yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I'm not asking you why you want any of this, I'm asking what you plan on doing with it. Let me get you up to speed since this thread is atrociously long.

1.) We know exactly where the s-off flag is stored. 2 positions on mmcblk0p3 - one is a simple flag change, the other is an algorithm which 1 or 2 of us know.

2.) mmcblk0p3 has emmc write protection applied

3.) Write protection on mmcblk0p3 is enabled by SBL2 - which is mmcblk0p2. SBL2 also applies the write protection to itself and SBL1 (mmcblk0p1) for good meaure.

4.) in later software revisions, mmcblk0p12 (hboot) applies WP to itself and a few other partitions as well.

Really 2 angles I see if we want to deal with disabling secure boot.

1.) Tell the device to boot from external device. This is how another recent exploit works. Issue is we don't have ext-sd slot and usb otg doesn't appear to get loaded until late in the boot process (hboot).

2.) Tell the device to allow insecure boot (assuming qfuses aren't tripped). Issue here is even if we do that, we have emmc WP to deal with in order to load any exploited code. And if we knew a way around emmc WP, then we'd just update mmcblk0p3 and skip all this hard stuff.

I see you've done a ton of boot analysis. I am curious about something:

Say we figure out how to trip the insecure boot mode. We still have no facilites to update SBL1 or 2 due to emmc wp.

Ignoring that, obviously SBL1 would not be authenticated. But if SBL1 is original code, would it still want to authenticate SBL2? And would SBL2 want to authenticate SBL3? And would SBL3 still want to authenticate APPSBL (hboot)?

Or would forcing insecure boot cause none of these authentication routines to occur?
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Don't bother if you're on a custom ROM!! I only want output from stock devices. Why? Because custom ROMs and Kernels often disable/break a whole bunch of useful debug tools and messages and other completely unknown things.

NO CUSTOM ROMS! STOCK--STOCK--STOCK!!
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
I should add I'm running the stock update 2.20 with HBOOT 1.14.0002
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
NOW **** just got real :D
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Has anyone tried fastboot oem writesecureflag 0
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Holy s**t I neve though of that :)
[AT&T, Rogers HTC One X, Telstra One XL] :
oh god. crossing my fingers :

I'd really love to help, but the Only thing I know is C with a side of C++. Don't know how to apply it to android :(
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
I like pictures:

That is the result flag then. Surely there must be more details to it. Could someone show me this devices partition table (partition, image, function)? Can you tell us more about the algorithm?

I have to look into this...

1. (a) You need to activate "Emergency host Download" (EhostDL) mode. But we have to check that you're not running under Qfuse: "EhostDL disable". That would disable any form of Emergency downloads, unless PBL has error. Typically PBL Error handler will trigger EhostDL when faulty SBL image authentication. See MSM specs in my thread.

(b) In addition we're using HS-USB in any case. Unless the BOOT_CONF or other Qfuses are screwed up, but this is very unlikely as it would impair also service center access.

(c) The USB may only be active for 90 seconds! Another Qfuse to be checked: OEM_CONFIG0 .

(d) OTG doesn't belong here...

(e) I have good reasons to think that the uUSB POGO pins are used for this!

2. eMMC WP can be circumvented during reset, according to some documents, but problem is that reset line is hardwired to some system reset. AFAIK. I'll have to look into this... I don't know jack about eMMC...

But these are good references:

"JEDEC: Embedded MultiMediaCard(eMMC) Product Standard" (JESD84-A441)

"eMMC v4.41 and v4.5" (JDEC presentation by Victor Tsai)

I have to get back to you on this because I'm sleepy!

In the meantime perhaps we can play with this:

Reading the first 0x100 Qfuse PROM values (QFPROM):

viewmem 0x706000 0x100

with this info:

[SIZE=2]Address Qfuse-function Arithmetic What
-------------------------------------------------------------------------------
0x706034 BOOT_CONFIG[X] (@0x706034 & 0xFC) >> 2 upper 6 bits
0x706038 SECURE_BOOT[?] (0x706038 & 0x20) 5th bit
[/SIZE]
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I've seen your picture and I do like the visual. However it really doesn't answer whether or not SBL2 and 3 are authenticated when secure boot mode is disabled.

