• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[S-OFF]Development

Status
Not open for further replies.
Search This thread

xmoo

Retired Recognized Developer
Aug 19, 2006
5,420
1,797
31
Eindhoven
www.Mohammad.Moghtader.net
Read post #2 before posting!!

So Football and me are busy with trying to get S-OFF for this Badboy, but it seems to be a hard job. Please be patient!
Code:
/*
 * Your warranty is now void.
 *
 * We are not responsible for bricked devices, dead SD cards,
 * thermonuclear war, or you getting fired because the alarm app failed. Please
 * do some research if you have any concerns about content included in this thread
 * read before doing anything! YOU are choosing to make these modifications, and if
 * you point the finger at me for messing up your device, We will laugh at you.
 *
 */


13-04-2012 XDA.CN releases pictures showing someone succesfully has S-OFF'd his device. Tool is for sale here: http://item.taobao.com/item.htm?id=10824156715
17-04-2012 Thread made.
17-04-2012 We have found someone with a S-OFF device, and a newer HBOOT than the one from XDA.CN. Trying to get access to the HBOOT.
18-04-2012 OTA 1.28 brings HBOOT 0.94.
18-04-2012 New member with a S-OFF device is willing to help.
s-off-hboot_HOX.JPG

19-04-2012 HBOOT 0.43 S-OFF rfs.img received and uploaded.
19-04-2012 RFS.img is not the correct file, searching continues...
19-04-2012 Radio located, click here
26-04-2012 HBOOT probably located here
15-05-2012 NVFlash app + APX Drivers added
12-06-2012 Tegra 3 Manual added, see here!
16-06-2012 HBOOT 1.11 from the test-keys uploaded here!
16-06-2012 Huge development, read more about it!
18-06-2012 Need to find a way to by-pass CID check.
19-06-2012 Football Partition list for One X with all addresses and lengths of partitions which can be found here.
27-06-2012 Huhge thread clean-up and update.
04-07-2012 Had the chance to play with a S-OFF device, read more about it here! ENG HBOOT which is used in test, is located here.
09-07-2012 Javacard with DIAG will work, but won't be a good solution cause no one got a legit Javacard and the DIAG files can't be leaked!
14-07-2012 Video added which shows the Javacard with DIAG method. Video can be found here.
14-07-2012 The ENG HBOOT 0.03 that Football uploaded lost it's sign. I re-uploaded it and re-checked the file and it should be good now. You can find the new .zip here.

HBOOT versions
Past: 0.03, 0.04, 0.32, 0.43, 0.94, 0.95, 0.96, 1.01
Current: 1.11

More to come, please stop PM'ing me!

 

Attachments

  • NVFlash.zip
    466.2 KB · Views: 8,045
Last edited:

xmoo

Retired Recognized Developer
Aug 19, 2006
5,420
1,797
31
Eindhoven
www.Mohammad.Moghtader.net
FAQ.
What is S-OFF?
S-OFF stands for Security-OFF
S-OFF means that the NAND portion of the device is unlocked and can be written to. The default setting for HTC’s devices is S-ON, which means that neither can you access certain areas of the system nor can you guarantee a permanent root. Furthermore, signature check for firmware images is also ensured by the S-ON flag.

What has already been done?
-Tried flashing DIAG file, but with no success. File needs SuperCID.
-Tried flashing ENG HBOOT as zip file, but with no success. File needs SuperCID.
-Tried flashing modified DIAG file, but with no success. File needs SuperCID.
-Tried flashing modified HBOOT as zip file, but with no success. Signature check failed.
-Tried creating a Goldcard, but won't work. The Goldcare is for Qualcomm devices.
-Root while phone is LOCKED, won't work. Only will work on the Qualcomm One X and One XL.
-Ask the Chineese guy with the S-OFF tool. Won't share, cause he needs his money.
-Tried flashing files over recovery, but with no success.
-Tried flashing TETS and MFG ROMs, but with no success. Phone needs S-OFF because the ROMS are not sighned.
-Tried changing CID, but won't work. Only will work on the Qualcomm One X and One XL.
-Tried commands over ADB, but with no success.
-Tried XTC clip, won't work.

