yashsingh1/xdaforums huggingface dataset:
[T-Mobile myTouch 4G Slide] gtmaster303:
Idea for you, and possibly a fix!

Hey blue, you should try sending your phone into HTC.

Update it to the latest OTA and then complain to them that the phone is acting up after updating. Ask them if they can revert the phone back to the original retail release, or any other previous version.

The OTA is kinda buggy right now, so HTC are not installing it on any phones (even ones that come in for repairs).

We may not have the power to downgrade the hboot yet, but I'm sure HTC does. Worth a shot if you want a sure fire way of getting back to 1.44.007
[T-Mobile myTouch 4G Slide] yogi2010:
@tbalden: have we confirmed that you have made a proper image file to flash to our misc partition? i feel pretty sure that we can downgrade from the new update, provided that we have a proper misc image file to flash.

---------- Post added at 06:17 PM ---------- Previous post was at 05:44 PM ----------

another thought: could it be that the reason we haven't achieved this yet is that the HTC Unlock is not enough? that method supposedly lets you write to your system, boot and recovery partitions, but keeps radio and hboot, and presumably misc partitions locked down.
[T-Mobile myTouch 4G Slide] thrice43:
I have high hopes for the misc.img working
[T-Mobile myTouch 4G Slide] Blue6IX:
The point is not to get my phone back to 1.44.0007.

The point is to find out how to get everyone else's phones to 1.44.0007 so they can run revolutionary and get s-off.

...or figure out how to get s-off another way.

I am sure it will - i've been pretty busy the last week.

I am clearing cobwebs out of my head now, just woke up, and am gonna spend some time on this tonight.
[T-Mobile myTouch 4G Slide] yogi2010:
I found some simple instructions for getting root access in an adb shell, then flashing the appropriate image to the misc partiition.. and then of course being able to downgrade to the 1.44.0007 hboot/firmware. So I think/hope our issue is just a matter of having the proper misc image to flash.

There might be more than one way to flash the image... I did find one way in a thread for downgrading the Evo... will post the link later on..
[T-Mobile myTouch 4G Slide] Blue6IX:
I haven't looked closely enough at that part of it yet to tell, hoping to review it sometime tonight.

We won't have one old enough - we have to get back to at the very least 1.28.531.8 - our original pg59img.zip file is for 1.28.531.9 (retail launch) and i don't think that the new partition protections allow for flashing the same image, only newer.

So if we can't spoof just the number, we'll have to make a new misc.version

If you can flash the same version we can pull the misc.version from any 1.28.531.9 phone and be done with it. If not, then we need something older - which doesn't exist that we know of.

Our only hope would be someone like daniel who had a 1.44.0006 hboot that was an already s-off phone, but he's long since flashed over his misc.version image so that's lost to us.

----

We do have two pre-release radios, so they give us something to look at in comparing s-on stuff, and might provide a clue in getting our result.

I'm still kinda waking up and trying to come to terms with reality, so starting to review all of this and try to get myself back into the dev mindframe.
[T-Mobile myTouch 4G Slide] yogi2010:
I know little about this, but the dev who responded to me in the thread said if we have any image pulled from a misc partition on our device, changing the version number is a simple matter of a hex edit. Again tho, I am just repeating what he said.
[T-Mobile myTouch 4G Slide] mrbmg:
There has to be a way after root, to either downgrade, or at least swap the hboot numbers tricking it into thinking it has the old hboot. I'm trying to look through some of the old g2 guides and see, because I do remember people hexediting the boot.img or something to that effect. I don't know how to do all that, but it seems if the older hboot that can be s-off, is extracted, we can trick the new hboot into thinking it is that.
[T-Mobile myTouch 4G Slide] Blue6IX:
S-off isn't determined by the hboot. I've flashed s-on hboots, from virgin doubleshot devices to mine, and they still read s-off.

hboot is a very small part of the key, if even a part of it at all.
[T-Mobile myTouch 4G Slide] Ohgami_Ichiro:
There WAS an older version leaked. I know this because I had downloaded it and there were a couple of roms based off it. I think there were 2 prerelease now that I think of it. But sadly it was HTC911 that had it. Maybe football might know where to find it.
[T-Mobile myTouch 4G Slide] Blue6IX:
I know nothing of this?

We have 2 pre release radios linked here ( power went out at my house, looking them up is cumbersome through this app )

You can find them here in dev or I'm pretty sure I linked them up in the radio section of my dev reference.

That hopefully isn't what you are referring to because those packages only include the radio partition which is of limited (if any) help.

