yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Will the new Droid Incredible 4G method work? Same chip set, in the xda portal...
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
They just got a unofficial bootloader unlock. Big kudos tho, that was good team work.
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Does that mean they can get their unlock state back to ***LOCKED*** then?
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
With s-off, we can change bootloader unlock state to locked with it still being unlocked. You can get rid of the red dev build text on the HTC boot up screen. You can change that white screen to something else if you wanted too. With s-off you can change/mod anything you wanted. Except for trying to do any physical things like turning your phone into a transforming car. That's still in the works.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
It just means they can unlock their bootloader like we can on the hox. By changing cid to 11111111.

Also, FYI, we can change splash screens ATM even s on. There's a thread in themes. Or you can make your own and dd it to p14
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Asked because the main reason why some people want S-OFF is so they don't void their warranty.
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
I sent in one unlocked phone, haven't heard anything from at&t
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
Well, that is useful. I was unaware of this splash screen change.. Lol
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Unfortunately the UK are complete con-artists compared to the US, everyone is a scammer here and try to extract money from you in every possible way. The UK is the hole of the EU.

/offtopic
[AT&T, Rogers HTC One X, Telstra One XL] kennethpenn:
Please quell the off-topic chatter. Thank you!
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
wait, so if we get S-OFF we can make it appear as if we haven't tampered with our device(barring ROM changes, and if we flash new splash screens and boot animations), how does that work? is there no check for if we have S-OFF that AT&T/HTC will do?
[AT&T, Rogers HTC One X, Telstra One XL] :
In the boot loader it will say S-Off.

But you can use s-off to change the relocked flag to locked and then turn s-on again.. then it should look untouched. No sure if it will stick when you turn the security back on though.

Sent from my HTC One X-
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
From what I know, when you have S-OFF it shows locked and that flag won't change. But it does say S-OFF, but you can change that back to S-ON by flashing the original HBOOT (if it is labelled, like JUOPUNUTBEAR, otherwise you can skip this step) and write fastboot oem writesecureflag 3.
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
When its s-off you can change the locked, unlocked, relocked flags. So if you decide to unlock your boot loader while you were s off and the re lock it then it would say relocked until you edited it

And flashing another hboot does not re s-on your phone. At least not a true s-off, it may have happened in the past when they used some method to make the bootloader think it was s-off

The only way to s-on the phone is that fast boot command
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
I meant flash the original HBOOT then use the command, if you have a custom HBOOT and lock it, it will say S-ON, but will still have the custom text like "Revolutionary" written across the top.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Either scenario would brick the phone. You must have a HTC signed hboot if you go from s off to s on. If the text is modified, and you decide to s on, you have a unsigned hboot and it will brick.
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Exactly
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
Hmm. If you were to brick with this scenario, any idea where you'd end up? qhsusb_dload mode or ehostdl?

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] :
I'd place my guess for qdl mode, since flashing an international rom older firmware puts you in qdl mode as well.. however

unsigned hboot =/= corrupt hboot

So hard to say for sure.
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
That would be my guess as well. Though not a theory i'd personally like to test.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
On the Sensation it was QHSUSB_DLOAD when you bricked HBOOT, so my guess is definitely on that.
[AT&T, Rogers HTC One X, Telstra One XL] pinbacninh_city:
offers you

you can help me a little is not

your machine is one xl and his s-off.

have supper cid then

So you need an unlocked bootloader to flash rom

would like to thank everyone
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Lmao! WRONG PLACE to post your non sense. :banghead::banghead:
[AT&T, Rogers HTC One X, Telstra One XL] nickeedoo:
Has anyone really been far even as decided to use even go want to do look more like?

Edit: I'll be useful. What's the current hangup? Can I be of any help with testing or such?
[AT&T, Rogers HTC One X, Telstra One XL] sieempi:
Has anyone managed to disassemble hboot or spl? I'd do an analysis on pogo pins & usb port.

via xda app
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
It seems we either need a .hex file for our processor, JTAG, or find a way to mount an SD card on the board to exploit it

Pogo pins or USB port won't do any good, its been discussed that these are not exploitable
[AT&T, Rogers HTC One X, Telstra One XL] sieempi:
How would you use the hex file? (Bear in mind that this is tegra, not qualcomm). I don't get the sdcard thing, why wouldn't you use a y cable?

