yashsingh1/xdaforums huggingface dataset:
[HTC One X] blubbers:
the OTA updates flash the firmware this way in the ruu mode:

write_firmware_image("PACKAGE:firmware.zip", "zip");

i think this just copies the firmware.zip to /sdcard/PGblabla.img and after that it reboots to the bootloader

i am not sure tho
[HTC One X] niels-cil:
Can't we use this RUU mode or something: http://xdaforums.com/showthread.php?t=1632200

to flash a modified hboot?
[HTC One X] blubbers:
pretty sure this will brick your phone if the hboot signature is wrong :D

---------- Post added at 04:31 PM ---------- Previous post was at 04:29 PM ----------

on the other hand, if the new flashed hboot thinks it is s-off, it could work :D
[HTC One X] JeckyllHavok:
We should start with an uncritical part first for example splash screen, if it works we can try for ex. boot img
[HTC One X] blubbers:
can anyone try getting into this state and flash a normal signed stock hboot? (fastboot flash hboot hboot.img)

does the device in this "ruu/download" mode even respond to fastboot commands?
[HTC One X] JeckyllHavok:
how to get in download mode? fastboot oem rebootruu gives just the black htc logo but no triangles
[HTC One X] blubbers:
http://xdaforums.com/showthread.php?t=1632200
[HTC One X] ytwytw:
That IS the download mode

Then you can do

fastboot flash zip xxxxxxxxxxxxxxxxxxxxxxxxxxx.zip

Afterwards, the hboot gonna check the signature before flash

btw, does anyone look for ENG HBOOT? find it?!
[HTC One X] JeckyllHavok:
so we need someone who is brave enough to cancel ruu while updating user data, and try then to flash an alternate img.

Maybe thats the point of exploit we are searching for (on desire it was at some point of rebooting)
[HTC One X] :
Thats asking for trouble

Sent from my Desire HD
[HTC One X] blubbers:
flashing an official signed stock 0.43 hboot should not be dangerous
[HTC One X] JeckyllHavok:
Ok, then im out for testing, i'm on 0.94, or should downgrade on this way be possible
[HTC One X] steve36:
would imagine if it wont let ye itll just say your already upto date
[HTC One X] blubbers:
i've never seen the hboot screen with "RUU" in orange. i think it would need to be in this mode. but i don't know if the RUU mode with the 4 signs in each corner is diffrent.

in the normal RUU mode (rebootRUU) you get "not allowed" when trying to flash hboot

---------- Post added at 05:02 PM ---------- Previous post was at 05:01 PM ----------

if you can really flash the hboot partition, it won't matter what version you have. it either allows or denies you to flash the hboot partition
[HTC One X] Sentinel196:
While we are on the subject of flashing HBOOT, has anyone had a look at the work 'condi' is doing on the Sony Tablet S (tegra 2 chipset).

It might give us some clues at least. His all-in-one tool is able to sign customised zip files, allowing them to be installed without S-OFF. But in the case of the HOX, he might be able to give some pointers for signing and flashing a modified HBOOT.

Long shot I know, but I figured its worth someone with more knowledge than me taking a look.

He's also made some interesting discoveries regarding APX mode on the Tegra 2 chipset which may be clues to achieving this on the Tegra 3.
[HTC One X] JeckyllHavok:
ok, if now someone has a working link for the 0.96 ruu i will test (the 3 eralier posted won't work for me)
[HTC One X] blubbers:
why do you want the 0.96 ruu?

