yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
Truth be told we don't NEED it. Only thing we can't do is adjust what it says on the bootloader menu.

I'd rather have kernel source than S-off right now
[AT&T, Rogers HTC One X, Telstra One XL] Justjusten:
Yeah I agree
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
But trying to get s off is fun. :)
[AT&T, Rogers HTC One X, Telstra One XL] rohan32:
Well I just asked on #JuopunutBear IRC whether there was any plans for the HTC One XL and I got kicked

I guess they have the same no ETA rule? lol.
[AT&T, Rogers HTC One X, Telstra One XL] sbryan12144:
No. The devs aren't planning on supporting the One X as har as I gathered in my pm's they replied to. They hate ETAs as well so I wouldn't hold my breath for them to do it. Not saying they can't but I'm saying they're most likely not interested.
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
The thing is for us devs, the whole process of finding the exploit is the fun part, not always what we can do with it afterwards. It's the pursuit of it, not the end result. But working on a project such as lazypanda for such a long time for fun wears you out temporarily after it's finished. I know that from my projects as well.
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
well you can't blame us for wanting help. Or being just a tad jealous and resentful of you guys with your shiny S-off :D
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
I.can understand not liking ETA questions, and that's cool. But not even helping anyone that wants to port it on their own? Not sharing any info or offering any clues? Sorry, that's not what a "dev community" is to me.

I got the same treatment, more or less. Damn shame, really.
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Yeah definitely.. I'm not a part of that team, in case people think I am. And if I had their source (which they won't release) I would try my hardest to get it working for you guys on the One X. Sometimes people get God complexes on here (well anywhere really) especially if lots of people like and use what they create. That's definitely a downfall that is hard to overcome. I also understand how much time a project like this takes, not only to code the s-off tool, but to find and code an exploit that actually works. I'm sure something will come of this soon, and I will be a part of it when it does. I will also try my hardest to get the source code (I won't release it) and try to get something working on the One X. BUT.... read this post. Won't happen at least this weekend... :( http://xdaforums.com/showpost.php?p=28380323&postcount=184
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I'm sorry for your loss bro!!! Keep your head up!!! Thank you for your help also.
[AT&T, Rogers HTC One X, Telstra One XL] rohan32:
Ah that sucks man, sorry to hear that. I know how much dogs can be a part of the family and that must be tough.

And congrats on the XDA news post :) pretty nifty tool you made!

==================

I'll be looking at what I was able to extract from hex whenever im not working on the AOKP port. if anyone wants to help I'll be on #HTC-One-XL on freenode the entire weekend

I'll try playing around with some of the partitions again also since that seemed like it was going somewhere

EDIT: Can someone link me to the S-OFF and S-ON partition zips again?

---------- Post added at 09:29 PM ---------- Previous post was at 09:23 PM ----------

So I wanted to state my plan of attack.

All comparisons will be done using MD5 hashes. Lets figure out where the S-OFF flag(s) reside(s).

1. Get one S-OFF dump and 2 or more S-ON dumps

2. Disregard common partitions such as system and data

3. Compare the two S-ON dumps and disregard all the ones that are changed between the two

4. Compare the unified partitions from an S-ON device to that of the S-OFF dump

5. Disregard the common partitions between the S-ON and S-OFF dumps

Hopefully by this point we will only be left with a few partitions. We need to dig around in these partitions then.

From there we need to figure out how to change S-ON partitions to be like the S-OFF partition and get it to flash properly. I'm assuming the Panda exploit does something like this so I will try to find their flashing method via hex, or however they changed the layout of the partions
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Basically the exploit has to do with how they made hboot writable, not as much the re-engineering of the hboot.img in IDA. I don't know exactly how they made it writable, but I'm investigating. I worked on the S-OFF for the OG Evo 4G and HTC Hero, and I'm friends with some of the unrevoked members, and this process that they came up with was very similar to revolutionary's exploit, which was basically the unrevoked team + a few others.
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
The HERO

That's where I remember you from :D

I actually loved that phone.