Are you talking about a whole pre-release ROM like the pg59img.zip packages we have?

I wish i'd known about this sooner - this is the first mention of such I've heard of here at xda...

What is htc911?
[T-Mobile myTouch 4G Slide] tbalden:
Yes, there was a prerelease, and ported to g2. I dont have any image tho.

sent from HTC Doubleshot pyroiced
[T-Mobile myTouch 4G Slide] yogi2010:
http://shipped-roms.com/index.php?category=android&model=Doubleshot

there it is, i had totally forgotten about this, just wasn't thinking it was of any use!

is it possible that if we flash this, we could pull the misc partition off it, and just flash that to any device stuck with S-ON on the new update, since the version number would be lower than even the original factory launch ROM? the version number on this is 1.01.531.1.

i have the zip downloaded, and it doesn't flash thru the bootloader, so it must flash thru recovery. and it doesn't really look to me like a full ROM, but more like some kind test build, judging from the small amount of apk's in the system/app folder. but it does seem to be a full flashable package, with radio, sbl's, etc.
[T-Mobile myTouch 4G Slide] Ohgami_Ichiro:
Yeah I had one downloaded about 9 months ago and I remember after that another one popped up closer to release. I can try to check my archives and see if I still have it but I am pretty certain I deleted it.

HTC911 was HTC Rom leak site. It was sadly shut down but he leaked a ton of prerelease roms. Now we mostly have to depend on football for releases. He's been a good guy about being careful and mostly just releases here on xda.
[T-Mobile myTouch 4G Slide] thrice43:
With version 1.55.531.3

I think dd'ing the insecure boot image for the new 1.55.531.3 version to the the mmcblk0p## containing the boot image, rebooting, and then dd'ing the modified misc.img containing the characters 1.01.531.1 in hex instead of 1.55.531.3 to mmcblk0p31 and the identical mmcblk0p16, and finally using PG59IMG.zip containing retail release 1.28.531.9 in hboot will cause the phone to think it needs to write to hboot, so it'll update it to hboot version 1.44.0007.
[T-Mobile myTouch 4G Slide] xzuhto:
In theory this sounds great. Now to find a guinea pig....
[T-Mobile myTouch 4G Slide] Blue6IX:
Yep. This should work, it jives with everything i've learned about what we're doing (the last few weeks of around the clock research minus work is quite a bit)

I am downloading the pre-release ROM as soon a I finish typing this, it'll block up my net connection for a few hours. If I can't get my S-ON phone tested before work tonight i'll do it as soon as I get in tomorrow morning.

If it works on my S-ON phone, we can try on a factory S-ON phone - mine may not be the equivalent of factory S-ON, but if it works for me it should work for a factory phone.

If it bricks my phone from a mismatch of some sort, i'll be willing to take the risk just like I did flipping to S-ON.
[T-Mobile myTouch 4G Slide] xzuhto:
If it works for you I might be willing to be the next tester.
[T-Mobile myTouch 4G Slide] Blue6IX:
Notes:

-Filesystem protected ... even when all comes back that version number was successfully changed, it is not upon inspection of both partitions 16 and 31.

Easy avenues of modifying software version unsuccessful.

Other methods available, will start further testing on the morrow.

(this is a group effort - we are trying)
[T-Mobile myTouch 4G Slide] xzuhto:
Well that's a shame. Slow and steady it'll happen. I'm still keeping an eye out here in case I can be of any use.

Swype screwed me on the original message.
[T-Mobile myTouch 4G Slide] Indirect:
I was told by a little bird that you guys might need some help. If someone feels like PM'ing me with some info, the misc.img from the partition, and the version number of the last s-off'able version, I can try to help out. I don't have a device so, I can't test. :| Anyone wanna be a guinea pig? ^_^
[T-Mobile myTouch 4G Slide] Indirect:
PROGRESS! We made some decent progress, we currently have rewritten misc.img of mmcblk0p16 without any kind of issue while in recovery meaning, recovery atleast gives write access to one of the 2 partitions. I'll give a link to my misc.img's as soon as i feel like uploading. I would have gotten a pic of it, but oh well. :( Anyway, now onto seeing if that changed the version of the device completely or if we need a new exploit to change blk31 :|

