yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Thanks for taking the time to clean up the mess. BUT please take more care when you remove posts, as it appears some posts relevant to the discussion have been removed, while others (who have even been marked as "deleted" by the postee himself), are still there. Now I understand that we cannot expect you to read through all this and follow even half of it, but you shouldn't have to either, just the last few pages. You see this thread has been cleaned up, many more times than you think, probably on average every 3-5 weeks or so...

Thanks again.
[AT&T, Rogers HTC One X, Telstra One XL] PeartFan40:
You're welcome. I've actually had to clean this theead a couple of times over the months. Anytime you see off-topic chatter, just pm me and I'll take care of it. In regards to using care, normally I do. If a post or two were removed relevent to the discussion, I will go through and double check, and undelete anything pertaining to the topic. PS: I follow this just fine. ;)

Added: ok EVA, replies relevent to the discussion have been restored, and the "delete me" replies removed. Get in touch with me if there is anything else you need. This goes for everyone. I'm here if you need me.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"If you choose not to decide, you still have made a choice"
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Which is what I thought. I don't think using the 8660 hex on an 8960 device would be a smart idea.

Edit: Found it. Here.

Edit2: Doesn't work. The guy is searching for the file, not uploading it.

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
It looks the 8660 hex was found in a ZTE firmware package. There are a few ZTE 8960 phones and tablets, but it looks like they use a firmware updater program to flash. I cant find a separate package anywhere.
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
Looks like it should be available now

http://www.qualcomm.com/media/relea...ansion-hexagon-dsp-access-program-uplinq-2012
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Right! But windows-based firmware updater programs usually unpack stuff in a temp directory, that can be intercepted.

I think there was some Chinese site doing something like this for the ... lets see, some "SKY" device.

That was in June!
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
Mod Edit: Off-topic discussion removed.
[AT&T, Rogers HTC One X, Telstra One XL] ptesmoke:
dude... peart JUST cleaned this thread.. This has nothing to do with s-off development.
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Hopefully this thread won't die down since root has been achieved, but somehow I forecast it will.

Qualcomm are idiots, they release hex for APQ8064 and all the others but not MSM8960. I don't know where to find a ZTE devices firmware either.

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] iElvis:
Brethren, we appear to have a black swan.

I don't know for sure if this will help with S-OFF, but we have a case of someone with 2.20, flashing an international rom, and somehow corrupting hboot even though it's write-protected. This is as far as I can take it, but check out the thread:

http://xdaforums.com/showthread.php?t=1953975

Edit: May be a second. Both flashed the same rom.

http://xdaforums.com/showthread.php?t=1954325
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
That could indeed be helpful as it seem to verify that HTC are signing their bootloaders with the same cert across their different devices. Thus we have an entry point for providing corrupt bootloaders in the bootchain...
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
It's been a common perception that the intl. Roms corrupt the hboot partition causing qshusb mode. The problem is, no doubt about it that p12 is wp on hboot 1.14 period. Not Sig protected like 1.09 and previous. Because international Roms still cause qshusb mode even on the latest firmware, it means that it is not caused by /system overwriting p12(hboot) it is being caused by their boot.img flashing to our p4. I determine this because whether you use a signed hboot or not, you cannot simply flash over the wp hboot, and the international /system is certainly not going to either. Wp is wp.

So in a recap(:D) international Roms soft brick by flashing boot to our p4

Not by /system over p12

ADDED - on boot 1.09 and below it will corrupt both p4 and p12, which is useless info, but couldn't put the tab down knowing I left that bit out;)
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
Could it still be of value as a shortcut to qpst instead of having to open the phone and do a wire trick?
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Wiretrick doesn't do anything worth our time. This method of bricking does open up the emmc window(which p3 is still wp in so atm it doesn't help here either)
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Also, if you want to play with qpst or qxdm, use diagnostic mode

