yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] markgolly:
Mainly from tjworld since I have not found a better resource to describe HTC's boot process. Specifically, at http://tjworld.net/Wiki/Android/HTC/Vision/BootProcess, the spot where it talks about what processes are booted into what 'security domain'.

What I believe you've found is the communication method used between the modem (ARM9 core) and Android (ARM11 core(s)).

Of course all of this is how the HTC Vision boots, and I am sure HTC has changed many details between the Vision and the 3D, so I certainly can be wrong....
[HTC EVO 3D] dragonfyre13:
Take a look at the kernel/lk.git branch of CAF, there's a number of pieces which, while certainly not the radio portion, talk to what looks like the radio. There's at least one area where I'm sure it's talking to the radio, and that's on reboot (aboot file I believe)
[HTC EVO 3D] RADLOUNI:
!!!!!!!!!!!!!

I went to HTC page and checked that guy's comment, he mentioned nothing about S-OFF or someone preparing a package to s-off our device. He just said that to root your phone, go to xda dev team/alpha rev, which is true as we have a temp root here at xda

Guys please be accurate when you read and convey information :-)
[HTC EVO 3D] dragonfyre13:
I just posted this in the general forum, in the hopes that someone might have a copy of the schematic. Apparently, the FCC had a schematic for the E3D up on their site, but pulled it shortly after upload. If anyone has a copy of it, please comment here:

http://xdaforums.com/showthread.php?t=1174814
[HTC EVO 3D] markgolly:
I apologize that I do not have the familiarity with the kernel sources that you do. Please point me to specifically what you are talking about....
[HTC EVO 3D] dragonfyre13:
And now I'm replying to myself. It's up here, dig in! Credit goes to wirelessgoodness.com, t2 came through and had it saved.

HTC EVO 3D schematics.pdf - 995 KB
[HTC EVO 3D] mayfield103:
The power of xda!

don't forget to bring a towel!
[HTC EVO 3D] dragonfyre13:
Not a problem!

Here's the aboot section (lots of stuff going on in there, but related to the radio it's just flashing the radio partition I think):

https://www.codeaurora.org/gitweb/quic/la/?p=kernel/lk.git;a=tree;f=app/aboot;hb=refs/heads/master

Here's the target for our device:

https://www.codeaurora.org/gitweb/q...rget/msm8660_surf/init.c;hb=refs/heads/master

Looking at it briefly, I can't seem to find the piece that's storing into RAM, I had thought it was check_reboot_mode in the target file, but on reading over it again I believe that might be talking to flash mem, not ram.

I may very well be wrong keep in mind. I haven't looked over this git tree with the same fervor as the msm.git branch on CAF, since this is all occurring before we get to the linux kernel (this is what decides fastboot vs recovery, etc).
[HTC EVO 3D] jason62082:
nevermind...
[HTC EVO 3D] pbedard:
Go guys show were the bias not HTC!

sent from my EVO 3D use xda premium
[HTC EVO 3D] jason62082:
I don't think this has been said, but according to the schematic, the eMMC reset signal is not controlled by a general purpose I/O pin, it is connected to the dedicated reset system.
[HTC EVO 3D] dragonfyre13:
A few things about the emmc card, just FYI for those not wanting to dig into the schematic:

Looks like it's a moviMCP card from samsung, KMMLL000QM-B503

It has 768MB ram, 4gb flash, dedicated eMMC controller.

jason, I'm seeing that it's part of the reset subsystem, but still a gpio pin (not kernel "gpio" but an actual pin). The good news is that it appears to be attached per the schematic, and the few things that we've been able to show through our work in the kernel line up incredibly well with what's shown here.

Ideally, we should be able to just work around the reset subsystem currently hooking it, and force a reset, but right now it's mostly reconciling what was previously learned about the kernel with what the spec says (again, so far it fits, though the path to the emmc pin, and how it reached from the msm8660 was/is unknown).
[HTC EVO 3D] jason62082:
I disagree with you about being GPIO. If the pin were actually a general purpose I/O (a pin the you can set the direction and value), the symbol creator would label it as such like they did on the other pins on the right side of the symbol.

