Info Mining my Jetstream (hopefully helping devs root it)

Search This thread

cabbykins

Member
May 10, 2011
25
5
Charlotte, NC
[Originally posted in Jetstream General]

So I just got mine, fresh from the store. My permanent device, not the trial unit was using.

Since I love voiding warranties (it's kind of a hobby), I'm going to muck around with the software and see what I can get into. My goal is to stumble across a root method, but I have no idea what I'm doing and will really just be lurking in IRC channels and reading other root guides to see what I can try.

Since I can't post in the development thread yet (stupid lurker status), I'm going to post relevant info here, starting with software versions running on my device.

In Bootloader, I see:
HTC PUCCINILTE PVT SHIP S-ON RL
HBOOT-1.78.0007
eMMC-boot

Standard vol-up/down and power button controls work there, which was to be expected.

Software info:
Android Version: 3.1
HTC Sense version: 1.1 for tablet
Software number: 1.17.502.3

Kernel: 2.6.35.10-g4612ecf
htc-kernel@u18000-build-144 #1

Baseband Version: 1.04.550I.15v2_30.60.550I.10L

Build number: 1.17.502.3CL139056 release-keys

adb shows normal information, but adb reboot recovery doesn't work (not surprising)

Running http://revolutionary.io/ shows the following:
Code:
C:\jetstream>revolutionary.exe
 =============================================
| Revolutionary S-OFF & Recovery Tool 0.4pre4 |
 =============================================
    Brought to you by AlphaRev & unrEVOked.

Waiting for device...
Found your device: HTC PG09410 (puccinilte-1.78.0007, Android: 3.1, ROM version: 1.17.502.3)

Your device: puccinilte, with HBOOT 1.78.0007 is not supported at this time.

Booting into the bootloader and running "fastboot oem ?" provides the following:
Code:
C:\jetstream>fastboot oem ?
...
(bootloader) command list
(bootloader) get_identifier_token
(bootloader) checkSbl1
(bootloader) checkHWSecurity
(bootloader) checkKeycardID
(bootloader) enter
(bootloader) keytest
(bootloader) heap
(bootloader) boot
(bootloader) reset
(bootloader) powerdown
(bootloader) rebootRUU
(bootloader) heap_test
(bootloader) rtask
(bootloader) task
(bootloader) enableqxdm
(bootloader) gencheckpt
(bootloader) readpid
(bootloader) writepid
(bootloader) readcid
(bootloader) writecid
(bootloader) readimei
(bootloader) writeimei
(bootloader) readsecureflag
(bootloader) writesecureflag
(bootloader) lock
(bootloader) list_partition_emmc
(bootloader) load_emmc
(bootloader) check_emmc
(bootloader) check_emmc_mid
(bootloader) read_mmc
(bootloader) load_modem_emmc
(bootloader) get_wp_info_emmc
(bootloader) send_wp_info_emmc
(bootloader) get_ext_csd_emmc
(bootloader) get_sector_info_emmc
OKAY [  0.186s]
finished. total time: 0.187s
Note that there's no "unlock" command as with the xoom. I'm wondering if it's disabled somewhere or just a file change somewhere to get the unlock option in there.


http://www.htcdev.com/bootloader/ doesn't give the option to unlock the Jetstream quite yet :-(


Pulled my build.prop:
Code:
ro.ril.enable.a52=0
ro.ril.enable.a53=1
ro.ril.enable.dtm=0
ro.ril.gprsclass=10
ro.ril.hsdpa.category=14
ro.ril.hsupa.category=6
ro.ril.hsxpa=4
ro.ril.def.agps.mode=5
ro.ril.att.feature=1
ro.ril.disable.fd.plmn.prefix=23402,23410,23411
ro.ril.enable.sdr=0
ro.ril.enable.gea3=1
ro.ril.enable.ucsq=2
ro.ril.enable.sim.hot.swap=1
ro.ril.set.mtusize=1410
ro.ril.reject.cs.ss.enabled=1
ro.ril.reject.mo.sms.enabled=0
ro.ril.reject.mo.ussd.enabled=1
persist.pdn.profile=broadband
ro.com.google.clientidbase=android-htc
ro.com.google.clientidbase.yt=android-htc
ro.com.google.clientidbase.am=android-att-us
ro.com.google.clientidbase.gmm=android-htc
ro.com.google.clientidbase.ms=android-att-us
ro.wifi.hotspotUI=0
ro.tether.denied=true
ro.product.model=HTC PG09410
ro.phone.function=0
ro.monkey=0
ro.sllowmock.location=0
# begin build properties
# autogenerated by buildinfo.sh
ro.aa.rid=191
ro.aa.skulist=502
ro.aa.customizationid=216086
ro.aa.mainsku=502
ro.aa.taskid=210183
ro.aa.romver=1.17.502.3
ro.aa.maincid=CWS__001
ro.aa.cidlist=CWS__001
ro.aa.project=Puccini_LTE
ro.aa.modelid=PG0941000
ro.build.changelist=139056
ro.com.google.clientidbase=android-att-us
ro.aa.rid=191
ro.aa.skulist=502
ro.aa.customizationid=216086
ro.aa.mainsku=502
ro.aa.taskid=210183
ro.aa.romver=1.17.502.3
ro.aa.maincid=CWS__001
ro.aa.cidlist=CWS__001
ro.aa.project=Puccini_LTE
ro.aa.modelid=PG0941000
ro.build.changelist=139056
ro.com.google.clientidbase=android-att-us
ro.build.id=HMJ15
ro.build.display.id=HMJ15
ro.build.version.incremental=137848.3
ro.build.version.sdk=12
ro.build.version.codename=REL
ro.build.version.release=3.1
ro.build.date=三  8月 17 00:02:05 CST 2011
ro.build.date.utc=1313510525
ro.build.type=user
ro.build.user=
ro.build.host=AA138
ro.build.tags=release-keys
ro.product.model=HTC PucciniLte
ro.product.brand=cingular_us
ro.product.name=htc_puccinilte
ro.product.device=puccinilte
ro.product.board=verdilte
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=HTC
ro.product.locale.language=mdpi
ro.wifi.channels=
ro.board.platform=msm8660
# ro.build.product is obsolete; use ro.product.device
ro.build.product=puccinilte
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=1.17.502.3 CL139056 release-keys
ro.build.description=1.17.502.3 CL139056 release-keys
ro.build.changelist=139056
ro.build.fingerprint=cingular_us/htc_puccinilte/puccinilte:3.1/HMJ15/137848.3:user/release-keys
ro.build.characteristics=default tablet tablet
ro.build.project=210183
ro.product.version=1.17.502.3
ro.build.languageremove=0
ro.build.sense.version=2.1
# end build properties
#
# system.prop for puccinilte
#

ro.sf.lcd_density=160

debug.fb.rgb565 = 0

ro.fb.mode = 1

#+HTC_RIL: from QCT Fusion
rild.libpath=/system/lib/libril-qc-qmi-1.so
rild.libargs=-d /dev/smd0
persist.rild.nitz_plmn=
persist.rild.nitz_long_ons_0=
persist.rild.nitz_long_ons_1=
persist.rild.nitz_long_ons_2=
persist.rild.nitz_long_ons_3=
persist.rild.nitz_short_ons_0=
persist.rild.nitz_short_ons_1=
persist.rild.nitz_short_ons_2=
persist.rild.nitz_short_ons_3=
persist.rild.ril.ltedr=0
persist.rild.ril.ltedrtable=max_retries=infinite,10000
DEVICE_PROVISIONED=1
debug.sf.hw=1
#debug.composition.type=c2d

#
# system props for the cne module
#
persist.cne.UseCne=false
persist.cne.bat.range.low.med=30
persist.cne.bat.range.med.high=60
persist.cne.loc.policy.op=/system/etc/OperatorPolicy.xml
persist.cne.loc.policy.user=/system/etc/UserPolicy.xml
persist.cne.bwbased.rat.sel=false
persist.cne.snsr.based.rat.mgt=false
persist.cne.bat.based.rat.mgt=false
persist.cne.be.ge.sqi.min=0
persist.cne.be.ge.sqi.max=100
persist.cne.be.umts.sqi.min=0
persist.cne.be.umts.sqi.max=100
persist.cne.be.hspa.sqi.min=0
persist.cne.be.hspa.sqi.max=100
persist.cne.be.1x.sqi.min=0
persist.cne.be.1x.sqi.max=100
persist.cne.be.do.sqi.min=0
persist.cne.be.do.sqi.max=100
persist.cne.be.wlan.sqi.min=0
persist.cne.be.wlan.sqi.max=100

#
# system props for the data modules
#
ro.use_data_netmgrd=true
persist.data_netmgrd_nint=11

#
# system props for telephony modules
#
#device supports LTE
ro.config.lte=true
#device supports EHRPD
#ro.config.ehrpd=true
#device supports simultaneous 1x voice + LTE
#ro.config.svlte1x=true
#-HTC_RIL: from QCT Fusion

# Modify MMS APN retry timer from 5s to 2s.
ro.gsm.2nd_data_retry_config = max_retries=3, 2000, 2000, 2000

# verdi RF team request
ro.ril.enable.dtm = 0
ro.ril.gprsclass = 12
ro.ril.hsdpa.category = 10
ro.ril.hsupa.category = 6
ro.ril.hsxpa = 3

# Default network type.
# 0 => WCDMA preferred.
ro.telephony.default_network=0

wifi.interface=eth0
wifi.supplicant_scan_interval=15

# The OpenGL ES API level that is natively supported by this device.
# This is a 16.16 fixed point number
ro.opengles.version = 131072

# This is a high density device with more memory, so larger vm heaps for it.
dalvik.vm.heapsize=256m
dalvik.vm.heapgrowthlimit=48m

# For the default value of agps
ro.ril.def.agps.mode = 2

# For HSDPA low throughput
ro.ril.disable.power.collapse = 1

# For Pyramid China NEL
ro.ril.enable.prl.recognition = 1

# For emmc phone storage
ro.phone_storage = 0
# For ext4 file system
ro.ext4fs = 1

# For FOTA setting (leave empty value to use default)
ro.htc.checkin.url = http://andchin.htc.com/android/checkin
ro.htc.checkin.crashurl = http://andchin.htc.com/android/crash
ro.htc.checkin.url_CN = http://andchin.htccomm.com.cn/android/checkin
ro.htc.checkin.crashurl_CN = http://andchin.htccomm.com.cn/android/crash
ro.htc.checkin.exmsg.url = http://fotamsg.htc.com/android/extra/
ro.htc.checkin.exmsg.url_CN = http://fotamsg.htccomm.com.cn/android/extra/

# Release Bluetooth HW/SW information
ro.bt.chipset	= Broadcom BCM4329-B1
ro.bt.version	= Bluetooth 2.1 + EDR
ro.bt.stack	= Broadcom BTL-A
ro.bt.stack.version	= 2.0.50.032
#0x10000010010100100000011 represent bt profile list
ro.bt.profiles	= 4270339

# Properties of BTLA stack
service.brcm.bt.activation = 0
service.brcm.bt.srv_active = 0
service.brcm.bt.hcid_active = 0
service.brcm.bt.btld = 0
service.brcm.bt.btld_pid = 0
service.brcm.bt.bluetoothd_pid = 0
service.brcm.bt.avrcp_pass_thru = 0
service.brcm.bt.avrcp_toggle = 1
service.brcm.bt.ag_supported = 0

