Goal: S-off HOX (TEGRA3)

Lloir · Jan 9, 2013

Right I've told off for being so "easy going" so I've nuked EVERYTHING non-dev related. This will be the only warning from this point on. Anything Off topic or nothing to do with dev, will be deleted and passed onto some one higher up.

thanks guys and please KEEP ON TOPIC

-Lloir

MikeS. · Jan 10, 2013

PJ46*KEY.img

Hi after some reading, I've found something interesting (at least for me).

Code:

Check PR key file : [%s]PJ46PKEY.img
Read Key File Data OK %X %d
Write PR Key Data OK
Check DP key file : [%s]PJ46DKEY.img
Write DTCPIP Key Data OK
Check ZIP file USB Dongle
Test PJ46DIAG.zip

So, is it possible, that we need a 2nd, 'KEY' file, which only allows us to flash the DIAG-file?

Sorry, if it's not dev related.

lenthele · Jan 10, 2013

m_atze said:
Hi after some reading, I've found something interesting (at least for me).

Code:

Check PR key file : [%s]PJ46PKEY.img Read Key File Data OK %X %d Write PR Key Data OK Check DP key file : [%s]PJ46DKEY.img Write DTCPIP Key Data OK Check ZIP file USB Dongle Test PJ46DIAG.zip

So, is it possible, that we need a 2nd, 'KEY' file, which only allows us to flash the DIAG-file?

Sorry, if it's not dev related.

Actually there are two different Key files (PJ46PKEY.img and PJ46DKEY.img)! Where did u find this?

Gesendet von meinem HTC One X mit Tapatalk 2

MikeS. · Jan 10, 2013

lenthele said:
Where did u find this?

I've just opened the diag.nb0 with a text editor, approximately in the center of the file is an area that contains some text lines.

Fightspit · Jan 10, 2013

I found also this:

Code:

config.s.driverType:crypto
config.s.default_stack_size:2048
config.s.mem.1.size:128
smx.name:Software Cryptography Driver
smx.vendor:TL
smx.description:Secure Driver for TL Software Cryptography.0!0

A lazy Google search gives this http://www.google.com/search?btnG=1&pws=0&q=Secure+Driver+for+TL+Software+Cryptography

Edit#1:
A couple of lines later...

Code:

config.s.driverType:customx
config.s.default_stack_size:4096
config.s.heap_size:131072
config.s.powerChangeStackSize:0
config.s.lazy_instantiation:false
config.s.multi_instance:false
config.s.multi_session:false
config.s.multi_command:false
config.s.custom.allow_nw_clients:false
config.s.mem.1.address:0xBFFF7C00
config.s.mem.1.size:1024
config.s.mem.2.address:0xBFFF8000
config.s.mem.2.size:12288
config.s.mem.3.address:0xBFFFB000
config.s.mem.3.size:1024
config.s.mem.4.address:0xBFFFB400
config.s.mem.4.size:1024
config.s.mem.5.address:0xBFFFB800
config.s.mem.5.size:1024
config.s.mem.6.address:0xBFFFBC00
config.s.mem.6.size:1024
smx.name:HTC Security
smx.vendor:HTC
smx.description:Secure Driver for HTC Security

Edit#2

Code:

config.s.lazy_instantiation:true
config.s.multi_instance:false
config.s.multi_session:true
config.s.multi_command:true
config.s.default_stack_size:1024
config.s.heap_size:8192
smx.name:SampleService
smx.vendor:TRUSTED LOGIC
smx.description:Sample Service
config.data.widevine_key:deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5
config.data.widevine_key.size:1024

A dead bee could be the key ??? lol ^^

pandaball · Jan 15, 2013

Chanced upon this while looking for something else entirely. Might be useful: http://su3.me/all-about-htc-phones-bootloader-security-system/

deadwilder · Jan 15, 2013

maybe something useful. Trip wrote new powerboard and due to that as he says

At least we now have the option to configure all the stuff like we want it to be. Maybe htc locked some stuff idk, but some pmu devices are found during boot that didnt exist previously.

On top, all mmcblk cards / partitions are reconized and can be messed with because they have proper power that is -not- configured in hboot like htc currently does to lock everything up.

