yashsingh1/xdaforums huggingface dataset:
[HTC Wildfire S] jikantaru:
even if its fake xtc clip. it would still soff ur WS. just the update takes the whole day. :P
[HTC Wildfire S] logout20:
bro .....

according to jikantaru....the fake xtc clip can S-OFF wfs....luckily I got the no. of Indian reseller...he told me that its gonna cost 1250/....why don't we group buy it...its gonna cost us less....

@jikantary what about update...?????
[HTC Wildfire S] no.human.being:
Just to make this clear again, I think the term "NAND write lock" is very confusing. S-ON is not the "hardware ROM protection" that some embedded controllers offer. S-ON is enforced by firmware only. Android itself can write to NAND memory, even on S-ON devices. This is how over-the-air updates are performed. But Android, like any POSIX system, makes use of memory protection, so application processes cannot directly write to NAND, they have to use system calls and the Android kernel can and will do additional security checks here. My intent is to find a way around these security systems.

Actually, we are probably quite close to S-OFF with all the "patching around in mtdblock3" stuff, we probably just have the offsets wrong. So next thing we have to do is finding out exactly where this information is stored on the WFS and how the phone's memory is mapped to the device files that can be accessed through Android. If secu_flag is located inside a memory area that is mapped to a device file and if the latter can be accessed from a root process, then flipping the secu_flag over to S-OFF will be an easy task.

I'm not that much into hacking HBOOT, as it seems to be ten thousand times the effort of just flipping around some flags. I don't see how writing an entirely new bootloader image to the phone's memory would be easier than writing some bytes that store the key security information. I find the GFree exploit quite elegant and this one leaves the HBOOT entirely intact. I am striving for a similar exploit on the WFS.

I've just returned from Amsterdam yesterday. Happy new year Android hackers. :D

I am quite sure they won't toggle the secu_flag. There's just no need to. S-ON is enforced on the operating system level. As long as you are executing code in "kernel mode" with no operating system intervening (and the recovery is probably executed this way), S-ON does not have any effect at all. Period. There is no hardware measure to protect the NAND memory present in the phone chipset. It's just not there. So the protection must be a policy enforced by firmware and my intent is to break the security system that is doing it. It must be located somewhere inside the Android kernel, as Android itself can and does write to "/system" on S-ON devices.
[HTC Wildfire S] ONeill123:
Now i am confused. The revolutionary team member said, that the secu_flag stored in the radio nvram and works on an lower level as system.

Now u say the different exactly :S
[HTC Wildfire S] no.human.being:
Yes, I've also just stumbled upon that post, finally. However, I think we are really talking about different things. I'll post a reply in that thread and hope that he'll explain his answer a bit more.
[HTC Wildfire S] *se-nsei.:
Welcome back, and happy new year to you also. ;)

Hopefully we'll make more progress now with at least some sort of contact with the revolutionary team (I hope).
[HTC Wildfire S] BeciMester:
This blog I found, the guy goes in a different direction (rewriting hboot from scratch) on a different phone, but his findings might be relevant to us. ;)

http : //tjworld.net/wiki/Android/HTC/Vision/HbootAnalysis

Desire-Oxygen2.3.2 | WFS-stock
[HTC Wildfire S] meanmug:
Not trying to be rude, but I've said this a few times already it will do no good if we dont have a way to send it to the phone. The fact of the matter is if there is any way to transfer files to this phone we wouldn't need a scratch hboot or anything, we could simply root and be done with it.
[HTC Wildfire S] sythe179:
Ok, mean, no.human, and oneil, have any of you got an s-off'd WFS?

If so, if it is reverted back to basicly stock with s-off, I will do a dump of my s-on, or even pull the one from a few pages back, and you do the same, when run them through a byte compare tool, and see what's different?.

Could get a few people to do it for homing down on the "sweet spot".

Mentioning you guys Becouse you seem to be doing something that I can see...
[HTC Wildfire S] meanmug:
Its a hardware lock, but as some of you may know, software is used to control the hardware to allow an opening to pass files to the phone from the goldcard. This is what I'm thinking(along with a few others) xtc-clip changes the value of secur-flag(or it is prejumpered like a gsm test simcard) once the flex cable is inserted thus allowing files(PG76DIAG.nbh) from the goldcard to be flashed to phone. A few devs are working on a softmod to change this value wether or not it stays(hboot will probaly rewrite this value) after reboot is a another task. Again heres my thinking I'm almost certain that we can find a way thru usb to disable this security just as xtc-clip uses the flex cable. If you watch this video http://www.youtube.com/v/bLWtIzOkEbI&hl=en_GB&feature=player_embedded&version=3 you'll see that xtc-clip is activated after "get sw version" at that moment the lock is disabled and PG76DIAG.nbh is flashed.
[HTC Wildfire S] sythe179:
Well, if your making a .bat file to run it, use a pause instead of using that waitsometime.exe.....