# Following property will be reference by Settings.
ro.product.bluetooth = 3.0

# For quick boot mode
persist.sys.shutdown.mode = hibernate

# Temporary workaround [Arthur]
# profiler.checkheap = 0
profile_freeNativeBmp = 0

# ABL
htc.abl.enable = 0

# unlock keyguard when SIM is non-inserted
keyguard.no_require_sim=1

# Dump native call stack when an ANR happens to com.htc.launcher.
profiler.anr_dump_native_uid = 9999

# Following property will be reference by Settings.
ro.product.processor = 1.5 GHz dualcore
ro.product.ram = 1GB
ro.product.display_resolution = 10.1 inch WXGA resolution
ro.product.main_camera = 8M
ro.product.front_camera = 1.3M
ro.product.bluetooth = 3.0
ro.product.wifi = 802.11 a/b/g/n

# support USB Host
ro.usb_host = 1

# For opensense sdk
ro.htc.common.version = 3.0.0.0

# For matching the sample rate of touch driver
windowsmgr.max_events_per_sec=70

# Extend key dispatching timeout
keydispatchtimeout = 15000

#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.setupwizard.mode=OPTIONAL
ro.config.ringtone=QuietlyBrilliant.mp3
ro.config.notification_sound=Zeta.mp3
ro.config.alarm_alert=NewDay.mp3
ro.config.cal_notification=Epsilon.mp3
ro.config.msg_notification=Gamma.mp3
ro.setupwizard.mode=DISABLED
ro.com.google.gmsversion=3.1_r2
htc.audio.alt.enable=1
htc.audio.hac.enable=0
drm.service.enabled=true
ro.marlin.drm.service.enabled=true
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
Interesting build.prop notes:
lines 25/26:
ro.wifi.hotspotUI=0
ro.tether.denied=true

lines 234-236 (Was Arthur supposed to fix this before release?):
# Temporary workaround [Arthur]
# profiler.checkheap = 0
profile_freeNativeBmp = 0


In watching logcat, it's constantly trying to connect to AT&T's LTE network. Except that I haven't activated the service and under System Settings I have Mobile Network disabled. I'm sure that's working out great for my battery.


Results of a "df" command in shell
Code:
$ df
df
Filesystem             Size   Used   Free   Blksize
/dev                   406M    64K   406M   4096
/system               1007M   718M   289M   4096
/data                   11G   390M    11G   4096
/cache                 314M     5M   309M   4096
/devlog                 31M    10M    21M   4096
/vendor/firmware/misc   199M    21M   178M   4096
/vendor/firmware/misc_mdm   199M    27M   171M   4096
/mnt/asec              406M     0K   406M   4096
/mnt/obb               406M     0K   406M   4096
/data/DxDrm/fuse: Permission denied

Here's a dump of /system/app/
Code:
$ ls
ls
ATTAPNWidget_1.1.63.apk
ATT_FamilyMap_stub.apk
ATT_Navigator_stub.apk
ATT_code_scanner_vpl_1.2_aligned.apk
AndroidMoviesClub_att_vpl_1.0.0.0004.apk
AndroidWispr1.17.apk
AppSharing.apk
AppSharing.odex
ApplicationsProvider.apk
ApplicationsProvider.odex
Bluetooth.apk
Bluetooth.odex
BooksTablet.apk
BrcmBluetoothServices.apk
BrcmBluetoothServices.odex
Browser.apk
Browser.odex
Burgundy.apk
CSPeopleSyncService.apk
CSPeopleSyncService.odex
Calculator.apk
Calculator.odex
Calendar.apk
Calendar.odex
CalendarProvider.apk
CalendarProvider.odex
CertInstaller.apk
CertInstaller.odex
CheckinProvider.apk
CheckinProvider.odex
ChromeBookmarksSyncAdapter.apk
ContactsProvider.apk
ContactsProvider.odex
CustomizationSettingsProvider.apk
CustomizationSettingsProvider.odex
CustomizationSetup.apk
CustomizationSetup.odex
DFPI.apk
DFPI.odex
DefaultContainerService.apk
DefaultContainerService.odex
DmClient.apk
DockMode.apk
DockMode.odex
DownloadProvider.apk
DownloadProvider.odex
DownloadProviderUi.apk
DownloadProviderUi.odex
DrmProvider.apk
DrmProvider.odex
Facebook.apk
FilePicker.apk
FilePicker.odex
Finsky.apk
Flickr.apk
Flickr.odex
FriendStream.apk
FriendStream.odex
FusionStockWidget.apk
FusionStockWidget.odex
GameWorld-1.0.7.apk
Gmail.apk
GoogleBackupTransport.apk
GoogleCalendarSyncAdapter.apk
GoogleContactsSyncAdapter.apk
GoogleFeedback.apk
GoogleLoginService.apk
GooglePartnerSetup.apk
GoogleQuickSearchBox.apk
GoogleServicesFramework.apk
GreenImmersion.apk
HTCAlbum.apk
HTCAlbum.odex
HTCCamera.apk
HTCCamera.odex
HTCLivewallpaperStreak.apk
HTCLivewallpaperStreak.odex
HTCPDFViewer.apk
HTCPDFViewer.odex
HTCSetupWizard.apk
HTCSetupWizard.odex
HTCSync.apk
HTC_IME.apk
HTC_IME.odex
HTMLViewer.apk
HTMLViewer.odex
HoloSpiralWallpaper.apk
HoloSpiralWallpaper.odex
HomePersonalize.apk
HomePersonalize.odex
HtcAutoRotateWidget.apk
HtcAutoRotateWidget.odex
HtcBackgroundDataWidget.apk
HtcBackgroundDataWidget.odex
HtcCalculatorWidget.apk
HtcCalculatorWidget.odex
HtcClock3DWidget.apk
HtcClock3DWidget.odex
HtcCompressViewer.apk
HtcCompressViewer.odex
HtcConnectedMedia.apk
HtcConnectedMedia.odex
HtcContacts.apk
HtcContacts.odex
HtcDLNAMiddleLayer.apk
HtcDLNAMiddleLayer.odex
HtcDMC.apk
HtcDMC.odex
HtcDataRoamingWidget.apk
HtcDataRoamingWidget.odex
HtcDataStripWidget.apk
HtcDataStripWidget.odex
HtcDialer.apk
HtcDialer.odex
HtcDirect.apk
HtcDirect.odex
HtcDm.apk
HtcDm.odex
HtcDmSettingWidget.apk
HtcDmSettingWidget.odex
HtcFacebook.apk
HtcFacebook.odex
HtcFeedback.apk
HtcFeedback.odex
HtcFootprints.apk
HtcFootprints.odex
HtcFootprintsWidget3d.apk
HtcFootprintsWidget3d.odex
HtcGreader.apk
HtcGreader.odex
HtcGreaderWidget.apk
HtcGreaderWidget.odex
HtcHubSyncProvider.apk
HtcHubSyncProvider.odex
HtcImageWallpaper.apk
HtcImageWallpaper.odex
HtcLocationPicker.apk
HtcLocationPicker.odex
HtcLocationService.apk
HtcLocationService.odex
HtcLockScreen.apk
HtcLockScreen.odex
HtcLoggers.apk
HtcLoggers.odex
HtcMessageProvider.apk
HtcMessageProvider.odex
HtcMessageUploader.apk
HtcMessageUploader.odex
HtcMusic.apk
HtcMusic.odex
HtcMusicEnhancer.apk
HtcMusicEnhancer.odex
HtcMusicMarkedItems.apk
HtcMusicMarkedItems.odex
HtcNotes.apk
HtcNotes.odex
HtcNotesProvider.apk
HtcNotesProvider.odex
HtcPhotoGridWidget3D.apk
HtcPhotoGridWidget3D.odex
HtcPhotoWidget.apk
HtcPhotoWidget.odex
HtcPowerStripWidget.apk
HtcPowerStripWidget.odex
HtcProfileWidget.apk
HtcProfileWidget.odex
HtcRecommends.apk
HtcRecommends.odex
HtcRecommendsWidget.apk
HtcRecommendsWidget.odex
HtcResetNotify.apk
HtcResetNotify.odex
HtcRichNotesWidget3D.apk
HtcRichNotesWidget3D.odex
HtcScreenBrightnessWidget.apk
HtcScreenBrightnessWidget.odex
HtcScreenTimeoutWidget.apk
HtcScreenTimeoutWidget.odex
HtcSettingsProvider.apk
HtcSettingsProvider.odex
HtcSoundRecorder.apk
HtcSoundRecorder.odex
HtcSoundSetDownloadManager.apk
HtcSoundSetDownloadManager.odex
HtcStreamPlayer.apk
HtcStreamPlayer.odex
HtcTipWidget.apk
HtcTipWidget.odex
HtcTwitter.apk
HtcTwitter.odex
HtcWeather3DWidget.apk
HtcWeather3DWidget.odex
HtcWeatherWallpaper.apk
HtcWeatherWallpaper.odex
IdleScreen_Weather.apk
IdleScreen_Weather.odex
Idlescreen_Base.apk
Idlescreen_Base.odex
JETCET_PRINT_Resources.apk
JETCET_PRINT_T11.apk
KidMode.apk
Kindle_STUB.apk
LGolf2HD_HEP_HTC_Puccini_ATT_ML_102.apk
LMW.apk
LMW.odex
LiveWallpapersPicker.apk
LiveWallpapersPicker.odex
Mail.apk
Mail.odex
Maps.apk
MarketUpdater.apk
MediaProvider.apk
MediaProvider.odex
MediaUploader.apk
MyHTC.apk
MyHTC.odex
MyPen.apk
MyPen.odex
MyPenTips.apk
MyPenTips.odex
MyReportAgent.apk
MyReportAgent.odex
MySketcher.apk
MySketcher.odex
NFSShift_signed_submission.apk
NetworkLocation.apk
OneTimeInitializer.apk
OnlineAssetDetails.apk
OnlineAssetDetails.odex
PCSC.apk
PCSC.odex
PCSCSettingWidget.apk
PCSCSettingWidget.odex
PRAndroid.apk
PackageInstaller.apk
PackageInstaller.odex
Phone.apk
Phone.odex
PicoTts.apk
PicoTts.odex
PluginManager.apk
PluginManager.odex
PolarisOffice.apk
QXDM2SD.apk
QXDM2SD.odex
QuickLookup.apk
QuickLookup.odex
Rosie.apk
Rosie.odex
Settings.apk
Settings.odex
SettingsProvider.apk
SettingsProvider.odex
SetupWizard.apk
SoundHound_Freemium.apk
Stk.apk
Stk.odex
Stock.apk
Stock.odex
Street.apk
SystemUI.apk
SystemUI.odex
Talk.apk
TaskManager.apk
TaskManager.odex
TelephonyProvider.apk
TelephonyProvider.odex
Transfer-puccini-8.31.0.40-Stablet11.apk
TrimIt.apk
TtsService.apk
TtsService.odex
Twitter.apk
Updater.apk
Updater.odex
UpgradeSetup.apk
UpgradeSetup.odex
UploadProvider.apk
UploadProvider.odex
UserDictionaryProvider.apk
UserDictionaryProvider.odex
Vending.apk
VoiceSearch.apk
WatchApp.apk
WatchApp.odex
Weather.apk
Weather.odex
WeatherAgentService.apk
WeatherAgentService.odex
WeatherLiveWallpaper.apk
WeatherLiveWallpaper.odex
WeatherProvider.apk
WeatherProvider.odex
WeatherSyncProvider.apk
WeatherSyncProvider.odex
WifiRouter.apk
WifiRouter.odex
WorldClock.apk
WorldClock.odex
YPMAndroid_VPL-release_287.apk
YouTubeTablet.apk
ZinioReader.v1.01.3587.VPL.apk
com.htc.FriendStream3DWidget.apk
com.htc.FriendStream3DWidget.odex
com.htc.MusicWidget.apk
com.htc.MusicWidget.odex
com.htc.Sync3DWidget.apk
com.htc.Sync3DWidget.odex
com.htc.TrendsWidget.apk
com.htc.TrendsWidget.odex
com.htc.Twitter3DWidget.apk
com.htc.Twitter3DWidget.odex
fusion.apk
fusion.odex
htcbookmarkwidget3d.apk
htcbookmarkwidget3d.odex
htccalendarwidgets3d.apk
htccalendarwidgets3d.odex
htccontactwidgets3D.apk
htccontactwidgets3D.odex
htcmailwidgets3d.apk
htcmailwidgets3d.odex
htcsettingwidgets.apk
htcsettingwidgets.odex
htcwatchwidget3d.apk
htcwatchwidget3d.odex
idlescreen_blank.apk
idlescreen_blank.odex
idlescreen_shortcut.apk
idlescreen_shortcut.odex
install_flash_player.apk
myATTWebLaunch_v2_aligned.apk
restartapp.apk
restartapp.odex
tabletv2-98_aligned.apk
teeter.apk
teeter.odex


