yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Definitely, I was planning on it. Unfortunately, I'm out of town on a run of a few gigs for half of this week, and I forgot to add this laptop to my desktop's TeamViewer whitelist at home... lol. n00b mistake, and now I can't get into it, which (stupidly) has the only copy of this code. I'll push it to my github when I get back, or just clone the gfree repo again tonight and work on it from scratch.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Unknown HTC property relating to Qfuses / Efuses

Looking at some of your Qualcomm based (i.e. Snapdragons) kernel command lines,

I found some yet un-documented OEM property. I'd like very much to understand

this one better.

From Kernel cmdline (as seen in dmesg and /proc/cmdline):

androidboot.efuse_info=NFSL

From running "adb shell getprops":

ro.efuse_info=NFSL

Googling around I have seen the following in the wild:

[SIZE=2]NFSL - most common and found in "our" (US) AT&T? HTC One X LTE (aka. "HOXL")
SFSL ? (Found on T-Mobile HTC One S)
FFSL ? (Found on Sprint HTC EVO Jet?)
FFSH ? (Found on T-Mobile HTC ???)[/SIZE]

(If anyone has something different here, let me know!)

What do these mean?

PS. Could someone please dump the HOXL boot-loaders somewhere so that I can pick them up and have a look...

EDIT: ================= 2012-09-10 =================

The kernel cmdline with "androidboot.efuse_info=" is constructed in HBOOT (p12 for us), but the Qfuses are probably already read much earlier. But the first sign I could find by simple inspection, was in SBL3 (p9). But apparently the reading/writing algorithms are located in TZ (p11). RE is still needed to understand where the "NFSL" string come from...

EDIT 2: =============== 2012-09-18 =================

SOLVED!

Thanks to a brilliant RE guy, we managed to figure this out. Its all written from HBOOT as above, but with code reading the Qfuse registers from PHYS:0x7000C0 and C4. The code that solved this mystery was the acpuclock-8960.c sources. The values are:

S = Slow, N = Nominal, F = Fast

H, L are still unknown but related...

and "FS" = (Krait ACPU) Frequency Support

for the possibilities of:

[FNS]FS[HL]
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
http://db.tt/Yr5IvoYL

Here's partitions 1-32, from 1.85 firmware. Hboot is p12, and is ver. 1.09.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
^^

Thanks! But I also need an accompanying partition table for those files. (I.e. What's on each...)
[AT&T, Rogers HTC One X, Telstra One XL] douchebaggins:
Here's the mountpoints for a few of those partitions.

sh-3.2# mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,noatime,nodiratime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,noatime,nodiratime 0 0
sysfs /sys sysfs rw,noatime,nodiratime 0 0
/dev/block/mmcblk0p33 /system ext4 ro,relatime,user_xattr,barrier=0 0 0
/dev/block/mmcblk0p35 /data ext4 rw,nosuid,nodev,noatime,user_xattr,barrier=0,data=ordered,noauto_da_alloc 0 0
/dev/block/mmcblk0p34 /cache ext4 rw,nosuid,nodev,noatime,user_xattr,barrier=0,data=ordered 0 0
/dev/block/mmcblk0p26 /devlog ext4 rw,nosuid,nodev,relatime,user_xattr,barrier=1,data=ordered 0 0
/sys/kernel/debug /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p17 /firmware_radio vfat ro,relatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-
ro 0 0
/dev/block/mmcblk0p18 /firmware_q6 vfat ro,relatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro
0 0
/dev/block/mmcblk0p19 /firmware_wcnss vfat ro,relatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-
ro 0 0
tmpfs /data/secure/data tmpfs rw,relatime,mode=755,gid=1000 0 0
htcfs /data/htcfs fuse.htcfs rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0
DxDrmServerIpc /data/DxDrm/fuse fuse.DxDrmServerIpc rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0
/dev/block/vold/179:36 /mnt/sdcard vfat rw,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso885
9-1,shortname=mixed,utf8,errors=remount-ro,discard 0 0
/dev/block/vold/179:36 /mnt/secure/asec vfat rw,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=i
so8859-1,shortname=mixed,utf8,errors=remount-ro,discard 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
/dev/block/dm-0 /mnt/asec/com.quoord.tapatalkxda.activity-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso885
9-1,shortname=mixed,utf8,errors=remount-ro 0 0
sh-3.2#
[AT&T, Rogers HTC One X, Telstra One XL] douchebaggins:
This is how it looks like the files from the 1.85 RUU match up to the partitions.

mmcblk0p1 - sbl1-x.img

mmcblk0p2 - sbl2.img

mmcblk0p9 - sbl3.img

mmcblk0p11 - tz.img

mmcblk0p12 - hboot_8960_1.09.0000_20120402_signedbyaa.img

mmcblk0p14 - splash1.nb0

mmcblk0p17 - radio.img

mmcblk0p18 - adsp.img

mmcblk0p18 - wcnss.img

mmcblk0p22 - recovery_signed.img
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Thanks. The WCNSS (wifi stuff) should be p19, but what about the other 22 partitions?

