yashsingh1/xdaforums huggingface dataset:
[HTC Amaze 4G] Binary100100:
Comparisons

Comparing xboarder's s-off XE device and my own s-on PVT device I have concluded the following: (paritions in red indicate interest)

loop0 are completely different up to offset 0020A400

mmcblk0p1 is identical

mmcblk0p2 is identical

mmcblk0p3 is different at offset 424 AND there's a "security, simlock, HTCU, etc" hints present. ??? Further examination required but I might have something here.

mmcblk0p4 and p5 are different but I'm pretty sure it's just basic device information such as serial number.

mmcblk0p6 are completely different.

mmcblk0p7 is slightly different at offset 424 (interesting) a few differences following thereafter.

mmcblk0p8 is interesting. s-off device is completely blank while s-on is filled with data.

mmcblk0p9 are completely identical.

mmcblk0p10 are completely identical.

mmcblk0p11 are completely identical.

mmcblk0p12 are different but probably because he has 1.90.2005 and I have 1.90.0008. Vast differences.

mmcblk0p13 is slightly different. s-off has the serial number while s-on does not.

mmcblk0p14 are identical.

mmcblk0p15 are identical.

mmcblk0p16 is slightly different. s-off does not possess firmware version whereas s-on does. Extra value at offset C40 s-off is 00 whereas s-on value is 01. Other than that they are identical.

mmcblk0p17 are identical.

mmcblk0p18 are identical.

mmcblk0p19 are identical.

mmcblk0p20 are completely different.

mmcblk0p21 are identical.

mmcblk0p22 are completely different but that's probably because I'm using the newer Faux123 beta13 kernel.

mmcblk0p23 are different because it's recovery.

mmcblk0p24 is yet another reason that supports my MISC theory. Offset C40 s-off is 00 whereas C40 s-on is 01.

mmcblk0p25 are identical.

mmcblk0p26 are identical.

mmcblk0p27 are completely different.

mmcblk0p28 are completely different.

mmcblk0p32 are completely different.

mmcblk0p33 are identical.

mmcblk0p34 are identical.

mmcblk0p35 are identical.

End of partitions.
[HTC Amaze 4G] Binary100100:
Partitions of Interests

The following partitions are of interest for obtaining s-off.

loop0 are completely different up to offset 0020A400

mmcblk0p3 is different at offset 424 AND there's a "security, simlock, HTCU, etc" hints present. ??? Further examination required but I might have something here.

mmcblk0p8 is of particular interest since they are so different.

mmcblk0p16 is slightly different. s-off does not possess firmware version whereas s-on does. Extra value at offset C40 s-off is 00 whereas s-on value is 01. Other than that they are identical.

mmcblk0p24 is yet another reason that supports my MISC theory. Offset C40 s-off is 00 whereas C40 s-on is 01.

Possibly mmcblk0p7, mmcblk0p13, mmcblk0p27, mmcblk0p28 and mmcblk0p32

And none of those files seem to be included in any RUU files.
[HTC Amaze 4G] Nshih422:
Pardon my incompetence, but would it be benificial to have everything as close to the same as possible like the hboot and kernel I know that would eliminate some of the inconsistencies. I know we have to work with what we have but its a suggestion.

Regardless, I know you're really busy and I really appreciate your effort.
[HTC Amaze 4G] :
I was thinking the same

Sent from my HTC Amaze 4G
[HTC Amaze 4G] Binary100100:
Anyone in The Netherlands or UK with a spare device they are willing to sacrafice for s-off?
[HTC Amaze 4G] raiden9250:
Are those partitions flashable, or just read only
[HTC Amaze 4G] Binary100100:
They are

all

read only.