Here's a dump of /system/bin/
Code:
$ cd bin
cd bin
$ ls
ls
3D_calibration
DmWrapperTest
DxDrmServerIpc
PktRspTest
adb
akmd
am
app_process
applypatch
ash
awb_camera
bluetoothd
bma150_usr
bmgr
bootanimation
bootcomplete
btld
bugreport
cam_ins_spmo
cat
charging
chmod
chown
cmp
dalvikvm
date
dbus-daemon
dcvs
dcvsd
dd
debuggerd
dexopt
df
dhcpcd
diag_klog
diag_mdlog
dmagent
dmesg
dnsmasq
drmserver
ds_fmc_appd
dumpstate
dumpsys
fsck_msdos
fusermount
getevent
getprop
gzip
hciattach
hd
hdmid
htc_ebdlogd
htc_ext4_fsck
htcfs
id
ifconfig
iftop
ime
input
insmod
installd
ioctl
ionice
ip
ipd
iptables
keystore
kill
ks
linker
ln
load-modem.sh
log
logcat
logcat2
logwrapper
ls
lsc_camera
lsmod
lsof
make_ext4fs
mediaserver
mkdir
mm-audio-acdb-test
mm-audio-alsa-test
mm-jpeg-dec-test
mm-jpeg-enc-test
mm-qcamera-testsuite-client
mm-qcamera-testsuite-client-aw
mm-vdec-omx-test
mm-venc-omx-test720p
mm-video-driver-test
mm-video-encdrv-test
mmcamera_test
monkey
mount
mpdecision
mtpd
mv
nandread
ndc
netcfg
netd
netmgrd
netsharing
netstat
newfs_msdos
nl_listener
notify
ntrig_touchd
omx_tests
pand
ping
pm
port-bridge
pppd
printenv
ps
qcks
qmiproxy
qmuxd
racoon
ramdump-9K.sh
ramdump2sd-9K.sh
reboot
renice
rild
rm
rmdir
rmmod
rmt_storage
route
run-as
schedtest
schedtop
screencap
screenshot
sdcard
sdptool
sendevent
service
servicemanager
setconsole
setprop
sh
shutdown
simg2img
sleep
smd
sound8x60
start
stop
surfaceflinger
svc
sync
system_server
tc
test_diag
test_gemini
thermald
toolbox
top
udhcpd
umount
uptime
usbhub
usbhub_init
vdc
vmstat
vold
watchprops
wipe
wpa_supplicant
zchgd

File dump of /dev/
Code:
cd /dev
$ ls
ls
akm8975_aot
akm8975_daemon
alarm
android_adb
android_adb_enable
android_mtp_tunnel
ashmem
audience_a1028
binder
block
bma150
bthid
codec_aic3254
console
cpu_dma_latency
cpuctl
device-mapper
diag
diag_arm9
diag_mdm
dsp_debug
full
fuse
gemini0
graphics
htc-acoustic
htc-portlist
htc_simhotswap
htcdiag
hw_random
i2c-1
i2c-4
i2c-5
input
keychord
kgsl-2d0
kgsl-2d1
kgsl-3d0
kmsg
lightsensor
log
mdm
msm_aac
msm_aac_in
msm_acdb
msm_adc
msm_amrnb_in
msm_audio_dev_ctrl
msm_camera
msm_dsps
msm_evrc_in
msm_fm
msm_mvs
msm_pcm_in
msm_pcm_lp_dec
msm_pcm_out
msm_qcelp_in
msm_rotator
msm_vidc_dec
msm_vidc_enc
msm_vidc_reg
msm_wma
msm_wmapro
network_latency
network_throughput
ntrig_touch
null
oncrpc
perflock
pmem
pmem_adsp
pmem_audio
pmem_smipool
ppp
ptmx
pts
radio_feedback
random
rfkill
rmt_storage
rtc0
sdio_al_test
sdioctl0
sdioctl1
sdioctl2
sdioctl3
sdioctl4
sdioctl5
sdioctl6
sdioctl7
sdioctl8
sdiotty0
simlock
smd0
smd21
smd22
smd27
smd36
smd7
smd9
smd_pkt_loopback
smd_sns_dsps
smdcntl0
smdcntl1
smdcntl2
smdcntl3
smdcntl4
smdcntl5
smdcntl6
smdcntl7
snd
socket
system_bus_freq
tpa2026
tpa2028
tty
ttyHS0
ttyHSL0
ttyHSL1
ttyHSUSB0
ttyHSUSB1
ttyHSUSB2
ttyntrig-debug
tun
uinput
urandom
usb_accessory
zero
$

I've joined (and am the only person in) #jetstreamdev on freenode IRC. Come find me there if you want to work with me interactively on this :)

That's all I've got so far. I'm going to keep digging around in here with adb and such. If anybody has an suggestions (and real devs want to provide insight?) I'll gladly try things out.
 
Last edited:

cabbykins

Member
May 10, 2011
25
5
Charlotte, NC
Just got off the phone with HTC, they said that their internal policy is to have the bootloader unlock method on their dev site within 180 days of the device launch.

So, failing the community finding it, HTC will unlock it within the next 5 months.

I've also got a call in to their development team to ask about the process early, we'll see if that gets me anywhere.

Anybody have any other suggestions?

Sent from my HTC PG09410 using XDA App
 

DanMc85

Senior Member
Jan 6, 2008
631
264
USA
Just got off the phone with HTC, they said that their internal policy is to have the bootloader unlock method on their dev site within 180 days of the device launch.

So, failing the community finding it, HTC will unlock it within the next 5 months.

I've also got a call in to their development team to ask about the process early, we'll see if that gets me anywhere.

Anybody have any other suggestions?

Sent from my HTC PG09410 using XDA App

I was talking in a chat with the guys who made Revolutionary a few weeks ago as I got my jetstream on launch day and gave them some info from it. They believe the bootloader version was to old to support the website unlock.

INFOversion: 0.5
INFOversion-bootloader: 1.78.0007
INFOversion-baseband: N/A
INFOversion-cpld: None
INFOversion-microp: None
INFOversion-main: 1.17.502.3
INFOserialno: HT18SVD00***
INFOimei: 3571210400*****
INFOproduct: puccinilte
INFOplatform: HBOOT-8260
INFOmodelid: PG0941000
INFOcidnum: CWS__001
INFObattery-status: good
INFObattery-voltage: 3687mV
INFOpartition-layout: Generic
INFOsecurity: on
INFObuild-mode: SHIP
INFOboot-mode: FASTBOOT
INFOcommitno-bootloader: 8ebb8b6c
INFOhbootpreupdate: 11
INFOgencheckpt: 0

- Dan
 

idanfima

Senior Member
May 18, 2010
241
93
Kefar Shmuel
Well I tried some stuff to root it, but got no luck...
Guys did you got the big "*** LOCKED ***" written inside your HBOOT?

I think that the only persons who will be able to help us is Revolutionary team...
 

cookiesowns

Member
Apr 9, 2010
40
1
Irvine CA
Hope someone cracks the code to root it.

I think I just hit a gold mine. I got my hands on a developers Htc jetstream. It's already rooted, with dev tools. I won't leak too much, and considering I don't have access to a USB cable I don't believe I'll be able to info mine. But hopefully this helps.

Some preliminary stuff:

Android Version: 3.1

HTC Sense: 1.1 for tablet

Software version: 1.20.0.0

Kernal Version: 2.6.35.10-g0478d3htc-kernal@*snipped* (has information regarding this device, and which one it is) it was built last week of August.

Build number 1.20.0.0

Info from root check.

Congratulations! You have root access!

Superuser.apk - com.noshufou.android.su - version 3.0.2 is installed!

System Environment PATH: /sbin /vendor/bin /system/sbin /system/bin /system/xbin

The adb binary is set to default shell user access as root

Standard su binary location: ls -l /system/bin/su:

/system/bin/su: No such file or directory

Standard su binary location: ls -l /system/xbin/su:
-rwsr-sr-x root root 22228 2011-10-06 23:54 su

Alternate su binary location:
/sbin/su: Permission denied

Alternate su type binary location:
/system/xbin/sudo: No such file or directory

Root user id:
uid=0(root)

Root group id:
gid=0(root)


Results provided on your HTC PG09410 device by Root Checker version
3.7 from joeykrim in the Android Market - http://goo.gl/GgWae
 
Last edited:
  • Like
Reactions: cabbykins

cookiesowns

Member
Apr 9, 2010
40
1
Irvine CA
Awesome, cookiesowns! What are the chances you will be able to get at it with a USB cable to grab as much data as possible?

Well, I'll only be playing with the stream for a short days, and the cable is quite expensive. Plus, it's a HTC dev machine, and I can already tell the firmware, kernal, and what not has tag keys, so HTC can track down which machine it was leaked from.

Does anyone know how to access the bootloader though? I tried volume up, down, and both, doesn't seem to enter boot loader.
 

cabbykins

Member
May 10, 2011
25
5
Charlotte, NC
Volume down during a reboot gets me into fastboot, from there it has an option to reboot into a very basic recovery. Of.coure, using a usb cable with adb works as well.

Does the dev unit not use a normal micro usb cable? I know the cable it comes with looks funny, but a normal micro usb cable works fine as well.

Sent from my HTC PG09410 using XDA App
 

cookiesowns

Member
Apr 9, 2010
40
1
Irvine CA
Volume down during a reboot gets me into fastboot, from there it has an option to reboot into a very basic recovery. Of.coure, using a usb cable with adb works as well.

Does the dev unit not use a normal micro usb cable? I know the cable it comes with looks funny, but a normal micro usb cable works fine as well.

Sent from my HTC PG09410 using XDA App

Your right. It does work! my Micro USB from my HD2 works, and I'm in bootloader! Jack pot! hopefully you're on irc, as this is new waters for me.

