yashsingh1/xdaforums huggingface dataset:
[HTC Wildfire S] no.human.being:
A "toolchain" is just "a set of tools" (utility programs).

Yes any hex editor or disassemble it with an ARM-capable disassembler (I think objdump should do it) as the Radio is firmware, so it's ARM code.

Well, the NAND supports physical addresses from 0x00000000 to 0x1fffffff. This post explains what lies at which physical address in NAND. The physical addresses 0x00000000-0x02fbffff are the area with the highest amount of protection around them.

It's what we call "unmapped memory", since the "normal" Android kernel is so much "concerned" about the security of this memory area that it removes the mapping to these physical addresses from the device's page table so that they don't have a virtual address assigned any more that it could use to access it. :D

Thank you guys, you were so amazing. I would have never got that far without your support, thank you so much for everything. :D
[HTC Wildfire S] theq86:
@nhb

the CWM OS image contains a flash_image binary that is able to flash mtd partitions (as one, so we would have to write the whole radio back) but at least we have a flash tool.

So now, there the mtd called "radio" is mapped, we could probably flash the radio using

flash_image radio radio.img from CWM shell

I'm not yet brave enough to try (and flash back the image I cat'ted out), are you? :D
[HTC Wildfire S] heavy_metal_man:
anybody else too excited to go to bed??? (12.20am where i am :P)
[HTC Wildfire S] no.human.being:
Not really. :D

Also what purpose should it have other than causing wear on the NAND.

Also remember that you cannot flash a "radio image" extracted from an RUU in this way. These are much smaller (about half of the size) and look way different than what's actually on the NAND. So the RUUs are not doing raw flashing for them.

However, we actually don't care for all that. All we're gonna do is modify some pages. Only thing left is finding out what to modify and then head into lots and lots of programming and API work.

If we can't find out how to flash a single page in memory, we could of course still dump --> patch --> erase --> writeback the entire partition, but I'd actually prefer the "less invasive" method. :D

Well, actually you could just do it. We certainly won't find the secu_flag and create/publish the S-OFF utility tonight. :D

---------- Post added at 01:26 AM ---------- Previous post was at 01:21 AM ----------

Size is exactly the same (of course, since that's the amount of memory we mapped in :D ).

MD5 is: 48349adaf977ebd48ae6c48fe1f0bc35
[HTC Wildfire S] theq86:
wish I could come over for a beer and see the diffs between our radios.

won't help us S-OFF but I'm just curious.

I found out the hboot begins 0x02400000, is 512k large and before and after there is much more :D

I also read somewhere in the RUUs, that there is a radio and a radio_v2. maybe one above and the other below the hboot.

---------- Post added at 01:46 AM ---------- Previous post was at 01:43 AM ----------

only unlockable hboot with unlocked bootloader. otherwise fastboot refuses the custom boot command and we won't be able to give the kernel parameters that make mtd7 map.

maybe we could later find a more convenient way, but for now, it's so.
[HTC Wildfire S] heavy_metal_man:
thanks man :)
[HTC Wildfire S] no.human.being:
Yeah, would be nice, but too much of a distance sadly. :D

However, might consider doing it once we got this through, hehe. :D

Wow that's small actually. But it seems right. The disassembly of HBOOT images (I think they were from an RUU) were 131.417 lines of assembler code. Now consider one line to be one machine instruction. ARM is a 32-bit processor so one machine instruction is 4 bytes long. That would be 525.668 bytes or 513,34 KiB so given that not every line of assembler code is a machine instruction but some are information for the assembler itself it seems right. Lol that's so incredibly small. Probably just a few hundred lines of C, since ARM assembler is really verbose as the instruction set is so simple (it's a RISC machine). :D

Right. We're focusing on "escalating" from "Unlocked S-ON" to true "S-OFF" first, then publish the exploit so that most users can get S-OFF at the earliest point in time. Afterwards we can focus on breaking the bootloader lock so that people can get S-OFF who can't unlock the bootloader due to carrier restrictions.
[HTC Wildfire S] theq86:
Great success today, a major milestone achieved. But now I'll shutdown and reboot tomorrow with a fresh and clean RAM. So to say, I go to bed :D

Also from me a great thanks to nhb and all the other contributors and helpers.

