yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
We could write to partition 3 IF somebody could find how to get the partition table file. That, I think would allow us s off quite easily, but without the partition table file there won't be any writing to partition 3
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Another big thing to look at is our msm8960 chipset is revolutionary as its the first of its kind to have the system ON the chip.....the latest qpst build from qualcomm only offers up to msm8660 support technically. So we may need a software leak from Qualcomm before being able to see what all is on the chip.
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
this is the problem

the ram dump.too.doesnt.work with 8960

else.we.may get.the p table.from the dump...
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Did rpomponio tell u what we tried last night?? Lmao. Went thru all your partitions and changed any value msm8960 to msm8660 and pushed them, I was gonna reboot and try juonpunutbear release and it officially killed it dead as dirt lmao. Won't even give me an led light. Dead. But wire tricks into dl mode just fine :-)

*A moment of silence for frankenfone x*
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Yes, a moment of silence for Frankenfone x. Lol atleast we only bricked one device the last week and a half we be working on this..

Keep in mind we have made it to a major milestone!! Very proud!!!
[AT&T, Rogers HTC One X, Telstra One XL] ptesmoke:
im no pro, and dont take offense, but how did that even sound like a good idea? obviously itd result in a nice doorstop..

thanks tho!
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
We thought we would be able to use the one click s off for that chipset.. and it was late last night..
[AT&T, Rogers HTC One X, Telstra One XL] shadowscreation:
Late night does make not so good ideas sound great especially without a red bull by your side
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Well the idea started, when juopunutbears program would stop and give msm8960 chip not yet supported. So thought if we could make the program think it was msm8660 chipset(supported) then we would see wat would happen. The phone was gettin pretty haggered anyways from us and didn't expect it to last thru half the stuff we tried anyways. It kept coming back tho. It's a pretty tough phone to actually paper weight it:)
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
You are right it was absolutely foolish. Made no sense. NONE. :rolleyes: how is changing the chip number to a differnt number gonna help? It's not gonna transform in to a new chip because u renamed it. 8660 and 8960 Are two completely differnt chips. Different architecture. Im sorry, It just doesn't work like that. I don't care how late it is.
[AT&T, Rogers HTC One X, Telstra One XL] G4 Man2:
Thats not very encouraging...
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Sorry 'bout that! You get my PM?

Thanks again!

Billy
[AT&T, Rogers HTC One X, Telstra One XL] G4 Man2:
Have you agreed with anyone about anything on this thread so far? The devs are making progress and your just putting them down and questioning them. and thats negative to all the people like me who believe they are working hard to get this done.
[AT&T, Rogers HTC One X, Telstra One XL] designgears:
>fastboot oem list_partition_emmc

...

(bootloader) index, type, start, num

(bootloader) 0, 0x4D, 0x1, 0x100

(bootloader) 1, 0x51, 0x101, 0x200

(bootloader) 2, 0x5D, 0x301, 0x3FCDE

(bootloader) 3, 0x5, 0x3FFDF, 0x1CDF020

OKAY [ 0.017s]

finished. total time: 0.018s

Is this the partition table you are looking for?
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Yea I don't get very many encouraging post, don't know why just trying to help...
[AT&T, Rogers HTC One X, Telstra One XL] random1204:
Yeah, sorry! I know it's late...my time, so I figured, oh I'll just stop bothering ya!

I got it, I'll send it now.
[AT&T, Rogers HTC One X, Telstra One XL] Koizuma:
Haters are gonna hate, don't bother listening to them. Keep up the hard work buddy!

Swyped from my HTC One X using XDA premium.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I believe so!!! Thanks, I will pass the info on, thank you
[AT&T, Rogers HTC One X, Telstra One XL] G4 Man2:
Does this mean progress?
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Hey some encouragement.!!!! Thank you buddy!!! I greatly appreciate it!! :)
[AT&T, Rogers HTC One X, Telstra One XL] Loneeagle14:
How's that LTE working out for ya? Oh wait...

