yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Unfortunately I believe the send_wp command is asking the card to send data back to us, not update the card. If you read through eMMC source code it's a consistent use of the word "send" and also the CMD31 in the help text also reaffirms that. Regardless, poweron WP cannot be removed without power cycling the emmc. Even if we could send a CMD29 to the card, it wouldn't matter as rebooting the phone would cause the WP to be enabled again.

It's a shame nobody wants to run with my theory of attempting to cause a pre-hboot partition to fail sigcheck and exploit through emmc download mode PRIOR to the WP being applied.

Also, we could be dealing with temp WP which persists after power cycle but can be disabled in realtime with CMD29. Shame there is we don't have anyone to code a way to send those commands.

I can't get it to compile for android, but someone smarter than me can. Look here http://comments.gmane.org/gmane.linux.kernel.mmc/12766

Concept here would be to update the extcsd with the bytes set to DISABLE WP. If the htc loaders don't bother to check/reset the extcsd before applying the WP at boot time, the phone will boot with emmc WP disabled.

So 3 (different) angles here.

1.) update extcsd with WP disabled bytes set. Hope that htc BL is sloppy, and then we can update P3 with easy DD method.

2.) corrupt pre-hboot partition, hope that the boot fails prior to WP application, update P3 and repair corrupted partition in eMMC download mode.

3.) if we are dealing with temp WP instead of poweron WP, send CMD29 and then update P3
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
I feel we need to dig more on those oem commands...

---------- Post added at 10:06 AM ---------- Previous post was at 09:50 AM ----------

1. Casey said at some point when he had his phone taken apart I got p3 updated with dd( ???? in 0 out). However it doesn't comit...diff show differ..

2. how to corrupt pre-hboot partition? if you just want the download mode (semi bricked mode), casey also did this by wiring trick...(it involves drilling a hole....) ...however, what tool do we use to update p3 when in download mode...we were there...but give up since there is no tool for 8960...ATM?

3. "send_wp command is asking the card to send data back" the data is kinda useless...to send back..I think it does more than that...

---------- Post added at 10:21 AM ---------- Previous post was at 10:06 AM ----------

i wonder ...how this guy made those .ko file for disabling WP

http://xdaforums.com/showthread.php?t=805327
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
What are the odds of a brick, as in must return/exchange? I couldn't care less about a soft brick that we can recover from. If it does end up resulting in a hard brick, what are the odds of AT&T allowing a return? I might be willing.
[AT&T, Rogers HTC One X, Telstra One XL] random1204:
The odds are very high. Mine was bricked and I simply stated that I tried to update, and the next morning it wouldn't turn on. It was stuck in USB Download mode, but I couldn't get it to be recognized on any computer except a windows machine. Anyway, sent me a replacement out within 2 days.

EDIT: ODDS ARE HIGH THAT THEY'LL REPLACE IT. My bad... Haha I have no idea on the risk of brick.
[AT&T, Rogers HTC One X, Telstra One XL] mikelebz:
Just wanted to pop in and say that you guys are amazing! Good luck and keep up the amazing work! We ALL, AT&T and Rogers users alike, greatly appreciate everything you devs put into this phone!

-Mike
[AT&T, Rogers HTC One X, Telstra One XL] Scott:
IM going for FULL RUU.

hboot is only part of the key. The other part of the key, and this is just theory, is tz.img.

Although never proved for fact, I believe this is "Trusted Zone" and contains the actual portion of ROM that pops up and allows you to unlock. I am sure that must match hboot as well.

Once again that it is thoery.

Newb question, is our device PJ86IMG or PJ83IMG?

EDIT: Newb Answer: Look at android-info.txt. Sorry, just work up. Not normally up this early!
[AT&T, Rogers HTC One X, Telstra One XL] sk806:
Would you mind if I pick your brain about rebuilding the RUU IMG via PM? I am new to that...Thanks.

Steve
[AT&T, Rogers HTC One X, Telstra One XL] Scott:
Sure. I'll try but I am sure its not as easy as I think it is, lol
[AT&T, Rogers HTC One X, Telstra One XL] sk806:
Sent. I am a mac guy, so not up on winrar, etc...
[AT&T, Rogers HTC One X, Telstra One XL] sk806:
Meh, willing to learn...;).
[AT&T, Rogers HTC One X, Telstra One XL] Raadius:
Understandable.

