yashsingh1/xdaforums huggingface dataset:
[HTC Wildfire S] tacromx:
from my misc dump(mtd0) (s-on)

code

Offset 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

00000000 56 4F 44 41 50 30 30 31 00 00 00 00 00 00 00 00 VODAP001........

00000016 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000032 44 65 76 69 63 65 57 61 72 6D 42 6F 6F 74 00 00 DeviceWarmBoot..

00000048 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

00000064 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

00000080 43 45 20 53 65 72 69 61 6C 20 49 6E 55 73 65 00 CE Serial InUse.

00000096 44 65 62 75 67 20 43 61 62 6C 65 20 45 6E 61 00 Debug Cable Ena.

00000112 43 45 20 20 20 55 53 42 20 20 49 6E 55 73 65 00 CE USB InUse.

00000128 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000144 43 6C 65 61 72 41 75 74 6F 49 6D 61 67 65 00 00 ClearAutoImage..

00000160 32 2E 31 37 2E 30 2E 30 00 00 00 00 00 00 00 00 2.17.0.0........

00000176 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000192 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000208 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000224 48 54 43 55 00 00 00 00 00 00 00 00 00 00 00 00 HTCU............

i tried to write mtd0 but its protected. hboot possibly checks this for current version and rejects flash if lower tha 2.17.0.0 like mine

so patching mtd0(misc) could give you CID1111111 and downgrade Hboot

i wonder if CID111111 turns off signeature check automatically??

00000F0 to 0001FFFF is filled with zero's

then 00020000 to 0009FFFF is filled with FF

file size 640 KB
[HTC Wildfire S] Antagonist42:
This posting I think may shed a little more light on the set_tls - seems to be for protecting corruption of vectors in misc and libc ( previous is slightly beyond me :o )

Seems a few reasons for this cropping up...

msm: Remove TLS hacks for msm7x27
Michael Bohan [Tue, 19 Apr 2011 22:43:06 +0000 (15:43 -0700)]
For historical reasons, bionic expects the TLS address at
0xffff0ff0 on msm7x27. Since the chip itself supports a hardware
register interface to the TLS address, switch to use that
instead. This requires a corresponding changes in Android.

This change also regains read-only permissions on the HIGH_VECTOR
page.

Change-Id: Ie80013168657ae71e52dd51c1ad00a24d5704cdf
Signed-off-by: Michael Bohan <mbohan@codeaurora.org>

From here...

:confused: :eek: what if you force an error with set_tls...what is say reset and where is it read from? maybe that is what the info in misc is written in for, to be read after the set_tls error .....:rolleyes: just an idea
[HTC Wildfire S] munjeni:
Good ! But I am abble to erase/edit misc partition... but I have s-off allready ! Will try with s-on something

---------- Post added at 11:16 AM ---------- Previous post was at 11:12 AM ----------

:eek: great finding... its very interesting ! Maybe L_PTE_RDONLY to L_PTE_WR:D
[HTC Wildfire S] Antagonist42:
Something that may be of interest kind of on and off topic, Valgrind a program/memory testing install that runs on the following

It runs on the following platforms: X86/Linux, AMD64/Linux, ARM/Linux, PPC32/Linux, PPC64/Linux, S390X/Linux, ARM/Android (2.3.x), X86/Darwin and AMD64/Darwin (Mac OS X 10.6 and 10.7).

they have also been having problems with the set_tls and how to get around it.

The program itself may be worth a look ;)

I'm not sure 'all' data will be erased from using the 'dd' command, saw it here about yaffs2 about it not either erasing/writing oob info so not creating the img/file correctly, not sure myself but worth checking maybe if data is being read/written from their.
[HTC Wildfire S] munjeni:
dd working good if you set proper sizeof the block, I allready played with dd... try dd if=/dev/zero of=/dev/mtd/mtdX bs=131072 where x is your system partition :D and dump that mtdX again and you will se mtdX is completely erased:)... when I dump mtd with jtag (including oob data) I always see oob with 0xff so... do you see oob data in *.img ? I think no.
[HTC Wildfire S] tacromx:
no, its not in image

....yes i have acces to system mtd, but not misc mtd, i can dump misc, but get write errors when trying to errase it
[HTC Wildfire S] munjeni:
Same as I think. What dmesg you got after trying to erase?

