Goal: S-off HOX (TEGRA3)

Thunder07 · Jan 22, 2013

TripNRaVeR said:
I have no clue, i'm trying for a while now to find them.

Mounting mmcblk0p5 as ext4 errors out, choosing yaffs or yaffs2 starts mounting it but fails with dev 187... some numbers here and then it stops

however, i've seen somewhere that someone mounted the recovery & boot as emmc... maybe thats the one? though i know that it isn't strickly a filesystem format... its seems to be working for them

An Acer device recovery.fstab

/boot emmc /dev/block/mmcblk0 bs=int count=int skip=int
/recovery emmc /dev/block/mmcblk0 bs=int count=int skip=int

MrT69 said:
Can you please add the full log with all partitions?
How did you get this informations? Is this a Tegra3 device & partition log? As far as I can see it is a Tegra 3 device!!!!!!
This is exacly what I'm searching for!!!!!!!!!!!!!!

How the hell you get this file???

Would be great if you can add this file as ZIP content. Thanks m8!

Xmoo actually removed the zip... probably because it's tracable.. so i don't think he'd appreciate me reuploading it,
just to remind you... that this is a REALLY OLD VERSION a debug at that so it might not be useful as you'd think,
but here it is, for the HTC One X ofc

TripNRaVeR · Jan 23, 2013

Note sure if you allready know,

The key(s) to set S-Off and some other settings can be found here:

Code:

/sys/firmware/fuse

Normally that dir is hidden but if you chmod it then the contents are visible. Almost everything can be read if you change permissions. Only the security key cannot be read.

Probably with a FUSE mount tool (fusermount) we can maybe read the contents. Also the other flags can be usefull i guess.

edit:
look for

Code:

/sys/firmware/fuse/secure_boot_key

edit 2:
fuse filesystems require the file

Code:

fuse.conf

add this to

Code:

/system/etc/fuse.conf

add the following into the file:

Code:

user_allow_other

edit 3:
to unmount

Code:

fusermount -u /sys/firmware/fuse

or

Code:

fusermount -z /sys/firmware/fuse

Both dont work because it -seems- that they are mounted with the "root" flag, i have no clue at this point how to remove it.

TripNRaVeR · Jan 23, 2013

Mr_S said:
View attachment 1669029

Sent from a dark place

Can you read secure_boot_key? I can read everything and change permissions except that file. Not able to get any write acces now.

edit:
with old hboot you can maybe try fastboot -c androidboot.mode=mfg boot boot.img, that brings you in manufactory mode

TripNRaVeR · Jan 23, 2013

Mr_S said:
Might need stock maybe with relocked bootloader?

Sent from a dark place

Try it setting engid=0x1 and maybe you also need to remove the identification as a SHIP build. My kernel is loaded as a ENG kernel.

I will build a 2.6.39.4 kernel only for purposes of getting s-off.
Meaning setting ENG as default, using HTC Engineering ID as identification, override boot mode as MFG etc etc.

Then we should have at least an correct enviroment to work on, when we use this road to S-OFF, i strongly believe there is a very easy way to gain S-Off. It is stored on mmcblk0.

Yesterday i enabled mmcblk1 card that worked correctly but there wasnt anything special on it.

I had;
- tegra-sdhci.0
- tegra-sdhci.2
- tegra-sdhci.3

All of them are stored on mmcblk0, strang thing tough, tegra-sdhci.1 is NOT found on mmcblk0, maybe there is the answer? I dont know, but i suggest this being investigated further. mmcblk0 and mmcblk1 can be enabled and accessed now. If people are interested i enable them and upload the kernel, it brakes audio tough because the device address is moved.

Thunder07 · Jan 23, 2013

TripNRaVeR said:
Try it setting engid=0x1 and maybe you also need to remove the identification as a SHIP build. My kernel is loaded as a ENG kernel.

I will build a 2.6.39.4 kernel only for purposes of getting s-off.
Meaning setting ENG as default, using HTC Engineering ID as identification, override boot mode as MFG etc etc.

