yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] Zarboz:
That would be a step in the direction we need to go it won't completely solve the problem but it will help in poking around at stuff. As previously stated by a few people the hboot is loaded after radio wich is preceded by boot Rom.... I was reading that irc convo with agrabren and he had mentioned having scotty2 (creator of Wpthis) lookin at stuff

To assist in emmc unlocking do not be mistaking just cause we could in theory write to emmc doesn't mean it would be as easy as just flashing eng_hboot or ship s off hboot

But would certainly help

sent from my EVO 3D

Here's ruu for but it has the newer hboot in it

http://dev-host.org/h67jtgzd8p0o/RUU_Shooter_S_Sprint_WWE_1.13.651.7_Radio_0.97.10.0530_NV_NV_SPCS_1.16_release_198109_signed.exe
[HTC EVO 3D] unCoRrUpTeD:
I had to abandon it for a while. I've messed with it a little bit here and there, but am waiting for this phone to be rooted and s-off. Then it's on, I have some other projects in mind too.

Back to the subject here....

Looking into the write protection on emmc. Trying to determine which blocks are what. Anyone have a full list of what each block is (/dev/block/mmcblk0pXX)

I know the basic ones.
[HTC EVO 3D] Zarboz:
sent from my EVO 3D
[HTC EVO 3D] dj_L:
Same info in the post above, along with the known mounts and partitions is also in this same thread: http://xdaforums.com/showthread.php?t=1144401&page=14
[HTC EVO 3D] unCoRrUpTeD:
Evo 3D partition layout

For my record and anyone else....

/dev/block/mmcblk0p1------sbl1

/dev/block/mmcblk0p2------sbl2

/dev/block/mmcblk0p3------pgfs

/dev/block/mmcblk0p4------

/dev/block/mmcblk0p5------

/dev/block/mmcblk0p6------

/dev/block/mmcblk0p7------pgfs

/dev/block/mmcblk0p8------wimax

/dev/block/mmcblk0p9------

/dev/block/mmcblk0p10-----spl3

/dev/block/mmcblk0p11-----rpm

/dev/block/mmcblk0p12-----tz

/dev/block/mmcblk0p13-----

/dev/block/mmcblk0p14-----

/dev/block/mmcblk0p15-----splash1

/dev/block/mmcblk0p16-----

/dev/block/mmcblk0p17-----

/dev/block/mmcblk0p18-----radio

/dev/block/mmcblk0p19-----radio_config

/dev/block/mmcblk0p20-----adsp

/dev/block/mmcblk0p21-----boot

/dev/block/mmcblk0p22-----recovery

/dev/block/mmcblk0p23-----system

/dev/block/mmcblk0p24-----data

/dev/block/mmcblk0p25-----cache

/dev/block/mmcblk0p26-----modem_stl1

/dev/block/mmcblk0p27-----modem_stl2

/dev/block/mmcblk0p28-----devlog

/dev/block/mmcblk0p29-----

/dev/block/mmcblk0p30-----pdata

/dev/block/mmcblk0p31-----

/dev/block/mmcblk0p32-----local

/dev/block/mmcblk0p33-----udata_wimax

/dev/block/mmcblk0p34-----misc

Now on to the fun stuff!
[HTC EVO 3D] agrabren:
It would appear that the "important bits" to set are at offset 0x1017c0 of partition 19 (radio config). This will read (in bytes) 25 00 A5 00 03 03. This should be the secure flag. It needs to read 25 00 A5 00 00 00. No other bytes around it should be touched. (All the bytes right before it are 00, and there's some data after the 03 03 that remains the same).

If we can get past the eMMC write protect, either via some internal glitching, or an update.zip or bootloader hack, this should set S-OFF in the radio.
[HTC EVO 3D] steal25:
you two need to collaborate.
[HTC EVO 3D] pbedard:
Ill test it
[HTC EVO 3D] agrabren:
To share one other piece of information...

Since I've met my disclosure requirement to HTC.

