yashsingh1/xdaforums huggingface dataset:
[HTC Wildfire S] no.human.being:
Well of course I remember you. ;)

As to the current status: Most devs (including me) have moved on to other devices and don't own a WFS anymore. Another dev team on another device (based on an MSM7225A processor) has taken over. I've given them the code for our "chainloader" exploit, explained in detail how it works so that they could adapt it to their chipset and they're now testing.

They found out that, on their device, when they chainload a modified (version string changed) HBOOT image with our exploit, HBOOT will display "Security warning!" and show the modified version, then lock up (enter an infinite loop). When they load an unmodified (original) HBOOT image with our exploit, HBOOT will also display "Security warning!" (so this message does not seem to be related to the fact that the HBOOT code was modified), show the original version, then lock up.

They then asked which instructions we did change to gain S-OFF and I told them. I also told them that they most likely need to start over reverse-engineering and patching their HBOOT, since it's probably different from the MSM7227 HBOOT. Last thing I told them was that building HBOOT from source won't work (because they specifically asked for that and said that the code won't assemble) and that they have to modify the boot code on the machine or binary image level.
[HTC Wildfire S] heavy_metal_man:
could we do a cat/mtd dump of a s-off 0.9 hboot and then again with s-on and see if it shows us where the old/new s-off location is?
[HTC Wildfire S] mstfkaratas:
s-off flag is not stored in hboot, it is stored somewhere else in unmapped area of memory
[HTC Wildfire S] no.human.being:
In fact the secu_flag is completely inaccessible to aARM. It has to query mARM via inter-processor communication, then mARM reads and returns the flag. Aaaages ago, someone has found the physical address where it lies, but there is no way to access it from aARM. You can access it via JTAG though, but we're searching for a software S-OFF solution here.
[HTC Wildfire S] heavy_metal_man:
So then if we had temp s-off could we not just talk yo m-arm and ask it to switch it off?
[HTC Wildfire S] artturnip:
But we haven't managed to get temp s-off properly working (yet) it just locks up :mad:
[HTC Wildfire S] heavy_metal_man:
And realistically we probably never will. The main devs have no phones to test anything on, no way or manpower to port uboot and most of us are out of ideas. I hate to say it but its over. Without someone who knows what they are doing, can write machine code (?) For the hboot and has a wildfire s And a JTAG with debugging capabilities its not happening. :(

We need a Christmas miracle, or pool in our resources and buy the equipment we need, including the phone and then hope we can find someone who can do the JTAG debugging.
[HTC Wildfire S] no.human.being:
"Normally" it doesn't lock up, but instantly reverts to S-ON after checking for the "PG76DIAG.nbh" file on the SD card. The HBOOT we load ("custom HBOOT") somehow realizes that it's been tampered with and then overwrites itself (in RAM) with the "known good" version that the Radio provides.

It will only lock up in case there's no SD card inserted. In this case, the lock-up happens before the USB driver is initialized (screen freezes saying "HBOOT", not "HBOOT USB").

By the way, great news! The other dev-team on the HTC Explorer finally managed to get to the same point we did. Check it out.

Let's see what they find out. I'm gonna work through their dev thread now (thankfully it's A LOT shorter than this one :D ) and try to understand exactly what they did.
[HTC Wildfire S] artturnip:
I have the device, but as I'm only 14 I don't have any money to spend on JTAG equipment or the time to learn machine code. :(
[HTC Wildfire S] heavy_metal_man:
:) its the thought that counts :)
[HTC Wildfire S] artturnip:
Getting in the Christmas spirit I see :p
[HTC Wildfire S] BeciMester:
Guys, just a thought. As we all know, the chainloaded hboot works for a while before reverting/locking up: it searches the sdcard for a PG76IMG.zip.

