yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] TrevE:
well for sure theres more commands what i documented in the wiki. I figured out alot of those by taking apart the RIL library in hex and seing what was in there.

But recovery hopefully will have other stuff - cant figure out much from editing recovery but If you open hboot.img you can see stuff mentioned like AT@CID=, AT@SECURITY=, im sure recovery has its own set of commands

generally anything with a ? at the end of it is a query. if you replace that ? with like an = and some values, it will set them. or should.

The ones that looked interesting to me from when i was testing commands was:

AT$QCSYSMODE (because radio died in regular boot mode, sysmode sounds fun)

AT$QCSLIP ( returned connect, connect to what?)

*Edit* Actually were directly in radio.img it looks like, i can find the AT-Command Interpreter line were hitting so i guess anything recovery.img would have doesnt matter. but radio does have some way of controlling s-off seing we were trying to edit radio-config part earlier. Just dont know what flags or anything we were looking for.

*Edit2* i also updated our synergy wiki with my latest info on "radio serial recovery" to keep all info in one place - https://code.google.com/p/synergy-evo3d/wiki/Radio
[HTC EVO 3D] rpav2004:
SLIP, or Serial Line Internet Protocol is a method of passing IP data via serial communications. You may have hear of it's cousin PPP, which your DSL uses. The Qualcomm chip is probably expecting an identifier to tell it where to connect to, and it's outputting the standard AT/Hayes connection response command.

Edit 1: more here: http://en.wikipedia.org/wiki/Serial_Line_Internet_Protocol
[HTC EVO 3D] TrevE:
thanks buddy - ill update wiki for that.

Digging more into radio, and how other phones were unlocked. From http://tjworld.net/wiki/Android/HTC/Vision/HbootAnalysis

Now i know we dont use sims, but by looking at hboot could it be something similar on our phone with simlock/supercid/pg2fs_ and unlocking emmc. Relevant things i saw:
[HTC EVO 3D] wineguy:
Flame away if necessary...

I'm a noob and I know it, but I was just wondering if anyone realized that CWR installs and runs on a temp rooted EVO3D? It installed, got SU permissions, but I didn't try to go any further with it in fear of doing something wrong.

If this means nothing, sorry to waste thread space....
[HTC EVO 3D] -viperboy-:
How did you do this? via ROM Manager, fastboot, etc?
[HTC EVO 3D] wineguy:
Sorry, like I said, noob. Rom Manager installed with the option of CWR. As I posted, it just came to the red !

Spoke to soon....Apologies
[HTC EVO 3D] seashell11:
What temp root method did you use?

Sent from my EVO 3D!
[HTC EVO 3D] USSENTERNCC1701E:
They are all Fre3vo, same exploit, same root. All Eugene373's method does is change where the SU binaries, BusyBox and SQlite3 are stored.
[HTC EVO 3D] fedge1234:
delete

10 char
[HTC EVO 3D] -viperboy-:
Here is the link for that...

http://xdaforums.com/showthread.php?t=1185866
[HTC EVO 3D] sgt. slaughter:
link for those that want it.

http://xdaforums.com/showthread.php?t=1185866&page=2
[HTC EVO 3D] USSENTERNCC1701E:
That SDCard signature swapping trick TrevE and some others were working on... has anyone tried that and paired it with dc13's rooted stock ROM? I'm willing, just wondering if I need to just rename his file or if I need to do anything with the structure.
[HTC EVO 3D] NinjaWolf:
hey saw this on twitter, i'm guessing these are the sd cards you guys have been looking for:

http://networkedblogs.com/kQRIE
[HTC EVO 3D] jason62082:
Has anyone with an S-OFF Evo 3D or Sensation run "fastboot oem readsecureflag"? I'd be interested to see what that returns on an S-OFF device.
[HTC EVO 3D] TrevE:
has anyone hitup ida pro yet with hboot before i rip my hair out?

the alrogirthms are below

C references

functiions
[HTC EVO 3D] xHausx:
Bad link
[HTC EVO 3D] Zarboz:
It's an article referring to desire series gold card from HTC for store use in repair , or the actual HTC diag card
[HTC EVO 3D] xHausx:
They just have updates on them, it doesn't say they're for unlocking. If you go in to the recovery and push vol up it will give you the option to update from sd.
[HTC EVO 3D] sn0b0ard:
I looked at the HBOOT with revskills a while back. Not sure what use it will be though :(
[HTC EVO 3D] jagaroth:
Yep.

