[DEV] S-OFF (wirte permission to NAND)

Search This thread

nader1450

Senior Member
Dec 16, 2011
527
922
Kuala Lumpur
Guys stop spamming the thread, as soon as anyone has more info it will be posted here. Hopefully, within the next day or 2, me and jinx will attempt a remote unlock If it works I will post details on how you guys can get S-Off.

This will be a paid method though.

Sent from my HTC Sensation XL with Beats Audio X315e using Tapatalk 2

Thanks

i'm waiting

Best Regards
 

sJet

Member
Nov 28, 2008
5
1
Kiev
Guys stop spamming the thread, as soon as anyone has more info it will be posted here. Hopefully, within the next day or 2, me and jinx will attempt a remote unlock If it works I will post details on how you guys can get S-Off.

This will be a paid method though.

Sent from my HTC Sensation XL with Beats Audio X315e using Tapatalk 2

S-OFF is based on the server response to a request, phone must be connected to the same PC as an USB-key. If any USB-key sharing software is detected, then key will be blocked

Code:
06:07.968 Connecting with <b>Sensation XL</b>
06:08.046 In order to connect with phone you should:
06:08.062 1. Install HTC ADB drivers
06:08.093 2. Turn on the phone
06:08.125 3. Enable Debug mode in phone (Settings->Applications->USB Debug)
06:08.140 4. Check your Internet connection
06:08.203 5. Plug USB Cable
06:08.218 WARNING: Don't forget to click "Disconnect" at the end.
06:08.234 Probing ADB Interface...
06:08.890 Android Debug Bridge version 1.0.29
06:08.921 Starting ADB server...
06:13.671 Waiting for device...
06:14.171 Device Found: HT22XXXXXXXX
06:14.218 Connected
06:14.234 Receiving phone info
06:14.250 Waiting for data...
06:14.281 Waiting for boot completion...
06:18.296 Waiting for device id...
06:22.250 Getting data...
06:42.531 <b>Serial Number:</b> HT22XXXXXXXX
06:42.562 <b>Android Version:</b> 2.3.5
06:42.609 <b>Manufacturer:</b> HTC
06:42.640 <b>Model:</b> HTC Sensation XL with Beats Audio X315e
06:42.671 <b>Hardware:</b> runnymede
06:42.718 <b>ROM Version:</b> 1.08.415.4
06:42.750 <b>BOOT Version:</b> 1.25.0004
06:42.781 <b>IMEI:</b> 358697-04-xxxxxx-9
06:42.812 <b>CID:</b> HTC__J15 / HTC-GCC
06:42.906 <b>Backup CID:</b> HTC__J15
06:42.937 <b>Linux Kernel Version:</b> 2.6.35.13-g537b6b9
06:42.984 Info received
07:08.562 Repairing CID
07:08.625 Waiting for data...
07:08.640 Waiting for boot completion...
07:09.921 Waiting for device id...
07:11.437 Getting data...
07:22.156 Getting table...
07:25.531 Getting Root Privileges...
07:26.312 Probing #1...
07:27.093 [255][rm failed for /data/local/tmp/*, No such file or directory]
07:27.906 [255][rm failed for /data/local/tmp/lgtool.root, No such file or directory]
07:31.593 Sending exploit...
08:06.281 Waiting for device...
08:06.953 Device Found: HT22XXXXXXXX
08:14.828 Connecting to server...
08:15.109 Sending data to server...
08:15.203 Receiving data from server...
08:15.437 Reading NVM...
08:28.515 Backuping NVM to file Backups\Sensation XL_nvm_35869704xxxxxx9_2012-4-28_20-8-28.sbf...
08:35.984 Connecting to server...
08:36.171 Sending data to server...
08:36.203 Receiving data from server...
08:38.843 Patching CID: HTC__A07...
08:42.765 Connecting to server...
08:42.968 Sending data to server...
08:43.000 Receiving data from server...
08:43.234 Writing NVM...
08:50.546 Rebooting device...
08:55.125 CID successfully repaired
09:37.187 Repairing Security
09:37.234 Waiting for data...
09:37.250 Waiting for boot completion...
09:38.562 Waiting for device id...
09:39.937 Getting data...
09:50.265 Getting table...
09:53.468 Getting Root Privileges...
09:54.359 Probing #1...
09:56.156 [255][rm failed for /data/local/tmp/lgtool.root, No such file or directory]
10:00.062 Sending exploit...
10:34.562 Waiting for device...
10:36.515 Device Found: HT22XXXXXXXX
10:44.484 Connecting to server...
10:45.812 Sending data to server...
10:45.859 Receiving data from server...
10:46.531 Reading NVM...
11:03.171 Backuping NVM to file Backups\Sensation XL_nvm_35869704xxxxxx9_2012-4-28_20-11-3.sbf...
11:10.640 Connecting to server...
11:10.812 Sending data to server...
11:10.843 Receiving data from server...
11:12.328 Patching Security: S-OFF
11:16.359 Connecting to server...
11:16.546 Sending data to server...
11:16.562 Receiving data from server...
11:16.812 Writing NVM...
11:26.078 Rebooting device...
11:31.328 Security successfully repaired
13:10.359 Removing Root Privileges...
 

