yashsingh1/xdaforums huggingface dataset:
[HTC One X] tids2k:
alright all partitions have been dumped !

im still not convinced ... kholk the secret lies in one of them .. did u or have u checked any of the partitions yet ??
[HTC One X] blubbers:
the hboot partition is

/dev/block/platform/sdhci-tegra.3/by-name/EBT

i don't know the number it would mapped to, but probably not 1-20

the partition will probably not be accessible even on a SHIP SOFF device by the the stock kernel.
[HTC One X] xmoo:
How do you know this?

/EBT does not excist on my phone.

mmcblk0p2 -> /dev/block/platform/sdhci-tegra.3/by-name/WDM

mmcblk0p16 -> /dev/block/platform/sdhci-tegra.3/by-name/DUM

mmcblk0p17 -> /dev/block/platform/sdhci-tegra.3/by-name/MSC

mmcblk0p20 -> /dev/block/platform/sdhci-tegra.3/by-name/PDT
[HTC One X] tids2k:
elaborate !!!

---------- Post added at 10:45 AM ---------- Previous post was at 10:44 AM ----------

also @kholk when doing a key test under fastboot ... the volume down key is recognized as volume up key !! and vice versa ..
[HTC One X] JeckyllHavok:
we need to find out if it exists( is visible) on an s-off device
[HTC One X] tids2k:
maybe via JTAG ? it can be found out ? my head spinning ... ignore if its useless post !
[HTC One X] N3m3515:
http://twitter.com/#!/shen_ye/status/195438838611582976
[HTC One X] tids2k:
thats good news :D
[HTC One X] :
...laughing at all that upgraded there device with the OTA =O.
[HTC One X] tids2k:
if he is able to do it ! expect CM9 for HTC One X tonite !
[HTC One X] Polarfuchs:
What is displayed?

I only get "sorry this page doesn't exist"
[HTC One X] tids2k:
there will be a solution to downgrade .. !@
[HTC One X] xmoo:
01 WLN

02 WDM

03 RCA

04 LNX

05 SOS

06 PG1

07 PG2

08 PG3

09 SIF

10 SP1

11 RV1

12 APP

13 CAC

14 ISB

15 UDA

16 DUM

17 MSC

18 RFS

19 DLG

20 PDT

So no EBT
[HTC One X] N3m3515:
:( i am one of them...

---------- Post added at 11:54 AM ---------- Previous post was at 11:54 AM ----------

Shen Ye ‏ @shen_ye

I may have found a way to get S-Off on the 0.43 One X HBoot. Just need to grab my mates retail One X to give it a go.
[HTC One X] xmoo:
Solution to downgrade... we need to know where hboot.img is located ;)

The structure havn't changed... So he should be able to use his tool on newer HBOOT's.

He also has access to a dev device and probably a dev rom.

https://twitter.com/#!/shen_ye/status/195094022736445440
[HTC One X] blubbers:
of course it does not exist as i have written a few times before!

it is not accessible with a stock kernel!

i know it is there:

130|root@android:/ # hexdump -C /dev/block/mmcblk0|grep EBT
000000e0 03 00 00 00 00 00 00 00 04 00 00 00 45 42 54 00 |............EBT.|

and the EBT partition does contain the bootloader!
[HTC One X] N3m3515:
and there was no "exploit" to bypass the s-on on 0.43 on the time they updated theyre hboot to the newer version so maybe the security hole wasnt fixed.
[HTC One X] glukosio:
can't we just simulate a lower version to avoid version check in the firsts bytes?
[HTC One X] xmoo:
I flashed the hboot on a XE and PVT device and was able to get it back alive. So guess he was unlucky.
[HTC One X] ali3nfr3ak:
:crying:
[HTC One X] xmoo:
Did you send it back for warrenty?
[HTC One X] ali3nfr3ak:
No i had pulled it apart to rechagre the battery,,, so didnt think it was worth my time
[HTC One X] xmoo:
Is the device working again?
[HTC One X] ali3nfr3ak:
no its not... lol. luckily I have 2.
[HTC One X] DarkMio:
Can someone clear something for me up?

