yashsingh1/xdaforums huggingface dataset:
[HTC One X] Kickasskev:
I have a micro sd gold card created from when I rooted my desire HD, only problem is I don't have the wires to connect it to my hox, don't mind posting it to someone if they could help
[HTC One X] n1kon:
If someone wants to do me a little favor to get back to stock I can get my hands on the relevant cables and create gold cards here but can't stock my phone on my works laptop. If someone wants to do this 2 min job for me http://xdaforums.com/showthread.php?t=1706989 ill crack on in the hotel as I have nothing better to do.
[HTC One X] Thunder07:
run the ruu

click the windows key on the keyboard and r (Win+r)

type %temp%

press enter

there should be a folder or few called {blahblah} <--- with the {}

inside one of them should be rom.zip
[HTC One X] muamers:
Could someone please explain the bold part ? Why it gets corrupted ? What is the error ?
[HTC One X] krogoth:
HTC signing works in similar way to md5. If any bit in file will be changed, the sign check will fail.
[HTC One X] n1kon:
Can't coz I can't run the ruu here as have nothing to run it on.
[HTC One X] ArtaxXP:
^^the ruu is an *.exe-file...just dubbleklick it...
[HTC One X] bobsie41:
Tricky without a pc. :rolleyes:
[HTC One X] SvenSSSvensson:
He's using his HTC One X. I'm downloading the RUU as we speak. Can PM u a link to the file, n1kon, when done.
[HTC One X] n1kon:
Thanks a lot
[HTC One X] SvenSSSvensson:
PM!
[HTC One X] ArtaxXP:
sorry ;)
[HTC One X] theROMinator:
Edit: Disregard the message below, apparently they only develop for Qualcomm devices.

A few years ago, there was an S-OFF exploit called alpharev, does anyone know if the developer is still around? His twitter page hasn't been updated in a few months and the last device he worked on was the Sensation XE, I believe.

Old site: http://alpharev.nl/
[HTC One X] GabrielSousa:
this team, and the other, only work with Qualcomm devices
[HTC One X] xmoo:
Hmz seems you guys have to wait for about 2 weeks. Before I can meet the guy with the S-OFF :(

He works and I'm busy with my internship. And we live 150KM from eachother.
[HTC One X] P1n3apqlExpr3ss:
What do you need to do with the s-off device exactly? Is it basic enough to tell me what to do over xda?
[HTC One X] Evil-Dragon:
I might be wrong but I assume it involves a diag file?
[HTC One X] xmoo:
Yes, want to test it.

Got some commands to play with and test the modified diag file.
[HTC One X] Rekoil:
What do you expect to get out of this that will be applicable on S-ON devices?
[HTC One X] sieempi:
My thughts on s-offing this device.

Firstly, I the consider the diag approach dead from the beginning for various reasons: cid check, mid check, crc check (which could be patched in the diag but you'd already need a higher security in hboot who runs the diag, which means s-off already), diag files are also signed and in order to ignore the check you need the hboot to have higher privileges = s-off. Either way you'd do with the diag, you must already have s-off or the htc diagnostic card (!= than what we used to know as goldcard, which is a cryptoghraphy enabled sd card).

My approaches would be: studying the platform a lot and hboot by disassembling it and dig for vulnerabilities. The platform that Sensation is on, and other devices as well, have the hboot make all the security checks thus the posibility to gain s-off by an exploit. Desire, on the other hand, inquires another loader for security which can't normaly be accessed for exploitation. I don't know which is the case here, though..

Btw, that guy s-offing hox on those chinese sites does it with that diagnostic card (which is the official htc way, done in services), I don'know how one could get one of those.
[HTC One X] xmoo:
Are you really stupid?? What are we trying to achieve here???

S-OFF yes!

And I'm trying to achieve the same thing.

The DIAG came pass all checks, but was blocked cause of SUPERCID.

