yashsingh1/xdaforums huggingface dataset:
[HTC One X] m7ixalis:
We must thank you million of times for your hard work .

keep trying and i am shure that soon you will have the sulution.
[HTC One X] jonas2295:
*guys lol :D
[HTC One X] mattman83:
Stuff that works for the One S is 99% irrelevant for us. It's a different SoC, even stuff that works for the ATT HOX doesn't work for us. Security seems to be much looser on the One S/ATT HOX, but at the same time you can't get a htcdev unlock on ATT HOX.

M.
[HTC One X] GabrielSousa:
@xmoo

when you going to meet the guy with a soff HOX ?
[HTC One X] Megawhopp:
I have bought a phone from a guy working at a phone company here in Denmark. He is a tester on phones.

I havent rooted it or anythin, and i can see that it is S-off

I cant imagine that he has rooted it, so maybe this can be used to anythin exiting??
[HTC One X] LlabTooFeR:
Please make screenshot of bootloader and rom version.
[HTC One X] P1n3apqlExpr3ss:
I have an s-off One X here that I'm not doing much with. I'm happy to help out the s-off process in my spare time, just let me know what to do and I'll get around to it
[HTC One X] Rekoil:
That's the idea.

EDIT: Easiest way would be to dump the entire nand onto an external harddrive, preferably from within recovery since most of the nand isn't being accessed by a system while in there.

It's not the partitions that are locked, afaik it is actually the memory locations on nand that are locked. Meaning we probably can write to mmcblk0, but possibly only in the locations that are not locked. It's hard to say what will work not knowing how the lock works. Sufficed to say, writing to mmcblk0 should work.

For the record, once they change the CID from the AT&T CID to one that is allowed to unlock, like HTC__001 or 11111111, then they are able to do the HTCDev unlock just like us.
[HTC One X] mattman83:
I haven't been following it, but I thought that got blocked by HTC a few hours later? Or did they open it up again.

M.
[HTC One X] xmoo:
Probably July since I'm very busy with school now.

These two weeks is all about deadlines :P
[HTC One X] dezborders:
3 points were made to me by the main players in this thread...

1. Writes to all the mmcblk files get reverted to original at reboot

2. Mmcblk0 is 32gb in size so cannot be dumped to sd. Also, the dd command conv=notrunc parameter is disabled in android so you can't update only part of mmcblk0 without corrupting (truncating) the 10s of gigabytes after the cid bytes.

3. None of the mmckblk.p part files map to the same area of Nandroid memory where the cid is stored so they are no use.

In all honesty do you think if there was an easy way to write to specific bytes in mmcblk0 directly that we would still be discussing ways to obtain s-off? Lol
[HTC One X] Rekoil:
You might be right, I haven't been following it either.

Like I said in my previous post, as we don't know how the lock works (and as far as I know this has yet to be attempted) we cannot know for certain the result before we try. As I understand it, conv=notrunc is used to truncate the output when the input ends without having reached the requested block size, it has nothing to do with what we are trying to accomplish. If you want to write a specific size to a specific area you would type:

This command would start writing input.img to /dev/mmcblk0 starting at 512kb into the nand. It would continue writing until it had nothing left in the input image to write. If you had a larger input file, but only wished to write the first 16kb of it to /dev/mmcblk0 the command would instead be:

Of course, I don't actually know until I have tried that this does indeed write anything to the nand, it is also entirely possible that I can

only

write to the addresses which the nand controller has specifically stated should be available.

An interesting (or not) idea I just had while thinking about all of this. When we are writing to areas which "do not get saved" they are actually saved while the device is running, correct? So where is it storing what we're writing? It obviously keeps it somewhere? RAM? Somewhere else on the nand? What would happen if we overflowed this temporary storage area, would it then begin writing to the actual nand? (Probably not, but anything is worth looking into at this point in my opinion)
[HTC One X] dezborders:
This is what I was trying for a few weeks back but I was led to believe without notrunc option everything past the block I wrote to would be wiped clean.

Of course you are welcome to be the brave man to try your command and see what happens. I am not that brave. Lol
[HTC One X] KrisPerry:
What is the worst that could happen
[HTC One X] Rekoil:
Once my USB-OTG cable arrives I plan on dumping the entire nand, figuring out where the CID is stored, and doing just this.