Fre3vo works by accessing the msm_rotator object, and requesting to do a 0-degree rotation from fb0 to fb0. This isn't a problem. The problem is, they allow you to specify a completely arbitrary, un-boundary checked offset into the frame buffer. So if you blit from around 0x3DBC0000 to 0x3FFFFFFF, you'll find the ro.protect value which allows is how we mimic psneuter. For the HTC Sensation, it's 0x2D000000 that you start from.

For someone with more time than I have, this exploit could be changed to elevate itself instead of making adb shell happen. The problem is, a shell account or greater is needed to access msm_rotator. If another exploit were found which got you a process in the graphics group, you could elevate yourself to root and remount /data to support suid.

Fre3vo^2 is really just based on mapping around /system. The reason the files are "vanishing" or getting stuck is because they're being purged by the OS to make room in RAM. Unfortunately, because the /system partition in write-protected by the eMMC, the write never completes, and the data is lost. When the OS tries to get it back, it gets confused and fails with the stuck file handles in memory. So I created a tmpfs and over-mounted on /system, and transferred all the goods to /data/fre3vo/system/... and used symlinking. It didn't work all that well, and I decided to spend my time focusing on S-OFF.

Currently, I'm trying to glitch the clocks on the eMMC to see if I can trigger a hard reset of the chip. We only need write access for exactly one page. I already have code which can talk directly to the eMMC, read a block, write a block, check the wrote protection states (They're all marked power-on write protect in the region we care about).

Thanks,

Kevin
[HTC EVO 3D] siraloz:
Mr. Moderator! Kick this agrabren out, he's talking gibberish! :rolleyes:

---------------

On a serious note: Thanks for educating the masses. Great job!
[HTC EVO 3D] agrabren:
Oh, and don't forget to use Code Aurora for a lot of researching the newer kernel code. While it isn't the actual code the EVO 3D or Sensation were built against, it's closer than anything else we've got.
[HTC EVO 3D] unCoRrUpTeD:
I couldn't figure anything out yet.

However I was worried that even with s-off we would still have a write protected emmc. From what I have gathered s-off will unlock emmc giving us full write permissions.

I think we all need to focus on 1 of 2 options.

1. Power cycle the chip and write to the radio.

2. Disable write protection on emmc to allow changing the radio.
[HTC EVO 3D] agrabren:
The RST_n is tied to the PMIC8901 GPIO extender. We need to gain control over that. I'm going to throw myself at that extender tomorrow. If we can get the RST_n assert to the chip, we should be clear to program the eMMC and push the write. Even if the whole OS crashes down after it, we'll have our write in place.
[HTC EVO 3D] Brandas:
Does it mean anything if the my radio config reads 25 00 A5 00 01 01 instead of 03 03? Just figured I would share in case it does.
[HTC EVO 3D] SpyFi:
I know for many this may be far fetched but maybe helpful. I repair electronics as a living and may be able to get some info. From what i understand the emmc is an actual physical chip. I dont have a problem removing my evo 3d logic board and poking around to see if i cant find a way to identify the model and maker so you guys can better search for more info.

Edit: the emmc is the 4 gb onboard memory the system / os is written to much like nand memory i guess i would just need to find the onboard storage and reoort back on any chip identification if thats helpful to anyone.
[HTC EVO 3D] sgt. slaughter:
Yeah we know the model # already from the teardowns. Its made by samsung btw.
[HTC EVO 3D] Zarboz:
If we could do that in theory after accomplishing the write of those few "bits" in a emmc power cycle wouldn't that kill then phone and kick you to recovery or hboot? At wich point the phone would be "s-off" or would we still need a ship s off hboot or eng hboot flashed ? To attain true s off or would this essentially function as a gfree type work for the 3d

sent from my EVO 3D

thanks for the input with development
[HTC EVO 3D] pbedard:
Returning my 3d today I got it when it came out great phine bit useless to me unrooted
[HTC EVO 3D] markgolly:
Just looked at my partition 19. Sorry to pop your bubble, but my bits are already "00 00" and my phone is S-ON.

Now, that could be because I took the bootloader update....:eek:
[HTC EVO 3D] Zarboz:
Is there a way to check this

sent from my EVO 3D
[HTC EVO 3D] agrabren:
What are the bytes before it?
[HTC EVO 3D] markgolly:
The same as you quoted - 25 00 A5 00

However, I'm seeing a number of 25 00 A5 00.... I think it is some sort of marker for raw data structures.

