yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] xHausx:
http://xdaforums.com/showthread.php?t=1138870

Now, this is all/mostly speculation by me so take it with a grain of salt. Hopefully someone who knows more about the hboot can chime in if I'm wrong about something.

There are three things that come to mind with this. With HTC's security turned on the hboot prevents access to certain eMMC partitions while the phone is booted in to the ROM. If we could modify it like that it would probably be easier to just overwrite it with the eng hboot. Another thing is that flashing the hboot usually require the boot (kernel) partition to be reflashed before the phone is able to start up normally. So going by that it makes me thing there is a pointer stored there that would need to be changed if anything is modified. The last thing is I'm not really sure where the hboot stores the firmware zips while it is flashing them. I'm assuming it puts it on the cache partition but it's possible it uses the sd card instead.
[HTC EVO 3D] dragonfyre13:
Nevermind, it was already on the forums. Just wasn't looking in the right place...
[HTC EVO 3D] dangerruss:
Would firerats tool for repartitioning system files be aplicable or modified to be useful for the hboot?
[HTC EVO 3D] Zarboz:
Currently we couldn't even write to hboot just read

sent from my EVO 3D
[HTC EVO 3D] Randy D:
setcpu

please for those that have evo 4g still, can you update me on what version you have?
[HTC EVO 3D] dragonfyre13:
Well that's something else interesting. I assumed that HTC used a higher exponent for complexity, but looks like it's 3 (commonly identified as the easiest to crack the RSA encryption for)

tim@DRGNDESK:~/Downloads$ openssl pkcs7 -inform DER -in CERT.RSA -noout -print_certs -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
86:fc:49:b6:2a:e3:a8:07
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=TW, ST=Taiwan, L=Taoyuan City, O=HTC Corporation, OU=SSD, CN=HTC Cert/emailAddress=Htc_Cert@htc.com
Validity
Not Before: Sep 1 08:50:56 2008 GMT
Not After : Jan 18 08:50:56 2036 GMT
Subject: C=TW, ST=Taiwan, L=Taoyuan City, O=HTC Corporation, OU=SSD, CN=HTC Cert/emailAddress=Htc_Cert@htc.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (2048 bit)
Modulus (2048 bit):
00:d0:7d:ad:2f:30:04:c4:99:18:40:02:3d:2b:dd:
41:a8:c5:44:fc:fd:40:f0:f2:17:6e:9a:23:e5:b9:
c4:be:c4:41:7e:ba:fd:da:f3:4a:7b:54:d3:3b:be:
33:6a:8b:06:8d:7a:0d:8a:87:de:2a:df:d0:f7:bf:
b6:f3:ab:0f:74:b0:75:34:f9:ab:6e:41:33:4b:48:
d9:c1:2c:12:04:7a:73:0d:4c:80:43:fd:16:f6:14:
2a:10:51:82:ac:63:45:78:0a:cd:d8:29:b5:64:b1:
a2:17:65:8b:f2:2a:ea:06:ab:66:16:c7:af:4b:44:
44:0d:55:ff:0d:d5:9e:3f:cb:85:51:cf:74:78:de:
da:cb:c4:e5:c1:8a:10:ba:be:d0:e3:99:96:8e:fb:
8d:00:ef:5d:54:66:74:00:65:42:b5:1f:81:a9:b9:
be:d6:22:a6:28:54:63:aa:5c:d6:22:1d:ca:2e:4a:
f2:c8:fe:29:7a:48:71:4e:4d:31:ae:db:d5:8a:93:
7f:32:4e:74:29:7a:04:26:62:64:1a:f7:25:1c:1d:
0b:c1:7f:27:bc:96:95:9c:85:b5:89:6a:2a:33:e8:
90:6d:f9:ac:ba:88:9e:9d:f5:d7:a7:b5:f7:96:fc:
48:95:d4:41:f9:6c:b6:6c:8d:f9:8b:fa:f3:a7:84:
86:5b
Exponent: 3 (0x3)
X509v3 extensions:
X509v3 Subject Key Identifier:
E6:EC:7A:EB:37:33:9A:AA:0B:F8:9A:46:0E:D5:F6:04:D0:D0:A6:F2
X509v3 Authority Key Identifier:
keyid:E6:EC:7A:EB:37:33:9A:AA:0B:F8:9A:46:0E:D5:F6:04:D0:D0:A6:F2
DirName:/C=TW/ST=Taiwan/L=Taoyuan City/O=HTC Corporation/OU=SSD/CN=HTC Cert/emailAddress=Htc_Cert@htc.com
serial:86:FC:49:B6:2A:E3:A8:07

