yashsingh1/xdaforums huggingface dataset:
[HTC One X] vincenzo697:
I can't understand why you are so negative to any other options, I asked for something simple because I want to check something.
[HTC One X] vincenzo697:
Yeah but somefiles we can see them with s-off and not with s-on isn't this right?

And I never said " So if you magically drop the files on an S-ON device.. *poof* OMG, i never thought that was possible!"
[HTC One X] KrisPerry:
So what do you suggest
[HTC One X] Erik Lieders:
to find hardware crackers (as AIR team which cracked and emulated USB Dongle)
[HTC One X] dryan433:
This is mad I recently had the update from o2 uk and mine stayed on bootloader 0.94 it never updated to 0.96 that's a bit puzzling lol
[HTC One X] danlat1415:
Has anyone considered examining the read/write code of an average RUU file?

Because these have the ability to write at a low level and flash hboot.

It could be possible to find the execution code for writing, but also look at modifying a RUU so we can flash whatever hboot or modified hboot we like...

As the RUU itself isn't open source it could be considered piracy though. Only the ROM inside the RUU is open source.
[HTC One X] Drefsab:
Ruus would be simple to use if you knew how to digitally sign your files with htcs private encryption key. Thats something we cant do. If we could break the phones check on this we would be almost home free, hence why people are looking for exploits.
[HTC One X] danlat1415:
Ok, so maybe not compile a modified RUU, but maybe decode the RUU to check the write script for hboot. This could shed light on how HTC recovery is used as this has full privileges to the phone, whereas clockwork recovery has limited access due to hboot.
[HTC One X] BenPope:
You don't understand. There is nothing special about an RUU. It just just wraps the same commands you can do with fastboot/adb. Hboot checks the signature of the files to prevent unsigned code from being transferred to protected memory regions. The protection is on the phone, not the flashing tool.
[HTC One X] Drefsab:
Exactly the ruu process is well understood its not doing anything special its just pushing files signed with htcs private key that the phone then knows it can trust. Any attempt to modify the files breaks the sig, we cant sign with htcs private key so the only hope in that method of attack is to break the sig check.
[HTC One X] KrisPerry:
Or interrupt the boot process
[HTC One X] forster:
Uummm, can somebody explain how to extract img from a rom? I.E. if i want to extact stock recovery from offical rom :confused: ?

Thank you in advance!
[HTC One X] BeciMester:
1) Start RUU, let it run until the welcome screen, don't touch it

2) Open Windows Explorer, click on the address bar at the top, type %temp% (including the percentage signs) and Enter, you should see your temp folder

3) Right click and select Sort by -> Date modified and Descending, you should get new headings on top like Today, Yesterday etc.

4) Under Today you should see two folders with very long names made of random characters, one of them contains the unpacked contents of the RUU, it's a lot of files, one of them is rom.zip, that's what you need; copypasta it to a safe location

5) You can go back to the running RUU and click Cancel, it will delete (almost) everything it created in the temp folder

6) Unzip the rom.zip file you saved, it has all the flashable files inside

7) ...

8) PROFIT!

I'm on my 1X...
[HTC One X] KrisPerry:
What about some sort of timing attack
[HTC One X] KrisPerry:
There is a member on here Urban strata who works for HTC. Could he help
[HTC One X] muamers:
Weird :confused: are you HTCdev unlocked ?
[HTC One X] Kickasskev:
Has anyone asked him? If they did ask it would look better coming from a recognised developer and not just anybody
[HTC One X] :
I had another idea. In some partition wherever CID is located, you will see two CID's. take the first one and change it to htc cid as if you had bought it unlocked from them. Then take the the second one and set the hex for the second CID to 0's. Write back to the phone after that. I examined partitions on the att version and that was one difference between soff and son devices.
[HTC One X] ximonx:
These look like some of the tegra 3 base addresses
[HTC One X] jags_the1:
will htc one x have official cm support? thinking of upgrading ..
[HTC One X] forster:
Thanks mate!
[HTC One X] Rekoil:
A RUU is just a bunch of data files sent to HBOOT. There is no executable code which we can look at/tamper with in a RUU.

