yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] rejectedkid:
I know this may be out in way left field but is it possible that HTC and other companies might use a low voltage service mode like the psp used to use.
[HTC EVO 3D] aleksis2010:
I am probably late to the party but i just saw this and wanted to share http://community.sprint.com/baw/message/311259?tstart=0 ,i was suspecting it was all sprint's fault and not htc's but you never know. check out the second reply from the admin.
[HTC EVO 3D] johnsonjs:
That's probably what HTC is struggling with. How do you release an update, OTA or otherwise, that if accepted voids the warranty -- if that is what Sprint is demanding? Tough spot to be in but it was HTC's CEO that promised it.
[HTC EVO 3D] sgt. slaughter:
That doesn't really belong here. belongs int he speculation thread about the bootloader if anything at all. I dont see an Admin post either to begin with there. And also its not about accepting an OTA which voids your warranty b/c if that was the case then they would have to leave said OTA in stream till the death of the phone forever incase anyone wants to do it, which is not a very likely thing to happen.

If its unlocked via OTA then its likely to be done like the Moto xoom where you can unlock it yourself AFTER the OTA and in doing so you void warranty, OR you leave it alone and your good.

That or like someone speculated before itll be with ppl calling in to have it unlocked somehow so they can track them.

regardless it wont be w/ an OTA that when you simply accept the OTA you void your warranty. Rather just giving you the option to unlock after the OTA is accepted.

again, non of this belongs in here though, feel free to move my post with others to the general bootloader thread.

Devs keep crackin at this thing and getting closer and closer every day though!!
[HTC EVO 3D] AyyRayy:
The second post is a sprint admin

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] sgt. slaughter:
missed that my bad. regardless all the talk of OTA going out that will void warranty needs to stop b/c theres a 0.000000000001% chance they do that. if by OTA the user will still have to unlock it themselves(ala the moto xoom bootloader somewhat).

looking forward to this next week as seems we have potential to make some strides here. well I guess thats the case every week with the talented group working on this here! :):D
[HTC EVO 3D] AyyRayy:
Yeah buddy. Fastboot oem unlock. Those are the magic words for the xoom :D

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] williamjf77:
another thought,

i was reading up on the android to arduino stuff that was recently announced by google about the usb accessory mode where the android is a host to the arduino. I don't really know any java but i use a little C with avr micros but the arduino supposedly has code that sets up a connection with the android and once recognized it sends either a reply to the phone to tell if it is a usb accessory or adb, i havent really tried anything because i can't decipher the java in the app, but if somebody thinks it could be a possible exploit i can post some solid info

android open accessory developement kit it is called in case anyone is unfamiliar

http://www.google.com/search?client=safari&rls=en&q=android+adk&ie=UTF-8&oe=UTF-8
[HTC EVO 3D] williamjf77:
more ADK

this is the Quote that made me think this could be useful

"The first interface is for standard communication while the second interface is for ADB communication. To communicate on an interface, all you need to do is find the first bulk input and output endpoints, set the device's configuration to a value of 1 with a SET_CONFIGURATION (0x09) device request, then communicate using the endpoints."
[HTC EVO 3D] sn0b0ard:
Absolutely agree with you. People need to stop this speculation bs.
[HTC EVO 3D] xHausx:
http://www.facebook.com/note.php?note_id=10150305151453084

Slightly off topic but thought you all would still like to see it.

So... think they'll spring a leak to ease some of the pressure on them? Doing that did wonders for Motorola
[HTC EVO 3D] markgolly:
The accessory stuff was added in Android v2.3.4. The EVO 3d is v2.3.3.
[HTC EVO 3D] wrapkgb:
Straight from the horses mouth... Good looking out sir!
[HTC EVO 3D] ktulu909:
September? Wow
[HTC EVO 3D] sgt. slaughter:
yeah September is a bit far off for this imho. Having the 3D get it last too....though i guess Sensation has bene out longer so only fair.

