yashsingh1/xdaforums huggingface dataset:
[HTC Pico (Explorer)] shortyoko:
Ok I have this hboot version, I can try what ever you guys wan't, just somebody have to say is it 'safe'(and procedure, what to do if I f@#k up something), also details about what to do, what details do you need(if you need some), and stuff like this. I'm a noob (not afraid to admit it) but I'll do my best to help out about this. If you guys wan't this thread to stay clean send me a pm.

Edit: I can help in about 2-3 hours, now I'm in the office and here.....
[HTC Pico (Explorer)] ngoralph:
@bhargzFor real its really s offed???? I'm not sure whether its really scoffed or not did you check it already
[HTC Pico (Explorer)] #define:
Run this with your phone in fastboot mode :

fastboot boot hboot.img

See if it boots..

Sent from my Nexus 7
[HTC Pico (Explorer)] #define:
I didnt check it out, coz i dont have this hboot version..

We'll know soon enough...

Shortyoko gonna tell us...

Sent from my Nexus 7
[HTC Pico (Explorer)] ngoralph:
I think he's afraid of bricking the device any way to restore it if something f*cked up???

---------- Post added at 11:02 PM ---------- Previous post was at 11:00 PM ----------

Cant we use xtc clip for soff???
[HTC Pico (Explorer)] Sachin Thomas:
We can't fastboot boot because it's not an android image

Does anyone have the link to original 1.01 HBOOT?

---------- Post added at 08:43 PM ---------- Previous post was at 08:33 PM ----------

It's totally identical to stock HBOOT image :mad:
[HTC Pico (Explorer)] ngoralph:
what?! :eek: never thought chinese websites would lie about that

sorry for the false info guys
[HTC Pico (Explorer)] Sachin Thomas:
Can you post the link to the chinese website? I never thought that chinese websites would allow you to download something without "points"
[HTC Pico (Explorer)] shortyoko:
Yes I was afraid of brick, but after a little thinking, if I flash the original hboot, after this everything should be fine, so it will be no harm done. As I stated before, I'm at the office (and it's kind a impossible to do anything) and will do it around 19:00 now is 18:22 here (if there is no big traffic jam, if there is I'll be home around 19:20)

uuu now I read all previous reply's, should I try it anyway

Sorry for being late, in 10min. I'll be at home, so how can I back up my hboot.

And nothing happened........... as expected
[HTC Pico (Explorer)] Red Devil:
Bump. Dead end is it?
[HTC Pico (Explorer)] ngoralph:
http://android.zuibao.net/anzhuo-thread/6761/1/1.html

registered an account (using QQ)

then posted something in the thread (to get dl link)

clicked the link

redirected to DL page on goo.im

then downloaded

extracted hboot
[HTC Pico (Explorer)] abhinavthms:
And...??:confused:

What result did you get?
[HTC Pico (Explorer)] no.human.being:
Not exactly. I don't have a lot of "real-time contact" to devs at an Explorer though. What I do have though is contact to devs with an HTC Butterfly. However, this is not their full-time job either, so progression is slow. The fact that this is now the third platform (1st HTC Wildfire S (MSM7227), 2nd HTC Explorer (MSM7225A), 3rd HTC Butterfly (not sure - iirc they said MSM8960, Wikipedia says APQ8064 though)) on which we bootstrap the exploit doesn't make it very efficient either.

It slows things down incredibly if you have to collaborate with other people so deeply. I mean I currently don't have ANY of the platforms that we support. I need to find people with HTC phones, explain to them what the exploit does, ask them details about their platform, explain how to build the exploit, then they build and test it and say for example "doesn't work, stuck at HTC splash screen". Then I have to go through each and every detail until I find something that's wrong, tell them how to fix it, let them rebuild, test it again and so on. This is an enormously slow process, especially when people are "busy" and take three or four days to make each adjustment, test it and return the results.

The HTC dev scene appears to be dying rapidly. This is mostly HTC's (and Qualcomm's) own fault. If you lock a platform down, devs migrate away, that's the way it goes. And as the devs migrate away, the platform gets less and less supported, as fewer and fewer devs optimize for it or test on it, so the overall quality of apps and ROMs for that platform goes down and soon users will follow the devs and migrate away as well. Let's face it, HTC and Qualcomm have initiated their own product's death.

