yashsingh1/xdaforums huggingface dataset:
[HTC One X] Evil-Dragon:
WARNING: Be careful with messing with any of the below, it used to cause the bootloader to freeze with the smart_io.crd file on the SDCard. With no way to access the sdcard from recovery or a rom you could leave your phone potentially screwed.

A long time ago when the Evo 3D never had any htcdev unlocking, people were looking into how HTC officially made phones S-OFF. We did find that when 'fastboot oem writesecureflag 0' was sent to the phone it would look for a javacard file on the SDCard called SMART_IO.CRD.

Alot of time was spent trying to replicate the file or even trying to figure out it's contents. Every phone that was ever found with S-OFF out of the box was checked for the above file but it was never found.

Example:

C:\android\platform-tools>fastboot oem writesecureflag ?
...
(bootloader) shooter_init_sd, SD card power on
(bootloader) sdcc_init_memory_device done
(bootloader) Error status=0x8
(bootloader) [SD_HW_ERR] SD: read fail ..
(bootloader) DATA_TIMEOUT
(bootloader) [SD_HW_ERR] read data fail in CMD17
(bootloader) [SD_HW_ERR] sdcc_read: retry..
(bootloader) [SD_HW_ERR] read data fail in CMD17
(bootloader) [SD_HW_ERR] SD: Read data fail..
(bootloader) [JAVACARD_ERR] reset javacard error: sd reading fail
(bootloader) writesecureflag: Permission denied, value 2
OKAY [667.181s]
finished. total time: 667.181s

C:\android\platform-tools>

Now, some speculation was done that it might not be a file, but rather a specially formatted sdcard to some kind of specification or a special type of sim card. Either way you can read up about these things below:

http://en.wikipedia.org/wiki/Java_Card

http://xdaforums.com/showthread.php?t=1142409&highlight=javacard

They might have changed the method though because last time i tried this with the One X i got no output like the above and the bootloader froze. This was completely without the smart_io.crd file on the SDCard and with just the fastboot oem writesecureflag 0 command issued.

Anyway it's food for thought at least.
[HTC One X] kholk:
IMHO, that's really bad. Snapdragon S4 seems to not be that much good... Also I dislike how Qualcomm makes SoCs.

nVFlash isn't absolutely needed for S-OFF'ing, but for having a recovery method if we flash a broken bootloader.

If we can flash through nVFlash, I/we can experiment to modify the bootloader...with some disassembling effort. Nothing really too much hard, though.

Anyway, hard or easy, we would anyway need 3-4 tries prior hitting the S-OFF.. and since we don't want to brick devices, we want nVFlash for reflashing the stock bootloader and retry.

I can remember that on an HTC device I've had, probably it was the Desire Z, there was the goldcard method. It consisted to write some raw data on the first sectors of an external SDCard, then the bootloader recognized that data and triggered the S-OFF procedure.

Even if the One X doesn't have an external SDCard, the bootloader might read that data from the first sectors of the "internal memory" partition.

Anyway, I don't know if this is still applicable, and if it is, the data has to be calculated in a different way because this is a different device.

@xmoo

Thanks.

If you need any help I'm available.

Keep me updated! :D
[HTC One X] ytwytw:
Well

Please think about S4 users

They need s-off too

and they wanna it badly because...

AT&T DOESN'T ALLOW HTCDEV TO UNLOCK BOOTLOADER

so no s-off, no root :(

Moreover

T-Mobile/Wind/Mobilicity users need s-off to unlock AWS HSPA Band

So it still matters
[HTC One X] JeckyllHavok:
Just a question, how does the ruu work, does it Check the signature and then Flash the Files or does it simply push them and the device checks signature? Cause if just the ruu checks, this could be a Start.
[HTC One X] ytwytw:
The HBOOT check the signature not the RUU

The signature is checked after rom.zip push to the phone and unzip
[HTC One X] Rekoil:
You are under the assumption that the signature checks are carried out on the computer before the files are sent to the device, this is a false assumption, the device (or running version of HBOOT if you will) is actually carrying out the signature checks

after

the image is already sent to the phone.

As I've told you before this thread is not concerned with HTC One XL users, you belong in this forum. Now if we should discover something that works on your XL then great! But until then, please stop hijacking the thread.

