yashsingh1/xdaforums huggingface dataset:
[HTC Wildfire S] island3r:
@no.human.being

http://xdaforums.com/showthread.php?t=1168521

We can safely assume that the sensation layout is the same with the desire s. Needless to say, both are way different than the WFS.

The most important partition in that case was p3. They compared it between s-on and s-off devices, and found the difference. We should look for something similar.
[HTC Wildfire S] XDA_h3n:
I actually think It's zergrush, over my past experience. I had a HTC DHD (Which I still do.) I had updated my DHD, then noticed the Rom I was using, isn't s-off supported. I downgraded with zurgrush and got random errors with the CID. Untill I used the revolutionary temp-root, after temproot I had RW and had no CID errors somehow.

Do we have a different temproot?
[HTC Wildfire S] *se-nsei.:
HTCdev announced that changes to the site will appear (or come into effect) in the coming weeks for all 2011 models prior to September, so I would advise that people should try and test it every week for a few weeks or so with different HBOOT versions in case. :)

Also, just spotted this on twitter.

However, all development should still go ahead, they've let us down before and they'd do it again. :)
[HTC Wildfire S] ONeill123:
But this isn't the same like s-off, or? So plz search for an software solution to get full s-off plz.
[HTC Wildfire S] no.human.being:
<sry, double post>
[HTC Wildfire S] Antagonist42:
Nope .... tried this before and it's fastboot reboot-bootloader unless adb is stripped down {has a quick check :confused:} hmmm that's removed... Aaaaah now I remember, adb cannot pick up my device etc so executing the adb reboot bootloader/recovery has no effect - it see's no device - fastboot will and using keypress will bring bootloader or recovery (with this Xakep ROM has specific device TWRP installed) up, the following is what I get...

Android Fastboot Mode 01

Button Sequence

Volume Up+Down +Power Button = Fastboot

Modem download mode

MID:	C6_4GMI2

Android Fastboot Mode 02

**	PowerButton + V+/- depress vol-/press/depress =Fastboot

USB FastBoot:	V0.5

Build Date:	Jan 4 2012, 17:39:09

HW ID:	PVT2

MID:	C6_4GMI2

Fastboot

Auto update

from SDCard

Hold power + vol+ +vol-

on led lighting

depress vol+/press/depress

Phone goes into auto update/download

MID:	C6_4GMI2

Validate images

*******************************

*******************************

Undefined state(32): Image not found - Partition Table

Download fail...

Didn't have an image on the SDCard ;)

Other than that there is nothing indicating it is S-ON/OFF (Original recovery only gave options to Reboot or Flash and was V0.3 I think), without further info from ACER about the state of the HTC Licensed M.Board it's a bit of a bummer :mad: (found that ACER using an ODM not OEM as this phone M.Board is ChaCha) as for the Radio as far as I can tell it was updated from initial release (not 100% sure) although the supposed Radio I don't think has actually changed only the version number it reports as I locked phone up with differing values between system and radio :laugh:
[HTC Wildfire S] munjeni:
Guys, if here is some one who want to test revolutionary "method" on his device I will patch an hboot and will modify revolutionary exploit for you, but first I must to say I will not be responsible if you brick your device!!! Found everything analysed and I can modify it for wfs but I not guarante if your device will not be bricked!!! Let me know if you are ready to test!!! If yes, please reply to me with hboot in attachmend (must be the same version as version runing in phone!!! No want htcdev hboot!!!) and need dump of the misc partition in attachment allso! Please do not upload here, please upload to an sharing server and send me a link for download!
[HTC Wildfire S] davidang:
cool,but i dont dare to risk my Wildfire S
[HTC Wildfire S] munjeni:
Ok no problem, you are not ready, but I am here to do it for you! Need testers!
[HTC Wildfire S] csoulr666:
Well most of the people have an unlocked bootloader and hence an HTC-dev HBOOT..........i would have volunteered but I'm on 1.09.099(Or something close to that :) )
[HTC Wildfire S] munjeni:
Did you have write access to misc patition trought recovery erase_image and flash_image ?? And which versions of the hboots wfs have (its allready ansfered to me but I searched forums without luck finding that post). You can install every oldest hboot over htcdev hboot if you have write access to misc partition
[HTC Wildfire S] no.human.being:
Exploit for old (pre-HTCdev) HBOOT (I suspect you mean 0.90.0000) is more or less useless unless there is a way to downgrade to the exploitable HBOOT version without S-OFF. But tell me if you know how to patch 0.90.0000, why couldn't you patch the newer ones? The newer ones have a lot more features, which means lots and lots of attack vectors.