X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha1WithRSAEncryption
87:e7:7f:33:1d:b8:b7:e0:5f:92:42:1a:d4:3d:80:3b:1b:f3:
84:ba:02:45:fb:a3:11:40:e1:cf:93:30:1a:9c:2e:3c:22:66:
3d:7a:f0:8f:cf:07:f5:96:33:06:10:96:ce:6f:66:73:2b:1c:
27:10:a7:3e:d8:45:e2:b9:97:e0:db:12:b0:c4:e4:58:6a:bd:
ec:ae:86:a2:04:9c:22:c9:9b:ed:1b:5e:e2:9d:04:9b:63:1f:
be:e7:f2:8c:00:0a:d6:9f:88:e3:01:23:f2:6e:e1:12:88:37:
18:cb:89:17:b5:8d:84:b0:ce:c5:9c:2c:46:9d:5a:5b:3a:6d:
b6:0a:6d:43:00:76:c4:66:1f:72:07:90:99:ea:c0:8c:73:b0:
4e:ff:4c:b7:56:08:2a:aa:56:b7:38:69:3d:8a:be:7b:67:3c:
6f:f3:28:bf:2e:66:ec:92:78:49:89:c9:b9:90:79:0d:c3:e7:
4b:dc:36:27:0f:4d:51:67:77:8d:e8:34:75:05:37:37:4d:d0:
82:b3:dd:57:9d:2f:c8:7f:1e:65:6a:3f:ea:a8:40:65:9a:53:
e4:05:ed:3f:f2:ec:6a:55:b7:08:db:69:1a:34:bf:76:8f:1f:
ab:75:97:0c:50:a6:12:c7:77:29:2f:b7:b7:01:cd:6d:42:19:
c8:89:61:c1

Doesn't make it any more likely that that's the direction we should go, but if someone wants to check out the feasibility of that route, you can go for it. Just be aware that RSA has been around 20 years, and is still going strong, even using a small exponent.
[HTC EVO 3D] Randy D:
My subject line wasn't posted. Setcpu is was I going for. Any help with with that

would be great.
[HTC EVO 3D] Zarboz:
i wrote to the emmc partition for hboot...

using a code like

dd if=/data/local/tmp/hboot.nb0 of=/dev/block/mmcblk0p18

it accepted the write and busy box verified proper MD5 but i dont have the ENG hboot layin around to use to try with

and the one attached in xhausx's thread is a .bin file?

do i append the file extension to nb0

would this be a plausible way to write hboot

edit

nevermind after further review of checking md5sums

it wasnt writing the enghboot.nb0 it was just saying thru terminal it was

gfree and wpthis wanna power the emmc to do what it does

but it said module loading failed and i dont know how to compile those tools against our phone

im not super l33t at root hacking just porting and rom dev
[HTC EVO 3D] markgolly:
So, what happened? Could you still boot?
[HTC EVO 3D] Zarboz:
root@Voodoo:/home/bryan/Downloads/sdk/platform-tools# ./adb shell /data/local/tmp/wpthis
Build: 25
Section header entry size: 40
Number of section headers: 45
Total section header table size: 1800
Section header file offset: 0x00014e90 (85648)
Section index for section name string table: 42
String table offset: 0x00014cc7 (85191)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000f80 (3968)
-- size: 0x000000c4 (196)
Kernel release: 2.6.35.10-gcb1cf83
New .modinfo section size: 204
Loading module... Failed.
Module returned an unknown code (Exec format error).
root@Voodoo:/home/bryan/Downloads/sdk/platform-tools#

dd if=/data/local/tmp/hbooteng.nb0 of=/dev/block/mmcblk0p18

2048+0 records in

2048+0 records out

1048576 bytes transferred in 0.046 secs (22795130 bytes/sec)