How Do I Know If My Device Is S-ON Or S-OFF?
That is easy to verify. Simply boot into HBOOT (bootloader) on your device, and the text on top will show the flag status as either S-OFF or S-ON. A full root generally means S-OFF.
s-off.jpg


S-OFF – What And Why?
HTC have installed a sort of security check whose level is determined by S-OFF/S-ON. Essentially, this security level is a flag stored on the device’s radio that checks signature images for any firmware before it is allowed to be written to system memory. This hinders using any custom ROMs, splash images, recovery etc., and also restricts access to the NAND flash memory. However, when security level is set to S-OFF, the signature check is bypassed, allowing a user to upload custom firmware images, unsigned boot, recovery, splash and HBOOT images, as well as official firmware that has been modified, this enabling maximum customization of your HTC Android device.

Furthermore, S-OFF also reduces restrictions on accessing the NAND flash memory on the device, allowing all partitions (including /system) to be mounted in write mode while the operating system is booted.

Where is it located?
Don't know yet, here are the partitions.

How can I flash through SD?
Tutorial added here!

What HBOOT status have we seen so far?
ENDEAVORU PVT SHIP S-ON RL
ENDEAVORU PVT SHIP S-OFF RL
ENDEAVORU PVT ENG S-OFF RL
ENDEAVORU XE ENG S-OFF RH
ENDEAVORU PVT MFG RH
ENDEAVORU XE SHIP S-OFF RH
ENDEAVORU UNKNOWN ENG S-OFF RH

Partition list for One X with all addresses and lengths of partitions
Football share the full list which can be found here.

How does HTC do it?
They do it with a smartcard/javacard/goldcard (What ever you want to call it) in combination with the DIAG file. Proof is in the attachment.
 

Attachments

  • s1.JPG
    s1.JPG
    65.8 KB · Views: 12,078
  • s2.JPG
    s2.JPG
    31.1 KB · Views: 9,956
Last edited:

mike1986.

Senior Member
Something more:

/system/etc/Flash_Loader.conf

boot_port_name=/dev/ttyACMX0
fw_download_port_name=/dev/ttyACMX0
baudrate=921600
BootTimeOut=3000
CommTimeOut=1000
eep_normal_mode=m
file_name=/data/modem_work/QUO_6260.fls
#file_name=QUO_6260.fls
#file_name=XMM6260_SIC.fls
#log_fname=/dev/null
log_fname=/data/modem_work/Flash_Loader.log

also

\system\bin\poweron_modem_fls.sh

Line 55: /system/bin/InjectionTool -i ${backup_dir}/QUO_6260.fls.clean -o ${Injected_dir}/QUO_6260.fls -n ${work_dir} -s ${sec_dir}
Line 55: /system/bin/InjectionTool -i ${backup_dir}/QUO_6260.fls.clean -o ${Injected_dir}/QUO_6260.fls -n ${work_dir} -s ${sec_dir}

and

\system\bin\poweron_modem_hboot.sh

Line 50: /system/bin/InjectionTool -i ${backup_dir}/QUO_6260.fls.clean -o ${Injected_dir}/QUO_6260.fls -n ${work_dir} -s ${sec_dir}
Line 50: /system/bin/InjectionTool -i ${backup_dir}/QUO_6260.fls.clean -o ${Injected_dir}/QUO_6260.fls -n ${work_dir} -s ${sec_dir}

And from flash_loader.log

Start downloading item 'CODE:../HW/XMM6260_V2_USB-HSIC_FLASHLESS_EDE_1.0/MODEM_DEBUG/QUO_6260.fls'' from file '/data/modem_work/QUO_6260.fls
 
Last edited:

lckuok

Member
May 23, 2008
35
6
Hmm would buying this tool be helpful to the development of this? Just not sure if this fake or not

Sent from my HTC One X using XDA
 

lckuok

Member
May 23, 2008
35
6
Don't think they can do it remotely, I'm just reading thr the xda cn forums and see if there will release any info there