The undone solution is still known or? The problem before was also that we don't have access to this partition?

Btw., if we could get access to RAM while it is in hboot, we could easily change the bits in the package while it is flashed. This method would work but I don't have any idea how we could access this part in hboot. It sounds a hit silly, but I wantend to throw a new idea in.
[HTC One X] ZeDestructor:
What you are referring to here is JTAG access (full read/write access to RAM, registers, NAND, other inaccessible locations) which we unfortunately do not have.
[HTC One X] boe323:
All this security is completley nuts, its basically a palm computer, yet you dont see other computers being locked down, its a discrace, and theres still the fact that there locking down open source software. By the time we get the HTC ONE X security free, it will be out of date.
[HTC One X] ZeDestructor:
The Android OS is open-source and uses a license that allows then make a closed-source derivative (*ahem* sense *ahem*). The bios/efi/hboot is not. Thus what they are doing is perfectly legal. Meanwhile, the Linux kernel is GPL-licensed, which means that they *have* to release the source-code for their custom kernel in order not to break the license (and is probably the only reason we even have kernel source-code releases).

Doesn't make HTC any less of a **** though.

I am however impressed at the security layer in the software. That is some insanely good code there for it to withstand attack this well.

As for other computers not being locked down, that is purely incidental to the prevailing situation where openness is regarded as essential. MS wanted Windows 8 to be locked down using SecureBoot, but the backlash from enterprise users and the open-source world made sure that the x86 version will be as open as ever once you disable SecureBoot (or sign whichever other OS you use).
[HTC One X] Thunder07:
Actually Xmoo since you have an S-OFF cant you dump the partitions now??
[HTC One X] xmoo:
Yes, it's the same as what we had... So would be no use...
[HTC One X] Thunder07:
[B]fastboot getvar version-tp[/B]
(bootloader) Enable Flash Programming!

(bootloader) Enable Flash Programming!

version-tp: synaptics-5J09-fw30-Jtouch
finished. total time: 1.024s

i dont think that getvar can do much but the response to this is interesting

i dont know what it is but its something.

and the version-tp i think is only technology used for touch screen or something like that

it'll be interesting if someone with a locked bootloader could try it

[B]fastboot oem rebootRUU[/B]
...
(bootloader) Save data from original MSC...
(bootloader) Save data from SIF...
(bootloader) Update partition data to SIF partition
(bootloader) offset = 0
(bootloader) Update partition data from original MSC...
(bootloader) offset = 0
(bootloader) [MSG] OKAY

about this i know that our mainver is saved in the 1st 11-12bytes of mmcblk0p9 which is The SIF partition, while we only need to edit the 1st byte for my experiment to work

and i know somewhere within the 1st 512byte in mmcblk0p17 which is MSC partition the mainver is saved aswell

but while SIF is not writable at all MSC would change until next boot and the change would be nulled and mainver disappears from it,

while it would come reappear after a while im not sure what i did to get it back

well my guess is that its saved on SIF and copied into the MSC

it not so much progress but i thought i'd share incase someone has some input

---------- Post added at 03:30 PM ---------- Previous post was at 03:27 PM ----------

so we still cant access them???

try "fastboot oem ?"

there might be a command that allows dumping through fastboot
[HTC One X] mibikin:
Xmoo, since you have S_OFF, can you do fastboot oem readsecureflag? If we get that flag, someone can try writing it with fastboot oem writesecureflag [value]. Its worth a try.

Sent from my HTC One X
[HTC One X] Thunder07:
Though I'm s-on I'll take a wild guess and say it's either 0 or 1

Sent from my HTC One X
[HTC One X] mibikin:
I think it was 0 on the Vivid, but the S_ON secure flag was carrier dependant.

