yashsingh1/xdaforums huggingface dataset:
[HTC One X] Freezeil:
The reason for that, I believe, is that:

a. Tegra 3 devices have much different architecture (and as such, different exploits) than other devices that are based on other CPUs (like Qualcomm). Even the One XL and One S are completely different.

b. HTC Added on that defense (that is, a different and somewhat unique architecture), and used extra measures to ensure S-OFF's security in the phone itself. For example, the S-OFF flag is located in the Hboot, which is (correct me if I'm wrong) a unique partition to HTC devices. Other Tegra 3 devices that aren't HTC's don't have hboot/S-OFF is located somewhere else/have a found exploit.

Add those two together and you get the fact that it is hard (but not impossible) to find such an exploit.

However, as previously mentioned by those better than you and me, every piece of code written by a human being is hackable - nothing is perfect unless it is written by Skynet, and even then we had John Connor.

I'd also like to remember you that xmoo (OP and one of the guys that had made some real process) is supposed to meet with his S-OFF buddy any day now, as it is now July.

"There is no faith but what we make for ourselves" is a good motto here - keep fighting the good fight guys, and let xmoo and friends do his work.
[HTC One X] Kickasskev:
No, unless they have recently changed it
[HTC One X] Braindamage1989:
Before you read this I want to tell you something. I have been trying to find a way for S-OFF. I do this on my own way. Maybe it's not the way to find S-OFF at all, so please do not scream that my info is **** or useless (atleast I try to find a way that isn't mentioned a billion times)

Been digging around for a day hoping to find something S-OFF related. After I couple of hours I found this.

In the hope to find some traces to APX mode I went searching for any clue which could lead me there. First of all I found 3 files (poweroff_modem.sh, poweron_modem_fls.sh & poweron_modem_hboot.sh). All coded in plain text. Looking at the hboot one we can find some interresting lines.

/system/bin/log -p e -t MODEM "NVM Injecting file: new InjectionTool will generate empty nvm file if it doesn't exist"
/system/bin/InjectionTool -i ${backup_dir}/QUO_6260.fls.clean -o ${Injected_dir}/QUO_6260.fls -n ${work_dir} -s ${sec_dir}
/system/bin/log -p i -t MODEM "Delete sec.bin in ${sec_dir}"
rm ${sec_dir}/sec.bin

This was mentioned by Mike at the 3rd or 4th post. InjectionTool, hmmmm nice. Digging for that, found it. This is the information what was useful.

[Injection]Usage: %s -i <input file> -o <output file> -n <NVM path> [ -x -s <Sec path> -c <Cert path> ]
[Injection]Available Program Options:
[Injection] -i file The Flash input file (Required)
[Injection] -o file The Flash output file (Required)
[Injection] -n NVM_path Path to the NVM input files (Required)
[Injection] -c Cert_path Path to the certificate.bin file
[Injection] -s Sec_path Path to the sec.bin file
[Injection] -x This parameter makes the program prompt before quitting
[Injection] -q Run in quiet mode
[Injection] -v Show the version of this tool

So basiclly it uses a file called sec.bin. Look at the parameters HTC uses -i -o -s -n (no certificate). But wait, another mention of sec.bin was in poweron_modem_hboot.sh.

# Check if /rfs/sec.bin can be generated
sec_dir=/rfs/
/system/bin/make_sec_bin ${sec_dir}/sec.bin
if ls ${sec_dir}/sec.bin 2>&1 /dev/null ; then
/system/bin/log -p e -t MODEM "Gen. sec.bin SUCC in ${sec_dir}"
else
sec_dir=/data/modem_sec/
mkdir ${sec_dir} -p 2> /dev/null
/system/bin/make_sec_bin ${sec_dir}/sec.bin
/system/bin/log -p e -t MODEM "rfs seems not mounted, Gen. sec.bin SUCC in ${sec_dir}"
fi
sync

So if it doesn't exist run make_sec_bin? Aight lets look on that.

ERROR: Unable to close file ('fclose' returned EOF).
ERROR: Data not written - wrote %u/%d bytes ('fwrite' failed).
rERROR: Unable to find file (fseek returned -1).
ERROR: Data not read - read %u/%d bytes ('fread' failed).
ERROR: Missing or wrong number of input parameters.
/dev/block/mmcblk0p6

The only thing I need to hammer out for myself is where the "sec_dir" is.