0.96 -> hboot 0.43

1.26 -> hboot 0.43

1.28 -> hboot 0.94

---------- Post added at 05:25 PM ---------- Previous post was at 05:24 PM ----------

ahh wrong. 0.96/1.20 has 0.34
[HTC One X] JeckyllHavok:
someone told that the 0.96 ruu was an eng ruu that maybe didn't a cid check
[HTC One X] blubbers:
stock hboots from 1.20/1.26 RUU's
[HTC One X] JeckyllHavok:
I need the whole ruu, the idea was straight before the ruu starts flashing to replace the rom.zip
[HTC One X] blubbers:
no, the 0.96 RUU i have has a SHIP hboot. i don't think ENG RUU's exist. that's what s-on/s-off is about
[HTC One X] JeckyllHavok:
damn signature checking
[HTC One X] Ox41464b:
Is there any way to gain temporary-root without unlock/S-OFF ?
[HTC One X] co@ch:
Maybe one of them:

http://xdaforums.com/showpost.php?p=25635606&postcount=1032

http://xdaforums.com/showthread.php?t=1606088

:p
[HTC One X] f4flake:
I just pulled the plug on an RUU update at the beginning to see if I could time it at "enter nvflash mode".

stalled very badly and would not come out of bootloader.

Had to run an ruu to recover.

All data wiped. :D
[HTC One X] ytwytw:
no one gonna do that, the result will be highly possible a hard brick

---------- Post added at 12:20 PM ---------- Previous post was at 12:17 PM ----------

Orange RUU will show on the screen when you fail during RUU flash (simply turn on the phone it will show)

hboot is not possible to downgrade without s-off (except misc exploits which i can never get permission to access that part of partition, which is used on htc flyer 3G, but unlock bootloader looks like is required)

---------- Post added at 12:23 PM ---------- Previous post was at 12:20 PM ----------

I am not sure but I think Sony does full bootloader unlock via their website...

so looks like the toolbox just call apx mode or sth like that, not quite sure :confused:
[HTC One X] abc27:
That's actually not half a bad idea. It may even allow for downgrading the HBOOT e.t.c.

Normally, it'd say "The file is in use" but you can easily unlock the hold on the file with a program like "Unlocker".
[HTC One X] JeckyllHavok:
Yeah that was the idea for example ig the signatur Check Starts at beginning it should allow us ti Flash what we want. Flake, could you just replace Boot.img and Test it ( for ex superboot.img and Rest stock
[HTC One X] f4flake:
I didn't go any further than interupting the ruu to see what state the phone was in.

Waited until it cleared user data then killed the process. Perhaps I should have simply pulled the plug...

I can try again, just not right now.

Hell, if I'm not unlocking the bootloader, I'm still under warranty, right?
[HTC One X] JeckyllHavok:
In theory yes, if bootloader is locked
[HTC One X] f4flake:
I insisted my provider give me written re-assurance regarding my warranty only the other day. lol.
[HTC One X] GabrielSousa:
any one know if revolutionary team is working on s-off ??
[HTC One X] JeckyllHavok:
No, Not for tegra afaik
[HTC One X] starbase64:
why not?
[HTC One X] Evil-Dragon:
They said they will only work with Qualcomm based devices due to all their previous exploits were based on Qualcomm. You can ask but my betting is they'll give you same answer and probably kick you out of the channel.
[HTC One X] steve36:
whats the channel ill ask em
[HTC One X] Evil-Dragon:
#revolutionary

EDIT: I told you:
[HTC One X] steve36:
lol still no harm in asking
[HTC One X] rogersnm:
Here's a mirror:

RUU_Endeavor_U_HTC_Europe_0.96.401.2_Radio_0.120201.21.10_test_240060

MD5 Hash: ce08d8a45981b4cbac9bcc1ce9a53065

SHA1 Hash: f2fd3a1542e46e589504c8c3709b71dc900e0850

File Size: 619.57 MB

URL: http://hoxroms.serveftp.com/RUU_End...96.401.2_Radio_0.120201.21.10_test_240060.exe
[HTC One X] huwwatkins:
They sound like a bunch of idiots. Looks like they traded their common decency and manners for the qualcomm s-off exploit.
[HTC One X] steve36:
well i didnt like to say owt lol
[HTC One X] leith51:
I think the running the ruu but swapping out the hboot could be an option but not with the known hboots 0.43 or 0.94 but with the 1.01 hboot which has been shown with s-off if I had unbranded device and the 1.01 hboot I would try it but It fails I don't have the branded t-mobile one to reverse it
[HTC One X] theliquid:
Mirrored RUU_Endeavor_U_HTC_Europe_0.96.401.2_Radio_0.120201.21.10_test_240060.exe for everyone interested to my server:

