yashsingh1/xdaforums huggingface dataset:
[HTC One X] angusc:
You would need to install a Chinese language pack on your PC to get the correct characters on the program output screen. Then you could possibly use Google translate to know what passed and what failed.

Sent witH desire from OneX
[HTC One X] graemeg:
S-On has no effect on network unlocking the phone at all, most phones dont come locked these days because there is no way to effectively block unlocking.

The revolutionary method on sensation which is a htc phone worked really well, there must be a way to get s-off achieved on the one-x, the sensation xe isnt that old a phone yet its easy to debrand compared to this.
[HTC One X] artymarty:
Just a thought, remember when HTC first started locking the phones, everyone went crazy and *****ed about it on their facebook Page and within a day they said sorry and promised to give an unlock method.

Everyone quietened down....

Now they slowly start unlocking less and less... Don't you think it's time for everyone to get back on their Facebook and complain?

They gave us a half-assed unlock and then slowly make it even more useless... This is not on... Everyone should demand a full unlock along the lines of - " HTC, You had a chance to make good, you screwed up, full unlock s-off is only acceptable option now"

SO, MY QUESTION IS:

how is the best way to organize this so as many users as possible do it in the same period (and continously till its sorted) not just talking about xda, I mean everyone......

Marty

Sent from the future using tipi-tapa-talk 37
[HTC One X] Sentinel196:
Unfortunately we are a small part of the bigger picture.

As with all manufacturers, the customers they care about are the carriers, who demand security features be in place to protect themselves.
[HTC One X] omar302:
Just a thought.

Flashing an older RUU (downgrade) is currently not possible, correct? Which is supposed to be because the RUU will check the version you currently have in the phone, and if it is the same version or older, the RUU will update.

So, what will happen if you unlock the phone, wipe system, relock & then try and flash an older RUU?

Or, Flash a custom RUU that has an older ROM version than the required RUU, relock, and then flash the RUU?
[HTC One X] skr_xd:
Downgrading Hboot is not possible & Flashing a different CID ROM is not possible even if unlocked.

Shall be possible only with SOFF.
[HTC One X] Rauke:
I wonder what HTC's gonna do when they come to Brazil, where carrier unlock is free and supported by law

Maybe thats why they delayed OneX's release to second halfyear

I hope they need to S-OFF phones to sell here
[HTC One X] mattman83:
Simple, they just wont carrier lock them, same as buying a handset outright. Its got nothing to do with soff.

M.
[HTC One X] pdagenius:
Am interested to know if this investigation revealed anything new which can help us?
[HTC One X] SB13X:
See my signature ;)
[HTC One X] pdagenius:
Has anyone downloaded this now and had a look if it can help us?

---------- Post added at 12:16 PM ---------- Previous post was at 11:22 AM ----------

Came across this blog on Tegra APX. Is there something we can pursue from this for Tegra 3 APX?
[HTC One X] f4flake:
the development kit is just like the android sdk so is of limited usefulness.

The nvflash guide is interesting, but unless we can discover how to get into apx mode we're stuck.
[HTC One X] pdagenius:
Are you able to post the guide please?
[HTC One X] artymarty:
Now I do on my PC, Tapatalk does not show them :D
[HTC One X] Polarfuchs:
Can you please look into these slides?

http://vulnfactory.org/research/android-modding-source.pdf

At page 26 they talk about nvflash.

They mention "miniloader", a minimal bootloader, that handles actual flashing.

Is this miniloader already integrated into the APX mode, or can we use this miniloader (If we had it) to achieve something?
[HTC One X] f4flake:
:confused:

you posted it fella. :confused:

---------- Post added at 02:07 PM ---------- Previous post was at 02:01 PM ----------

NvFlash is just a utility like ADB. This 'miniloader' is just part of nvflash not something that we need to acquire.
[HTC One X] pdagenius:
Is there a way to dis-assemble or exploit the knowledge from the unlock apk used with the Transformer Prime - a Tegra 3 device: unlock app download
[HTC One X] theliquid:
As shown in this guide http://chencen2000.blogspot.co.uk/2011/04/flash-nvidia-tegra-apx-device.html (for another device) getting in APX-Mode isn't done by pressing a combination of buttons.

As far as I can see he did it by executing the command "echo 1 >/proc/naz10_diag/force_recovery" in terminal emulator ...

Will have a short look into /proc !
[HTC One X] Evil-Dragon:
Not really, different device. HTC's security is ****ty.
[HTC One X] johncore:
http://xdaforums.com/showpost.php?p=26119549&postcount=1714
[HTC One X] theliquid:
Ok, I also realized that when having a look into /proc ...
[HTC One X] Arthas92:
not ****ty.

in this one it is a good security

if it wasn't good, may be we have already had off-set
[HTC One X] Evil-Dragon:
****ty as in hard to break.
[HTC One X] pdagenius:
Maybe looking at this in conjunction with the disassembly of the hboot may give us some more clues?

Or maybe our kernel developers can comment from their knowledge of the kernel details?

Just found this http://ac100.grandou.net/nvflash

Maybe by following this method with the tegra 3 sdk files we might get NVflash to work?

Also look at this http://xdaforums.com/showpost.php?p=11758575&postcount=14. This suggests that if we install nvflash on the pc first and enter the command in the link before maybe powering down and rebooting the one X with the power button we possibly could get into apx mode?
[HTC One X] ytwytw:
I have no faith in this phone now... gonna put it up on the kijiji for sale...

I wonder APX mode need diag file present on the OTG

as when you do "fastboot oem writecid 11111111"

instead of return permission denied, it is looking for something on the USB Host (someone has post that couple pages before), fail to find that cause hboot crashed... (so i have to force turn the phone off to do anything more)
[HTC One X] Rekoil:
Good for you. Bye bye.

For those of us who actually have an HTC One X and also some patience: Is there any source code for the kernel for that Toshiba AC100 tablet which shows how the naz10_diag thing works?
[HTC One X] XDeveloperX:
Have you guys even tested tacoroot from jcase?

jcase: "lol @HTC still shipping new firmware vulnerable to TacoRoot, after almost 6 months?"

source: https://twitter.com/#!/TeamAndIRC/status/202866907118960640
[HTC One X] theliquid:
This doesn't work for One X ... :(
[HTC One X] pdagenius:
Temp root only? http://rootzwiki.com/topic/13713-tacoroot-htc-universal-root-exploit-12-30-2011/
[HTC One X] johncore:
Only 180 pages ago.

http://xdaforums.com/showthread.php?p=25169678&highlight=tacoroot#post25169678
[HTC One X] KrisPerry:
Could we use the temp root to change kernel to one that accepts the /proc command
[HTC One X] co@ch:
Was trying today some (key-) combinations regarding APX mode. For example on the powered down Cube U9GT (Rockchip 2919) you have to keep pressed the menu button and connect the USB cable for entering - let's call it - APX mode. Well the HOX doesn't have a menu button, anyway I tried anything without using the power button. No luck at all.

OT: while I was trying I found out something unexpected. When you connect the powered down HOX to the PC not pressing anything the red LED will show up (phone stays off). When you then unplug the cable the LED will not switch off (phone stays off). Doing the same with the charger the LED switches on when connected and off when disconnect. Someone knows why? Bug or feature? :confused:
[HTC One X] KrisPerry:
Not the case on mine
[HTC One X] blubbers:
Anyone tried shorting the 3.5mm port?
[HTC One X] KrisPerry:
Doesnt seem to do anything. One thing I have noticed though:

Power off phone

Hold vol+

connect USB

after 4 secs hold vol+ also

Phone does a short 1 sec vibrate

Nothing seem to appear in device manager. Where exactly would the APX device be located in device manager
[HTC One X] X10@Germany:
I have a question. We havent made any progress or have we? Can anyone say it in percent?
[HTC One X] blubbers:
could you explain this more exactly please? i can't reproduce the vibrate
[HTC One X] KrisPerry:
It doesnt seem to be woking now which is strange, I was able to replicate it multiple times earlier.

---------- Post added at 12:12 AM ---------- Previous post was at 12:07 AM ----------

OK this was it:

1. Start with phone powered on

2. Hold power button and select power off

3. When phone begins to shutdown, press and hold vol+ until further notice

4. When phone power off completely count to down and then plug in usb (still holding vol+)

5. Count to 5 and then hold vol- (still holding vol+ also)

6. Phone vibrates

---------- Post added at 12:14 AM ---------- Previous post was at 12:12 AM ----------

Just to add to this. If I then release vol+ and while still holding vol-, i press and hold the power button then the three touch sensitive buttons begin to flash.
[HTC One X] theliquid:
I also can't confirm this ...
[HTC One X] Sentinel196:
Define 'progress'...

Like Thomas Edison with the light globe, we now know 100 ways not to S-OFF a One X.
[HTC One X] artymarty:
Also, like when you lose your car keys and they are always in the last place you look, I can guarantee that S-OFF or APX model will be in the last place we look....

..... Because who keeps looking after they find their car keys? :0)

Sent from the future using tipi-tapa-talk 37
[HTC One X] miniudavid:
For its mostly the wife.. maybe nvidia.

or they are in the first place where I didn't looked right....
[HTC One X] creative0100:
Mine does this.

Also when i plugged in the usb cable it installed some device drivers
[HTC One X] Sentinel196:
If to press Vol+ 32 times, while holding Vol- and Power, then press Triangle, Square, Left, Left, Up, Circle, R1, R1, R2, L1, Left, Left, L2, Square, Triangle, Start, you'll get Infinate Health and See-through Walls.
[HTC One X] mattman83:
Testing now. The last part is probably just the force shutdown, it flashes the soft buttons before "pulling the battery".

Also, what it "count to down" ? :p

M.
[HTC One X] P1n3apqlExpr3ss:
Will s-off be as useful as what we think it will be?

http://xdaforums.com/showthread.php?t=1656598

Yes it's my thread and yes and I'm trying to direct those lurking here with s-off phones in the direction of the thread in order to try and verify it
[HTC One X] maxld:
Yes, it will.
[HTC One X] KrisPerry:
What drivers was it
[HTC One X] creative0100:
No idea.

My phone was already working with that computer so i thought it was strange. Is there any way to check?
[HTC One X] KrisPerry:
How can we check if the phone is in apex mode
[HTC One X] pdagenius:
USBdeview is a really useful windows tool that will show you your USB drivers, what you are using and then remove them if you want.
[HTC One X] n1kon:
That worked like a charm. Why didn't I think of that pmsl.
[HTC One X] KrisPerry:
So how do you know it installed drivers. Can you use theta program suggested by pdagenius to check
[HTC One X] creative0100:
The little pop up box that windows likes to show when it is installing drivers is how i knew:D

Will try it again on my other pc to see what it does..
[HTC One X] KrisPerry:
Is that the same little pop up box that tells you which driver it is installing
[HTC One X] pdagenius:
Hmm... I can't get the phone to vibrate and have tried it half a dozen times. All I hear is the pc recognizing the phone a couple of times.

Query: on Item 4 what do you mean ".. count to down.. "

If this sequence is repeatable for you then I am missing a step somewhere. Are you sure you have described the sequence precisely? Thanks
[HTC One X] KrisPerry:
Sorry it should read "count to ten". Works everytime for me
[HTC One X] pdagenius:
Thank you for the reply. Can't get it to vibrate here :(
[HTC One X] ytwytw:
I think we need try s-off device first to get into APX Mode

if we find a way to enter APX on s-off device, it may work on s-on device too

Just a thought
[HTC One X] jejehtc:
Hello,

Can you make a full tutorial for this feat.

Thank you in advance for your work and also for your response
[HTC One X] KingOfNV:
Make a Video.
[HTC One X] KrisPerry:
Make a video of what
[HTC One X] KingOfNV:
From this:

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] pdagenius:
I take it though you haven't managed to get into APX mode?

Sent from my Galaxy Tab 10.1 with Tapatalk
[HTC One X] jejehtc:
But after a time I do not know what to do with the nvflash doissier
[HTC One X] KrisPerry:
I don't know as no one has told me how to check if i am in apx mode or not
[HTC One X] f4flake:
It may depend on a driver, perhaps the handset masks APX mode, but you would expect the operating system to appear with an item it doesn't recognise. Or one it recognises as something else in the absence of a modified driver. For example, if you connect your device, while switched off, a windows OS will detect a portable drive, which isn't your "SD" partition, which looks suspiciously like an emulated CD drive.

On another note, logically, the odds are HTC will be delivered a bunch of bricked devices.

That being the case it seems unlikely that one can only access APX mode from a booted state.

At which point, given the extensive efforts myself and others have put in to finding the mode via the mini-usb port, perhaps the time has come to imagine that the pogo pins are in fact the input/output conduit for APX mode.

To my knowledge no-one has yet attempted to modify a USB cable to attach to them.

While it is of course for use with a docking station, for audio and charging, perhaps the tegra hardware is also accessible given the correct pin combination, which wouldn't be available on the commercially available dock.

Find the way the dock is wired and try something different.
[HTC One X] nicholaschum:
At times I feel the need to fly to Shanghai, call up that guy, pay for S-OFF.....

While the whitecard is in my phone and he goes to light up his cig, I sneak away with my phone and fly back to Hong Kong.

I wish.....I wish....:(
[HTC One X] KrisPerry:
What do you mean by Pogo pins
[HTC One X] f4flake:
The five brass contacts on the side of the back of the phone, below the usb port.
[HTC One X] graemeg:
I have also tried various combinations but with a usb jig i made, ive made a couple of them jumpering various pins with 10k watch resistors but to no avail, unlike on the samsung, a jig seems to have no effect on the One x in powered on or off state.

Ive come to the conclusion that there must be a different way rather than through the usb.
[HTC One X] f4flake:
Have you tried connecting it to the pogo pins? Or have I misunderstood your post?
[HTC One X] E:V:A:
Hello,

I'm from the Samsung Galaxy S2 Hardware Hacking side. What you're doing here is very interesting and I'd like to help if possible. I do have some limited knowledge about the Baseband Processor (Modem) that our devices share. After having briefly skimmed through the 1st 60 and last 20 pages, I have the following comments and questions. (Please excuse me in case I have missed something relevant by ignoring all pages in between.)

1) It may be very helpful to completely understand the boot process of the HOX. Have anyone posted the detailed boot procedure that is used with your processor? (Please provide links, if so.)

2) Getting a proper and early Kernel log (dmesg/kmsg) output may be very helpful, but this may require UART serial port acess when phone is "offline". Have anyone done this yet?

3) There are several ways to get Kernel messages from your phone;

a) from local console/shell. (dmesg, cat proc/kmsg etc)

b) from external adb shell

c) from externally available UART/serial port:

i. from emulated USB serial device driver

ii. from USB D+/- signals, after telling processor/kernel

iii. from headphone-jack

d) from internally available serial port, through test pads or other forms of JTAG connections inside phone.

4) The XG626 (XMM6260) modem is a very powerful device, that run its own OS (RTOS) and can handle firmware updates and bootloaders. For example in the SGS2 the BP is responsible for most settings in the service menus accessible through "hidden/secret" dial codes. I'd doubt that your device is much different from that (SGS2) in this regard.

5) Is there any service and/or processor manuals or other relevant documentation available for your device (HOX)?

6) It would be helpful if someone could summarize the relevant current status and knowledge about the HOX, including tools and documents.

Hope to be of any help.
[HTC One X] blubbers:
2/3) search for my posts, i've attached an early dmesg

4) i've also posted a list of AT commands
[HTC One X] KrisPerry:
blubbers could you provide these to E:V:A, it may help to move things forward.

FYI a driver was definitely trying to install earlier when I did the "vibrate sequence" described earlier. See attachment
[HTC One X] KrisPerry:
So my next question is where can i get the driver
[HTC One X] co@ch:
2/3)

http://xdaforums.com/showpost.php?p=26079961&postcount=1623

4)

http://xdaforums.com/showpost.php?p=25507881&postcount=706

http://xdaforums.com/showpost.php?p=25780203&postcount=1286
[HTC One X] pdagenius:
Easy - attached by Mike in the first post :)
[HTC One X] SB13X:
Big thanks EVA for popping in with your assistance we appreciate you giving us your time.
[HTC One X] blubbers:
I still cannot reproduce the vibrate.

What is the vendor/device ID?

Have you installed the apx driver? Get the nvflash binary and run it in a terminal

nvflash -w
[HTC One X] pdagenius:
Are you using 32 or 64 bit os on pc? Just wondering if this a factor too?

Sent from my Galaxy Tab 10.1 with Tapatalk
[HTC One X] E:V:A:
How did you obtain those?

There is a line in the AT set that say: "PBREADY" but it is not prefixed with a "+". Is that a typo? "PB" may refer to "Primary Bootloader"...

In any case the dmesg output is very interesting as there sem to be many different serial ports etc, to play with. I am conviced that when you send your HTC in to service, that they use a (special?) USB cable (likely in serial mode) to upload new boot-loaders or tuning the modem/radio. Right know I just don't know anything about your hardware, so I'll go have a look.

In addition, you seem to have one hell-of-a-kernel-command-line there! However, the console messages are not early enough to say anything about boot loaders. That is why we should try to figure out:

1) if you can get (serial) connection when phone is off(!), making it boot when plugging in a micro-USB jig-cable with certain resistances between USB_ID and GND. This is how it's done on Samsung, however a similar trick could also be implemented on the HTC, although I doubt it at the moment. [Phone is never dead, unless battery is out.]

2) Get early console messages when phone boots. (This is hard, and may be impossible without a serial converter attached to micro USB cable.)

3) If there are some special USB drivers that can be used to catch serial console.

At the moment I'm confused as I was looking at this "teardown" (TechRepuplic) of the HOX, which does not mention (or show) the XMM6260 modem chip... although the posted dmesg ouput clarly show that this is the modem. Are there different models??
[HTC One X] E:V:A:
BTW. When rebooting using codes or whatever, what happens in Windows Device Manager? Any new interesting devices? (Also check under "modems"!)

BTW2. Could someone update me on what "APX" stand for, and is used for?

I recall seeing a disassembly somewhere in this thread, with both nvflash and JTAG code in it.

Where is this code located? (And more importantly, where is it run from?)
[HTC One X] Setsuna666:
There's two model, one with a Tegra 3 processor (international version) and the other a Snapdragon S4 (AT&T) . The one from Tech Republic seem to be the S4 from AT&T based on the picture they provided.

We have the Tegra 3 device here.

Hope this help
[HTC One X] blubbers:
also check out this;

http://xdaforums.com/showpost.php?p=25508567&postcount=708

pbready refers to phonebook.
[HTC One X] techmatlock:
I believe there is also two different HOX's, a Europe and Asia version. One of the kernel developers was running into problems getting overclocking to work on both.
[HTC One X] blubbers:
htc devices have a secondary bootloader (hboot), which get's bootstrapped from the tegra3 pbl (nvflash)

right now, we do not have access to nvflash since we don't know how to put the device into this state

in my opinion, getting into nvflash is getting us eventually to s-off (altough this may not be the only option)
[HTC One X] KevinB88:
Can' t the implemented Recovery help?
[HTC One X] 1000moths:
No you can't access the bootloader from recovery due to S-ON
[HTC One X] E:V:A:
Having spent the night, scanning the thread in "archive mode" for something useful, I can't help thinking that there is a bunch of info being held back. I really don't know how we can make any progress, if people who sit on good documentation and relevant info, are not sharing it!

1) There is a Tegra-3 Technical Reference Manual "around". This is essential for finding the correct boot procedures and registers needed to be able to track the S-OFF code. Please drop it somewhere!

2) There seem to be a leaked "HTC One X" Service Manual as well, around...

3) There are source-code snippets around which seem to indicate that you have sources to some of the relevant code. Please link to those sources!

4) There is a disassembly of the APX -mode subroutine. Did someone follow up on that?

5) Then the following procedures should be checked off, unless already done.

_a) Provide a detailed description of boot procedure.

_b) Check other HTC devices how S_OFF have been implemented.

_c) Obviously (?) the S_OFF is just a parameter stored in some parameter file. What other parameters do we know about? We know that for other XG626 devices there is a param.lfs file that stores important radio stuff. So there is probably something like that here as well. The shared part of the RAM between BP and AP should be inspected.

_d) Find a way to get a serial connection. Has these options been thoroughly tested? (There should be hints about this in source code and in device drivers.)
[HTC One X] artymarty:
Just wondering - when my phone has crashed and comes up with a 'send report to HTC' if you look at that report it seems to have a lot of info about the boot up...

I have zipped up some log files, kernel logs etc, hope they help

https://docs.google.com/open?id=0Bw7bueTkStuHcHk4VFlVc2VHRkE

(7mb in size)

Cheers, Marty
[HTC One X] mickfitz:
Now that a bounty for s off has started, did you expect people to play nice?

It sucks but money talks.
[HTC One X] angusc:
Don't see any relevance in that.....or your post.

Sent witH desire from OneX
[HTC One X] RedGreenGeek:
Hmmn

I tried a similar thing, but the drivers in the start is not for a win 64 system, correct?
[HTC One X] mickfitz:
Nobody will share info because everyone wants the bounty. How hard is that to understand?
[HTC One X] angusc:
http://xdaforums.com/showthread.php?t=1611116

Sent witH desire from OneX
[HTC One X] pdagenius:
Would love to get my phone into the right mode to try.... I must of rebooted and shutdown 20 time yesterday but the sequence does not work for me:-(

Sent from my Galaxy Tab 10.1 with Tapatalk
[HTC One X] artymarty:
Yeah whatever.... Do you have anything constructive to add? Or are you just using up bits on the net.... You must be the guy in the disaster movie who just runs around screaming "What's the use, we're all going to die anyway!"

-----------

So, as people have mentioned, 64 bit windows... That is a very good question... I've got that too. Is there any special drivers I should load for apx mode hunting?

On the shorting of usb id line to ground via a resistor. Does or could the value make a difference? Would we need to try it with a variable resistor giving it a turn, try again and so on. If so, what range do you think it would be between?

Sent from the future using tipi-tapa-talk 37