About your rooting situation. Why don't you look into mempodroid? I'm not sure about the XL since it runs a newer kernel than the One X, but it would be worth looking into I suspect.
[HTC One X] ytwytw:
Read it again, signature check does happen on device and checked by hboot

Even X and XL have different CPU, they could have the same method to get into download mode(Sensation Series is one of the example)

We need the right offset to use mempodroid, and I have no idea how to find those offset
[HTC One X] Rekoil:
If just the RUU checked there would be no problem S-OFF'ing literally every HTC device ;) The phone unfortunately checks the signatures on things like hboot.img, boot.img and system.img when they are sent to it.
[HTC One X] angusc:
So you don't want me to post the .pkg file......you don't think it has any relevance or use here ?

Sent witH desire from OneX
[HTC One X] Rekoil:
It does happen on device, but it happens as files are sent to the HBOOT, not after HBOOT unpacks a zip, in fact, I would be surprised if the entire zip is ever sent to the phone during a RUU installation.

They could indeed, but the download modes would be very different as the Qualcomm SoC and the Tegra3 SoC have different BootROMs.

There is a readme in the Git repository which explains where the offsets are to be found... Saurik is a nice guy, you might even get some help by going to irc.saurik.com (channel #saurik) and asking him to help you locate them.
[HTC One X] JeckyllHavok:
I just asked him in irc, hope he answered
[HTC One X] steve36:
That's a suprise
[HTC One X] Arthas92:
but i think yes, may be the signature is check by the phone but the whole image doesn't sent to the phone yet

because if it did, there will be no brick just because unplus the cable or some thing like that (because the whole image is already in the phone)

i'm not sure about one x as when i flash rom, radio,etc for my old phone is HTC diamond

after check infor it need time to flash(run from 0->100%)
[HTC One X] JeckyllHavok:
If this tool is right (http://xdaforums.com/showthread.php?t=1612591)

Offset is 0x8003 0xaf47
[HTC One X] starbase64:
this work?
[HTC One X] JeckyllHavok:
I fear not:
[HTC One X] starbase64:
same here :(
[HTC One X] Quercus1:
maybe is this one the right x-off.tool?

http://item.taobao.com/item.htm?id=10824156715
[HTC One X] bigpp85:
I think so too. We need only a guy how speaks chinese and someone buys it, and tests. ;)
[HTC One X] Evil-Dragon:
Already previously discussed.
[HTC One X] JeckyllHavok:
You can't buy you give them your phone and they'll give it S-OFFed back
[HTC One X] starbase64:
here is the mempodroid github: https://github.com/saurik/mempodroid
[HTC One X] Rekoil:
If you look at the offset for exit() on other devices it is always much higher up in memory, I don't think you've got the correct offset for it.

EDIT:

Acer A200 Tablet 4.0.3:	0xd9f0 0xaf47
Galaxy Nexus 4.0.2:	0xd7f4 0xad4b
Motorola RAZR 4.0.3:	0xd6c4 0xad33
Nexus S 4.0.3:	0xd7cc 0xad27
Transformer Prime 4.0.3:	0xd9ec 0xaf47
[HTC One X] starbase64:
n95-offsets identified the wrong offset?
[HTC One X] Rekoil:
If you look at the source code it is obvious that n95-offsets never managed to find anything for the exit() offset, as the value that was returned was just the initial value 4 + 8000 + -1 (what the function returned because it didn't find anything) == 0x8003

Now, why it didn't find the correct value I can't tell you because I don't have the device with me yet. In fact, I have no Android devices what so ever, I was previously an iPhone man :P
[HTC One X] starbase64:
ok, how to find the correct value?
[HTC One X] Rekoil:
If I was to somehow gain access to the run-as binary I would take a look at it for you.
[HTC One X] starbase64:
where is this file?

edit: file attached (1.26.401.2)
[HTC One X] JeckyllHavok:
I got answer from Saurik, he's not sure if it will work for us, but i send him run-as and he said he will have a look for the offset
[HTC One X] Drefsab:
doesn't this just exploit to give root access? while not a bad thing we have root already on the one x so what I'm not understanding is how this helps get s-off.
[HTC One X] Polarfuchs:
I think it is for temporary root without htc dev unlock.
[HTC One X] starbase64:
this is the way to permroot, and more ...
[HTC One X] Evil-Dragon:
Also most S-OFF exploits need root access to push a binary file, execute the binary file as root and exploit the area needed to change the security flag and then push a modified hboot to the device.

