[HTC Wildfire S] munjeni:
From strace I getting this info when I run arx-helper with command liberty 1.02.0000:

1|root@android:/data/local # strace ./arx-helper liberty 1.02.0000
strace ./arx-helper liberty 1.02.0000
execve("./arx-helper", ["./arx-helper", "liberty", "1.02.0000"], [/* 21 vars */]
) = 0
mmap2(0x1f000, 49860, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_
ANONYMOUS, -1, 0) = 0x1f000
cacheflush(0x2a388, 0x2ad80, 0, 0xea000000, 0x17000) = 0
cacheflush(0x2ad80, 0x2b5c0, 0, 0, 0x17000) = 0
cacheflush(0xbe9411a0, 0xbe941254, 0, 0, 0xbe941188) = 0
mmap2(0x8000, 82652, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_A
NONYMOUS, -1, 0) = 0x8000
cacheflush(0x8000, 0x80b4, 0, 0, 0xbe941130) = 0
cacheflush(0x80b4, 0x1c2dc, 0, 0, 0xbe941130) = 0
mprotect(0x8000, 82652, PROT_READ|PROT_EXEC) = 0
mmap2(0x1d000, 2828, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS,
-1, 0x15) = 0x1d000
cacheflush(0x1d000, 0x1db0c, 0, 0, 0xbe941130) = 0
mprotect(0x1d000, 2828, PROT_READ|PROT_WRITE) = 0
mmap2(0x1e000, 1656, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS,
-1, 0) = 0x1e000
brk(0x1f000) = 0x1f000
munmap(0x20000, 45764) = 0
gettid() = 827
set_tls(0xbe941a34, 0, 0x40, 0, 0xbe922000) = 0
mmap2(NULL, 49152, PROT_READ, MAP_SHARED, 8, 0) = 0x40000000
open("/dev/urandom", O_RDONLY) = 3
read(3, "\223\234l\37", 4) = 4
close(3) = 0
pipe([3, 4]) = 0
close(2) = 0
dup(4) = 2
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40
00c000
mprotect(0x4000c000, 4096, PROT_READ) = 0
write(2, "Errors (if any):-\n", 18) = 18
unlink("./arx-helper") = 0
open("/proc/emmc", O_RDONLY) = -1 ENOENT (No such file or directory)
brk(0) = 0x1f000
brk(0x1f000) = 0x1f000
brk(0x20000) = 0x1f000
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40
00d000
open("/proc/mtd", O_RDONLY) = 5
read(5, "dev: size erasesize name\nm"..., 2047) = 228
close(5) = 0
open("/dev/mtd/mtd0", O_RDONLY) = 5
ioctl(5, MTRRIOC_SET_ENTRY, 0xbe94086c) = 0
close(5) = 0
mmap2(NULL, 659456, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x
4000e000
mmap2(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x
400af000
open("/dev/mtd/mtd0", O_RDONLY) = 5
ioctl(5, 0x80104d12, 0xbe940850) = 0
lseek(5, 0, SEEK_CUR) = 0
lseek(5, 0, SEEK_SET) = 0
read(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1
31072) = 131072
ioctl(5, 0x80104d12, 0xbe940840) = 0
ioctl(5, 0x80104d12, 0xbe940850) = 0
lseek(5, 0, SEEK_CUR) = 131072
lseek(5, 131072, SEEK_SET) = 131072
read(5, "********************************"..., 131072) = 131072
ioctl(5, 0x80104d12, 0xbe940840) = 0
ioctl(5, 0x80104d12, 0xbe940850) = 0
lseek(5, 0, SEEK_CUR) = 262144
lseek(5, 262144, SEEK_SET) = 262144
read(5, "********************************"..., 131072) = 131072
ioctl(5, 0x80104d12, 0xbe940840) = 0
ioctl(5, 0x80104d12, 0xbe940850) = 0
lseek(5, 0, SEEK_CUR) = 393216
lseek(5, 393216, SEEK_SET) = 393216
read(5, "********************************"..., 131072) = 131072
ioctl(5, 0x80104d12, 0xbe940840) = 0
ioctl(5, 0x80104d12, 0xbe940850) = 0
lseek(5, 0, SEEK_CUR) = 524288
lseek(5, 524288, SEEK_SET) = 524288
read(5, "********************************"..., 131072) = 131072
ioctl(5, 0x80104d12, 0xbe940840) = 0
ioctl(5, 0x80104d12, 0xbe940850) = 0
lseek(5, 0, SEEK_CUR) = 655360
close(5) = 0
munmap(0x400af000, 135168) = 0
mmap2(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x
400af000
open("/dev/mtd/mtd0", O_RDWR) = 5
lseek(5, 0, SEEK_CUR) = 0
ioctl(5, 0x40084d0b, 0xbe940830) = 0
ioctl(5, MTRRIOC_DEL_ENTRY, 0xbe940828) = 0
lseek(5, 0, SEEK_SET) = 0
write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"...,
131072) = 131072
lseek(5, 0, SEEK_SET) = 0
read(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1
31072) = 131072
lseek(5, 0, SEEK_CUR) = 131072
ioctl(5, 0x40084d0b, 0xbe940830) = 0
ioctl(5, MTRRIOC_DEL_ENTRY, 0xbe940828) = 0
lseek(5, 131072, SEEK_SET) = 131072
write(5, "********************************"..., 131072) = 131072
lseek(5, 131072, SEEK_SET) = 131072
read(5, "********************************"..., 131072) = 131072
lseek(5, 0, SEEK_CUR) = 262144
ioctl(5, 0x40084d0b, 0xbe940830) = 0
ioctl(5, MTRRIOC_DEL_ENTRY, 0xbe940828) = 0
lseek(5, 262144, SEEK_SET) = 262144
write(5, "********************************"..., 131072) = 131072
lseek(5, 262144, SEEK_SET) = 262144
read(5, "********************************"..., 131072) = 131072
lseek(5, 0, SEEK_CUR) = 393216
ioctl(5, 0x40084d0b, 0xbe940830) = 0
ioctl(5, MTRRIOC_DEL_ENTRY, 0xbe940828) = 0
lseek(5, 393216, SEEK_SET) = 393216
write(5, "********************************"..., 131072) = 131072
lseek(5, 393216, SEEK_SET) = 393216
read(5, "********************************"..., 131072) = 131072
lseek(5, 0, SEEK_CUR) = 524288
ioctl(5, 0x40084d0b, 0xbe940830) = 0
ioctl(5, MTRRIOC_DEL_ENTRY, 0xbe940828) = 0
lseek(5, 524288, SEEK_SET) = 524288
write(5, "********************************"..., 131072) = 131072
lseek(5, 524288, SEEK_SET) = 524288
read(5, "********************************"..., 131072) = 131072
lseek(5, 0, SEEK_CUR) = 655360
close(5) = 0
munmap(0x400af000, 135168) = 0
fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0
mprotect(0x4000c000, 4096, PROT_READ|PROT_WRITE) = 0
mprotect(0x4000c000, 4096, PROT_READ) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0