alfchin

Senior Member
Mar 15, 2011
95
25
S-OFF is based on the server response to a request, phone must be connected to the same PC as an USB-key. If any USB-key sharing software is detected, then key will be blocked

Code:
06:07.968 Connecting with <b>Sensation XL</b>
06:08.046 In order to connect with phone you should:
06:08.062 1. Install HTC ADB drivers
06:08.093 2. Turn on the phone
06:08.125 3. Enable Debug mode in phone (Settings->Applications->USB Debug)
06:08.140 4. Check your Internet connection
06:08.203 5. Plug USB Cable
06:08.218 WARNING: Don't forget to click "Disconnect" at the end.
06:08.234 Probing ADB Interface...
06:08.890 Android Debug Bridge version 1.0.29
06:08.921 Starting ADB server...
06:13.671 Waiting for device...
06:14.171 Device Found: HT22XXXXXXXX
06:14.218 Connected
06:14.234 Receiving phone info
06:14.250 Waiting for data...
06:14.281 Waiting for boot completion...
06:18.296 Waiting for device id...
06:22.250 Getting data...
06:42.531 <b>Serial Number:</b> HT22XXXXXXXX
06:42.562 <b>Android Version:</b> 2.3.5
06:42.609 <b>Manufacturer:</b> HTC
06:42.640 <b>Model:</b> HTC Sensation XL with Beats Audio X315e
06:42.671 <b>Hardware:</b> runnymede
06:42.718 <b>ROM Version:</b> 1.08.415.4
06:42.750 <b>BOOT Version:</b> 1.25.0004
06:42.781 <b>IMEI:</b> 358697-04-xxxxxx-9
06:42.812 <b>CID:</b> HTC__J15 / HTC-GCC
06:42.906 <b>Backup CID:</b> HTC__J15
06:42.937 <b>Linux Kernel Version:</b> 2.6.35.13-g537b6b9
06:42.984 Info received
07:08.562 Repairing CID
07:08.625 Waiting for data...
07:08.640 Waiting for boot completion...
07:09.921 Waiting for device id...
07:11.437 Getting data...
07:22.156 Getting table...
07:25.531 Getting Root Privileges...
07:26.312 Probing #1...
07:27.093 [255][rm failed for /data/local/tmp/*, No such file or directory]
07:27.906 [255][rm failed for /data/local/tmp/lgtool.root, No such file or directory]
07:31.593 Sending exploit...
08:06.281 Waiting for device...
08:06.953 Device Found: HT22XXXXXXXX
08:14.828 Connecting to server...
08:15.109 Sending data to server...
08:15.203 Receiving data from server...
08:15.437 Reading NVM...
08:28.515 Backuping NVM to file Backups\Sensation XL_nvm_35869704xxxxxx9_2012-4-28_20-8-28.sbf...
08:35.984 Connecting to server...
08:36.171 Sending data to server...
08:36.203 Receiving data from server...
08:38.843 Patching CID: HTC__A07...
08:42.765 Connecting to server...
08:42.968 Sending data to server...
08:43.000 Receiving data from server...
08:43.234 Writing NVM...
08:50.546 Rebooting device...
08:55.125 CID successfully repaired
09:37.187 Repairing Security
09:37.234 Waiting for data...
09:37.250 Waiting for boot completion...
09:38.562 Waiting for device id...
09:39.937 Getting data...
09:50.265 Getting table...
09:53.468 Getting Root Privileges...
09:54.359 Probing #1...
09:56.156 [255][rm failed for /data/local/tmp/lgtool.root, No such file or directory]
10:00.062 Sending exploit...
10:34.562 Waiting for device...
10:36.515 Device Found: HT22XXXXXXXX
10:44.484 Connecting to server...
10:45.812 Sending data to server...
10:45.859 Receiving data from server...
10:46.531 Reading NVM...
11:03.171 Backuping NVM to file Backups\Sensation XL_nvm_35869704xxxxxx9_2012-4-28_20-11-3.sbf...
11:10.640 Connecting to server...
11:10.812 Sending data to server...
11:10.843 Receiving data from server...
11:12.328 Patching Security: S-OFF
11:16.359 Connecting to server...
11:16.546 Sending data to server...
11:16.562 Receiving data from server...
11:16.812 Writing NVM...
11:26.078 Rebooting device...
11:31.328 Security successfully repaired
13:10.359 Removing Root Privileges...
maybe we can use vmware to make it work?
usb share works on the host and let the guest get access to the host's usb.
 
