H
Henry_1
Guest
Wow guys, not so fast! 
It's not because this thread has moved that development is dead!
Other phones have moved also, like htc chacha, galaxy ace, hero ...
I would bet when there was a software unlock, you would become back immediately!
Rom development is growing, theme support also (thanks to me). Even CM7 is here! Jikanturu left, but others went over here. Alquez is still going strong
Just get that xtc clip! Use ebay, the official site or other ways!
Some help for the lazy person, hit thanks!
My WFS is such a super smartphone, even a friend said it.
According to him, the screen is gorgeous, 10 times better than original wildfire.
And he has a desire s!
For all that sell or throw away this device because of the message:
you shouldn't be here, you had enough money to buy a higher end smartphone before!!
It's not because this thread has moved that development is dead!
Other phones have moved also, like htc chacha, galaxy ace, hero ...
I would bet when there was a software unlock, you would become back immediately!
Rom development is growing, theme support also (thanks to me). Even CM7 is here! Jikanturu left, but others went over here. Alquez is still going strong
Just get that xtc clip! Use ebay, the official site or other ways!
Some help for the lazy person, hit thanks!
My WFS is such a super smartphone, even a friend said it.
According to him, the screen is gorgeous, 10 times better than original wildfire.
And he has a desire s!
For all that sell or throw away this device because of the message:
you shouldn't be here, you had enough money to buy a higher end smartphone before!!
Last edited:
Wow guys, not so fast!
It's not because this thread has moved that development is dead!
Other phones have moved also, like htc chacha, galaxy ace, hero ...
I would bet when there was a software unlock, you would become back immediately!
Rom development is growing, theme support also (thanks to me). Even CM7 is here! Jikanturu left, but others went over here. Alquez is still going strong
Just get that xtc clip! Use ebay, the official site or other ways!
My WFS is such a super smartphone, even a friend said it.
According to him, the screen is gorgeous, 10 times better than original wildfire.
And he has a desire s!
For all that sell or throw away this device because of the message:
you shouldn't be here, you had enough money to buy a higher end smartphone before!!
Listen to this guy! I paid twenty quid to get my WFS unlocked in a phone unlocking shop, they used an xtc clip and made it s-off in the process. It cost £20. Hardly breaking the bank, and think of the hassle it will save you compared to having to sell your device and find another 'cheap' smart phone with a good dev scene. So what if Jikanturu left the scene? The rom's he posted were solid.
WFS is a nice handset. Good luck getting a software s-off.
This is pretty **** no doubt, but it's not the end of the wildfire S. I never use the main plate forum to visit this place anyway, it's bookmarked. As is for all of you I'm sure.
This is pretty **** no doubt, but it's not the end of the wildfire S. I never use the main plate forum to visit this place anyway, it's bookmarked. As is for all of you I'm sure.
Too right, I wouldn't have known if it wasn't reported in here, bookmarks are the way to avoid trawling through crap.
Sent via Tapatalk
Not showing up in Legacy yet on my Tapatalk. Lucky I have General and Dev sub forums as favorites.
This status has to change though. I am steamed.
Whereabouts in the UK are you? Everywhere I tried where I live (Newcastle/South Shields) don't know what the XTC Clip is :/
get yourself to the metro centre. the phone shop opposite the cinema did mine. £20. pm me if you need more info or whatever
I am not a dev but I am joining all of you. S-OFF is highly required for keeping a phone last forever!
H
Henry_1
Guest
And a post here also!
For s-off you need xtc clip!
An xtc clib buy group with 25 pages is in my signature, just click on it and search your country!
Hit thanks if I helped you!
For s-off you need xtc clip!
An xtc clib buy group with 25 pages is in my signature, just click on it and search your country!
Hit thanks if I helped you!
No use of bumping.
We are not on the first page of Portal, transferred to old devices. Nobody visit this forum except us, the WS users, and it looks like there is not enough qualified persons among us who know how to solve this problem.
