yashsingh1/xdaforums huggingface dataset:
[HTC Pico (Explorer)] #define:
If I understand your question correctly, i'd say the locked resources would be stored in the radio, which we don't have access to without JTAG... Or making a dump... as soon as we get the GDB virtual memory problem figured out, we'll be able to answer all our queries...

And as far as writing new code goes, I guess we'd have to know what locked resources to skip, in order to integrate the instructions in our code..
[HTC Pico (Explorer)] Sachin Thomas:
If it's in the radio then we are helpless. But, if the resources are locked by the HBOOT for its own use, then we can release them through our own code
[HTC Pico (Explorer)] #define:
Well, thats what we're doing right now.. Trying to release the resources locked by the HBOOT.. For that, we need to patch the HBOOT like we did with the S-OFF function.. To patch it we'll need to know where the HBOOT locks up the resources.. To know that, we'll need the GDB.. So basically, the emulator can answer all our questions/solve all our problems... :) :good:
[HTC Pico (Explorer)] no.human.being:
The "waiting on a locked ressource" thing is guesswork only. That's why I want to know where the loop is where it gets stuck. However, on our emulator it may even be stuck somewhere else than on an actual phone. Remember that, on the emulator, we only emulate aARM, not mARM and that, on a phone, HBOOT displays the Radio version. It most likely queries mARM for that information. Now if we're lucky, it queries the Radio, on the emulator, the Radio "does nothing" (as there is no Radio), HBOOT reads a bunch of zero bytes and displays "0.00.0000" or an empty string (C strings are zero-terminated) or whatever. If we're not that lucky, it waits on something and gets stuck in a piece of code, where it normally (on an actual handset) wouldn't get stuck.

So, of course, JTAG would be a lot better than the emulation thing, but ... well ... something tells me that we just won't get it. :D

All we actually know is that, on the actual phone, the HBOOT gets stuck (or on the WFS reverts) "somewhere before the USB port is initialized", since it displays "HBOOT", not "HBOOT USB".
[HTC Pico (Explorer)] #define:
Can someone upload the "mkbootimg_wfs" utility?? I lost it...
[HTC Pico (Explorer)] Sachin Thomas:
http://xdaforums.com/attachment.php?attachmentid=1456677&d=1352054488

We may be able to use our "static" radio dump here as there's no need to dynamically generate radio version every time.

BTW, can we log the value of program counter (after fetching each instruction) to a log file from gdb or qemu?
[HTC Pico (Explorer)] #define:
Sachin is right.. We can use our dump as radio.. Also, I found this..

http://openocd.sourceforge.net/doc/html/GDB-and-OpenOCD.html

Its a solution to the virtual memory problem(i think) with OpenOCD and GDB.. Check it out and see if it'd be any help to us..
[HTC Pico (Explorer)] bulletproof136:
any new news :D whats the progress ....... :)
[HTC Pico (Explorer)] #define:
Does anybody know anything about the APX mode that either Android/only HTC phones have?? Apparently its some troubleshooting/debugging mode... I read about it in different HTC One series phones... don't know whether it would even be applicable to Pico or not...

Anyways, if anybody has/gets any info about APX, please post here.. :good:
[HTC Pico (Explorer)] cute_prince:
I just googled about APX mode and found this:

The most common way to get into APX mode is pressing volume up and down together while device is off and then plugin USB while connected to a computer..

Try it bro, I haven't tested .
[HTC Pico (Explorer)] Sachin Thomas:
It's available for NVIDIA Tegra based devices only...
[HTC Pico (Explorer)] DanceOff:
Any progress?
[HTC Pico (Explorer)] #define:
Hey people... Whats the progress report here?? NHB, where you at bro??

I make you read.
[HTC Pico (Explorer)] no.human.being:
Don't panic guys, I didn't let you down. I'm still here and checking back at regular intervals. I've just run a bit out of ideas and I also don't have a lot of time I could currently invest into this, sorry.

