yashsingh1/xdaforums huggingface dataset:
[HTC One X] Thunder07:
i was looking through this threads attachments and saw this

what interests me is the part about RUU at the bottom,

"when flashing RUU, there is a time when the lock is open and it is closed again when the flash is complete"

if the way i look at this is... if you stop the RUU half way through you might just be left with an open/writeable nand

also you could end up with the 1st fully bricked HOX :p

AS Always Attempt This At Your Own Risk

Also im presuming this guy knows what he's talking about

i wont provide to much detail to make sure if you make it all the way to the end of the instruction you've done so very willingly

you'll need a locked bootloader/relocked.... probably stock rom

you need to get the firmware zip or even rom.zip corresponding to your phone cid/version

boot into RUU mode "fastboot oem rebootRUU"

"fastboot flash zip fm.zip"

see how long it takes to get to the recovery flash part...

now time it so when you force shutdown your phone you'll stop at recovery... to avoid hardbrick

"fastboot flash zip fm.zip" while attempting to force shutdown at recovery

when you're done with that hopefully you'll be able to boot normally into android..

and through there see if you can access locked partitions and modify them

I cant and even if i can WONT try this on my phone

You've Been Warned
[HTC One X] backfromthestorm:
Or, when its stopped, quickly try fastboot flash recovery? Save having to boot then, if its s-off it'll flash. Or even fastboot flash hboot eng_hboot.img? Incase it gos back to s-on on reboot, stick the eng boot in while we have the chance.
[HTC One X] Thunder07:
no because when you stop it the phone will be off....

however you can try booting back into the bootloader and try flashing it there...

if it works then you're s-off or even without s-off but still can write to recovery
[HTC One X] HebeGuess:
thunder07, could this be a solution for rooting HOX. i saw a thread on TW forum stating he achieve root without unloacking bootloader..

http://xdaforums.com/showthread.php?t=1081239

Its seems like the singnature is part of the file system, thus editing file meta (at least file permissions) is not breaking signature generated using the content.

:confused:
[HTC One X] Thunder07:
any means of modifcation will break the signature

long story short there will never be a way around the signature unless htc's private key is leaked,

look at the ps3 it took 3years i think before it was hacked...

and even after that nothing came out of it until they found that a random string that was used to sign was not so random but was 4 ALL the time...

this was a mistake by song which allowed people in.... they signed their stuff to get it to work...

unless htc make the same mistake it might be just as hard to break into the HOX as the ps3
[HTC One X] bunny0007:
There is no way this will work.

You will have 1 or 2 sec to power down your phone, and force power of takes about 5-8 sec and flash time of recovery takes about 1,5 sec.

Or you will end up in ruu mode again if ruu update fails.
[HTC One X] arabmed:
if we use y cabel or we can dicconect the usb cable ?

if we use y cabel or we can dicconect the usb cable ?
[HTC One X] bunny0007:
Ycable are for flashing direct from bootloader, but i do not thing we are able to flash from bootoader with s-on, and if you disconnect while flashing from hboot i think the phone freeze.

And if you disconnect the cable within ruu upgrade, you will end in at ruu recover mode, or if you disconnect at a wrong time, you can end up with a corrupt system partition, or broken hboot there for sure will kill your phone.

Its pretty much pure hazzard
[HTC One X] backfromthestorm:
have another usb cable set up ready to flash eng hboot, and swap em over quickly! at the right moment of course. then hit enter, flash hboot.
[HTC One X] supendal:
Instead of timing to turn off device, you can open it up and just pull the battery at the right time.
[HTC One X] theDroidfanatic:
Since when does the HOX have a removable battery?
[HTC One X] ste1164:
It doesnt so to speak but if you take off the back the battery is fairly easily replaced.
[HTC One X] supendal:
I said open your device up.
[HTC One X] nms247:
Nothing is impossible. Will just take time.
[HTC One X] Fightspit:
Or, instead of switching off the phone, why not to shut down the computer ?

It will force to stop the RUU, no ?

