yashsingh1/xdaforums huggingface dataset:
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Status update...

I messed around some more, and made some progress: now the chainloaded hboot gets as far as checking the sdcard for update files (green list appears), recognizes my homemade PG76IMG.zip file, and offers to flash the modified hboot inside it -- right before rebooting back into the original hboot (reverting). I could press Yes here and try flashing, but I still don't know what causes the reboot, and I'm afraid it would still happen and interrupt the flashing process, which would certainly brick my phone.

I have a suspicion that the reverting is related to the "reboot-bootloader" function (the same one that's available in the hboot menu) but it needs confirmation before I can risk a brick. But we're nearly there, folks. :D

(I'm on my phone...)
[HTC Wildfire S] Lt.Win:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Aw yeah!! Awesome work! :good:
[HTC Wildfire S] no.human.being:
Wow! That sounds great. Gotta explain how you got that far. Btw, you still have a WFS? I thought none of our devs had a WFS and that's why development stopped.
[HTC Wildfire S] LuKaYa:
Development hasn't really stopped.... roms still coming out so many! Pleasantly surprised!
[HTC Wildfire S] Mazer.one:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

I think nhb talk about S-OFF development not ROM dev ... ;)
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

This campaign has died though. :(

Sent from somewhere too far away from my computer. Axis_Drummer calls me Wolfy. Jessica said I need to behave...
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

I narrowed down the part that checks for keypresses, but still not 100% sure how it's done, so for now I've just disabled the part that jumps to Android when nothing is pressed. :D What happens now is: I give the fastboot boot command, holding Vol Down -- chainload starts -- phone gives short vibrations 6 or 7 times, while it checks the sdcard -- zip file gets recognized -- I get the prompt to press Vol Up if I want to flash or Vol Down if not -- this is on screen for like 2 seconds, then screen goes black and reboot to original hboot. It does recognize keypresses as I pressed Vol Down for No once and it reacts normally, giving the usual "press Power to reboot" message, but it reverts anyway.

No it hasn't. It's just that, unlike some post-count-farmers and thanks-harvesters, I don't like opening my mouth if I have nothing useful to say. ;)

(I'm on my phone...)
[HTC Wildfire S] no.human.being:
Couldn't you prepare a "PG76IMG.zip" file that contains an image of a non-critical partition (e. g. "cache") and try to flash it? In case something goes wrong, you just boot into CWM recovery and re-format "cache".

Obviously a bootloader running stable from RAM would be a lot nicer, since it would enable you to obtain S-OFF without writing anything to NAND. After all it seems as if you modified the bootloader like hell (I mean it doesn't even boot into Android when nothing is pressed so it's certainly not something you want to use as a regular bootloader on your phone :D ), but at least you'd know if it would revert while flashing.

If it does not revert, then we do at least have an option to flash unsigned "PG76IMG.zip" files. After all, that's the main point in S-OFF, isn't it? ;)
[HTC Wildfire S] Mazer.one:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Wow, we should not laugh every day with you if you always say useful things ;)

Thanks for your work and sorry for off topic.
[HTC Wildfire S] ONeill123:
Maybe with the new diwg files it is possible to flash a cdma rom first and then use these new diag files to set s-off and flash a gsm rom again. But i think it wouldn't work, bc the virgin mobile ruu flash only the rom, any other is the same like gsm ruu.

Only an idea.
[HTC Wildfire S] island3r:
About the hboot dump can anyone help? If you have an s-offed GSM WFS just reboot to fastboot usb and type in cmd:

fastboot oem saveprt2sd hboot -n hbootpart.img

It should be 512kb in size.
[HTC Wildfire S] csoulr666:
Unfortunately that won't work.....The WFS doesn't support "fastboot oem" commands.....if it did we could have officially unlocked our bootloaders
[HTC Wildfire S] ONeill123:
No, thats wrong.

Fastboot oem says the phone that they have to execute the line after oem as internal command. And the wfs undertand some oem commands.