THIS is the exact time that 911sniper's blog came in HUGE with the leaks as its 99% likely it would of shown up there weeks before the real thing is pushed.

Can't believe we haven't seen/herd anything at all regarding that since it went off...huge help to the dev community.
[HTC EVO 3D] goodelyfe:
BWAHAHAHAHA august? september?

what a ****ing joke
[HTC EVO 3D] sgt. slaughter:
xHausx,

Once they roll it out to the Sensation in August, will it not be fairly simple to roll the method over to the 3D on our own afterward and not wait till HTC gets to us later?

That is depending on how they go about doing it and all.
[HTC EVO 3D] xdviper:
Hopefully we'll find a leak and just reverse engineer it and go on from there.
[HTC EVO 3D] xHausx:
As you said, it depends on how they go about it. Unless they are doing something to enable the fastboot's already present writesecureflag command my guess is we'll still be in the same position we were before.
[HTC EVO 3D] xHausx:
Back on topic....

If it is the kernel that keeps re-enabling the write protection would a chroot be possible to fix that? I know we don't have any source but that didn't stop Toast with the E4G.

I'm also curious if anyone has had a chance to look at htcfs and fusermount? Maybe it's not the kernel but a running process that is watching the file system and ensuring it stays locked.
[HTC EVO 3D] B-dub25:
Heap allocation(%d Bytes) for eMMC write is failed!
The verify partition is not in sort. Stop eMMC protect verify
start/end index = %d/%d
[PARTITION_ERR] partition_verify_prot_mmc: eMMC initial fail
[PARTITION_ERR] partition_verify_prot_emmc: Cannot find start partition
recovery
--gen_checkpt
--reboot=oem-74
recovery
--gen_checkpt
--reboot=oem-42
--gen_checkpt
Allocte heap for setting struct error!
FNOC?????Restore data from origanal MISC........
Adopting default serial NO. (%s)
123456789012^@^@^@TMUS^@^@^T-MOBO10^@^@^@^@TMA^@T-MOB008
[RECOVERY_ERR] Wrong zipped image!
[RECOVERY_ERR] security check failed!
(signature is not match)
fb_cmd_clearflag:%s
INFOCheck signature .....^@INFOSignature verify
HTCZIPAES90123456789012345678901
import passwd first!!!!
INFODecrypt [%s] %d/%d.....^@^@FAILDecode
R] sp_custom partition: sp_custom_img_hd read error!
DISPLAY_ERR] allocate heap for sp_custom_img_info error!!!
[DISPLAY_ERR] allocate heap for sp_custom_img_info error!!!
[DISPLAY_ERR] non-support image format!!!
[DISPLAY_ERR] allocate heap for unlock_warlost_buf.img_buf error!!!
DISPLAY_ERR] sp_custom partition: unlock_warlost_buf.img_buf read error!!
DISPLAY_ERR] allocate heap for unlock_disp_buf.img_buf error!!!
DISPLAY_ERR] sp_custom partition: unlock_disp_buf.img_buf read error!!
DISPLAY_ERR] allocate heap for unlock_select_yes_buf.img_buf error!!!
Can not load custom splash!
Location of warrant_lost_splash is out of LCD panel!
*** UNLOCKED ****** Security Warning *****
HBOOT^@CPLD^@^@MICROP-^@N/A^@RADIO-^@eMMC-boot
androidboot.baseband=^@^@CID is super CID
androidboot.dq=PASS

There is a lot more I mean a lot more. My place where I upload files is not working so I'm looking for another way

There is a area

All supported names:

writemid

Calculate hboot checksum ( along with recovery,boot,radio,system, ..ect)

hboot CRC checksum = 0x%x
[HTC EVO 3D] xHausx:
Try pastebin.com

I'm guessing that is from a Sensation?
[HTC EVO 3D] pinky059:
Correct me if I am wrong, but I believe the radio, kernel, and the bootloader must agree that it is okay to be S-OFF. I think there is some sort of 3-way protection going on where they all verify each others signatures.

