yashsingh1/xdaforums huggingface dataset:
[HTC One X] N3m3515:
sure... you can extract the rom.zip file from the ruu and try to find the install script wich should contain instructions for flashing the hboot image.

edit:

one thing to remember: http://xdaforums.com/showthread.php?t=1551581

mike already found out that we can place a PJ46IMG.zip to our "SD-Card" to flash it.
[HTC One X] mattman83:
There is no updater script in the RUU, just a bunch of IMG's (that said, hboot should reside in one of the IMG files).

The OTA update may have more info as it's a CWM flashable zip i think. It also narrows down the potential places the HBOOT could sit.

M.
[HTC One X] blubbers:
i've posted about this already, but this is what i wrote

partitions actually on the emmc:

APP BCT BIF CAC DIA DLG DUM EBT GP1 GPT ISD LNX MSC PDT PG1 PG2 PG3 PT RCA RFS RV1 SIF SOS SP1 UDA WDM WLN

partitions seen by the kernel

APP CAC DLG DUM ISD LNX MSC PDT PG1 PG2 PG3 RCA RFS RV1 SIF SOS SP1 UDA WDM WLN

one way to get access to the missing partitions if with nvflash
[HTC One X] Evil-Dragon:
No go: write_firmware_image("PACKAGE:firmware.zip", "zip");
[HTC One X] N3m3515:
could it be possible to see these partitions with a modified kernel?
[HTC One X] Rekoil:
Someone mentioned a few posts back that it might be possible to boot into APX mode using a modified kernel, I think this should be looked into.
[HTC One X] mattman83:
We do at least get the hboot img from the OTA though :) Dunno if that helps at all.
[HTC One X] Polarfuchs:
From the RUU Progress Text File:

So before Hboot is flashed, first CID and then Radio are flashed.

There must be some secrets in the radio.img?!
[HTC One X] blubbers:
kernel sources would of course help, but the "reboot oem-/restart_reason" stuff is not implemented in the tegra arch, to my knowledge (checked on the latest android-tegra-nv sources)
[HTC One X] N3m3515:
the s-off switch could be in the radio or its in the hboot itself. if the switch is stored in the radio we need a modified hboot wich ignores the switch. i think this is how its made with the desire.
[HTC One X] mattman83:
Yes that's my understanding of the desire fix too. Can't touch radio without s-off, but can just ignore the check ;)

Although, if RUU is stating flashing radio, perhaps that system file mike found isn't the radio after all? Maybe just RIL or something to that effect.

M.
[HTC One X] Polarfuchs:
Can you tell what these are for?

Obviously they get pushed at the beginning.
[HTC One X] N3m3515:
can you look into them with a hex editor?
[HTC One X] Cristianop:
I would pay a small amount for it if it works. No prob.

But let's wait for xmoo what he says...
[HTC One X] LlabTooFeR:
It doesn't work in this way. You should have this card physically connected to your device.
[HTC One X] Zulake:
Personally, I think a solution like Revolutionary (online unlock tool webpage) for the Sensation is more likely to come.

Yes, you still unlock the bootloader. But HTC doesn't know about it.
[HTC One X] lordtillt:
Amazing, someone finally proved all the "will never work blab"-pessimists wrong, thank you!

But, and please forgive me for the noobish question, I'm reading every post since page <<300 and I just can't make sense of these Javacards, Goldcards and whatsoever.

What are these? On Xmoos picture the javacard looks like a micro SD card - which for me must be sharable with some sort of dd-magic! Could you explain why this doesn't work?
[HTC One X] mattman83:
They are shaped like microsd but have their own internal OS etc that you can't touch. So you can dump an sd image onto it, but it doesn't have the OS to do what it needs to do....

M.
[HTC One X] g3rm3n:
Good day

Why is more difficult to find these javacards ?

And how much money cost more or less ?

can we with this method return to S-ON ?

have we for download DIAG file ?

thanks
[HTC One X] KamikaZeeFu:
AFAIK (someone correct me where I state false things) a goldcard is just a sd card that was formatted in a special way.

A javacard however is not a normal sd card. It has additional components and circuity on it which allows it to run (presumably java) code. It still uses the sd slot and might also have some storage capacity on it.