Sent from my HTC One X
[HTC One X] glukosio:
mine secureflag is: 3 i'm s-on but unlocked bootloader
[HTC One X] mibikin:
Alright, if anyone is willing to try to take the risk, try writing the 3 to a 0. That, if it works, should give S_OFF. Doubt its that simple, but its worth a shot.

Sent from my HTC One X
[HTC One X] miHah:
what could be the possible results of doing that? :)

(if things went wrong?)
[HTC One X] Thunder07:
It's not like half of us didn't try it.... Very much useless

Sent from my HTC One X
[HTC One X] glukosio:
so what remains us to try? it's almost impossible that everything with this HOX were tried! i think we have to write detailed list of thing we tried and another list with other "useless ideas"
[HTC One X] mibikin:
Well we've tried so much, but that wasn't on the list so... it could have worked. :shrugs:

Sent from my HTC One X
[HTC One X] witm01:
Please correct me if I'm wrong but what makes you think that editing mainver would allow for a downgrading of HBOOT? Mainver obviously refers to the ROM version and does not seem in any way related with HBOOT versions. It is HBOOT that flashes partitions in the course of an upgrade and I would be surprised if it didn't include a separate version check when it comes to replacing itself. As I said, correct me if I'm wrong and there's certainly no harm in trying, but this approach doesn't really make much sense in my view.

PS as a matter of interest: what happens to mainver in mmcblk0p9 when a custom ROM is flashed onto the device?
[HTC One X] Thunder07:
its an educated guess

this is my attempt at flashing a zip with only kernel image inside even with that it checks for all 4 MID, CID, mainver & hboot

while true there is a hboot check, i think its just for show as its possible to check hboot version but how will it check the packaged hboot version

sure its doable but will require reading the hboot img as it stand and looking for the version or will it read the file name (CL21401) as its a signed zip any way but how do you compare CL21401 to 0.43

and not to forget what good is a hboot version check when im flashing a kernel what was it being compared against??

while you're right there is no guarantee im right, there is only one one to find out.

while this is the same package but with a lowered mainver in android-info.txt

again these checks for a kernel??

while mainver should refer to ROM version, it refers to HTC's Stock Rom/OTA and not custom rom and no matter what Custom Rom You have it will always be the version of latest Stock Rom base that you installed, as im on 2.05 leaked custom Rom if that changed that value ill be screwed for RUU as there is no suck RUU... i am screwed already with mainver of 1.29000 :p but thats beside the point

in short nothing happens to it
[HTC One X] Zulake:
The device totally locks up after trying to write it, hence the <waiting for device>. I have to hold the powerbutton to force reboot it. It boots fine after that and is still S-ON though.
[HTC One X] Rusty!:
Yeah that obviously wasn't going to work. You can't change the secureflag via fastboot without being S-OFF.
[HTC One X] Zulake:
Still, I find it funny it gives exactly the same error you get after unlocking the bootloader.
[HTC One X] glukosio:
@thunder07 isn't possible to modify fastboot and make that it doesn't ask about versions but just jump directly to flashing? something like reprogramming it differently?
[HTC One X] Zulake:
The phone checks the versions, not fastboot.
[HTC One X] godutch:
There is a version number in the hboot.img itself. Anyway it might not be possible to downgrade but is it possible to flash our own custom hboots, or do they need to be signed too?
[HTC One X] BenPope:
Wow.

No, they're signed.
[HTC One X] Thunder07:
I know there is but how did you read a raw img and always get the version,

Surely the version's position would change everytime an update is made even if by a few bytes....

The whole point by trying to Lower Mainver is so we can flash a signed zip we have that has older hboot

So no it's not possible, if it was we'd have s-off ages ago

Sent from my HTC One X
[HTC One X] glukosio:
here a guy changed his mainver, maybe can we do the same?

http://xdaforums.com/showthread.php?t=1455349
[HTC One X] BenPope:
That's a different phone and his method requires root. WTF are smoking?
[HTC One X] Thunder07:
i've tried that but in a smart way.

adb shell "echo -n 0 | dd of=/dev/block/platform/sdhci-tegra.3/by-name/SIF"
adb shell "echo -n 0 | dd of=/dev/block/mmcblk0p9"
adb shell "echo -n 0 | dd of=/dev/block/vold/179:9"
adb shell "echo -n 0 | dd of=/dev/block/mmcblk0 seek=188416"

since we just need to edit the mainver and its at the very start of the partition we can do just that

still no luck.

while the last one (adb shell "echo -n 0 | dd of=/dev/block/mmcblk0 seek=188416")

does change the value until boot i still cant see the change in the other partitions though they should be one partition

they reason im sending just 0 is to overwrite the 1 in 1.26.401 or 1.29.401 to 0.29.401 which is a low enough mainver

even if it requires root its a start,

anything to do with partition modification would require unlocked bootloader, as far as im concerned.

but the more people with s-off the better chance we can find something
[HTC One X] glukosio:
http://xdaforums.com/showthread.php?t=1526316

tried this one (post #4) but don't work... from recovery i rebooted into fastboot and with fastboot getvar mainver i have everytime the same result.

tried also to edit manually with hex editor misc.img in mmcblk0p9 but it's the same! :(
[HTC One X] nicu96:
i found the same on my unlocked s-on HOX at offset A00000, used

dd if=/dev/block/mmcblk0 of=/mnt/sdcard/mmcblk0.img count=100000

to dump the first 51200000 bytes (51.2 MB)...

large image

this seems to be (according to this by Football) the bootloader?!

blubbers said he found this information on partition 26 (mmcblk0p26):

full post here
[HTC One X] Thunder07:
mmcblk0p26 is an imaginary partition blubbers made to map unmapped areas on the nand

mmcblk0pXY are all part of the mmcblk0 divided into partitions by the system(the kernel to be exact) making them much easier to manage and flash

just like on your pc you would have folders its the same case, while to you the folders appear separate in fact they are all mixed up on the harddrive.

at this stage we figured where everything is we just need to find a way to edit them :?
[HTC One X] glukosio:
so our problem is that at reboot all changed things return to be as first? maybe somewhere exists a backup file of partitions like .bak file for rootexplorer and it's rewrited every reboot...we should try to find it and even if it really exists we should edit it
[HTC One X] mkrle:
I think that when protection is on, there are no actual writes to the protected partitions (with later restoration), only some kind of copy-on-write to RAM memory, so the changes are lost on reboot, and not changed-then-restored. While playing with my HOV, i was able to write up to some point when kernel started rejecting the write calls.
[HTC One X] portals:
I used this http://briefmobile.rainmotorsports.net/public/HTC/Evita/onxr.zip and get temp root(I can read from /dev/block/mmcblk0) on locked device.

Sense was crashing but adb shell work.
[HTC One X] N3m3515:
please clear up what device you have. i am sure you are using a ONE XL!!!!!!
[HTC One X] portals:
No, i using locked one x form t-mobile. Unfortunately I can not get root again :( but one time is worked. The whole system and adb work unstable but cat /dev/block/mmcblk0 worked twice, after adb stop working.

Software version 1.29.118.11
[HTC One X] N3m3515:
http://briefmobile.com/how-to-root-htc-one-x-att

you got the file from there. and it clearly states that its for a at&t one x (One XL, Snapdragon One X, LTE One X). this root method was disgussed many times and we know its not working.
[HTC One X] portals:
I got one x with tegra 3 and it's work I swear.

I don't know how it can work and can't replete but it's work. I removed same reboot from bat file.

This can be difficult to repeat bug.

EDIT:

It's work again. I removed last @adb reboot and retry many time, and it's work.

weak evidence in attach

Device is s-on and locked(no relocked). When is rooted htc sense still crash after reboot everything is ok but no root.
[HTC One X] mkrle:
This also works with HOV, but

1) the phone is much slower while qemu is on

2) any changes to protected partitions are gone on reboot
[HTC One X] jonhyxda:
Also works in my HOX after remove last reboot!! :laugh:
[HTC One X] portals:
So, now wait for real developer.
[HTC One X] shadehh:
Hotlinking doesnt work with the link you provided by the way. Or is it just me?
[HTC One X] Adrianiii:
where can we download that file?
[HTC One X] N3m3515:
http://briefmobile.com/how-to-root-htc-one-x-att

here is the download without hotlinking.
[HTC One X] portals:
It's work for my but file in attach.
[HTC One X] SvenSSSvensson:
Correct me if I'm wrong, but isn't it working because you loose the changes on reboot, and therefore not loosing them cause you remove the last reboot?
[HTC One X] godutch:
I wonder what happens if you use titanium backup to restore and old backup; if this were possible I wouldnt have unlocked my device and lost warranty
[HTC One X] Alex240188:
With temp root can't you just install busy box and supersu binaries to get permroot after reboot
[HTC One X] mkrle:
You install them, you reboot, and everything you installed is gone.
[HTC One X] N3m3515:
can we boot into a recovery image with temp root?
[HTC One X] portals:
Probably no, still s-on. We need s-off to do this. But we're a little closer to s-off.
[HTC One X] keroro430:
Same script. But it worked and System UI keep crashing before the phone was rebooted.
[HTC One X] f4flake:
This method has been around for some time and is the same as Paul O'Brien's method on Modaco.

ADB works, as root, but the sense is unstable and crashes.

All changes are gone on reboot.

It has already been discussed in this thread.

Attempts have been made to combine it with Simonsimons unlock utility to no effect.
[HTC One X] Sybregunne:
Everything is lost because most of this partitions are sort of virtual. Uses some sort of ram disk. Like in DOS long time ago. Certain drivers lock out blocks of memory and treat this as a disk partition. So you can make changes to the partition. Meanwhile if your device is s-on sense would compare this ram disks to the actual file or disk block. If it's not the same sense crashes. Your device would reboot and reload the unmodified file.
[HTC One X] Thunder07:
if anyone wants to try something crazy do this... with an unlocked bootloader

http://xdaforums.com/showpost.php?p=29451649&postcount=4165

but set mainvar as 2147483648...

WHY.... android uses ARMv7 processors which are 32bit cpus and a known limiting to these processors is that they cause buffer overflow( they crash) with integer values higher than 2147483647

with a bit of luck htc didnt take that into account and we can exploit it

NOTE.... AS I EXPECT MOST OUTCOMES ARE BAD Except (1,4)(which will hopefully get)

1)nothing at all happens and the file doesnt flash

2)Nothing happens and your mainvar becomes 2147483648.... Lossing the ability to ever use an RUU unti S-Off

3)the file flash and causes hboot to crash and thats it.... and lose fastboot/hboot forever... i dont even thing S-Off can fix it unless S-off can be done without access to hboot and we can write over partitions

4)the file flash and causes hboot to crash and you get into APX

unfortunately i cant afford to try this as you see the outcomes,

i dont presume any of you would but to those who would please report back so that i can remove it or leave it

also post cmdline result
[HTC One X] Hunt3r.j2:
I would be stunned if this worked.
[HTC One X] Micropot:
Are you shure it is a signed integer? Because if it is a usinged integer the max value is 4294967296 (2^32).
[HTC One X] glukosio:
maybe if is possible to use negative number bigger than 32bit we can exclude the 3rd of the 4 possibilities and we will have less probability to destroy our HOX

-1 is more than 32 bit too i think
[HTC One X] Chezbel:
For 32-bits you have hex values from 0x00000000 to 0xFFFFFFFF, which can be interpreted as unsigned or signed.

If treated as unsigned then the values are 0..4294967295

If treated as signed then the values are -2147483648..2147483647

I think the point was that if a 32-bit value is treated as signed and you specify a value larger than 2147483647 it will actually be treated as a negative value, which can result in a bug if the system does not specifically check for this.
[HTC One X] KrisPerry:
So try it
[HTC One X] g0dsCookie:
Why should HTC use a 32 Bit Integer for a the version number? I think they use a 16 Bit.

And i don't think that they would use a signed one. Because, why should they name a version like -1.2.402.5?

And yes, if you overflow a Integer Value, it will begin at the start. So a unsigned one will Start at 0.

Send with tapatalk 2 on my SGS3.
[HTC One X] theliquid:
I wouldn't try this rooting script again.

My S-ON and LOCKED device hangs in a bootloop. Hardreset didn't help.

Found a solution: do a full script run. Then Sense doesn't crash anymore,
[HTC One X] backfromthestorm:
Not always,

Quote =

The most common result in these cases is for the least significant representable bits of the result to be stored (the result is said to wrap). On some processors like GPUs and DSPs, the result saturates; that is, once the maximum value is reached, attempts to make it larger simply return the maximum result.
[HTC One X] Thunder07:
time to put that bad boy to bed...

i gave it a go using mainver 4294967296 & 4294967296.0.0.0

sending 'zip' (5713 KB)...
OKAY [ 0.769s]
writing 'zip'...
(bootloader) P**** zipped android_info fail!

FAILED (remote: 24 parsing android-info fail)
finished. total time: 1.076s

and 4294967296.0.0

sending 'zip' (5713 KB)...
OKAY [ 0.785s]
writing 'zip'...
(bootloader) checking model ID...
(bootloader) checking custom ID...
(bootloader) checking main version...
FAILED (remote: 43 main version check fail)
finished. total time: 1.287s

no such luck :/
[HTC One X] theDroidfanatic:
This guy called 'PsyChoses' bought a One X, and it was S OFF. His hboot is 0.43.XXXXXX

He posted and gave proof in this thread, check last few pages

http://xdaforums.com/showthread.php?t=1727657
[HTC One X] Thunder07:
practically useless at this stage since Xmoo has s-off probably Football aswell.

but why didnt u just link that page :p
[HTC One X] theDroidfanatic:
Oh :-\ hehe, too lazy xD
[HTC One X] kholk:
Just saying, but you're everyone thinking to a number. It doesn't have to be forcefully a float or integer variable.

Moreover:

1.2.3.4 -> Those are four (probably unsigned) int variables. It doesn't make sense... if hTC are really that much pigs it's okay, but if I were the programmer of HBOOT, I would never use four unsigned (short) int variables for a version number that's surely >=0 and <1000, not only for useless memory consumption reasons.

Can those be float?

Again, WHY?!?!? two float variables? And.... then did you know that in ANSI C the "unsigned float" is not legal (there is no such thing)?

But...so, what data type can it be?

Noone ever thinked about an array of chars? (-> commonly called "a string"<-)

......lol!

Just my two cents :)

The EternityProject Team Manager & Main Developer,

--kholk
[HTC One X] Thunder07:
I did think they are char and guess what they are..... Why did I think.. because i added a z into my Mainver and it flashed.

But what I also know is that you want to compare the numbers(as in greater or less) they must be numbers/integers and not char

And was hoping that would cause the crash

Sent from my HTC One X
[HTC One X] kholk:
Sure, but for comparing the numbers, you're actually evaluating a string. EDIT: On HBOOT, I mean.

Let's name the actual phone version string as "pver" and the new one (of the eventual ZIP file) to compare as "nver" for a better explaination.

There are many ways for making that to happen:

1. Compare the hex code of the --first,second,third, etc-- char variables of pver with the corresponding ones of nver

2. Take the "number" from pver and nver and use a function like "int atoi ( const char * str );", then compare the integers (stupid)

3. Don't know, but there are other really stupid ways that aren't coming to my mind actually.

If it was my code, I'd use the first way, wouldn't you?

Easy and effective.

P.S.: Yeah, I can look on my not-totally-RE'ed HBOOT, but it's useless... things like those are almost obvious :)