(Sorry for all these annoying questions. It would probably have been easier if I just downloaded the whole disk image myself and tried to extract the individual image files. Is there such a type of download? (I want to be on the same version as you guys.)
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
We haven't been able to get a partition table.XML, any ideas on pulling it?
[AT&T, Rogers HTC One X, Telstra One XL] RussianBear:
Some zte devices have .xml, .hex, .mbn, and other files are available online. If you want to reverse engineer those, or at least look at them.
[AT&T, Rogers HTC One X, Telstra One XL] android4ever91:
Don't know if this helps but...

u0_a39@android:/ $ export PATH=/data/local/bin:$PATH

u0_a39@android:/ $ cat /proc/emmc

dev: size erasesize name

mmcblk0p23: 000ffa00 00000200 "misc"

mmcblk0p22: 00fffe00 00000200 "recovery"

mmcblk0p21: 01000000 00000200 "boot"

mmcblk0p33: 67fffc00 00000200 "system"

mmcblk0p30: 00140200 00000200 "local"

mmcblk0p34: 0ffffe00 00000200 "cache"

mmcblk0p35: 97fffe00 00000200 "userdata"

mmcblk0p26: 01400000 00000200 "devlog"

mmcblk0p28: 00040000 00000200 "pdata"

mmcblk0p36: 27be00000 00000200 "fat"

mmcblk0p31: 00010000 00000200 "extra"

mmcblk0p17: 02d00000 00000200 "radio"

mmcblk0p18: 00a00000 00000200 "adsp"

mmcblk0p16: 00100000 00000200 "dsps"

mmcblk0p19: 00500000 00000200 "wcnss"

mmcblk0p20: 007ffa00 00000200 "radio_config"

mmcblk0p24: 00400000 00000200 "modem_st1"

mmcblk0p25: 00400000 00000200 "modem_st2"
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
You can download the ruu.exe which will give you several of the images, sbl's, recovery, hboot, system and some others but it isn't all partitions. Other thing is get somebody to dd mmcblk0p0 which should be a Full 16gb image of device, but it can't be dd to device because they only have 9-10gb free with a formatted internal SD.
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
evita RUUs here:

http://www.filefactory.com/f/4e1ce47f16313c0d/
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Are you guys still working on angle of removing emmc wp? I'm having a hard time following what the current plan of attack is.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Come out, right hand in front. Fake jab BAM, LEFT HOOK.... oh, oh crap...here??? I have no idea but its looking awful familiar............
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
careful of the garbage posts :D
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
.... uhhh ....

--------------

Anyways, I decided to just push my changes to gfree when I get home on Thursday instead of starting over out here, I already have quite a bit stripped out.

If anyone cares to know why I'm gone and not working on this 24/7... http://www.youtube.com/watch?v=tV3L2zhKWo8&hd=1
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
SICK Man!!! That's was awesome!!
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Very nice!!
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
PS. This is a very loosely organized effort, which have three typical characteristics.

1) The bad thing is, that usually it happens that everyone is waiting for someone else to do something (about "it"), instead of getting involved themselves.

2) The good thing is, that everyone can actually get involved. There are plenty of things to do, and surely there are a wide variety of skill required. Everything from Google-Fu to RE of bootloader code. Anywhere you see a "?", there is something for someone to do or to find out.

3) We should make a more clear strategy as to who does what and what still need to be done. This will help keep track of what have been done and what not. I t may even help passive talents/contributors to get more involved.

Given that there have been over 200,000 views of this thread (100/post!) there are surely enough people who can get involved, if they want to. I must refer to my old post here, about what it means to be actively involved. This is obviously not aimed to those of you I have been in touch with / posting lately, but more to all of those who are silently following this thread, but perhaps may have enough talent and knowledge to contribute...
[AT&T, Rogers HTC One X, Telstra One XL] joelgsmst:
I'll gladly help, but my One XL is on 2.20 without root, so I don't know how much of a help I can be. Just tell me what I can do, and I'll try to follow along as best as I can, because I would really love root on this phone.
[AT&T, Rogers HTC One X, Telstra One XL] TheNightHawk223:
Since you don't have a phone, I can do anything that won't brick my phone. Other than that I can do everything provided you tell me how as that I'm not that experienced in these matters...

Edit: Yes I do know the basics and stuff like soft bricks, broken recoveries etc, just no hard bricks.
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
Same here, my computer has windows and ubuntu

And I can easily recover from a soft brick
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Dude, you are working so far above my head I cant even see you anymore, but you've sparked some enthusiasm in me, so let me know what I can do to help! I have a black belt in google-fu and I follow instructions well. I've got a decent base of Linux knowledge too. But this is my ONLY phone, and I am out of pocket if I brick it, so keep that in mind.

Thanks for spending so much time on this!

Billy
[AT&T, Rogers HTC One X, Telstra One XL] serialtoon:
Im bored. I can follow instructions well. Im on 2.20 with root, and unlocked bootloader but with the ****ty hBoot (1.14). I dont mind bricking my phone. Gives me a reason to buy another one. Lets have at it.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Could someone post the output of this:

viewmem 0x706000 0x100 |hexdump

(You need to be root and the push the viewmem binary to your /system/xbin/, and set it as executable with "chmod 755 viewmem".)

This is a perfectly safe PEEK operation.

EDIT: Oops forgot to add "hexdump" to convert raw binary to hex-code.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Sorry I can't download from there. Need premium membership. Can you upload to some other place please.

(BTW. Which one are you guys mostly using? At&T??)

So this is what we have so far. Right?

[SIZE=2]mmcblk0p1 - sbl1-x.img
mmcblk0p2 - sbl2.img
[B][COLOR=Red]p3[/COLOR][/B]
p4
p5
p6
p7
p8
mmcblk0p9 - sbl3.img
p10
mmcblk0p11 - tz.img
mmcblk0p12 - hboot_8960_1.09.0000_20120402_signedbyaa.img
p13
mmcblk0p14 - splash1.nb0
p15
mmcblk0p16: 00100000 00000200 - "dsps"
mmcblk0p17: 02d00000 00000200 - radio.img
mmcblk0p18: 00a00000 00000200 - adsp.img
mmcblk0p19: 00500000 00000200 - wcnss.img
mmcblk0p20: 007ffa00 00000200 - "radio_config"
mmcblk0p21: 01000000 00000200 - "boot"
mmcblk0p22: 00fffe00 00000200 - recovery_signed.img
mmcblk0p23: 000ffa00 00000200 - "misc"
mmcblk0p24: 00400000 00000200 - "modem_st1"
mmcblk0p25: 00400000 00000200 - "modem_st2"
mmcblk0p26: 01400000 00000200 - "devlog"
p27
mmcblk0p28: 00040000 00000200 - "pdata"
p29
mmcblk0p30: 00140200 00000200 - "local"
mmcblk0p31: 00010000 00000200 - "extra"
p32
mmcblk0p33: 67fffc00 00000200 - "system"
mmcblk0p34: 0ffffe00 00000200 - "cache"
mmcblk0p35: 97fffe00 00000200 - "userdata"
mmcblk0p36: 27be00000 00000200 - "fat"
[/SIZE]

What's on p3 worth write protecting first? RPM?

Work you can help to do:

a) Fill in the "blanks" of the other "pN" partitions.

b) Give the image file name (if present) in addition to "xxx". (So we know what to Google for.)

How can it be 36 partitions, if "MSM_MAX_PARTITIONS 32"?
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
P3 - carries security flags, simlock, and a huge amount more. 130ish Mb

---------- Post added at 12:22 PM ---------- Previous post was at 12:16 PM ----------

Not trying to offend anybody, but ALL of this is posted quite a few times throughout this thread. Explanations on the wp partitions, yada yada...
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
they can also be found here: http://shipped-roms.com/index.php?category=android&model=Evita

http://shipped-roms.com/download.ph....11_2_10.105.32.25L_release_271865_signed.exe

is the most current ATT. i will work on getting some others uploaded there as well.

edit:

RUU_EVITA_UL_ICS_40_S_O2_DE_2.29.207.1_Radio_0.19as.32.09.20_3_10.107.32.25L_release_272946_signed

and

RUU_EVITA_UL_ICS_40_S_hTC_Asia_WWE_2.23.707.2_Radio_0.19as.32.09.09_L_10.104b.32.25L_release_271654_signed

are currently uploading. that is all the 2.2x builds,let me know if youd like to see anything else from the filefactory folder,and i will get it uploaded
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
The 2.20 RUU can also be downloaded directly from HTC.
[AT&T, Rogers HTC One X, Telstra One XL] laptopfreek0:
http://db.tt/AKzSoFvS
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Oops, I forgot that it should have been hexdump'ed:

0000000 0000 0000 00a1 0320 0000 0000 0001 7e40
[B]0000010 [/B]5d67 0000 1000 0020 0000 0000 0086 0000
[B]0000020 [/B]6000 0000 0000 19c0 0003 0000 0000 0000
[B]0000030 [/B]0000 0000 [B][COLOR=Blue]000f 0000 [COLOR=DarkGreen]0130 0000[/COLOR][/COLOR][/B] 0100 0000
[B]0000040 [/B]0100 0000 0100 0000 0100 0000 0100 0000
*
[B]00000a0 [/B]0100 0000 0100 0000 0000 0000 0000 0000
[B]00000b0 [/B]0000 0000 0000 0000 0000 0000 0000 0000
*
[B]00000d0 [/B]0000 0000 0000 0000 bc8e 56d8 00d0 0000
[B]00000e0 [/B]50e1 406b 0000 0000 0000 0000 0001 0000
[B]00000f0 [/B]0000 0000 0000 0000 0000 0000 0000 0000
[B]0000100[/B]

Then, if I didn't screw this up:

BLUE: BOOT_CONFIG[x] and

GREEN: SECURE_BOOT[?] .

I think I did screw this up... We have to think about this,and the endianess...

<< to be continued >>
[AT&T, Rogers HTC One X, Telstra One XL] cuyo11:
how did yo know that adress?
[AT&T, Rogers HTC One X, Telstra One XL] samiam0295:
This thread is full of the dev equivalents to the Gods.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
UPDATE:

Well it was obtained by RE of PBL, but for a different device.

There are two issues that need to be resolved with this:

1) If the PBL for your HOXL is the same as for SCH-I535. (Which the RE was done for.) EDIT: Is the SAME!

2) What are proper address offsets and meaning of the fuses at those addresses.

Unfortunately I cannot work any further on this, without hands-on access to a HOXL.

So yes, I'm getting just as bored as you guys about this...

It would be great if someone could start, post or PM some IRC channel where we can communicate live about this.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
This is safe, so could you do this and post it for download?

viewmem 0x0 0x18000 >/path_to/pbl.img

(Replace /path_to/ with what you need to get it out of your phone.)

BTW. Do you have any electronics skills?

----

In the meantime, could someone please explain, as was suggested before, and in simple terms:

How do you plan to exploit that WP is off during eMMC bootup?

(I.e. How can you write to it before it's been booted?)
​

Also please post the output of:

cat /proc/iomem
[AT&T, Rogers HTC One X, Telstra One XL] laptopfreek0:
http://db.tt/yn0JFC77
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Somebody want to run-

fastboot oem jump

And paste it then

Fastboot oem get_wp_info_emmc

And paste

If either commands freeze, just hold power until phone reboots.

---------- Post added at 05:02 PM ---------- Previous post was at 04:51 PM ----------

This only works when the device has been soft bricked. Qshusb_dload mode. By forcing a manual hard reset in this mode with the power button their is a 3-4 second window we have full write privileges as discovered by beaups. We've used it to unbrick several devices where boot has been corrupted. hboot.nb0 is only 1-2mb so the file is able to send in that short time frame.​
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
jump will get you a command error

wp_info outputs: INFOeMMC write protection group size = 65536
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
It doesn't disable WP though. WP is applied by SBL2 and SBL3 is what gets you emmc mode.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Since 2.2x hboot is wp now that won't even work anymore then right. It was only working before because it was a signed partition and not protected right?

---------- Post added at 06:36 PM ---------- Previous post was at 06:21 PM ----------

Need another readout pls:)

fastboot oem list_partition_emmc
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
Haha I was messing with commands and I just ran that, made no sense to me

Let me paste the output

C:\adb>fastboot oem list_partition_emmc
...
(bootloader) index, type, start, num
(bootloader) 0, 0x4D, 0x1, 0x100
(bootloader) 1, 0x51, 0x101, 0x200
(bootloader) 2, 0x5D, 0x301, 0x3FCDE
(bootloader) 3, 0x5, 0x3FFDF, 0x1CDF020
OKAY [ 0.016s]
finished. total time: 0.017s
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Hey, thx for readout!! I need the same command from somebody on 2.2x that's locked
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
...
(bootloader) index, type, start, num
(bootloader) 0, 0x4D, 0x1, 0x100
(bootloader) 1, 0x51, 0x101, 0x200
(bootloader) 2, 0x5D, 0x301, 0x3FCDE
(bootloader) 3, 0x5, 0x3FFDF, 0x1CDF020
OKAY [ 0.021s]
finished. total time: 0.021s

Looks identical to me
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Reason they're the same is you aren't running the commands 18th.abn asked you to run.