Fun fact: I mistakenly ordered a USB-OTG cable that only fits in Nokias a while back >.<... anyone have a Nokia and would like an OTG cable? :P
[HTC One X] dezborders:
Permanent brick with void warranty? Lol
[HTC One X] dezborders:
Kl keep us posted as to progress.

Nokia? I remember them. Not always fondly ... Lol
[HTC One X] KrisPerry:
Why would it void warranty. HTC would have no way of knowing the cause
[HTC One X] Rekoil:
It is definitely not something that can be done while S-ON and locked. I assume dezborders was referring to the fact that if it fails then the person who had unlocked and tried it would be screwed if it actually did something and didn't work.
[HTC One X] Rekoil:
Something that could work, and bear with me here :P

What if we just wrote ones across the entire nand and rebooted into recovery and dumped the nand, easy way to check which areas we can write to, and since we can write to them we can fix it again! :D

EDIT: Oh dear, sorry for double posting!
[HTC One X] blubbers:
I've posted some weeks ago which sectors are protected
[HTC One X] Evil-Dragon:
It can be a bit more catastrophic than that, if a small section gets corrupted or written with bad data it will probably brick with little to no chance of recovery without a jtag method or a complete motherboard replacement from HTC (expensive!)

I really would avoid writing any random data to nand without it being verified as safe. This is why the revolutionary team have a beta system to stop mass bricks from happening on a massive scale. I'm not down playing any work being done on this I would just stress that once bricked, you're buggered.

Even if we can get supercid to stick, we will still be someway to getting s-off. Writing a new hboot to ignore javacard checks would be awesome, it would allow us to push secure flag to off and then you wouldn't need to worry about keeping a modified hboot across hboot upgrades.
[HTC One X] sieempi:
I agree with you, super cid is so much != s'off, new approach required

Via XDA App
[HTC One X] Rekoil:
But it's not random, it's ones, very predicable!

Yeah I know, I was being slightly silly.
[HTC One X] artymarty:
Writing patterns to memory to see what changed - Not that silly.... Probably before your time, but there was a cartridge for the commodore 64 computer that was called the 'ice-pic'

It did just that -wrote a predefined pattern to all the computer memory, did a soft reboot and let you load a program/game.

At any point you could flick a switch on the cartridge, and it would then do an image dump of everything in the ram that *didnt* match the pattern. You could then load up the image dump at any time, and the computer would continue from the exact point where the switch was flicked.

Anyway... Something on topic, I've worked in the it industry for 20 -30 year's, and after reading the last 10 pages I would say:

1) please don't say something doesn't work unless you have personally tried it. In science they have a peer review process. Someone says something does or doesn't work when only THEY have tried it. Not someone's brother ex girlfriend who knew this guy that tried it.. Then it's tested by someone else. If someone wants to try something, do not discourage them as it may work, or it may not but give them an idea about something else that will.

If things are not tried because some negative Nancy said it won't work, things will get missed and a solution not found.

HTC say the phone is not hackable - so do you want to prove them right or prove them wrong?

2) Don't ever ask how long will it take. The only way to know the answer to that question is when you know the solution. Until you know the solution, it could be anywhere from "in one second" to "for ever."

... And while they are answering the "how long" question, they are not looking for the solution, so you just made it take longer. Thanks.

When I was in IT, nothing pissed me off more than that question. :0)

Keep up the good work for those working on it, and everyone else, stay positive or stay away....

Marty.

Sent from the future using tipi-tapa-talk 37
[HTC One X] Joolee:
Ah, no problem. When you reboot, everything will be reset again. There are a few that already wiped the whole mmcblk0 part. After reboot, everything is back to normal.

That's also the reason this pursuit isn't going to bear fruit.
[HTC One X] miniudavid:
But when you change something and it gets back at reboot. Where is the information stored how its got to be? Can't we just search for that and change it? So that its changed to what we want at reboot?
[HTC One X] Diamondback:
Thread cleaned! Stay on topic please!
[HTC One X] Erik Lieders:
I spoke with my sister's husband. Actually he works in Google as hardware engineer. He sad that EU HOX has controlled security. It means some chip inside HOX gives a command to HBOOT (S-ON or S-OFF) and it initializing at start. There is no access to the security chip. It programmed by special hardware to the one way. Thats why there is no difference between s-offed HOX and s-oned.
[HTC One X] N3m3515:
and why do some people here state that they lost s-off after updating the hboot?

cant be true if its controlled by a chip wich cant be written after its out of factory.

and even if its true: if we find out ho to put a "custom hboot" on our devices.

we can put one on there that ignores this chip and is s-off all the time.
[HTC One X] Erik Lieders:
Yeah, but all s-offed devices have factory s-off. If hboot is different - it automatically switch s-off to s-on. Probably HTC hardware which used to give s-off made some writing in hboot. But this writing dont gives us s-off. It just pass the verifying.