http://cxsr.eu/pubftp/index.php?dir=onex/
[HTC One X] JeckyllHavok:
If you create something like them you can talk abou decency
[HTC One X] huwwatkins:
It doesn't matter what you create. It doesn't cost anything to be nice.
[HTC One X] wtfhax:
The way i see it they created s-off for other device doesn't mean they could do it for h1x and maybe.. just maybe.. you and me may not know but probably there's too many people asking them for help on _insert device_ that they are not supporting, they got sick of it.

They are the one with the knowledge to get the job done and they set their own rules. Choose to follow or ignore them.
[HTC One X] SB13X:
No for me your bang on. If they want to have that stinking attitude then they should throw the rules and all the relevant links they supplied in being abrupt as part of the MOTD.

Only link mentioned is for a guide on here, and it says no asking for ETA as this is worthy of a ban.

Truth is popping in and asking without any other information that that if they have an intention to support a device is fine.

Narcissistic self important pompous asses is all they come across otherwise.

Manners cost nothing, taking the time to fill out a more substantial and suitable MOTD costs 2 minutes.

Beside they aren't supporting us and have no intention of doing so leave them to their self aggrandisement and lets get on with supporting our own.

[EDIT]Maybe they don't like hearing about the Tegra One X because they can't crack it and in them constantly having to admit it it makes them look inferior.[/EDIT]
[HTC One X] Rekoil:
https://github.com/saurik/mempodroid would quite likely work, we just need to find the offsets for the functions it needs to call on the run-as binary.
[HTC One X] Drefsab:
does anyone have a contact that speak Chinese? im wondering we we can ask the guys that did the one x teardown to try and see if they can get APX by removing the battery.
[HTC One X] clyder:
This is something I have done with HTC Desire recently to fix some issues with a friends phone. In section "Fixing a USB Brick on an unrooted phone" there is a process to aquire temp root on a Desire stock rom.

I haven't tried it on OneX and I dont know if it will work though.
[HTC One X] xmoo:
Anyone has Visionary? Anyone tried Visionary? To get temp root, so we can change boot loader etc. Just like the old DHD days.
[HTC One X] Nipqer:
Rage and Visionary use very old temp-root exploits which were patched ages ago. they will not work on the oneX.

You might be lucky and see if tacoroot can work, but chances are htc fixed that hole.

mempodroid would also be worth having a look at I reckon, if someone can just figure out the addresses.

Otherwise you'll just have to wait for a new exploit to be discovered

-Nipqer
[HTC One X] ytwytw:
thats a good news since ATT One X is S4 device :D :D :D

---------- Post added at 08:28 PM ---------- Previous post was at 08:10 PM ----------

nice idea,

but after send all BSs to phone first, then it gonna check signature, so it doesnt work...

let me explain this way...

--Run RUU--

--rom.zip is out of the RUU.exe--

fastboot oem rebootRUU

fastboot flash zip rom.zip

--hboot is unzip the rom.zip file--

--Signature Check on each img file--

--Flash start--

so if you can replace the hboot file right after signature check, it would be great idea, but maybe not possible since the hboot flash hboot first... so you have to be fast to do it...

and... I dont even know where are all the files... which partition they are? how to replace them? possible to do with fastboot?

lots problems need to be resolved...
[HTC One X] Sentinel196:
Incorrect. Sony do not offer a solution for unlocked bootloader for the Tablet S and Condi's tool allows you to sign and flash zip files without the need for an unlocked bootloader.

I know because I've used it on my tablet S myself. It's worth someone who knows more than me checking it out I think.

it might offer some clues as to how we can sign and flash an S-OFF'd bootloader file on a locked bootloader device. Or how we can sign files so we don't even need to bother with unlocking the bootloader to flash whatever we want.
[HTC One X] Hunt3r.j2:
Anyone ask the Juopunutbear S-OFF team if a similar method would work?

