[T-Mobile myTouch 4G Slide] Blue6IX:
Given that trust zone is the gatekeeper, i've been sitting here working on ways to trick it into thinking that what i'm doing is something i'm supposed to be able to do.

Some of us may have realized by now that when the device is locked/relocked, if your partitions don't pass the carious checks (boot, recovery...) it won't let you get past hboot and stop you right there at the door with that "security warning" label on the top of the hboot screen in the ugly pink.

We also know that trying to fastboot boot cwm 5.0.2.7 is against the rules, according to TZ, same with the fastboot oem boot command, but I was able to get this far and gather some more clues:

(bootloader) Boot/Recovery signature checking...
(bootloader) setup_tag addr=0x48000100 cmdline add=0x801E59D0
(bootloader) TAG:Ramdisk OK
(bootloader) TAG:skuid 0x28500
(bootloader) TAG:hero panel = 0x2940024
(bootloader) TAG:engineerid = 0x1
(bootloader) TAG: PS ID = 0x0
(bootloader) Device CID is not super CID
(bootloader) CID is T-MOB010
(bootloader) setting->cid::T-MOB010
(bootloader) serial number: [B]REMOVED[/B]
(bootloader) commandline from head: console=ttyHSL0 androidboot.hardware=
(bootloader) doubleshot no_console_suspend=1
(bootloader) command line length =590
(bootloader) active commandline: poweron_status=1 board_doubleshot.disabl
(bootloader) e_uart3=0 diag.enabled=0 board_doubleshot.debug_uart=0 userd
(bootloader) ata_sel=0 androidboot.emmc=true androidboot.pagesize=2048 sk
(bootloader) uid=0 ddt=20 androidboot.lb=1 androidboot.baseband=11.16.350
(bootloader) 4.20_2 androidboot.cid=T-MOB010 androidboot.batt_poweron=go
(bootloader) od_battery androidboot.carrier=TMUS androidboot.mid=PG591000
(bootloader) 0 androidboot.keycaps=qwerty androidboot.dq=FAIL androidboot
(bootloader) .mode=normal androidboot.serialno=[B]REMOVED[/B] androidboot.b
(bootloader) ootloader=1.45.0013 zygote_oneshot=off msm_watchdog.enable=1
(bootloader) console=ttyHSL0 androidboot.hardware=doubleshot no_console_
(bootloader) suspend=1
(bootloader) aARM_Partion[0].name=misc
(bootloader) aARM_Partion[1].name=recovery
(bootloader) aARM_Partion[2].name=boot
(bootloader) aARM_Partion[3].name=system
(bootloader) aARM_Partion[4].name=cache
(bootloader) aARM_Partion[5].name=userdata
(bootloader) aARM_Partion[6].name=devlog
(bootloader) aARM_Partion[7].name=pdata
(bootloader) aARM_Partion[8].name=radio
(bootloader) aARM_Partion[9].name=adsp
(bootloader) aARM_Partion[A].name=radio_config
(bootloader) aARM_Partion[B].name=modem_st1
(bootloader) aARM_Partion[C].name=modem_st2
(bootloader) partition number=13
(bootloader) Valid partition num=13
(bootloader) TZ_HTC_SVC_SET_DDR_MPU ret = 0
(bootloader) smem 50005000 (phy 50005000): TZ_HTC_SVC_UPDATE_SMEM ret = 0
(bootloader) TZ_HTC_SVC_LOG_OPERATOR ret = 0
(bootloader) TZ_HTC_SVC_MEMPROT ret = 0
(bootloader) TZ_HTC_SVC_DISABLE ret = 6381568 (0x616000)
(bootloader) jump_to_kernel: machine_id(3149), tags_addr(0x48000100), ker
(bootloader) nel_addr(0x48008000)
(bootloader) -------------------hboot boot time:69399 msec
FAILED (status read failed (Too many links))
finished. total time: 3.891s

...so i'm thinking a modified CWM might be able to sneak past, but that doesn't necessarily get us anything worthwhile other then an oblique mission I was trying to fulfill while testing the parameters under which TZ can act.

All the partitions on the device are the ones from the HTC signed 1.55.531.3 PG59IMG.zip file, the device is S-ON and LOCKED when it provided this output and then on failed (but not because it wasn't allowed, but for another reason) it proceeded to continue on a normal boot sequence into the stock ROM itself.

Definitely better output then

Failed: remote not allowed

or for a sig check, etcetera, etcetera...

So while i've been at this for all of my free time except for when I was out working and I have another shift coming up very shortly, hopefully someone else can get something else out of this while i'm busy with those annoying responsibilities I have to go shoulder when I would rather be sitting here working on this.

Not exactly the progress (if it can be called that?) that I was looking for, not even the mission I was on at the time as my purpose was primarily on something else entirely - but also worth noting is the CWM 5.0.2.7 I was trying to fastboot oem boot was renamed to 'recovery.img' for this escapade.

Figured i'd share in case someone else can use this info for anything, I did edit out the serial number of the device in the two places it appeared in the output - otherwise it is unchanged from the console window I copied it from.

However much progress wasn't made, it didn't fail a sig check, and the CWM recovery is certainly not sporting a valid signature, so that in itself hints at a weakness or limitation on the TZ guardian without actually editing/modifying said guardian.

I can consistently reproduce this at leisure, so hopefully while i'm out I can think of a way of using this inch to take another piece of the mile we need to grab to make this happen.

If TZ decides to let me pass the rest of it should be a cakewalk, so it's either convincing it that i'm legit or taking away it's authority to make that call.

I'll see what I can do about passing a custom boot image instead of CWM, as that is a much stronger platform to mount an offensive from which puts many more options at our disposal then CWM would. ...but a custom recovery that accepts an adb shell is significant tactical advantage in the the skirmish.