yashsingh1/xdaforums huggingface dataset:
[HTC Wildfire S] ONeill123:
Hmm, good idea. But which app can write into system folder?

And we need someone how can write an update for this app.

But idk if it is possible :(
[HTC Wildfire S] Lt.Win:
Don't we need full root to get system access? Also, writing an app such as this is possible, but of no use till we have full root. If there's a way in which we can get access via s-on, our job's done.
[HTC Wildfire S] :
More conclusions please!

*Just trying to get this thread back on the list*
[HTC Wildfire S] island3r:
The gfree method won't work. The WFS is not an emmc device. Unfortunately.
[HTC Wildfire S] SebastianFM:
If HTC Aria has the same flash as WS?
[HTC Wildfire S] logout20:
This is grewcloud's post from apk.tw....

Note that the A510E and A515C on the contents of S-OFF is not the same but the theory is a method you can share some of the phone will replace the SD card to pick from to do Gold jumping to DIAG Gold production failed to produce replacement SD card

First, do the first Gold

1, see Gold Production Gold production of concrete steps

2, his experience points to note!

a, es recommended browser to view cid;

b, the TF card Gold should do is to look at CID code on the phone when plugged into that card, tf card replacement will lead to different cid, remember!

c, cid from machine code to see the house through the post in the address transformation;

d, when using HxD open the disk, select remove disk, do not select the drive letter.

Second, the tool will then break the PG76 extract files PG76DIAG.zip, PG76DIAG.nbh copy on Gold....

there is a rar file uploaded..I'm on mobile...

so result is grey cloud succeed to S-OFF A515C models..........

---------- Post added at 02:24 PM ---------- Previous post was at 02:21 PM ----------

one more thing there is a thread in development section of cdma wildfire S-OFF..he uses a soff.bat script...Devs can analyse it...if its works on gsm...
[HTC Wildfire S] island3r:
They are pretty much the same so yes. Also, in general the bootloader says "eMMC boot" if the device is emmc. The WFS does not, so it's regular nand.
[HTC Wildfire S] ONeill123:
The idea with the script.bat:

It dows the same like the tutorial to set s-off for virgin mobile devices. Not specially. Only the diag files nbh and zip.
[HTC Wildfire S] SebastianFM:
I have WS and I know that it has regular flash, not emmc. I'm asking about Aria because Revolutionary tool can s-off it. Which exploit or any other method the Revolutionary team use to break Aria security?
[HTC Wildfire S] island3r:
Unfortunately I don't know what exploit they use now for MTD devices. But as a general rule of thumb it goes like this:

1)Figure out the partition scheme (possibly with fdisk)

2)Flash a custom misc.img to the misc partition (this partition contains info about the hboot version. If what you try to flash is lower than that number it won't flash)

3)Flash the eng hboot

... and the rest is easy.
[HTC Wildfire S] no.human.being:
Do you know, why they flash an ENG HBOOT? (I know they do, I just don't understand exactly why.) Won't setting security flag to S-OFF inside the radio suffice for turning the device S-OFF and enable you to flash a custom recovery through regular (non-ENG) HBOOT?

I imagined setting a "flag" value would suffice for S-OFF. Flashing an entirely new bootloader could turn out to be much more difficult.
[HTC Wildfire S] island3r:
Because It's impossible to change something in the radio firmware without breaking the md5sums. Even normal radio updates are kinda risky. Also if you screw the radio then you will have a total brick on your hands.

PS, if anyone is interested the version of both the DIAG (eng-hboot) files floating around here is 0.78.2000. Anyone with the same stock hboot version here?
[HTC Wildfire S] no.human.being:
And which component will check the radio md5s? Which component will "complain"? You could change the values againt which it is compared too. They will also be located in the NAND.
[HTC Wildfire S] island3r:
I am not sure about that, and you can't test something like that either. If the radio flash fails, then it fails and the device is bricked. But if the Alpharev guys couldn't do it then I'd say it's pretty much impossible.
[HTC Wildfire S] no.human.being:
The only way to really "brick" a device is to wear out the embedded NAND completely. NAND memory has limited write cycles per cell, probably around 10,000. When you write to it more often, the cells will "wear out" and cease to hold their state so the memory is really "dead" at some point and you can throw your phone into the trashcan.