And this is where my questions pops in. See the last line of the code block. Looks like a path to mmcblk0p6. I has been mentioned before, but what is this partition for? Is it possible for a S-ON One X to write in there? Anyone got an idea were all this is all about?
[HTC One X] DesmondderMondbär:
Are you kidding? I think that your are Not really clever
[HTC One X] Rekoil:
What he was saying was that the HTCDev unlock is not S-OFF, which he is correct in... it isn't.
[HTC One X] KrisPerry:
!= means "not equal to"
[HTC One X] tgascoigne:
Injection tool and the poweron scripts are just for setting up the radio firmware at boot
[HTC One X] ANDYx1975:
Is it possible to move this tread into a secret developer corner. I do not think, that it is a good idea, to share important lines... cause one thing is sure... HTC also knows this message board... and they want to fix securerity holes if you find some!!!
[HTC One X] gffmac:
Anyone wanting to preserve the ability to exploit hboot will not be updating it anyway, using roms rather than official updates.
[HTC One X] xmoo:
Ok you guys, finished everything for my school with a good grade. Done with school for next 2 months.

Tomorrow I will visit someone with S-OFF device.

Will test the DIAG file and will test a HBOOT, see what the output will be.

Will keep you up to date for tomorrow.
[HTC One X] GabrielSousa:
good luck ;)
[HTC One X] Cristianop:
Good luck hope to have s-off soon. Want to root my onex through an unofficial way xD
[HTC One X] Rekoil:
Like gffmac said, those who are wishing to use this will know not to update their HBOOT. Personally I want HTC to know about the exploits. Preferably before they are released into the wild so that they have some time to push out an update with a fixed HBOOT for the business users.
[HTC One X] Phil402:
So you recommend not to install any OTA Updates?
[HTC One X] almogas:
http://xdaforums.com/showthread.php?t=1749572

i have s off maby i can help
[HTC One X] DarkMio:
Seems like you have a S4 HOXL. Which is easily to S-Off but not helpful.

Thanks for you engagement.

(:
[HTC One X] LlabTooFeR:
S4 has Evita Codename, he has HOX with TEGRA
[HTC One X] DarkMio:
Are you sure? EndavourU is the S4 Version I thought.
[HTC One X] LlabTooFeR:
Yes I'm sure.
[HTC One X] Rekoil:
I am no authority on the matter, but it's only common sense for people who wish to exploit their hardware to stay on the earliest possible software versions until it is absolutely certain that the updated versions can be exploited as well.

EndeavorU is the Tegra 3 version. But access to an S-OFF device probably won't help much to develop an exploit for everyone.
[HTC One X] xmoo:
Guys, had a good session with the One X. I actually bricked it and got it back to life. The device was an engineering device (XE instead of PVT). Will do a full report when I'm back.
[HTC One X] doublecheese:
Result ??? S-OFF possible ??? Yes or No ???
[HTC One X] Mischaseb:
very useful to restate the entire purpose of this thread
[HTC One X] Kickasskev:
Whats the difference between XE & PVT
[HTC One X] miniudavid:
Hope you are a little step closer:-D
[HTC One X] Babydollll:
It's an engineering device. PVT are retail devices.
[HTC One X] co@ch:
http://xdaforums.com/showthread.php?p=27900376
[HTC One X] LlabTooFeR:
Here the ENG HBOOT used on tests.
[HTC One X] FordSierra88:
Hi Guys,

We should Xmoo and football very grateful for his work and donate ALL. Thank Xmoo! You are one of the best! Sorry for my bad englisch.

@ Xmoo

You should really be rewarded ! Thank you Thank you Thank you !
[HTC One X] Adrianiii:
I donated to Xmoo. He is the best.

6U980209NU8189802

Sorry if this is offtopic.
[HTC One X] Mux89:
@xmoo For your good work

(Transaktionscode 9EU82799PN467034G)
[HTC One X] backfromthestorm:
""I remembered from the HTC Leo (HD2) and ACE (Desire HD) that the early ENG/MFG/DEV HBOOT's only worked with 0.x based ROMS.""

Can't the eng hboot be modified so it'll allow roms other than 0.x ones?