So I want to find a device with CID 11111111 to see if I can clear security with the DIAG file. If that works, the modified DIAG file will be able to S-OFF. Only thing left to do is bypass CID check on not SUPERCID devices to be able to boot the DIAG and clear security

http://youtu.be/zsHPEYFzsJo?t=3m40s

Others and you are free to try it. I believe my approach with the DIAG file will be a success, but then again who Am I?

I know the thread only point to Mike, Football and me. But if other want to try stuff, be my guest.

You some times can buy smartcards/javacards on gsmhosting.com
[HTC One X] sieempi:
I've done my research on Desire and Sensation, including running patched diags and I didn't get much. The only thing working for Sensation is revolutionary's hboot exploit. It might be worthwhile, though.

Ps: it's not smartcard, but smard sd / assd

Via XDA App
[HTC One X] xmoo:
The DIAG files always say smartcard and javacard...
[HTC One X] Rekoil:
I'm sorry if I came across as being rude, this is all very new to me (first android device) but the notion of running a signed diagnostic ramdisk that has been modified (yet somehow is still runnable without higher privileges) just didn't sound right to me. On top of that you are looking for someone who has S-OFF already, surely any results gathered from that endeavour (hah, see what I did? :P) would not be trustable? Instead, why don't you look for someone with S-ON and CID 11111111 (I've seen a few posting), and get them to try it? But best of luck with it either way mate, fingers crossed it works!
[HTC One X] sieempi:
Just a generic name for java enabled microchips, but as far as I know htc jumped from smart sims to smart micro sd cards (which are plane microsd + components that run java applets). See sensation example which is not compatible with xtc clip because it dropped that standard.

Using diags from other phones is useless as well, even more if they're on different platforms..

Via XDA App
[HTC One X] xmoo:
Ooh, I didn't know they excisted. Normaly only Unlocked phones have CID 1111111.

Could you point me to some foks having S-ON device with SuperCID?
[HTC One X] Rekoil:
As I understand it they are devices which had previously been S-OFF, but have had security re-enabled after the CID was set to 11111111. About the person who had it, unfortunately I can't seem to find it now, but I do distinctively remember it because it was so strange, he said something along the lines of "I have something even weirder, I do not have S-OFF but I do have SuperCID". Maybe you could convince the german bloke to re-enable security on his device before or after doing the tests? After all, if it works while S-OFF that at least leaves a larger chance at disabling security again after enabling it.

EDIT: It would make sense for HTC to send a device with CID 11111111 to a reviewer wouldn't it? Along with RUU's for multiple carriers or multiple regions? :P
[HTC One X] Mischaseb:
yep i also remember that someone had s-on and super cid
[HTC One X] glukosio:
this can be a good idea, but first you have to be sure about it or we only will lose an s-off device!
[HTC One X] Rekoil:
Losing an S-OFF device isn't really that big a deal, honestly, people with S-ON devices don't have much to gain from developers having access to an S-OFF device.
[HTC One X] xmoo:
http://xdaforums.com/showpost.php?p=25799067&postcount=1310

Found it, PM sent.
[HTC One X] Dark_Avenger:
In this thread (http://xdaforums.com/showthread.php?t=1674202), there are instructions (hex edit of a file) to get generic HTC__001 CID or even super CID 11111111. I don't know if this is true, but at least we could give it a try.
[HTC One X] mattman83:
Same as the ATT HOX, completely useless on this device.

M.
[HTC One X] xmoo:
I believe mmcblk0p4 is where the HBOOT is located on the Qualcomm devices. That's why it is working for them.
[HTC One X] kb0n:
No, this one: http://xdaforums.com/showpost.php?p=26923257&postcount=2479
[HTC One X] Rekoil:
Indeed, that is the post I was talking about.
[HTC One X] xmoo:
Contacted him aswell.
[HTC One X] crazy88:
How about this dude too...

http://xdaforums.com/showpost.php?p=25577428&postcount=15

Apparently has an S-On device with CID:11111111
[HTC One X] muamers:
This one too ...