Apart from this, the content of the NAND inside the controller can be saved and imaged back using JTAG. JTAG is a hardware feature, so you can write to the NAND via JTAG even when the firmware is completely messed up.

The reason is as follows: You can expect the MSM7227's NAND to be completely empty when the chip comes out of Qualcomm's fab. So there is no "firmware" method (bootloader, etc.) to get an operating system to the controller and there won't be a "radio" on it either. But obviously, HTC can program these chips. So there must be a method of programming them "in hardware" and this is the controller's JTAG interface. So if HTC can do it, then we can do it as well, provided we have the tools. What you need for this is a JTAG interface for ARM. If you followed my thread, you'd know that I'm planning to use JTAG to develop the exploit anyway.

So I'd create a complete image from the ROM of an operable phone via JTAG and if you mess up the radio/bootloader/everything, you can always flash it back over JTAG and have your entire phone restored to its previous state. I know of no method to brick a phone so that it's not recoverable over JTAG, apart from wearing the NAND cells out with excessive writing.
[HTC Wildfire S] ONeill123:
If u find a way to program an exploit...then we can use it without JTAG, right?
[HTC Wildfire S] no.human.being:
Exploits work by software and are run on the phone or on a computer connected to the phone. ZergRush seems to be a heapspray-like exploit for privilege escalation.

You can directly read/write the registers, RAM and/or NAND using JTAG and as far as I know you can also set traps so that execution stops when the instruction pointer runs over a certain address and you can perform single-steps and stuff like that.

Think of JTAG like a debugger, just for an embedded controller instead of a software process. I will use JTAG for reverse-engineering how the device security is implemented in firmware and how the stock firmware is laid out in memory, so that it becomes easier to develop an exploit for it.
[HTC Wildfire S] island3r:
Yes I meant the phone will be bricked for anyone WITHOUT a JTAG. Which is pretty much anyone.

For instance, when you get a brick during a "bad" RUU flash, and send the phone to HTC for repair, they don't bother jtagging your nand. They just replace the whole motherboard.

Out of curiosity, is the WFS your first HTC device?
[HTC Wildfire S] d33ps1x:
Holy signature...Are you from Vegas and a used car salesman?

That is...Flashy... :rolleyes:
[HTC Wildfire S] no.human.being:
It depends on how much you're into this. A JTAG interface for ARM costs about 50 €. I just bought my own so I won't depend on getting access at university anymore. The adapter for the proprietary JTAG connector on the HTC board is probably around 15 €. Didn't get a hold on that one yet, still discussing the shipment details with the distributor. You see the equipment is not exactly cheap, but probably worth it, considering the XTC clip is in for around 45 € too and JTAG is a "universal programming" interface, not just an "unlocking" device. So if you're a developer, don't bother investing some money into this.

Yes, that's because they'd have to perform diagnosis, etc. and the hardware is so cheap in large quantities, that they won't consider paying the time for an engineer to diagnose and fix the problem, they just replace the entire board. The hardware costs just "nothing" to them.

In fact it is my first smartphone. I had an Ericsson K800i before, which did a good job for what it was. However, I wanted to get internet access anywhere, so I bought the Wildfire S, which wasn't exactly high-end, but had quite reasonable hardware back then.

When I bought the phone, I didn't know I was going to do operating system development on the device, so I didn't care much about all the rooting stuff and S-ON/S-OFF at that time. After some time, I found out about CyanogenMod. This is where my quest for S-OFF began.

In the long run, I see the phone getting replaced by some higher end model, possibly a Galaxy S2/S3, as hardware made progress, especially concerning the displays, with resolution gone up by a factor of about 2.5 and LCD progressively being replaced by AMOLED over the course of a bit more than the last half year. The Galaxy series can be unlocked via a tool called Heimdall. I think it's not really "rooting", as it does not perform an exploit, but a method which is officially embedded into the device firmware, but usually not disclosed to the end user.
[HTC Wildfire S] arkatis:
Just sold my wifes Wildfire s and my Desire HD and we got ourselves 2 HD2's TMobile version!

