yashsingh1/xdaforums huggingface dataset:
[HTC One X] krenze:
Sv: Obtaining HTC One X Diag File to Manage S-OFF!!

Is their any piggybank for rooting the one x? Really think that it could speed up the progress by getting a developer/team a One X or simply buying one of them Russian s-off cards.
[HTC One X] kupijaj:
Maybe it will be helpful. Someone tried freezing phone

By freezing phone is possible to hack RAM so maybe it can help you.

http://www.forbes.com/sites/andygre...nes-data-by-chilling-its-memory-in-a-freezer/
[HTC One X] feraay:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

You need a removable battery

Do you have

My one x not

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] nitrous²:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

The people whose job is to hack will know how to do this. If you're experienced enough, ideally a dev, only then give suggestions about new/other methods. Also, even I as a completely noob in things like developing or hacking engineering, know that it'll never work with a refrigerator... Anyways, please stay on topic.

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] dilster97:
http://db.tt/rViNipR0

My dropbox link for the DIAG file

HTC One X Viper X 3.3.7

XM-kernel #115

Backup: O2 XDA IIs WM 2003 SE 4.21
[HTC One X] nitrous²:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

Thanks, but its not the correct one.

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] Abaddon:
Can I help on this? got an S-Off device
[HTC One X] dilster97:
Here's where I found it.

http://xdaforums.com/showthread.php?t=1058918

HTC One X Viper X 3.3.7

XM-kernel #115

Backup: O2 XDA IIs WM 2003 SE 4.21
[HTC One X] theDroidfanatic:
This is good news for To-be HTC One users :D Since that is Qulacomm :)

Sent from my HTC One X
[HTC One X] thecoby:
Guys, I know one of HTCs managers, can I help us somehow to ask him for diag file or what should I ask him?
[HTC One X] nitrous²:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

Even if you get the diag from him, we'd still need a Javacard matching to One X' security environment (I don't know how to explain this better). A good hardware documentation about partitions would be really helpful. Like where CID is located and so on. Better wait for other answers.

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] sprogurt:
Freezing RAM isn't new, it's been around for ages, just it has now been replicated on android devices.

This is more of a data security issue and would be classed as forensic recovery as the cooler temperature makes clearing the RAM slower; no hacks here.

Definitely a nice read though
[HTC One X] FCDHBubbles:
Re: [PETITION]S-OFF for HTC One X &lt;&lt; Let's finally unleash our devices &lt;&lt; STICKY THRE

We're looking for reasonably priced (read that as really cheap) HTC Tegra devices, as well as HTC One V and HTC One S (s3 only)

This is a tweet from justin case of teamandirc maybe there are people out there with a spare HTC one x tegra...

These guys recently S-OFF HTC one xl (qualcomm) device so... You can contact them via Twitter @TeamAndIRC
[HTC One X] Alex240188:
We already know where the cid is located but the problem is changing it. They are protected partitions and so far all attempts to modify have failed
[HTC One X] dilster97:
Screenshot of diagnostic screen shows Location: LAC and CID.

Where are they actually located.

HTC One X Viper X 3.3.7

XM-kernel #115

Backup: O2 XDA IIs WM 2003 SE 4.21
[HTC One X] Alex240188:
From what I have learnt. Don't have my PC at moment so can't give exact details.

There are several partitions before the start of mmcblkp01 which are invisible once booted into android.

These contain various things such as partition layouts, cid, hboot and radio versions and the actual hboot itself.

The problem comes when changing these partitions.

If you modify the cid and flash the block back, it appears successful but upon rebooting the partition reverts back to it's original unmodified state.

From what we have gathered this is protection built into the tegra chip.

The 2 possibilities of gaining soff at present are via Java card. Or by completely rewriting mmcblk0 with modified parameters. However mmcblk0 is your entire 16/32gb storage (meaning its every piece of software on the device. Including the things that make the phone work. Not ROM related)

This is very risky as one incorrect offset would result in a hard brick not to mention that it's probably impossible to write the entire mmcblk0 without using a JTAG.

I think the best course of action is to find a software exploit which will temporarily remove the write protection of the partitions. Just like the one xl which the Qualcomm hack uses.

Its a genius hack

I have had it a few times when updating hboot versions where you get the same thing asking you to flush then reflash the bootloader. I think at this point the security on the partition is disabled and that is where they have managed to drop their modified images into the cache.

I personally believe an adaptation of this process is likely to be our best chance of success

In fact I'm going to look closer at this tonight
[HTC One X] Alex240188:
OK more testing but not really getting anywhere.

attempting to reflash my hboot to get it to fail needing flush

typically its not failing now i want it to

ok tried like 30 times but its not failing.

i guess your only going to get the need to flush manually when you are actually updating your hboot and not just reflashing the same one

that sucks

its going from bad to worse.

so flashing the firmware is not getting into the flush part like it should when updating

fastboot oem boot just locks the device up instead of booting normally

though the key has to be here somewhere im starting to have serious doubts

1. this method requires tricking rebootRUU mode into unlocking the partitions for us.

sadly it seems the only way we can trick it to leave them is unlocked is to physically update the hboot to a new version (not reflash the same one) which is bad because we cannot downgrade and if we are already on the latest then it cant be done and you can only have as many attempts as you have updated versions available

2. even once you get it unlocked, there is no way to boot directly into android from rebootRUU mode. rebooting the device will relock the partitions, fastboot continue does nothing, fastboot oem boot either does nothing or locks the device up.

so once again looks like sad faces for us international users for now. sorry to have got anyones hopes up a little
[HTC One X] nitrous²:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

"Fastboot OEM boot" command was removed by HTC within the last updates :(

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] feraay:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

Sure that u did not mean fastboot Boot boot.img ??

:(

HTC removed even more thats horror

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] Vcek:
That CID(cell id) refers to the reception towers located near your house, the location they are speaking about(customer id) is within the phone's memory.
[HTC One X] nitrous²:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

Sorry, you're right :D

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] BlueSingA:
I'm just being curious here, but aren't people that happen to have S-off on HOX able to give insight in which partition needs to be edited or ways to boot without the write protection, easier than those that don't have S-off?

(At least I'm assuming that guys with S-off have an easier time disabling/enabling the protection)
[HTC One X] miniudavid:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

Thats right. But with soff you can do what you like to your device. But I dont think that it is reproducable on son devices.. I got the HOX since release and followed all the soff threads but having an soff device didnt helped in any way. I think that nvflash is the only way of changing things on HOX without soff.

Greetz
[HTC One X] Vcek:
Yes currently the only non-exploit soft method in mind is leaking some nvflash tips from the 'inside', other than that we can pray for hardcore hackers and devs to find an exploit for the tegra and/or radio chips.
[HTC One X] nitrous²:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

Any news? I'm kinda obsessed with the fairytale of s-off. I even dreamed last night of a guy with a device that did an s-off to my HoX :D

That thing looked like a gun...nevermind.

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] Goku80:
You need to get laid me thinks. :cool::cool:
[HTC One X] nitrous²:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

Wohooo, exactly!...wait...maybe. Unfortunately, depends on what my wife thinks about that idea :D

My post sounds rather ambiguous :D

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] Goku80:
I'm playing dude
[HTC One X] thecoby:
gaaaayyyyyyyyyy! :d
[HTC One X] nitrous²:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

I got your sarcasm, but despite from it I want to say "so what"? I'm not gay, but I also don't know why saying "gay" to someone should be offensive.

So back to topic, please.

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] thecoby:
Dude, I also think as you think, it was joke. Google "gay seal meme" and you will get it. No offense. :)
[HTC One X] nitrous²:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

Sorry, my fault. Damnit!! Never understood any of Goku80's Jokes and now yours...sorry Goku80 it's really not because of you, seriously. I guess it's up to my bad english.

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] iuly_vn:
If you want to obtain S-OFF click this link- http://www.pdacenter.ru/novosti/s-off-dlja-novykh-modelejj-htc/ But maybe this is a method with J-tag. I don*t know.
[HTC One X] nitrous²:
AW: Obtaining HTC One X Diag File to Manage S-OFF!!

Jtag isn't possible atm. They use the diag and Javacard. Talked to them several times.

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] high662:
HEREs the file guys good luck!
[HTC One X] high662:
from this site

http://chomikuj.pl/spidboy1/

LOOKS LEGIT A LOT OF CONFIDETIAL FILEs
[HTC One X] Vcek:
i checked the files and they dont seem correct s-off diags(although they are for one x, not sure about the pg88)

anyways, I think those files are useless without the proper hardware.
[HTC One X] Juanig:
I´ve downloaded two diferent PJ46DIAG.zip from that site, one was inside \CID select folder and the other from \Diagnostic Program for ASP or S58i.

You can see some videos too where HTC explains how to enter diag mode with a "diagnostic card", card reader and Y cable.

There is lots of info there, I hope we could find something interesting.
[HTC One X] feraay:
The diag files need supercid read nfo

And nothing New we already have this files bro

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] maxilick:
pipe dreams folks.
[HTC One X] davitox87:
Maybe it is a pipe dream, or maybe it isn't. You shouldn't say stuff like this because it kills motivation and hope... If you have nothing useful to say, you shouldn't say anything at all. :banghead:
[HTC One X] maxilick:
Took the words right out of my mouth. HTC have or are probably planning to use similar security flag on other devices.
[HTC One X] D4rk_nVidia:
My first android device and my first device from HTC and I don't get S-OFF :D

Maybe anyone can tell us in a few months how we can get S-OFF.

I would donate him :D

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] vin4yak:
I don't know why people make such a big hush hush of it :S

One X is one of the best devices I have owned and S-ON is just a minor hiccup...

For a normal user who just wants to flash custom roms... the only extra step he has to take is flash the boot.img from his PC... I don't think that's too much?? :silly:

Yes, with S-OFF you might be able change the HTC logo and also flash firmwares of any bases(Upgrade+downgrade) but I think it's for the best that S-ON is implemented. If it wasn't there would be a large number of bricked devices out here where people would have flashed firmwares of other devices n stuff...(there are a lot of people who do that)...

Ahh well! That's what I think.. for me, it's not such a big issue to do that extra step... might be for others?!

LONG LIVE THE HOX!! <3
[HTC One X] D4rk_nVidia:
Sure the only extra step is to flash the Kernel from PC.

But it can be easier :D

Sometimes I dont want to start my PC again only to flash the Kernel.

When we have S-OFF its much better.

Example

A new Version of an AOSP ROM´s is released. We backup the Sense ROM and flash AOSP ROM.

Then you go out and see that this ROM have bugs so u cant use it well.

Backup Sense it you are done!

But you cant do that because S-ON and the Kernel
[HTC One X] Ambious:
I have a CID that doesn't have an update to JB.

That means I can't install ANY of the newer roms (anything 2013) because they all require an updated HBOOT (1.13+) and I can't update my HBOOT because of the CID.

S-OFF would mean being able to get Supid CID or just changing my CID and that would mean finally being able to USE MY DEVICE AS I INTENDED!

So yes, S-OFF is still a big deal to some of us.
[HTC One X] BlueSingA:
Not to mention having easier time porting KLP once it's out and improved chances of having the device repaired for free should something happen (yes, some countries don't have HTC repair centres, but do have accredited repair centers that often don't look at htcdev, just look at the locked/unlocked/relocked flag in bootloader). S-off pretty underrated lately.
[HTC One X] matt95:
are you sure of this?
[HTC One X] Brds7t7:
I agree that S-Off isn't such a big deal. Sure, it would be great to get it of course, but it really doesn't change a lot with regards to rooting/flashing the device. One extra step really isn't a problem.

Although I would love to get rid of that horrible BRIGHT WHITE "IN YOUR FACE" HTC splash screen and change it for a dark one.

Let's face it though, as far as I'm aware, it's extremely difficult to brick your device with S-On.
[HTC One X] matt95:
well, imo it is very important thing... i had to return the device to htc cause i wasn't able to flash a RUU (long story), with s-off everything would have been simple and great
[HTC One X] Brds7t7:
Well, in your case Matt, I see what you mean. Very frustrating if you can't get back to stock. :(
[HTC One X] dilster97:
Lol dude I bricked my s-on hox (long story)

Does that make me a rare breed of stoopid ?

HTC One X Viper X 3.5.5 (Variant 1 CPU)

Stock Viper X kernel
[HTC One X] Brds7t7:
Haha doesn't make you stupid no. I'm not saying it's impossible to brick with S-on, just a lot more difficult! :D

Sent from My Calculator!
[HTC One X] Zarboz:
Idk if these have been posted or will help at all
[HTC One X] :
I hope they do. I want to get to JB Sense but can't due to wrong CID and that makes updating hboot impossible.
[HTC One X] Zarboz:
i didnt see the CLEAN S58 string in ANY of those pj46DIAG files

but afte doing some really long talking with a few folks i know

you SHOULD be able to hex edit a CID into it and flash away but since they dont have CLEAN S58 might be pretty pointless / possibly brick your device
[HTC One X] :
I just want S-OFF, then supercid will be easy. I guess I can pay like 15$ and get it cid unlocked with one of those hardware boxes. Can't recall how they are called. Btw can't anyone get one and reverse engineer the code for cid unlock?
[HTC One X] Zarboz:
I am only familiar with JTAG and i know most JTAG boxes dont support Tegra SOC's

so you guys are stuck waiting for a software exploit or a leak of a good PJ46DIAG file

OR

if all goes well on this deal i am doing i am buying some "whitecards" from a buddy from a jtagging website to "s-off any htc phone"

he says
[HTC One X] :
Yep that's the name. And yes waiting for any sort of method either hardware or software so we aren't stuck anymore. The JTAG solution would be great. Just make sure the One X and Tegra are included in that whitecard.
[HTC One X] Zarboz:
Just hex edit the zip to fix cid to yours
[HTC One X] Shan89:
How exactlly did you manage to brick your hox ?

I've tried to brick mine but no luck , i've tryed flashing roms from other devices , mods , rebooting it while flashing roms , flashing kernels from different devices , i even tried removing USB while flashing RUU , it simply wont die, all i managed to do was f@ck up system , but after the reflash everything came back to normal. I even tried to burn it down , running stability test with +100 over volt on all freqs + 1600 mhz quad locking it , the worst that happend was it rebooteed then booted up again and sometimes rebooted again in a row after reaching around 60c of the battery and probably over 100c cpu , it's literally impossible to brick it , so i'm CURIOUS HOW DID YOU DO IT ! lol :P?
[HTC One X] Vcek:
Flash engineering build and it will be bricked on reboot
[HTC One X] Bloodbreed:
I got mine bricked after flashing a rom kernel from tripndroid, seems it changed some of the partitions permission, and those are just on read only.Since, so far i read in this forum, we need s-off and apx mode working to change partition permissions, how the hell did this rom/kernel managed to change those settings .....
[HTC One X] feraay:
If you change the cids via hex editor the file will loose the signature

And cid is not the only thing it checks on flash

Mid mainvers firmvers i belive radio too

Read the hole hex of a diag and and hboot the files are full of checks its not only 1 cid checking

Someone knows OEM 42 und OEM 74 ??

gencheckpt ??

After that it boots recovery.TP.NFC.LCD

immediately follows

MSG device cid is not super cid

tp.IMG in the second line

S3202

The TP.IMG from debugging Rom with MFG hboot

May the secureflags???

A Connection of recovery. TP.NFC.LCD

And the tp.img ??
[HTC One X] Vcek:
It seems that many independent repair centers have obtained the java cards required, i think they are able to soff if you can communicate properly
[HTC One X] dilster97:
Got a buddy of mine to flash an engineering hboot.

My phone bricked on reboot, but it worked for his and he has s-off.

He later sold the phone.

HTC One X (Tegra 3)

ROM: Viper X 3.6.1

KERNEL: Viper X stock

CID: HTC_001

NETWORK: O2 UK
[HTC One X] feraay:
A eng hboot does not mean soff

To flash a eng HBOOT does not automatically soff your device....but you are able to write secureflags

But the latest eng hboot i know is 0.03.00 and without supercid and a

equally high or lower Main Version

Cant belive your little story .....sry

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] dilster97:
I think my buddy had s-off originally and then he flashed the engieering hboot.

HTC One X (Tegra 3)

ROM: Viper X 3.6.1

KERNEL: Viper X stock

CID: HTC_001

NETWORK: O2 UK
[HTC One X] feraay:
True

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] deathgame:
In talk with a dev who can help us to get s-off ..

BTW isnt it working ? http://www.androidpolice.com/2013/0...e-htc-one-xl-and-droid-dnaheres-how-to-do-it/
[HTC One X] athulele:
That's for the Dual Core HOXL and not the Quad Core HOX.
[HTC One X] Vcek:
Thinking out of the box, isn't it possible to "create" a software solution to crack the security? like most other phones are SOFFed from within the ROM.

The fact that Trip's engineering build kernel was able to change the R/W permissions and brick some devices still gives me hope for a software solution, although it would require SOFF to test(who would want to test bricking their phone?)

You know ... there is a huge bounty for SOFF
[HTC One X] Bloodbreed:
I ve got an one x for testing but again im stuck with r/w permissions, from what i see is it no possible to emulate this y cable host file thing via pc so that when we enter booloader device finds the nbh file and rewrite what ever is needed ? Again i willing to try anything since the phone is nothing more than a dustcatcher, .... saddly.
[HTC One X] Vcek:
have you tryed reflashing the firmware.zip ?

I heard some people got their phones back to *LOCKED* miraculously which entitled them for free repair
[HTC One X] Bloodbreed:
Thx for the info.

Nope, where can i find it , didn t found it in this thread.
[HTC One X] Vcek:
http://xdaforums.com/showthread.php?t=1957376
[HTC One X] Bloodbreed:
Tried to flash zip.

Was worth a try but didn t lock bootloader device stays unlocked.

thx anyway
[HTC One X] BlueSingA:
Just keep trying or try to interrupt flashing the zip at certain point (I don't know which point, there's some reports about this, search may help).
[HTC One X] Bloodbreed:
From what i know from tegra devices, it is needed to get access to apx in order to change anything on device but our apx is locked with sbk (also the same on different tegra devices).

Now there is also a protection from HTC the s-off thing which could be s-offed with nbh file.

What is the difference between both ? What are those protection blocking user from ?
[HTC One X] Vcek:
The first method : writing the partitions directly onto flash memory with nvflash commands, flashing a new bootloader should be already s-off(or from s-off phone), requires sbk (for Asus transformer a workaround was found)

the second method: s-off the official way, flashing nbh/nb0 diagnostic software, which doesn't work, because the bootloader prevents it from flashing by checking if the device is already SOFF (CID and PID check, they must be 111111 and pj46*****), this check can be neglected if you have the Official HTC java/white card or whatever htc repair centers have, this is connected through usb(java) or through the sim slot(white card).
[HTC One X] MrT69:
I'm still thinking about to do the "hard-brick" on the HOX to S-OFF but I don't know what to do after this.

I remember to the first HTC Sensation S-OFF option.

When you have the firmware.zip for the HOX you can flash this with the Wizard and you can see that the hboot will be written to the device if it is the same or an higher Version.

If you unplug the batterie during the hboot flash this might kill the hboot. From my point of view this fact will also cause that the fuse is removed because this will be installed during the hboot is loaded.

If this is true than the nvflash is available without write protection because this will be also initiated during the hboot start.

I don't know if this all is right but I hope and based of all facts around nvflash, hboot and fuse it must be true.

At the moment I still have the problem what to do after killing the hboot.

Does anyone have more experiance about nvflash and restore the hboot?

I will do this with my device but currently I have no clue what is required to restore the hboot via nvflash.
[HTC One X] feraay:
You mean if you Brooke your hboot by Bad flashing you will not need your sbk to flash it in nvflash ???

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] Vcek:
I contacted my local phone repair shop and he said he can soff for 75AED ($20). I think he will use the white card method.

I will post any updates, it may take time cuz I'm during examination week and I don't have a car(around 15min drive)

Edit: if you attempt to pull the battery during flash you might end up with a hard brick, otherwise the phone will stay in ruu mode until you flash a successful hboot. Also flashing stuff in nvflash will probably require sbk, so unless your phone is not already soft bricked, I don't recommend it.
[HTC One X] Bloodbreed:
There must be another way to flash in apx, because after i flashed trip's rom anything was good until i flashed older trip kernel and if i m not wrong i also used trip older sense kernel and flashed it with his asop v.003 rom.

So my read only partition occurred without removing battery or wrong flashing hboot.

From what i understood this has nothing to do with htc s-off protection but with tegra apx mode.

Then yes in some circumstances were able to change stuff in apx without using sbk.

One question how did the guys managed to get asus tegra 3 pad sbk ?
[HTC One X] Vcek:
I think this was done using "wheelie" which exploited something : http://xdaforums.com/showthread.php?t=1927818
[HTC One X] feraay:
No wheelie is just for starting apx mode