But im afraid that we cant contact this one, he has only 2 posts :o
[HTC One X] glukosio:
sorry for stupid question, but how to see which cid i have? i'm trying in cmd:

fastboot getvar cid

but answer is: cid: None
[HTC One X] xmoo:
HBOOT 0.27 is a ENG HBOOT.

PM'd him.

To help me finding a device, Androidworld.nl is helping me out.

Please retweet. https://twitter.com/Androidworld/status/215066736930721792

My friend with the S-OFF device can't meet a.t.m. Can meet begining of July. So trying to find a other one.
[HTC One X] kb0n:
It's "fastbood oem readcid".

You can get all the getvar stuff with "fastboot getvar all", and get the oem commands with "fastboot oem ?"
[HTC One X] j.finn:
Try vid getter from play store.
[HTC One X] Fears:
Could you post a link , i can't find it .
[HTC One X] kb0n:
No need for a link ;) It's "cid getter" (c next to v on a keyboard)
[HTC One X] RazorGTR1:
Here is the link: play.google.com/store/apps/details?id=org.tritonsoft.cidgetter
[HTC One X] xmoo:
3sec search... https://play.google.com/store/apps/details?id=org.tritonsoft.cidgetter&feature=search_result
[HTC One X] MySam:
DELETE THIS POST.., har de hur hur....
[HTC One X] keroro430:
Can we flash the ENG HBoot after gaining S-OFF?
[HTC One X] angusc:
Is there a known list of all the "FASTBOOT OEM ..........." commands available? While i teeter on the edge of writing

FASTBOOT OEM get_identifier_token

I wonder if there is some other FASTBOOT command that might be accessible now on stock but lost once the token and revised HBOOT are installed to give root access..........?

Sent witH desire from OneX
[HTC One X] xmoo:
If we have it as a .img, yes.

Does anyone know where splash1.nb0 is located on the phone? That most of the times also the place where hboot is located.
[HTC One X] kb0n:
I just wrote less than 10 comments ago, with "fastboot oem ?" you get all commands available.

If you're talking generally about all oem commands ever, that's a different story. That probably depends on hboot versions (or other components) and it might take a while to collect them all (I did the search a while ago and couldn't find a "complete list"). It wouldn't be of much help anyway, as you can only use what "fastboot oem ?" gives you. You would only know what could've been available or is available on other devices/hboot, but you wouldn't have any practical use out of it (as it de facto is not available for you/us).
[HTC One X] ferreinf:
With s-off u can use fastboot to fix your phone for example, one other thing not unlocking with htcdev allows you to s-on your device again and send it to repair without them knowing u messed around with the bootloader... ;-)
[HTC One X] xmoo:
If we find a way to talk to mmcblk0p26 there the CID should be located, this might work then.

http://xdaforums.com/showpost.php?p=25788378&postcount=1295
[HTC One X] j.finn:
Sorry, cid getter i meant:)
[HTC One X] RichmondoUK:
Mmcblkp010 I believe :)

Edit... Yes defo!
[HTC One X] RichmondoUK:
Funny you ask as found it by dumping each partition then converting it to a picture using boot splash tools.

There were some other part images of when you do htcdev unlock in partitions before partition 10
[HTC One X] LlabTooFeR:
After intensive digging in some stuff I have found this. This is whole partition list for One X with all addresses and lengths of partitions...

[partition]
name=BCT
id=2
start_location=0x00
size=0x400000

[partition]
name=PT
id=3
start_location=0x400000
size=0x200000

[partition]
name=EBT
id=4
type=bootloader
start_location=0x600000
size=0x400000

[partition]
name=DIA
id=5
type=bootloader
start_location=0xA00000
size=0x400000

[partition] (Board Information)
name=BIF
id=6
start_location=0xE00000
size=0x200000