So, we need the eng hboot for soff, but soff to flash the hboot. Im confused.

And on an s_on device would it not check the correct rom is in the ruu?

A few questions.
[HTC One X] Htc_One_X:
Thank you xmoo for the update, I bit the bullet and unlocked my replacement handset as it came shipped with the latest update, shame. Love the work your doing, and to travel 4 hours is insane dedication. Hope alls well with exams and good luck.
[HTC One X] xmoo:
No, this one is 100% for the One X.

Guys I appreciate all the support, love and donations. But please send your love through Twitter "@Xmoo" and keep this thread clean.

Thank you all!
[HTC One X] backfromthestorm:
Think you misunderstood me. Edited my post. Good luck anyway.
[HTC One X] xmoo:
Yes you could. If you have access to the HTC server ;) In real life I don't believe it would be posible.

The HBOOT is a ENG HBOOT. It allows you to play with a lot of commands using adb. This of removing SIM lock, perm secu flag off. You need the 0.04 HBOOT to be able to go back to normal ROM. And I don't have a signe HBOOT 0.04 in zip format. So you need to flash whole RUU.

Anyone brave enough to test it on a s-on device? Check if your CID is on the list.
[HTC One X] MonsieurDream:
You're a god, guy !! Thank you very much, good works !! I will you make a donate, much speedily !! : Rire: : Rire: : Rire: : Rire:
[HTC One X] Htc_One_X:
I'll try it mate s-on device unlocked via HTC dev, how would I do it matey.
[HTC One X] xmoo:
Use of a Y cable would be the easiest way. Else use the RUU and replace the rom.zip (remember to rename the hboot.zip to rom.zip)

Remember to make back up. Ur stuff will be lost! Goodluck.
[HTC One X] blubbers:
You are not allowed to downgrade anything, including hboot, on a s-on device.
[HTC One X] backfromthestorm:
That's what I was trying to say!
[HTC One X] Htc_One_X:
What ruu shall I use the one I'm currently on ? I broke my y cable New ones on order
[HTC One X] xmoo:
I belive with ENG HBOOTS it is posible. But with ship not.

I used the 1.29.401.11 RUU
[HTC One X] Htc_One_X:
I'll try it later, kids first lol :eek:
[HTC One X] n1kon:
How did you replace the zip as when the ruu is run the zip will be read only as its in use?
[HTC One X] xmoo:
No it aint. The RUU will be extracted in the temp directory in windows. There you can replace it.
[HTC One X] n1kon:
Ok so is the hboot restricted to those cids or the ruu? Could I flash this on tmo uk then change cid? Or is the risk that the hboot will no allow me to remove flag and change cid so would be stuck?
[HTC One X] Thunder07:
As The RUU is no more then a fancy adb/fastboot GUI i have a faster way,

which i got from the RUU itself,

adb shell reboot oem-78
fastboot flash zip my.zip

or

fastboot oem rebootRUU
fastboot flash zip my.zip

though let it be known i never used an RUU or never got past flash zip as i couldnt find a newer version than of that on my phone,

nor do i want to as i'd like to stay on 0.43 HBOOT,

so i dont know if there is anything after that
[HTC One X] xmoo:
If you phone CID does not match, I dont think it will be flashed. But if it does flash, there probably wont be any cid control, so you could flash the 0.04 hboot and after then get a wrong model id error and after that flash stock rom.

But I have not tried it. So its on your own risk.
[HTC One X] n1kon:
As is everything were do here lol. Good job I work in a phone shop lol. I'm going to give it ago.
[HTC One X] Htc_One_X:
When you say back-up prior to trying i asume you mean by recovery?

Im ready to go otherwise.
[HTC One X] xmoo:
Whatever you want to backup. I always back up my pictures, nothing else ;)
[HTC One X] n1kon:
no go for cid T-MOB005. Even tried to add cid in the info file but all i get is:

sending 'zip' (854 KB)...