Download link to my 2 misc images:

http://dl.dropbox.com/u/15069134/MiscPartitions.zip

MD5's of each image:

misc31.img eb977c326de7b6135750c3be6c220140

misc16.img 40a9008a1c33f749648b953fef40a9e2

Not bad for someone who just went in without a device. :)
[T-Mobile myTouch 4G Slide] Indirect:
Update 2: We now have compromised misc.img! :D Busybox from recovery helped us out with cp (copy) and it still boots and both partitions are edited. :3
[T-Mobile myTouch 4G Slide] mrbmg:
I don't even have this device anymore, but man, I really appreciate all your help and info leading up to all this. Its amazing to me the knowledge one person can bring to the table, from one to another. My wife has the phone and I'm ready to hook it up!!
[T-Mobile myTouch 4G Slide] thrice43:
Have you tried flashing the stock PG59IMG.zip? If you try to flash the PG59IMG.zip release version from t-mobile which contains hboot version 1.44.0007 and it writes the hboot instead of skipping over it, then we got ourselves a method of downgrading for sure. Make sure that the misc.img written contains a version less than 1.44.0007 so it'll think it needs to update. A valid hboot version other than 1.44.0007 is 1.44.0006.

And oh yah. Why use cp? I'm not sure if it'll result in the same mmcblk0p## as "dd if=modded.IMG of=/dev/block/mmcblk0p16". Does it stick after reboot?
[T-Mobile myTouch 4G Slide] Coug76:
Indirect doesn't have our device. He is working blind.

Hastily spouted for your befuddlement.
[T-Mobile myTouch 4G Slide] Indirect:
Turns out you can't dd block 16 or 12 (second misc + hboot) so I think we could potentially attack through init.rc where it sets everything up for the radio.

Also, we can't just change the version of hboot, since it's contained within block 12 (hboot partition) so, until we can get write access to that partition, we're boned. I'll keep trying but this further shows why I would need a device. :| having to wait for testers suck.
[T-Mobile myTouch 4G Slide] yogi2010:
Just so you know, aside from HTC bootloader unlock, we also have tacoroot(the only temp-root that works on the newest firmware). It potentially puts the phone in a bootloop, but does give root access in adb shell. Not sure if it gives any extra write priviledges, but just letting ya know.

https://github.com/CunningLogic/TacoRoot
[T-Mobile myTouch 4G Slide] Indirect:
I know all about Tacoroot. I talked with jcase about it a while ago. I planned on using it for the final revision of my work. :P
[T-Mobile myTouch 4G Slide] Emmanuel U:
guys take a look at this http://xdaforums.com/showthread.php?t=1526316
[T-Mobile myTouch 4G Slide] Indirect:
Xmc, we already have misc taken over. I would prefer if people at least manually do this for now.
[T-Mobile myTouch 4G Slide] Blue6IX:
Good find XMC, this works to change the version # on both partition 16 and 31 of my s-on device.

...and i've got an idea, gonna try some stuff real quick.
[T-Mobile myTouch 4G Slide] strapped365:
Holy ish** does that mean xmc blue and indirect have raepd the bootloader? I sure do hope so, or at least one step closer, keep at it guys
[T-Mobile myTouch 4G Slide] Blue6IX:
Okay, so, i've gotten dd copies of all the partitions on the device in various stages - s-on, off, locked and unlocked.

I have complete partition archives for 3 separate doubleshots in some form of those configurations for the software versions of 1.28.531.9, 1.55.531.3 and 1.63.531.2

I have been comparing directly in a hex editor partitions from all 3 doubleshots all day long, since the last posting I made without pause, and to say I have learned a lot is an understatement.

My new MicroSD card came in today and I haven't even opened it yet, 64 gigs of happiness is still in it's packaging because of how wrapped up in this i've been.

I learned some of the ways the rev method preserves S-OFF through the software updates, but not necessarily how they are done.

I've gained a much more thorough understanding of what's on our partitions and how they work together.

There is still a lot of work ahead of me in comparing them, but quite a bit more is apparent to me thus far and i'm eager to continue with going through it.

Just wanted to give an update on where i'm at since i'm taking a break for breakfast now - i've definitely got a lot to share over the next few days as I get my notes sorted out.

I can probably get my device S-OFF again based on the partition images I have here now, but that doesn't help the collective get a method down - still, if I can do so then I can gather more partition images to add to what I don't have yet and compare them.

It's interesting and enlightening to see the differences between s on and off, unlock and lock, and from device to device.

I've also managed a root prompt in an adb shell without tacoroot on the 1.55.531.3 software version for my s-on phone. This wasn't from any other tools, either, so I actually devved something lol.

Much more to follow as I can, but right now i'm starving and need to clear my head a bit.

