yashsingh1/xdaforums huggingface dataset:
[HTC One S] avataranjie:
There's some guy in the general section trying to brick his one s. Maybe we can try something related to s-off for him?
[HTC One S] PeQuEsan:
Exactly. So am I (scared). :)

Saludos compatriota. :P
[HTC One S] shootind5nukes:
Wrong. It does not void your warranty getting unlock token. It is if you use it. If when you use it and it comes up in fastboot and you select no when it asks you to unlock you did not void your warranty
[HTC One S] avataranjie:
So you're saying you can unlock bootloader while not voiding warranty?

Sent from my Texas Instruments Ti-69 calculator
[HTC One S] azzledazzle:
Please read the previous posts before posting, This has already been answered

http://xdaforums.com/showpost.php?p=27297780&postcount=259
[HTC One S] snwman:
Plus afew people have said that there phones have came from facotry tampered/unlocked.
[HTC One S] stOwner:
Hey guys, one question: is partition mmcblk0p3 writable?
[HTC One S] Reevine:
This thread is for S-OFF not bootloader unlock/ warranty. Please post in the appropriate thread. Thank you.
[HTC One S] decalex:
I'm not a computer scientist, but wouldn't this thread make a lot more sense being back in the Development area? Wouldn't that bring a lot more input?

Does anyone really read the 'General' section. when they're not just bored?
[HTC One S] avataranjie:
I want to get my phone bricked. Anything you devs want me to test?

Sent from my Texas Instruments Ti-69 calculator
[HTC One S] Reevine:
For now it seems it's just S-OFF discussion. Once there is some actual visible development going on then I'll create a new thread in Dev section. I'm hoping that if someone ends up getting some good progress going then they will start a new thread themselves. :)
[HTC One S] Reevine:
I have not been able to write to it.
[HTC One S] Reevine:
As per suggestion I created a thread in the Development section to see if that increases our progress.

http://xdaforums.com/showthread.php?t=1711933
[HTC One S] Big_Den:
Is there not some sort of bounty going on?
[HTC One S] Reevine:
You can put out a bounty if you want but I prefer to work with the community. :)
[HTC One S] Reevine:
Well I figured it would happen. The dev thread was closed. Hence why I initially made this in general section.
[HTC One S] Reevine:
Any luck in finding the security in the extra partitions? I haven't been able to locate anything so far.
[HTC One S] Big_Den:
I don't think you understand the meaning of a bounty. Its for extra motivation. Don't blame me, blame how the world works.
[HTC One S] k1llacanon:
How long do u guys think itll be before we get s off ? Will it be hard to get s off? Harder than rooting ?
[HTC One S] androidcues:
ETA's do not really help.

itll be a few lines of code.
[HTC One S] k1llacanon:
So how would u do it and apply it?
[HTC One S] Smokem_I:
We will not know until someone creates a method for S-Off. Sometimes it's easy but it just depends....
[HTC One S] stOwner:
I think the security-flags are in mmcblk0p3. I'm working on remove wp.
[HTC One S] Reevine:
Awesome. Hope we can get somewhere with it. Question though. TWRP recovery can apparently flash anything without fastboot. This makes no sense! Lol
[HTC One S] xmoo:
Some of you guys are PM'ing me to help with S-OFF for the One S.

Will try to, when I get the One X done.

Today we had a huge update.

http://xdaforums.com/showthread.php?t=1604300

Some of you with a USB Y-Cable should try to flash a .zip through sd-card.

If that works, and I can modify a DIAG file, also for you S-OFF will come very fast.
[HTC One S] frickinjerms:
:D this is awesome news :D
[HTC One S] Reevine:
Alright! I'm really wanting the HOS development to pick up. I will look into the method further and see if I can contribute to the process any.
[HTC One S] Wel1973:
And I wonder.... Do you look for a method to do S-Off without need to unblock the Bootloader?

Would this allow to do Root with the blocked Bootloader, not?