Has anyone tried what happens if it actually finds one??
[HTC Wildfire S] no.human.being:
Are you sure that it actually searches for a "PG76IMG.zip", not for a "PG76IMG.nbh" or a "PG76DIAG.zip" or a "PG76DIAG.nbh"? ;)

But no I haven't tried. I didn't want it to "revert while writing to NAND" even though it probably wouldn't do that. I think it would revert before actually processing the file, but it might be worth trying.
[HTC Wildfire S] BeciMester:
It searches for all of those. I know because that's how I flash my test hboots, with PG76IMG.zip on the sdcard. My USB connector is way too flaky for fastboot flash. Naturally, the signature check is patched out. ;)

In case you wonder, I can't test the theory myself, as the whole "locked", "unlocked", "security warning" malarkey is patched out as well, and this somehow broke "fastboot boot". :cool:

(I'm on my phone...)
[HTC Wildfire S] artturnip:
Could I test this then?
[HTC Wildfire S] no.human.being:
Yes, I know that it "normally" searches for all of those, but if I saw it correctly (it goes very quick so you can't really tell) it only gets the chance to show that it's searching for one file (it normally prints out all the files it searches for) and then the revert happens. Might be that I didn't see it correctly though and it actually checked for all files before reverting, I'm not sure. It all goes way too fast. Can't actually read those messages. :D
[HTC Wildfire S] Lt.Win:
Crazy idea, bear with me.

How about recording the process on a camera and then slow it down?
[HTC Wildfire S] heavy_metal_man:
Tbh I'm pretty confident that it will check for all of them. There is no reason for it not too :)
[HTC Wildfire S] BeciMester:
Normally yes, but I think n.h.b means that the revert happens before it has the chance to check for all files. Which gives us a clue about where we should look in the code for the cause of reverting.

I wish I could chainload and test. :( Someone who can, please make a video of it happening, as Tyr Fifteen says.

My theory:

chainload a hboot that has s-off and no signature checks

prepare a PG76IMG.zip (or .nbh or whatever) with the copy of the same hboot

the chainloaded hboot finds the .zip file on the sdcard

if we're lucky, it flashes it for us

...aaaaand we're done! :D

I can provide the PG76IMG.zip with the hacked hboot 1.09.0099 that has s-off, all fastboot oem commands patched back in [***], and signature checks off. It's ready to go. But someone else should make the boot.img for chainloading as I'm not 100% sure I'm doing it right (can't test).

[***] by that I mean, all the commands that are still there in 1.09, as a LOT of the commands present in 0.90 are just removed from 1.09.
[HTC Wildfire S] BeciMester:
Look around 0x1bb40, and mainly 0x1bd3c, those subs refer to the strings in question. I can't see anything related to reverting though. Right now my biggest fear is that "hboot integrity check" and reverting is independent of the hboot itself.

Never mind the .nbh, I don't think it's necessary to go to that sort of trouble if we have the right hboot running. All I know is that I have a PG76IMG.zip file with the hboot image and a file named "android-info.txt" containing this:

modelid: PG7610000
cidnum: HTC__001
hbootpreupdate:0
mainver: 2.17.0.0

And it works.

I just know that my version works. :) Making another boot image is not hard, it's just I'm having trouble with "mkbootimg_wfs" not working 100% in my Ubuntu install, so if anyone wants to make a new boot.img I'll send the hboot file to be included.

HTCCUSSP = HTC CUStom SPlash...? :confused:

If you recall turning your phone on, it immediately shows the "green logo on white", then a bit later it looks like the screen is re-initialised or something, it goes dark for a split second, then shows the same logo. Now, I think the "sp1" from radio shows when the phone turns on, and later the "spcustom" when hboot takes over. I reckon it's customizable. ;)

Edit: 320 x 480 x 2 (16 bits) = 372736 ;)
[HTC Wildfire S] no.human.being:
Fortunately it's not. If you overwrite the HBOOT in RAM with "a big amount of no-ops and then an instruction that jumps to the beginning" (so basically an infinite loop in the size of the HBOOT that does nothing - can't get a lot more "unlike an HBOOT" than this ;) ), it stays in that loop forever and doesn't revert to HBOOT.

Right. But if we found out that it reverts after "PG76IMG.zip" is parsed and flashed, we may not have to fix the reverting issue. Fixing it is most likely guaranteed success though (unless we end up in the "infinite loop issue" like the HTC Explorer people).

