything else to be added like that. IMO people like to choose what version of busybox, what type of recovery, what root app they like to use themselves.
Sent from my HTC Sensation XL with Beats Audio X315e using Tapatalk 2
shingers5
Inactive Recognized Contributor
Exactly as we have these solutions here already. What we need is full radio s-off and cid bypass. After that we can look at super cid etc
Sent from my Xoom using XDA Premium HD app
Radio S-OFF is a different approach and since it's risky (I disassembled Radio image to see what can I do, I started by simple byte patching, and patched get CID routine but as people reported installing unsigned Radio bricks the phone, I didn't try that) and finding an exploit in radio image is hard and very time consuming, it's not going to happen by me (at least for now).
I already patched a few functions, related to CID checking and I can't find anything else yet, so I have no ideas what can I do... unless somebody gives us an engineering hboot image (this is the safest and easiest way and we can also SuperCID) or I find something interesting in current HBOOT image.
So... I have to be honest with you guys
I started this for fun and learning purposes and there are still way more things I have to learn/experience to be able to get into a complete solution and reliable state...even if you know what you are doing, risks of having a bricked device prevents you to go further and test each new idea comes to your mind.
Last edited:
Of course you can (I mentioned it in the first post.)
@secu_flag (Security Flag) is stored in Radio. Basically Radio S-OFF means changing it from there.
Alternatively you can patch HBOOT to ignore it which is exactly what I've done.
These are two different approaches with the same effect, however Radio S-OFF is more reliable for obvious reasons.
Last edited:
My device is S-OFF fardjadb
i try flash zip ruu, but have error:
C:\adb>fastboot flash zip Ruu_xl_arab_1.08.415.4.zip
sending 'zip' (384723 KB)... OKAY [ 47.290s]
writing 'zip'... INFOzip header checking...
INFOshift signature_size for header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
FAILED (remote: 42 custom id check fail)
finished. total time: 49.218s
any idea ?!
i try flash zip ruu, but have error:
C:\adb>fastboot flash zip Ruu_xl_arab_1.08.415.4.zip
sending 'zip' (384723 KB)... OKAY [ 47.290s]
writing 'zip'... INFOzip header checking...
INFOshift signature_size for header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
FAILED (remote: 42 custom id check fail)
finished. total time: 49.218s
any idea ?!
shingers5
Inactive Recognized Contributor
Mate all you have done is more than I expected so I am grateful. Hope you can get to the level you need to be to take this further. Maybe the rev boys can use your approach to take this to the next level
Sent from my HTC Sensation XL with Beats Audio X315e using xda premium
Sent from my HTC Sensation XL with Beats Audio X315e using xda premium
haha , the rev boys are such high class guys , they don't use anybody's exploit or program or script of anykind ! When , paul.robo wanted to modify their exploit and give it to them so they can distribute it with THEIR credits , they refused , they wanted the exploit to be ""theirs"" !!
What the hell are you on about?
I don't even know who you, or this paul.robo are.
Sorry, you fail to make any sense.
mmhh..sorry ieftm...but i have a similiar thinking...maybe you can clear this..
i had maked a donation thread...and some of us and also i maked a donation...but all response what i got from you guys was you kicked me from chat and say "read through the lines" this is not friendly....so maybe you can clear this situation...i also write emails and got no response...with kind regards...Alex
shingers5
Inactive Recognized Contributor
yea we wanna know where that money has gone and what should we expect? some people donated blindly on alex word and i would assume they'd want some answers. hope we get some answers soon
yeap...first contact was good...so i thought why not...but after that / after some days...mmhhh (because of no responce in any thing..i wrote again...and than comes what i posted some post´s above...mmmmhh...so i´m really happy that fardjad help and made it...thx to him again
with kind regards
Last edited:
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
27Runnymede S-OFF
Since we didn't have S-OFF on Runnymede, I decided to work on it, and here is the result:
It's basically a patched bootloader that pretends S-OFF (not to be confused with Radio S-OFF.)
The following commands have been tested and working correctly:
erase (system, recovery, boot)
flash (zip, system, recovery, boot, hboot, radio)
boot
It also by passes the CID check(See the next post for a workaround.)
and here is the flash "zip", "hboot", and "recovery" demo:
It's still under development; since many people asked me to release it, I decided to release a public beta:
Download (Windows Only)(link removed, see below)
Open the attached file and follow the instructions.
You'll need to install a stock RUU (or if not available, you can flash this stock recovery posted by fshami on an unlocked device) and install HTC Sync Drivers.
Note that this is not guaranteed to work and I won't take any responsibilities if something bad happened to your device.
My farewells
I had lots of fun modifying Runnymede HBOOT and it was a great experience. I want to say thanks to all of the testers for their feedback and also for being nice and patient (maybe I should have released this after my exams, so I'd have enough time to work on it), and I'm sorry for the problems you may have faced because of the incompleteness of my work.