So dumping it with DD is not possible, at best you'd get what limited storage is on the card, but you'd be missing the whole circuity and stuff that makes the javacard do it'S job.
[HTC One X] lordtillt:
Thanks - does one know how these operating systems work? Maybe we could make a step towards software s-off if we'd know how exactly they work. Or too much reverse engineering?
[HTC One X] GOLDFiSH92:
CONFIRMED NOT WORKING - FLASH ENG HBOOT OVER STOCK

Under HBoot 0.94, locked, it is not possible to flash this hboot. Fails on signature check in RUU mode and "not allowed" if flashed as the .img. May flash on S-OFF but that's irrelevant.

I really want to PM some of you guys but am un-able to because I am still a newbie member ffs. Hit up the IRC some time, don't want to put my email out here ;-)

Also, after reading all 3500+ posts, if someone posts a retarded comment, ignore it. Don't answer, don't flame, just leave it. Much easier for mods that way and OT conversations RAPIDLY grow to pages... Don't even respond to this ^^ just ACT! PLEASE!

If you have a simple idea, try it. Don't post it in here waiting for someone else to put their device on the line unless your idea is really out there. No point mentioning whitecards/javacards/smartcards unless you have one or are working on cloning one. Forget Chineese forum links unless you have tested the methods yourself and confirm it working. We have tried most all of them so far, none work and the repetative posts to the same non-working exploit is maddening. If you aren't willing to brick your device helping then don't post conjecture and crap or ETA's either.

I hope Blubbers has/is looking into that splboot that Bin4ry suggetsed, it looked promising but I personally don't know if this is applicable here.

Evil Dragon, doing so well on all the decompilation of hboot, would love to help with that anyway I can.

Xmoo cheers for updating the thread, unfortunatley I doubt anyone seems to read your first page otherwise we would still be <100 pages :-( Keep up the great work and thanks for the images and flashing infos, hope you can find a way to get the images to the phone, even if it is a temp hardware, y-cable kind of job. :-P

There are too many other people in here who actually contribute to this and I reckon with a more organised effort we can get this dooooown.

Thankyou, and thanks all for the hours of work you have all already put in, we can crack this :-)

EDIT: Also, if you are just throwing ideas around or want to ask a quick question use IRC, then once you have maybe a solid leads or idea THEN post it here for the wider world otherwise you a) may look foolish to more people b) clutter the thread with useless crap... just a thought lol. #soffonex OR #htc-one-x (general disc)
[HTC One X] xmoo:
This is the common used card by HTC: http://www.go-trust.com/products/microsd-java/
[HTC One X] Rekoil:
What difference is there between an emulated USB device on a computer, and a USB device physically connected to your phone? You can create remote USB links with relative ease these days.

What I mean is that for all intents and purposes, the One X would think the device was connected, it would just experience insane amounts of latency.

So:

Java-card > connected to Xmoos computer > fancy linux wizardry > my computer > One X connected via USB

Basically you establish a USB link over the internet, how do you think those unlock solutions back in the day worked? Sure they had little computers in the cables, but that was only so that the solution couldn't be copied via simple network sniffing, there is nothing saying that you cannot do this with a simple USB cable.
[HTC One X] KrisPerry:
Provided it doesn't time out
[HTC One X] Rekoil:
Granted, but with modern internet the way it is, that shouldn't be a problem, I highly doubt it'll time out before a few seconds have passed. I updated my post by the way.
[HTC One X] ingFu:
That sounds promising. And It's definitely an approach I'd support.

BTW: there is a sourceforge project taking care of this idea: http://usbip.sourceforge.net/
[HTC One X] staffanbe:
This is basically the way it's being done when logging in with smart cards via a thin client (Citrix). You tunnel the communication with the devices through the thin client protocol.
[HTC One X] ali3nfr3ak:
so seeing as i have an s-off phone thought i might play with this eng hboot , as it turns out i probably shouldnt have done that...lol

so i flashed the eng hboot by changing the rom.zip, during an ruu update , but i only put in the eng hboot, of course as soon as the phone reboot it wouldnt boot the os , or be recognised by usb

when i boot into hboot , i have no access to fastboot, recovery etc etc, pressing the power button on any option just results in a jump up to the next option as if i was using the volume up/down keys, and of the vol up/down keys only the vol down works.

So i made up a y cable and put some different types of PJ46IMG.zip ( from 1.29 ruu , am downloading the test rom now but that will take another 3 hours) on but they all get stuck. attached pic.
[HTC One X] xmoo:
You need the 0.96 test rom, that one has HBoOT 0.04. That one will allow you to flash back to 1.29 and get ur phone back alive!
[HTC One X] Rekoil:
Couldn't he also just flash a signed 1.11 HBOOT image? That should be enough to get you to a state where you can install ROMs via recovery I think.