No problem. Just send it to me. It would be convenient if you gave it a distinct version number (something like "6.09.0000" then increment the last number should "revisions" occur) to differentiate it from the other HBOOTs. Also, could you tell me what you changed?

Yep. Would be a nice gimmick to stick a logo in that displays some chains and then says "Chainloaded - by xda-developers" or something like that for the "final version". Until we get "final", we have to think about some obfuscation as well, as we probably don't want to ship HTC code too obviously, but let's get this working first. :)
[HTC Wildfire S] heavy_metal_man:
Once you have s-off the splash screen is easily changed :D

Its one of the first things I do after a s-off :cool: you can update it via ****IMG.zip method or by using fastboot to flash a custom one you make :D
[HTC Wildfire S] BeciMester:
Haha, scrap the custom image idea for now. I probably should research things before I open my mouth. :o

The spcustom.img in question can be converted to .bmp using this excellent tool, and it contains the bootloader unlock warning screen:
[HTC Wildfire S] no.human.being:
Yes I know and it updates the splash screen in the Radio.

Hehe, ok. Definitely not what I had expected. :D
[HTC Wildfire S] artturnip:
Do we actually have a device to test this on?
[HTC Wildfire S] heavy_metal_man:
Nope. Only biesmister has one and I don't think he can test on his. But I do remember a member being here saying that they had the wfs spare. We could ask them
[HTC Wildfire S] BeciMester:
Good news: I found the problem with my "fastboot boot", did another little permission fix in hboot and it's working now. Also managed to build the boot.img properly (had to recompile "mkbootimg_wfs" as the binary in the download package didn't work for me). As far as I can see, the PGxx file check (green list) happens the same way in the chainloaded hboot as it would in a normal one.

Bad news: it doesn't get to flashing, after the file check the reverting happens. Back to the disassembler I must go.

Edit: after patching out the part that's normally called when a reboot is needed, it still reverts. Grrrrr.
[HTC Wildfire S] heavy_metal_man:
Excellent work man :) :highfive:
[HTC Wildfire S] no.human.being:
Excellent! It doesn't have to be a reboot though. A loop that copies itself into a "safe place", then reads from unmapped memory and writes to the first physical page in RAM, disables cache, MMU (like "chainloader" does) and sets the program counter to zero should work just fine. Who tells us that the HTC engineers didn't have an idea that's roughly like ours? ;)

Of course I'm not exactly certain how they do it, it's just an idea. If we roughly know the order in which certain routines are executed, we could build an infinite loop into one (like I said, on the ARM architecture you can create an infinite loop in one instruction, "sub pc, pc, #4"). If it locks up the bootloader, the instruction was hit before the reverting routine was executed. If the bootloader still reverts, it didn't hit that instruction, so the reverting routine was executed before.

Of course a real debugging facility would offer much nicer methods. :D
[HTC Wildfire S] no.human.being:
GREAT NEWS! We finally found a debugging facility and we can run the exploit in it and also the HBOOT (it sets up the page tables etc.). We can use arbitrary images as "virtual NAND" and "virtual SD card" and we can set breakpoints, single-step, disassemble, patch, modify just like we could with JTAG, just that the processor is virtual here.

Disadvantages:

- We probably cannot recreate the "class one hypervisor" stuff, so we can run one domain only. So far we've decided to run the application processor only, so we can run HBOOT but not Iguana. Don't know whether this will "bite us".

- We have processor and memory only, no "peripherals". No display, no keys/buttons, no touch input. This implies no way to hold Vol-Down either and no way to read any output from the bootloader. Remember that for JTAG access you also have to remove the board from the phone, so you have no display either. However, at least you still have the three actual physical buttons (Power, Vol-Up, Vol-Down).

Advantages are obviously many. We can actually run the code, break it, single-step it, watch register contents live, see which branches are taken. It's wonderful. So far I haven't gone too far into the HBOOT code so I don't know how far it will get or whether it will "die" at some point because there are no peripherals and no Radio.