Back to the old days i guess! I am a flashaholic! ;) :D
[HTC Wildfire S] :
So, you..you.youu dit...ch.edd us?? :eek: :confused: :(
[HTC Wildfire S] no.human.being:
I'll probably stay clear of HTC after this device. Almost any phone seems to be easier to root than the HTC devices. Samsung is technically on the cutting edge at the moment with their Exynos processors and AMOLED+ displays. The HD2 is more expensive than the GS2, yet the GS2 has a tad more to offer in almost any area and a lot more to offer in the display area (PVA-TFT, also called SLCD, just can't compare to AMOLED). With the HD2, you just pay for the license for Windows Mobile OS, that you're not going to use anyways. :-)

I expect prices for the GS2 to drop to about 300 € during the first quarter of 2012 as the GS3 is expected for February. I'll get myself a GS2 when they drop to that mark.
[HTC Wildfire S] ONeill123:
I hope that anyone find a way to set s-off!
[HTC Wildfire S] elol:
Hey all,anyone have try flash a rom"ruu" cdma to get s off and again flash radio use recovery when get s off,, edit::sory for bad english and this a only idea that i have....
[HTC Wildfire S] ONeill123:
this idea we had too. But the RUU says, that not correct phone connected or the RUU isn't the false for this phone.
[HTC Wildfire S] m1ndh4x8r:
Im content with WS if only it was more slim then its perfect. I'm not craving for any phone right now. I'm sober from flashing. I just like to customize its looks.
[HTC Wildfire S] *se-nsei.:
That's what I said a few months ago. Now I'm desperate to slap CM7 on without an XTC.
[HTC Wildfire S] Aef 101:
I don't think some of you are as desperate to get permanent s-off as you all make out.

An Xtc clip costs approximately £30 (equivalent to 5 packets of cigarettes or a couple of dvd's), buy a clip, achieve s-off, sell clip on eBay - simple :)

It's not rocket science, and it will help you to free up memory etc.

Let's be honest, no clip means no permanent s-off, if it could be done on GSM it would have happened by now.

The marvel is a great phone once it's been rooted etc.

Sent via Tapatalk
[HTC Wildfire S] no.human.being:
It can be done on the Desire S GSM. The Desire S is EXTREMELY similar to the Wildfire S in both hardware and firmware. It was released on the same day. It's just a slightly lower spec CPU, less memory, lower resolution and smaller display and obviously different Android build so probably slightly different in-memory layout of certain things. Only the last could possibly make a difference concerning S-OFF, the others certainly won't.

So it's not that it cannot be done, it's just that the Revolutionary devs are not willing to take a look at it, as the number of Wildfire S devices out there is probably way smaller than the number of Desire S devices out there so they think it's not worth the effort. I'd love to port their software over to the Wildfire S, but they seem to be quite self-opinionated people, so they do not disclose the source code of their work to other Android hackers like us.

If we had the Revolutionary source and enough devs interested in this, we'd get S-OFF on Wildfire S within a week or two. I'm very certain about that. There is no "extra security" present in the Wildfire S that wasn't there in the Desire S so missing developer support is the only logical reason for the lack of an S-OFF for the Wildfire S.
[HTC Wildfire S] ONeill123:
Have anyone ask revolutionary team, that we get source code and if we get s-off and publish software in revolutionarys name?
[HTC Wildfire S] no.human.being:
I have not, since they explicitely state on their website, that they're unwilling to disclose their exploit. Remember Revolutionary is still considered "beta" and you have to obtain a key for each unlock. They probably shut down the "beta" key generation one day and turn it into a "pay-for-unlock" thing. What they're doing wouldn't make any sense otherwise. So I doubt they will disclose anything.
[HTC Wildfire S] island3r:
If that was the case, then s-off would be easy. They are not as similar as you make them out to be. The most important difference in this case is the type of memory they use. Desire S is emmc, wildfire S is standard nand. If the WFS was emmc as well then it would have been s-offed already using the gfree method. However it's not and no one knows what kind of exploit revolutionary uses when it comes to standard nand memory.
[HTC Wildfire S] no.human.being:
Thanks for the hint. I must admit I didn't look that deep. I expect the eMMC to be off-die (inside a separate package on the phone's board). Do you know whether the NAND of the WFS is embedded inside the MSM7227 or whether it is off-die? Same for RAM, is it on-board or on-die?

