[S-OFF]Development

Status
Not open for further replies.
Search This thread
By:
Advanced…
riemervdzee

riemervdzee

Retired Recognized Developer
May 27, 2010
593
292
Dokkum
@EVE, Hmm ****, finally been reading the last messages. Just had the hope we could get something going, then we end up with posts like these :-/
Should have said it then, but screw the bounty. Never liked donations to be honnest..

If you are still there (or any other), got any pointers on serial connections with the phone? I think I'm going to attempt to get one via headjack. Any papers/topics etc. on how others did it is quite welcome.

Edit: My biggest question is, should we try a 4 contact jack-plug? I would say we only need tx, rx and ground. I tried a 3 contact plug just very quickly the other day with an oscillator, but I couldn't get any signal back.
 
Last edited:
S

smoke2

Senior Member
Apr 6, 2011
177
2
Did you updated your firmware to version 1.29.401.11 with new h-boot 0.95?
I still not because is there a bigger chance to do s-off on h-boot version 0.94?
Am I right?
 
B

BeciMester

Senior Member
Jul 22, 2010
181
186
Dublin
Just one more week and my final exams are over. I'm following this thread since day one and can't wait to finally contribute something. :)

I'll do a detailed comparison of the old and new hboots if nobody does it until then. I think the only reason for HTC to update the hboot is to fix something, hopefully some vulnerability they've found and we haven't (yet!). It'll be interesting to see. Also the code Evil-Dragon posted about entering nvflash mode is worth an investigation.

And for the record: I'm completely against the idea of a bounty. It's not what XDA should be about. If we keep paying people for discovering things we'll just end up with another XTC-clip with a greedy wanker behind it. :rolleyes: I think E:V:A is right and I'm sad to see him go.

You know the tale of the wise man who was asked why money corrupts people. He said 'Look out the window, what do you see?' The asker said 'The street. People. A mother with her baby. An old man on the bench.' The wise man then said 'Look into the mirror, what do you see now?' The asker said 'I see myself.' The wise man then said 'See, both are the same sheet of glass. All it takes is a thin layer of silver and you instantly can't see anything but yourself.'
 
  • Like
Reactions: sibbor, Htc_One_X, mickfitz and 4 others
kfasheldon

kfasheldon

Senior Member
Jun 17, 2010
1,093
273
Birmingham
Hi, no idea if this HP's but looks like a promising development to me.

Noticed sensation xl (runnymede) just got s-off solution , someone has patched bootloader and succeeded in bypassing s-on and cid checks so all stock and custom roms should work , all parts can be flashed , maybe he has ideas that would work here




Sent from my HTC One X using xda premium
 
C

Chezbel

Senior Member
Jan 16, 2011
1,980
1,668
Taipei
I'm not really familiar with ARM Assembly language, but I tired to add a few comments to Evil-Dragon's code, which I marked with
; ***