The only partitions that an unlocked bootloader will allow are:

boot.img (partial, can't be updated by cwm)

cache.img

recovery.img

system.img

data.img

The other 30 are read only. So I guess 5 out of 35 partitions aren't too bad for an unlocked bootloader. :rolleyes:

I've tried everything that I could think of last night. I've tried:

placing them in a PH85IMG.zip with unlocked bootloader

booting to RUU and using the fastboot flash zip rom.zip method,

Goldcard method with PH85IMG.zip with unlocked bootloader

Goldcard method booting to RUU then using fastboot flash zip rom.zip method

Used "dd if=/sdcard/xpartition.img of=/dev/block/mmcblk0pxx" method for all partitions of interest

fastboot flash method

flash_image method

SMART_IO on sdcard hacking

Anyone have any other ideas? I'm fresh out.
[HTC Amaze 4G] :
Can you convert those hex numbers to code? We should figure something out like apk tool did with apps. Being able to reverse engineer is the first step to hacking apps so this could be true here as well.

Sent from my HTC Amaze 4G
[HTC Amaze 4G] Binary100100:
No idea. Don't think so.
[HTC Amaze 4G] :
Let's start with the basics. How is alphanumeric converted to hex?

Sent from my HTC Amaze 4G
[HTC Amaze 4G] johnk1973:
Looks like the blind leading the not so blind.. Lol
[HTC Amaze 4G] neoissuperman:
do you think it might help to use a stock locked bootloader? does anyone have the exact same HBOOT as Xboarder with S-ON? Just thinking it might reduce the differance's....
[HTC Amaze 4G] :
What do you mean? Do you feel a troll today? Just asking.

Sent from my HTC Amaze 4G
[HTC Amaze 4G] Binary100100:
It's not so easy to reverse engineer a closed source code and drivers.

The Android Open Source is available and the HTC Source Code is available but that only applies to the partitions that we have access to. Boot, data, system, cache. There are over 30 partitions and we don't even know what over half of them are! Many would be used to control the overall function of the device.

It depends. If xboarder has an extra partition (which he

does

) it might be that HTC flashed a seperate image to allow s-off. Kind of like your unlock_token.bin file. You flashed that to get s-on unlocked, right? How do you know that you didn't just flash and overwrite an entire blank partition with data? This works both ways. I could have a full partition and he could have a blank one. Or he can have a full one and I can have a blank one. He also has an XE device where I have a PVT one. The bottom line is that I need to know ALL variations to make any progress at all.

Go ahead and reverse engineer a closed source. Have fun with that. :rolleyes:

By the way... when your finished let me know how you plan on writing to a R/O partition.

Does anyone have a 1.90.2005 s-on hboot? If they do I can compare them but I don't think it'll matter anyway. We still need a way to downgrade (possibly misc.img file editing somehow) then to hex edit the hboot.img file and to somehow flash it. Keep this little fact in mind. Almost every OTA we've received included a new hboot.img file. If the same new hboot.img file was flashed then how do the s-off phones still have s-off with the s-on hboot? Hmmm? Again... theory goes to it not being in hboot anymore thus the focus on other partitions.

Let's keep on track so I don't have to delete several pages of worthless comments please. I've dedicated HUNDREDS of hours to this and I've accomplished practically nothing. Yet I have a HUGE demand for it which is why this person with NO programming or coding experience is working on making bricks for noobs. That is why I want to give it to someone else to take over.
[HTC Amaze 4G] dj tray:
my HBOOT is 1.90.0004 s-on eMMC-boot Sept 15 2011.

Mind you, i bought this device off craigslist. I am not sure if anything other than what i did was changed before hand.

Please dont bash me. I'm just trying to help
[HTC Amaze 4G] xboarder56:
all good buddy we dont need s-on ones
[HTC Amaze 4G] neoissuperman:
So this is a total noob shot but... i read on android police that total comander allows you to change permissions to read only partitions as long as you have root access... If that granted the ability to write and we changed all the 01's to 00 in the partition's highlited by BINARY possibly help? I know it's probably not possible just throwing it out there.

Sent from something AMAZING!!!!

Sent from something AMAZING!!!!
[HTC Amaze 4G] Binary100100:
These partitions are not a simple text file.