I'm sure that the "chainloader" exploit is almost what we need and it'll probably work for all HBOOTs that have Fastboot support, but I do not have a way to debug on the device (no working JTAG) and so I cannot verify where it's loaded and where HBOOT jumps after loading the exploit code. Vary its kernel base address, the length of the "padding" before and the address from where it starts copying and I'm quite sure there'll be a configuration where it works. But I don't know how to find this "sweet spot" without JTAG access and pure guessing seems hopeless. You have JTAG access on your device. If I were to send you a "kernel image", could you try trapping at 0x12c80000 and 0x12c80800 (better trap both since I'm not sure where it's loaded), then tell me where execution starts and single-step through the loop (it's only one iteration at the moment) to see if the memory write works and if it jumps to physical zero?
[HTC Wildfire S] csoulr666:
You mean downgrading the misc partition and thus downgrading the HBOOT right????Havent had much luck yet......i wanted to revert back to HBOOT version 0.90.0000,downgraded everything except the HBOOT
[HTC Wildfire S] no.human.being:
Known HBOOT versions for WFS are: 0.90.0000, 1.03.0000, 1.04.0000, 1.08.0099, 1.09.0000, 1.09.0099, 1.10.0000

I think that 1.04.0000 and 1.09.0000 are for CDMA variants only though (1.04.0000 = marvelct, 1.09.0000 = marvelc) and these can be S-OFFed via DIAG.
[HTC Wildfire S] munjeni:
I managed! Procedure if htcdev hboot is installed:

- fastboot oem lock (after that your hboot will be relocked and you will see "***RELOCKED*** at top of the hboot screen)

- reboot to recovery

- adb shell dd if=/dev/mtd/mtd0 of=/mtd0 bs=131072

- adb pull /mtd0 mtd0.img

- hex edit mtd0.img (you need to change version string to 1.11.111.1)

- adb push mtd0.img /

- adb shell

- erase_image misc

- flash_image misc /mtd0.img

- create gold sd card and copy paste rom to it and rename it to (not know which name is for wfs but on htc aria its LIBEIMG.zip)

- reboot phone to hboot and you will see that installation asking you to install that rom... confirm by power button and everything is installed like hboot, radio ...etc

I don't know why revolutionary team used hboot 1.02 for aria but I think maybe older one is not exploitable? About jtag debuging, I sayed before that I am unable to debug my phone because I have no working "halt" because I have unknown position on motherboard for vref so I tricked vref by puting pin to battery + ! Only have posibility for flashing and dumping but no for debuging! About hboot, what is new features in new bootloaders for example what is in htcdev hboot and not in hboot 1.09.0000 ?
[HTC Wildfire S] csoulr666:
Thanks will try this tomorrow..........and the name of the package for the WFS is PG76IMG.zip

