yashsingh1/xdaforums huggingface dataset:
[HTC One X] Rekoil:
If you run "fastboot oem getcid" you'll see that the CID has not changed, all that changes by this is a static value that the OS knows about, not what HBOOT sees.

The block with the CID information is outside the range of what an unmodified kernel sees. It is not part of the memory that is fed to the OS.

It could potentially be accessible through mmcblk0 though.
[HTC One X] GabrielSousa:
SO, we need a kernel, to see that blocks, right ?

---------- Post added at 10:53 AM ---------- Previous post was at 10:50 AM ----------

i did a strings -n 8 /dev/block/mmcblk0pXX > /sdcard/temp1/mmcblk0pXX

so if we can learn a bit more about the device.
[HTC One X] Bin4ry:
Guys, MOST LIKELEY you cannot do this from kernel. The MPU is being out of range on CPU. Just with a kernel you cannot reach there, you need a exploit to get access to the data.

Yes HTC has made some mistakes on other phones so the data which is interesting seemed to be accessabile from mmcblk partitions, but this is not the case here and you not "just" boot anoter kernel and get access to the restricted data. It's hidden right from hboot not kernel. So what you need is a splboot like we did on Xperia X10 to access the hidden areas. We did a spl jump via kernel module to load and execute our very own SPL -> this one gave us a fastboot shell and a serial one to access all areas / download / upload them without the security of the original bootloader.

If you want to try such a attempt -> sources of splboot are somewhere upped to X10 fourms as an example of such an attempt, all had to be adapted to this special device of course.

BUT please : Don't mix the stuff up!

Regards
[HTC One X] P1n3apqlExpr3ss:
I know this is really off topic but how much of a price premium (percentage) would you pay for a s-off One X? PM me to avoid more than one off topic post

On topic: Keep up the hard and diligent work guys, I'm sure there will be a break through sometime soon!
[HTC One X] GabrielSousa:
making the exploit MUST be the next step, we need to access to the other blocks ;)
[HTC One X] heavy_metal_man:
Not sure if this is any use but over at the wildfire s forums to try get s-off we managed to map the unmapped partition by issuing a new kernal via fastboot with new kernal piramiters. Its lost at reboot but we can see the whole nand Afaik. Our only issue is trying to get write access to patch in our modified hboot.
[HTC One X] N3m3515:
this is posted 2 posts above yours...
[HTC One X] Dunc001:
Don't know if anyone noticed this in Trips twitter feed yesterday (referring to his latest 3.1.10 endeavour kernel):

Any significance here?
[HTC One X] n1kon:
No go without xtc clip

Also fastboot oem s-off my f***ing phone and give me super cid dont work ether. My brian is fried i will come back to this tomo or friday
[HTC One X] dezborders:
It's in mmcblk0 at offset 00a00014 (see attached, with my IMEI masked)
[HTC One X] dezborders:
I haven't managed to edit mmcblk0 so far so wouldn't expect cid to have changed

I also agree if mmcblk0 contains the entire 32gb nand memory then it's unfeasible to dump it all to pc (via cifs) then edit and write it all back - even if the os would allow it, which is doubtful.
[HTC One X] doublecheese:
Why am I getting these errors , I am with XTC CLIP inserted

C:\adb>su

'su' is not recognized as an internal or external command,

operable program or batch file.

C:\adb>stop ril-daemon

'stop' is not recognized as an internal or external command,

operable program or batch file.
[HTC One X] h00py:
You need to type "adb shell" first
[HTC One X] Babydollll:
try leaving out the > symbol.
[HTC One X] kruppin:
Sure, we shouldn't stop people from giving ideas, but if they have one, then the least the can do is search and check the thread a little first. And secondly, you being able to change something in p19 doesn't matter as it just contain logs as far as I know, so if we can write to that specific partition doesn't change anything. :p The places we maybe could change something useful in are masked and/or write-protected.

