yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
+1please, lol :D
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
This could be BIG for exploiting emmc mode..

the command to extract a single partition outua mmcblk Quote:

dd if=/dev/block/mmcblk0 of=/sdcard/imagename.img skip=blockstart count=#sectors

say if you wanted mmcblk0p19 radio-config. you would use the following command Quote:

dd if=/dev/block/mmcblk0 of=/sdcard/radioconfig.img skip=212994 count=16381

you can also change the above command to use dd if=/sdcard/imagename.img and extract partitions from a full mmcblock dump.

We could sent individual sectors of an individual partition.... If it allows it to stick......
[AT&T, Rogers HTC One X, Telstra One XL] pablo11:
So, I guess the back-biting and general arguing has killed this?
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
I hope not...
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Sadly WP is in effect in this mode....so the area mmcblk0p3 is in is protected, regarless of how you try to write there.
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Anyone know what emmc spec the emmc is at? At least 4.4?

I think we need to disable POWER-ON-WRITE-PROTECT, but that means apparently that a protected partition cannot become a writable one unless the device emmc is reset.

I think this basically means, you have to reset the emmc using a physical switch, it is impossible from a software perspective. I have no idea where this emmc reset switch is.

Not sure if this helps, or not.

Edit: Looked through some previous posts, anyone know in which software versions HBOOT enables WP for itself?

Edit2: Also, anyone know if EHostDL is disabled by qfuse "EHostDL disable"

We need some info from real testers, or S-OFF will get nowhere.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I think your interpretation of the reset switch is wrong. The documentation's suggestion for binding the eMMC reset line to the system reset line is a physical design suggestion, in my opinion. I don't believe this would affect trying to reset via software. Again, my interpretation.

eHostDL I believe is QHUSB mode (or show me otherwise), and considering we see that mode, I believe it's safe to say it is not disabled.

As for hboot versions that protect themselves, it's just the latest update that started that. Software version 2.20...someone will have to chime in on what hboot version that is.

Not sure what you mean by "info from real testers". Are you a "real tester"?
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
It's HBOOT 1.14.0002
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
You could be correct. I just guessed from what the documentation said.

I also thought eHostDL could be QHUSB mode (both have dload, qhusb_dload and ehostdl). If it's not disabled, and if the write protection is disabled in this state, could we somehow soft-brick devices, and write to HBOOT to acheive S-OFF?

I'm not sure of the XL and it's respective HBOOT versions, since I own a One S (Snapdragon S4, like the XL, not the S3 version), but if it started in 2.20 it must have started in the recent update, or in a future update. I'm not sure if having the HBOOT make write protection for itself is a good or a bad thing, or both.

By real testers I mean someone who is willing to possibly sacrifice their device to get a lead or test a method (someone with insurance would be better, so they can get a new one for free, but if they don't have one and are still willing to test that's fine, as long as we're not sued :eek:)

The first post on page 202, of this thread seems like a good lead, I was told this method is already being used to flash splash screens, etc.

-------------------------

Edit: or we can go the official way and ask htc to provide dev s-off, I can PM the HTC rep, urban strata on xda if you like and we can try our luck (highly unlikely, near impossible)
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Also noticed that a long while back in this thread, everyone was talking about JTAG and getting into download mode by doing the wire trick. A similar thing was done to unbrick the Sensation; could we flash an ENG HBOOT whilst in download mode, if there is no WP?

For some phones JTAG S-OFF etc. can be done through the microusb port, with a microSD card. If an application is written, for Windows which utilizes the SD card reader, with an adapter and the proper software on the microSD, could you write S-OFF and all partitions in DL mode from the MicroSD to the internal storage?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
This has all been covered at length. Couple things.

1.) Flashing hboot doesn't help. Even eng hboot. Hboot is signature checked. ENG Hboot is only useful AFTER s-off

2.) QHUSB mode requires a .hex flasher, partition tables, etc in order to flash, which nobody has access to.

3.) JTAG is likely a viable option. Nobody wants to do that.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
OK, I now have a spare functioning one x w. No screen that can be used for hardware testing. Its disassembled down to motherboard w. Battery attached with all 3 aluminum chipset protectors removed. So its 100% exposed and working. I'm willing to send it off also if needed. Just saying for any ideas that it can be used for
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Your awesome bro!
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
could one use a riff box for this?
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
I think E:V:A should get it, he's a hardware master it seems.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
If he wishes to use it I'm happy to send it off.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Referenced for the above information.....

Sent from my HTC One X+ P-type_0.91.1
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
No
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
So, I cracked my damn screen and I'm going to have to make an insurance claim. So, I'll be available to test out any brick-likely theories in the next week or so.