Code: 
sub_ROM_25AF8
sub_ROM_25AF8      ; =============== S U B R O U T I N E =======================================
sub_ROM_25AF8
sub_ROM_25AF8
sub_ROM_25AF8      sub_ROM_25AF8                           ; CODE XREF: sub_ROM_16BB4+26
sub_ROM_25AF8
sub_ROM_25AF8      var_3C          = -0x3C
sub_ROM_25AF8      var_28          = -0x28
sub_ROM_25AF8      var_20          = -0x20
sub_ROM_25AF8      var_1C          = -0x1C
sub_ROM_25AF8
sub_ROM_25AF8      PUSH.W  {R4-R8,LR}
sub_ROM_25AF8+4    LDR     R4, =(unk_ROM_1D30B4 - 0x25B06) ; *** R4 = 0x1AD5AE
sub_ROM_25AF8+6    LDR     R1, =0xFFFFFA5C
sub_ROM_25AF8+8    SUB     SP, SP, #0x28
sub_ROM_25AF8+A    ADD     R4, PC                ; *** This is ROM location 0x25B02
                                                 ; *** so I think PC is 0x25B04 now
                                                 ; *** so R4 = 0x1AD5AE + 0x25B04 = 0x1D30B2
sub_ROM_25AF8+C    MOVS    R0, #0
sub_ROM_25AF8+E    ADD     R2, SP, #0x40+var_20
sub_ROM_25AF8+10   STR     R0, [SP,#0x40+var_1C] ; *** Init [SP,#0x40+var_1C] to 0
sub_ROM_25AF8+12   STR     R0, [SP,#0x40+var_20]
sub_ROM_25AF8+14   LDR     R0, [R4,R1]
sub_ROM_25AF8+16   ADD     R1, SP, #0x40+var_1C
sub_ROM_25AF8+18   BL      loc_ROM_290AC         ; *** This must potentially change [SP,#0x40+var_1C]
                                                 ; *** It must also set R0, which is used at loc_ROM_25B38
                                                 ; *** to decide if we branch to loc_ROM_25B4E.
sub_ROM_25AF8+1C   LDR     R3, [SP,#0x40+var_1C]
sub_ROM_25AF8+1E   MOV     R5, R0
sub_ROM_25AF8+20   CBNZ    R3, loc_ROM_25B38     ; *** Branch if [SP,#0x40+var_1C] != 0
sub_ROM_25AF8+22   LDR     R2, =0xFFFFFA70
sub_ROM_25AF8+24   LDR     R7, [R4,R2]           ; *** R4 + R2 = 0x1D30B2 + 0xFFFFFA70 = 0x1001D2B22 = 0x1D2B22
                                                 ; *** (assumes I used the correct value for PC at sub_ROM_25AF8+A)
                                                 ; *** R7 = [0x1D2B22]
sub_ROM_25AF8+26   LDR     R6, [R7]
sub_ROM_25AF8+28   CBNZ    R6, loc_ROM_25B38
sub_ROM_25AF8+2A   MOV     R0, R6
sub_ROM_25AF8+2C   BL      sub_ROM_2740C
sub_ROM_25AF8+30   MOV     R0, R7
sub_ROM_25AF8+32   MOV     R1, R6
sub_ROM_25AF8+34   MOV     R2, R6
sub_ROM_25AF8+36   BL      sub_ROM_339C8         ; *** This routine must set R0, which determines if
                                                 ; *** we will branch to loc_ROM_25B4E
sub_ROM_25AF8+3A   MOV     R5, R0
sub_ROM_25AF8+3C   CBZ     R0, loc_ROM_25B4E
sub_ROM_25AF8+3E   B       loc_ROM_25C3E
sub_ROM_25AF8+40   ; ---------------------------------------------------------------------------
sub_ROM_25AF8+40
sub_ROM_25AF8+40   loc_ROM_25B38                           ; CODE XREF: sub_ROM_25AF8+20
sub_ROM_25AF8+40                                           ; sub_ROM_25AF8+28
sub_ROM_25AF8+40                   CMP     R5, #1
sub_ROM_25AF8+42                   BNE     loc_ROM_25B4E
sub_ROM_25AF8+44                   LDR     R0, =0x989680
sub_ROM_25AF8+46                   BLX     loc_ROM_96E90
sub_ROM_25AF8+4A                   LDR     R0, =(aLoadOsNowViaJt - 0x25B48)
sub_ROM_25AF8+4C                   ADD     R0, PC          ; "Load OS now via JTAG backdoor....\r\n"
sub_ROM_25AF8+4E                   BLX     loc_ROM_97CB4
sub_ROM_25AF8+52                   BL      nullsub_1
sub_ROM_25AF8+56
sub_ROM_25AF8+56   loc_ROM_25B4E                           ; CODE XREF: sub_ROM_25AF8+3C
sub_ROM_25AF8+56                                           ; sub_ROM_25AF8+42
sub_ROM_25AF8+56                   LDR     R0, =(aPlatformPreBoo - 0x25B54)
sub_ROM_25AF8+58                   ADD     R0, PC          ; "Platform Pre Boot configuration...\n"
sub_ROM_25AF8+5A                   BL      sub_ROM_25F40
sub_ROM_25AF8+5E                   MOVS    R0, #0
sub_ROM_25AF8+60                   BLX     sub_ROM_9112C
sub_ROM_25AF8+64                   CMP     R0, #0
sub_ROM_25AF8+66                   BEQ     loc_ROM_25C3E
sub_ROM_25AF8+68                   LDR.W   R12, =0x1F3CBA
sub_ROM_25AF8+6C                   LDR     R1, [SP,#0x40+var_20]
sub_ROM_25AF8+6E                   ADD     R12, PC
sub_ROM_25AF8+70                   LDR     R3, [SP,#0x40+var_1C]
sub_ROM_25AF8+72                   STR.W   R1, [R12]
sub_ROM_25AF8+76                   CBZ     R3, loc_ROM_25B8E
sub_ROM_25AF8+78                   LDR     R0, =(aEnteringNvflas - 0x25B76)
sub_ROM_25AF8+7A                   ADD     R0, PC          ; "Entering NvFlash recovery mode / Nv3p S"...
sub_ROM_25AF8+7C                   BL      sub_ROM_25F40
sub_ROM_25AF8+80                   MOVS    R0, #1
