yashsingh1/xdaforums huggingface dataset:
[HTC One X] Morto_jeffrey:
Ah thats lame you need a 64bits driver :S.

Do you have a other pc with a 32bits OS on it?

(heb net de hele tututorial moeten vertalen naar het engels omdat het nederlands was had niet eens gehoeven :P)

(Had just translated the tutorial to English but you are dutch to so it was'nt necessary :P)

You can try these drivers.

http://xdaforums.com/showthread.php?t=1161769

Or these from Football (Thanks Mattman83)

http://d-h.st/OvU
[HTC One X] mattman83:
I assume you guys have tried the drivers football linked a few pages back?

M.
[HTC One X] Zulake:
Yes, didn't work. They won't even install. The drivers Morto_jeffrey just provided do install fine, but it still doesn't want to list the device after installing them. Not in Android and not in HBOOT/Bootloader.
[HTC One X] Braindamage1989:
Those drivers seem to work (but not Windows 7 x64), but nvflash won't recognize. I think we got the same as they do:

http://xdaforums.com/showthread.php?t=1625183
[HTC One X] Zulake:
They always speak about 'unlocked devices only'. I surely do hope that's not the case for our poor HOX. Mine is still 100% stock, locked and unrooted.
[HTC One X] co@ch:
Your phone is broken and device manager shows apx device? Otherwise stop trying, won't work. Phone has to be in apx mode.
[HTC One X] Zulake:
No, it's working just fine (luckily).

But alright, it was worth a try though.
[HTC One X] miniterror:
Lol'd

Again, all what youre saying here is that every nvflash(including the ones youre using now, wich is just a download from god knows where) wont work, unless they have the hox settings in it wich obviously only htc has so wont be on the inet

So why are you trying to use a nvflash wich according to you wont work.

Also i assume in the asus one it had the adress of the mem, there diff on the asus but there setted in that package. We kniw the mem adresses of the hox so maybe change the asus ones to the hox ones according to youre methmetics?
[HTC One X] Morto_jeffrey:
Now we need someone with real apx mode then?
[HTC One X] Braindamage1989:
Ok. let me explain the whole story.

A guy with APX, and the drivers(football) installed and working, tried xmoo's nvflash but that one didn't find his device.

He searched for a newer version and tried that one. This one looked somehow liked that it worked, but after all it turned out to be a graphic card nvflash. And he did knew some other website (http://androidroot.mobi/t3_nvflash/) for the Transformer Prime which uses nvflash to unlock or something like that. This was the one YOU and I were talking about. The file had no nvflash inside but a couple of other files, one of them was a config file. Inside this config file was the partitioning from the Transformer Prime. In the other files was some data what was Transformer Prime specific. basically no nvflash at all.

So there is a great chance that xmoo's nvflash isn't the right one. If you watched the Transformer Prime forums you should know that they are waiting for a nvflash which is used for ICS/Tegra3 binary. Even if we got the right one, we have a chance there still is a SBK which also is device specific, to get all access.
[HTC One X] co@ch:
Some more info about this.
[HTC One X] Thunder07:
The Problem is that we cant flash the bootloader(hboot)

they basically modified hboot and flashed it to allow easy access to the APX which we cant do.

and the partitions arent a problem, a simple modification is needed.
[HTC One X] ~Immo~:
If anyone come up with anything else regarding APX drop me a pm...

Don't have a problem getting APX i just have to leave my device in my pocket for 10 mins -.-
[HTC One X] GOLDFiSH92:
Hey, please could you run "adb shell "dmesg" " on your device whilst it is operating 'normally' as soon after it has restarted into APX mode as possible and copy the output here. This will allow us to look for what naughty driver (if any) may be causing your device to restart into APX mode. If you need further instruction please PM me and I will do my best so long as I am not in work.

If you could give us the USB ID of your device too whilst it is in 'APX mode' that would be of interest too, thanks (lsusb command under linux will do the trick or device manager on windows) :-)
[HTC One X] keroro430:
Did anyone find a kernel bug to make the phone get into apx mode?
[HTC One X] ~Immo~:
managed to get into APX while attached to PC and have produced a logcat. its probably a right mess as was having random reboots and apps FC.....

Hopefully it will give some clue into giving us all access to APX

https://dl.dropbox.com/u/72311982/logcat.txt
[HTC One X] vincenzo697:
How you got into APX mode?
[HTC One X] ~Immo~:
Faulty device :(

Can get into APX from leaving device in pocket/rubbing screen/knocking back of device.... Along with random reboots/bootloops and Apps FC =/

I believe it all started from dropping my HOX....
[HTC One X] Jhinta:
seems like a loos connection inside ( think apx is active if somthing failes )
[HTC One X] Stephie:
@thunder07

Thank you for the information and advice in your pm's, you have helped me loads.:)
[HTC One X] Rekoil:
If this is the case then we could potentially coax it into apx mode by disconnecting whatever it is that's been disconnected... Worth a look I suppose, anyone got their HOX open?
[HTC One X] ~Immo~:
I'll pop mine open later if that helps...... Although have no idea what I'm looking for.........
[HTC One X] MySam:
Just take plenty of detailed pictures and post them here :)
[HTC One X] RichmondoUK:
No good. I pretty much stripped mine while still powered on to replace screen.

No apx :mad:
[HTC One X] backfromthestorm:
How about wiping system data boot etc. Or would it just boot into fastboot only.
[HTC One X] Rusty!:
On the O2X, when you wiped the boot image it would drop to fastboot. OK, so it's a different phone, but it seems the logical thing to do.
[HTC One X] kb0n:
Won't know until you try. Can make a plausible assumption, but then again it's just an assumption.
[HTC One X] jerrylzy:
I believe that Chinese guy uses White Card to s-off, and I might have seen him once in Shanghai, when I asked him to s-off my devices and he required 150 yuan.
[HTC One X] miniudavid:
I think I would try it. Finally got the device unlocked. And if I make a nandroid before there is no risk for me right..??..
[HTC One X] xmoo:
Yes cause recovery wont be wyped. But make a back up to you computer of de nandroid backup.

Meanwhile our HTC connect is gathering information about the APX mode for us.
[HTC One X] ~Immo~:
ENDEAVORU XA ENG SHIP S-ON RL

Hboot status after trying RUU due to phone not booting at all... but failed right at the end (tried a few times and always the case -.-)

Also had security reset option and was showing *** LOCKED *** (Previously *** RELOCKED ***)

Similar to this http://xdaforums.com/showpost.php?p=26436594&postcount=2063 Only the locked status restored back to back to relocked but the hboot status remained the same ENDEAVORU XA ENG S-ON RL

No real progress i know just a bit of new info.....
[HTC One X] xmoo:
You got a screenshot? Weird stuff... XA ENG.
[HTC One X] ~Immo~:
Oooops sorry -.- Remove the ENG was reading the all the different hboot status in your OP before i posted......
[HTC One X] Diamondback:
Please staY on topic guys! There is a dedicated Q&A thread for all your questions. Please use that instead of this DEV thread.

Cleaned.
[HTC One X] ~Immo~:
Update on APX....

after sometime searching for driver etc so nvflash could detect my device i came across this post http://xdaforums.com/showpost.php?p=28968851&post=125

After downloading and extracting the link provided i no longer get "unknown device found"

c:\nvflash>nvflash --sync
Nvflash started
rcm version 0X4
Command send failed (usb write failed)

Any ideas?

Was going to send phone in for repair today as i cant seem to boot it on demand, but ill hold it off for a bit longer ^_^
[HTC One X] Morto_jeffrey:
Try running this nvflash --list
[HTC One X] ~Immo~:
c:\nvflash>nvflash --list
Nvflash started
unknown command: --list
[HTC One X] dryan433:
Just run nvflash with no commands and it should list all its basic commands most dos apps do.

I know some versions of nvflash have diffrent commands to do the same found this with the gfx versions commands commands would be diffrent with different version so ie --list would change to something like /list etc.

I know most the gfx nvfashs would list its basic functions on just running the app.

Sorry probably telling people how to suck eggs here lol.
[HTC One X] techmatlock:
The problem is, is that we don't actually have developers/exploiters working on our phone. We have football and xmoo whom are people that have connections with people and have knowledge on steps involving unlocking phones. Don't get me wrong, they're a great help to this thread, but there won't be any exploits at least not for now. We need people with a lot of background experience (e.g. alpharev, unrevoked, or known developers). People with experience in arm architecture, disassembly, bootloader execution and memory locations, etc...
[HTC One X] KrisPerry:
You may have already seen this

http://androidroot.mobi/technical/tf-secure-boot-key/

basically even with the sbk only certain nvflash commands are available. Granted this is specifically talking about the transformer but still useful
[HTC One X] KrisPerry:
Also, are you using this version of nvflash that is specific for tegra 3

http://androidroot.mobi/t3_nvflash/
[HTC One X] madenssblade:
Can't we put second bootloader in the recovery partition with Soff
[HTC One X] Thunder07:
If you can boot it...sure..

but you cant.
[HTC One X] ~Immo~:
Yeah i had came across that, although there is a program called wheelie that gives full nvflash access from what i have seen/read ^_^

Ill have a look at this one..... tried so many nvflash downloads now -.-

Edit ** No link for nvflash just for Wheelie as mentioned above ^_^ i might go post on transformer prime forums to see if i can get any assistance :D
[HTC One X] Diamondback:
Can you guys please stay on topic? There is a dedicated discussion thread. This thread is for dev stuff only!
[HTC One X] ~Immo~:
Windows is unable to detect APX anymore -.-

Tried everything and windows just does not read my device at all........ well and truly bricked.....

Looks like ill have to send off to see if i can get repaired :(

Ill keep trying APX and if i manage ill hold off repair a bit longer

Edit** Never mind sorted it ^_^
[HTC One X] Stix0rz:
So have people given up on the sensation gold card to debrand or run with no CID check? I think I remember someone stating that there is no gold card for the sensation? If that was the case why would xmoo suggest it?
[HTC One X] xmoo:
I suggest it because HTC does it the same way. But there is no Sensation Goldcard for the Public.

Sorry for the development going slow. Football is on holidays and i'm busing moving to my new apartement.
[HTC One X] avensakias:
Anyone can create a goldcard IF he has xtc clip.

In combination (xtc clip to create a gold card,dev y cable, microsd card ,microsd usb card reader & diag.nbh file from the java card you used) Anyone is able to s-off his ONE-X.

Correct me if i'm wrong.

Sent from my HTC Desire S
[HTC One X] xmoo:
You are wrong. XTC Clip does not work for Sensation series, so also won't work on One sersies.... ;)
[HTC One X] avensakias:
I know that you can not s-off just using xtcclip the sensation BUT, creating a goldcard for the desire s and replacing the diag.nbh after the creation of the goldcard using the one that you have in the java card you used with football what it gives us.??

I believe S-OFF.??

Have you tried.??

Thanks for hearing me xmoo.

Sent from my HTC Desire S
[HTC One X] xmoo:
This has been tried and mentioned before. The older Goldcard methods won't work.
[HTC One X] avensakias:
Ok then.

So we have to wait.!

:)

Sent from my HTC Desire S
[HTC One X] glukosio:
so what we can still do for getting s-off? try to explain open source meaning to chinese guy and ask again for his method?
[HTC One X] shino82:
the guy earns money with his method. he gives a **** about open source!
[HTC One X] glukosio:
how much he want? can't we s-off one device and then study it to understand what has he done?
[HTC One X] VIIRU§:
If we have an official let's say ota or something that can be flashed via hHoot make be we can use something like 7zip to edit it without braking the signature?
[HTC One X] BenPope:
No. If you modify the data, you have to sign it again with the private key.
[HTC One X] HebeGuess:
If you can do it, then you're breaking the security credentials all around the world..

Why HOX while you have access to all super/non-so-super computers...

Just kidding
[HTC One X] ~Immo~:
Phone in for repair tomorrow so no more APX.... Was pretty stuck anyway needing a SBK =/
[HTC One X] DarkMio:
He did it like HTC would do:

He got a whitecard, which is similar to a simcard. This is obviously stolen from a repairfactory of HTC.

And this let's you do all crazy stuff we want to do.

And let me give you something on the way: you can't even copy simcards, nor whitecards. I messed a lot of things with these baby's of, few years ago, trying to emulate simcards as normal simcards for easy dualsim (which should do as a quick simcard changer) and its not in any kind doable. Instead of freaking hardware hack, they are so much expensive you can still forget that. I'll search a YouTube link were a guy explains his method of breaking all security layers with hardware reverse engeneering.

You need a grade in chemistry, patience and an electronic microscope.

Edit: here you go: http://www.youtube.com/watch?v=tnY7UVyaFiQ&feature=youtube_gdata_player

This is about smartcards, but its the same way and familiar with simcard and whitecards.
[HTC One X] xmoo:
For the new series HTC does not use Simcard... but a goldcard sighned sd-card.

They use Javacards because the goldcard can be signed on a different level. So if you would format the card, the sign won't be lost.

http://youtu.be/7EueLGDqIpo
[HTC One X] mattman83:
Bounty has been discussed, there is a thread for it in general section. If you wish to continue discussion re bounty then please use the existing bounty thread.

M.
[HTC One X] demajoor:
nothing more found out since 14-07?
[HTC One X] DarkMio:
Thanks for clearing up. Thought it was still with whitecards.

Anyways, this system works nearly like the same. Javacards are powered enough up to active 1/2(?) security layers (even RFID-Cards can do this, different mechanism, same story. And then it's getting executed. I'm not sure about the different layers, since I worked more on SIM-Dumps than SD-Dumps with securitymechanism.

ATM I see our only chance in [94,5%] APX, an [5%] exploit in bootloader (since we can flash different roms with DEV-Unlock we could even mess around there, which showed in the past brings us not any advantage), or [0,5%] in some messup with recovery, which shouldn't bring us any further, since this is also the same lock-mechanism like the writeprotection from ROM to Bootloader.

Btw., have anyone checked MoDaCo-Forums? There was this one guy who said, that he (perm?)rooted his phone without unlock. I'm atm less aware about S-Off, since I only want CustomROMs / Root at first.

xmoo, can you link me any source how the backroll works? I mean, when you change / write on the ROM-partition its getting overwritten with the original system. Do you know what I mean? ...

Best wishes, have nice holiday, I'm also in my holidays with poor internet,

Mio
[HTC One X] HebeGuess:
I saw a Taiwanese wrote a method to gian root using something from official ruu. Haven't try, but I can say the method provided seems pretty rational
[HTC One X] WiZARD7:
details?
[HTC One X] g3rm3n:
Perhaps this ?

http://www.qdppc.com/thread-114934-1-1.html
[HTC One X] Thunder07:
he posted this 3 months ago and got not replies....

anywho rom.zip is signed...

and again we're back to signature breaking
[HTC One X] Rusty!:
That won't work, as you're breaking the signature on the ROM.zip
[HTC One X] Stix0rz:
Has anyone tried using a tool to give a modded ruu the same hash/signature as an official ruu? Imba nab here btw, I'm guessing the signature is a bit deeper than just the hash but I know that we can sign apks. Any other news xmoo?
[HTC One X] HebeGuess:
The sign apk for app is actually different case, they're replacing with own sign.. But on ROM the rom will verifying itself you can't fraud a sign by others people, the ROM will know and you was unable to replace it.
[HTC One X] wph:
Giving it the same signature will result in failure, when you change it, you need to sign it again but then you get a different signature. Something only HTC can do.
[HTC One X] godutch:
To crack the private key (needed to sign the ruu) it would take a trillion computers, each trying a billion keys(or a thousand times faster than present day computers) per second 2 billion years....

http://www.theinquirer.net/inquirer/news/2102435/aes-encryption-cracked

Some one will need to physically break into HTC HQ and steal the key to get it....
[HTC One X] DarkMio:
Your last sentence reminds me about our tries with the Motorola Milestone 1. The securitychain was much much more secure.

Our last hopes are still in reverse-engeneering and exploiting the bootloader. You can treat your enemy when you know his behaviour.
[HTC One X] Diamondback:
Please stay on topic guys!

Threac cleaned.
[HTC One X] xmoo:
I used that method to root my phone. It does work on s-off devices, but won't work on s-on devices.
[HTC One X] ste1164:
It also worked if you had an unlocked bootloader.
[HTC One X] Hunt3r.j2:
At this point it seems like these are the only possible methods, broadly speaking:

1. Bypass security to change the security flag.

2. Figure out a way to do what HTC's javacard would do, and exploit that to change the security flag.

3. Revolutionary-style hboot?

4. Something akin to Lazypanda and Juopunutbear, where a low level direct access eMMC mode is used to achieve S-OFF. This might not be possible for Tegra 3.
[HTC One X] DarkMio:
Sure that we mean the Same thing?

There was a guy who claimed that he can root his s-on phone with a bit modification from the modaco-method.
[HTC One X] ste1164:
A guy temp rooted it. He made the device boot loop i think so it stayed rooted. When the device turned on he lost root.
[HTC One X] Thunder07:
THIS WIll NOT GIVE S-OFF

ok i've got something useful for a change

HOX saves build-version(mainver) /dev/block/mmcblk0p9

in the first few byte... should we be able to edit it we'll be able to lower it and flash the HBoot Football/Xmoo posted<----BUT THIS SHOULD GIVE S-OFF IF WE GET IT TO WORK

note the i found a way to increase it but thats dangerous as you will not be able to decrease it

not only that the way the hboot checks for version is as follows

e.g 1.26.401.12

it only checks for the 1.26 and it does so individually

let say u try to update to 1.29 it will compare the 1 => 1 and 29 => 26 (the => means equal to or greater)

and will allow for update i was messing around and removed the dot and my version is now 1.29000.0.0

and it wont let me update using 1.29.401.12 which means until RUU version 2.x comes out i cant use them on my phone

also you can downgrade the version from 1.29.xxx.xx to any 1.29.yyy.yy but thats really useless as the mainver of the hboot is 0.87

Note This is Dangerous to mess with as you might lose the ability to ever use an RUU