Heh, why contents from the link is hidden I realy not understand, maybe one of the possible doors ?
[HTC Wildfire S] tacromx:
i think maybe you mean this hidden link?
[HTC Wildfire S] munjeni:
I think not... cid 11111111 is super cid, so with super cid you are abble to install every "cid locked" zips, for exmple if "zip upgrade" contain only update for devices with cid VODAP_013 or VODAP_xxx or HTC_024, you will be abble to install these zip with super cid... its like gold card. But I'm not surre about cid from misc partition, these cid is backup cid... True cid is located (in htc aria cid is in 0x480800 offset), something like VODAP_1100000074, but I set it to supercid like 1111111100000074, so I never need gold card)... but signature check you can not bypas I think, only if you install patched hboot
[HTC Wildfire S] tacromx:
This was for SYSTEM mtd yes? bs= 131072?

What would bs= for misc mtd?
[HTC Wildfire S] munjeni:
I thinked about:

> These three patches modify the Zygote to enable debug instrumentation. I
> haven't tested them a whole lot.
>
> https://review.source.android.com/24891
> https://review.source.android.com/24892
> https://review.source.android.com/24893

---------- Post added at 12:51 PM ---------- Previous post was at 12:49 PM ----------

I forgot what I use for that, but try 1024, 2048, 4096, 131072... I think only one right is 131072 because nand block size is 131072, or you can use command: erase_image misc. I had problems when I tried to install old hboot after installing htcdev hboot, and only option to do that was (relock hboot, than edited misc partion, than installed revolutionary hboot_upgrade, than installed hboot 1.02.0000, than installed revolutionary hboot)... so maybe you need to relock htcdev hboot in order to edit misc partition... search aria forum for my post when I tried to install old hboot after installed htcdev hboot... I done that sucessfully!

---------- Post added at 01:04 PM ---------- Previous post was at 12:51 PM ----------

Found my post here http://xdaforums.com/showthread.php?t=1528808&page=2
[HTC Wildfire S] tacromx:
Yes i followed your guide a while back to try and downgrade Hboot, but failled to erase misc, i got i/o error, i tried with erase_image and DD way too but same error.

I think this is why NHB explot is not working either, due to kernel restriction and or MTD drivers or both possibly and probably related to what Antagonist42 posted above
[HTC Wildfire S] munjeni:
Hmmm, maybe htcdevs implemented patch to new hboots for previous security bug in oldest hboots ?;) Or maybe its only in kernel you use, for example read only flag to misc partition? Whick kernel is in your device? Any link to git? Did you tried to install old hboot?
[HTC Wildfire S] tacromx:
http://dl4.htc.com/RomCode/Source_and_Binaries/marvel-gb-mr-2.6.35-a66971c.tar.gz

Kernel 2.6.35.
[HTC Wildfire S] Antagonist42:
This is going to be complicated :mad: just flicked through some of the source for my kernel..... AMSS could actually be 'Striped' so data may not be incremental in NAND as it can span both 'die's' of the NAND, something I'm almost positive I have read is that I think the partitions can overlap so maybe that's how AMSS gets info installed through misc ( what with it being able to be striped and overlap :( )

and that's why data in each .bin of the .hex files has data for maybe each partition even though one may be installing AMSS at the time there could be spurious data installed then SYSTEM could install the rest of the file completing the spurious data..... :confused:

for your enjoyment if you like >>here<< will be my source code for ACER E320 or C6 ( Liquid Express ... Not to be confused with Liquid E ;) ) From the ACER Site <<< and 2Shared <<<
[HTC Wildfire S] davidang:
Maybe let try to get Adam Outler to help us cause he is a pro in hardware hacking he may be able to help us:D
[HTC Wildfire S] seaskyways:
And who will donate a WFS to Adam :D ?? There is someguy around this thread that had a WFS that booted without touchscreen but buttons are okay , enough to enter bootloader and recovery !
[HTC Wildfire S] davidang:
ask that dude to donate to Adam and Adam can help us achieve s-off u will feel happy cause he has done something good for the community:D
[HTC Wildfire S] munjeni:
What is WFS ?