Sent from HTC One X
[HTC One X] Thunder07:
sorry but why be so retarded :p :cyclops:

if that was any good... just disconnecting th cable would've done it...

but no, the zip is sent to the phone before anything takes place so its no good
[HTC One X] glukosio:
is there any way to make a short with pogo pins to force reboot without waiting 8-10 seconds?
[HTC One X] :
On the att model you can get it into dl mode with pogo pins but its a locked down dl mode
[HTC One X] CamoGeko:
Who in their right mind would do that?

Sent from my HTC One X
[HTC One X] GabrielSousa:
open the HOX is very very easy...

http://xdaforums.com/showthread.php?t=1668206
[HTC One X] Mischaseb:
It's only mildly harder than taking the cover off a sensation
[HTC One X] NEUR0M4NCER:
... at this point I'm glad I went the HTCDev route!
[HTC One X] glukosio:
it's possible to do with fingers! just pay attention when you put it back again, one time i had problem with led of back button and speaker didn't work, then i did it again and it works
[HTC One X] DarkMio:
If it is the RUU which opens the lock and closes it again:

Try Cheat Engine which can freeze Software completely. I don't think that the ruu have any sort of timers in it, so slowing down wouldn't work.

While the RUU is frozen, mess around.

To get the speed a little more down: Cap the USB Bandwidth. There are some sort of manipulation drivers / software which can do it, since I don't have fast internet anywhere atm. I can't provide Links. Sorry for that.

But this are two steps to slow this processes down.
[HTC One X] glukosio:
@DarkMio

is the phone who open access, not the computer, so we need to reboot phone in that lapse of time, computer doesn't do anything but giving command to open for writing
[HTC One X] bunny0007:
Yep the zip is signed with the htc private certificate, like all other htc updates.

It the same check in fastboot, ruu and revocery.
[HTC One X] CamoGeko:
I doubt I'll be bothered to do it at all lol
[HTC One X] ferasab:
What if we take a look at G2X LG <<< TEGRA

Hello, am just a htc one x user, i am not into hacking that much, but since i wanted my htc to be s-off ed :D i been visiting this page almost everyday,

today i was installing customized rom for my friends phone LG G2X, and this phone got nvidia technology on it, the g2x needed APX mode in order to unlock the device, and it was nothing about the lg bootloader, what if nvidia is more important to us than htc bootloader...

i don't know, i am just thinking.:laugh:
[HTC One X] Cass67:
G2X is tegra 2, OneX is tegra 3 .. Not sure how much of a difference that makes in terms of APX but the stumbler here is the HTC bootloader and its lack of path to APX mode, its not easy to get in to.. seems LG left that mode wide open and HTC did not. not sure to be honest what your point was about Nvidia being more important as im not understanding what you mean.
[HTC One X] ste1164:
Didnt the LG 4X get root recently? Doesnt that have tegra 3.
[HTC One X] mattman83:
It is tegra 3, but it doesn't have htc messing with things either.

M.
[HTC One X] feis:
You realise one x has root too? People who have no understanding of what s-on is and how to disable it shouldn't spam this thread. I'm not trying to offend anyone, but 10 pages of silly questions ain't helping here :P just wait patiently for the smart guys to work it out. Peace
[HTC One X] Rusty!:
Yeah the Optimus 4X is in the same boat really, if not worse. It is properly locked down. At least we have a compromise in HTCDev.
[HTC One X] ste1164:
Yes Im aware we have root but I also wondered if we found a way around HTCDev that would help, we might find a S-OFF exploit on the way. I'm fully aware of what S-ON and S-OFF are thanks.
[HTC One X] Cristianop:
Stop spamming this thread.there is a separate soff discussion thread where you can ask whatever u want.

This thread is for dev who currently r working on soff.

Thx

Gesendet von meinem HTC One X
[HTC One X] Genkville:
Can this thread be closed and deleted?
[HTC One X] Goku80:
to big and long for it to happen mate....no offence to whoever is working on the s-off but really does not fill me with confidence that it will ever happen at least in the near future...not much is going on and might as well close it till any actual developments happen...
[HTC One X] sabret00the:
Shhhhh
[HTC One X] madindehead:
I know I'm late to the party on this, but I have a quick question about this post.