They apparently force the phone into qualcomm dload mode w/ emmc access via shorting two pins.
[HTC One X] Sentinel196:
What happened to Bepe and Cotulla from the Dark Force Team? (the guys who cracked the HD2). are they still around?
[HTC One X] ytwytw:
I briefly take a look into it...

correct me if i am wrong

For the root part, they use kernel exploits to gain root...

I think they get temproot first, then later push all the stuff to gain permanent root

for the recovery part, I am surprised Sony Allow user to flash testkey signed package (key file: testkey.pk8, testkey.x509.pem)

I have a idea, could be worth for a try

We can make up a update.zip file, get it signed by testkey, use htc stock recovery to flash this update, see what it returns.

if still signature check fail, or package invalid, then we need to look into other ways...

im not a pro dev, so anyone can try this idea?

---------- Post added at 09:20 PM ---------- Previous post was at 09:15 PM ----------

I am thinking the same thing this afternoon

what are the 5pins on the back of the phone?

what are they connected? what they do?

hopefully we can get ifixit to disassemble it that will be great!

---------- Post added at 09:27 PM ---------- Previous post was at 09:20 PM ----------

Just found WORLD FIRST Guide to Disassemble HTC ONE X (Tegre3)

http://fashion.pconline.com.cn/mobile/1204/2754053.html

plz dont blame me its in Chinese, cuz its made in China ;)

Looks like VERY Difficult to take a LCD off,

and if you wanna disconnect the battery, you need to remove the motherboard first...

so

There is a hope on APX mode, but i would say not all general public can do it...
[HTC One X] Arthas92:
may be i'm stupid

but can we modify the fastboot and let it switch the hboot image for us(after signature check)
[HTC One X] Nipqer:
fastboot just passes the zip onto hboot to flash.

You cannot swap the rom.zip in an ruu, it will not work.

The only potentially possible way would be a hardware hack.

-Nipqer
[HTC One X] blubbers:
Fastboot is only like an untrusted peripheal to the phone, everything fastboot sends is validated. There might be some buffers you could overflow on the phone via fastboot tho, but i doubt that
[HTC One X] angusc:
I tried installing this one " zysploit-release.apk" but then could not enter /data/data to see if it had installed.....anyone with more terminal know how want to double check it?

EDIT SOLUTION FOUND:I went to UnRevoked.com and to their online help page (hxxp://webchat.freenode.net/?channels=unrevokedtest) and got great assistance from kmdm & @ZanaDroid who got me out of jail....thanx guys!! I had already downloaded flash_image & mtd0.img from the first post of this thread and saved to my SDCard. REMEBER to unzip the flash-image.zip file!!

IF YOU ARE ALREADY S-OFF THEN JUST RUN THIS: fastboot oem eraseconfig

Here is the log follow these steps if you like me in above condition (Stock ROM. USB Bricked): [16:41] how do you disable qxdm? (Mount the SDCard)[16:41] fastboot mode[16:41] fastboot oem enableqxdm 0[16:41] fastboot oem boot[16:42] if that doesn't get usb back Copy these files to your SDCARDhxxp://shadowchild.nl/mtd0.img and hxxp://shadowchild.nl/flash_image[16:44] grab a terminal emulator from the market[16:51] zysploit might work[16:52] hxxp://home.kennynet.co.uk/~kenny/zysploit-release.apk or hxxp://www.kennynet.co.uk/misc/zysploit-release.apk[16:54] you need to install the apk, then hope you can run this command from the terminal emulator: am broadcast -a com.unrevoked.zysploit[17:08] then wait a couple of minutes and do:-[17:08] ls /data/data/com.unrevoked.zysploit/root/su[17:11] ok so i ran the: ls /data/data/com.unrevoked.zysploit/root/su[17:12] any output?[17:12] now shows: /data/data/com.unrevoked.zysploit/root/su[17:12] ok Good[17:12] run this: /data/data/com.unrevoked.zysploit/root/su[17:13] (hopefully that'll give you a root prompt that'll let you flash mtd0 to misc)[17:15] output is: #[17:15] ok Good[17:17] i have both files (flash_image & mtd0.img) on the root of my sdcard[17:20] run this command:cat /sdcard/flash_image > /data/local/flash_image[17:20] alternate way to copy[17:22] did that go ok?[17:32] ok ran the command and now have: #[17:35] chmod 755 /data/local/flash_image[17:36] now type:/data/local/flash_image misc /sdcard/mtd0.img[17:37] and lemme know the output[17:38] output: #[17:38] perfect[17:40] hehe, he should be deusb bricked now after reboot[17:41] really!! so now i reboot the phone ?[17:41] yep, try it[17:44] Blue Tooth working.......I love you guys![17:45] Yeap!!!!! the USB Brick is no more......[17:45] so now i can Unrevoke as normal?[17:49] uninstall zysploit BEFORE running UnRevoked!![17:56] great! don't forget to run alpharev when you're done for S-OFF (if you need it)

