yashsingh1/xdaforums huggingface dataset:
[HTC Amaze 4G] Binary100100:
Thanks anyway. So far the only way to get s-off on these phones is to have a lot of luck to have had it included upon arrival. It's possible to get one but extremely rare. I've read cases were people people have gone through several different phones in stores trying to find one that has s-off.

I think HTC has finally outsmarted us on this one... for now. I remember when the bootloaders were really easy to update. It was as simple as flashing a zip file that would over-write an existing hboot with one that is s-off. And we've tried that without any success. On the same note, with those exact same earlier devices if you had s-off already and flashed an hboot with s-on you would be stuck with s-on again. Strange enough this is no longer the case. Those that are fortunate enough to have s-off and received an OTA with a new hboot image does not effect the s-on/s-off status. This is exactly why I'm stuck on the theory that obtaining s-off doesn't have anything to do with the bootloader.

Wouldn't it be funny if it was as simple as pulling a "hidden" partition from our phones, doing a little hex edit and pushing it back for s-off? Or maybe even just sharing that particular partition from a device that already has s-off to our phones? I can see that happening... can't you guys?
[HTC Amaze 4G] djdeviance:
IKR I remember when all you had to do was get the original .img file flash through bootloader and be good to go. Back in the JesusFreak days. Lol
[HTC Amaze 4G] xboarder56:
i might be getting a s-off version of the amaze but i need 150 bucks for it :( plus my amaze
[HTC Amaze 4G] xboarder56:
i just ordered the amaze so binary i can pull any partions you want starting monday
[HTC Amaze 4G] defmute:
I actually wrote HTC (didn't expect much from it, just wanted to see what they would say) to see why some phones are shipped with S-Off while others S-On. I was assured that ALL phones were shipped with S-ON.

Sure they are, sure they are.
[HTC Amaze 4G] Bronyr:
really?....

http://xdaforums.com/showpost.php?p=20889433&postcount=185
[HTC Amaze 4G] :
Well since we can track what is happening with ddms(if it works). Try for example flashing a radio. You will most likely find the thing that prohibits it where it resides. Any serious crack for pc games those days involves listening.
[HTC Amaze 4G] Bicster_:
Maybe we should get an Amaze for the guy that came up with the blackrose pseudo S-OFF hack for the Nexus One. Also, keep in mind that phone has been out for two years and it just got that hack two few months ago. :D

Or, just complain to HTC until they make the bootloader unlock as useful as it should be, e.g., like the Nexus phones. We don't need S-OFF on the Amaze if HTC offers a proper unlock.
[HTC Amaze 4G] ChristoA1:
:lol:

10char
[HTC Amaze 4G] xboarder56:
lol ill shw them a pick of mine when i get it haha
[HTC Amaze 4G] Binary100100:
Pull all 36 (or however many) and compare them with the RUU. Then send me whatever doesn't match up and I can HELP look through them all with a hex editor. Maybe we'll get lucky. :)
[HTC Amaze 4G] alistairfang:
my bad .. 10101010
[HTC Amaze 4G] xboarder56:
Ok I will as soon as I get the phone
[HTC Amaze 4G] ChristoA1:
Unpossible. You can't possibly have S-OFF as the phones all come with S-ON. HTC says so. ;)
[HTC Amaze 4G] Marquis63:
Food for thought, because I use my phone/s for hotspot net connection for my laptop, I turned on the $14.99 data fee for the amaze, was getting nearly 1MB down in a 4g area, but none of the apns on the phone changed. Then canceled, DLed apn manager to change apns , DLs were down to 245kB/s. So maybe the S-off is controled much the same way #justsaying
[HTC Amaze 4G] Binary100100:
By the carrier? Unlikely because there are a small percentage of phones that come shipped with s-off. The s-off state wouldn't have anything to do with the sim introduced into the device because you can boot into the bootloader mode without the sim placed inside. If this were to be the case then someone with s-off could wipe their data, remove their sim card and upon rebooting to bootloader mode it would display s-on like everyone else. As far as I am aware, this is not the case. Xboarder was telling me that there are two different boards as well. There is PVT and one other. So there's also a small chance that it could be hardware related too which would be very unfortunate because acquiring s-off would require disassembling the phone. :eek:
[HTC Amaze 4G] xboarder56:
looks like the amaze i bought is a world wide amaze
[HTC Amaze 4G] Marquis63:
another thing I noticed was my bootloader was1.90.0004 till I did the OTA to 1.435xxx then it went to 1.90.0008, I'm still stock waiting patiently for you Masters to figure it out. Keep up the great work.

---------- Post added at 11:58 PM ---------- Previous post was at 11:56 PM ----------

Taiwan or China mfg?
[HTC Amaze 4G] xboarder56:
no its like a world wide version unbranded sim unlocked s-off
[HTC Amaze 4G] pjim:
Perhaps you can extract that rom and post it with the others? Some of us like those plain roms. The asian ones are always very dependable.
[HTC Amaze 4G] xboarder56:
i all ready did its the v1.0.1 one i have its a tmobile eng one super bad battery life on it lol
[HTC Amaze 4G] :
Don't want to be rude or anything but what does this have to do with the purpose of this thread? Binary could you do a little clean up please.
[HTC Amaze 4G] Binary100100:
Well I know where this is going. xboarder is going to use his new Amaze to try to experiment with methods to share the s-off with everyone else. There are two different boards, PVT and XE. Most of us have PVT boards and xboarder has an XE. The key to s-off is hidden somewhere in his device. We just need some patience, hacking, editing, reading, researching, trial and error to figure out where, what and how to use it.
[HTC Amaze 4G] Marquis63:
WOOT WOOT oh happy day, maybe now we can haz S-off:D
[HTC Amaze 4G] Binary100100:
Don't count on it. Just because one person has s-off that actually knows how to use it means that the rest of us will anytime soon.
[HTC Amaze 4G] jcparks:
Is my info of any interest to you guys? I noticed it isn't on the list.

*** UNLOCKED ***

RUBY PVT SHIP S-ON RL

HBOOT-1.90.0008

eMMC-boot

Nov 1 2011,16:50:47
[HTC Amaze 4G] Binary100100:
Welcome to the 99% club. ;)
[HTC Amaze 4G] krook6023:
Looking for those 1 percenters lol
[HTC Amaze 4G] Binary100100:
Yay! Another FSM with an Amaze!
[HTC Amaze 4G] krook6023:
I just got the device yesterday, so far I love it...don't tell anyone but I still running stock :eek:

This is the first phone that has not forced me to instantly flash a custom ROM, I remember when I got my HD2 it was HSPL'd and it never booted stock...never :D. I am looking forward to rooting this thing tonight...24 hours on stock in enough. I really could care less about s-off there are ways around it...but I would like to see official CyanogenMod support someday so I hope something gives
[HTC Amaze 4G] Binary100100:
Well, welcome to the party.

This is true that we don't really NEED S-OFF however it would make things much easier to flash kernels while flashing custom roms. Because of the S-ON we can't easily flash roms that require different kernels because the boot partition doesn't get flashed during the update process. I've found a workaround that uses the flash_image binary however it still requires the phone to boot before updating the kernel so it's still pretty much useless unless you want to update to a custom kernel. Unfortunately HTC and Texas Instruments aren't making that easy for us either since the wlan drivers don't work right with the source code when compiled. It's all very frustrating. So development for this device has been very slow as of late because of all of this. So that should pretty much bring you up to speed.
[HTC Amaze 4G] xboarder56:
Towmarow the prototype Global amaze is coming :D
[HTC Amaze 4G] Binary100100:
What are you talking about?
[HTC Amaze 4G] xboarder56:
I bought a Amaze xe but with no tmobile branding its a global version like the Desire HD and Sensation sold buy htc website
[HTC Amaze 4G] Binary100100:
I thought you already had it.
[HTC Amaze 4G] xboarder56:
was supposed to be here today but fedex taking forever so it will be here towmarow
[HTC Amaze 4G] amehdi43:
Give me a link X, I havent been able to find it.
[HTC Amaze 4G] xboarder56:
ya theres a reason its a prototype not a release phone probably wont be at all
[HTC Amaze 4G] krook6023:
Thanks for the run down. I have spent the last week reading all these threads...hint hint newbs...that is what you should do. So I have read all about these issues. I would not have bought the phone without being comfortable with the dev community. I will be honest I almost bought the Sensation but ultimately I have seen this community do amazing (no pun intended) things...so something will spark the wick that leads to the explosion we are waiting for.

Edit: A couple of mods should know better than to hijack a thread with off topic posts...:)
[HTC Amaze 4G] Binary100100:
I think I can speak for the community and say that we apprciate your optimism. We've been hoping for more developers to jump aboard so that we can accomplish more. The very few developers that we currently have are going insane!
[HTC Amaze 4G] krook6023:
I know that I have not had the device long enough to feel your pain...but I can't imagine this not getting sorted out in time.

If only we could get HTC to say officially "The Amaze 4G is unhackable, no one will ever achieve s-off on that device, we are too clever"

...6 days later...someone would have exploited :)

The kernel not compiling correctly is a PITA perhaps if the rumors of an official ICS update coming soon are correct...then a new source would follow and....THERE GOES THAT OPTIMISM AGAIN...
[HTC Amaze 4G] BIGMOH:
X, do you see any differences between Canadian ROMs and US ROMs in regards to wireless speeds?

Cause it got me thinking do all ROM's allow you to achieve dual carrier HSPA+ for wireless speeds of up to 42Mbps? The max i get is 12Mbps. or is there some tweaks we can do to the build.prop that you might know about?

Thanks in advance for your thoughts.
[HTC Amaze 4G] xboarder56:
Working on a patch for you guys :)
[HTC Amaze 4G] krook6023:
*crossing my fingers*
[HTC Amaze 4G] xboarder56:
Look at this
[HTC Amaze 4G] jimczyz:
Very jealous am I...(must hear it in Yodas voice)
[HTC Amaze 4G] xboarder56:
i think its controled in the radio
[HTC Amaze 4G] govindar77:
Wow, X ... any reason for running such an old baseband? Or is that the one that came with the phone?
[HTC Amaze 4G] xboarder56:
lol just to try it haha i think the best baseband so far is 1.06
[HTC Amaze 4G] xboarder56:
just got it supercid too so i can test the stock roms for telus wind and tmobile
[HTC Amaze 4G] BIGMOH:
Wicked!

looking fwd to it man!

keep it up ;)
[HTC Amaze 4G] daddioj:
any progress in the S-off department? :confused:
[HTC Amaze 4G] Binary100100:
Yes! We've pretty much given up.
[HTC Amaze 4G] daddioj:
not good.. lookin to sell this phone
[HTC Amaze 4G] Binary100100:
Umm. Okay. Good luck.
[HTC Amaze 4G] 30000:
Ok, well as I'm sure we're all still hoping someone can find a way to make such an invaluable device S-OFF. However, is there a way we can work with S-ON? I know it sounds really tedious and in some cases, stupid, but isn't there a way to sign files that would be flashed in HBOOT? If we can figure that out, then the procedure for flashing new HBOOTs and the like would be relatively simple, and someone could then create a sort of tool for the everyday user to do that themselves. Nothing's impossible, it's just that the people over at HTC know something we don't.
[HTC Amaze 4G] daddioj:
i know it sounds nuts but in my area reception is crazy dumb lol and trying diff radios might help. and right now we cant do that without S-OFF correct?
[HTC Amaze 4G] Binary100100:
Unless you use an OTA update. I've tried to use the two radio partitions by CWM but it wouldn't take. I've tried PH85IMG.zip but it was a no-go and you can't fastboot flash the radio partitions. I think we've tried everything.
[HTC Amaze 4G] daddioj:
thats the problem i am having now. shotty reception i always had these issues with htc for some reason. my samsung s2 phones never
[HTC Amaze 4G] :
So where is the s-off stuff stored after all?

Sent from my HTC Amaze 4G
[HTC Amaze 4G] Binary100100:
In one of over 30 partitions.
[HTC Amaze 4G] :
Ok, let's get it step by step. Use that listener program you told me about and try to flash a radio and see what blocks it.

Sent from my HTC Amaze 4G
[HTC Amaze 4G] Binary100100:
What listener program?
[HTC Amaze 4G] tragedykilla:
what is so different between the amaze and the sensation? they were able to obtain s-off on the sensation and a reversible process. why is it so hard for the amaze to have the same result?
[HTC Amaze 4G] :
The one that allowed seeing every process in CPU ram and so on

Sent from my HTC Amaze 4G
[HTC Amaze 4G] Binary100100:
What's similiar? They are both totally different in almost every way. Why do you think we can't flash Sensation roms? Or even port them for that matter. If we can't use the roms what makes you think we can obtain s-off the same way? This is NOT the Sensation.

ddms?

That only works with adb.
[HTC Amaze 4G] :
Yes. How can we find its location?

Sent from my HTC Amaze 4G
[HTC Amaze 4G] Binary100100:
MAYBE but pulling all ~36 partitions off an s-off device THEN pull all ~36 partitions off an s-on device and use a hex editor and compare each one individually line by line. Have fun! :rolleyes:

Then... we just need to figure a way to flash the correct partition

WITH HAVING S-ON

.

So it's kinda pointless in my opinion.

By the way... you can't use ddms while the phone is in fastboot mode. That would be like using adb shell in fastboot. Won't work.
[HTC Amaze 4G] :
I have a better idea just build a script to compare each line. Simple and effective. We are past the days when we had to check every line of code ourselves.

Sent from my HTC Amaze 4G
[HTC Amaze 4G] Binary100100:
I use HxD to compare two different files and look for differences.

Using the misc.img as an example:

The file itself is like 15mb in size. This is a pretty small file in our phone.

I compared xboarder's misc with mine and there were vast differences but I couldn't see anything that was relevant. And this was with xboarder's s-on phone. So two of the "same phones" but two totally different partitions. Use that example for about 30. You still have to go through and read each line for any signs of relevance. I work on average 56 hours a week and spend about 4 hours a night on here moderating. How much time do you think I have to waste TRYING to get s-off? Screw that. If you want me to take time off work to TRY to get s-off I need to be compensated for the time off. I get paid $22/hr without overtime. Paypal will be fine.
[HTC Amaze 4G] krook6023:
So if I donate $2 you will work on it of approximately 5min? Heading to Paypal now :D
[HTC Amaze 4G] tragedykilla:
i get what you are saying its just it seems seems the sensation's s-off was obtained easier, and i was just wondering y it much more difficult for the amaze. and i know they r different devices. Just curious, i'm trying to learn this too
[HTC Amaze 4G] Binary100100:
It takes me about 5 minutes to dump the 15mb misc.img file.

Unfortunately I didn't see anything that resembled the @secuflag in it. That is what we need and that is what I've been looking for. So I've eliminated the misc file. I think it's safe to say that it's not in the cache, data, recovery or system files. So we only have about 32 partitions to pull and read line by line. Just to give you an idea take a recovery file which is about 5mb in size. That is 5,877,760 blocks. That's almost 400,000 lines of hex code to read through. Obviously it's not in recovery but you get the idea of what is being asked. The misc is THREE times the size. Do the math. It'll be like trying to read an entire encyclopedia set except not as exciting. If you've never opened a img file in HxD I encourage you to do so. It's pretty complicated. As you can see by the attached photo that even IF we can figure out what partition it is... it's unlikely we would be able to read it. And IF we could read it... how could we write to it without corrupting it? Even if we could write to it... how could we flash it with S-ON?
[HTC Amaze 4G] Binary100100:
The Sensation received more attention b/c it's a more popular phone. Our phone isn't anywhere near as popular. Thus the few developers and thus the few support and attention. If we can get this phone into the hands of Revolutionary (AlphaRev and crew) they MIGHT have a chance at getting us s-off.
[HTC Amaze 4G] :
So we have to raise up to about 450$ to get one of eBay.

Sent from my HTC Amaze 4G
[HTC Amaze 4G] Binary100100:
Another idea/theory

Someone with s-off dig around and see if you have a file called SMART_IO.CRD

I got the idea from these threads:

http://xdaforums.com/showthread.php?t=1193540

http://xdaforums.com/showthread.php?t=1142409

I edited the CRD file from the second thread with the build.prop and put it on the root of the external sdcard. The phone WOULD NOT BOOT! This is a good thing! It means that I might be onto something. This means that the phone looks for the SMART_IO.CRD file on the sdcard BEFORE it displays the bootloader information. I know it sounds strange but it's true. As soon as you remove the sdcard the phone will boot right up. Remove the file from the sdcard completely and all is normal.

Before the SMART_IO file I attempted the following command in fastboot.

C:\Users\Administrator\Desktop>fastboot oem writesecureflag 0 which resulted in:

... INFOvreg_set: request is duplicated id 14

INFO ruby_init_sd, SD card power on ok

INFOsdcc_init_memory_device done

INFO[FAT_ERROR] fat_open_file: can not find SMART_IO.CRD

INFO[JAVACARD_ERR] SMART_IO.CRD cann't find

INFOwritesecureflag: Permission denied, value 1

OKAY

So I searched for the SMART_IO.CRD file.

Upon placing it onto the sdcard the phone wouldn't boot up. So I removed the sdcard and when it booted back to bootloader I pushed it back in and ran the command again.

C:\Users\Administrator\Desktop>fastboot oem writesecureflag 0

... FAILED (status malformed (1 bytes))

There's something significant here.
[HTC Amaze 4G] krook6023:
If X's phone has that file....I may fall over in my chair....
[HTC Amaze 4G] Marquis63:
don't know if it's important or not, but while DLing files to my amaze I thought they would go to my

external sd, come to find out they all went to my internal sd. Still stock unrooted OEM ROM, build number 1.43.531.3 CL192596, baseband version 1.08.550L.19DC_30.66.550L.08D
[HTC Amaze 4G] alx294:
its set to do that by default
[HTC Amaze 4G] Binary100100:
What does that have to do with s-on vs s-off? :confused:

It's doubtful. I would like to ask someone with s-off to try the fastboot command:

fastboot oem writesecureflag 3 (or some variation) but more than likely it will set it to s-on and probably not be able to get it back off. I did notice something else (with more sleep) that it seems to use something called a JAVA CARD.

... INFOvreg_set: request is duplicated id 14

INFO ruby_init_sd, SD card power on ok

INFOsdcc_init_memory_device done

INFO[FAT_ERROR] fat_open_file: can not find SMART_IO.CRD

INFO[JAVACARD_ERR] SMART_IO.CRD cann't find

INFOwritesecureflag: Permission denied, value 1

OKAY

So it might be that the phone may require a special card (Java card, not to be confused with gold card) with the specific SMART_IO.CRD file placed inside.

If that's the case then we may be left with having to brute force this entire thing because I don't see how it'll be possible to produce the Java Card. The SMART_IO.CRD file would be difficult (but not impossible) to produce but first we may have to have that Java Card before we can try to crack it in the first place. :(

So... I'm out of ideas here. I suppose we just need to find that SMART_IO.CRD file before we should spend the time and money purchasing or producing the Java Card.

Now for those that have s-off enter this command in fastboot:

fastboot oem readsecureflag

and if it reads:

...

(bootloader) secure_flag: 0

OKAY [ 0.007s]

Then that would make sense.

For everyone else it would read

...

(bootloader) secure_flag: 3

OKAY [ 0.007s]

So all we need to do is force our devices to have secure_flag: 0 if this theory is correct. Question is... how?
[HTC Amaze 4G] Marquis63:
Like I said, don't know if it's important or not,thinking the file or whatever we're looking for might be imbedded on the internal sd, just food for thought from a noob!
[HTC Amaze 4G] raiden9250:
Not sure if this would help but you can buy blank cards here

http://www.smartcardsource.com/cards.html?gclid=CLuh4b2c5K0CFUHktgodxFDWiQ

and use sdk to write to them, from everywhere I looked the java card is a modified Sim, correct me if I'm wronG
[HTC Amaze 4G] gravis86:
As far as comparing partitions with a hex viewer, what if we got a few S-ON devices and compared all of their differences. Then got the same partition from an S-OFF device and compared its differences, while ignoring the differences between all the S-ON devices. That would narrow it down quite a bit I would think... if that even made any sense.
[HTC Amaze 4G] :
Good point

Sent from my HTC Amaze 4G
[HTC Amaze 4G] xboarder56:
I could pull them
[HTC Amaze 4G] Binary100100:
But how to WRITE onto the cards?

Get to it. I can't because I just don't have the time. :(

Start at "1" and work your way up man. Maybe you can make a .bat script to make it easier. :p
[HTC Amaze 4G] xboarder56:
binary ill post the linux .sh for you to use to i have s-off device and you have s-on so you can compare :D

Binary ill upload shortly but here is the program i made for you it runs copys all the partions to the sdcard then just upload them to compare :D
[HTC Amaze 4G] lainemac:
Whoa! It sounds like Binary is really on to something with all that info.
[HTC Amaze 4G] xboarder56:
Partions for s-off device :D

http://www.filefactory.com/file/c2b4368/n/s-off_partitions.zip
[HTC Amaze 4G] mikeschevelle:
sorry for the noob question, but whats more important S-OFF or a full release of source from HTC?
[HTC Amaze 4G] xboarder56:
2 dif things there man
[HTC Amaze 4G] charlatan01:
No doubt.

I would say that while S-OFF provides the ability to flash some stuff from recovery, getting the source for stuff like WiFi etc.. is more significant at this point. Hard to troubleshoot the issues we're having with ROM's / kernels with black boxes in the middle, and I think it will encourage more development in the long run. 'course, with S-off, CM might come to the device eventually... always nice to have lots of options.
[HTC Amaze 4G] mikeschevelle:
i know just didnt know if one was more important, like if you had to pick one to have kinda thing
[HTC Amaze 4G] will_69_67:
They have card readers and software programs for writing onto the cards on that site also.
[HTC Amaze 4G] Binary100100:
I re-opened the thread to try to move forward with the process. I've pulled my partitions and will be comparing ours for differences and post results in the following post.