*** LOCKED ***
PUCCINILTE PVT ENG S-OFF RH
HBOOT-1.78.2010
eMMC-boot
Aug 30 2011


C:\Windows\system32>cd C:/Jetstream

C:\Jetstream>revolutionary.exe
=============================================
| Revolutionary S-OFF & Recovery Tool 0.4pre4 |
=============================================
Brought to you by AlphaRev & unrEVOked.

Waiting for device...
Found your device: HTC PG09410 (puccinilte-1.78.2010, Android: 3.1, ROM version:
1.20.0.0)

Your device is already S-OFF, what exactly do you think you're doing? Not settin
g S-OFF.

Do you want to download (Internet connection required) and flash ClockworkMod Re
covery? [Y/n]

Code:
A ls command on /dev/
# ls
ls
akm8975_aot
akm8975_daemon
alarm
android_adb
android_adb_enable
android_mtp_tunnel
ashmem
audience_a1028
binder
block
bma150
bthid
codec_aic3254
console
cpu_dma_latency
cpuctl
device-mapper
diag
diag_arm9
diag_mdm
dsp_debug
full
fuse
gemini0
graphics
htc-acoustic
htc-portlist
htc_simhotswap
htcdiag
htcdrm
hw_random
i2c-1
i2c-4
i2c-5
input
keychord
kgsl-2d0
kgsl-2d1
kgsl-3d0
kmsg
lightsensor
log
mdm
msm_aac
msm_aac_in
msm_acdb
msm_adc
msm_amrnb_in
msm_audio_dev_ctrl
msm_camera
msm_dsps
msm_evrc_in
msm_fm
msm_mvs
msm_pcm_in
msm_pcm_lp_dec
msm_pcm_out
msm_qcelp_in
msm_rotator
msm_vidc_dec
msm_vidc_enc
msm_vidc_reg
msm_wma
msm_wmapro
network_latency
network_throughput
ntrig_analysis
ntrig_touch
null
oncrpc
perflock
pmem
pmem_adsp
pmem_audio
pmem_smipool
ppp
ptmx
pts
radio_feedback
random
rfkill
rmt_storage
rtc0
sdio_al_test
sdioctl0
sdioctl1
sdioctl2
sdioctl3
sdioctl4
sdioctl5
sdioctl6
sdioctl7
sdioctl8
sdiotty0
simlock
smd0
smd21
smd22
smd27
smd36
smd7
smd9
smd_pkt_loopback
smd_sns_dsps
smdcntl0
smdcntl1
smdcntl2
smdcntl3
smdcntl4
smdcntl5
smdcntl6
smdcntl7
snd
socket
system_bus_freq
tpa2026
tpa2028
tty
ttyHS0
ttyHSL0
ttyHSL1
ttyHSUSB0
ttyHSUSB1
ttyHSUSB2
ttyntrig-debug
tun
uinput
urandom
usb_accessory
zero

This is where it gets interesting. "Fastboot oem ?"
Code:
C:\platform-tools>fastboot oem ?
...
(bootloader) command list
(bootloader) mb
(bootloader) mh
(bootloader) mw
(bootloader) ew
(bootloader) eh
(bootloader) eb
(bootloader) mmu
(bootloader) ram_test
(bootloader) jump
(bootloader) test
(bootloader) sdtest
(bootloader) eraseconfig
(bootloader) writeconfig
(bootloader) readconfig
(bootloader) writesku
(bootloader) readsku
(bootloader) rflash
(bootloader) tflash
(bootloader) block_test
(bootloader) partition_test
(bootloader) rbchk
(bootloader) erasesd
(bootloader) btrouter
(bootloader) nfcrouter
(bootloader) nfcreader
(bootloader) nfccard
(bootloader) nfcversion
(bootloader) nfcdl
(bootloader) tick
(bootloader) heaptable
(bootloader) sysinfo
(bootloader) emapi
(bootloader) emapiTest
(bootloader) emapiCountryID
(bootloader) emapiWlanMac
(bootloader) emapiSetDefCal
(bootloader) emapiReadCal
(bootloader) emapiReadbtaddr
(bootloader) lr
(bootloader) imgcrc
(bootloader) resetautoimage
(bootloader) resetpreferdiag
(bootloader) resetRUUflag
(bootloader) writeserialno
(bootloader) readserialno
(bootloader) battcheck
(bootloader) enter
(bootloader) gotofastboot
(bootloader) gotohboot
(bootloader) writemid
(bootloader) usbtestmode
(bootloader) eraseWifiFlash
(bootloader) erase
(bootloader) readmbserialno
(bootloader) listpartition
(bootloader) erasebcid
(bootloader) writebcid
(bootloader) readbcid
(bootloader) fmrouter
(bootloader) fmtx
(bootloader) resetuP
(bootloader) bdaddress
(bootloader) readbdaddr
(bootloader) resetgift
(bootloader) wMfgTp
(bootloader) rMfgTp
(bootloader) emptypagecheck
(bootloader) saveprt2sd
(bootloader) savemem2sd
(bootloader) savefb2sd
(bootloader) emapiInit
(bootloader) emapiChannel
(bootloader) emapiBand
(bootloader) emapiRate
(bootloader) emapiRateset
(bootloader) emapiCountry
(bootloader) emapiTXpwr1
(bootloader) emapiPkteng_start
(bootloader) emapiPkteng_stop
(bootloader) emapiOut
(bootloader) emapiFqacurcy
(bootloader) emapiCrsuprs
(bootloader) emapiUp
(bootloader) emapiDown
(bootloader) emapiMpc
(bootloader) emapiCounters
(bootloader) emapiVersion
(bootloader) emapiEtheraddr
(bootloader) emapinRate
(bootloader) emapiSetIrqPin
(bootloader) usblog
(bootloader) bkflash2emmc
(bootloader) fl
(bootloader) loaddiag
(bootloader) lnb
(bootloader) init_a1026_fw
(bootloader) checkKeyCard
(bootloader) loopback
(bootloader) spitest
(bootloader) i2ctest
(bootloader) pmic8058_led_test
(bootloader) ats
(bootloader) gpiow
(bootloader) gpior
(bootloader) clock
(bootloader) i2cr
(bootloader) i2cw
(bootloader) i2ctest
(bootloader) ulpi
(bootloader) changeCid
(bootloader) powertest
(bootloader) read_l2_acc_fuse
(bootloader) ltetest
(bootloader) sdio_loopback
(bootloader) sdio_setsize
(bootloader) sdio_readblk
(bootloader) sdio_writeblk
(bootloader) sdio_readblk
(bootloader) sdio_dumpreg
(bootloader) get_mdm9k_serial
(bootloader) clear_mdm9k_serial
(bootloader) set_mdm9k_serial
(bootloader) update_prkey
(bootloader) emmc_boot
(bootloader) 8x60i2cr
(bootloader) 8x60i2crNoAddr
(bootloader) 8x60i2cwNoAddr
(bootloader) 8x60i2cw
(bootloader) poweron
(bootloader) poweroff
(bootloader) setvol
(bootloader) spi
(bootloader) fat
(bootloader) pmgpiow
(bootloader) pmgpior
(bootloader) 8058vregon
(bootloader) 8058vregoff
(bootloader) 8058vregw
(bootloader) 8058vregr
(bootloader) 8901vregon
(bootloader) 8901vregoff
(bootloader) 8901vregw
(bootloader) 8901vregr
(bootloader) mipi_test
(bootloader) chargeron
(bootloader) chargeroff
(bootloader) adc
(bootloader) readsimlocktype
(bootloader) enablesimlock
(bootloader) addsimlockcode
(bootloader) clearsimlockcode
(bootloader) listsimlockcode
(bootloader) clearunlockrecord
(bootloader) lite_heap_test
(bootloader) vibrate_test
(bootloader) getrtc
(bootloader) setrtc
(bootloader) getrtcalarm
(bootloader) setrtcalarm
(bootloader) pgfs
(bootloader) bumpclk
(bootloader) acpuclk_get
(bootloader) acpuclk_set
(bootloader) rpmclk_set
(bootloader) rpmclk_get
(bootloader) oschalt
(bootloader) tz_req
(bootloader) blow_efuse
(bootloader) blow_qfuse_cfg
(bootloader) dump_tzlog
(bootloader) fdisk_emmc
(bootloader) set_partition_emmc
(bootloader) erase_emmc
(bootloader) test_emmc
(bootloader) sector_erase_emmc
(bootloader) fat_format_emmc
(bootloader) init_emmc
(bootloader) reinit_emmc
(bootloader) write_mmc
(bootloader) set_wp_emmc
(bootloader) write_prot_test
(bootloader) clear_wp_emmc
(bootloader) set_enh_area_emmc
(bootloader) ntrigsetcal
(bootloader) get_identifier_token
(bootloader) checkSbl1
(bootloader) checkHWSecurity
(bootloader) checkKeycardID
(bootloader) enter
(bootloader) keytest
(bootloader) heap
(bootloader) boot
(bootloader) reset
(bootloader) powerdown
(bootloader) rebootRUU
(bootloader) heap_test
(bootloader) rtask
(bootloader) task
(bootloader) enableqxdm
(bootloader) gencheckpt
(bootloader) readpid
(bootloader) writepid
(bootloader) readcid
(bootloader) writecid
(bootloader) readimei
(bootloader) writeimei
(bootloader) readsecureflag
(bootloader) writesecureflag
(bootloader) lock
(bootloader) list_partition_emmc
(bootloader) load_emmc
(bootloader) check_emmc
(bootloader) check_emmc_mid
(bootloader) read_mmc
(bootloader) load_modem_emmc
(bootloader) get_wp_info_emmc
(bootloader) send_wp_info_emmc
(bootloader) get_ext_csd_emmc
(bootloader) get_sector_info_emmc
OKAY [  0.225s]
finished. total time: 0.226s
 
Last edited:

cabbykins

Member
May 10, 2011
25
5
Charlotte, NC
Wow, your fastboot oem command has a lot more options. I'm in IRC now, but don't know how much help I can be, as I'm just getting into this scene myself. I'll be on for the rest of the day, tomorrow is looking bad for my schedule (flying to memphis to set up a convention, then flying back home tomorrow night fir surgery wednesday).

Once thursday rolls around, though, I should have plenty of time to sit around and use the computer :-D
 

DanMc85

Senior Member
Jan 6, 2008
631
264
USA
it would be awesome if there was a way to rip and download just that S-OFF bootloader from the device...
 

cabbykins

Member
May 10, 2011
25
5
Charlotte, NC
it would be awesome if there was a way to rip and download just that S-OFF bootloader from the device...

Indeed, but we would still need to figure out a way to unlock the device before we could think about flashing the bootloader. I didn't see the unlock command in cookiesowns' "fastboot oem" command still, or anything that looked like it might work.
 

DanMc85

Senior Member
Jan 6, 2008
631
264
USA
Indeed, but we would still need to figure out a way to unlock the device before we could think about flashing the bootloader. I didn't see the unlock command in cookiesowns' "fastboot oem" command still, or anything that looked like it might work.

that's possibily because the bootloader on the puccini doesn't support htc's website unlock tool... like not that it doesn't at the moment, but rather it can't and will not.

---------- Post added at 08:52 PM ---------- Previous post was at 08:47 PM ----------

Your right. It does work! my Micro USB from my HD2 works, and I'm in bootloader! Jack pot! hopefully you're on irc, as this is new waters for me.