Or would It be essential to have the Bootloader unblocked?:confused:

If I am in the certain, alone thing I want to say to them that.... God should help them in his search!!!

I hope that they should be lucky in his work!!!:)

I am sorry not to be able to contribute, my knowledge is scarce in these matters.

Greetings and Good Luck!!
[HTC One S] stOwner:
If we have S-Off, you could set the Bootloader locked status to whatever you want, so it is unimportant if we need unlock on the way to S-Off. :D
[HTC One S] Wel1973:
Oh!! Ok!!! Now I understand it.

Big Thank´s...

Greettings.
[HTC One S] PeQuEsan:
You could set back locked flag to whatever you want, but if you used htcdev HTC know you had requested a tocken... Not at evidence that you actually unlocked your phone... but anyway.

I agree with Wel1973 I would prefer not to have to go to htcdev as part of S-OFF process... I'm waiting S-OFF to root my phone specially to avoid htcdev...

bye!
[HTC One S] Wel1973:
THX....@PeQuEsan.

Perhaps, I do not explained myself with clarity .... but you have understood me.

In the search of the S-Off it is normal that be necessary to unblock the Bootloader, but if there was a method, which is what I believe that it wants to be obtained here.

It would be better ( I think so..) that this method was finished. That is to say, to be able to do Root and S-Off without need to unblock....

And to be able this way, to install Recoverys Customs and this way to be able to do Root flashing aplication from the same last Recovery (If it was posible, clear) . Not if I explain myself with clarity.:D

This way, we would not lose our guarantees in case of a Return...ok??

Big thank´s, anyway....for all!!
[HTC One S] stOwner:
I need the wp-state from emmc for an unlocked One S with root before and after "adb remount". Could someone download the zip, execute "getWpState.bat" and post the content of "wpResult.txt"?
[HTC One S] k1llacanon:
I'm not getting into this stuff got not clue what u guys are doing but I appreciate it a lot one question are we allowed to do s off? Because it looks tricky and if HTC didn't mind us doing it they would tell us how to do it right?
[HTC One S] Unconn:
HTC does not own the phone, you do. This is close to replacing the BIOS on a locked PC. The major difference is that this hardware runs on your cell/mobile providers network. They really like to have some control over the types of devices that are on their network and what they are running. They do this for many reasons including security and money.

All that said HTC does not have to provide warranty support for your device if you unlock it or S-OFF. Just as they do not have to provide warranty if you opened the case or got it wet. (I have heard of all of these happening)

The Cell provider also does not have to provide you service if they thin kyour device is a threat to the system, or is actaully causing network problems. Maybe because you flashed the wrong radio and now it is flooding the cell tower. (I have never heard of this happening by-the-way)

It is your hardware, you can do what you want. But they do not have to provide you service once you do.

I can't help because I have not unlocked or rooted. I was just thinking that a thread for people waiting for S-OFF may not be the best place to look for rooted and unlocked phones to run your script. I could be wrong. You don't know anybody that has one rooted you could ask (through PM maybe)?
[HTC One S] k1llacanon:
Ur not rooted or unlocked but u know so much information lol nice why ain't u rooted? Will it be worth doing the s off?
[HTC One S] Reevine:
Just as an update I'm looking into how TWRP can flash radios and ROMs without fastboot. Hopefully this will bring in some insight on how the security works.
[HTC One S] mugetsu666:
I

I'm not sure what u really want done, but I'm rooted & unlocked. Shoot me a pm and I'll be glad to help.
[HTC One S] eminembdg:
It's so friggen awesome that I can flash roms in TWRP without having to fast boot the boot.img separately!
[HTC One S] stOwner:
The eMMC has three different write protections:

Permanent - Write and erase prevention scheme, which once enabled, cannot be reversed

Power-on - Write and erase prevention scheme, which once enabled, cannot be reversed until a

power failure event that causes the device to reboot occurs or the device is reset using

the reset pin.

Temporary - Write and erase prevention scheme that can be enabled and disabled.

