yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Hey Guys!

I have been haunted by these S-OFF threads for more than half a year now, ever since I first read about it. However, it is unfortunate to see that you have not made much progress since. So I'm willing to pitch in wherever possible to help you guys out. (Always looking for a good challenge when time allows.)

But I must warn you first of all. That I do not own a HOX, nor do I have access to one, so my input will be rather theoretical and sporadic. In any case seeing that you're using the US version of HOX, you're probably using the Snapdragon 4 S (MSM8960) which is the same we have in the (Verizon) Samsung Galaxy S3 for which we were trying to unlock the bootloader. We found and have some very relevant information for this processor setup, so I really think this is related to your S-OFF troubles.

So in order to best be able to help you out I would like to see as much as possible of the following items.

Close-up internal HOX photos of the MSM8960 and surrounding electronics

HOX Service Manual

HOX schematics

Extracted bootloader images, all possible/available from IROM to HBOOT

(Or RE code if there is any available)

The exact HTC model number and FCCID (Something like NM8xxxyyyy..)

When giving this information it is very important that you specify for what model (HTC product ID), firmware and the android version you're using. If we work simultaneously on different firmwares, models, its gonna get complicated, if not impossible to compare notes. Only working with non updated stock firmware would be the best...

Also have anyone tried to reverse the code actually displaying the "S-OFF" after boot? I'd guess this would be the first thing to look at! (To find where in memory space S-OFF and if indeed the HTC concept of S-OFF is a combination of security features implemented. Such as a combination of Qfuses (Qualcomm)...

The main reason we need a Service Manual (or Schematics) for the device is to figure out how the boot configuration pins have been set, in hardware. It's possible that this have already been discussed and solved in this thread, but I have not had time to search for / look for the details in this yet.

Hope to be of any help.
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
im not quite sure how to provide some of the things youve requested,but do greatly appreciate your input and willingness to help. for what its worth,the lte evo(jewel) has a radio s-off via some sort of processor exploit,and is running the smae s4 processor. i am hoping they are working to add the s4 HOX,as well as some other s4 variants(one s,inc 4g,etc)

http://unlimited.io/lazypanda.htm

for most of us,asking in IRC for ETAs,or even what theyre working on is strictly prohibited(they are not very nice in their responses) but since you seem to have a great technical knowledge maybe you can be of service to them or vice versa.

i have an HOX still running 1.73.502.1 and hboot 1.09.0000. id be happy to help or test however i can :)
[AT&T, Rogers HTC One X, Telstra One XL] 8125Omnimax:
Is the java on the HOX vulnerable to the java "zero day exploit", or has this been tried already
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Lazy panda exploit requires an SD card, trust me. Me, beaups and 18th.abn know that exploit to a T. It will NOT work sadly..
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
BTW1: Does the HTC One X go under any other brand/model names? (Something that seem popular for HTC to do.)

BTW2: Has anyone gotten a complete UART bootup-log output? (This can be very helpful in tracking what the different bootloader(s) does and when.)

PS: I'm not a big fan of IRC. IRC is great for discussions, but bad for keeping track of success and failures. You also loose most of the random community involvement that can suddenly kick up the development in just a post or two!
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
The one X is codenamed EVITA

any phone codenamed Evita will be known as either a One X or a One XL

Stupid North American Carriers didn't differentiate between this phone and the tegra 3 codenamed endeavor.
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
I noticed it on the header of your hboot the openDSP version and i wanted to ensure that i had it written down somewher for ref
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
oh ok :D
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
can you run this command while in fastboot USB mode?

fastboot getvar CID

and post the output

mine for att is

C:\Users\IBM_ADMIN\Downloads\onxr>fastboot getvar cid

cid: CWS__001

finished. total time: 0.003s
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
I changed mine to 1111111

from rogers001

---------- Post added at 01:44 PM ---------- Previous post was at 01:44 PM ----------

sorry i mean 11111111

---------- Post added at 01:48 PM ---------- Previous post was at 01:44 PM ----------

my is cid: 11111111
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
This is exciting.!!! Good luck you guys, I hope you win the huge bounty as well for s=off :)
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
Before you altered ti was rogers001??