Dumping the whole MMC is probably also a waste of time, as we probably mess upp some signatures when an edited dump is written back and we have a brick and thats assuming we even get a full "real" dump to begin with. They (htc) aren't dumb, and with every new phone it get harder to gain s-off so until an exploit is found then s-off won't be possible. If we are real unlucky we'll never even get s-off, but that also probably when I'll stop buying htc. ;) And the "real devs" probably already are in a private irc-channel somewhere, and hopefully they already have a way to get this sucker s-off'd. Wouldn't count on it though.
[HTC One X] GabrielSousa:
first you need to do "adb shell"
[HTC One X] doublecheese:
OK, after adb shell before the commands this is what I get :

C:\adb>fastboot oem readsecureflag

...

OKAY [ 0.109s]

finished. total time: 0.109s (this is just to see if adb was working)

C:\adb>adb shell su

error: device not found

C:\adb>adb shell stop ril-daemon

error: device not found
[HTC One X] h00py:
I mean like this:

"adb shell"

"su"

"stop ril-daemon"

Etc.

Not before every command :)
[HTC One X] witm01:
ADB and FASTBOOT are two different things. When in Fastboot-mode you can't get an ADB-shell. Boot up into Android for that or get the beta of CWM recovery with working ADB/USB.
[HTC One X] h00py:
Yeah, this would help too lol. Like bin4ry said make sure you run the commands when the ROM is running.

Start off with "adb shell" then follow his commands and let us know how it goes.

Good luck :D
[HTC One X] doublecheese:
Yes I am learning , pls tell me how to get into that screen to type these commands

Do you mean that , I have to open Terminal Emulator or something ?

I have the latest CWM recovery .

I mean I type these commands from my PC or HOX ?
[HTC One X] h00py:
Turn your phone on and let it start normally.

Make sure you have usb debugging enabled (settings>developer options>usb debugging).

Type "adb shell" in the command prompt on your PC like so:

Now enter bin4ry's commands in the command prompt on your PC too.

Hope this helps.
[HTC One X] Chura:
you need to connect via adb to the device

adb shell <--- Press Enter after

you will now be in you HOX shell

then copy paste what Bin4ry asked

su

stop.....

thats it :)
[HTC One X] doublecheese:
Thats why I love XDA , althouh I am 40 , I learn something everyday :)

Here you are :)

C:\adb>adb shell

adb server is out of date. killing...

* daemon started successfully *

shell@android:/ $ su

su

shell@android:/ # stop ril-daemon

stop ril-daemon

shell@android:/ # cat /dev/ttyHS3 &

cat /dev/ttyHS3 &

[1] 4732

shell@android:/ # echo -e 'ATE1\r' > /dev/ttyHS3

echo -e 'ATE1\r' > /dev/ttyHS3

shell@android:/ # echo -e 'ATV1\r' > /dev/ttyHS3

echo -e 'ATV1\r' > /dev/ttyHS3

shell@android:/ # echo -e 'AT@CID?\r' > /dev/ttyHS3

echo -e 'AT@CID?\r' > /dev/ttyHS3

shell@android:/ # echo -e 'AT@SIMLOCK?40\r' > /dev/ttyHS3

echo -e 'AT@SIMLOCK?40\r' > /dev/ttyHS3

shell@android:/ # echo -e 'AT@SIMLOCK?AA\r' > /dev/ttyHS3

echo -e 'AT@SIMLOCK?AA\r' > /dev/ttyHS3

shell@android:/ # echo -e 'AT@SIMLOCK=7,0\r' > /dev/ttyHS3

echo -e 'AT@SIMLOCK=7,0\r' > /dev/ttyHS3

shell@android:/ # echo -e 'AT@SIMLOCK?AA\r' > /dev/ttyHS3

echo -e 'AT@SIMLOCK?AA\r' > /dev/ttyHS3

shell@android:/ # echo -e 'AT@CID=11111111\r' > /dev/ttyHS3

echo -e 'AT@CID=11111111\r' > /dev/ttyHS3

shell@android:/ # echo -e 'AT@CID?\r' > /dev/ttyHS3

echo -e 'AT@CID?\r' > /dev/ttyHS3

shell@android:/ #

---------- Post added at 06:43 PM ---------- Previous post was at 06:30 PM ----------

