yashsingh1/xdaforums huggingface dataset:
[HTC Wildfire S] no.human.being:
But there's a problem with it. Some part of Iguana (probably the OEMSBL) loads the APSBL from NAND to aARM 0x00000000 physical, then aARM runs from this page. The important thing is, aARM never reads the APSBL from NAND. Instead, mARM reads the APSBL from NAND and writes it into aARMs RAM. Only after that is finished, aARM is released from halt and begins executing from 0x00000000 physical.

Then we do "fastboot boot chain_109.img". Chainloader + payload (patched HBOOT) get loaded to 0x12c08000 physical. Chainloader moves payload to 0x00000000 physical, then puts aARM into a mode as if it was coming from a reset (cache and MMU disabled, instruction pointer reset to zero). Then payload executes from physical zero.

Now what happens when the payload resets aARM? Well, there are two possibilities. Either the reset clears registers and RAM, then aARM will run from physical 0x00000000, where there is just zeroes. This is probably not what happens. Other possibility is that reset clears registers, but preserves RAM, then aARM will run from physical 0x00000000, where there is the chainloaded (S-OFF) HBOOT. This is also not what happens, since we see HBOOT "reverting" to S-ON.

So there are three possibilities left what happens. HBOOT either restores itself from NAND, then jumps into it (what I find likely) or it calls Iguana and causes it to go through OEMSBL again so that a clean HBOOT is loaded into aARM (which I find unlikely, since Iguana can probably not "lock" aARM again once it is "released") or it calls Iguana which then does a full reset so that mARM starts executing PBL from on-chip ROM again (I think this is also possible).

HBOOT on its own can't reboot, as it's designed to be loaded by OEMSBL. So either it doesn't do a full reboot, or it does it in a way that causes mARM to go through OEMSBL again.
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Just wanna know. Are you guys still thinking about UBOOT?

Yeah, I still remember what was happening before I was robbed.

Sent from somewhere too far away from my computer. Axis_Drummer calls me Wolfy. Jessica said I need to behave...
[HTC Wildfire S] artturnip:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Can I help with any testing? I'd ideally not like to brick my phone, seeing as it's my only phone but..
[HTC Wildfire S] BeciMester:
Sure, join the fun. PM on the way, instructions above. :D

The risk at this stage is pretty low, nothing crucial can be messed up if I'm not mistaken.
[HTC Wildfire S] BeciMester:
In the light of my recent experiments, I'm afraid you may be right on that. First I thought it just does a full reboot, because the "revert" looks and behaves the same way as "reboot". By "reboot" here I mean selecting "reboot" from the fastboot menu on the phone. "Reboot" has no equivalent fastboot command, the only thing that's similar is "fastboot oem reboot-bootloader" but that behaves differently: it doesn't blank the screen when resetting, but "reboot" does, so I assumed that is what's happening.

However, last night I redirected the "reboot" routine to display an error message on the phone screen and enter an infinite loop. Then I chainloaded and let it find the "splash1" zip file on the card as above, but pressed Vol Down for "No flash" -- then it says "Press Power to reboot phone" as it's supposed to.

--- From there 2 things can happen:

1) if I don't do anything, the "revert" happens after a few seconds, as usual;

2) if I press Power, I get my "hijacked" error message as above --- for about a second, then the "revert" still happens!

So all in all, "revert" != "reboot". :(

This makes me think the "revert" might have nothing to do with hboot at all. But I still remember you saying that if the chainloaded "payload" is just an infinite loop, the "revert" never happens -- so the hboot must trigger it somehow after all, which means there's hope.

And I didn't even touch on the 10 vibrations yet. Some googling reveals that it's obviously some kind of error message, but nobody knows what it means. Common variants are the 3 vibrations and the 7 vibrations, many people encountered these. I'd kill to learn how to turn on the vibration motor with assembly code, and/or how the hboot does it.