I believe it's both the radio and the kernel that are causing the problem. I see alot of people just attacking the radio and I believe we may have to do both...
[HTC EVO 3D] B-dub25:
Nope thats from a RUU for the Shooter
[HTC EVO 3D] xHausx:
From what I understand the radio has the final say. Previously the hboot could be modified to ignore the radio and unlock it but now the radio checks to see if the hboot has been tampered with and, if the radio is locked, that the hboot is not an eng version.
[HTC EVO 3D] sn0b0ard:
How about if we were able to somehow abort the ruu process after it shows in the log that the phone is unlocked? Then while its aborted or paused, we can gain access to flash?
[HTC EVO 3D] agrabren:
The kernel knows nothing about s-off as far as cracking the device. The kernel isn't re-protecting the memory, it never got unlocked. We're working on it. Sadly, I've been dealing with kids who won't sleep lately, and some time with the wife. But progress is being made. I'm doing more consulting than cracking at this point to a very talented developer. I really believe we're heading in the right direction, but until it works, we won't know for sure. Tomorrow, I get to dive back into it, head first.
[HTC EVO 3D] nerv666999:
I realize I might be projecting here but by employing the description of "vinegar and water" do you by chance mean douche? because if so I am LMFAO and really glad to be a witness to the breach birth of the EvO 3D. I have no doubt we will reach the promised land together, though there ,may need to be a douche or two ejected along the way......:D
[HTC EVO 3D] sn0b0ard:
msm_watchdog.enable=1

I was sifting through the hboot_1.40.nbh file and found references to msm_watchdog. Specifically it has msm_watchdog.enable=1 flagged to load in the kernel when the device boots. I was researching online and found that it can be used to detect 'changes to code in rarely used codepath'. Apparently this can reset the device whenever it detects lockups or any sort of interrupts. Researching further about 'petting the watchdog' I found that these systems can revert to a fail safe state to protect the core of the system. Maybe this is why our /system is reverting back after making changes to it.

Here is some information about this if anyone is interested:

http://en.wikipedia.org/wiki/Watchdog_timer

http://www.gossamer-threads.com/lists/linux/kernel/1359716?do=post_view_threaded

https://patchwork.kernel.org/patch/665491/
[HTC EVO 3D] Jon.StatiK:
Wow, I remember reading about this years ago It seems like. Interesting that It's been implemented into a phone system as at the time I heard of it it was mainly a desktop solution. If this is what it seems to be hopefully we can do something with it.

Sent from my EVO 3D Dual-core beast.
[HTC EVO 3D] Zarboz:
Watchdog.runs on my thunderbolt

sent from my EVO 3D
[HTC EVO 3D] Evil-Dragon:
msm_watchdog also runs on the Sensation and is in the hboot.

There is also a watchdog for the power management: pm8058_enable_watchdog (pm8058 is one of the Qualcomm chips) but this is probably normal and unrelated to anything here.

EDIT: There's a reference to htc_watchdog_status in the radio.img. Also there's a reference to secure_flag under a HTC_SSMEM (The only thing i can find about SSMEM is this: http://www.controller-designs.de/index.php?lang=de&cat=projekte&cont=ssmem&sub=)

Just a few of my ramblings and observations that i've made looking through some files. Probably not very useful.
[HTC EVO 3D] danaff37:
That's exactly what I meant. These "my phone is useless to me rooted, I'm returning it and thirty days and htc said" guys are really getting on my nerves.
[HTC EVO 3D] B-dub25:
OMG!!!!!!!!!!!!!!