Doesn't the most up to date have HBOOT 1.11? (Not getting my device until tomorrow). Also, what did you mean xmoo, when you said "I'll have something to let us downgrade."

Surely if the latest HBOOT is 1.11, can you try that something you mentioned?
[HTC One X] f4flake:
How do you know it's in APX mode? will it not boot and does windows as k for an APX driver when you connect it?
[HTC One X] Whiskey103:
No need to report anything, I read here anyway.

Let's be civil, no need for hostile comments guys ;)

Let's play nice shall we please!?

Thread cleaned, nothing happened :D

Cheers

Whiskey

Forum Moderator
[HTC One X] Diamondback:
Please stay on topic guys....

Stacking up mod posts one after each other isn't exactly a good sign for a thread ;)

Thread cleaned.
[HTC One X] KaoMinerva:
If I had the One X, I'd ship mine to xmoo for s-off.

***Cooking The Work With Them Gloves On, So The Junkies Can Get They Grub On***
[HTC One X] xmoo:
As I said 100000000 times before. I had the javacard for a day to do some testing!

Please stop pm'ing me and asking for shipping the device to me etc...

Football and me tried a lot of stuff and are now at a dead end.

Mid next week I hope to get some more info about APX.
[HTC One X] KrisPerry:
Apx mode is the only way, and we are a million miles from that
[HTC One X] Jhinta:
i realy am seeing mmcblkboot 0 and 1, dont know what there are.

cant do anything yet have to get some hardware but those partitions are there ( +/-2mb in size )
[HTC One X] xmoo:
Hmz. 2mb is size of a hboot.

Tell me more about this.
[HTC One X] Jhinta:
From what I read online this is the protected space of mmc detected as mmcblk0boot0 . I'm trying to run native but need a keyboard connected to type I already have fb and terminal

Verstuurd van mijn HTC One X met Tapatalk
[HTC One X] VIIRU§:
With that said this thread should be locked until someone has s-off to release.
[HTC One X] Cristianop:
Omg always those ungrateful comments.do you have some development to contribute to s-off? If not please, stay out this thread (and use instead the s-off discussion thread) until someone has s-off!

Thx

Sent from my HTC One X
[HTC One X] Fightspit:
Since a few hours, HTCdev has released supplement files for 2.17 kernel. One of the files called mtd.c may shows something interesting for understanding the partition of the OneX. There are functions which can read or write blocs of the mtds and many more.
[HTC One X] MrT69:
Based on the idea to change the SUPER CID on the "mmcblk0p4" partition I imaged all partitions on the HOX.

It seems "mmcblk0p19" contain logfiles where i.e. HTC can find and see who has done changes within the bootloader.

But more interesting is this log file:

Take a look at the KERNEL COMMAND LINE. Never have seen this bevore.
[HTC One X] Thunder07:
sure to have to tell you this... but mmcblk0p19 is devlog partition is you can access it through /devlog

and as for the cmdline its in /proc/cmdline and is controlled by the kernel if i wasnt wrong...

considering how all the kernels developers are proper developers if thy though its any use they would have done something with it...

Off-topic....

to all the *****ing *****es....

i know of people working behind the scene away from your *****ness...

now i hope you're turning in your graves as i wont tell you of any of their progress until they decide to speak themselves :mad:
[HTC One X] viper619:
Just don't answer back to them and we all know who they are, anyone who would like to help will add something usefull others *****ing leave them.

we have a saying (Dogs bark, but the Convoy still moves forward).

cheers
[HTC One X] VIIRU§:
That's what we all should be doing. Everyone its just trolling or arguing and its way off topic. This thread should be closed until xmoo is ready for it to be reopened.
[HTC One X] BenPope:
I must have missed the post where xmoo asked for it to be closed.
[HTC One X] orb3000:
.