They are in many cases very large and compiled partitions.

I'll give you an example. If you make a nandroid backup of your recovery or boot file you would have recovery.img and boot.img. That is what we have to work with. Using a file browser would not work. I'll show you what I mean.

Use adb shell.

now cd to /dev/block and tell me what you see.

You should have this:

dm-0
mmcblk1p1
mmcblk1
mmcblk0p36
mmcblk0p35
mmcblk0p34
mmcblk0p33
mmcblk0p32
mmcblk0p31
mmcblk0p30
mmcblk0p29
mmcblk0p28
mmcblk0p27
mmcblk0p26
mmcblk0p25
mmcblk0p24
mmcblk0p23
mmcblk0p22
mmcblk0p21
mmcblk0p20
mmcblk0p19
mmcblk0p18
mmcblk0p17
mmcblk0p16
mmcblk0p15
mmcblk0p14
mmcblk0p13
mmcblk0p12
mmcblk0p11
mmcblk0p10
mmcblk0p9
mmcblk0p8
mmcblk0p7
mmcblk0p6
mmcblk0p5
mmcblk0p4
mmcblk0p3
mmcblk0p2
mmcblk0p1
mmcblk0
loop7
loop6
loop5
loop4
loop3
loop2
loop1
loop0
vold
platform

Now use a file explorer, any file explorer. Let's use Root Explorer for example.

Where are those files? All you will see is platform and vold. The rest aren't available. Even if they were then what would you do with them? You can't edit, add, remove or replace them. I've tried to use the dd command to write over them and I did it with every single s-off partition xboarder provided. Can you guess what happened? That's right! Nothing. Absolutely nothing. My CID hasn't changed, serial number hasn't changed, hboot hasn't changed, s-on hasn't changed. It seemed to take at first and I had hopes but after a reboot to bootloader I was greatly dissappointed. As I stated before... I tried everything that I could possibly think of. Plus I would think that if HTC and service providers discovered an Android app so powerful that it could easily delete all of those protected partitions it would probably be removed from the Market within the hour. :rolleyes:
[HTC Amaze 4G] neoissuperman:
Ok, i figured... So can we start a collection to purchase and ship one of these to REVOLUTIONARY? i can kick in this weekend...

Sent from something AMAZING!!!!
[HTC Amaze 4G] :
Seems the last good option.

Sent from my HTC Amaze 4G
[HTC Amaze 4G] Binary100100:
We don't even need to do that.

I already made contact with Revolutionary.

http://xdaforums.com/showpost.php?p=21810248&postcount=346

I haven't heard anything back yet.
[HTC Amaze 4G] seansk:
this is kind of beyond my scope of knowledge, but I would like to make a suggestion, perhaps it will help speed this process. We know that the HTC vivid and rezound both have not gained S-off yet, would it be better for the developers to work together on this issue, as someone mentioned to me that it seems the latest HTC phones we have run into a brick wall trying to gain S-off.

good luck
[HTC Amaze 4G] gbgadgets:
Binary,

Can I PM you with some thoughts on this post? You were giving examples of using Root Explorer on the /dev/block folder and mention not being able to see the partitions. If you could see the data on the partitions, and it was mostly encoded, is that something that has been looked at? I am not sure how the 'compare' was done for all the partitions from S-On to S-Off where you listed the differences. I would think that would have been done looking at the data, with perhaps an emacs file diff or something. Anyway, when I go into the /vold folder and see all the 179:x files listed, and then send the output of those to a file, and open those files, there is some readable text in them. Let me know if you want me to PM you with more details if any of this sounds at all useful.