It's just a way to say thank you for making my time with the One X that much more enjoyable :cool:
[AT&T, Rogers HTC One X, Telstra One XL] sk806:
Sent the PM to mike. I am reading up on how to edit-without-breaking signature. Need to do some real work at some point...:).

Will let you know, unless you find out first.

Steve
[AT&T, Rogers HTC One X, Telstra One XL] arnelolavides:
God bless and good luck guys.unleash the monster on this phone
[AT&T, Rogers HTC One X, Telstra One XL] sk806:
So, tried to flash PJ83IMG.zip based on Endeavor PJ46IMG.zip (can edit contents), signature check failed...

EDIT - Would editing misc partition have any effect on this? Man I need to work...

Will keep trying.

Steve
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I hope you get this handled today, from the sounds of it, it is a strong possibility :) good luck and thank you!!!
[AT&T, Rogers HTC One X, Telstra One XL] x3phyr:
seeing all this action just lights up my eyes. I'm so glad that we're on the brink of getting this phone to unleash it's true potential. I previously brought up spoofing the MID in some way shape or form but it appears that the only way to do that is with S-OFF. Frown.
[AT&T, Rogers HTC One X, Telstra One XL] sk806:
I knew supercid was s-off, but was hoping the opposite was true for MID stuff, which makes no sense, but a man can dream...

EDIT - Think I'm going to have to start using my endeavor as my phone until this thing is done, as every time I reboot from an RUU flash or whatever, I have 2 or 3 new missed calls, ooops....forgot this was a phone...;).
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
Haha i have like 5 tickets to follow up on and a few NTIDS to resolve then i can get my linux hat on and try some things

scott i really really feel spoofing MID is the key here... i have some info i would like to relate but i don't want to post in the forums
[AT&T, Rogers HTC One X, Telstra One XL] UnknownPleasures:
Posting to show my support!
[AT&T, Rogers HTC One X, Telstra One XL] sk806:
No, it doesn't work...
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
can someone with rogers post screenshot of their hboot i want to take note of version numbers etc

also .. i think that the MID is referring to the IMEI of the phone or directly tied to it.. I am curious about this trusted zones img that is available.... im used to cdma hacking and altering of ESN's and MEID's but have no exp with IMEI alterations
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
there hope it helps
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
http://code.google.com/p/open-dsp/
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
ah?...what is that...
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I'd say 25% we can't write to a prehboot parttion

25% chance we can and it works but emmc is still WP from PBL

25% chance it's the right angle and we get s-off

25% chance you hard brick
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Not sure if it's the same guy as the thread starter, but I found this in the .ko file:

description=i'd like this to disable wp on the emmc chip on my g2, please? author=Scott Walker <*his-email*@gmail.com>​

I'll try emailing him!

Billy

PS - I can't believe the Governor of WI is an Android hacker! :eek:

EDIT: emailed the author and PM'd the OP.
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
Alright. I'm at work for several hours, but I'll touch base with you when I get home.
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
lmao....
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I'd test for u in a second if I had my hox beaups, really kickin myself for not getting another. Somebody should sack up and go for it!!
[AT&T, Rogers HTC One X, Telstra One XL] thcue:
Haha Gunny take one for the Team!!:p
[AT&T, Rogers HTC One X, Telstra One XL] TheNightHawk223:
Just sent a email
[AT&T, Rogers HTC One X, Telstra One XL] ChongoDroid:
I brought you guys some e coffee..

*sets down imaginary coffee*

Sent from my HTC One X
[AT&T, Rogers HTC One X, Telstra One XL] :
Roflmao.!!!!! Now that made me laugh :D

Sent from my Nocturnalized Beast
[AT&T, Rogers HTC One X, Telstra One XL] Crappyvate:
How do you guys like your coffee ? :silly:

Thanks for the sacrifice....and hard work.

