yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
You can do it! Break that promise, and join the fun!

Wheels within wheels in a spiral array, a pattern so grand and complex, time after time we lose sight of the wave , our causes can't see their effects.

Rush. Top 5 all time. Rock and Roll Hall of Fame should be embarrassed.
[AT&T, Rogers HTC One X, Telstra One XL] Spankly:
Yea my wife really wants to try out her new whip..... Hmmm might be fun:D

Sent from my factory HTC ONE XL unrooted and loving it..... kinda not really... I made a promise I wouldn't root :-(
[AT&T, Rogers HTC One X, Telstra One XL] iElvis:
This just in:

Source code due out next week.

http://xdaforums.com/showpost.php?p=28071736&postcount=14
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
A Mod without a Rooted phone shouldn't be a mod ;)
[AT&T, Rogers HTC One X, Telstra One XL] Spankly:
I'm not a mod. Atleast I don't think I am. Haven't visited the website in about a month lol. Been using tapatalk to talk on the forums to help because I've been so busy with my family. I only try and help:D:thumbup:

Sent from my factory HTC ONE XL unrooted and loving it..... kinda not really... I made a promise I wouldn't root :-(
[AT&T, Rogers HTC One X, Telstra One XL] ChongoDroid:
Sweet, I get Skizzs one x in a week. :D hehe

Sent from my HTC One X
[AT&T, Rogers HTC One X, Telstra One XL] Koizuma:
That's pure speculation and nothing more, I want to see an official statement from HTC about them releasing the source.

Swyped from my HTC One X using XDA premium.
[AT&T, Rogers HTC One X, Telstra One XL] rohan32:
Back on topic please. This is for S-OFF, not kernel source.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
We can write to hboot from any mode (assuming you have root). It'll just brick your device. due to signature failure.
[AT&T, Rogers HTC One X, Telstra One XL] Skizzy034:
There's someone with an AT&T s-off device. I think it's niceppl. Would his phone be able to help us out?
[AT&T, Rogers HTC One X, Telstra One XL] Spankly:
Ty for correcting me :D I was sure I read that hboot was the only thing we couldn't flash. Guess I was wrong :thumbup: now I know

Sent from my factory HTC ONE XL unrooted and loving it..... kinda not really... I made a promise I wouldn't root :-(
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Doing the wire trick gets the phone into download mode... We can't just write from there?? That's what me and 18th.abn were trying to do but we never figured out how to do it..... Now he has moved on to a sgs3..
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
Does it brick right away, or on reboot? Seems to me if it flashes, the sig check is coming from outside hboot. Maybe we could find the spot that checks the hboot sig?

Just tossing ideas out.
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
should be able to, yes.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
So now just to figure out how to write.... If you want the video to show how our wire trick is done let me know.. I will post it
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
It pseudo-bricks on reboot. The radio decides whether or not the sig checks (secureboot) should take place at all. It checks (we believe) mmcblk0p3 to make that decision. Once it sees that we are s-on the decision is made to sigcheck hboot. Since we edited hboot, the sigcheck fails and we get our pseudo-brick.

This is simply how I understand it.

Based on that, we have 2 methods of attack.

1.) Modify radio to force insecure boot. This is complicated and out of my league. The radio even has certain signature checks on itself. And if we screw up here we are bricked.

2.) Figure out a way to write to mmcblk0p3 to set the flag to s-off. Also quite complicated as it's eMMC WP. The other piece we don't know is whether or not this partition is signature checked. If it is, we're screwed again.