*** LOCKED ***
PUCCINILTE PVT ENG S-OFF RH
HBOOT-1.78.2010
eMMC-boot
Aug 30 2011


C:\Windows\system32>cd C:/Jetstream

C:\Jetstream>revolutionary.exe
=============================================
| Revolutionary S-OFF & Recovery Tool 0.4pre4 |
=============================================
Brought to you by AlphaRev & unrEVOked.

Waiting for device...
Found your device: HTC PG09410 (puccinilte-1.78.2010, Android: 3.1, ROM version:
1.20.0.0)

Your device is already S-OFF, what exactly do you think you're doing? Not settin
g S-OFF.

Do you want to download (Internet connection required) and flash ClockworkMod Re
covery? [Y/n]

Code:
A ls command on /dev/
# ls
ls
akm8975_aot
akm8975_daemon
alarm
android_adb
android_adb_enable
android_mtp_tunnel
ashmem
audience_a1028
binder
block
bma150
bthid
codec_aic3254
console
cpu_dma_latency
cpuctl
device-mapper
diag
diag_arm9
diag_mdm
dsp_debug
full
fuse
gemini0
graphics
htc-acoustic
htc-portlist
htc_simhotswap
htcdiag
htcdrm
hw_random
i2c-1
i2c-4
i2c-5
input
keychord
kgsl-2d0
kgsl-2d1
kgsl-3d0
kmsg
lightsensor
log
mdm
msm_aac
msm_aac_in
msm_acdb
msm_adc
msm_amrnb_in
msm_audio_dev_ctrl
msm_camera
msm_dsps
msm_evrc_in
msm_fm
msm_mvs
msm_pcm_in
msm_pcm_lp_dec
msm_pcm_out
msm_qcelp_in
msm_rotator
msm_vidc_dec
msm_vidc_enc
msm_vidc_reg
msm_wma
msm_wmapro
network_latency
network_throughput
ntrig_analysis
ntrig_touch
null
oncrpc
perflock
pmem
pmem_adsp
pmem_audio
pmem_smipool
ppp
ptmx
pts
radio_feedback
random
rfkill
rmt_storage
rtc0
sdio_al_test
sdioctl0
sdioctl1
sdioctl2
sdioctl3
sdioctl4
sdioctl5
sdioctl6
sdioctl7
sdioctl8
sdiotty0
simlock
smd0
smd21
smd22
smd27
smd36
smd7
smd9
smd_pkt_loopback
smd_sns_dsps
smdcntl0
smdcntl1
smdcntl2
smdcntl3
smdcntl4
smdcntl5
smdcntl6
smdcntl7
snd
socket
system_bus_freq
tpa2026
tpa2028
tty
ttyHS0
ttyHSL0
ttyHSL1
ttyHSUSB0
ttyHSUSB1
ttyHSUSB2
ttyntrig-debug
tun
uinput
urandom
usb_accessory
zero
This is where it gets interesting. "Fastboot oem ?"
Code:
C:\platform-tools>fastboot oem ?
...
(bootloader) command list
(bootloader) mb
(bootloader) mh
(bootloader) mw
(bootloader) ew
(bootloader) eh
(bootloader) eb
(bootloader) mmu
(bootloader) ram_test
(bootloader) jump
(bootloader) test
(bootloader) sdtest
(bootloader) eraseconfig
(bootloader) writeconfig
(bootloader) readconfig
(bootloader) writesku
(bootloader) readsku
(bootloader) rflash
(bootloader) tflash
(bootloader) block_test
(bootloader) partition_test
(bootloader) rbchk
(bootloader) erasesd
(bootloader) btrouter
(bootloader) nfcrouter
(bootloader) nfcreader
(bootloader) nfccard
(bootloader) nfcversion
(bootloader) nfcdl
(bootloader) tick
(bootloader) heaptable
(bootloader) sysinfo
(bootloader) emapi
(bootloader) emapiTest
(bootloader) emapiCountryID
(bootloader) emapiWlanMac
(bootloader) emapiSetDefCal
(bootloader) emapiReadCal
(bootloader) emapiReadbtaddr
(bootloader) lr
(bootloader) imgcrc
(bootloader) resetautoimage
(bootloader) resetpreferdiag
(bootloader) resetRUUflag
(bootloader) writeserialno
(bootloader) readserialno
(bootloader) battcheck
(bootloader) enter
(bootloader) gotofastboot
(bootloader) gotohboot
(bootloader) writemid
(bootloader) usbtestmode
(bootloader) eraseWifiFlash
(bootloader) erase
(bootloader) readmbserialno
(bootloader) listpartition
(bootloader) erasebcid
(bootloader) writebcid
(bootloader) readbcid
(bootloader) fmrouter
(bootloader) fmtx
(bootloader) resetuP
(bootloader) bdaddress
(bootloader) readbdaddr
(bootloader) resetgift
(bootloader) wMfgTp
(bootloader) rMfgTp
(bootloader) emptypagecheck
(bootloader) saveprt2sd
(bootloader) savemem2sd
(bootloader) savefb2sd
(bootloader) emapiInit
(bootloader) emapiChannel
(bootloader) emapiBand
(bootloader) emapiRate
(bootloader) emapiRateset
(bootloader) emapiCountry
(bootloader) emapiTXpwr1
(bootloader) emapiPkteng_start
(bootloader) emapiPkteng_stop
(bootloader) emapiOut
(bootloader) emapiFqacurcy
(bootloader) emapiCrsuprs
(bootloader) emapiUp
(bootloader) emapiDown
(bootloader) emapiMpc
(bootloader) emapiCounters
(bootloader) emapiVersion
(bootloader) emapiEtheraddr
(bootloader) emapinRate
(bootloader) emapiSetIrqPin
(bootloader) usblog
(bootloader) bkflash2emmc
(bootloader) fl
(bootloader) loaddiag
(bootloader) lnb
(bootloader) init_a1026_fw
(bootloader) checkKeyCard
(bootloader) loopback
(bootloader) spitest
(bootloader) i2ctest
(bootloader) pmic8058_led_test
(bootloader) ats
(bootloader) gpiow
(bootloader) gpior
(bootloader) clock
(bootloader) i2cr
(bootloader) i2cw
(bootloader) i2ctest
(bootloader) ulpi
(bootloader) changeCid
(bootloader) powertest
(bootloader) read_l2_acc_fuse
(bootloader) ltetest
(bootloader) sdio_loopback
(bootloader) sdio_setsize
(bootloader) sdio_readblk
(bootloader) sdio_writeblk
(bootloader) sdio_readblk
(bootloader) sdio_dumpreg
(bootloader) get_mdm9k_serial
(bootloader) clear_mdm9k_serial
(bootloader) set_mdm9k_serial
(bootloader) update_prkey
(bootloader) emmc_boot
(bootloader) 8x60i2cr
(bootloader) 8x60i2crNoAddr
(bootloader) 8x60i2cwNoAddr
(bootloader) 8x60i2cw
(bootloader) poweron
(bootloader) poweroff
(bootloader) setvol
(bootloader) spi
(bootloader) fat
(bootloader) pmgpiow
(bootloader) pmgpior
(bootloader) 8058vregon
(bootloader) 8058vregoff
(bootloader) 8058vregw
(bootloader) 8058vregr
(bootloader) 8901vregon
(bootloader) 8901vregoff
(bootloader) 8901vregw
(bootloader) 8901vregr
(bootloader) mipi_test
(bootloader) chargeron
(bootloader) chargeroff
(bootloader) adc
(bootloader) readsimlocktype
(bootloader) enablesimlock
(bootloader) addsimlockcode
(bootloader) clearsimlockcode
(bootloader) listsimlockcode
(bootloader) clearunlockrecord
(bootloader) lite_heap_test
(bootloader) vibrate_test
(bootloader) getrtc
(bootloader) setrtc
(bootloader) getrtcalarm
(bootloader) setrtcalarm
(bootloader) pgfs
(bootloader) bumpclk
(bootloader) acpuclk_get
(bootloader) acpuclk_set
(bootloader) rpmclk_set
(bootloader) rpmclk_get
(bootloader) oschalt
(bootloader) tz_req
(bootloader) blow_efuse
(bootloader) blow_qfuse_cfg
(bootloader) dump_tzlog
(bootloader) fdisk_emmc
(bootloader) set_partition_emmc
(bootloader) erase_emmc
(bootloader) test_emmc
(bootloader) sector_erase_emmc
(bootloader) fat_format_emmc
(bootloader) init_emmc
(bootloader) reinit_emmc
(bootloader) write_mmc
(bootloader) set_wp_emmc
(bootloader) write_prot_test
(bootloader) clear_wp_emmc
(bootloader) set_enh_area_emmc
(bootloader) ntrigsetcal
(bootloader) get_identifier_token
(bootloader) checkSbl1
(bootloader) checkHWSecurity
(bootloader) checkKeycardID
(bootloader) enter
(bootloader) keytest
(bootloader) heap
(bootloader) boot
(bootloader) reset
(bootloader) powerdown
(bootloader) rebootRUU
(bootloader) heap_test
(bootloader) rtask
(bootloader) task
(bootloader) enableqxdm
(bootloader) gencheckpt
(bootloader) readpid
(bootloader) writepid
(bootloader) readcid
(bootloader) writecid
(bootloader) readimei
(bootloader) writeimei
(bootloader) readsecureflag
(bootloader) writesecureflag
(bootloader) lock
(bootloader) list_partition_emmc
(bootloader) load_emmc
(bootloader) check_emmc
(bootloader) check_emmc_mid
(bootloader) read_mmc
(bootloader) load_modem_emmc
(bootloader) get_wp_info_emmc
(bootloader) send_wp_info_emmc
(bootloader) get_ext_csd_emmc
(bootloader) get_sector_info_emmc
OKAY [  0.225s]
finished. total time: 0.226s

you should go on the revolutionary IRC channel and see if there is anything they can get from your device... blocking out serial numbers obv that would allow them to get S-OFF for other tablets.
 

ieftm

Retired Recognized Developer
Apr 17, 2008
291
1,761
fastboot oem saveprt2sd hboot -n eng.bin

That will pretty much save the current ENG hboot to your sdcard (which you'd need inserted), so you can upload.

But, as with many factory/eng S-OFF devices, they are of little use in exploiting S-ON.
 
  • Like
Reactions: DanMc85

DanMc85

Senior Member
Jan 6, 2008
631
264
USA
fastboot oem saveprt2sd hboot -n eng.bin

That will pretty much save the current ENG hboot to your sdcard (which you'd need inserted), so you can upload.

But, as with many factory/eng S-OFF devices, they are of little use in exploiting S-ON.

thanks eft for getting back to me and taking a look at this. :)
 

cookiesowns

Member
Apr 9, 2010
40
1
Irvine CA
fastboot oem saveprt2sd hboot -n eng.bin

That will pretty much save the current ENG hboot to your sdcard (which you'd need inserted), so you can upload.

But, as with many factory/eng S-OFF devices, they are of little use in exploiting S-ON.

Awesome, my last day with the device. I'll try that now.

Already got the ENG HBOOT, if any devs or anyone else that wants to have a peek at it, let me know and I'll upload it for them.

Also talked to IEF about backing up the rom, and it's doable. But he doesn't find a necessity or benefit for doing so.
 