Closed until xmoo wants to re open
[HTC One X] kholk:
@blubbers

Smart thing, but we already know where and what the partitions are!

If you scroll up, there's a list with meaning and correct order ;)
[HTC One X] Sentinel196:
XMOO, I saw that same pic a week ago...?
[HTC One X] N3m3515:
depends on his method. if its radio s-off it will stay. if its a cracked hboot it will be gone.
[HTC One X] xmoo:
He posted it on his Twitter account.

And no, he is not my source.

His source are people from HTC.

We the underground kings :P

I think it is Radio S-OFF, don't think people from HTC would love it, if he leakes a ENG HBOOT.
[HTC One X] tids2k:
but if you install an official RUU with hboot.img in it it will overwrite the hboot, thus making s-off -> s-on !
[HTC One X] blubbers:
yeah, i've posted that already for a s-on device.. i wanted to check if there is a diff on s-off
[HTC One X] tids2k:
He is not the only one with S-Off device in hand '_'
[HTC One X] xmoo:
Nope, on my DHD even flashing other official RUU's the S-OFF kept being OFF.
[HTC One X] blubbers:
ah alright, didn't knew you had soff

run this please

hexdump -C /dev/block/mmcblk0|head -1000|grep GPT|wc -l
[HTC One X] schriss:
Good thinking, never assume anything :D
[HTC One X] tids2k:
I meant others have S-Off .... If I had one we would have S-off on each device by now.

Sent from my HTC One X
[HTC One X] mattman83:
Depends on how it's done.

The other way is to extract the rom from RUU and flash via cwm - but remove the hboot.img before you flash. It'd prob kill the signature but that doesn't matter if you're s-off ;)

M.
[HTC One X] tids2k:
Lol exactly, that's why s-off tool was invented so that anyone who had updated his hboot could go back to the required hboot, to get s-off.

Sent from my HTC One X
[HTC One X] xmoo:
C:\Downloads and ROMs\ssdtool>fastboot oem saveprt2sd hboot -n hbootpart.img

...

(bootloader) [ERR] Command error !!!

OKAY [ 0.031s]

finished. total time: 0.031s

block.img http://www1.zippyshare.com/v/89862834/file.html

But it is 30bytes, not 30mb... So I guess the command should change right?
[HTC One X] Sentinel196:
Do OTA updates contain a hboot image?

If we need to make sure the S-OFF'd hboot file doesn't get overwritten, that would mean we'd have to extract OTA updates and remove the hboot file from those too, right?

Sorry for the dumb question. My previous experience with custom ROMs on android was with HD2 so I never had OTA updates.
[HTC One X] xmoo:
C:\Downloads and ROMs\ssdtool>adb shell

root@android:/ # hexdump -C /dev/block/mmcblk0|head -1000|grep GPT|wc -l

hexdump -C /dev/block/mmcblk0|head -1000|grep GPT|wc -l

14
[HTC One X] tids2k:
Thats what I'm getting but I was expecting something else.

Sent from my HTC One X
[HTC One X] tids2k:
This command is not supported ?? !!

Sent from my HTC One X
[HTC One X] Polarfuchs:
Th RUU firmwares you can find here on xda do contain the hboot.xx.xxx.img inside the rom.zip, yes
[HTC One X] Sentinel196:
Thanks, but I was asking about the updates that get pushed via OTA. Not the RUU files.

I suppose it doesn't really matter for those of us just wanting to debrand anyway. Once the device is S-OFF'd and flashed to the WWE RUU, it shouldn't matter if it get's locked again, as long as superCID remains (or gets changed to a WWE CID)

Anyway I'll shut up now. Very interested to see what happens over the next few days!
[HTC One X] tids2k:
I get the same 30 byte file.

Sent from my HTC One X
[HTC One X] kholk:
Are you sure he've written 1M?

Note that "1M" is different from "1m"

EDIT: It seems the version of dd in the One X doesn't recognize the "M".