Dont know what they tought with it but that configuration is ALWAYS available to overwrite it from userspace

http://xdaforums.com/showpost.php?p=36719110&postcount=256
maybe APX? maybe finally access to hidden partitions?

check this thread http://xdaforums.com/showthread.php?t=2092946

Thunder07 · Jan 15, 2013

pandaball said:
Chanced upon this while looking for something else entirely. Might be useful: http://su3.me/all-about-htc-phones-bootloader-security-system/

someone posted this before on another thread, not sure if its the same person, someone else or what.

but long story short.... i don't see any new information on the table.... or do you??

deadwilder said:
maybe something useful. Trip wrote new powerboard and due to that as he says

http://xdaforums.com/showpost.php?p=36719110&postcount=256
maybe APX? maybe finally access to hidden partitions?

check this thread http://xdaforums.com/showthread.php?t=2092946

ya this would almost guarantee us an s-off... but it will only work with unlocked bootloader... and at this very moment i'm not gonna argue with that, however,
it will finally give us for access to everything on the phone.. to allow those with knowledge find an exploit for everyone :highfive:

marice22 · Jan 15, 2013

Fightspit said:

I found also this:

Code:

config.s.driverType:crypto
config.s.default_stack_size:2048
config.s.mem.1.size:128
smx.name:Software Cryptography Driver
smx.vendor:TL
smx.description:Secure Driver for TL Software Cryptography.0!0

A lazy Google search gives this http://www.google.com/search?btnG=1&pws=0&q=Secure+Driver+for+TL+Software+Cryptography

Edit#1:
A couple of lines later...

Code:

config.s.driverType:customx
config.s.default_stack_size:4096
config.s.heap_size:131072
config.s.powerChangeStackSize:0
config.s.lazy_instantiation:false
config.s.multi_instance:false
config.s.multi_session:false
config.s.multi_command:false
config.s.custom.allow_nw_clients:false
config.s.mem.1.address:0xBFFF7C00
config.s.mem.1.size:1024
config.s.mem.2.address:0xBFFF8000
config.s.mem.2.size:12288
config.s.mem.3.address:0xBFFFB000
config.s.mem.3.size:1024
config.s.mem.4.address:0xBFFFB400
config.s.mem.4.size:1024
config.s.mem.5.address:0xBFFFB800
config.s.mem.5.size:1024
config.s.mem.6.address:0xBFFFBC00
config.s.mem.6.size:1024
smx.name:HTC Security
smx.vendor:HTC
smx.description:Secure Driver for HTC Security

Edit#2

Code:

config.s.lazy_instantiation:true
config.s.multi_instance:false
config.s.multi_session:true
config.s.multi_command:true
config.s.default_stack_size:1024
config.s.heap_size:8192
smx.name:SampleService
smx.vendor:TRUSTED LOGIC
smx.description:Sample Service
config.data.widevine_key:deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5
config.data.widevine_key.size:1024

A dead bee could be the key ??? lol ^^

deadbee5 reminds me of this:
http://www.ps3devwiki.com/wiki/Flash:0FACE0FF_DEADBEEF

Ps3 magic number

TripNRaVeR · Jan 21, 2013

Not sure if this is any help but maybe you can do something with it.

Code:

mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22

Code:

[    3.379131] Adding recovery (SOS) as MMC partition 21: offset 7864320 bytes, size: 8388608 bytes
[    3.379475] Adding boot (LNX) as MMC partition 22: offset 16252928 bytes, size: 8388608 bytes

Code:

boot size of mmc0 is 4194304

Tried to mount recovery as yaffs2 but that failed, mmcblk0p4 cannot be mounted with current progress, mmcblk0p5 can be mounted as soon as i have correct filesystem, it gives error about filesystem.

Anyone knows the various filesystems for all partitions?

feraay · Jan 21, 2013

AW: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

You mean something like this??

Ah OK you mean the Format of filesystem?

Code:
[partition]
name=BCT
id=2
start_location=0x00
size=0x400000

[partition]
name=PT
id=3
start_location=0x400000
size=0x200000

[partition]
name=EBT
id=4
type=bootloader
start_location=0x600000
size=0x400000

[partition]
name=DIA
id=5
type=bootloader
start_location=0xA00000
size=0x400000

[partition] (Board Information)
name=BIF
id=6
start_location=0xE00000
size=0x200000

[partition]
name=GP1
id=7
start_location=0x1000000
size=0x200000

### WLAN firmware ###
[partition]
name=WLN
id=8
start_location=0x1200000
size=0x600000
#filename=wlan.img

### WLAN Data + MFG Data ###
[partition]
name=WDM
id=9
start_location=0x1800000
size=0x200000
filename=WDM.img

### Radio Calibration Data ###
[partition]
name=RCA
id=10
filesystem_type=ext3
start_location=0x1A00000
size=0x600000

### Linux Kernel OS ###
[partition]
name=LNX
id=11
start_location=0x2000000
size=0x800000
filename=boot.img

### Recovery ###
[partition]
name=SOS
id=12
start_location=0x2800000
size=0x800000
filename=recovery.img

### PG1FS ###
[partition]
name=PG1
id=13
start_location=0x3000000
size=0x1000000

### PG2FS ###
[partition]
name=PG2
id=14
start_location=0x4000000
size=0x1000000

### PG3FS ###
[partition]
name=PG3
id=15
start_location=0x5000000
size=0x1000000

### Software Info ###
[partition]
name=SIF
id=16
start_location=0x6000000
size=0x400000
filename=SIF.img

### Splash1 ###
[partition]
name=SP1
id=17
start_location=0x6400000
size=0x400000

### Reserve1 ###
[partition]
name=RV1
id=18
start_location=0x6800000
size=0x1C00000

### System ###
[partition]
name=APP
id=19
filesystem_type=ext3
start_location=0x8400000
size=0x50000000
filename=system.img

### Cache ###
[partition]
name=CAC
id=20
filesystem_type=ext3
start_location=0x58400000
size=0x14000000

### Internal SD ###
[partition]
name=ISD
id=21
start_location=0x6C400000
size=0x650000000

### Userdata ###
[partition]
name=UDA
id=22
filesystem_type=ext3
start_location=0x6BC400000
size=0x89400000
filename=userdata.img

### Memory dump ###
[partition]
name=DUM
id=23
start_location=0x745800000
size=0x200000

### MISC Partition ###
[partition]
name=MSC
id=24
start_location=0x745A00000
size=0x200000

### Radio File System ###
[partition]
name=RFS
id=25
start_location=0x745C00000
size=0x600000

### Develop Log ###
[partition]
name=DLG
id=26
start_location=0x746200000
size=0x1600000

### PDATA for MASD ###
[partition]
name=PDT
id=27
start_location=0x747800000
size=0x200000

[partition]
name=GPT
id=28
type=GPT
start_location=0x747A00000
#size=0xFFFFFFFFFFFFFFFF
size=0x200000

Gesendet von meinem HTC One X mit Tapatalk 2

Braindamage1989 · Jan 21, 2013

feraay said:
You mean something like this??

Ah OK you mean the Format of filesystem?

Keep in mind this is the data from an ENG ROM that was released before the HOX got shipped. The partition table could be changed!

For those who care:

Someone managed to make changes to p9, at the radio version (don't know who and where, but know how he did). While this partition normally is write protected, so thats a good start (although it doesn't have any effect).
Also more to come soon!

TripNRaVeR · Jan 21, 2013

Is there any change we could know how they are formatted currently? Like /system ext4 /data ext4 recovery? boot?

Thunder07 · Jan 21, 2013

TripNRaVeR said:
Is there any change we could know how they are formatted currently? Like /system ext4 /data ext4 recovery? boot?

This is a much older list I've got from the debug rom Xmoo posted awhile ago,
while they aren't very useful the boot/system are listed as "filesystem_type=basic"
and so are the Internal storage and devlog...
can't you just mount it as RAW file system??

Edit:
Basically since dd is the method used to update the kernel on some phones ( I know some Samsung do anyway)
I do t think they have a partition type?

note i removed alot of the partitions as they serve no use to my point,
if you want them listed let me know.