Just messing around with the phone here in spare time.
[HTC Amaze 4G] Binary100100:
I pulled my partitions and used HxD to compare with the partitions pulled from an S-OFF device. I repeated the process for about 30 partitions. It took about four hours to do the entire thing. Feel free to download the s-off partitions that xboarder posted and do the same if you want to have a crack at it. I disabled my PM because I've been way too busy the last couple days with my profession due to a important person visiting the area. I can't be distracted by something like this at the moment.
[HTC Amaze 4G] mcs117:
Just a food for thought, this idea came from the psp hacks to upload custom firmware. A concept is to force the system to go into service mode, so it bypasses all security, so you can load custom bootloaders and ROM. This is to recover bricked systems. Any way to hotwire the jtag to make it need to go into that other mode? If it's been tried or impossible, then just ignore this.
[HTC Amaze 4G] Binary100100:
As far as I know it hasn't been tried. There is a device that is supposed to do this called xclip or something ernother. I believe xboarder bought one but there's still no hope for the Amaze. :(

I'm not savvy enough to open up my phone and start shorting pins in hopes to find the right combination to find s-off. Even if I was I would not want to release that information to the forums becaues noobs would be messing up their phones left and right. You wouldn't believe how many people start new threads on here saying "I reed and seerched but I cant find out how 2 root my fon!!!! Do I needz s off?" :rolleyes:
[HTC Amaze 4G] mcs117:
Would the concept of that java card? be the sim card? Like it's looking for the smart_io.crd. But we need to find the smart_io file, and check its size and see if it can be stored in one of those sim cards. I'm tossing things into the air at the moment. But those java cards are essentially smart cards, and a sim is essentially a java card, am i wrong?

Actually, scratch that. This gets too complicated. Is it possible to check if your smart_io call change with and without a sim card?

Also what's in mmcblk0p31

In the EVO 3D, people hacked the s-off onto it by modifying the CID in mmcblk0p31... Maybe we can try it here...
[HTC Amaze 4G] Binary100100:
Uhh... mmcblk0p31 is data. LOL! So that wouldn't work. What is the mmcblk0p31 partition?

I found this:

/dev/block/mmcblk0p31 293599 293600 16 0 Empty
[HTC Amaze 4G] mcs117:
I found my CID in mmcblk0p31 offset 9DA4038 - 9DA403F along with IMEI.

I might be wrong, but if we forced the CID on the mmcblk0p31 to be s-off, and port it back... it tricks the phone to thinking it's s-off... this is all guess. But the final problem, how to modify this block....

there are more than one locations with the CID and IMEI... And the thing is huge(i stopped it at 1.6GB), if it's only data, then how does it store those data of the CID....
[HTC Amaze 4G] Binary100100:
What? p31 is userdata.

http://rootzwiki.com/topic/7027-amaze-4g-mount-points/

And even if we did use the Evo 3D method we STILL need a modified bootloader to flash which we don't have. Remember that each device is different and not all partition mount points are the same. Heck even the Vivid has different mount points than the Amaze and it's just about the same phone. Even the Sensation has different mount points! Thus the techniques may vary depending on devices.
[HTC Amaze 4G] mcs117:
any place i can download the s-off partition mounts? filefactory is currently making me pay to download them...
[HTC Amaze 4G] Binary100100:
That right there is exactly why I told xboarder to stop using those stupid file sharing services.

Luckily I still have the zip file. Give me some time to upload it.
[HTC Amaze 4G] Binary100100:
Here you go.

S-OFF Partitions provided by xboarder56.
[HTC Amaze 4G] lainemac:
Wow I cannot believe the level of intelligence of these fine people. I feel like we're super close to having s-off! :D
[HTC Amaze 4G] Binary100100:
Pretty much what I was thinking too.

http://xdaforums.com/showpost.php?p=21785486&postcount=342

http://xdaforums.com/showpost.php?p=21785486&postcount=343

However I cannot figure out how to edit the values in these partitions. I've tried everything I could think of. You appear to know more about this than I do. Perhaps you're onto something here.
[HTC Amaze 4G] Binary100100:
Maybe I didn't look hard enough but I didn't see anything in mmcblk0p08 for s-off devices. I'm not looking at it now just going off my notes from last week.
[HTC Amaze 4G] mcs117:
There is nothing in s-off devices. These things are solely on S-on...

