yashsingh1/xdaforums huggingface dataset:
[HTC One X] blubbers:
Ida can disassemble it, but without an arm decompiler plugin you cant decompile it.

Decompile = generate pseudo code (usualy C) from assembly instructions. Which is alot faster and easier to read
[HTC One X] xmoo:
Thats what you get when you don't share stuff with community :P
[HTC One X] shenye:
I'm not sharing because I was trying to clone my phone onto theirs and seeing if that worked as my device has test keys not release keys, allowing me to have S-Off. I'm not sharing my files because if it was successful, people could clone my phone ¬¬
[HTC One X] Try4Ce:
Very good point. I hope you'll succeed with your attempts one day :) Keeping fingers crossed!
[HTC One X] blubbers:
Mind sharing what you have tried? No details required
[HTC One X] bozza1001:
S-on needs signed cert to flash ne radio's stuff right so y don't you pull all of the security checks off the update.zip to flash a new radio that will allow s-off some how ??? Then at least you will have the security to flash
[HTC One X] xmoo:
What test keys are you on?
[HTC One X] Evil-Dragon:
Because you can't because the security isn't controlled by the zipped file, it's controlled by the Hboot/Radio working and checking each other to make sure that the secureflag stays as it should.

For updates/RUU it works something like this:

HTC puts together an update file and signs it with their private key

On the device we have a public key, we can view it but we don't have the private key

When you put an update on the phone, it checks the private key (it's obscured) against it's public key and if it's correct then it allows the update.

Any change to a zip file will break the key, even if you hex edited one file by one value

The key can't be hacked, viewed or broken by any known means, it's probably a 256 bit AES key (meaning it probably needs thousands of years worth of CPU time to break)

That might not be accurate to how all the key signing and checking works but it's near enough.
[HTC One X] :
Its not 256 bit lol

Sent from my Desire HD
[HTC One X] Evil-Dragon:
Well i dunno, was just a guess. LOL.
[HTC One X] f4flake:
I've been trying to access APX mode, and got so far as unknown device found.

Could be a poor driver or simply applying the right driver to the wrong hardware.

Either way I still think nvflash is the way to permanent root and s-off. Simply because it's pre-hboot/radio
[HTC One X] :
I already have info n stuff for one x users to try, but ill give it a few dayz before saying anything

Sent from my Desire HD
[HTC One X] Baz Scotland:
Why wait a few days ?
[HTC One X] mwilky:
Sounds good pal!
[HTC One X] dr-jo:
Hello everyone,

Sorry for my bad English.

I do not know if it's a good thing, but opening the HBOOT 0.04.0000_0204_1 the ROM (RUU_Endeavor_U_HTC_Europe_0.96.401.2_Radio_0.120201.21.10_test_240060) and HBOOT 0.94.0000 with a hex there not the same UNLOCKED, RELOCKED, LOCKED ...

I do not know if it can help.

Thank you all for your work
[HTC One X] :
Have enough on my plate just now, dont need more :p

Sent from my Desire HD
[HTC One X] Baz Scotland:
Take your time buddy, all help is appreciated by the community :D
[HTC One X] :
Worst case scenario xda may need to get someone like darkalex, grafchokolo or the guys that hacked the ps3 system on this

Sent from my Desire HD
[HTC One X] dk_zero-cool:
Anyone asked HTC?
[HTC One X] :
Glad someone recognises those names, not many people from otger scenes on here, id mention mathiulth the french dude but he seems to talk alot and provide nothing lmao

Sent from my Desire HD
[HTC One X] N3m3515:
you mean mathieulh ;)
[HTC One X] mwilky:
I recognize them, had my very own jailbroke ps3 :P The thing was crazy!