Sure we're getting close.
[AT&T, Rogers HTC One X, Telstra One XL] mmanjj:
just a hopeful crack flasher patiently waiting on some good news :) We know you guys can pull it off!
[AT&T, Rogers HTC One X, Telstra One XL] sbryan12144:
Hope the development went in a good direction. It's was going good and then silence came :)
[AT&T, Rogers HTC One X, Telstra One XL] TheNightHawk223:
Just to let it out there since I can't get a hold of some people, I'm willing to help in any way I can, but unlukily I only know minimal stuff about software/programming.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
I've been following this "lead" and found that Scott Walker is scotty2 on XDA. I also found his source code for the wpthis.ko file. https://github.com/tmzt/g2root-kmod/blob/master/scotty2/wpthis.c

Obviously, it's from the G2, and the exploit was patched, but it may give us some insight as to how we power cycle the emmc. Since the insmod command was used, we would probably need kernel source before we could actually make this work for us.

Billy

EDIT: This seems to be the relevent code for the power cycle:

void powercycle_emmc()
{
gpio_tlmm_config(PCOM_GPIO_CFG(88, 0, GPIO_OUTPUT, GPIO_NO_PULL, GPIO_2MA), 0);

// turn off.
gpio_set_value(88, 0);
mdelay(200);

// turn back on.
gpio_set_value(88, 1);
mdelay(200);
}
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
Beaups has an idea worth testing, if you're interested. I'm trying to get my PC fixed so I can test myself, but if you're interested shoot him a PM.

It seems that's what's needed most, is people willing to test ideas.
[AT&T, Rogers HTC One X, Telstra One XL] TheNightHawk223:
Just one thing... I cannot refund/exchange my device so I would highly appreciate if it had a low hard brick risk, soft bricks or anything else I can handle :D
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
OK, so I spoke to adwinp, the dude that started the thread niceppl linked a ways back. He said that they reset the emmc by reducing the current on the gpio to the minimum. He confirmed that we would need kernel source in order to send the instructions, but eluded to the idea that the module is somewhat flexible; maybe we can use One S kernel source if we don't get ours soon?

Who do we know that hacks kernels that may be able to help with this direction?

Thanks,

Billy
[AT&T, Rogers HTC One X, Telstra One XL] Irish Enigma:
What's wrong with you're PC?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
This is an angle worth exploring, but if I recall correctly this method was patched out by HTC long ago.

Also, we are going on the assumption that we are dealing with poweron WP, and not temporary WP. If we can get some basic emmc utilities built, we can find out for sure. But since the "writesecureflag" fastboot command is able to call an SR that ultimately updates P3 (if you have the correct sim/rsa card) that leads me to believe we may be dealing with temporary WP - which, as you know, a power cycle does NOT clear.

Anyways.....my money is still on corrupting a pre-hboot partition and hopefully exploiting the eMMC download mode without WP...but seems nobody wants to work on that.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Ooops my mistake
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
how do we flash mmcblk blocks...when we are in the download mode...
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
Any testing with real low risks canbe done by the devs. We kinda need someone that a brick will not effect. I know it's frowned upon by many but it probably needs to be someone who would exchange it or claim Asurion or some other after market warranty. Unless you are just willing to eat $500 for dinner this evening...and be fine with it:angel: or maybe someone already returning their phone for another reason...... Ive

Lost 2 due to testing...
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
when the device is bricked (qhusb mode), after pushing and holding power for ~10 seconds - in linux shortly thereafter all of the partitions will enumerate and expose themselves to linux for about 5 seconds (you'll see sdX1, sdX3, sdX8, about 30 partitions alltogether). During that quick 5 seconds you can DD whatever you feel like back to those partitions.

.

This is how I've recovered bricks. Corrupt hboot --> Brick device. DD back correct hboot while in this mode --> unbricked

Again, my theory WAS to:

1.) Corrupt hboot (1 byte only)

2.) it forces this emmc mode

3.) dd an s-off fixed P3 over while in this mode

4.) dd back the fixed hboot

5.) boot and have s-off

The problem is the P3 didn't stick because WP is still active in this mode. (I've bricked/salvaged 10+ times in this mode before, but ONLY by screwing up hboot).

So my NEW theory is change step 1 to corrupt a parition that loads BEFORE hboot (e.g. SB3, SLB2, SLB1, RPM, or TZ, etc.) and maybe we cause the boot to fail BEFORE the eMMC WP is applied.

I think it's a damn good strategy. I'm just on vacation for a week with no ATT store nearby and have no backup phone.
[AT&T, Rogers HTC One X, Telstra One XL] Irish Enigma:
Why doesn't anybody contact lazy panda and see how he did.it instead of this wild goose chance
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
That's been explored. The people who authored the exploit that Lazy Panda worked with (I think it's the EVOlution people) have not been willing to share the exploit with us.
[AT&T, Rogers HTC One X, Telstra One XL] ptesmoke:
This sounds logical to me...but I'm no s-off dev lol. Props to all you smart fellers :)
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
Just about everything ;-)

It freezes periodically, and at random. Until I can resolve it, I won't risk it freezing during a flash. A lot of other issues, but that's the main one related to testing.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Why don't you contact them and provide us the exploit?
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
If they are unwilling to provide their exploit, maybe they will give us only the tools they used?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Not gonna happen, they want the exploit under wraps for good reason.

I'm thinking SBL2 is our guy to break. for the record:

MMCBLK0P1 is SBL1

MMCBLK0p2 is SBL2

MMCBLK0p9 is SPL3

MMCBLK0p11 is TZ
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
I laughed. So hard.

This has been discussed how many times in 161 pages?
[AT&T, Rogers HTC One X, Telstra One XL] k4p741nkrunch:
Somewhere there's an HTC engineer reading this thread and laughing maniacally. Or soiling himself. One of the two.
[AT&T, Rogers HTC One X, Telstra One XL] Crappyvate:
or both:p
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Need a TESTER ASAP!!! Email/Gtalk 18th.abn@gmail.com or Robert.pomponio@gmail.com, THIS IS A MAJOR DEVELOPMENT!!!!
[AT&T, Rogers HTC One X, Telstra One XL] Irish Enigma:
Then has reverse engineering lazy pandas program been explored?
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
It's a compiled executable.
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Exactly gunnyman, that's what reverse engineering is for.
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
I know all about compiling but nothing about decompiling
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Uh, yeah... Why don't we reverse engineer the kernel too?

Billy
[AT&T, Rogers HTC One X, Telstra One XL] rohan32:
I posted a sizeable chunck of their process a few hundred posts back...

I decompiled and then looked through the hex really quickly. I can look further into it sometime this week since I don't have much to do.

But whatever 18th.abn has will hopefully pan out
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
I believe you can, but it isn't what is needed. Kernel source is very different than decompiled kernel.
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
Rpomponio and 18th.abn will have this done before kernel source is released. They are on a mission. Thanks guys, I know you are getting close.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Hey, can somebody drop me a link to the stock recovery.img please? I can't find it posted anywhere. Gunny said it was in the RUU in another thread where somebody was requesting it, but I dumped the RUU files and it ain't there.

Thanks,

Billy

PS - Yes, this is related... Though it's a long shot.
[AT&T, Rogers HTC One X, Telstra One XL] XsMagical:
What ruu would it be in? I can get it for you in the Morning

Sent from my Nocturnal'd ONE XL
[AT&T, Rogers HTC One X, Telstra One XL] :
Check this thread may be what your looking for

http://xdaforums.com/showthread.php?t=1619556

Sent from my Nocturnalized Beast
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Perfect!! Thank you sir!!

Billy

After reading the thread E.Cadro linked, it's apparently inside the ROM.zip file, but when I got a hold of that file, from the RUU, I couldn't open it like a regular archive... it said it was corrupted. Maybe it's just my crappy, unmaintained, Windows XP virtual machine. :confused:

Anyway, thanks!

Billy

EDIT: Just to set the record straight, the recovery was in the rom.zip for the RUU... I dunno why I couldn't open it in my virtual box, but whatever... it is there.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Yeah, all source is much different than decompiled code... that was my point, but if anybody wants to work that angle, I don't want to discourage them! I just had a brief moment of frustration. Now back to the show ;-)

Billy
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Do you guys have an ENG hboot image?
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Haha, you got me before the edit! That would have been my next question too. I'm not sure how universal they are, but I tried to flash the one posted in the International HOX forum. Unfortunately, I got:

sending 'recovery' (2048 KB)...
OKAY [ 0.355s]
writing 'recovery'...
FAILED (remote: image error! (BootMagic check fail))
finished. total time: 0.388s