Download mode could be useful. Issue is I don't believe ANYONE has been successful in getting it to do anything.
[AT&T, Rogers HTC One X, Telstra One XL] Hunt3r.j2:
The Jewel (Evo LTE) managed to get into some kind of low level dload mode without any wire tricks, I suspect something similar is doable with the One X...
[AT&T, Rogers HTC One X, Telstra One XL] ptesmoke:
this^ its gotta be awfully familiar.
[AT&T, Rogers HTC One X, Telstra One XL] Antagonist42:
You may be want to check this I posted about my phone and where BOOT_SCUR kicks in for security and from where it is kicked in from... also here for MSM8960 Schematic [Page 10 - Sheet 5] gives you WDOG_EN and BOOT_CONFIG as looks like you have 5 GPIO pins to contend with, also ensure which S4 chip you are dealing with (MSM8960 is only as a guide/idea and only for the S4 Plus the MSM8960T is for S4 Pro) as S4 Play and Plus are dual core the Pro and Prime are QUAD core I would not take it as read that they are the same chips in all the same model ;)
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
I never know 1.44 ruu has a hboot of 1.01?
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
A big problem is I don't have a One X to work with as well. It seems some of you thought I am part of Unlimited.IO's team, but I am not. Just wanted to clarify that. But I am working on things to get this moving for you guys. Having a phone would help. If anyone here's phone get's "stolen" let me know ;)
[AT&T, Rogers HTC One X, Telstra One XL] Spankly:
Would it help if I borrowed you my phone for a coupe weeks??

Sent from my factory HTC ONE XL unrooted and loving it..... kinda not really... I made a promise I wouldn't root :-(
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
Dude you are the man if you do that. I'm sure it could help. Dude is honest so you wont have to worry about not getting it back.. and if you didnt... most add on warranties cover lost or stolen.... Hence the wink ;) about the stolen phone earlier :highfive:
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
In the event one were to frequent various establishments typically inhabited by unsavory characters, where would one pick up an add on insurance plan? ;)
[AT&T, Rogers HTC One X, Telstra One XL] dkirchik:
Haha. That made me LOL for reals!

If you're within your 30 days ATT will add it to your plan. I think best buy might add it too.
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
And do you know if they ban the IMEI? From memory I think they don't. Which is, um, too bad, really.
[AT&T, Rogers HTC One X, Telstra One XL] kleeman7:
Isn't there that one sim unlock that gives a generic imei?
[AT&T, Rogers HTC One X, Telstra One XL] Spankly:
Edit: dumb thought removed:D

Sent from my factory HTC ONE XL unrooted and loving it..... kinda not really... I made a promise I wouldn't root :-(
[AT&T, Rogers HTC One X, Telstra One XL] k4p741nkrunch:
Forgive me if this is a stupid question, but can't you access Qualcomm dload mode simply by booting up the phone while holding volume up? Saw a thread where this was discussed as a potential quick brick, before it was found people could exit dload mode by forcing a reboot.

Just trying to help.
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
The trouble is what to do from there. ;-)

It's a matter of drivers (found), and commands that work. Another forum (similar chipset) is pretty close. I actually hope to get in touch with them, when I finish the last 100 pages of their thread.
[AT&T, Rogers HTC One X, Telstra One XL] k4p741nkrunch:
I was simply referencing it as a way to avoid this ominous-sounding "wire trick". I think I heard somebody mentioning poking a hole through the back of the phone? Please god no if it can be avoided!
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
LMao to who ever pokes a hole in there phone.... I got a video showing how to take it apart and do the wire trick. Problem is we don't know how to flash in dl mode.... We got the qpst drivers/program but don't know how to flash.
[AT&T, Rogers HTC One X, Telstra One XL] daddioj:
i am very good with electronics when it comes to repair solder and removing things but god. i rather not take apart my 600 dollar phone to do a wire trick even though it seems simple enough i dont like disturbing things. but by the looks of all the past recent devices the wire trick seems to be the "thing" hopefully there is another way
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I agree with you a million percent!!! Hopefully it will be like panda s off ;)
[AT&T, Rogers HTC One X, Telstra One XL] k4p741nkrunch:
I hear a lot about mismatched signatures causing soft-bricks. Is this signature calculated using MD5 hashes or is it SHA-1? If it's MD5 its possible to generate a zip with new contents and spoof the hash and forge a valid signature. This would allow for overwriting secure partitions as if you were HTC correct?

If anyone is interested, there are many articles out there detailing methods of spoofing MD5, the best method I've found being a collision prefix. There is also an application called MD5 hasher that claims to automate spoofing MD5.

I hope this idea can help. I'm trying to think of circumventing approaches to S-Off as opposed to conventional methods.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I think it's a great idea but I have no idea how they are generated.. you my friend may have stumbled across something helpful... Hopefully. :) guess we will know soon! :)
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
It's very true that if md5(x) == md5(y) then md5(x+q) == md5(y+q)

But the problem is, even if you had the 2 vectors that produce the same md5 (x and y), you would need some program in the middle to decrypt/parse q out of the full payload.