---------- Post added at 03:47 PM ---------- Previous post was at 03:44 PM ----------

maybe... But if this chip starts first? If this security chip starts hboot? It can be...
[HTC One X] xmoo:
So you guys think the chineese people seeling s-off can edit that chip?

I'm very busy with my deadlines, will try to do some testing etc. as much as I can.
[HTC One X] N3m3515:
if these chinese guys really sell s-off (was someone in theyr shop and let them do theyr magic?) we have another proof that this chip isnt true. but maybe your brother-in-law was not specific enough about the security on the european tegra3 htc one x?
[HTC One X] Erik Lieders:
i think they use special hardware which can work with security system.

---------- Post added at 04:27 PM ---------- Previous post was at 04:20 PM ----------

sorry for offtop, BUT! 3 years ago Steinberg Cubase was cracked by AIR Crackers Team. There was so difficult secure system. They worked about 400-500 days. That was Cubase 4 and 5. Cubase 6 was released 2 years ago. There is no cracked version at all... And it will not be in future. 'Cause it uses usb dongle with not accessible part. We have almost the same. Its the new security system. And it's not a pessimism. It's a realism...
[HTC One X] ChronoWerX:
Stop trolling, our dev will do s-off

I really think this. There is nothing this is breakable. And I don't think, HTC do this, because is will costs and customers, because the devs will locked at other hardware like Samsung etc.
[HTC One X] Erik Lieders:
are you think that HTC thinks about customers??? They all think about money=)
[HTC One X] ChronoWerX:
Yes and the chip, the software, the hardware is free?

Now stop and a MOD pls clean the thread
[HTC One X] kb0n:
I read lots of "if, can, maybe, probably, I think, perhaps"...

It's nice to have a discussion about this, but it's all assumptions. And all it is used for right now is to think of cases where s-off could not be achieved, but what we need is the opposite. You gain almost 0 useful information from that :/
[HTC One X] ximonx:
Looking at page 1683 (25.2.3.5) in the Tegra 3 manual:

25.2.3.5 Memory Lock

The hardware provides a programmable address range on the flash controller, and a write once unchangeable bit for each

range (

unless the HW is reset

) to implement this feature for software.

NAND_LOCK_CONTROL: software configures which range check is applicable now.

NAND_LOCK_STATUS: HW indicates which of the range is matched caused this interrupt.

NAND_LOCK_APERTURE_START0 – NAND_LOCK_APERTURE_END0: If Block erase command address

matches this range (inclusive of start, ends), actual flash erase is skipped and LOCK_ERROR interrupt is generated.

Also, looking at page 1727 (25.4.26) in the Tegra 3 manual:

LOCK_APER_EN7: Enable lock feature for selected apertures 7 Can be set only once

register field,

hardware reset OR controller reset

ONLY can disable this feature.

Can we not just re-set the nand controller and re-initialise it without the security aperatures set??
[HTC One X] danlat1415:
I'm sure you're already aware - but here is a link to a Chinese company claiming to have achieved S-OFF the Indonesia HTC One X.

Not sure if this would be relevant to European Tegra version or not.

original link:

http://htc.zol.com.cn/109/33080_1083270.html

translated version:

http://translate.google.com/transla...=http://htc.zol.com.cn/109/33080_1083270.html

They use a method of using a modified boot image and pushing S-OFF to the device.
[HTC One X] musa91:
when u copy something point to the real sorcerer .... i just thread this 20 mins ago here
[HTC One X] skygear:
I just read the whole thing and 25 pages of comments. All I kept reading was failed downloads, "DINg ding ding", "no S-Off", no pictures of anyone with S-OFF! not even in the OP... I'd try it, but looks like you need to earn "Z-Calls" or something to get DL points. Someone join and get the files then post here...
[HTC One X] witm01:
Well, there may be a lot of instances of "S-OFF" in that text but the screenshots and what little Google translation can make of the Chinese seem to tell a different story - namely that of a simple bootloader unlocking.