Last edited:

sk806

Senior Member
Jan 30, 2005
1,973
1,441
Rye, New York
Awesome, my last day with the device. I'll try that now.

Already got the ENG HBOOT, if any devs or anyone else that wants to have a peek at it, let me know and I'll upload it for them.

Also talked to IEF about backing up the rom, and it's doable. But he doesn't find a necessity or benefit for doing so.

I would like to take a look at the eng hboot. Would you be willing to post? Or via a pm? Thanks!

Steve
 

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    [Originally posted in Jetstream General]

    So I just got mine, fresh from the store. My permanent device, not the trial unit was using.

    Since I love voiding warranties (it's kind of a hobby), I'm going to muck around with the software and see what I can get into. My goal is to stumble across a root method, but I have no idea what I'm doing and will really just be lurking in IRC channels and reading other root guides to see what I can try.

    Since I can't post in the development thread yet (stupid lurker status), I'm going to post relevant info here, starting with software versions running on my device.

    In Bootloader, I see:
    HTC PUCCINILTE PVT SHIP S-ON RL
    HBOOT-1.78.0007
    eMMC-boot

    Standard vol-up/down and power button controls work there, which was to be expected.

    Software info:
    Android Version: 3.1
    HTC Sense version: 1.1 for tablet
    Software number: 1.17.502.3

    Kernel: 2.6.35.10-g4612ecf
    htc-kernel@u18000-build-144 #1

    Baseband Version: 1.04.550I.15v2_30.60.550I.10L

    Build number: 1.17.502.3CL139056 release-keys

    adb shows normal information, but adb reboot recovery doesn't work (not surprising)

    Running http://revolutionary.io/ shows the following:
    Code:
    C:\jetstream>revolutionary.exe
     =============================================
    | Revolutionary S-OFF & Recovery Tool 0.4pre4 |
     =============================================
        Brought to you by AlphaRev & unrEVOked.
    
    Waiting for device...
    Found your device: HTC PG09410 (puccinilte-1.78.0007, Android: 3.1, ROM version: 1.17.502.3)
    
    Your device: puccinilte, with HBOOT 1.78.0007 is not supported at this time.

    Booting into the bootloader and running "fastboot oem ?" provides the following:
    Code:
    C:\jetstream>fastboot oem ?
    ...
    (bootloader) command list
    (bootloader) get_identifier_token
    (bootloader) checkSbl1
    (bootloader) checkHWSecurity
    (bootloader) checkKeycardID
    (bootloader) enter
    (bootloader) keytest
    (bootloader) heap
    (bootloader) boot
    (bootloader) reset
    (bootloader) powerdown
    (bootloader) rebootRUU
    (bootloader) heap_test
    (bootloader) rtask
    (bootloader) task
    (bootloader) enableqxdm
    (bootloader) gencheckpt
    (bootloader) readpid
    (bootloader) writepid
    (bootloader) readcid
    (bootloader) writecid
    (bootloader) readimei
    (bootloader) writeimei
    (bootloader) readsecureflag
    (bootloader) writesecureflag
    (bootloader) lock
    (bootloader) list_partition_emmc
    (bootloader) load_emmc
    (bootloader) check_emmc
    (bootloader) check_emmc_mid
    (bootloader) read_mmc
    (bootloader) load_modem_emmc
    (bootloader) get_wp_info_emmc
    (bootloader) send_wp_info_emmc
    (bootloader) get_ext_csd_emmc
    (bootloader) get_sector_info_emmc
    OKAY [  0.186s]
    finished. total time: 0.187s
    Note that there's no "unlock" command as with the xoom. I'm wondering if it's disabled somewhere or just a file change somewhere to get the unlock option in there.


    http://www.htcdev.com/bootloader/ doesn't give the option to unlock the Jetstream quite yet :-(


    Pulled my build.prop:
    Code:
    ro.ril.enable.a52=0
    ro.ril.enable.a53=1
    ro.ril.enable.dtm=0
    ro.ril.gprsclass=10
    ro.ril.hsdpa.category=14
    ro.ril.hsupa.category=6
    ro.ril.hsxpa=4
    ro.ril.def.agps.mode=5
    ro.ril.att.feature=1
    ro.ril.disable.fd.plmn.prefix=23402,23410,23411
    ro.ril.enable.sdr=0
    ro.ril.enable.gea3=1
    ro.ril.enable.ucsq=2
    ro.ril.enable.sim.hot.swap=1
    ro.ril.set.mtusize=1410
    ro.ril.reject.cs.ss.enabled=1
    ro.ril.reject.mo.sms.enabled=0
    ro.ril.reject.mo.ussd.enabled=1
    persist.pdn.profile=broadband
    ro.com.google.clientidbase=android-htc
    ro.com.google.clientidbase.yt=android-htc
    ro.com.google.clientidbase.am=android-att-us
    ro.com.google.clientidbase.gmm=android-htc
    ro.com.google.clientidbase.ms=android-att-us
    ro.wifi.hotspotUI=0
    ro.tether.denied=true
    ro.product.model=HTC PG09410
    ro.phone.function=0
    ro.monkey=0
    ro.sllowmock.location=0
    # begin build properties
    # autogenerated by buildinfo.sh
    ro.aa.rid=191
    ro.aa.skulist=502
    ro.aa.customizationid=216086
    ro.aa.mainsku=502
    ro.aa.taskid=210183
    ro.aa.romver=1.17.502.3
    ro.aa.maincid=CWS__001
    ro.aa.cidlist=CWS__001
    ro.aa.project=Puccini_LTE
    ro.aa.modelid=PG0941000
    ro.build.changelist=139056
    ro.com.google.clientidbase=android-att-us
    ro.aa.rid=191
    ro.aa.skulist=502
    ro.aa.customizationid=216086
    ro.aa.mainsku=502
    ro.aa.taskid=210183
    ro.aa.romver=1.17.502.3
    ro.aa.maincid=CWS__001
    ro.aa.cidlist=CWS__001
    ro.aa.project=Puccini_LTE
    ro.aa.modelid=PG0941000
    ro.build.changelist=139056
    ro.com.google.clientidbase=android-att-us
    ro.build.id=HMJ15
    ro.build.display.id=HMJ15
    ro.build.version.incremental=137848.3
    ro.build.version.sdk=12
    ro.build.version.codename=REL
    ro.build.version.release=3.1
    ro.build.date=三  8月 17 00:02:05 CST 2011
    ro.build.date.utc=1313510525
    ro.build.type=user
    ro.build.user=
    ro.build.host=AA138
    ro.build.tags=release-keys
    ro.product.model=HTC PucciniLte
    ro.product.brand=cingular_us
    ro.product.name=htc_puccinilte
    ro.product.device=puccinilte
    ro.product.board=verdilte
    ro.product.cpu.abi=armeabi-v7a
    ro.product.cpu.abi2=armeabi
    ro.product.manufacturer=HTC
    ro.product.locale.language=mdpi
    ro.wifi.channels=
    ro.board.platform=msm8660
    # ro.build.product is obsolete; use ro.product.device
    ro.build.product=puccinilte
    # Do not try to parse ro.build.description or .fingerprint
    ro.build.description=1.17.502.3 CL139056 release-keys
    ro.build.description=1.17.502.3 CL139056 release-keys
    ro.build.changelist=139056
    ro.build.fingerprint=cingular_us/htc_puccinilte/puccinilte:3.1/HMJ15/137848.3:user/release-keys
    ro.build.characteristics=default tablet tablet
    ro.build.project=210183
    ro.product.version=1.17.502.3
    ro.build.languageremove=0
    ro.build.sense.version=2.1
    # end build properties
    #
    # system.prop for puccinilte
    #
    
    ro.sf.lcd_density=160
    
    debug.fb.rgb565 = 0
    
    ro.fb.mode = 1
    
    #+HTC_RIL: from QCT Fusion
    rild.libpath=/system/lib/libril-qc-qmi-1.so
    rild.libargs=-d /dev/smd0
    persist.rild.nitz_plmn=
    persist.rild.nitz_long_ons_0=
    persist.rild.nitz_long_ons_1=
    persist.rild.nitz_long_ons_2=
    persist.rild.nitz_long_ons_3=
    persist.rild.nitz_short_ons_0=
    persist.rild.nitz_short_ons_1=
    persist.rild.nitz_short_ons_2=
    persist.rild.nitz_short_ons_3=
    persist.rild.ril.ltedr=0
    persist.rild.ril.ltedrtable=max_retries=infinite,10000
    DEVICE_PROVISIONED=1
    debug.sf.hw=1
    #debug.composition.type=c2d
    
    #
    # system props for the cne module
    #
    persist.cne.UseCne=false
    persist.cne.bat.range.low.med=30
    persist.cne.bat.range.med.high=60
    persist.cne.loc.policy.op=/system/etc/OperatorPolicy.xml
    persist.cne.loc.policy.user=/system/etc/UserPolicy.xml
    persist.cne.bwbased.rat.sel=false
    persist.cne.snsr.based.rat.mgt=false
    persist.cne.bat.based.rat.mgt=false
    persist.cne.be.ge.sqi.min=0
    persist.cne.be.ge.sqi.max=100
    persist.cne.be.umts.sqi.min=0
    persist.cne.be.umts.sqi.max=100
    persist.cne.be.hspa.sqi.min=0
    persist.cne.be.hspa.sqi.max=100
    persist.cne.be.1x.sqi.min=0
    persist.cne.be.1x.sqi.max=100
    persist.cne.be.do.sqi.min=0
    persist.cne.be.do.sqi.max=100
    persist.cne.be.wlan.sqi.min=0
    persist.cne.be.wlan.sqi.max=100
    
    #
    # system props for the data modules
    #
    ro.use_data_netmgrd=true
    persist.data_netmgrd_nint=11
    
    #
    # system props for telephony modules
    #
    #device supports LTE
    ro.config.lte=true
    #device supports EHRPD
    #ro.config.ehrpd=true
    #device supports simultaneous 1x voice + LTE
    #ro.config.svlte1x=true
    #-HTC_RIL: from QCT Fusion
    
    # Modify MMS APN retry timer from 5s to 2s.
    ro.gsm.2nd_data_retry_config = max_retries=3, 2000, 2000, 2000
    
    # verdi RF team request
    ro.ril.enable.dtm = 0
    ro.ril.gprsclass = 12
    ro.ril.hsdpa.category = 10
    ro.ril.hsupa.category = 6
    ro.ril.hsxpa = 3
    
    # Default network type.
    # 0 => WCDMA preferred.
    ro.telephony.default_network=0
    
    wifi.interface=eth0
    wifi.supplicant_scan_interval=15
    
    # The OpenGL ES API level that is natively supported by this device.
    # This is a 16.16 fixed point number
    ro.opengles.version = 131072
    
    # This is a high density device with more memory, so larger vm heaps for it.
    dalvik.vm.heapsize=256m
    dalvik.vm.heapgrowthlimit=48m
    
    # For the default value of agps
    ro.ril.def.agps.mode = 2
    
    # For HSDPA low throughput
    ro.ril.disable.power.collapse = 1
    
    # For Pyramid China NEL
    ro.ril.enable.prl.recognition = 1
    
    # For emmc phone storage
    ro.phone_storage = 0
    # For ext4 file system
    ro.ext4fs = 1
    
    # For FOTA setting (leave empty value to use default)
    ro.htc.checkin.url = http://andchin.htc.com/android/checkin
    ro.htc.checkin.crashurl = http://andchin.htc.com/android/crash
    ro.htc.checkin.url_CN = http://andchin.htccomm.com.cn/android/checkin
    ro.htc.checkin.crashurl_CN = http://andchin.htccomm.com.cn/android/crash
    ro.htc.checkin.exmsg.url = http://fotamsg.htc.com/android/extra/
    ro.htc.checkin.exmsg.url_CN = http://fotamsg.htccomm.com.cn/android/extra/
    