Please elaborate, you sound like you know a lot about this kind of thing...
[HTC One X] KrisPerry:
For example in the XBox 360 it was found that by sending a tiny reset pulse to the processor while it is slowed down does not reset it but instead changes the way the code runs, it seems it's very efficient at making bootloaders memcmp functions always return "no differences". memcmp is often used to check the next bootloader private key against a stored one, allowing it to run if they are the same. So we can put a bootloader that would fail hash check in NAND, glitch the previous one and that bootloader will run, allowing almost any code to run.
[HTC One X] CosmicDan:
Probably obvious, sorry if it's spam, but the hboot 0.96 could have patched an undiscovered exploit from 0.94. An experienced hacker could disassemble both and examine the machine code differences, maybe a lead to an overflow. I'm sure those working on the S-off have already investigated this though....
[HTC One X] Evil-Dragon:
I doubt it, I've only seen a handful of people actually disassemble hboots. Unfortunately I don't have the time right now to look into it.
[HTC One X] KrisPerry:
My hboot is 0.43. Is that useful to anyone. Can I dump it without htcdev unlock or S off
[HTC One X] ErrorInLogic:
No its not, I'm also still on .43 but it's just the same one most people that never did any ota's or newer ruu's would have. I've been holding out on updating to any newer hboots in case an exploit is found for .43.
[HTC One X] KrisPerry:
Yeah sorry, I just re read some of the thread and realised that. Is there no one who could disassemble hboot
[HTC One X] ingFu:
I am thinking about emulating an USB-Device with a microprocessor in order to analyze the traffic and and the onexs' responses.

As it will need a lot of effort, I'd like to ask the experts if this approach is promising.
[HTC One X] mattman83:
Yes people can/have done it, but things are also changes to fix non-exploitable bugs, features, whatever. Just because something changed does not mean it was an exploit fix. Disassembling a hboot takes a lot of work.... Its not something you do just to check.

M.
[HTC One X] Rekoil:
Ah, of course, but this requires us to actually open the HTC One X up and solder to the board. Which is something we've always known could lead to an exploit.
[HTC One X] Joolee:
First or second exploit for the Motorola Milestone consisted of running a partially signed update from SD card. The bootloader only checked a few files for signatures, not all the files.

Hack was more elaborate of course but that was the base for it.
[HTC One X] KrisPerry:
Correct
[HTC One X] xmoo:
fuse.zip from a S-OFF device.
[HTC One X] DesmondderMondbär:
I can't really understand what to Do with the fuse.ZIP can someone tell me please :o
[HTC One X] glukosio:
a guy want to see differences from s-off and s-on versions,
[HTC One X] Evil-Dragon:
You open the zip, look at the files with a text editor and say "Oh, there's no difference"

Told you it was a dead end ;)
[HTC One X] NikMel:
There is difference and our problem is to patch the parts on S-ON system.

I tried it but no luck by simple dd/cat command.
[HTC One X] muamers:
Yeah, that would be to easy :o
[HTC One X] angusc:
What the problem with you two guys? If you can only be negative they sit and say nothing rather than spamming this thread.

Sent witH desire from OneX
[HTC One X] tids2k:
This findings have already been discussed. I don't know why you guys are not reading the previous few pages. There had been three posts where the fuse and partitions dumps had been made avaialable and there is no difference in the masked partitions between both phones.
[HTC One X] racatapum:
But the key is not to find differences in software, but little bugs that allow you devs to access all the phone modules, isn't it? And every software must have a bug...

Enviado desde mi HTC One X usando Tapatalk
[HTC One X] xmoo:
Too badd 2.05.401.2 test-keys don't have test or eng SPL.
[HTC One X] Evil-Dragon:
My problem is it's the same spit going from one cheek to the other. The same discussions, the same 'have you tried', 'has any one made a goldcard' crap.

It's not spam, it's just me proving that people can't read or be bothered to read the thread. Sure it's getting big but if you or anyone else really had something to contribute then you would take the time to see what has or hasn't been tried. Me and others are spending a lot of time re-answering the same questions and it's getting tiring.
[HTC One X] xmoo:
Post #1 updated. New RUU 2.05 has HBOOT 1.11. No ENG SPL :(
[HTC One X] sieempi:
Have any of you tried a different approach: investigating the htc diagnostic smart sd?

Via XDA App
[HTC One X] hubseven:
Hi all - I have been reading this thread a while now and I can't see (unless I missed it and I'm sorry if I have) that anyone has tried to intercept the files from HTC update tool

On the SE Xperia X10 we used the software repair tool to do a factory reset and intercepted the files.

The process went something like this...

1) load SE Update tool

2) perform factory reset from the software while phone connected to pc

3) software downloads legit firmware from SE server

4) software verifies, signs and authenticates the firmware

5) the software starts to flash the phone. <--- at this point the downloaded files are quickly replaced with custom firmware

5) the device accepts the firmware and installs

I hope this is of some use to someone. If its not please don't flame - I'm just trying to help.
[HTC One X] KrisPerry:
I would assume this would break the signature
[HTC One X] glukosio:
can't we partitionate internal memory and take a little piece for creating a gold card?
[HTC One X] wph:
No because to repartition you need to change the hboot. Which only can be done with S-Off.
[HTC One X] glukosio:
so, at the time, wtf we can do without s-off, root, apx, unlocked bootloader...??? nothing?
[HTC One X] Rekoil:
I'm surprised to hear this works on the X10, I guess SE's security has gone downhill since the K610 I had ages ago.

On our device, the bootloader does the signature checking, so we can't just substitute the files with our own ones, as ours are not signed.
[HTC One X] CosmicDan:
Dude you can unlock and root with htcdev the only issue is that you can only show "relock" on bootloader so it might not be covered under warranty once you get official unlock. Very risky given the problems with some models. S-off allows r/w to system while booted in Android, among other things. You can root and install custom ROM's fine uf you dont care aboit warranty, browse the forum.
[HTC One X] CosmicDan:
Yes, the X10 doesnt even have a fastboot - it uses their own weird loader. The X10 is two years old and compared to recent androids (including newer SE's) is quite exotic. Pretty much all hacks for it are very unique to it.
[HTC One X] Whiskey103:
Thread cleaned.

Please read, if you have no idea what you are talking about!? Read even more ;)

Whiskey

Forum Moderator
[HTC One X] xmoo:
The new 2.05 test-keys roms includes a unsecure boot.img

But in order to flash you still need to be UNLOCKED or S-OFF :(
[HTC One X] KrisPerry:
What does this mean
[HTC One X] gffmac:
Think it means you get superuser privileges as default.
[HTC One X] f4flake:
Personally I think it means the way we've thought about s-off needs to change. We'd be better off asking the guy over at Omegadrivers.net as he's been modding nvidia BIOS for years.

APX mode is just like a low level bios flash, I think we'd have more joy that way
[HTC One X] karoodee:
would it be possible that with this boot.img the root exploit tested by paul o'brien could work and would not wipe the pushed files off of /system? Or what does unsecure mean?
[HTC One X] xmoo:
Would be posible, but then we need access to the full RUU.

Cause only flashing boot.img requires UNLOCKED or S-OFF.
[HTC One X] ytwytw:
That may not help since that is a htcdev.com unlock file...
[HTC One X] JeckyllHavok:
I think we somehow need ti combine the token that you are sending toHtc with the goldcard
[HTC One X] f4flake:
I've tried writing a good card image a few times with the traditional method, and it simply responds corrupt drive.

Theoretically when you fastboot the token it may be being redirected to the "cd" drive. It's essentially a drive image.

Is it possible tids2k, you could post your input token too?
[HTC One X] tids2k:
The input icon is attached to the post. Key.zip

Sent from my HTC One X
[HTC One X] f4flake:
aye, saw that after.

Was trying to match our input tokens on the basis they would likely contain an IMEI in hex.

Can you confirm the first two digits of your imei number?
[HTC One X] JeckyllHavok:
Should it be that simple?
[HTC One X] f4flake:
I doubt it, but I was looking for a patern of some kind.

I tried to fastboot flash a modified gold card image and got error remote. Didn't wanna flash somone else's token as it's device specific.

Figured if it's device specific I could identify where the imei occurs in the identifier token.

Then perhaps see the same pattern in the .bin....

Total guess work on my part, lol.,
[HTC One X] mattman83:
If you want another token to compare, just let me know. I don't have the text block that they get you to copy, but unlock_key.bin is still on my pc :)
[HTC One X] JeckyllHavok:
So i tjink it would be good that some other people would upload their unlock bins, too cause i think it would be easier to find a patern

---------- Post added at 01:59 PM ---------- Previous post was at 01:56 PM ----------

think it would be good if you would upload, and the first 2 digits of your IMEI
[HTC One X] f4flake:
That'd be good mate.

Even if we recognise generic codes and identity device specific stuff.
[HTC One X] mattman83:
Done :) I am nowhere near good enough at this stuff to positively contribute to S-OFF, however I'm more than happy to provide data :)

M.

edit - imei stuff is in the zip, just for clarity.
[HTC One X] xmoo:
Isn't the first two digits of a IMEI not always 35?
[HTC One X] blubbers:
the unlock process is a basic signing process

the token you submit to htcdev get's signed with a private key, the resulting data can be verified by the device with the corresponding public key to ensure the data is authentic from HTC. the device does not know the private key

it's very basic asymmetric cryptography, there is no way you will get this private key, it's probably 256+bit strong

stop wasting your time
[HTC One X] bobmarsh72:
They said something like this about the ps3 back in the day, that got cracked.
[HTC One X] sirholm:
No. It used to be that way, but now alot starts with 01 aswell. IPhone was the first I saw in my shop to have 01xxxxxx
[HTC One X] abc27:
After more than four years using what more or less amounted to a hardware exploit.