BTW: Lt.Win, artturnip -- have you guys managed to do any testing? I'm dying to know what's happening at your end! :confused:
[HTC Wildfire S] Sachin Thomas:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Can you explain how you managed to locate and access the framebuffer?
[HTC Wildfire S] BeciMester:
I started by finding a string that I can see on the phone screen, and looking at how it is referenced/what is done with it. I can give more specific info about your phone in the Explorer dev thread if you want me to.

On the WFS the framebuffer starts at 0x60314000 (upper left corner), with 2 bytes per pixel, the length is 320 x 480 x 2 = 307200, or 0x4b000. The first 320 x 2 = 640 (0x280) bytes form the first horizontal line of pixels (0x60314000 - 0x6031427f), the second line is from 0x60314280 - 0x603144ff, and so on. The 2 bytes per pixel allow for 2^16 = 65536 colours, where 0x0000 is black and 0xffff is white. The whole area is directly writable by the hboot, no restrictions or special tricks, so if you manage to stick your own code in there you can do anything, but it's much easier to just use the routines already built in.

Immediately after this area there's a second framebuffer (starting from 0x6035f000), which is displayed when you switch to RUU mode, and contains the silver/white HTC logo on a black background.

I used pof's excellent conversion tool to convert between .bmp and .nb (the format of splash images and the way the screen is stored).
[HTC Wildfire S] no.human.being:
The problem with UBOOT is that it's not designed to run from RAM. It's designed to execute from an on-chip EEPROM. The developers of UBOOT say that modifying UBOOT so that it runs from RAM is about as much effort as writing a bootloader from scratch and explicitely recommend against this undertaking.

That's cool to know, thanks.
[HTC Wildfire S] artturnip:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

@BeciMester will do tomorrow when I get home from school :P
[HTC Wildfire S] Lt.Win:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Sorry for the delay. Haven't got any time for testing :( My class suddenly got in exams, so I've been studying only.

But I have some free time today, I'll let you know. I'm dying to know myself lol.
[HTC Wildfire S] Lt.Win:
Fail... Sort of.

Yup, failed.. :|

What exactly happened:

I put the zip on the root of my SD, and the img in the adb folder.

Went fine till fastboot mode.

I held volume down with SD inside and hit the command. It rebooted into the chainloaded HBOOT and I left Vol Down immediately.

Now this is a bit different from csoulr666's process. No vibrations, BUT it scanned for the files. It said no files were found, and returned to the main screen. I was unable to operate the menu using the buttons, so I pulled the battery and rebooted back into CM10 Jelly King.

Tried this twice. Oh, and the original HBOOT detects the files. Not the chainloaded one.

Sad. :/
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Very very interesting. Both for n.h.b and me, the chainload freezes on the main screen if there's no sd card, and reverts if there is. Hmmmm...

As for not finding the file -- 2 possibilities come to mind:

1) I missed some permission check somewhere (I have an idea for that if that's the case), or

2) it has another way of checking the CID that I'm not aware of.

Would you mind opening the "android-info.txt" in the PG76IMG.zip and replacing the "HTC__001" with your own CID, if it's different? I have the main CID checking routine disabled (report superCID), so I was not worried about the correct CID in the zip file -- but if there's a second check somewhere it may reject the zip file.

(I'm on my phone...)
[HTC Wildfire S] Lt.Win:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

How do I know my CID?
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

When you're in fastboot mode connect the phone to PC and type

fastboot getvar all

Should work on every phone.

(I'm on my phone...)
[HTC Wildfire S] Erackron:
If you still need more testers, I wouldn't mind to help.

I'm getting a new phone tomorrow, so it won't matter if I hard-/softbrick my phone anyway.

I have a Marvel Wildfire S with an unlocked 1.09 HBoot.
[HTC Wildfire S] vbhtt:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

HTC_038

fastboot getvar cid

Would be more specific...

Sent from my bowl of jelly!
[HTC Wildfire S] st47k3r:
Hi! Thank you for sharing this info!

But.. i can't download it :(

Can you reupload again?

On mediafire, or another hosting?

I really need info about MSM7227 develop..