We can get to ehostDL mode no problem. As you are well aware, that code resides in PBL. We have two methods to get there.

But what can you do while in there? There's a lot of software we are missing to utilize that mode.

As for where soff is stored, it's not the result, it's the "cause". Again, there are 2 flags in there, one is very simple, the other is slightly less simple.

It really doesn't matter how the algorithm is structured until we have write access to that partition.

edit: And I've checked your link about the pogo pins....what does that have to do with this? We already know where the "wire-trick" pads are on our devices....and it isn't the pogo pins. Besides, we can get to ehostdl mode by simply borking hboot. It's childs play :)
[AT&T, Rogers HTC One X, Telstra One XL] Vendetta-NY:
LOL Gunny.

But I still contend **** got really real a few pages back. Watching brilliant minds like beaups and E:V:A and others collaborate is enough to give most members here geekwood. And I can barely spell S-off.

Some people enjoy Housewives of Whatevertrashtown, I'll just hit F5.

Keep it up, guys!
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Everything is authenticated! (AFAIK)

From our work on the SCH-I535 and the QC documents, it certainly gave me the impression that "SECURE_BOOT" (aka FORCE_TRUSTED_BOOT) was enabled by default, for everything. But now when you mention it again, it could just be a side effect of being blinded by sexy documentation. That is, the original QC documentation is only about "Secure Boot 3.0" and doesn't mention any non-secure or "ordinary" bootup... And in other references of the MSM Bootup Sequence, there certainly is a check. So I'm quite sure everything is checked. (Otherwise it would be pointless, right?)

We know that the similar MSM8660 have more than one (Qfused) SECURE_BOOT register. But it is still unknown what these are. However, the SECURE_BOOT1 register has an AUTH_EN bit that that can be only be temporarily circumvented by RPM-JTAG. But we don't know if this is the same as in the MSM8960, certainly the address is different...

Can you elaborate?

Is there a reason why you are reluctant to share this information? This is important or I wouldn't have bothered to ask. I already a have a bad memory of the Xmoo thread, with people sitting on obviously relevant information not willing to share, and that time I left. I work out of the ideology of maximum sharing, because that make us move at light-speed and that is what inspires me. If you feel otherwise that is fine, but then I will be way less motivated in helping out.

Your point (1) in your previous post gave the impression that you could not boot from external device, or get EhostDL, or communication...

So if you already know what the wire-trick pads are why don't you tell us?

(What is it connected to?)
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
As much as it's flattering with these comments, they are equally annoying for the development.

THIS IS A DEVELOPMENT THREAD!

So please stop posting all these little comments, they're just making it harder and

more time consuming for us to sort through and find relevant posts.
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
Never mind
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I'm too lazy to do proper quotes.

1.) The algorithm doesn't matter until we can write to the partition. There's no use in discussing it, only to have it patched out before we can actually use it.

2.) We cannot boot from external device, because the phone has no external device. We can enter qhusb/ehostdl mode via wire trick or hboot corruption with no issues, and communicate via USB. We require an MSM8960 specific flasher (.hex in QC speak) and partition xml, etc. in order to utilize that mode. Short of a leak by QC themselves, I don't see that happening.

3.) Nobody here is looking for a jtag method. If we were, we'd simply order an XTC clip or something along those lines. I believe the community is looking for a software-only solution. Anyone can feel free to chime in here if they disagree.
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
If it required getting a XTC clip then I'm more than ok with buying one
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
As I said before, there is definitely a good use in understanding what S-OFF consists of in this case. And to see if it is using old tricks that have already been solved for other devices. What I think will happen is that after eMMC WP have been solved, someone will hack together some tool and we will never know what's going on behind the scenes with S-OFF. I'm trying to think a little further than just solving SOFF for this device and perhaps long term, if possible, so that the next update doesn't blow the SOFF. So you guys may as well spill your secrets now while it is still of interest, unless of course you're planning to make money from this, in which case I'm leaving!

(a) Well if you tell me what the BOOT_CONFIG[x] pins are, I will tell what what should be possible to boot from, given that no Qfuses are stopping us. Then you have 2 internal devices (MSM IMEM & eMMC) and 3 external (2 USB & SIM)!

