yashsingh1/xdaforums huggingface dataset:
[HTC One X] BeciMester:
If you know a bit of ARM assembly, look over the hboot/radio code and try to find programming errors we can exploit. Assembly is not as hard as it seems, I find it much more straightforward than object-oriented languages. There are plenty of resources available on the net, but I can link some too if anyone's interested.

If you feel it's not for you, you can still help. Try the hardware side: test key combinations with the phone plugged in/not plugged in etc., build cables, and so on. Read back this thread to see what was done already, and try to think of something that hasn't been done. Make sure you document everything! No point trying things randomly.

Collect all your findings and report in this thread. THIS is what the thread should be about.

As for me: I've found a little difference between hboots 0.95 and 0.96, it's part of the SIM unlock routine. I don't know how important it is, I want to see exactly what it does before posting it.

Edit: typo

I'm on my 1X...
[HTC One X] tids2k:
While checking the diag files for wildfire and salsa I found out that the s-off was achieved via gold card and hence I am a bit more focused on giving it a try. The simlock and security lock was disabled by issuing AT commands. I am in sydney and a bit hard to find a y cable for otg; purposes. There were also references to a third mfgkernel boot besides hboot and fast boot. And also the OEM -34 -72 fast boot commands. I tried to put the diag *.nbh onto emmc and tried but it wasn't detected. But if compared both diag files they had the same RAW1 signatures. One more thing while running ARUWIZARD.exe I found a file icx.dll which had a link to verisign link to a signature key. Could that be the AES key the partitions had been encrypted with.

I m not really that smart with IDA but could give it a try if you can point me to the right direction.

With the key combinations I tried several times and I did had three different drivers that showed in device manager. But I don't think they contributed towards anything to do with APX mode.

1. Android device -> HTC Android Interface

2. HTC Mass USB drive

3. HTC Cd-Rom drive. (????????)
[HTC One X] Drefsab:
im quite curious about the htc cd-rom driver, its clearly incorrectly labled (perhaps deliberately) and would love to find out what it really is.
[HTC One X] KevinB88:
http://forums.androidcentral.com/verizon-droid-incredible/122091-computer-thinks-sd-card-cd-rom-drive.html

look here
[HTC One X] freaked9:
An unlock tool for the ASUS Transformer Pad TF300T (Tegra3) was released, it's an apk running on android.

I was not able to install the file, but maybe someone can look into it if there's anything what can help.

http://www.asus.com/Tablet/Transformer_Pad/ASUS_Transformer_Pad_TF300T/#download
[HTC One X] pdagenius:
The question has already been asked
[HTC One X] Evil-Dragon:
We need to stop looking at other brands/devices methods. It won't work on the One X, period. HTC built the security on this device on top of an already difficult security model with the HTC Sensation. People were caught off guard when they started tackling the Sensation security and found how much more difficult it was compared to previous devices. We are looking at the same here. The One X security model will be harder than the previous flagship, even more so when it's a completely different chipset.
[HTC One X] blubbers:
I disagree, other tegra devices can get us some intel, it was worth checking out the transformer unlock app.

Has anyone taken a closer look at the usb port? I belive it is a hdmi/usb (EMU) port. I cant see the pins on the upper side, but on other htc devices it contains additional 7 pins, of which two can be used tx/rx for rs232.

Ive ordered a hdmi cable for the sensation, will get it tomorrow to check the pins
[HTC One X] riemervdzee:
I believe that these extra pins are replaced by the pogo pins
[HTC One X] Kickasskev:
Ok to be honest I dont have a clue about programming etc but

Wouldn't there be a way to exploit the s-off through the OTA updates, for example once they are downloaded to phone save and apply later, is it possible to then open these upadates up and see whats in them, because the 1.29 has a new radio etc which needs the s-off to be applied right?, so is there any info in the update package that would give any clues as how to remove the s-off for a period of time while the update takes place?

And if so would it be possibe to alter the file/files for it not to re-aply the s-on once the update is complete.

Does this sound silly or does it just not work like that?
[HTC One X] N3m3515:
it does not sound silly. but the files are signed and if you change a file in there the signature is broken and they wont get flashed.
[HTC One X] pdagenius:
I would suggest you spend some time reading before you ask more questions friend :)
[HTC One X] joll200x:
we can't change the HTC signing keys obviously - but for the device to verify the update as being offical the HTC public key must be on the device somewhere already or requested on the fly? I'd love for it it to be as simple replacing that key and resigning a package - but I guess if the keys are on the the device they're probably in a masked partition.
[HTC One X] mattman83:
The signature on the files generates a hash, the bootloader knows what the hash needs to be but does not know the actual signature. That is how most things like this work (including that little chip on your credit card).

M.
[HTC One X] joll200x:
Other way around I think isn't it - the hash of the file is signed because that only requires knowledge of HTCs public key and can guarantee file integrity and authenticity. For the hashes to be known by the bootloader, this would mean HTC would have to know the hash of every OTA before they have written it (impossible!). Once the signature is verified, the hash (MD5, SHA1 etc) will verify the integrity of the file.
[HTC One X] Rekoil:
The signature checking process is based on the principles of private/public key encryption. In order to encrypt a piece of data in this manner a private key is required, but any public key generated by the private key can decrypt the information. In our case the packages aren't encrypted as such, but the signatures work in exactly the same way.
[HTC One X] joll200x:
that's what I was leaning toward - if we can find and replace the HTC OTA server public key on the device and then resign an OTA package (provided it's signed with a detached sig and not encrypted) we could potentially get system software in that way? If the keys are on the device though, I bet they'll have the right permissions set =/
[HTC One X] blubbers:
If you can change the public key, you can disable signature checking all together.....
[HTC One X] joll200x:
true - and I have no idea what the mechanism is for the checking on this device. But I have seen instances in other linux systems where the binaries for signature checking are all bulletproof, except when it comes to reading the public key from a world-writeable keyfile. Just throwing it out there as a thought really.
[HTC One X] angusc:
I saw another thread where someone reporting to be an HTC employee responded. I pm'd him and he replied with Another Taobao link. I'm unable to get full access to the web page at my current location.......can anyone check it out and if there is a Chinese speaker around can they contact the shop and find out if it is genuine and by what method....

http://a.m.taobao.com/i14678398161.htm

Sent witH desire from OneX
[HTC One X] agento:
People really should read the thread before posting.
[HTC One X] Bonzo87:
Nobody will read through more than 200 pages. Somebody should summarize the "results" and update the initial posting...
[HTC One X] pdagenius:
It's a fair point - where we are what we have looked at, the links where we are going/looking at...

It would be a huge help
[HTC One X] kryptoner:
Yeah, op please update your post and avatar :D:D:D
[HTC One X] xmoo:
Regarding the Tacoroot method http://xdaforums.com/showpost.php?p=26699099&postcount=2278 , here you have mmcblk0p17 from a S-OFF HOX as misc.img

Havn't had time to check it tho!
[HTC One X] xmoo:
On the G2 Root, they found S-OFF in mmcblk0p7

Here is a dump from a S-OFF HOX mmcblk0p7 as pg2.img

http://www65.zippyshare.com/v/30841118/file.html

Havn't had time to check it though
[HTC One X] NikMel:
On our phone we should check mmcblk0p9 partition here where we can do somthing with S-OFF.
[HTC One X] tids2k:
it is all masked , how did they find it ?
[HTC One X] xmoo:
What makes you think mmcblk0p9 should be it.

I believe mmcblk0p9 was system.

how did they find what?
[HTC One X] tids2k:
I am already root what to do with this misc.img ?

how to use the misc_version command with the misc.img ?
[HTC One X] GabrielSousa:
BLOCKS from 1.28.161.9 HOX S-ON

​

system is mmcblk0p12
[HTC One X] GabrielSousa:
mmcblk0p9 only has this​
[HTC One X] xmoo:
Just the software number? :S

What about 26, I asked a couple post back why the guy said it should be in 26.
[HTC One X] GabrielSousa:
we need a special kernel to have access to 26 :(

i can only see 1 to 20 :(
[HTC One X] xmoo:
Maybe people with S-OFF can see it. I PM'd a user with S-OFF to see if he can get access to it. But if no one can access, how do you know there is something in 26?
[HTC One X] Chezbel:
Is there anyone following this thread with an s-off phone that can dump all the partitions?

Sent from my HTC One X
[HTC One X] tids2k:
OK i found something :-D

This is a part of CID -- (When you get unlocked from HTCDev your CID becomes None)

and its in part mmcblk07

going to try now with the misc.img @xmoo provided
[HTC One X] GabrielSousa:
no my frind the command do know your CID on HOX is:

fastboot oem readcid

---------- Post added at 03:02 PM ---------- Previous post was at 03:00 PM ----------

i think blubbers can dump the mmcblk0p26
[HTC One X] tids2k:
yes, i know that matey, but i was trying to show here was the location where the CID gets changed to None after unlocking the device. It might be a location of the offset to unlock the phone ?

---------- Post added at 03:06 PM ---------- Previous post was at 03:05 PM ----------

and btw the my CID show both None and OPTUS001

@xmoo ur misc.img has this

<code>0000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................

*

0001440: 0100 0000 0000 0000 0000 0000 0000 0000 ................

0001450: 0000 0000 0000 0000 0000 0000 0000 0000 ................

*

00023f0: 0000 0000 0000 0000 0000 0000 464e 4f43 ............FNOC

0002400: 0000 0000 0000 0000 0000 0000 0000 0000 ................

*

0007000: 312e 3132 3034 2e31 3035 2e31 3400 0000 1.1204.105.14...

0007010: 0000 0000 0000 0000 0000 0000 0000 0000 ................

*

01ffff0: 0000 0000 0000 0000 0000 0000 0000 0000 ................</code>
[HTC One X] GabrielSousa:
we need some one to Reverse Engineering the blocks,

any one knows how ?
[HTC One X] tids2k:
and this

0000000: 312E 3238 2E31 3631 2E39 0000 0000 0000 1.28.161.9......
0000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
*
0001000: 312E 3132 3034 2E31 3033 2E31 3400 0000 1.1204.103.14...
0001010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
*
03ffff0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
[HTC One X] Fightspit:
I remind you that the block mmcblk0p11 store the HTC splash screen. You can compare it from the splash1.nb0 from a RUU, they are the same.
[HTC One X] xmoo:
shell@android:/ # dd if=/dev/block/mmcblk0p26 of=/mnt/sdcard/26.img

dd if=/dev/block/mmcblk0p26 of=/mnt/sdcard/26.img

/dev/block/mmcblk0p26: cannot open for read: No such file or directory
[HTC One X] johncore:
Here's 26, and the kernel mappings you'll need:

http://xdaforums.com/showpost.php?p=25788378&postcount=1295

edit: lol 10 pages ago:

http://xdaforums.com/showpost.php?p=26548082&postcount=2152
[HTC One X] xmoo:
Anyone able to make the kernel?
[HTC One X] johncore:
http://xdaforums.com/showpost.php?p=26549151&postcount=2154
[HTC One X] GabrielSousa:
we need the ram disk, right ?
[HTC One X] Rekoil:
It is HBOOT that does all the signature checking, and we can't replace HBOOTs public key because we need a modified and resigned HBOOT to do that, which we can't get. The possibility here is to find an exploitable error in HBOOT itself which could be used to fool HBOOT to check for the signature somewhere else than what it is flashing for example, but this is an incredibly difficult task.