Yeah that french guy never really helped, he just "teased" if you ask me
[HTC One X] miniudavid:
:D
[HTC One X] :
I can never spell his name right

I also have a jb ps3, did install other os and dnt use it much, but yeah he doesnt provide physical evidence n his exploits seem to be announced after someone exploits them lol :) he also mentioned that he devs on android scene? :/ recent interview

Okies back on topic i can say a tonne of stuff but ill mention a few

IF using encryption, itll be using aes 128 bit encryption (including the padding)

Only nvidea get to access via UART mode

Sent from my Desire HD
[HTC One X] Polarfuchs:
So we are speaking about this:

http://xdaforums.com/showthread.php?t=1081743

Has anyone tried to mod the OTG cable and connect Pin4 to VCC instead of GND?
[HTC One X] :
You dont need UART access to remove security, but yes only Nvidea have UART access, not even HTC have UART access LOL

I need to work closely with someone that owns the device, that runs a linux os and knows their basics to test a few things, BUT im not deving on this device yet

Sent from my Desire HD
[HTC One X] Polarfuchs:
Ok, I'm shure you'll find someone.

I own a device, a have Ubuntu in VM, I now some Linux basics and can follow instructions.

But I think you didn't talk about someone of this forum!?

Plus, there are more dev-skilled people in this thread than me.
[HTC One X] BigladUK:
Happy to help here, I'm running a mac but can knock up a VM of Ubuntu if you need proper unix. I'm not an expert but not a noob either

Si
[HTC One X] :
Thanks not yet though cause i got other thingz to do atm, probably in a few dayz

Sent from my Desire HD
[HTC One X] dansharpy:
Ive got a laptop running mint. Not the best in linux but know some basics. Also good at following instructions! Let me know if you want a hand when you have time, id be more than happy to help.
[HTC One X] KingOfNV:
Kann es sein das diese 5 Pins auf der Rückseite zugreifen lassen. Sind zwar für ne Dockingstation. Aber wenn HTC eineSpecialstation hat und die Pins intern anders verdrahtet sind?

In Englisch:

Can it be that these 5 pins to access the rear panel. Are in favor of a docking station. But if HTC has a special station and the pins are internally wired differently?
[HTC One X] leith51:
Add me to that list got laptop set up full on ubuntu not use to the system yet but willing to listen and learn and have hox locked branded t-mobile UK still on 1.26 firmware 0.43 hboot so we can compare devices across the board from firmwares to hboots :)
[HTC One X] visor:
Also happy to help with this. On Three UK, running ARHD 3.1.0. Original 0.43 HBOOT and 1.26 firmware too. Can test using Mac/Windows and Linux if need be.
[HTC One X] JeckyllHavok:
willing to help, either
[HTC One X] bmbaker:
ya i can help too :-) running ubuntu and archlinux and windows and mac-osx in VT keep up the good wk :-)
[HTC One X] riemervdzee:
You think a uart setup like that would work for the One X? Might be interesting for kernel-deving (as in; getting a higher linux than the current 2.6.39 :rolleyes:).

Cheers, R
[HTC One X] KingOfNV:
Full picture guide of how to open HTC One X

Here

MOD EDIT: Link is safe, just need to translate from German I guess...
[HTC One X] DarkMio:
I'm willing too.

Running an hackintosh, windows, linux on triple boot bootloader ;)

My last big action was wwith modaco while rootjing the desire.

Don't mess up with VM since the drivers run through your OS and will be emulated.

This is a easy way to brick you phone. Also it gives another errorproblems, of they are not emulated right.

Just write me, I follow this thread since its created.

Chill down, bros, the desire have this revolutionary s-off method, that works like a charm.

Btw., I can brick this phones until they don't know what they are and what they habe to Do. So I fullbrick em, that I can use it as a varrantyproblem. Its a financialthing and a huge help for the Community.
[HTC One X] anko184:
Old news... ;)
[HTC One X] huwwatkins:
These look like new pictures?
[HTC One X] KingOfNV:
OH :o
[HTC One X] Micropot:
I am following this thread since is has been created and I have to say great community! Hope you can manage the s-off soon.