The bootloader lock the (important)partitions on our phone normally with power-on protection but if the phone is unlocked, some partitions become unprotected (or temporary protected) so TWRP can flash roms.

But not partition 3 in which, i think, are the flags for s-off and locked/unlocked. So we could only write to this partition before bootloader sets the power-on protection OR we reset the eMMC via GPIO.
[HTC One S] Reevine:
Just discovered this myself! good to know I was on the right trail.

resetting the eMMC would seem an easier process but how would we intercept the bootloader before power-on protection is started?
[HTC One S] Unconn:
Oh, I had a Euro HTC Hero, and then an HD2 before this. I learned loads. Still so much to learn.
[HTC One S] stOwner:
There is a download-mode, maybe we can flash the memory in this mode but i don´t know if there is a signature check like it is in fastboot and i don´t know how to start this mode.

I prefer the other approach: Maybe the reset-pin from the eMMC is routed to an io-port so we could write a kernel-driver and reset the emmc. After this the memory is in idle-state and the protection is removed. Then we reinitialize it and from this point we could write to every partition.

In case the write-protection of a rooted phone is power-on for the /system partition, the phone must reset the emmc to unprotect the memory. Someone should check this with my driver: http://xdaforums.com/showpost.php?p=27658821&postcount=297

if the write protection is temporary, the chance that the reset-pin is routed, is marginal.
[HTC One S] avataranjie:
There's a download mode?
[HTC One S] Reevine:
Just ran your bat file and wpResults.txt was blank. No output.
[HTC One S] gemarcano:
Do you have an s-off One S? I think that was needed for the bat file to work as it needs to, based on the description given, anyhow. I think.

Edit: Nvm, it just says unlocked and rooted. I just got confused.
[HTC One S] stOwner:
http://xdaforums.com/showpost.php?p=27620590&postcount=1139

http://xdaforums.com/showpost.php?p=16042980&postcount=1

http://xdaforums.com/showpost.php?p=27629145&postcount=1182

Our phone has also two holes under the upper back-cover. I have checked this with my multimeter. One pin is Ground, the other one has 1,8Volt. Maybe a pulled up io-pin from the qualcomm chip. I have connected this pin with ground and the phone reboots.
[HTC One S] shootind5nukes:
I know I'm beating a dead horse but I thought I'd ask again. Do we know anyone with an s-off phone that will dump their partitions, I'll make a script later for windows and linux that even a non power user can run and it'll do the work for them. lets get this
[HTC One S] shootind5nukes:
I have a ton of resistors..........any guesses on what to look for on the phone and what resistance to use.
[HTC One S] JDenson77:
I had a vibrant that I hard bricked and finally fixed useing a 301k resister and made a jig out of.. probably want work for our one s but couldn't hurt anything
[HTC One S] Reevine:
Didn't Reviewers contact some S-OFF owners? I though he was going to have them send you some info. You might have to remind Reviewers lol
[HTC One S] Reviewers:
I never got a reply back.

Even if you dump it won't mater cause you can't compare and contract e'm.
[HTC One S] Sneakyghost:
i thought that was possible. why not? bcause of individually signed/encrypted partitions? too different anyway?
[HTC One S] shootind5nukes:
Yes it is. Find out what rom base they're on, flash that rom base to mine, dump mine, then compare the partitions of interest. If you don't like that idea tell me what your doing.
[HTC One S] :
Not to be counter-productive, but this same way was tried on the Amaze before they got s=off and it didn't yield to anything. They had a shipped s=off and a shipped s=on and used all kinds of software to compare but they were too different. If I remember right... Some multiple s=on devices were even different
[HTC One S] xxquicksh0txx:
Yeah, the ones with shipped s-off were not even matching up with each other.
[HTC One S] fcpelayo:
+1 on my end as well. Jbear the only way
[HTC One S] shootind5nukes:
Well I'm going to try. I wanna do something
[HTC One S] avataranjie:
Can someone download system info from the play store and see if the board says msm8960 or msm8260a?
[HTC One S] stOwner:
Board: MSM8960
[HTC One S] avataranjie:
Okay thanks
[HTC One S] mugetsu666:
Same here for US One S
[HTC One S] frickinjerms:
Well the evo 4g lte has s-off now.. i wonder if the same trick used in lazypanda will work with the one series?