Each of their datastructs are 172 bytes long in this section. My section seems to start at offset 0x101280 and the "header bytes" (those 4 bytes before what should be '00 00' for S-OFF), go:

20 00 A5 00 ...

20 00 A5 01 ...

21 00 A5 00 ...

21 00 A5 01 ...

22 00 A5 00 ...

23 00 A5 00 ...

And so on....

24 00 A5 00 ...
[HTC EVO 3D] agrabren:
Can you run fastboot oem readsecureflag?
[HTC EVO 3D] Nieylana:
Hey, just wanted to let you know the bytes off of my wifes (non-ota) Evo 3d is:

and mine (with OTA) is:

Also, fastboot oem readsecureflag returns 0x03
[HTC EVO 3D] agrabren:
Ultimately, it'll come down to one our two bytes. Once we can write to it, we can identify which bytes are the right ones.
[HTC EVO 3D] markgolly:
:eek: I don't have the fastboot client binary.... Help??

Ubuntu Lucid 64-bit....
[HTC EVO 3D] NxtGenCowboy:
http://developer.htc.com/adp.html

Halfway down the page.
[HTC EVO 3D] markgolly:
Thank you. Just what I needed!

INFOsecure_flag: 3
[HTC EVO 3D] Nieylana:
i've got the fastboot binary but when i put my phone in fastboot mode it shows up as Android 1.0 device (windows) and I dont know where to get the driver for that. any idea?
[HTC EVO 3D] agrabren:
Ok, attaching the current wpthis.c file which I've been using to attack (and talk to) the eMMC. I suffer vanity like the rest of you. I've been staying up till 2 or 3 in the morning trying to be "the first to crack this", but I also can't forget my family, and I do have a job to do so I can get paid. This kept me, in the last few days, from releasing more details about how things were going on Fre3Dom, and I apologize. Fre3Dom is not mine to protect, it was "bought" by all the people who have followed me on twitter, congratulated me for Fre3vo, donated to me, etc. People have taken Fre3vo further than I envisioned it would go before a perm-root would be discovered. And that isn't a statement on how quickly I felt perm-root would be found, it is a statement about the ingenuity of XDA members. XDA isn't a place for people who protect their secrets and are only in this for the glory. And I'm sorry that I started down that path. The reason I had to hold back on the Fre3vo exploit details was because I do have to cover my own butt a little, and since the exploit was found by accident in Qualcomm's graphics drivers, I had to inform HTC of the issue first. Remember, the only reason I can afford to be on here, and enjoy these new devices is because I work all day at a real job. That real job happens to compete directly with Qualcomm in the graphics business on mobiles with it's Tegra line of SOCs. It's very possible that the same Fre3vo exploit could be used to poke directly at memory-mapped devices like the radio. Not sure I'd go that route, but again, the community can do more together than it can alone.

Once we get s-off, regardless of how painful the process is, we can improve it. And by we, I don't mean myself or teamwin. I mean we as the whole community. I'll sift back over the s-off radio configs and look for more details. If people who are finding they have different values for 25 00 A5 00 can send me their p-dump, I'll add it to the pile of s-on and s-off dumps I'm sifting for comparison. Keep in mind that I can't give out all the dumps I have for privacy concerns. But I promise I'll keep everyone posted about where the valuable diffs are and where they aren't.
[HTC EVO 3D] dcplaya:
I know this is the Evo 3D section but do the Sensation share the same eMMC chip? I so would a p-dump from a Sensation help any?
[HTC EVO 3D] Shinzul:
#teamwin! :)
[HTC EVO 3D] RyteSyde:
http://developer.htc.com/

last download on the page
[HTC EVO 3D] curiousGeorge:
So you compete against Qualcomm with Tegra? Or you compete against Tegra with Qualcomm? Qualcomm makes Adreno, not Tegra.
[HTC EVO 3D] MikeC84:
"@LBOOGSHH: Have a EXCELLENT day twitter fam... TODAY WILL BE GREAT! #TeamWin"

What are you hinting at? You releasing something today?
[HTC EVO 3D] unCoRrUpTeD:
He works for nvidia
[HTC EVO 3D] markgolly:
Heh, he'll be the one to crack the tegra phones when they get big.... :p

agrabren, better use a nom de guerre.... ;)
[HTC EVO 3D] DGreen1:
Not trying to get off topic and I greatly appreciate your work along with everyone else but I just have (1) question.