we need to alter CID IMO for htcdev unlock
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
yes..it was rogers001

---------- Post added at 02:58 PM ---------- Previous post was at 02:54 PM ----------

want't htcdev unlock imei based
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
i have some tools to alter those things but unsure of use on att one x
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
good luck to you
[AT&T, Rogers HTC One X, Telstra One XL] PurpleFries:
You guys still need Rogers unlock tokens? I should have 2 in my email
[AT&T, Rogers HTC One X, Telstra One XL] K4get:
[WIP][DEV] Unlock AT&T Bootloader

I am not a Dev. Is there a way to clear everything on the motherboard like brand new off the assembly line . flash or clone the bios or firmware from say the Vivid or the sanitation phones that have already been unlocked. Sorry guy's I am not trying to upset you . I am just thinking out loud. :cool:
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
Sure if you want a nice brick :D
[AT&T, Rogers HTC One X, Telstra One XL] K4get:
[WIP][DEV] Unlock AT&T Bootloader

well if nothing else maybe I gave you a good laugh
[AT&T, Rogers HTC One X, Telstra One XL] sk806:
Status

So, we (zarboz and I) are fairly certain the bootloaders are identical between Rogers and At&t (I am going through the extremely painful line by line comparison in terminal to be sure...). So that's likely not it. Probably CID/IMEI...In other words, unless we are wrong about the bootloaders, HTC did not lock down its bootloader, but agreed to not allow At&t HTC One X phones to use their unlock service. Lame...
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
lol.......sad...

as lucky as I am having a s-off unlocked htc one xl...

but i'm not a phone developer...== I want cwm...aokp rom...on this good looking phone...
[AT&T, Rogers HTC One X, Telstra One XL] sk806:
This may be a very long shot, but could a few at&t users and a Rogers user or two send me their identifier tokens via PM. probably ok to paste in open, as they are likely useless, but just in case.... I just want to see if there are any similarities...

In fastboot, "fastboot oem get_identifier_token", then paste the output in a pm. Thanks.

Steve
[AT&T, Rogers HTC One X, Telstra One XL] dasfiend:
If that's the case, could there not potentially be a way to trick HTCdev into unlocking our at&t BLs? I don't know anything low level about how that check is completed or where, but hey it's an idea. ;)
[AT&T, Rogers HTC One X, Telstra One XL] sk806:
see my post right above yours, that may be it, or we may need to actually alter the cid to get the identifier token right. That's why I am asking for people to send me their identifier tokens....

Steve
[AT&T, Rogers HTC One X, Telstra One XL] killster:
ATT PM coming your way sir.

Hope it helps.

killster
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
Please ensure they are from different
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
Because that extra letter means soooooo much, especially since every variant in north America has the S4

So by default they all have LTE so there isn't a reason to have that L at the end if there isn't a version without LTE
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
the version without LTE Looks identical to ours and is called the One X. Internally it is a completely different device.

Calling it the XL is what they should have done IMHO.

How many questions have you answered from people who flashed stuff not meant for our device?
[AT&T, Rogers HTC One X, Telstra One XL] CalypsoMoon:
Maybe this will help you.
[AT&T, Rogers HTC One X, Telstra One XL] vaggolena:
Just wanted to say thanks to everyone for all the work you have done to try and get s-off on our phones!:good:
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
i was not aware that the jewel lazy panda tool was using an sd card exploit. makes me a sad panda :(
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
I disagree, but that's just my opinion

Xda needs rename the forums to fix the problems of flashing the wrong roms

I've stated this many times, but its not going to happen

I've helped a few, usually people beat me to it

I've helped plenty of people throughout my time in Xda
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Yes, I have already seen similar videos, but they are not helping or

interesting apart for the scribbles on the notepad. ;)

I bet you a dollar that the "Wire-Trick" is simply shorting (forcing)

a breakout-pin from the MSM, most likely one of these (from here):

[SIZE=1]-------------------------------------------------------------------------------
pad gpio name connection boot Rxxx
-------------------------------------------------------------------------------
AH32 119 [COLOR=Red]BOOT_FROM_ROM[/COLOR] ANT_SW_SEL0
AH33 118 [COLOR=Red]BOOT_CONFIG_0[/COLOR] ANT_SW_SEL1 * R-0
AM31 117 [COLOR=Red]BOOT_CONFIG_1[/COLOR] ANT_SW_SEL2 * R-1
AM30 116 BOOT_CONFIG_2 ANT_SW_SEL3
AN30 115 BOOT_CONFIG_3 BC0_SW_SEL0
AM29 114 BOOT_CONFIG_4 BC0_SW_SEL1
AN29 113 BOOT_CONFIG_5 BC1_SW_SEL0
AK28 112 [COLOR=Red]BOOT_CONFIG_6[/COLOR] ANT_SW_SEL4 * R-6
C30 - RESOUT_N MSM_RESOUT_N
-------------------------------------------------------------------------------
[/SIZE]

What it does, is either:

a) allowing you to download a new unsecured bootimage (BC[6]) in Emergency Host Download Mode (EhostDL)

b) setting the boot device, to boot from SD, eMMC or USB. (BC[0:1])

c) a combination of (a) and (b)

d) "NOT" BOOT_FROM_ROM (this functionality is still unknown to us)

e) Something else ... ?

According to the recommended reference boot table:

[SIZE=1][SIZE=2]------------------------------------------------------------------
[B]c1[/B][/SIZE] [SIZE=2] [B]c0[/B] function
------------------------------------------------------------------
0 0 Emergency Boot from SDC3 (SD) followed by USB-HS
0 1 SDC3 followed by SDC1 (eMMC)
1 0 SDC3 followed by SDC2 (not used?)
1 1 SDC1 (eMMC)
------------------------------------------------------------------
[B]c6[/B][/SIZE] [SIZE=2] 0 - Secure Boot
1 - Fast Boot
------------------------------------------------------------------[/SIZE]
[/SIZE]

(The full table is more extended, but this is for the MSM8960 Reference Design.)

Then the guys (in the wire-trick video) are just using the Qualcomm

protocol to download some new/hacked boot image to work their S-OFF magic...

So I'd like to compare the GPIO settings for HOXL with those of I535,

could you dump the results from:

cat /sys/kernel/debug/gpio

and if that doesn't work try following part B of this post.

BTW: Does the US HTC One X(L) have the extra uUSB "POGO" pins as described here?
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Finding the BOOT_CONFIG and BOOT_FROM_ROM pins + connections

Reason for asking about GPIO is to see how similar the board wiring (next to MSM) is to that of the I535 (which we know exactly). Seeing that very few GPIO are in fact similar (mostly I2C) we cannot expect the component layout be remotely similar to that of the I535. We need internal photos + schematic!

(We could also back trace PCB measurement to find BOOT_CONFIG + BOOT_FROM_ROM pins/resistors/connections. Difficult!)

If you wonder why the BOOT_CONFIG pins are not shown in GPIO, it is because:

a) when they are used (set) as such, they cannot be used as GPIO, unless Qfuse is blown. AFAIK

b) "unused" pins are not shown (and default pin setting is unknown since we don't have MSM manual)

c) could also be masked by kernel not to show in FS "../gpio" file.

I need:

1) Does someone have a Service Manual (or schematic) for another recent HTC phone using either the MSM8660 or MSM8960 PoP's, that have been successfully S-OFF'ed?

2) Also I'd like to see a dmesg log immediately after a "take out & insert" battery reboot. Please dump to Pastie or like and only provide link here.

3) If possible an early UART boot log.

Why we need this?

A) We need to determine how HTC uses the BOOT_CONFIG (etc) pins to secure their boot/startup mechanism and many other security mechanisms.

B) We need to determine if HOX is using Qfuses (and which ones), this is hard to determine, but may be understood from knowing (A).

I now suspect that the boot pins are not actually permanently set in hardware (as in other devices) but could be programmed in the firmware of the PMIC (or other chip powered on before AP/CP).

This would be a very dirty trick! <=== BUT is just my own wild speculation!!