Then we should have at least an correct enviroment to work on, when we use this road to S-OFF, i strongly believe there is a very easy way to gain S-Off. It is stored on mmcblk0.

Yesterday i enabled mmcblk1 card that worked correctly but there wasnt anything special on it.

I had;
- tegra-sdhci.0
- tegra-sdhci.2
- tegra-sdhci.3

All of them are stored on mmcblk0, strang thing tough, tegra-sdhci.1 is NOT found on mmcblk0, maybe there is the answer? I dont know, but i suggest this being investigated further. mmcblk0 and mmcblk1 can be enabled and accessed now. If people are interested i enable them and upload the kernel, it brakes audio tough because the device address is moved.

ya that would be great... the massive disadvantage is that we have practically no access to any of the partitions such we're limited to what we can do... but once we have access... s-off will be much easier, hopefully.
when you can you do post it here or PM me anyway

also... how hard is it for you to create a similar kernel for HOX+??
in all honestly, it doesnt even have to boot.. it just need to give us the same lvl of access through adb... do our thing and reboot into a normally working kernel... but that's for later

however, the next step is finding a n exploit which everyone can use to avoid using htcdev all together

Ill Be Expecting You

TripNRaVeR · Jan 23, 2013

When i use mmcblk0boot0 and ..boot1 i have rw acces, can set ro and force_ro to 0.

Would there be any possibillity to flash/update stuff at that moment? Can i mount that **** in recovery, then remove ro/force_ro and write to the partitions?

Asus tablets use that method to write the unlocked bootloader/boot.img from recovery.

Another thing, when i mount the MISC partition correctly, with the proper filesystem, the phone keeps rebooting after init lol. Is this the hboot protection? If that is the case then i can skip that method and hack fuse.

Oh ps. for those wanting to run MFG mode, you need a mfg ramdisk. You can find it in RUU released in feb 2012 (quick guess), the one with hboot0.96.

Thunder07 · Jan 23, 2013

TripNRaVeR said:
When i use mmcblk0boot0 and ..boot1 i have rw acces, can set ro and force_ro to 0.

Would there be any possibillity to flash/update stuff at that moment? Can i mount that **** in recovery, then remove ro/force_ro and write to the partitions?

Asus tablets use that method to write the unlocked bootloader/boot.img from recovery.

Another thing, when i mount the MISC partition correctly, with the proper filesystem, the phone keeps rebooting after init lol. Is this the hboot protection? If that is the case then i can skip that method and hack fuse.

Oh ps. for those wanting to run MFG mode, you need a mfg ramdisk. You can find it in RUU released in feb 2012 (quick guess), the one with hboot0.96.

this is what i was hoping for... though i thought up of an even safer way...
though it's may require few extra steps....

you need to access the MISC partition,
look for mainver, hboot ver and cid ( they should be in MISC)
change mainver/hboot to something like 0.01 and cid to superCID (not sure if there is a variable for hboot version, the check might be done directly from the hboot)
then lock bootloader and flash ENG 0.03 hboot
s-off and flash a newer hboot

but are you really asking us... you're the one with access to them, not us

Lloir · Jan 23, 2013

Seriously guys.............KEEP ON TOPIC!!! thread cleaned! YET AGAIN, i'm quite easy going,

READ THIS

this point on-wards infractions are a huge possibility

O_G · Jan 23, 2013

MOD Notice

Please people, lets keep this thread on topic. Show some respect to the OPs wishes. He might not be able to hand out infractions, but i can. No more OT.

Drefsab · Jan 23, 2013

I know I will probably get a warning for posting this but you guys might want to message trip to advise if you guys meant him at all because he has posted:

Noeri ... ‏@TripNRaVeR

no more s-off development for me, not going to risk warnings when trying to discuss gaining s-off, the policy there is to risky for me

@TreeBoommm i didnt get warned, but 1 or 2 posts of me where removed to, and when i get a warning i'm banned, so i'm just quiting to be safe

I've replied with:

@TripNRaVeR think their comments were more aimed at people like me who while trying to be helpful may not be contributing any code or such.

