yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
My assumption is that it has a specific boot process that you can't modify without being s off
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
Your assumption would be correct. Before we can do anything, we have to get that wp off or bypass it some how. But, I doubt we will be able to by pass the wp.

Feel free to correct me if I am wrong, anyone.

Sent from my HTC One XL cellular device over clocked to 1.9Ghz
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Yes, and the wp is disabled with a emmc-powercycle. A power cycle is done by resetting emmc WITHOUT resetting the device. If the device resets power on wp instantly reapplies itself. So, why don't we find a way to power cycle emmc? First, way out of my league. Secondly, Beaups and I were discussing it, and he was talking of the emmc reset pin built into all boards, he also said that newer devices all have the emmc reset pin connected to the system so if you find the pin and short it, it also resets system, so wp instantly reapplies itself. So I went digging thru jedec manuals and found not only is he correct, but the same safety measure, linking emmc reset pin and system reset pin to prevent hardware exploits, but it also functions the exact same way if we came up with a emmc reset by software exploit. So, in a wrap, the one GUARANTEED methods of removing wp is super patched hardware and software side. We just need to keep plugging away at theories, and if you can, if you have an idea, something to test, see if its something you can try yourself, it will give us more results and less theories, and we ALL learn a ton along the way. I got pulled here from beaups, rpomponio, and niceppl looking to test something for them one night and I've been locked in ever since and have learned more than I ever thot possible in a very short time:D so think, test, post, play.........people do this for free because its fun(even I forget that sometimes:beer:)
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
We have a guy who completely restored his note via qpst from qhsusb_dload: http://xdaforums.com/showthread.php?p=33545892

He re-assembled everything from the ground-up. Has anyone looked into that at all?
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
I'm the same way, Absolutelygrim got me hooked on learning everything there is to know shortly after I became a member on this site. And projects like this make me want to learn faster so I could possibly be of some use. I'll keep plugging away at my brain and see if i can't test the ideas that come to my head on how to bypass the wp.

Sent from my HTC One XL cellular device over clocked to 1.9Ghz
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Yes, they have the msm8660 chip set. They have the all elusive .mbn and .hex files for that chip set. We need the 8960_msimage.mbn and mprg8960.hex and we could do exactly the same. But they are nowhere. If somebody finds them it would be major!!! Best chances are translating the Chinese sites but haven't found them there either.
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
I'll get on the hunt for those later. College football has my attention right now.

You think a Russian site would? They are pretty extensive when it comes to torrent files and such. I don't know if they would have what we are looking for, though.

Sent from my HTC One XL cellular device over clocked to 1.9Ghz
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
We need people with some reverse engineering skills. Viper from revskills was going to look into this hex file and see if he could re-assemble it, but I have been out of touch with all this stuff to follow up.

Russians did come up with some kind of s-off for newer htc phones, but no clue as to what it is, as you have to send the phone in.
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
Been running around the websites for the Chinese looking for the .hex and .mbn files and it's not looking like they have them. A lot of people are requesting them, but not able to receive them. Time to start on russian websites. Found a lot of useful info on the files, though.

EDIT: So 3 forums on the russian websites have said that the .mbn and .hex files aren't extract-able just yet...? Anyone heard anything like this?
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
I could be wrong, but if this device is anything like jewel, then sbl1-3 are signed by HTC. easiest way to confirm if you have busybox on your phone:

hexdump -C /dev/block/mmcblk0p1

near the end you'll find something like "HTC Secure Boot" "SHA256" "HTC ROOT CA"

From the fdisk info some one else posted, it appears that most of the partitions are the same between jewel and evita. only difference that i see is jewel has 39 partitions and evita has 36. also note that p4 is an extended partition table. p1-p3 are logical partitions and p5-p36 or p38 are extended partitions.

Here's a nearly complete listing of Jewel's partitions:

p1 = SBL1
p2 = SBL2
p3 = ? PGFS ?
p4 = extended
p5 = MEID
p6 = ? contains: serial #, MAC addr
p7 = ? PGFS ?
p8 = empty
p9 = SBL3
p10 = RPM
p11 = TZ
p12 = HBOOT
p13 = "HTC-SECURITY-REC"
p14 = splash1
p15 = empty
p16 = DSPS (empty)
p17 = Radio (fat16 fs)
p18 = ADSP (fat16 fs)
p19 =WCNSS (fat12 fs)
p20 = radio_config
p21 = boot
p22 = recovery
p23 = ?
p24 = modem_st1
p25 = modem_st2
p26 = devlog (ext4 fs)
p27 = empty
p28 = pdata (empty)
p29 = empty
p30 = local
p31 = extra (empty)
p32 = skylink (empty)
p33 = cdma_record (empty)
p34 = empty
p35 = system (ext4)
p36 = cache (ext4)
p37 = userdata (ext4)
p38 = internal SD (fat)

E:V:A, i have some more detailed info about these partitions that i will post to your thread soon. just haven't had a chance to finish putting it all together (tons of sticky notes)

2 things i've been trying to find out:

1) where is the secu_flag stored?

2) what is "PGFS" i've seen it at the begining of a few partitions and also part way through SBL1. i've been searching google but haven't found anything concrete.
[AT&T, Rogers HTC One X, Telstra One XL] :
I know parts of it are WP..

Go check mmcblk0p3, I think the security flag is 0x8400.. 03 to 00.. I'll get that hex dump in a second for you

Could PGFS be the PostGres File System?

Here's the hexdump

http://pastebin.com/KQ89TivL

Is this the flag you are looking for?
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
sorry, i only have jewel and i'm already s-off.

p3 on jewel is 127.6 mb partition which is almost entirely empty. nothing at or around 0x8400

p7 on jewel is another large partition, 15.2 mb, that one has a lot more data.

unfortunately i don't have an s-on jewel device to compare with
[AT&T, Rogers HTC One X, Telstra One XL] :
Our p3 is 127.61MB, mostly empty. p7 is 15.2MB

Would you like me to upload p3 and p7 to dropbox for you?

I can also link you to the s-off partitions for evita

S-off paritions

S-on paritions If you want me to dump the rest, let me know
[AT&T, Rogers HTC One X, Telstra One XL] Skizzy034:
I think this was the first time I've seen this on the second page.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
P3 on jewel absolutely has the flag at 0x8400. P3 on jewel is basically identical to hox. But if you are s-off then the flag at 0x8400 is set to 00.....
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Someone on the One S forums has found a way to downgrade the HBOOT. I wonder if it will work on the XL. It's in the Android Development forum I think.

It should be useful for testing S-OFF by using an earlier HBOOT version.
[AT&T, Rogers HTC One X, Telstra One XL] :
That method came from the evo 4g lte, then the one xl, now the one s. I assume it will work on all msm8960 devices.. the hboot doesn't really have s-off.. you gotta find an exploit in the firmware
[AT&T, Rogers HTC One X, Telstra One XL] mcrook:
firmware being the hboot?
[AT&T, Rogers HTC One X, Telstra One XL] :
firmware being the RUU.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
What are you trying to say?
[AT&T, Rogers HTC One X, Telstra One XL] :
That there are possible exploits on different/older RUU versions?

Unless an exploit lies within a specific hboot.. haven't heard anything more
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
I thought the RUU didn't do anything besides push the rom.zip to the phone.
[AT&T, Rogers HTC One X, Telstra One XL] :
No, the firmware installed by the RUU.

The partitions, recovery.img, hboot.img, etc.

The 1.44 firmware is less secure than any current firmware from what I've seen, but still locked down.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Well the hboots are part of the ruu themselves. Sbls haven't changed much and you aren't going to get an s-off exploit from any other image in an ruu. Only way to downgrade hboot is via brick method.....
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Device down.......ugh, its been fun, but I'm not getting another at this point. I'm down for the count. Sorry guys:beer:
[AT&T, Rogers HTC One X, Telstra One XL] InflatedTitan:
I think the better part of the community are hanging their heads when it comes to s-off... oh well... what device you getting next?

Sent from my Liquidy Smooth, blazingly fast as f#(k HTC OneXL.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
If those new pads are external storage support...........then maybe people can lift their heads a bit:rolleyes:
[AT&T, Rogers HTC One X, Telstra One XL] zounduser:
Good find!

RATTLED FROM MY ONE XL USING ICS TAPATALK 2
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
More good news Here.............

There have been 3 crucial files that we have been needing and searching for.