And I still believe that hboot/other loaders manage the role of pogo & usb..

via xda app
[AT&T, Rogers HTC One X, Telstra One XL] pablo11:
Never mind...........
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
You can try disassembling hboot and sbl3. Even if it doesn't result in obtaining s-off it might help to better understand the boot process for the msm8960 and could benefit unbricking efforts.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
We have a Qualcomm phone here, you may be in the wrong forum

There are hidden points on the phone that may be where you can mount external storage like an SD card. If we had an sdcard we could possibly use the lazypanda exploit

Doesn't matter what manages them if all exploits are pretty much closed
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
Don't know if this can be of value:

http://xdaforums.com/showthread.php?p=35122708

He flashed boot from one x+ and it caused a "speed bootloop" from how he described it.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
Can anyone confirm the MSM8960 version after the 2.20 ota? I have noticed the 8X utilises MSM8960 V3.1-P3 0x406b50e1... not sure if its useful but its still information that may help
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Could this be the hex file?

https://github.com/romanbb/msm8960-common/blob/master/firmware/cyttsp_8960_cdp.hex
[AT&T, Rogers HTC One X, Telstra One XL] darkspr1te:
This is not the programming hex for QDLOAD but more of a small fw hex included in the kernel/ramdisk.

q quick strings on the file gives me

QUALCOMM N2850-1 TMA340 Firmware Identification Block
Version 09.02.00 Compiled Nov 16 2011 13:59:01
End of ID Block

It also does not have the qualcomm header. i though you hit jackpot there but alas no.
[AT&T, Rogers HTC One X, Telstra One XL] MadMax:
hey, idk anything about this stuff, but I am hunting down for the hex file we need. Would this be any help at all

http://blog.csdn.net/su_ky/article/details/7773273

http://www.anyclub.org/2012/04/how-to-build-emmc-flash-programmer.html

Chrome translated the page for me
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
I haven't translated the csdn.net page yet, but the directions on anyclub.org appear to be for use within the source code directories, which we don't have access to.

In fact, most posts on anyclub.org seem to be written for developers with access to the official source code.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] codeprimate:
if you guys are chasing the .hex file for evita firmware, is it the one that is in the HTCDev downloads? There are a load of .HEX and .IHEX files in the firmware folder of the One XL code (Telstra version).

I might be barking up the wrong tree, but these are available for download from http://www.htcdev.com/devcenter/downloads.

Good luck guys.
[AT&T, Rogers HTC One X, Telstra One XL] :
Downloading it now.. It may just be kernel source code.
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
Already been tried by someone. Failed attempt if I am correct.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
NO! That is the Cypress TMA-340 Capacitive Touchscreen driver firmware!

As I have said several times before and many months ago, THERE IS NO HEX file for the MSM8960, simply because it is not needed! Probably you could make one, by RE the IROM and add the certificates... Good luck.

EDIT: We now have it!!
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
Actually, there are 8960.hex files! Yes, files, as in more than one. They are built from source along side the other qualcomm firmware. There is documentation on how to build and use them for the 8960. But it is highly unlikely we will EVER see them, as they would need to be leaked by the oem's, for EACH device.

Even IF you got your hands on the right .hex file, all you'd manage to do is load the device specific .mbn file, which will then provide qhsusb_dload and enumerate the emmc partitions so SIGNED images can be reflashed. Good for recovery purposes as jtag is not needed. Bad for s-off as it does nothing to change the write protected nature of existing partitions.

Sources of information:

Anyclub.org

Qualcomm pdf's from E:V:A's msm8960 thread.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] eraste:
With the newest 3.17 Asia jb update I wonder if they overlooked some security there? They have done something ( some saying kernel related) that prevents root from sticking. Maybe they accidentally left a whole open somewhere?

Scribed on my Clean one X
[AT&T, Rogers HTC One X, Telstra One XL] hyun18:
You mean a hole ?;P
[AT&T, Rogers HTC One X, Telstra One XL] eraste:
Yup :banghead:

Scribed on my Clean one X
[AT&T, Rogers HTC One X, Telstra One XL] :
I suspect, that if there is no hole within the kernel (I believe it's based off linux kernel 3.4? I assume it's very secure.), it would be from the hboot (I don't believe one was bundled in that OTA). or possibly the sbl images, which I doubt, because they have been secure even in the pre-release 1.44
[AT&T, Rogers HTC One X, Telstra One XL] eraste:
Wishful thinking, o yea congrats on the promotion.

Scribed on my Clean one X
[AT&T, Rogers HTC One X, Telstra One XL] wileout:
If this been posted im sorry but has any one looked into the exploit that team unlimited.io used to crack all of the evolte hboots and obtain soff? If i knew anything about how to crack id look into it but i have no clue lol so hopefully someone with the knowledge and know how should try talking to them or looking into it. Also if we want soff we should really consider a donation thread to get them a device or two to get us soff.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
http://xdaforums.com/showthread.php?t=1819238

In the over 200 pages in this thread, a lot of things have been tried.

If the same methods for previous phones worked, it would have happened a long time ago.