Sent witH desire from OneX
[HTC One X] tids2k:
so whats the solution for ...again ?
[HTC One X] ytwytw:
Wait, what?!

What are you talking about?!
[HTC One X] angusc:
The code irc chat was when they helped me obtain root when i lost it on my desire and also lost S-Off after flashing an ruu.

Not sure if this exploit could work on One-X.....?

Sent witH desire from OneX
[HTC One X] tids2k:
damn U @ !
[HTC One X] Evil-Dragon:
That would be great, BUT... if you read the specifications you would have noticed that this phone is not a QUALCOMM phone. It's Tegra. It does not have a qualcomm dload mode. It uses APX to work at low levels. This is what we've been struggling to get into.
[HTC One X] angusc:
???? :confused:

Sent witH desire from OneX
[HTC One X] steve36:
so did flashing a ruu get us any where?
[HTC One X] supendal:
I guess he was excited for a moment and was just kidding :)
[HTC One X] ytwytw:
I got a xtc clip,

So when I am into s-on trouble,

I just create a goldcard and everything is done :P
[HTC One X] blubbers:
these are the partitions seen by the OS:

APP CAC DLG DUM ISD LNX MSC PDT PG1 PG2 PG3 RCA RFS RV1 SIF SOS SP1 UDA WDM WLN

none of these partitions contain the hboot!

these are the partition actually on the emmc:

APP BCT BIF CAC DIA DLG DUM EBT GP1 GPT ISD LNX MSC PDT PG1 PG2 PG3 PT RCA RFS RV1 SIF SOS SP1 UDA WDM WLN

so, you won't be able to access the hboot partition (on a s-off device neither) without a bit of work, ;)
[HTC One X] Arkaknio:
Unfortunately this is gonna be hard.

Keep the good work mates!
[HTC One X] 777ace:
About time a Mod stepped in here and cleaned this thread out.

Looks like HTC are getting ever more crafty with their bootloaders! :D OTA is not even available here yet, but I intend to wait for S-Off anyway.

Really enjoying this thread and learning a lot (except for the idiots that cannot/will not read). A real shame the guy with the ENG S-OFF device uopdated, lol! Keep it up guys, looking forward to seeing you crack this!! :)
[HTC One X] riemervdzee:
At the file QUO_6260.fls.clean, there seems to be another header-ish piece of text in it besides the one Evil-Dragon mentioned:

---------------------------DESCRIPTION OF DEFINES-----------------------------
------------------NOT WHAT THE CODE IS ACTUALLY COMPILED WITH-----------------

BOOT_INTERFACE_NOR # NOR flash used
IFX_KEYS # Use Infineon keys
CUST_KEYS # Use Customer keys
PSI_TYPE_FLASH # Built for flash
PSI_TYPE_RAM # Built for ram
CDS # ?
SECURITY_LEVEL_CERTIFICATE # Built with security layer
EPOCH # Epoch of the PSI
XGOLD618 # Platform
UTA_PLATFORM_XMM6180 # UTA platform
SERIAL_USIF1 # Only compile with USIF support
BOOTCORE #
CHIP_REV_ES2 # Used to switch between ES1 and ES2 hw
TARGET # built for target and not for host