From rom(booted)

adb shell

su

echo 1 > /sys/devices/virtual/android_usb/android0/f_diag/on

From recovery:

adb shell

echo 1 > /sys/devices/virtual/usb_composite/diag/enable
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
There's also a script for toggling it on and off in the sensation unbrick thread.
[AT&T, Rogers HTC One X, Telstra One XL] iElvis:
Okay, but here's the thing: Not all international roms are doing this. Unless I've missed a thread, only IceColdJelly has been bricked anyone. Plenty of people have flashed other intl roms and just gotten boot loops. But I've seen three people get bricked by flashing ICJ. That suggests to me that something else is going on.
[AT&T, Rogers HTC One X, Telstra One XL] :
http://xdaforums.com/showthread.php?t=1956313

it appears this user flashed aokp for the endeavoru.
[AT&T, Rogers HTC One X, Telstra One XL] iElvis:
Yeah, I just saw that. Could be its something in the aokp base. Oh well.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
The updater scripts will tell you exactly what the flash is doing. The boot.img from each Rom is different, so those Roms that are causing qshusb mode have a boot.img that is completely incompatible/modifies it to an unbootable state. The ONLY partitions being touched are p4 and p12, p12 is WP and there is no kind of flashing what so ever that is going to change that. I see where your question is but you have to remember a WP partition is NOT going to be written over. Even with a signed image.
[AT&T, Rogers HTC One X, Telstra One XL] :
Is partition 4 the boot.IMG or /system?

Or is it overwriting our boot.IMG with their /system

Either way, I guess we can scratch this off the list for exploiting s-off.
[AT&T, Rogers HTC One X, Telstra One XL] Skizzy034:
I was reading one of the "bricked" threads and someone linked this: http://xdaforums.com/showthread.php?t=1940512

Is that of any use to us? Has it been suggested before? Sorry if it has.
[AT&T, Rogers HTC One X, Telstra One XL] :
I don't think it would work on the new hboot unless we disable or bypass write protection. As for older hboots, I'll let someone that knows what they are.talking about answer it for you
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
The endeavor One x

/system - mmcblk0p12

/boot - mmcblk0p4

Evita One x

/system -mmcblk0p33

/boot - mmcblk0p21

So the endeavor flashes over our evita p12 and p4, p12 is a WP partition so it's impossible for anything to change on that partition, it will remain untouched no matter what. So now we get a boot.img flashed over our p4 which has no protection what so ever(which is the only reason we can unlock bootloader).

---------- Post added at 05:35 AM ---------- Previous post was at 05:30 AM ----------

If you wanted to downgrade to hboot 1.09 you could use that same exact method. Just replace the hboot.nb0 in their zip with a signed hboot 1.09 from a ruu. Then, since they are using a hox p4 or 5 to brick their phone, just use the boot.img from the ice cold jelly intl. Rom since we know it will brick us, and dd it to your p4. Once bricked follow their instructions just the same and you can downgrade to 1.09.

Hox users that already bricked by flashing intl. Roms could use the exact same method to unbrick
[AT&T, Rogers HTC One X, Telstra One XL] Skizzy034:
I wasn't talking about their bricks I was wondering if the link I posted helped at all with s-off for our device. Maybe we could do something similar but then again we'd still be at the step we with the old hboot are at now. Trying to get lazypanda or something similar to work.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I know you werent going into bricks, I just wanted to throw out there what is possible atm with the emmc mode. Right now it's a dead end for s off, but it's far from disregarded because it may turn out to be a crucial step in the process, I'm hoping we find a more user friendly process. REALLY hoping for a proces at all:)
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
For you who have this device, this may be a stupid question, but it could be essential.

When you manage to go into EhostDL mode (DLOAD), for whatever reason, does your device enumerate as a USB storage device when connected to a Linux PC? (Given that you have already installed the correct drivers?)

If it does, I'd like to see a complete partition table, obtained using the Linux "parted" (or equivalent) command, on your PC for this device (eMMC?). It's important that the partition types/IDs are shown. It should preferably be done for a rooted stock device. But definitely not for anything that has been structurally modified at the eMMC level.

In summary, I would like to see something more complete like this.

But, all I know at the moment about the HOXL partition table is this:

[SIZE=2]mmcblk0p1 - sbl1-x.img
mmcblk0p2 - sbl2.img
p3
p4
p5
p6
p7
p8
mmcblk0p9 - sbl3.img
p10
mmcblk0p11 - tz.img
mmcblk0p12 - hboot_8960_1.09.0000_20120402_signedbyaa.img
p13
mmcblk0p14 - splash1.nb0
p15
mmcblk0p16: 00100000 00000200 - "dsps"
mmcblk0p17: 02d00000 00000200 - radio.img
mmcblk0p18: 00a00000 00000200 - adsp.img
mmcblk0p19: 00500000 00000200 - wcnss.img
mmcblk0p20: 007ffa00 00000200 - "radio_config"
mmcblk0p21: 01000000 00000200 - "boot"
mmcblk0p22: 00fffe00 00000200 - recovery_signed.img
mmcblk0p23: 000ffa00 00000200 - "misc"
mmcblk0p24: 00400000 00000200 - "modem_st1"
mmcblk0p25: 00400000 00000200 - "modem_st2"
mmcblk0p26: 01400000 00000200 - "devlog"
p27
mmcblk0p28: 00040000 00000200 - "pdata"
p29
mmcblk0p30: 00140200 00000200 - "local"
mmcblk0p31: 00010000 00000200 - "extra"
p32
mmcblk0p33: 67fffc00 00000200 - "system"
mmcblk0p34: 0ffffe00 00000200 - "cache"
mmcblk0p35: 97fffe00 00000200 - "userdata"
mmcblk0p36: 27be00000 00000200 - "fat"
[/SIZE]

As you can see, there are a lot of holes here... In addition this has not been verified, and could be wrong as they were sent to me from different sources.

(I think I have posted this before, but I post it again for reference.)

Also, please clearly indicate which are write protected.

Also, this is significantly different to what I am used to, so I'd need to know more what the following partitions are used for (or their function).

p14 splash1
p23 misc
p26 devlog
p28 pdata
p30 local
p31 extra
p36 fat

If you don't have a Linux PC, you can download the ZIP containing Android compiled "parted" here. Do not use/push/install anything else than "parted".

(And do not use any other commands than "print".) Alternatively you can get some limited info from:

cat /proc/partitions
cat /proc/emmc
busybox fdisk -l mmcblk0

I know quite a bit about the i535 partitions that I will publish soon, but I'd like to confirm a couple of things with the HTC device. In addition I think HTC have their own FS types... What I fail to understand is why HTC has 13 more partitions than the i535. Doesn't make sense, yet...
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
On the sensation, the wire trick didn't trigger the emmc mode. Corrupting hboot did and it enumerated the partitions, but I don't think there was any kind of description for them.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Corrupting will enumerate but only for about 5 seconds, only about 0.5 seconds that's writable. WP on p1, p2 and p3 still remain fully intact during that time. Any other partition can be written to in small blocks at that time..about 24k at a time
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Splash1 is the splash screen when you first boot your phone.

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] jrior001:
Has anybody looked at what these guys are doing on the new incredible 4G?

http://xdaforums.com/showthread.php?p=33021951
[AT&T, Rogers HTC One X, Telstra One XL] zounduser:
I asked about the inc 4g method already bro. It wont help us. Thats what i was told.

RATTLED FROM MY TEAM VENOM POWERED AT&T ONE X USING ICS TAPATALK 2
[AT&T, Rogers HTC One X, Telstra One XL] jrior001:
My bad, must have missed that one. I try to follow along.
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
starting on page 206. the inc 4g has a removable sd card,like the LTEvo. apparently our non-removeable sd card phones cannot use the same exploit.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
How do you know this? (I'm very curious to know how you perform a enumeration and write test in 0.5 s...)
[AT&T, Rogers HTC One X, Telstra One XL] PeartFan40:
He has a magic unicorn.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"If you choose not to decide, you still have made a choice"
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
That's what happened with sensation. We had limited time to write anything into the memory.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
By corrupting partitions, which puts phone in qshusb_dload, then each time the device is hard reset, it's enumerates for a few seconds. Problem is, even when it enumerates p3 is still wp, therefore the security flag is still protected. P1 and p2 are also wp which is sbl1 and sbl2 which are what protect p3. P9 is vulnerable which is sbl3 but any modification to it perma bricks the phone, completely unresponsive, unfixable state.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Right, I understood the theory, but how was it done in practice? Did you do this? Is there any code available?

I don't think this is right. I would not consider SBL3 corruption as "perma-brick", at least not until we can prove there's some kind of anti-tampering routine triggered that would blow some qfuse...which I consider as hardware. Do you know anyone this has happened to?
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
http://xdaforums.com/showthread.php?t=1522351
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
E.v.a, Our fellow friend Niceppl perma bricked his phone when he corrupted sbl3, (P9). The phone was dead to the world. It didn't show up in linux or anything...
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
We've done this several times to enumerate and write to the hox. We did it to sbl3, one time, modified 1byte and it was a permanent dead bricked phone
[AT&T, Rogers HTC One X, Telstra One XL] mcrook:
Looking at finding a solution finally for this problem. I have found some stuff relation to using a Linux boot disk and the hijack 0.5-1 sec write frame. I also noticed some user managed to load an evita hboot on to a jewel. Would the reverse work the same? All we need is bootloader to get s-off from the jewel, load it on the evita, let it boot to bootloader, and then use one of the methods used for the jewel to get s-off (revelutionary?) and once s-off have been writen to the phone, you should be once again able to load the orginal hboot back, while keeping s-off.

Anythoughts before I start looking at this more seriously?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Won't work. Those exploits require sdcard.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Hboot doesn't have anything to do with s off except display if its on or off. No matter what hboot you put on it it won't make other exploits work. All of unlimited.io exploits are done with a removable sd, revolutionary and all others are not built for the evita either. The security flag is on p3, hboot is p12, and although your thinking creatively that won't work

---------- Post added at 10:13 PM ---------- Previous post was at 10:12 PM ----------

Also, even in the 0.5 second emmc window you are referring to p1,2 and 3 still remain wp so it won't work for switching the security flag either
[AT&T, Rogers HTC One X, Telstra One XL] mcrook:
doesn't the hboot take control the wp p1, p2 and p3 of that after you boot the hboot?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Nothing to do with jewels hboot is useful to us. Please drop this, its been covered over and over.

---------- Post added at 05:46 PM ---------- Previous post was at 05:45 PM ----------

It is right. Breaking sbl3 permabricks the phone, we learned the hard way. Apparently sbl2 doesn't know how to deal with sbl3 failing its SIG check and it gets stuck in some sort of loop.

Regardless, even if it didn't break it does not help up. Sbl3 is where the emmc recovery code is stored and if you were to break it and NOT brick you'd just drop to qhusb mode.

---------- Post added at 05:47 PM ---------- Previous post was at 05:46 PM ----------
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Unfortunately that is just TL;DR, and not code I can use to "play" with...
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
Isn't usb OTG storage still an option? Given the lack of removable sd card, the phone seems to detect it as one in it's place.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
No, it never was.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
P1,2,3 are all 3 power on wp, hboot only wp itself
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Hboot wps itself and radio and kernel and system on 2.20.....
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
There is a Linux based program attached to post one or two that executes everything.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
The code is dd if=/x of=/x
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
What about the Qualcomm QPST? I think that is a really good way forward. Just need to find a MSM8960 hex file. Unless there is another way?

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Sorry to hear that. It simply sucks. But I also fail to understand why he'd even try to corrupt SBL3? That is what Secure Boot 3 is all about. You mess up the bootchain, and you get bricked, with the exception of PBL and "maybe" SBL1. I think we've been through that months ago!

Anyway, did he get his phone fixed / warranty? If not he can send it to me, and I'll try to fix it AND get you WP-OFF!

Can you explain that. (Where did you get this info from?)

What you're saying doesn't make sense...

It's a linux executable. So how do you suggest that I can change it?

@ALL:

I just don't understand "YOU PEOPLE"! ;)

You want to get S-OFF and expect someone to help you. But you're just not providing any necessary info (AFAICT).

Examples:

1) I asked for someone to provide me with some partition table information months ago, and all I got was a "mount" listing. I have since asked this several times without any response. Last time here. Now, could someone please get off their lazy behind and execute the commands listed in this post ?

2) I asked about a simple, but essential gfree code-modification a few months ago, and "someone" said they were working on it. This modification was trivial, since it was only about removing parts not used, so that I could focus on the PMIC parts. I never saw or heard from that person again, even after sending PMs. I have asked about this several times after that. No response!

3) I just asked if there was any code for performing the eMMC 0.5 second write tests claimed above. Again, no response, and avoiding the question.

4) A few weeks ago, someone offered to send me a broken device for tests and HW analysis, but when I responded positively, I never heard back from that person again. Strange.

In fact you're not providing any useful information at all. Just word-of-mouth information about all the things that didn't work, and certainly no details about how you did it, if you ever did. Also there's brilliant absence of output from these "tests".

"There's an infinite number of ways of doing something wrong, but only one way to do it right..." So,

Why should we believe anything said in this thread!??

IMHO, I can't help starting to think "you" are a bunch of HTC-trolls that are pretending to help, but actually trying to mislead any potential progress. Are you?
​

So if you have anything of progressive value, NOW is time to come forward, because I'm about to get out. And this time I mean it.

No return, one way, out.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Well, Eva

Quite a few of your questions have been answered.

You asked for your code to "play" with. I told you, dd if= of=..how else would you write to enumerated partitions? This is the most basic of knowledge.

You ask why would you even try to corrupt Sbl3, wen obviously........but, a page back when I mentioned it, you said I was wrong and you don't think that could hurt the device, now, several people confirmed it you act like it OBVIOUSLY would have bricked. Why the sudden change of opinion?

You also asked about some partition info, you wanted info about the misc, devlog, fat32, splash1 partitions, a explanation of what they are......SERIOUSLY, look at the names of them, any basic understanding of partitions at all and you shouldnt need google or our time to figure out what they are..the names of them answer your own question. Again, this is very very basic.

You ask in q&a for help retrieving a partition table...you need a phone as close to stock as possible so the partitions layout isn't modified. Did NOBODY else find that a little disconcerning? It's a partition table....how is unlocking, rooting, flashing going to affect the partition layout? It doesn't magically reform the the partition structure..again, this is basic knowledge that applies to partition structure.

You ask about the device I offered to send.

You have a thread thats full of brilliant, and I do mean brilliant information about our chipset, our architecture the the most in depth functioning of the components(I highly recommend people read it) so, I pm you, and what did you tell me?????

That you are COMPLETELY unfamiliar with HTC devices, you ask if there is a way to get a video out display??how to charge it, if a uUsb from Samsung would maybe charge it???????

I mean seriously????? You have the most in-depth thread about our hardware on xda ......how do I charge it??? Video out???? Come on, Eva, I'm so baffled by that I don't even know where to start!!

you have done a good job rallying troops for your support, but there are are a few of us that picked these flags out and have done our best to bite our tongues and let you continue with your elegant idiocracy. I only hope that more people can see thru it. As far as moving on from here, I could care less atm what others think, bounce out of here, go, you haven't helped one bit with anything in here, there's are countless hours of testing, theories, results and discussion within this thread, NONE of which you have helped with. So go, please, I prefer our path over answering your questions, half of which can be answered in a google search, or are common understandings for anyone that has invested time in such information
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
strings sbl3.img | grep Qualcomm

You'll see it. Also, Fuses confirmed this. SBL3 is last to load before hboot. When it doesn't like hboot (signature) it executes the emmc recovery mode and then the drop to QHUSB. Not sure why you don't think it makes sense.

​

If it's so "trivial", why haven't you done it?

​

Been answered. It's simple linux dd....

Adios.
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Not attacking you or anything, but linux scripts with the executable flag can be right clicked and then you view the script in a text editor. With .exe's you need to decompile them (right terminology?) and then re-make the .exe.