Sent from HTC
£20 is what it cost. Simple. And I know the guy can do it. Another tried to charge £30 just to unlock. Robbery. Regardless, £20 to be able to stop pining for s-off and have more space, speed and fun. I know its the principal of the matter..but screw it, enjoy your hand set to its full potential ....
Sent XDA App
Sent XDA App
3 little things...
We need two things to keep this development and forum alive:
Well three.
1/ Stop obsessing over HTC's unlocked bootloader. We need FULL S-OFF and SIM card unlock
2/ Shake out your pockets and get your devices XTC-Clipped. For the cost of it vs the effort put into moaning about it. What is YOUR time worth? I know mine is worth more than the time I spent trying to software S-OFF this thing. If it happens great! Until then we need a bunch of S-OFF'd phones and developers to not be relegated to the boneyard.
3/Focus on what we CAN change soonest. Getting back on the main forums. This is the most likely thing to happen with the least effort to keep us current and visible to other WFS users and developers looking for a home.
So get through wasting time on item 1, spend some money on item 2 and let's all work on petitioning for item 3.
So check out the threads in my signature and find your local XTC Clip owner and let's get this forum moving.
Thanks to all those still making development efforts and efforts to raise awareness of this great little phone that could.
Cheers.
B
Totally agree.
We need two things to keep this development and forum alive:
Well three.
1/ Stop obsessing over HTC's unlocked bootloader. We need FULL S-OFF and SIM card unlock
2/ Shake out your pockets and get your devices XTC-Clipped. For the cost of it vs the effort put into moaning about it. What is YOUR time worth? I know mine is worth more than the time I spent trying to software S-OFF this thing. If it happens great! Until then we need a bunch of S-OFF'd phones and developers to not be relegated to the boneyard.
3/Focus on what we CAN change soonest. Getting back on the main forums. This is the most likely thing to happen with the least effort to keep us current and visible to other WFS users and developers looking for a home.
So get through wasting time on item 1, spend some money on item 2 and let's all work on petitioning for item 3.
So check out the threads in my signature and find your local XTC Clip owner and let's get this forum moving.
Thanks to all those still making development efforts and efforts to raise awareness of this great little phone that could.
Cheers.
B
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
59[DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD!
Progress so far:
DEVELOPERS!
THIS CAMPAIGN IS STILL GOING!
Please try to read the latest posts in this thread if you would like to help!
---
S-OFF is still needed! Don't get happy with your HTC unlocked bootloaders, you have no more warranty! You still can't resizie your system partitions! You still can't flash the hboot, and many other things! You can get your warranty back, if we crack S-OFF!!
Well I basically did a lot of of low-level (mostly hardware) stuff to the phone recently, not so much actual development. I found out how to configure OpenOCD (don't know whether the configuration is any good, since lots of values are more "good guesses" than actual knowledge but at least it's a starting point). I found how to get the board to boot without being attached to the Lithium cell which is not important for getting JTAG access (because this works as long as the board has power supply, being booted is not neccessary for JTAG to work) but will later be needed for tracing through the boot code, since the phone won't boot without what it thinks is a Lithium cell. However, I didn't get the debugger running yet. I suspect that the processor's logic level might be too low for the JTAG equipment. I don't really have an idea how to work around that yet, I might need to build a circuit that boosts the processor's JTAG signal to the appropriate voltage level (a so-called "level-shifter").
Apart from that munjeni and Antagonist42 also seem to make progress, but I must admit that I wasn't really able to keep track of all the things that they were doing recently. So basically we're now down at the actual physical layer and messing around with the electrical stuff that's going on on the phone's board and trying to find a way of actually talking to the processor to get the on-chip debugging working.
The far goal will be getting a patched HBOOT that has signature verification removed loaded into the device's memory via JTAG, then flash a patched HBOOT image via Fastboot. If this works it will be the first S-OFF GSM WFS that's neither shipped S-OFF nor turned S-OFF via xtc-clip, but this might still be a long long way.35Get your Teeth into these
Do not PM requesting Documents unless.....