(b) If you tell me what the Qfuses settings are and what they mean, then we will know for sure what's possible, given knowledge of (a).

(c) I don't see why you complicate things about specific flashers. Certainly this have been done before, so I must be missing something... Can you elaborate on the details about this problem? AFAIK, all you have to do is format a file according to EhostDL spec's and it should be executed after completion. (?)

(d) We know all the QPST protocols!

I never meant JTAG as a solution. I mentioned it because arbitrary code execution is possible with it, if you know your addresses. And if you don't know them, you can find them with it. In addition it is perfectly possible to do JTAG over USB...

..MOREOVER..

(A) In your earlier post you say that the P3 WP is enabled in SBL2. That means we need to find out whether WP is enabled BEFORE or AFTER EhostDL routine! If WP is enabled after EhostDL, then we can do "stuff", otherwise we have to figure something else.

(B) In some other posts you guys were discussing eMMC reset, and that it could be possible to circumvent WP at eMMC boot time. What was the results of this? Is this correct? I can probably reset eMMC without resetting entire system...

(C) I would like to have/see the following:

1. A list of partitions and what bootloaders (or other boot relevant files), are present on each. (Ie. mount + some descriptions)

2. The raw file with SBL2 unless you happen to have some RE assembly or C.

3. Same for the file that is responsible for the boot-up screen (showing S_OFF, Secure, Unlock etc).

4. A HW UART boot-up log...

5. A direct modem connection where we can issue AT commands...

6. A list of stock + engineering fastboot commands.

7. Tell me what function/signal the wire-trick pad is wired to.

8. A datasheet or pin/pad diagram for the eMMC

Here is a picture of the wire-trick pads. If someone knows what that lower pad it is connected to, please let me know.

Finally, it would be great if somebody would actually care trying to do and answer the above,

so that we can move along. I think this is the third time I'm asking...

Mind you again, I DO NOT HAVE A HOXL!!
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
I think you are sensing antagonism from us which isn't there. Beaups isn't trying to make money from any method found, in fact when he won the bounty for finding root on 1.85 he directed all of the proceeds be donated to charity.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
It has nothing to do with money. It's a totally useless algorithm until we can utilize it. Once we can utilize I'm sure it can be shared. Let's stop discussing this piece.

How would you like us to retrieve these Qfuese states?

I'm not complicating anything at all. The folks at Qualcomm did. I suggest you research on anyclub.org the process for flashing via qhusb. Yes, we know the protocols. But you need an SOC specific hex that is downloaded to the device, xml partition tables, etc. etc. I have not see any successful use of flashing in this mode without a leak.

Emergency download mode is code contained in PBL (or is it DBL? Whichever it is, it is truly ROM and very early in the boot process), which I'm sure you know. Issue is creating a situation to trigger that mode. We can do that with wire trick, in which case I believe the device is in download mode with no eMMC write protection. Issue is, we don't have a way to do anything in that mode.

We failed. If you can manage that, you'd be a hero here.

Your requests are rather broad and ambiguous, especially considering you haven't shared any sort of strategy.

For #1, 2, and 3, yeah, I'll link you shortly to SBL2 and Hboot (hboot would be the file "that is responsible for showing the boot screen".

#4 how exactly do you expect us to provide this?

#5 what specifically do you want? We can talk to the modem from diag mode while booted.

#6 ok, will provide

#7, dunno. It was found on accident, by another user here.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Short the inside pad to a ground, like the simcard tray but not pad to pad. Just want to clarify so nobody tries it. I dont know what the end result would be, if anything. But only the inside pad reacts to ground. The outside does not.
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
ive allready got one. so id be more than ok with it :D

but,if it required buying a different device,id be ok with that too. i want s-off badly,and would buy a device that would give it(thats why i bought the xtc clip)
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Were u able to use it on your hoxl thru the simtray. I have to go back and research but i believe theres two crucial files that it creates we could possibly use for everybody.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Wrong! SIM-card tray is GND and if you look at the picture the outer pad is also GND!