Be back in the dev chair soon...
[T-Mobile myTouch 4G Slide] Blue6IX:
mmcblk0p1 is most likely SBL1

mmcblk0p7 is most likely a backup of mmcblk0p1

mmcblk0p2 is most likely SBL2

mmcblk0p8 is most likely a backup of mmcblk0p2

mmcblk0p9 is most likely SBL3

mmcblk0p10 is most likely RPM (real time power management)

mmcblk0p11 is most likely TZ (Trust Zone) and looks like it could brick on mismatch.

Also seems at least semi-responsible for eMMC write protection, simlock, and verification of bootloader (bootloader not necessarily being just hboot) as well as many other things.

--------

mmcblk0p3 - stores S-ON or OFF flag, also simlock/simunlock flag.

Important find with mmcblk0p3 - would've missed if I didn't have 3 doubleshots to compare partitions to.

The S-ON device had a different marker after security, the two S-OFF devices had identical markers following security

Will be verifying with juggle of S-ON/OFF.

Will be verifying simlock/unlock as well - after work today. Simunlock has different flags following on all 3 devices - most likely due to unique unlock codes? (speculation on why for simunlock)

--------

Much more to follow... isn't a hexeditor a fun tool?
[T-Mobile myTouch 4G Slide] Indirect:
Yeah. Mmcblk0p3 is where globatron was looking out before he found the exploit. Now shhh before you give HTC too much info!
[T-Mobile myTouch 4G Slide] Indirect:
and when you go to get that silver one, the one you have now is mine! :P Also, I was playing around when I said to shush. If you want some help with it, I won't mind when I get the device. :P
[T-Mobile myTouch 4G Slide] Blue6IX:
Lol I figured.

I'll load up it's sdcard with all the custom doubleshot software I've written so you don't have to download it all, like the insecure boot images and custom pg59's for recoveries and so forth, as well as all the HTC signed pg59's - shame we don't have an actual RUU for the doubleshot.

The rumor is that the latest update will resume on the 9th, only a few days away, so I'll time my release of the S-OFF method for the new software version to be right behind their release so it's a hack for the most current software and they'll have to wait until the next update to patch it. My nod of recognition to what you mentioned before.

Hopefully that way we can maximise the number of people we get S-OFFed before they craft the next level of the game.

This S-OFF issue has really put the brakes on the other 3 major projects I was trying to tackle - my ROM, kernel work and that retarded bluetooth controller problem HTC saddled us with. Rewriting the bluetooth stack for sense from the ground up is not exactly a small project that would have been done by now if I had either ignored S-OFF or quit my job.

Neither is viable, Tmo demands their blood money and I do want a silver one, and we have too many people who bought a device just to find out they only bought a limited use lease on their hardware. This isn't apple, and it's not fair to the people who are stuck S-ON, so fixing that is the most important thing on my dev plate.

...and here I sit outside of a locked business with a 'mission critical we need our computers fixed yesterday!' Issue, which is apparently so important I've wasted almost an hour mostly typing this out on my doubleshot - I think there's gonna be a hassle tax on this bill, wasting my time is one of the few things I don't tolerate well.

( well, given my last few posts over the last few hours you can see what I walked away from... There's only so much data I can work through on the doubleshots themselves without a multi-monitor setup and all my dry erase boards and printouts. Another 22 minutes and I leave and charge them for the day anyway.)

Sent from a digital distance.
[T-Mobile myTouch 4G Slide] Indirect:
Hey, that "hassle tax" will probably cover the rest of the money for your silver double shot! :p
[T-Mobile myTouch 4G Slide] Blue6IX:
Also, forgot to mention before:

So mmcblk0p16 and mmcblk0p31 (misc) are much like how mmcblk0p7 is a backup of mmcblk0p1 (SBL1) or how mmcblk0p8 is a backup of mmcblk0p2 (SBL2).

What is interesting to note is that in version 1.28.531.9 the partitions 16 and 31 are the same as the 16 and 31 partitions from the 1.63.531.2 update, but the one in the middle 1.55.531.3 has the 16 and 31 partitions different on my S-OFF device.

Is this a function of Revolutionary or how it's supposed to be - it's only one bit change from 1.28.531.9 to 1.55.531.3 and then that bit changes back again moving forward from 1.55.531.3 to 1.63.531.2

Interesting, what does it mean? I've got an idea but what do you guys think.