Sorry for your loss. We had to put down our beloved Lab who was also 9 last Halloween. I still miss that dog.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Nah, hboot is always writeable. We can write it right this second. Only the signature check will fail and you'll be (temp)bricked.

I believe they either

1.) modified the radio or amss to not bother checking hboot

2.) figured out how to proper sign a hacked hboot (doubtful)

3.) s-off'd the device by writing mmcblk0p3 (you see it in their code) and simply flashed a fun hboot after the fact

My money is on 3.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I'm with you!!
[AT&T, Rogers HTC One X, Telstra One XL] Skizzy034:
I'm also so sorry for your loss. I'll never be able to get over losing my dog and cat. They were the best friends anyone could ask for.

As for that team, what bad egos. "Omg, I created a s-off tool. Now I'm God and screw everyone else. I get off on seeing people want something that I won't release to them just because I wanna be an a**hole. I'm great and you know it."

They pm'ed me that.

All joking aside, why can't these developers share what they have? Why do they have to be a d*ck about it? I don't care if it's their exploit. If they're on xda they should be helpful towards the other members not hold something back because they think they're cool. They're actually not as cool as they think. What is so hard about releasing their source material?

Before you say it, I would do it myself if I knew how but I don't just like everyone else here.
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Ah yeah I guess you're right I remember someone trying to do that and temp bricking. I thought it was actually read-only on our LTEvo, I may be wrong. My guess is some combination of 1 and 3, because there are some radio/activation problems for some users right away after running it.

---------- Post added at 07:43 PM ---------- Previous post was at 07:40 PM ----------

Well I think they're holding back the source on the exploit because HTC could use it to patch and update SUPER fast. Same as why revolutionary/unrevoked never released theirs.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I think they are just trying to keep the exploit under wraps so it doesn't get patched out by HTC. Even though it's inconvenient, it benefits us all.
[AT&T, Rogers HTC One X, Telstra One XL] Skizzy034:
They're not even attempting nor wanting to help us out from what I see and hear.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Edited to keep the peace
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I've had very reasonable interactions with them. Let's move on and get back to finding s-off?
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
Sure. Next idea to try?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
The goal for me is still to try to figure out how to write to P3. To do that, it appears we need to get past eMMC WP. IMO we should all be working on that.
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
From what I've read and seen, it's definitely possible. Are we sure the WP is power on? If I recall correctly, there are two possible results of a fail, continued WP and then zero WP. So it's just a matter of getting it to fail in the right way.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
As I understand - 3 types

It's either power on or temp here (perm would prevent htc from writing). I believe the route to defeat is the same (or similar at least).
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
Technically, 4 types. Perm, power on, temp, and then none.

However, and forgive my terminology here, the standards dictate the result of a "failure" in any given WP mode. Perm blocks stay perm. Temp behaves differently. And I believe there are two options for Power On WP given the type of "failure". One such result is the removal of WP.
[AT&T, Rogers HTC One X, Telstra One XL] Skizzy034:
What do we have to do?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Right, temp write protection persists after power reset. Power on WP gets cleared. I believe we are dealing with temp WP here as I am of the opinion that hboot is checking/applying this WP at boot-up, yet even when we break hboot, we still have WP in the eMMC download mode.

Of course, Radio could be applying it or some other code between PBL and hboot (I'm still trying to understand fully the boot process).