    # Release Bluetooth HW/SW information
    ro.bt.chipset	= Broadcom BCM4329-B1
    ro.bt.version	= Bluetooth 2.1 + EDR
    ro.bt.stack	= Broadcom BTL-A
    ro.bt.stack.version	= 2.0.50.032
    #0x10000010010100100000011 represent bt profile list
    ro.bt.profiles	= 4270339
    
    # Properties of BTLA stack
    service.brcm.bt.activation = 0
    service.brcm.bt.srv_active = 0
    service.brcm.bt.hcid_active = 0
    service.brcm.bt.btld = 0
    service.brcm.bt.btld_pid = 0
    service.brcm.bt.bluetoothd_pid = 0
    service.brcm.bt.avrcp_pass_thru = 0
    service.brcm.bt.avrcp_toggle = 1
    service.brcm.bt.ag_supported = 0
    
    # Following property will be reference by Settings.
    ro.product.bluetooth = 3.0
    
    # For quick boot mode
    persist.sys.shutdown.mode = hibernate
    
    # Temporary workaround [Arthur]
    # profiler.checkheap = 0
    profile_freeNativeBmp = 0
    
    # ABL
    htc.abl.enable = 0
    
    # unlock keyguard when SIM is non-inserted
    keyguard.no_require_sim=1
    
    # Dump native call stack when an ANR happens to com.htc.launcher.
    profiler.anr_dump_native_uid = 9999
    
    # Following property will be reference by Settings.
    ro.product.processor = 1.5 GHz dualcore
    ro.product.ram = 1GB
    ro.product.display_resolution = 10.1 inch WXGA resolution
    ro.product.main_camera = 8M
    ro.product.front_camera = 1.3M
    ro.product.bluetooth = 3.0
    ro.product.wifi = 802.11 a/b/g/n
    
    # support USB Host
    ro.usb_host = 1
    
    # For opensense sdk
    ro.htc.common.version = 3.0.0.0
    
    # For matching the sample rate of touch driver
    windowsmgr.max_events_per_sec=70
    
    # Extend key dispatching timeout
    keydispatchtimeout = 15000
    
    #
    # ADDITIONAL_BUILD_PROPERTIES
    #
    ro.setupwizard.mode=OPTIONAL
    ro.config.ringtone=QuietlyBrilliant.mp3
    ro.config.notification_sound=Zeta.mp3
    ro.config.alarm_alert=NewDay.mp3
    ro.config.cal_notification=Epsilon.mp3
    ro.config.msg_notification=Gamma.mp3
    ro.setupwizard.mode=DISABLED
    ro.com.google.gmsversion=3.1_r2
    htc.audio.alt.enable=1
    htc.audio.hac.enable=0
    drm.service.enabled=true
    ro.marlin.drm.service.enabled=true
    net.bt.name=Android
    dalvik.vm.stack-trace-file=/data/anr/traces.txt
    Interesting build.prop notes:
    lines 25/26:
    ro.wifi.hotspotUI=0
    ro.tether.denied=true

    lines 234-236 (Was Arthur supposed to fix this before release?):
    # Temporary workaround [Arthur]
    # profiler.checkheap = 0
    profile_freeNativeBmp = 0


    In watching logcat, it's constantly trying to connect to AT&T's LTE network. Except that I haven't activated the service and under System Settings I have Mobile Network disabled. I'm sure that's working out great for my battery.


    Results of a "df" command in shell
    Code:
    $ df
    df
    Filesystem             Size   Used   Free   Blksize
    /dev                   406M    64K   406M   4096
    /system               1007M   718M   289M   4096
    /data                   11G   390M    11G   4096
    /cache                 314M     5M   309M   4096
    /devlog                 31M    10M    21M   4096
    /vendor/firmware/misc   199M    21M   178M   4096
    /vendor/firmware/misc_mdm   199M    27M   171M   4096
    /mnt/asec              406M     0K   406M   4096
    /mnt/obb               406M     0K   406M   4096
    /data/DxDrm/fuse: Permission denied

    Here's a dump of /system/app/
    Code:
    $ ls
    ls
    ATTAPNWidget_1.1.63.apk
    ATT_FamilyMap_stub.apk
    ATT_Navigator_stub.apk
    ATT_code_scanner_vpl_1.2_aligned.apk
    AndroidMoviesClub_att_vpl_1.0.0.0004.apk
    AndroidWispr1.17.apk
    AppSharing.apk
    AppSharing.odex
    ApplicationsProvider.apk
    ApplicationsProvider.odex
    Bluetooth.apk
    Bluetooth.odex
    BooksTablet.apk
    BrcmBluetoothServices.apk
    BrcmBluetoothServices.odex
    Browser.apk
    Browser.odex
    Burgundy.apk
    CSPeopleSyncService.apk
    CSPeopleSyncService.odex
    Calculator.apk
    Calculator.odex
    Calendar.apk
    Calendar.odex
    CalendarProvider.apk
    CalendarProvider.odex
    CertInstaller.apk
    CertInstaller.odex
    CheckinProvider.apk
    CheckinProvider.odex
    ChromeBookmarksSyncAdapter.apk
    ContactsProvider.apk
    ContactsProvider.odex
    CustomizationSettingsProvider.apk
    CustomizationSettingsProvider.odex
    CustomizationSetup.apk
    CustomizationSetup.odex
    DFPI.apk
    DFPI.odex
    DefaultContainerService.apk
    DefaultContainerService.odex
    DmClient.apk
    DockMode.apk
    DockMode.odex
    DownloadProvider.apk
    DownloadProvider.odex
    DownloadProviderUi.apk
    DownloadProviderUi.odex
    DrmProvider.apk
    DrmProvider.odex
    Facebook.apk
    FilePicker.apk
    FilePicker.odex
    Finsky.apk
    Flickr.apk
    Flickr.odex
    FriendStream.apk
    FriendStream.odex
    FusionStockWidget.apk
    FusionStockWidget.odex
    GameWorld-1.0.7.apk
    Gmail.apk
    GoogleBackupTransport.apk
    GoogleCalendarSyncAdapter.apk
    GoogleContactsSyncAdapter.apk
    GoogleFeedback.apk
    GoogleLoginService.apk
    GooglePartnerSetup.apk
    GoogleQuickSearchBox.apk
    GoogleServicesFramework.apk
    GreenImmersion.apk
    HTCAlbum.apk
    HTCAlbum.odex
    HTCCamera.apk
    HTCCamera.odex
    HTCLivewallpaperStreak.apk
    HTCLivewallpaperStreak.odex
    HTCPDFViewer.apk
    HTCPDFViewer.odex
    HTCSetupWizard.apk
    HTCSetupWizard.odex
    HTCSync.apk
    HTC_IME.apk
    HTC_IME.odex
    HTMLViewer.apk
    HTMLViewer.odex
    HoloSpiralWallpaper.apk
    HoloSpiralWallpaper.odex
    HomePersonalize.apk
    HomePersonalize.odex
    HtcAutoRotateWidget.apk
    HtcAutoRotateWidget.odex
    HtcBackgroundDataWidget.apk
    HtcBackgroundDataWidget.odex
    HtcCalculatorWidget.apk
    HtcCalculatorWidget.odex
    HtcClock3DWidget.apk
    HtcClock3DWidget.odex
    HtcCompressViewer.apk
    HtcCompressViewer.odex
    HtcConnectedMedia.apk
    HtcConnectedMedia.odex
    HtcContacts.apk
    HtcContacts.odex
    HtcDLNAMiddleLayer.apk
    HtcDLNAMiddleLayer.odex
    HtcDMC.apk
    HtcDMC.odex
    HtcDataRoamingWidget.apk
    HtcDataRoamingWidget.odex
    HtcDataStripWidget.apk
    HtcDataStripWidget.odex
    HtcDialer.apk
    HtcDialer.odex
    HtcDirect.apk
    HtcDirect.odex
    HtcDm.apk
    HtcDm.odex
    HtcDmSettingWidget.apk
    HtcDmSettingWidget.odex
    HtcFacebook.apk
    HtcFacebook.odex
    HtcFeedback.apk
    HtcFeedback.odex
    HtcFootprints.apk
    HtcFootprints.odex
    HtcFootprintsWidget3d.apk
    HtcFootprintsWidget3d.odex
    HtcGreader.apk
    HtcGreader.odex
    HtcGreaderWidget.apk
    HtcGreaderWidget.odex
    HtcHubSyncProvider.apk
    HtcHubSyncProvider.odex
    HtcImageWallpaper.apk
    HtcImageWallpaper.odex
    HtcLocationPicker.apk
    HtcLocationPicker.odex
    HtcLocationService.apk
    HtcLocationService.odex
    HtcLockScreen.apk
    HtcLockScreen.odex
    HtcLoggers.apk
    HtcLoggers.odex
    HtcMessageProvider.apk
    HtcMessageProvider.odex
    HtcMessageUploader.apk
    HtcMessageUploader.odex
    HtcMusic.apk
    HtcMusic.odex
    HtcMusicEnhancer.apk
    HtcMusicEnhancer.odex
    HtcMusicMarkedItems.apk
    HtcMusicMarkedItems.odex
    HtcNotes.apk
    HtcNotes.odex
    HtcNotesProvider.apk
    HtcNotesProvider.odex
    HtcPhotoGridWidget3D.apk
    HtcPhotoGridWidget3D.odex
    HtcPhotoWidget.apk
    HtcPhotoWidget.odex
    HtcPowerStripWidget.apk
    HtcPowerStripWidget.odex
    HtcProfileWidget.apk
    HtcProfileWidget.odex
    HtcRecommends.apk
    HtcRecommends.odex
    HtcRecommendsWidget.apk
    HtcRecommendsWidget.odex
    HtcResetNotify.apk
    HtcResetNotify.odex
    HtcRichNotesWidget3D.apk
    HtcRichNotesWidget3D.odex
    HtcScreenBrightnessWidget.apk
    HtcScreenBrightnessWidget.odex
    HtcScreenTimeoutWidget.apk
    HtcScreenTimeoutWidget.odex
    HtcSettingsProvider.apk
    HtcSettingsProvider.odex
    HtcSoundRecorder.apk
    HtcSoundRecorder.odex
    HtcSoundSetDownloadManager.apk
    HtcSoundSetDownloadManager.odex
    HtcStreamPlayer.apk
    HtcStreamPlayer.odex
    HtcTipWidget.apk
    HtcTipWidget.odex
    HtcTwitter.apk
    HtcTwitter.odex
    HtcWeather3DWidget.apk
    HtcWeather3DWidget.odex
    HtcWeatherWallpaper.apk
    HtcWeatherWallpaper.odex
    IdleScreen_Weather.apk
    IdleScreen_Weather.odex
    Idlescreen_Base.apk
    Idlescreen_Base.odex
    JETCET_PRINT_Resources.apk
    JETCET_PRINT_T11.apk
    KidMode.apk
    Kindle_STUB.apk
    LGolf2HD_HEP_HTC_Puccini_ATT_ML_102.apk
    LMW.apk
    LMW.odex
    LiveWallpapersPicker.apk
    LiveWallpapersPicker.odex
    Mail.apk
    Mail.odex
    Maps.apk
    MarketUpdater.apk
    MediaProvider.apk
    MediaProvider.odex
    MediaUploader.apk
    MyHTC.apk
    MyHTC.odex
    MyPen.apk
    MyPen.odex
    MyPenTips.apk
    MyPenTips.odex
    MyReportAgent.apk
    MyReportAgent.odex
    MySketcher.apk
    MySketcher.odex
    NFSShift_signed_submission.apk
    NetworkLocation.apk
    OneTimeInitializer.apk
    OnlineAssetDetails.apk
    OnlineAssetDetails.odex
    PCSC.apk
    PCSC.odex
    PCSCSettingWidget.apk
    PCSCSettingWidget.odex
    PRAndroid.apk
    PackageInstaller.apk
    PackageInstaller.odex
    Phone.apk
    Phone.odex
    PicoTts.apk
    PicoTts.odex
    PluginManager.apk
    PluginManager.odex
    PolarisOffice.apk
    QXDM2SD.apk
    QXDM2SD.odex
    QuickLookup.apk
    QuickLookup.odex
    Rosie.apk
    Rosie.odex
    Settings.apk
    Settings.odex
    SettingsProvider.apk
    SettingsProvider.odex
    SetupWizard.apk
    SoundHound_Freemium.apk
    Stk.apk
    Stk.odex
    Stock.apk
    Stock.odex
    Street.apk
    SystemUI.apk
    SystemUI.odex
    Talk.apk
    TaskManager.apk
    TaskManager.odex
    TelephonyProvider.apk
    TelephonyProvider.odex
    Transfer-puccini-8.31.0.40-Stablet11.apk
    TrimIt.apk
    TtsService.apk
    TtsService.odex
    Twitter.apk
    Updater.apk
    Updater.odex
    UpgradeSetup.apk
    UpgradeSetup.odex
    UploadProvider.apk
    UploadProvider.odex
    UserDictionaryProvider.apk
    UserDictionaryProvider.odex
    Vending.apk
    VoiceSearch.apk
    WatchApp.apk
    WatchApp.odex
    Weather.apk
    Weather.odex
    WeatherAgentService.apk
    WeatherAgentService.odex
    WeatherLiveWallpaper.apk
    WeatherLiveWallpaper.odex
    WeatherProvider.apk
    WeatherProvider.odex
    WeatherSyncProvider.apk
    WeatherSyncProvider.odex
    WifiRouter.apk
    WifiRouter.odex
    WorldClock.apk
    WorldClock.odex
    YPMAndroid_VPL-release_287.apk
    YouTubeTablet.apk
    ZinioReader.v1.01.3587.VPL.apk
    com.htc.FriendStream3DWidget.apk
    com.htc.FriendStream3DWidget.odex
    com.htc.MusicWidget.apk
    com.htc.MusicWidget.odex
    com.htc.Sync3DWidget.apk
    com.htc.Sync3DWidget.odex
    com.htc.TrendsWidget.apk
    com.htc.TrendsWidget.odex
    com.htc.Twitter3DWidget.apk
    com.htc.Twitter3DWidget.odex
    fusion.apk
    fusion.odex
    htcbookmarkwidget3d.apk
    htcbookmarkwidget3d.odex
    htccalendarwidgets3d.apk
    htccalendarwidgets3d.odex
    htccontactwidgets3D.apk
    htccontactwidgets3D.odex
    htcmailwidgets3d.apk
    htcmailwidgets3d.odex
    htcsettingwidgets.apk
    htcsettingwidgets.odex
    htcwatchwidget3d.apk
    htcwatchwidget3d.odex
    idlescreen_blank.apk
    idlescreen_blank.odex
    idlescreen_shortcut.apk
    idlescreen_shortcut.odex
    install_flash_player.apk
    myATTWebLaunch_v2_aligned.apk
    restartapp.apk
    restartapp.odex
    tabletv2-98_aligned.apk
    teeter.apk
    teeter.odex