sub_ROM_25AF8+82                   BL      sub_ROM_2740C
sub_ROM_25AF8+86                   LDR     R0, =0xFFFFFA5C
sub_ROM_25AF8+88                   LDR     R5, [R4,R0]
sub_ROM_25AF8+8A                   LDR     R0, [R5]
sub_ROM_25AF8+8C                   BL      sub_ROM_29400
sub_ROM_25AF8+90                   MOV     R5, R0
sub_ROM_25AF8+92                   CMP     R0, #0
sub_ROM_25AF8+94                   BNE     loc_ROM_25C3E
sub_ROM_25AF8+96
sub_ROM_25AF8+96   loc_ROM_25B8E                           ; CODE XREF: sub_ROM_25AF8+76
sub_ROM_25AF8+96                   LDR     R2, =0x1F3C90
sub_ROM_25AF8+98                   ADD     R2, PC
sub_ROM_25AF8+9A                   LDR     R2, [R2]
sub_ROM_25AF8+9C                   CMP     R2, #0x12
sub_ROM_25AF8+9E                   BNE     loc_ROM_25BAC
sub_ROM_25AF8+A0                   LDR.W   LR, =0xFFFFFA5C
sub_ROM_25AF8+A4                   LDR.W   R3, [R4,LR]
sub_ROM_25AF8+A8                   LDR     R0, [R3]
sub_ROM_25AF8+AA                   BL      sub_ROM_2A638
sub_ROM_25AF8+AE                   MOV     R5, R0
sub_ROM_25AF8+B0                   CMP     R0, #0
sub_ROM_25AF8+B2                   BNE     loc_ROM_25C3E
sub_ROM_25AF8+B4
sub_ROM_25AF8+B4   loc_ROM_25BAC                           ; CODE XREF: sub_ROM_25AF8+9E
sub_ROM_25AF8+B4                   BLX     sub_ROM_9111C
sub_ROM_25AF8+B8                   LDR.W   R12, =(loc_ROM_1D24D0 - 0x25BBA)
sub_ROM_25AF8+BC                   ADD     R7, SP, #0x40+var_3C
sub_ROM_25AF8+BE                   ADD     R12, PC
sub_ROM_25AF8+C0                   MOV     R6, R0
sub_ROM_25AF8+C2                   LDMIA.W R12!, {R0-R3}
sub_ROM_25AF8+C6                   STMIA   R7!, {R0-R3}
sub_ROM_25AF8+C8                   LDR.W   R1, [R12]
sub_ROM_25AF8+CC                   STR     R1, [R7]
sub_ROM_25AF8+CE                   CBNZ    R6, loc_ROM_25BD2
sub_ROM_25AF8+D0                   LDR     R3, =0x1F3B0C
sub_ROM_25AF8+D2                   LDR     R2, =(unk_ROM_1D9118 - 0x25BD2)
sub_ROM_25AF8+D4                   ADD     R3, PC
sub_ROM_25AF8+D6                   ADD     R2, PC
sub_ROM_25AF8+D8                   B       loc_ROM_25C26
sub_ROM_25AF8+DA   ; ---------------------------------------------------------------------------
sub_ROM_25AF8+DA
sub_ROM_25AF8+DA   loc_ROM_25BD2                           ; CODE XREF: sub_ROM_25AF8+CE
sub_ROM_25AF8+DA                   LDR     R7, =(unk_ROM_1D9134 - 0x25BDC)
sub_ROM_25AF8+DC                   MOV     R0, R6
sub_ROM_25AF8+DE                   MOVS    R2, #4
sub_ROM_25AF8+E0                   ADD     R7, PC
sub_ROM_25AF8+E2                   LDR     R1, [R7]
sub_ROM_25AF8+E4                   BLX     loc_ROM_96B7C
sub_ROM_25AF8+E8                   CBZ     R0, loc_ROM_25BE6
sub_ROM_25AF8+EA                   MOV     R8, SP
sub_ROM_25AF8+EC                   B       loc_ROM_25C16
sub_ROM_25AF8+EE   ; ---------------------------------------------------------------------------
sub_ROM_25AF8+EE
sub_ROM_25AF8+EE   loc_ROM_25BE6                           ; CODE XREF: sub_ROM_25AF8+E8
sub_ROM_25AF8+EE                   MOVW    R0, #0xC06
sub_ROM_25AF8+F2                   ADD     R1, SP, #0x40+var_28
sub_ROM_25AF8+F4                   BLX     loc_ROM_91608
sub_ROM_25AF8+F8                   CBZ     R0, loc_ROM_25BFC
sub_ROM_25AF8+FA                   LDR     R3, =0x1F3AE2
sub_ROM_25AF8+FC                   LDR     R2, =(unk_ROM_1D9124 - 0x25BFC)
sub_ROM_25AF8+FE                   ADD     R3, PC
sub_ROM_25AF8+100                  ADD     R2, PC
sub_ROM_25AF8+102                  B       loc_ROM_25C26
sub_ROM_25AF8+104  ; ---------------------------------------------------------------------------
sub_ROM_25AF8+104
sub_ROM_25AF8+104  loc_ROM_25BFC                           ; CODE XREF: sub_ROM_25AF8+F8
sub_ROM_25AF8+104                  LDR     R3, =0x1F3ADA
sub_ROM_25AF8+106                  ADD     R3, PC
sub_ROM_25AF8+108                  B       loc_ROM_25C12
sub_ROM_25AF8+10A  ; ---------------------------------------------------------------------------
sub_ROM_25AF8+10A
sub_ROM_25AF8+10A  loc_ROM_25C02                           ; CODE XREF: sub_ROM_25AF8+124
sub_ROM_25AF8+10A                  MOV     R0, R6
sub_ROM_25AF8+10C                  LDR     R1, [R7]
sub_ROM_25AF8+10E                  MOVS    R2, #4
sub_ROM_25AF8+110                  BLX     loc_ROM_96B7C
sub_ROM_25AF8+114                  CBNZ    R0, loc_ROM_25C16
sub_ROM_25AF8+116                  LDR     R3, =0x1F3AC8
sub_ROM_25AF8+118                  ADD     R3, PC
sub_ROM_25AF8+11A
sub_ROM_25AF8+11A  loc_ROM_25C12                           ; CODE XREF: sub_ROM_25AF8+108
sub_ROM_25AF8+11A                  STR     R7, [R3]
sub_ROM_25AF8+11C                  B       loc_ROM_25C28
sub_ROM_25AF8+11E  ; ---------------------------------------------------------------------------
sub_ROM_25AF8+11E
sub_ROM_25AF8+11E  loc_ROM_25C16                           ; CODE XREF: sub_ROM_25AF8+EC
sub_ROM_25AF8+11E                                          ; sub_ROM_25AF8+114
sub_ROM_25AF8+11E                  LDR.W   R7, [R8,#4]!
sub_ROM_25AF8+122                  CMP     R7, #0
sub_ROM_25AF8+124                  BNE     loc_ROM_25C02
sub_ROM_25AF8+126                  LDR     R3, =0x1F3AB6
sub_ROM_25AF8+128                  LDR     R2, =(unk_ROM_1D9118 - 0x25C28)
sub_ROM_25AF8+12A                  ADD     R3, PC
sub_ROM_25AF8+12C                  ADD     R2, PC
sub_ROM_25AF8+12E
sub_ROM_25AF8+12E  loc_ROM_25C26                           ; CODE XREF: sub_ROM_25AF8+D8
sub_ROM_25AF8+12E                                          ; sub_ROM_25AF8+102
sub_ROM_25AF8+12E                  STR     R2, [R3]
sub_ROM_25AF8+130
sub_ROM_25AF8+130  loc_ROM_25C28                           ; CODE XREF: sub_ROM_25AF8+11C
sub_ROM_25AF8+130                  LDR     R2, =0xFFFFFADC
sub_ROM_25AF8+132                  MOVS    R1, #0
sub_ROM_25AF8+134                  LDR.W   LR, =0xFFFFF9F0
sub_ROM_25AF8+138                  LDR     R3, =0xFFFFFAE0
sub_ROM_25AF8+13A                  LDR     R0, [R4,R2]
sub_ROM_25AF8+13C                  LDR.W   R2, [R4,LR]
sub_ROM_25AF8+140                  LDR     R3, [R4,R3]
sub_ROM_25AF8+142                  BL      sub_ROM_27CFC
sub_ROM_25AF8+146
sub_ROM_25AF8+146  loc_ROM_25C3E                           ; CODE XREF: sub_ROM_25AF8+3E
sub_ROM_25AF8+146                                          ; sub_ROM_25AF8+66 ...
sub_ROM_25AF8+146                  MOV     R0, R5
sub_ROM_25AF8+148                  ADD     SP, SP, #0x28
sub_ROM_25AF8+14A                  POP.W   {R4-R8,PC}
sub_ROM_25AF8+14A  ; End of function sub_ROM_25AF8
sub_ROM_25AF8+14A
sub_ROM_25AF8+14A  ; ---------------------------------------------------------------------------
ROM:00025C46                 DCB    0
ROM:00025C47                 DCB 0xBF ; +
ROM:00025C48 dword_ROM_25C48 DCD 0x989680            ; DATA XREF: sub_ROM_25AF8+44
ROM:00025C4C off_ROM_25C4C   DCD unk_ROM_1D30B4 - 0x25B06 ; DATA XREF: sub_ROM_25AF8+4
ROM:00025C50 dword_ROM_25C50 DCD 0xFFFFFA5C          ; DATA XREF: sub_ROM_25AF8+6
ROM:00025C50                                         ; sub_ROM_25AF8+86 ...
ROM:00025C54 dword_ROM_25C54 DCD 0xFFFFFA70          ; DATA XREF: sub_ROM_25AF8+22
ROM:00025C58 off_ROM_25C58   DCD aLoadOsNowViaJt - 0x25B48 ; DATA XREF: sub_ROM_25AF8+4A
ROM:00025C58                                         ; "Load OS now via JTAG backdoor....\r\n"
ROM:00025C5C off_ROM_25C5C   DCD aPlatformPreBoo - 0x25B54
ROM:00025C5C                                         ; DATA XREF: sub_ROM_25AF8:loc_ROM_25B4E
ROM:00025C5C                                         ; "Platform Pre Boot configuration...\n"
ROM:00025C60 off_ROM_25C60   DCD 0x1F3CBA            ; DATA XREF: sub_ROM_25AF8+68
ROM:00025C64 off_ROM_25C64   DCD aEnteringNvflas - 0x25B76 ; DATA XREF: sub_ROM_25AF8+78
ROM:00025C64                                         ; "Entering NvFlash recovery mode / Nv3p S"...
ROM:00025C68 off_ROM_25C68   DCD 0x1F3C90            ; DATA XREF: sub_ROM_25AF8:loc_ROM_25B8E
ROM:00025C6C off_ROM_25C6C   DCD loc_ROM_1D24D0 - 0x25BBA ; DATA XREF: sub_ROM_25AF8+B8
ROM:00025C70 off_ROM_25C70   DCD 0x1F3B0C            ; DATA XREF: sub_ROM_25AF8+D0
ROM:00025C74 off_ROM_25C74   DCD unk_ROM_1D9118 - 0x25BD2 ; DATA XREF: sub_ROM_25AF8+D2
ROM:00025C78 off_ROM_25C78   DCD unk_ROM_1D9134 - 0x25BDC
ROM:00025C78                                         ; DATA XREF: sub_ROM_25AF8:loc_ROM_25BD2
ROM:00025C7C off_ROM_25C7C   DCD 0x1F3AE2            ; DATA XREF: sub_ROM_25AF8+FA
ROM:00025C80 off_ROM_25C80   DCD unk_ROM_1D9124 - 0x25BFC ; DATA XREF: sub_ROM_25AF8+FC
ROM:00025C84 off_ROM_25C84   DCD 0x1F3ADA            ; DATA XREF: sub_ROM_25AF8:loc_ROM_25BFC
ROM:00025C88 off_ROM_25C88   DCD 0x1F3AC8            ; DATA XREF: sub_ROM_25AF8+116
ROM:00025C8C off_ROM_25C8C   DCD 0x1F3AB6            ; DATA XREF: sub_ROM_25AF8+126
ROM:00025C90 off_ROM_25C90   DCD unk_ROM_1D9118 - 0x25C28 ; DATA XREF: sub_ROM_25AF8+128
ROM:00025C94 dword_ROM_25C94 DCD 0xFFFFFADC          ; DATA XREF: sub_ROM_25AF8:loc_ROM_25C28
ROM:00025C98 dword_ROM_25C98 DCD 0xFFFFF9F0          ; DATA XREF: sub_ROM_25AF8+134
ROM:00025C9C dword_ROM_25C9C DCD 0xFFFFFAE0          ; DATA XREF: sub_ROM_25AF8+138

Also, there must be some tools available that would make it a lot easier to disassemble hboot. For example, I found this page. The demo video is interesting. Perhaps to use something like this it's necessary to have an ARM development kit of some sort...

http://www.hexblog.com/?p=124
 
  • Like
Reactions: techmatlock, Istvan_86, Evil-Dragon and 1 other person
pdagenius

pdagenius

Senior Member
Nov 4, 2006
551
34
kfasheldon said:
Hi, no idea if this HP's but looks like a promising development to me.

Noticed sensation xl (runnymede) just got s-off solution , someone has patched bootloader and succeeded in bypassing s-on and cid checks so all stock and custom roms should work , all parts can be flashed , maybe he has ideas that would work here




Sent from my HTC One X using xda premium
Click to expand...
Click to collapse

Maybe someone from this thread who has been looking at our hboot could pm the Sensation XL chap for some help?

Sent from my Galaxy Tab 10.1 with Tapatalk
 
riemervdzee

riemervdzee

Retired Recognized Developer
May 27, 2010
593
292
Dokkum
Anyhoowz...., I think I'm going to try a serial connection tomorrow at university. Maybe something interesting pops up, first thought is still the jack. But maybe it is also obtainable via pogo? Anyone know the internal serial names for pogo and/or jack used in the kernel?

Cheers, R
 
Last edited by a moderator:
  • Like
Reactions: tommmtom
Sentinel196

Sentinel196

Senior Member
Mar 24, 2010
3,228
3,795
Back on topic, it was mentioned a week or so ago that Cotulla (from DFT, the guys who cracked the HD2) are onboard and helping out. Any news from them in the IRC channels?
 
Last edited by a moderator:
  • Like
Reactions: Willieumm
Sybregunne

Sybregunne

Senior Member
Jan 24, 2011
983
1,128
Currently in Singapore
Anybody with a rooted phone willing to try something else?

open up /etc/permissions
then look for the file platform.xml

add the following line:

<assign-permission name="android.permission.DIAGNOSTIC" uid="shell" />

theoretically this should give adb diagnostic permissions. :D

try to dd to hboot if you dare. :D
 
M

mattman83

Senior Member
Jan 19, 2011
2,982
1,104
Brisbane
Sybregunne said:
Anybody with a rooted phone willing to try something else?

open up /etc/permissions
then look for the file platform.xml

add the following line:

<assign-permission name="android.permission.DIAGNOSTIC" uid="shell" />

theoretically this should give adb diagnostic permissions. :D

try to dd to hboot if you dare. :D
Click to expand...
Click to collapse

DD is just a dump, correct? If you can give me an exact command I'm happy to.

M.
 