Root without HTCDev is a great step forward, even if it is only temp root.
[HTC One X] JeckyllHavok:
Anyone here with one of thoose devices?

Acer A200 Tablet 4.0.3:

Galaxy Nexus 4.0.2:

Motorola RAZR 4.0.3:

Nexus S 4.0.3:

Transformer Prime 4.0.3:

Could you please upload the run-as from system/bin
[HTC One X] starbase64:
here is it http://xdaforums.com/attachment.php?attachmentid=1042559&d=1336233725
[HTC One X] JeckyllHavok:
which device is it from
[HTC One X] starbase64:
htc one x stock rom 1.26.401.2
[HTC One X] JeckyllHavok:
Thanks but we need one from one of the devices that are already exploited with mempodroid
[HTC One X] starbase64:
look here on post 9: http://xdaforums.com/showthread.php?t=1612595
[HTC One X] jmpmjmpm:
They simply don't have the skills
[HTC One X] JeckyllHavok:
very helpfull:confused:
[HTC One X] starbase64:
did you see?
[HTC One X] JeckyllHavok:
it seems HTC fixed the mepodorid hole, anyway someone earlyer than 1.93 could try offset 0xd8dc 0xaf47 (thanks saurik for that)

for beeing 100% sure we need to wait untill sources are available
[HTC One X] PapaDocta:
What about sprint nexus s 4g 4.0.4? Will it work?
[HTC One X] co@ch:
Probably useless, but did someone checked the protocol content of the error report created automatically (if activated) after the phone got e.g. rebooted into recovery and from there restarted normally? Maybe forcing the phone to "crash" in a proper way this protocol could give us some other hints. :confused:
[HTC One X] miniudavid:
You mean with older kernel than 1.93? I think there's no one x with that.. ???
[HTC One X] JeckyllHavok:
Yeah, any other ideas instead of mempodroid?
[HTC One X] ChronoWerX:
I'm on Galaxy Nexus from my company with 4.0.4, I can downgrade to 4.0.2 when it help
[HTC One X] KingOfNV:
We can create with the internal memory not a gold card?

Under Settings -> Memory-> encrypt the phone memory

No hacking = (not encrypted phone memory will be write-protected)

Is this the reason why no gold card could have been created with the memory?

In German:

Wir können mit dem Internen Speicher keine Goldcard erstellen?

Unter Einstellungen ->Speicher->Verschlüsselung von Telefonspeicher steht:

Kein Hacken = Nicht verschlüsselter Telefonspeicher wird schreibgeschützt sein.

Ist das der Grund warum keine Goldkarte mit dem Speicher erstellt worden konnte?
[HTC One X] ytwytw:
Just tried, no luck :(

still $ not #

---------- Post added at 11:14 PM ---------- Previous post was at 11:13 PM ----------

even rooted, no permission to touch misc partition :( (Whatever I dump from there is ffffffff)
[HTC One X] fknshwow:
i have a transformer prime, i will upload files when i get home if you like

---------- Post added at 08:37 AM ---------- Previous post was at 08:15 AM ----------

so, would it help to start looking to exploit with a htcdev unlocked phone as it would have root? then work backwards form there to get s-off? sorry if this is a stupid question, just spit balling
[HTC One X] JeckyllHavok:
Thanks but due to the fact that the mempodorid exploit won't work we can't se heese files anymore
[HTC One X] Polarfuchs:
I don't get it:

Engadget writes about the international version got rooted.

But the AT&T version has a locked bootloader.

http://www.engadget.com/2012/05/05/att-htc-one-x-locked-bootloader/

But the international version can only be rooted if you have htc dev unlock.

So the bootloader is initially locked, like the AT&T version.

http://android.modaco.com/topic/352328-how-to-root-your-htc-one-x-tegra3-for-windows-mac-and-linux/
[HTC One X] preacher65:
The difference is that the AT&T version

can't be unlocked

through HTCdev, due to restrictions imposed on HTC by AT&T.
[HTC One X] trojanere:
WTF man I have lost S-OFF, how the ... can that happen?

Had it after unlocking and now no more.. I take it, its really hard to get back if you can get it back.