@shaky if u need help from someone who got the device and has linux skills you can cound on me. I am an admin for linux and windows systems (but have no dev skills)
[HTC One X] mattman83:
I can't remember who, but I know one user was following a thread on xda.cn about s-off. Just posting to say the forum is back ;)

http://bbs.xda.cn/forum.php?mod=viewthread&tid=11021287&extra=page1=&page=130
[HTC One X] xmoo:
Good point there... But if we don't really know the location of the HBOOT. I think it will be hard flashing a HBOOT. Specially a older HBOOT.
[HTC One X] :
Theres 2 type of s-offs

Sent from my Desire HD
[HTC One X] N3m3515:
but we know where the radio is? and we know that the radio controlls s-off state? maybe we can do something with this knowledge and without touching the actual hboot?
[HTC One X] :
radio doesnt control s-off state

So who said that? Theres alot of guesses here and not facts

Sent from my Desire HD
[HTC One X] N3m3515:
isnt it the radio who gets checked by the hboot if s-off switch is on or off?
[HTC One X] co@ch:
Great!

...to know just one would be enough for the beginning... :p
[HTC One X] JeckyllHavok:
Yes it is, but in the past a patched hboot worked better, here from AlphaRev Website (desire):
[HTC One X] co@ch:
What I meant was to know at least one method/how-to of s-offing... ;)
[HTC One X] xmoo:
Wrong, cause there is also DEV S-OFF.

Please state it correct.

There is no ENG S-OFF, SHIP S-OFF what so ever...

You have for example an ENG HBOOT, which means it is a Engeneering bootloader which the security can be put on or off...

ENG = Engineering

SHIP = Shipped

DEV = Developement
[HTC One X] kholk:
I've examined the dumps from @xmoo's source:

1. In the dumps there is HBOOT. There's also some interesting stuff needed for nVFlash (when you're in APX Mode).

2. The dumps are encrypted with the Secure Boot Key: we need to decrypt those with it, otherwise they're only a bunch of "useless" data. Useless because it's unreadable since it is encrypted.

The EternityProject Team Manager & Main Developer,

--kholk
[HTC One X] :
Theres dedicated slots for encrpytion, the tegra security engine (uses 4 engines), 2 dedicated to sbk key tables which has read only access set by the BR, 2 dedicated to SSK key tables write only access,

SSK Can be overwritten with user defined values by bootloader

Anywayz i gt thingz to do, will look at it later

Sent from my Desire HD
[HTC One X] kholk:
I was disassembling the bootloader, when I've found some useful words in there.

Those ones are remembering me a file with a list of fastboot commands for Evo 3D, but since I've taken those from the One X Bootloader....

I feel that those ones are better to use as a reference for the One X.

gpiow
gpior
dgtest
mddiw
mddir
clock
i2ctest
ulpi
changeCid
read_l2_acc_fuse
emmc_boot
poweron
poweroff
setvol
spi
fat
pmgpiow
pmgpior
8058vregon
8058vregoff
8058vregw
8058vregr
8901vregon
8901vregoff
8901vregw
8901vregr
8x60i2cr
mipi_test
chargeron
chargeroff
adc
readsimlocktype
enablesimlock
addsimlockcode
clearsimlockcode
listsimlockcode
clearunlockrecord
lite_heap_test
vibrate_test
getrtc
setrtc
getrtcalarm
setrtcalarm
pgfs
bumpclk
acpuclk_get
acpuclk_set
rpmclk_set
rpmclk_get
oschalt
rtask
task
enableqxdm
readpid
writepid
readcid
writecid
readimei
writeimei
readsecureflag
writesecureflag
lock

The EternityProject Team Manager & Main Developer,

--kholk
[HTC One X] tids2k:
So they can be executed via the fastboot command. I don't see any possibiltu of these working ...... Will check once I reach home.

Sent from my HTC One X
[HTC One X] kholk:
Oh, going on with the Bootloader examination, I can see some references to the JAVACARD.

Probably the S-OFF can be achieved with that.
[HTC One X] :
Delete post

Sent from my Desire HD
[HTC One X] :
Htc definitely support the dev community, if they wanted to they would encrypt the hboot but have choosen not to

Sent from my Desire HD
[HTC One X] tids2k:
and i think thats the biggest mistake they have done again, there customer support is already decreasing, since the rivals like huawei and samsung have unlocked bootloaders which can be easily unlockable if not initially..

HTC needs to realise now that if this continues to happen, thier customer database will decrease furthur, and they will be left with no option too.
[HTC One X] BeciMester:
How are you guys getting on with the hboot disassembly? Is it just me or most of the code is unreadable? Sure a lot of strings are plaintext and there's a bit of code around them, but most of the 2MB of the hboot seems to be encrypted to me... Also there are bits of Thumb2 code. Now I have to admit, I haven't seen the "newer" hboots like the Eco or the Sensation, the last I have experience with is the Marvel, but that was straightforward compared to this. I went through 3 versions of the Marvel hboot, following the changes HTC made, no problem, but now I'm stumped. What's the secret? I really want to help. :)
[HTC One X] Evil-Dragon:
My decompiler in IDA isn't working. Dissambly works but it's unreadable so it's impossible to work with it. If anyone has a working decompiler with IDA can you try and get the psuedocode?
[HTC One X] BeciMester:
The decompiler in IDA works with x86 only. It's the disassembler I'm worried about.

Am I right that ARM can switch endianness on the fly? This is something I just remembered.
[HTC One X] Supaiku:
On the other hand, all you need to do is essentially tell HTC that you've effectively voided your warranty by tinkering with low level device software. That's a pretty reasonable request if you ask me.

This whole S-ON/OFF thing is lame though.
[HTC One X] mickfitz:
Agreed.

Just give people the option for s off from factory.

No ota updates and warranty would be a choice for the consumer to make who purchased the hardware and not wanting the software.

It's just like watching a dog chase its tail.
[HTC One X] visor:
About access to external SD card (OTG) from HBOOT.

I can confirm that an external SD card was read by the HBOOT process when connected to the OneX.

I used the following cable: http://www.amazon.co.uk/gp/product/B0047AALW6/ref=oh_details_o01_s00_i00

and a Female-Female (A) USB adapter: http://www.amazon.co.uk/gp/product/B0012XXX2Q/ref=oh_details_o00_s00_i00

Connect the adapter to the black USB A plug. Put the SD card (in a reader) into the other end of the adapter.

Micro B plugs into the phone (obviously) and plug the red USB A cable into a hub or PC.

HBOOT then runs through the whole check process - finds the PJ46IMG.ZIP file that I placed on there, checks it then asks me to unplug the USB.

This could be a method for either using a Goldcard image or XTC Clip perhaps? Having the ability to use an external SD card (much like the HD 7 can) opens a few possibilities, surely?

Hope this helps - if someone would like me to test something with this setup, please let me know.
[HTC One X] abc27:
In the EU at least there is

no such thing

as no warranty. Manufacturer defects (Which are the only thing that the warranty covers anyway) are always covered regardless of what you do with the device's software.

If you cause the fault, the warranty is useless regardless of whether or not you've rooted.

Essentially giving people S-OFF will allow a lot of clueless people to destroy their phones and then blame HTC for it.
[HTC One X] Rageypeep:
Indeed, also the same reason why phones don't come pre-rooted is because dum people will brick there phones and they will blame HTC for it, even when it was the persons own fault. A few of my mates have asked me to root there phones and I tell them sure... If you can provide me with one reason why you want it rooted, I then tell them that its safer not to, and only do it after doing some research. So far not one has given me a reason to root lol.
[HTC One X] mickfitz:
Easily rectified.

Make most of the phones with S on for regular consumers and have a developer version for the nerds who can't leave things alone.

Id agree to no ota updates or warranty for that. Probably could be sold much cheaper without Google's cut for ics attached.
[HTC One X] JeckyllHavok:
just created a goldcard and am on an locked stock one x. Anyone got a quick link to the OTA 0.94 hboot? Then i can test
[HTC One X] xmoo:
There you go
[HTC One X] darrenj87:
Keep up the good work! :D

Can't wait for this shiz!
[HTC One X] tids2k:
created via ??

---------- Post added at 02:10 PM ---------- Previous post was at 02:05 PM ----------

@kholk u mentioned references about JAVACARD ??

Could you elaborate ??
[HTC One X] kholk:
@tids2k

It should be the white HTC factory SIM.
[HTC One X] xmoo:
Here a video about it: http://www.youtube.com/watch?v=nLFqGKzrtyg
[HTC One X] Rekoil:
Since you always have the ability to go up a version, it might be best to just stay on the HBOOT version you're at if you're looking to do an S-OFF exploit. There's no way of downgrading HBOOT right?
[HTC One X] torxx:
Great stuff you two but no chance for ENG S-OFF?
[HTC One X] nikorette:
I would be careful about upgrading. If you don't really have a problem with the current RUU 1.26 I wouldn't upgrade. Speculating S-OFF can be obtained with a HBOOT of 1.01 from one foreign users hboot screen picture is abit worrying. If there were more instances of S-OFF on HBOOT 1.01 I personally would be agreeing.

Hold up about the ENG S-OFF lol let's get the thing unlocked without the use of htcdev first.
[HTC One X] xmoo:
We have to find a ENG ROM first if we want something like that.

But havn't found one yet.

The Newer HBOOT could come from a newer ROM which we havn't seen yet. The device is a ENG sample, no review/test sample. So fingers crossed he manages to drop HBOOT and share.
[HTC One X] ancola66:
Exactly, should stay with the existing Hboot >>> Because the S-Off tool (if it is released) generally support the first version Hboot. In the past such as DHD, 3D EVO ....
[HTC One X] geek78:
That's why I have posted this topic

http://xdaforums.com/showthread.php?t=1605885

But It has been closed ....

never mind, I have updated to 1.28 without updating my hboot :D
[HTC One X] xXxVenomxXx:
Buying this will give us S=OFF and if so how can we buy this I can't understand anything the site say
[HTC One X] ChriKn:
I wish you luck in finding this !

(Sorry that mine isn't S-OFF to help you guys :( )

Looking forward into this ;)
[HTC One X] mwilky:
guys someone has 0.43 hboot s-off here

http://xdaforums.com/showpost.php?p=25024501&postcount=22
[HTC One X] N3m3515:
i think shen has a developer preview device
[HTC One X] mwilky:
Do you speak to him?

Surely a dev would be welling to help others :p
[HTC One X] tids2k:
Villainrom is in the forums.
[HTC One X] tids2k:
@moo have u got the rfs dump yet ?
[HTC One X] M3PH:
Shen posted the same pick on G+ and said he had no idea how he got S=off. Looking back at comments and posts made on various One X things he has on his g+ account i would say he does indeed have a developer version and i'm sure if he turns up something good he will post it for everyone to muse over.
[HTC One X] bozza1001:
can some one send me a link to this forum and i will read through and see if i can get this tool for free
[HTC One X] nikorette:
Have shot a pm to shen asking for a HBOOT dump hopefully that will help moo and mike.

In the meantime I would suggest those with the 0.43 HBOOT not to upgrade to a higher version as shen's HBOOT and S-OFF are a reliable source. Rather than the S-OFF user on the XDA China site.

EDIT here's a screenshot of shen's HBOOT
[HTC One X] NZtechfreak:
I'm on Hboot 0.43 and it says S-Off, although unlike the above screenshot mine says ***Locked*** at the top. So am I able to help?

Will post a screen later when I have a camera besides the One-X with me.

Mine is a phone from HTC and Telecom NZ for the Telecom Tech blog, so likely not a retail handset and hence the S-Off.
[HTC One X] vinillum:
Absolutely, just follow the steps mentioned at the first post
[HTC One X] tids2k:
Is it ENG S-OFF ?
[HTC One X] xmoo:
Instead of everyone talking.

Please follow the tutorial.

Havn't seen a drop yet in my inbox :(
[HTC One X] Supaiku:
This seems promising! :)
[HTC One X] JeckyllHavok:
I created the goldcard with an old G1. Created as usual, but it seems hboot didn't recognize my cardreader, think i need a hub

so got an y cable will check
[HTC One X] Polarfuchs:
They not only change the Sim, but also the sd card in that video.

It shows eMMC Boot on the screen.