Thanks!
[HTC Wildfire S] Sachin Thomas:
@BeciMester

Please check your PM

I need some help in locating string references, i.e, finding the reference to a string using the offset of the string in the HBOOT image
[HTC Wildfire S] ayan_drawingthedevil:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

How to s-off my htc wildfire s?tutorial pliz??
[HTC Wildfire S] Lt.Win:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Only way is XTC Clip as of now, and that will cost you quite a lot.

Sent from my HTC Wildfire S
[HTC Wildfire S] ayan_drawingthedevil:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Thanks 4 dat:thumbup:...what is XTC CLIP?sorry for asking..coz im new here :)
[HTC Wildfire S] crossfire77:
xtc clip is kinda device which is necessery to s-off your phone.

check here
[HTC Wildfire S] Lt.Win:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Here you go.

http://lmgtfy.com/?q=XTC+Clip

Sent from my HTC Wildfire S
[HTC Wildfire S] Olivier:
AW: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

any news?

Gesendet von meinem Wildfire S A510e mit Tapatalk 2
[HTC Wildfire S] no.human.being:
Development has shifted from the HTC Wildfire S (MSM7227 processor, ARM1136JS, ARMv6) to the HTC Explorer (MSM7225A processor, ARM Cortex A5, ARMv7) since it is similar (though a bit more secured, APSBL on MSM7225A is signature-verified when loaded from NAND into RAM by SBL, while on the MSM7227 it is not) and there are at least SOME active devs for that device.

Once we break the MSM7225A security, we can probably "backport" to the MSM7227. MSM7227 is a bit easier to break since SBL doesn't verify APSBL's signature on MSM7227, while it does on MSM7225A.
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Looks like the project died.
[HTC Wildfire S] hell_lock:
Whats the status here? I need to do the s-off for my desire X... its similar to pico
[HTC Wildfire S] no.human.being:
S-OFF for HTC Explorer (Pico)

It's still under development though. Development is always shifting. It began on the HTC Wildfire S (Marvel), went on to the HTC Explorer (Pico), now we're on an HTC Butterfly. The problem is that the devices get abandoned so quickly and firmware gets updated so we're always chasing a moving target.

Biggest problem is that the "main developers" have abandoned HTC phones altogether (e. g. my HTC Wildfire S failed so I moved to a Samsung Galaxy Nexus (i9250) - other devs have moved away from HTC as well - HTC just doesn't cut it anymore from the technical point of view - they use Qualcomm chips and Qualcomm's crap) so we must always collaborate with other devs who still have an HTC device floating around. And they're getting rare. Qualcomm processors are not the developer's choice. It's a closed and proprietary platform. Datasheets are under non-disclosure-agreement. They make poor design decisions. Similar platforms from competitors are outperforming. The list goes on and on.

HTC should rather drop Qualcomm soon before it's too late. Developers are leaving the Qualcomm boat like crazy and once developers quit, customers will follow.
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Agreed. Even I'm gone. Phone got stolen. got an s3

Sent. That's it. Just sent.
[HTC Wildfire S] powerfull777:
I did it!

I don't understand this I s-off my brothers gsm wildfire s around 8 months ago via playing around with flashing different h-boots. If there is anyway I can help just say :)
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Please explain more. From where did you get this other hboot?
[HTC Wildfire S] heavy_metal_man:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

He means the upgrade radio by htc dev zip2 method. We can't do that as we cannot downgrade to that hboot.
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Ah.. You still got a WFS Heavy?
[HTC Wildfire S] heavy_metal_man:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Never owned one, I just get my hands on one from time to time..
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Oh OK. I can see you have the Nexus 7. Nice device. You're in the UK right?

Also, as you may remember, my WFS was stolen.
[HTC Wildfire S] heavy_metal_man:
Yes I remember your phone got nicked pal, but this is a bit OT for this thread..
[HTC Wildfire S] kosmasgr:
hello im new with wildfire s. i have unlocked bootloader , S-ON and Hboot 1.09.0099. Is there any way to s-off and root my phone ?
[HTC Wildfire S] no.human.being:
Root yes: Install custom recovery (e. g. CWM via "fastboot flash recovery ..."), then flash "superuser.apk" via recovery or just flash a completely new ROM via recovery that's already rooted (e. g. CyanogenMod 7.2) - they're a lot better than the stock ROMs anyways.