D:\DevTools\android-sdk\tools>fastboot oem readsecureflag

...

(bootloader) secure_flag: 0

OKAY [ 0.010s]

finished. total time: 0.010s

And anticipating your next question I can also writesecureflag.
[HTC EVO 3D] markgolly:
jagaroth, can you get me a dump of mmcblk0p19 from your S-OFF phone?
[HTC EVO 3D] jagaroth:
mmcblk0p19 attached.

Other blocks dumped here -> http://www.sensation-devs.com/index....tition-layout/

Note: From a Sensation.
[HTC EVO 3D] jason62082:
Great. I just wanted to make sure the fastboot command was still able to read (and write) S-OFF is the same way as older devices.
[HTC EVO 3D] pbedard:
mac is the same

i have amac thats similar
[HTC EVO 3D] jason62082:
I think we are actually looking for mmcblk0p18: 007ffa00 00000200 "radio_config" from the sensation. mmcblk0p19 is the radio_config on the Evo 3D.

For whatever reason that link is broken for me.
[HTC EVO 3D] jagaroth:
Radio config.
[HTC EVO 3D] pbedard:
How do we use these files can they be used for s off I know I will get flamed sorry
[HTC EVO 3D] jason62082:
You can't do anything with these files. I was trying to see any differences between the two radio configurations that could hopefully point us to the location of an S-OFF word of some sort.

There are some similarities between the S-OFF Sensation and S-On Evo 3d radio configs, but they are mostly different. It would be more useful to have the dump from that guy yesterday with the S-OFF Evo 3D.

Maybe I'm performing a pointless exercise. I haven't seen it posted, but do we know the location of the S-OFF word?

Just FYI, even if we do know the location, it appears to be write protected in eMMC.
[HTC EVO 3D] jagaroth:
For the most part you look at them in a Hex editor (helps if you can compare to a stock rom). Looking for different values (for example in mmcblk0p3, line 420 S-ON has 31 9A 8A 13 and S-OFF 4E D7 B9 21 ).

The changes "may" be related to security.

Some blocks are data only and some contain code. Poking at both of them with an electronic stick is the way to root, s-off and bricked phones.

Edit: Before you put any effort into mmcblk0p3 I think it is related to SIM/network lock and of no use.
[HTC EVO 3D] pbedard:
I asked a question that's it
[HTC EVO 3D] sn0b0ard:
Yes, you did ask a relevant question: What does one do with the files that are posted? You received two responses indicating that you compare them in hex editors to find any subtle differences between a S-OFF device and a shipped device. I don't think anyone is trying to flame you or anything, if that is what you are getting at...
[HTC EVO 3D] TrevE:
Do we have a full eng release with hboot/radio.img/boot.img/recovery.img/system.img built somewhere? earliest "ruu" i found was no hboot and everyrthings ripped apart- Shooter_Sprint_WWE_1.07.651.1_Radio_radio_0.97.00.0513_NV_SPCS_1.15_release_191892.zipip

*edit*

well i found the hboot, recovery, boot from old thread. do we have an older radio than 97.00.0513?
[HTC EVO 3D] ricoroadstar:
Hey bud, quick question, im texting with the Dev that by buddy got the evo 3d with s-off from. any questions i should ask him other than if i can get a signed eng RUU???
[HTC EVO 3D] ktulu909:
How about a listing of the files on the dev SD card and if we can maybe get those files.
[HTC EVO 3D] jason62082:
Ask him for the private key they use to sign their ROMs. ;)
[HTC EVO 3D] TrevE:
oops well you got a thanks while i was quoting haha

anyway if anyone gets hands on dev device just

dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0.img

this will make an image of every partition on the mmc. well beable to extract everything later. if someone gets this just zip it up and send me a PM and i can give you ftp space or whatevers needed to get the file.
[HTC EVO 3D] TrevE:
so obviously we can write to hboot from our eng brick test earlier, what does everyone think about swapping up to the europe hboot? from what im looking at, it should accept it on any of these models below. It also has new modes, pre-DISP USB. What im hoping for is that hboot serial would be unlocked completly, where on ours i just get FAILnot allowed. Thoughts?
[HTC EVO 3D] Zarboz:
i have handset protection but my 30 days ended on the 24th ...... if theyll replace a phone that doesnt boot (in the event of brick) ill be the guinea pig i could care less as long as theyll replace it. the guy at sprints pretty cool
[HTC EVO 3D] jason62082:
Sounds like a decent plan, but isn't the problem the radio is write protected? Are you hoping that the Euro hboot will have the ability to disable the write protection?