OK Guys , I did it

Now what ???? I am still connected as it is !!!
[HTC One X] h00py:
Guess it's good you're not getting any errors like the last person who tried it without the XTC clip. Sadly I have no idea what that output means, I just have a basic understanding of adb commands/linux in general :p

I guess we got to wait until bin4ry gets back from university and checks the thread lol

Could you check to see if your CID has changed?
[HTC One X] Bin4ry:
Too bad! Seems not to work. I really hoped that this is a serial interface for ril. Because in getprop it shows up as ril.dev.serial .....

Ok. Another thing:

someone at the start of this thread said that there is a option in HBoot like "Clear Security".

What happens if you do this option while XTC is inside?

Regards
[HTC One X] doublecheese:
remind me the command for checking the CID :)
[HTC One X] GabrielSousa:
well now you can see is you have superCID
[HTC One X] doublecheese:
I just did 'fastboot getvar cid'

and the answer I got was 'NONE'

hBOOT

FASTBOOT

RECOVERY

FACTORY RESET

SHOW BARCODE

IMAGE CRC

There is no 'Clear Security' command on HBOOT
[HTC One X] skygear:
Willing to /bash commands at my HOX too if anyone needs. On a MAC using terminal.

Bin4ry - no HOX yet?
[HTC One X] h00py:
Try fastboot oem readcid

I've got no clear security option either. I'll see if I can find the original post.
[HTC One X] doublecheese:
C:\>cd adb

C:\adb>fastboot oem readcid

... INFODEBUG: cid: HTC__203

OKAY [ 0.000s]

finished. total time: 0.016s
[HTC One X] GabrielSousa:
didnt change :(
[HTC One X] Bin4ry:
No i dont have the device.

I was referring to this post:

http://xdaforums.com/showthread.php?p=26915073&highlight=clear+security#post26915073

Whats it about then if you dont have the option in HBoot ?!

Regards
[HTC One X] doublecheese:
How can I be sure that my XTC CLIP is communicating with my HOX.

As you all know I cut the normal ribbon into Micro Sim shape with a help micro sim adapter.

I just need to make sure some how they really communicate.
[HTC One X] Bin4ry:
That is a good question. We cannot be sure yet. As far as i remember the XTC Clip kind of blinks the LED while communication is on the SIM ?! But REALLY NOT SURE! :D

I am waiting to get the diag file for this phone. Maybe the guy i wrote will get it.

But out of interest. Where is the guy that said there is a "clear security" option? Can he tell us where he found it? Maybe its inside one Submenu or smth.

Regards
[HTC One X] skygear:
I looked around and couldn't find anything.
[HTC One X] h00py:
This is how he managed to get the reset security option to appear:

http://xdaforums.com/showpost.php?p=26436594&postcount=2063
[HTC One X] doublecheese:
I think i must find an old HTC phone which could be S-off'ed by XTC Clip and insert the cutted micro sim ribbon into the sim adaptor and try .

Now I get no green light blinking at all which makes me wonder.
[HTC One X] Bin4ry:
Thats the info needed! Thanks very much!

Don't wonder too much! As long as no sim action is there (becasue no security checks are done) there wont be any action on clip. Lets try to find some videos on youtube to check how the clip signals anything.

Maybe you can try to get the security option popup like in the instrctions, if you dont mind to play with this *risky* things.

Regards
[HTC One X] dezborders:
Stupid question (probably)... so if mccblk0 is the entire 32GB nand memory, including hboot, recovery, boot, sdcard and any private memory containing CID etc... then where in the memory map does hboot, recovery and CID live? i.e. The first few GB or last few GB?