---------- Post added at 04:03 PM ---------- Previous post was at 04:02 PM ----------

Its htc kernel? Or its cyanogen kernel? Allso that link to kernel provided in your post not working!
[HTC Wildfire S] kalaker:
WFS is Wildfire S. It is just a shortened version of the name.
[HTC Wildfire S] tacromx:
@munjeni

go here and choose wildfire s, i think any carrier is the same kernel ...stock 2.3.65
[HTC Wildfire S] the Doctor:
I am totally unable to contribute to this discussion, but wanted to mention a new(?) tool that claims to gain s-off for HTC devices including WFS:

http://www.lgtool.net/index.php

A person in the One V forum claims it worked on their phone.
[HTC Wildfire S] davidang:
i think it is for cdma
[HTC Wildfire S] Lt.Win:
Damn you, why didn't you post this like 8 hours back!? I'm about to sleep now.

My sleep is now wasted, finished. Thanks a lot.

Please test that someone.

I hate you for posting it that late!! :D
[HTC Wildfire S] bingzz:
Wildfire S page 404'd. Not a good sign.
[HTC Wildfire S] Antagonist42:
Tried getting the tool from LG/SE working, got another device showing up on system USB connection but it's not for having it on my PC lol :(
[HTC Wildfire S] rezo609:
I would test it but I don't find the drivers for windows vista.:(
[HTC Wildfire S] the Doctor:
It's not my fault you read it 1 1/2 hours after I posted it! :D
[HTC Wildfire S] csoulr666:
Every HTC phone's page is being 404'd.....

Although i am going to try it when completely stock.....no root,stock rom,stock recovery,bootloader locked
[HTC Wildfire S] Lt.Win:
LGETool is downloading. 2 mins to download.

I'm trying this on EQDKP 5.0.

If this s**t works, We are so partying tonight. :D

Hold tight!

Edit: At first, It gave me a smartCard drivers not installed error.

I went to the link in the error window and downloaded all possible ones, out of which a few were only .dll files. Could someone explain me how do i install these?

There's no smartcard driver for win 7, so I installed the XP one.

I'll try something else. I don't have much time now, I'll do as much as possible.

I want this tool to work!! :mad:

EDIT 3: I can't get it to work....

FAIL. :(

Go on Nhb, do your stuff.
[HTC Wildfire S] the Doctor:
Just found the thread and user that claimed to get s-off on One V with the LGE Tool if you want to PM him:

dohaa32

Patch mid??

Here's another post about the tool:

http://xdaforums.com/showpost.php?p=25683600&postcount=56
[HTC Wildfire S] seaskyways:
If you have the XP drivers , then Run the tool in compatibility mode to XP Service Pack 2 ... Right click the exe , properties , compatibilty , and the mentioned :D
[HTC Wildfire S] Lt.Win:
The xp drivers too fail to install. We need some card for it to activate or something...
[HTC Wildfire S] munjeni:
I created modified simple kernel module that is for remounting misc as a read/write... maybe try on your kernel :)

Log:

cat /proc/mtd
dev: size erasesize name
mtd0: 000a0000 00020000 "misc"
mtd1: 00420000 00020000 "recovery"
mtd2: 002c0000 00020000 "boot"
mtd3: 0f000000 00020000 "system"
mtd4: 02800000 00020000 "cache"
mtd5: 0b920000 00020000 "userdata"
mtd6: 00080000 00020000 "hboot"
mtd7: 000a0000 00020000 "misc_rw"