Thank you very much. This might be an important difference.

EDIT: Both, NAND and RAM seem to be off-die. Could someone confirm?
[HTC Wildfire S] :
The XTC-Clip was made in an effort to S-OFF HTC Devices, and they succeeded. This means it can be done. It's just that we're missing something out. For example, although I'm not smart like you guys and half the time I have no idea what's going on, I do know that official ROMS work perfectly. This is probably because they have an decryption key, or a certificate.

We could look into a Stock ROM in depth, and find out how it does it's job properly.

We could modify a RUU to put the phone in the state where ROMS can be flashed.

The developer Olipro (the guy who made Hard-SPL) made CustomRUU, which works by being a normal RUU, although you use your own .nbh. (I have a Hermes and I did some stuff round there).

I know that when Stock ROMS work their magic they run the "fastboot RebootRUU" command, therefore causing the phone to enter a state where the silver metalish HTC logo is displayed in a black background, also letting ROMS be flashed. We could look into this state and see how it works. Maybe we could use a USB Monitor program.

Hope this helps!
[HTC Wildfire S] bonesy:
Has anyone tried the HTC super tool? Wildfire S is supported and option 4 is s-off
[HTC Wildfire S] SavageButcher:
just tried.

Option 4 is just a gate to htcdev.com, so it's useless.

The tool, however, should be capable of rooting the phone even if its bootloader is not unlocked.

Sadly option 2 (the root attempt) fails. I just writed a post in the htc super tool thread giving my results, let's see what the dev says about it!
[HTC Wildfire S] island3r:
Of course it fails, the script tries to push files to /system. You can't do that without s-off sadly.
[HTC Wildfire S] ONeill123:
The supertool (option 3) is using gfree, and gfree require eMMC-memory, but the wfs has the nand-memory and will not funct.

The output is like this:
[HTC Wildfire S] SavageButcher:
i wonder why our WFS is in the compatibily list. When i first read that this morning, i almost had a stroke.

i hope they'll answer me.
[HTC Wildfire S] logout20:
Internal testing is closed for Wildfire S. Didn't go very well, due to chipset bugs (MSM7227 = old). Therefore unsupported for the time being........they closed the support for wildfire S because of old chipset.....

Thread Link ...

http://xdaforums.com/showthread.php?t=1141225

User "IEFTM" seems to be a member of alpharevx....

http://xdaforums.com/member.php?u=939673

---------- Post added at 04:22 AM ---------- Previous post was at 04:08 AM ----------

here a thread about bootloader hacking..

http://xdaforums.com/showthread.php?t=1209288
[HTC Wildfire S] island3r:
Ok, anyone interested in maintaining a freenode channel?

EDIT: I could do it as well if there are no takers.
[HTC Wildfire S] no.human.being:
Yep, I knew about that one. That's why I said I'd love to port their exploit over to the MSM7227. Shouldn't be too much of a difference though. MSM7227 is basically an ARM11 36EJS, which is ARMv6 instruction set and that's basically all you have to care about. As long as you're not deeply involved with driver programming etc., you usually don't have to code specifically for MSM7227, you just have to code for ARMv6.

It's like you don't have to code for AMD Opteron or for Intel Core i, you just build for x86-64. I would not expect the exact processor model (microarchitecture) to matter that much, as long as they make use of the same macroarchitecture (instruction set, etc.). Could be different in this case though, because we're on embedded here and embedded systems are quite different from "normal" computers in certain areas. This is actually, where all the problems emerge. I'm not the worst at writing exploits, however, I am an absolute greenhorn when it comes to embedded systems. When I hear about how you cannot use exploits from the DS on the WFS, because they use different memory technology, I go like: "What the heck who cares? They are both block devices!" I don't understand how the physical memory structure will make a difference. To me, they are both just a thing holding a sequence of bytes and the software side should not see below that threshold of abstraction.