Id hate to see the only promising development towards S-OFF in a long time to die because the dev is scared of getting banned because users might reply to him (like my offer to help with the custom made kernel for older hboots like mine).

O_G · Jan 23, 2013

Drefsab said:
I know I will probably get a warning for posting this but you guys might want to message trip to advise if you guys meant him at all because he has posted:

Noeri ... ‏@TripNRaVeR

no more s-off development for me, not going to risk warnings when trying to discuss gaining s-off, the policy there is to risky for me

@TreeBoommm i didnt get warned, but 1 or 2 posts of me where removed to, and when i get a warning i'm banned, so i'm just quiting to be safe

I've replied with:

@TripNRaVeR think their comments were more aimed at people like me who while trying to be helpful may not be contributing any code or such.

Id hate to see the only promising development towards S-OFF in a long time to die because the dev is scared of getting banned because users might reply to him (like my offer to help with the custom made kernel for older hboots like mine).

Nobody is going to get banned if they stay on topic and follow the rules. The warning i posted was a general one, not aimed at a individual user. Any user is free to post in this thread if they are contributing to the discussion. Its when it goes off topic is when we have the problem. I have no intention of preventing a user from posting here, if they feel their post has been deleted wrongly, please contact a member of the moderation team for action. We will look into it.

Now for your post. I was very clear that i wanted this to continue on topic, so why post this here? A PM to myself or a member of the moderation team would of cleared this up. The only reason i am going to leave it at that is i understand you are concerned about the development of this thread, i hope i have cleared that up now. So please, on topic only!

MrT69 · Jan 23, 2013

Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

TripNRaVeR said:
Note sure if you allready know,

The key(s) to set S-Off and some other settings can be found here:

Code:

/sys/firmware/fuse

Normally that dir is hidden but if you chmod it then the contents are visible. Almost everything can be read if you change permissions. Only the security key cannot be read.

Probably with a FUSE mount tool (fusermount) we can maybe read the contents. Also the other flags can be usefull i guess.

edit:
look for

Code:

/sys/firmware/fuse/secure_boot_key

edit 2:
fuse filesystems require the file

Code:

fuse.conf

add this to

Code:

/system/etc/fuse.conf

add the following into the file:

Code:

user_allow_other

edit 3:
to unmount

Code:

fusermount -u /sys/firmware/fuse

or

Code:

fusermount -z /sys/firmware/fuse

Both dont work because it -seems- that they are mounted with the "root" flag, i have no clue at this point how to remove it.

I don't know if this will help but this Problem remember me to an problem I have had years ago as I have build a custom Rom for Desire HD.
My ROM Bootes but with lot of errors. This was the reason why I have rebuild a boot.img where I set every security to root with full r/w permissions for everything. Also the system permissions I set to root with full r/w (0777) to everything.
I would not recommend this for daily usage but for access some files which are normaly not accessable this might work.

The Phone was starting without Problems. But it was DesireHD and it was long time ago.

Sent from my EndeavorU using xda app-developers app

TripNRaVeR · Jan 23, 2013

MrT69 said:
I don't know if this will help but this Problem remember me to an problem I have had years ago as I have build a custom Rom for Desire HD.
My ROM Bootes but with lot of errors. This was the reason why I have rebuild a boot.img where I set every security to root with full r/w permissions for everything. Also the system permissions I set to root with full r/w (0777) to everything.
I would not recommend this for daily usage but for access some files which are normaly not accessable this might work.

The Phone was starting without Problems. But it was DesireHD and it was long time ago.