Less user friendly, but combatable with 64bit comps...

Also, can I edit the .bat once your finished, and send it back to you before you release it?...

Better having it look pritty and error-proof than random end-users having problems with it, and no feedback on what they have done wrong...
[HTC Wildfire S] meanmug:
New s-off direction

I'm thinking a new direction is in order, we should try to create a script or command that we could run at the moment PG76DIAG.nbh is flashed that would disable sim-security.
[HTC Wildfire S] sythe179:
Well, what are all the commands that are combatable?

And is there a rev member on this forum that is reading this/watching what where doing?....or are they finding out by messages to them?.
[HTC Wildfire S] ONeill123:
Why you want to used a cracked hboot. The secuflag isn't stored in hboot. So its better to find a solution to change the value of secuflag, or not?

@sythe179:

I haven't got s-offed ws, but schnrllo has one, maybe u can ask him to do something. He can flash official hboot again and again and have still s-off.
[HTC Wildfire S] sythe179:
Create the backend for commands that are accepted, but not executed due to no code?

Another way of "forcing" non-supported commands to work?

/edit

Ok....scratch that idea, maybe there could be a way of using a Unix OS to write to the NVRAM?...

Or look through the dumped xdclip files, and see what they change?..
[HTC Wildfire S] adlx.xda:
Excelent! Any chance we join forces together with HTC Chacha users? We have the same problem.

We have already managed to port CM to HTC Chacha (except Cameras) [see http://xdaforums.com/showthread.php?t=1291232], but almost no user can install it because of no free S-Off :-(.
[HTC Wildfire S] No.12:
We can say it worked only when we get soft S- OFF. Hope we will.

Sent from HTC
[HTC Wildfire S] *se-nsei.:
I'l be updating first post in a bit with a bit more info, but yes we can take ideas from the chacha forum and vice versa - we've come very close but we just don't know how to bypass the SIM CID protection to get S-OFF.
[HTC Wildfire S] qzfive:
This, please - the hardware of both the Chacha and Wildfire S seem fairly similar - from what I can tell, CM7 ports for both devices are stuck at the same bit, which is the Camera, which supports my theory of similar hardware, so if an exploit is found on one device, it -could- work on the other.

Excellent job getting on the Portal btw :D
[HTC Wildfire S] gordo79:
Keep on it guys htc should respect all there users.
[HTC Wildfire S] ash98:
Great thread, I am supporting this 100% and will post this on my blog tommorow, and i'll try to post it on technorari too, which will bring some more attention to this thread :p
[HTC Wildfire S] aloy99:
GO GUYS! My mom has this phone, and is irritated by the severe lack of internal storage.

Sent from my x10 mini running the latest version of minicm 7. :D
[HTC Wildfire S] aloy99:
What about the salsa?

Sent from my x10 mini running the latest version of minicm 7. :D
[HTC Wildfire S] *se-nsei.:
Still lacking dev support people. We are relying on greyclouds only and he's not even XDA. Who knos when he will release his edited hboot? We can't get the ENG hboot to him, and we've just found the reversed engineering files for the XTC clip but can't get that info to him either!

We need someone on XDA to thoroughly take part.
[HTC Wildfire S] Nightshadow931:
Didn't he register & post here few days ago?
[HTC Wildfire S] ash98:
Blogged about it, would link it but cant post links yet! :P
[HTC Wildfire S] *se-nsei.:
What name is he registered under do you know?
[HTC Wildfire S] Nightshadow931:
Dunno, he posted somewhere saying he is gray cloud, and he said something about what he was doing for S-OFF.If I find post, I'll link it here.
[HTC Wildfire S] aparici:
Here is the link to the post

http://xdaforums.com/showthread.php?p=20041292

Enviado desde mi HTC Wildfire S A510e usando Tapatalk
[HTC Wildfire S] Nightshadow931:
Yea, to be more exact..

http://xdaforums.com/showpost.php?p=20041292&postcount=209
[HTC Wildfire S] nowhat?:
I have an account on the site..

