[HTC Wildfire S] SeeKai:
no joy

When I tried to use the munjeni mtdutils from the prompt I got 'file not found' errors. Wrong arch? The files where there...

/sdcard # ./mtdutils/flash_unlock --help
./mtdutils/flash_unlock --help
/sbin/sh: ./mtdutils/flash_unlock: not found
/sdcard # ls -al ./mtdutils/flash_unlock
ls -al ./mtdutils/flash_unlock
-rwxrwxrwx 1 root root 4296 Aug 29 2011 ./mtdutils/flash_unlock

So I switched back to the mtdutils in your exploit-inject.zip.

nanddump -nf gives an error:

./mtdutils/nanddump -nf hboot.img /dev/mtd/mtd7
Block size 262144, page size 4096, OOB size 128
Dumping data starting at 0x00000000 and ending at 0x00080000...
libmtd: error!: cannot read 4096 bytes from mtd7 (eraseblock 0, offset 0)
error 22 (Invalid argument)
nanddump: error!: mtd_read

Without -n it does work.

BTW: flash_unlock gives an error too:

./mtdutils/flash_unlock /dev/mtd/mtd7
flash_unlock: error!: could not unlock device: /dev/mtd/mtd7

error 95 (Operation not supported)

And yes, cat and nanddump seem to do the same, md5sums on the results are the same:

cat /dev/mtd/mtd7 > hboot2.img
./mtdutils/nanddump -f hboot3.img /dev/mtd/mtd7
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 262144, page size 4096, OOB size 128
Dumping data starting at 0x00000000 and ending at 0x00080000...

md5sum hboot*.img
54a0d97f73e1ed632c309eefc36cc473 hboot.img
d6ee9e987876964cfebb573a751c6fd7 hboot2.img
d6ee9e987876964cfebb573a751c6fd7 hboot3.img

ls -al hboot*.img
-rwxrwxrwx 1 root root 524288 Mar 24 16:43 hboot.img
-rwxrwxrwx 1 root root 524288 Mar 24 17:05 hboot2.img
-rwxrwxrwx 1 root root 524288 Mar 24 17:07 hboot3.img

Note: hboot.img is the one adjusted by the inject program.

And these are the results of nandwrite (cat hboot.img > /dev/mtd/mtd7 gives and I/O write error, to rude probably)

/sdcard # ./mtdutils/nandwrite -an /dev/mtd/mtd7 hboot.img
./mtdutils/nandwrite -an /dev/mtd/mtd7 hboot.img
nandwrite: error!: Autoplacement and no-ECC are mutually exclusive
/sdcard # ./mtdutils/nandwrite -a /dev/mtd/mtd7 hboot.img
./mtdutils/nandwrite -a /dev/mtd/mtd7 hboot.img
Writing data to block 0 at offset 0x0
libmtd: error!: cannot write 4096 bytes to mtd7 (eraseblock 0, offset 0)
error 5 (Input/output error)
Erasing failed write from 00000000 to 0x03ffff
libmtd: error!: MEMERASE64 ioctl failed for eraseblock 0 (mtd7)
error 5 (Input/output error)
nandwrite: error!: /dev/mtd/mtd7: MTD Erase failure
error 5 (Input/output error)
Writing data to block 1 at offset 0x40000
libmtd: error!: cannot write 4096 bytes to mtd7 (eraseblock 1, offset 0)
error 5 (Input/output error)
Erasing failed write from 0x040000 to 0x07ffff
libmtd: error!: MEMERASE64 ioctl failed for eraseblock 1 (mtd7)
error 5 (Input/output error)
nandwrite: error!: /dev/mtd/mtd7: MTD Erase failure
error 5 (Input/output error)
nandwrite: error!: Data was only partially written due to error
error 5 (Input/output error)

/sdcard # ./mtdutils/nandwrite -n /dev/mtd/mtd7 hboot.img
./mtdutils/nandwrite -n /dev/mtd/mtd7 hboot.img
Writing data to block 0 at offset 0x0
libmtd: error!: cannot write 4096 bytes to mtd7 (eraseblock 0, offset 0)
error 22 (Invalid argument)
nandwrite: error!: /dev/mtd/mtd7: MTD write failure
error 22 (Invalid argument)
nandwrite: error!: Data was only partially written due to error
error 22 (Invalid argument)
/sdcard # ./mtdutils/nandwrite -on /dev/mtd/mtd7 hboot.img

./mtdutils/nandwrite -on /dev/mtd/mtd7 hboot.img
Input file is not page-aligned. Use the padding option.
nandwrite: error!: Data was only partially written due to error
error 0 (Success)
/sdcard # ./mtdutils/nandwrite -o /dev/mtd/mtd7 hboot.img

./mtdutils/nandwrite -o /dev/mtd/mtd7 hboot.img
Input file is not page-aligned. Use the padding option.
nandwrite: error!: Data was only partially written due to error
error 0 (Success)

/sdcard # ./mtdutils/nandwrite -om /dev/mtd/mtd7 hboot.img
./mtdutils/nandwrite -om /dev/mtd/mtd7 hboot.img
Input file is not page-aligned. Use the padding option.
nandwrite: error!: Data was only partially written due to error
error 0 (Success)

/sdcard # ./mtdutils/nandwrite -op /dev/mtd/mtd7 hboot.img
./mtdutils/nandwrite -op /dev/mtd/mtd7 hboot.img
nandwrite: error!: Can't pad when oob data is present

/sdcard # ./mtdutils/nandwrite -p /dev/mtd/mtd7 hboot.img
./mtdutils/nandwrite -p /dev/mtd/mtd7 hboot.img
Writing data to block 0 at offset 0x0
libmtd: error!: cannot write 4096 bytes to mtd7 (eraseblock 0, offset 0)
error 5 (Input/output error)
Erasing failed write from 00000000 to 0x03ffff
libmtd: error!: MEMERASE64 ioctl failed for eraseblock 0 (mtd7)
error 5 (Input/output error)
nandwrite: error!: /dev/mtd/mtd7: MTD Erase failure
error 5 (Input/output error)
Writing data to block 1 at offset 0x40000
libmtd: error!: cannot write 4096 bytes to mtd7 (eraseblock 1, offset 0)
error 5 (Input/output error)
Erasing failed write from 0x040000 to 0x07ffff
libmtd: error!: MEMERASE64 ioctl failed for eraseblock 1 (mtd7)
error 5 (Input/output error)
nandwrite: error!: /dev/mtd/mtd7: MTD Erase failure
error 5 (Input/output error)
nandwrite: error!: Data was only partially written due to error
error 5 (Input/output error)

/sdcard # ./mtdutils/nandwrite -n /dev/mtd/mtd7 hboot.img
./mtdutils/nandwrite -n /dev/mtd/mtd7 hboot.img
Writing data to block 0 at offset 0x0
libmtd: error!: cannot write 4096 bytes to mtd7 (eraseblock 0, offset 0)
error 22 (Invalid argument)
nandwrite: error!: /dev/mtd/mtd7: MTD write failure
error 22 (Invalid argument)
nandwrite: error!: Data was only partially written due to error
error 22 (Invalid argument)
/sdcard # cat hboot.img > /dev/mtd/mtd7
cat hboot.img > /dev/mtd/mtd7
cat: write error: I/O error

I know now there is no OOB data in the hboot.img. If there is, the inject program can't determine the HBOOT version.

flash_erase (V1.4.9) doesn't seem to work either:

/sdcard/mtdutils # ./flash_erase -u /dev/mtd/mtd7 0 0
./flash_erase -u /dev/mtd/mtd7 0 0
Erasing 256 Kibyte @ 0 -- 0 % complete libmtd: error!: MEMUNLOCK ioctl failed for eraseblock 0 (mtd7)
error 95 (Operation not supported)
flash_erase: error!: /dev/mtd/mtd7: MTD unlock failure
error 95 (Operation not supported)
Erasing 256 Kibyte @ 40000 -- 50 % complete libmtd: error!: MEMUNLOCK ioctl failed for eraseblock 1 (mtd7)
error 95 (Operation not supported)
flash_erase: error!: /dev/mtd/mtd7: MTD unlock failure
error 95 (Operation not supported)
Erasing 256 Kibyte @ 40000 -- 100 % complete

-u -N gives the same errors.