Billy
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Sorry to hear it man:( but I got some tests that are a bit riskier so let me know when it ready:)
[AT&T, Rogers HTC One X, Telstra One XL] android4ever91:
Mine is working just fine but I will be more then willing to risk my phone! Just give me detailed instructions and I'll be willing to help! :)

Might I add that I'm comfortable with taking the back off the phone as I did it last night out of curiosity! ;) lol

Also on new Hboot and AOKP build 3 if that matters...
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Ya, this test is like 80/20, 20 being the success rate.......so I need a phone that can be bricked. I wasn't even going to mention it until jeepfreak offered up his cracked one.........thanks to you both!

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] android4ever91:
Instructions please? :) also if I need to be around my computer I'll have to do it later as I'm not around my computer right now..
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Awesome, we'll consider this a public disclaimer:) I'll pm you my gtalk so you can let me know when your around a pc....thank you

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] android4ever91:
Sounds good I'll let you know as soon as I'm at my PC! :p
[AT&T, Rogers HTC One X, Telstra One XL] :
If the test does not succeed, do you have any other plans or tests to run after that one?
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Not atm, no.

Me, beaups and Rpomponio will most likely all be working together and may be nothing, may be something but things sometimes can develop as results come about. Don't anyone get all fired up tho, this isn't any major development, just a test to check vulnerability really....

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
No brix.....no vulnerability.....big thx to android4ever91 for testing

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
@18th.abn; rpomponio; regaw_leinad and many others

Hey guys!

Sorry for my very late response. I have been very busy with some real-life affairs, job and outside XDA stuff while trying to follow-up on a few other XDA projects.

I have not abandoned you, but as I wrote to a couple of other people trying to get me more involved again, I'm not sure I can be of much help. The main reason is that (and as far as I can see), the best options we have so far is by rebooting eMMC or using the download mode, somehow. Thus we still need the stripped down version of gfree that regaw_leinad said he was doing... (waiting) Then we would have something to work with (to modify) to eventually get whatever method (if any GPIO pins) can be used in that mod, to get a reset sent to eMMC...

I really appreciate that you're willing to send your HOXL over here, that could certainly help us to establish once and for all the boot-pin settings, the wire-trick pin, the eMMC reset connection and perhaps some juicy UART logs. But whatever you send me, it will not be returned as I would probably have to de-solder the dragon to make some measurements underneath...and I don't have the equipment to get it back on. But more importantly, is that it works (ie. boots).
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
How did you get that output? That look way more comprehensive than the one we got before...
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Here's a zip with a couple folders and file from hox /d/ directory. It has all the gpio info I posted plus vreg(voltages). Notice the gpio folder has the protocols for every gpio individually 0-151, but nothing on 152-207. I'm suspecting they aren't utilized it "normal" mode and may be a lead to figure out what 152-207s main functions are.

Pm me a mailing address for the motherboard and battery and I will mail also....... It only boots to qshusb dload with the ribbons removed tho,

Link to /d/ files - http://db.tt/9ENCRyRt

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
More close up pics...........for ref.

E.V.A., I need that address pmed before I do something I shouldn't.........I'm uncapable of keeping my jumpers away from this thing:D

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Those internals look awesome... might pull mine apart just to see whats in it
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
And off topic......here's how you make a fully bootable/ exposed hox for hardware testing

Prereq's - Spare undies:beer:

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] ki11bert:
You are a wildman.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Lol, check this out:beer:

(This is nothing usable atm for people on 1.14hboot. You still can't downgrade.) This is the result of a VERY long day. Hopefully it will lead somewhere, but as it seems I'm good at hitting dead ends.....

But it is kinda cool;)

Thx Beaups, for answering my questions ALL DAY btw
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
how's 1.44 lol
[AT&T, Rogers HTC One X, Telstra One XL] nickeedoo:
Not sure what this means, but awesome! Thanks for working on this!

It sucks. Lots and lots. :P
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
It's pretty much crap, just like u said it would be:what:
[AT&T, Rogers HTC One X, Telstra One XL] ChongoDroid:
Sorry just reminded me of this xD
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
This is not a troubleshooting thread.....
[AT&T, Rogers HTC One X, Telstra One XL] kikokazuma:
I'm a complete XDA noob for the most part, but I'd like to see if I can be of assistance in any way.

Would it be of any help if I had a pre-production AT&T HTC One X with S-OFF?