    Here's a dump of /system/bin/
    Code:
    $ cd bin
    cd bin
    $ ls
    ls
    3D_calibration
    DmWrapperTest
    DxDrmServerIpc
    PktRspTest
    adb
    akmd
    am
    app_process
    applypatch
    ash
    awb_camera
    bluetoothd
    bma150_usr
    bmgr
    bootanimation
    bootcomplete
    btld
    bugreport
    cam_ins_spmo
    cat
    charging
    chmod
    chown
    cmp
    dalvikvm
    date
    dbus-daemon
    dcvs
    dcvsd
    dd
    debuggerd
    dexopt
    df
    dhcpcd
    diag_klog
    diag_mdlog
    dmagent
    dmesg
    dnsmasq
    drmserver
    ds_fmc_appd
    dumpstate
    dumpsys
    fsck_msdos
    fusermount
    getevent
    getprop
    gzip
    hciattach
    hd
    hdmid
    htc_ebdlogd
    htc_ext4_fsck
    htcfs
    id
    ifconfig
    iftop
    ime
    input
    insmod
    installd
    ioctl
    ionice
    ip
    ipd
    iptables
    keystore
    kill
    ks
    linker
    ln
    load-modem.sh
    log
    logcat
    logcat2
    logwrapper
    ls
    lsc_camera
    lsmod
    lsof
    make_ext4fs
    mediaserver
    mkdir
    mm-audio-acdb-test
    mm-audio-alsa-test
    mm-jpeg-dec-test
    mm-jpeg-enc-test
    mm-qcamera-testsuite-client
    mm-qcamera-testsuite-client-aw
    mm-vdec-omx-test
    mm-venc-omx-test720p
    mm-video-driver-test
    mm-video-encdrv-test
    mmcamera_test
    monkey
    mount
    mpdecision
    mtpd
    mv
    nandread
    ndc
    netcfg
    netd
    netmgrd
    netsharing
    netstat
    newfs_msdos
    nl_listener
    notify
    ntrig_touchd
    omx_tests
    pand
    ping
    pm
    port-bridge
    pppd
    printenv
    ps
    qcks
    qmiproxy
    qmuxd
    racoon
    ramdump-9K.sh
    ramdump2sd-9K.sh
    reboot
    renice
    rild
    rm
    rmdir
    rmmod
    rmt_storage
    route
    run-as
    schedtest
    schedtop
    screencap
    screenshot
    sdcard
    sdptool
    sendevent
    service
    servicemanager
    setconsole
    setprop
    sh
    shutdown
    simg2img
    sleep
    smd
    sound8x60
    start
    stop
    surfaceflinger
    svc
    sync
    system_server
    tc
    test_diag
    test_gemini
    thermald
    toolbox
    top
    udhcpd
    umount
    uptime
    usbhub
    usbhub_init
    vdc
    vmstat
    vold
    watchprops
    wipe
    wpa_supplicant
    zchgd

    File dump of /dev/
    Code:
    cd /dev
    $ ls
    ls
    akm8975_aot
    akm8975_daemon
    alarm
    android_adb
    android_adb_enable
    android_mtp_tunnel
    ashmem
    audience_a1028
    binder
    block
    bma150
    bthid
    codec_aic3254
    console
    cpu_dma_latency
    cpuctl
    device-mapper
    diag
    diag_arm9
    diag_mdm
    dsp_debug
    full
    fuse
    gemini0
    graphics
    htc-acoustic
    htc-portlist
    htc_simhotswap
    htcdiag
    hw_random
    i2c-1
    i2c-4
    i2c-5
    input
    keychord
    kgsl-2d0
    kgsl-2d1
    kgsl-3d0
    kmsg
    lightsensor
    log
    mdm
    msm_aac
    msm_aac_in
    msm_acdb
    msm_adc
    msm_amrnb_in
    msm_audio_dev_ctrl
    msm_camera
    msm_dsps
    msm_evrc_in
    msm_fm
    msm_mvs
    msm_pcm_in
    msm_pcm_lp_dec
    msm_pcm_out
    msm_qcelp_in
    msm_rotator
    msm_vidc_dec
    msm_vidc_enc
    msm_vidc_reg
    msm_wma
    msm_wmapro
    network_latency
    network_throughput
    ntrig_touch
    null
    oncrpc
    perflock
    pmem
    pmem_adsp
    pmem_audio
    pmem_smipool
    ppp
    ptmx
    pts
    radio_feedback
    random
    rfkill
    rmt_storage
    rtc0
    sdio_al_test
    sdioctl0
    sdioctl1
    sdioctl2
    sdioctl3
    sdioctl4
    sdioctl5
    sdioctl6
    sdioctl7
    sdioctl8
    sdiotty0
    simlock
    smd0
    smd21
    smd22
    smd27
    smd36
    smd7
    smd9
    smd_pkt_loopback
    smd_sns_dsps
    smdcntl0
    smdcntl1
    smdcntl2
    smdcntl3
    smdcntl4
    smdcntl5
    smdcntl6
    smdcntl7
    snd
    socket
    system_bus_freq
    tpa2026
    tpa2028
    tty
    ttyHS0
    ttyHSL0
    ttyHSL1
    ttyHSUSB0
    ttyHSUSB1
    ttyHSUSB2
    ttyntrig-debug
    tun
    uinput
    urandom
    usb_accessory
    zero
    $

    I've joined (and am the only person in) #jetstreamdev on freenode IRC. Come find me there if you want to work with me interactively on this :)

    That's all I've got so far. I'm going to keep digging around in here with adb and such. If anybody has an suggestions (and real devs want to provide insight?) I'll gladly try things out.
    1
    Hope someone cracks the code to root it.

    I think I just hit a gold mine. I got my hands on a developers Htc jetstream. It's already rooted, with dev tools. I won't leak too much, and considering I don't have access to a USB cable I don't believe I'll be able to info mine. But hopefully this helps.

    Some preliminary stuff:

    Android Version: 3.1

    HTC Sense: 1.1 for tablet

    Software version: 1.20.0.0

    Kernal Version: 2.6.35.10-g0478d3htc-kernal@*snipped* (has information regarding this device, and which one it is) it was built last week of August.

    Build number 1.20.0.0

    Info from root check.

    Congratulations! You have root access!

    Superuser.apk - com.noshufou.android.su - version 3.0.2 is installed!

    System Environment PATH: /sbin /vendor/bin /system/sbin /system/bin /system/xbin

    The adb binary is set to default shell user access as root

    Standard su binary location: ls -l /system/bin/su:

    /system/bin/su: No such file or directory

    Standard su binary location: ls -l /system/xbin/su:
    -rwsr-sr-x root root 22228 2011-10-06 23:54 su

    Alternate su binary location:
    /sbin/su: Permission denied

    Alternate su type binary location:
    /system/xbin/sudo: No such file or directory

    Root user id:
    uid=0(root)

    Root group id:
    gid=0(root)


    Results provided on your HTC PG09410 device by Root Checker version
    3.7 from joeykrim in the Android Market - http://goo.gl/GgWae
    1
    fastboot oem saveprt2sd hboot -n eng.bin

    That will pretty much save the current ENG hboot to your sdcard (which you'd need inserted), so you can upload.

    But, as with many factory/eng S-OFF devices, they are of little use in exploiting S-ON.