I probably just thinking I did something but has anyone ever get this

ize of command data..........*********:424

Sending signal ...... to read cmd data

Size of command data..........*********:424

Sending signal ...... to read cmd data

Size of command data..........*********:424

Sending signal ...... to read cmd data

Size of command data..........*********:424

Sending signal ...... to read cmd data

Setting the api flag to : 0

Size of command data..........*********:424

Size of command data..........********

I'm a little worried about resetting at the moment so anyone please give me some feed back
[HTC EVO 3D] l33tlinuxh4x0r:
what did you do??? What commands were used?
[HTC EVO 3D] B-dub25:
I decrypted the hboot and it was saying that the unlock only can happen through the cmd I don't know if I should go into hboot or not
[HTC EVO 3D] xHausx:
You were able to decrypt it? Any chance you would be able to post it somewhere?
[HTC EVO 3D] mhespenh:
...Give a few more details?
[HTC EVO 3D] Zarboz:
i would like to see this can you put on pastebin plz?
[HTC EVO 3D] B-dub25:
sorry I'm past/bin the hboot and on the irc
[HTC EVO 3D] B-dub25:
http://pastebin.com/3Hj1nMyK

some of it re-inverted back but it should be good enough for now I still have more
[HTC EVO 3D] markgolly:
Hey, if you have the complete unzipped hex of the hboot, please paste it. I've got a way to disassemble it and turn it back into ARM assembler code to see what the hboot is doing....
[HTC EVO 3D] Zarboz:
Get on irc

sent from my EVO 3D
[HTC EVO 3D] markgolly:
I'll be there in 10 min. Have kids to put to bed.
[HTC EVO 3D] markgolly:
Aaah, what channel is it?

nvrmind. I'm there....
[HTC EVO 3D] Scott:
freenode server

Channel: #htc-evo-3d
[HTC EVO 3D] Evil-Dragon:
What method did you use to decrypt the hboot?
[HTC EVO 3D] markgolly:
Looking at what Bdub posted, I don't think he actually 'decrypted' (as in crypto) anything. I think it was more of a 'finding human-readable strings' embedded in the hboot bin. The reason I say that is because I've been looking at the hboot via hexedit on Linux for close to a week now, and I can see all of the strings Bdub pastebinned just by scrolling through (no more, no less).

I'm interested in what commands he sent to the radio to get his phone in such a silly state last night. Bdub, care to let us know?
[HTC EVO 3D] Evil-Dragon:
I did think this, i'd been looking over the hboot for the Sensation in a similar way via a hex editor and it's very similar. It's a shame, i actually got excited that someone had decrypted it. :(
[HTC EVO 3D] dragonfyre13:
I posted a logcat towards the start of this thread including startup and shutdown.
[HTC EVO 3D] markgolly:
Well, the fact that there are plain, human-readable strings in there makes me think that there isn't any crypto or even compression going on. But I very well could be wrong....
[HTC EVO 3D] dragonfyre13:
Coming from someone that has very little experience disassembling roms (some minimal experience with a straight ELF), I popped it into IDA and it doesn't look encrypted at all. I can get you guys a pretty nice dump of the strings and such, but it's not going to help much unless we know what it's doing while spitting out those strings.

If someone has more experience disassembling, they very well might be able to use those though.

On a side note, agrabren and I have been working quite a bit on this, we've made some good progress, and things are starting to look up. Stay tuned for more, but we've had a few good breaks recently, so hopefully that keeps up. I've got a considerable amount more time than him, so I've been stealing him when I can, and working through things more slowly when he's not around. Hopefully that will offset his lack of time currently.
[HTC EVO 3D] dragonfyre13:
By the way mark, if you've got questions, ping me. I'm generally on IRC.
[HTC EVO 3D] B-dub25:
What we did with the hboot is turned it from hex->to readable strings . My buddy is does cryptography so we made a custom tools using his algorithm. I would share the tool but its not mine to give and I think he may be pretty mad about . With the phone I was looking over the hboot and there is a line that pops up in almost every file that was decompiled ANDROID! with too special characters after. Also the commands qmud and cmdline are directly connected to each other which is interesting. I did somethinglasy night sending commands to radio and my phone rebooted . I'll have to look at that after class today.
[HTC EVO 3D] markgolly:
IDA as in IDA Pro made by Hex-Rays? Oooo, I'd love some time with that....
[HTC EVO 3D] markgolly:
I wasn't after any kind of tool(s), I was really just looking to replicate what you did. I usually find another set of eyes helps me see things that I miss.