# ./data/local/tmp/busybox md5sum /dev/block/mmcblk0p18

43c5740f70eb4e1706c5b7e01f56b3f0 /dev/block/mmcblk0p18

still not getting a write

i think wpthis or gfree will work if the module is compiled for our phone

could someone assist me in compiling a wpthis.ko against our phone?
[HTC EVO 3D] markgolly:
Without source (at least headers and config) I'm not sure we can.
[HTC EVO 3D] xHausx:
I didn't see the EMMC list yet so figured I would post it

cat /proc/emmc
dev: size erasesize name
mmcblk0p34: 000ffa00 00000200 "misc"
mmcblk0p22: 00fffc00 00000200 "recovery"
mmcblk0p21: 01000000 00000200 "boot"
mmcblk0p23: 31fffc00 00000200 "system"
mmcblk0p32: 00140200 00000200 "local"
mmcblk0p25: 06ebde00 00000200 "cache"
mmcblk0p24: 4aabc400 00000200 "userdata"
mmcblk0p28: 01400000 00000200 "devlog"
mmcblk0p30: 00040000 00000200 "pdata"
mmcblk0p18: 02800000 00000200 "radio"
mmcblk0p19: 007ffa00 00000200 "radio_config"
mmcblk0p26: 00400000 00000200 "modem_st1"
mmcblk0p27: 00400000 00000200 "modem_st2"
mmcblk0p8: 00c00200 00000200 "wimax"
mmcblk0p33: 007ffa00 00000200 "udata_wimax"
#

moar

cat /proc/partitions
major minor #blocks name

7 0 20822 loop0
7 1 21861 loop1
7 2 16664 loop2
7 3 3150 loop3
7 4 3150 loop4
7 5 6269 loop5
179 0 2359296 mmcblk0
179 1 128 mmcblk0p1
179 2 256 mmcblk0p2
179 3 32367 mmcblk0p3
179 4 1 mmcblk0p4
179 5 16 mmcblk0p5
179 6 256 mmcblk0p6
179 7 8153 mmcblk0p7
179 8 12288 mmcblk0p8
179 9 256 mmcblk0p9
179 10 1024 mmcblk0p10
179 11 256 mmcblk0p11
179 12 2048 mmcblk0p12
179 13 1024 mmcblk0p13
179 14 32 mmcblk0p14
179 15 6144 mmcblk0p15
179 16 1024 mmcblk0p16
179 17 256 mmcblk0p17
179 18 40960 mmcblk0p18
179 19 8190 mmcblk0p19
179 20 16384 mmcblk0p20
179 21 16384 mmcblk0p21
179 22 16383 mmcblk0p22
179 23 819199 mmcblk0p23
179 24 1223409 mmcblk0p24
179 25 113399 mmcblk0p25
179 26 4096 mmcblk0p26
179 27 4096 mmcblk0p27
179 28 20480 mmcblk0p28
179 29 4 mmcblk0p29
179 30 256 mmcblk0p30
179 31 16 mmcblk0p31
179 32 1280 mmcblk0p32
179 33 8190 mmcblk0p33
179 34 1022 mmcblk0p34
179 64 31267840 mmcblk1
179 65 31267839 mmcblk1p1
254 0 20821 dm-0
254 1 21861 dm-1
254 2 16663 dm-2
254 3 3150 dm-3
254 4 3150 dm-4
254 5 6268 dm-5
#
[HTC EVO 3D] Zarboz:
Thank you

I dont know if they'll release it and that's not somethin we can sidestep is it

sent from my EVO 3D
[HTC EVO 3D] toastcfh:
ur trying to write the hboot to the wrong block.