FAILED (remote: (00030003))

finished. total time: 0.000s
[HTC One X] Htc_One_X:
C:\Users\Becky&Karl\Documents\One-X-Toolkit\Data>fastboot flash rom rom.zip

sending 'rom' (854 KB)... OKAY [ 0.130s]

writing 'rom'... FAILED (remote: not allowed)

finished. total time: 0.340s
[HTC One X] Thunder07:
fastboot flash zip rom.zip

Sent from my HTC One X
[HTC One X] Htc_One_X:
Just tried both your ruu method and the adb fastboot method to no avail, i have a working cid, HTC_001 and get remote: not allowed.
[HTC One X] Zulake:
How can I currently help the progress?
[HTC One X] Adrianiii:
Cant somebody make a how to do it?
[HTC One X] Htc_One_X:
Nope im sure its fastboot flash rom rom.zip . . .

Any who it failed,may be because i have s-on still.

Just ried with replacing the rom .zip and i get "ruu failed error: 171 usb"
[HTC One X] Thunder07:
I personally got that line form the RUU, granted the ruu uses -s blahblah to make sure its flashing to the right device

and it doesnt make sense to be rom as you are flashing hboot and not a rom
[HTC One X] xmoo:
What does the RUU say when it fails?

Remember to oem relock. Football said this could make a difference.
[HTC One X] Htc_One_X:
RUU Failed Error 171 Usb Connection..... And i did not know to oem relock ill try again ( Sorry kids tire me out lol )

---------- Post added at 09:35 PM ---------- Previous post was at 09:31 PM ----------

Im just doing what XMoo stated, re-name the Eng-Hboot to Rom.zip and place it in the %temp% folder when running the ruu, Or you "could" flash the r

Re-Named rom.zip via fastboot or adb all of which failed....
[HTC One X] wph:
Almost had a heart attack, tried flashing the hboot, so renamed it to img.zip.

In fastboot I entered this command:

fastboot flash rom img.zip

So the status stayed on "sending 'rom' (854 kb)" for more than 10 minutes.

Eventually pressed control+c to abort, luckily nothing had flashed and nothing was bricked.

My device is a S-On device, nothing unlocked via HTC, so completely stock.

-edit-:

like someone said before, it makes little sense to do it this way. Via fastboot it's easier to unpack the hboot and type:

fastboot flash hboot hboot_CL21401_stable.img
[HTC One X] Htc_One_X:
Just tried re-locking and trying the ruu to same result, usb error 171, going to try adb-ing then direct fastboot.

---------- Post added at 09:37 PM ---------- Previous post was at 09:36 PM ----------

Try renaming it to rom.zip in lower case, let me know your results. :good:
[HTC One X] Zulake:
I wish to help aswell, what can I do, flash or whatever else to help?
[HTC One X] oksagi:
I think the command for flash need to be: "fastboot flash zip rom.zip"

correct me if i'm wrong
[HTC One X] wph:
I tried a different method, as stated in the post above, I unpacked the hboot and typed:

fastboot flash hboot hboot_CL21401_stable.img

But it doesn't work, it gives this result:

fastboot flash hboot hboot_CL21401_stable.img

sending 'hboot' (2048 KB)...

OKAY [ 0.308s]

writing 'hboot'...

FAILED (remote: not allowed)

finished. total time: 0.566s
[HTC One X] Htc_One_X:
FAILED (command write failed (Unknown error))
[HTC One X] wph:
So I don't think we are any further. On the S-Off phone xmoo tried al this stuff it is quite logical you can flash all kinds of stuff. It was to good to be true that you just could flash a ENG Hboot on a S-On / no HTCdev phone.
[HTC One X] Zulake:
Is your CID HTC_001 or HTC_E11? I have the second one.

//What harm could it do to flash a HBOOT? Will it break the boot or whatever so I have to reinstall the RUU or can I just boot up my stock rom again after flashing HBOOT?

Otherwise I will give it a go.
[HTC One X] Htc_One_X:
If it fails ( For me any way ) itll throw an error n reboot your device, however if t flashes were still in the unknown hence xmoo asking us to be brave lo
[HTC One X] Rekoil:
Let me put it this way, if you do manage to flash it, you'll most likely be able to toggle security status and after that you can do anything you want, including flashing HBOOT-1.11.0000 which will at that time become S-OFF as well.

...and if you don't manage to flash it nothing at all will happen. So there's no harm in trying.

So, best case scenario: you will have an ENG HBOOT which can toggle security flag.

Worst case scenario: nothing happens.
[HTC One X] wph:
I have a HTC__E11.