If you cannot satisfy the above, do not PM. Thank you
My DropBox is defunct :silly: , as i'm not now as active on XDA I will see about re-posting when I can get some time to sort it all out again (like my mind it's a mess ).... I'll leave page as-is until I can sort it out Thankyou for your patience... and thankyou dropbox for the total lack of any idea of what went wrong
QualcommRelease Info July 2010
Booting
Qualcomm Boot VM984
File Systems
Qualcomm Filesystem Overview
ARM sheets
ARM9 Compiled Framework - Translated
ARM926EJ-S pdf
ARM1136JF-S + J-S pdf
ARM Phone/PC/Chip Info doc
Qualcomm REX User Guide Rev C 2001
REX and common software
ARM9EJ-S r1p2 _ RETIRED _ DDI0222
ARM Architecture Reference Manual v6m _ DDI0194C
eMMC Electrical Standards
ARMv7
Architecture App Level Ref Manual v7-M
Architecture App Level Ref Manual v7-M
Architecture Ref Manual v7-M
ECC
Reed Solomon Error Correcting Codes - OhadRodeh
Qualcomm - System Boards / User System
MSM7xxx Q-Fuses and Security
USB Host Driver W2k/XP -80-V4609-1-Rev-E
Android Linux Device Bus Drivers
Qualcomm - AMSS / Radio ... non user
AMSS - D'ya wanna know how to?
AMSS Overview 7x27 EBI1 cfg Original pdf
AMSS Overview 7x27 EBI1 cfg Translated (roughly lol) rtf
AMSS/DMSS C Debug/Troubleshoot
CMX Overview 80-V1484-1 Rev H
AMSS Multimedia Concurrency
AMSS 6055/6065/6075/6085 Build Instructions and Environment
MSM7227 Info
MSM7200A Sales Datasheet
MSM7500 Sales Datasheet
TM7200 [Test Phone] Sales Datasheet
MSM7227/7227 - Turbo - Build your own!!! See Below For Chip Infos
MSM7227 Chip Training-Overview
MSM7227 modem pdf
Micron NAND information
Package Naming
Part Numbering
NAND or OneNAND + RAM pdf
Micron NAND 101
NAND Flash Memory for MT29F4G08AAA, MT29F8G08BAA, MT29F8G08DAA, MT29F16G08FAA
4Gb, 8Gb, and 16Gb x8 NAND Flash Memory Features
TN-29-16: Boot-from-NAND with the TI OMAP2420 Processor
TN-29-18: Booting from Embedded MMC
TN-29-13: Determining NAND Flash Ready/Busy Status
TN-00-25: Enabling a Flash Device into the Linux MTD
Samsung NAND information
512 NAND
K9K2G08(U/R)0A Datasheet
KFG1G16Q2M-DEB6 Datasheet
Lauterbach - NAND
NAND FLASH Programming User’s Guide
Board IC's
PM7540 Power Manager pdf
RTR6285 RF Transceiver IC pdf
RTR6285/6280 Specs pdf
RTR6285 RF SW Driver pdf
MSM7227 Boot doc - Chinese but mostly the actual android/linux we're after.
MSM7227 Boot - Translated (roughly) - doc
Qualcomm 7X27 Platform Training Summary - rtf
Contains Partition Info .Doc file
Program (Linux) Unsure of authenticity please be aware...
QualcommAuto Test - No idea, Linux OS, trying to find documentation.