P.S. Can you point me to the post where you were able to write to hboot?
[HTC EVO 3D] Zarboz:
http://xdaforums.com/showpost.php?p=15919634&postcount=740
[HTC EVO 3D] TrevE:
the radio partition is write protected, but if we can get hboot usb we might be able to issue some of these security commands to rip it down. the problem now is were locked out of everything serial but AT command mode in recovery.

There is also commands to enable and suspend the usb we dont have in our hboot which makes me think it could work. and preboot USB serial would always be awesome. it still has CDMA sections in it too, so i it looks like it has the right stuff...

*Edit* this is what im looking at with hopes of serial usb somewhere else

From EU:

from 1.30 us hboot:
[HTC EVO 3D] Zarboz:
I wanna try so bad .....
[HTC EVO 3D] B-dub25:
Ask him if he can go in to radio and do AT&VTS?

And do AT+FRP=? To see if it says ("SC",8"FD",8)
[HTC EVO 3D] TrevE:
yep i know me too, the only thing im worried about is security sigs. I mean the board looks like its supported in the top of hboot and everything, its real possible they sign with all the same key, and its a higher version than our hboot. i was trying to find a reason not to and i cant as of now...

Just got some more playing to do incase i brick for the night...
[HTC EVO 3D] Zarboz:
Godspeed
[HTC EVO 3D] Tiffany84:
If nobody wants to try it let me know when your ready and I'll do it. I am within my thirty days so I'm good.
[HTC EVO 3D] my95z34:
You can put me on that list too. Just got the phone a week and a half ago. lol
[HTC EVO 3D] TrevE:
I wont beable to try till late tonight, so if someone wants to try heres what i would do:

Take PG86IMG_Shooter_Sprint_WWE_1.11.651.2_Radio_radio_0.97.00.0518_NV_SPCS_1.15_release_193503_signed.zip or whatever RUU you are currently on.

Make a copy of it, call it PG86IMG.zip and put it on SD Card #1

Extract the RUU using winrar. Extract the attached EU hboot into the same directory, and rename it the exact same file name as the old one (ex: hboot_1.30.0000_signedbyaa.nb0 if on 1.11)

Make a new archive in winrar. Make it a ZIP+SFX with normal compression. it should name it something .exe, just rename to PG86IMG.zip after, open it up to verify it looks like the original image exactly, then put it on SD #2

reboot into bootloader (adb reboot bootloader or vol down + power) with SDcard #1 in the evo. let it verify the file but DO NOT PRESS VOL UP TO FLASH

Plug evo into AC power (usb really doesnt cut it) pull the battery out, pull sdcard out and put in sdcard #2 and the battery.

Say yes to flash now, watch when hboot goes by and note the status for us.

reboot, go back to bootloader and check out the version. If its good we want to go back to the USB-> serial / linux screen instructions thats a few pages back and try hboot, fastboot and normal boot and see what we can hit

*Edit* if you brick dont kill me, we already broke one :)
[HTC EVO 3D] Tiffany84:
I'm at work right now but if no one has done it by the time I get off I'll give it a shot. Thanks for all the work u have been putting into this TrevE.
[HTC EVO 3D] TrevE:
cool and no problem, i love knowing how lower level stuff and security works so its actually been fun. Got a bunch of great ideas already going through all this for our rom, cant wait to start on that :)
[HTC EVO 3D] my95z34:
If someone wants to throw the file together ill get on flashing it ASAP
[HTC EVO 3D] Bentenrai:
Gonna give this a shot a little later on tonight, I'll drop you a PM if I need to, otherwise I'll post results here. Still in 30 days as well.
[HTC EVO 3D] Bentenrai:
I could get the files together and upload them later tonight if nobody beats me to it, but I got company on the way over right now and they'll give me hell if I'm all in my computer. Been in it all day.