[partition]
name=GP1
id=7
start_location=0x1000000
size=0x200000

### WLAN firmware ###
[partition]
name=WLN
id=8
start_location=0x1200000
size=0x600000
#filename=wlan.img

### WLAN Data + MFG Data ###
[partition]
name=WDM
id=9
start_location=0x1800000
size=0x200000
filename=WDM.img

### Radio Calibration Data ###
[partition]
name=RCA
id=10
filesystem_type=ext3
start_location=0x1A00000
size=0x600000

### Linux Kernel OS ###
[partition]
name=LNX
id=11
start_location=0x2000000
size=0x800000
filename=boot.img

### Recovery ###
[partition]
name=SOS
id=12
start_location=0x2800000
size=0x800000
filename=recovery.img

### PG1FS ###
[partition]
name=PG1
id=13
start_location=0x3000000
size=0x1000000

### PG2FS ###
[partition]
name=PG2
id=14
start_location=0x4000000
size=0x1000000

### PG3FS ###
[partition]
name=PG3
id=15
start_location=0x5000000
size=0x1000000

### Software Info ###
[partition]
name=SIF
id=16
start_location=0x6000000
size=0x400000
filename=SIF.img

### Splash1 ###
[partition]
name=SP1
id=17
start_location=0x6400000
size=0x400000

### Reserve1 ###
[partition]
name=RV1
id=18
start_location=0x6800000
size=0x1C00000

### System ###
[partition]
name=APP
id=19
filesystem_type=ext3
start_location=0x8400000
size=0x50000000
filename=system.img

### Cache ###
[partition]
name=CAC
id=20
filesystem_type=ext3
start_location=0x58400000
size=0x14000000

### Internal SD ###
[partition]
name=ISD
id=21
start_location=0x6C400000
size=0x650000000

### Userdata ###
[partition]
name=UDA
id=22
filesystem_type=ext3
start_location=0x6BC400000
size=0x89400000
filename=userdata.img

### Memory dump ###
[partition]
name=DUM
id=23
start_location=0x745800000
size=0x200000

### MISC Partition ###
[partition]
name=MSC
id=24
start_location=0x745A00000
size=0x200000

### Radio File System ###
[partition]
name=RFS
id=25
start_location=0x745C00000
size=0x600000

### Develop Log ###
[partition]
name=DLG
id=26
start_location=0x746200000
size=0x1600000

### PDATA for MASD ###
[partition]
name=PDT
id=27
start_location=0x747800000
size=0x200000

[partition]
name=GPT
id=28
type=GPT
start_location=0x747A00000
#size=0xFFFFFFFFFFFFFFFF
size=0x200000
[HTC One X] JDenson77:
I'm a one s user and we have super cid. I know a lot of differences between the two but maybe there is enough to help here is tha link and wish you luck. Also sorry if you've already seen this.

http://xdaforums.com/showthread.php?p=26523386
[HTC One X] LlabTooFeR:
Well, we have this thing as well, the problem is that hboot is not available in this way...
[HTC One X] NikMel:
when I check mmcblk0p at 0xA00000 there i see "HTC-BOARD-INFO!@ž...VODAP1023530...".

This address is the end of EBT and start of DIA partitions.
[HTC One X] LlabTooFeR:
Good then :) Now need to find way to write own data there...
[HTC One X] NikMel:
here you are: http://xdaforums.com/showpost.php?p=26983851&postcount=2525

---------- Post added at 08:10 PM ---------- Previous post was at 08:06 PM ----------

I patched and tried misc_version but no luck to override mmcblk0p.

I even deleted mmcblk0p but after reboot this thing was back again.
[HTC One X] blubbers:
the nvflash mode is the earliest mode of the booting process, the only way without a command or exploit would be a key-sequence before hboot starts (i know you can reboot from hboot into nvflash, but not with s-on)
[HTC One X] N3m3515:
there has to be some sort of button combination to enter nvflash mode. but even when we can figure that out we have to get the right drivers for our device and the nvflash is still secured by any sort of key. as far as my knowledge goes.