I got tired of sprints joke of a network. Best I had ever gotten 3g wise was 800kbps and wimax was pathetic. So don't pity us. We can use all of our phones hardware. :cool:

On the other hand, I'm loving the 40Mbps I'm getting now.
[AT&T, Rogers HTC One X, Telstra One XL] corythug:
Truth, I just jumped from sprint and chose this over the evo lte. No regrets whatsoever.
[AT&T, Rogers HTC One X, Telstra One XL] designgears:
what output do you get when you try to run;

fastboot oem writesecureflag 0
[AT&T, Rogers HTC One X, Telstra One XL] broncogr:
OK guys, I have cleaned the thread a bit.

Some people's attitude and language are totally unacceptable.

What the point in turning this thread in a flame war?

Are you going to get closer to S-off by doing that?

Consider this a warning...
[AT&T, Rogers HTC One X, Telstra One XL] expertzero1:
Not sure of serious
[AT&T, Rogers HTC One X, Telstra One XL] K4get:
Thanks you. For the much needed moderation.
[AT&T, Rogers HTC One X, Telstra One XL] h8rift:
The funny part about this comment is.....

We can flash all of those things too. The only thing we are unable to do, which everyone wants S-Off for is:

* Get rid of tampered/relocked message

* Not have HTCDEV have a list of your phone in their database (a list of warranty forfeitures).

Thats all. Thats all this whining, complaining, cracking your phone open, etc. is for.

So how about everyone that info about where these guys are at and what they are doing just simply.....go to the IRC channel they are working in and get the info there. I do agree with nugzo that I would NOT be posting such a 'hardcore mod' with such a high possibility of failure here until it is 100% proven and completed.

I really am rooting for anyone able to S-Off this device....but its really not necessary unless you want to lie about your warranty to be honest at this point :).

Good luck to everyone, and lets just stop posting here in general unless you are ACTUALLY contributing to this (or maybe not at all until there are actual findings).

Thanks,

-h8
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
billy:~/android$ fastboot oem writesecureflag 0
...
(bootloader) elite_init_sd, SD card already power on
(bootloader) sdhw_7xxx_open: id=0
(bootloader) [SD_HW_ERR] SD: No device attached
(bootloader) 902910 902E20
FAILED (status read failed (No such device))
finished. total time: 6.260s

And then Fastboot locks up. If I try 'fastboot oem h' or anything else, it just says <waiting for device> and I have to hold the power button to get it to restart.

HTH,

Billy
[AT&T, Rogers HTC One X, Telstra One XL] PeartFan40:
Ok, thread has been cleaned up again. From thid point forward, I don't want to see anymore bickering, flaming, or disruptive behavior. If you see anybody being disruptive, DO NOT engage or participate, just report it, and one of us Mods will deal with it. Engaging in disruptive behavior only makes things worse. Let's all show respect to the OP for his work. The next person who is disruptive will receive an infraction.

With that said, have fun, and please be.respectful to each other. :)

Thread Re-Opened.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"If you choose not to decide, you still have made a choice"~Rush
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
OK, so I'm nearly certain that 0x8400 in mmcblk0p3 is the S-OFF bit, as was discussed a while back (page ~80 or so). I believe I found the tampered flag and the unlocked bootloader flag too. By dumping my partitions, then unlocking for the first time, dumping again, relocking, and dumping a third time. I then hashed all the dumps and compared them. Then I compared the images where the hashes that didn't match.

0x8400 is '00' on the two S-OFF devices we have dumps from, and it's '03' from every other phone I've checked, regardless of if it's locked, unlocked, or re-locked. '0' and '3' are consistant with the 'fastboot oem writesecurityflag' command too.

Everything else, on every partition, is either inconsistent on devices of similar security status, or it changes from lock to unlock to relock.

To reiterate what was said earlier in this thread in the interest of organization, I've tried dd'ing a modified version mmcblk0p3 and it seems to complete successfully, but you can pull it again immediately afterwards and it's unchanged. I tried "cat mmcblk0p3.img > /dev/block/mmcblk0p3", which either froze or powered off my phone at some point in the process, but that didn't work either.

The permissions of /dev/block/mmcblk0p3 is BRW------ root.root, but I tried chmod'ing it 777, but that didn't help anything.

Do we know anything else about mmcblk0p3? What else is contained within it? It's a big file 130mb. If we can determine when the device is expecting it to be modified, maybe we can take advantage and modify it ourselves.

Billy
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Great observations and great find. That partition is probably nand-locked by security built into h-boot. Perhaps with the correct tools (qpst, etc) we can write to it.

Did you notice any other changes to that partition when you made the lock/relock change? Hopefully there's not a hash or signature of some sort that needs to be updated when that byte gets updated.

ADD: And I know it's a total longshot, but anyone try editing that partition from ADB in CWM? Perhaps the kernel is blocking the write and not h-boot. Longshot, I know.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
ok so it says it writes p3 but it doesnt comit, thats why we are trying to flash in download mode, when the phone reboots it reflashes p3, we think its bootloader doing this reflashing but we are not sure. Download Mode gives us the highest access like an ruu does, thats why we are stuck, dont know how to flash in download mode... hope this helps and makes sense to you... We tried flashing all the partitions fron Niceppl's s off phone but p3 just wont stick, so we need to figure out how to flash in DL MODE, i think....
[AT&T, Rogers HTC One X, Telstra One XL] Adam5400:
I agree about it being in P3, on other phones when you execute 'fastboot oem writesecureflag 0' it makes reference to updating pg1fs which is what p3 is.
[AT&T, Rogers HTC One X, Telstra One XL] designgears:
Bootloader unlock, simunlock and s-off are all in that partition, almost 100% sure. Have been trying to write to it for some time :)
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Another longshot. But has anyone tried

fastboot flash pg1fs pg1fs.img

on an UNLOCKED bootloader?

I'm on relocked BL and get signature failure

Maybe unlocked bootloader accidentally opens this up?

Another longshot, I know....
[AT&T, Rogers HTC One X, Telstra One XL] designgears:
According to jcase the radio tells hboot "we are s-on", most partitions are then locked early on by hboot.

I have tried the wire trick and it works, but I have partially bricked my phone so I can't test anything right now :p
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
but it sounds like the radio reads the data from p3 before it decides what to tell hboot? I thought we'd already confirmed that the radios between s-on and s-off devices are identical. But then again it was 100 pages ago and I'm foggy.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Well 18th.abn flashed niceppls nv dump, which is the radio I think..
[AT&T, Rogers HTC One X, Telstra One XL] designgears:
right, which means after it boots, there is nothing we can do to p3.

is that what bricked his phone?
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
nah...what bricked his phone is changing the chip model...

i dumped my nv in qpst...and casey flashed it ..but .no s-off

however, we didnt try reflash p3 again...and fastboot oem writesecurity 0....

maybe we should have...
[AT&T, Rogers HTC One X, Telstra One XL] taylor.fowler:
So when we're flashing Radios, Some are showing up with a U at the end instead of an L in About Phone (although these users are still S-OFF according to HBOOT, and we're flashing the same radio.img). Possibly related?

There's a pretty long conversation about it in the Flashable radios thread, and I mentioned it earlier in this thread but it was right after the guys figured out download mode so I think it might have gotten glazed over.
[AT&T, Rogers HTC One X, Telstra One XL] :
Is that what the "U" and "L" stand for at the end of the radio baseband? For Unlocked and Locked?
[AT&T, Rogers HTC One X, Telstra One XL] kilo89:
I think you mean S-ON...
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Thanks. Somebody else tried it with adb via CWM and it didn't work. As far as changes upon lock/unlock/relock, there are just a couple. I don't have dumps from any one person (beside myself) in more than one of those states (locked/unlocked/relocked) to compare, but I'm pretty certain that the changes will be the same across devices. They are little more than one bit like what I believe to be SOFF though.

Thanks,

Billy
[AT&T, Rogers HTC One X, Telstra One XL] Scott:
After having seen S-OFF done on many a phone and learning the differences amongst them I am pretty sure this will need to be a hardware exploit.

If I were the person working on this I would reach out to the Devs that did Jbear for the Rezound. That was a hardware exploit that required shorting out the eMMC twice at a specific rate and then allowed the toggle to be toggled off.

Thats just my thoughts and I certainly could be wrong.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I tried in system and recovery to no avail. Same thing, it writes just find but run a diff right afterwards and it differs. We can write to partition 3 in qpst, while in download mode but we have to no matter what have the .mbn partition table.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
So now you have successfully written from QPST? I thought there was issue with the version being too old.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
No. Re-read what I said... You can dump the partition again immediately after it appears to dd back successfully... It's unaltered BEFORE a reboot. Hboot is not restoring mmcblk0p3, it's just not taking.

Billy
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
This is what I'm thinking.

Billy
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
There is a line a little ways after 0x8400 in mmcblk0p3 on most devices that reads HTCU or HTCL which doesn't seem to correlate with unlocked or locked like I expected. Maybe it's what you're talking about?

Billy
[AT&T, Rogers HTC One X, Telstra One XL] Hadcook:
A little bit of a noob question, but if the new RUU leak has a updated hboot, would that affect the sof/son work devs have been doing?

(Again total noob and trying to learn/get involved in the community, totally understand getting yell and kick out of this thread :p)
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
One other thing I was gonna try is to mount mmcblk0p3 from the phone, while in Android. The permissions suggest we can do it, and its not mounted already... The only thing preventing this (afaik) is that I don't know what filesystem type is used (and it must be specified). This data isn't being used in hex format! Maybe we can modify the specific file...

I found a list of filesystem types via "cat /proc/filesystems" and I've been meaning to try mounting with each of them... I just can't do it at the moment.

Sorry about the multiple posts by the way... On my phone and juggling a 2 year old ;-)

Billy
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
If you dd #3 back to device, and it is shows that it wrote, if u immedietly run a diff between /dev/block/mmcblk0p3 and /sdcard/mmcblk0p3 u will see that they DO differ, before and after rebooting, so its actually not dd'ing successfully at all. To write to partition 3 u need download mode and the .mbn partition table. Hopefully there's another way around that can be found or we can figure out how to pull that .mbn
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Yeah, that's what I said. ;-)

Billy
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
what RUU leak??
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Gotcha man. Ima post a pic to show the need for the partition table...

You can see without the .mbn partition table its asking for (bottom highlight) qpst has no idea how to map the locations to send partitions too.

Just Gen info for people to reference
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
It's simply nand-locked by hboot. (you think you wrote but you didn't). A lot of these partitions are. Go over to the international HOX threads and their system partition is nand-locked until you unlock the bootloader, even after getting root via emulator mode (temproot). Something is screwed up on our s4 variants that we are able (with root) to write to partitions that are typically nand-locked by htc (the misc parition, the system partition, etc.). But recent htc phones have nand locked everything useful and it looks like they successfully nand-locked mmcblkp3.
[AT&T, Rogers HTC One X, Telstra One XL] :
Check the general section dg has a new leaked ruu bit may not be able to release do to signatures in the framework

http://xdaforums.com/showthread.php?p=27589624

Sent from my Nocturnalized Beast
[AT&T, Rogers HTC One X, Telstra One XL] Hadcook:
See answer below :)

Thanks for linking it, I just went to look for the thread. I saw someone in the thread mention it included an updated hboot, so if/when the ruu was "clean" from signatures. So would a new hboot affect this process? I dont know enough about it :s
[AT&T, Rogers HTC One X, Telstra One XL] :
I am far from an expert on this matter but would say it will depend on the final exploit to gain s off I've seen some phones that required downgrading the h boot to gain s off and seen some that require upgrading the h boot to gain s off so until the awesome people here get a working exploit it will be tuff to say at this time

Sent from my Nocturnalized Beast
[AT&T, Rogers HTC One X, Telstra One XL] designgears:
system partition is nand locked on the RUU leak until you unlock the bootloader
[AT&T, Rogers HTC One X, Telstra One XL] taylor.fowler:
Correct. Work + XDA = fried brain.

So do we have any idea what the hell those codes mean?

Not knowing is eating away at my soul....
[AT&T, Rogers HTC One X, Telstra One XL] kilo89:
And if it is related to that, then somehow mine was changed since it was an L up until recently. If we could figure out how, then perhaps it could lead to a way to write to the mmcblk0p3 partition?

Edit: Just checked and mine does say HTCU in offset 8400
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
It should be 0x8404-0x8407, 0x8400 is potentially the S-OFF flag.

You're unlocked, right?

I just checked again, and what I said was misleading/incorrect. The bits from 0x8404-0x8407 ARE directly related to bootloader lock status.

When locked, those bits are blank.

When unlocked, those bits read HTCU.

When re-locked, those bits read HTCL.

So, that's most definitely the unlocked/relocked banner.

I'm not sure if it's connected to the L or U you guys saw in the OS afterall.

Billy
[AT&T, Rogers HTC One X, Telstra One XL] kilo89:
Yes that makes sense, I am unlocked. Guess our U and L must have to do with something else.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
OK, since we know mmcblk0p3 has the bootloader lock flags, then we know that is one time when mmcblk0p3 is writable, when those flags are being toggled, right? Unfortunately, that only happens through fastboot, huh? :(

Billy
[AT&T, Rogers HTC One X, Telstra One XL] Adam5400:
What about simlock status? That is changeable in OS (with the appropriate code, but still), and it is possible it is located in this partition as well.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
I got it mounted! I can browse the whole p3 filesystem :cool:

No write access still. I'm trying to pull the files and host them for y'all.

Billy
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
You see an actual filesystem there? How'd you mount?
[AT&T, Rogers HTC One X, Telstra One XL] designgears:
indeedy, how did you mount that?!
[AT&T, Rogers HTC One X, Telstra One XL] LGSilva:
EXCELLENT!

Almost there, thank you all the devs for your work.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Sure looks that way!

adb shell
su
mkdir /mnt/sdcard/p3
mount -t sysfs /dev/block/mmcblk0p3 /mnt/sdcard/p3
cd /mnt/sdcard/p3
ls -l

Billy

---------- Post added at 01:24 AM ---------- Previous post was at 01:21 AM ----------

LOL! For the record, I'm not a developer... I'm just persistent ;)

Billy
[AT&T, Rogers HTC One X, Telstra One XL] designgears:
its just a bunch of symlinks from I can see. If you dump the partition and hex edit it, it is mostly zeros.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
I've pulled actual files :confused:

Billy

EDIT: I see symlinks to other places on

that

partition.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
really? I see about 130mb of zeros.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I'm not available to do adb right now but I think something is wrong with the file you pulled or your mount. Or something isn't working right when we dd the partition to SD (security interfering) or something isn't working right when we mount like you did (security interfering).

Either way, what you are seeing there doesn't match what we see in that block with hex edit. Looks to me like /sys directory.
[AT&T, Rogers HTC One X, Telstra One XL] designgears:
drwxr-xr-x

Those are all directories filled with symlinks inside. You can mount any partition the way you did and get the same stuff.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Well, that's why I followed the directory structure until I got to an actual file that I could open with a text editor.

I'll keep playing with it, but what are you guys actually seeing???

Billy

---------- Post added at 04:35 AM ---------- Previous post was at 04:30 AM ----------

Damn, you're right. I mounted mmcblk0p5 the same way and the files are the same. WTF? What a buzzkill.

Billy
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
So what would happen if we were somehow able to writesecureflag 0 the instant those bit were being change during an unlock? Fastboot probably isn't accessible at that time though...
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
When your unlocking, and you get the yes or no to unlock screen, fastboot does recognize the device. This might seem like some work but if we can get partition dumps from a device never unlocked before, then do a differ in shell on each partition after unlocking you will know without doubt all partitions that have a change in them from the unlocking. I personally don't think it will be possible to write to the secure ones outside of download mode(pure speculation) but atheist you will know factually all partitions that experienced a change and have more places to look into closer.
[AT&T, Rogers HTC One X, Telstra One XL] ptesmoke:
pretty sure we did this with stock s-on and with niceppl's s-off as well.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
I doubt that's worth investigating as "fastboot oem writesecureflag 0" is toggling the flag the way HTC intended, and HTC doesn't intend on the average user being able to do that. I think it's going to have security built right into the command, which is why it looks for a special sdcard instead of releasing the NAND lock and flashing the change.

Buuuuut, if we had shell access to write to that partition at that moment, I think we'd be golden. Too bad there's no "fastboot oem shell" command that I know of!

Billy