yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
OK, if you look at the logs, there is clear communication between device and qpst. With mprg8960.hex, you will see the first write address is at 0x2A000000, after it finishes writing it sends the go command to the start address again (0x2A00). It times out after not receiving a ping return.........I've used a couple other .hex files in place of mprg8960.hex.(You can use any .hex programmers as long as the file is renamed to mprg8960.hex) One .hex sent the first write address to 0x10000000. It never receives a response so just repeatedly sends a write command, fails because no response. (A response is required for it to continue writing)..3rd .hex I tried sends first write command to 0x2A3F0000. It responds, so the communication is successful, it finishes writing, sends go command to start address(0x2A3F0) and again times out from no ping response.

As mentioned before .hex is a set of instructions. There are different instructions that can be utilized to acquire different modes. One mode that we know of is USB mass storage, another that is there is I believe is flash programming mode. There are others also......So, what I believe we are lacking is a proper set of instruction (.hex) to utilize the modes......this is why a generic .hex will not accomplish what we need(My opinion) and that device specific .hex files must exist. Just from the few hex files I've tried you see there is a address range that gives a response. Its far from narrowed down but its a start......

0x10000000-no response

0x2A000000-communicates

0x2A3F0000-communicates

So we know that we can communicate in ranges 0x2A00-0x2A3F

What we need to know

What set of instructions is a specific .hex giving, and what start address does it need to be directed at?

A successful flash with .hex will receive a ping response from the go command, the device loaded with .hex and qpst will then both iniate a "hello"command/response and continue with whatever the next instruction is on the given .hex file sent.

This is my understanding of this process and its purely derived from testing, reading and theory. It absolutely contains speculation so step in if I'm misunderstanding any of this please
[AT&T, Rogers HTC One X, Telstra One XL] darkspr1te:
I am not really familiar with the htc devices, can someone tell me if they can accept external sd-card ?

if so, i've proven a msm8660 can boot off a sd-card , no rewire required.

[ 8447.574034] scsi16 : usb-storage 1-2:1.20
[ 8448.572797] scsi 16:0:0:0: Direct-Access Qualcomm MMC Storage 2.31 PQ: 0 ANSI: 2
[ 8448.573163] scsi 16:0:0:1: Direct-Access Qualcomm MMC Storage 2.31 PQ: 0 ANSI: 2
[ 8448.573989] sd 16:0:0:0: Attached scsi generic sg3 type 0
[ 8448.574698] sd 16:0:0:1: Attached scsi generic sg4 type 0
[ 8448.579116] sd 16:0:0:0: [sdc] 30777344 512-byte logical blocks: (15.7 GB/14.6 GiB)
[ 8448.579862] sd 16:0:0:1: [sdd] 3911680 512-byte logical blocks: (2.00 GB/1.86 GiB)
[ 8448.580403] sd 16:0:0:0: [sdc] Write Protect is off
[ 8448.580408] sd 16:0:0:0: [sdc] Mode Sense: 0f 0e 00 00
[ 8448.581029] sd 16:0:0:1: [sdd] Write Protect is off
[ 8448.581034] sd 16:0:0:1: [sdd] Mode Sense: 0f 0e 00 00
[ 8448.581524] sd 16:0:0:0: [sdc] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 8448.582156] sd 16:0:0:1: [sdd] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 8448.592525] sdc: sdc1 sdc2 sdc3 sdc4 < sdc5 sdc6 sdc7 >
[ 8448.595025] sdd: sdd1 sdd2 sdd3 sdd4 < sdd5 sdd6 sdd7 >
[ 8448.598795] sd 16:0:0:0: [sdc] Attached SCSI removable disk
[ 8448.601154] sd 16:0:0:1: [sdd] Attached SCSI removable disk
darkspr1te@darkspr1te:~/Desktop/partition_load_pt/test$

this may help in the search for changing bootloaders for s-off, i dunno, just throwing it out there.

darkspr1te
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
I must admit I'm not really following what you're trying to do. (Also, unfortunately, I have little time/possibility to stay on top of this topic at the moment.)

But if you want to change the execution address of the supplied HEX file, you'll have to edit it's last line ( :040000052A000000CD ) as I described HERE. But emmcswdownload could probably also change this when loading/producing your images. In addition, several people have told me that HEX files are also authenticated (signed), but I have not seen any specific code/confirmation, that this is actually happening, although it is proclaimed that all SecureBoot3 devices should have everything signed by default... But then we have to remember that the HEX files are just the bootloader "flash loader" files (as already mentioned above) so that the HEX file itself

might

not have to be signed... (AFAIK)

Second, looking at your (18th.abn) logs, I don't seen any "cookie" related error message... What is the exact message? (So that we can find the assembly that is producing it.)
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Thx for the info. As for the error, its just a generalized error qpst gives whenever the process doesn't complete. No matter where it fails its just a pop up screen. The actual fail in the log is just the timeout from no ping response.
[AT&T, Rogers HTC One X, Telstra One XL] Myrder:
Every time I see this topic in the forum at the top, I get more excited. Every single one of you who are working on s-off deserve a medal of honor/valor and some even a purple heart. ;) Keep the good work up.

While I may not know a whole lot, yet, about this phone and the boot process. I'm willing to help in every which way I can.
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
It would have been a lot easier to gain s-off, if this device actually had an sdcard.

Edit:

Just had a thought, what about using the above method with a usb thumb drive?

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] BreatheHT:
I bet, since they're in the same family (MSM8x60).

That's gonna be really helpful but wouldn't it be a little complicated to operate when it comes to a public release... Maybe some kind of emulation would help?

Sorry if this had been mentioned before......
[AT&T, Rogers HTC One X, Telstra One XL] ECEXCURSION:
I thought this avenue had already been explored?

Sent from my HTC One XL
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Msm8960 boot architecture.. https://dl.dropbox.com/u/69550833/MSM8960_Boot_Architecture.pdf

More 8960 info http://xdaforums.com/showthread.php?t=1856327 <----- Thank you E.v.a.

And another interesting article.. thank you E.v.a. http://xdaforums.com/showthread.php?t=1978703
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
I'm familiar with all of those. In fact it was the early efforts of E:V:A that got me started researching all of this.

Hopefully his efforts will continue to help and inspire others. With enough knowledge and ppl working on things, there's a lot of untapped potential for these devices. (For instance, I recently learned that some of the qualcomm radios actually support wireless fax capabilities. Which ones and how usable it would be, I don't know. But it would be cool if one day you could send and/or receive faxes on your smart phone.)

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
That actually wouldn't be cool at all. Not even a little bit.
[AT&T, Rogers HTC One X, Telstra One XL] mikef:
I will discuss with my mod teammates and see what they think before moving it so someone else doesn't report it and ask to move it back.

Thank you,

mf2112
[AT&T, Rogers HTC One X, Telstra One XL] E.Cadro:
Okay the moderator team has decided to move this back to the development section in an effort to put an end to the off topic discussion

and because this is development related.

Given the size of this thread I'm going to suggest that you USE the search thread feature located at the top to make sure your suggestion or idea has not been attempted already the op has also been updated to reflect this decision.

FROM THIS POINT FORWARD ANY OFF TOPIC DISCUSSION IS PROHIBTED YOUR POST WILL BE DELETED

If someone posts something off topic DO NOT reply hit the report button!​
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Ok its been a few months since I last asked this but we have new players aboard so I will ask again for the heck of it.... Is any one proficient at C+? If so the source code for the gfree exploit is publicly available. We have spoke about it in the past specificly about the code in it the 'power cycles' the emmc leaving wp disabled... If any one new here is interested ill post the source code for you. Its not gauranteed to work but it is close to the only thing that has not been tried to acheive s-off.. thanks
[AT&T, Rogers HTC One X, Telstra One XL] -Perp-:
I haven't touched C/C++ in 5+ years, but I am a software developer by profession. I used to love C/C++ but at my job, I only do Java/php/perl, so I'll be a bit rusty.

I can take a look at the code if you can tell me what you are looking for. Although to be honest, coding 40 hours a week, I don't really like to look at more code in my spare time, but can check it out.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Sweet, i cant do sh*t in C. anyways this has to be modified to match our partitions, etc. the part we want to focus on is the part that disables power cycles the emmc and disables wp. we can manually s off afer that very easily. https://github.com/tmzt/g2root-kmod/commits/master/scotty2
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
I know c/c++ too. I'll take peek.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Awesome! Hopefully we will get to the bottom of this this time. Thanks guys.
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
your welcome...spoof cid is it easy?
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
Pshh no but it's somewhere to start
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I have a feeling you guys are gonna be winning the bounty :)
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
I'm not a mobile dev...but I remember reading something like called gold card?

does that thing may help us?
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
It would if this phone had an sd card slot
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
its been discussed in other threads for S-off you can usesomekind of card reader and it recogniZes the SDCARD
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
cant we fake that?....maybe easier than spoof cid
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
Both will be exceptionally difficult

i am leaning more towards CID since we know the values that work

as where with gold card it will be guess work
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
If don't know if the hox supports otg USB host mode. If it does then it seems like using gold card to flash Rogers ruu would be a solution
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
http://www.youtube.com/watch?v=y4uVGgwC4LE

http://www.youtube.com/watch?v=zg97l9WXxEg
[AT&T, Rogers HTC One X, Telstra One XL] vinvinvinster:
You guys probably tried this already, but I remember reading somewhere that even HBOOT and RUUs cannot read from the protected radio storage area, and that it just reads settings from the misc partition. If it just reads the CID from the misc partition, even if the value originates from somewhere else, could it be possible to change it in the misc partition, then use HTCDev to unlock the bootloader and then if the CID gets changed back to CWS__001 then it wouldn't really matter? That wouldn't help in getting S-OFF but it might help in unlocking the bootloader the normal way.
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
no

the misc partition was locked down after the tbolt

http://www.youtube.com/watch?v=y4uVGgwC4LE

http://www.youtube.com/watch?v=zg97l9WXxEg

OTG mode for rogers RUU might work?
[AT&T, Rogers HTC One X, Telstra One XL] dasfiend:
Old Hat I'm sure but my CID is:

CWS__001 (8 char)

AT&T retail unit bought via amazon.com.
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
even this is the solution....so everyone has to buy a OTG...

oh...OTG is gonna make money lol...
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
confirmed CID
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Here's a pic of my boot screen let me know if I can help...
[AT&T, Rogers HTC One X, Telstra One XL] crisis187:
if we could get an unlocked rogers boot flash i would be willing to try it even an unlocked ruu
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
hey....probably this is somewhere tried...people who has an att htc one x...

did you try to extract the rom.zip from rogers ruu

push to the phone and

and flash it ?

does that change the cid or not? anyone know?
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
The full ruu would need to be written
[AT&T, Rogers HTC One X, Telstra One XL] equlizer:
As it stands now the OTA cable does not work. Ive tried 4 diff sticks and no go. Works fine on my SGSII though.
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
I currently working on another project, so I might not have time to look at it before the weekend.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I completely understand :good: take your time sir.
[AT&T, Rogers HTC One X, Telstra One XL] -Perp-:
Has anyone tried this? If so, what messages do you get?

I quickly took a look and some parts I can follow, other parts... will take some time lol. A bit more complicated than my current skill level (plus it's always hard looking at someone else's code w/out having much documentation.)

Edit: Funny, I looked at the code to avoid doing documentation myself on code I just wrote.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
No, we have not tried this yet because no one has been able to pull the code we need and put it together so we can try it...
[AT&T, Rogers HTC One X, Telstra One XL] :
I know some C and will look at it as well, I had a conversation with beaups over this a while back, but I don't remember the end result, that is, if we decided it will/will not work or is worth a try
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Thanks grim. Yea I believe its worth trying, I just spoke with beaups again about it and he's on the same page...
[AT&T, Rogers HTC One X, Telstra One XL] -Perp-:
To the people who are going to look at the code, assuming you don't 'get' it right away, should we discuss the code in this thread or take it off-line?
[AT&T, Rogers HTC One X, Telstra One XL] mikef:
Code discussions are fine here if you like.

mf2112

XDA Moderator
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
this exploit was closed after the 7x30 SOC
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Well guys I guess that's the end of that idea, lol
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
Oh well, it was a good try.

At least that link contained information about the original author of another script, which I passed on to another developer so he can now be properly credited.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Hey I'm happy something good came from that. Any one eelse have any other ideas??
[AT&T, Rogers HTC One X, Telstra One XL] :
I thought 18th found the external storage pins on the board, other than that, no clue what he tried from there
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
He said he is not sure if they are pins for external storage.. he also doesn't own a hox at the moment but is gonna post some pictures for us of the pads later on today/tonight...
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Ok thank you 18th.abn for the countless devices you have sacrificed in the process of trying to s-off this b@#$!.

Here is a Picture of the pads 18th found that we believe are for connecting a external sd card holder. Can anybody confirm this?

After further investigation the htc evo 4g lte is MSM*(^) and judging by this picture i believe we have located external sd card pads..
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Heres a evo lte board. Its looking pretty good imo but need somebody to do some voltage testing ect..... to find what the pinout is exactly. Until then all we can do is speculate.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Coming back to thoughts, while talking to another member I was reminded the exact point of this thread.

To achieve s-off in a manner that is usable by the masses.

Im not actively working on this anymore but will be following along and chiming in where I can. As this thread continues to develop just keep in mind that without a exploit that can be deployed by the % of population, s off development will have to continue on.

Its going to happen eventually, and the more focused and on target the development thread stays, the better it is for development. The better the development, the better it is, that is being developed;)

Heres a link to my dropbox s off folder. I have more to add but atleast there is some usable info in there.

http://db.tt/gfWasMFX
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I've come to my senses and realized the same thing... Without this exploit being noob proof, there's no point in moving forward in that direction... No one is gonna attempt to attach a external sd card even if was confirmed to s off because its not something everybody has the knowledge to do even with a step by step guide lol... Thanks 18th.
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
I think at this point in the game any s-off is better than no s-off. With s-off maybe some more devs pick up the device, maybe new stuff is learned while figuring out the s-off method yall are discussing now. My opinion for the ones with the know how would be to not give up on it just because everyone cant use it... It very well may lead to an easier way... Thanks to all involved!
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
I agree with this completely. I'd take my phone apart,id buy a tool,I'd try a rediculously comlex,even risky method. I hate s on. I'm actually considering sending my hox to Russia to be s offed.

Any method will be good for devs and experienced users,and in time it hopefully will be streamlined.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Well get your volt metors out and get us some voltage readings on those pads. :) if we are to move forward with this plan of action then this is the next step... :)
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
The only problem I can see with trying to attach an external sd card is if they left out, or disabled via qfuse, the support in the bootloader firmware. That would be needed since the firmware acts as a middle man between qualcomm hardware and the Linux kernel. No real way to know for sure though.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
I'm just throwing out ideas but could flashing a evo LTE hboot solve that problem?

Slithered from my HTC One X+
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
That will brick you
[AT&T, Rogers HTC One X, Telstra One XL] scotty1223:
Unfortunately,I don't still have one. I sold it after picking up an HOX. I still follow along in hopes of a method being modifiable to other no-external sd devices.

I do still watch cl.. if I can pick up another one cheap,I will :)

---------- Post added at 12:33 PM ---------- Previous post was at 12:25 PM ----------

Maybe not... if you could figure out a way to do it. my experience with q fuses is that the unallowed/unsigned hboot will work fine,youre not bricked until you try and boot something else.