And i found something really cool in hboot :D I'm trying to tidy it up :\
[HTC Amaze 4G] Turboboxer:
Well, yea but pronounced like I spelled it.
[HTC Amaze 4G] mreeekay:
I noticed I had a hard time getting into the recovery menu also since my g2. I have fastbook checked also so...

Turn off your phone, take out the battery, put it back in, then hold the power and volume down button, then it will go into recovery.
[HTC Amaze 4G] Willieumm:
Fastboot needs to be unchecked.
[HTC Amaze 4G] bizal05:
so if I have ship S-on, I just download the Ship s-on file place onto SD card and boot into hboot mode? what happens after that?

I tried and its says checking file then just goes to the bootloader main screen
[HTC Amaze 4G] macheteZen:
To install a new bootloader you need to have S-off. So nothing. Not much you can do until you have S-off. Temp-root is about the extent of it, but nothing will last past a reboot because you have S-On

Also please read OP carefully-
[HTC Amaze 4G] homais:
HOLY GUACAMOLE!!! Congrats man!! x youre a beast...
[HTC Amaze 4G] Binary100100:
I was thinking...

If we can get a working recovery then we should (in theory) be able to put the hboot in a .zip flashable folder with the following command in the update-script

write_hboot_image PACKAGE:hboot.img

However I'm also thinking that we might be able to do that from the system itself.

Any ideas?

I researched means of making it happen and I found this:

http://htcevohacks.com/htc-evo-hack...ection-and-install-recovery-menu-permanently/

Understanding that this is for a different device, it may still work for ours.

I'm thinking that if we:

unlock the bootloader

obtain root

push flash_image to /data then chmod 755 the flash_image binary file

then simply use the flash_image enghboot.img file to the appropriate partition.

What do you guys think?
[HTC Amaze 4G] xboarder56:
i talked to the revolutionary guys about this comand:

dd if=/sdcard/hboot.img /dev/block/mmcblk0p12

but they said that it wouldnt work because its right protected dont have amaze 4g to try but anyone with permroot can and report back if it works

you download a hboot from this thread extract zip folder copy hboot.img to sdcard

and then adb shell and then dd if=/sdcard/hboot.img /dev/block/mmcblk0p12

but to warn be carefull and do md5's becuase this is verry dangours "could brick"
[HTC Amaze 4G] Binary100100:
I updated the previous post with the flash_image binary. Should make things easier.
[HTC Amaze 4G] xboarder56:
you could test man as i dont have amaze 4g till next week

i would test with just the ship s-off one for now

i got a stock hboot in there that should work if you need to reflash
[HTC Amaze 4G] Cadeo:
You have fastboot on, that needs to be turned off in the settings or turn your phone off and take out the battery and than put it back in and do that process again. holding the volume key down + power key to get to hboot mode,.
[HTC Amaze 4G] homais:
You guys are really lucky cuz this guy can do anything...Roms to recovery to miui to aosp to sense... :) x thanks one again for everything you brought to the sensation
[HTC Amaze 4G] TheSneakerWhore:
2011 and Its spellingis still butchered ;)
[HTC Amaze 4G] xboarder56:
we are working on recovery but its alot of work we hope to have it soon though :D
[HTC Amaze 4G] Binary100100:
That's great to hear! What kind of problems are you having? I was just reading information from this:

http://www.koushikdutta.com/2010/10/porting-clockwork-recovery-to-new.html

It looks pretty straight forward but then again... I've never done it for a brand new device.
[HTC Amaze 4G] jimczyz:
And here I thought HTC was going to ship all the new phones with unlocked bootloaders.
[HTC Amaze 4G] xboarder56:
cache mounting errors are holding use back it seems like i cant get the cache to mount in my build so its useless right now
[HTC Amaze 4G] Binary100100:
Nope. You have to void your warranty to get it unlocked.

I would like to give it a go however I have an S-ON spl so I don't have a lot of room for error. :rolleyes:
[HTC Amaze 4G] krylon360:
it's built ;)
[HTC Amaze 4G] Bigv69er:
will the new recovery bring s-off for all???
[HTC Amaze 4G] Binary100100:
mmcblk0p12 partition or something else?
[HTC Amaze 4G] mcs117:
mmcblk0p12 it is....

It isn't related to s-on/s-off.... I thought it was cool xD

The starting address is 0xA36EC

---------- Post added at 08:31 PM ---------- Previous post was at 08:19 PM ----------

sbl1.img writes itself to mmcblk0p7 starting address is 0x3194

sbl2.img writes itself to mmcblk0p8.

sbl3.img writes itself to mmcblk0p9.

And I think we found our link! mmcblk0p9 is identical to both S-on and S-off but sbl1 and sbl2 are not written to s-off... So we need to find how sbl3.img ticks....
[HTC Amaze 4G] Binary100100:
which partition is sbl3.img?

I'm looking at an sbl3.img from an ruu and I don't see anything at all at 3194 pertaining to mmcblk0p7.

And I also noticed the unusual code in 0xA36EC and after. It's almost like ascii graphics. Pretty interesting.
[HTC Amaze 4G] mcs117:
sbl3.img writes itself to mmcblk0p9

---------- Post added at 08:42 PM ---------- Previous post was at 08:38 PM ----------

sbl1.img writes itself to mmcblk0p7 starting address is 0x3194 not spl3.img

And sbl1 and sbl2 writes to mmcblk0p7 and 8 respectively only on SHIP S-ON

In ENG S-OFF, it is not there....
[HTC Amaze 4G] Binary100100:
I don't see anything in there about mmcblk0p9 either. I can't really read any of the data until 7500C. What are you using to extract the encoded data?

I thought the sbl3.img partition was just a splash screen anyway. I also don't understand how this could be relevant to s-off since it's in every RUU file yet someone with s-off can flash an ruu and remain with an s-off device.
[HTC Amaze 4G] mcs117:
I'm comparing the blocks to the ruu from ph85img for tmous.

And..

0x49D8C and 0x739DD (mmcblk0p9)

ChipIdOverride

use HxD, and do a comparison between spl3.img and mmcblk0p9, it says they are identical but the size is different....
[HTC Amaze 4G] Binary100100:
And that's different from s-on and s-off?
[HTC Amaze 4G] mcs117:
This is on both S-ON and S-OFF... The point is, SBL3 can be running SBL1 and SBL2, and if it detects the S-OFF initially, it won't write SBL1 nor SBL2 during update, so it doesn't show up on S-OFF.
[HTC Amaze 4G] Binary100100:
Okay... which partitions are they?
[HTC Amaze 4G] mcs117:
mmcblk0p7-9

In mmcblk0p7, the sbl1.img writes itself at starting address inside mmcblk0p7 at 0x3194
[HTC Amaze 4G] Binary100100:
So we have a working theory... but we still need to figure out how to modify the existing partitions.
[HTC Amaze 4G] mcs117:
I'm trying to find out what each partition is, and I'm like 80% done
[HTC Amaze 4G] Binary100100:
Nice. When we have it all I should go through this and clean out this thread of all irrelevant posts. Any ideas as to what (if any) the misc partition is for? That's bugging the hell out of me.
[HTC Amaze 4G] mcs117:
Ok, this is odd... mmcblk0p1 is also sbl1 and mmcblk0p2 is sbl2... on both S-on and S-off.... This is really weird now.......
[HTC Amaze 4G] Binary100100:
Maybe not. It's possible that HTC made a tamper proof backup partition in case one of them is edited it can copy back over. Say for example p1 and p2 are what controls the secureflag and upon initializing it compares with p7 and p8 for differences. If differences are detected then it writes back to p1 and p2.