If you work for a competing company who makes the Tegra Processor, why would you be obligated to share your findings with HTC or Qualcomm?

Again Thanks for everyone's hard work, I will make sure to donate!
[HTC EVO 3D] Nieylana:
pretty sure it's a moral obligation mate, because the seriousness of the exploit.
[HTC EVO 3D] markgolly:
Looks like someone used a kernel module to overclock the processor in the 3D and Sensation to 1.7GHz...

https://twitter.com/#!/coolbho3k

Pic:

http://twitpic.com/5mgjse
[HTC EVO 3D] Triumph:
So HTC or Qualcomm can down the road issue a fix. If it was an Nvidia issue, I'm sure he would know who to go (if not himself or the team he works with) to make sure that issue is plugged.

Don't forget, that if we can take advantage of this bug, then down the road hackers can also, and get info from our devices through a bad app or something along those lines.
[HTC EVO 3D] xspeed9190:
when we use setcpu what cpu do we select since this is a whole new chipset then previous Qualcomm devices
[HTC EVO 3D] markgolly:
agrabren, what set of kernel source does this compile against?
[HTC EVO 3D] Vinchenzop:
Think of it as a public service obligation to get the issue fixed so in the future, people with malicious intent won't exploit it to steal other people's personal/private information
[HTC EVO 3D] markgolly:
I have absolutely no idea. Maybe that is what this guy is going to release today....
[HTC EVO 3D] agrabren:
It's both moral and a little anti-competitive in concern. If Qualcomm wanted to argue that NV was using bugs in there code to make their products look bad, then I don't wanna be the scapegoat. I reported their graphics bug within a week of discovery.

I build using the desire hd tree.

Sensation users should wait on sending dumps until we sort one device out. But I promise we will not rest with just the E3D, the sensation will get S-OFF too. It'll almost certainly be the same method, but with a different offset possibly.
[HTC EVO 3D] doublecheese:
Come on guys

Let's concentrate on Agrabren's file and keep this topic clear off other stuff
[HTC EVO 3D] markgolly:
I'm assuming you mean the 2.6.35 kernel tree, right?
[HTC EVO 3D] Compusmurf:
Lots of non android folks use the #teamwin tag for other things.

This guy is a "DJ" and has nothing to do with android so it looks. :)
[HTC EVO 3D] dragonfyre13:
guessing the one from the HTC developer site. And you'll need bits and pieces from the CAF site as well, if you want to compile a loadable module (SMP support primarily, but some others as well).

Looking at your code in a bit agraben. We need to sync up some, IRC or whatever so I can bounce some ideas off of you.
[HTC EVO 3D] AyyRayy:
--------------------------------------------

Bootloader Version...: 1.30.0000

Baseband Version.....: N/A

Serial Number........: HT16HHX09803

--------------------------------------------

downloading 'signature'... OKAY

installing signature... FAILED (remote: signature not 256 bytes long)

this is the error i keep getting in fastboot can we create a 256 byte signature?
[HTC EVO 3D] markgolly:
Well, don't keep me in suspense, what other pieces are you referring to? And, yes, I'll be compiling wpthis tonight and trying it out....
[HTC EVO 3D] xspeed9190:
I would love to contribute to the sensation dump. how do i do it ill do it asap for you and where to submit?
[HTC EVO 3D] stealthee:
Originally Posted by agrabren View Post

It's both moral and a little anti-competitive in concern. If Qualcomm wanted to argue that NV was using bugs in there code to make their products look bad, then I don't wanna be the scapegoat. I reported their graphics bug within a week of discovery.

I build using the desire hd tree.

Sensation users should wait on sending dumps until we sort one device out. But I promise we will not rest with just the E3D, the sensation will get S-OFF too. It'll almost certainly be the same method, but with a different offset possibly.