Which is disabled on Ship S-On devices.
[HTC One X] mattman83:
How does that work? Isn't the goldcard based on some Id in your phone?

I also noticed on the white sim clip it throws a block of text that looks a lot like the dump we send htcdev for our unlock key. Prob not useful as the as card/sim prob have the encryption key but thought it interesting.

M.
[HTC One X] JeckyllHavok:
Ok, first step done, my hboot recognizes the card, now lets put hboot on it

so, now it states:

hboot

Checking SD card update (maybe it scans the whole sdcard, waiting for 5 min now)

---------- Post added at 03:50 PM ---------- Previous post was at 03:34 PM ----------

ok it stays at checking sd card update, but i think it's a good start
[HTC One X] tids2k:
Anyone rooted and with HTC original rom .. try this

So, after "fastboot oem enableqxdm 1" Desire is able to produce this kind of logs.

To do that, use *#*#4635#*#*, go on "Phone info" (Informação de Telefone, pt), then "Activate log QXDM SD" (Activar registo QXDM SD,pt)

The log will be stored on the SD card like qxdm_20110808_220313_1.dm, to recover the SD you have to set "fastboot oem enableqxdm 0"

But now the problem is to open this log...

I've tried with QXDM but I got crash on Win7 64 bits, any idea how to read these files?

Best Regards,
[HTC One X] abc27:
They cannot sell anything without warranty. They cannot sell you a product and then absolve themselves of responsibility for manufacturer defects.
[HTC One X] :
DO NOT ENABLE THIS LOGGING, its used to log the radio freq/network monitoring, SOMETHING YOU DONT WANT :D

Sent from my Desire HD
[HTC One X] tids2k:
Found this on microsoft website, anyone wants to check this out....
[HTC One X] JeckyllHavok:
Theese are the normal hboot drivers i think
[HTC One X] tids2k:
so there is nothing we can do with these...

i am actually trying to find a htc diag driver which i can emulate with the QPST .. and hence get some more data out of the device.

@kholk .. @moo any help ?
[HTC One X] wtfhax:
Included in this driver packs

ADB Testing Interface

Fastboot interface (Google USB ID)

HTC Bootloader

HTC Dream

HTC Dream COmposite ADB Interface

Qualcomm Composite ADB Interfac (Google USB ID)

Taiwan Mobile QW-100 Composite ADB Interface
[HTC One X] JeckyllHavok:
We use theese drivers since G1 times
[HTC One X] Polarfuchs:
These are the normal drivers win7 automatically downloads/installs when you connect the phone in hboot via usb.
[HTC One X] tids2k:
ok so they are useless then ???
[HTC One X] JeckyllHavok:
I think so
[HTC One X] kholk:
LOL! I can clearly remember this video that I've seen when I was on my good ol' Desire Z times :P
[HTC One X] Evil-Dragon:
So it is a sim card. So we need to get hold of the diag file and a HTC factory sim. That's a tall order to achieve. I guess what XTC Clip did is to fake the white card sim. Since XTC Clip hasn't been updated in ages then we'd either have to make our own or find a way to create a white card sim which is difficult without any image file to create one. Surely the chinese forums would have a white card image?

EDIT: Wait, so the DIAG file and White Card SIM only rewrites the CID? Making it SuperCID? Does it reset the secureflag as well?
[HTC One X] Wonderkik:
It probably is a very dumb question, but as I am quite new to that S-off thing (phone history is Lg KS20, Iphone4, Htc One X ^^ ) I'll ask anyway.

Can't we simply ask HTC for the method to S-off? After all, they are rather "Dev friendly" aren't they?

Again, I don't know what that would imply, in terms of piracy and such important matters for a big company. Sorry if this is just me having a "Mr. Nice" moment ^^
[HTC One X] itchy67x:
Try it and tell us ;)
[HTC One X] Wonderkik:
If it was so easy, I suppose we would have it by now, thanks for the answer ;)

It would just seem fair to me that they allow S-off on a per-demand basis, but then again I don't know how far it opens the device nor HTC's policy about piracy. (If that is even piracy, I'm quite lost here ^^ )