T

tids2k

Senior Member
Apr 21, 2009
2,740
955
Sydney
Google Pixel 6 Pro
riemervdzee said:
Anyhoowz...., I think I'm going to try a serial connection tomorrow at university. Maybe something interesting pops up, first thought is still the jack. But maybe it is also obtainable via pogo? Anyone know the internal serial names for pogo and/or jack used in the kernel?

Cheers, R
Click to expand...
Click to collapse

what do u mean by internal names are u referring to the resistors or Pins ?
 
M

mattman83

Senior Member
Jan 19, 2011
2,982
1,104
Brisbane
co@ch said:
dd what to hboot? A dump of a S-OFF hboot? :confused:
Click to expand...
Click to collapse

An S-OFF HBOOT is no different to an S-ON HBOOT. You want whatever partition contains the S-OFF flag ;) Or as done on Desire, a modified HBOOT that ignores the flag.

M.

Edit - change made in permissions... someone give me an adb line to test. Not familar with DD (something harmless would be even better :p)
 
Last edited:
Status
Not open for further replies.

Similar threads

tbalden
[ROM][official] HTC OneX CyanogenMod 10.1 (4.2) release
Replies
16K
Views
3M
IllUMINATUz
IllUMINATUz
mike1986.
[ROM] Android Revolution HD 33.1 | High Quality & Performance | Sense 5 | 4.18.401.3
Replies
50K
Views
9M
C
cmaz
m0narx
[ROM][05.06] Team Venom presents: ViperX 4.1.1 - welcome to the future
Replies
26K
Views
4M
izzulhafiz
izzulhafiz
L
Goal: S-off HOX (TEGRA3)
Replies
359
Views
306K
D
Douglas Longfellow
T
[ROM][official] HTC One X CyanogenMod 11.0 nightlies + M-releases
Replies
4K
Views
816K
Petert87
Petert87

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 141
    xmoo
    xmoo
    Read post #2 before posting!!

    So Football and me are busy with trying to get S-OFF for this Badboy, but it seems to be a hard job. Please be patient!
    Code: 
    /*
 * Your warranty is now void.
 *
 * We are not responsible for bricked devices, dead SD cards,
 * thermonuclear war, or you getting fired because the alarm app failed. Please
 * do some research if you have any concerns about content included in this thread
 * read before doing anything! YOU are choosing to make these modifications, and if
 * you point the finger at me for messing up your device, We will laugh at you.
 *
 */


    13-04-2012 XDA.CN releases pictures showing someone succesfully has S-OFF'd his device. Tool is for sale here: http://item.taobao.com/item.htm?id=10824156715
    17-04-2012 Thread made.
    17-04-2012 We have found someone with a S-OFF device, and a newer HBOOT than the one from XDA.CN. Trying to get access to the HBOOT.
    18-04-2012 OTA 1.28 brings HBOOT 0.94.
    18-04-2012 New member with a S-OFF device is willing to help.
    s-off-hboot_HOX.JPG

    19-04-2012 HBOOT 0.43 S-OFF rfs.img received and uploaded.
    19-04-2012 RFS.img is not the correct file, searching continues...
    19-04-2012 Radio located, click here
    26-04-2012 HBOOT probably located here
    15-05-2012 NVFlash app + APX Drivers added
    12-06-2012 Tegra 3 Manual added, see here!
    16-06-2012 HBOOT 1.11 from the test-keys uploaded here!
    16-06-2012 Huge development, read more about it!
    18-06-2012 Need to find a way to by-pass CID check.
    19-06-2012 Football Partition list for One X with all addresses and lengths of partitions which can be found here.
    27-06-2012 Huhge thread clean-up and update.
    04-07-2012 Had the chance to play with a S-OFF device, read more about it here! ENG HBOOT which is used in test, is located here.
    09-07-2012 Javacard with DIAG will work, but won't be a good solution cause no one got a legit Javacard and the DIAG files can't be leaked!
    14-07-2012 Video added which shows the Javacard with DIAG method. Video can be found here.
    14-07-2012 The ENG HBOOT 0.03 that Football uploaded lost it's sign. I re-uploaded it and re-checked the file and it should be good now. You can find the new .zip here.

    HBOOT versions
    Past: 0.03, 0.04, 0.32, 0.43, 0.94, 0.95, 0.96, 1.01
    Current: 1.11

    More to come, please stop PM'ing me!

    ​
    View
    89
    xmoo
    xmoo
    My story

    Kantoor.jpg

    The guys of Tweakers.net invited my to there office the play with there Engineering HTC One X device which they got by HTC Netherlands. It is so good to see a huge tech website like Tweakers.net trying to help the community getting S-OFF. Tweakers.net wants to write a review about the new ROM and by this way they could write a official review about the 2.x based ROM of the HTC One X. They want to help the community and the community will help them back ;)

    205.JPG

    Beginning situation:
    Device was running the 1.29.401.11 SHIP ROM with the 1.1204.105.14 RADIO.
    It is a engineering device, in the bootloader it said XE and RH instead of the PVT and RL.
    HBOOT located was version number 0.95, May 8th. CID of device is: HTC__E11.
    The device has a option for RAM Dump, but when I tried to dump the RAM, the phone would just reboot.
    Did not check SD if something was dumped or not.

    First attempt:
    Tried the flash a ENG HBOOT and tried running the DIAG with USB OTG but it failed. The cable did not work because it did not have a extra power supply (no Y USB).
    So basically I gave up. I promised Tweakers.net to flash the 2.05.401.2 TEST ROM (Which comes with a SHIP HBOOT) in return for me to play with his device.

    Test-Device.JPG

    2.05:
    I flashed the 2.05.401.2 ROM with the 2.1204.119.17 RADIO. I flashed the RUU using my MacBook Pro (Virtual Windows 7). That one succeeded and the reviewer did couple of benchmarks. On normal benchmarks it did not have massive improvements, but the browser benchmark went through the roof. HBOOT is now 1.11, May 25th. Suddenly I came with the idea to flash RUU again but change the rom.zip just like I did on past HTC Android phones.

    PJ46IMG.JPG

    Second attempt:
    I ran the RUU and replaced the rom.zip with PJ46IMG.zip (which includes ENG HBOOT 0.03.200, Jan 20th). The RUU tool recognized it as version 0.87.401.0 and I was able to flash it. Flashing went OK. HBOOT is DOWNGRADED!! But the OS would not boot :(

    205-flash.JPG

    Bricked:
    The downgrading of the HBOOT did succeed and the phone is now XE ENG S-OFF but the OS wont boot.
    The bootloader gave SECURITY WARNING. Recovery, Factory reset, clearing cache did not boot or work… So I was in deep ****, don't want to leave him with a bricked device.
    The phone did recognize everything, so I knew the phone was not fully bricked.
    Tried flashing the 2.05 TEST ROM but it would gave me Model error. Flashing the 1.29 SHIP ROM gave me Image error.
    So still only access to HBOOT and nothing else.

    096-hboot.JPG
    096.JPG

    Experience:
    I remembered from the HTC Leo (HD2) and ACE (Desire HD) that the early ENG/MFG/DEV HBOOT's only worked with 0.x based ROMS.
    I did not have the 0.87.401.0 ROM but I did have 0.96.401.2 TEST ROM (Which weird enough has a SHIP HBOOT).
    I tried installing the 0.96.401.2 TEST ROM. It did first flash HBOOT 0.04, Feb 4th reboot and then it started to flash the ROM again. Flashing the ROM almost succeeded but got aborted/failed installing something regarding NFC.

    205-2.JPG

    So bricked again:
    Because of the 0.96.401.2 TEST ROM failing on NFC, the phone did not boot but was in RUU mode. I knew because of the phone being in the RUU mode I was still able to flash it. I ran the 2.05.401.2 TEST ROM and it flashed successfully (Funny enough on this ROM there was nothing regarding NFC which needed to be flashed) and the phone booted. Thank god everything was fine again!! Funny thing is that on all the firmwares (TEST/MFG/ENG/SHIP), the OS did recognize it as a engineering device. So I guess that it is hard-coded or whatsoever in the NAND of the phone.

    What about the DIAG:
    Tried running the DIAG file in the same way I got the HBOOT to flash using the RUU. But it failed because it was not a flashable file. Suddenly I got the phone to read the DIAG file through the root of my MacBook PRO. The file did pass the CID check but then it got cancelled because of the needed for a SmartSD (same as Smartcard/Javacard). So I couldn't do ****. But the DIAG was legit and has version number 0.06.

    So what have we learned:
    HTC One X (ENDEAVOR) was originally the EDGE, the first renders were real and legit. The software was designed for that device but got a final as ENDEAVOR. The ENG HBOOT located in the PJ46IMG.zip is the ENG HBOOT that made the software to work on the ENDEAVOR. The SHIP HBOOT 0.04 was the first legit SHIP HBOOT for the device.

    The HBOOT is downgradable using the .zip but the OS won't work. The good thing is that the ENG HBOOT located in PJ46IMG.zip will work on none SuperCID devices. The file is not restricted to SuperCID just like the PJ46DIAG.zip. BUT… you can't flash the 0.96.401.2 TEST ROM because it is unsigned and replaces your HBOOT to a SHIP HBOOT. Theoretically you would be able to flash a SHIP ROM after the ENG HBOOT 0.03 is upgraded to SHIP HBOOT 0.04 with the 0.96.401.2 TEST ROM. So this gives us a ENG HBOOT which maybe allows us to perm remove secuflag or erase the locking state, so the device goes back to LOCKED using command which are allowed on ENG HBOOT.

    The DIAG file is basically a dead-end without having a SmartSD (Smartcard/Javacard).

    The 2,5 hour meeting brought blood/sweat/tears/happiness. Only thing now left is for someone to be brave enough to Flash the PJ46IMG.zip (which includes ENG HBOOT 0.03.200, Jan 20th) try commands and then get his/her phone back to life using the 0.96.401.2 TEST ROM. CIDs that will be able to flash the PJ46IMG.zip are: HTC__001, HTC__E11, HTC__203, HTC__Y13, HTC__102, HTC__405, HTC__304, HTC__032, HTC__J15, HTC__A07, HTC__016


    It was a 2hour trip to get there and another 2hour trip to go back home. Remember this is a hobby of mine, so please stop asking ETA's, other files or what so ever. Want to show some love? Donate to me and/or Football
    View
    84
    xmoo
    xmoo
    Ok you guys little summary for today.

    Today a XDA Veteran joined the development team! I welcome Football. We did several test and tried to flash couple of stuff.

    1. APX Mode, My device came in APX mode today, but because of lack of drivers I failed to send any commands or what so ever. Howto: Shutdown phone (Disable fast boot), Press volume down, keep it pressed, plugin USB cable to device (while it is connected t your laptop/desktop), wait till you here the sound of new hardware found, release the volume button. You device is in APX mode. Well I think it is APX mode, because my device did not recognize it but did say new hardware.

    2. Flashing through HBOOT. We did couple of check with filename PJ46IMG.zip. We managed to get the boot loader to read the files, some files did flash and other stopped at security check. We tried a modified diag file, we succeeded to let it load, but got canceled on CID check. So we now have found a way to flash to the boot loader but need something to bypass the security check. If we bypass the security check, the modified diag file will be able to load, and we be able to reset security. What gives us S-OFF and LOCKED again!
    Proof is in the attachment.

    3. Downgrading did work, but not possible because of version check. When S-OFF you will be able to downgrade.

    Setup:
    You need to relock boot loader and be on stock rom again, or else it won't work.
    Phone, Y Cable, Cardreader, Microsdcard, PJ46IMG.zip

    Will add a huge summary on post #1 after we finish dinner.
    View
    62
    orb3000
    orb3000
    .

    Closed until xmoo wants to re open
    View
    60
    xmoo
    xmoo
    FAQ.
    What is S-OFF?
    S-OFF stands for Security-OFF
    S-OFF means that the NAND portion of the device is unlocked and can be written to. The default setting for HTC’s devices is S-ON, which means that neither can you access certain areas of the system nor can you guarantee a permanent root. Furthermore, signature check for firmware images is also ensured by the S-ON flag.

    What has already been done?
    -Tried flashing DIAG file, but with no success. File needs SuperCID.
    -Tried flashing ENG HBOOT as zip file, but with no success. File needs SuperCID.
    -Tried flashing modified DIAG file, but with no success. File needs SuperCID.
    -Tried flashing modified HBOOT as zip file, but with no success. Signature check failed.
    -Tried creating a Goldcard, but won't work. The Goldcare is for Qualcomm devices.
    -Root while phone is LOCKED, won't work. Only will work on the Qualcomm One X and One XL.
    -Ask the Chineese guy with the S-OFF tool. Won't share, cause he needs his money.
    -Tried flashing files over recovery, but with no success.
    -Tried flashing TETS and MFG ROMs, but with no success. Phone needs S-OFF because the ROMS are not sighned.
    -Tried changing CID, but won't work. Only will work on the Qualcomm One X and One XL.
    -Tried commands over ADB, but with no success.
    -Tried XTC clip, won't work.

    How Do I Know If My Device Is S-ON Or S-OFF?
    That is easy to verify. Simply boot into HBOOT (bootloader) on your device, and the text on top will show the flag status as either S-OFF or S-ON. A full root generally means S-OFF.
    s-off.jpg


    S-OFF – What And Why?
    HTC have installed a sort of security check whose level is determined by S-OFF/S-ON. Essentially, this security level is a flag stored on the device’s radio that checks signature images for any firmware before it is allowed to be written to system memory. This hinders using any custom ROMs, splash images, recovery etc., and also restricts access to the NAND flash memory. However, when security level is set to S-OFF, the signature check is bypassed, allowing a user to upload custom firmware images, unsigned boot, recovery, splash and HBOOT images, as well as official firmware that has been modified, this enabling maximum customization of your HTC Android device.

    Furthermore, S-OFF also reduces restrictions on accessing the NAND flash memory on the device, allowing all partitions (including /system) to be mounted in write mode while the operating system is booted.

    Where is it located?
    Don't know yet, here are the partitions.

    How can I flash through SD?
    Tutorial added here!

    What HBOOT status have we seen so far?
    ENDEAVORU PVT SHIP S-ON RL
    ENDEAVORU PVT SHIP S-OFF RL
    ENDEAVORU PVT ENG S-OFF RL
    ENDEAVORU XE ENG S-OFF RH
    ENDEAVORU PVT MFG RH
    ENDEAVORU XE SHIP S-OFF RH
    ENDEAVORU UNKNOWN ENG S-OFF RH

    Partition list for One X with all addresses and lengths of partitions
    Football share the full list which can be found here.

    How does HTC do it?
    They do it with a smartcard/javacard/goldcard (What ever you want to call it) in combination with the DIAG file. Proof is in the attachment.
    View

New posts