Code:

[device]
type=hsmmc
instance=3

[partition]
name=EBT
id=4
type=bootloader
allocation_policy=sequential
filesystem_type=basic
start_location=0x600000
size=0x400000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=hboot.img

### Radio Calibration Data ###
[partition]
name=RCA
id=10
type=data
allocation_policy=sequential
filesystem_type=ext3
start_location=0x1A00000
size=0x600000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0

[partition]
name=BIF
id=6
type=data
allocation_policy=sequential
filesystem_type=basic
start_location=0xE00000
size=0x200000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
#filename=board_info.bin

### Linux Kernel OS ###
[partition]
name=LNX
id=11
type=data
allocation_policy=sequential
filesystem_type=basic
start_location=0x2000000
size=0x800000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=boot.img

### Recovery ###
[partition]
name=SOS
id=12
type=data
allocation_policy=sequential
filesystem_type=basic
start_location=0x2800000
size=0x800000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=recovery.img



### System ###
[partition]
name=APP
id=19
type=data
allocation_policy=sequential
filesystem_type=ext3
start_location=0x8400000
size=0x50000000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=system.img

### Cache ###
[partition]
name=CAC
id=20
type=data
allocation_policy=sequential
filesystem_type=ext3
start_location=0x58400000
size=0x14000000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0

### Internal SD ###
[partition]
name=ISD
id=21
type=data
allocation_policy=sequential
filesystem_type=basic
start_location=0x6C400000
size=0x650000000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0

### Userdata ###
[partition]
name=UDA
id=22
type=data
allocation_policy=sequential
filesystem_type=ext3
start_location=0x6BC400000
size=0x89400000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=userdata.img

### Develop Log ###
[partition]
name=DLG
id=26
type=data
allocation_policy=sequential
filesystem_type=basic
start_location=0x746200000
size=0x1600000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0

TripNRaVeR · Jan 21, 2013

feraay said:
Its not easy never read any info of this

I expect you have tried ext4 ? And that's wrong?
Can we See a hint in the imgs ?

I have no clue, i'm trying for a while now to find them.

Mounting mmcblk0p5 as ext4 errors out, choosing yaffs or yaffs2 starts mounting it but fails with dev 187... some numbers here and then it stops

Lloir · Jan 21, 2013

Little bit of cleaning done AGAIN

TripNRaVeR · Jan 22, 2013

Maybe this is usefull to;

http://pastebin.com/0vsRFSeA

just changed the boot partition on mmcblk0boot1 forced read only value from 1 to 0

update:
mmcblk0/mmcblk0boot0/force_ro 0
mmcblk0/mmcblk0boot0/ro 0
mmcblk0/mmcblk0boot1/force_ro 0
mmcblk0/mmcblk0boot1/ro 0

this is basicly what we need correct?

MrT69 · Jan 22, 2013

Don't know if you know this page:

https://devtalk.nvidia.com/default/board/105/

But this seems to be very interesting:

https://devtalk.nvidia.com/default/...failure-to-flash-os-image-to-cardhu-dev-kit-/

BUT (...wtf is there always a damn BUT...) it seems that it is a process to become a member of this board. It should takes day's to weeks until someone will get access to this forum.
Also the download for the JB Devel Image and Files is restricted only to members.

This would be the Link:
https://developer.nvidia.com/rdp/as...r-cardhu-jb-10-windows-2012-10-20-11617556exe
but it is restricted and only possible to users of the dev board.

This is the Page for the Android Dev Tools:
https://developer.nvidia.com/tegra-android-development-pack

I guess this would be the file:
tegra-osinstaller-cardhu-jb-10-windows-2012-10-20-11617556.exe

I have already done a search but did not found this file within the web.

TripNRaVeR · Jan 22, 2013

Lloir · Jan 22, 2013

Having a conversation about the Nvidia\Tegra website DOES NOT = Development...nor does a random conversation about some old files and where to get them.

Goal: S-off HOX (TEGRA3)

Inactive Recognized Developer

Senior Member

Senior Member

Senior Member

Senior Member

Inactive Recognized Developer

Senior Member

Inactive RC / RD

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Inactive RC / RD

Senior Member

Inactive Recognized Developer

Senior Member

Senior Member

Senior Member

Inactive Recognized Developer

Similar threads

Top Liked Posts