Last edited:
  • Like
Reactions: chrisme14

hannemaster

Senior Member
Oct 4, 2009
226
161
38
Rotterdam
www.hannemaster.nl
hmm...

I don't think remote usb and stuff is the direction we need to go.

I think we need to find out what kind of commands is the LGtool sending. And what kinda files are pushed to the phone for example in this directory:
/data/local/tmp/lgtool.root

is logcat an option? only used it once in my life...

there must be a file somewhere which we can cr@ck open...
 

AndroHero

Senior Member
May 28, 2010
6,476
906
Manchester
hmm...

I don't think remote usb and stuff is the direction we need to go.

I think we need to find out what kind of commands is the LGtool sending. And what kinda files are pushed to the phone for example in this directory:
/data/local/tmp/lgtool.root

is logcat an option? only used it once in my life...

there must be a file somewhere which we can cr@ck open...

we are still trying ways to get unlock over a network working. as i write this. As it stands it looks like it's not going to. That was the next point. We need to find out what exploit LGTool is using, and try and build our own tool.
 

alfchin

Senior Member
Mar 15, 2011
95
25
we are still trying ways to get unlock over a network working. as i write this. As it stands it looks like it's not going to. That was the next point. We need to find out what exploit LGTool is using, and try and build our own tool.

it seems LGTool hide its expoit code on its server.
You send your code of your device to the server,and the server returns a expoit which works on this device only
 

AndroHero

Senior Member
May 28, 2010
6,476
906
Manchester
it seems LGTool hide its expoit code on its server.
You send your code of your device to the server,and the server returns a expoit which works on this device only

It looks like unlock over network is not going to work. We just cant get past "exploit has problems" issue. If SETool thinks this is going to force us all to go out and spend $115 on a SETool box and card, they have another thing comming.

Sent from my HTC Sensation XL with Beats Audio X315e using Tapatalk 2
 

booyaga

Senior Member
Sep 18, 2010
88
13
It looks like unlock over network is not going to work. We just cant get past "exploit has problems" issue. If SETool thinks this is going to force us all to go out and spend $115 on a SETool box and card, they have another thing comming.

Sent from my HTC Sensation XL with Beats Audio X315e using Tapatalk 2

ok, now there is a gameplan, so il Update This post later.

And now we just need to figure out if anything needs to be bought, and if so get a Dev on it and establish a donation thread so we can "split the cost"

Sent from my HTC Sensation XL with Beats Audio X315e using xda premium
 

booyaga

Senior Member
Sep 18, 2010
88
13
If donation is needed, i vote that donators get Access to exploit some time ahead of the rest

Sent from my HTC Sensation XL with Beats Audio X315e using xda premium
 

jMurr

Senior Member
Nov 1, 2009
55
3
Kiev
Is here anyone who can tell that LGETool is working for 100%?
I've heard that it doesn't realy work!
 

claudenegm

Senior Member
Aug 16, 2011
286
148
You need a SETool box and a SETool card with LGTool activation.

Sent from my HTC Sensation XL with Beats Audio X315e using Tapatalk 2

I found this, I'm not sure if what you're saying is right :D I can't confim though, cause I didn't try it ;)
"Please note when you are buying SEtool card you are buying Sonyericsson module ONLY! LGtool Module ( for Servicing HTC, LG, Samsung, Motorola, ZTE, Huawei, Sky phones) is FREE and added only for limited period & for testing purpose."

I didn't have the opportunity to test the application on my PC yet, but I don't like the idea of sending my IMEI and serial number to the server.
Why would they use your IMEI anyway? I don't think it's needed to unlock a bootloader or even to exploit security flags!
 
Last edited:

Jinx13

Senior Member
Apr 24, 2011
348
82
40
Wiltshire/UK
phoneunlockserver.com
I found this, I'm not sure if what you're saying is right :D I can't confim though, cause I didn't try it ;)
"Please note when you are buying SEtool card you are buying Sonyericsson module ONLY! LGtool Module ( for Servicing HTC, LG, Samsung, Motorola, ZTE, Huawei, Sky phones) is FREE and added only for limited period & for testing purpose."

I didn't have the opportunity to test the application on my PC yet, but I don't like the idea of sending my IMEI and serial number to the server.
Why would they use your IMEI anyway? I don't think it's needed to unlock a bootloader or even to exploit security flags!
You cannot run lgtool without setool smartcard ;)

Jinx13
 
  • Like
Reactions: AndroHero

paul.robo

Senior Member
Apr 8, 2012
181
105
Hi, Guys im a programmer and i use exploits and write scrips all the time. ive been looking into the revolutionary exploit latley, it seems to me that with the right amount of time and with enough heads on this. S-off for sensation XL CAN be done. the exploit from the sensation can be modded abit and this WILL work for your device. i am going to speak with the revolutionary team and see if i can put my own input into this. i think if they acctually let me give them my modded exploit and let them test it then it will work. they might want to mod it to their liking but this is a well thought out idea. i am from the desire s forum. im not a sensation XL developer. BUT i got hold of a blocked sensation XL and used it for my exploit. and it didnt work at first but i got it to the point where in the hboot menu it stated s-off but after reboot it was lost. i dont know if the revo team have come accross this before but it really frustrated me because i got so close. if the team accept my exploit im hoping this will go forward. i will let you know when i have spoken to them and ill give you guys an update on how things are progressing as time goes on :) take care guys . 1 other thing. please remember ( DONT donate untill this is official or it is released to the public by revo team. ) have a good evening
 

hannemaster

Senior Member
Oct 4, 2009
226
161
38
Rotterdam
www.hannemaster.nl
Hi, Guys im a programmer and i use exploits and write scrips all the time. ive been looking into the revolutionary exploit latley, it seems to me that with the right amount of time and with enough heads on this. S-off for sensation XL CAN be done. the exploit from the sensation can be modded abit and this WILL work for your device. i am going to speak with the revolutionary team and see if i can put my own input into this. i think if they acctually let me give them my modded exploit and let them test it then it will work. they might want to mod it to their liking but this is a well thought out idea. i am from the desire s forum. im not a sensation XL developer. BUT i got hold of a blocked sensation XL and used it for my exploit. and it didnt work at first but i got it to the point where in the hboot menu it stated s-off but after reboot it was lost. i dont know if the revo team have come accross this before but it really frustrated me because i got so close. if the team accept my exploit im hoping this will go forward. i will let you know when i have spoken to them and ill give you guys an update on how things are progressing as time goes on :) take care guys . 1 other thing. please remember ( DONT donate untill this is official or it is released to the public by revo team. ) have a good evening

Sounds great! keep it up!
 
  • Like
Reactions: paul.robo

Top Liked Posts

  • There are no posts matching your filters.
  • 7
    S-OFF

    I did something today :)


    It's still under development and since DEVs are not willing to help me, I'm doing all this on my own...

    Tested the following commands and they are working:
    erase (system, recovery, boot)
    flash (zip, system, recovery, boot, hboot, radio)
    boot

    I'm checking everything again and will release the modified HBOOT.
    7
    Hi, Guys im a programmer and i use exploits and write scrips all the time. ive been looking into the revolutionary exploit latley, it seems to me that with the right amount of time and with enough heads on this. S-off for sensation XL CAN be done. the exploit from the sensation can be modded abit and this WILL work for your device. i am going to speak with the revolutionary team and see if i can put my own input into this. i think if they acctually let me give them my modded exploit and let them test it then it will work. they might want to mod it to their liking but this is a well thought out idea. i am from the desire s forum. im not a sensation XL developer. BUT i got hold of a blocked sensation XL and used it for my exploit. and it didnt work at first but i got it to the point where in the hboot menu it stated s-off but after reboot it was lost. i dont know if the revo team have come accross this before but it really frustrated me because i got so close. if the team accept my exploit im hoping this will go forward. i will let you know when i have spoken to them and ill give you guys an update on how things are progressing as time goes on :) take care guys . 1 other thing. please remember ( DONT donate untill this is official or it is released to the public by revo team. ) have a good evening
    6
    What is TacoRoot? hmm sounds promising. i will test it

    Check your PMs.

    (We're testing the HBOOT, will update the post with results)

    Edit:

    It seems it worked :) Thanks chrisme14 for testing, he will post a proof screen shot in a minute.
    4
    Guys stop spamming the thread, as soon as anyone has more info it will be posted here. Hopefully, within the next day or 2, me and jinx will attempt a remote unlock If it works I will post details on how you guys can get S-Off.

    This will be a paid method though.

    Sent from my HTC Sensation XL with Beats Audio X315e using Tapatalk 2
    3
    hmm...

    I don't think remote usb and stuff is the direction we need to go.

    I think we need to find out what kind of commands is the LGtool sending. And what kinda files are pushed to the phone for example in this directory:
    /data/local/tmp/lgtool.root

    is logcat an option? only used it once in my life...

    there must be a file somewhere which we can cr@ck open...