yashsingh1/xdaforums huggingface dataset:
[HTC One X] Vcek:
starting apx mode is just power+vol up on asus transformer, wheelie makes nvflash mode "ready"

Edit:
[HTC One X] feraay:
So or so wont work for us ........
[HTC One X] nitrous²:
Accept it. There is no "hack" to S-OFF the phone a user friendly way! Either you purchase the needed hard- and software, or stay S-ON. It'd be much more productive if you'd search for another way to flash to boot partition via recovery. You're waisting your own resources with this topic! Only a real hardcore hacker could do the trick! I mean someone like Kevin Mitnick or George Hotz! HTC also seems to accept their mistake with this sort of locking. The HTC ONE's boot partition can be flashed via recovery even with S-ON. There might be also a chance for you, that HTC will deliver an update that could allow you to flash boot via recovery. Even this hypothesis is more likely to become true than you find a way to S-OFF the "unofficial" way.
[HTC One X] MrT69:
Not sure. But I hope :)

Remember to the Sensation device there it was also required to hard brick and destroy the hboot. There where a lot of RMA because of this and HTC was realy sad about this.

I have changed my device 3 times until I got the right "brickpoint". And there was no way to confirm if it was the User fault or a bad device.

As far as I knows this was the reason why HTC build in the NVFLASH option.

Now, lets assume the hboot is bricked.

How can HTC recover the sbk? From my point of view this hard brick can be an Option to S-OFF with a 50:50 chance.

I'm still searching informations how to flash and work with NVFLASH and there is no overview about options and commands for this tool.
[HTC One X] bunny0007:
Jtags will always repair soft og hardbrick from fail flash.

But proberley only htc service centers and htc will have jtag equipment for the phones.
[HTC One X] ximonx:
Some ideas:

1 -

If the USB traffic between the phone and a device emulating an SD card with the firmware.zip on was monitored we could see how the bootloader checks the signature on the firmware zip before flashing it, if it checks and extracts in two operations then when the bootloader went to access the file the second time we could send it an alternative file (i.e use an official zip for signature checking, then our modified zip with s-off fixed bootloader)

This could easiy be achieved with a teensy / microchip pic18 (microchip provide the source to emulate a mass storage device already)

2-

When the HOX boots it sets some registers in the tegra3 to enable the write protection on certain sections of the flash, could we not use a kernel module to reset the CPU and alter the hboot to disable the signature / s-on verification?
[HTC One X] Vcek:
I disagree with idea 1, the bootloader stores the firmware.zip (temporary partition) then flashes it regardless of the usb status, you can unplug the usb after it completes "sending" and the bootloader will continue the flashing process.

TLDR: Sniffing bootloader is totally useless on usb level, it just sends back the status of each operation.

I had some hope for idea 2, but the best results for avoiding the bootloader was changing the writing permission of the system and data partitions, which rendered the devices useless.(this was achieved by trip's kernel based on tegra references, no one else made kernels based on this source except HTC themselves )
[HTC One X] TripNRaVeR:
If someone wants to look into this method again, i have a hack on my github to expose Fuses to sysfs and make them writeable. The write protection can be hacked with a kernel, but since my last attempt i'm not going to try it so quickly again as before lol.
[HTC One X] mido.fayad:
If u want to try anything risky, i can try it on my device

Send me what u want and i will try and no problem if it bricked my device ;)
[HTC One X] ximonx:
I meant when flashing from an SD card via an OTG cable, but if the phone copies the zip to temp before the check then this will not work :(

Is there a disassembled hboot for the HOX?
[HTC One X] MrT69:
I was able to resign the ZIP file with a Tool here from XDA Board. Can't remember the Name but its actually not important.

I was able to "flash" even with a relocked device but it was not possible to write anything to the device.

For better understanding:

The wizzard confirmed that the flash was done but nothing was installed on the Phone.

So there is more than check the signature of the File.
[HTC One X] Vcek:
What do you mean by the "wizard", the actual ruu wizard or the bootloader feedback on cmd prompt?

Because ruu wizards only send the ruu fastboot command for you.
[HTC One X] wineds:
I don't suppose the new revolutionary soff for the htc one is of any use to us? I know it is qualcomm based but...
[HTC One X] vin4yak:
Hox is tegra... I don't think it will ever be possible to s-off it ourselves.. :p

-Sent from my IceCold One X!
[HTC One X] AdrianM:
Yeah, probably not.

All I want is to be allowed to flash boot.img from recovery, without using fastboot and being near a computer.

I'm not sure, but I think on the One you can do that even if you are not S-OFF-ed. All you need is to be unlocked. I wonder why it doesn't work the same for us.

I wish HTC will allow us to do the same too.
[HTC One X] Juanig:
I think our last chance would be to donate a phone to someone like Trip or Jcase...
[HTC One X] ExoticMe:
yes the snapdragon 600 does not require you to flash the boot.img unlike tegra 3 :mad: .

hox is a year old if they didn't crack it back then the will not achieve it now tripnraver and XMOO worked hard on it .

the one has s-off now BTW

and cheer up we will have sense 5 in the near future :D
[HTC One X] AdrianM:
The problem on the One X is the added Tegra 3 security, so we need APX mode acces.
[HTC One X] ace9988:
It'll be difficult to s-off, but not impossible as some people have managed it. Like those companies that you send your HOX too and they s-off it and send it back. That said it'll be very unlikely we will get s-off because the phone is over a year old and developers would've moved on.
[HTC One X] mr.dj26:
lets all buy the HTC ONE :D

DAMN YOU TEGRA!!!!!
[HTC One X] Sadman Khan:
I'll buy one next year when price falls....besides tegra compatibility is terrible sometimes :/

Sent from my Revolutionary Htc One X HD :D
[HTC One X] Shan89:
Lol in my country One was 700E @ start when it came out , now i can find it for average 510-520E , by the end of this month it'll be 480/490 and then it will stuck there for a while , probably untill the september or october. Which i think is not too much considering i gave for hox nearly 600E last year lol , now i wouldn't give 250E for hox :P

Anyway how much are you willing to give for the one ?
[HTC One X] Sadman Khan:
Well a month ago it was 68000 taka in our country...it should actually be 50000 right now..anyway it's 58000 right now...so i'll buy when it's in the 40000 range :P which is why, one more year :P

Sent from my Revolutionary Htc One X HD :D
[HTC One X] mr.dj26:
lol ^^

Dont wait one year then the next flagship phone will be out and you will be behind :P

I didnt buy the ONE because im really looking for a bigger screen and ill wait for the phablet from HTC:highfive:
[HTC One X] Sadman Khan:
I bought HOX last december :P last year flagships all the way xD i cant afford latest flagships lol

Sent from my Revolutionary Htc One X HD :D
[HTC One X] Shan89:
Buy used one , One in my country is atm 510 lowest brand new unpacked , used one goes for 400E which is quiet cheap , stolen one can be gotten for 350E ( which is new hox price ) , used hox goes for 300/250 E right now and brand new is 360 , while in stores HoX is around 500E while One is around 900E ( stupid pricing imho ) Anyway your best bet would be buying USED One of course look for the one that is looking exactly as brand new.
[HTC One X] nitrous²:
Everyone out there with an S-OFF'd s720e/s728e did it the official way much like how HTC service would do it= Using a signed Javacard with the correct Diag file which you can buy for 1000-1500€.

From the informations I have it's rather impossible without those...

Gesendet von meinem GT-I9300 mit Tapatalk 2
[HTC One X] DeeZZ_NuuZZ:
So we will never be able to get this f#cking s-off for our phone ? ...really sad -_- I hope I can get the one...to prevent this f#cking flashing via cmd/ fastboot....

Really no other way ? Hm :/

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] Sadman Khan:
Lol..i would have done that..but thing is, i never buy used phones :P it hurts my saiyan pride xD

Sent from my Revolutionary Htc One X HD :D
[HTC One X] athulele:
Guys, we're getting off-topic here.
[HTC One X] Thant:
Why nobody don't want to talk with Trip for try him method with the fuse hack maybe he have something to offer?
[HTC One X] mido.fayad:
I sent him pm and replied here that I can try what he need but no reply from him :(
[HTC One X] mido.fayad:
New interseting thing about trip kernel wich lead to apx mode

as alot of us know, trip kernel aosp v004 which comes with his rom 003 leads to apx mode and make all partitions read only and lead to bricking the device and it make the device identified as ENG build

i tried today to flash it again to enter apx mode and try some commands in it but after flashing it, every thing works perfect without single problem and i locked my bootloadr and unlocked it again then flashed the kernel again and flashed cwm recovery then twrp recovery and formatting all the phone and formatting system then reinstalling the rom again then wiping data again in cwm recovery

all this works without any problem and i can delete anything from the phone and reinstalling all my apps which mean that partitions isn't read-only and the device is identified as ENG Build

so now i'm looking forward the next step from trip ... what should i do and how can i use ur hack for the fuse because i can't edit it with the current kernel

also i reflashed the latest hboot 1.39 without any problem and tried to flash eng boot loader but it failed in signature verification

hope trip still interested in it and i'm saying it again ... no problems at all trip if u bricked my device

now i'm thinking that if i can get into apx mode, we will be able to do what we need because the main problem in the past was tat the whole device become red-only so we can't flash any thing throm apx mode

and here is last_kmsg in the attachment from the kernel
[HTC One X] Bloodbreed:
Can you explain how you got your device working again ???

So to be clear, you flashed your device a while ago with this asop 004 rom and after a moment you got the read only trouble like

most of us. Today or yesterday you tried reflash your device with this rom again and now everything is ok?

Did you had this rom already on your internal sd card or did you just pushed it ?

I m asking this because when i try to put a file on it via cwm as soon as i unmount sdcard file disapears immediatly.

So how did you managed to flash a new zipped rom when it s not possible to send something to device (... sending works but wont be able to find this file on the device)?

(Could you write down which commands you used in adb/fastboot please ?)

By the way it is possible to enter apx without trouble the thing is we can t change something in it without the sbk.

I tried this via fastboot but i get this error message

C:\adb>fastboot flash zip tripndroid_endeavoru-ota-eng.noeri_003.zip

sending 'zip' (212624 KB)...

OKAY [ 27.335s]

writing 'zip'...

FAILED (remote: not allowed)

finished. total time: 27.543s

C:\adb>

Also tried this via HTC RUU SCREEN but still errors

C:\adb>fastboot flash zip tripndroid_endeavoru-ota-eng.noeri_003.zip

sending 'zip' (212624 KB)...

OKAY [ 27.287s]

writing 'zip'...

(bootloader) Can not find [android-info.txt] in zipped image!

FAILED (remote: 24 parsing android-info fail)

finished. total time: 97.168s

C:\adb>fastboot flash zip firmware.zip

sending 'zip' (12876 KB)...

OKAY [ 1.665s]

writing 'zip'...

(bootloader) adopting the signature contained in this image...

FAILED (remote: 99 unknown fail)

finished. total time: 2.116s

Maybe also due to the fact that partition is read only

So i copied android info from another zip to trip 003 rom zip but then i got this error .

C:\adb>fastboot flash zip tripndroid_endeavoru-ota-eng.noeri_003.zip

sending 'zip' (212565 KB)...

OKAY [ 27.275s]

writing 'zip'...

FAILED (remote: 11 no transfered data)

finished. total time: 36.276s

It s getting boring trying and trying stuff and nothing changes, thanks HTC .....
[HTC One X] mido.fayad:
@ Bloodbreed

all what i have done is flashing it normally then i removed it from the device storgae and also deleted some files to see if they will appear again after reboot or not and aeverything remains deleted then i copied some files and no problem

no i'm trying to flash the firmwre in RUU mode and will try to disconnect the device while flashing and will see what happens
[HTC One X] Bloodbreed:
So this zipped rom was already on your device sdcard before flashing it ?

No i m not trying to deconnect just trying to flash like you.

An other question is this the right command to push file in cwm when my file is in adb folder and wish to push it to /sdcard/ so that maybe cwm would find it .

C:\adb>adb push firmware.zip sdcard

ok /sdcard/

but file is corrupted when instaling.
[HTC One X] mido.fayad:
for me i mounted the storgae from recovery normally and copied the files

now new interseting thing ..

i rebooted phone in RUU mode then disconnected now then tried to open recovery but it open only grey screen so i tried adb and it found the device

so i entered ls commeand and it showed all my files so i tried to remove everything there to see what will happen

so i entered rm -rf * and everythimg deleted even ls command as i no more can access it through adb then i rebooted my device and entered fastboot oem lock and now it say

LOCKED

And also a new option appeared in hboot menu which is ( SECURIY RESET ) and it's in grey colour

will try to take a pic for it
[HTC One X] MemAllocatoR:
interesting mate! keep doing the trial and error... the security reset seems very interesting does all of this happened with trips kernel?
[HTC One X] mido.fayad:
yes with AOSP v004 trip kernel

EDIT

Here is pic of securiy reset and when i choose it, it says ( check keycard failed )
[HTC One X] Bloodbreed:
can you upload this kernel or post link to it ?
[HTC One X] MemAllocatoR:
wait a minute, you unlocked and locked again bootloader and in the pic "locked" is with

written instead of "relocked"? kind of a breakthrough I think... correct me if I'm wrong... I'm wondering about that key card though
[HTC One X] Bloodbreed:
Should the security warning be there also under locked ?
[HTC One X] mido.fayad:
will upload it now but note that it will brick your device ;)

https://www.dropbox.com/s/q4creq13rw0in62/TripNDroid_endeavoru_3.1.10_aosp-v004.zip

note that my device is now bricked so don't flash it if u want ur device alive ;)

yes first i flashed the kernel v004 then i relocked my device and it appeared as relocked with security warning under it then flashed my firmware for hboot 1.39 nd the security warning disappeared and still relocked then i unlocked it again and flashed the kernel again as it was overwritten by the firmware then flashed twrp recovery then changed it to cwm recovery

and after that i rebooted it into RUU mode then recovery which appear grey and do adb commands then fastboot oem lock in fastboot mode and now it's locked not relocked ;)

it appears sometimes then it will disappear and no problem of it as it says locked :)

---------- Post added at 10:11 PM ---------- Previous post was at 09:46 PM ----------

And now there is no more security warning

here is pic
[HTC One X] TripNRaVeR:
The security warning is because of the ENG hack, that isnt implemented correctly so sometimes it works sometimes it doesnt. The security reset is just setting youre device S-OFF which can be done when you are identified as HTC.

Since we cant do that without the HTC card, i started working backwords with the kernel and step by step trying to see where i could get. I just cant risk another HOX going down with this S-OFF stuff, so i can try answering some questions here but thats about it.
[HTC One X] mido.fayad:
ok so now the security warning disappeared as i posted pic in the previous comment showing it .. can u provide us with the kernel with the new hacks u found and what's needed to be done ?
[HTC One X] TripNRaVeR:
There is no new kernel
[HTC One X] mido.fayad:
ok , thanks anyway for ur work
[HTC One X] teemo:
This is not completely new. You may want to look at the "original" s-off thread. See what is already done and maybe get some ideas for what to try next. Appreciate your work, but much of it is already tried :(

As I remember, this was used by some of the people with bricked devices. They were able to relock to LOCKED and could therefore use warranty for a new hox. Should be in one of Trips threads - I did not check on that now.
[HTC One X] Bloodbreed:
Mine just doesn t flash, every way I know i just get error or doesn t even change something.

Will have to wait for working apx.
[HTC One X] witek_77:
Hi. Is there a way to change from RELOCKED to LOCKED bootloader ? I can't found this. I have problem with green tinted photos. I have unbranded cid_032 with hboot 1.39. I want to send on warrantly my HOX but it is risky in Poland :) Thanks Adam.
[HTC One X] BlueSingA:
If you pay attention to the posts above you'll find that it -might- be possible by flashing the kernel mido.fayad posted the link to (IT WILL HARD BRICK YOUR DEVICE) and trying to flash a RUU or fastboot oem lock, something like that, just read up.
[HTC One X] witek_77:
ok i found this. So there is no chance to back to stock with locked and working phone. I will try to send with relocked. Thx for reply.
[HTC One X] ximonx:
As the one X uses emmc i'm going to buy a one X with broken screen on ebay and remove the emmc with a hot air rework station so it can be connected to an sd/mmc reader.

Once connected it will allow a complete dump to be saved, from there we can try to manipulate the hboot / security flag and have s-off.

Another advantage is that we will then know where the emmc balls are connected to any passives / pads, possibly allowing a juopunutbear wire trick style unlock ;)
[HTC One X] DeeZZ_NuuZZ:
really good idea hope it will work :) if we get through that s-off that would be nicer then nice :D
[HTC One X] nitrous²:
I remember someone, who had tried to do this with the radio chip. He managed to desolder the chip properly, but then we never heard of him. I hope you ain't gonna do the same ^^
[HTC One X] dilster97:
He could try.

At least he would be using a broken one X.

HTC One X (Tegra 3)

ROM: Viper X 3.6.1

KERNEL: Viper X stock

CID: HTC_001

NETWORK: O2 UK
[HTC One X] maxilick:
Great try and thread guys , lots of speculation. Long ago I accepted the fact I have to flash via pc. To date it appears the only way S-off will be achieved is if HTC release it.

Sent from...... Uranus
[HTC One X] TripNRaVeR:
Some dare devils arround who are in for some kernel flashing regarding obtaining s-off?

Even if we dont get s-off it would help in gaining knowledge on Tegra** kernels.
[HTC One X] Bloodbreed:
Yop what should i do ? Not sure if i can do something i m stuck with read only partition.
[HTC One X] mido.fayad:
I will get my device back from warranty today or tomorrow

They will change the main board again for me because it's in read-only mode then device go again into apx mode and won't go out :D

So I can test it when I get my device back :)

Hope it come today to start testing ;)
[HTC One X] :
A transistor in my phone broke, which has ****ed up the backlight so I can risk a bricking before it gets picked up by my insurance!

As long as you send me some **** to test between like, 3 and 8 today i'll be up for it!
[HTC One X] TripNRaVeR:
You have to be able to flash kernels, and have some phone acces at least adb.
[HTC One X] DeeZZ_NuuZZ:
Ok I would try if it won't brick my phone

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] supendal:
I volunteer for it. It don't care if it bricks my phone.
[HTC One X] adamnz:
I'm willing to try
[HTC One X] enigma2446:
What's the chances of bricking?

< Coming to you live from the planet One X >
[HTC One X] XeKToReX:
Got a HOX here with a smashed screen but can still adb

I'll try stuff if need be
[HTC One X] TripNRaVeR:
I'm sorry my cat died today :( so therefore no developing has being done. Will continue on this kernel tomorow.
[HTC One X] DeeZZ_NuuZZ:
oh sorry for that :( no problem mate :P use your time when you have it :)
[HTC One X] mido.fayad:
HTC service called me today and told me that their is no mainboards available now and they will order it from Taiwan so I have to wait till 29 june to get the new one and they gave me another device to use till 29

Hope my device comes fast to test the new kernel :)
[HTC One X] nitrous²:
Sounds good so far. Haven't expected that much effort after so long time =)

I hope you'll make it possible! That's what I really wish for you! Also I'd definitely come back to the HOX!

LLAP
[HTC One X] cronojay:
This will definitely will help the hox tegra phones.
[HTC One X] dilster97:
I was taking apart my HOX (this one in question) and I saw a contact pad that had the letters NV.

Made me think of NV flash.

You can look for pictures on the Internet where it is located.

HTC one X

ROM: Viper X 3.6.1 (Variant 1 CPU)

KERNEL: Viper X stock

CID: HTC_001

NETWORK: O2 UK
[HTC One X] matt95:
sounds like HW failure :D
[HTC One X] dilster97:
What?

I was taking my phone apart for the lolz.

HTC one X

ROM: Viper X 3.6.1 (Variant 1 CPU)

KERNEL: Viper X stock

CID: HTC_001

NETWORK: O2 UK
[HTC One X] matt95:
just kidding man :good:
[HTC One X] wineds:
Got a link?
[HTC One X] dilster97:
Just search the Internet for a dismantled one X and you'll see the contact pad.

HTC one X

ROM: Viper X 3.6.1 (Variant 1 CPU)

KERNEL: Viper X stock

CID: HTC_001

NETWORK: O2 UK
[HTC One X] ll_r1d0_ll:
got something interesting but not so sure that it might work or not:eek:

http://androidforums.com/droid-dna-all-things-root/685665-s-off-via-jtag.html
[HTC One X] DeeZZ_NuuZZ:
That wouldn't work for the hox be wise we have tegra and its really difficult to do such things...its for droid DNA but not hox...so please stop to post things which are for HTC phones which don't have the tegra 3....

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] ll_r1d0_ll:
i know that it was for DNA i thought maybe it might work if we do to the tegra 3 ...well thanks :)
[HTC One X] AdrianM:
Do you really think that if it would have worked, we wouldn't have known already? That post on that website is made in February.

Sent from my HTC One X
[HTC One X] ll_r1d0_ll:
my bad...didnt check the date !:eek:
[HTC One X] jonhyxda:
Hi,

How are the tests of the kernel?

Happy results?

Sorry the bad english...
[HTC One X] Whoareyou:
hey, how does this look, im having a hard time downloading the file, keeps failing...

http://pan.baidu.com/share/link?sha...m/share/link?shareid=3798187154&uk=1745301068
[HTC One X] jonhyxda:
Hi,

I've downloaded with downthemall firefox plugin.
[HTC One X] malakoid:
bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/

Aside from the vulnerability that bluebox has found (sadly for us), could this help to manage s-off?
[HTC One X] AdrianM:
Not a chance.
[HTC One X] xmoo:
Just checked all the 3 DIAG files and all 3 are the same.

5.01A-ASP

5.02A-ASP

I don't know where you can find it. The file sizes differ, the Clean S58 should be around 950kb/1mb.
[HTC One X] supendal:
Anyone else checked wschm123's diag file?
[HTC One X] HebeGuess:
All the conversations above actually just the same talks in dual languages...
[HTC One X] :
Don't worry - I don't mind. People might tell you off, that all. Thanks for your help btw. We'll get there in the end!

sent from my internet