Sent from my HTC One X using XDA
 

xmoo

Retired Recognized Developer
Aug 19, 2006
5,420
1,797
31
Eindhoven
www.Mohammad.Moghtader.net
  • Like
Reactions: avensakias

evilNathan

Member
Jan 9, 2012
30
26
Someone wrote a software (based on official dev software)that you can use just one click to unlock your device

Sent from my Transformer Prime TF201 using xda premium
 
Last edited:

lckuok

Member
May 23, 2008
35
6
From what I gather from this, http://translate.googleusercontent....1.html&usg=ALkJrhirB5MK3WvhdLHS2DwwB0ljoOLOqQ, apprently someone has developed a file that enables unlocking of the phone, not S-OFF, but allows you to unlock without having to do it through the htcdev website, someone correct me if im wrong.... :/
u are right, that is just a tool for others to easily use the HTCdev to unlock their bootloader

The one mentioning the s-off isn't on a sticky, and no details as of yet

Man its a pain reading thr their forums


Sent from my HTC One X using XDA
 

TwinCalibre

Senior Member
Dec 25, 2011
98
9
London
Can someone who understands Chinese not make an account on the forums so they can download the tool?

---------- Post added at 06:15 PM ---------- Previous post was at 06:10 PM ----------

u are right, that is just a tool for others to easily use the HTCdev to unlock their bootloader

The one mentioning the s-off isn't on a sticky, and no details as of yet

Man its a pain reading thr their forums


Sent from my HTC One X using XDA

Yeah lol massive pain :/, hopefully somone else can shed some light on it lol
 

lckuok

Member
May 23, 2008
35
6
Can someone who understands Chinese not make an account on the forums so they can download the tool?

The tool is on taobao which is like eBay but its just for ppl in China which I hate so much cuz it doesn't support PayPal.

I'm trying my best to spot the tool once its on the forum, but if someone else is more fluent with simplified Chinese and actually uses the xda China forums I think its easier for them to understand what they are talking about.

They have ranking system on their forum so iunno if ranks are needed when something like that is released

I can try to contact the seller of that tool tomorrow and see how the trade works out

Sent from my HTC One X using XDA
 

evilNathan

Member
Jan 9, 2012
30
26
The tool is on taobao which is like eBay but its just for ppl in China which I hate so much cuz it doesn't support PayPal.

I'm trying my best to spot the tool once its on the forum, but if someone else is more fluent with simplified Chinese and actually uses the xda China forums I think its easier for them to understand what they are talking about.

They have ranking system on their forum so iunno if ranks are needed when something like that is released

I can try to contact the seller of that tool tomorrow and see how the trade works out

Sent from my HTC One X using XDA

I come from Taiwan. I think i can help to download that software

Sent from my Transformer Prime TF201 using xda premium
 
  • Like
Reactions: mils69

TwinCalibre

Senior Member
Dec 25, 2011
98
9
London
The tool is on taobao which is like eBay but its just for ppl in China which I hate so much cuz it doesn't support PayPal.

I'm trying my best to spot the tool once its on the forum, but if someone else is more fluent with simplified Chinese and actually uses the xda China forums I think its easier for them to understand what they are talking about.

They have ranking system on their forum so iunno if ranks are needed when something like that is released

I can try to contact the seller of that tool tomorrow and see how the trade works out

Sent from my HTC One X using XDA

Ahhhh fair enough, it seems like someones taken the tool, then just trying to make some money out of it? Even though it looks like you may be able to get it of the forums for free? lol I dunno :/
 
Status
Not open for further replies.

Top Liked Posts

  • There are no posts matching your filters.
  • 141
    Read post #2 before posting!!

    So Football and me are busy with trying to get S-OFF for this Badboy, but it seems to be a hard job. Please be patient!
    Code:
    /*
     * Your warranty is now void.
     *
     * We are not responsible for bricked devices, dead SD cards,
     * thermonuclear war, or you getting fired because the alarm app failed. Please
     * do some research if you have any concerns about content included in this thread
     * read before doing anything! YOU are choosing to make these modifications, and if
     * you point the finger at me for messing up your device, We will laugh at you.
     *
     */


    13-04-2012 XDA.CN releases pictures showing someone succesfully has S-OFF'd his device. Tool is for sale here: http://item.taobao.com/item.htm?id=10824156715
    17-04-2012 Thread made.
    17-04-2012 We have found someone with a S-OFF device, and a newer HBOOT than the one from XDA.CN. Trying to get access to the HBOOT.
    18-04-2012 OTA 1.28 brings HBOOT 0.94.
    18-04-2012 New member with a S-OFF device is willing to help.
    s-off-hboot_HOX.JPG

    19-04-2012 HBOOT 0.43 S-OFF rfs.img received and uploaded.
    19-04-2012 RFS.img is not the correct file, searching continues...
    19-04-2012 Radio located, click here
    26-04-2012 HBOOT probably located here
    15-05-2012 NVFlash app + APX Drivers added
    12-06-2012 Tegra 3 Manual added, see here!
    16-06-2012 HBOOT 1.11 from the test-keys uploaded here!
    16-06-2012 Huge development, read more about it!
    18-06-2012 Need to find a way to by-pass CID check.
    19-06-2012 Football Partition list for One X with all addresses and lengths of partitions which can be found here.
    27-06-2012 Huhge thread clean-up and update.
    04-07-2012 Had the chance to play with a S-OFF device, read more about it here! ENG HBOOT which is used in test, is located here.
    09-07-2012 Javacard with DIAG will work, but won't be a good solution cause no one got a legit Javacard and the DIAG files can't be leaked!
    14-07-2012 Video added which shows the Javacard with DIAG method. Video can be found here.
    14-07-2012 The ENG HBOOT 0.03 that Football uploaded lost it's sign. I re-uploaded it and re-checked the file and it should be good now. You can find the new .zip here.

    HBOOT versions
    Past: 0.03, 0.04, 0.32, 0.43, 0.94, 0.95, 0.96, 1.01
    Current: 1.11

    More to come, please stop PM'ing me!

    89
    My story

    Kantoor.jpg

    The guys of Tweakers.net invited my to there office the play with there Engineering HTC One X device which they got by HTC Netherlands. It is so good to see a huge tech website like Tweakers.net trying to help the community getting S-OFF. Tweakers.net wants to write a review about the new ROM and by this way they could write a official review about the 2.x based ROM of the HTC One X. They want to help the community and the community will help them back ;)

    205.JPG

    Beginning situation:
    Device was running the 1.29.401.11 SHIP ROM with the 1.1204.105.14 RADIO.
    It is a engineering device, in the bootloader it said XE and RH instead of the PVT and RL.
    HBOOT located was version number 0.95, May 8th. CID of device is: HTC__E11.
    The device has a option for RAM Dump, but when I tried to dump the RAM, the phone would just reboot.
    Did not check SD if something was dumped or not.

    First attempt:
    Tried the flash a ENG HBOOT and tried running the DIAG with USB OTG but it failed. The cable did not work because it did not have a extra power supply (no Y USB).
    So basically I gave up. I promised Tweakers.net to flash the 2.05.401.2 TEST ROM (Which comes with a SHIP HBOOT) in return for me to play with his device.

    Test-Device.JPG

    2.05:
    I flashed the 2.05.401.2 ROM with the 2.1204.119.17 RADIO. I flashed the RUU using my MacBook Pro (Virtual Windows 7). That one succeeded and the reviewer did couple of benchmarks. On normal benchmarks it did not have massive improvements, but the browser benchmark went through the roof. HBOOT is now 1.11, May 25th. Suddenly I came with the idea to flash RUU again but change the rom.zip just like I did on past HTC Android phones.

    PJ46IMG.JPG

    Second attempt:
    I ran the RUU and replaced the rom.zip with PJ46IMG.zip (which includes ENG HBOOT 0.03.200, Jan 20th). The RUU tool recognized it as version 0.87.401.0 and I was able to flash it. Flashing went OK. HBOOT is DOWNGRADED!! But the OS would not boot :(

    205-flash.JPG

    Bricked:
    The downgrading of the HBOOT did succeed and the phone is now XE ENG S-OFF but the OS wont boot.
    The bootloader gave SECURITY WARNING. Recovery, Factory reset, clearing cache did not boot or work… So I was in deep ****, don't want to leave him with a bricked device.
    The phone did recognize everything, so I knew the phone was not fully bricked.
    Tried flashing the 2.05 TEST ROM but it would gave me Model error. Flashing the 1.29 SHIP ROM gave me Image error.
    So still only access to HBOOT and nothing else.

    096-hboot.JPG
    096.JPG

    Experience:
    I remembered from the HTC Leo (HD2) and ACE (Desire HD) that the early ENG/MFG/DEV HBOOT's only worked with 0.x based ROMS.
    I did not have the 0.87.401.0 ROM but I did have 0.96.401.2 TEST ROM (Which weird enough has a SHIP HBOOT).
    I tried installing the 0.96.401.2 TEST ROM. It did first flash HBOOT 0.04, Feb 4th reboot and then it started to flash the ROM again. Flashing the ROM almost succeeded but got aborted/failed installing something regarding NFC.

    205-2.JPG

    So bricked again:
    Because of the 0.96.401.2 TEST ROM failing on NFC, the phone did not boot but was in RUU mode. I knew because of the phone being in the RUU mode I was still able to flash it. I ran the 2.05.401.2 TEST ROM and it flashed successfully (Funny enough on this ROM there was nothing regarding NFC which needed to be flashed) and the phone booted. Thank god everything was fine again!! Funny thing is that on all the firmwares (TEST/MFG/ENG/SHIP), the OS did recognize it as a engineering device. So I guess that it is hard-coded or whatsoever in the NAND of the phone.

    What about the DIAG:
    Tried running the DIAG file in the same way I got the HBOOT to flash using the RUU. But it failed because it was not a flashable file. Suddenly I got the phone to read the DIAG file through the root of my MacBook PRO. The file did pass the CID check but then it got cancelled because of the needed for a SmartSD (same as Smartcard/Javacard). So I couldn't do ****. But the DIAG was legit and has version number 0.06.

    So what have we learned:
    HTC One X (ENDEAVOR) was originally the EDGE, the first renders were real and legit. The software was designed for that device but got a final as ENDEAVOR. The ENG HBOOT located in the PJ46IMG.zip is the ENG HBOOT that made the software to work on the ENDEAVOR. The SHIP HBOOT 0.04 was the first legit SHIP HBOOT for the device.

    The HBOOT is downgradable using the .zip but the OS won't work. The good thing is that the ENG HBOOT located in PJ46IMG.zip will work on none SuperCID devices. The file is not restricted to SuperCID just like the PJ46DIAG.zip. BUT… you can't flash the 0.96.401.2 TEST ROM because it is unsigned and replaces your HBOOT to a SHIP HBOOT. Theoretically you would be able to flash a SHIP ROM after the ENG HBOOT 0.03 is upgraded to SHIP HBOOT 0.04 with the 0.96.401.2 TEST ROM. So this gives us a ENG HBOOT which maybe allows us to perm remove secuflag or erase the locking state, so the device goes back to LOCKED using command which are allowed on ENG HBOOT.

    The DIAG file is basically a dead-end without having a SmartSD (Smartcard/Javacard).

    The 2,5 hour meeting brought blood/sweat/tears/happiness. Only thing now left is for someone to be brave enough to Flash the PJ46IMG.zip (which includes ENG HBOOT 0.03.200, Jan 20th) try commands and then get his/her phone back to life using the 0.96.401.2 TEST ROM. CIDs that will be able to flash the PJ46IMG.zip are: HTC__001, HTC__E11, HTC__203, HTC__Y13, HTC__102, HTC__405, HTC__304, HTC__032, HTC__J15, HTC__A07, HTC__016


    It was a 2hour trip to get there and another 2hour trip to go back home. Remember this is a hobby of mine, so please stop asking ETA's, other files or what so ever. Want to show some love? Donate to me and/or Football
    84
    Ok you guys little summary for today.

    Today a XDA Veteran joined the development team! I welcome Football. We did several test and tried to flash couple of stuff.

    1. APX Mode, My device came in APX mode today, but because of lack of drivers I failed to send any commands or what so ever. Howto: Shutdown phone (Disable fast boot), Press volume down, keep it pressed, plugin USB cable to device (while it is connected t your laptop/desktop), wait till you here the sound of new hardware found, release the volume button. You device is in APX mode. Well I think it is APX mode, because my device did not recognize it but did say new hardware.

    2. Flashing through HBOOT. We did couple of check with filename PJ46IMG.zip. We managed to get the boot loader to read the files, some files did flash and other stopped at security check. We tried a modified diag file, we succeeded to let it load, but got canceled on CID check. So we now have found a way to flash to the boot loader but need something to bypass the security check. If we bypass the security check, the modified diag file will be able to load, and we be able to reset security. What gives us S-OFF and LOCKED again!
    Proof is in the attachment.

    3. Downgrading did work, but not possible because of version check. When S-OFF you will be able to downgrade.

    Setup:
    You need to relock boot loader and be on stock rom again, or else it won't work.
    Phone, Y Cable, Cardreader, Microsdcard, PJ46IMG.zip

    Will add a huge summary on post #1 after we finish dinner.
    62
    .

    Closed until xmoo wants to re open
    60
    FAQ.
    What is S-OFF?
    S-OFF stands for Security-OFF
    S-OFF means that the NAND portion of the device is unlocked and can be written to. The default setting for HTC’s devices is S-ON, which means that neither can you access certain areas of the system nor can you guarantee a permanent root. Furthermore, signature check for firmware images is also ensured by the S-ON flag.

    What has already been done?
    -Tried flashing DIAG file, but with no success. File needs SuperCID.
    -Tried flashing ENG HBOOT as zip file, but with no success. File needs SuperCID.
    -Tried flashing modified DIAG file, but with no success. File needs SuperCID.
    -Tried flashing modified HBOOT as zip file, but with no success. Signature check failed.
    -Tried creating a Goldcard, but won't work. The Goldcare is for Qualcomm devices.
    -Root while phone is LOCKED, won't work. Only will work on the Qualcomm One X and One XL.
    -Ask the Chineese guy with the S-OFF tool. Won't share, cause he needs his money.
    -Tried flashing files over recovery, but with no success.
    -Tried flashing TETS and MFG ROMs, but with no success. Phone needs S-OFF because the ROMS are not sighned.
    -Tried changing CID, but won't work. Only will work on the Qualcomm One X and One XL.
    -Tried commands over ADB, but with no success.
    -Tried XTC clip, won't work.

    How Do I Know If My Device Is S-ON Or S-OFF?
    That is easy to verify. Simply boot into HBOOT (bootloader) on your device, and the text on top will show the flag status as either S-OFF or S-ON. A full root generally means S-OFF.
    s-off.jpg


    S-OFF – What And Why?
    HTC have installed a sort of security check whose level is determined by S-OFF/S-ON. Essentially, this security level is a flag stored on the device’s radio that checks signature images for any firmware before it is allowed to be written to system memory. This hinders using any custom ROMs, splash images, recovery etc., and also restricts access to the NAND flash memory. However, when security level is set to S-OFF, the signature check is bypassed, allowing a user to upload custom firmware images, unsigned boot, recovery, splash and HBOOT images, as well as official firmware that has been modified, this enabling maximum customization of your HTC Android device.

    Furthermore, S-OFF also reduces restrictions on accessing the NAND flash memory on the device, allowing all partitions (including /system) to be mounted in write mode while the operating system is booted.

    Where is it located?
    Don't know yet, here are the partitions.

    How can I flash through SD?
    Tutorial added here!

    What HBOOT status have we seen so far?
    ENDEAVORU PVT SHIP S-ON RL
    ENDEAVORU PVT SHIP S-OFF RL
    ENDEAVORU PVT ENG S-OFF RL
    ENDEAVORU XE ENG S-OFF RH
    ENDEAVORU PVT MFG RH
    ENDEAVORU XE SHIP S-OFF RH
    ENDEAVORU UNKNOWN ENG S-OFF RH

    Partition list for One X with all addresses and lengths of partitions
    Football share the full list which can be found here.

    How does HTC do it?
    They do it with a smartcard/javacard/goldcard (What ever you want to call it) in combination with the DIAG file. Proof is in the attachment.