MSM6025 QSC60x6
Data Sheet
Device Specification
User Guide
Chipset Training
MSM60x5 AMSS Secure Boot Overview
MSM60x5 AMSS Flash and Memory Layout
MSM60x5 AMSS Board Support
MSM6500
Chipset Training
Basband Ref Schematic
MSM7200/A
Software Interface Manual 80-VA736-2 Rev B
MSM7200A Chipset Training - Baseband Topics
MSM 7225
Device Specification 80-VF815-1 Rev E
MSM7625
MSM7625 Device Info pdf
MSM7627
MSM7627 RF Training pdf
MSM7627 SCHEMATIC pdf - try at your own peril
Training Baseband Topics-80vm151-25 - pdf
Training Baseband Topics-80vm151-25 - (plain text file) - pdf
SURF7627 Main Board Ref Schematic pdf
SURF7627 Platform User Guide
AMSS 7x27A Linux Release 2.0.35 (Modem, Multimode) for Android™
Platform-Enabled MSM7627A Devices Release Notes for M76XXUSNEKNLYM2035
MSM8260/8660
MSM8260/8660 Baseband Reference Schematic
APQ8060/MSM8260/8660 Mobile Station Modem
MSM8660 Voice/Audio Topology and Tools Overview
MSM8x60
MSM8X60 Modem Debug Guide
MSM8960
Schematic including PM8921 WCD9310
MSM8969 Boot Architecture
MSM8960 Chipset Training - Intro & Overview
QSC
QSC6240/QSC6270 Single Chip User Guide
MDM Series Chips
62+6600 User Guide
8200 User Guide
JTAG Info
AND72J v1.0 25.04.2011 doc
JTAG ETM Interface for ARM9
Lauterebach - ARM JTAG Interface Specifications
Program for JTAG
From above site - H-JTAG v2.1
H-JTAG User Documents
MSM Devices.
Lauterbach Dev Tools - Debugging Linux GDB Android
Trace32 Training not Qualcomm.
MSM7227 Schematic Chip Infos
B4B-PH-K_LF_SN
JST - PH Connector Info
CCM03-3013-LFT-R102
C&K Components - SIM Holder
CM1213-08MR
CMD California Micro Devices - 1, 2, 4, 6 and 8-Channel Low Capacitance ESD Protection Arrays
DTC124EE
ROHM Semiconductor - 100mA/50V Digital Transistors
DTC144WE
ROHM Semiconductor - NPN 100mA/50V Transistor
EMIF02-MIC02F2
ST Microelectronics - EMI/RFI Filter
HEC3650-018010
HOSIDEN Electronic Components - DC Power Jacks
IP4047CX6-LF
NXP (founded by Philips) - ESD protection EMI filter Level shifter and buffer
LP5900TL-3.3
Texas Instruments - Ultra Low Noise, 150 mA Linear Regulator for RF/Analog Circuits Requires No Bypass Capacitor
LT3465FA
Linear Technology - 1.2MHz/2.4MHz White LED Drivers with Built-in Schottky in ThinSOT
Linear Technology - High Efficiency ThinSOT White LED Driver Features Internal Switch and Schottky Diode – Design Note 325
MT46H32-64M16-32LF
Micron - Mobile Low-Power DDR SDRAM
NC7SP34L6X
Fairchild Semiconductor - TinyLogic ULP Single Buffer
NC7SZ74
Fairchild Semiconductor - TinyLogic UHS D-Type Flip-Flop with Preset and Clear
PACDN1404-D
On Semiconductor - ESD Protection Arrays in Chip Scale Package
ISP1362
USB Schematic Philips - Philips ISP1362 USB On-The-Go Expansion Board For Accelent IDP's
0522P_0524P
Semtech - Ultra Low Capacitance TVS Arrays
SI2333DS-T1-E3
Vishay Siliconix - P-Channel 12-V (D-S) MOSFET
ZXTD2M832
Zetex Semiconductors - MPPS Miniature Package Power Solutions DUAL 20V PNP LOW SATURATION SWITCHING TRANSISTOR
Programs
QXDM - 3.9.19 Still using 80-V1241-21 Rev. A November 21, 2001
With update info for Expected Differences Between QCAT Version 4 and QCAT Version 5 Output - 2006
QXDM Software Users Guide 80-V1241-21 X2 September 13, 2001
Other Stuff I have come across, passed on, may be of use/interest ...