If we will ever meet, the first beer is on me :D

Good night.
[HTC Wildfire S] heavy_metal_man:
I`ll drink to that :cool:

night guys :)
[HTC Wildfire S] BeciMester:
Great work guys! :D Could any of you upload your radio dump somewhere so I can have a look too? Curiosity is killing me but I won't have access to my WFS for a few days (wife's away) :(. I can provide storage if necessary ;).
[HTC Wildfire S] MrTaco505:
So does this call in the JTAG?
[HTC Wildfire S] theq86:
No, I don't think so. We have to find one who is willing to unlock his phone, dump the radio, clip the phone and dump the radio again. Otherwise we'd been searching the needle in a haystack.

But if that will not work we probably have to use JTAG to find out how exactly and where the flag is read from.
[HTC Wildfire S] no.human.being:
So we got entirely different Radio firmware, theq86? :eek:

Mine is ...

*** UNLOCKED ***
MARVEL PVT SHIP S-ON RL
HBOOT-1.08.0099
MICROP-0451
RADIO-7.53.39.03M
Nov 28 2011,19:09:21

What is yours?

Also remember the last thing the DIAG software says when S-OFFing via xtc-clip is: "Get OEMSBL fail! Pls chk SECU-flag on/off!"

After this message is displayed you are S-OFF.

So we might find the flag somewhere around the "OEMSBL" markings, but that's heavy guesswork actually. :D
[HTC Wildfire S] theq86:
yes, nhb we do have a completely different radio and you should consider upgrading :D

MARVEL PVT SHIP S-ON RL
HBOOT-1.09.099
MICROP-0451
RADIO-7.54.39.28M
Feb 8 2012,18:29:31

It just looks like you missed the 2.13.401.3 update? because there the 7.54er radio was in. but obviously on cm7 you don't get FOTAs :D
[HTC Wildfire S] m1ndh4x8r:
in gfan someone tried eoghans method used a sim card that has no signal, and he achived s-off. not sure if it's true.
[HTC Wildfire S] theq86:
I doubt that a sim card without signal would be enough to mime an engineering sim.

But, nevertheless, we have full access to the radio. there is no need in handling with sims or diagnostic tools. We will be flicking the flack as if there was no security.
[HTC Wildfire S] heavy_metal_man:
so am i correct in thinking that the next step is to get someone radio dumped and clipped?
[HTC Wildfire S] MrTaco505:
I think I missed it too.
[HTC Wildfire S] theq86:
Yes. the "subject" (tho one who is willing to help us :D )

will have to

1. Unlock Bootloader (so that we can map the radio)

2. Dump the radio

3. Clip the phone

4. Dump the radio again

5. Upload radio_before and radio_after

Then we compare radio_before and radio_after and see what exactly the clip changed.

When we have this information, we must find out how to make the changes the xtc clip did in a program. So we need to know how to access the mtd device within a C-program. I think nhb will do it in C.

When this is ready we can test the exploit on an S-On Unlocket Bootloader phone.

If we successfully S-OFFED this phone, we can probably test on 4-5 other devices. If we are sure we got it without bad side-effects, we can really publish it as working exploit.

It's hard to estimate a time. To find someone willing to clip and help is probably easy, to dive in to the API can tricky, too. We made a great progress, but don't expect the exploit the next few days ;)
[HTC Wildfire S] MrTaco505:
is anyone willing to share a radio dump because the commands are not working on my tmobile us version of the wfs?
[HTC Wildfire S] theq86:
then you probably have a unable fastboot. use the fastboot binary from the official android sdk to be able to set kernel parameters.

it has nothing to say wether your device is t-mobile, us or other. just be sure

* us use a clockworkmod 5.0.2.8 recovery.img

* to use an able fastboot (preferably from the android sdk)

* to follow the steps exactly

I'd like to upload mine, but uploading > 50 megabytes would take days with my current connection :D
[HTC Wildfire S] heavy_metal_man:
groovy:cool: sooooooooo:rolleyes: who is willing to help out the cause :P
[HTC Wildfire S] pihug12:
If the dumps are pretty similar, maybe you could compare yours to the dump of someone already S-OFF (without having to wait for someone who can dump before/after XTC-Clip).

I think only two configurations are possible right now :

HBOOT-1.09.0099 + RADIO-7.54.39.28M

HBOOT-1.08.0099 + RADIO-7.53.39.03M

(I don't see other possibility...)

Maybe no.human.being should wait before upgrading to check if the flag is at the same place in the two cases. Tell me if I'm wrong but we're not 100% sure, right ?

Someone S-OFF with one of the configuration above should do the steps written by no.human.being and send the dump (by hosting it on mediafire.com for example) to no.human.being, theq86 and BeciMester so they could compare it.

However I don't understand where to get the "recovery.img".
[HTC Wildfire S] heavy_metal_man:
never mind, misread the last post.
[HTC Wildfire S] BeciMester:
7zip it or something, those walls of 0xff's should compress pretty well. :)

EDIT: I can pop down to the unlocking shop and do the XTC-clip thing and the before-after comparison, but not sooner than the weekend. :(

(I'm on my phone...)
[HTC Wildfire S] :
I can maybe help. S-off and hhoot 0.90, radio 7.53M.

Mac user btw. Dont want to use linux and dont want a bricked phone :p

If something goes wrong, just pull out battery?
[HTC Wildfire S] a.s.j:
If I understand that well it would be possible to play around with partiton sizes too to get more space for data space?

Would it be then possible to do what i did with my vision to use temp root and just push the image using dd to the correct partiton and overwrite the locked one with unlocked one?

Would we be able to create ENG-HBOOT so we do not need to use the one supplied by HTC Dev?
[HTC Wildfire S] theq86:
Well, it would surely be possible to look for the secu flag comparing two arbitrary chosen radios, on s-on and one s-off, but ...

We want to get THE ONLY changes of xtc-clip. If we compare 2 different radios (and be them the same version either) the radios would more differ than we want.

So to trace only xtc clip changes it HAS to be two dumps from the same phone before and after.

Yes, it does. So do the 0x00's, I should have known myself

Unfortunately you are too far away from the conditions we need.

Remember, we need unlocked bootloader and latest versions of radio and hboot.

that means HBOOT 1.09.0099 and radio RADIO-7.54.39.28M

---------- Post added at 03:20 PM ---------- Previous post was at 03:15 PM ----------

From what I know when you are S-OFF you can change the partition sizes. there's a tutorial in this forum.

We are not that far. Still, you have to be bootloader unlocked to access the radio at all.

And I don't think dd is the tool of your favor in this case.

Why ENG HBOOT? S-OFF will be made inside the radio. You will be able to use any hboot you want. We could also make our own custom bootloader and stuff.
[HTC Wildfire S] a.s.j:
This question was only to bypass the HTC Dev token check when unlockking the phone. I know that we want to get S-OFF by changing the flag in Radio, but at this moment you can not do it without HTC Dev one. Althrough I've seen those files and some tutorial using GoldCard without the need of the token on the forum somewhere.

I just do not want HTC to know, that I messed with the phone that is not mine ;)
[HTC Wildfire S] theq86:
As I have stated some pages ago, there is currently no other way than going through the whole unlocking process. So no.human.being decided to work on that base.

See, without unlocked bootloader there is no chance to map in the radio.

without S-OFF, we will not be able to flash ENG hboot.

It's some kind of "Chicken or the egg" until we cracked the bootloader witout S-OFF.

But this is not our primary goal. If we succeed in making the exploit we can focus on that, but for now there is no other way.
[HTC Wildfire S] seaskyways:
Progress !!

Come on guys days passed while the idea is not done by any body !! come on any body Dump the ******* radio and xtc clip your phone then dump then upload both !! come on guys !
[HTC Wildfire S] theq86:
instead of pushing everyone, why don't you do it?

I think we have many people wanting to help even without you pushing everyone.
[HTC Wildfire S] seaskyways:
i would do if i had an XTC clip , perhaps i am selling this WFS cuz i am having a major problem mostly with the misc which i couldn't find a solution for, and i couldn't get it working , well if misc doesn't have to do with the Radio , i will dump my s-on radio , just tell me how , and if you are willing to help with my problem pm please cuz i am getting outta hope !

---------- Post added at 05:24 PM ---------- Previous post was at 05:22 PM ----------

meaning i could only give you a radio_before only , and i am very excited for the s-off too , but i can't s-off it cuz it is windy and might be very $$ ...
[HTC Wildfire S] *se-nsei.:
The token method won't work and it's stupid people trying HTCdev anyway, because the phone needs to have a certain feature in the ROM that will give such a token when HTC recognise it via adb.
[HTC Wildfire S] ONeill123:
Hmm, was only an idea :(
[HTC Wildfire S] ONeill123:
Why the rom must understood this command?

Its a fastboot command, so max. The bootloader can interact with user. Adb doesn't funct. In hboot.
[HTC Wildfire S] Schnello:
Thats wrong.

To get the token you must use the fastboot command: fastboot oem get_identifier_token

So I think ONeill123 would only verify: Is the command in the new bootloader available. With this information it possible to say: The unlock process is coming soon….

I think no because the bootloader 1.008 is only optional regarding spez. unknown rules. (Update only if Hboot is 1.003?)

Edit:

Servus ONeill :)
[HTC Wildfire S] ONeill123:
I think the new hboot updates only with special rules, bc i have try to update twice with ruu and one time with the PG76IMG.zip (renamend from rom.zip of the ruu) and then say: bootloader bypassed

i thought like the explorer users, the device isn't shown in the supported devices list, but they can unlock the device with the htc method. I hope HTC will do this method for us as christmas present :D

P.S.: Hallo Schnello :D
[HTC Wildfire S] Tectas:
Sry to say, but the rom itself doesn't matter for this, just the bootloader.

If you got LOCKED at the first line of your bootloader, you can use htcdev even if the device isn't listed, but you won't gain s-off with this. Your bootloader will stay s-on, but instead of the locked there will be UNLOCKED at the first line.

With the unlocked bootloader you can flash custom roms, but no kernels (you indeed can flash them, but only with fastboot and NOT from recovery).

Oh and btw the desire s is also not listed, but it worked for many to unlock it, but only since an ota, that included a bootloader with the locked unlocked ability, was shipped.
[HTC Wildfire S] ONeill123:
Hmm, hope that anyone find a way to software s-off.

How the xtc clip changes the value of the secruity flag?
[HTC Wildfire S] no.human.being:
I don't know exactly, but their website states that it is a "universal goldcard generator". (*)

The xtc clip has an SD card slot and it will "burn" a special image to the SD card you insert, turning it into a "goldcard". I think the SD card must then be inserted into the phone, HBOOT finds the "goldcard" code and switches device security off.

So in some sense, the special SD card the xtc clip creates (*) works like some kind of "master key" for the HBOOT of this particular phone. You cannot use the goldcard on any other phone, as it seems to be tied to the device serial. There are other "goldcard generators" out there on the internet, but I have verified them NOT to work.

(*) Actually the goldcard image will probably be generated on the servers of the xtc clip manufacturers and just get "burnt" to the SD card by the clip, as their website states, that you MUST be connected to the internet in order for the unlocking to succeed.
[HTC Wildfire S] ONeill123:
Hmm, but if give many xtc clip manufacturar. Maybe it give an algorithm to create the goldcard.

But why it must be insert the hardware xtc clip?
[HTC Wildfire S] no.human.being:
The xtc clip's flex adapter must be inserted into the SIM card slot as the clip seems to read the device serial via the SIM card interface somehow. The serial gets transmitted to some servers operated by the xtc clip manufacturers, which use some unknown algorithm in order to generate the goldcard image from the device serial. The goldcard image gets transmitted back to the xtc clip software, which will use the SD card writer inside the xtc clip in order to write the goldcard to SD.

I guess there is additional hardware (some kind of key generator, like on a smartcard or security token) inside the xtc clip, which uniquely identifies it to the manufacturer's servers, so that you (or a third party) can't build their own xtc clip device. The goldcard generating servers will check for this security feature to be present and will not give you a goldcard image when not authenticated.
[HTC Wildfire S] ONeill123:
So, if u have the goldcard image for your device, in theorie you don't need the clip?
[HTC Wildfire S] imlgl:
A goldcard is a goldcard. The xtc clip one is nothing special it just does the process quicker as it is optimized for it. The main unlocking comes from the hardware not the goldcard.
[HTC Wildfire S] Schnello:
Hardware and spez Software (PG76DIAG.zip) on the SD Card. But you are right... the goldcard is a normal goldcard.
[HTC Wildfire S] :
The XTC clip emulates an HTC test SIM.
[HTC Wildfire S] no.human.being:
Sorry, but the hardware inside xtc clip isn't special at all. I think someone even posted a schematic of it somewhere some time ago. Just some pretty standard ICs you could grab at an electronics distributor, get a PCB etched and solder it all together. They must make sure that their intellectual property remains on their servers. Their secret cannot lie in this little box or in the software they supply, as anything that gets into the customer's realm is far too simple to reverse-engineer by a competitor.

See also Revolutionary, which performs the unlocking without any hardware involvement at all.
[HTC Wildfire S] Schnello:
If you create a goldcard via the XTC Clip ... at this step its not necessary to connect the Phone to the Clip. Only to enter manually some information: OS, Phone Model, HBoot Version.

During the unlock process there is no internet access ...

Phone <> Sim Dummy <> Clip with 9V Bat
[HTC Wildfire S] ONeill123:
So i thought right, only the xtc software doesn't funct. :(

And in which process the htc test sim aka xtc clip is required and why not a normal sim funct?
[HTC Wildfire S] imlgl:
Surely there would be a way of extracting this information as it would be stored on the clip. I'm sure there are people that could get the data from it which could help but I don't think anyone which are active here know how. As you said it is the software the secret must lie with the clip as it has a copy of the software on it so it can unlock devices by using a 9v battery.
[HTC Wildfire S] no.human.being:
Ah I see. So another method for gaining S-OFF method. Reverse-engineer xtc clip. :D

Just kidding. Their product might be overpriced, but it's their IP and I don't want to "steal" it from them. I'm confident we'll get our own method done and if I get some exploit running, I will definitely publish the code in order to provide a free and safe (because hiding malicious code inside an open source product is usually not possible) S-OFF method to our HTC community.

The bootloader probably probes for both, the goldcard and the special SIM (is that "special SIM" the same as the "whitecard"?) to be present before turning device security off.

Probably reverse-engineering the Revolutionary software and porting it over to the MSM7227 (which it doesn't support because this processor is not considered "widespread" enough) would be easier, but as I said, I will respect the IP of the developers. If they open up the exploit to me, great, I'll make the offer to port it to the MSM, but I don't think they will. They explicitely mention on their website, that they are not willing to disclose their exploit. It's currently "beta" software and you need a key for each unlock. The keys are free at the moment, but they will probably charge for them once it is not considered "beta" any more. They will lose this opportunity by disclosing their exploit method, so I doubt it will happen.
[HTC Wildfire S] ONeill123:
Hope u find a way for an exploid to s-off our wildfire s.
[HTC Wildfire S] BeciMester:
The first successful dump was done roughly 12 hours ago. We understand that you're impatient, but if you could wait months for the solution, one or two more days won't kill you. :)

(I'm on my phone...)
[HTC Wildfire S] heavy_metal_man:
Well I have the clip in Scotland, anyone else wanna tag in? Get a list of people with a clip and see

Who is near to them.
[HTC Wildfire S] BeciMester:
I'll have to go to the local unlock shop so yes, I have "access" to one. It's probably €20 but screw it, I'll take one for the team. :) Has to wait til the weekend though.

(I'm on my phone...)
[HTC Wildfire S] theq86:
Sorry, you are limited to 8 thanks per day :mad:

This is just great of you, please tell us your hboot and radio version. best is you post your hboot output :)
[HTC Wildfire S] BeciMester:
Well I'll have to upgrade to the latest as I'm still on hboot 0.90 and the old radio. I wanted to keep the option, just in case we discover something that needs the old hboot. (one would think that newer ones are better patched and stuff) So my hboot and radio will be the same as yours. I hope to do the dump later tonight, after college, and upload it, but I can't see why it would be different from yours.

(I'm on my phone...)
[HTC Wildfire S] theq86:
It will be different because of our different unlock codes. maybe also some regional differences, too.

I have uploaded my radio some posts above for you. when your dump is ready you could also upload it and we can see the differences.