(that means no, it's already been tried and doesn't work)
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
the incredible 4glte DOES HAVE and sd card. its using a similar(same) exploit as the LTEvo(dirty racun)

please check facts before posting such things,and honestly,if you care about this subject,you should read the thread,or at least search it for some different keywords(unlimted,wire trick,QHUSB_download,etc),as you are making it even longer without really helping,even tho you are well intentioned.

sc card slot on fireball(inc 4glte)

wire trick has been tried. there were no obvious exploits.

all modern phones gaining s-off via unlimited ARE using an sd card exploit
[AT&T, Rogers HTC One X, Telstra One XL] darkspr1te:
Merry Xmas Folks

http://xdaforums.com/showpost.php?p=35762370&postcount=46

Enjoy the link.

Hit thanks if you liked :)
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
From what I've seen, the methods used by team unlimited somehow utilize the external sdcard to trick the software in to running a file they create and store on the sdcard. What it does or how it works I don't know, but it does rely on having 100% stock firmware and software and being htcdev unlocked.

Also, please note that while these devices are so similar in terms of hardware, they each have different software and firmware that is written and maintained independently of one another. They may share a common base and any patches that apply to such, but that's where the similarities end.

I remember reading, somewhere, that they are looking in to the onex. For all we know they may even have an exploit ready. However, they have both stated and demonstrated that they will not release anything until it has been properly tested to be safe and reliable. Of course, as with any developer working in their spare time, results don't always come fast or easily.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] el7145:
Can someone let us know what this means
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
For s-off, not much. That contains a generic hex file for the msm8960. Sure, with some testing and some fooling around one might be able to gain s-off, but it wouldn't make a good mass-usage solution. It's main purpose is to completely reflash a blank or corrupted emmc and currently the only way to load it is via qpst to an already bricked phone.

Subjecting a working phone to this limits you to using windows to load the hex, the need to distribute a copyrighted program, and also risks wiping all data from a users phone if and when something goes wrong.

But with it's help someone might discover another way... The door is now open, but know what your doing before you walk through.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] E.Cadro:
Okay I just cleaned up the last two pages of non related posts.

It has been asked on numerous occasions to keep this thread on topic and to only post things that are relevant to S Off and yet the posts continue.

There are people who are still actively working on gaining s off and use this thread for reference and they don't need to search through page after page of things that have nothing to do with gaining s off. They may not be posting in the thread but that doesn't mean things aren't being worked on.

So please STOP the irrelevant posts.

Moderating from my One Xl
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
I'm very HAPPY TO BE WRONG!!

Here are your HEX files. MERRY CHRISTMAS!

8064_msimage.mbn
8930_msimage.mbn
8960_msimage.mbn
MPRG8064.hex
MPRG8930.hex
MPRG8960.hex
GPP8064.hex
GPP8960.hex

THESE ARE NOT TESTED! AFAIK. You could hard brick your device if you try to flash these, in case they have the wrong signature key, as expected by your HTC device. I TAKE NO RESPONSIBILITY with anything that happens if you use these.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Holy crap....
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Wow!!! Thanks
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I've been trying to use these, I figured it would go through. I keep getting an error because it's missing a cookie that should be "attached". I'm guessing it's missing a signature, or a cookie(key) that is needed to allow mmc flash thru qshusb mode. Any ideas?
[AT&T, Rogers HTC One X, Telstra One XL] :
18th said that the post right above you.

# su
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
You're not alone. Other ppl have seen that error on different devices using a different hex (8660 to be exact). The actual cause is unclear. Some ppl got that error, some didn't. Some things to consider:

1) you are using the emergency download option in qpst, as the files can only be loaded when the phone is in ehostdl.

2) the hex can only be loaded once per cold boot and will only load the proper msimage.mbn file in to memory.

3) double check all your qpst settings and proper driver installation.

4) double check that the supporting files are properly built for the device.

I believe the problem is related to #1 and #2. Based on exhaustive reading, the hex appears to be a generic, processor specific binary that's only job is to load the msimage.mbn which contains the vendor specific code needed to init the processors, access the emmc, and provide qhsusb_dload. So far I've seen no evidence of signature checking being done on the hex. Also worth noting is that signature check failures actually cause the device to enter download mode.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] olegfusion:
ok, trying those files in the Pantech vega r3 a850s with qualcomm apq8064.

So, file is MPRG8064.hex

I get also cookie error (not present) in emmc downloader. If I'm trying to upload hex file in the revskills to address 0x2a000000, I get failed to execute bootloader: 05.

If I'm uploading hex in the software download (qpst), tab factory image, I see that it's uploading well, but then it says that can not to communite with flash bootloader.

If I try to download hex file in the software download tab, I get that hex file is invalid.