Send me a PM if there is any way I can help you.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
We appreciate the offer. The s-off hox we've got everything that we need from them but feel free to dive in and help. Atm, where I am is getting a Emmc powercycle. If we can successfully powercycle, we have wp off and can then write to the partitions needed to turn security off.
[AT&T, Rogers HTC One X, Telstra One XL] h1m:
If this does work would the average xda user be able to achieve it as well?
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
You might be able to be of help if you dd your ENG HBOOT.

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
They don't have eng hboots on them. They have the same hboots as us...1.01, 1.08, 1.09.. here's a link to a full evita one x s-off partition dump......hboot will be mmcblk0p12

If it did have an eng hboot we still couldn't do anything with it since dd partitions contain no signature:(

http://db.tt/TVIne5Yd

Anybody interested feel free to dig thru them

^^^^^^^^gotta go fix that build.prop, lol
[AT&T, Rogers HTC One X, Telstra One XL] kenfly:
I'm sure if it works, a dev will just write a batch script to automate the process. So yeah.
[AT&T, Rogers HTC One X, Telstra One XL] Crappyvate:
hboot downgrade

I'm assuming you guys have seen this ? http://xdaforums.com/showthread.php?t=1932914

don't really know that it can help since ultimately it uses lazypanda but at the very least they found a way to downgrade hboot...:D
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Thx, ya I checked it out, doesn't really apply because we can downgrade much easier(hboot 1.09 and below) 1.14 doesn't have root so its not possible for them.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Edited for time being.......
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
You can't downgrade EASILY because the new hboot added emmc WP to itself. Apparently there is a complicated method to work around this, but, what's the point? We don't have an exploit in the old hboot either.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Exactly, it's pointless, and not the topic in here......
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
This is off-topic and and unrelated to the topic here. This thread WILL NOT become a disarray of crap discussion like the root thinktank. There is far far to much information and hard work in this thread, and if you do not have information pertaining specifically to s-off, move your posts elsewhere.
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
Well this is sort of related to the off-topic discussion, but applies to S-off: So the oldest RUU we have contains Hboot version 1.01 right? Has it been thoroughly checked for exploits? They had to have patched something up going from 1.01 to 1.08-09 etc. I know we have mostly been working with 1.09 but perhaps we should try backtracking a bit...
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I'm running 1.01 on 1.44 firmware atm and its protection seems to differ but haven't had a great deal of time with it yet. Good suggestion, and it is def. Being explored atm;)
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
kind of an apples and oranges comparison. the inc 4g has a removable sd card,like the LTEvo.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
No old exploits currently work atm. gfree, unrevoked, revolutionary, none of the unlimited.io.
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
How about Alpharev X?

Edit: I think they actually took it down when Revolutionary was released, unless you can find an old zip or something

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] :
No
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
How about using unlimited.io's QHSUSB_DLOAD clearing tool and modifying it so it gets access to system or something?

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
We have access to the system already thru root, what we do not have access to is p1 2 or 3. There is no mode in which those become unprotected. Not qshusb, not emmc. Security flag is in p3 and there are no modes that is unprotected. We need a emmc power cycle, that is the ONLY way I can see us getting s off. Not saying its impossible otherwise but any other exploits that are even related have been beaten like a bad dog.

---------- Post added at 07:04 PM ---------- Previous post was at 06:56 PM ----------

I linked back 10 or so pages I'm guessing to the jedec emmc standards manual. Wealth of info in there that applies to us.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
What clearing tool are you referring to
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
They posted up the PBL reset tool.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Reset meaning just reboot from PBL?
[AT&T, Rogers HTC One X, Telstra One XL] tylerdurdin:
To my understanding the tool is just to get you out if you become stuck in that mode.
[AT&T, Rogers HTC One X, Telstra One XL] :
http://unlimited.io/qhsusbdload.htm

As Tyler said, it looks like it is used to get you out of qhsusb mode, I do not know if will help for an exploit though
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
It just re writes hboot to p12. With that mentioned it will not work on the new 2.2 update since its wp....
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Well the funny part is our device is not effected by volume up + power. Only way we get QHUSB-DLOAD mode Is if either, A, hboot is corrupt and a new hboot needs to be pushed. B, the phones battery is COMPLETELY dead... So realistically that tool does not support our device. Please correct me if I am wrong again since your a god around XDA for those who don't already know.. Lol :beer::beer:
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
I think you can talk to them on IRC, #SensationUnbrick

Edit: someone can even send their device to him

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Let me see if I can get the HTC acronyms right...

What do you mean with "write anything"? Certainly, you must write something to send the "reset signal" (however you define it?), if the device is sitting and waiting in EhostDL mode for the correct HOST packet. At least this is so in PBL, so perhaps it's doing the same at a later bootloader stage (in an alternate error handler)...