Recently unlimited.io guys (known for Juopunutbear S-OFF) provided their patched HBOOTs. Apparently these are available for GB and ICS, by-pass CID check and have optional update protection:
http://unlimited.io/runnymede said:
See this post.14How to install RUUs with different CIDs
You won't get Radio S-OFF with flashing this HBOOT. Having this said, even if you enable writeCID function in HBOOT you can't change the CID.
I thought people prefer to install one of the custom ROMs floating around in Development Section and flashing the Radio separately rather than upgrading to ICS using RUUs... well I thought wrong
And for those having problems with CID, here is a workaround:
First thing you need to do is to extract the rom.zip file from the RUU. I believe Shen posted a video on XDA-TV showing this, here is a quick how-to however:
- Open the RUU.
- After the Welcome screen has shown up, open %temp% in explorer (ie. Meta/Win-Key + R, type %temp% and press enter)
- Sort items by Date modified and open the most recent modified folder having a name like {3F99782F-1E57-40F2-9F33-D48C3DC171C5}
- Search for rom.zip and move/copy it to somewhere else.
- Close the RUU.
Now downloadSigTool(link removed, see the first post) and place it beside the rom.zip file. Open Command-Prompt, navigate to the relevant directory and execute the following:
the expected output is:Code:SigTool rip rom.zip
Extract the signature-ripped rom.zip file.Code:Creating backup... Ripping signature... Done.
Open android-info.txt in a *nix end of line aware text editor (ex. Notepad++). You should see something like the following:
Add your phone CIDCode:modelid: PI3920000 cidnum: HTC__001 cidnum: HTC__E11 cidnum: HTC__203 cidnum: HTC__102 cidnum: HTC__405 cidnum: HTC__Y13 cidnum: HTC__A07 cidnum: HTC__304 cidnum: HTC__032 cidnum: HTC__J15 cidnum: HTC__016 mainver: 1.05.111.8 hbootpreupdate:12
If you don't know your CID you can get it this way:
While your phone is in bootloader mode and connected in FASTBOOT-USB mode, execute this:
it should output something like cid: T-MOB101Code:fastboot getvar cid
then add a new line (cidnum: <YOURCIDNUM>) below the modelid in android-info.txt so it looks like:
Save changes and close the editor.HTML:modelid: PI3920000cidnum: T-MOB101...
This is very important:
In extracted contents you should see a file with hboot name prefix, exclude/take it away and repack other files. I assume you'll choose rom-new.zip for the archive name.
Now you should null sign (that's how I like to call it) the file:
and flash the null-signed rom zip file:Code:SigTool nullsign rom-new.zip
when finished, flash the 1.28 hboot you moved away before:Code:fastboot flash zip rom-new.zip
Reboot your device.Code:fastboot flash hboot hboot_*.nb0
I know this is not the easiest guide ever but I really don't have enough time to create a one-click tool for this. Needless to say that this is not guaranteed to work and I won't take any responsibilities if you bricked your phone.
Take care7
Guys please be careful when playing with HBOOT, Radio, etc.
Here is the easy way to unbrick:
1. Flash your unlock token on 1.28 if it's (re)locked.
2. Boot into a working recovery.
3. Download this and push it to /tmp (adb push fardjadb_runnymede.nb0 /tmp)
4. get into adb shell and execute dd if=/tmp/fardjadb_runnymede.nb0 of=/dev/block/mmcblk0p18
5. reboot bootloader
6. Download this and flash it to the misc partition (fastboot flash misc supermisc)
7. fastboot reboot-bootloader
8. Install a stock RUU
* As alfchin said, if you want to flash RUUs with different CIDs, extract the zip, open android-info.txt, change CID, repack and flash with fastboot flash zip ...6What don't you understand? S-Off means security off, the standard way of acheiving S-Off is by switching off the security flag held on the radio partition. This is commonly known as Radio S-Off. There is also another type of S-Off called engeneering S-Off, this is acheived by flashing a special engeering bootloader (hboot) after you already have standard S-Off.
Now this is neither, This is a special modifed version of the standard HTC hboot by fardjab, this hboot tricks the device into thinking it is S-Off and allows end users to perform security protected actions. But unlike "real" S-Off this is not perm, flashing a stock HTC hboot or RUU will return you back to S-On status.
Sent from my HTC Sensation XL with Beats Audio X315e using Tapatalk 23
mmhh..sorry ieftm...but i have a similiar thinking...maybe you can clear this..
i had maked a donation thread...and some of us and also i maked a donation...but all response what i got from you guys was you kicked me from chat and say "read through the lines" this is not friendly....so maybe you can clear this situation...i also write emails and got no response...with kind regards...Alex