(They made 2 holes for a reason.)
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Lots of things were created with two holes in them. That doesnt mean they should be poked or probed at the same time:beer:

Going thru my notes i can CONFIRM probe to probe will get NO reaction. The only way is inner pad (+) to ground (not the outter pad) If you cant perform it yourself and someone chimes in that can and HAS. Perhaps in all your knowledge you will find the room upstairs to learn that you CAN be wrong. Today, you are wrong. I didnt call you out as wrong but simply noted an error you had made. Since you took it so negatively i will now CONFIRM to the community YOU ARE DEAD WRONG!
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
So I have spent way too much time reading through this thread, just to find that the majority of posts are garbage (but you knew this already). However, from some bright posts, I see you really did a lot of good work. It's just too bad it's so hard and time consuming to find it. I would have suggested to start a new thread that is heavily moderated, but then again who am I to come up with such a suggestion...

OK, but let me summarize the simple parts:

[SIZE=2]S-OFF-1: @P3: 0x8400 == "00" or "03"
S-OFF-2: @P3:>0x8400 == "HTCU"
S-OFF-3: @P3: ------ == <some ?? function>
[/SIZE]

I already told you, at the end of this post! These should work, unless HTC also pushed their own memory maps! But this we should be able to confirm from kernel sources. Could somebody look that up?

I know about those things, but have anyone actually tried anything?

===> We need to check for a new script!

<< To Be Continued >>

Check my previous post response. We need to check if before or after...

That should be easy by either:

1) finding the correct GPIO to send reset signal/trigger.

2) Make the PMIC shut down the voltage to eMMC

3) Using the same QPST protocol to trigger EhostDL. (It is a modified AT handshake if I recall right, which emphasizes why we need modem connection.)

4) Figure out the signal on wire-trick pad and then "do it"!

[/quote]

#1-3: Great!!

#4 (a) Someone need to connect a USB-to-serial converter (FTDI, BusPirate etc) to their PC, attach a Realterm to the right USB port. Then probe all the test points on PCB for kernel/debug messages. Plenty of posts in here about how to do this...

(b) From here:

#5 Really? Excellent!! Then try these:

[SIZE=2]
AT // OK?
ATI // device info
ATZ // "reset" modem to default configuration (safe)
ATE1 // turn on echo
ATV1 // turn on verbose results
AT+CLAC // lists all officially available AT commands
AT+CGMI // Manufacturing Identification
AT+CGMM // Model Identification
AT+CGMR // Firmware Revision

AT$QCDMG // Should cause phone/modem enter to diagnostic mode. (May be hard to exit...)[/SIZE]

and if they work, then try the TJ ones:

AT@EBI_CFG
AT@GPIO_IN?
AT@PMIC_LEVEL

Some of the relevant partitions for reference:

MMCBLK0P1 SBL1
MMCBLK0p2 SBL2
MMCBLK0p9 SPL3
MMCBLK0p11 TZ
MMCBLK0P12 HBOOT

and the others?
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
I'm happy to admit when I'm wrong but in this case we have clear picture evidence!!

And the only thing I did wrong was using the word wrong, since the result is the same, it is also right!

(But I take it you didn't bother to flip back one page to see that picture, so I'm not gonna argue with you.)
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
I'm offended and insulted.

GARBAGE?

It's called blowing off steam. Those of us here have been here since launch day and have become friends in a sense.

We joke with each other, and laugh and have a good time.

Garbage?

GOOD DAY SIR

I said GOOD DAY!
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
the clip itself does not generate any files. all it does is emulate an engineering sim card so that the provided DIAG file will work. im sure i can cut down a sim flex cable to fit in the tray,but someone will need to program the "sim" portion of it into the clip,and then we will need to obtain a signed DIAG file from htc.

the clip seems to be dead. there have not been any updates forever,just alot of drama and name calling on the clip forums. my guess is that whomever is truly the original clip lost their inside source for the DIAG files :(

if you know something i dont,or have some instructions on manipulating the clip differently,id be happy to cut down a sim flex cable and try and get it to work. :)
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Edited for censorship........
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
[YOUTUBE]M5QGkOGZubQ&feature=fvwrel[/YOUTUBE]
[AT&T, Rogers HTC One X, Telstra One XL] ChongoDroid:
Maybe we should start a bounty to get this "genius" a HOXL..