And this is why we need HW info; in order to avoid wild speculations!
[AT&T, Rogers HTC One X, Telstra One XL] Vendetta-NY:
**** just got real.
[AT&T, Rogers HTC One X, Telstra One XL] Antagonist42:
Info

Schematic and boot architecture.... link in signature.... Docs were kindly passed to me for posting
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Thanks I already have that. But what we need is the phone schematic specific for this device...
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Schematics would be in the IEEE database but you have to be a member to get access to it or pay a fee and fill out a membership application.
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
I don't see them anywhere in ieee.

E:V:A check your messages. I sent you a link to the MSM 8960 schematic. Let me know if that's what you're looking for.

Nevermind, think I sent you the same stuff as Antagonist.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Thanks to some great High-Res PCB photos of HOXL, and our previous MSM8960 BGA layout, I have managed to partially reconstruct the location for the BOOT_CONFIG pads and resistors (if any). These have to be checked my measurements, unless someone can confirm with the service manual.

The initial image I got from the FCC pages. The HOXL has FCC ID: NM8PJ83100

and the very bad internal FCC pictures are here. It was clear that this sucked,

so instead I found the "Cracking open the HTC One X" from TechRepublic.

Wow what an improvement! FCC should afford buy themselves a new camera!

Original FCC:

From TechRepublic:

(Courtesy TechRepublic)

The MSM8960 pad layout superimposed on the HOXL PCB, showing the relevant boot configuration pins:

0-6 = BOOT_CONFIG[0:6]

B = BOOT_FROM_ROM

R = RESOUT_N

Unfortunately these photos were cut off and not showing all MSM relevant components,

but they can be seen in the FCC on top. Here is close-up of the interesting area (yellow)

where to measure, with the pink arrow pointing to additional components outside picture.

"They" should also have removed the shielding before making these photos...

...
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
woah
[AT&T, Rogers HTC One X, Telstra One XL] wdkingery:
Alright Sorcerer EVA, what happens next?
[AT&T, Rogers HTC One X, Telstra One XL] toptalent:
RU gonna turn the naysayers into believers???
[AT&T, Rogers HTC One X, Telstra One XL] InflatedTitan:
Dude is a beast... Did beaups give up on this matter? haven't seen him post...
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Would be nice if eva would share where he is going with all of this...
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Well I'm about to reach my limit of what I can do on the other side of the planet away from Qualcomm's HQ (CA, USA), all while being some 7-8 time-zones away from the nearest HOXL! But there's plenty of things YOU can do. Just look at my post one pages back, where I made a list of things I'd like to see and so on...

In addition, it would be great if some technician would get his/her hands "dirty" by opening their device and measure voltages around the points I pointed out. (The resistor values, if present, should be 10K @ 5% & 1/20W, SMT 0603.)

In fact this was one of my last posts before this thread closed. In particular part (A) and (C) are of interest for us. Then:

1) We need to know the exact HW boot-pin configuration.

2) We need to find/read the Qfuses.

3) We may find the dmesg output directly after a battery-out reboot, useful!

4) We may need early boot log UART (debug) output

5) It could help to understand how both the main µUSB and the POGO-pin µUSB are connected/switched.

6) How the eMMC is used for securing the partitions.

7) Get me a copy of the code that display the S-OFF & other lock information.

There are of course many different ways to approach SOFF. My way is only one, because I know the hardware better than any other particular feature of the HOXL, which is a completely uncharted territory for me. If anyone care to keep me up-to-date what people are doing/working on and what have been tried, that would be great. I have of course seen the Xmoo thread, but it seems like everyone left that ship... Where did they go?

This brings up another point. People wonder where I'm going. Honestly I don't know, but it is clear from the Xmoo thread, that working from the outside-in is too messy with too many variables (ie. BOOT_CONF, APX, various HBOOT versions etc.) So I just choose to work inside-out. I know there is a lot of interesting work already done on the eMMC behaviour, but that's probably what we should look at last! (Unless these people are already in possession of the information I'm looking for, in which case they should share it.)
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
But what is your "way"? What's your angle?
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
^^ Bottom line is to gather reliable information required for someone to successfully reverse engineer the part of the boot loaders that does the SOFF checking. From then on we can hopefully easily find ways to fake/inject those bits and pieces that constitute SOFF.

EDIT ================================

Has anyone actually tried to RE the SOFF code?

(Do we even have the image containing the SOFF checking-code?)

What exactly constitutes the SOFF anyway?

- To me it seem clear that what is SOFF for the HOX, is not the same as the SOFF for the HOXL. It just can't be unless SOFF checking have been made modular and hardware independent, which certainly is not what various threads and solutions are presenting.

The excellent explanation by regaw_leinad is helpful. Since HTC will never want us to have SOFF, they will continue to offer their unlocking service, but mind you, that if I were HTC, I would make sure everyone who does unlock his phone, also gets his latest patch of the SON (in their boot loader or wherever these pieces are located), which varies quite bit, AFAIU. Surely someone checked this, right?
[AT&T, Rogers HTC One X, Telstra One XL] wdkingery:
So what about this thing for sale at about $3? (200 yen)

a.m.taobao.com/i10824156715.htm

I don't know if it's a device, or software or what.. Not very descriptive.

But I found it on the xmoo thread EVA linked.

Clearly says s-off HOXL
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
We've done a lot of this already. I'll put the time into this again, but want to understand your theory first.
[AT&T, Rogers HTC One X, Telstra One XL] InflatedTitan:
Yea... Can you follow that beaups? I know you were the leader. All that looks familiar to you?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Follow what? I'm trying to figure out what evas strategy is here. Not questioning the validity, just looking for clarification.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
I understand that many people are worried that I am just barking up random trees hoping that one would get me the cat, but this is not so. So let me try to motivate my actions/requests.

Why do we need to know the Qfuses?

-- The Qfuses are used for all fundamental security settings used by the bootloders. (whether to check for signed images, external USB devices, JTAG device authentication etc etc.) As such, we can assume that at least one, but most likely several, Qfuse settings are involved in defining SOFF. By knowing these settings we can eliminate some of the Qfuses as being involved.

Why do we want early (preferably HW) UART boot logs?

-- Because UART boot logs come from the boot loader chain and often tell us secrets about what is loaded and from where/when. Addresses, registers, HW settings etc. Under the right happy conditions, a UART serial terminal may even presented you with the FIQ debugger, where you can read and write registers and/or memory locations etc. Here is an example of the most complete UART boot logs we've seen. (For an OMAP 4460...)

Why do I want the dmesg output?

-- Because kernel dmesg tell us more detailed secrets about the hardware, such as configuration settings, chip drivers, and all attached devices, boot options, debug levels etc. Come on guys, I'm still waiting for someone to post the results from: "adb shell dmesg" !! Just remember that its using a ring-buffer that will eventually overwrite all the goodies, unless you do it immediately after a reboot.

Why do I want to access the Modem AT command interpreter?

-- Because everything is done here, this is the real brain of your phone, all info you could imagine about the radio part is contained here. What used to be a simple boring interface 30 years ago, today you can manipulate everything from here... The Application processor is just for fun and games, the UI. The Modem (CP/BP) is where it's happening and who like to talk to QPST etc...

The Big Question: What constitutes S-OFF/ON in the HOXL?

-- That's what were trying to find out here! Most likely a list of items like:

- Qfuses

- eMMC protection

- Bootloader Authentication

- other hidden parameters

- the entropy of the black-hole in the center of our galaxy

Hope that helps (YOU getting motivated)!
[AT&T, Rogers HTC One X, Telstra One XL] wdkingery:
Anyone notice this post? I'll gladly spend ¥200 on it if it gains us what we are after
[AT&T, Rogers HTC One X, Telstra One XL] xaey:
So I would gladly like to help out in getting you this info, but most of it seems to be way over my head (I'm no dev). Pretty much all I understood was using this adb command (which I'm not even completely sure what the output means). But I can post the output of this if needed. Does it matter if im using a custom rom and is timing important? for fear of being thrashed, I'm sorry if I can't be all that much helpful... otherwise I can leave it to the recognized devs to help you out.
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
Here is my output after doing a fastboot reboot. It is difficult to pull a dmesg after battery pull as our battery is not exactly easy to just unplug.

http://pastebin.com/6LF5G6sF
[AT&T, Rogers HTC One X, Telstra One XL] xaey:
Ah beat me to it. I think I got the timing wrong on mine anyway.