EDIT: Just to let you know, I'm still around this thread, just been quiet lately ;)
[AT&T, Rogers HTC One X, Telstra One XL] k4p741nkrunch:
MD5 is generated by adding padding to the original file based on it's length, then using blocks of the original message to generate an encrypting 'seed' which then encrypts the next block into another seed until the whole message is encrypted. A more detailed explanation can be found here

http://www.huyng.com/posts/dont-hash-your-secrets-heres-why-in-python/

This might not be entirely useful for generating a completely new zip and trying to force its hash to match that of an RUU, but adding a small file to an RUU, like perhaps a script, could be possible while maintaining the hash.

If this method becomes a dead end, there is another common exploit called 'binding' which involves piggy-backing a file (typically malware) to a fully functioning and unmodified file, allowing custom executable code to be run while the original file is parsed. It's possible that this could keep any HTC signatures intact and yet run a simple command to delete a security check from the secure partition.

If THAT method becomes a dead end, it might be possible to run unsigned code through use of an exploit like the TIFF exploit used to first run unsigned code on the PSP. Basically it involved modifying the hex of an image to contain code that when ran, tripped a security flag on a typically non-writable partition. Because this code was unexpected by the image parser, it had never been properly secured against the exploit. With the S4 schematics its possible that someone could write code that specifically targeted a unique structure of the S4. It could even be possible with enough code to make a universal S-off for any device.

Just writing down some thoughts. Hope it might inspire someone.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
To my knowledge we are dealing with actual SHA signatures, not md5 hashes.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Yeah, I was just gonna say that. :-/

Billy

---------- Post added at 04:24 PM ---------- Previous post was at 04:08 PM ----------

Here is that video that rpomponio got in case anybody is interested. I had a hard time finding it at first because it was posted under a different username :confused:

Billy
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
i dont believe that version of qpst supports our device... i have qpst 2.7.374 witch supports our device i believe.. Here you guys go..

https://www.dropbox.com/sh/15a1w9ke4eaa07c/SgYMgpPhVr

The reason i have 18th.abn's videos is because he is no longer part of this community, he moved on to the sgs3 and gave me permission to use his videos he made :)
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
What about cracking HTC's key? Anyone here know someone with a decent bitcoin rig? Maybe we can buy some time, shouldn't cost too much, $50-$100 at the most.
[AT&T, Rogers HTC One X, Telstra One XL] dkirchik:
I actually do. I've asked him about cracking HTC's key. He said he'd do it but after he finished what he's currently doing. Idk how long that'll be. He may have 6 GPU's but they're 6990's. I know he's upgrading to the 7970 GPU's next week.

I can probably convert my Intel computer and give it a whirl. I have 7970's (2) in that one. Seeing as I've never done it before, you'd have to tell me where to start?
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
I don't think it is enough hardware. I'm pretty sure we are dealing with 2048bit(correct me if wrong). Probably gonna need a bigger fpga or asic rig. On top of having enough processing, and you need a lot, brute force won't finish till long after we are dead. Need to use some tricks.

http://m.engadget.com/2010/03/09/1024-bit-rsa-encryption-cracked-by-carefully-starving-cpu-of-ele/

Just an example of one trick.

I know a little, but not nearly enough about what is involved. Gonna need someone with some "secrets" about cracking large keys. The govt can do it very quickly now(yes large computing power), but that isn't enough. There are tricks and shortcuts that they use. Realtime cracking of 2048 bit is within their reach, so someone out there knows some tricks. Anyone?
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
Hold off on wasting time with this for now. This is truly a last resort path. I was just throwing it out there in case the right person is lurking.

Wait for kernel source, and the awesome devs here, it will come. We are ok until then with what we have.
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
I would think there would be better luck removing the power on WP via cracking that password. Only issue is to remove it, you have supply both the password and the length of the password. I'm not sure we have that kind of access to the eMMC to even be able to determine where it's stored and it's length. But an additional thought nonetheless.
[AT&T, Rogers HTC One X, Telstra One XL] Toaster Strudels:
Will kernel source help us with getting S-OFF?
[AT&T, Rogers HTC One X, Telstra One XL] dkirchik:
I've been waiting for kernel source I have some idea for the kernel to break the security checks via the kernel. Looking over the schem for our chip set- makes idea idea promising.

