yashsingh1/xdaforums huggingface dataset:
[HTC One X] Chezbel:
Here is the link that @Beatastic sent me

http://bbs.xda.cn/thread-11044106-1-1.html
[HTC One X] xmoo:
Ive seen this method before and it did need Bootloader unlock through HTCDEV.

Gonna try the file to see what is in it.

EDIT:

boot.insecure

So you need to unlock HTCDEV.

Then this bat will install insecure boot and flash root.zip

So basically they made rooting a bit easier if you have a unlocked boot loader.

So no S-OFF.
[HTC One X] riemervdzee:
Just a weird idea I just had but, if you fastboot boot a recovery (so you have adb access) you might be able to read/write to some more specific partitions? I can't seem to understand why they blocked USB support in normal recovery mode
[HTC One X] richardtrip:
When you fastboot boot a recovery the kernel-mode is 1 instead of 2. Check my github to see how i fixed usb/adb in recovery (already fixed in a test recovery).
[HTC One X] Laurentius26:
Hi,

Thanks a lot.

I've tried this method as well and run the batch while my device was usb connected in storage mode.

All run fine but I've checked my bootloader and it's still locked.

usb debug mode I've enabled as well.

Thanks all people who participate here, awsom work. Hopefully it will be done soon and we will have S-Off for our devices too. :)
[HTC One X] riemervdzee:
Hmm very interesting, will check it out thanks. thanks for the works already. Ignore my previous comment then ;)
[HTC One X] WiZARD7:
or maybe tegra3 tablets? (I don't know whether there is S-OFF, for tablets also, or only for phones)
[HTC One X] xmoo:
S-OFF is for every HTC Android device ;) So also Tablets.
[HTC One X] matt95:
Better... Htc's tablets :)
[HTC One X] Stuart.upton666:
Okay guys, quick question.... I had the Nexus One... And it was s-on, yet I was able to flash the boot.img through recovery... How was that possible?

Sent from MoDaCo'd HTC One X
[HTC One X] joshnichols189:
Anyone see this?

http://xdaforums.com/showthread.php?t=1675882
[HTC One X] GabrielSousa:
its Qualcomm

we have Nvidia Tegra 3
[HTC One X] joshnichols189:
Yes I know, it was just a question.
[HTC One X] Sentinel196:
I mentioned 150 pages ago, and again 100 pages ago that we (someone with more knowledge than me) should speak to 'Condi', the guy who works on the Sony Tablet S (tegra 2).

He found a way to 'sign' modified zips so they can be flashed. Maybe it could give us some clues at least.

Not sure about Tegra 3 tablets though.
[HTC One X] DarkMio:
Signed and signed are different things.

Motorola did the: 'oh ****, you aren't signed, I won't work, you sucker'-way. With an incredible sign-chain via chipchecks.

HTC does the: 'holy shat, you? You don't have permissions, don't give me instructions to write anywhere anything'-way.

Did anyone checked the milestone1 hack? It uses a signed zip and reopens a second header in the zip, which doesn't belong to the first zip header, so the signkey is already valid, bit the instruction of the second header get opened and write everything everywhere.

If not, I have contact to the German guy who did this - maybe he can write us a valid zip.
[HTC One X] Sybregunne:
This is most probably the basis for securing the HOX

see attached pdf...

So the way to go about should be to get the secure boot key as in the tf 101 or find a way to exploit the process where our only hope is probably through the recovery...

if someone more knowledgeable can input something it would be great.

Edit: this goes in line with the notion that we need apx mode first. also for htcdev-unlocked users (especially with custom kernels) can you check the folder /sys/firmware/fuse/ lots of file there that might give more hints as to how to go about our mission...

I haven't unlocked and I cannot see the contents of the file. :D
[HTC One X] tids2k:
Here's what's in the fuse folder nothing useful though
[HTC One X] Sybregunne:
Can you open each file if it contains any info?
[HTC One X] theliquid:
Seems like another guy with an international HOX posted there too:

http://xdaforums.com/showpost.php?p=26618039&postcount=4

Claimed S-OFF by white-carding the international version.
[HTC One X] mattman83:
Its all masked.

M.
[HTC One X] mikep1993:
yeah but not the tegra 3 version ;(
[HTC One X] Sybregunne:
also did anybody who knows better try to find exploits with the

/proc/sys/kernel/real-root-dev

from what I read this moves the system root to a different device. After initrd the device would assign a real-root-dev some to physical disk or card and some to mem. I gather if we manage to tamper the initrd process we can recreate a device root directory and recreate everything from scratch (on the fly) and possibly bypass security?

Edit: More reading materials :D http://www.cvedetails.com/vulnerability-list/vendor_id-3090/Fuse.html
[HTC One X] theliquid:
doesn't this show the international version?
[HTC One X] mikep1993:
i can't tell you what the image shows, but it's posted in a thread for the dualcore edition.

http://xdaforums.com/showthread.php?p=26618039#post26618039

I've set up a small text but after i've seen that the thread is for the dualcore edition i was not sure if i shall post it there...
[HTC One X] tids2k:
Ok here's what in the files ... it seems like switches to me 0 -> on or enabled and 1 -> off or disabled

sec_boot_dev_cfg - > 0x00000011
sec_boot_dev_sel - > 0x00000000
odm_production_mode - > 0x00000001
device_key - > 0xffffffff
jtag_disable - > 0x00000001
sw_reserved - > 0x00000000
ignore_dev_sel_straps - > 0x00000001

for rooted devices or not rooted ( experiment )

you can try these commands to get the output

adb shell cat /sys/firmware/fuse/odm_production_mode > odm_production_mode.txt

adb shell cat /sys/firmware/fuse/sec_boot_dev_cfg >

sec_boot_dev_cfg.txt

adb shell cat /sys/firmware/fuse/sec_boot_dev_sel > sec_boot_dev_sel.txt

Also i would really like kernel dev's like @kholk and other known devs to have a look at this and see if we can get anything with writing onto this switches.

Please also see this patch which allows to read the fuses via sysfs ..

I hope someone will have a crack at it :)

---------- Post added at 11:23 AM ---------- Previous post was at 11:18 AM ----------

I would alos like to suggest to everyone, to stop pointing towards other threads not related with HTC ONE X .. This is ONE X thread, please do not get confused and make other confuse with HTC ONE XL or any other variant.

I really appreciate everyone's input into the thread, but guys due to useless and non-informative posts the thread has grown two-fold and it is very difficult for anyone to find the required information, i had to start from page 1 until i found the schemetics for NVIDA Tegra 3 on page 82. So please only contribute to the thread if you are a programmer or a modder and know what you are talking about.

@kholk

Could you try to implement this patch into your kernel and see if it makes any difference with the switches.

The original thread is here ...

http://nv-tegra.nvidia.com/gitweb/?p=linux-2.6.git;a=commitdiff_plain;h=4c92e4f2ac11913c4ba19
[HTC One X] leith51:
I copied and pasted the whole folder across to the sd card for the the hell of it as soon as I pasted the fuse folder the hox did a full reboot which was kinda strange tbh never had any other system info copied then pasted to the sd card cause a reboot!
[HTC One X] tids2k:
basically write protection error.

try the commands i posted above and post your output here, also note if you are on stock rom and kernel or custom rom and kernel.
[HTC One X] Htc_One_X:
What is odn_production_mode ?
[HTC One X] tids2k:
http://xdaforums.com/showpost.php?p=11888043&postcount=215
[HTC One X] lostunsunghero:
Hi,

I stopped following this thread from about page 30 because ive been busy with other stuff. Can someone summarise how far weve come since then so i can get an idea of how i can help.
[HTC One X] Evil-Dragon:
Those fuse files regenerate on every reboot. It pulls the data from the phone on boot. I would bet you can work with them in apx mode probably just not from that folder.
[HTC One X] richardtrip:
That patch is already in. You missed the

odm_reserved btw. Think that one is important. Hope anyone with s-off post the results.
[HTC One X] tids2k:
odm_reserved - > 0x0000000000000000000000000000000000000000000000000000000000000000

---------- Post added at 12:33 PM ---------- Previous post was at 12:02 PM ----------

It seems that the fuse cannot be programmed again , but information can be read from it. And that info is encrypted with an AES key :(

---------- Post added at 01:00 PM ---------- Previous post was at 12:33 PM ----------

also could someone explain this kmsgs to me ...

<6>[ 9.042331] nvavp nvavp: using SMMU at ff00000 to load AVP kernel

<6>[ 9.046081] nvavp nvavp: read firmware from 'nvavp_os_0ff00000.bin' (15212 bytes)

<6>[ 9.075813] nvavp nvavp: entry=00000094 control=00004930 debug=00005130 size=15188

<6>[ 9.076852] nvavp nvavp: AVP os at vaddr=c88c2000 paddr=ff00000 reset_addr=0ff00094

<6>[ 9.083660] nvavp nvavp: read ucode firmware from 'nvavp_vid_ucode.bin' (41956 bytes)

<6>[ 9.203424] nvavp nvavp: using SMMU at ff00000 to load AVP kernel

<6>[ 9.203707] nvavp nvavp: AVP os at vaddr=c88c2000 paddr=ff00000 reset_addr=0ff00094
[HTC One X] FordSierra88:
Hi Guys,

I like this video on youtube by chance and maybe it might help. :)

http://www.youtube.com/watch?v=y4uVGgwC4LE

Thank you for you hard Work :)
[HTC One X] KrisPerry:
I don't get it
[HTC One X] visor:
I don't believe that he created the Goldcard correctly, as the OTG does not appear to work with the phone booted to the OS. He would have gotten the CID of the 'SD' in the phone - it needs to be the CID of the external card (obviously).

This can be done with external readers, but they have to be of a certain type to work where the USB interface does not interfere.

Thanks anyhow though. :)
[HTC One X] tids2k:
Did you read the post regarding useless information being posted by users. You have done just the same. Did you see the video before posting your comments here ... " He had a Y cable and the USB card reader was powered via his computer USB. I dont know how knowledgeable you are with this process, but if you were you wouldn't comment on his video and put your useless thoughts here. You couldn't flash a zip in hboot until you have a gold card and he illustrated that in his video. It is actually a one step towards getting S-Off on our devices.
[HTC One X] NikMel:
I think that visor has a point cause this guy choses MMC0.

MMC0 is internal storage of hox and that means this goldcard was created for internal storage and not the external SDcard.

I don't believe this video and I agree with visor.
[HTC One X] Beatastic:
Isnt the Asus Prime Tablet also a Tegra 3 Device ? Why can't we use the method to root our HOX like they used at the Asus Prime ?

How to root

1. First you’ll need ADB access on your PC. If you don’t have this yet, install the Android SDK.

2. Next you’ll want to download the following two files:

NachoRoot

SU

3. Make sure you have enabled USB debugging on your Transformer Prime. This setting can be accessed via Settings>Applications>Development.

4. Connect your Transformer Prime to your PC via USB.

5. Now it’s time to fire up the command line. On Windows, open a command prompt and navigate to the ADB directory in the Android SDK (usually platform-tools).

Enter the following commands (enter after each line):

adb push nachoroot.bin /data/local/
adb shell chmod 777 /data/local/nachoroot.bin
adb shell /data/local/nachoroot.bin –stage1
adb reboot

(at this point wait for the tablet to boot)

adb shell /data/local/nachoroot.bin –stage2
adb reboot

(wait for the tablet to boot)

adb shell id

(if id result is anything other than 0, then start over)

adb remount
adb push su /system/xbin/su
adb shell chown 0.0 /system/xbin/su
adb shell chmod 06755 /system/xbi/su
adb shell /data/local/nachoroot.bin –undo
adb reboot

The next step is to open the Android Market on your tablet, and search for an app called SuperUser. Install it, and you’ll have full root.
[HTC One X] Polarfuchs:
That's only a root tutorial.

But yeah, we could look at other devices with tegra3, like the Asus Prime.

But HTC has made other security steps, to prevent S-Off i think.
[HTC One X] johncore:
Why not try it and find out? (spoilers - /data/ is mounted -nosuid..)
[HTC One X] xmoo:
I believe the boot loader is unlocked...

That's why it only needed just root.

Also it is easier to get in APX mode...
[HTC One X] Beatastic:
So, mates. I talked to some guys from China and all of them told me that the only way to get the HOX S-OFF is by white/gold card. In addition they told me that there is no "software" that can do it.

Here is what a guy told me

[Brush the agreement]

A Brush risk, please be careful. I am not due to customer improper operation (such as the Brush move data lines, broken network, computer crashes by external factors) caused by the brush unit responsible for the failure

Second, I brush machine to ensure that buyers of the basic functions of mobile phone systems are using the normal; but does not guarantee the compatibility of the system and other non-formal third-party software; nor the Baoding ROM perfect ROM bug I can not brush machine control, only by the stability of the brush several times and Forum Rating to determine the use of ROM recommended brush.

Third, due to personal habits and aesthetic is different, I can not guarantee the buyer to upgrade the new system fully satisfied. Very few buyers brush good features are normal, but the new feel that the systems are not used to, I understand the nostalgia, but this I am not responsible for the free brush back, buyers want after a good shot;

Four, Andrews software can be installed on the 91 phone assistant or pea pods, software to download, I am not responsible for the installation of mobile phone software;

5, the purchase of the service thereof as clearly and agree to the above protocol.

By the way : I think it is a Google translation, so I think "Brush" means "root" and "Andrews" means "Android". Maybe this can help you guys !
[HTC One X] angusc:
@beatastic,

What location in China is he and do you have a shop address that can be visited?

Ps. Brush usually means flash.

Sent witH desire from OneX
[HTC One X] Chura:
Wait, so we can gain root but not S-OFF ?

currently no root option for locked devices, correct me if i'm wrong.
[HTC One X] Evil-Dragon:
Of course any one in China will say that white card is the only method because no one else has done their dirty work for them and they have no other methods to pinch like Revolutionary. Again this won't help the masses even if you get your own phone S-OFF. Root will help us in the quest for s-off however without a point of entry to exploit we are grounded. I started some of the radio disassembly the other day. I've not really found anything of interest to be honest. I was hoping that we could exploit the radio flashing method and inject our own version that either bypasses or forces the flag change from the radio side without touching hboot. I have a feeling the radio is signed like other core areas but it deserves a look at.
[HTC One X] GabrielSousa:
one x Qualcomm

have a tool for supercid http://xdaforums.com/showthread.php?t=1672284
[HTC One X] jureca:
works in one x?, which is the file to download?, thanks

Enviado desde mi HTC One X usando Tapatalk 2
[HTC One X] leith51:
It's for one xl
[HTC One X] GabrielSousa:
yes, like i said on my #2241 post.

but maybe we can port to your ONE X Nvidia Tegra 3
[HTC One X] jureca:
ok, hopefully you can ;) Thanks

Enviado desde mi HTC One X usando Tapatalk 2
[HTC One X] GabrielSousa:
i'm on my recording studio, tomorrow i will try to port ;)
[HTC One X] jureca:
Hopefully you get lucky, thank you very much

Enviado desde mi HTC One X usando Tapatalk 2
[HTC One X] wtfhax:
It has already been discussed starting from page 212. If i remember correctly the CID is located in some other block which cannot be written.

[Not for tegra 3 HOX] http://xdaforums.com/showthread.php?p=26516911#post26516911
[HTC One X] GabrielSousa:
well its very easy...

if some one can try now, get the file

this copys the file to sd card

"adb shell "su -c dd if=/dev/block/mmcblk0p4 of=/sdcard/tmp/mmcblk0p4""

copy the file to a linux machine and convert it to text

"xxd mmcblk0p4 mmcblk0p4.txt"

search the file for your CID

---------- Post added at 09:43 PM ---------- Previous post was at 09:42 PM ----------

what a unlucky.... can be written on XL and not on X :(
[HTC One X] Chura:
the point is to gain S-OFF without HTCdev isnt it ?

cuz obiously we cant use SU for now.
[HTC One X] Nubzori:
I'd be happy even with htcdev unlocked s-off :D
[HTC One X] mattman83:
We went through all this when the One XL exploit was first found. It definitely does not work on One X.

M.
[HTC One X] :
If you guys ever need help, like low level stuff, visit the Wildfire S devs. Trust me, we're very close. Contact me if you want more information.
[HTC One X] GabrielSousa:
our mmcblk0p4 dont have CID information

---------- Post added at 10:59 PM ---------- Previous post was at 10:50 PM ----------

i will search in all blocks ;)
[HTC One X] nicemblem:
I prefer to flash a boot.img rather than a S-OFF device:D
[HTC One X] mattman83:
It's in 26, but we can't write to it.

M.
[HTC One X] leith51:
Which ones can we write to?
[HTC One X] GabrielSousa:
mmcblk0p26 ?????

---------- Post added at 11:08 PM ---------- Previous post was at 11:05 PM ----------

theres no mmcblk0p26

---------- Post added at 11:55 PM ---------- Previous post was at 11:08 PM ----------

Wildfire S is Qulacomm

---------- Post added 29th May 2012 at 12:10 AM ---------- Previous post was 28th May 2012 at 11:55 PM ----------

i did search on all blocks, and didnt found CID info,

must be coded :(
[HTC One X] Rekoil:
Just to clarify for everyone: mmcblk0p26 is not a partition that exists stock. It can be bound to the correct area of the nand by the kernel, but it is not writable by the kernel.
[HTC One X] GabrielSousa:
how we read it ?

with blubbers kernel ?
[HTC One X] kruppin:
Please stop posting things about S4 One X. Their hboot have less security since they have been able to root without htcdev-unlock. And also, since it's a completly different soc the s4 hboot probably only share a few things with ours. Getting perm-root on the tegra version without unlocking (or a s-off exploit) just doesn't seem that likely since every change to /system is undone on reboot.
[HTC One X] pa64:
Get lost please.
[HTC One X] leith51:
???? Why ?????
[HTC One X] tids2k:
how is this post helpful in development :mad:
[HTC One X] mattman83:
To be honest this whole page is a waste. The only conversation is responses to someone demanding a progress update and people trying to work on something that was covered a week ago.

The whole thread needs a clean out, possibly even a new thread in dev and close this one.

It's been said a million times - if you don't have something constructive to post then please just do not post. The amount of clutter and BS in here just makes it harder for the real devs to do their work.

M.

(I was even thinking about not posting this just because it adds to the chaos - but it really needs to be said again)
[HTC One X] Sentinel196:
Guys, rather than posting comments and adding to the clutter. Just report the pointless posts to the mods so they can delete them :) Works a charm!
[HTC One X] Evil-Dragon:
It's just either people are too lazy to read the thread before posting or think that the XL = X. It's not, it's a different device entirely. It's like comparing a Ford to a Porsche.

All their exploits won't work with ours, different chipset. All the old exploits don't work, that includes revolutionary, junonautbear, gold card.

We don't know how to get into apx mode, no volume + & - and power doesn't work. The battery pull method has been tried.

The misc partition can only be seen with a modified kernel, no we can't write to it.

All other questions in this thread should be directed to an appropriate Q&A thread in that section. Lets keep this thread for development and stop posting the same information over and over. It's annoying.

If you want to do something useful start probing the hboot/radio/fuse for exploits. Only one person has done any additional analysis to the hboot i posted, that's a shame. Similarly try getting a serial connection to the radio and post any findings.
[HTC One X] N3m3515:
pleeaaaaassssseeee keep that one xl out of this topic... this has discussed so many times... its qualcom and we have tegra 3... their methods wont work with our phone... period
[HTC One X] xmoo:
Anyone got a example how 26 should look like, or what the output should be?

EDIT:

The chinese are playing with the radio "\system\etc\QUO_6260.fls.clean".

But this would be no use to get S-OFF, since the radio is working different now, compared to the past.
[HTC One X] N3m3515:
could this help us? http://xdaforums.com/showthread.php?t=1678084
[HTC One X] GabrielSousa:
how we probe the hboot/radio/fuse for exploits ?
[HTC One X] mattman83:
This has been covered dozens of times. XTC clip is no longer being actively developed so does not specifically support our phone, plus we don't have the diag files for it anyway.

Please, go back and read the thread.

M.
[HTC One X] tids2k:
that was just the schematic i posted, @matty did u mean any diag file or one for our device ?
[HTC One X] mattman83:
Isn't XTC reliant on the htc diag files same as white card? I thought these were specific to phone, but it's not something I know a heap about.

M.
[HTC One X] tids2k:
Evil, i am not sure if you have a USB2Serial interface cable .. if you are interested here is a program which will let you connect to the phone and issue AT commands. The drawback is that you need

1. USB Host support enabled in the kernel

2. Emulate a virtual port on the pc ... Else it will not work.

Cheers,

I tried running radio commands in the shell but it doesnt seem to work.

Also while working with the radio i came across this references

http://android.serverbox.ch/?p=370

http://code.google.com/p/android-serialport-api/

Now with the serialport api it seems only ACMx0 is active, others i am not able to open due to permission errors although i am on an unlocked bootloader with root.

Any clues ?
[HTC One X] tids2k:
@xmoo i saw Laurentius26 in this forum, i know you guys are good friends and have good HTC contacts.

Could that help us to achive S- OFF ?
[HTC One X] xmoo:
Laurentius26 is getting to know Android. This is his first Android device, he was a Windows Mobile lover. He is learning the OS.

And believe me, if our contacts could help us, we'd already shared it ;)

EDIT:

Anyone tried Tacoroot in combination with misc_version?

How It Works
HTC left the recovery log world writeable, so all we have todo is delete it, symlink
it to the non existant file /data/local.prop and reboot to recovery. Recovery will
write a new log, allowing us to set ro.kernel.qemu=1 and reboot. This will make the
phone believe it's an emulator, and run adbD as root. While the phone will be highly
unstable, and may not fully boot, you will have a root shell with adb.

misc_version [-h|-?|--help] [-v|--version] [-s|--set_version <VERSION>]
-h | -? | --help: display this message
-v | --version: display program version
-c | --cid <CID>: set the CID in misc to the 8-char long CID
-s | --set_version <VERSION>: set the version in misc to the 10-char long VERSION
-r | --setRUUflag <on|off>. Set of clear the RUU flag

I'm having someone with S-OFF dropping #17, misc.img
[HTC One X] xmoo:
http://onexroot.com/one-x-root/root-any-htc-one-x-windowsmaclinuxattinternationalone-click-method/

Root HOX. Anyone tried this version? I'm at my internship.

I think it is a S4 HOX and HOXL
[HTC One X] andreyxxl:
tested yesterday, confirm NOT working
[HTC One X] theliquid:
Can also confirm not working ...
[HTC One X] xmoo:
Just checked the files and it is the Tacoroot method.

So ignore my last 2 post, won't work. http://xdaforums.com/showpost.php?p=26699099&postcount=2278