Use that, instead:

dd if=/dev/block/mmcblk0 of=/sdcard/dumps/block.img bs=1024000 count=30
[HTC One X] blubbers:
don't run the command, it is a waste of time. xmoo already checked with "

hexdump -C /dev/block/mmcblk0|head -1000|grep GPT|wc -l" on a s-off device if there is any difference to a s-on device

the data keeps repeating after 4096 bytes
[HTC One X] mattman83:
Yes the ota can contain hboot too. Just be careful with htc updates until it settles down.

M.
[HTC One X] tids2k:
with this commad

dd if=/dev/block/mmcblk0 of=/sdcard/dumps/block.img bs=1024000 count=30

Im getting the same repitition of commands ! i think i cant help u with it !
[HTC One X] kholk:
@blubbers

Wasting 30 seconds of our lives is nothing ;)
[HTC One X] tids2k:
@moo the dump u provided is it from S-off device, because if it is so then it has the same set of data and the 'interesting' partitions are masked @ ..

SO THE PARTITIONS AND DATA ON THE S-OFF & S-ON ARE SAME ! MASKED 00000 00000 00000 00000 00000
[HTC One X] f4flake:
Nvflash --getbct is an nvflash command.

This is clearly the bct it fetches.

http://androidroot.mobi/technical/tf-secure-boot-key/
[HTC One X] blubbers:
no, this is clearly a part of the partition table fetched ;)

---------- Post added at 01:49 PM ---------- Previous post was at 01:48 PM ----------

off to build an usb otg cable..
[HTC One X] f4flake:
Perhaps I should have said "to do with" nvflash.
[HTC One X] blubbers:
http://dashu4.wordpress.com/2011/11/10/how-to-make-diy-usb-otg/

if anyone wants to build one
[HTC One X] tids2k:
---------- Post added at 12:55 PM ---------- Previous post was at 12:54 PM ----------

i have one what do u want me to do with it :D , i dont think the kernel supports OTG support ! not with the microusb plugged into an OTG adapter.
[HTC One X] xmoo:
Block.img first 30mb ;)

http://www51.zippyshare.com/v/25822482/file.html
[HTC One X] tids2k:
fingers crossed !

---------- Post added at 01:04 PM ---------- Previous post was at 01:00 PM ----------

its the same data that i have got !!!! :( :(:mad: same repitive sequence / 4096 .... 4096 /
[HTC One X] blubbers:
hboot does support otg
[HTC One X] tids2k:
i have tried two otg adapter's and two flash drives none works in either hboot or normal boot :(

---------- Post added at 01:14 PM ---------- Previous post was at 01:11 PM ----------

@kholk what could be the possible combinations for entering into APX/nvflash mode ! Can you do it via JTAG test points ? if we found out the exact points ?
[HTC One X] N3m3515:
i dont think that we get a button combination. reboot-into-apx-kernel would help
[HTC One X] blubbers:
i am trying to attach a keyboard. i guess i need an Y-cable with a charging source
[HTC One X] f4flake:
I was trying to enter apx mode all morning, using various combinations. Seemingly simply connecting the USB cable when its powered off is a possibility, though holding both volume keys before hand might do something judging from other handsets.

Managed to get a few "not allowed" responses with nvflash within a terminal.
[HTC One X] blubbers:
what happens if you run

./nvflash -w --sync

?

---------- Post added at 03:55 PM ---------- Previous post was at 03:44 PM ----------

i made a Y-otg-cable, can't get a keyboard working in hboot, just hangs at "checking sd card update"
[HTC One X] schriss:
Transformer Prime goes into APX mode by powering device as usual THEN when you see logo (HTC in our case) they press Power+Vol-Up. I tried that but with no USB cable (at work) and it rebooted. Now that's unusual because usually pressing-holding power would shut off.
[HTC One X] Polarfuchs:
It does the same with usb attached.