That idea is to rewrite the security check with Qualcomm master security for debugging mode of the chip and eMMC checks. Pretty much if it works I think we'd achieve an ENG S-OFF via the kernel.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Awesome, well I'm happy to hear you are thinking ahead!! Looks like my work is done for the moment being :)
[AT&T, Rogers HTC One X, Telstra One XL] dkirchik:
The whole problem would become when those who'd want to do it can risk ruining the chip. If it works I'm gonna send it to Scott and see if he could make it a one click but it'd have to be done with qdart which I'd supply to everyone.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Well we got 1 year manufacturer warranty, could we use that to our advantage in worse case scenario?? I would have Scott one click it as well, :)
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
On the bright side, if you ruin the chip, they can't say you unlocked it and flashed a different ROM. ;)
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Hey, just throwing a bone out there. The other day, i was doing a ruu before selling my hox and it had an error. So the ruu wanted me to do a recovery process. Just for ****z n i opened up my cmd and did writesecureflag command. Instead of freezing up the phone as usual i got a different error. It was a java_sd_err id=1 . Different than before, it didnt freeze phone and after the error it gave me an okay. So it was actually allowing the command. Before all this, days ago i was messing around and did fastboot flash mmcblk0p3 mmcblk0p3 w. Soff #3 in fastboot folder. It actually sends it then give the verifying signature. Sig failed wen done. After the ruu recovery is wen i remembered this. I then tried writesec.flag during several diff. Points in the ruu and never got the java_sd error okay, again. So im pretty confident, if u can get the ruu to fail at the point it wants to do a ruu recovery, YOU have a phone ready to accept sime help without security...ruu, failed ruu needs to recover, FASTBOOT FLASH MMCBLK0P3 MMCBLK0P3. Sounds ridiculous, i know but trust me, we may get surprised!!
[AT&T, Rogers HTC One X, Telstra One XL] Tiffany84:
From what I've seen when messing with the RUU's before there was a root method for 1.85, pulling the cord during any part of the RUU flash will give you the option to recover like what your describing.
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
When it fails like that, can we push pieces, or does it have to be a full ruu to recover?
[AT&T, Rogers HTC One X, Telstra One XL] Irish Enigma:
I've been trying to follow this thread as best I can working night shift at my local Wal-Mart. I was wondering where we were with the Evo LTE method of s-off because tas you all know they have almost identical hardware.
[AT&T, Rogers HTC One X, Telstra One XL] eraste:
Also if you do not re lock bootloader you get this fail and it gives you several steps to do to recover ruu. Just did it lol I always forget to re lock before trying to ruu. However none of the steps really do anything as I know it failed due to me not re locking bootloader.

scribed on my clean one X
[AT&T, Rogers HTC One X, Telstra One XL] daddioj:
i read over in the INT hox forums. considering i came from a INT hox to the at&t varient i still peak over every now and again. someone had got a response from CEO of HTc and claimed htc listened and is not longer going to lock there bootloaders. how true this is i dont know. but if it is true its great news
[AT&T, Rogers HTC One X, Telstra One XL] bloodrain954:
thats very old news
[AT&T, Rogers HTC One X, Telstra One XL] daddioj:
thanks for letting me know. what a let down :crying:
[AT&T, Rogers HTC One X, Telstra One XL] bloodrain954:
yeah, its not HTC who is "C" blocking us, its ATT.
[AT&T, Rogers HTC One X, Telstra One XL] zounduser:
Our time will come. ;-)
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Hope so.... I've gotten quite discouraged lately...
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
Don't be, we have almost everything we need already. Kernel source is next, and it is coming sooner than later. After that s-off will come. Until then, you can root, unlock, flash roms, flash radios, and even carrier unlock. Could be worse.

Enjoy the phone in the meanwhile, cleanrom4.0LE is awesome.

Sent from my ATT S4 One X
[AT&T, Rogers HTC One X, Telstra One XL] zounduser:
Cleanrom 4.0 SE is awesome 2!!!! Lots of mods available!

Sent from my HTC One X using Xparent ICS Tapatalk 2
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
I wouldn't be. The manufactures have gotten quite good at preventing this. The dev community has constantly stepped up to find a way. Remember the old Droid on Verizon with the efuse? Things could be much, much worse.

We'll have s-off, and it will be because of the devs here. Period.
[AT&T, Rogers HTC One X, Telstra One XL] Irish Enigma:
Re: [WIP][DEV] S-Off

How do you know we will get the kernel source soon?
[AT&T, Rogers HTC One X, Telstra One XL] purin:
Sorry to butt in on this but I was with understanding that we were working so hard for s-off to get to carrier unlock (this is same as SIM unlock correct?) or perhaps I was misunderstanding the purpose of s-off.

thanks

-p
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
No we already have carrier unlock. There actually isnt a whole lot that s-off brings to the table now. WE have almost everything.

---------- Post added at 09:07 AM ---------- Previous post was at 08:57 AM ----------

because it has to be released by law. normally we get it before 90 days but i think they have up to 120 days to release it. We are coming up on 90 days.
[AT&T, Rogers HTC One X, Telstra One XL] purin:
I am aware of paid SIM unlock services (this is the same as carrier unlock right?). I thought S-off will get us free SIM unlock. Are we talking about the same thing?

Can you provide link for free SIM unlock?

thanks

-p
[AT&T, Rogers HTC One X, Telstra One XL] loneBoat:
http://xdaforums.com/showthread.php?t=1671237
[AT&T, Rogers HTC One X, Telstra One XL] maybewehitamoose:
Nothing related to SIM unlock on that page.
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
Here is one thread. i think there is another in general. I didnt follow the thread and have never needed sim unlock. just remember seeing the title. It could be misleading.. If so , i apologize.

http://xdaforums.com/showthread.php?t=1694846&highlight=unlock

---------- Post added at 10:56 AM ---------- Previous post was at 10:49 AM ----------

http://xdaforums.com/showthread.php?t=1717082&page=2

this one claims $5.98 on ebay ? you probably knew that though
[AT&T, Rogers HTC One X, Telstra One XL] loneBoat:
My bad, sorry about that. :o
[AT&T, Rogers HTC One X, Telstra One XL] ptesmoke:
we have not achieved free sim unlock.
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
You can get sim unlock online for a few dollars. If you really need it, pony up the 6 dollars! If you are waiting for s-off to achieve this, you really don't NEED sim unlock!

Sent from my ATT S4 One X
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
I apologize for misleading. According to the titles of some threads we have it lol. I saw the threads about it and never read in depth.
[AT&T, Rogers HTC One X, Telstra One XL] mcmb03:
take the talk about sim unlocking elsewhere please
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Guys check this out, it maybe of some use.. http://tjworld.net/wiki/Android/HTC/Vision/BootProcess#Chainrecoverysystem
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Guys... Could we modify this to work for us possibly ? ?

It's for the evo 3d and it had same chipset!!

http://themikmik.com/showthread.php...-18-HBOOT-with-HTCDev-com-No-More-Watermark!-). from my HTC One X using xda app-developers app
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Nah, unfortunately that uses unrEVOked to gain s-off and won't work for the OneX.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Darn... Ok thank you for the quick response... :)
[AT&T, Rogers HTC One X, Telstra One XL] Tiffany84:
Umm, that's for the Evo 4G not the 3D and neither the Evo 4G or the Evo 3D share the same chipset as the One X.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
my mistake.. sorry
[AT&T, Rogers HTC One X, Telstra One XL] Justjusten:
Has anyone heard anything for a lazy panda port? I dont want to sound naggy! Sorry if I missed something in the thread and there is an update or something. Ive been trying to keep up with it
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
I saw someone was looking into it, but nothing since. I'm surprised too because I thought they used the same SOC as us.
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
I thought after reading the EVO LTE had s-off we'd have it in a couple days at most. I' would've bet money on it. i assumed it would be an easy port. I wonder What's different? what is holding it up? Is it a lack of interest? Do we need a bounty thread?
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
Probably but someone else can start it. :D
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Hope some one is hard at work on it cause at this point I don't know how to write software like panda s off, much less reverse engineer it.. if I was granted permission to do so anyways.....