I will pm him the link..
[HTC Wildfire S] No.12:
Hmm, with most devices still S-ON,I would not be such optimist.
[HTC Wildfire S] theq86:
Wildfire S got dropped off the main forum template ... our phone is really an orphan ...

http://www.xda-developers.com/announcements/where-did-my-forum-go-3/
[HTC Wildfire S] No.12:
This is pretty frustrating.

Wish I new better when I bought this phone. :(

Sent from HTC
[HTC Wildfire S] :
That sucks. I will copy my hensemod over to desire s.
[HTC Wildfire S] meanmug:
Whats the conclusion on where secure-flag is stored? If its in the radio I'm beginning to think that maybe simply sim-unlocking the phone will allow PG76DIAG.nbh to be flashed. Theres sites on the net and stores everywhere that will do it for around $20-$30 and is alot cheaper than xtc-clip. Quick question, anyone have a gsm unlock WFS(can use with any carrier) and tried s-offing with the PG76DIAG.nbh file?

I would poll this question in the general section, but there are saboteurs among us that get jollies from our misfortune.
[HTC Wildfire S] sythe179:
Think it was concluded its on one of the partitions, and if I can remember, it was partition 3.

But if the x clip sim-unlocks, could that mean we could also make a simple sim-unlock with some rev-enginering?...
[HTC Wildfire S] meanmug:
Its not the xtc-clip that sim-unlocks its the diag file also sim-unlocking is done 1 or 2 ways: flash a different firmware or get a unlock code.
[HTC Wildfire S] ONeill123:
My phone is sim unlocked and both diag files, cdma and gsm, doesn't work.

The xtc clip emulate a test sim card, or?
[HTC Wildfire S] meanmug:
Thanks for your reply(just saved me $30) and I'm almost certain it does.
[HTC Wildfire S] ONeill123:
Xtc clip has more functions as only s-off, at same time your phone become supercid and sim unlock. Thats why i think that people think the clip is only for sim unlock.

But while set gsm version s-off woth the gsm diag files, the diag files or the hboot asks for an htc test sim emulated by the xtc clip. If we want to go the way with the diag files, we must emulate the clip or emulate a cdma version without a sim slot.

Both methods are difficult i think.

Can anyone generate the mdt sums of the included files in the rom.zip of cdma and gsm version?

Maybe we find the differences.
[HTC Wildfire S] sythe179:
Can't you buy a 5 dollar blank sim that you can put your own files on?...

Saw something about it a while back but dident think anything of it...

Don't md5 sums change even if the file is opened, then saved at a different time, even if the code is the same?..

Couldent you change the checksum/cert it checks againced on the phone?
[HTC Wildfire S] meanmug:
In the video http://www.youtube.com/v/bLWtIzOkEbI&hl=en_GB&feature=player_embedded&version=3 at 5:42 when "Waiting for GSM Ready" appears the xtc-clip activates, this is when xtc-clip disables security and the diag file is flashed.

---------- Post added at 12:27 AM ---------- Previous post was at 12:21 AM ----------

Its bedtime for me gents I'll catch up later, maybe someone will have developed some testies or a solution by the time I get from work, if we've helped any. Thanx for the brain workout.
[HTC Wildfire S] sythe179:
Is adb able to use the xtc diag file/s?

And if so, can it run at the same point if the phone has a test sim in it?
[HTC Wildfire S] ONeill123:
The DIAG Files are hboot scripts, so can only executed with the hboot. You can push the diag files to the phone using adb, but if u want to run them i thinkit will give an error.

P.S.:

The GSM DIAG files u find here:

http://xdaforums.com/showpost.php?p=20845965&postcount=118
[HTC Wildfire S] sythe179:
Try then reply?
[HTC Wildfire S] ONeill123:
I have tried the files with and without sim-card inserted.With gsm rom and cdma virgin mobile rom, but it doesn't work.

I posted only, mybe any other need the gsm files.
[HTC Wildfire S] sythe179:
Any way of making a virtual sim while at hboot?

(Software based)

Or changing the check in hboot to check a file instead of checking the sim location?
[HTC Wildfire S] csoulr666:
To be clear.....the CDMA versions of the WFS get s-offed with the diag files for the GSM variant.....there are no special files for CDMA......in my opinion all the test sim does is authenticate to remove the secure flag....as the CDMA version doesn't have a sim slot...the DIAG files do it anyway
[HTC Wildfire S] ONeill123:
Why the diag files i uploaded from the goldcard of an GSM XTC clipped device are different to the cdma uploaded?

The md5sums are different.
[HTC Wildfire S] sythe179:
Idea = (How about I order some sim cards, with some software preinstalled, and if they remove the s flag, ill sell em on eBay?..)

Well, unpack the gsm, and cdma files, and check each file to see what's different?...
[HTC Wildfire S] ONeill123:
My idea what i mean with generate md5 sums of the inckuded files.

I will do at evening an post the sums
[HTC Wildfire S] sythe179:
I know its your idea, hence why my idea is in brackets.

I"ll check back aswell tommorow with any info I have.
[HTC Wildfire S] BeciMester:
Not trying to be rude, but have you read the link I posted? That fella figured out a way to talk directly to the radio through a USB serial interface, and even identified the fastboot command to check the status of the @secu_flag. I thought it might be interesting, that's all. There's a wealth of information on that page.

Desire-Oxygen2.3.2 | WFS-stock
[HTC Wildfire S] sythe179:
Edit in original post or link please.
[HTC Wildfire S] BeciMester:
The link was there all along, post edited to make it a bit clearer as I can't post links yet.

Desire-Oxygen2.3.2 | WFS-stock
[HTC Wildfire S] ONeill123:
but i can post ;)

here is the link:

http://tjworld.net/wiki/Android/HTC/Vision/HbootAnalysis
[HTC Wildfire S] meanmug:
Thank you sir I missed your post somehow, I think it will be useful. I saw a few fastboot commands that are accessible in hboot, as some of you may know the process xtc-clip uses does not involve fastboot.
[HTC Wildfire S] ONeill123:
right, the xtc clip diag files uses the hboot script...
[HTC Wildfire S] XDA_h3n:
I tried on my sim unlocked wfs and the file didn't work.
[HTC Wildfire S] ONeill123:
Thats what i said.

And here are the md5 sums of the roms:

boot.img

GSM:

e18f91354ef85506412128873365cf01

CDMA:

53aba31370f2132cdb7c26e8b3875784

hboot_1.08.0000_7c2ddb69cf.nb0

GSM:

68671ab7d3982428fe0838987af3eab0

CDMA:

70353e4153bbb6e467ccc2a262cd6c73

radio.img

GSM:

a67cdbda57f580cf1f805d4299b38378

CDMA:

36af2a5bac46ede7baf92a88e1aa43c2

ramdisk.img

GSM:

01cdf003919075a056d71eb70a717c06

(missing in CDMA)

microp.img

CDMA:

9a49ac9a9bd263f36c05ea63e1c61c3e

(missing in GSM)

rcdata.img

GSM:

6a150bc9014f9fdf0a7601e5be3ede1b

CDMA:

b535348ff5fa0173c7f113c446575d6e

recovery.img

GSM:

c392fec86c4c37d03c13813a5e5ef0f4

CDMA:

9391d3bb23207ee5d493adb6a82b0deb

The other files does not matter ;)

In radio.img i search with hexeditor for secuflag and i found this line:

534543555F464C41473D25642C20554E4C4F434B3D30782558

means:

SECU_FLAG=%d, UNLOCK=0x%X

Found in line:

0x02257A0-0x02257B0

This is in CDMA Version like in GSM, but there are no "UNLOCK=0x%X"

Found in line:

0x0225170

maybe there we can overwrite?
[HTC Wildfire S] *se-nsei.:
Sounds like your on to something, but how do we overwrite it?

Methods that won't work: (will be added to first post as another section)

Structuring your own HBOOT files - NO MEANS OF TRANSPORT!

DIAG FILES on a SIM-UNLOCKED GSM device - TESTED NOT WORKING

Methods that sound like they are worth a shot:

no.human.being's code - ROOT EXPLOIT TO SOMEHOW PUSH S-OFF

Overwriting the flag in the radio
[HTC Wildfire S] m1ndh4x8r:
Keep it coming. Those s-on won't stand a chance with our exploit. :D
[HTC Wildfire S] ONeill123:
Hmm, i don't know how to overwrite the flag in the radio.img

because it's only the check if secuflag 1 or 0 (on or off). The "%d" is only a variable i think and read out of the NVRAM, like the revolutionary team member said.

Idk where the flag stored in the device, maybe any other has the knowledge to analyze the phones memory and locate the memory adress of the secuflag.
[HTC Wildfire S] mansmith:
I was thinking, if that is the ofsett in the radio.img and if we could figure out at wich offset the image gets written in memory ( maybe by examining an official htc Wfs flash utility) couldn't we get the offset of the secu flag by adding these two?

Then we only need the privileges to change that address.
[HTC Wildfire S] ONeill123:
Thats is impossible i think, bc thats is only an information offset i think :(

I have tried a little bit and found following:

in /dev/mtd/mtd3

following found for secu_flag:

@secu_flag: .+Q2

line 0D5C24C0

But i think its only an information mtd file :(
[HTC Wildfire S] ONeill123:
i think revolutionary not only flash a hacked hboot, bc my brother has a sensation xe and he has flashed a eng hboot now.

Before he has set s-off with revolutionary and now he is still s-off. So revolutionary must change the value of the secuflag. But how? I hope, that they will help us.

If we know in which memory adress the secuflag is, an programmer can write a code to change this value. Hope that anybody dev found a way to set s-off!
[HTC Wildfire S] sythe179:
Is there a way of doing a NAND/NVRAM dump/read to a txt file?

Another question for no.human, if I was to buy some blank sims, and write the HTC test sim image on them, and create a goldcard, should that work?...
[HTC Wildfire S] csoulr666:
In my opinion it should work because all we need with the diag files is the HTC test sim that the xtc-clip emulated.....but this brings my question........How are you planning to get the image of the HTC Test sim???
[HTC Wildfire S] ONeill123:
This isn't a real software solution. So you must have clear sim-cards, and i haven't got ;)

So we will change the XTC-Clip to the clear sim-crads.

And i think the software image, if there any, isn't enough, bc you can build your own xtc clip with electrical knowledge. SO i think only clear sims isn't enough.
[HTC Wildfire S] csoulr666:
Altough it ain't a software solution....but it is better than nothing.....and i think only getting the HTC test sim might just work......
[HTC Wildfire S] meanmug:
To make it simple for everyone if you change that value of secuflag you would have to reboot for it to take effect, once you reboot hboot will take over and rewrite the value, because hboot is just a compressed zip that contains all of the original images. Now with that said theres another way, if you manage to overwrite secuflag you will also have to overwrite secuflag located inside hboot.
[HTC Wildfire S] ONeill123:
What u mean with this?

That you must overwrite 2 secuflags? That isn't so. It give "only" one secuflag stored in the redio NVRAM. ANd if u overwrite this, then the hboot check this and shows s-off/s-on
[HTC Wildfire S] meanmug:
Hboot doesnt check anything, it loads itself before anything does. Thats the reason a ENG hboot is needed for true s-off. How many s-offed phones do you know of without a ENG or hacked hboot?
[HTC Wildfire S] ONeill123:
???

and why revolutionary don't flash an eng hboot?

My brother has uset s-off sensation xe and must flash eng hboot by himself.

And if it so like you said, how you want to flash an eng hboot with s-on? Simply we need an RUU eng hboot included or an update.zip signed
[HTC Wildfire S] meanmug:
Rev. did hack that hboot.
[HTC Wildfire S] ONeill123:
But why if my brother flash another hboot, s-off is there?

And how they flash a non-signed hacked hboot.
[HTC Wildfire S] gordo79:
if anything like the desire s he would have changed the hboot because the rev one has issues with flashing certain things
[HTC Wildfire S] meanmug:
That exploit has been patch now, they only gave us part of the solution with zerg. They used the temproot method to hack the hboot or flash their own hboot, I'm not sure which one. More than likely the reason they made zerg public.
[HTC Wildfire S] ONeill123:
Hm maybe they can help us, to find a way to flash a unsigned hboot with temprooted ws. The hacked hboot is after this.
[HTC Wildfire S] hascimal:
like this?

http://xdaforums.com/showthread.php?t=805327

http://www.techhackz.com/2010/11/how-to-root-permanently-your-htc-desire.html

wildfire s have emmc...
[HTC Wildfire S] meanmug:
I think we got all were gonna get from them with zerg plus its useless on our phones anyway. HTC is pretty much on top of all their own vulnerabilities thanks to Rev.
[HTC Wildfire S] ONeill123:
Hmm, this thing i see:

- we haven't got an ENG-Hboot, unhappily

- the Ws has only /dev/block/mmcblk0p0 and /dev/block/mmcblk0p1 (maybe the same like the files the dhd means)

- we have only CWM recovery, the thread says, that is isn't the CWM

It is a lot of risk by trying this.