(it'll be interesting to see what happens when I take a fresh one from 1.28.531.9 to 1.55.531.3 and then up to 1.63.531.2 - not sure i'll be able to say for certainty until I have that to compare it to?)
[T-Mobile myTouch 4G Slide] Indirect:
You just gave me a few ideas. I'll be working on this as soon as I get the device. i have a few attack ideas for this. I'll talk to you about them tonight on IRC.
[T-Mobile myTouch 4G Slide] Indirect:
Interesting tidbits of Hex from tz.img from 1.63 update:

hTCVer001.125.02

*HTC_MODEM_KEY
[T-Mobile myTouch 4G Slide] Blue6IX:
Oh - I got it to skip the sig check by using two computers, you need two mcrousb cords. Works consistently on windows, not tested on linux.

The device has to have already been introduced to both before starting, and should be in fastboot mode with all the right, unedited partitions from the 1.55.531.3 PG59IMG.zip file. It should be locked.

I had tacoroot installed on it, not sure if this matters?

Get the device into fastboot mode.

Plug it into one of the computers.

On the other one, have CWM 5.0.2.7 in your folder with fastboot, and rename it to recovery.img

Now, on that second computer that you are not plugged into with the doubleshot, open up the command window to the fastboot folder, and type this command:

fastboot oem boot recovery.img

...and hit enter.

It will hang on "waiting for device" I let this run for 1 minute and 30 seconds.

Then I very quickly swap the microusb on the phone from being plugged into the computer sitting there doing nothing to the one that has the command hanging there. Gotta be quick.

It then pushes the hanging command faster then the sig check can keep up, or something, and leads to the output two posts ago.

This tactic consistently produced the same results, but it failed because it overloaded with too many arguments - but it skips the sig check and tries to go ahead and just load up.

Once it fails it just moves on to the normal boot sequence and into the stock ROM, but with either a customized version of CWM or with a modified boot.img (try the same thing with fastboot oem boot boot.img - does that get us anywhere?) maybe we can use this technique to skip the sig check on a S-ON LOCKED device?

Given that it wasn't just a one-off random event we might be able to leverage it to launch an attack on the device or TZ more directly, but not with our current custom recovery - and we need to see what happens trying to fastboot oem boot a boot.img with a modified ramdisk to maybe work within the overflow limitation of this:

FAILED (status read failed (Too many links))
[T-Mobile myTouch 4G Slide] thrice43:
I don't believe "fastboot oem boot boot.img" is the valid syntax. If you run "fastboot oem boot", the phones immediately begins to boot android. I think its "fastboot boot boot.img"? But I know for a fact its not a oem command to get fastboot to boot the boot.img. 8\
[T-Mobile myTouch 4G Slide] Blue6IX:
Okay, thanks. I had used that command to try to boot the recovery image and had some limited success (posted the output a few posts back) but it didn't make it there.

I am unsure the difference between fastboot boot and fastboot oem boot, but we have both on at least the 1.45.0013 hboot.

The thought on trying to use it for a custom boot.img was really for trying to use a modified ramdisk part of it to nerf trust zone, but I didn't have a chance to try before I packaged up the device and shipped it.

The device I was testing on is now in Indirect's hands, so all i've got is my original S-OFF T-Mo subsidized plan doubleshot now. Until I can get a few days off in a row I can't really keep trying because having a smartphone is a requirement for my job - so i'm trying to get another one again for strictly dev purposes like before.

Hopefully i'll have the second doubleshot within a few days or so and can keep picking away at this problem more directly.
[T-Mobile myTouch 4G Slide] thrice43:
Np np. The difference bt the two commands I found here http://tjworld.net/wiki/Android/HTC/Vision/HbootAnalysis#FastBootModeCommands

And also, afer reading through the sensation forums reference thread, http://xdaforums.com/showthread.php?t=1232107, I realized the mt4gs basically has the same output in mmcblk0p6 as the sensation. Take a look and you'll see what I mean. I haven't tried yet but I'm quite sure we can unlock our phone using the same method ;D.
[T-Mobile myTouch 4G Slide] Indirect:
We can unlock with that. It works just fine.
[T-Mobile myTouch 4G Slide] Blue6IX:
Yea, you can - i have that copied into the dev reference here:

Notable

I got the unlock codes for 4 doubleshots that way so far.
[T-Mobile myTouch 4G Slide] thrice43:
Do you think unlocking the device would open up vulneralbilities to the cid? Maybe achieve supercid status to flash/exploit bootloader?
[T-Mobile myTouch 4G Slide] Blue6IX:
Definitely worth checking into - I wish I could try right now, i'm waiting to hear back from someone, might be able to get another doubleshot for 275 + gas to get there and back, prolly another 80ish to 100, so if it goes through I could probably grab it next friday... ( fingers crossed )

I hate being sidelined like this when there are ideas to check out