Has anybody been keeping up with the International S-OFF thread? It looks like one guy (Xmoo) got S-OFF with some inside info/help from somebody at HTC, but they can't all use it because it will get the employee in trouble. There is an interesting video posted in there too! http://youtu.be/7EueLGDqIpo

Billy
[AT&T, Rogers HTC One X, Telstra One XL] :
But the AT&T/Rogers One X (XL) is totally different from the international One X so even if the international One X gets S-OFF we can't use their tool. But it is good news. It might help to get us S-OFF.
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Lol you got lucky that flash didn't take, because you'd have a brick. Flashing wrong bootloaders isn't very safe :p
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
hes trying to flash a recovery i think
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
Yes, absolutely. The only reason I thought it was relevent was because it's supposedly "the way HTC S-OFF's a phone".

Billy

EDIT: Oh, and the signature card thing.

---------- Post added at 11:07 PM ---------- Previous post was at 10:54 PM ----------

Yeah, and flashing a recovery is quite safe. We all agree that the error I got wasn't because it was the wrong HBoot image, but because it wasn't a recovery image, right?

Thanks,

Billy
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
If someone wants a decompiled kernel, let me know which one you want and I will see what I can do.
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
breaking hboot is safe .....you can unbrick it ...i done it last night...method thanks to beaup
[AT&T, Rogers HTC One X, Telstra One XL] Adam5400:
How do you unbrick a phone with a bad hboot?
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
emmc mode in linux
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Is anybody even trying for s off anymore?? I keep hearing the devs coming up with ideas, then nothing.....can u guys give me a rough eta??
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
We are trying, but not much progress just yet, except for hardbricking phones..
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Thought you and rompiiooooonnmon had a breakthrough? What happened to that?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I don't know what breakthrough he was referring to, but last theory caused hard brick. Deader than a doornail, no qhusb, etc.

We do have a couple methods to try still, and there is a backup plan that WILL get us s-off, but it's crazy cumbersome.
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
That one....
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
What happened to this?

As far as my "progress", I'm still working on it, every day, and when I'm not working on it, I'm thinking about it... the problem is, all the stuff that we haven't already tried is over my head, like probing for UART ports or sending AT commands through the serial bus, so I've gotta spend a whole day reading before I can even tell if something is going to be safe/likely/possible. I've gone though several other S-OFF threads from start to finish hoping to find other possible solutions too. I don't want to just throw random ideas out there that have no chance of working because it just gets people's hopes up and wastes the time of people like me, who don't already know of it will work, but are going to research the hell out of it to find out.

Additionally, this is my only phone (like, I have no other cell phone I can put my sim into, I have no home phone, and I work from home, so I have no office phone), I do have insurance, but it's the kind where you buy the replacement out of pocket and they reimburse you (less a $50 deductable), and I take care of my 2 year old daughter all day long, so I really can't go without a way to communicate in the case of an emergency.

Don't read this like I'm offended or being defensive (not in the least)... I just want everyone to understand why things may slow down in here from time to time... everyone has a reason for their level of involvement.
[AT&T, Rogers HTC One X, Telstra One XL] PeartFan40:
Ok guys, in order for a thread to exist in the development section, there must be an active, working link to downloadable development. As a result, I am moving this into the general section. I will gladly move it back to the dev section, once the OP provides a link.

Thread Moved.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"If you choose not to decide, you still have made a choice"
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Wow, want to know the major development was???? Turning HTC one x into a HTC Evo, Put that in your pipe and smoke it, lol

Now if we could make lazy panda write to the correct place we would be golden!
[AT&T, Rogers HTC One X, Telstra One XL] k4p741nkrunch:
For the record I don't think rpomponios last post was meant for you sir. I believe it was directed to the person asking for his 'major development'.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Umm just letting the people wondering our major development know.. with some humor in it. :-) sorry for posting our findings?? Lol
[AT&T, Rogers HTC One X, Telstra One XL] PeartFan40:
Ok, no problem. ;):p:D:thumbup:

Cleaned up the confusion. :)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"If you choose not to decide, you still have made a choice"
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Lmao, guys^^^^^^^^^ that was a troll, I was trying to get the thread bumped in a POSITIVE way:-/