I would love to contribute to the sensation dump. how do i do it ill do it asap for you and where to submit?

let me help you out here maybe you missed the part you quoted so ill RE RE quote it back for you.

Sensation users should wait on sending dumps until we sort one device out. But I promise we will not rest with just the E3D, the sensation will get S-OFF too. It'll almost certainly be the same method, but with a different offset possibly.
[HTC EVO 3D] Nieylana:
[delete me]
[HTC EVO 3D] agrabren:
Lets remain civil. The sensation guys are more eager than we are. They've been waiting longer to have anything. And they've been very nice and helpful for fre3vo, too.
[HTC EVO 3D] Evil-Dragon:
I will add this, i've been watching more of what has been going on in this forum than in the Sensation section. There's hardly anyone working on any methods for the Sensation. It's lucky that the devices share similar technology, otherwise we wouldn't be any further on, at least from a temp-root point of view.

So, just to say thanks for all your attempts and continued work. I'll be keeping my eyes on this thread.
[HTC EVO 3D] cheflarry:
Open source code of conduct. That is why open source is more secure.
[HTC EVO 3D] urcboss07:
I just want to share E3D hboot differences with and without sdcard:

When I do hboot with sdcard in, here is the result:

SHOOTER XC SHIP S-ON RL

HBOOT-1.30.0000

eMMC-boot

May 20 2011,00:32:22

and here is the result when I hboot WITHOUT sdcard:

SHOOTER XC SHIP S-ON RL

HBOOT-1.30.0000

RADIO-0.97.00.0518

eMMC-boot

May 20 2011, 00:32:22

Have anybody noticed the above differences? I think there is something to do with sdcard as well in order to get S-OFF. What say you?
[HTC EVO 3D] tehbeetus:
That or maybe it's easier to get access to the radio without the SD card in.
[HTC EVO 3D] markgolly:
Whoa, my radio-data partition is *different* with/without the sdcard....

Don't know what the differences are yet, but very interesting....

EDIT: Dang, 0x1017C0 is still the same....
[HTC EVO 3D] Scott:
What does this mean:
[HTC EVO 3D] RVDigital:
It means there is a

rumor

that Sprint is preparing a patch to upgrade the phone to official GB (2.3.4) and possibly Add Google Voice Video or Google Talk Video which will also contain an unlocked bootloader.

If THIS ^ Then --> S-OFF
[HTC EVO 3D] tehbeetus:
It simply means that sprint may be releasing a patch to S-OFF our devices. The reason sprint has to release it is because HTC puts it on the carriers to approve whether or not the patches are stable and if they should be released to the public. HTC could go bat **** crazy and say "They own the phone so they have to flash their own firmware" but sprint has the final say in updating the phone.
[HTC EVO 3D] Zabalba:
http://www.youtube.com/watch?v=7xNSgBkum7o
[HTC EVO 3D] Scott:
Thanks guys. I was like.. GV? Is that supposed to be GB?

Thanks for clarifying.

Crosses Fingers!
[HTC EVO 3D] urcboss07:
I don't know the difference yet, digging thru smart_io crd now.
[HTC EVO 3D] pstevep:
do you have the stock sd card that came with the phone or are you using a different one??

if using stock, i wonder if anything changes with a non-stock card??
[HTC EVO 3D] MikeC84:
Where did you quote that from?
[HTC EVO 3D] Scott:
twitter: agrabren

http://twitter.com/#!/agrabren
[HTC EVO 3D] Zarboz:
Please refer to wip s off thread op xhausx talks about smartcardio

sent from my EVO 3D
[HTC EVO 3D] urcboss07:
I use the stock sdcard that came with phone. However, I reloaded RUU Sprint rom once more time after I messed up the phone. It could be the reason.
[HTC EVO 3D] markgolly:
Full List Of eMMC Partitions?

I know at one time I saw a full list of the 3D's eMMC partitions along with their 'names' (all 35 of them, like 'radio' and 'radio-data', etc...). However, I've been google'ing to exhaustion and can't seem to find it now. (Oh, and I'm not talking about posts #104 and #131 in this thread.)