I'm very interested in this and willing to throw a brick on the pile or perhaps help out. Reminds me of the old 'swaploit' exploit on the PSP. Ahhhh... the good ol days of busted fingernails and jammed memory cards. I did get hello world running on day 1 of the swaploit exploit drop.

+1 for low level bait and switch.

Anyway, I'll be back..
[HTC EVO 3D] AyyRayy:
This might work better than the one I tried and bricked. Treve package the golden pg86img.zip and package the modified one so some people can try. Or I will do it when I get home
[HTC EVO 3D] TrevE:
ill see if i can get something uped in a sec. I really hope we can get at some different serial consoles, if you look back a page or two now it looks like usb is enabled in more spots and its signed not like a eng build so it has potential. I have some faith

*edit* upping a modded 1.11 now, about 20 minutes left hopefully someone is rocking wihtout update, a bit busy now but ill do a 1.13 later on if noone can test this.

Just follow above instructions, have PG86IMG_Shooter_Sprint_WWE_1.11.651.2_Radio_radio_0.97.00.0518_NV_SPCS_1.15_release_193503_signed.zip renamed as PG86IMG.zip on sdcard #1

PG86IMG_Shooter_Sprint_WWE_1.11.651.2_swap_with_1.49.007_EU_Hboot.zip thats uploading now as PG86IMG.zip as sdcard #2
[HTC EVO 3D] pbedard:
I have the same hboot as the file ill take the hit what do I need to do just pm me plz so I don't screw up
[HTC EVO 3D] pbedard:
I'm on hboot 1.40
[HTC EVO 3D] pbedard:
I own a mac I can't do any of that
[HTC EVO 3D] sn0b0ard:
To the people saying that they will risk bricking because they are within 30 days: You do realize that one of the arguments that people are making about why HTC / Sprint are hesitant to unlock our phones is because of people sending back bricked devices right?

On another note, good luck TrevE!
[HTC EVO 3D] ktulu909:
Well if they would just give us the keys then we wouldn't have to be risking devices lol
[HTC EVO 3D] my95z34:
I am also on 1.40
[HTC EVO 3D] my95z34:
QFT!
[HTC EVO 3D] TrevE:
ok file upload for testing on 1.11.651.2 with hboot 1.30. This has everything stock from 1.11 except hboot, which is hboot_SHR_U_1.49.0007_20110712_signedbyaa.nb0 renamed to match 1.30 filename.

**************CAUTION*******************

messing with hboot is scary, aray92 bricked going down to eng so you have been warned.

THIS IS A TEST.

i have not tried this, i kinda need phone right now.

Why i want to do this, im looking for serial in hboot that we are locked out of now. see - http://xdaforums.com/showpost.php?p=16022485&postcount=903

pros - looks like our boards supported - http://xdaforums.com/showpost.php?p=16022178&postcount=899

cdma is in the hboot, and itis a higher version so it should pass checks. Its signed unlike eng so hopefully it wont brick.

Cons - its a higher hboot verrsion so going back down might not be possible.

were hoping shooter keys are shooter keys, but that could not be the case and it breaks security.

Once again your doing this at your own risk, kthnx.

now for the fun.

On sdcard #1 put -

http://xdaforums.com/showthread.php?t=1092957 - PG86IMG_Shooter_Sprint_WWE_1.11.651.2_Radio_radio_0.97.00.0518_NV_SPCS_1.15_release_193503_signed.zip renamed too PG86IMG.zip

on sdcard #2 put - http://www.multiupload.com/YURWGPOT8S -

PG86IMG_Shooter_Sprint_WWE_1.11.651.2_swap_with_1.49.007_EU_Hboot.zip renamed to PG86IMG.zip

reboot to bootloader with sdcard #1 in the device (adb reboot bootloader, or vol down + power)

let it verify the file, do not press vol up to flash it. Plug the phone into AC power. now take the battery out, and put sdcard #2 in it. now put battery in and press vol up too flash

Make note of what it says for hboot, pass or fail.

Reboot and pray :) go back to bootloader and look at version. if all is well we hopefully have some new serial consoles to play with using serial cable or screen tutorial which is buried some pages back now

ill do a 1.40 hboot later if nobody can test this or we get great success
[HTC EVO 3D] mcmikecruz1:
Way to go you guys fingers crossed
[HTC EVO 3D] pbedard:
downloading wish me luck
[HTC EVO 3D] AyyRayy:
Hope this all goes well :D
[HTC EVO 3D] my95z34:
Ahhh! Good luck.
[HTC EVO 3D] wrapkgb:
God speed... :)
[HTC EVO 3D] jovanbell:
on the edge of my seat! good luck!
[HTC EVO 3D] DomSim:
well, if it works, we are all going to be real glad you didn't return your phone like you threatened to do oh so many times. maybe even redeem yourself!
[HTC EVO 3D] sn0b0ard:
He should make a reality tv show about the transition from troll life to being a functional member of XDA.

In all seriousness, good luck troll dude!
[HTC EVO 3D] TrevE:
just got some tiime to make modded filie for 1.13.651.7 with a 1.40 hboot. once again it is the stock update with just the hboot changed from eu release to omatch 1.40 hboot file name

***potential brick caution ***

blabhlabhal im not repeating instructions again, see post on previous page.

sdcard #1 file - RUU_Shooter_S_Sprint_WWE_1.13.651.7_Radio_0.97.10.0530_NV_NV_SPCS_1.16_release_198109_signed.zip

sdcard #2 file - http://www.multiupload.com/U1Q0NG9WNI

PG86IMG_Shooter_Sprint_WWE_1.13.651.7_swap_with_1. 49.007_EU_Hboot.zip

rename both to PG86IMG.zip, swap from card #1 to #2 and pray. let me know if anyone gets upgraded for next steps on using screen or a serial cable
[HTC EVO 3D] Vinchenzop:
Don't give him any ideas...
[HTC EVO 3D] my95z34:
Well depending on the results of other people I will try this tomorrow as my area Sprint stores are now closed and I need my phone at work tomorrow.
[HTC EVO 3D] TrevE:
im in the same boat. cant really afford to have my phone off as much as i wanted to try myself. i never like putting anything out that could brick, but i figured everyone in devs smart and could maybe someone else could play if they were as eager as i am and like the idea...
[HTC EVO 3D] pbedard:
Still downloading
[HTC EVO 3D] my95z34:
I was planning on doing it today, but it got late fast, lol. Going on 8 here on the west coast. I would have needed to take it straight to get exchanged right after the potential brick. Being in the Army I need my phone 24/7. Just in case.
[HTC EVO 3D] sn0b0ard:
You know what though? You did it. No one else has released anything close to instructions on how to potentially unlock it and with one post you gave us hope!

I can't risk my phone either. If I could, I would be doing this in a heartbeat.
[HTC EVO 3D] Scott:
See below

Exactly dude! Exactly! Make it safe for us and we will be OK!
[HTC EVO 3D] Tiffany84:
Hey TrevE, could U put one together for 1.11.651.3 and hbot 1.30? My pc is acting retarded.
[HTC EVO 3D] TrevE:
just so everyones on the same page, were trying break a hole in hboot to allow serial, it looks like the EU hboot is alot less restrictive (makes sense, look up windows N) if this works my end goal is to have access to the very low level commands hboot can do, see- http://tjworld.net/wiki/Android/HTC/Vision/HbootAnalysis

tiffany84 - 651.3? i dont think i have that.. the original is 651.2, i didnt know there was another
[HTC EVO 3D] Tiffany84:
Ok. It's the ota before the newest one that's out now. Hopefully I can get my pc working. If someone else has it and can throw it together I would appreciate it.
[HTC EVO 3D] Scott:
What exactly do you need? Sorry I missed the actual request.
[HTC EVO 3D] tehbeetus:
Bam there it is
[HTC EVO 3D] Tiffany84:
Thanks.
[HTC EVO 3D] unCoRrUpTeD:
What's the word from anyone that's tried. Or is every one to scared to try right now. I just passed 30 days, so unfortunately I can't, otherwise I would since I could live without my phone till the morning.

Sent from 3D Land.