I flashed the cm9 then put it back to sense and I noticed s-off was then on:confused::mad:
[HTC One X] JeckyllHavok:
did you use a ruu?
[HTC One X] tids2k:
did u make a nandroid backup of your initial rom, you should never flash an official RUU if you had S-OFF.

You might be in luck if u do a backup from your nandroid ( if u made one ) otherwise join the club ..
[HTC One X] trojanere:
ah you mean the OTA when you say RRU .. I have about 10 backups using CWM
[HTC One X] co@ch:
What did you mean with "had it after unlocking"? You already had it before unlocking, right?
[HTC One X] trojanere:
Well I'm a total noob to Android.. I got the phone from 3 and unlocked it via HTCdev but I'm that much of a noob to it I don't know if it was there before or after.. Will S-ON mean I can't use the better roms now?
[HTC One X] fknshwow:
S-ON unlock via HTCdev means you void warranty and you have to flash boot.img manually. you can still flash roms
[HTC One X] 1000moths:
So if restoring one of these backups gives you S-OFF again, surely that puts us closer to a solution?
[HTC One X] Willieumm:
It won't restore the s-off. If he had s-off and lost it then it's because his hboot was updated most likely and he won't be able to downgrade his hboot to a s-off hboot.
[HTC One X] 1000moths:
I agree that's most likely going to be the case, but at present i think anything is worth a try, only other solution is a trip to china by the look of it!
[HTC One X] ytwytw:
Are you talking about s-on s-off on bootloader screen?

i know if its white card s-off, even ruu flash will NOT turn it back to s-on
[HTC One X] RedGreenGeek:
Will Taobao S-off your HOX?

Does this mean they have a physical store you can enter in china to achieve S-off? And would an S-off phone from this be of help to achieving it for all?

Thanks a lot for all the effort you put in this.

BTW I am of to shanghai in a month, maybe I could get my HOX, s-off'ed then.
[HTC One X] trojanere:
I tend to agree now I'm getting a grip with how it works.. I will try all the backups. On the other hand my mate is in china now near shenzen, what needs to be done there? He'll probably want something for his time though LOL
[HTC One X] steve36:
thought the shop in china had already been proved to be a bit of a con they cant get s-off either
[HTC One X] trojanere:
Yes it was S-OFF on the boot screen.. white one... now S-ON

Been boot patched with the update I've been informed.

I've been chatting to my mate and he says that you can't fix S-OFF with software and they are working on the x-clip update and he has a clip and will do mine when he gets back or it gets one x updates which ever is sooner..

I take his word as he's been in the phone game since the beginning and has got contacts in high places.

So if anyone knows different and can prove it wrong then that's the score for now.

:rolleyes:
[HTC One X] JeckyllHavok:
Sound good, can you maybe ask him for a little hint for us?;)
[HTC One X] trojanere:
Well he's just gone to bed.. but I tried to get as much info out of him as possible and the word was you can't do it without the x-clip as it emulates the HTC service card process similar a jtag on other devices like xbox modems etc. I my opinion, gives you god rights to the hardware.

oh and buy the way he says the link that was quoted earlier for some files on a chinese site is a chinese equivalent of ebay and the files are just a collection of mods etc for £3.. so don't bother buying them.
[HTC One X] ytwytw:
deleted
[HTC One X] Baz Scotland:
Does anyone know what the small hole next to the 3.5mm jack is for, when looking inside you can see there is a copper contact?

This message was written on 100% recycled electrons.
[HTC One X] trojanere:
Usually the noise cancellation mic
[HTC One X] xmoo:
Can we please keep this thread about the Tegra one X and not the S4 one X. It's confusing people.
[HTC One X] JeckyllHavok:
so still at the beginning i think:

1: get a working temproot

2: find an exploit to gan s-off

3: bring all togethet in a package so that everyone can do this without htcdev or at least can get back to 100%stock
[HTC One X] Rekoil:
Yep, and the best bet for S-OFF still lies with APX mode I reckon.
[HTC One X] blubbers:
Its a microphone
[HTC One X] starbase64:
...and antenna for fm radio
[HTC One X] Polarfuchs:
No, the Antenna usually is the headphone cable.
[HTC One X] supendal:
...for stereo recording.
[HTC One X] starbase64:
I have not read correctly, a misunderstanding.
[HTC One X] Rekoil:
More likely for noise canceling.
[HTC One X] supendal:
Makes sense. Back to the topic, I have not enough technical knowledge to contribute but I'm watching this thread since day one and reading every single post. I know it'll happen. Keep digging.
[HTC One X] emperact:
WOW! We just had 2 pages of talking about a stupid 2nd microphone and its functions, instead of focusing on what the thread is really about.
[HTC One X] starbase64:
and this helps?
[HTC One X] Rekoil:
Didn't you get the memo? We're gonna ***** and moan until someone delivers us S-OFF on a silver platter now. Get your head in the game mate!
[HTC One X] le_cactus:
Well, kernel sources are released! I really hope this will help the hunt for S-OFF, I'm desparate for two-way call recording :)

Good luck all, cheers,

/Cacti
[HTC One X] JeckyllHavok:
He's right :

http://htcdev.com/devcenter/downloads
[HTC One X] :
First Kernel 3.0 HTC One X, compiled stock

Link:Link removed

Delete post pls
[HTC One X] Micropot:
Why do they supply a 3.0 kernel for download but install a 2.xxxx kernel on the hox?
[HTC One X] le_cactus:
From the readme:

I guess even HTC webmasters make typos?

Cheers,

/Cacti
[HTC One X] emperact:
Probably because the HOX will be updated to 3.x kernel in the next update
[HTC One X] KrisPerry:
Just keeping this on topic, does anyone know what the cover is behind the power button.
[HTC One X] le_cactus:
I stand corrected:

FYI,

Cheers,

/Cacti
[HTC One X] Wonderkik:
This is where you put the micro-sim... Inserting a needle or the tool HTC gave us in the package with the phone into the hole next to it opens it.
[HTC One X] Polarfuchs:
So this kernel source is only useful for the 1.26 rom?

Or is this applicable to all following roms?
[HTC One X] KrisPerry:
I haven't put my SIM in yet so that would explain that. I have the screen flicker fault so I am DOAing and so didn't want to transfer to microsim yet
[HTC One X] blubbers:
/* This constant is used in bootloader to decide actions. */
#define RESTART_REASON_BOOT_BASE	0x77665500
#define RESTART_REASON_BOOTLOADER	(RESTART_REASON_BOOT_BASE | 0x00)
#define RESTART_REASON_REBOOT	(RESTART_REASON_BOOT_BASE | 0x01)
#define RESTART_REASON_RECOVERY	(RESTART_REASON_BOOT_BASE | 0x02)
#define RESTART_REASON_HTCBL	(RESTART_REASON_BOOT_BASE | 0x03)
#define RESTART_REASON_OFFMODE	(RESTART_REASON_BOOT_BASE | 0x04)
#define RESTART_REASON_RAMDUMP	(RESTART_REASON_BOOT_BASE | 0xAA)
#define RESTART_REASON_HARDWARE (RESTART_REASON_BOOT_BASE | 0xA0)
#define RESTART_REASON_POWEROFF	(RESTART_REASON_BOOT_BASE | 0xBB)
#define RESTART_REASON_ERASE_FLASH	(RESTART_REASON_BOOT_BASE | 0xEF)

now this looks interessting :)
[HTC One X] Sentinel196:
Thanks Blubbers.

Can you give the post any more context? Are these commands issued to the handset by the RUU utility?
[HTC One X] nikorette:
Temp root please lol. Kernels are out
[HTC One X] blubbers:
it's part of the kernel source

you can issue one of the reasons to the kernel with

arm_machine_restart(mode, cmd);

and the device will reboot to the requested mode. like reboot to the recovery, or hboot

i think RESTART_REASON_HTCBL is hboot, the SPL

RESTART_REASON_BOOTLOADER might be the PBL

just a guess. going to try it tomorrow
[HTC One X] shaft77:
HTC One X kernel source code posted at HTCDev

www htcdev com / devcenter / downloads

Hoping that the gurus will find an exploit now..
[HTC One X] angusc:
Don't bet on it, i live in Beijing and all the inquiries that i have made have dead ended......these guys are very good at make believe.....the reality maybe much different. Advertising S-Off but really meaning unlock bootloader using HTC dev.com Being one example.

I bet there is not many, if any that have the required white cards and expertise.