A small question.....if i want to go back to say HBOOT 0.90.0000.....then i think 1.11.111.1 might not work
[HTC Wildfire S] no.human.being:
Beware that HBOOT contains the partition tables and there are different partitioning schemes for the phone. Flashing a "foreign" HBOOT can mess that up.
[HTC Wildfire S] munjeni:
I can patch 1.03, what you think? I think newer hboots have bypassed revolutionary method, so I think better is an oldest! If you manage to install an s-off hboot than you will be able to install whatever you want! Is not?
[HTC Wildfire S] no.human.being:
Well of course. You will have to patch the HBOOTs you install though. If you install a "stock" HBOOT image on a Revolutionary S-OFF handset I think you're gonna lose S-OFF.
[HTC Wildfire S] munjeni:
Thats problem! I know you have 2 diferent wfs models but whats happen when you install complete ruu for example over an installed ruu which have diferent nand layout? Brick?
[HTC Wildfire S] csoulr666:
We'll flash the ENG HBOOT then :)
[HTC Wildfire S] munjeni:
Yes!
[HTC Wildfire S] csoulr666:
The WFS models are different by the fact that one of them is a GSM one while the other is the CDMA one......even if the nand layout were same....we would brick our phone's due to the incredibly different radios
[HTC Wildfire S] munjeni:
You can change to 0.89 :)
[HTC Wildfire S] no.human.being:
I don't know. I think there is a protection measure that prevents you from doing this. Theoretically it would be possible if they "chainloaded" a bootloader with the "new" layout to RAM, then overwrite EVERY partition. After they overwrite everything it should fit together again. But I doubt that they can really do this. Especially since "userdata" is moved and you would thus lose your data by installing such an RUU. I've never heard of an RUU that clears your data.

What's interesting though is that the size of "userdata" is the same in all layouts, so they might back up "userdata" (to host or SD card or whatever), then change the partitioning, then overwrite all partitions with "new" images from the RUU, then restore "userdata". But I don't think they are clever enough to do so, so it's probably forbidden to flash an RUU that does not have the same layout.

Is ENG HBOOT for WFS leaked?

Not true. I have a GSM WFS and theq86 (another xda member) also has a GSM WFS and we have completely different NAND layout.

See here. The bottommost table is "my" NAND layout. The topmost table is "his" NAND layout. You see his "recovery" partition goes from 0x026c0000 to 0x02bbffff physical, while my Radio goes from 0x00000000 to 0x02fbffff physical. So if I were to put his "recovery" partition onto my phone to the same physical addresses where it was on his phone, it would be entirely contained in my Radio. Same goes for his "boot" partition, which goes from 0x02bc0000 to 0x02efffff physical. Still all Radio at my phone. The layout is completely different. Not even one partition matches. Still, we both have GSM phones.
[HTC Wildfire S] munjeni:
Is PG76IMG.zip for booth versions of the phone ?? I think diferent ruu is installable for booth devices if PG76IMG.zip name is for booth devices!!! Do you have a link for 1.03 ?
[HTC Wildfire S] no.human.being:
I don't know how this works. I also don't know if HTC could make an RUU that could change "my" layout into "his" or vice versa. No idea. But the file that HBOOT looks for on the SD card when booting is called "PG76IMG.zip" for both phones, yes.

No, haven't even seen it yet. I went from 0.90.0000 straight to 1.08.0099 and seem to be stuck there. I cannot update to 1.09.0099. The RUU refuses to install. I'd probably have to flash a "complete" RUU that restores everything, not just installs a new HBOOT. Don't want to do that though.

The 1.08.0099 and 1.09.0099 RUUs are the only ones I've seen that "just" update HBOOT. Don't know how you could get e. g. to 1.09.0000 HBOOT. Probably only by "complete" RUU.
[HTC Wildfire S] munjeni:
Ok, but is mark of the phones the sime or you have diferent model name or something (maybe chipset or a label to distinguish two diferent models) ? There must be something that will "diff" two versions of the phone! If all is the same than I think you can install ruu that contain diferent layout? Its amazing that no one had bricked his phone by installed wrong ruu, did you seen that?
[HTC Wildfire S] csoulr666:
An XDA member named meanmug had it i guess......it was meddled with a long time ago but without luck

It could be possible.......i'm not much of an expert in such parts
[HTC Wildfire S] no.human.being:
The board in my phone is called "PG76100" (that's most likely where the name "PG76IMG.nbh" comes from). We've already thought whether we can distinguish the two phones by Radio version, since up to a certain point, all phones with "my" layout we've come across had RADIO-7.53 installed, while all phones with theq86's layout had RADIO-7.54 installed. But then, some exceptions to this rule appeared, so we scrapped the idea that the NAND layout has something to do with the version number of a certain firmware component.