Dmesg:

<6>[ 68.923004] mtd-hack-rw: found driver msm_nand modname (null)
<6>[ 68.923339] mtd-hack-rw: device (null)
<6>[ 68.923492] mtd-hack-rw: mtd name msm_nand, type 4, size 536870912
<5>[ 68.923675] Creating 2 MTD partitions on "msm_nand":
<5>[ 68.923980] 0x000002400000-0x000002480000 : "hboot"
<5>[ 68.944793] 0x00001ff60000-0x000020000000 : "misc_rw"
<6>[ 68.954986] mtd-hack-rw: mtd name msm_nand, type 4, size 536870912
<6>[ 68.955169] mtd hack loaded

Kernel changes:

https://gitorious.org/ics-cyanogenm...mmit/175247546b1751500568230596224bb0c4a9d241

Install module:

adb shell insmod /system/lib/modules/nandhack.ko :D
[HTC Wildfire S] tacromx:
@munjeni

Thanks for that, i'm a bit of a newbee to linux so can i compile just the files there with make

or do i have to compile the whole kernel?, i did try 'make' in the same directory as the five files you posted the link to but it says 'no targets'

Any help much appreciated, sorry for for my linux ignorence ; )

Its ok, i worked it out ; ))))))

compiling now ; )
[HTC Wildfire S] no.human.being:
Mind that there are two entirely different memory layouts for the Wildfire S and we better support both.

I first thought this is related to the Radio version, but it ain't. Most RADIO-7.53 phones have the latter layout and most RADIO-7.54 phones have the former layout, but there are exceptions.
[HTC Wildfire S] tacromx:
Anyone any idea why i'm getting this?....

**update**

Fixed it
[HTC Wildfire S] Sneiben:
How about those who already got the new radio 7.57.39.10M that came with the last fota?
[HTC Wildfire S] :
What about my exotic memory layout?

Sent from my TARDIS!
[HTC Wildfire S] tacromx:
@Sneiben and Bad-wolf

this is how it's derived (thanks nhb for your previous post a while back)

Further info here
[HTC Wildfire S] tacromx:
Kernel mtd hacked

This is the compiled kernel with Munjei's hacked mtd drivers if anyone wants to give it a try.

My fone is in pieces at the moment due to Jtag.

So if someone can please try it

thanks
[HTC Wildfire S] munjeni:
That layout I added is for htc aria!!! So you need to modify nandhack to look like your partition layout!

Ok, I gave you an example and simple module (that is for htc aria, and working for sure in aria, I tested and posted on my git), so you can adjust these module for your needs...

Hey, I found something (io error) while trying to erase hboot partition (maped as a mtd partition after insmod nandhack module), io error is after something about oob data, so I think hboot partition is treated same as system, data,cache...etc (that is yaffs), I have idea, maybe we need to hack msm_nand.c and treat hboot partition as a raw partition.... what you think? I think oob data is only problem (preventing us to erase that partition)!

EDIT:

Direct message from adb console:

dd if=/dev/zero of=/dev/mtd/mtd6 bs=131072
/dev/mtd/mtd6: write error: I/O error
1+0 records in
0+0 records out
0 bytes transferred in 0.003 secs (0 bytes/sec)

and message from dmesg:

<3>[ 2152.519165] msm_nand_write_oob 2400000 8000 0 failed -5

But when I use block device, I have no error in adb console:

dd if=/dev/zero of=/dev/block/mtdblock6 bs=131072
/dev/block/mtdblock6: write error: No space left on device
5+0 records in
4+0 records out
524288 bytes transferred in 0.019 secs (27594105 bytes/sec)

but a lot of errors (oob ?) in dmesg:

http://paste.ubuntu.com/1039706/

Dma_map and oob !!??
[HTC Wildfire S] tacromx:
ok no problem, i'll sort it.
[HTC Wildfire S] no.human.being:
As far as I remember it didn't turn out to be that "exotic" in the end. It was just the 7.53 layout on a 7.54 Radio or something like that. So it wasn't all that different, it was just one of the "exceptions" that made our "Radio version determines partition layout" assumption invalid.