BTW. Why don't you guys publish the source code you use for your magic solution? Any particular reasons to keep it secret?

That is doubly funny, as if what you refer to as "QHUSB-DLOAD", is the same as EhostDL (emergency host download). That happens at a much earlier stage in RPM PBL, under the PBL error handler, when no SDC1 (eMMC in our case) is found. When EhostDL is triggered, PBL enumerates HS-USB and wait for eMMC Flash programmer (FP) to be uploaded and authenticated. Once passed FP will execute and download all necessary boot images. Apparently there is modem connectivity during this phase, where QFPROM can also be read...

So there are probably many ways (or stages) where it can enter into HS-USB enumeration...

To read the PBL Error Log (from RPM code RAM), you can dump 1K of the memory from 0x3FF18. Would be nice to see what it says for the dead battery...

BTW. Any progress on the gfree code?
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
And if we had that flash programmer we would be golden, but I've torn google apart, and nobody has or is willing to leak it.

Do you have any ideas on powercycling emmc?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
The PBL reboot command has been known for some time. Just download revskills for windows, you can do it there too.

Regardless, like 18th.abn said, if we had the flash programmer (.hex) we wouldn't need an s-off WIP thread :)
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Well, I'm tired of downloading other peoples executables. If they have something to share they could dump the sources somewhere. Sound to me they're just sending QC OEM reboot command to modem, nothing else. So why they didn't go further to use all other possibilities available, once you get modem access, is beyond me.

It's not that simple. The FP need to be signed! (Unless you know something about the BOOT_CONFIG that I don't.)
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
revskills software is commercial, but they list all the commands in the software, the free version is a good study still.

As for reflash...if we had hex, my strategy "would" be to reflash the entire device just like stock, only make the changes to P3 (unsigned) first. SBL1,2,3, RPM, TZ, HBOOT, etc we would be flashing signed, unaltered versions.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Are you talking to me? If you are, then I have the same ideas as we discussed the first times we talked about the eMMC. A gfree-code-like modification seem to be the only direction to progress at this point. Have anyone done anything more with that? (There's always HW, soft-jtag.)

Regarding signing, it would be very interesting to know whether they use HTC keys or QC keys to sign SBL1-3. If they use QC keys we might be able to use code meant for other devices, and HTC can go sc--- off.
[AT&T, Rogers HTC One X, Telstra One XL] Fuses:
Sorry, I meant that tool won't write anything on emmc.
[AT&T, Rogers HTC One X, Telstra One XL] :
no it won't help, because it uses a removable SD card.

This was covered 3 pages back.

Any help is appreciated though, and do know devs are searching high and low, but have ruled out that exploit.
[AT&T, Rogers HTC One X, Telstra One XL] Fuses:
Some old one x(evita), one s, one v & sprint 4g lte firmwares enters into QHUSB_DLOAD mode by pressing VOL-UP & POWER. Usually you can get device out from that mode by pressing POWER for about 30 sec. But not always.
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
Might be an interesting read for you guys:

http://xdaforums.com/showthread.php?p=33082185#post33082185
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
This thread is for S-OFF on the One XL in general, not just the AT&T model with the 2.2 update.

There is another thread about rooting the AT&T model on the most recent update.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Perhaps it is THAT simple!! I don't think anyone checked FP for signature?

If FP doesn't need signature, then we're all go, as we'll use an already signed bootchain. That should be easy to check.

Exactly!! Unless the "new" bootloader(s) have some trickery included, to re-enable WP on eMMC, we don't have to change anything, just the partition XML! Whoa! BTW. We have HEX, and might not need it anyway!

This may very well be the break-through we need! I'm not sure the guy himself realize how much help he has been. I've been working on this path myself, but not having a device has kept me from being able to test...anything. I have a half written tutorial which will certainly complement what he did.
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
We've crossed that path many times while brainstorming the qhsusb_dload unbricking for sensation, but nobody that I knew of tried messing with qpst.

I'll keep lurking :)
[AT&T, Rogers HTC One X, Telstra One XL] PeartFan40:
OK folks, thread has been cleaned up of all off-topic discussion. This is the second time the thread had to be cleaned up. DO NOT engage in off-topic discussion in this thread. If it's not directly related to S-Off, it does not belong here. Anybody found going off-topic will suffer the consequences.

Thread Re-opened.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"If you choose not to decide, you still have made a choice"
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Does anyone know which files to load to use the QPST? (.mbn, .hex etc.)

Does this completely rewrite the boot sector?
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
I'd follow darkspr1te's thread for more instructions.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Isn't the hex he posted for msm8660? Last I checked there was no hex for 8960 in the wild.....