I don't understand how this works though. "My" RADIO-7.53 is obviously way too large to fit into the "new" partitioning, where less space is reserved for the Radio. So it seems that there are different Radio builds with identical version number, which is obviously not so nice for devs. :(
[HTC Wildfire S] munjeni:
I think in an complete ruu there must be an hboot like 1.03... I found 1.08.0000, disasembled it and found function that is called from misc payload in comparation with hboot from aria is diferent so I think we need an older hboot for patching. Hboot lies in an complete ruu not just hboot only update ruu ! Do you have link to 0.90 ?
[HTC Wildfire S] Tera Tike:
Here is hboot 1.03 if you are looking for it.

Here is the PG76DIAG file as well.

Yes, PG76IMG.zip is for both GSM and CDMA version phones.
[HTC Wildfire S] munjeni:
Ok, found 1.03 and from first analyse there allso function called from misc payload difer in comparation with aria hboot:

- aria:

ROM:9D0013EC sub_9D0013EC ; CODE XREF: sub_9D0010E0+48p
ROM:9D0013EC ; sub_9D0010E0:loc_9D001188p ...
ROM:9D0013EC STMFD SP!, {R4,LR}
ROM:9D0013F0 LDR R3, =dword_9D077938
ROM:9D0013F4 LDR R0, [R3]
ROM:9D0013F8 CMP R0, #0
ROM:9D0013FC LDMEQFD SP!, {R4,PC}
ROM:9D001400 BL sub_9D01070C
ROM:9D001404 LDR R3, =dword_9D077938
ROM:9D001408 MOV R2, #0
ROM:9D00140C STR R2, [R3]
ROM:9D001410 STR R2, [R3,#(dword_9D07793C - 0x9D077938)]
ROM:9D001414 LDMFD SP!, {R4,PC}
ROM:9D001414 ; End of function sub_9D0013EC

- wfs 1.03:

ROM:9D0014AC sub_9D0014AC ; CODE XREF: sub_9D001140+48p
ROM:9D0014AC ; sub_9D001140:loc_9D0011E8p ...
ROM:9D0014AC STMFD SP!, {R4,LR}
ROM:9D0014B0 LDR R3, =dword_9D07CA34
ROM:9D0014B4 LDR R0, [R3]
ROM:9D0014B8 CMP R0, #0
ROM:9D0014BC LDMEQFD SP!, {R4,PC}
ROM:9D0014C0 BL sub_9D013704
ROM:9D0014C4 LDR R3, =dword_9D07CA34
ROM:9D0014C8 MOV R2, #0
ROM:9D0014CC STR R2, [R3]
ROM:9D0014D0 STR R2, [R3,#(dword_9D07CA38 - 0x9D07CA34)]
ROM:9D0014D4 STR R2, [R3,#(dword_9D07CA3C - 0x9D07CA34)]
ROM:9D0014D8 LDMFD SP!, {R4,PC}
ROM:9D0014D8 ; End of function sub_9D0014AC
ROM:9D0014D8

Do you have link to 0.90 ?
[HTC Wildfire S] rezo:
It is NOT possible to downgrade to 0.90.0000 hboot those ways!. I have tried all RUUs and always the 0.90.0000 hboot was bypassed. There must be some security added to newer bootloaders.

The lowest number of the bootloader you can downgrade is 1.03.0000

It is in RUU_Marvel_HTC_Europe_1.66.401.1_Radio_47.10g.35.3032H_7.49.36.01M_release_209754_signed.exe.

Guys... Do you know that we can run diag.nbh on our S-ON phones! And changing a value (i don't remember now, maybe 0xC8) at 0x0000C40 in the misc partiotion we can run "Clean S58 data" without reboot? And there is an option to reflash whole NAND in the phone? Check this thread: http://xdaforums.com/showthread.php?t=1540515, make goldcard and run diag.nbh.
[HTC Wildfire S] Tera Tike:
Here is Hboot 0.90.

I am S-OFF but I just down graded my hboot to the 0.90.0000 version...Just to see if it will.
[HTC Wildfire S] munjeni:
Great, but in zip must be cid or something that is used to prevent installing ruu to diferent phone model? Or maybe its the same for booth models?

---------- Post added at 06:35 PM ---------- Previous post was at 06:31 PM ----------

You can see eng hboot inside diag file, its 0.81.2000
[HTC Wildfire S] Tera Tike:
This is the android-info.txt file contents that I just used to flash Hboot 0.90.0000; (GSM Version)

modelid: PG7610000
cidnum: HTC__001
cidnum: HTC__N34
cidnum: HTC__203
cidnum: HTC__102
cidnum: HTC__405
cidnum: HTC__Y13
cidnum: HTC__A07
cidnum: HTC__304
cidnum: HTC__032
cidnum: HTC__J15
cidnum: HTC__016
cidnum: HTC__E11
mainver: 1.33.401.2
hbootpreupdate:13
DelCache: 1

This is the same file but for Marvel_C_S_Sprint_WWE_VM_3.01.652.1-1.02.652.00 (CDMA Version)

modelid: PG7620000
cidnum: SPCS_002
hbootpreupdate:13
cidnum: SPCS_002
mainver: 3.01.652.1
[HTC Wildfire S] munjeni:
You can not do this by ruu, you need gold card to do it + modified misc partition! With gold card your cid is super cid!
[HTC Wildfire S] rezo:
Tera Tike provided a link to the 1.03.0001 hboot. It is for GSM version??

munjeni, download this file: RUU_Marvel_HTC_Europe_1.66.401.1_Radio_47.10g.35.3 032H_7.49.36.01M_release_209754_signed.exe.

This is the complete RUU with the 1.03.0000 GSM bootloader.
[HTC Wildfire S] munjeni:
Analysed hboot 1.03... will try with 0.90

Edit:

Analysed 0.90 and found the same thing:

STR R2, [R3,#(dword_9D079968 - 0x9D079964)]
STR R2, [R3,#(dword_9D07996C - 0x9D079964)]

so its on aria

* R3 = R2;
* (R3 + 4) = R2;

but wfs have

* R3 = R2;
* (R3 + 4) = R2;
* (R3 + 8) = R2;

Will patch 1.03
[HTC Wildfire S] rezo:
No, it is not possible. It will be always bypassed during update.

If it would be possible, we have a signed special radio file which makes our phones S-OFF.

munjeni check http://xdaforums.com/showthread.php?t=1504214
[HTC Wildfire S] csoulr666:
I think it's best that he just downloads the HBOOT alone.........because he just is trying to work with it
[HTC Wildfire S] no.human.being:
Ok the HBOOT in an RUU is a *.nb0, which is a raw image iirc. So there can't be different versions for different phones as far as I can see. This means a "complete" RUU will probably change your partitioning and re-flash everything after the partitioning changed right?
[HTC Wildfire S] Tera Tike:
I have super CID 11111111, due to my XTC-Clip, which I think is built in the Diag file it ran.
[HTC Wildfire S] csoulr666:
I think so....considering the changes in the layout for the 2 GSM WFS's........partitioning is done when we flash an RUU

This mught also be the reason it wipes all data,so that we dont have any unnecssary buggers after an install
[HTC Wildfire S] no.human.being:
That would mean that HTC has to do something similar we are trying, e. g. loading a new bootloader to phone with new layout, then use that one to flash, right? Otherwise the images wouldn't end up in the right places when written to NAND. Remember that an RUU is an "update.zip" containing partition images pushed to HBOOT.
[HTC Wildfire S] rezo:
IMHO, radio.img in the RUUs is just a bunch of instructions for the phone and NOT a real radio image. I removed a battery several times when flashing "the radio partition" and my phone is still alive. The same microp.img... I damaged that partition by removing battery but the phone was still ok. There is something different with this phone... Something like a "double nand". IMHO.
[HTC Wildfire S] munjeni:
Dude its not true! Using gold card its possible to bypass cid check !!! If you want to try I will generate one gold card for you! Your fault in update proces maybe is wrong generated gold card?
[HTC Wildfire S] Tera Tike:
When HTC does there OTA update there is a file called firmware.zip that is written at the end of the system file update.

There are also fotaBoot which is loaded to /data/system/fotaBoot (has in it "fota.load.customization=true") and a file named version.txt ( in it "1.62.531.3 CL98014 release-keys").

Not sure it that's helps...
[HTC Wildfire S] munjeni:
Yes but I not understand why there is 2 diferent models! Its maybe some htc tests or maybe 2 diferent chipsets or I don't know what. Flashing complete ruu mean reflash everything (radio, first stage bootloader, seccond stage bootloader, amss, boot, system...etc). I flashed windows 6.5 complete nand from htc hd mini to htc aria and had working windows under aria that was like native wince device :)

You need to find why wfs have 2 diferent layouts before going to flash an ruu that difer than your partition layout...
[HTC Wildfire S] Tera Tike:
The Radio setup file is rcdata.img

QCT_UMTS_RADIO_VER=1
DisH=1
AGPSNVSetting=1
EnDTM=0
MSCMode=10
HSDPACat=8
GEA3=0
QCT_UMTS_RADIO_END=1

The radio.img is the radio firmware file.

---------- Post added at 01:05 PM ---------- Previous post was at 01:00 PM ----------

From what I can tell there are two different radio chipsets on for GSM(modelid: PG7610000) the other for CDMA(modelid: PG7620000).

Even the Hboot versions are different between them from what I have found.
[HTC Wildfire S] rezo:
DUDE, IT IS NOT. Not in WFS! Read my posts and I say it again: for the 0.90.0000 bootloader, we have a special radio image which makes S-OFF. If downgrading to 0.90.0000 was possible this thread would be closed 6 month ago because everyone would have S-OFF.
[HTC Wildfire S] munjeni:
I found diag file 2 days ago and I sucesfully run diag but I am unable to clean s58 data, it stay on "clear" 5 minutes so I need to remove battery...
[HTC Wildfire S] no.human.being:
But they can't flash the entire Radio. We've had a look at the Radio (in NAND) and it contains stuff like CID, secu_flag, SIM-Lock information, MAC addresses, configuration for output power of several transmitter stages. These values are different for all phones. Especially the "transmitting power" stuff were different on EVERY device we had a look at. I suspect that they measure how much power each transmitter puts out and then raise the voltages until the FCC limits are exceeded, then go down a notch and write that value. I think that they do this procedure individually for each device. Of course it'll be an automated procedure, but it means that every Radio image is unique.

Yes, but me (no.human.being) and another xda-member called theq86 both have GSM PG7610000 phones. Still we have entirely different NAND memory layout.
[HTC Wildfire S] munjeni:
Ok, but please give me direct link to an post that contain unsucesfull attempt for hboot 0.90 instalation...

Edit:

ok you are right... found now after hboot 1.03 analyse:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00072D30 30 00 00 00 30 2E 30 39 00 00 00 00 31 2E 30 30 0...0.09....1.00

0.09 - 1.00 mean versions from 0.09 to 1.00 is not suported ! Version 0.90 will be installable only by changing version string and installing trought an allready hacked hboot....
[HTC Wildfire S] rezo:
Uff, excatly :)
[HTC Wildfire S] munjeni:
Model id is the same ? So that mean for sure htc tried something for tests only, so you can flash complete ruu with diferent nand layout
[HTC Wildfire S] Tera Tike:
Just from my own experimentation(I am NO expert) I have flashed Asia, Europe, and T-Mobile, RUU radio.img's on my devices alone without issue. I also have found the the rcdata.img is different for T-Mobile and other regions as well. Currently I am using the Europe rcdata.img and T-Mobile lastest radio.img, it seems to give better signal and battery life for me.

True, and I agree, even playing with different RUU's they seem to change in various ways.
[HTC Wildfire S] munjeni:
Did you had diferent nand layouts on your phone ?
[HTC Wildfire S] rezo:
IMHO, WFS has an internal support for the DIAG mode. Go to the misc partition and change 00 to C8 in 0x0000C40. It enables the DIAG support and USB in the same time

Then the DIAG mode operates in different way. Ex: my screen after pushing "Clear S58 data":

PS.. Look at the diode. It's flashing infrared. Search for the reciever or not? :))))