yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
doesn't have to be either of those as long as we can re-create the scheme it has after we break it
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
You cant just mount the partitions in linux...
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
for people who have experience modifying hex values in the past it is realistic, however if you are a n00b to this then dont attempt hex value edits unless you are still in warranty (in which case if it has no physical damage claim warranty as you may f*** up)
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
Wouldn't say its a dead end yet, but so far I haven't been able to get it to mount the drive, let alone flash something.
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
lol the most hex editing experience I have is modding xbox games a while back. I'm not messing with my phone until necessary and safe. Good to know it's another option we have though.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Its not realistic. Regardless youd need root to do ANY of that.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Disassembly

http://db.tt/SEyYD60W

Qshusb_dload mode

http://db.tt/mzdBmaIu

Evita(S-On) full Dump

http://db.tt/Yr5IvoYL

Evita(S-Off) full Dump

http://db.tt/TVIne5Yd

Mmcblk0p12-Hboot, wp itself

Power on WP

(protected by Sbl2, which is verified by Sbl1)

Mmcblk0p1, mmcblk0p2, mmcblk0p3

Security flag- mmcblk0p3 x00008400

Free hex editor (HxD)

http://hxd.m.en.softonic.com/

Here's your base information, hex edit away
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
May I re-propose my previous idea of fooling the update program into downloading a modified update (like by modding your router's DNS to redirect the updater)?

Can someone with knowledge of networking chime in on this?
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
I may not know too much about all of this, but I DO know that you can't flash tampered files, like an update that contains SU. It would need to be signed properly.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
It's not a horrible idea. Issue would be understanding the communication protocols with the update server and whether or not a key exchange takes place. Then, after that, whether or not the update itself is signed.
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Couldn't you use a packet sniffer to see how it communicates with the update server
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
We don't know for sure how OTA updates are authenticated.
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Ah, I was thinking about ROMS and RUU's then. Why wouldn't OTA Updates be signed? Unless when you choose to download the update, the phone logs into an AT&T server and then downloads the update? Like fetching packages from repos or an FTP.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
you could, yes.

---------- Post added at 08:59 PM ---------- Previous post was at 08:58 PM ----------

We just don't know for sure. The OTAs are flashed via recovery whereas hboot handles the RUU/rom.zip updates. It "probably" is signed, but I can't say 100%.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
From a bunch of pages back:

If stock recovery doesn't check the signature, then we just need to figure out how to get it to flash a modded ota.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
So far it seems to only mount the /cache partition, which we need root to access, and as for OTG I am working on it but its not looking good. It seems they purposefully disabled flashing from any other directory...
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
DNS spoof your router to whatever your phone looks for the OTAs to then build your own OTA which has su, it may work but I wouldnt hold my breath for it to work... you'll probably need a webserver for it though (might be possible with some OTA services out there)
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
You wouldn't need to do anything to your router, just buy a domain and set up the dns there. Of course, I have no idea if this is legal or not (most likely not legal) and you might get shut down. That's not so much a problem though. It would be really cool if we could push our own updates, but I think it the OTA updates are signed (most likely).
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Or redirect back to a local address.

But before we talk about where to host the spoofed ota, we need to figure out whether it is possible to spoof an ota.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Actually you probably couldn't do that... Unless you want to buy the domain from at&t
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
its probably a certificate signed by at&t, you may be able to get your hands on it if you escalate a complaint enough times that you are "unable to receive an OTA"
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
At this point, I'm fairly sure the ota's themselves aren't signed, but are directed by the command put in a /cache/recovery dir. If you take a Rom.zip and try to add something to the compressed file, you then get the archive corrupted error, that's the signature being broken. If you take a ota.zip you can freely add and take away from it without it ever becoming corrupted. That's why Im pretty sure it's not signed. It doesn't look hard to create a command file either and you can get the cmd format from the aosp android recovery source code. So, I'm not big into networking.....but if you guys can get the /recovery directory created in /cache directory and get a file of any type in there, I'll make the busybox/su ota and the command file for you guys to push

---------- Post added at 03:04 AM ---------- Previous post was at 03:00 AM ----------

Other thing, anybody on stock rooted 1.85 dl the ota, pull the whole /cache directory......then delete the ota off the phone....zip it, upload it
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
and now we are at the stage where we ask if anyone has a link to the OTA.zip so we can rebuild it
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Well that would be the last step. First step is setting up an http server on your PC and learn how to emulate atts ota server protocol. Only after all of that is figured out will an ota.zip be useful.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I'll upload in a bit.....dinner time
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
The hardest part will probably be that.

Pretty sure there will be some kind of authentication that will have to be cracked.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Perhaps. Who is going to work on it?
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Someone will have to have a router that is capable of monitoring the traffic to the update servers to figure out where to start looking.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Or you could set up a proxy server on a pc in your network, then use that to sniff the traffic
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
I can have a web server set up in 12hrs, we could probably try a full blown approach and have the zips set up so they will work on any carrier if that helps (make sure we cut hboot out of the zip cause its a POS)
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
You could use a FTP server right? I know there are free ftp hosts out there.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Its not an ftp server.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
The update servers probably aren't a simple ftp.

Edit: ninja'd :(

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
I was thinking something a bit like "here is this website, go to it to get your rooted OTA" and then we could possibly push custom roms in the same way
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
I highly doubt it would work that way...
[AT&T, Rogers HTC One X, Telstra One XL] randong:
Has anyone thought about some if the newer software versions? I don't know if it's been discussed just throwing that out there...and also viper Rom sends otas out can that some how be useful to setting up the ota portion of yalls new idea?
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
I think he means have the DNS redirection go to a server with a fake OTA.

Viper ROM's OTAs aren't from AT&T.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
The update app checks a specific address. There's no changing that.
[AT&T, Rogers HTC One X, Telstra One XL] randong:
I know that but they have figured put a way to push a ota is what I'm saying
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
You could spoof the dns, that's not the issue. I think all of this is heresay until someone finds out where it looks for otas, and then the hurdle of sorting out the encryption
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
Yes and we need to figure out the address, so we can force the router to redirect the ota app to the custom domain with the custom Rom on it. The app will think it's going to the att servers but it will actually be going through the custom domain
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Its not heresay as much as there's a lot of unknowns. I'll concede its a long shot.

It doesn't help that everyone is getting ahead of themselves.

Step 1. Sniff packets, log,etc communication from phone to ATT servers to see what's exchanged during an ota check. Nothing else matters until that is done.
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Agreed
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
There is a program called Cain and Abel, it can monitor internet traffic, could help to see where/how it connects possibly.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
point it to an internal server which is named the same as AT&T's one, surely a VPN has priority over AT&T in terms of where it looks
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
Also, it has a WiFi redirect too I'm pretty sure. Been a while since I've used it, but I think it does. Idk if that would help or not.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
It looks for a specific address. You can't change where the update program looks.

You CAN change your router's DNS settings to redirect it to somewhere else.

But all of this is irrelevant until we actually figure out if this has any plausibility.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I would think connecting to the internet via internet pass through on a PC with a hosts file for the update address pointing back to localhost and then a server running on the same PC listening on the appropriate port would be the step AFTER we figure out what the hell we are doing. :). This has been done on other phones (iPhone, lg phones, etc).

And yes that's a nasty run on sentence
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
In a nutshell:

There are plenty of ways to redirect internet traffic.

But first, we have to figure out how to fake an AT&T update.
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
So how are everyone's network skills. I could probably do it, just don't have the time with 2 jobs and a family
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
I was thinking web-based rooting like apple products had with jailbreakme.com, I guess it could be done with the OTA
[AT&T, Rogers HTC One X, Telstra One XL] ECEXCURSION:
I'm a bit of a security novice, but it does sound to me that it would be really easy to see what's going on (not saying I can do it...) Start up wireshark on a linux pc connected to your wireless network. Start monitoring the packets being sent to the phone and run the update. That will give you a log of all the data, protocols, handshakes etc that are being done. I've used the program a few times for various classes and it really is helpful for debugging your network.

So... Know anyone that's a hacker? :D:beer:

Sent from my HTC One XL
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
define hacker... I use backtrack and blackbuntu on an almost daily basis if that counts for anything, however I am guessing we are after capturing packets from the whole link between the OTA server and the phone, one with 2.XX wont do for the update
[AT&T, Rogers HTC One X, Telstra One XL] ECEXCURSION:
Well... Anyone who uses backtrack almost daily. :P

I'd do it but I'm a little short on time and expertise with regards to reading the logs from wireshark.

But it sounds feasible. Assuming the ota is pushed out over WiFi you can at least see it when it's updating.

Sent from my HTC One XL
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
That would be a software exploit...

Which we haven't made much headway on so far.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
I meant in terms of basing the OTA with DNS/proxy settings on a web server for easier access, so we just go to the website for the rooted ota which gets pushed to our device
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Pretty sure DNS doesn't work like that.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
pretty sure web based proxy does
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
That would involve more than simply visiting a website.

But anyway, all of this is irrelevant at this stage.

Sent from my HTC Rezound

(oh and having the OTA updater go through a proxy would require you to change your system proxy settings, which probably needs root. But once again, still irrelevant at this stage.)
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
I guess we leave the idea of web-based OTA updates for now, however the concept was to use the website itself as a proxy (an example would be anything kids refer to as proxies to get past censorship in schools) then host the OTA from an internal part of that site (I know how to do it, if that doesnt seem easy to comprehend then I will leave it at what its at)
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
*#*#CHECKIN#*#* , what would that check for updates as opposed to Settings»About»Software updates?

Would it be easier to find the server from there?

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] Zoide_:
Can't you change the proxy/DNS servers simply by going to the Wifi settings and modifying the current connection? I do it all the time so that I can access the US version of Netflix from Costa Rica.

BTW, I live in Costa Rica and I use a different carrier (unlocked SIM). It looks like it can check for AT&T updates just fine via Wifi.

---------- Post added at 01:11 AM ---------- Previous post was at 01:08 AM ----------

Has anyone looked at Project Cheesecake? It's used in Motorola devices to check the AT&T development servers for pre-release OTA updates.
[AT&T, Rogers HTC One X, Telstra One XL] timdorr:
Guys, you're barking up the wrong tree.

Even if you're able to spoof and provide your own OTA update file, the thing is still signed. You would need to have HTC's signing certificate to create a signed OTA file that the bootloader would accept.

All you're going to get with spoofing is an error message/icon from the bootloader and no update.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
Proof or STFU&GTFO

RUUs require signing, OTAs are carrier specific meaning no signing as that may break a lot of things.. the same thing will happen with exchange if you try to replace a trusted expired certificate with a self signing one, it wont work and there will be breaks
[AT&T, Rogers HTC One X, Telstra One XL] Shryvone21:
Hate to say it but I think we should test this...may seem stupid at first but don't go against his hypothesis. Lets see what this project(or Minni experiment) can achieve. Nocturnal I really hope you fix this mischief.

Sent from unrooted and plain HTC one x 2.20:/
[AT&T, Rogers HTC One X, Telstra One XL] twistedddx:
Break what things? RUU's are just as carrier specific as OTA's are. They are just different ways of distributing the updates.

The RUU creates a rom.zip that clearly has 256kb signature at the beginning of the zip.

This is not the case with OTA zips, but the OTA zips do have a comment of "signed by SignAPK".

And viewing the zips in a hex editor you can see the certificate is at the end of the zip.

SignAPK is used to sign all official applications.

So they are signed in a different way, end versus start, but in the end both ways are signed by HTC.

I assume the difference in signing is because there is major difference in the code used to flash the content. Eg hboot versus recovery.

One lives in its own world and the other within a more complete Android OS.

OTA are created and released by HTC.

HTC creates them to fit the carriers requests, sends them to carriers for testing, but at the end of the day HTC is creating and distributing all OTA's.

Eg:

http://fotadl.htc.com/OTA_EVITA_UL_...1.89.841.9_release_279477r07a3nyy05j4vcis.zip

All OTA updates can be found on http://fotadl.htc.com/ and that is where your phone finds them also.

The only reason you see filefactory and other hosting site links is for peoples own personal gains.

Even if the carrier had the zip on their own servers it was almost certainly still created and signed by HTC and only being distributed by the carrier.

PS. someone should test. Just because the zips are signed does not mean the phone is actually checking the signature correctly or at all. There is like a 0.000001% chance it will just allow anything.

Failing that go find the next geohot, give him any HTC phone and await for the HTC master key to be dumped from somewhere in the phones memory.
[AT&T, Rogers HTC One X, Telstra One XL] stOwner:
Maybe this is interesting for some of us:

http://marakana.com/s/updating_android_os_via_ota,1065/index.html
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
You've said some of the most retarded things I've heard in these forums so far. You clearly haven't even read up on the vast amount of information already discovered about this device, and clearly don't understand the the tools used to interact within it. You need to better inform yourself of android eco-system, the systems that protect and control it and how to properly interact with them. After some of the ludicrous nonsense you have posted you don't have any room to tell somebody possibly informing you of information to stfu, or gtfo. Anybody that has even basic development knowledge would plain laugh at the stupid things you have posted in here. I know I certainly have:beer:

PROOF OR STFU&GTFO
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
Quick question, i know there are ways to view the android system files from pc, but is there any way to mount them? then access them from a VMware running android and then install a previously exploited app or some other means of root.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
The only time it becomes available is when certain partition become corrupted and the device goes into qshusb mode. Only then it becomes available in 5-7 second intervals, of which only about 0.5-1 second is writable. You can find in linux with /dev ls sd* and will show up as sdx12, x being a variable depending on device. So, it's been brought up before, if we could find a way to corrupt a partition on 2.2x that would produce the emmc mode we would be golden, as we could write mmcblk0p4 with supercid to it. Methods like severe battery drain or wiretrick will put the phones into qshusb mode, but don't produce the emmc writing window because nothing is actually corrupted.
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
Okay. That clarified a lot. Thanks

---------- Post added at 09:42 AM ---------- Previous post was at 09:38 AM ----------

Do these partitions corrupt the same way a normal pc partition would? Not sure if this would help http://pario.no/2011/11/14/how-to-corrupt-a-disk-partition-using-dd/
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
You can not corrupt the partitions without root.
[AT&T, Rogers HTC One X, Telstra One XL] itzsnookums:
Noob, here but that makes no sense^^^^.....you should be able to corrupt any kind of data, the key is timing it perfectly and knowing what your doing....a power outage while writing to flash could potentially corrupt data, but the issue is you cant pull the power and expect it to corrupt a single partition....the best way i know to do this is kinda risky, but may work...that ota that at&t sent out the 2.2 ota, what if during the write to the system partition, pull the battery, should that trigger some kind of response? sorry once again a noobs ideas trying to help out.......
[AT&T, Rogers HTC One X, Telstra One XL] venelar:
Annnnd stop right there.
[AT&T, Rogers HTC One X, Telstra One XL] fitchpuckman:
You do know the battery is non-removeable, right? Am I missing something?
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Been tried many many times at several points of ruu'ing/updating. I don't know what is happening in here, and saying it is getting old......read these threads before inputting, gain the information of what's been tried, what hasn't, dead ends etc..... If you don't, your probably just repeating what's already been discussed.....on more than one occasion
[AT&T, Rogers HTC One X, Telstra One XL] itzsnookums:
Yes, I'm aware of all the above statements, but i happen to be able to remove the back, quite easily may i add, and im also aware that what i posted is a very bad idea.....but hey wtf, worth asking about, its a start....and see here^^^, it has been tried. So question answered, im just trying to help thats all......

18th.abn-- I was trying to help by just throwing ideas out here, no need to act like your on facebook........
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
Do we know if the ruu/update/rom checks for HTC's signature before the installation, or does it do it throughout the installation? If it was before, could we intercept it. Like name them the exact same thing, then as soon as it verifies, make it look in a different place or at a different file? Just a thought
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Corrupting during HBOOT write would almost certainly put the device in a state where we could take advantage of emmc recovery mode and push root (and push a downgraded hboot). Emmc recovery mode is tedious to deal with but it's doable. The issue is resetting the device while hboot is being written, the flash happens in (I'm guessing) around a tenth of a second.......
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
The OTA is flashed in stock recovery, not bootloader.

The stock recovery may not check for a signature according to 18th.abn

So what we're trying to do is trick the OTA updater into downloading a fake ota so it can be flashed in stock recovery.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
I thought you could get into EHostDL by bricking any partition, not just HBOOT?

What about pulling the cable during an RUU?

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
The emmc recovery mode we need (comes before ehostDL) only presents itself when hboot is borked. Actually there's one other partition that can cause it, but it's not updated by any RUU.

Cables don't help, the flashing is all done on the device, systematically, after the rom.zip file is sent. Device needs reset....

And even if the cable would work (it won't), good luck timing it down to 0.1 seconds....
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
How do Sensation owners flash an HBOOT.nb0 through QHSUSB_DLOAD in ubuntu then? Will dexter93's tool work then for this phone?

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Give me link. I suspect its not actually qhusb mode they are using, but this other mode that pops up prior. The 2 get mistaken for one another often. Link me and I'll look.
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
I'm assuming he means this:

http://xdaforums.com/showthread.php?p=23078349
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Yup, that one.