As for disabling, it doesn't have to be a power hack. We could just figure out how to send the commands to the card. It's all in the source....
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
Changing the WP mode, or disabling it all together, requires the correct command. The correct command includes passing both the password itself and the length of password. So you'd have to find where it's stored, read it, and then pass it along with its length.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
If you are referring to commands to the emmc itself (e.g. CMD42), the only provisions for passwords I see are to totally lock the card, which obviously has not been done here. I don't see any references to passwords in regards to sending WP commands, rewriting ext_csd etc. I certainly could be missing something, if I am, please point me in the right direction.
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
I'll pull it up again when I get home. I could be wrong, but pretty sure that's what I remember.
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
Ok, I take those protocols listed in 6.6.19 to also apply to the various WP modes. Now, I may be wrong, but if you also look at A.5.1, and A.5.2, I would assume those would also apply to WP.

Again, I could be wrong. But logically, if you are right and those only apply to complete lock/unlock, there is no mechanism in place to remove/change WP if the password is forgotten (or unknown, in our case). The only option would be a complete erase, which seems a bit extreme for simply dealing with temp or power on WP.

And looking at table 13, that may actually be correct, where only a power failure can remove power on WP, though that would also mean there's no way to remove the temp WP without the proper password and protocol from HTC.

I also wonder about the data authentication, as it's listed in 6.6.22.4.1, but I haven't much chance to really look at that at all.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Not sure which doc you are looking at as the sections don't line up. I see nothing in the WP commands or any other command for that matter that involve password protection. Only exception is CMD42 which allows to password lock/unlock the entire card. If you could post a link to the particular datasheet you are looking at, I'll review. But I do believe you are mistaken here. And what "pasword and protocol from HTC" are you referring to??
[AT&T, Rogers HTC One X, Telstra One XL] XNine:
I don't wanna derail the thread or anything, I just want to say THANK YOU to everyone who's working on it. I wish I didn't suck at programming, otherwise I'd be helping too. :(

You guys are frickin awesome! :good:
[AT&T, Rogers HTC One X, Telstra One XL] DeathmonkeyGTX:
Yeah a wealthy nerd that resells devices would be the ideal candidate to try hardware mods, jtag, and other crap that can actually brick it.
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
eMMC protocol standards from Jendec, I think. I'll see if I can link to it, because my PC is having issues.

In regards to the latter, the password used by HTC when updating HBoot, and/or other updates that require replacing data in WP area.

Edited: File is linked. https://www.dropbox.com/s/u4umsnhald3g6gf/JESD84-B451.pdf
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
OK, you're looking at 4.51. I was on 4.4. Do we not use a 4.4 revision? I could be wrong.

Either way the password appears to have nothing to do with setting WP, it's the same CMD42 card lock password. The authentication key stuff is interesting (and I believe new to 4.51), but it appears to only deal with RPMB. Again, not what we are dealing with here.

As for the password trying to write secureflag=0 in hboot - that's a totally different animal alltogether. Just something HTC put in to keep us from using a subroutine in hboot that they don't want us to be using.

Now that this is settled, I'd like to get back to figuring out how to get ext_csd written disallowing WP (and hopefully the boot partitions don't overwrite that) and/or trying to clear the WP groups and/or figuring out how to power cycle the eMMC if in fact it is power-on WP....
[AT&T, Rogers HTC One X, Telstra One XL] SoberGuy:
Not sure. Guess the ideal place to start would have been verifying the version we're on. Oops.

So what are your thoughts in regards to getting around WP? What's the best way to proceed from here, and what can I do to help?
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Wait, haven't we already confirmed that hboot is writable though (just fails sig check)? Am I missing something? What are you trying to disable WP on?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Trying to disable it on p3, where we believe the s-off flag is stored.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
We need someone savvy in C to hook into the driver to send theses commands. it's all in the kernel source. I'm working with someone but I fear we will have a long timeline.
[AT&T, Rogers HTC One X, Telstra One XL] regaw_leinad:
Lol sorry, must have missed that browsing through. I'm working on some code to communicate with the controller. Going in blindly, but we'll see what happens.
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
Bump. Just cause its s-off.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I know i keep coming in from left field and dont own a hox anymore, but when writing secureflag 0, you get the sd already powered on error, lazypanda i believe needs the sd to be removed a d reinserted at some point. Is there a way to change the internal sd power setting to 0 instead of 1, thus disabling it from use? This would be considered secure storage since its not accessible so when writing secureflag 0 it wont give the powered on error, and it will enable the sd storage for whatever its trying to use it for. Might not successfully write s off but could let us see what its trying to do with the sd storage once its past the powered on error. Again, sorry i cant play with you guys anymore.