Sent from my EndeavorU using xda app-developers app

I tried setting everything rw, still the secure key cannot be read, therefore it is something interesting. Problem that it must be readable at boot and not at running system. We really need an extended recovery to get more access

Thunder07 · Jan 23, 2013

Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

TripNRaVeR said:
I tried setting everything rw, still the secure key cannot be read, therefore it is something interesting. Problem that it must be readable at boot and not at running system. We really need an extended recovery to get more access

Secure key is something interesting...
It's referred to as sbk in Asus transformer,
Without it apx=useless
Like I was in connect with someone with apx not more than a month ago (as pm'ed you about it) and had to find out about it the hard way (you know I was excited I found a apx but couldn't do anything with it), I was also connected to his pc remotely so I knew it was genuine.

Sent from my EndeavorU

Mr_S · Jan 23, 2013

Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

http://xdaforums.com/showthread.php?p=36134906

Something like this

Sent from a dark place

nitrous² · Jan 23, 2013

AW: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

TripNRaVeR said:
I tried setting everything rw, still the secure key cannot be read, therefore it is something interesting. Problem that it must be readable at boot and not at running system. We really need an extended recovery to get more access

Couldn't this be done via UART? This should allow you to debug the boot process. Samsung devices got their bootloaders hacked this way.

Thank people as long as you can...

MrT69 · Jan 23, 2013

Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

thunder07 said:
Secure key is something interesting...
It's referred to as sbk in Asus transformer,
Without it apx=useless
Like I was in connect with someone with apx not more than a month ago (as pm'ed you about it) and had to find out about it the hard way (you know I was excited I found a apx but couldn't do anything with it), I was also connected to his pc remotely so I knew it was genuine.

Sent from my EndeavorU

Intersting.
At the moment I'm waiting for some informations and I plan to force my HOX to run into APX Mode by killing the hboot Partition. I cross my fingers that this will help to run into APX

Do you know more about the APX Mode?
BTW - i know that it is possible to read the key within APX MODE. OK, better to say it should be possible

Sent from my EndeavorU using xda app-developers app

Thunder07 · Jan 23, 2013

Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

nitrous² said:
Couldn't this be done via UART? This should allow you to debug the boot process. Samsung devices got their bootloaders hacked this way.

Thank people as long as you can...

We don't uave access to UART,
Also this would make kernel debugs so much easier.....(or so I hear) But as I said we don't have/have access to it

MrT69 said:
Intersting.
At the moment I'm waiting for some informations and I plan to force my HOX to run into APX Mode by killing the hboot Partition. I cross my fingers that this will help to run into APX

Do you know more about the APX Mode?

Sent from my EndeavorU using xda app-developers app

Just that you'll be stuck in it forever without the ability to run a single cmd if you don't find your sbk,
Note it might be the same or it might be different, for each phone, if it's different the chances are no one but HTC will ever be able to fix your phone,
So I wouldn't risk it just yet.

Also if by killing you mean dd /dev/null
Well show-p tried that on mmcblk0,
He ended up with a green screen asking for rom.zip,
Which means the hboot wasn't touched...
However, you might have more luck doing that with trips planned development kernel, still too risky at this stage.

Sent from my EndeavorU

TripNRaVeR · Jan 24, 2013

I have gained access to some neat tools!

The tool is also able to boot into diag58, currently i'm running it userspace and can freely set everything i want. I tried entering diag58 but it was waiting on modem. Going to try to read the secure key, it has basicly acces to everything.

MrT69 · Jan 24, 2013

Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

Found this:

http://a500bootloaderflash.tk/sbkcalc/

May be lcd047 could help at this point also for the HOX.

Sent from my EndeavorU using xda app-developers app

Goal: S-off HOX (TEGRA3)

Inactive RC / RD

Senior Member

Senior Member

Senior Member

Inactive RC / RD

Senior Member

Inactive RC / RD

Inactive Recognized Developer

Retired Senior Moderator / Retired ET Admin

Senior Member

Retired Senior Moderator / Retired ET Admin

Senior Member

Senior Member

Inactive RC / RD

Senior Member

Senior Member

Senior Member

Inactive RC / RD

Senior Member

Senior Member

Similar threads

Top Liked Posts