Intel - Hex Addressing/Recording - Hexadecimal Object File Format Specification
LG VS930 Service Manual
LG KS20 Service Manual pdf - just for interest.
How the Dalvik Virtual Machine works
Qualcomm Rex Boot - Needs Translating though!
AMSS Doc Translated - rtf
Qualcomm OS Kernel Code REX Translated - rtf
Generate Release Version Android System Signature Translated - rtf
Translated Boot doc 1
Translated boot doc 2
Multi-Core Communication - Original txt pdf
Multi-Core Communicaton - Translated
Wavecom Open AT Firmware 7.4
Boot/Kernel Analysis Docs -
Simple Analysis Android Kernel rtf
Android Boot Proc 01 rtf
Android Boot Proc 02 rtf
Linux Kernel Porting (mini2440) rtf
Qualcomm Boot Analysis rtf
U-Boot Analysis rtf
A Physically Addressed L4 Kernel paper - pdf
L4 User Manual API Version X2 pdf
A Secure MicroKernel pdf
This document is intent to provide detailed instruction on building the Android Gingerbread BSP on the
SMDKV210 board.15
Proof (screenshot) is attached.
Yes I managed to "chainload" a patched ("exploit inject" generated) HBOOT on the device via Fastboot. Have prefixed it with a small (assembly language) exploit code that moves it to over to physical zero and jumps into it, then put it into an Android boot image created with mkbootimg_wfs and booted that via Fastboot. You have to hold Vol-Down when issuing the Fastboot command, since obviously otherwise it won't get into bootloader mode but boot straight into ROM. It shows S-OFF and "*** INJECTED ***" (which is the string that the exploit leaves inside the HBOOT image to prove that it worked - I've "stolen" the idea from Revolutionary that show "*** REVOLUTIONARY ***" or something like that). Cannot test whether it actually "acts S-OFF" (allows stuff like "fastboot flash hboot" etc.) since I have no way to enter Fastboot mode. It will boot straight into the ROM after checking the SD card for the PG76IMG.nbh.
Don't want to publish yet since the image obviously contains an entire HBOOT and while I really want to gain S-OFF on the device, I also respect HTC's copyright on their code. I have to turn this into an exploit that generates the image from an HBOOT dump pulled off the phone itself since then I do not have to ship any HTC code with it, which I'd consider "fair".9Haha it works!
Code:~ # cat /proc/mtd dev: size erasesize name mtd0: 00100000 00040000 "misc" mtd1: 00500000 00040000 "recovery" mtd2: 00340000 00040000 "boot" mtd3: 10400000 00040000 "system" mtd4: 02300000 00040000 "cache" mtd5: 09600000 00040000 "userdata" mtd6: 00a00000 00040000 "devlog" mtd7: 02fc0000 00040000 "radio" ~ #
I had a fastboot image of unknown origin that probably couldn't do it for whatever reason. I now used the fastboot that ships with the Android SDK and this one does it.
So yes people, we have access to the Radio!
Code:~ # cat /dev/mtd/mtd7 > /sdcard/radio.img
Succeeds so I'm now having the Radio firmware right on my SD card!
So victory I'd say! We just have to find the flag now. Memory protection is gone! The rest is "good programming work" and "finding out how APIs work" for programming the Flash via mtd devices. It's not that trivial as you have to do quite sophisticated "ioctl" calls to explicitely erase pages before programming them again, otherwise the memory won't be writable. But like I said this is just coding skills and API knowledge. We have passed the challenge, Radio protection is dead!9GOT IT! PHONE SHOWS S-OFF! Bootloader is unusable though. Shows boot screen (including S-OFF), then checks SD card for PG76IMG.nbh, then boots into ROM. No chance to do anything. But I think that only SMALL modification is required now.
