yashsingh1/xdaforums huggingface dataset:
[HTC One X] ytwytw:
found something interesting today

if you get into the recovery mode, wait for the red tringle

press power+Vol up

you could find a recovery menu obv...

Some interesting opinion...

Apply update from cache

Apple update from Internal storage

Apple update from external storage :eek:

so where is the external storage? OTG? :confused:
[HTC One X] JeckyllHavok:
Do you have an OTG cable to try it with a goldcard?
[HTC One X] emperact:
Removed
[HTC One X] JeckyllHavok:
gimme a sec and i'll try,

k, i tried with OTG and when i then start the recovery the only line that apears is that theres no command on cache partition the other lines won't apear, so i think it recognizes the OTG

So, i take the 0.94 hboot and put it in an update.zip, create a goldcard (with an old g1), start to recovery, it gives me something like unable to find cache recovery command or so. No other lines, when i select update from external storage it sais bad cid and reboots.
[HTC One X] jonny1974:
Don't know if it's usible, but If your hox is charging and you shut it down and boot in to hboot it is checking for sd card update.

Sent from my GT-I9100
[HTC One X] JeckyllHavok:
according to my above post, maybe we need something like the fake recovery from the good old desire days, it was the first device with locked nand
[HTC One X] Ox41464b:
1.29 Europe OTA Update zip,

inside firmware.zip,

boot.img#init.endeavor.common.rc

got 0777 to /system/bin/RXN_IntApp

Anyone have idea how to exploit this?

temporary root... at least.
[HTC One X] blubbers:
<4>[ 3.525950] num: 0
<4>[ 3.526033] start: 00007000
<4>[ 3.526187] end: 00009fff
--
<4>[ 3.526363] num: 1
<4>[ 3.526446] start: 0000a000
<4>[ 3.526598] end: 0000afff
--
<4>[ 3.526767] num: 2
<4>[ 3.526851] start: 0000b000
<4>[ 3.527003] end: 0000dfff
--
<4>[ 3.527173] num: 3
<4>[ 3.527257] start: 0000e000
<4>[ 3.527341] end: 00011fff
--
<4>[ 3.527579] num: 4
<4>[ 3.527663] start: 00012000
<4>[ 3.527745] end: 00015fff
--
<4>[ 3.527983] num: 5
<4>[ 3.528066] start: 00016000
<4>[ 3.528148] end: 0001dfff
--
<4>[ 3.528389] num: 6
<4>[ 3.528471] start: 0001e000
<4>[ 3.528554] end: 00025fff
--
<4>[ 3.528794] num: 7
<4>[ 3.528879] start: 00026000
<4>[ 3.528964] end: 0002dfff
--
<4>[ 3.529205] num: 8
<4>[ 3.529290] start: 0002e000
<4>[ 3.529373] end: 0002ffff
--
<4>[ 3.529613] num: 9
<4>[ 3.529695] start: 00030000
<4>[ 3.529777] end: 00031fff
--
<4>[ 3.529947] num: 10
<4>[ 3.530103] start: 00032000
<4>[ 3.530187] end: 0003ffff
--
<4>[ 3.530358] num: 11
<4>[ 3.530510] start: 00040000
<4>[ 3.530592] end: 002bffff
--
<4>[ 3.530763] num: 12
<4>[ 3.530845] start: 002c0000
<4>[ 3.531001] end: 0035ffff
--
<4>[ 3.531172] num: 13
<4>[ 3.531255] start: 00360000
<4>[ 3.531409] end: 035dffff
--
<4>[ 3.531579] num: 14
<4>[ 3.531663] start: 035e0000
<4>[ 3.531816] end: 03a29fff
--
<4>[ 3.531986] num: 15
<4>[ 3.532069] start: 03a2a000
<4>[ 3.532152] end: 03a2afff
--
<4>[ 3.532395] num: 16
<4>[ 3.532477] start: 03a2b000
<4>[ 3.532561] end: 03a2bfff
--
<4>[ 3.532847] num: 17
<4>[ 3.532933] start: 03a2c000
<4>[ 3.533016] end: 03a2efff
--
<4>[ 3.533258] num: 18
<4>[ 3.533342] start: 03a2f000
<4>[ 3.533425] end: 03a39fff
--
<4>[ 3.533595] num: 19
<4>[ 3.533678] start: 03a3a000
<4>[ 3.533760] end: 03a3afff

these are the sectors mapped to the partitions

the EFI partition table is at 0x03a3c000

i've mapped the missing areas in the kernel with

put_partition(state, i+1, 0x0000 * ssz, 0x1000 * ssz);
put_partition(state, i+2, 0x1000 * ssz, 0x1000 * ssz);
put_partition(state, i+3, 0x2000 * ssz, 0x1000 * ssz);
put_partition(state, i+4, 0x3000 * ssz, 0x1000 * ssz);
put_partition(state, i+5, 0x4000 * ssz, 0x1000 * ssz);
put_partition(state, i+6, 0x5000 * ssz, 0x1000 * ssz);
put_partition(state, i+7, 0x6000 * ssz, 0x1000 * ssz);
put_partition(state, i+8, 0x03a3b000 * ssz, 0x1000 * ssz);
put_partition(state, i+9, 0x03a3c000 * ssz, 0x1000 * ssz);

sadly, the new partitions do not contain the hboot data

---------- Post added at 06:22 PM ---------- Previous post was at 06:18 PM ----------

but i can access the partition with the CID

130|root@android:/ # hexdump -C /dev/block/mmcblk0p26
00000000 48 54 43 2d 42 4f 41 52 44 2d 49 4e 46 4f 21 40 |HTC-BOARD-INFO!@|
00000010 9e 00 00 00 48 54 43 5f 5f 31 30 32 33 censored |....HTC__1023591|
censored [imei] :p
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200 ff ff ff ff 0b 00 01 00 58 4d 3e 80 58 4d 3e 80 |........XM>.XM>.|
00000210 00 00 00 00 00 00 00 00 b4 27 33 80 10 00 00 00 |.........'3.....|
00000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[HTC One X] JeckyllHavok:
Can you weite to that Partition?
[HTC One X] blubbers:
the kernel does not complain but the data does not get stored. it's s-on after all :p
[HTC One X] dk_zero-cool:
I don't know much about nand drives or how SoC Systems works, most of my work is software and not hardware. But would it not be possible to access the nand from outside the phones systems (hboot, radio, etc). Something like take out the hardware, connect it to a PC with some kind of home made cable of some sort and then write a new hboot and radio directly to the nand? Or is these systems to integrated for this to be possible?
[HTC One X] DarkMio:
This is a plain Chip. Id you take it out and bind it on an audrinoboard...

Nah, dont think about it. Would be senseless. It's more like RAMchip, moreover its a band-chip. Haha.

A blackbox / flashbox can do it, but these things are seldom, was really popular on Nokia's big times, before the smartphones. HTC have some on their own, but nevermind you would get one anywhere.
[HTC One X] dk_zero-cool:
So It's not easy but possible.
[HTC One X] DarkMio:
It's nearly impossible. You would rather brick the chip / maimboard than get any results. Btw, we don't have that much usable sources to rewrite such a chip and get a working result. Don't mess with it, srsly. On iPhones you can remove the harddrive and have your own 3-days party with it. But here it isn't that much easy.
[HTC One X] dk_zero-cool:
Don't worry, I'm not just gonna do it. For now I was more interested in knowing if it was even possible, which I had a great time finding reasons why not. However the One X has not been out for long and we are currently able to flash custom ROM's. So I'm not in that much of an hurry to get S-Off other than the principle in it.

Currently I am having long arguments with HTC. After a week back and fourth I was told that they will never provide S-Off. My arguments were understandable, but they are very protected of their beloved HBoot and possible SIM Lock.

However now I am trying to get them to fix the Recovery/Boot lock instead. They can't seam to find any arguments for why THIS should be a problem. So let's see what will happen. It would be a start.
[HTC One X] N3m3515:
sure... but if we can access the apx mode we could do exactly that withut modifying the hardware
[HTC One X] KrisPerry:
What about something similar to the XBox rgh - reset glitch
[HTC One X] dk_zero-cool:
Yes but would HTC not have locked us out of this as well?
[HTC One X] DarkMio:
Nope. We're only not sure, how we get there. Maybe It's a command-line, maybe a combination if the few hardwarekeys. I saw a friend if mine, how he jailbroke a iPhone with its rediculous Keycombinations to boot it in downloadmode.

Stay patient, there will be a solution for all of us.
[HTC One X] dk_zero-cool:
I saw a device from a google search to day about APX where they accessed it by typing "echo 1 > /proc/naz10_diag/force_recovery" which would reboot the phone into APX. I can't find that on the One X, so maybe just a lack of support in the kernel which could be fixed now that HTC released the kernel source.
[HTC One X] aranab:
I have a noob question: once s-off is achieved can we make the boot loader go back to its original state (after it says "relocked")
[HTC One X] JeckyllHavok:
Hey man, nice to see you on OneX board, cool to see the desire people around here. Maybe you should join #htc-one-x and #soffonex
[HTC One X] trojanere:
I've started a ticket with HTC, I had S-OFF and then lost it after I accidently RRU'ed... I know what your thinking.. forgot I had put stock recovery back on and its my first android phone... noob like.

Anyway the sent me a reply.. standard bull about S-ON and S-OFF.. with a choice of fixed or reply. So I've sent a reply saying I recieved the phone with S-OFF and your update broke it i.e. S-ON. I want a fix back to S-OFF please.

See what comes back.. not expecting alot:p
[HTC One X] KrisPerry:
How did you get s-off
[HTC One X] co@ch:
As he/she has written: received it S-OFF.. :rolleyes:
[HTC One X] KrisPerry:
Why would that happen
[HTC One X] Nipqer:
HTC occasionally accidentally send phones out with S-OFF.

If you had S-OFF and it got wiped by an RUU it can't of been true S-OFF, in which case a dump off the hboot would've been rather handy.

-Nipqer
[HTC One X] trojanere:
The phone came like it.. I didn't know what it was or notice it till I unlocked it as its my first android/htc phone
[HTC One X] ytwytw:
this is my test

i made a goldcard tf card

rename the rom.zip and put it on the tf card

connect the OTG-HOX-card reader

get the phone into bootloader

BOOM!:p

It scans the PG??IMG.zip and ask me if i wanna continue to update :rolleyes:

---------- Post added at 11:04 PM ---------- Previous post was at 11:00 PM ----------

you should buy a lottery ticket and next billionaire could be you :D

---------- Post added at 11:06 PM ---------- Previous post was at 11:04 PM ----------

so APX Mode wont work?

I know for iPhone, there is something called Factory Cable that can change everything, including rewrite imei, meid, esn, sn, baseband and of course Firmware.
[HTC One X] Drefsab:
Was that using the vol up+power method? if so I think its promissing that it supports OTG.
[HTC One X] pdagenius:
Could this APX tool http://forum.tegraowners.com/viewtopic.php?f=30&t=388&sid=2dccff6ecfea708b563136999e1346e4 be of use with HOX.

Sent from my Galaxy Tab 10.1 with Tapatalk
[HTC One X] co@ch:
So, next step is? :confused:
[HTC One X] Rekoil:
Which rom.zip?

What harddrive? The iPhones do not have a harddrive, they have flash memory soldered onto the board just like the HTC One X. And yes, that could be removed, but it's a job for an extremely skilled (in both microelectrics and reverse engineering) individual and is not something that is realistically possible on such a large scale as this. It could, however, be of use for dumping an S-OFF HBOOT, as we wouldn't need to break through security to do it on the phone.

What are you talking about mate? There is nothing of the sort for iPhones... The only kinda different cable for iPhones is one which allows it to output debug information over a serial interface.
[HTC One X] dk_zero-cool:
That was my idea. Not that we should make a tutorial of it for all to use. And what do you want an reverse engineer for? Remove the nand, connect it to a PC and dump it with dd. Also I don't see the removal of the nand as the hard part. I have removed plenty of small chips and other small stuff from different circuit board's. I just have no idea how to connect the damn thing to a PC. I remove things to replace them, not to mess with whatever is stored on them.
[HTC One X] blubbers:
we do not need a dump of a s-off hboot. it is easy to make one

here is a modified hboot 0.43 (unsigned) that will ignore the security flag.

but we have no way to flash it yet......
[HTC One X] fknshwow:
so wait.... we already have s-off hboot... so if we find a way to force the flash it should give s-off
[HTC One X] Evil-Dragon:
Guys, as knowledgeable as you all think you are you need to understand that the hboot on an s-off phone is identical to an s-on phone. Dumping it gives you nothing. The real place is in the radio, the security flag is there. It says if it's s-on or not. The hboot simply checks this flag and reports what it finds. This is how the old modified hboots worked, they reported that the flag was 0 even though the device was s-on (3). Obviously flashing a new hboot would undo the modifications. So please if you want to help then get the basics right first.
[HTC One X] fknshwow:
so where to we start?
[HTC One X] :
Youre basing this on (as you said yourself an old) + diff soc hboot? So youre 100% sure its in radio?

Sent from my HTC Desire HD
[HTC One X] tids2k:
he is correct !

Alright to get into APX mode, you need to take out your battery and then press vol + and then Power key. I and kholk havent tried the reason being i dont have the tools to do it, and kholk loves his virgin phone a bit :D
[HTC One X] KrisPerry:
What about fully discharging the battery instead
[HTC One X] Drefsab:
Isn't it logical to assume that it would be the same in this rather than HTC re-engineering an entirely new system for security.

The thing I was wondering (not that it helps us) it it possible to alter the security flag in the radio?

The only reason I am wondering is if we find an exploit to write one of these partitions and not the other it could be another angle of attack to get what we want.
[HTC One X] :
Ok so if its in radio, how would you change it? Give me an example of how htc changes it? Im gna make a point here so bare with me.

That method was mentioned awhile back but no ones willing to test so i dont see it happening :/

Sent from my HTC Desire HD
[HTC One X] blubbers:
there are diffrent ways to achieve s-off, either exploit the nand lock and flash a modified hboot, or change the security flag.
[HTC One X] :
Exactly the bootloader isnt the same

Sent from my HTC Desire HD
[HTC One X] blubbers:
reading this sounds like it is a fact. is it?
[HTC One X] tids2k:
that is the only way to get into APX mode from my understanding. thats why i asked if anyone has taken the battery out can test it ..
[HTC One X] Drefsab:
Is this confirmed, just because this works on say the LG 2x doesn't mean it will on the 1x. If its confirmed then hell I will buy the tools and do it myself id be happy to give it a go (I've opened and repaired a few phones in my time).
[HTC One X] blubbers:
one way was to send the radio an at command (at@simlock) which would change the security flag.

other exploits disable the nand lock and give you r/w access to all nand partitions to flash a bootloader that ignores the security flag
[HTC One X] tids2k:
and to do that you need to put the phone into diag mode ( pc -> diag drivers ??? ).

there was an app for Windows Mobile 6.5 :-p but i dont think i know any for the android :)
[HTC One X] JeckyllHavok:
What about the at commands, will they ork in normal mode, too?
[HTC One X] blubbers:
#define RESTART_REASON_BOOTLOADER	(RESTART_REASON_BOOT_BASE | 0x00)
#define RESTART_REASON_REBOOT	(RESTART_REASON_BOOT_BASE | 0x01)
#define RESTART_REASON_RECOVERY	(RESTART_REASON_BOOT_BASE | 0x02)
#define RESTART_REASON_HTCBL	(RESTART_REASON_BOOT_BASE | 0x03)
#define RESTART_REASON_OFFMODE	(RESTART_REASON_BOOT_BASE | 0x04)
#define RESTART_REASON_RAMDUMP	(RESTART_REASON_BOOT_BASE | 0xAA)
#define RESTART_REASON_HARDWARE (RESTART_REASON_BOOT_BASE | 0xA0)
#define RESTART_REASON_POWEROFF	(RESTART_REASON_BOOT_BASE | 0xBB)
#define RESTART_REASON_ERASE_FLASH	(RESTART_REASON_BOOT_BASE | 0xEF)

i've tested all the restart reasons,

bootloader -> fastboot

htcbl -> hboot

offmode -> poweroff with charging

the only one that didn't make sense was hardware. the phone does a reboot
[HTC One X] tids2k:
i dont think so but you can see the logcat by typing "logcat -b radio" in adb shell or terminal
[HTC One X] blubbers:
read my posts about AT commands a few dozen pages back
[HTC One X] Rekoil:
We would need a reverse engineer to implement the FTL (flash translation layer) in use by the HTC One X.

I've long wondered why someone wants to dump an "S-OFF" bootloader since we already have dumps of the bootloader in (nearly) every OTA out there. From what I understand, to make a bootloader S-OFF it's simply a matter of toggling a setting stored somewhere, correct? Note that I use the term "simply" quite loosely here hehe, as it's not really simple in execution, only in concept ;)
[HTC One X] tids2k:
If anyone interested can try these .. ( If you are on UNIX )

http://code.google.com/p/android-serialport-api/

http://stackoverflow.com/questions/5246094/android-emulator-pc-serial-port

For running AT+T commands !
[HTC One X] Rekoil:
But you are speaking about knowledge from

another phone

. The fact is we have no idea how APX mode is entered on the One X. It may very well be how you say, but it's not something we know. This phone you're referring to by the way, was it even an HTC device?
[HTC One X] fstluxe:
Shall we start a bounty Topic to speed up the S-Off process. Maybe the money could be used for replacing dead devices, Buy S-off devices, White/Goldcards or something.
[HTC One X] tids2k:
That is

correct.

It is from a different device but if someone had access to an open device .. he can test it ! that is the only viable option i can think of ..
[HTC One X] co@ch:
Assuming someone would do this test and it's working, would that mean everyone who wants to s-off this way has to open the device? Or is this just a step that brings us to a "don't have to open my device" solution?
[HTC One X] Traniz:
The text is not big enough but I'll bump it so people will see it multiple times.
[HTC One X] :
Cant access irc :/ blubbers, can you read the misc partition?

Sent from my HTC Desire HD
[HTC One X] artymarty:
I have had a similar idea to the bounty... Can it be done via kick starter?

"develop a reliable method that the general public can use to gain permanent s-off of the HOX Quadcore -all country versions that does not involve opening the device (that's not 'general public' capability)"

The method must be released in the public domain (free) and first to develop and submit wins the pot.

Hell, I'd pledge $10 right now. That would raise ten, twenty thousand really quick... And then there are added benefits...

Like:

Someone working at HTC might be tempted to leak the methods OR THE PRIVATE KEY anonymously and claim prize. $$$$

If evey phone got cracked quickly this way, the manufacturers will eventually give up locking them down...

Cheers, Marty

Sent from the future using tipi-tapa-talk 37
[HTC One X] Htc_One_X:
I to would donate. let's hope this gets the ball rolling.

Sent from my cm9 powered OneX
[HTC One X] blubbers:
anyone can read the misc partition

root@android:/ # hexdump -C /dev/block/platform/sdhci-tegra.3/by-name/MSC
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000023f0 00 00 00 00 00 00 00 00 00 00 00 00 46 4e 4f 43 |............FNOC|
00002400 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00007000 4e 6f 6e 65 00 00 00 00 00 00 00 00 00 00 00 00 |None............|
00007010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00200000
[HTC One X] Sybregunne:
Just a thought is it possible to flash a modded hboot to recovery and run the second copy from there which would idk temp s-off the device maybe.
[HTC One X] KrisPerry:
Me too
[HTC One X] tids2k:
anyone know any good usb sniffer tool for windows .. ?
[HTC One X] blubbers:
i think the data transfers are encrypted. but anyway, wireshark
[HTC One X] joll200x:
Wireshark is only useful for network interfaces. I think USB would need a filter driver similar to the one VMware / virtualbox uses perhaps?
[HTC One X] Evil-Dragon:
I don't think that would work. It's more like a bios than a binary. I did find a section in the hboot that suggested if the data it was reading for the security flag was invalid or corrupted then it would reset the security, possibly the flag. I need to spend more time in disassembly. I'm still learning how it works.

ROM:00019822 STRH R3, [R0,R0]
ROM:00019824 LDR R1, =(aSecurity_res_0 - 0x1982C)
ROM:00019826 ADD R0, PC
ROM:00019828 ADD R1, PC ; "security_reset"
ROM:0001982A BL loc_CB18
ROM:0001982E LDR R0, =(aFailedToRead_0 - 0x19834)
ROM:00019830 ADD R0, PC ; " failed to read security data, reset\n"
ROM:00019832 BL loc_CB18
ROM:00019836 LDR R5, [R5]
ROM:00019838 CBZ R5, loc_19852
ROM:0001983A MOVS R1, #0

Anyone that can help me with IDA a bit more is more than welcome to help.
[HTC One X] blubbers:
i don't know about the windows version, but the linux version can tap into just about any interface, including usb
[HTC One X] tids2k:
check memory lock 07 00 05 00 80 02 00 02 unlock memory 08 00 13 01 AF E0 00 0E A5 D0 FE A5 D0 FD A5 D0 FC A5 02 80 A9 7500 00 00 08 00 C5 00 82 00 00 C0 A0 AF E0 80 A9 6C 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 00 82 C0 00 3E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 08 00 07 00 80 02 00 02 00 00 08 00 C5 00 82 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 08 00 43 00 82 C0 00 3E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	00 00 00 00 00 00 Settings memory area 1 0B 00 01 00 Disable patches 0A 00 01 00 Settings memory area 2 Settings memory area 2 first

Someone please explain this !

---------- Post added at 02:43 PM ---------- Previous post was at 02:24 PM ----------

Interesting ::: JTAG :::

Load OS now via JTAG backdoor....
Platform Pre Boot configuration...
Entering NvFlash recovery mode / Nv3p Server
Use scroll wheel or keyboard for movement and selection
Neither Scroll Wheel nor Keyboard are detected ...Booting OS
Checking for RCK.. press <Enter> in 5 sec to enter RCK
Press <Enter> to select, Arrow key (Left, Right) for selection move
Key driver not found.. Booting OS
Checking for RCK.. press key <Menu> in 5 sec to enter RCK
Press <Menu> to select, Home(Left) and Back(Right) for selection move
Checking for RCK.. press any key in 5 sec to enter RCK
Press scroll wheel to select, Scroll for selection move
Scroll wheel not found.. Booting OS
Press <Wake> to select, Home(Left) and Back(Right) for selection move
Press <POWER> to select item, <VOL UP> to previous item
and <VOL DOWN> to next item
[HTC One X] pdagenius:
How have you got into NVflash recovery mode?
[HTC One X] Polarfuchs:
You clearly need a keyboard attached additionally to the JTAG
[HTC One X] wph:
I also would easily give $10 to speed up development! I know it is a kind offtopic, but starting a new topic in some kind of way would be a great idea. My One X suffers from bad wifi reception, but didn't had it on the first radio, only after the 1.28 update. So flashing radio's would be the solution to test this and therefore I need S-Off. So if someone has time to start such a topic and deal with all the work involved: please do so! As a gesture I will double my donation to $20 :)