And, as you know, I don't have an MSM-based device. :(
[HTC Pico (Explorer)] #define:
Well, we really are running out of ideas now... What about GDB?? Didn't that turn out to be like something we can use??
[HTC Pico (Explorer)] sufian88:
Is there any hope of getting our HTC Pico/Explorer S-OFF'd? What if we get we all request devs to help us out? :)
[HTC Pico (Explorer)] #define:
Yes.. it could be done faster if all the devs come together... but most of them are busy with cm10 and cm10.1 with kernel 3...
[HTC Pico (Explorer)] sufian88:
Thanks for the quickest reply ever. :p

I guess if you make a thread for this request, many people will notice is quicker than if I do. So please do. :)
[HTC Pico (Explorer)] fahad786:
Salam to all how is our pico progress:D
[HTC Pico (Explorer)] Apex-Predator:
So wats the progress till now

I'm not catching up this thread

Can anyone tell !!!!
[HTC Pico (Explorer)] sufian88:
What progress are we talking about? I hope it's S-off, because I'm waiting for it. :)
[HTC Pico (Explorer)] #define:
We're working on it... Progress is the same as the last couple pages...
[HTC Pico (Explorer)] sufian88:
Can you please name the developers who are doing this generous task? :)
[HTC Pico (Explorer)] #define:
Hmm.. lets see... from the wfs forum, there's no.human.being, becimester, heavy_metal_man... from the explorer forums there's sachin thomas, cute_prince, and myself... we are working for 2 phones... the wfs and the explorer...
[HTC Pico (Explorer)] Neel.Aryan:
I came across this software from revolutionary.io . It doesn't have htc explorer listed. But what it seems to me is that they try either downgrading hboot then setting the secuflag to 0 or 1 (smthng lyk dat).
[HTC Pico (Explorer)] Lt.Win:
The problem with downgrading on our WFS is that we have a method to S-OFF the thing, but on the first hboot. I.e. 0.90.0000. But it won't let is downgrade to that version.

Now in case of the exploit:

The exploit works, but HBOOT falls back, thus resetting to S-ON. If we can prevent it from falling back, OR alternatively downgrade to 0.90.0000, problem solved. :)
[HTC Pico (Explorer)] #define:
Thats what we are trying to do... to prevent it from falling back... as, unfortunately, downgrading isnt an option for us Explorer users...
[HTC Pico (Explorer)] Neel.Aryan:
Yes, it isn't an option. What if we flash in a mod hboot with hacked drivers. Then maybe it won't fall back.
[HTC Pico (Explorer)] #define:
Bro, thats exactly what we are trying to do here... we are trying to find out where and why the hboot becomes unresponsive... so we can patch it up to force to respond... for that, we either need jtag or some sort of emulator... unfortunately, jtag wouldnt work due to some voltage problems... so we tried to emulate an environment in which we can run the hboot code, ie, gdb... but, gdb has some problems allocating memory as ram... if we can figure that out, we'll have unreverting s-off...
[HTC Pico (Explorer)] Neel.Aryan:
jtag method might work if we can connect ground and positive terminal to the exact circuit loop.

Or, like in some other htc phones, a short circuit method with a program was run to get the s-off. The JuopunutBear s-off method.
[HTC Pico (Explorer)] #define:
No one here has that kind of knowledge, or the balls... to jtag their phone..

And the people that do, dont have the device to experiment on...
[HTC Pico (Explorer)] Neel.Aryan:
I think you had a look at the stock kernel. So, do you think the kernel is stopping s-off ?

There maybe some kind of flag in the kernel also.
[HTC Pico (Explorer)] #define:
Kernel doesnt play a role in s-off at all... we have to play with the bootloader and the bootloader only...
[HTC Pico (Explorer)] Neel.Aryan:
Hmm... I see one hassle free workaround as flashing a custom bootloader, as soon as you get s-off.

But again as you said, device wasn't responding...
[HTC Pico (Explorer)] Neel.Aryan:
Check out unrevoked.com for wfs tools. If it works then same mechanism can be used for pico.
[HTC Pico (Explorer)] #define:
That is for Wildfire... not Wildfire S..

Plus, that website is the final result... we need to know how they arrived at that final result... the result for us would be different..
[HTC Pico (Explorer)] Neel.Aryan:
Opsie... I got confused for an "S". :P

Agreed... Finding our own method will be original. :good:

M trying to understand the available working s-off methods mechanism, that would help a lot.
[HTC Pico (Explorer)] DanceOff:
What's the status guys ?

Right there below, yeah that thanks button it needs some help it needs you to press it :D
[HTC Pico (Explorer)] #define:
Just check out the last 3-4 pages... we havent had any noteworthy progress after christmas...

But i have high hopes that we'll have s-off soon...
[HTC Pico (Explorer)] Neel.Aryan:
We should also consider changing the file system of our NAND chips from mtd to UBI.

Because,

1. mtd will last sector's of memory uptil 10^5 erase cycles. Then they will become bad sectors & unusable.

2. ubi is newer file system for NAND chips & can handle blocks of memory much better than mtd.
[HTC Pico (Explorer)] gnustomp:
Umm...why not ext4?
[HTC Pico (Explorer)] Neel.Aryan:
ext4 are for block devices, eg.: sd card, pendrive, hard drive.etc.

While, nand / nor / flash chips are mtd devices. They support mtd & ubi file system.

ext4 can be implemented via an emulator running on the mtd device. But, who will make that emulator ? Its extremely complex.
[HTC Pico (Explorer)] no.human.being:
I used to have both, the device (Wildfire S though, not Explorer) and a JTAG interface and I had the equipment and the "balls" to do it. So I opened up the phone, got the board off, got JTAG connected (which is a bit risky ^^) and all, but then OpenOCD says "processor returns all zeroes", so I hooked up an oscilloscope to the serial data lines of the processor (MSM7227 for Wildfire S) and then I saw that it was running on just 0.9 V. Whe JTAG interface won't see this as a "logical high", as it expects a processor running from the much higher 3.3 V, which is quite a common voltage.

So: JTAG interface expects 0 V as "logical low" and 3.3 V as "logical high", but processor runs off 0.9 V supply and logic level can't get higher than supply, so it puts out 0 V as "logical low" and 0.9 V as "logical high", but since the JTAG interface expects 3.3 V as "logical high" and 0.9 V isn't even close to that (it's less than a third of it), it thinks all the processor puts out is zeroes.
[HTC Pico (Explorer)] Neel.Aryan:
Its risky as hell. The site itself says "Proffesional experience" required for soldering.

Anyway, we can try manipulating mtd-utils tools.

The board itself will provide power to the processor & other functions we can try manually executing.
[HTC Pico (Explorer)] #define:
HTC does quite a well job sealing off their phones' components.. I opened the device(Explorer) once, but I could not locate the JTAG port.. Plus, to make connections, I'd have to tear the device apart, all the components are covered with plates.. so putting it back is gonna be a big, big pain in the neck...

BTW, could you post a few pics/schematics of what JTAG ports look like, and how they are to be connected???

Just out of curiosity...
[HTC Pico (Explorer)] fahad786:
Jtag Daigram

I think it can help:confused:
[HTC Pico (Explorer)] no.human.being:
Yep I think that's what bhargz16 wanted. :good:
[HTC Pico (Explorer)] Neel.Aryan:
Hey no.human.being, how much are we putting in stake if we try the jtag method ??

M searching where to find it (required stuffs) in my city.
[HTC Pico (Explorer)] #define:
If you know what you are doing, nothing...

If not, everything...

Btw, what about the voltage-too-low issue?? If we can overcome that, jtag would work...

Nhb, i wanted to ask you something..

If you have the time and a little spare money, you could try to find a damaged explorer... we only need the board right?? You most probably still have the jtag stuff.. htc service centers in your city could help you out...

Food for thought...
[HTC Pico (Explorer)] Sachin Thomas:
Another option is to test whether the chainloader exploit can be modified to work on high end HTC phones with strong dev support. In our case the price of JTAG hardware may be higher than the price of the phone itself!
[HTC Pico (Explorer)] no.human.being:
Probably not so much. The biggest problem is that you need a lot of stuff to get it done. Tools to open the phone and remove the board, JTAG interface, JTAG adapter, regulated DC supply, the proper resistor values, lots of clamps and cables. And it's all pretty messy and a mistake might not only "brick" the phone, but indeed damage the hardware. If you're very careful the risk should be pretty low though. After all, my phone survived it all without any problems.
[HTC Pico (Explorer)] Neel.Aryan:
Well, finding all the stuffs is an issue in my state market (still searching though).

I have been thinking of trying it out. But until i m sure of exactly what procedure i have to follow, i believe the chances of happening a mishap are extremely high.

Need to take calculated risk as this is my only phone.
[HTC Pico (Explorer)] Sachin Thomas:
@no.human.being

Is the part of your chainloader exploit that disables the MMU, caches, etc universal? Do you think it will work on the MSM7225A without any modifications?
[HTC Pico (Explorer)] no.human.being:
I'm not even sure that it does what I expect it to do on an MSM7227. I actually "stole" it from (iirc) a Linux kernel without a lot of further verification. I just simplified it a bit so that it uses fewer (and other) registers. I also hardcoded this "main_prepare_execute_mask" value that the original code calculated from some other values. The features it uses are definitely part of the core (ARM), not part of the SoC (Qualcomm Snapdragon).
[HTC Pico (Explorer)] #define:
Any updates??

Anyone??

Becimester's making quite some progress!!

Hopefully we'll come up with a solution... (No time frames now)
[HTC Pico (Explorer)] no.human.being:
There's progress going on in the WFS thread. We post most stuff there unless it's Explorer-specific, since the WFS is where this all started, so most devs hang around there.
[HTC Pico (Explorer)] cute_prince:
@bhargz16,

Bro, once you had opened pico case for seeing motherboard ryt ? Do you happend to see anything like shown in the following pic ? Its UART3 serial port used in another MSM SoC .. I need to know if its present in our board also
[HTC Pico (Explorer)] #define:
I didn't see that hard, but if you want, I can check it again....
[HTC Pico (Explorer)] cute_prince:
Thanks bro.. pls check it :)
[HTC Pico (Explorer)] #define:
Will report by tomorrow... Sunday latest...
[HTC Pico (Explorer)] Sachin Thomas:
More Chinese stuff :p

http://124.127.119.48/download/06_%E4%BA%A7%E5%93%81%E6%89%8B%E5%86%8C/02_%E4%BA%A7%E5%93%81%E6%89%8B%E5%86%8C/5xxx%E7%B3%BB%E5%88%97/5913A_W650_%E4%BA%A7%E5%93%81%E6%89%8B%E5%86%8C_V1.00_120413.pdf
[HTC Pico (Explorer)] cute_prince:
@sachin,

Bro, you had brought really amazing stuff :) An entire Datasheet for MSM7225A SoC .. Although it is for Karbonn K-Touch W650, the device is extremely similar to ours.. Only difference I found is Camera and G-Sensor

---------- Post added at 11:00 PM ---------- Previous post was at 10:56 PM ----------

Datasheet sheet shows that both UART3 and JTAG headers are accessible :)

---------- Post added at 11:57 PM ---------- Previous post was at 11:00 PM ----------

@bhargz16,

Also bro take close-up pics of our motherboard ( both front and back sides ) if possible
[HTC Pico (Explorer)] cute_prince:
[setting up jtag for htc explorer]

Hey guyz, I found this video for connecting JTAG with HTC Explorer :)

[YOUTUBE]EDZpm1I0Z_U[/YOUTUBE]

Also, see the following pics.. It shows JTAG interface connected with Explorer's Motherboard :)

SOURCE: http://www.multi-com.pl/index.php/en_US,details,id_pr,8815,menu_mode,categories.html
[HTC Pico (Explorer)] #define:
This is awesome man!! Finally a working JTAG method!!

U still need those pics of the board??

EDIT : this is riff box ressurection method right?? To unbrick a dead phone... We'll probably be able to modify this to work with openocd...

Right??
[HTC Pico (Explorer)] cute_prince:
@bhargz16,

Yes bro, we can use the same RIFF box for on chip debugging too... See the following video, it shows on chip debugging with RIFF JTAG and GDB server using Samsung I9100 as example :) ..

http://jtagbox.com/RIFF_JTAG_GDB_SERVER_IDA_DEBUG_SAMSUNG_I9100.swf

Also, bro it would be really helpful if you could post the more close-up images of our motherboard :) .. I need this for locating UART3 Rx and Tx headers :)
[HTC Pico (Explorer)] Hpsgill:
U mean u already s off European ruu????
[HTC Pico (Explorer)] #define:
Nahi re...

I've just finished downloading European RUU.. Slow internet over here..

I'll experiment with it tonight..

I need somebody who can test it with me..

Anybody interested??

There's no risk involved.. If something does go wrong, all you have to do is reboot the phone..

So, anyone got the balls of steel?? :laugh:
[HTC Pico (Explorer)] cute_prince:
Hmm... in order to S-OFF we need the diagnostic file PJ03DIAG.nbh . Were u able to get it?
[HTC Pico (Explorer)] #define:
Almost.. Setting up Wine right now..
[HTC Pico (Explorer)] cute_prince:
Good work bro :thumbup:
[HTC Pico (Explorer)] #define:
Thanks.. BTW, I dont know if you know, but the people over at Wildfire S forum, wrote an exploit, which when attachd with a modified "shell code", can temporarily turn off security, so you get S-OFF until you reboot..

Thanks to 'no.human.being'(the genius guy who wrote the code), I have it with me, and I need some help with it..

Can you help??
[HTC Pico (Explorer)] cute_prince:
Yes, I'll help you ... can u post the link to wildfire S-Off'ing

Also does the exploit work for GSM version?
[HTC Pico (Explorer)] #define:
It was specifically designed for GSM version.. The DIAG file you mentioned, as you probably know, works only on CDMA devices.. A DIAG file basically wipes off all the user data, and that allows S-OFFing a CDMA device, since there is no SIM card slot..

Read the posts in this thread :

http://xdaforums.com/showthread.php?t=1374926

Especially the posts by "no.human.being", "theq86", "beci_mester", "antagonist42", "munjeni"..

But mostly "no.human.being"'s posts.. Those guys came up their own method, to S-OFF Wildfire S, and even succeeded, but then, HTC stopped manufacturing the device, so the thread went a bit cold..

I asked them for help, and they gave me the code they had written.. It worked there, and it should work here, with some modifications..

Wine is all set up now.. M gonna extract an RUU and do a test run..
[HTC Pico (Explorer)] #define:
Guys, can someone provide me with an HBOOT v1.03.0000??

You can find it in the ROM.zip file you extract from the RUU..

The RUU I downloaded has HBOOT v1.02.0000..

Also, I need a tester who has HBOOT v1.02.0000..

So if you're up for it, post here.. Or better, PM me..

Its not the code to S-OFF, but just something along the lines of a "test run", to see what more changes have to be made..
[HTC Pico (Explorer)] #define:
Alright guys, a "test" file is ready..

If it works, then it will display HBOOT version as 1.13.0000.. Thats all..

Now I need a tester who has HBOOT v1.02.0000..

Anybody up for it??

Edit : NVM.. Didnt work...

I'll patch up another file 2mrw...

WARNING : Before you do anything, make NANDroid backup of your system..

I shall take no responsibility for your actions..
[HTC Pico (Explorer)] cute_prince:
Thanx for the link pal.. I have one doubt, since we dont have ENG HBOOT how can we perform "fastboot boot " command as NHB suggested
[HTC Pico (Explorer)] xpmode:
I have HBOOT 1.02 but I can't help because this is my main device and I can't afford bricking it.