The fastboot oem get_identofoer_token doesn't work, bc the phone execute get_identifer_token, but then it comes an error, that it is an unknown errror, like an non-existing cmd command.

So the command is executed, but i think the phone dumps the false partition.
[HTC Wildfire S] d33ps1x:
C:\tools>fastboot oem saveprt2sd hboot -n hbootpart.img

...

(bootloader) [ERR] Command error !!!

OKAY [ 0.016s]

finished. total time: 0.016s
[HTC Wildfire S] ONeill123:
same error by me, maybe false command or the hboot can not interpret this command correctly.
[HTC Wildfire S] meanmug:
I wonder would it be possible to load new fastboot commands to our phone in order to use HTC bootloader unlock(maybe a signed zip or apk)? Also would HTC recognize our phone as unlock ready?
[HTC Wildfire S] XDA_h3n:
Cant. The HTC unlock bootloader works by this type of identification token, in fastboot. Our WFS'S does do commands in fastboot BUT doesn't do them, if were going to get HTC dev unlocked bootloader, they would need to update the HBOOT.

Difference is:

Bootloader - Custom Recovery, Custom ROMS

S-off - Sim-unlock, Super-CID, Eng HBOOT, Custom Recovery, Custom ROMS

Sent from a stranger :D using XDA Premium App
[HTC Wildfire S] meanmug:
WRONG they would only update the fastboot commands so that we can use "fastboot oem get identifier token" to send back to them, then they would send us "unlock code binary file" thru email to unlock bootloader.
[HTC Wildfire S] ONeill123:
We wont s-off not only unlocked bootloader, so plz work for an software s-off solution and not discuss about HTCdev ;)
[HTC Wildfire S] Schnello:
Hi.

The recovery can allways write to the /system...regardless the secu flag is on or off. But the HTC Stock Recovery reject all files with non HTC Sig.

If you flash a custom Recovery you can flash all what you need... but you can´t flash a recovery with s on... but it´s not impossible (remember the unrevoke tool for desire, etc.).

The secu flag is not in the Hboot. I can flash on my wildfire s with s off every stock Hboot (0.90,1.03, 1.08, RUU or PG76img file.... ). The phone remains on s-off

Greetings
[HTC Wildfire S] ONeill123:
right, so we said, the secuflag is in the radio.img in the NVRAM, so a revolutionary team meber said.

But how we rewrite there with s-on?
[HTC Wildfire S] meanmug:
What you fail to realize is that if they unlock the bootloader it will probaly take a day or so for someone to come up with full s-off method, maybe even a few hours.
[HTC Wildfire S] Schnello:
I think he means that the information is stored in the radio hw part and not in the radio.img

I can flash also every stock radio.img file with no impact regarding the secu flag state.
[HTC Wildfire S] ONeill123:
yes, sry i mean the radio NVRAM, like the revolutionary team member said.

To HTCDev:

I think, that HTC will not unlock Ws in next time. So plz work for an software s-off now.

How we can, or the xtc clip or revolutionary in other phones rewrite the secuflag?
[HTC Wildfire S] Schnello:
What is the difference between "full S off" and unlocked bootloader.

From my view... some peoble reports "bull..." and all other forward this information.
[HTC Wildfire S] ONeill123:
Not only, somebody has wrote, that u can only flash CstomREcovery and Custom ROMS, no CUstomKernel.
[HTC Wildfire S] Schnello:
And what somebody wrotes is the fakt?

And in case its not possible to flash a kernel..

If you can flash a rom you can also set a symlink... if you can set a symlink, you can transfer the kernel part to every place what you want.
[HTC Wildfire S] ONeill123:
Ok ok, i only thought ;)

But the Ws isn't supported yet, so its better we will search for a software s-off and not dream what we can do with unlocked bootloader.
[HTC Wildfire S] Schnello:
Yes you are right but if you stop to ask HTC for a open bootloader ... maybe you have after the day .... nothing.
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Good idea, I'll try that tonight and report back. In fact it's quite possible that once the flashing process started, it disables keypresses, and if my suspicion is correct and it's the key sensing part that "malfunctions", the flash should go straight through. We'll see.

If it does not revert, we have won the game. :D Once it's confirmed that the flash works, we just flash an appropriately modified hboot and call it a day.

On second thought, what if I disable keypresses altogether, and after the zip file detection jump straight to flash...? Busy night ahead it seems. :)

(I'm on my phone...)
[HTC Wildfire S] no.human.being:
Well that would be an option, but obviously we should not write your current "hacked all options out"-bootloader to NAND, since as far as I understand, it can't even boot into Android anymore since that is patched out. ;)

The perfect solution would of course be if we found the conditional jump where it decides to either revert or "do something else". I suspect that the revert happens when the condition is met so that the jump is taken and the "do something else" happens when the condition is not met. This makes sense, since if it decides to revert, it must not preserve any state, so even a normal branch ("b") would suffice, a branch with link ("bl") is not required, since it obviously must never "return" from reverting. So if this is right and we have the conditional branch instruction, we just turn it into a no-op. Then we'd have an HBOOT that runs from RAM.

The problem is that we don't know what condition it is that causes the revert. Say it does a binary comparison of the HBOOT in RAM against the HBOOT in NAND, then recognizes that it's different and reverts. This could be overcome by writing the modified HBOOT to NAND, so that they are both identical again.

But on the other hand let's assume that the HBOOT has a signature in its own data segment, decrypts it obtaining a hash. Then it hashes its own code segment in RAM and compares both hashes. If they don't match, it copies the boot code from NAND into RAM, then jumps into it. HBOOT in NAND is modified, so signature does not match, so revert. And so on. We end up in an infinite loop and the phone probably ends up bricked since the boot code never gets functional again.

I'd really favor if we'd suppress the revert so that the HBOOT can run stable and fully functional from RAM, then we have "temporary S-OFF" and can flash whatever we want. And if we have tested it thoroughly and came to the conclusion that all the other functionality (Fastboot support, etc.) still works (which I'd assume), then we can build a "PG76IMG.zip" to make it permanent. I just don't have an idea how to do it without a debug facility. If we got OpenOCD then we could place breakpoints all over the boot code, check in which order they are hit and then narrow down to the instruction where the revert happens.
[HTC Wildfire S] BeciMester:
OK. Looks like the flashing is working. :D

I decided to use the splash screen (sp1 partition) as a guinea pig; it's not essential, and if anything goes pear-shaped, it has no effect on the rest of the phone -- and it's a raw partition just like the hboot. I downloaded a custom splash screen, made it into a PG76IMG.zip, put it on sdcard, and chainloaded the "neutered" hboot. The phone vibrates 10 times, then the zip file is recognized, and I answered yes to the flashing question. And it worked. The flash process actually has a progress bar on screen but it can barely be seen, the process is completed within 1-2 seconds, it's extremely quick. Immediately after it finished, the reboot happened, but instead of the green htc logo my spiffy new splash screen showed up when the screen came back on! :D So all in all, the rebooting problem is still not solved, but it seems that it doesn't happen anyway until the flashing is finished.

Please note that it still doesn't mean that the hack is ready for public consumption: the sp1 partition is 1280Kb, most of it is empty and the splash picture takes up the first 300Kb only. I have no way to verify that the flash worked 100% to the end -- all I know is that the picture at the beginning is flashed properly. I've made a partition dump before and after the flash, and there are no differences after the picture itself -- but it's a wall of 0x00 so it doesn't mean anything. The phone boots to Android and behaves normally, there's no damage done as far as I can see; but when it comes to the hboot we are talking open heart surgery on the phone that can kill it stone dead in a few seconds if anything goes wrong.

My other worry is that I have no idea how this will behave on a vanilla phone. Mine still has the "s-off radio" and a hacked hboot flashed, and although I had a very thorough look at the hboot code and removed all the checks and obstacles I could identify, it's entirely possible that I missed something that would make it behave differently on an s-on phone. The code that does the flashing is -theoretically- independent from the one stored on the NAND, and it can do whatever it wants, but I can't be 100% sure.

I'd love to run it by someone who has a way to restore his phone if anything goes wrong. But seeing that only Munjeni managed to get JTAG working, looks like somebody will have to bite the bullet and possibly sacrifice his/her splash screen. :D

TL;DR - flashed new splash screen via chainloading, we're nearly there guys! :laugh:
[HTC Wildfire S] heavy_metal_man:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

That is excellent progress :) well done! :thumbsup: what we could maybe do is if anyone who had the balls and a s-on phone could maybe attempt the splash screen test and see how they get on?

tapped out from my sexy sensation XE ;)
[HTC Wildfire S] Lt.Win:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

What happens if the splash screen flashing goes wrong?
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

The green HTC logo on white background that you see when turning the phone on will be distorted or it disappears (not the animated one with the "quietly brilliant" appearing, the very first one).

(I'm on my phone...)
[HTC Wildfire S] csoulr666:
I could give it a try if you want.......just guide me how to do it
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Alright, let's do it. Please read through it all before proceeding, there is a part where you have to be quick, expect it.

As usual, although I did my best to double check everything and there's very little chance of something going wrong, I won't be responsible for any damage to anyone's equipment!

Prerequisite: you need an unlocked bootloader, either v1.08 or v1.09 as only these support the fastboot boot command. Also need adb/fastboot working.

1) of the two files I'll send you in a minute, put PG76IMG.zip on the SD card and put chainload.img in your adb folder on the PC.

2) shut down the phone, take battery out, put it back in.

3) remove the SD card - we don't want the zip file to be recognized by the original hboot as it won't work anyway. Leave the back cover of the phone off.

4) hold Vol Down, press Power - you're in hboot mode now.

5) press Power once to get to fastboot mode.

6) put the SD card back in.

7) connect phone to the PC.

8) Open a command line window in your adb folder on the PC and type this command:

fastboot boot chainload.img

but don't press Enter yet.

9) hold Vol Down on the phone and then hit Enter.

10) the phone will reboot into the chainloaded bootloader -- as soon as the hboot screen appears let go of the Vol Down button.

11) Now pay attention because you'll need to be quick here. The phone will start vibrating, 10 times, then the usual green list will appear as it searches the SD card for suitable files. As soon as it finds our file, some stuff will be flashing on screen while the zip is unpacked, for like half a second -- then it'll give you a choice of either flashing it or not: here you have around 1 SECOND to press VOL UP! Do it.

Don't worry if you miss it, the phone will just reboot and behave like it's just turned on. Remove battery, put it back and start over from 3).

12) if you pressed Vol Up quickly enough, the flashing process starts, it will take less than 2 seconds, then the phone will do a cold reboot -- you should see your new splash screen now.

Let us know what happened. :D

(Sorry for the delay, I typed all of the above on a bloody phone, it took my lunch break and then some.)

(I'm on my phone...)
[HTC Wildfire S] Lt.Win:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Could you send me the files as well? I'll try it out if I get the chance before sleeping.

If it does work for him, remember nhb talking about those exotic hboots? I MAY have one if those. But I'll give it a shot myself. :D
[HTC Wildfire S] csoulr666:
Failure :(

A docmentation of what I did and what happened

1.Added the PG76IMG file to the SDcard and the chainload.img file in my adb folder

2.Booted into bootloader after a battery removal on shutting down

3.Removed SDcard

4.Selected fastboot

5.Readied the command

6.Held volume down while pressing enter

7.Got into the chainloaded HBOOT and got my hand of the Vol down button as soon as the HBOOT appeared

There were no vibrates in the chainloaded HBOOT nor any file checking process.....It just rebooted after 2-3 seconds

If you want i can record the process for a better understanding of what is happening
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Ah bollox. :( I'll have a look tonight.