Edit: On my HTC Desire: my hboot checks for a file everytime i enter hboot

On my HOX: the hboot only checks for files if i am connected to my computer via usb and leaving fastboot into hboot.

Is this normal?
[HTC One X] Rekoil:
That got cracked only because Sony, thinking the PS3 is unbreakable, left their private key for the PS3 and PSP on the system, unencrypted. Nobody is that stupid, especially not after Sony already made that mistake. It's quite as simple as this, private keys will go out of service before they are cracked, that is the unfortunate truth.

I believe the way to S-OFF lies in finding a way of triggering this "APX mode" thing. With that it sounds like we should be able to re-flash HBOOT freely, and if we can do that, then we can enable S-OFF.
[HTC One X] mwilky:
Just reading through other tegra device forums and this is how to get into the nvflash mode on tablets

"I'm not sure what other's experiences are, but the back, back+power, back for 2 seconds each just does not work for me. It's more like back,back+power, release both, and no more than a second for each. Here's what I've found with my Vega and Win7 (this assumes correct drivers have been installed beforehand ) ...

1. USB cable connected to PC.

2. Starting from completely powered off, press and hold the power button - Vega should begin booting - keep holding power button until off again. (PC makes USB connection/disconnection noises during this). Now ready for entering NVFlash mode.

3. Press and hold Back button and count, 0 ... 1

4. Whilst still pressing Back hold Power button and count, 0 ... 1 then release Power button only. On release of power button PC makes USB connection noise and were in NVFlash mode - so no need to keep holding the back button after releasing the power button.

5. If not in NV mode, repeat from 2.

The time waster for me is that if it doesn't work first time it won't work at all until normal power on/power off routine is performed - I've tried and tried and only ever get into NVFlash mode immediately after a power off - hence step 2 above.

I've found I can get into NV mode almost every time with this method - Hopes this helps anyone struggling, like me... "

I would try but my device is getting replaced
[HTC One X] Starky09:
There's an update for my One X (German Vodafone Branding) and I'm not sure if I should install it, because I want to turn it S-OFF when some has found a way. Is there a possibility that the update will affect the S-OFF-thing?

Thanks!
[HTC One X] riemervdzee:
Unfortunately the back-button is a non-physical one on the OneX.
[HTC One X] mwilky:
Would holding/pressing it still not work then?
[HTC One X] JeckyllHavok:
I don't think the drivers for the sensor keys are loaded in such an early stage of booting, but maybe we need the right combination of power/ volup / down
[HTC One X] mwilky:
I would try but don't have my device :(
[HTC One X] jonas2295:
just tell me what to do and I will test it :cool:
[HTC One X] emperact:
I have my HOX right here, and I can try some of the combinations. But trying it out, won't have a chance bricking my phone, right? And when/how will I know, that I am in nvflash mode?
[HTC One X] mwilky:
Few posts back i posted about a button combination to get into nvflash. Try how it says and if it doesnt work try with volume down as the back button
[HTC One X] Wonderkik:
I just tried, using the volume down button. I do hear the windows sound of USB being plugged in, and the boot animation seem slower to me, but I still boot as usual, so I'm not sure it did anything.
[HTC One X] jonas2295:
tried it but getting always into bootloader :eek:

touch buttons are not functional

Issue could be the custom recovery since it doesn´t charge when off ..

Did following:

Connecting

Shutting down

powering on holding power for 10 seconds

volume down 0..1

power button + volume 0..1

release power button

-->Bootloader :cool:

---------- Post added at 07:31 PM ---------- Previous post was at 07:27 PM ----------

Edit :

Recovery is no issue since phone can stay off while connected ...

Still getting only in bootloader :(
[HTC One X] blubbers:
Hboot supports usb otg. Maybe with an attached keyboard one can get into nvflash. The one-x simply lacks hw buttons, i've tried anything i can think of with the volume/power keys.