$ cat /proc/emmc
dev: size erasesize name
mmcblk0p34: 000ffa00 00000200 "misc"
mmcblk0p22: 00fffc00 00000200 "recovery"
mmcblk0p21: 01000000 00000200 "boot"
mmcblk0p23: 31fffc00 00000200 "system"
mmcblk0p32: 00140200 00000200 "local"
mmcblk0p25: 06ebde00 00000200 "cache"
mmcblk0p24: 4aabc400 00000200 "userdata"
mmcblk0p28: 01400000 00000200 "devlog"
mmcblk0p30: 00040000 00000200 "pdata"
[B]mmcblk0p18: 02800000 00000200 "radio"[/B]
mmcblk0p19: 007ffa00 00000200 "radio_config"
mmcblk0p26: 00400000 00000200 "modem_st1"
mmcblk0p27: 00400000 00000200 "modem_st2"
mmcblk0p8: 00c00200 00000200 "wimax"
mmcblk0p33: 007ffa00 00000200 "udata_wimax"

as u can see above in bold the partition u are attempting to write to is the radio..... on that note if it were to have worked u wouldve bricked ur phone ;x so i suggest researching before attempting to write to random blocks on a phone

on another note the proper block for hboot/bootloader is mmcblk0p13 and no it will not stick when u try to write to it. its write protected (like system, radio, recovery, boot and ect). the only partition i seen that wasnt write protected and that was of use was mmcblk0p34 / misc. this would only be of use in the event of attempting to downgrade with a HTC signed zip. sadly we dont have any signed engineering builds for the evo 3d. htc learned from previous mistakes and did not sign any builds until the release builds (ie .2 and up ruu and otas we have).

ive tried every know way to flash the hboot including having friends at unrevoked and alpharevx take shots at doing it. all attempts have failed so far. we are all still looking into it and hope to find the missing link that will not allow us to flash. anyhow just thought id drop in and give some input.
[HTC EVO 3D] markgolly:
Kernel Source is GPL'ed

They have to release it or they will be in breach of the GPL.
[HTC EVO 3D] Zarboz:
i had assumed as much

the thought with wpthis was one i had after messing with some tbolts and a couple inspires and DHD phones

i did notice the write was to the wrong partiiton after haus posted a emmc partition table and i figured it wouldnt be as easy as a dd if of statement to make a write on the partition

something i noticed in the process of s-off thunderbolt was writing a misc.img to a partition before being able to downgrade?

was this to allow sig to pass in hboot?

if so could we mirror such actions to allow our hboot to flash an older RUU

or will that not help since as you stated the pre release RUU's are NOT signed

ive been up all night thinking on this like i previously stated i am no l33t linux hacker i just port roms and do some tweakin here and there
[HTC EVO 3D] markgolly:
eMMC Chip

Anybody who has torn down the 3D can you tell me what eMMC chip is in use?
[HTC EVO 3D] sgt. slaughter:
Check here http://xdaforums.com/showthread.php?t=1150454&highlight=fix+camera+button

Kinda thinkin its Samsung chip that he couldn't see the #'s on. Least thats my guess after lookin at the others and seeing that the samsung product numbers for their eMMC chips are similar to what he noted in the post.
[HTC EVO 3D] Zarboz:
cat /sys/class/block/mmcblk0/device/name

cat /sys/class/block/mmcblk0/device/name

KLL00M
[HTC EVO 3D] xHausx:
The misc partition was used to change what firmware version the hboot thought was on the phone. By setting it to a lower version it would trick it into letting us downgrade
[HTC EVO 3D] Zarboz:
so could we in essence mirror that with the 3d to let us use an older RUU to downgrade EVERYTHING to a ENG build?

or would it not matter because the RUU with the ENG hboot is not signed?
[HTC EVO 3D] xHausx:
I don't think HTC has made an eng RUU since around the time of the evo 4g
[HTC EVO 3D] dragonfyre13:
Just an FYI, this site has some decent info about eMMC on android (among other things), I've read most of the stuff on there, but didn't find anything seriously useful other than a good basis to work off of for others.

http://tjworld.net/
[HTC EVO 3D] bluejayskater:
For the Desire HD, a (or maybe the only) way they gained root was using first using a temp root tool, then a script that glitches the eMMC controller. It used insmod with a kernel update.