Hold on. Was the SD card in the phone when you first booted into hboot? Steps 2 and 3 on your list. It should not be.

Edit2: looks like your card wasn't in the phone when you did the chainload. Can you clarify?

(I'm on my phone...)
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Sure why not. But I'd say think twice about flashing some hboot file if you're not certain of what it does. Messing with a picture is one thing, but modifying the most important piece of software on the phone is a whole new ball game. It's up to you. :)

(I'm on my phone...)
[HTC Wildfire S] csoulr666:
Yes.... I inserted the SD card after I selected fastboot..... I did this stuff 5-6 times to confirm....I will try it again tomorrow.. No electricity ATM :@
[HTC Wildfire S] no.human.being:
Second most imporant thing. Afaik the OEMSBL (bootloader that loads Iguana, part of Iguana image) can be used by the board manufacturer (Btw, who manufactures these boards? I'm quite sure that HTC don't do it on their own.) to reinstall an APSBL (HBOOT, bootloader that loads Android) but you really don't want to do that. It's an entirely proprietary and confidential (and publicly undocumented) procedure and I have no idea if and how it works, but I know that it's possible "somehow".

Damage the OEMSBL and you're definitely in for JTAG repair. The PBL is "hardcoded" in an actual on-chip ROM. It certainly won't have any bells and whistles like a facility for installing an OEMSBL so you definitely need to consult "hardware methods" in case you have to install an OEMSBL. ;)

But yeah, messing with HBOOT is still "hot". It's the code that initializes the aARM, so effectively without a functional HBOOT the aARM is "dead". This means your phone still has a working GSM transceiver, but that's basically all. :D

That's the reason why I'm so after the "soft S-OFF" thing. If we know that HBOOT works for flashing, we might reconsider finding the branch to the "reversion routine" and disable that, then restore most of the other boot code (except the routine that queries for the secu_flag) to stock and hope that we get a functional bootloader again. Then you could boot into "soft S-OFF" mode, do whatever action you need to do that requires S-OFF (e. g. flash the Radio, downgrade your HBOOT, whatever), then reboot and find yourself S-ON again.

This sounds like the chainloaded bootloader didn't find the "PG76IMG.zip" file on the SD card. But you said you had the file on the card and inserted it before (!!) setting off the "fastboot ..." command right? Now that's weird. Perhaps the file didn't get properly written to the SD card? Did you check whether your original HBOOT finds the file (it won't install it, but it will display a message that it's found an image) when you boot your phone normally with Vol-Down held and the SD card inserted?
[HTC Wildfire S] Lt.Win:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

I'm gonna do the splash screen test. Let's see how it goes.
[HTC Wildfire S] csoulr666:
As I mentioned I tried it five to six times..... The original bootloader recognized the file and didn't ask to install it
[HTC Wildfire S] BeciMester:
I don't think there's a "reversion routine" per se. The way this thing operates is, it sets 0x603130A0 to a certain value (I call it "boot mode" because at init it gets read and added to the log as "ARM11 boot mode" but it's not limited to booting), and it switches modes based on that. Example values: 2 = fastboot mode, 8 = bootloader (hboot) mode, 0x10 = enter offmode charging, 0x14 = reboot bootloader, etc. (there's more). Different parts of the program read it at certain points to see which mode it is in currently. Now I think all that happens when reverting is, it doesn't "copy itself back from NAND", it just sets the "bootmode" somehow to cause the hboot to reboot. I'll sit down when I have a free hour and map out all the instances where this value is written, and what part initiates the write.

I understand and appreciate your help, but we can only go by your report of what you've done, and judging by your detailed description a few posts back, you removed the card after booting into hboot and before selecting fastboot mode. Then you say the card was put in. Could you please update that list to show more accurately what you're doing? :)