If you are feeling even more adventurous, and can actually get a USB connection to talk to HBOOT, try to toggle security, if we are correct you should be able to turn security on, reboot, be S-ON, then toggle security off again, reboot, and be S-OFF. If we have all understood correctly, the ENG HBOOT has this ability.

Of course, if it can't be made S-OFF again you will have lost S-OFF. So it depends on how much you wanna help the community at large :P
[HTC One X] lordtillt:
Well okay - but what do these cards actually do? Is the hboot configured in a way that allows code to be executed from this javacard? There has to be a way to emulate/fake these cards!

/edit: In fact, we wouldn't need to emulate the whole card but only the commands sent to the smartphone. Maybe that's possible by intercepting the communication between a real javacard and a real smartphone
[HTC One X] xmoo:
The 1.11 HBOOT is SHIP and not ENG or MFG. I got a lot of sources but signed HBOOTs in .zip are very rare. This one was used to get the software from the HTC Edge to work on the One X. See HBOOT date ;)
[HTC One X] xxxAzrealxxx:
Secure Element Evaluation Kit for the Android platform

Bit of research into getting android devs developing and deploying security-based applications to communicate with SD/microsd's and other security APIs

http://www.code.google.com/p/seek-for-android/
[HTC One X] ali3nfr3ak:
hmmm phone went flat before i could finish downloading the test rom ... :\
[HTC One X] Rekoil:
The HBOOT image in the latest RUU would be a signed one, same goes for all the update zips. Extract the HBOOT image, run "fastboot flash hboot hboot-1.11.img" should work theoretically.
[HTC One X] GOLDFiSH92:
Ok, after reading the majority of the Tegra 3 TRM (thanks Evil-Dragon) I am almost certain that there is a way to access APX using some sort of jumper/short-cirucuit/dongle. Certain pins can be set to read nominal push/pull causing certain wake states. I will look into this further for sure. Only problem is, after the One XL has been found to have internal pins to enter Qualcom's downloads mode it seems likely that we may have to do the same and I'm not just going to start poking around inside my phone with wires, nevertheless, I will see what I can find.

Also, it looks likely there is UART and JTAG available on the board despite what an earlier post suggested. Whether these are blocked or even utilised by HTC remains to be seen, but again, may just require a dongle for access, otherwise not sure I could get this to work...

Anyway, 1000 pages in and a bit tired. Will carry on with this tomorrow :-)

EDIT: Wish memprodroid exploit would work for us, am willing to HTCDev unlock but putting off due to the effort of backing up my stock ROM just to get root. On a positive side, had fun using busybox, ssh and adb all day :-P If you are that way inclined check out the source for zergRush exploit http://xdaforums.com/showthread.php?t=1296916; no longer works but makes an intersting read.
[HTC One X] ali3nfr3ak:
funny enough after not touching the phone all day it booted up, but only into hboot,

have no PC access to phone, windows recognizes the phone as unknown device..., eventually finished downloading .94 test rom, extracted rom.zip from it, renamed to PJ46IMG.zip same thing happened as before ...

stuck at

loading DIAG file...

trying running .94 test ruu , but keep on getting usb connection error,...

now phone flat again...lol, not able to charge it for some reason...

maybe the home made y cable is not good enough..?
[HTC One X] xmoo:
Don't think it will work, but here you go!

Weird that yours goes directly into DIAG :S

If you could get it to Fastboot. Then you can flash RUU.
[HTC One X] ali3nfr3ak:
hmm that is the problem for some reason the power button has been disabled, (does not go to the selected menu item, instead jumps to the next item in the menu, above it)

@xmoo do u had a dump of an s-off hboot? if you do any chance you could up that, as i will lose s-off altogether if i manage somehow to flash the .94 test rom, so if i manage to get into fastboot ,an s-off hboot would be the way to go?
[HTC One X] Thunder07:
Why would you loss it,

According to earlier post we are trying to flash 0.03 to toggle s-on to s-off than update to whatever newer hboot there is,

So unless you're s-on you are OK to flash

Sent from my HTC One X
[HTC One X] RazorGTR1:
Guys, let me have a question.

After flashing the ENG HBOOT, do we have permission to write recovery image from fastboot? Or something similar to get any ROM (even cooked) working without installing the test RUU?
[HTC One X] GOLDFiSH92:
Do we know anyone that still has a broken/bricked HOX that we can get to poke around inside? The two pads bellow the audio jack look interesting but I don't have the balls to go jumping them nor do I own a bus pirate to see if they are UART-TX points...