But I can help if I get a new device.
[HTC Pico (Explorer)] #define:
Like i said before, this is actually a pretty low risk procedure.. the s-off u achieve is also temporary.. all the changes u make, can be reverted back to original by simply rebooting the phone.. i just wrote that to remind everyone to take a backup, so if they do nethng wrng, thru their own fault, i wont be blamed 4 it..
[HTC Pico (Explorer)] #define:
Actually, from hboot v1.xx.xxxx, htc has included the fastboot boot command.. so we dont need an eng hboot... u can check fastboot commands in terminal/cmd prompt...
[HTC Pico (Explorer)] DanceOff:
I am ready to help in s-off is anybody is ready to buy me a few new explorer! because I guess 2-3 explorers would surely be bricked in the process !
[HTC Pico (Explorer)] #define:
Removed.
[HTC Pico (Explorer)] xpmode:
Calm down. No need to rage.

I'll help you when I get home. PM me what you want me to do.
[HTC Pico (Explorer)] #define:
Not raging man.. Its just that m excited to see S-OFF on explorer, what you saw was just a result of that excitement.. nothing else..
[HTC Pico (Explorer)] cute_prince:
I have hboot v1.03 and am ready for testing :) .. can you make the test compatible with hboot v1.03 instead of v1.02
[HTC Pico (Explorer)] Sachin Thomas:
This is awesome... but what about our processor's logic level?
[HTC Pico (Explorer)] #define:
Thats something we're gonna have to figure out by experimenting...
[HTC Pico (Explorer)] cute_prince:
I don't think our processor's logic level is going to be a problem with RIFF JTAG because the product says it supports HTC Explorer fully and its software also includes a built-in GDB server for On Chip debugging with IDA ARM debugger..

All this means it should be able to distinguish between logic high and logic low of MSM7225A :)

Only problem is..well money :D .. The JTAG itself cost 119 Euro which is about 8700 INR :eek: Connecting interface cost additional 14 Euro
[HTC Pico (Explorer)] #define:
Damn!! To be honest, i'd rather buy another device...

Cant we try to make a copy of the riff box, if we had the specifications???
[HTC Pico (Explorer)] SifJar:
You could always set up a donation. I'd say there will be a number of people about who would be willing to donate a bit.
[HTC Pico (Explorer)] zgintasz:
maybe you could lend it from someone :rolleyes:?
[HTC Pico (Explorer)] cute_prince:
I think donation is the only way to go .. See this link

http://www.aliexpress.com/item/Riff...0-Original-by-Rocker-Team-Free/629355752.html

Here I found they are selling RIFF JTAG for $130 ( about 6900 INR ).. This is the lowest price I found for RIFF JTAG on the internet
[HTC Pico (Explorer)] Sachin Thomas:
People who want to regain warranty by locking the bootloader may donate ;)

---------- Post added at 09:11 PM ---------- Previous post was at 08:51 PM ----------

Hey I forgot to tell something. I was able to reproduce this HBOOT reverting from NAND on the Explorer while experimenting with NHB's chainloader exploit last week. This happened when I added a few lines of code (at the beginning of main_prepare_execute) to overwrite physical memory content after (load_addr+length) with 0x00. It showed the HBOOT screen for a few seconds, then blacked out for a second and reverted instead of freezing
[HTC Pico (Explorer)] #define:
Send me a copy man...
[HTC Pico (Explorer)] Sachin Thomas:
Ok I'll send it tomorrow when I switch on my pc. I'm not an expert in assembly language so I don't know whether it does what I wanted it to do :)

Also it didn't check for any file on the SD card
[HTC Pico (Explorer)] Sachin Thomas:
Here's an encrypted archive containing the "reverting" HBOOT 1.03.0000 for explorer, along with the modified exploit code

Password is NHB's "official" password, which is impossible to brute force :p

You'll need to wait for a few seconds at the HTC logo to get to the bootloader screen

Edited:

View attachment loader.7z
[HTC Pico (Explorer)] #define:
Hey guys, i opened the phone, but my camera is just not capable of handling such detailing, as required by the board for anything to be read clearly...