To use the zip you must add in your cid "fastboot oem readcid" to android-info.txt

and also edit the mainver to your main version "fastboot getvar version-main" because if your version is 1.26 and you flash this it will become 1.29 and you'll be out of luck if there is no RUU 1.29 for your CID... but it doesnt have to be exact version 1.29.0.0 or 1.26.0.0 would work

I Repeat This Could Potentially Be Dangerous & I Take No Responsibility For What Happens

The Zip contains android-info.txt which you should edit and CWM recovery img as you need something inside for it to work

how to flash the zip

fastboot oem rebootRUU
fastboot flash zip MainVer_Hack.zip

or use RUU option in my tool

You've Been Warned

using "adb shell strings /dev/block/mmcblk0p9" will show mainver and radiover

With That Said again all this will do is be able to change MainVer no. but not the actual version,

it can increase but not decrease ,the trick is to get it to go down somehow...

all we need is be able to write the the 1st byte of mmcblk0p9 and we'll hit gold
[HTC One X] Jhinta:
Zo this makes your dev soff ?

Verstuurd van mijn HTC One X met Tapatalk
[HTC One X] Thunder07:
no where did i say it will....

but if we can lower mainver some ppl will be able to get s-off

but also risk breaking their phones as ali3nfr3ak did
[HTC One X] VIIRU§:
My hBoot is 0.96 is 1.29 a downgrade for me or and upgrade sry I'm just unsure I wanna try this
[HTC One X] MacSeoin:
Yes 1.29 is an upgrade
[HTC One X] VIIRU§:
So my best cance a s-off is to stay on 0.96
[HTC One X] Thunder07:
always the best chance is to stay on the lowest version, as you can update but not always downgrade

and 1.29 is mainver and not hboot
[HTC One X] miniterror:
Cant we change the main ver number of the s-off img? Then we can flash that as we give ut a higher number and therefore get s-off?

Edit: if you need a command tested lemme know, i have insurance on my phone and for 30 euro(own risc fee) ill get a brand new one

Edit2: maybe hex edit the s-off image to think its higher number

Verstuurd van mijn HTC One X met DroiDevs Premium
[HTC One X] Thunder07:
no because you'll break the signature doing so

and that file has to be flashed with a locked bootloader and be signed

while the file i uploaded contain nothing important like a hboot so it can be flashed with an unlocked bootoader without been signed

and hexing it will make it unextractable
[HTC One X] arabmed:
can help to locat cid

in AT&T HTC One X is located in mmcblk0p4
[HTC One X] Thunder07:
well for once SuperCID is useless to this cause...

it only helps in allowing us flash any RUU but i dont think it allows us to bypass version check,

2nd our mmcblk0p4 is used to store kernel,

3rd we cant dump out partitions but we have limited access to some like mmcblk0p9 first 11 bytes
[HTC One X] arabmed:
if we can chang cid to 1111111

if we can chang cid to 1111111 we can work wthe diag file
[HTC One X] Thunder07:
which Xmoo said are only for diagnostic and testing
[HTC One X] theDroidfanatic:
@thunder07 Awesome :D We are actually getting somewhere. So all we need to do is, somehow find a way to decrease the value. BTW how did you achieve S-OFF? I'm not asking to provide files and stuff, but which method did i use? Like diag+goldcard? Thanks :) thread search isn't working, or I would have searched, thanks :)
[HTC One X] Thunder07:
i dont have s-off,

Xmoo got s-off because he got his hand on the official htc diag files which ofc cant be released

however he did release a signed development hboot which allows s-offing

so if we can decrease mainvar we can flash that hboot and s-off then flash a newer hboot and keep the s-off

all in theory ofc as the last person who flashed that hboot ended up with a brick after flashing a newer hboot

why did he brick we dont really know.... but it could just be his luck
[HTC One X] theDroidfanatic:
Thanks mate :) but how did that guy flash the low hboot? How did he decrease the values? Doesnt he tell?
[HTC One X] Thunder07:
few lucky ppl got their device with s-off

they usually do that with reviews and so forth but just by luck they could have left it open for some reason
[HTC One X] tids2k:
btw @kholk i did not get any FC's while dumping .... have u looked into the partitions yet ?

---------- Post added at 10:24 AM ---------- Previous post was at 10:21 AM ----------

and also s-off partition dumps will be available soon, contacted one of my sources ...

@xmoo have u got in touch with @NZtechfreak he has one with a locked bootloader and s-off ? lol strange though but anyways ...
[HTC One X] nikorette:
That's factory s-off. He said it was a dev/review phone for his blog on one of the nz telcos
[HTC One X] N3m3515:
every s-off around is factory s-off because there is no cracked s-off yet