[HTC Wildfire S] no.human.being:
I don't think it is writing anywhere. I think it asks the Radio to turn the security off and the Radio knows how it's done. I don't think there is an easy opportunity to talk to the Radio from within Android. I don't think that a userspace process will be able to do it, probably only the kernel can.

Yep, I know. There are videos on Youtube where people unlock their phones with the xtc-clip and there are always lots of error messages and then the phone is S-OFF.

Yep that's exactly how it's done. The diag file checks for a smartcard to be present in the SIM slot and the xtc-clip emulates that smartcard's behaviour via a microcontroller that's located inside the clip's housing. The flex cable connects the microcontroller's GPIO (general purpose I/O) pins to the phone's SIM card slot and the microcontroller's firmware knows how to emulate the SIM.

The SIM is only checked by the diag software, there's no check on the hardware side. So principally when we could modify the diag software not to look for the SIM card, it would work without any hardware involvement.

The problem is that the diag software is signed with a certificate from HTC. It's probably in fact original HTC software that HTC's engineers use as a "backdoor" to their phones and some HTC employee has smuggled it out and sold it to the xtc-clip creators. They probably tried to remove the check for the special SIM and probably failed due to the signature, so they decided to reverse-engineer that special SIM and build a controller to emulate it, so that the diag software can remain original. If they were to modify the diag software not to look for the SIM, the signature would no longer match the modified version and HBOOT would not execute the modified diag software any more. If we were to modify the diag software, we'd of course face the same problem so this is probably a dead end as well.

This would be great. If we manage to access the Radio's persistent storage, it'll be like having "god mode" on. :D

We're finally having the big picture. We have never been so close. Thank you very very much for your efforts. This community is amazing. :D

What's really weird though is that the security storage is on a standard partition on the Desire S while it seems to reside in some obscure "hidden memory location" on the Wildfire S. I mean I'm a software developer myself and I cannot really imagine that there is a programmer who says "I'm putting it somewhere else on the MSM7227 controller than on the MSM8225 controller" considering the phones' similarity concerning both hardware and firmware and the fact that they have the same release date, stem from the same manufacturer, are based on the same microcontroller series and make use of very similar technology. It just doesn't make any sense. Even given the fact that the MSM8225's memory controller is much more advanced than the MSM7227's (e. g. the MSM8225's controller does wear levelling, erasure and bad block management in hardware while it has to be performed on the file system level at the MSM7227). It still doesn't make sense to put the data in a different location on the software side. Does anyone have a rational explanation for that?