Thread is.. here
[HTC One S] torxx:
I'm not sure but One S and evo 4g lte should be really simliar..
[HTC One S] frickinjerms:
Thata exactly what I was thinking too ;)
[HTC One S] Pheroh:
It's the same processor alright but the radio is CMDA and we are GSM.. Wouldn't that make a big difference?
[HTC One S] mteezey:
Anyone heard anymore on this. Ltevo just got s-off from unlimited.io hopefully those guys are working on our device as well. Or even if the method used can be made useable for.our phones that would be awesome. There's not many threads regarding develoent of this of anyone has a link let me know.
[HTC One S] fcpelayo:
I told you guys in the beginning unlimited.io were the ones who made s off possible for a lot of devices. I'm sure they are working on yours as well just give it time.
[HTC One S] PeQuEsan:
Could you please send me that script? Or just the adb sentences to execute... I need to dump all of my HOS partitions to... well... to try something. :P Do I need to be unlocked or/and rooted to do this?

Thanks a lot.
[HTC One S] kurniawan77:
Tidy just a little here....

Let's stay OT on here... changing title to [Discussion]
[HTC One S] k1llacanon:
How would u learn how to do this stuff ?
[HTC One S] McGiver93:
will I brick my one s using LazyPanda S-OFF for EVO 4G
[HTC One S] :
I wouldnt recommend it... But if u wanna be the tester... Give it a shot :):beer:
[HTC One S] Behold_this:
Won't work. It checks the build.prop so you'd need to do some editing to even run it. The exploit itself, however, MAY work IF it were edited for the One S.
[HTC One S] invasion2:
But it is an .exe right? That would be hard to decompile. And if you were to change it and recompile successfully, then you might get a few testers willing to try the exploit.
[HTC One S] McGiver93:
I have only 1 ONE S and i dont wanna broke it :D it was just a question.
[HTC One S] Behold_this:
Exactly. Although i didn't mean edit their package, i meant edit your build.prop (which you should not do to run this exploit you will likely get bricked). Obviously lazypanda would need to be updated by the guys at unlimited.io for true One S support.
[HTC One S] invasion2:
Oh my bad. No way I'd try it. I'm 14 and paid for this $600 phone for myself, and no way I will S-OFF until an official one comes. Sorry, I can't test anything :o
[HTC One S] globatron:
Running LazyPanda on a One S will

WITHOUT QUESTION

brick it.
[HTC One S] SharkBait Ha:
Well at least we got to the bottom that question. now we still play the waiting game
[HTC One S] usaff22:
I've noticed on Revolutionary's website they have the Incredible S, HBOOT 1.09.0000. My One S is also 1.09.0000, will it work with a bit of editing?

Edit: Will SuperOneClick work? It worked on my Wildfire, and a number of other devices like the Sensation.
[HTC One S] torxx:
No
[HTC One S] avataranjie:
How's it going y'all
[HTC One S] Skyman1:
It's not going...

Inviato dal mio HTC One S con Tapatalk 2
[HTC One S] mteezey:
It doesn't seem like it.
[HTC One S] k1llacanon:
Doubt Itll happen
[HTC One S] gemarcano:
O ye of little faith!

I'll go check on the One X forums to see if they have any progress. I know the HOX has a different CPU, but perhaps an exploit there might be similar to what's required for HOS.