S-OFF no, not yet. We've been very close, but couldn't do the last step efficiently because we had no low-level debug facility (JTAG), which threw us back quite a bit. Now developers don't have the hardware anymore (moved to phones from other manufacturers since they were better - e. g. I moved away after my HTC had a hardware malfunction and had to be replaced - didn't want to get an HTC again since there was better stuff on the market at that point) so it's almost impossible to progress.
[HTC Wildfire S] Lpfan83:
I still have my wfs.

HBOOT .09
[HTC Wildfire S] no.human.being:
"HBOOT .09"? Never heard of it. These are the ones I've come across so far:

HBOOT-0.81.2000 (marvel, ENG HBOOT)

HBOOT-0.90.0000 (marvel, SHIP HBOOT)

HBOOT-1.03.0000 (marvel, SHIP HBOOT)

HBOOT-1.03.0001 (?, SHIP HBOOT)

HBOOT-1.04.0000 (marvelct, SHIP HBOOT)

HBOOT-1.08.0000 (marvel, SHIP HBOOT)

HBOOT-1.08.0099 (marvel, SHIP HBOOT)

HBOOT-1.09.0000 (marvelc, SHIP HBOOT)

HBOOT-1.09.0099 (marvel, SHIP HBOOT)

HBOOT-1.10.0000 (marvelc, SHIP HBOOT)

HBOOT-1.10.0001 (marvelc, SHIP HBOOT)

You probably mean the HBOOT-1.09.0099 as it's the most common variant. All newer devices shipped with it and older devices got OTA'd or RUU'd for it. If your bootloader unlocked?
[HTC Wildfire S] Erackron:
I still have a Wildfire S which isn't my primary phone anymore, so it won't really matter if I brick it.

HBOOT: 1.09.0099 (unlocked bootloader)

RADIO: 7.54.39.28M

I am no stranger to adb, fastboot and, if necessary, google. If you want me to try something, just reply here or pm me.
[HTC Wildfire S] rezo609:
This thread is still going? Its been 2 years!
[HTC Wildfire S] heavy_metal_man:
Yup :/
[HTC Wildfire S] :
Hey rezo! I remember you! You were rezo the dare devil!

Sent with my Sonic Screwdriver
[HTC Wildfire S] XDA_h3n:
Long time since I seen this thread. Just want to see the progress even though I cant use my wfs since it's interesting :cool:. Don't know if this useful or not, but I'm sharing it anyway.

And this is for the HTC Desire HD so don't try flashing the gfree method and you probably cant.

What I'm sharing is the process of the gfree method, it doesn't show the source code of it but I'd thought it help a bit.

Attn1 had published it after the AAHK had been discontinued.http://tau.shadowchild.nl/attn1/?p=411The problem with it is we cant see the source code of gfree/visionary radio and recovery + kernel exploit source code. Assuming gfree IS visionary I'd think it would impossible as he has said this (Not sure I don't remember much from this) was impossible or something similar.

I don't have my wfs, I went swimming with it. The whole thing works just that the digitizer and usb and speakers and vibration don't work. So I can't use it.
[HTC Wildfire S] Lpfan83:
Yea its the 1.09.0099 boot. Yes bootliader is unlocked with HTCdev.
[HTC Wildfire S] simonsickle:
Gfree source code is actually available. And wpthis etc. Give me some time and I'll find it for you guys.
[HTC Wildfire S] no.human.being:
Yeah I know, gfree is available. But it patches secu_flag in "nvram" partition. On eMMC-based devices this partition is visible but write-protected via the standard MMC WP mechanism. Power-cycling the memory will disable write-protection. That's what gfree does. However, on mtd-based devices, the protection is done by the processor, not by the memory itself. There are dedicated "NAND MMUs" on the SoCs that do address translation for the Flash memory on EBI2 (slow bus), a lot like the "normal" MMU does address translation for the RAM memory on EBI1 (fast bus). Thus on mtd-based devices, the part of the Flash memory where secu_flag lies is not even visible for aARM. We can't even read it. In fact, it doesn't even have a "virtual" (with which the processor works) address assigned. The NAND MMU hides it completely. A gfree-like method won't work on mtd-based devices, unless we find a way to disable the MMU and access the "raw" NAND by physical address.
[HTC Wildfire S] :
Hey simon! I remember you!