In case you are interested, check it out.
[HTC Wildfire S] artturnip:
Does anyone actually have the time, energy, knowledge to do this? Personally, I've only got the energy... :mad:
[HTC Wildfire S] heavy_metal_man:
Don't forced there are two teams working towards the same goal now ;)
[HTC Wildfire S] munjeni:
Its not true! I had everything (display, buttons, android runing, jtag connection when android runing in backgroung...etc, only missed debuging because missed one pin needed for halting())! You looking for working jtag hardware? Any one tried Segger Jlink Edu + revskills pro software (software I used for sucesfully flashing but not debuging)? It worked like a charm for me! Allso segger have his own software so I am sure some one can figure out debuging with Seger support site. Segger allso have own software included with Segger Jlink...
[HTC Wildfire S] #define:
Are you talking about wildfire s??
[HTC Wildfire S] no.human.being:
Why didn't you try OpenOCD, the de-facto standard software for on-chip debugging? They also have support for Segger JLINK. See here, the interface is listed under "2.5 USB JLINK based".
[HTC Wildfire S] munjeni:
I sold my msm7227 device so I can not test
[HTC Wildfire S] no.human.being:
Yeah, same here. :(
[HTC Wildfire S] kalaker:
I have a marvelc I'd test on if you think it'd be of any use...
[HTC Wildfire S] simonsickle:
This is semi off topic but semi on. Through reading I saw that some htc devices show UART info through USB in certain modes. I currently have a one v, which supports USB JTAG aka UART but I can't seem to access this mode. Has anyone had success in accessing USB UART info
[HTC Wildfire S] no.human.being:
No and it's not like JTAG. The kernel puts out debug information through the UART during boot, so you can monitor the boot process if you don't have access to log files, that's all.
[HTC Wildfire S] simonsickle:
I don't have access to log files. Which is why I asked :)
[HTC Wildfire S] artturnip:
Have the device but not the hardware to set up JTAG on it
[HTC Wildfire S] Olivier:
AW: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Any news?

Gesendet von meinem Wildfire S A510e mit Tapatalk 2
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

News? Yes and no. Finished with exams for now so I found some time to mess with the hboot again. I managed to patch the 'Ramdump' command back into 1.09 (it's a hboot menu item now) and it ran successfully, giving me 8 or 9 files on the sd card -- all full of garbage. :( Nothing else to report for now.

(I'm on my phone...)
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

So, guys, who remembers me? And what's been happening?

Sent from somewhere too far away from my computer. Axis_Drummer calls me Wolfy. Jessica said I need to behave...
[HTC Wildfire S] heavy_metal_man:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

(Off topic) (sorry :()

I'm sorry but read the thread dude, and we are not here to remember people :/.....

tapped out from my sexy sensation XE ;)
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Wow. I was just saying hi after a long time... I've missed 200 pages, since my WFS was stolen. That's a lot to read.

Sent from somewhere too far away from my computer. Axis_Drummer calls me Wolfy. Jessica said I need to behave...
[HTC Wildfire S] artturnip:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Long story short we need someone with JTAG equipment and the device and the time and the experience to properly look into this device's hboot
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

I swear NHB was doing all that when I was here before my WFS was stolen.

Sent from somewhere too far away from my computer. Axis_Drummer calls me Wolfy. Jessica said I need to behave...
[HTC Wildfire S] heavy_metal_man:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

He could not get his debugger to work and then his device was damaged/lost, not sure. He couldn't get a wfs as a replacement.

Tapped out from my sexy nexus 7 ;)
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Yeah, he told me that him and a few other devs just got a new device, and got some other devs to help.

Sent from somewhere too far away from my computer. Axis_Drummer calls me Wolfy. Jessica said I need to behave...
[HTC Wildfire S] heavy_metal_man:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Another phones community requested to carry on the wfs work on their device with the intention of attaining s-off. I believe nhb has been working with them and there device, but all is quite on this front. Biecmiester is working quietly in the background but other than that....

Tapped out from my sexy nexus 7 ;)
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Ah yes. The Buzz devs I believe. Or another phone. Not quite sure. Maybe the Chacha ones. I got a new device too, after several months. I got an S3. No gift can beat this. And, I don't get gifts often. Is Rezo still being a dare devil?

God, I remember that stunt he pulled last time.