write(1, "OKAY\n", 5OKAY
) = 5
mprotect(0x4000c000, 4096, PROT_READ|PROT_WRITE) = 0
mprotect(0x4000c000, 4096, PROT_READ) = 0
munmap(0x4000c000, 4096) = 0
exit_group(0) = ?

If you have idea please let me know! I can not disasemble arx-helper because... I thinks thats binary is obfuscated too ?

Interested lines is:

- set_tls .... http://old.nabble.com/ARM-set_tls-syscall-handling-td27407796.html

- st_rdev=makedev(136, 0)... what device is created?

- ioctls

- lseeks

- why opening mtd0... mtd0 is misc partition !!!

- MTRRIOC_SET_ENTRY ... https://www.codeaurora.org/git/proj...ntry/android/external/strace/linux/ioctlent.h

EDIT:

After erasing misc partition (dd if=/dev/zero of=/dev/mtd/mtd0 bs=131072) and after verifying if misc is realy erased (yes, its erased), and after runing arx-helper again and dumping again misc partition I found what is writen to misc partition, see -> http://paste.ubuntu.com/1036891/ but what is use from that :confused: Definitelly misc partition have something with hacking hboot ! Maybe doors is opened now? ...Will try to map hboot in kernel as a mtd6, maybe I can erase mtd6 partition after all that. Any one know whats use of misc partition in android?