It might be possible to install the hboot,then s off so no security checks are being done,then safely flash back to a correct hboot.

That of course is 100% speculation. it might be the fuse is blown the instant the wrong hboot is flashed,despite the fact it lets it boot. Just tossing it out for discussion :)
[AT&T, Rogers HTC One X, Telstra One XL] SouL Shadow:
No. Experience from the Evo lte shows that s-on with an insecure hboot will brick.

-SLS-
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
According to MobileTechVideos Facebook page, they have been successful...

"AT&T/Rogers One X and One XL S-OFF now possible via JTAG for all owners. S-OFF service coming soon through our e-Store for those interested in unlocking your phone's security..."

​

Not sure what this means, since they're not mentioning Verizon, and there's not much other info there...

Also, unless this is already outdated, here is some more info about bootloader cookies, mentioned a few pages back... This is for the Secure Boot 2.0, but is probably still valid also for SB 3.0.

[SIZE=2]
Table 4-1 Cookie format
-------------------------------------------------------------------------------
Items Description
-------------------------------------------------------------------------------
magic_number1 Magic number
version Cookie version number
OS_type OS type to boot to, such as Linux Android, L4, Windows Mobile
boot_apps_parti_entry Start address in storage device of the APPS partition;
gets information from EBR in eMMC
boot_apps_size_entry Size in bytes of APPS kernel in APPS partition to be loaded
boot_apps_ram_loc Location to copy APPS kernel into RAM[/SIZE]
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Awesome, i sent this guy a message about a week ago asking for help with S-OFF, he kindly replied to my email very promptly asking what he could do to help, i also gave him a rundown of how of how other MSM8960 devices acheived S-OFF. he kindly replied to me again saying he would take a deep look into it and see if he could help us out... Well judging from your post E.V.A he is going to help us out like i asked...very good for you hox guys.. sadly i sold my hox yesterday so i will no longer be working on s off. Good luck guys and i hope the new contact i made is going to s off this B*&^$ for you guys finaly :D
[AT&T, Rogers HTC One X, Telstra One XL] ImagioX1:
So does this mean we have soff?
[AT&T, Rogers HTC One X, Telstra One XL] ECEXCURSION:
Supposedly. At least if you send your phone to that guy on facebook.
[AT&T, Rogers HTC One X, Telstra One XL] ImagioX1:
Think its something an average user could do himself? without sending it in?
[AT&T, Rogers HTC One X, Telstra One XL] johnwayne007:
Youtube

At the moment it doesn't look like something a Normal user could do. Check out the video.
[AT&T, Rogers HTC One X, Telstra One XL] ImagioX1:
Ah yeah. I'd have bricked it by just taking it apart. Good we got soff finally though.
[AT&T, Rogers HTC One X, Telstra One XL] Reevine:
Does anyone know if the SB 3.0 cookie stores any signed cert? I'm assuming it does but would like to get some input on this.
[AT&T, Rogers HTC One X, Telstra One XL] darkspr1te:
Yes as of dmss protocol v5 the cookie is required. It's part of the Qualcomm header now, see e:v:a's thread.
[AT&T, Rogers HTC One X, Telstra One XL] Reevine:
OK perfect! I'm pulling certs from different portions of the device to eng a jcard. I'm double checking the signed HTC info for the Jcard. I'm working on s-off for HOS right now. Thanks for the conformation!
[AT&T, Rogers HTC One X, Telstra One XL] buradd:
do we need this s-off to get carrier 'sim' unlock? I want to switch from at&t to straight talk prepaid
[AT&T, Rogers HTC One X, Telstra One XL] ImagioX1:
This is a little off topic but so long as you get a straight talk SIM card that uses att's network your phone does not need to be SIM unlocked.

Sent from my VenomXL using Xparent Red
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
Seeing that you guys are still working on this.

Not sure it will help you, but here is the eMMC layout description...