As has been discussed, we need a special kernel to map the partitions, whether you have S-ON or S-OFF will not make a difference if you are running the same software. S-OFF users would likely be able to write to all of the partitions that the kernel can see though, but you would still need to map them in the kernel so that the operating system can see them.

The ramdisk only contains code for initialising the higher level android stuff, the mapping of the actual partitions to locations on the nand takes place in the kernel. In short, grab whatever ramdisk you want, or rather, whichever one works with your ROM.
[HTC One X] GabrielSousa:
how we flash the zimage ?
[HTC One X] jonas2295:
Inject it into your boot image
[HTC One X] GabrielSousa:
i will do it on kitchen ;)

---------- Post added at 05:27 PM ---------- Previous post was at 05:20 PM ----------

blubbers, your kernel dont boot :(
[HTC One X] GabrielSousa:
well...

the kernel dont boot....

blubbers, can you make one that boot :D
[HTC One X] NikMel:
I tried to overwrite mmcblk0p9 with a fake/orig stock version but this partition is write protected.

I did that by calling dd but no luck.

About mmcblk0p26 there is no mmcblk0p26 that I can see or find?!?!?!

---------- Post added at 07:05 PM ---------- Previous post was at 07:00 PM ----------

below is all we have on hox:

APP -> /dev/block/mmcblk0p12

CAC -> /dev/block/mmcblk0p13

DLG -> /dev/block/mmcblk0p19

DUM -> /dev/block/mmcblk0p16

ISD -> /dev/block/mmcblk0p14

LNX -> /dev/block/mmcblk0p4

MSC -> /dev/block/mmcblk0p17

PDT -> /dev/block/mmcblk0p20

PG1 -> /dev/block/mmcblk0p6

PG2 -> /dev/block/mmcblk0p7

PG3 -> /dev/block/mmcblk0p8

RCA -> /dev/block/mmcblk0p3

RFS -> /dev/block/mmcblk0p18

RV1 -> /dev/block/mmcblk0p11

SIF -> /dev/block/mmcblk0p9

SOS -> /dev/block/mmcblk0p5

SP1 -> /dev/block/mmcblk0p10

UDA -> /dev/block/mmcblk0p15

WDM -> /dev/block/mmcblk0p2

WLN -> /dev/block/mmcblk0p1
[HTC One X] Fightspit:
You need the modules from blubblers's HOX
[HTC One X] GabrielSousa:
Did he share de modules ?
[HTC One X] Evil-Dragon:
You missed our elusive friend... EBT ;)
[HTC One X] NikMel:
and you mean ...?
[HTC One X] Evil-Dragon:
EBT = HBoot partition

It's elusive because it's been difficult to find, but it does exist and is called EBT.
[HTC One X] NikMel:
and I thought you meant that this system had no EHboot.. :)
[HTC One X] blubbers:
No you don't.

But you need to pack the zimage with a ramdisk, you cant flash only the zimage. Take a look at fastboot flash raw:
[HTC One X] GabrielSousa:
i did that and my HOX didnt boot with your kernel :(
[HTC One X] pewpewbangbang:
just wondering if we're still really far off from S-OFF and if it's even possible?

thanks
[HTC One X] GabrielSousa:
we are so far way :p
[HTC One X] agento:
Not to derail the thread, but a 5 second search of THIS thread (not even XDA) for "Taobao" shows this was suggested, investigated and ruled out as a valid S-Off method.

THIS is why the thread is over 200 pages.

And yes, I appreciate the irony of posting this!
[HTC One X] Rekoil:
We are neither far away nor close to a solution. Once we discover something usable it probably won't be that long until S-OFF is achieved. But one simply cannot put a date on when (if) that will ever happen.
[HTC One X] blubbers:
some info on the mmc:

csd:

d0 27 01 32 0f 59 03 ff f6 db ff ff 8a 40 40 00

ext_csd:

00000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000003000800000000000000000000000000
00000500000012301211201000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000d10100
030001010000051f0100001000110000000000000000000000000000000000000500020007000201
00000000000000000000000000e0a30300110007074001010107100007111b150200000000000000
001e00000000003c0000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000001030100000000000000

sectors (à 512 bytes): 61071360 (-> 29820 MiB)

write protectd sectors: 16928 (-> 8464 KiB)
[HTC One X] n1kon:
Xmoo,

Any chance of adding tried and tested section to the first post as I'm starting to lose track with what's been tested.
[HTC One X] xmoo:
Would be a good one.

But thing is I was on holiday and am very busy for school (deadlines, end semester). So no time reading back.

If anyone want to do that, be my guest
[HTC One X] Cney:
Couldn't find if this was allready said but niceppl did an unlock on his rogers HOX and it turned s-off http://xdaforums.com/showthread.php?t=1645002

as i am aware that this Rogers HOX is probably the same as the AT&T one and so the hardware is different. it is weird that it turned s-off just bij doing the HTC-Dev unlock.

we should look into if he used a different set of platformtools or not. if he didn't might be that HTC-Dev really did something usefull for a change
[HTC One X] TeniusGG:
forget about this
[HTC One X] Evil-Dragon:
I tried locking and unlocking twice with a new unlock_code.bin from HTC, no change to security and still S-ON.
[HTC One X] fezza:
I find it interesting that when you look at that guy's 'proof' screenshot, the S-OFF bit is so straight compared to the rest of the slanted text that's taken at an angle. I wouldn't be surprised if it was shopped :p
[HTC One X] tids2k:
things aside, has anyone tried blubbers kernel yet ?
[HTC One X] GabrielSousa:
i did, dont boot :(
[HTC One X] MySam:
Xmoo,

I'm cheering this thread from the sidelines from Page one, it's entertaining yet interesting to say the least :D

Any donkey work needing done, pm me :cool:
[HTC One X] xmoo:
Weird, he is S-OFF but no SuperCID.... So don't know if it is fully S-OFF
[HTC One X] GabrielSousa:
maybe he didnt change his CID ;)
[HTC One X] xmoo:
He, or the unlock tool?

When you S-OFF it is not up to you if you want to or not SuperCID, SuperCID is part of S-OFF.
[HTC One X] GabrielSousa:
I did soff my sensation. And didn't change my cid. I had to do it manually
[HTC One X] ErrorInLogic:
this is true
[HTC One X] xmoo:
Never had a sensation, but on WM and WP7 and my earlier HTC Android phones S-OFF was directly SuperCID.
[HTC One X] GabrielSousa:
we have to do

fastboot oem writecid 11111111
[HTC One X] ErrorInLogic:
^^^this^^^
[HTC One X] Evil-Dragon:
Wasn't large enough for me to be able to read. ;)
[HTC One X] GabrielSousa:
Lol
[HTC One X] matt95:
for the sensation they were 2 different things...
[HTC One X] raimondomartire:
for the bind partition we need kernel upgrade

http://git.kernel.org/?p=linux/kern...it;h=371a689f64b0da140c3bcd3f55305ffa1c3a58ef
[HTC One X] gffmac:
Is it possible for one of the devs in the development thread to incorporate this into their kernel?
[HTC One X] blubbers:
No we do not
[HTC One X] GabrielSousa:
i cant boot with your kernel :(

what im missing ?
[HTC One X] kholk:
Doing.... It will hopefully be in the EternityProject Kernel for HTC One X v0.92b.
[HTC One X] GabrielSousa:
good news !!!
[HTC One X] steve36:
from reading post aftear post from the begining at&t chipset is different
[HTC One X] bornsummer:
I hope, this comment (5 hours ago) wasn't the last one concerning the fight against the s-off problem...
[HTC One X] Evil-Dragon:
It's one that is a difficult nut to crack. It's a case of trying all different avenues and trying old exploits first that have worked with old devices. It's going to take a while, but chances are someone will figure it out of the blue without XDA.
[HTC One X] xmoo:
Im talking to all my connects... Trying to get a ENG HBOOT for the HOX...
[HTC One X] Supaiku:
Exactly the same. It goes through the site from what I can tell.