Any ideas?
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
The hex file is a 'flash programmer', a set of instructions that tell the hardware how and where to download the mbn file. It can only be used with the emergency download feature built in to the pbl. To access that feature the pbl checks if 2 variables are set in the imem, called magic numbers. Together they are referred to as a cookie, signaling the pbl to enter emergency download mode (ehostdl). If these are not set, then the hex file can not be sent.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] olegfusion:
hm, thanks. Actually I tried to use revskills, uploading of hex file works fine, but I get error cannot execute bootloader: 05.

Is it referred to same idea you posted upper?

is there any way to de-brick the device then?

I have fastboot available and dd and I need to repair partition table (all data is fine and I have partition table backup). but I can't write partition table because when I try to dd it or when I try to use gdisk write option the phone goes into qhusb mode and I can't do anything
[AT&T, Rogers HTC One X, Telstra One XL] saketh91:
thanks for the explanation. now I really understood wts happening. now I have two doubts. 1.can a hex file in which those two variables are set be produced? 2.when this process is a success, will it make the device expose its partitions or those partitions will be set so that we could boot into android?. anyways thanks for the explanation again and hoping you will come up with the solution soon.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I'm writing to device successfully in emmc flash programmer. Its completeing the writing process and sending the go command to 0x2A000000, which is also the first write address . It times out with no response after go command sent.

Unsure of what the go command is, and if the start address is proper

Disregard.........moving on
[AT&T, Rogers HTC One X, Telstra One XL] saketh91:
can you provide me instructions on how to do it. may be I will test check for you. thank you
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
INSTRUCTIONS FOR saketh91 ONLY

Download p4recover from one of the last few posts in the Jet thread (see link below)

Unzip p4recover in to the Jet folder.

Follow instructions to properly use hex file. Then switch to linux. After it boots up unplug phone then plug it back in.

Run:

sudo dmesg | tail -10

Look for the sd device reported for the phone.

cd to jet directory.

Make p4recover executable:

chmod +x p4recover
./p4recover

Enter your imei # at the prompt. It will calculate the checksum and then create a new bakp4

Then you need to check to make sure we have the correct address to write to:

(Replace ? with the letter of your phone, sda, sdb, sdc)

dd if=/dev/sd[I]?[/I] of=./data.bin bs=512 count=2 skip=262111
hexdump -C ./data.bin

In the right side on the first line you should see EXACTLY:

HTC-BOARD-INFO!@

IF YOU DON'T SEE EXACTLY THAT, STOP!

If you DO see that, then:

dd if=./bakp4 of=/dev/sd[I]?[/I] bs=512 count=2 skip=262111

If everything was correct you should be able to reboot your phone in to android.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] saketh91:
I am sorry but i have two doubts in this.

1.where can i find p4recover file in the jet thread?

2.where to go to find the directions to use hex file?

thanks again and you are the man. i would really appreciate that

thanks again man

ok i understand the second step is yet to be found right?
[AT&T, Rogers HTC One X, Telstra One XL] :
http://xdaforums.com/attachment.php?attachmentid=1570702&d=1355760471

this may also be relevant, it applies to older ones, though it may still work with the same process.. http://www.anyclub.org/2012/04/how-to-build-emmc-flash-programmer.html

If I am incorrect, someone slap me so I can fix it
[AT&T, Rogers HTC One X, Telstra One XL] saketh91:
thanks for providing the links to the thread.i already found the p4recover file.followed it.but the another link anyclub.org posted instructions on how to create .hex and .mbn files for 7x30. it may even work 8x60 also but those instructions are beyond my understanding. i would better wait for someone to create those files and post instructions to noobs like me on how to use it.

thanks man for the reply.

---------- Post added at 01:11 PM ---------- Previous post was at 01:02 PM ----------

that's ok still have faith in you.
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
Edited that post with the correct instructions. Make sure you have the latest version (version 2) of p4recover that grim linked to.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] saketh91:
i understood ur instructions.thanks for the info.but what i am asking is how do you use the hex file in windows? is it the possibility that you are posting here to be done after we are able to successfully load that hex file or is there a method already to do that?please reply.

thanks again
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
Once someone posts how to successfully load the hex file.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] saketh91:
i have been searching for the proper hex file and how to instructions.found this http://www.anyclub.org/2012/04/how-t...rogrammer.html and thought if it works.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Could you guys post the exact error you get?

(And the procedure you followed followed immediately before.)

There are different "cookies" used for different subsystems... Basically a cookie is set on the eMMC FS to tell the device why and how to reboot. For example if it is rebooting because of recovery procedure or backup etc. In which case it will do different things, AFAIK.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Will post more when I'm home, but I'm using qpst emmc flash programmer, with mprg8960.hex/msimage_8960.mbn.....error is....failed to retrieve cookie(if attached)......here's my log........

http://db.tt/n046glgI