I will build an otg cable tomorrow

---------- Post added at 07:52 PM ---------- Previous post was at 07:44 PM ----------

Btw, the quick connection the phone makes is when it is trying to initiate a usb master connection, which obviously fails
[HTC One X] Polarfuchs:
Did you notice if you turn on the phone and hold the power button while it boots up, it begins the flash all three touch buttons.

Either this is just a silly "warning: it will shut down now" message.

Or it is entry point for a key sequence.
[HTC One X] kholk:
Going from HBOOT to APX Mode is still going to APX Mode, but the point is finding a way to get into APX Mode without the aid of Android or the aid of the Bootloader.

There actually is a way to reboot into APX Mode through Android, setting the reboot mode: we only need to build a custom kernel for that. I don't know if you're aware of this, but a device, it should be the Acer A500, is able to go into APX Mode with that trick.

But our point isn't finding a software trick to reboot to APX Mode.

We want APX Mode in case we flash a bad bootloader.

I can give you two examples:

1. We ERASE totally the bootloader ----> The device will go into APX Mode, automatically (behavior of Tegra 2 devices, like Motorola Olympus and LG Star. Tegra3 shouldn't be different at all in this).

2. We flash a broken bootloader, looping itself: the device will loop, screen off, unable to get USB connection, unable to reflash bootloader. How do we boot in APX Mode?

The second example needs us to find a method for booting into APX Mode without the aid of any software. We need something like a key combination...OR...something like 2 points to short.

For example, on Motorola Olympus, you can get into APX Mode only using a Moto Factory Cable (nothing special, only V+ connected to PIN5): inserting it while pressing VOL UP if I remember well.
[HTC One X] Polarfuchs:
Please tell me if this is normal behavior.

I disabled fastboot and shut down the phone.

I hold the vol down button and connected the phone via usb.

The windows sound did popup. And it showed "HTC android phone usb device" in device manager.

I still held the vol down button down and pressed power until the disconnect sound in windows appeared.

I continued to press only vol down till I saw hboot.

I released the vol down key.

But instead of the Options "fastboot, recovery, factory reset, simlock, show barcode and image crc" it showed "waiting for sd card download"

In the meanwhile Windows downloaded a driver with 1.9MB and installed it, called "HTC Bootloader".

After this it showed the normal options on hboot, that I enumerated above.

I'm not into this stuff yet and trying out some key combos. I just wanted too hear if it is normal.
[HTC One X] Rekoil:
I think you misunderstood my post, I am fully aware what S-OFF means, what I meant was that access to an S-OFF device probably does more harm than good to any efforts towards developing a method for breaking into an S-ON device.
[HTC One X] ferreinf:
Never said it, it wasn't dangerous, but I can give an example, semi-brick phone s-off u can use fastboot to flash an extracted rom.zip from an ruu for example.. ;-)

It comes with some responsibility no one will make u s-off your phone

Sorry for the spam guys
[HTC One X] KrisPerry:
Yes because one is likely to make assumptions that an S on device will behave the same as an S off
[HTC One X] dezborders:
I posted that info 10 days ,ago... Sadly there's no easy ways to update mmcblk0 as its the entire 32gb nand memory
[HTC One X] f4flake:
Change the bct and you can change anything.
[HTC One X] dezborders:
What and how? It's Been discounted by the main devs last week
[HTC One X] Rekoil:
Of course you can write to mmcblk0
[HTC One X] Drefsab:
hmm surely if thats the case you build a custom image that has a changed CID and write it to mmcblk0 starting at the right block (would need to work that out precisely but still if you could just get it so everything upto the main data partition is right we could then skip the rest and sort that once the hboot flashed.
[HTC One X] Dubhaltach:
I'm hearing a lot about dd-ing to mmcblk0 but, correct me if I'm wrong, wasn't this tried ages ago and we found out that it's reset every boot? That would explain why even deleting it doesn't harm your phone.
[HTC One X] LlabTooFeR:
Well this works on One S, there we can make SuperCID...moreover I can launch DIAG files there...but the problem is I can't install MFG/TEST roms there because on stage of checking signatures it fails...