---------- Post added at 03:05 PM ---------- Previous post was at 03:04 PM ----------

Right. Wp was always active in emmc download mode, its just that hboot partition used to be unprotected.
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
Pretty sure he asked for "fastboot oem list_partition_emmc", which is what I provided...
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
My bad. He asked for get_wp_info first....nobody posted that...didn't see his second request.
[AT&T, Rogers HTC One X, Telstra One XL] dkirchik:
Does anyone here under stand BIOS coding? Because, been reading and chatting with people concerning Asus core unlocker and how it works. Then talking to where I work HTC rep about Qualcomm.. the Asus core unlock utility could work to s-off maybe? I can't make heads or tails of it tho..
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Look for XML code in radio "related" images in Partitions: 16,17,18,20,24,25.

Edit: never mind...
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
You can't write to it before it's booted. There are a few POSSIBLE ways around eMMC WP.

1.) Reset power to the controller and reinitialize it. This drops the Power-On WP. Theoretically this could be done right from android (if it's possible at all).

2.) Figure out how to flash from QHUSB (eDL) mode

3.) Exploit one of the routines that disables WP already - e.g. unlocking BL disables WP (temporarily), writing simunlock disables WP (temporarily), flashing RUU disables WP (temporarily), etc.​
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
im sure it has been meantioned

but has anyone taken the leap to try this expensive tool? http://item.taobao.com/item.htm?id=10824156715

if we were to get our hands on it, could it be used to create a free tool?
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
1. It's not expensive, it's in yen.

2. We're pretty sure its for the tegra 3 hox
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
Well i seen a $ sign so i assumed, if it is seriously $20 bucks id gladly buy it

in title is say One X One V and One XL

All three phones have a completely different processor
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Here's the JEDEC E*MMC Standards 4.51........A great resource on emmc standard. .pdf

http://db.tt/ZuiahDW0
[AT&T, Rogers HTC One X, Telstra One XL] stoopid2001:
The picture of the bootloader with s-off says "evita" on it, isn't that unique to our HOX?
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
i would too. id pay up to $100(maybe more) if it works on a few different devices

are you sure its not $200 usd? 200 yen=2.55 usd :eek:

the other thing thats odd is ive never seen CID listed on the hboot screen.

is is a tool,or just some sort of schematic or directions?
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
UPDATE:

a) We'll have to wait for the gfree cleanup, because our code guy had a major computer loss...

b) HOXL PBL code == I535 PBL code ==> Good.

Now, What about SBL1/2/3 ?

c) Qfuse register addresses, as desperately needed, are unclear as we lack proper documentation and that the original RE coder

may have confused the register meaning/function of what he found.

ANYONE who'd like to help can fire-up your IDA and import the PBL as dumped in an earlier post!

Finally, working with some occasional post's here is getting very annoying and its making me bored, so If someone can drop me an IRC freenode chat-room to communicate in, that would change things!! (Send PM)

Thanks, that clarifies. So from what I see there are plenty of opportunities to do this. We just have to put in the hours to get it done! From my point of view, it would be easiest to do (1), but then we have to know if the eMMC reset line is connected to the device/phone reset, as is suggested by Qualcomm, but only later... It is very possible that HTC never did connect these together, but just use a GPIO, like I mentione long ago... Actually (1) has another possibility, which is hacking PMIC to drop power to the eMMC...

I really wish I had a HOXL! I'd tear that sucker apart and probe it like it was no tomorrow!

Why ruin in the fun of doing something ourselves, by contacting some creepy greedy guy across the globe without any guarantees of anything??

I already wrote about this before, and many many pages ago so did somebody else.

YES! ...and what I wrote before was that the Chinese HTC One XL is nothing like ours!!
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Could someone please make a dump of this on Pastie:

cat /proc/kallsyms

(Anyone can do this, but I wanted you to do it because I already know your FW versions.)

And then these to download:

viewmem 0x700000 0x1000 >/path_to_sd_card/qfprom_raw.bin
viewmem 0x706000 0x1000 >/path_to_sd_card/qfprom_shadow.bin

(4K each, but full of 0's so you can always gzip...)
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
https://gist.github.com/3730589

Can't do these, not rooted.
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Anyone rooted?
[AT&T, Rogers HTC One X, Telstra One XL] ronnie498:
I am on 1.85 and rooted how can I help
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Second part of this. (The raw code dump.)

Please post dump to an open filehost...
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
Ran the viewmem, kept getting an error for both

Couldn't map **** bad file number