I guess it also has another HBOOT (it's no longer 1.09.0099 but 1.10.0099 right?) so we probably gotta go through all the reverse-engineering for this one as well, since the function that queries the secu_flag will probably have been relocated.

In addition, we'll have to figure out how the partitions are laid out in NAND. You can give us a starting point by executing "cat /proc/mtd" on your phone and posting the results here. Then we can do the calculation of all the physical offsets of the partitions and determine how large the Radio is on your phone. Please also tell us your exact RADIO and HBOOT version as shown by the phone when booted into the bootloader with Vol-Down key held.

If you want us to support that firmware version, you'll finally have to dump your Radio partition and upload to us (especially me and BeciMester) for analysis. Remember that the Radio partition may contain sensitive information. It contains your IMEI and several serial numbers and identifiers of your device. With this image, it's possible to create a "clone" of the device that will look like your device to the network. "Personal data" (like text messages, WLAN keys, account passwords, etc.) are most likely not contained in the Radio partition.
[HTC Wildfire S] munjeni:
When you read dmesg about "line 403 in msm_nand.c", line 403 in msm_nand looks like:

395 msm_nand_dma_map(struct device *dev, void *addr, size_t size,
396	enum dma_data_direction dir)
397 {
398	struct page *page;
399	unsigned long offset = (unsigned long)addr & ~PAGE_MASK;
400	if (virt_addr_valid(addr))
401	page = virt_to_page(addr);
402	else {
403	if (WARN_ON(size + offset > PAGE_SIZE))
404	return ~0;
405	page = vmalloc_to_page(addr);
406	}
407	return dma_map_page(dev, page, offset, size, dir);
408 }

if (virt_addr_valid(addr)) ... so invalid virtual adresse!!! Why, I realy not understand. Maybe hboot is in diferent memory bank?

And very interested multiple lines in dmesg about "<3>[ 2405.952636] msm_nand_read_oob: failed to get dma addr for d7bc6000", so interested thing is what is inside 0xd7bc6000 or why nand module looking for that adress many many times? Allso, very interested thing "WARN_ON(size + offset > PAGE_SIZE", so hboot block sizeof is not 0x20000 like system partition or any other that is accesible now for us? Or what? Ideas? I think there is security trick (missing code in kernel) instead of real security, but we need to understand what and where to look for possibly hack. I think key (as I thinked before) is in nand driver, and when we made right modification to msm nand module, we will broke that security! Nand have write/erase "abort on error", so that reason why our operation fail, but maybe we can "do" force something?
[HTC Wildfire S] no.human.being:
How did you do that? "dd" doesn't accept mtd devices as source/destination for me, only block devices. Mind that you have to explicitely erase the NAND (with a build of "mtdutils", e. g. the one contained in the release of my exploit package) before you can reliably write to it.

Which kernel do you use? CyanogenMod 7.2 (Alquez/Drowningchild) and CWM kernel do not implement the "mtdblock" devices. They are bogus and will always return "I/O error", not only on protected NAND regions but EVERYWHERE, even on regular partitions. Even reads fail immediately. I'm quite certain that they are just empty device nodes with no driver behind and "mtdblock" driver is missing from these kernels. The regular "mtd" devices will work though (but usually not with "dd").
[HTC Wildfire S] munjeni:
No, I using cyanogenmod kernel 2.6.35 (you can see direct link to "initial source" in my git (no ics kernel for aria)... using these kernel I have direct acces to char mtd, I can erase every partition "that is erasable for us" (verified that thing many times, its realy erased, but to do it you need to set proper block size to dd like I done "131072")...
[HTC Wildfire S] no.human.being:
Wait, let me just check again. You can just write zeros over an mtd using dd and then that partition will be clean? That's actually quite interesting. The "mtd" handles are supposed to be "dumb" and not provide "FTL-like semantics" (like in-place overwriting) and only provide sequential access (no seeking). That's the reason why there are "mtdblock" devices, which have these semantics implemented (in a very primitive way, so they will allow random access and in-place overwriting but won't provide for example wear-levelling and bad-block replacement). See here for more.