According to other Qualcomm data sheets, the RESout_n pin is controlled by the RESin_n pin and the software watchdog. Have you tried creating a really long loop to trip the watchdog?
[HTC EVO 3D] Zarboz:
I love you ... Thx

sent from my EVO 3D
[HTC EVO 3D] dragonfyre13:
Couple of things:

A) I'm more than ready to admit I'm not an EE, I could be way off base about what I'm seeing in here. That's part of why I've been attempting to ping agrabren when he's got a bit of time ;). This is something I'm muddling my way through.

B) I'm basing my assumption about it being a GPIO primarily off of the JEDEC spec sheet for 4.41, bits and pieces of samsung info for their emmc controllers (nowhere near current), and information I've read on the application of eMMC by other manufacturers. All of these point to all pins on the eMMC controller being GPIOs, though I'm not sure this is different than the schematic from the bit of time I've been able to spend on it thus far.

C) What "other Qualcomm data sheets"? I'd be interested in seeing those, if there's a historical pattern for these. As far as I know, the qualcomm chipsets changed drastically between 7xxx and 8xxx, but I've even delved into a few of those previously (though not recently). If you wouldn't mind posting a link, I'd be delighted to take a look.

D) The GPIO pins that have labels specifically attached are, from my look into the kernel, the ones that have a software GPIO number associated with them as well (although the mapping isn't exact, it differs in places if I recall correctly).

E) Note that on a previous chipset, although quite different from the E3D, the RST_n pin was in fact a GPIO. As stated, very different chipset, etc.

P.S. I'm more than ready to sit and learn if you want to give a quick write up of what you're seeing that the rest of us (me) should be. :D
[HTC EVO 3D] guitardoc64:
Awesome! I'll give it a look when I get time and see if I can find something.

Sent from my temp rooted Shooter!
[HTC EVO 3D] markgolly:
Aah, schematics! I love 'em. So, what pin on the eMMC is the reset? Was it a supply voltage pin?
[HTC EVO 3D] B-dub25:
This going to be great when I get home that switch is being hit !
[HTC EVO 3D] SpyFi:
Do you think it can be reset like a computer bios by bridging the pins/solder joints? If so im interested in aby findings. The pdf had some really good details about the emmc but can decipher what pin/s it would be yet*

Sent from a blazing fast 1.8 GHZ Evo 3D.
[HTC EVO 3D] hupo224:
Sorry to ask. But what exactly does the emmc do?
[HTC EVO 3D] pbedard:
It controls the RAM and security in the phone

sent from my EVO 3D use xda premium
[HTC EVO 3D] hupo224:
me gusta 10char
[HTC EVO 3D] heathmcabee:
This is what I'm hoping to have answered. Can we get this reset like a old jumper switch on older motherboards that used jumpers to clear the CMOS creating a clear BIOS and STOCK. I think he may be on to something, if it works anything like this. EMMC jumpers deciphered on the Evo3d will probably bring your phone to stock, but maybe it can bypass it enough to load something useful.
[HTC EVO 3D] jason62082:
I was looking at this data sheet. Just to be clear, I'm talking about pin AF32 on LAU1A in the schematic:

http://dev-host.org/0nefe6zcuikf/80-V5775-1_MSM6500_Device_Specification.pdf

I know it's from an older version, but it's probably a similar setup.

P.S. I hope you didn't take my opinion the wrong way. I'm very new at trying to root/s-off a mobile phone, but I do have a lot of experience with Telecom schematics :)
[HTC EVO 3D] EarlyMon:
It doesn't control the ram. It's a traditional flash memory type using a multimedia card (like Sd) interface. Link explaining in post 624.

dragonfyre13 - recall that the final MCP part number in the schematic doesn't match board. photos found here at XDA. I can't recall if I updated my write-up for the difference or not. It may have the full 1 GB on board, unless you've validated to the contrary.

Wishing I could help more with your datasheet or other spec needs.

I do lurk here on occasion to see if things come up that I can help with, but so far, no soap on these specific issues.

Anyway, go team, I'm pulling for you.

(Same name at AF, guess that's not much here, but it's another way to reach me.)
[HTC EVO 3D] Evil-Dragon:
Multiupload link for the schematic, in case the other download link should go down: http://www.multiupload.com/KIWPZF1CX6

I doubt it would but you never know.
[HTC EVO 3D] xHausx:
Question is how much is it going to reset? If we lose the phones SN, mac addresses, etc, we'll want to have a back up of all that to restore with.
[HTC EVO 3D] SpyFi:
Good Question.

Well depending that's a good question. Not sure about how the emmc works relative to a computer bios. I know that toshiba laptops often have 2 or sometimes 3 solder joints you can bridge with an electrical wire and on boot it clears the password and sets is back to default. I am not sure if it's a a safety feature in case you loose your password or a hack. I am guessing it may need to be hard coded into the chip set otherwise your just shorting a circuit. I am not sure if a company would set this as safety feature on a cell phone emmc. I'll dig more.

I found a another emmc document for another chipset that explains all the types of resets for emmc (on this model) I know it's totally different but maybe it demonstrates that it is possible to do at least. I hope this info is useful - www.pigeonpoint.com/pdf/BMR-H8S-EMMC-pb.pdf Here is the schematic showing a reset feature.
[HTC EVO 3D] johnsonjs:
Can we get Rick_Ho on the line please? :D
[HTC EVO 3D] jason62082:
For clarity:

1) What part of the source code are people using to read from the eMMC? Is it part of the Kernel source \drivers\mmc, wpthis?

2) Why can't we just issue CMD29 to disable the write protect group? Is it just not implemented in the source from question 1?

-Jason
[HTC EVO 3D] jason62082:
I actually sent him a linkedin request today. Still haven't heard back though....
[HTC EVO 3D] xHausx:
With the cover off and looking to the left of the top camera, above the sd slot, it looks like there are either two buttons or pads there. Can anyone tell if those are what's marked as LAT2 & LAT3 off the MSM8x60?

edit: You know, if anyone is able to get in touch with him he may be able to talk to someone high enough to allow for the eng hboot to be released. I doubt he's going to want an onslaught of people bugging him about it though. Just a thought...
[HTC EVO 3D] xHausx:
[YOUTUBE]oO4HkPHPJq4[/YOUTUBE]

edit: found it on HTC's facebook...
[HTC EVO 3D] bmtdan:
Dear god ;)
[HTC EVO 3D] miniterror:
Wtf:-o

I hope that aint a photoshopped video

Edit: need testers?

I have insurance on my phone so im not affraid of bricking it.
[HTC EVO 3D] juvenile43:
so weet jezuz
[HTC EVO 3D] danaff37:
Man I want that boot screen... SPAAAAAAAAACCCCCCCEEEEEE

Oh, and all you guys who know so much more about this than me > HTC.

Awesome guys.
[HTC EVO 3D] nerdo:
So that guy from hTC facebook wall was right after all re AlphaRev ... this is reeeeeally good news and an immense breakthrough :D
[HTC EVO 3D] sn0b0ard:
That's awesome! I wonder if that guy on Facebook actually wasn't trolling me, lol.
[HTC EVO 3D] doublecheese:
Sweeeett

For a moment I thought I saw S-OFF then I looked again it was really S-OFF !!!!!