MAJOR_VER=? # PSI major version
MINOR_VER=? # PSI minor version

EBL_MAJOR_VER=?	# Minimum Ebl major version
EBL_MINOR_VER=?	# Minimum Ebl minor version

-------------------------------------------------------------------------------
-------------------------------------------------------------------------------

Not sure if this is of any interest. Also xmoo I watched the msm3000 papers a little (preview) and it talks about a cmda chipset? Maybe some of the chips are inside the htc one X I guess
[HTC One X] kholk:
Instead of S-OFF, good thing on HTC devices, I think that there are two more interesting researches to do:

1. APX Mode (nVFlash interface) would make us able to even repartition the device or flash a CUSTOM BOOTLOADER (like UBoot) on it. Also, having access to APX, we wouldn't have any issue if we flash a broken bootloader: we can always reflash from there since the APX bootloader is on the Tegra BootROM, other than on TWO partitions of our eMMC.

2. UART: Using an UART, we could easily debug the earlyprintks of the kernel, making us able to port new kernels (I dislike 2.6.39 at all - anyone wants 3.2?) on our device.

If anyone of you is interested in researching on those two points, feel free to contact me.

P.S.: No, this post isn't absolutely an OT. Have a better read at the APX Mode part.

The EternityProject Team Manager & Main Developer,

--kholk
[HTC One X] sacredabyss:
Wouldn't flashing a custom bootloader enable us to use other OS on the device like the HD2?:D
[HTC One X] xmoo:
nVFlash is indeed a good thing of the tegra chipset. Will take a look on monday. This weekend busy with deadlines :(
[HTC One X] schriss:
But weekend didn't start yet :D Maybe just a quick look...
[HTC One X] tids2k:
Have patience my friend.
[HTC One X] tids2k:
@kholk can you please put links for the nvflash references and links ! Thank you.
[HTC One X] Sebianoti:
Worth waiting for?
[HTC One X] tids2k:
I would, if I was U ! :-)
[HTC One X] ytwytw:
kholk, hey nice to see you here, I love your work for the Moto Atrix :D

Too bad I am getting the Rogers HTC One X LTE Version (dual-core LTE)

so I *think* the nvFlash probably not genetic enough to deal with S-OFF, also for Atrix, one of the official bootloader has exploit so we got UNLOCKED, which is still not related to the tegra platform itself or nvflash...

and I *think*, the only solution, probably just for now, is that taobao.com 200RMB (~30USD) S-OFF solution

I *guess* it's use DIAG.nhb (put on the goldcard) + SmartCard(xtc should work too) to perform full S-OFF unlock (with change of CID obv)

and the DIAG.nhb file could be the key point since it is signatured, and the SmartCard only is used during the last step to change CID

so... yeah...

Please correct me if I am wrong... I am just discussing the s-off here, no offensive plz
[HTC One X] schriss:
If I buy this, what do I get? A file and smartcard or what? I can buy this no problem, if it helps to get closer to working solution. But no chineese skills, can't even operate that website not to speak of any instructions they would provide.
[HTC One X] DamoElDiablo:
Maybe I'm misinterpreting here, but as the One X doesn't have a micro-SD card slot, I don't think the goldcard/smartcard based solutions will work?
[HTC One X] huwwatkins:
How does the taobao method work? Do you have to send your phone off?
[HTC One X] Wiingy:
Yea would be great if somebody could translate the Pictures on the site.

Apart from the pics, there isn't much information at all on how it works.

---

Has anybody tried to create a gold card using the built in card ?

Going to give it a go later, just reading up more info on it, I don't really want to brick my phone

---

Tried it, didn't work. I am still locked btw, haven't tried htc-dev unlock yet, doubt it would make any difference but.

Damaged the internal sdcard and had to reformat inside the phone.