---------- Post added at 11:18 PM ---------- Previous post was at 11:18 PM ----------

They check for updates.

All indications are that it uses the htcdev site.

After all, it gives the same warning information.

Sorry. it might have been a little off the S-off topic. But it clears up what one of the xda.cn threads was talking about.

I'm going to translate the pictures from the taobao seller this evening (CN time).
[HTC One X] :
Sounds shady to me. Sounds like they know something we don't about warranty.... And snuck around and decided to charge. Just an opinion
[HTC One X] tids2k:
Simonsimon are u good with hardware modding ?????

Sent from my HTC One X
[HTC One X] ytwytw:
Just saying, the hardware method may work on HTC ONE X LTE (cuz its qualcomm, not tegra3), not the international version

I will see if there is sth pin fun there

And this hardware mod is exactly same as Sony Ericsson android phone unlock ( I have the setool3 and I've done similar for several times...)

I'm getting the Rogers One X this coming weekend, will continue on researching s-off via smartcard... (cuz this has been proven works!!!)
[HTC One X] tids2k:
It will workk only if you have a microSD card slot, then you could just ground the wire with the microSD card slot. But it seems its not possible with the new phones and hboot's.

Sent from my HTC One X
[HTC One X] tids2k:
Sent from my HTC One X
[HTC One X] tids2k:
You can unlock the tegra 3 HTC one x using lgtool2 ... But only simunlock right now.

Sent from my HTC One X
[HTC One X] kholk:
Thanks, but I already know what the BCT is :P

The problem is that we can't access APX Mode at all, at least for now :\
[HTC One X] dansharpy:
Have you got any more info on this? The main reason i want S-OFF is to network unlock!!
[HTC One X] BigladUK:
You could just pay £1.44 here http://xdaforums.com/showthread.php?t=1613613 and save yourself all the trouble ?

Si
[HTC One X] dansharpy:
Yeah ive done that but still waiting for the code and im impatient :)
[HTC One X] tids2k:
If anyone interested

My token ID

The Unlock code, and signature key (extracted via rev-skills) . Not sure about the signatures as it might be the same bin file.

---------- Post added at 12:36 PM ---------- Previous post was at 12:33 PM ----------

a4f6327b013911e8a1fa87376f10a178
d0fee500f4261135b6da0d46406cfe9c
ca92e05fd1af0fbe259e6f330f9785fc
6e99528b31c27990c165c08bba5c4c1b
afadcfa854ff67b17ef1bd68975c224b
195da857ad79e1b2a866df6b928d52e3
faf2d972b3aeab3bda48a347d852c3ed
237c0c48f7357f0fe0df0ab0b4d24c90
1b278a87995a013c71885c5835321c2d
82dc09aad31ad8921dcc5900c6123f88
283028b1dee67d22eecea280cec74461
9d5f2064b4315b6a795205743a2dc5b0
231a101e35fa8a8ccf98a744f6d643c8
2d63752c2a8a8917957d11a1ac3b148b
fff6941a160c6932960e2602876400d4
639b3318da2a75df8501c0430a4b682e
[HTC One X] tids2k:
the funny bit here here, i dont know why i am suspecting that HTC is in fact using a goldcard method here, it is the same process of making a goldcard except that they give u a .bin rather than a .img file to flash your bootloader.

Interesting stuff :-) i have uploaded my token file and key .. if anyone interested viperbjk we need you here . lol btw he is the main brain behind the goldcard scene :D and especially the rev-skillz prog designer.
[HTC One X] ytwytw:
It could be use USB host mode...

Probably similar step as HD7

A OTG Cable should be worth for a try...
[HTC One X] ytwytw:
You could pay that taobao seller ¥200 Chinese dollar to get soff unlock :P