My Evo will be here today so i will be playing with lazypanda to try n find exactly how its working. also will be pulling partitions and comparing to see how similar the devices really are. I will be using lazypanda in linux, and if anybody knows how to possibly get a log of the commands or steps its using while applying s off that would be great. Let me know
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Also, we were never able to get a successful NV memory dump from the hox using qpst. Im 93.24% sure i have that figured out too if someone wants to give it a go. Have to be familiar with getting the device into diagnostic mode and download mode to get the dump. Ill be on gtalk this afternoon once my phone gets delivered and can walk thru the steps, the dump itself will be kinda large so its a couple hours process but would be beneficial i believe. Gtalk-

18th.abn@gmail.com

Unrevoked Forever brings radio S-OFF to HTC Incredible ... www.talkandroid.com/10331-unrevoked... Aug 12, 2010 – This bad boy applies the S-OFF fix to the radio's NV memory, which means that
[AT&T, Rogers HTC One X, Telstra One XL] ethantarheels123:
Oh man... that cliffhanger...
[AT&T, Rogers HTC One X, Telstra One XL] Iamjustian:
It sure is. I kept trying to scroll down, I thought my touchscreen was frozen.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
^^^^^^^^^^^end quote^^^^^^^^^:-)
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
I really appreciate the brainstorming. I've been losing motivation just because there have been no new ideas lately. I'll play around with this angle later today if I get the chance.

Thanks man,

Billy
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Thanks Casey, of I wasn't on vacation I would handle it for you...
[AT&T, Rogers HTC One X, Telstra One XL] Iamjustian:
Did you mean to quote me on that post? It looks bad taken out of context. What you quoted me on was not directed towards you, it was directed at the person that I quoted when I originally wrote that. I hope you didn't think I was being rude to you. Either way, thank you for all your hard work in trying to get s-off for us, I was sorry to see you go but I am glad you keep coming back with ideas.
[AT&T, Rogers HTC One X, Telstra One XL] bloodrain954:
just bumping this so it doesn't get lost in the deep dark pages of XDA
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Trust and believe it's being worked on... Not an easy task though, specially considering this is new territory... :) be patient grasshopper :)
[AT&T, Rogers HTC One X, Telstra One XL] bloodrain954:
Oh I know, I'm just not letting the thread go into hiding. :)
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I feel you!!!! :-)
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
So after running lazypanda soff on my EVO, it does in fact put your device download mode. Qhsusb dload mode. Same as we were doing on the hox. No wiretrick needed but during the process it goes into it and windows ask for the qhsusb dload drivers. Neat thing is you just ignore it and it still does whatever its doing so it so driver's are not be essary
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
I knew we were headed down the right path Casey... Crap
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Ok, testers needed, hit me up at Robert.pomponio@gmail.com or get a hold of 18th.abn@gmail.com.. with that being said let the flaming begin cause I can feel it coming, lol :)
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I suspected as much.

What would be GREAT is if we could get a DD of partitions before and after. If they are not requiring drivers, I suspect they are taking advantage of the VERY quick eMMC download mode we get, where the partitions are enumerated (no drivers required).

I've played with this mode several times (as you all know) and unfortunately eMMC WP is still alive.

I've gotten into this mode by corrupting hboot.

The question is, if we corrupt one of the boot partitions that is loaded PRIOR to hboot does it (OSBL, SBL, REX, etc) will it:

1.) still allow the fast eMMC enumeration to take place

2.) Break the boot precess BEFORE eMMC WP is applied

From reading some of the documentation on anyclub.org the OEM "can" disable the eMMC enumeration in the early bootloaders, but it doesn't mean HTC did.....but there's only one way to find out.