Also, does anyone know if any devs are still looking into temp roots for our device?
[HTC One X] xmoo:
Guys, Javacard will work 100% so cancel that. You cannot copy a card and it would not be a solution for everyone...

Flashing through fastboot give error. But directly flashing to the partitions does work.
[HTC One X] angusc:
So do you have a link or source for java cards That people can use to order?

Sent witH desire from OneX
[HTC One X] lilvfr400boy:
Xmoo with java card solution will we all have to buy a java card or is there another way around this, also do you have the diag files needed ?
[HTC One X] xmoo:
I don't have the direct link. A member here in XDA wanted to help me with that. He wants to stay anonymous.

DIAG files are on the web and yes everyone wanting to use the solution needs to get a javacard.
[HTC One X] kozmikkick:
This is the javacard we need to buy right?

http://www.motechno.com/java-card.0.html?gclid=CLCvxKKFjbECFaQaQgodBUGfWw
[HTC One X] kozmikkick:
This site list a few different types if java jcop cards that they have for sale.

http://www.smartcardsource.com/cards.html
[HTC One X] Beatastic:
I think you'll need a microSD Javacard, like xmoo said before. He also gave us this link : http://www.go-trust.com/products/microsd-java/

Please look some pages back and dont post if you see that it was already mentioned :D
[HTC One X] Htc_One_X:
I think if we need Java cards, we should find what ones and maybe order a bunch, as its considerably cheaper to order in bulk...
[HTC One X] AdamLange:
And someone confirmed that using javacard can unlock S-ON ? Any reliable proof of that?
[HTC One X] KrisPerry:
Yes but this is not a link to buy them from
[HTC One X] kozmikkick:
Exactly. I guess my question is since the link I posted sells them rather cheap. Do you think a standard size javacard would work? I would think that if the micro one works with a reader the standard one should work with a reader as well.

I'm just unfamiliar with this technology.
[HTC One X] KrisPerry:
The card itself is the same provided it fits
[HTC One X] lilvfr400boy:
Xmoo please may you post a link to buy the correct java card and a link for the diag files ? I understand you get many requests sorry, possibly in the op? I am new to java cards and have no experience with them but am more then willing to buy it and test it if it helps everyone else
[HTC One X] LlabTooFeR:
Device can be s-off with special s58 diag and javacard, xmoo did that today with his device, BUT this diag WILL NOT LEAK because some people might get into trouble because of that. So that means practical useless of ordering javacards. Coz now we have S-OFF device in our hands, I'll start looking at solution for all...
[HTC One X] xmoo:
No use, cause it needs to be signed by HTC (like a goldcard.)

Will upload a video when I get it.
[HTC One X] kozmikkick:
I thought it was the same diag as the sensation. Thanks for clearing that up.
[HTC One X] xmoo:
No the card wil work on Sensation. Uses the same "Goldcard".
[HTC One X] colin_404:
Bit more smart card info.

http://www.linuxfordevices.com/c/a/News/MicroSD-Smart-Card-adds-security-to-Linux-devices/
[HTC One X] xmoo:
I remember the S-OFF device had the same thing. You need to unplug. Go into HBOOT wait like 15sec and then plugin. If you have a USB cable connected to PC or Power connected to the phone, it will look for ROM and DIAG. So remove cable, go into HBOOT and see if the menu works.
[HTC One X] g3rm3n:
So... is it possible to find a solution for us without this method of javacard signed?
[HTC One X] colin_404:
So if we want to use this solution do we get javacards OR is it useless getting one?
[HTC One X] xmoo:
Just to clear stuff up! Javacard+DIAG was just a test. This won't work for everyone, so please stop talking about that!

Added in post #1.
[HTC One X] co@ch:
So worked for him and he's s-off now? :confused:
[HTC One X] miniudavid:
So whats the Deal now? Can you soff hox with your javacard? I would travel to you;) Youre in the netherlands and I live close to the frontier in germany:) greetz
[HTC One X] KrisPerry:
10 posts ago you said

I am confused
[HTC One X] g3rm3n:
So... is it possible to find a solution for us without this method of javacard signed +DIAG?
[HTC One X] crazy88:
As far as I understand, the javacard will give S-Off, but it's not a feasible option because the diag files aren't available to use. However, it's progress still, as I think Xmoo has performed S-Off. I may be very wrong though, as I am not very knowledgable so have stayed out of the thread until now :)
[HTC One X] g3rm3n:
Yes but can this progress javacard + DIAG help to find a solution for us or not ?
[HTC One X] le_cactus:
the DIAG files can't be leaked!

Sure it can, you got it didn't you? Everything leaks eventually so why would it be impossible with this file? Just a matter of time I guess (and hope!)

Anyways, thanks for your on-going digging. Great to know now it's possible, although a disappointing hearing you say files can't be leaked.

Cheers,

/Cacti
[HTC One X] mattman83:
Yes, because it gives the lead dev on this project an S-OFF phone and a way to get back to S-OFF should experimenting screw things up :)

M.
[HTC One X] asafy:
Javacard simulator ?

If we can't buy javacards, maybe can we use a simulator ?

Something like http://code.google.com/p/jcardsim/ ?
[HTC One X] g3rm3n:
It doesn't work in this way. You should have this card physically connected to your device and it needs to be signed by HTC

Please read previous post
[HTC One X] Reaper82:
Xmoo is looking for ways to s-off without needing a java card (which is what the masses will need) and that is why he said to forget about java cards and to stop cluttering up the thread with useless talk about them.

When a feasible solution is available without requiring proprietary hardware and protected files we will all have s-off and not a second before. Just want to thank the devs for being patient despite all the noise in this thread.
[HTC One X] xmoo:
The problem is... You have several DIAGs... Then "Clean data s58" is a DIAG which is owned and used by a couple of head HTC repair centers... So if that leaks, it would be easier to trace it back. This DIAG clears security and hard resets the whole device, so S-OFF SuperCID SIM-Unlock.

Most repair centers have the "ASP" DIAG. This one checks hardware and hard reset the system folder, so no S-OFF.

The Javacard does not achieve S-OFF, it just bypasses the HBOOT security to run the DIAG file and does not check CID (like Goldcard), so you could flash any CID stock ROM.

Some people have gave us files which we could use to experiment with in order to help in gaining S-OFF. Some files come anonymously from HTC workers. Sharing those files would be illigal and we would break our promises.

I will share a video of how the whole Javacard + DIAG works. Probably end of this week. But the Javacard and DIAG file won't be shared, so stop asking.
[HTC One X] orb3000:
On topic please

Please use the report button.

Lets all try to stay on topic, it´s a way to respect developers work
[HTC One X] le_cactus:
I'm not asking, still we can be disappointed can we :)

We can only hope that with the experimenting with these leaked files helps you understand the process, and you will be able to find an exploit. Although reading up on current HTC security it doesn't seem like an exploid or work around will be found soon. Besides giving credit to you (on finding all this out) I guess we need to give credit to HTC for finally having a device that is really hard to hack.

Thanks, cheers,

/Cacti
[HTC One X] techmatlock:
Hardware method doesn't seem like any option for us even with an xtc clip because we still need the diag file. Without the proper diag file, then there's no way you can manipulate the diag drivers clearing security on an htc phone. How do we approach exploiting the htc one x since this phone is locked down without a diag file leaving the software option highly unlikely.
[HTC One X] TeniusGG:
the Javacard could be cloned to an empty simcrad?
[HTC One X] doublecheese:
Could this method work with XTC CLIP then ?

Because I remember I was seeing a CLEAN DATA s58 Diag Menu on the screen. So this XTC Clip was using the Diag file of some HTC service center ?
[HTC One X] LlabTooFeR:
No it won't, XTC Clip used different method to s-off/simunlock.
[HTC One X] mattman83:
The problem is also that Xmoo has agreed not to publically release the diag file to protect his source (which is fair enough IMO, with xmoo having an s-off device now dev is going to be better). It's not getting a javacard that's the issue - it's the diag file...

M.
[HTC One X] xmoo:
XTC Clip won't work. As I said before you need a goldcard which works on the Sensation series... that one will also work on the One series.
[HTC One X] Zulake:
And nothing but my deepest respect that you do all this for us in your spare time.
[HTC One X] Erik Lieders:
Expected silly answer like from others. I did not expect any other answer. You tell me one thing: why when the question comes to the hobby and profession, then everything is always about money? You know the phrase TO WORK FOR THE IDEA? To learn and to help get s - off? )) 5 weeks ago i found the solution. Simple solution. I cheked it and it works. Without javacards and other ****. Proof? after I come home from work.
[HTC One X] Zulake:
Okay, you got my attention. I will eagerly await your proof, and I guess I'm not alone with that. It would mean a lot to many of us if you really do have something like that.

And why everything always is about the money? Because we students in The Netherlands over here almost always are poor as f*ck and could use every single penny. ;)
[HTC One X] g3rm3n:
You know the phrase TO SHARE THE IDEA?