I tried using their script to work with Evo 3d. It seemed to cooperate, minus the kernel update because it has different kernel. Maybe once HTC releases their kernel, we can do something like they did.

Post
[HTC EVO 3D] dragonfyre13:
I have basically 0 experience with suspend mode (suspend to ram, S3), but if someone does a possible attack vector (from what I'm aware of) could be fast boot. Read here:

Hboot->Fast Boot Restart section: http://tjworld.net/wiki/Android/HTC/Vision/BootProcess

If it's suspending to ram, and we've got control prior to shutdown, since it's not reading from hboot on restart wouldn't it be a matter of rewriting the S3 piece of of memory to then flag hboot as writable on bootup when it's rereading? I don't know if eMMC power is actually removed during this period of time, but I've got to think it is. If so, the flag triggering write protection on the eMMC partitions that are RO should be read from ram, since it's not rereading except from the S3 file in memory.

At least that's a thought that popped into my head reading that. Could be completely and totally wrong.
[HTC EVO 3D] dragonfyre13:
Well, this is for an older kernel if I'm reading right. They released the desire HD source a bit ago, which has a 2.6.35 version number. Checking on the sub-minor point version right now, see if it's .10 but theoretically we might be able to build a kernel mod against those headers anyway, if the relevant header files haven't changed between the sub-minor point versions.

I'll go take a look and get back.
[HTC EVO 3D] myersn024:
Hey dragonfyre, I'd be happy to help in any way possible. I don't have much experience with this particular topic, but I've been writing code for about 20 years now.
[HTC EVO 3D] dragonfyre13:
Oh, and http://xdaforums.com/showpost.php?p=8523533&postcount=1 is a darn fine writeup of eMMC as relates to what we're doing.
[HTC EVO 3D] myersn024:
I'm sure this has already been tried, but does anyone have any hard evidence that the MISC/CACHE partition attack doesn't work?
[HTC EVO 3D] dragonfyre13:
If someone has a chance before I post it, could you boot into fastboot and run:

fastboot oem ?

which will give you a listing of the OEM commands (prefaced with INFO)

Then, any commands that end in _emmc that don't start with set_, just run those and post the output up here. Remember to ignore the "INFO" at the start of the line.

EDIT: To run the *_emmc commands, just do:

fastboot oem commandnamehere
[HTC EVO 3D] myersn024:
Here's the commands. I'll have to output in a few minutes.

INFOlist_partition_emmc
INFOload_emmc
INFOcheck_emmc
INFOcheck_emmc_mid
INFOread_mmc
INFOload_modem_emmc
INFOsend_wp_info_emmc
INFOget_ext_csd_emmc
INFOget_sector_info_emmc
[HTC EVO 3D] dragonfyre13:
Just a quick FYI, I've got the source for the emmc write protection disable kernel mod for thunderbolt and G2, working on porting to the e3d now. :)
[HTC EVO 3D] myersn024:
Oh, snap! I'll be a guinea pig if you need one!
[HTC EVO 3D] dragonfyre13:
gonna take a bit. Been a year or two since I wrote a kernel mod from scratch, though this should be considerably easier considering I already have a basis to work from.
[HTC EVO 3D] myersn024:
Like I said before, I'll help however is needed. Shoot me a pm when it's done if you want to.
[HTC EVO 3D] Zarboz:
Wpthis or gfree?