AlpharevX has done it again !!!! Congrats
[HTC EVO 3D] housry23:
OMG!!! This is a huge step in the right direction! I would say that EVO 3D is next(hopefully). I almost kissed my laptop screen watching that video!
[HTC EVO 3D] firsttimer44:
My only concern is the hboot differences. In my case I took the ota when i got my phone so I am sitting here with a hboot 1.4. I believe they did s off on 1.17. I hope that doesn't make things a lot more complicated.
[HTC EVO 3D] xHausx:
That's what I'm thinking, the lowest we have is 1.30 so there are still a lot of variables there. Mine as well keep working on it in the mean time...
[HTC EVO 3D] stealthee:
And thats exactly why im sitting here with the one my phone came with 1.3 think it is.
[HTC EVO 3D] bmtdan:
Man that's a bummer I didn't think about that :'(

Thank god I didn't take the ota though!
[HTC EVO 3D] cordell12:
The exploit is probably still there in 1.30, just may have to go at it from another angle. My guess is the OTA released on release day (h-boot 1.4) could have patched this exploit. Who knows though, at this point its all speculation. Until the AlphaRev beta is released and we can take a lookC, all we can do is start 100's of threads in the E3d forums. LOL j/k

I am dreading to see how many threads wind up started over this :eek:
[HTC EVO 3D] doublecheese:
This is what I was checking with my Sensation just now.

I know that on Incredible S , only some Incredible S `s were S-OFF`ed due to HBOOT mismatch .....

I am guessing the same will happen to us.

I am also on Hboot 1.17.011 just like the one they use on the video ....

But I have applied the OTA but AlpharevX guys did not have the OTA updated yet..

I hope they come up with a general solution for all HBoots
[HTC EVO 3D] IRepTheKing:
I'm just waiting for someone to complain about how excited we all are about the possibility that someone has found S-OFF! It's almost daily someone clicks into a thread simply to yell at a bunch of people who are excited about the new possibilities in their phones.

As for me, I really hope this guy is the real deal. If so, I say.... RELEASE IT TO THE MASSES!!!
[HTC EVO 3D] Evil-Dragon:
I'm happy for whoever gets the job done, either teamwin or alpharev. Either way at least we know it's not impossible with the Sensation now and most likely it will be the same with the Evo 3D since they share similar technology.

Today is a good day for freedom and a smack in the face to HTC.
[HTC EVO 3D] manson1978:
What about the Hboot 1.17.008? Will this work on both?
[HTC EVO 3D] doublecheese:
Nobody knows YET !!!

Just have some patience and wait like we will all do :)
[HTC EVO 3D] sgt. slaughter:
http://xdaforums.com/showpost.php?p=15791923&postcount=32
[HTC EVO 3D] ballr4lyf:
In case you haven't been looking, S-OFF was achieved on hboot 1.30.0000 :D
[HTC EVO 3D] markgolly:
And where did you see that?
[HTC EVO 3D] dragonfyre13:
It only resets data stored in the controller, marked as "power on write" in the JEDEC standard. That's (for the most part) just write protection settings.

Depends on what you mean "read from the eMMC". To communicate with the controller via the CMD line, we're using a couple of methods, easiest one is using ksyms exposed in that branch of the tree. However, keep in mind that's not accessing the hardware pins, that's going through a lot of layers before it gets to where it's dealing with a hardware level.

Check out the JEDEC standard (4.41, I posted earlier in this thread on it) for info on how to talk to the chip, etc.

As for 2, that doesn't reset power on write, just temporary write protection (which they aren't using in this card, it's power on write, which is only reset when powering off the card completely, or using the hard reset pin)
[HTC EVO 3D] AyyRayy:
Here :D

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] GabrielSousa:
are you a beta tester ?
[HTC EVO 3D] AyyRayy:
No this is a screen shot posted by an alpharev team member

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] markgolly:
Heh, you posted before I could update that I found it with a little Google'ing. Thank you!
[HTC EVO 3D] AyyRayy:
No problem, but this sure is exciting news throughout the community, hopefully we can all try this out on our very own devices soon :)

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] cordell12:
looks like that says shipped S-off. Alpharev s-offf will have a pink line on the top saying alpharevx.
[HTC EVO 3D] USSENTERNCC1701E:
For anyone who took the OTA, if it turns out the 1.4 is patched, here is the shipped ROM RUU thanks to xHausx and 911sniper.
[HTC EVO 3D] AyyRayy:
That's a picture before they put alpharev at the top. Watch the YouTube video for the sensation. It first says ship s-off then boots again and it is replaced with alpharev

Can s-off come out and play? You run but you can't hide
[HTC EVO 3D] sgt. slaughter:
that is no help though. it will not downgrade you. youll need s-off to downgrade the hboot.

BUT if you read one of them said it "should" work on all hboots out right now. but guess that could change.
[HTC EVO 3D] pbedard:
Man Abraham gave up he started it all

sent from my EVO 3D use xda premium
[HTC EVO 3D] USSENTERNCC1701E:
Damn, thanks, I've never tried to run an RUU on anything but s-off, lol.
[HTC EVO 3D] bballer71418:
I cant wait for s-off and RecoverWin!!
[HTC EVO 3D] alchemist316:
i dont think he gave up
[HTC EVO 3D] -viperboy-:
From Twitter...

"agrabren: Since @alpharevx has admitted to having s-off on both the Sensation and EVO 3D, dev on #Fre3Dom is officially over."
[HTC EVO 3D] jbrownusn:
First I would like to make this clear, I am not trying to take a jab at anyone for this post, but I feel this needs to be said. Also my profile shows that I am a noob, but I just never feel the need to post much. I dont want to be redundant to other posts, but I do read a lot and refer friends to XDA forums.

I feel that there was a lot of people working on root for our 3vos and TeamWIN went in full force. Now that we have temp root, there doesn't seem to be much going on. We are definitely not in the clear it is still going to be an uphill battle. I know also we are anticipating an unlocked boot loader from hTc in august but as time has proven things don't always go as planned. I expect that it will be at the end of August and when they do release it they will more than likely throw a few curve balls in the package.

Again I apologize if I hurt anyone's feelings with this post it was not for that purpose. I simply think we should beat hTc at their own game.
[HTC EVO 3D] alchemist316:
thanks viper
[HTC EVO 3D] housry23:
Um...AlphaRev Team has already beat them.
[HTC EVO 3D] pbedard:
But there not telling anything or releasing it I be ave was from alpha

sent from my EVO 3D use xda premium
[HTC EVO 3D] swaze:
They are not releasing anything until they have it all cleaned up and error free, which is the same thing they did for all the other phones they have done. It will come soon.
[HTC EVO 3D] netstat_EVO:
Anybody testing on 1.4 ? Eager to find out if this will still apply.
[HTC EVO 3D] CrippleB:
Now now, you have done well don't start down the troll path again.
[HTC EVO 3D] jason62082:
I'm looking in section 7.3.7 of JESD84-A441:

I don't see B_PWR_WP_EN (EXT_CSD[173] bit 0) set in the ext csd that was posted in this thread. And even if it was set, couldn't we set B_PWR_WP_DIS (EXT_CSD[173] bit 6) to disable it?

If I interpret the standard correctly, when the enable bit is '0' and the disable bit is '0', there can only be temporary write protection, if it is set by the SET_WRITE_PROT command. Even, if temporary WP is set, we should be able to disable it by setting the disable bit in the ext csd.