Be that as it may and on a more general note regarding the seemingly increasing streaks of pessimism here: there is one simple truth to remember and it's basic logic. The One X didn't just magically appear out of nothingness, security lock-outs in place and everything. It was engineered. In an economic context. Thus naturally, it was engineered to be serviceable in a cost-efficient manner and the security flag must have been designed to be switchable (see Tegra3 manual). And there is HTC's security flaw #1: given that no piece of software (or hardware) is error-free, it inevitably means that such a switch can also be attained in other ways than the one officially intended. It's only a matter of time. Best case scenario for HTC: it takes devs too long to devise a successful attack vector and they move on to the next device. Every other case means: we win! So give the devs a chance, let them explore different attack vectors, allow them to fail without being derided and ridiculed, because eventually one or more of them will succeed.
[HTC One X] Evil-Dragon:
I can't for the life of me figure out how a boot.img would even achieve s-off unless it's some kind of special exploit. Considering their is no proof of s-off then I'm calling it bull****.

EDIT: NOT AGAIN! This is the same boot.img and method from earlier in the thread. It doesn't work or give s-off.
[HTC One X] DarkMio:
Looks promising. They push something after unlocking. Can you post this in the development section, so someone can try this?
[HTC One X] f4flake:
If someone can post the files I'll try it.
[HTC One X] KrisPerry:
http://dl.dropbox.com/u/8252379/boot.rar
[HTC One X] lostunsunghero:
so i'll stop this right now. This was discussed on like page 30 or something really early and it was a dead end. Stop wasting your time.
[HTC One X] Kickasskev:
If at first you don't succeed try and try again

So the saying goes!!!!
[HTC One X] keroro430:
Stop flashing boot.img please. boot.img is just kernel and Ramdisk. This image will not gain S-OFF. Many informations from china is copied and fake!
[HTC One X] Rekoil:
While you're correct in this instance, a kernel and ramdisk could very well contain code that breaks into the device and makes it S-OFF, especially since we can run unsigned boot partitions after unlocking via htcdev.
[HTC One X] kholk:
There's no "special hardware from hell".

What we've got here is a SoC with crypto hardware, and that's a whole different thing: the crypto HW in there won't work as "special chip" or anything else and that's totally unrelated to hTC's security.

Also, why should they waste money in special chips from alien technology when they can simply blow an eFuse (like Motorola is doing) and stop everything of this?

Moreover, the hTC security isn't based on eFuses, so it's crackable.
[HTC One X] Erik Lieders:
I cant see the result...
[HTC One X] P1n3apqlExpr3ss:
Have you wondered why many other devices took so long to acquire s-off? Because it takes quite a while to find an exploit. Not because of a "secret hardware chip".
[HTC One X] angusc:
Well I thought that I would give the HTCdev.com feedback thing a go and asked why I can't S-Off my non contract phone. They replied asking for my IMEI and software version to allow them to forward my request for consideration. I suggested that they could offer this as a similar service to the unlock process currently available..........

Worth a try I thought.

Dear angusc,

Thank you for your email.

I have submitted the request for S-off to be made available for non-network branded devices, purchased out right.

I apologise for any inconvenience, but this is not something that is likely to happen in a short space of time, as it will take careful consideration from our Development Team. However, I assure you that this option will be considered and if viable it will be made available.

To let me know I have successfully answered your query, please follow the link below to close your enquiry, you will have the opportunity to leave feedback about your experience contacting me today.

Sent witH desire from OneX
[HTC One X] Erik Lieders:
name of secret chip is AT 900. It looks like this . You can believe in exploits like millions believe in god, but what practical things gives it...
[HTC One X] Audioboxer:
Why is it that carriers don't mind Samsung giving s-off?
[HTC One X] wineds:
Got a link to the datasheet?
[HTC One X] Erik Lieders:
yep, http://encyclopedia.thefreedictionary.com/TPM+chip
[HTC One X] wineds:
Can you point out the location of this device in this tear down?

http://fashion.pconline.com.cn/mobile/1204/2754053.html
[HTC One X] Erik Lieders:
i will ask my brother-in-law.
[HTC One X] phillh:
I doubt a TPM chip is on the One X.

The link you posted states TPM cannot be used in China amongst other places, places the One X is sold.

