yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
OK that is real qhusb stuff. Get a .hex and .mbn file for our device and it could be extremely useful. Problem is getting them....
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
Someone look at this please. http://xdaforums.com/showthread.php?p=32888705

New exploit. On a business call so can't play with it or even examine what its doing.

Might be exclusive to moto devices :/
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Its a Motorola specific exploit.

---------- Post added at 03:58 PM ---------- Previous post was at 03:42 PM ----------

I must've clicked on wrong link. Dexter's unbrickable sensation method uses eMMC recovery mode as I suspected, NOT qhusbdl mode.......
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
Uh, so what about that wrong link you clicked on? haha.
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
Can we not use a hex editor to look at the signature on a RUU and put that into our modified RUU with SU on it? Sure this has already been asked but I don't fully understand how the signatures work.
[AT&T, Rogers HTC One X, Telstra One XL] earhog:
Signatures are encrypted... We won't ever be able to get it
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
Ya but it has to decrypted at somepoint right?
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
We can not crack the signature in any way.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
I get that the RUU's are encrypted, but is it a specific file within the RUU that holds the encryption or the whole thing?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
They aren't encrypted, they are signed. We cannot do anything with this.
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Yes, the difference between encryption and a signature is important. Encryption is used to stop a person/computer from being able to read your files in plain text (unencrypted). A signature is used to make sure a file has not been tampered with in any way, and is exactly in the state it was when the person who signed the package/document sent it.

In android, we can open up RUU's and other files and look at them no problem. If it was encrypted, we would open the file and see nothing but nonsense (crazy characters, and other odd symbols). If we try to flash a file that has SU put in by someone who is NOT the person who signed it on a bootloader that checks and expects a certain signature, since the file has been tampered with, it will not accept the tampered file. If the bootloader accepted an XDA signature for example, we would be able to sign files with our key and everything would be fine, as long as the bootloader was programmed to accept an XDA key.

Now that being said, we CANNOT break the signature (or even if it was encrypted we couldn't break that either) since the signature is a long one and the companies have their own algorithms. It would literally take decades using a super computer to break it, considering you have to try each and every single combination of words, symbols, and letters in the english (and even other) language(s).

EDIT:

I have read the last pages and what are you guys talking about? This WON'T be easy. How are you going to convince the phone to accept our spoofed address over AT&T's? What happens when our phones see 2 of the same address? Oh and just "sniff the traffic", uh, no. You can't sniff mobile traffic on your 1337oMfGb4CkTr4Ck computer. Someone needs a wireless GSM traffic sniffing device. That *s*hi*t is hard to do and you need a rooted device to easily do it on android itself.

If someone who is stock rooted can go here https://sites.google.com/site/androidarts/packet-sniffer and then try to OTA update, we could see where it connects to and the goodies. Then we could go from there.

Oh and you need to use wifi and then try to OTA update, the app doesn't do mobile traffic.
[AT&T, Rogers HTC One X, Telstra One XL] ck4794:
so for those of us who are non dev's, you can't root because the boot loader wants a certain signature, and you can't change the boot loader because you need root... so we're in the middle of a catch 22...

---------- Post added at 07:15 PM ---------- Previous post was at 07:13 PM ----------

and to try and replace the whole system of checks and balances in it's entirety is beyond the average civilian's capability, and would most likely brick the phone?
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
or we could try it from another device on the same network using this assumption being you already have the pre-reqs
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
For the catch 22, yes, that's exactly right.

As for bricking the phone, with the bootloader locked, there's not much harm you can do unless you're trying to short out the phone on purpose, opening the back and pulling the battery, things of that nature. But without root, there's nothing software wise that I know of that can be done to softbrick or hardbrick.

---------- Post added at 09:21 PM ---------- Previous post was at 09:19 PM ----------

It needs to be rooted for that to work, and that's what I was saying in my post. Someone that has a rooted device to use some sort of packet sniffer to see where the phone connects to the OTA update.
[AT&T, Rogers HTC One X, Telstra One XL] ck4794:
then how hard would it be to go a step above and replace everything? i get that it would take longer and be more complicated but is it possible? basically erase everything on the phone, and i mean everything, and substitute it with the system from a one x on 1.85? as opposed to trying to do an ota or cracking the boot loader etc...
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
I don't know, ask whoever put the idea up. In order to start hex editing, you need superuser privileges for it to be saved. No idea how that would work, if it even could.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
take note of the "the assumption being you already have the pre-reqs"

surely its not that hard for people to figure out the basic sh!t like comprehending the requirements to run the program before stating something that had initially been said in an attempt to belittle them, anyone would gather that information by looking at the link rather than being told stuff they already know.

surely there has to be another method of pushing files across at a pre-bootloader level, nvidia has NVflash, whats not to say qualcomm has something similar
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Okay, so what was the point? Any method to packet sniff on android need root. If someone on rooted stock 1.86 (or whatever it is) could install one of the many apps, we could see the addresses needed to try and spoof an OTA update. Now everyone don't get your hopes up, chances are it won't work, but it's an option (a slim chance).
[AT&T, Rogers HTC One X, Telstra One XL] earhog:
Are you telling me that signatures don't use any form of encryption??? I have to disagree with that one
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Never said that, they are hashed I believe.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Doesn't matter.
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Okay.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Can't erase anything.

Write protection.

Only time there is no write protection is in qhusb mode, which has been attempted in the s-off thread.

(phones aren't like computers; everything is locked down)

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] twistedddx:
Ruu and ota are not encrypted they are signed. The signature is unique to the file it is signing, you can't use the signature on any file other than the exact file it came from.

The ota can be downloaded over WiFi and therefore you could sniff that traffic on your own network.

If the download is a simple standard file download request it would be easy to redirect the HTC.com to your own network and files on a decent router.

Why don't you Americans stuck with no root give it a shot and see what happens?

My hunch is that the signature checking would be done when writing the file to cache and maybe not in recovery.

If you redirect HTC.com and switch the file, signature check will fail and the phone won't write it to cache.

It doesn't need to check the signature in recovery as you have no way to get an unsigned zip to cache anyways.
[AT&T, Rogers HTC One X, Telstra One XL] iceman99393:
Atrix hd gained root today. Could that exploit work here?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
No and it was already discussed like one page back.....
[AT&T, Rogers HTC One X, Telstra One XL] NJGSII:
Linking to it would be nice.

http://xdaforums.com/showthread.php?t=1940594

If its the same one as earlier, it's specific for moto only.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
and rather pointless... hey look the one VX came out which is essentially (correct me if I am wrong but dont be a c*** about it) the same phone but .2" smaller and 8gb emmc rather than 16gb for you or 32gb for me.

chances are if that gets root this will too and vice versa, I will test the OTA spoof when I get home from work
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Did anyone else get a chance to try the otg dongle idea out
[AT&T, Rogers HTC One X, Telstra One XL] joho5:
This thread was active, and then all of a sudden nothing.

Is this the calm before the storm?
[AT&T, Rogers HTC One X, Telstra One XL] Zoide_:
Did anyone look further into the QHSUSB thread for the HTC Sensation? (http://xdaforums.com/showthread.php?t=1522351)
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Probably not, unfortunately.

As beaups said, it is really emmc mode in that thread.
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
I got ninja'd
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
What was the OTG dongle idea?
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Flashing an update.zip through 3e recovery
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Oh, I doubt anyone tried that. Did you??

Really, all ota zip testing should be done by someone who's already rooted. IF rooted user can get a customized update.zip to flash by properly placing the command in /cache (needs root) then we could procede with how to flash via 3e or spoofing OTA process.
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Does recovery care about root privileges?
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
I think the OTA option is the best bet. But we need to at least find out if the ota updates are signed or not so we might as well try it and find out to see if we are just chasing ghosts or not.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
No, but a rooted use could easily test the theory before we go trying to reverse engineer att's update servers.....

---------- Post added at 08:00 PM ---------- Previous post was at 08:00 PM ----------
[AT&T, Rogers HTC One X, Telstra One XL] TheEmpyre:
There was a fresh update to all the ATT bloat ware today idk if that is useful at all. Probably not but just thought I would see if that may Introduce a new exploit in an app
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
surely there has to be some method of low level write to the cache partition,has anyone looked into how the RUUs push their payload across to the device?

---------- Post added at 10:08 AM ---------- Previous post was at 10:06 AM ----------

it probably patched any known pre-existing exploits
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
ninja'd

though i have to agree that, as of right now, spoofing an OTA s probably our best bet at root.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Why do you say "surely"? If there was a low level method to write to cache, there "surely" would be a low level method to write to /system/xbin.

Actually, there is such a method. Root.

RUU has been discussed here over and over again, and again, and over again, and again. And again.

---------- Post added at 08:17 PM ---------- Previous post was at 08:16 PM ----------

Let's be real. Spoofing an OTA is a longshot. But it's a longshot we haven't yet ruled out.
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
No one has tested it. We need to see if the otas are signed or not. I believe someone said earlier you can download past otas off of the htc website
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
You can't install them. The only way to test is with root or reverse the whole ota download process.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Somebody wanna run 1.85, root, download the ota then pull /cache and any child directories in it would be super good. I don't have time atm
[AT&T, Rogers HTC One X, Telstra One XL] scrappy1959:
Member djrbliss just found an exploit for the ATT Motorola Atrix HD, if anyone knows him or is capable of looking at the way he did the root it might help on our quest to get this phone rooted. The Atrix HD was one of these phones that was impossible to root. Keeping my fingers crossed....
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
This has been covered several times already. Its a moto specific exploit. That said, he is a security genius and could root the HOX for sure, but not with that exploit.
[AT&T, Rogers HTC One X, Telstra One XL] scrappy1959:
Is there a way we could ask him to work on this. I did post on that forum asking for his help.
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
Get the link to the bounty thread to djbliss STAT
[AT&T, Rogers HTC One X, Telstra One XL] nickeedoo:
Anybody PM it to him yet? Don't want to spam him, but if I'm the first then I'll go ahead and send it.
[AT&T, Rogers HTC One X, Telstra One XL] TonyBoes:
Just wanted to note that I attempted the OTG (not rooted) restore last night and received the same invalid op message as stated previously. Disk activity confirms that something was going on, but it apparently failed to mount.
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
What format does the usb drive need to be, fat32 right?
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
FAT32, EXT3, EXT4 are generally the main ones used so it shouldnt overly matter which one you are using (just use fat32 if you are unsure)
[AT&T, Rogers HTC One X, Telstra One XL] TonyBoes:
I'll try various others tonight if I get a chance and it is helpful. No promises.
[AT&T, Rogers HTC One X, Telstra One XL] MeetShawn:
Just checked out the AT&T OTA update process with wireshark.

The connection was done with TLS, so I can't tell you what it says. I'll try decrypting it but no guarantee. If anyone else thinks they can decrypt the SSL data I'll send you the capture data.

Interestingly the phone wasn't talking to AT&T servers but rather Google servers...
[AT&T, Rogers HTC One X, Telstra One XL] ECEXCURSION:
The plot thickens!

Sent from my HTC One XL
[AT&T, Rogers HTC One X, Telstra One XL] itzsnookums:
LOL^^^ I wonder why Google servers are distributing the update?? makes me wonder if they make Android give it to the OEM's they do their "thing" with the software and then give it to Google to check/distribute, kinda puts another step to the update process don't it????
[AT&T, Rogers HTC One X, Telstra One XL] MeetShawn:
Let's not jump to conclusions here... For all we know AT&T just has a text file with the current firmware version and a link to the update on Google docs.

Does anyone know if you can decompile the app AT&T uses to handle their OTA updates? It's obviously a custom addition and if they made it in Java I would imagine you could at least somewhat convert it back to code. It would be useful to know what it does when there is an update available. i.e. messages being sent to the update server, responses to messages from the server, and update staging

I'm curious how dumb the app is. Perhaps it doesn't care what certificate the server feeds it and will accept any TLS connection. Maybe it doesn't even force TLS. In that case it would be easy to spoof our own OTA server.

Another big question we have to yet to answer is whether updates are signed.
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
As I've been saying we need to see if they are signed or not like what ^^^^he^^^^ said. Cause if it is, we are wasting time.
[AT&T, Rogers HTC One X, Telstra One XL] twistedddx:
http://fotadl.htc.com/OTA_EVITA_UL_...2.7-1.85.502.3_R2_releasenin45grzkfswb95v.zip

I have said before in this thread that OTA's are signed.

You can check the last AT&T OTA zip.

It claims in its comment that it is "signed by SignAPK".

Also at the end of the zip you can see a HTC certificate.

I really would have thought the download would be pulled from fotadl.htc.com when doing wifi downloads. fotadl.htc.com has all updates for all regions.

OTA over GSM network might make use of the carriers hosting and distribution, I wouldn't bother trying to tackle it via that, the wifi download path must be accessible from any carrier.

I would think you could just write up an iptable rule that redirects

http://fotadl.htc.com/OTA_EVITA_UL_...2.7-1.85.502.3_R2_releasenin45grzkfswb95v.zip

to your own hosted file.

Ofcourse the TLS connection might complicate things.
[AT&T, Rogers HTC One X, Telstra One XL] MeetShawn:
You're probably right about HTC hosting the OTA files. I have a feeling the packets I picked up just coincidentally showed up at the same time I clicked the update button and are totally unrelated. Sometimes the update button disables when have I airplane mode on and sometimes it doesn't. That suggests to me it will only check via mobile network. The only way I can think of to deal with that is using a femtocell.

I guess there's not too much hope for this method given that they are in fact signed. I would imagine if they're signed they're checked just like any stock rom flash.

Edit: It does only check over the mobile network.
[AT&T, Rogers HTC One X, Telstra One XL] maddie01:
Hey all, I have the 2.20 as well. Just curious...if the Jelly Bean update is supposedly coming soon would this change the firmware for enough time for us to unlock boot and root or will that be patched to prevent block as well?

Sent from my HTC One X using Xparent SkyBlue Tapatalk 2
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
I would expect it keep all known issues patched, however it may introduce some new exploits, but don't hold your breath
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
So I just tried rebooting into recovery, and the 3 soft keys at the bottom started flashing. It went away after i held down power, but kind of creeped me out. Anyone have an idea of what/why its like that?
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
Not sure. But this is a root thread, not a phone symptoms thread. Please try and stay on topic.
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
I'm well aware, I was asking if it was a possible way to exploit the phone. I just forgot to finish my sentence
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
When you hold the power for 10+ seconds they flash and the phone reboots

Since you can't battery pull this is the only way to force a reboot
[AT&T, Rogers HTC One X, Telstra One XL] alejobog:
to seek support from HTC and this is what he answered

//

Dear alejo andres,

Thank you for contacting us today. HTC is committed to assisting customers in unlocking bootloaders for HTC devices. However, certain models may not be unlockable due to operator restrictions. Please refer to our list of supported devices to see if your device is eligible for unlocking the bootloader.

If you ever have any other questions or concerns in the future Alejo, always feel free to contact us via e-mail or phone. Our phone support department can be reached at 1-866-449-8358 between the hours of 6 A.M. and 1 A.M. EST, seven days a week.

Let me know if I have successfully answered your question, please click here to complete this.

To send a reply to this message, please click here.

Sincerely,

Carl

HTC

Want to see what others are saying? Have a question to ask other HTC fans?

Become a fan of HTC facebook.com/htc

Follow us on Twitter twitter.com/htc

Subscribe to our YouTube Channel youtube.com/htc

Explore our development resources developer.htc.com

Please visit us at htc.com if you have any questions or need further assistance.

//
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
This is a common answer, nothing.new.

They read from a script
[AT&T, Rogers HTC One X, Telstra One XL] maddie01:
Hi all,

Just got a similar message back from HTC. I will post later as they elaborated a little bit more but answer was the same, "keep.checking back"...., etc....the more of us that hit them with requests the better ...also going to leave a few choice messages for ATT since they are the money stuffed entity that is truly behind this....keep the faith...

Sent from my HTC One X using Xparent SkyBlue Tapatalk 2
[AT&T, Rogers HTC One X, Telstra One XL] h1m:
When I messaged them I got the same response. I even tried talking to ATT and the guy told me he has the same phone and is also waiting to let it be unlocked. He had no idea when though. He said maybe when X+ comes out but that just sounded like a guess.
[AT&T, Rogers HTC One X, Telstra One XL] abhipati:
Let's get back to more exploiting root ideas please
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
What about a zip bomb, would that trigger anything other than a system crash
[AT&T, Rogers HTC One X, Telstra One XL] cafonez:
I may be going off the deep end here as I am not a programer or understand all aspects of cell phone technology, with this being said, I have an out of the box idea and its ok if you shoot it down and tell me flat out it wont work I might not know what the heck im talking about but here goes ..

Seeing that AT&T can send OTA updates to update the phone I am sure there might be checks in place for the phone firmware to verify the keys vs the update so few ideas ..

1) Spoof the AT&T update on the home network and block the actual AT&T update address.

-> ex : att.com/update/etc/check/ver -> block this via router and or redirect to localhost/att.com/update/etc/check/ver

*turn off mobile data, wifi only. forcing the phone to check against your own local network and tricking it into thinking its the carriers official update link. I dont know what the actual link is, havent tried to connect for an update and view the router log, just an example idea.

2) Modify the build to spoof 2.20 or 2.21, when in actuality its downgrading to 1.85 etc. Maybe tripping up the S Flag so it can be writable as root, if it sees it as an official carrier update? Would it be possible to recompile the build with a spoof?

3) or maybe bloat the package to be the same exact size, spoof the firmware, using the 2.20 build keys (if indeed it uses keys)?

4) if this does indeed get rooted whether 2.20 is eventually broken or a forced downgrade method is found, block atts official update to spoof it to a dev site update or let the user choose a local network update link or option to go back to carriers update if they dare choose to do so.

sorry if this has been thought of before I know theres 138 pages for this think tank and many people want this bad, prolly as bad as I do.

:eek: just bought my htc one x last week. ::bangs head::
[AT&T, Rogers HTC One X, Telstra One XL] :
A few pages back, one guy said it checks over mobile data. After that it downloads on WiFi.

I don't believe you can downgrade without s-off. The point of the fake ota is just to have su in the xbin folder

You also can't modify a signed update. Any change will break the signature and the boot loader will reject. So putting su in a signed package, even if the file size remains the same, will corrupt the signature.
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Is there any way we can create a memory overflow and inject code? As in something that hasn't been tried yet
[AT&T, Rogers HTC One X, Telstra One XL] wdkingery:
Why do you say that?
[AT&T, Rogers HTC One X, Telstra One XL] Skizzy034:
Isn't the wildfire s an old low-end phone? I'm surprised they're still working on it.