What am I missing?
[HTC EVO 3D] irock1985:
Just for good measure I just ordered a replacement so that I can get some pre-OTA love
[HTC EVO 3D] Philosophy757:
In the thread that's in the general section I believe one of the team members chimed in and said once they clean it up it should work for all hboot versions.
[HTC EVO 3D] 350zfern:
Is there an online method for ordering a replacement? like in the old days?
[HTC EVO 3D] jason62082:
The fact is, we don't officially have S-OFF yet. I know you are all excited, but can we take the excitement to the general forum so the development work doesn't get lost in the pages of nerdgasms?
[HTC EVO 3D] mastibeta:
We do have S-OFF, Fre3dom is no longer in developement. Ya want to develope somthing? Start working on ROMs.
[HTC EVO 3D] pbedard:
Actually no released s off yet

sent from my EVO 3D use xda premium
[HTC EVO 3D] dragonfyre13:
We don't have power on write protect set for the whole card, we've got it set per group. See the group write protect information in the JEDEC standard (see 7.6.12 for an explanation)

I actually did try the CMD29 stuff, on the off chance that samsung didn't comply with spec completely, and it didn't reset write protection. (Tried this very early on in the process). There's even stuff left in the CAF git repo for resetting write protection via CMD29 as well, but that's left over from one of the considerably older JEDEC standards which did allow for resetting power on WP via CMD29.
[HTC EVO 3D] steal25:
Really!!! I didn't know it was released yet and we can all flash ROMS. Dude we all know agrabren said FRE3DOM is no longer being worked on, But this isn't the freedom thread and these guys are probably shooting at different angles, so yeah I agree with jason that the general treads would be a better place to share in our excitement.
[HTC EVO 3D] busventinc:
Might not be released but it sure happened people agraben closed his thread so all team s-off and unrevoked is doing jut tweaking it for all bootloaders so time to bring on the roms case closed

sent from my synergistic RC2 evo og on xda app premium
[HTC EVO 3D] dragonfyre13:
Agrabren has chimed in saying fre3dom is no longer in development by HIM. I'm still poking at it, as is jason, though I would assume with alpharev already having S-Off by all indications, that they will release prior to me completing anything.

Until I've got my phone S-Offed, I'm going to keep poking the bear. Hopefully not, but you never know if we might need it one day (IE new hboot version that patches whatever exploit they are using for alpharev)
[HTC EVO 3D] Scott:
Right on dude! Until my phone (or yours) says S-OFF then keep going!
[HTC EVO 3D] aleksis2010:
+ 1

10 charcrs
[HTC EVO 3D] johnsonjs:
Can someone please explain how the person in the Sensation video is cycling through three different HBOOT versions?
[HTC EVO 3D] Shadowmite:
Let me add, your approach from what I've read is COMPLETELY different from ours and thus certainly merits continuing. You may well hit paydirt as well. If at that time we already are released or not please let us know and we can decide TOGETHER what the best approach is.
[HTC EVO 3D] cordell12:
I agree with everyone in until the S-off is released to the masses keep plugging away!

Thank You
[HTC EVO 3D] mastibeta:
All very true, but with a working method out there. Just be a little patient and you will be good to go. If they release another HBOOT, dont take it. More-over by the time another exploit is found to establish redundancy, there will likely be an official HTC unlock. Just my .02, but by all means, why have one hole when you can have fun.
[HTC EVO 3D] kmdm:
Ok, so, I don't tweet but I wanted to publicly reply to this one - figure this is as good a place as any...

Whilst this is true - that fact is a very minor one. It by no means detracts from the fact that fre3vo is an amazing piece of work - both in its implementation and in the exploit vector itself.

Also, importantly, fre3vo allows us to keep back a temp-root exploit for the future in our arsenal should it ever be needed (e.g. HTC not unlocking some potential newer devices).

In short, fre3vo is an excellent utility, one from which the community greatly benefits from. @agrabren and #teamwin should be highly commended for their effort and the speed at which they were able to bring it from concept to working exploit for the masses along with both their eagerness and willingness to rapidly expand it to support new devices.

If I wore a hat, I'd take it off to you, sir. ;)
[HTC EVO 3D] Tiffany84:
+ 1000000000. Thank U Team Win!!
[HTC EVO 3D] TMartin:
I'm sure they appreciate the gesture. If what has been said is true, and your team has had S-OFF for weeks, why has there been no other word about it publicly?? Especially since it seems you publicly beta test everything else??