Anyhow, if posible I'd like to help, but I'm not familiar with SOff exploits. Is there anywhere with some information on general points to understand before seeking the actual exploit? I program, so I'm not afraid of technical documentation.
[HTC One S] mteezey:
Oh it will happen. It's just a matter of time. I haven't had any time to research any of this stuff for our phones. And this being my first gsm device is a little bit of a change. But from what I can see t mobile has a smaller dev community than say sprint. Hence why the ltevo already has s off. I havent looked at what they used for that exploit yet. But with both phones running s4 chips I would guess they have a lot of similaraties other than the obvious(radio). But like stated above watching progress on the x is gonna be key. Especially if the atat version gets it since its a GSM phone and has the s4 chip as well. Once some people start letting used hos go cheaper I'm sure a lot more devs will get there hands on them. I haven't had an HTC phone yet that hasn't gotten s-off it just takes time.
[HTC One S] invasion2:
+1. It will definitely take a couple of weeks, if not months. I will happen, it's just a matter of when.
[HTC One S] frickinjerms:
i think were just gonna have to wait for team rev.. they pulled it off on a number of cdma and gsm devices before so thats where my faith resides
[HTC One S] k1llacanon:
Can someone tell me how ulearn this stuff
[HTC One S] somerandomhash:
An idea of what we are up against..

I read the One X S/Off thread pretty much all 300 pages of it and some great work has been done. It's a real pity HTC have taken this approach but we are only a small element of the customer base.

It's also symptomatic of a wider trend with smartphones and tablets (imho) Google and HTC have started to release hardware that is NOT designed for dev/modding the 1st thing to go has been sd cards.

The fact is content is where the money is for them, they are making (in Googles case) around what $15/20 on Hardware so the fact that it's becoming harder to 'own' your device is no suprise.

I understand that HTC have really upped the stakes with the One X and I would suggest it's not going to be any time soon that S/Off arrives.

For a good overview of the sorts of things that are being impleented (agreed different hardware but principles are the same):

http://www.freescale.com/files/32bit/doc/white_paper/IMX31SECURITYWP.pdf

http://androidroot.mobi/technical/tf-secure-boot-key/
[HTC One S] TramainM:
I just saw the evo 4G LTE has gotten s-off. Would that be of help to us?
[HTC One S] mteezey:
Not exactly because the evo has a removable memory card which helps in part of the process. Since in our case there is a part of the commands that we can't get past due to there being power to the sd card. Yes someone with knowledge of how to read the scripts used for them could be useful. So certain aspects yes and others no.
[HTC One S] Reviewers:
Y u no s-off one s
[HTC One S] JDenson77:
APX?

go into bootloader and fastboot mode on your phone and choose option where it says reboot bootloader and as soon as your screen goes dark hold vol up. If you have your phone plugged in you will see a driver promt. I cant find drivers that work with it.... TO get out of that mode hold power buttun down for about 10 sec and phone will reboot. ACTS like APX mode to me but not sure without working drivers. Has anyone seen this and sorry if you have.
[HTC One S] frickinjerms:
I think that's the qualcomm diag mode, that's what I used when I had my evo 4g and used cdma tools to change my carrier string
[HTC One S] JDenson77:
Don't think so its listed as USB_download mode in device manager.
[HTC One S] RussianBear:
is it qhsusb_dload?
[HTC One S] JDenson77:
Yea
[HTC One S] frickinjerms:
Oh OK haha just comparing to what I used to know :P

I think thats what's used to push the modded hboot on the 4g lte?
[HTC One S] JDenson77:
I'm not sure what it is I found it by dumb luck. Lok
[HTC One S] frickinjerms:
Haha hmmm cuz I saw something on the lazypanda page talking about the device "getting stuck in download mode" and a fix for it regarding the 4g lte haha so perhaps all we need is a patched hboot and presto :D
[HTC One S] JDenson77:
That would be nice if it was that easy :)
[HTC One S] JDenson77:
I found the right drivers atleast for 64bit anyway now I have "Qualcomm HS-USB QDLoader 9008' in device Manager' it dosent resopond to ADB or fastboot comands. If anyone wants to try drivers for 64bit. http://xdaforums.com/attachment.php?attachmentid=631288&d=1308601930
[HTC One S] RussianBear:
i believe you guys are on the right track :)
[HTC One S] JDenson77:
Don't know how to modify an hboot nor flash it thru this mode... I get a SGS3 on the 17th. I'm willing to try flashing hboot ill do some more googling when I make it home.
[HTC One S] zeroprobe:
Not sure if this may help anyone. I was curious and did a hex compare of the Lazypanda S-Off Hboot and LTE4G Stock HBoot. I've attached the stock hboot if anyone in the know how may find it useful.

For convenience I've also packaged the Hboots from each Ville RUU, along with other files apart from System/Radio/Recovery.

Stock Hboots for

Ville 1.09 / 1.47 / 1.53 / 1.78

http://www.filedropper.com/htcvillehbootcollection

hboot_1.13 from RUU_JEWEL_CL_ICS_40_Sprint_WWE_1.13.651.1_Radio_1.02.12.0427_NV_SPCS_2.28_003_release_259183_signed

Left: hboot_1.13.0000_signedbyaa.nb0: 1,047,808 bytes

Right: FeedPanda-RELEASE-Jewel-WIN\lp_hboot.img: 1,048,576 bytes

Offsets: hexadec.

31:	30	31

32:	30	31

33:	30	31

34:	30	31

26D4:	0F	00

26D6:	00	A0

26D7:	0A	E1

26EF:	0A	EA

3394:	0E	00

3396:	00	A0

3397:	0A	E1

33D3:	0A	EA

3B1F:	0A	EA

5698:	13	00

569A:	00	A0

569B:	0A	E1

58DF:	1A	EA

16197:	0A	EA

161BC:	06	00

161BE:	00	A0

161BF:	0A	E1

LazyPanda's Name String

BFE8C:	2A	2D

BFE8D:	2A	2D

BFE8E:	2A	2D

BFE8F:	20	4C

BFE90:	55	61

BFE91:	4E	7A

BFE92:	4C	79

BFE93:	4F	50

BFE94:	43	61

BFE95:	4B	6E

BFE96:	45	64

BFE97:	44	61

BFE98:	20	2D

BFE99:	2A	2D

BFE9A:	2A	2D

BFE9B:	2A	20
[HTC One S] mteezey:
Bump.
[HTC One S] JDenson77:
I have my SGS 3 now but don't know where to go from here I'm willing to flash stuff on my s one but have had no luck finding info on getting s off. Anyone have any ideas I'm willing to try.
[HTC One S] mteezey:
Yea there isnt much info on this device. Especially in regards to what exactly has been tried. I just re read all 38 pages of this thread but there's nothing to even use as a start point. I think I'm gonna have to get another hos so I can play around and not have to worry about bricking mine or my wife's daily phone.
[HTC One S] klin1344:
I wonder if we could all pool together some cash and send a one s to the devs at unlimited.io. From what I read on the one x forums was that they had an exploit that they were unwilling to share. But I still think is amazing how they were able to get s off for so many devices already, including the evo lte.

Sent from my One S
[HTC One S] mteezey:
Hmmm... Assurrion.:sly::D
[HTC One S] Reevine:
Sorry guys for the lack of updates. I've been busy and just got back from New Zealand. I'm having a difficult time with the hboot. Making some progress though nothing of major significance.
[HTC One S] klin1344:
Thanks, keep us posted.

Sent from my One S
[HTC One S] usaff22:
Wish we could get S-OFF so bad, as I don't want to officially unlock through HTCDev as you can't restore it to its original condition if something goes wrong... can't the AlphaRev and unlimited.io do anything about it?
[HTC One S] Reevine:
Do you happen to know their email? I couldn't find any info on their site.
[HTC One S] Reviewers:
Nope.

To contact Juo click here
[HTC One S] onerikeronebridge:
Sorry if this has been asked before, but what differentiates being rooted, having the bootloader unlocked, and s-off?
[HTC One S] Reviewers:
With S-OFF you can flash kernels in recovery and flash modems.

With bootloader unlocked/ S-ON it blocks you from flashing kernels in recovery and flashing modems
[HTC One S] onerikeronebridge:
So you have root access but no ability to flash without s off?