Partition.XML

8960_msimage.mbn

Mprg8960.hex

I was able to build 2 of them from scratch and they are proper

8960_msimage.mbn

http://db.tt/zePePzCO

Partition_boot.XML

http://db.tt/IeKEAsLj

So we have 2 ready, now to make them usable we need the mprg8960.hex, which is the flash programmer. Once we have the 3 together, we can flash the emmc to a big USB storage device, and we can build from scratch. This should not only benefit s off but unbricking any Evita that is in qshusb mode, regardless of how it got there and what firmware it was on......

8960_msimage.mbn is used in conjunction with the mprg8960.hex to flash emmc into usb storage device.

Partition_boot.XML will be used to flash sbl1, sbl2, sbl3, tz and rpm if one of them becomes corrupted.....namely sbl3 or rpm, as we sit, if either of those get borked, there is no fix ATM.

So......mprg8960.hex......we need to find one or build one:beer:

---------- Post added at 08:17 PM ---------- Previous post was at 08:12 PM ----------

I'm not investigating the pads on the motherboard ATM. A bricked hox cant provide the testing needed so if anyone else wants to jump on that it may provide some good news for us.
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
I thought you couldn't build the 8960_msimage.mbn without the mprg8960.hex?

At least, that's what E:V:A has said... http://xdaforums.com/showthread.php?t=1917166
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I had forgotten he said that. disregard above post. Its a virus download:sly:
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
sorry to bust your :victory: moment...
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
:what:
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
To me it seemed like you were having a victory moment when you posted you were able to build those two files. And I chimed in with the bad news about building the 8960_msimage.mbn without the mprg8960.hex.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Begin MBR at 0x0000000000000000

prtn 0 at 0x00000000000001be: bootable 0x80, type 0x4d, 1st sect 0x00000001, siz

e 0x000003e8

prtn 1 at 0x00000000000001ce: bootable 0x00, type 0x51, 1st sect 0x000003e9, siz

e 0x00000bb8

prtn 2 at 0x00000000000001de: bootable 0x00, type 0x45, 1st sect 0x00000fa1, siz

e 0x000005dc

prtn 3 at 0x00000000000001ee: bootable 0x00, type 0x05, 1st sect 0x0000157d, siz

e 0x001fea83

MBR disk signature 0xfffffffe, signature bytes 0x55 0xaa

Writing file "sbl1.mbn" to file partition at 0x0000000000000200

WriteFile position 0x0000000000000200, size 131072

File write complete

Writing file "sbl2.mbn" to file partition at 0x000000000007d200

WriteFile position 0x000000000007d200, size 131072

File write complete

Writing file "sbl3.mbn" to file partition at 0x00000000001f4200

WriteFile position 0x00000000001f4200, size 524288

File write complete

Begin EBR at 0x00000000002afa00

prtn 0 at 0x00000000002afbbe: bootable 0x00, type 0x47, 1st sect 0x00000a83, siz

e 0x000003e8

prtn 1 at 0x00000000002afbce: bootable 0x00, type 0x05, 1st sect 0x00000001, siz

e 0x001fea82

EBR signature bytes 0x55 0xaa

Begin EBR at 0x00000000002afc00

prtn 0 at 0x00000000002afdbe: bootable 0x00, type 0x46, 1st sect 0x00002a82, siz

e 0x001fc000

prtn 1 at 0x00000000002afdce: bootable 0x00, type 0x00, 1st sect 0x00000000, siz

e 0x00000000

EBR signature bytes 0x55 0xaa

Writing file "rpm.mbn" to file partition at 0x0000000000400000

WriteFile position 0x0000000000400000, size 131072

File write complete

thats is a properly assembled msimage, ....without needing a hex file
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
.......carry on, sir.
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
I thought the hex was embedded into the msimage.mbn?
[AT&T, Rogers HTC One X, Telstra One XL] Q9Nap:
I need these files also for trying to restore a bricked atrix hd: thanks for those two files :)

have been searching everywhere for mprg8960.hex and tracked down a link in a chinese forum:

http://bbs.wpcnn.com/forum.php?mod=redirect&goto=findpost&ptid=25317&pid=580675&fromuid=77335

unfortunately the link is no longer active. i joined the forum, pm'ed the poster and posted in the thread, but haven't heard back. maybe if he receives more requests he'll create a new link?

*edit*

i also downloaded the full firmware file linked in the op of that thread in the slight chance that mprg8960.hex would be included in it, but the file is a single .binx; no idea how to extract its contents. also, pantech uses an online update utility that requires the phone to be plugged in for it to work, so doesn't look like that is an option to extract the contents.
[AT&T, Rogers HTC One X, Telstra One XL] joorie:
There's no point mass PMing the poster; he wrote right underneath that the link does not contain MPRG8960.hex or 8960_msimage.mbn.
[AT&T, Rogers HTC One X, Telstra One XL] Q9Nap:
no, that's not what is written. he posted that qpst can't use those two files by themselves, the partition file is also needed.

*edit*

bah, you might be right; chrome's auto-translate feature made it look like those two files were included along with the qpst link, but the original looks like the poster is sharing just qpst.

---------- Post added at 07:28 PM ---------- Previous post was at 06:55 PM ----------

would EMMCBLD.HEX be of any use? it is included in darkspr1te's brixfixv1 package here:

http://xdaforums.com/showpost.php?p=33545892&postcount=89
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
anyone willing to try qpst with the 8660 hex file and 8960 mbn by 18th? :)

where is the guy that bought a cracked screen one?
[AT&T, Rogers HTC One X, Telstra One XL] sieempi:
I'd try anything on my newly bricked Sensation, if that matters..
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
It won't work. It will give error 180. Using eflashprg.hex does the same. Using emmcbld.hex doesn't give an error, it just sits there but never actually downloads to device. It may be that the hex file may have to be a signed .hex
[AT&T, Rogers HTC One X, Telstra One XL] sieempi:
I know. However, my phone was s-off when it happened, and qpst should've said something more than those errors. I had better luck with miflash, the log speaks more. The hex is actually sent to the phone, but the whole process gets stuck at some point trying to send the mbn.
[AT&T, Rogers HTC One X, Telstra One XL] darkspr1te:
Thats great, I've been playing with emmcswdownload and bit on a msm8660 device, can you expand on how you built .mbn the file ?

I don't know if you have ready my thread, it's first one in my signature, i have been attempting to bypass needing the xxxx_msimage.mbn and sd-card mode, that way you can just write bootloaders direct and not need the sd-card mode. when your device is in sd-card mode does it also show the external sd-card ? have you attempted any boot off external sd-card, the cpu supports it unless the q-fuse is blown for that option.

Yes, the hex file is very hard to find, i am also looking.

darkspr1te
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
We don't have an external SD, but I'm fairly certain I found ext SD support pads on the motherboard but do not have a hox ATM except a brick. On our chipset, some method of external storage support is necessary because it gets searched for in 2 places by default.

1. First thing that happens when phone is powered on, PBL searches for external software(you will never see this but its the very first thing that happens in the boot process)

2. Whenever a device is sent to qshusb dload mode from a insecure boot attempt (unsigned partitions loaded, invalid partition data ect...) and its sbl3 that controls the reset into qshusb mode. sbl3, first function it has is to search for external software. Then it resets in qshusb mode. This is (I believe) why the partitions become exposed for a very small amount of time when devices get bricked. Allowing us unbricking methods.

Under certain bricking conditions sbl2 will be the one sending into qshusb mode, and sbl2 does not ever search for external software. which (I believe) is why in those circumstances partitions will never enumerate, and we are unable to unbrick.

I don't even remember what I was originally trying to say, but I know there is a method of ext support, I believe I know where, but without something to play with there's not a lot I can do anymore.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Yes, I read it. My msimage is "rocking horse manure" I believe, correct me if I'm wrong;)

1. Get your sbl1, sbl2, sbl3, tz and rpm images in a new folder. Change them from a .img to a .mbn.

2. Download the partition_boot.xml and edit it as needed for the touchpads your working on. It needs to be correct or you won't be able to get the msimage built.

3. Put the .xml in the folder with your .mbn files.

4. Take the emmcswdownload.exe out of your qpst directory folder and copy it to the other folder also.

5. Open up a cmd prompt in your folder with all the files and run -

emmcswdownload.exe -f 8960_msimage.mbn -x partition_boot.xml -s 1G -g 4M

It will build the ms image.mbn into that same folder. Even if it doesn't build properly, a msimage will be in that folder, so make sure it didn't have any errors in the cmd readout before trying to use the new msimage.
[AT&T, Rogers HTC One X, Telstra One XL] darkspr1te:
I knew that comment would bite me in the ass, its a local comment meaning hard to find, rocking horse is wood hence no manure :p in reference to the hex file.

No insult was intended.

I think we also might be barking up the wrong tree, one pdf i could not download from a asian dev site said secure boot 3 devices are programmed using QDart software, has anyone heard of it, seen it,

i had access to a site that had all of the 8960 files on it and no hex, 8660 hex yes. (site is since password protected)
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I heard of it a while back. Me and a few others here did a short rampage looking for it and never came back with it. I don't think a leaked version exists.

It does explain why even the latest version of qpst(that we have access too) still doesn't show a secure boot 3.0.

But there are plenty of references on anyclub.org using qpst flash programming 8960 chipsets also. U know what we need.....that ATM would be probably the feasible compared to all this other stuff....

Somebody Find a username/password to this site

http://support.cdmatech.com

It would be unreal to get into their......^^^^^^^^^^^^^

We would have anything we could ever need software side
[AT&T, Rogers HTC One X, Telstra One XL] darkspr1te:
Someone one mentioned (E:V:A i think) that the hex file in question can be found in ZTE based firmwares, That reminded me of two files i pulled from a unknown forum. The two attached files are ment to be .bin versions of the hex files but I've never knew how to use them, a strings comparison shows they have the similar text to the .hex file in them.

The ZTE revers to a ZTE device inside the file so i dont thinks it would be useful, but the other does not. Post in case they are of any use to you.
[AT&T, Rogers HTC One X, Telstra One XL] darkspr1te:
Yeah, that would be unreal.

I will continue looking for a solution, we might also want to look towards the sky 830l as well, i've heard it is the same cpu (also the same question, where is the hex file) and also there was a mention of a native Miui phone using the 8960 that does not use a hex file to flash as it's built into the flashing program. now i have a few miui flashing programs i've downloaded but they are all 8660 based, i will go back over my links to see if there is any reference to 8960

darkspr1te
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
On the support website, it says:

[QUOTE="QCom CDMA Support Site]

I do not have an account with QCT. How do I access this new system?

Start by going to https://support.cdmatech.com/ and click on the [REGISTER NOW] button and follow the prompts. If you need your Organization Number, you can request it by sending an email to support.cdmatech@qualcomm.com with a subject of "Organization Number Request". Be sure to identify your company, location, project details and all Qualcomm products (model number, part numbers, software builds) you are using that you require support for. Once we validate your organization's status, we will provide you with your Organization Number and further instructions on how to log into the system and begin using it to submit Cases and search our knowledgebase.

[/QUOTE]

So if someone can send them an email asking for an organization number and fool them, it might work. Unlikely though.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
New hox in hand(#5).....I'm back onboard:beer:
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
I remember reading in a forum (don't remember where at this point) that the hex file is probably different for each phone/manufacturer. I also remember reading in either one of the many qualcomm pdf's or on anyclub's site that the flash programmer is created from the same source tree along with the other firmware for the device. Take that with these .bin files and it seems we should be looking for an HTCmprg.hex or something similar.
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
On the cdmatech site, I have a buddy who's dad works at a cell phone repair store. Since registration requires an organization, I think I might be able to get him to register for that site.

Give me a day or two and I will report back.
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
most of you know about anyclub already. not sure how many of you seen this post: http://www.anyclub.org/2012/04/how-to-build-emmc-flash-programmer.html

looks like it's possible to build your own hex programmer using python (as far as my newb brain could comprehend).

i'll let the real programmers or people that have a clue chime in. granted, it's for 7x30, but since 18th was able to generate the mbn the same way, i don't see why we can't at least try.
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
That would be great, if only we could get our hands on the source tree... although if we could get that we'd be able to do a lot more

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
No dice, he is selling his business to other people who have the resources to market better and what not. He apparently has been in the hole for quite sometime. However, I explained the situation for this thread and the unbrick thread. He said he thinks he knows a place that could find/get the files we need. He is going to do some digging around on his off time and let me know. As to how long, I'm not entirely sure.