What I feel we need and should be trying:

1.) A detailed order of which partitions (loaders) are loaded and in what order (e.g. which partition is PBL, OSBL, SBL, etc). We screw up a single partition going backwards from hboot (P12) and try to modify P3 while in that mode and then correct the partition we corrupted to cause dload mode to happen. (Remember, each partition that's loaded checks the next partition's signature. )

2.) Someone willing to test. I have destroyed my backup phone (long story).

Just food for thought.
[AT&T, Rogers HTC One X, Telstra One XL] niceppl:
I always had few questions and thought in my head...

1. I think beaup's idea about modifying the EXT_CSD and WP is what we need to get p3 flashed.

The WP protected size on S-on is 65536, and S-off is only 16384, seems the security part is under protection by the WP

2. the last few oem commands from fastboot

bootloader) list_partition_emmc

(bootloader) load_emmc

(bootloader) check_emmc

(bootloader) check_emmc_mid

(bootloader) read_mmc

(bootloader) load_modem_emmc

(bootloader) get_wp_info_emmc

(bootloader) send_wp_info_emmc

(bootloader) get_ext_csd_emmc

(bootloader) get_sector_info_emmc

does anyone know how to use them?

load_emmc? load_modem_emmc? send_wp_info_emmc?

they actually seems like set functions...however I cant guess out what are the format of those parameters...

3. The sdcard error we got when doing a writesecureflag 0....

it seems it's looking for a file named SMART_IO.CRD on the sdcard...

i'm not sure if this is a file or something else....

anyway...let's discuss about these.
[AT&T, Rogers HTC One X, Telstra One XL] JeepFreak:
From an email I sent beaups when this thread was locked (I don't have time to elaborate now):

"fastboot send_wp_info_emmc wp_start CMD29" is supposed to unlock the Power-On protected partition, and it seemed to complete successfully. I tried it and then tried writesecureflag, but got the sdcard error and then I tried DD'ing the modified p3 in Android, but no luck. Obviously, it's relocking when it reboots from Fastboot mode, but there's got to be some reason that command exists.

I'm going to keep researching/trying things later today, but thought I would let you know.

billy@htpc:~/$ fastboot oem get_wp_info_emmc ... (bootloader) eMMC write protection group size = 65536 OKAY [ 0.010s] finished. total time: 0.010s

billy@htpc:~/$ fastboot oem send_wp_info_emmc ... (bootloader) Invalid parameter (bootloader) command format: send_wp_info_emmc [wp_start] [CMD31?] OKAY [ 0.012s] finished. total time: 0.012s

billy@htpc:~/$ fastboot oem send_wp_info_emmc wp_start CMD29 ... (bootloader) Next 32 write protection groups: (bootloader) 0x0 (bootloader) 0x0 (bootloader) 0x0 (bootloader) 0x1 OKAY [ 0.012s] finished. total time: 0.012s

I read HERE that CMD29 is supposed to unlock the write protected partition. I should have tracked down the source, but I didn't... I just tried it.

-------------------------------------

Check this out!

http://www.htcmania.info/index.php?showtopic=4150&st=45

Unfortunately, most of it's over my head, but this part sure looks promising!

Looking at the eMMC 4.4 spec it seems there are two ways (accessible to us) to reset the controller:

CMD0 with 0x00000000 - this is a soft reset, which shouldn't reset the power-on write protection. CMD0 with 0xF0F0F0F0 - this is a 'hard reset', which should be equivalent to doing a reset with the reset pin on the controller.

Or to quote the spec: "The card will be in boot mode after power cycle, reception of CMD0 with argument of 0xF0F0F0F0 or (e•MMC only) assertion of hardware reset signal."

More tomorrow,

Billy