Sent with my Sonic Screwdriver
[HTC Wildfire S] :
Stop. Going. Off. Topic.
[HTC Wildfire S] :
Sowwy

Sent with my Sonic Screwdriver
[HTC Wildfire S] *se-nsei.:
Yeah :/

The WFS wasn't a very enjoyable device. Couldn't develop for it either as became busy for the last two years. Will be moving on to another device soon.
[HTC Wildfire S] :
I'm rocking an S3 now. I missed you.

Sent with my Sonic Screwdriver
[HTC Wildfire S] heavy_metal_man:
Come on man, its been literally 3 posts and your ot again :thumbdown:
[HTC Wildfire S] csoulr666:
Perphaps this might be helpful [MENTION=4318347]no.human.being[/MENTION] ??
[HTC Wildfire S] ScardracS:
Mmh you could make it like xtc-clip

Powered by my Thunderbolt (This isn't spam, this ia my signature)
[HTC Wildfire S] no.human.being:
Unsure. There is a "software way" to connect to a "serial console" via USB. If I remember correctly you had to boot the phone into Fastboot mode, then connect it to the PC via USB, then issue a "fastboot rtask c". The smartphone will then emulate an RS232 UART and will thus appear as a "/dev/ttyUSB*" device to a Linux host. You can then use "screen" to connect to the TTY (e. g. type "screen /dev/ttyUSB0" on a Bourne shell on your host). You will then be at a REX shell. It's buggy as hell though, so be careful what you type. Not all commands are known and some are probably destructive.

Type "ATE1" to enable the console echoing back keystrokes to you (useful to see what you type) and "ATV1" to enable verbose mode. All commands are terminated by a new line character. Be careful since you cannot correct what you have typed using the backspace key. There are several commands you can issue to REX, e. g. "AT@SIMLOCK?AA" to read the secu_flag or "AT$QCPWRDN" to power down the SoC.

The shell will sometimes behave in a very "weird" way. E. g. iirc when you enter a command and press enter, it won't go on to the following line but will stay in the same line so you "overwrite" the command. It's best to ignore most of the feedback and just type the commands you want to issue. It's probably not really meant to be used by a human and scripts communicating with it probably won't mind "weird behaviour". ;)

Just remember that you cannot correct what you have typed.

I have the impression that all the Arduino board does is set up this communication via a hardware-based method. I'm quite sure the phone won't have several "serial consoles" but only one and the way you get there (via UART or via USB/rtask or whatever) probably doesn't matter.
[HTC Wildfire S] csoulr666:
This would have been useful when you had issues with the input/output voltage right??

Just looked at the thread.......it is meant as a universal interface,not just limited to phones.....and it is a hardware based method
[HTC Wildfire S] hell_lock:
Can anyone tell me the technical aspects of getting s-off? What exactly you guys are trying to achieve? What keeps this s-on intact on a bootloader? Where is it stored?

Sorry for questions
[HTC Wildfire S] :
Sorry.

S-ON is defined by the secu_flag's state in the radio.img. it's a random bit and the file is too big to find it. We are trying to achieve S-OFF without a hardware method. HTC have made this difficult.

The only way too get S-OFF so far is either using the XTC-Clip device. Or try and downgrade your boot loader to a specific version and flash a zip through HBOOT that gives S-OFF. HTC did this by accident. But they fixed it.

Any other questions.

Sent with my Sonic Screwdriver