And if you press and hold power it reboots. It doesn't shut off.
[HTC One X] blubbers:
no, pressing power for 10+ seconds makes the device reboot, not power down
[HTC One X] schriss:
Maybe there is some trick. iPhones had something like: power on, as soon as splashscreen press home while still holding power, then release power but keep pressing home. We can play in spare time while other guys inspect partition dumps.
[HTC One X] blubbers:
supposedly, if the device is connected to nvflash, the device id is 0955:xxxx

0955 is the vendor id of nvidia, 0bb4 is the vendor id of htc

could you check the device id the next time you get a "not allowed"?

what os are you using?

connection the powered down device on linux with "nvflash -w" does not do anything. and the usb device id is "0bb4:0cd6" which is the same as in normal booted mode. in hboot/fastboot, the device id is "0bb4:0fff"
[HTC One X] f4flake:
Will check now.

-------------

sat on nvflash started, gave a little triple vibrate from the handset. but just sitting there.
[HTC One X] Polarfuchs:
If you power down the phone from android while you are connected via usb.

Why does does windows7 show "HTC Android phone usb device" after the red charging led goes on?

I mean, when it is powered off I don't need a mass storage mode.

So, how to make the phone really powered off? When is the phone off?

I think it shouldn't be recognized in device manager if it is turned off and charging via usb.
[HTC One X] blubbers:
"-w" waits for a device to connect. if it just sit's there, it is not in nvflash mode

what is the device id?

how did you get it to triple vibrate?
[HTC One X] N3m3515:
but we get nvflash responses from the phone. how did you manage to get it to that point?

meeeh :( i wanna hear something from shen
[HTC One X] Evil-Dragon:
Anyone tried connecting to:

ttyS0 115200n8

?

There's some interesting stuff in the Hboot, might have a few answers to some of the questions. A lot is in plain text.
[HTC One X] blubbers:
tried connection with the usbserial module while in fastboot mode and connection to ttyUSB0, always getting

FAIL(00120000)

[606140.978535] usb 2-3: default language 0x0409
[606140.978908] usb 2-3: udev 78, busnum 2, minor = 205
[606140.978912] usb 2-3: New USB device found, idVendor=0bb4, idProduct=0fff
[606140.978915] usb 2-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[606140.978918] usb 2-3: Product: Fastboot
[606140.978920] usb 2-3: Manufacturer: My HTC
[606140.978922] usb 2-3: SerialNumber: censored
[606140.979010] usb 2-3: usb_probe_device
[606140.979014] usb 2-3: configuration #1 chosen from 1 choice
[606140.979314] usb 2-3: adding 2-3:1.0 (config #1, interface 0)
[606140.979356] usbserial_generic 2-3:1.0: usb_probe_interface
[606140.979359] usbserial_generic 2-3:1.0: usb_probe_interface - got id
[606140.979363] usbserial_generic 2-3:1.0: generic converter detected
[606140.979420] usb 2-3: generic converter now attached to ttyUSB0
[606140.979450] drivers/usb/core/inode.c: creating file '078'
[HTC One X] schriss:
I think when you charge it it's not really off, it's just the screen might be off. So when it's off, as soon as cable plugged in, it boots into some charging mode.
[HTC One X] blubbers:
modprobe usbserial vendor=0x0BB4 product=0x0fff

is the command to load the module

hboot does not support client mode, so you wont be able to talk to hboot with this method, on earlier htc devices this was working
[HTC One X] f4flake:
os is centos5 64
[HTC One X] steve36:
shen,s attempt to s-off just broke hboot he trying some thing else i think
[HTC One X] f4flake:
triple vibrate appears to be time related.

powered down, connected to pc

after a short while it gives three short vibratres.
[HTC One X] Evil-Dragon:
Dammit, thanks for checking that out. Was just another idea from the Hboot. Out of interest, is the Hboot compiled in ARM? Can it be decompiled? Or is it encrypted?
[HTC One X] blubbers:
if you've got $2500 for an arm decompiler, we can decompile it.

there is only a "free" x86 decompiler around.

but i guess you mean if we can disassemble it. yes, get "ida pro", but 2mb of assembly is a sh*tload to read and understand.
[HTC One X] Evil-Dragon:
Woah. I'll see if Ida can decompile it later when my daughter wakes up.