Sent witH desire from OneX
[HTC One X] blubbers:
part of the early kernel output

<4>[ 0.000000] Parsting partition tag[emmc] (sizeof(struct msm_ptbl_entry) / sizeof(__u32)) 7
<4>[ 0.000000] [emmc] header->size 94
<4>[ 0.000000] [emmc] count 13
<5>[ 0.000000] Kernel command line: tegraid=30.1.3.0.0 mem=1016M@2048M vmalloc=768M video=tegrafb zygote_oneshot=off kmemleak=off androidboot.lb=1 androidboot.batt_poweron=good_battery androidboot.carrier=HTC-GER led=4 androidboot.keycaps=qwerty console=none debug_uartport=lsport usbcore.old_scheme_first=1 lp0_vec=8192@0xbc0a8000 nvdumper_reserved=0xbf7ff000 tegra_fbmem=3689280@0xbc0ab000 panel_id=0x4940014 tegraboot=sdmmc gpt gpt_sector=61063167 androidboot.mode=normal batt_V=1048575 batt_I=1048575 batt_T=1048575 modem_id=0 androidboot.baseband=None androidboot.emmc=true androidboot.cid=HTC__102 androidboot.mid=PJ4610000 androidboot.serialno=xxx androidboot.mb_serialno=xxx androidboot.bootloader=0.43.0000 last_off_event=pmu_poweroff start_on_event=none hw_rst_reason=0x0 sw_rst_reason=0x0 project_phase=UNKNOWN radioflag=0x0
<1>[ 0.583270] [mtd] mount /proc/emmc successfully

---------- Post added at 02:18 PM ---------- Previous post was at 02:14 PM ----------

<4>[ 0.000000] Ignoring unrecognised tag 0x41000801
<4>[ 0.000000] Ignoring unrecognised tag 0x41000801
<7>[ 0.000000] parse_tag_gs_calibration: gs_kvalue = 0x670009fd
<6>[ 0.000000] parse_tag_als_calibration: als_kadc = 0x6da50ecb
<6>[ 0.000000] parse_tag_ps_calibration: ps_kparam1 = 0x50530306, ps_kparam2 = 0xffff0a17
<7>[ 0.000000] tag_ps_parsing: PS type = 0x1
<4>[ 0.000000] Ignoring unrecognised tag 0x4e540000
<7>[ 0.000000] find the engineer tag
<7>[ 0.000000] parse_tag_engineerid: 0x0
<4>[ 0.000000] Ignoring unrecognised tag 0x54410100
<4>[ 0.000000] Ignoring unrecognised tag 0x54410110
<4>[ 0.000000] Parsting partition tag[emmc] (sizeof(struct msm_ptbl_entry) / sizeof(__u32)) 7
<4>[ 0.000000] [emmc] header->size 94
<4>[ 0.000000] [emmc] count 13
<6>[ 0.000000] Partition (from atag) recovery -- Offset:5 Size:800
<6>[ 0.000000] Partition (from atag) boot -- Offset:4 Size:800
<6>[ 0.000000] Partition (from atag) system -- Offset:c Size:50000
<6>[ 0.000000] Partition (from atag) cache -- Offset:d Size:14000
<6>[ 0.000000] Partition (from atag) misc -- Offset:11 Size:200
<6>[ 0.000000] Partition (from atag) wlan -- Offset:1 Size:600
<6>[ 0.000000] Partition (from atag) WDM -- Offset:2 Size:200
<6>[ 0.000000] Partition (from atag) pdata -- Offset:14 Size:200
<6>[ 0.000000] Partition (from atag) radiocab -- Offset:3 Size:600
<6>[ 0.000000] Partition (from atag) internalsd -- Offset:e Size:650000
<6>[ 0.000000] Partition (from atag) userdata -- Offset:f Size:89400
<6>[ 0.000000] Partition (from atag) devlog -- Offset:13 Size:1600
<6>[ 0.000000] Partition (from atag) extra -- Offset:10 Size:200
<7>[ 0.000000] found the pcbid tag
<7>[ 0.000000] parse_tag_pcbid: 0x80
<4>[ 0.000000] Ignoring unrecognised tag 0x41000801
<4>[ 0.000000] Ignoring unrecognised tag 0x41000801
[HTC One X] JeckyllHavok:
So, just a little update for you, mempodroid definitly won't work for us, HTC didn't patch the exploit but buil a powerfull workaround: