[HTC Wildfire S] no.human.being:
Secu_flag resides in the radio. HBOOT reads the secu_flag and, according to the Revolutionary member, enables hardware side NAND locks on the controller when it is set. (*) So for achieving S-OFF, you either have to modify the secu_flag to turn it S-OFF or modify the HBOOT code to ignore the secu_flag, which means don't verify signature of ROMs to be flashed and don't enable NAND lock if Android kernel is booted. Both will have the same result. As far as I know, Revolutionary does the second one (flash a hacked HBOOT that does not care about secu_flag). However, all of my development effort goes into the former direction, as I think this is the easier way as both memory areas are protected, but flipping a flag means less change than replacing the entire bootloader code, so less complexity and less possibility for disaster.

(*) Sorry, but I am still having doubts about this. I have never seen a trusted source that states that the chipset even has such a feature. Even the official datasheets do not mention it and I doubt that Qualcomm will leave such an important feature undocumented. Furthermore, no "non-HTC" device seems to have this security measure in place. If it was a chipset feature, I'm sure other manufacturers would make use of it as well.

I did not have the chance to verify that yet, but everyone says it's in the radio so almost certainly it's there. Signed (original) PG76DIAG.nbh can be flashed on S-ON phones, but obviously will not turn the phone S-OFF. Unsigned (modified) PG76DIAG.nbh will produce signature mismatch and HBOOT will refuse to flash.

It is on partition 7 at offset 0x00000a00 on the Desire S. I expect it to be on partition 3 0x00000a00 on the Wildfire S, but I could not verify this yet. One member said it was not on partition 3 offset 0x00000a00 as there was only "yyyy..." at this address. Could not verify this either. Still need to get a suitable toolchain working.

It creates a gold card on the MicroSD and emulates a test SIM card through the flex cable.

There is a modified version of the code that seems to get the device file open (afaik mine didn't for some reason). Like I said, I still need a suitable toolchain, but this should be very close to what we need. Probably the most difficult part will be getting the offsets right. They are from the DS and chances are that they're different on the WFS, but they might also be not. I see that this thread has developed so many different ideas for achieving S-OFF, but I think this exploit really is the way to go. Just need more time to get this all running and time is currently at a premium as I'm having a research project running at university and am preparing for the exams. Could anybody get this running and post the results (e. g. do a binary comparison of the two image files, original and patch, and post some hex dumps around the addresses that have changes applied)? Please comment out the entire step 3 while running this on your phone, as this is the only part that writes to NAND and could potentially brick the phone. Also tell me which toolchain you used to compile. Thank you very very much. Remember that you must have temprooted your phone with zergRush before performing the exploit.