Not to mention that there are far more PS3 owners than people who own a One X and I don't think that will ever change. As for getting a lot of unlock tokens and trying to find a pattern in them based on IMEI number, there's nothing to be said other than "Good luck with that"

There has to be a better way.
[HTC One X] blubbers:
yeah well, i don't say it is imossible, but even if you "crack" the process one way or another, it get's your device "htcdev unlocked" - wow, just use the website

i'm currently wasting my time with trying to get the device into nvflash, i don't know if it is even possible with "hw secure boot: enabled", but if we get into nvflash, this would get us somewhere

---------- Post added at 02:57 PM ---------- Previous post was at 02:49 PM ----------

btw, if anyone wants to help trying to get into nvflash, you can check with

./nvflash -w

if you got into

maybe there is a key sequence before powering on

maybe it's not even possible without short-circuiting some pins on the board (don't waste your time on the pogo-pins, it's an usb interface!)
[HTC One X] f4flake:
Look, I don't know what I'm doing, beyond a curiosity as to how the token.bin is constructed.

I don't believe I've suggested anything else.
[HTC One X] bobmarsh72:
That's a fair comment, I'm well out of my league with this stuff anyway. Just watching this thread closely hoping for s-off.
[HTC One X] JeckyllHavok:
I checked in normal power on, fastboot, hboot and recovery and during power on but nothing
[HTC One X] angusc:
Fine....just ignore those "silly" or "repetitive" questions then...

==========New topic==========

I modded my Samsung OTG cable to make it powered and also made a USB MALExMALE cable. I powered up in to HBOOT mode with an old Goldcard from my HTC Desire (Card had no .zip or .img files on the root). I note that while holding down the power and -Vol buttons first all the lower button lights flash repeatedly and then the phone takes a LOT longer to get in to HBOOT and then when in it checks the External storage card then spits out the message:

HBOOT

SD Checking...

Failed to open zipfile

loading HTCUpdateZipName image...

Failed to open zipfile

Please plug off USB

How can I log the traffic over the OTG cable USB connection and is it possible to see what data is being transferred? I'm wondering what the phone is doing during the longer than usual start up time to get in to HBOOT with the OTG and external card inserted....

Of course if this is a "spit swap" question or total crap then you will ignore it so as not to spam up the thread like i may just have done. :)
[HTC One X] DarkMio:
You could need a male x male USB on a pc, which fakes a dongle. So we can read the datastreams. This is the most unsecured part in the security chain.

I'm jot familiar with this faking. But I hope this helps a bit.
[HTC One X] KrisPerry:
Then wireshark can be used to capture the data
[HTC One X] KrisPerry:
Although not under windows
[HTC One X] miniudavid:
Try Holding vol down or up I don't even know no more when phone is switched on and then hold power button and keep holding. It will immediately go into hboot and searches for files on external storage ;) something like USB master or something I remember
[HTC One X] KrisPerry:
I don't think this is what is being asked
[HTC One X] miniudavid:
Yeah. But maybe you can use a matching goldcard.. ???
[HTC One X] DesmondderMondbär:
PaulObrien wrote on Twitter that the One X has a hidden SD Card Slot . May we can use this for a goldcard
[HTC One X] skygear:
I was getting the same thing. I was using parallels on my MAC with XP SP3 .... Same process without an advanced USB, standard micro usb from HTC. Buttons flashing and long boot. I just didn't have a Gold card in.
[HTC One X] KrisPerry:
Where is it
[HTC One X] muamers:
If a goldcard could help us, then i think we could make one like on the HD7 ... here the link :confused:
[HTC One X] xmoo:
Link please....
[HTC One X] DarkMio:
C/p:

Starbase64 @starbase64	8 Min.

@PaulOBrien they can confirm this? goo.gl/OSRPC

Paul O'Brien

@PaulOBrien

@starbase64 I never said that.

8:18pm Fr Jun 15 via TweetDeck

Confirmed trolling here
[HTC One X] xmoo:
All we need right now is to find where HBOOT is located and how to write to it. Other stuff we don't need for now... Truste me
[HTC One X] Evil-Dragon:
Thanks for the confirmation, i would have thought it was highly unlikely since i've looked at the teardown photos and seen no presence of a hidden sd card slot. It would stick out like a sore thumb.

---------- Post added at 10:05 PM ---------- Previous post was at 10:03 PM ----------

And APX mode would be useful too, it would probably allow us access to the hboot partition/area without getting masked/hidden.
[HTC One X] DesmondderMondbär:
Currently Not easy, he wrote that a month ago and in Twitter i can just go One week back. Tomorrow ill watch on pc
[HTC One X] MDAC3:
There isn't one on the One X

https://mobile.twitter.com/#!/PaulOBrien/status/209259670962061313
[HTC One X] MDAC3:
Is it possible to use a Unlock Token from htcdev for another device? Would that allow us to write to the partitions?

I clicked the sensation when unlocking bootloader on my old One X (faulty one) and it still worked but I never tried dd or cat commands.
[HTC One X] xmoo:
Here you have HBOOT 1.11 which comes with 2.05.

It looks like a SHIPPED HBOOT. IF we find a way to upgrade to this HBOOT, I'll have something to let us downgrade.

Also I tried flashing file by PJ46IMG.zip, HBOOT did notice it but then got Canceled. So if anyone is willing to try that. I'm at office so can't.
[HTC One X] KrisPerry:
If you explain how I'll try it
[HTC One X] xmoo:
Get the update.zip out of a RUU. Rename it, put it in root sdstorage. Got to boot loader and see what it does.
[HTC One X] KrisPerry:
Do I need to be HTC dev unlock
[HTC One X] xmoo:
Nope, stock rom ;)
[HTC One X] KrisPerry:
And what do I do with the attachment
[HTC One X] xmoo:
Nothing yet. That is for people who want to extract the new HBOOT or try to flash it through recovery or terminal or whatsoever.
[HTC One X] KrisPerry:
I'm sorry but I don't understand the purpose
[HTC One X] xmoo:
You don't need it.

And nvm, LAurentius26 tried it already and won't work.
[HTC One X] KrisPerry:
What way did they try to flash
[HTC One X] xmoo:
Could you try this

Shutdown phone.

Press volume up

Plugin USB cable, which is connected to computer or laptop, and the computer or laptop is powered on. (Keep the volume button pressed)

Now remove the button.

What do you get.
[HTC One X] KrisPerry:
Yes this seems to be the case. The computer did make the usb connected sound but no new devices. Also there was a delay before the red led lit after plugging in the usb

---------- Post added at 01:27 PM ---------- Previous post was at 01:23 PM ----------

nothing different than if i dont press the volume +
[HTC One X] xmoo:
Anyone got the correct Windows 7 USB drivers for NVflash? The ones added to this thread were corrupted.

This should be it tho, it did interface with my laptop, but wrong drivers I guess!

Device off (Fastboot disabled) press vol-up and plug in USB cable and un-press vol-up.
[HTC One X] Andy:
The ones here do?

http://www.modaco.com/topic/335416-nvflash-setup-instructions-drivers-links-active/
[HTC One X] angusc:
This HBOOT is exactly the same file size as the earlier OTA HBOOT "hboot_0.94.0000.img". What would happen if we rename "hboot_1.11.0000_ss.img" to "hboot_0.94.0000.img" and then inject this new renamed HBOOT in to the OTA to replace the original 0.94.0000.img?

Would this still break the signature and security of the original OTA file?
[HTC One X] Baz Scotland:
Trying to replicate the steps above without any luck, when do you un-press vol-up? as soon as you plug in the usb or after a second or so?

Can you replicate the process?

Edit: Does it show up in the device manager as APX?
[HTC One X] xmoo:
This one seems to be corrupted.

Normale as soon as the file size changes, the signature breaks. But correct me if I'm wrong. But then again how will you force your device to install OTA. Only people who have the OTA pop-up and not flashed it yet, can dot his.
[HTC One X] xmoo:
Wait a couple of sec. You should keep it touched till you see the battery led. Cause then you know USB is running.
[HTC One X] KrisPerry:
My win7 is x 64. Do you have compatible drivers
[HTC One X] icke:
Try these:
[HTC One X] angusc:
I still have the first "OTA_ENDEAVOR_U_ICS_40_HTC_Europe_1.28.401.9-1.26.401.2_release_256505w0tk6eiq8g74y4vb.zip" file sitting on my device in the Download folder waiting to be installed.

I tried to inject the renamed HBOOT file in to the OTA firmware.zip folder which itself is within the "OTA_ENDEAVOR_U_ICS_40_HTC_Europe_1.28.401.9-1.26.401.2_release_256505w0tk6eiq8g74y4vb.zip" but keep getting a 7-Zip "Not implemented" error message. is there a better program to use than 7-zip for the purposes of injecting this new HBOOT file?