It won't do any harm, since it can't be flashed on a stock device.
[HTC One X] Zulake:
FAILED (remote: (00000008))

FAILED (remote: (00120000))

Got those.

Trying to flash the hboot after extracting it results in a stucked 'sending'.
[HTC One X] Adrianiii:
Can you tell me how to do it? We need a guide´?
[HTC One X] MonsieurDream:
I have a CID : HTC_203 VODAP

Can I do it without worries?
[HTC One X] wph:
That's the whole point. You can't flash it.

@xmoo: please edit your posts and state that it is NOT POSSIBLE to flash the ENG HBOOT, otherwise we will have another 100+ posts asking how to flash it.
[HTC One X] h00py:
Tried flashing to my HTCDev unlocked phone. Got the following output:

EDIT: Did it wrong, derp. I'll try again.
[HTC One X] Htc_One_X:
I too tried to flash using the extracted file and flashing via fastboot and i got: "FAILED (remote: (00120000)" i have unlocked my bl again.
[HTC One X] h00py:
So you tried this?

-Relock the bootloader

-Extract the ruu

-Add eng hboot into the ruu and rezip it

-fastboot oem rebootRUU

-fastboot flash zip rom.zip
[HTC One X] Zulake:
What if you replace the 'hboot_0.95.0000.img' file with the ENG hboot in the rom.zip which is located in your temp files after opening the RUU setup?

//Wait, I repeated what you just said. My bad.

///Perhaps change the radio version and such in androidinfo.txt aswell since the HBOOT contains a different radio version and it might error out on that.
[HTC One X] N3m3515:
will break the signature
[HTC One X] h00py:
I've relocked the bootloader and added the ENG HBOOT to a new zip.

Sending the new zip now. Fingers crossed
[HTC One X] Htc_One_X:
Trying again nw, However i have just opened the Hboot file in textpad lol, and found this:

"###[ fastboot main ]###

############################

# Please detach the device #

s_KeyButton_VOL_UP_Pin handle could not be acquired s_KeyButton_VOL_DOWN_Pin handle could not be acquired s_KeyButton_PWR_Pin handle could not be acquired Start BootAndroid(0x%x)

KernelImage: 0x%x, ImageSize: %d, RamBase: 0x%x

Magic value mismatch: %c%c%c%c%c%c%c%c

Failed to setup warmboot args %x

Failed to set shmoo boot argument

Critical failure: Unable to start TF.

USB IS PLUG FASTBOOT USB USB IS UNPLUG %s NvOsMemcmp download: len = %d ,bufsize = %d , BytesRcvd = %d

DownloadCmdreceived = true

flash: zip diag image loaded: size=%d bytes, checksum=%u pg1fs_ pg2fs_ get file size = %d

FAILimage update error zimage flash zimage done.

err=%d

Flashing StorMgr partition %s

Flashing MBR to device

erase: StorMgr Formatting %s

Erasing %s

FAIL(%08x) Failed to process command %s error(0x%x)

%s Nv3pTransportReceiveTimeOut Booting recovery kernel image

Unrecoverable bootloader error (0x%08x).

Load OS now via JTAG backdoor....

Platform Pre Boot configuration...

Partition table Size =%d

Entering NvFlash recovery mode / Nv3p Server

EB2 Use scroll wheel or keyboard for movement and selection

Neither Scroll Wheel nor Keyboard are detected ...Booting OS

Checking for RCK.. press <Enter> in 5 sec to enter RCK

Press <Enter> to select, Arrow key (Left, Right) for selection move

Key driver not found.. Booting OS

Checking for RCK.. press key <Menu> in 5 sec to enter RCK

Press <Menu> to select, Home(Left) and Back(Right) for selection move

Checking for RCK.. press any key in 5 sec to enter RCK

Press scroll wheel to select, Scroll for selection move

Scroll wheel not found.. Booting OS

Press <Wake> to select, Home(Left) and Back(Right) for selection move

Press <POWER> to select item, <VOL UP> to previous item

and <VOL DOWN> to next item

Atag usage: %u bytes

[WARNING] Atag: size of atag is too large, system might hanging

add Partitions Tag.... Done....

add wifi_eeprom, 1024..... done

setting_wifi_eeprom is NULL, don't set ATAG_WIFI [ATAG] IMEI = %s [ATAG] pcb_id = 0x%x

[ATAG] engernee_id = 0x%x

serial_low = %x

serial_high = %x"

Now its the first 2-3 lines im interesting when booting it looks as if the phone is looking for a key combo, just a shot in the dark, i am not a software geek or hardware just browsing, it mentions apx mode and key combo v+,v- and power button . . . .
[HTC One X] h00py:
After repacking the ENG HBOOT into a new zip and flashing:

C:\Users\craig>fastboot flash zip C:\Users\craig\Downloads\rom.zip
sending 'zip' (576884 KB)...
OKAY [ 74.803s]
writing 'zip'...
(bootloader) signature checking...
FAILED (remote: 12 signature verify fail)
finished. total time: 110.004s
[HTC One X] Thunder07:
its for booting into android
[HTC One X] Zulake:
Did you edit androidinfo.txt? Might be due to wrong radioversion in there etc?

//Found this in androidinfo.txt:

hbootpreupdate:12
RadioVer: 0.120201.02.01

Perhaps that's the "12" it's referring to in the error?
[HTC One X] wph:
If the signature check fails, it doesn't even matter what's in that .txt file. The system detects that files have changed, so the signature mismatches. Nothing you can do about that.
[HTC One X] Zulake:
I wish we could edit files and clone the signatures aswell...:p
[HTC One X] Alex240188:
ok, doing from fastboot gets you "not allowed"

doing from RUU loader got me a variety of error messages

command write failed (unknown error)

FAILED (remote: (00120000))

FAILED (remote: (00030003))

FAILED (remote: 99 unknown fail)

or just stuck on sending
[HTC One X] Thunder07:
i just tried it myself and i get a different error

sending 'zip' (854 KB)...
OKAY [ 0.123s]
writing 'zip'...
FAILED (remote: 99 unknown fail)
finished. total time: 0.580s

though it might be because im unlocked..... but

not only that my radio version no. changed :/

i've noticed it before when i was playing with RUU but i thought my eyes were playing games on me

Edit:After Relock

ummmm...

my CID is o2___001 which is not included...but

am i meant to get this error??

sending 'zip' (854 KB)...
OKAY [ 0.124s]
writing 'zip'...
(bootloader) signature checking...
FAILED (remote: 12 signature verify fail)
finished. total time: 0.412s
[HTC One X] h00py:
So we're back to trying to bypass signature verification? :(
[HTC One X] Evil-Dragon:
I'm having a quick look at this ENG Hboot with IDA, see if anything interesting pops up (e.g. security related)
[HTC One X] h00py:
I think we're supposed to be adding the ENG HBOOT to the RUU and not just flashing the ENG HBOOT zip file that we downloaded.
[HTC One X] Zulake:
Somehow I have the feeling we're all very close to our goal but that we're overlooking something essential. Of course it's most likely something very little, like 1 word or command as per usual with such situations.

I mean, we have an ENG HBOOT, and the only hurdle to take now is the trick to get it onto the phone.
[HTC One X] wph:
Yes, we are. So nothing changed and worse: now nothing in the foreseeable future to look ahead to. This was not what I had in mind when I bought this device. I can't root it, no S-Off, nothing. Stuck on stock rom, waiting already more than a month on a update to fix lots of stuff and at the mercy of HTC to get an update to Jelly Bean if it pleases them.

Only option is HTCdev with the possibility of voiding my warranty (and already had to send it back twice, so that *is* important to me), so that isn't a real option.

I could live without S-Off if I had at least root, so I can flash ROM's. And what's even worse, development will die out a lot sooner. Not every dev wants to risk their warranty and even if they will, without users to flash their stuff there is little fun in developing. [/rant]
[HTC One X] Thunder07:
if you read few post back, i explained who RUU is just a glorified adb/fastboot GUI

all it does is check for the phone boot into RUU and flashes using fastboot,

1)adb devices

2)adb shell reboot oem-78

3)fastboot getvar boot-mode

4)fastboot erase cache

3)fastboot flash zip my.zip

also somewhere inbetween it checks for battery and correct build

so it makes no difference running the RUU or my way as its the RUU way

I LOL'ed so hard when i read this..... name me one dev