Someone here tried writing to an mtd handle without explicitely erasing it before and almost ended up with a bricked phone because the NAND content became extremely corrupted around the place that was written to without prior erasure. NAND always has to be erased before it can be written to, otherwise "undefined behaviour" may occur (which usually results in data corruption) and the mtd driver is not supposed to do that erasure on its own. The erasure usually only happens after an explicit request from a userspace utility (like "mtdutils").
[HTC Wildfire S] munjeni:
I am not surre now if data was 0 or 0xff after dd erasure, but I will let you know in the morning when I do it again for example to boot partition ! A bout mtd utils, I know thats the best tool for us, but using mtd utils I am not able to erase/write to for example hboot partition like all other methods that I tried (absolutely no way)! Mtutils use our krnel msm_nand driver and thats the real thing,so we can do nothing to an protected block while using an mtd tool, and I think thats the real thing (tried many times)!

And yes, I always erasing before writing ! Thats reason why I implemented allways erasure script to my rom,so users while installing my rom allways have erased partition before rom is installed.
[HTC Wildfire S] Sneiben:
No. My hboot are 1.09.0099 only things that got updated was the radio 7.57.39.10M and the software to 2.26.401.3 and a new kernel 2.6.35.10-g696f19b htc-kernel@and18-2 #1 couldn't start the cat/program/mtd stuff little new to this if it helps i can upload the fota zip
[HTC Wildfire S] no.human.being:
How did you erase it? I know of two ways and one is using mtdutils and the other is making a kernel call. For the second option I have no idea how to do that actually, I just know that such a call must exist, since mtdutils is userspace code and has to call some code in kernel space to get actual work done. In the end it will involve some calls to "ioctl(...)".

Erasing and writing zeroes/ones over it do different things to the memory. The persistent storage in our phone is NAND memory, which is a variation of EEPROM. EEPROM memory consists of so-called "floating-gate FETs", which is a variation of the field-effect transistor.

A field-effect transistor has four terminals called "drain", "source", "gate" and "substrate". The former three are actual "terminals", the latter is just a connection to the semiconducting material surrounding the transistor. The potential difference between "gate" and "source" controls the flow of electrical current from "drain" to "source".

When a cell is erased, it usually reads as high (1) bit. When a cell is programmed, it usually reads as low (0) bit. Programming a cell (turning 1 into 0) requires the transistor to be turned on (sufficient potential difference between "gate" and "source") and sending a current into its "drain". Erasing a cell (turning 0 into 1) requires the transistor's gate to be grounded and voltage applied to its substrate. Since lots of transistors share common substrate you can only erase fairly large blocks (128 KiB + OOB with the NAND in our phone), while you can program in smaller pages (2 KiB + OOB with the NAND in our phone) but can only program the 64 pages in a block in sequential order (and program all of them before moving to another block), while you can program and erase entire blocks in a random-access fashion.

So while a page that is in an erased state will read as containing 2048 times the byte 0xff, its electrical state will be distinct from a page that is programmed to contain 2048 times the byte 0xff. Writing to a page will always "program" but never "erase". Only the correct kernel call will actually return the NAND to an erased state. Therefore, attempting to "erase" by writing 0xff using dd (or any other utility that does "fwrite(...)" to the mtd handle) will not actually "erase" the page, but instead attempt to program a page that is already programmed to the value 2048x 0xff which will usually corrupt the page's state and not return it to its erased state. One person in this forum has USB-bricked his phone by "restoring" a backup of his "misc" partition without erasing the NAND first, which resulted in the NAND pages that make up the "misc" partition becoming entirely corrupted.