"You look even fatter in 3D"
[HTC EVO 3D] sn0b0ard:
Just trying to point out hypocrisy when people say Sprint / HTC are hesitant to release unlock because they want to stop people from returning bricked phones and how people are willing to brick their phones while trying to unlock and then take it back to Sprint like there was some defect with it or something...
[HTC EVO 3D] Tiffany84:
I think only one person is attempting it so far. They were downloading the file. Haven't heard back from them. I'm willing to do it but my computer is not acting right so I can't get the zip together or else I would do it.
[HTC EVO 3D] AyyRayy:
+1 this is a great lead
[HTC EVO 3D] sn0b0ard:
Yeah pbedard is doing it. He's the ex-troll. Hopefully he is successful and posts results :)
[HTC EVO 3D] pbedard:
Ok guys card 1 failed it needs another img called pg86dag.zip looks like its searching for 2 images at the same time

card 2 also failed the same issue pb86dag.zip then pg861mg.zip needs 2 imgs 2 work
[HTC EVO 3D] sn0b0ard:
Are you sure you renamed the files correctly??
[HTC EVO 3D] tehbeetus:
Well you know you're hot swapping them right? OR at least thats why I understand.
[HTC EVO 3D] TrevE:
well card 2 will never verify by it self, it needs card1. did you rename both images PG86IMG.zip ? ive flashed liike this many times....
[HTC EVO 3D] Vinchenzop:
Be sure you're using caps when renaming...
[HTC EVO 3D] sn0b0ard:
Hey just a thought, because you are on a Mac, it might be handling the file extensions differently?? Try renaming the files from a terminal on your Mac instead of from the GUI.
[HTC EVO 3D] pbedard:
Yes I'm sure I did swap them exactly like I was to told i put in card 1 it searched for image .1 but it didn't find it then I pulled the battery and pit card 2 it also searched for image 1 but didn't find it
[HTC EVO 3D] pbedard:
I did it correctly I'm 100% possitive
[HTC EVO 3D] sn0b0ard:
Try downloading the files using your phone. Then using File Manager, Astro, or Root Explorer, rename the file to PG86IMG.zip all caps PAPA GORILLA EIGHT SIX INDIA MIKE GORILLA.zip

lol
[HTC EVO 3D] TrevE:
then you named it wrong, if it found anything right in the root it would auto load it and start checking bad certs or not. you should have never put in card 2 though without getting a verrify on 1.

btw it will _always_ show a fail on the 2 PG86DIAG files, it just looks for them first. next in the sequence is PG86IMG
[HTC EVO 3D] d3vilskid:
From reading this and if this is how you spelled it, its wrong. It's pg86img.zip, what you have the in place of an I is a 1. Unless its a typo.
[HTC EVO 3D] pbedard:
I didnt have my caps on when i did this post

i didnt have the capps on when i did the post
[HTC EVO 3D] mcmikecruz1:
Anyone else trying ?
[HTC EVO 3D] pbedard:
Thats why i dont help

u ppl flame i hope we never get s off
[HTC EVO 3D] DomSim:
correct, both files should be named exactly "PG86IMG.zip"
[HTC EVO 3D] DomSim:
nobody is flaming, trying to help, chill
[HTC EVO 3D] pinky059:
He was trying to tell you the characters, not flame you ;)
[HTC EVO 3D] d3vilskid:
I know, but you still have a 1 where the i is suppose to be at.
[HTC EVO 3D] DomSim:
i can try, but i am on windows so dont know if it would even be worth the risk. input?
[HTC EVO 3D] k2buckley:
? who was flaming you?
[HTC EVO 3D] Tiffany84:
Somebody please make up the zips so I can do this.
[HTC EVO 3D] mbobino:
I guess I'll bite. I dont remember if I'm within 30 days or not but screw it. Got ~15 minutes left on the download then gonna give it a go.
[HTC EVO 3D] sn0b0ard:
Wasn't trying to flame you pbedard. If you look at my earlier posts, I was rooting for you to succeed...
[HTC EVO 3D] pbedard:
I put pg86img.zip
[HTC EVO 3D] DomSim:
latest ota? he posted files for that a bit ago here,

http://xdaforums.com/showpost.php?p=16027548&postcount=934
[HTC EVO 3D] sn0b0ard:
Apparently me.
[HTC EVO 3D] DomSim:
has to be all caps