If you dd mmcblk0 to sdcard, you get the first 4GB left behind on /sdcard/ after it errors with "file too large". Therefore IF hboot, recovery, CID, etc was in the first 4GB, could you edit in supercid, write the first 4 GB back (knowing it would truncate) and end up with a still functional hboot & recovery... but with superCID?

Admittedly your SDCARD partition would be corrupt buth you could hopefully format/repair that after flashing in a working ROM?

Oh and before you ask... NO I am not gonna try this on my HOX. :P
[HTC One X] doublecheese:
If someone can replicate it and write how to do it step by step then I can try with xtc clip.
[HTC One X] Bin4ry:
Ok i checked. XTC Clip stays green without blinking, UNTIL the security gets checked, then it blinks a few times.

So unless we trigger a security option it wont get checked and so it wont blink!

Regards
[HTC One X] doublecheese:
I checked those videos too, but my assumption was that the green light is on because the user is using 9V battery . I dont have a 9V battery with me and I use the pc (usb cable) to power up the xtc.

I am sure I will find some old Htc Phones tomorrow, i know some guys have Desire S and i know they can be s-off'd by xtc.

I haven't been using my xtc clip since my Incredible S days, so I kinda forget.
[HTC One X] dezborders:
The term 'exploit' implies to me a mistake (dumb or otherwise) made by the developer HTC which allows devs to get enough privileges to gain s-off.

I agree with you that if HTC hasn't left any exploits in their hboot code we may never see s-off on HOX
[HTC One X] Kickasskev:
Someone always has to sink the ship when things are startin to move lol
[HTC One X] ShyamSasi:
There is not software without exploit it's just a matter of finding them .. I'm sure our devs will figure it out.
[HTC One X] Kickasskev:
Don't know relevent this is but tomorrow the dock cr s650 is released in the UK don't know about rest of world

http://www.amazon.co.uk/dp/B007IYHJ...d=15106652011956680416&hvpone=&hvptwo=&hvqmt=

And I know I've heard a few people talking about the 5 pin setup on the dock & phone and how the could help with s-off or root

Some talk of it here

http://www.xdaforums.com/showthread.php?t=1611116

Maybe this is how its done
[HTC One X] godutch:
I don't know if this is interesting but I downgraded radio from 1.1204.103.14 to 1.204.90.13 (at least the version number mentioned in hboot) by trying to flash the austrian or german/swiss vodafone 1.26 ruu (I mistakingly though I had a german vodafone branded phone but it turned out it is a uk vodafone branded one). I was on insertcoin 6.3.1 rom with the stock kernel that came with either insertcoin 6.2.0 or 6.2.1. Eventhough the ruu failed too flash the radio mentioned in hboot was downgraded in the process.
[HTC One X] h00py:
Was your hboot version downgraded too?
[HTC One X] godutch:
no, it remained 0.94.000 (i am not 100% sure but I think this was the "factory state")
[HTC One X] WiZARD7:
Does anybody know, whether Juopunutbear is working on OneX?
[HTC One X] glukosio:
any news? can someone ask htc to help us? :D
[HTC One X] Kickasskev:
Don't think I've seen him here,
[HTC One X] Evil-Dragon:
Qualcomm only, won't work for us.
[HTC One X] Beatastic:
So guys, finally I managed to get a nVidia developer account with accsess to the Tegra 3 Technical Reference Manual (TRM). So I don't know if its needed but if anyone of you want to.give it a try don't hestitate to ask me, cuz I can't upload it or maybe I'll get sued by nvidia ;)
[HTC One X] KrisPerry:
Pmd
[HTC One X] techmatlock:
How did you get accepted?
[HTC One X] xmoo:
Some people are opening there HOX to fix the WIFI issues... Some of them could try to get into APX mode since they have access to the battery.

PM'd some, waiting for awnser
[HTC One X] Evil-Dragon:
This is just a theory since I haven't managed to figure out how it gets into apx from hboot but I have a feeling they have tied it into diag mode. Hboot suggests that there is a backdoor into it but again without someone that understands ARM programming then I won't be able to understand what is happening. Anyone got hold of this tegra 3 manual yet?
[HTC One X] artymarty:
Seriously dude? Two messages up and you would know.... I understand people not reading the whole thread, but at least the first post and last Page!

Sent from the future using tipi-tapa-talk 37
[HTC One X] marcadam:
I would have thought it obvious what evil-dragon was asking. Nice constructive feedback arty, have you got a copy and come up with any ideas of how it might be used to get s-off?
[HTC One X] Whiskey103:
Guys please, keep it civil ;)

I really don't like to warn ppl, but it's said multiple times now : read, read, and stay on topic.

And refrain from bashing ;)

Lecturing ppl will not give us s-off imo.

Cheers

Whiskey

Forum Moderator

Verstuurd van mijn HTC One X met Tapatalk
[HTC One X] Beatastic:
Don't ask me, I don't know, I think it was luck.

So, by the way to all ppl that pmd me : I am going to upload it and send the link to the ppl I think they can get some informations from it. But if some ppl just want a small chapter of the Tegra 3 Technical Reference Manual (TRM) just ask me. I think there is a summary of the chapters on the nvidia page.
[HTC One X] Bin4ry:
Cool.

Can you send me the link too?

Thanks very much :)

Regards
[HTC One X] Evil-Dragon:
I can see it's going to take a while to read this manual. It covers a lot. Before you ask, I can't share it with you. Ask the guy above.
[HTC One X] tids2k:
Would be good to have NVIDIA TRM . Someone send me one so that I can work with E.V.A and AdamOutler on this. Cheers.

via Flying Daggers.
[HTC One X] danlat1415:
Sorry if this has already been raised.

The AT&T HOX has now been able to make flashaqbl kernals and radios instead of using fastboot. They still don't have s-off they same as us.

Is there any way of using the script they use to make kernals flashable on the worldwide HOX?
[HTC One X] karoodee:
Dude... Read the thread... The One XL (or AT&T/Rogers One X...) is a completely different phone...
[HTC One X] danlat1415:
I know they are.

I meant is the principle there?

If its possible on theirs without s-off, is it potentially possible on ours?

Has anyone looked at their method to see if its feasible?
[HTC One X] KrisPerry:
I think... Think. This has already been asked
[HTC One X] glukosio:
but nobody have an answer :(
[HTC One X] kb0n:
Thought you did read the thread...

Just search this thread for "xl" and you'll find more of these:

sorry for ot
[HTC One X] danlat1415:
I appreciate they are two different devices - but it does not make sense to ignore their development.

There are still similarities. Neither have s-off, but can still flash ROM via clockwork recovery.

Both can flash kernal via fastboot.

What is so wrong in asking if a similar recovery script they have created can be used or modified to work with ours.

It's the concept rather than specific fix.

Although they are different devices, they still use the same programs, so its not an unreasonable question

Don't get tunnel vision. Take inspiration from things around.
[HTC One X] Evil-Dragon:
You're the same kind of person that would try and fit an AMD processor into an Intel based motherboard and say "It will fit, trust me"

Just because something looks the same or feels 'right' doesn't mean it'll work. Try for example to use an evita clockwork recovery on an endeavor device and see if it works. You need to understand that they are 'different' and they have 'different' chipsets. They have 'different' partition blocks for their partitions. The list really does go on.

People who continue down this road will only end up in bricks and tears and i have no sympathies.
[HTC One X] Arkaknio:
Stop throwing trash on the forum. They have different CPU, so ALMOST NOTHING developed for AT&T One XL will work for One X. HTC One XL is much more similar to One S and other Qualcomm's S4 based devices.

This have been said thousand of times on this thread so stop talking **** like "tunnel visión" and “inspiration“ and just read the thread.

Sorry for the OT mates.
[HTC One X] glukosio:
agreed, but if someone found a method to root qualcomm processors, why is it impossible to do the same with tegra? i know it's completly different, but years ago someone had the same problems with first's qualcomm devices like hd2 i think, and they found a method to unlock'em all
[HTC One X] orb3000:
.

Please keep discussion on topic and respect other members opinions
[HTC One X] Rekoil:
No, just no...

EDIT: Seriously mate, please, just re-read

the post literally directly above yours

.

EDIT2: To clarify, the difference isn't in the processor, an ARM processor is an ARM processor, no the difference is in the board that that processor sits in and all the little chips that help it accomplish its tasks. And because the board is different, it requires different software to boot,

this

is where the differences start to manifest, the result is that the bootloader, what we have to fool, is indeed very different to those other devices that you and your friends, who don't seem to be getting what we've already said tens of times in this thread, keep referring to.

---------- Post added at 08:35 PM ---------- Previous post was at 08:16 PM ----------

I can slice both cheese and cesium with a knife, but that doesn't mean I can eat them both. Please understand that even if two different things have similarities you just can't assume something is true for one just because it is for the other.
[HTC One X] kupijaj:
subsystem file is crossingover so mmcblk0p is getting bigger and bigger.
[HTC One X] Drefsab:
I see what you are saying, however you have to understand that the dev's keep their eye on the developments for other devices, for example when the one S root method was found it was tried on the one x shortly after. It didn't work. The people who create these exploits/scripts etc have a far better understanding of the way it works than you or I ever will. They wont ignore developments on other devices but all posts like yours do is confuse things, add clutter and junk into the thread and is not really helpful, I dont mean to be harsh but its the truth.
[HTC One X] Goku80:
Whole thread is coming off topic. How on earth am suppose to make a changelog when every freaking five minutes more off topic chat come up. When someone gives me better info then I will provide a changelog.and.links to.xmoo to stick in op.
[HTC One X] owenw:
So... I just checked my bootloader and the first line saids ENDEAVORU PVT SHIP S-OFF RL.

I have S-OFF then? Is this useful to you guys?
[HTC One X] techmatlock:
Yeah you do. Some devs in here will contact you.
[HTC One X] P1n3apqlExpr3ss:
Last time I checked the devs had found out all they can from a S-off unit?
[HTC One X] techmatlock:
I saw xmoo the other day requesting help with people who have s-off.
[HTC One X] P1n3apqlExpr3ss:
Oh, I saw something like that but it was with people opening to up to access the battery that could possibly also get it to boot into APX mode? Could be mistaken but I have a s-off unit (from HTC so no idea how they did it) if devs need any help at all
[HTC One X] xmoo:
You are correct. Was trying to see if you really need to remove battery for APX... or HTC just disabled it.
[HTC One X] p1lk0:
Hi guys, long time lurker didn't know if any of you spotted this in the pogo pin thread, the part with the phone switched off sounds like it could be of some use. Anyway good luck guys!
[HTC One X] Bin4ry:
Also i want to get you an idea, but i won't do it, since i dont have the device and this is MUCH TESTING.

Back in the days for Xperia X10 we wrote a splboot and adapted a miniloader to boot out very own boot.img on this device. It was the only way there.

For this device i can think of something like this:

Adapt our "old" splboot -> rip out bootimg functionality

Load splboot.ko kernel module -> feed it with HBoot dump -> kick off and start hboot.

Once this state is reached "all needed" is that the HBoot gets modified and the security checks for whitecard & magic card gets disabled -> You would be able to reset Security and disable secuflag.

If someone is willing to go this way, you can find my old splboot sourcecode, which i build from goroh-khan's idea, for Xperia X10 here, needs some modifications for this device of course :D But the idea is the same, stop kernel, kick to start spl ;) If all wents good MPU will allow to do this and you will get a nice working HBoot. So you would be able to do all stuff what you want, even boot a custom SPL from running system :)

https://github.com/freexperia/boot_tools/tree/master/splboot/

Next step would be finding a android exploit to gain temproot without htcdev unlock in first place, but it would be a good start to manipulate the device!

Regards