It's like saying you can't perform a certain exploit on a server because it uses an SSD instead of a HDD. No one would expect something like this to be the case on a "standard" (non-embedded) computer system (as long as you're not doing computer forensics), yet when we move into the embedded realm, memory technology seems to start making a difference and that's a thing I don't quite grasp yet. We escalate privileges, locate the security flag and write to the memory. Why would it matter, how that memory is actually implemented? S-ON/S-OFF is not the "hardware NAND protection" that certain embedded processors feature. If it was "hardware NAND protection", over-the-air updates would not be possible. So in my opinion we just have to get such "raw" access on the memory, that S-ON/S-OFF checks don't matter anymore. Maybe someone could explain this to me, but I might just need to invest more time to get basic embedded stuff done before cranking the exploits on this one.

It would be great if we could get at least one embedded expert involved, who knows how to port the exploits to embedded code. I'm actually very stuck at the moment, but I will start digging deeper into the datasheets when I have more time.
[HTC Wildfire S] No.12:
Maybe you should contact alpharevx personally.
[HTC Wildfire S] Lt.Win:
A few have tried, but they never replied it seems. :-(
[HTC Wildfire S] *se-nsei.:
Updated the campaign thread to help out ;)
[HTC Wildfire S] no.human.being:
Thank you very much. I really hope we get someone with embedded skills involved, so that we can do the heavy lifting together or at least get some more insight into the "lower level" layers of this topic.
[HTC Wildfire S] breaky9973:
I just checked for htc android phones which have hardware quite similar to the WFS.

It is a short list:

HTC Legend - Rooted (which involves downgrading to Android 2.1)

HTC Aria - Rooted by the Unrevoked tool, reported to have eMMC memory instead of NAND like WFS.

HTC Salsa - Same problem like WFS, only S-OFF with XTC Clip.

I see a few options here:

1. Work together with people who have HTC Salsa (Assuming hardware is really similar to WFS) on obtaining S-OFF without XTC Clip

2. Find out if there would be such an option as downgrading Android to 2.1 and from there enabling root on WFS.

3. Find why HTC Aria is so easy to root. Is it really the difference in memory? After all eMMC is just NAND + MMC Controller in one package.

Just posting my thoughts here...hope I can help a bit
[HTC Wildfire S] Lt.Win:
Thanks for the list there. Working together with the Salsa devs should give us a better idea of the case. Downgrading to 2.1 or even 2.2 won't be possible as far as I know. This phone is shipped with 2.3 so downgrading is impossible AFAIK.
[HTC Wildfire S] rememe:
So I dont understand it, if I have hboot 0.90 (no virgin) so what I must do to S-off my WFS wihnt XTC clip?
[HTC Wildfire S] :
Nothing!

This thread is mainly here to figure out how the XTC-Clip works and how we can unlock our bootloaders without it, no matter what HBOOT you've got.

Until then, we just have to wait, or we can help and speed things up a little. That's what I'm doing.
[HTC Wildfire S] rememe:
So hboot 0.90 can be unlock only with XTC clip yea? and hboot 1.03 can be unlock with virgin metod?
[HTC Wildfire S] :
Almost.

Only the CDMA and Virgin WFSs can be S-OFFed without XTC-Clip.

All other versions are in the mud.
[HTC Wildfire S] Lt.Win:
It's got nothing to do with the hboot. It depends if ur phone is cdma or not. If ur phone is cdma, software s-off is available for you. If you are gsm, wait for devs.
[HTC Wildfire S] :
What he said!
[HTC Wildfire S] bradsinram:
Duh the xtc clip just clears all security flags on the radio completely lol that's why you can't unroot afterwards
[HTC Wildfire S] bilool:
Hi !

Anyone tested HTC Super Tool V2 ? They listed the HTC Wildfire S in the working devices list : http://xdaforums.com/showthread.php?t=1343114

I don't know if it's just working with CDMA version or with the other too.
[HTC Wildfire S] *se-nsei.:
Doesn't work.
[HTC Wildfire S] bilool:
Ok thanks for the answer, so I'll buy a XTC Clip...
[HTC Wildfire S] Lt.Win:
Basically our problem is:

Signed boot and recovery partition,

Only TempRoot.
[HTC Wildfire S] ONeill123:
But how the revolutionary team did his unlock?

Maybe in the eng hboot is generally an "bug" where you can set s-off very fast.

I don't understand why they don't help us ;(