Anyway, when I killed rild to use /dev/smd0 to send commands to the radio, my phone shut down (as opposed to rebooting) after about 4-5 minutes. Surprised me, but then after thinking about it, the shut down makes sense as a protection measure.
[HTC EVO 3D] B-dub25:
Sorry I've been in class, but the command I did in order was

mount -o rwmount,rw -t yaffs2 /dev/block/mmcblk0p18 /

chmod -R 755 * ( in the radio partition )

qxumd AT@secureflag=0x0 | rild

If you look at there cmdline file its a message to the kernel that states

androidboot.watchdog=enable

qmud is linked to this file so I'm wondering if we can change that to stop the reset.

Now last night I did another command while overloading ( trying to at less ) the radio

that one made my phone reset and now has been acting a little off since.

I did add another user to the uid and grp, I labled the user as root for both.
[HTC EVO 3D] pbedard:
Did it give u any s off or on read out
[HTC EVO 3D] markgolly:
Well, first, mmcblk0p18 is VFAT, not YAFFS2. Shouldn't be a big deal, though, with the eMMC protections....

Second, I don't see qxmud or qmud anywhere in the hboot. Maybe its in the radio. Hummm....

Third, I never thought of doing the AT@secureflag command. Double hummm....

EDIT: "at@secureflag" and "at@secureflag?" return "ERROR".
[HTC EVO 3D] B-dub25:
Yea the yaffs2 was a typo lol sorry I'm doing three things at once

qmud is in bin and it is linked to cmdline which is stated in hboot

how are you executing the command
[HTC EVO 3D] markgolly:
through adb after rooting

EDIT: I can't seem to find qmud anywhere on my phone. I took the OTAs - maybe that's why?
[HTC EVO 3D] danaff37:
I haven't taken any ota's, and I have a qmuxd in my bin
[HTC EVO 3D] Evil-Dragon:
It's in /system/bin and it's called 'qmuxd'

What does qmuxd do exactly? I can't find any proper references to it on Google.
[HTC EVO 3D] Evil Bob:
Found a what's what list for a Motorola CM7 GingerBread ROM and there is a little bit in there about qmuxd and write states, may want to bug the CM team and see if they have anymore info for you.

Link: http://simply-android.wikia.com/wiki/What's_What_-_Motorola_MB501
[HTC EVO 3D] markgolly:
Yep, typo threw me.

Has something to do with calling....

http://www.simply-android.com/discussion/659/rom-help/p1

Last entry.

If I had a guess (and this is just a guess), I'd say it has to do with mux'ing sound from different sources together for your earpiece or to go out "over the air" to the cell tower. (i.e. so that you can hear driving directions from Google Nav while talking on the phone.) Again, just a guess.
[HTC EVO 3D] Evil-Dragon:
There is actually a lot of reference to QMUX in the radio.img. Not sure where it will go but not a bad line of enquiry to have a stab at.
[HTC EVO 3D] rejectedkid:
Guys forgive me for being off the current topic but I noticed a new vending.apk is being released and is available for download. Being a system apk can this market app be tweaked to help us?
[HTC EVO 3D] bmtdan:
i would be mad if it could lol since i just installed it
[HTC EVO 3D] xHausx:
Nope, it just gets installed like a regular app
[HTC EVO 3D] lawnguy:
Updates???

Haus, take the updates or no? i've seen answers both way now?
[HTC EVO 3D] xHausx:
I've updated my market, not my phone though.
[HTC EVO 3D] lawnguy:
ok, is the market update just an apk. or did you pull it from an update?
[HTC EVO 3D] Zarboz:
on my phone looking around with root explorer

does anyone else have hbooteng.nb0

in data/drm or did i leave it there

edit nevermind theres a bunch of stuff in here leftover in data/drm/tmp
[HTC EVO 3D] DomSim:
I don't

10char
[HTC EVO 3D] Zarboz:
Things in data/drm persists after reboot

sent from my EVO 3D
[HTC EVO 3D] sn0b0ard:
The hboot file extracted from the RUU is like hboot-1.4.00-signedaa.nb0 or something similar to that, so if you are seeing hboot-1.4.nb0 on your phone, maybe theres a difference?
[HTC EVO 3D] Zarboz:
It was residual from playing with the phone when. I got it.... but they've (the files) persisted after all kinds of tampering

sent from my EVO 3D
[HTC EVO 3D] bigfoottrucker:
Ok, just curious. How many here sweet talk their devices when trying a new exploit? Keep up the good work guys.
[HTC EVO 3D] Evil-Dragon:
It feels like progress has really slowed since HTC announced the unlock time frame. Has anyone got anything new?
[HTC EVO 3D] jmana:
Yeah I think they finally came to the conclusion that it's harder than they thought to unlock this phone. They are probably tired of spinning their wheels looking for a way to do it, and are probably relieved that HTC has officially promised to do it. At least they tried, and they did get the phone semi rooted which is more than I thought they could do!
[HTC EVO 3D] seashell11:
Developers are still actively working on getting s-off on this phone. Please keep messages like this out of the development thread. Only post in here if you have something useful to say.

Sent from my EVO 3D!
[HTC EVO 3D] phonetec:
booo-yaaaaaa
[HTC EVO 3D] dragonfyre13:
We are still working on getting perm root, but yes it is considerably more difficult than on previous devices. Where on the G2, it was relatively simple to just pull the hard reset pin, we have to actually talk to the hardware directly on this device. The current information points to it being behind another chip, which also means it's not as simple as just pulling a standard pin either. We have to convince the chip in the middle to do it, and of course in doing so learn how to communicate properly with that chip in the middle.

On top of all of this, there's the fact that there's no reliable pointers in the code as to which chip this pin is hanging off of, so some of what we're doing is working blind. What we aren't working blind on is actually taken from the qualcomm git tree, which is neither entirely accurate for our phones, nor entirely complete for some of what we're doing. If HTC would release the source, we would be able to pin some of our assumptions down much easier, but as of now that's not an option.

We're still making progress, actually have a few relatively recent developments that are looking good, but no perm root as of yet. We are still working on it though, fast and furious, it's just taking a while.

Also to note, part of the reason there's not a ton of discussion here on the forums is because we've got a plan of attack at this point. We're always looking for new methods, but right now a lot of the work we're doing is either:

A) probing the existing kernel for information to see if our assumptions are correct

B) fixing the code that assumptions were not correct on, or attempting to work through why something failed when your phone simply shuts off and refuses to boot back up, or

C) reading kernel source code to trace various information in and through the devices, drivers, and through kernel memory

As we run into things that we might be able to have people help with, I'll be trying to post those here, but rest assured that we certainly are still working on it, and definitely have not given up (nor do we currently plan to). When I give up, I'll be sure to throw something up here to let people know, along with whatever I can dig up on my progress in the hopes that someone outside of the group can take it up and keep moving forward. But I don't see giving up until I either prove that it's impossible (not likely) or get it right.
[HTC EVO 3D] zonyl:
Do you just need someone to crack open the phone and follow the trace?
[HTC EVO 3D] -viperboy-:
So let me speak for everyone here when I say...

ETA?!?!?!?!?!?!?!?111?!?/

You must have given up.

I needz root, noawwwwwwwww!

I'm going to return my phone since no one has gotten me S-OFF yet.

:p :p :p

But really, thanks for all the great work you and everyone else is doing. You guys are all very talented!