If anyone can point me to it, I'd be very grateful.
[HTC EVO 3D] ionballer:
http://xdaforums.com/showthread.php?p=15441516#post15441516

click on this and give it a shot i have a sensation and i talk to sprint and went to see if this would help. this guy just might be a idiot tho hopefully this helps
[HTC EVO 3D] unCoRrUpTeD:
I posted most of them a few pages back. There's only a couple I don't know.
[HTC EVO 3D] FractalSphere:
Stupid question and one that might have been asked before - I don't know.

Long story short I'm in the same boat as many others with a replacement HTC EVO 4G after running rooted for most of last year on my original EVO 4G.

Do you think this trick will also work on unlocking the new 2.3.3 S-ON bootloader for the HTC EVO 4G?
[HTC EVO 3D] connerrs:
It can be found in the first post of this thread: http://xdaforums.com/showthread.php?t=1135100
[HTC EVO 3D] markgolly:
No, those aren't the ones I'm thinking of. Maybe someone pastebin'ed it....
[HTC EVO 3D] l33tlinuxh4x0r:
It looks like stock kernels don't support loopback mounting...

ioctl LOOP_SET_FD failed: Bad file number
[HTC EVO 3D] klbjr:
Custom kernel maybe or will root be needed for that also?
[HTC EVO 3D] kthejoker20:
Did anyone try this?

fastboot oem opensesame
[HTC EVO 3D] l33tlinuxh4x0r:
lol 10char
[HTC EVO 3D] DomSim:
I didn't try that, but I did try the konami code. No luck though
[HTC EVO 3D] juortiz85:
I mean I got into the bootloader but its S-on still
[HTC EVO 3D] dsarch21:
up up down down left right left B A Start
[HTC EVO 3D] Rydah:
Hmmm, sounds like your on to something.
[HTC EVO 3D] Tiffany84:
Lmao.
[HTC EVO 3D] Leoisright:
Tiff, when you getting the 3D?
[HTC EVO 3D] jayharper08:
That's what I was wondering also. :D
[HTC EVO 3D] eslogic:
ditto =] =] =]
[HTC EVO 3D] Leoisright:
Where does the ota get downloaded too? Wondering if we can push anything to the updater script at all..
[HTC EVO 3D] Tiffany84:
Probably by the end of the week. I went and checked it out today and I had a hard time leaving without it. Just gotta come up with the rest of the money. Pretty hard choice, rent/evo3d. Lol.
[HTC EVO 3D] xHausx:
The ota gets put in /cache/ and then the update command is placed in /cache/recovery/command

You can manually start the update too by naming it update.zip and placing it on your sdcard.
[HTC EVO 3D] Leoisright:
So haus, couldn't we theoretically change out the updater to modify what gets updated and delete the script that installs the new hboot?
[HTC EVO 3D] Leoisright:
Lol, I hear ya... Are you able to upgrade? If so, trade in your beloved EVO.
[HTC EVO 3D] xdviper:
Wouldn't that mess up the signature on the whole .zip file as well? It'd refuse to apply the update at all.
[HTC EVO 3D] Tiffany84:
I'm eligible now that I called sprint and got it back. But I myself would rather come up with $200 and keep my Evo. To me its like trading in your first car. Just can't bring myself to do it.
[HTC EVO 3D] Leoisright:
Don't know. But only may not update is all
[HTC EVO 3D] skr_xd:
May be this is what you need?

http://xdaforums.com/showpost.php?p=15424392&postcount=225
[HTC EVO 3D] Zarboz:
http://xdaforums.com/showpost.php?p=15419202&postcount=304

these are the dumped ones posted by shinzul idk if its the one in post 104 that you didnt want though
[HTC EVO 3D] sn0b0ard:
Yeah I would say that 100% of that thread is pure troll dung.
[HTC EVO 3D] Tiffany84:
Sorry if this is of topic but what is all this talk about someone receiving an update that unlocked the bootloader? I haven't seen anyone actually post that just people commenting on it and saying the guy was suppose to upload a system dump. Just wondering if someone that knows anything about it could give a little information about it or where that was posted. Thanks.
[HTC EVO 3D] lafester:
That thread is all BS.
[HTC EVO 3D] Nieylana:
sorry dragonfyre