Sent from somewhere too far away from my computer. Axis_Drummer calls me Wolfy. Jessica said I need to behave...
[HTC Wildfire S] #define:
It was us bro.. The Explorer people.. And we've been making quite some progress.. Up until christmas.. Now we've run out of ideas... :(
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Ah ok. Shame really. Anyway, it's HTC's fault for losing potential future customers.

Sent from somewhere too far away from my computer. Axis_Drummer calls me Wolfy. Jessica said I need to behave...
[HTC Wildfire S] artturnip:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Someday a company is gonna realise like "Hey, people like to mod Android! Why don't we make it east for them?" Then devs will flock in there thousands to buy those devices! It's a Win-Win situation! :D
[HTC Wildfire S] beaups:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

And the carriers won't certify it and it will never come to USA. Yawn.
[HTC Wildfire S] BeciMester:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

A bit of a progress: I now know where the framebuffer is and how to access it. I'm working on putting some visual clues on screen, to see how far the chainloaded hboot gets before reverting.

(I'm on my phone...)
[HTC Wildfire S] heavy_metal_man:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Nice one man!

tapped out from my sexy sensation XE ;)
[HTC Wildfire S] no.human.being:
Lol, carriers. I believe the manufacturers have a bit more money and market power to push. If a manufacturer was really WILLING to take on the "fight", carriers would have to perish. I think in the US it's a bit different with big companies such as Verizon, but here in Europe, who cares what the carriers are saying? :D

However, there are also regulative bodies at the governmental level which force manufacturers to implement certain protocols properly. E. g. in most European countries, if you operate a wireless network (WiFi), there is some sort of "stop-signal" that the military can set off and then all non-governmental networks must cease transmission for some time. It's designed to facilitate ranging and location of radio sources like hostile communications by shutting off all the "noise" that civil use of wireless communication creates. How do you make sure that each wireless device adheres to this protocol? Well, by locking the firmware down.

There is already such a company and it's called Samsung. They're quite mod-friendly, even though they also keep part of their firmware secret, but it's all far less locked-down than all this HTC-related stuff.

The big disadvantage with Samsung is that they're said to treat their workers very badly, letting them work with hazardous substances without adequate protection, harrassing them until they commit suicide. So it's a bit questionable whether one wants to support such a company or not, but at least their products are quite modding-friendly and of overall good build quality.
[HTC Wildfire S] csoulr666:
I think everyone has forgot Sony...........They have been the most dev-friendly manufacturer of all.....

I would switch to Sony but HTC's phones are something else to use :D
[HTC Wildfire S] Lt.Win:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

I myself am deciding between a Samsung and Sony. :D

Xperia S and S III Mini are the two.

For most, they would obviously go for Xperia, but size does matter to my small hands. And looks. I've also heard the Xperia S has bad battery life. Size and battery are the main things for me. Battery is quite good on the mini I've heard, but I'm on the edge of the fence right now. I hate that feeling when you're on a budget and not able to decide. :/

Anyways back on topic: BeciMester good job. Now to wait and watch when it goes back.
[HTC Wildfire S] artturnip:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

I'd never get a HTC again, it's been a pain to all the devs and I think that devs should 'vote with their feet' to make sure that companies are dev friendly!
[HTC Wildfire S] #define:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Same here brother... never an HTC again.. my nexus 7 is on the way...

As soon as we get stable s-off, i'm gonna sell this phn...
[HTC Wildfire S] artturnip:
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

I used to have a Nexus 7, but it was horrifically unreliable, the first one I had the speaker blew and then second there were dead pixels on the screen. On the other hand, it was a cinch to s-off, root and install CM10 :D
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

That's weird. I know loads of people who have never had problems at all even after about 6 months. Maybe you were just unlucky.

Check out UltimaTIME Clock Widgets: 200 clocks, all in one widget!
[HTC Wildfire S] :
Re: [DEV][THE S-OFF CAMPAIGN] We need electrical engineers & experts in JTAG, OpenOCD

Oh ma. We haz some evil upon us!

Sent from somewhere too far away from my computer. Axis_Drummer calls me Wolfy. Jessica said I need to behave...