Gunny?

Sent from my HTC One X
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
And this is why we will never achieve S-OFF.
[AT&T, Rogers HTC One X, Telstra One XL] ChongoDroid:
You're right EVA had it down pat, how foolish of us right?

Sent from my HTC One X
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
I said good day sir!
[AT&T, Rogers HTC One X, Telstra One XL] ECEXCURSION:
Ugh... So much drama.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Maybe you had too much?

Well guys, I really didn't mean to ruin your nice little sandbox party by stepping on your castles. But the thread IS labelled as both "DEV" & "WIP", perhaps you should ask all your friends to relabel it as "S-H-I-T-ON (Buddy Discussion)" instead? Because it is obvious to all that you're not taking any constructive critique, and can't handle giving any either. Just navigate back 5 pages, and we can clearly see who is helpful and who is not.

It is really not my fault that you are not able to identify metal soldered to metal. Whatever you did on your device, it is either wired differently or your GND pad was dirty...which wouldn't surprise me at this point.

Cheers on you too!
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
OP?
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
Listen, this threads been dead for weeks. There's nothing going on, and most have given up. Sure, maybe it's just bunny trails, but at least it's something. I know most of you weren't around in the Captivate dev forum when Adam Outler was doing this exact stuff and asking these same questions in a thread a year or two back, but crazy things came from it. He developed a method to make the captivate completely unbrickable. And besides that, mapped and reverse engineered the complete subsystems and protocols of Samsung's bootloader process, mostly by himself because no one would help him either. Of course, he actually had a cappy to test with and I'm not saying E:V:A is an Adam Outler but dont give this guy crap just for trying to help. Who knows, maybe one of these trails will lead somewhere.

Also, congrats on the XDA Portal post E:V:A! http://www.xda-developers.com/android/find-out-virtually-everything-about-the-snapdragon-s4/
[AT&T, Rogers HTC One X, Telstra One XL] venelar:
Assuming here, but i think a lot of the perceived attitude/ terseness of E.V.A. may have to do with English not being a first language. I've followed many devs through the years here and since xda demands English first this happens quite often, coupled with all of the enthusiastic exclamation marks, it can come off as critical or rude.

Or hey, maybe not. But good/bad/whatever, at least the thread has been active :D
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
Insulting us will go a long way...
[AT&T, Rogers HTC One X, Telstra One XL] bigjohn6582:
How about we stop the petty bickering and get back on topic.....:p
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I can get past the inflection. We all want s-off, I get that.

What I'm struggling with is popping into a thread demanding all sorts of random tests/probes/etc., but the demands are coming from someone with very little basic knowledge of how our devices work...but has a lot of nice charts. And to make matters worse, no "plan" of what to do with all this information. I'm trying to think of some witty analogy, but it's too late here.

If you guys want to play along, more power to you.

I would work with him on disabling the emmc WP, since it's "easy". If you can get that, you'll get your s-off.
[AT&T, Rogers HTC One X, Telstra One XL] ChongoDroid:
I'm not criticizing his work since I haven't seen any. He doesn't have a HOXL so I don't expect him too.

So because EVA sounds like another guy that accidentally stumbled upon something that happened to work for the Cappy we should rehash the same stuff and ignore what's been proven not to work? Am I missing something here? If I am please tell me to jog on..

I promise I won't get upset and cranky..

Sent from my HTC One X
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I along with several others spent GREAT deals of time working on this and i just wanted to input pad to pad will not work. I alone have sacrificed 2 hoxl to achieving s off and would atleast expect an acknowledgement that perhaps im right and maybe if needed start figuring out why and is it relevant. Not just flat out told that no matter what im wrong. THAT is not development.
[AT&T, Rogers HTC One X, Telstra One XL] ChongoDroid:
that's true, I really don't mean any disrespect in case people think otherwise. I'm just glad people who use big words are still looking at the topic lol

Sent from my HTC One X
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
+1 nicely said
[AT&T, Rogers HTC One X, Telstra One XL] samiam0295:
+1 :good: