yashsingh1/xdaforums huggingface dataset:
[HTC Pico (Explorer)] no.human.being:
Yeah, JTAG adapter by Multi-Com (Poland). I had the same on the WFS (of course the WFS model, but also by Multi-Com). Btw, this one is normally called a "JTAG adapter". The "JTAG interface" is the piece of hardware that goes between your computer and the "JTAG adapter" to provide the electrical signalling. It usually has a USB connector on one side and a 20-pin JTAG header on the other.

Now that's cool. Now we "just" need to find the routine that does the reverting (probably related to the routine that handles the "reboot-bootloader" request?), then find where it's called. It's probably called based on some condition. Replace these conditional jumps with no-ops and win.

It's probably not gonna be simple, but the basic plan should be about that.
[HTC Pico (Explorer)] #define:
Hey guys, i've been talking to a new professor at my college, and i asked him about an ARM "simulator"....

Now i havent been able to find out much more about it at this point, but could it help us?? It's a simulator, so no debugging.. Unless we maybe link it to some debugging facility...

Should i get it??

Sent from my Nexus 7
[HTC Pico (Explorer)] xpmode:
I ran through this while I was looking around.

http://xdaforums.com/showthread.php?p=38009340

This guy states he has RIFF box(however apparently no knowledge of using it), which I believe is some sort of JTAG.

May be useful.
[HTC Pico (Explorer)] #define:
Well, unless we get him to send it to us or we teach him what we wanna do, its a very long shot...
[HTC Pico (Explorer)] #define:
@Sachin Thomas

@no.human.being

@cute_prince

Check this out guys,

Universal(or so they say) S-OFF for HTC's Qualcomm devices...

http://xdaforums.com/showthread.php?t=2155071

Can this be of any help to us??

Both MarvelC and Pico are Qualcomm, arent they??

Sent from my Nexus 7
[HTC Pico (Explorer)] Lt.Win:
We need SuperCID. Which we were going to get by S-OFF, not the opposite. We need a way to get S-OFF without SuperCID. Although it is a good find, could be useful.

Sent from the 32Bit Batman Potayto!
[HTC Pico (Explorer)] #define:
We could ask them how they achieved SuperCID without S-OFF(even that would work on all Qcomm devices right??) and then, if they're kind enough/if we're lucky enough, they'll either help us or give us the source(low probability of this happening)..

But then again, we'd need the diag files and such, and we dont have those for the Explorer...

But it could greatly help the WFS S-OFF project...:cool:

Correct my logic if flawed here...

Sent from my Nexus 7
[HTC Pico (Explorer)] Lt.Win:
I just checked the Droid DNA SuperCID thread they have linked to. Source.zip is attached, that what we want?

Sent from the 32Bit Batman Potayto!
[HTC Pico (Explorer)] #define:
Yes... Useful..

Now we need someone who can patch this source with correct values for our phones, make a new apk, and see if it works...

Unfortunaley, i dont know apps...

I can be the tester though..

Also, post this stuff on the WFS thread as well.. See what the big boys have to say about this...

Sent from my Nexus 7
[HTC Pico (Explorer)] SifJar:
Perhaps an easier way to get SuperCID: http://xdaforums.com/showthread.php?t=1671396 (manual process via command line over adb, but not many commands)

Basically you dump a partition to the SD card, pull it to PC, hex edit it a little, push it back to SD card, flash it back to the relevant partition. The problem is what partition it is that needs dumped; the HTC One X (which that thread is about) uses the "mmcblk0p#" partition naming scheme, whereas the Explorer uses the "mtdblock#" naming scheme. I can't see any reference to what partition mmcblk0p4 (the partition edited on the One X) actually is, so I'm not sure which partition on the Explorer needs dumped.

Or perhaps there is no direct analogous partition, in which case I'm not sure if SuperCID will work at all.

Plus, I can't seem to get dd to dump any partition on my Explorer:

C:\Users>adb shell "su -c dd if=/dev/block/mtdblock5 of=/sdcard/mtdblock5"

Unknown id: if=/dev/block/mtdblock5

I'm not sure what's wrong with this command, or why it isn't working...

[I should note that I do not completely know what SuperCID is/does. Also, that Facepalm S-OFF thread mentions "modern HTC phones"; is the Explorer a modern enough phone?]

EDIT: Another note: The above linked thread seems to do essentially the same thing as the previously linked APK. It's just a more manual method (but less effort in terms of development), and the APK may include rooting as well as SuperCID.
[HTC Pico (Explorer)] #define:
A few things wrong here @SifJar...

First of, if we dump a partition, and edit it, even so much as by a single byte, it wont flash back because of messed up signature... We could try to boot it, like we do with the tampered hboot for s-off... Thay could work.. But flashing is just out of the question...

Secondly, the dd utility doesnt seem to work on android as we'd like it to...

If you remember, we were trying to dump the radio of Explorer into file..

It was at that time, when we confirmed that dd is "broken" for android...

Lastly, the OneX/OneXL and Explorer were released about the same time(i think)...

So ours can be considered a fairly modern htc...

Sent from my Nexus 7
[HTC Pico (Explorer)] SifJar:
I'm going off EXACTLY what was done on the One X. The APK linked before does pretty much the same thing (I looked through the source), only instead of dumping the partition, patching it, then flashing it back, it just applies the patch directly to the partition. (Would still destroy any signature present, leading me to believe this particular partition is not signed).

And they used dd for the manual method I linked, which for them worked just fine (perhaps dd was fixed in ICS and above?).

The reason I wasn't sure if Explorer counted as "modern" was that it was released with Gingerbread, not ICS, which the phones involved in this stuff all seem to have been released with.

EDIT: I tried using dump_image and cat to dump a partition as well; they both gave the exact same error as seen above. I am pretty sure I have used some of these command before to dump partitions on my phone, but I can't figure out why they're not working now...
[HTC Pico (Explorer)] Lt.Win:
On a side note, related to dd.

Galaxy S3 Mini (ships with 4.1) has to use dd for flashing a recovery or something like that, I've read / heard. So, your theory that dd was fixed for ICS and above can be true. If so, why not try while CM9 / 10 is running?

Sent from the 32Bit Batman Potayto!
[HTC Pico (Explorer)] Sachin Thomas:
Can anyone type fastboot oem readcid in fastboot mode and post what value is returned? Fastboot doesn't recognize my phone (I think it's driver issue)
[HTC Pico (Explorer)] #define:
I think it would be HTC038

Sent from my Nexus 7

Edit : yep, its HTC__038
[HTC Pico (Explorer)] SifJar:
Figured out how to dump partitions successfully. Have to use the path "/dev/mtd/mtd#", and then the commands I posted before work. So one of these partitions presumably contains HTC__038 as posted by bhargz16. If we can find which, and then change it to 11111111 and copy it back to the phone, we should have SuperCID I believe. (This is perhaps why Sachin Thomas wanted the default CID value, to know what to look for)

EDIT: Upon dumping "misc" I found it started with HTC__001; is it possible different phones would have different CID values? (Perhaps by region etc.?) If so, maybe this is the string that needs changed

EDIT: I tried to check mine, but on typing "fastboot oem readcid" I got this:

No idea why that didn't work...
[HTC Pico (Explorer)] #define:
Try fastboot getvar cid

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
We have already dumped everything except the radio (mtd0). To dump the radio you need to map it with command line parameters. But it gives read error after reading a few megabytes

See http://xdaforums.com/showthread.php?t=1957236&page=24

EDIT:

dd wasn't working then. So we had to use cat

CID is based on your region. HTC__001 is Europe
[HTC Pico (Explorer)] SifJar:
Sounds like we have what we're looking for then. I had to use cat as well.
[HTC Pico (Explorer)] #define:
I'll post results back in sometime...

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
If there's a second copy of the cid stored somewhere in the radio partition then we're screwed :D

And if it's that easy to flash a misc partition then why can't we get our bootloader locked? The bootloader state is also saved in misc
[HTC Pico (Explorer)] #define:
Doesnt work... CID is still the same..

HTC__038

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
Did the misc partition get changed? Did you try dumping it again after editing?
[HTC Pico (Explorer)] #define:
Well, i didnt dump it after, but since the cid didnt change, i'm guessing the partition got overwritten by default values...

I'll check though..

Sent from my Nexus 7
[HTC Pico (Explorer)] #define:
Weird alert!!!!

The file is blank...!!!

Filled with all zeroes!!!

That wasnt the case before!!!

It had the CID, and some strings about "Device warm boot" and the likes!!!

WTF happened??

Why did it turn blank???

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
That's really weird! :eek:
[HTC Pico (Explorer)] #define:
Any explanantion??

Anyone??

@no.human.being??

@cute_prince??

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
We need to know where SifJar found this method

NHB once said that cat is used for character devices and dd is for block devices. So perhaps it was not correct to use cat to write to an mtd partition. You had to use dd

So your phone isn't bricked?
[HTC Pico (Explorer)] #define:
Nope... Phone is fine.. I can make calls as well..

Sent from my Nexus 7
[HTC Pico (Explorer)] SifJar:
I just assumed seeing as dd didn't work for dumping, and cat did, you would have to use cat to write it as well. I apologize for my mistake, thankfully it seems your phone is still working. Is it possible to flash misc with fastboot? If so, you could try doing it that way. (either the modified version or the original. Although it sounds like the modified one isn't going to work, seeing as a CID value is still reported with blank misc partition)
[HTC Pico (Explorer)] no.human.being:
An mtd is not a block device. Do an "ls -l /dev/mtd" and it will show permissions like "crw-rw-rw" (or similar .. either way they start with "c" for "character device"). It's not a "pure" character device either. The driver developers say that it's .. well .. an mtd. ;) It behaves a lot like a character device though. You have to read and write it sequentially, starting at the beginning. No "fseek(...)" support, etc.
[HTC Pico (Explorer)] Sachin Thomas:
Here's a method to modify the misc partition on the One X

http://xdaforums.com/showthread.php?t=1671396

The One X is an eMMC based device so I don't know whether it'll work on the explorer if we use mtd0 instead of mmcblk0p4

You do this at your own risk!!! This could turn your new phone into a very expensive paperweight!!! If you don't know how to do it or are uncomfortable DON'T DO IT!!!
[HTC Pico (Explorer)] #define:
I'll give it a shot...

Sent from my Nexus 7
[HTC Pico (Explorer)] #define:
Alright...

Update time...

ls on the /dev/block gives me :

Loop0, loop1, ...., loop6...

Mmcblk0, mmcblkp1, mmcblkp2...

And mtdblock0 thru 6....

Now, dd on the mtdblock(s), gives me i/o error... 0 bytes in, 0 bytes out...

dd on the mmcblk0 is running right now, it seems painfully slow...

Lets see what happens(probably another i/o error)...

P$ : permissions are bwr-------(or something), like nhb said...

Meanwhile the misc partition i overwrote with supercid patch is still blank, i tried changing the rom and kernel on it(didnt have much hope to begin with, but still worth a shot)...

I think simple overwriting wouldn't work.. We'd have to erase the partition, and then write new info on it(which would require s-off, and hence, fail), pretty much like the early efforts in the WFS project(the injector code)....

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
Did you try to write to mtd0 with dd?

Is explorer eMMC based? :confused:
[HTC Pico (Explorer)] #define:
I couldnt find mtd0...

But get this...

I performed dd on mmcblk0, it went on for like, a half hr, and then, gave me an error that the file is too large...

But it had written some data on file..

So i checked on the sdcard, and the mmcblk0 file is 4.3 GB!!!!!!!!

How???

The total memory of explorer is 512mb ROM and 512MB RAM!!!! Where did it get 4.3 gb from????

Is it a "volatile" partition or something??

Sent from my Nexus 7

EDIT : I opened the file in hex editor, and it says FAT32 in several places... Could be a dump of the sdcard...
[HTC Pico (Explorer)] Sachin Thomas:
Yeah... The name 'mmcblk0' is the raw device name of the SD card

http://www.randomexploits.com/projects/sheevaplug/sd-boot.htm
[HTC Pico (Explorer)] #define:
The last couple lines are intriguing...

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
How did you get here?
[HTC Pico (Explorer)] #define:
Fastboot oem gencheckpt...

Do 'fastboot oem ?' to see all available commands...

Sent from my Nexus 7
[HTC Pico (Explorer)] SifJar:
That's the thread I linked before, from which I based what I posted. I just changed dd to cat because dd didn't seem to work on the Explorer.
[HTC Pico (Explorer)] #define:
dd worked when i tried to dump mmcblk0 this morning...

Turns out it was just the raw sdcard...

Sent from my Nexus 7
[HTC Pico (Explorer)] SifJar:
But it doesn't work for mtd0 (the partition we need to write)...

C:\Users>adb shell "dd if=/dev/mtd/mtd0 of=/sdcard/mtd0"
/dev/mtd/mtd0: read error: Invalid argument
0+0 records in
0+0 records out
0 bytes transferred in 0.004 secs (0 bytes/sec)

I assume it would not work for writing to mtd0 either, but I don't wish to brick my device, particularly seeing as I'm not overly concerned about S-OFF (I'm only really in this thread to learn and try to help if I can), so I haven't tried it myself.

Does anyone know can misc be flashed with fastboot (I'm guessing probably not, or someone would have suggested that already...)?
[HTC Pico (Explorer)] #define:
Cant flash misc through fastboot...

Sent from my Nexus 7
[HTC Pico (Explorer)] SifJar:
Figured out how to get dd to work with mtd0: you just need to specify block size (for mtd0 this is 1048576). So the following command works for dumping:

adb shell "dd if=/dev/mtd/mtd0 of=/sdcard/mtd0 bs=1048576 count=1"

I checked this against the file dumped using cat, they are identical.

I'm not sure if this means dd could be used to write to mtd0 or not. (Although I doubt it).

EDIT: For reference, I obtained the block size like so:

C:\Users>adb shell "cat /proc/mtd"
dev: size erasesize name
mtd0: 00100000 00040000 "misc"
mtd1: 00500000 00040000 "recovery"
mtd2: 00400000 00040000 "boot"
mtd3: 0eb40000 00040000 "system"
mtd4: 03b00000 00040000 "cache"
mtd5: 09600000 00040000 "userdata"
mtd6: 00a00000 00040000 "devlog"

0x00100000 is 1048576 in hex.
[HTC Pico (Explorer)] Sachin Thomas:
munjeni has done it before (to downgrade his HBOOT)

http://xdaforums.com/showpost.php?p=30476950&postcount=2994

And remember that the One X, One S and DNA methods for SuperCID work (and might even require) a locked bootloader!

There's no need to hurry. We'll wait for NHB's opinion :)
[HTC Pico (Explorer)] #define:
Wont this need a goldcard or something??

We tried basically the same thing this morning, didnt we??

My misc is still blank... So to speak.. ;)

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
A GoldCard is a special SD card which, when inserted into your device, allows you to flash RUU files with a different CID to your own device. It's basically the same thing as SuperCID

http://www.modaco.com/topic/305672-creating-a-goldcard/

We tried with an unlocked bootloader. Also, munjeni used erase_image and flash_image on misc

EDIT:

I think we don't need a GoldCard or locked bootloader as we're not trying to flash any RUU
[HTC Pico (Explorer)] SifJar:
So you think erase_image and then flash_image could work? Well I guess bhargz16's misc partition is already erased, so that part of the process probably shouldn't do any further harm... :p
[HTC Pico (Explorer)] #define:
Its either not erased, and not dumped properly, or it really was erased, and the misc partition isnt really necessary for anything...

Sent from my Nexus 7
[HTC Pico (Explorer)] DanceOff:
Get guys when we first boot into boptloader it shows up searching for some files , they need to be HTC signed I guess ! Is there any method to flash unsigned without s-off?

I want to change splash logo.
[HTC Pico (Explorer)] Sachin Thomas:
It's good to hear that writing to the misc partition doesn't require S-OFF or unlocked bootloader. But will it cause the HBOOT to show " TAMPERED" until we flash an RUU (or get rid of it after gaining S-OFF)? I saw this on the other threads

No, you can't change splash screen without S-OFF. But it should be trivial after gaining S-OFF, you only need to create a PJ03IMG.ZIP with an sp1.img and flash it. You can use this utility to create splash screens

These are NOT images of my phone :)
[HTC Pico (Explorer)] #define:
No... No way to flash unsigned stuff without s-off...

We can boot from it though, like we do with the chainloader exploit...

Sent from my Nexus 7

1000 posts... Phew!!! :p
[HTC Pico (Explorer)] Sachin Thomas:
I've flashed the modified misc partition and rebooted. But still, no SuperCID :(

shell@android:/sdcard # erase_image misc
erase_image misc
shell@android:/sdcard # flash_image misc mtd0
flash_image misc mtd0
mtd: successfully wrote block at 0
mtd: successfully wrote block at 40000
mtd: successfully wrote block at 80000
mtd: successfully wrote block at c0000
wrote misc partition
shell@android:/sdcard #
143|shell@android:/sdcard # Killed
137|shell@android:/ $
C:\Users\Sachin\Desktop>fastboot getvar cid
cid: HTC__038
finished. total time: 0.003s

There are no other instances of HTC__038 in misc. It occurs only at the beginning
[HTC Pico (Explorer)] #define:
Whats this radio_v2 and radio_cost(or cust) in the second image??

Sent from my Nexus 7
[HTC Pico (Explorer)] SifJar:
Did you dump it again afterwards to check it was modified correctly? Assuming you did, I can only assume that it is read from mtd0ro (the read only version), which presumably will still have HTC__038 in it.
[HTC Pico (Explorer)] Sachin Thomas:
Yes... I dumped it again and found that it was modified correctly.

Aren't mtd0 and mtd0ro referring to the same "physical" partition? So if the r/w version is modified shouldn't the r/o version get modified as well?
[HTC Pico (Explorer)] #define:
Ur misc didnt go blank??

Like mine did??

Sent from my Nexus 7
[HTC Pico (Explorer)] SifJar:
Well in that case try dumping mtd0ro and check ;)
[HTC Pico (Explorer)] Sachin Thomas:
It didn't... The rule is that nand must always be erased before writing to it. So if you are interested in repairing your misc partition use erase_image first and then flash_image. You can do it even when android is running. I didn't use nhb's mtdutils as the two required binaries were already available

I'll try it
[HTC Pico (Explorer)] #define:
Well, i dnt need to fix, as long as the phone's workin'...

Sent from my Nexus 7
[HTC Pico (Explorer)] no.human.being:
The CID in "misc" is also known as the "backup CID". I don't know exactly why Android needs to have a backup of the CID, but the original CID is stored in the Radio and S-OFF is required to change it. You can temporarily bypass CID checks using a gold card though.

Yep they should be.

EDIT: Uploaded chainloader source code for use by the HTC One V community (hope you don't mind).
[HTC Pico (Explorer)] #define:
at first I thought you sent the pm to me by mistake..:D

Sent from my Nexus 7
[HTC Pico (Explorer)] #define:
then how are the one x, droid DNA and one people getting super cid for s off??

The principle is basically the same right??

edit : nvm... Just read the pm properly...

Sent from my Nexus 7
[HTC Pico (Explorer)] SifJar:
If you understand how they were able to get SuperCID without S-OFF (and then S-OFF as a result of SuperCID, instead of the other way round), would you care to share that information please? I am very interested to know.
[HTC Pico (Explorer)] #define:
yes.. That's exactly what i am trying to figure out..

I'll post as soon as i get some info

Sent from my Nexus 7
[HTC Pico (Explorer)] AmalD:
@op

Pease contact this dev

" xHausx " Forum Moderator / Recognized Developer

he is ready to help us :)

what he replied

"

I'm afraid I'm unable to be much help with that but I've passed your request along to someone else who may be able to help.

have you guys had any previous s-off methods?

-Jon "
[HTC Pico (Explorer)] #define:
thanx bro.. I'll pm him right now...

Sent from my Nexus 7
[HTC Pico (Explorer)] AmalD:
bro

I got another rply from " beaups " more expert in soff section :)

" But for soff, are you able to get supercid? Link me to your device forum. "

profile : http://xdaforums.com/member.php?u=711482

please pm him
[HTC Pico (Explorer)] Sachin Thomas:
Can't we use a GoldCard instead of SuperCID?
[HTC Pico (Explorer)] #define:
Well, that may be our next go-to response, since supercid didnt work out so far..

The next few days may bring some good news for us..

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
Any news from the One V community? Did the chainloader work for them? I searched their S-OFF thread but didn't find anything about the chainloader exploit
[HTC Pico (Explorer)] #define:
We'll hear from them any day now...

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
Has anyone tried booting into android with a locked bootloader? When I tried to do this I got a security warning on HBOOT and it didn't allow me to go into android or recovery. This happens even on rooted stock ROM

Now the chainloaded HBOOT also thinks that we have a locked bootloader, but doesn't give any security warning

@bhargz you got a security warning the first time you tried it, right?

And did you try the chainloader with your "blank" misc partition?
[HTC Pico (Explorer)] #define:
Yea i got a warning..

I think i posted a pic too..

No, havent tried chainloader with blank misc..

I'll try n report in a couple hours..

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
Also check whether you can boot into android or recovery with a "RELOCKED" bootloader, without flashing an RUU

Repair your misc before trying this or you may get into trouble
[HTC Pico (Explorer)] #define:
That i wont be able to do... Because when the bootloader is relocked, it then checks for some sort of signature on the rom and recovery partitions, which it wont find when i have a custom rom/recovery flashed, and hence give me the finger in form of an error.. ;)

Sent from my Nexus 7
[HTC Pico (Explorer)] no.human.being:
Seems like the Explorer is WAY different from the WFS. On the WFS you can relock the bootloader at will and it will still boot custom ROMs that are installed on the phone, like CM or CWM. It just won't allow you to flash or fastboot them. The signatures are checked by our bootloader before the images are flashed and then the signatures are discarded. The signatures do not get written to NAND at all.
[HTC Pico (Explorer)] #define:
Nope..

Shows relocked, a security warning, and doesnt let me do anything forward.. Whatever i do, it brings me back to the bootloader...

The weird thing is, whenever we unlock bootloader, its supposed to erase user data right?? That didnt happen when i unlocked it.. My apps and google account are still there, safe and intact..

Meanwhile, after unlocking, relocking and unlocking again, my misc partition is still blank, and the phone still works just fine...

HTC stumbled upon quite a system eh?? ;)

Sent from my Nexus 7
[HTC Pico (Explorer)] Sachin Thomas:
It didn't erase my userdata, not even when I unlocked for the first time :D
[HTC Pico (Explorer)] #define:
You lucky duck!!

Sent from my Nexus 7
[HTC Pico (Explorer)] beaups:
I'm lurking....someone pm me with teamviewer credentials so I can have a look.
[HTC Pico (Explorer)] #define:
Thnx for dropping by...

What do you need??

Teamviewer credentials??

Sent from my Nexus 7