Also, it seems to be still mostly talk on the Trusted Computing Group site about integrating TPM into mobile devices.
[HTC One X] SartoriXX:
That's not a datasheet, that's just a link to a generic page on how a TPM works. Anymore details on the chip? Nothing comes up just searching for AT 900
[HTC One X] Erik Lieders:
are you kidding? what detail about security system which used in servers, banks and mobile devices you want? for example, you bought new lock for the door... And somebody found in Internet "Anymore details"... It's a bad deal to their customers.
[HTC One X] BenPope:
Encryption is good precisely because the details are published and the maths underlying it, sound.

Security through obscurity is not a solution.
[HTC One X] Erik Lieders:
facepalm... Thats why all the newest army researches are secret...
[HTC One X] backfromthestorm:
That's a straw man argument.
[HTC One X] Erik Lieders:
Yes, it is. Like this ravings:

"Encryption is good precisely because the details are published and the maths underlying it, sound.

Security through obscurity is not a solution."
[HTC One X] Evil-Dragon:
I love posts with 0 proof and 100% theory. Photos? Technical documentation? Anything? Makes my day, while we start going off topic, lets start discussing Loch Ness Monster. My cousins, brothers sister's relation said they saw it once. No photos though, shame. Just like this TPM chip. No proof at all it exists in the One X.
[HTC One X] MonsieurDream:
Respect the devs, and don't be off topic please ;)
[HTC One X] doublecheese:
I seriously started thinking there us some real HTC employees amongst us and they are diverting the subject and blowing our minds and then enjoying themselves reading what we say.

Can somebody from the moderators see the IP numbers of people who's on this thread to see if some different users have the same IP numbers and possibly trace those suspicious numbers to HTC headquarters?
[HTC One X] KrisPerry:
Lol paranoia
[HTC One X] theROMinator:
It wouldn't surprise me, it's been known to happen. That's how companies receive feedback when they're stumped. I've heard of it in many Samsung forums.
[HTC One X] g0dsCookie:
@Erik Lieders:

I hope i understood you in this point correctly: You mean that HTC use the TPM to S-On their devices, so that you can't S-Off the device?

I don't think so. If i read correctly, the hboot-Partition is invisible?

I think the TPM is integrated to fully encrypt and hide the hboot-Partition.

This makes more sense for me.
[HTC One X] Evil-Dragon:
The HBoot is probably encrypted under the Fuse programming mode by using a SBK (Secure Boot Key) or other encryption method. It's mentioned in my work decompiling the hboot (0.43.0000) using IDA as well.

You can read more about it in the Tegra 3 manual too.

---------- Post added at 07:49 PM ---------- Previous post was at 07:46 PM ----------

This is also why if an exploit is found it's best if it's kept out of public view, since HTC know of these forums, they can easily enough read how the exploit works and patch it out in a new update/hboot. You can understand now why the likes of Juantobear (sp?), Revolutionary & Alpharev keep their exploits to themselves, because if they did reveal how they S-OFF then HTC would patch it in a heartbeat.
[HTC One X] gwuhua1984:
Curious... would the CID of an S-OFF device be different from a S-ON device??
[HTC One X] LlabTooFeR:
Yes, htc encrypt HBOOT with SBK, I know where this key should be written. But only htc knows how to make it...
[HTC One X] KrisPerry:
So does that mean we need a hardware approach.

How were you able to disassemble hboot if it was encrypted
[HTC One X] LlabTooFeR:
I have encoded hboot...but the problem is that it can be used only in some particular situation...
[HTC One X] KrisPerry:
Secretive.. .hopefully that is a good thing
[HTC One X] xmoo:
S-off is 11111111

S-on is htc__001 (example)
[HTC One X] KrisPerry:
But is it not possible to have super cid with S on. And fixed cid with S off
[HTC One X] Evil-Dragon:
The CID can be set to anything, by HTC, initially. For example HTC can set the CID as 1111111 and leave the security ON (S-ON) which means the device can flash ROM it likes without CID checks, however the user can't change the CID to something else or go doing anything that a S-OFF phone can do.

So this would give you an S-ON phone but with SuperCID (there are some out in the wild that have never been S-OFF before)

S-ON or S-OFF, HTC phones can have any CID they like either set by HTC or being S-OFF and allowing you to set any CID you like.

Hope that clarifies it a bit better.
[HTC One X] hutzdani:
Your previous rom was using a cm9 boot table . . . your phone did not magically flash boot.img ;-) has happened to me on several occasions