Sweet I would like to be in the loop please keep us updated

sent from my EVO 3D
[HTC EVO 3D] xHausx:
Looking forward to what you can come up with :) In the mean time, thought i would dump some more info here

cat /proc/iomem
00500000-00500fff : ssbi_base
00500000-00500fff : msm_ssbi
00700000-007060ff : hdmi_msm_qfprom_addr
00c00000-00c00fff : ssbi_base
00c00000-00c00fff : msm_ssbi
04100000-04100fff : kgsl_2d0_reg_memory
04100000-04100fff : kgsl
04200000-04200fff : kgsl_2d1_reg_memory
04200000-04200fff : kgsl
04300000-0431ffff : kgsl_reg_memory
04300000-0431ffff : kgsl
04400000-044fffff : msm_vidc.0
04600000-046fffff : msm_gemini.0
04700000-047effff : mipi_dsi
04a00000-04a00fff : hdmi_msm_hdmi_addr
04e00000-04efffff : msm_rotator.0
05100000-051effff : mdp
05300000-053fffff : msm_vpe.0
05300000-053fffff : msm_vpe
12080000-12081fff : ppss_reg
12140000-12140fff : msm_sdcc.2
12180000-12180fff : msm_sdcc.3
121c0000-121c0fff : msm_sdcc.4
12400000-12400fff : msm_sdcc.1
12500000-125003ff : msm_hsusb
12500000-125003ff : msm_otg
12500000-125003ff : msm_hsusb_host.0
16000000-16000003 : gsbi_base
16000000-16000003 : spi_qsd
16080000-16080fff : spi_base
16080000-16080fff : spi_qsd
16100000-16100003 : gsbi_base
16100000-16100003 : spi_qsd
16180000-16180fff : spi_base
16180000-16180fff : spi_qsd
16300000-16300003 : gsbi_qup_i2c_addr
16300000-16300003 : qup_i2c
16380000-16380fff : qup_phys_addr
16380000-16380fff : qup_i2c
16400000-16400003 : gsbi_qup_i2c_addr
16400000-16400003 : qup_i2c
16480000-16480fff : qup_phys_addr
16480000-16480fff : qup_i2c
16500000-16500003 : gsbi_resource
16500000-16500003 : msm_serial_hs
16540000-16540fff : msm_serial_hs_brcm.0
16600000-16600003 : gsbi_qup_i2c_addr
16600000-16600003 : qup_i2c
16680000-16680fff : qup_phys_addr
16680000-16680fff : qup_i2c
16c00000-16c001ff : msm_rng.0
18700000-18700fff : ssbi_base
18700000-18700fff : msm_ssbi
19a00000-19a00003 : gsbi_qup_i2c_addr
19a00000-19a00003 : qup_i2c
19a80000-19a80fff : qup_phys_addr
19a80000-19a80fff : qup_i2c
19c00000-19c00fff : gsbi_resource
19c00000-19c00fff : msm_serial_hsl
19c40000-19c40fff : uartdm_resource
19c40000-19c40fff : msm_serial_hsl
40300000-403cffff : ram_console
40400000-42dfffff : System RAM
4043a000-40b17fff : Kernel text
40b18000-40cd138f : Kernel data
48000000-5a3fffff : System RAM
5a400000-7fffffff : System RAM
#
[HTC EVO 3D] AyyRayy:
That's awesome we are all ready to test when you are. This is big

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] dragonfyre13:
wpthis. Doesn't gfree use rageinthecage? That was my understanding.
[HTC EVO 3D] Zarboz:
Wpthis is what I thought would work

sent from my EVO 3D
[HTC EVO 3D] -viperboy-:
Are the kernels between all of these devices similar enough that this will work? Care to explain (or link) to this mod so I can take a look at it?
[HTC EVO 3D] myersn024:
It may work once the code is ported over. I tried the .ko files from the desire, and neither would load with insmod.
[HTC EVO 3D] Zarboz:
https://github.com/scotty2

https://github.com/scotty2/thunderbolt-root
[HTC EVO 3D] xHausx:
I believe wpthis was patched awhile back, could be wrong though. It sounds like their eMMC set up is different than ours too. Our security flag is set to 3 where the ones they describe were all even.
[HTC EVO 3D] -viperboy-:
Thanks for the link! Looks like someone has their work cut out for them!
[HTC EVO 3D] markgolly:
eMMC Datasheet

I've been looking for the blasted eMMC datasheet all day and haven't found squat. Does anyone have it? It seems to be a Samsung part starting with KMKLL (which is a part that has more than eMMC in it), but I've had 0 luck finding it.

Help?
[HTC EVO 3D] sgt. slaughter:
Nope, I looked earlier when I responded and couldn't find anything on samsungs site. Would like to see another teardown so we can get the full part number though if possible.

Their eMMC part #'s are very similar to the one listed on the chip but none r exactly like it from what i saw.

The photos here have some detail to them btw if you wish. http://tucci999.imgur.com/evo_3d_teardown#r0S0q

Seems its KMKLL000UM-...
[HTC EVO 3D] Zarboz:
Is there a more specific command we can run to Identify the emmc?

sent from my EVO 3D
[HTC EVO 3D] Zarboz:
The last part is b406

sent from my EVO 3D
[HTC EVO 3D] markgolly:
eMMC Datasheet

I think the O (letter O) is actually a 0 (zero), but I could be wrong....
[HTC EVO 3D] markgolly:
Not that I know of. Your post from earlier:

http://xdaforums.com/showpost.php?p=15290096&postcount=138

helped me. I'm about to start checking the kernel source on www.kernel.org for that string and see if I can find the FTL code that has it. Maybe that code has more identifiers in it.
[HTC EVO 3D] sgt. slaughter:
your right, mistype there.

can't believe i can't find anything on this dang chip anywhere. nothing even close to it really. cept partial numbering of some of the part numbers.

all I could find is this product info on samsungs website on these two pages:

http://www.samsung.com/global/busin...es/downloads/memory/mobilememory_brochure.pdf

http://www.samsung.com/global/business/semiconductor/products/fusionmemory/Products_MoviNAND.html
[HTC EVO 3D] B-dub25:
1048576 bytes transferred in 0.067 secs (15650388 bytes/sec)

# md5sum /data/local/HBOOTA.nb0

b01e1937d6552ae35c6585f187d731f0 /data/local/HBOOTA.nb0

# md5sum /dev/block/mmcblock0p13

b01e1937d6552ae35c6585f187d731f0 /dev/block/mmcblock0p13

that was the transfer of the eng_hboot

I'm not sure it stuck thought
[HTC EVO 3D] markgolly:
Yea, all I can gather is that this chip has DRAM and eMMC in it.... I did find in the PDF that Samsung's eMMC uses the eMMC v4.3 or v4.4 spec. I haven't looked at the spec yet as I haven't registered to get it. So I don't know if the spec has implementation details or if we need the datasheet to get those (which is the most important thing right now for busting the eMMC protection...).
[HTC EVO 3D] markgolly:
Doubt it. Others have tried dd'ing it and it didn't stick. The eMMC memory has that partition write protected.
[HTC EVO 3D] Zarboz:
Reboot into hboot and check I don't think it did I was doing the same thing.

sent from my EVO 3D
[HTC EVO 3D] B-dub25:
Do we have a eng boot for this yet?
[HTC EVO 3D] markgolly:
Yea. Its on the 3D dev forum.

EDIT: its here at the bottom of this post....

http://xdaforums.com/showpost.php?p=14960494&postcount=1
[HTC EVO 3D] unCoRrUpTeD:
I was messing with some things and applied temp root. In adb shell I did /init trying to test some thing out. It rebooted my phone into recovery. From there I rebooted the phone. Guess what happened? My phone has been reset to factory. All data and apps are gone. I had to do the setup all over again.
[HTC EVO 3D] markgolly:
Ouch.

I'm trying the SuperOneClick from IRC now. Waiting 15 minutes at "waiting for device"....

EDIT: Doesn't work.
[Verizon Droid Charge] idkwhothatis123:
Hey guys,

Current Thunderbolt owner, dev, and AOSP enthusiast. We are having a hell of a time merging a working RIL (radio interface layer) into roms such as MIUI and CM7. I haven't seen any complaints of a non-working RIL, but do you guys have any AOSP roms with RIL working? PM me if you have, and what lines of codes (of the 40k there are lol) you have edited to get it up and running. you will get full credit if it happens to be incorporated into our stuff. two heads are better than one, most of the time lol. thanks!