I'd like to continue supporting the platforms, even if they're dying. Supporting abandoned/legacy platforms is a fun task. However, I can't do it on my own, since they're not my "home" platform either.
[HTC Pico (Explorer)] chikanchilly:
Even if somebody gets the vague idea of donating an HTC explorer to you?
[HTC Pico (Explorer)] no.human.being:
Want to remain anonymous, therefore can't accept shippings or payments. Can't guarantee for success either and don't want to disappoint anyone. Sorry. :(
[HTC Pico (Explorer)] #define:
To be really honest, i'm really glad we all came this far!! :D

Sent from my Nexus 7
[HTC Pico (Explorer)] Red Devil:
Meanwhile, Elsewhere :P

HTC One
[HTC Pico (Explorer)] #define:
Will do tonight.. i have to dwnload an ruu that has hboot v1.03..

If u hv it, could u pm it 2 me?? I have a slow net, so it'd take me around 4 hrs 2 dwnload an ruu.. seems kinda pointless 2 dwnload everything 4 1 file, if sum1 has it..
[HTC Pico (Explorer)] xpmode:
I'm home and ready to test.

Can you send the file?
[HTC Pico (Explorer)] #define:
Will do ASAP....
[HTC Pico (Explorer)] petar258:
hboot 1.03.000

I have no attach option in pm, so i attach hboot here. I have hboot 1.03 in phone too and can test s-off.
[HTC Pico (Explorer)] xpmode:
Well, sadly HBOOT testing for 1.02 failed, stuck in HTC logo.
[HTC Pico (Explorer)] #define:
Thanks for the file..

Ok.. So now we know that there is something wrong with the code.. It doesnt get initialised properly.. I'll give you a new file..

But this time it'll take longer(a week or so) as I have some term work piling up.. Will have to finish that first..
[HTC Pico (Explorer)] xpmode:
Take your time.

In the meantime, should I get HBOOT 1.03 or stay with 1.02?
[HTC Pico (Explorer)] #define:
No no you stay on 1.02..

We will have to modify every hboot version there is.. so far i've come across 3.. 02,03,n 04..

So we have to modify 3 hboots..

N we'll be needing testrs 4 every version.. so u stay on 02.. once we get soff, thn u cn upgrade..

Will that be ok??
[HTC Pico (Explorer)] rajko666:
my HBOOT version is 1.07
[HTC Pico (Explorer)] #define:
WOW!!! How many hboots are there??
[HTC Pico (Explorer)] rajko666:
how can i get another HBOOT version? i have problem with calls on CM10, and dev said it's HBOOT version related

Sent from another dimension with my shoe
[HTC Pico (Explorer)] #define:
Ur hboot version seems to be the latest.. sadly, u cannot downgrade hboot version..

And there is absolutely no relation between hboot and calls on ur phone..

Maybe they meant something else.. calls could be related to radio..
[HTC Pico (Explorer)] rajko666:
ohh i see, tnx...i had HTC Wildfire/Buzz, and there i could downgrade HBOOT version

i don't know, i hope it would be fixed when CM10 beta1 gets released :)

Sent from another dimension with my shoe
[HTC Pico (Explorer)] #define:
Yes in buzz ut was necessary for the revolutionary method right?? But our phone is a legacy device, so we have to do it ourselves..:sly:
[HTC Pico (Explorer)] rajko666:
yes, you are right :)

i had download all files from wildfire section for that i tried to see how it can be done for our pico, but i don't understand a thing

Sent from another dimension with my shoe
[HTC Pico (Explorer)] #define:
Revolutionary doesnt wrk for phones other than they specified.. Nothing woupd happen even if u try..
[HTC Pico (Explorer)] immortal_yash:
looks like i have the oldest Hboot out here... HBOOT-1.00.0000 and RADIO-1.10.81.17
[HTC Pico (Explorer)] Hpsgill:
My hboot is 1.02
[HTC Pico (Explorer)] #define:
1.00???????????????????????????????????? Does your Hboot support the fastboot boot .. command??

How many versions are there?? Could somebody tell me how many HBOOT versions there are for Explorer?? I've found 4(and counting, apparently)..
[HTC Pico (Explorer)] immortal_yash:
Obviously it works that how I could unlock my bootloader...I have a rooted phone with ICS on it come on...
[HTC Pico (Explorer)] BleedingIris:
Deleted
[HTC Pico (Explorer)] gnustomp:
Meanwhile, elsewhere, a thread was closed eh?
[HTC Pico (Explorer)] no.human.being:
Exploit development for the HTC Butterfly (APQ8064) has stopped. The exploit had the same problems as here (reverted). Devs then found out that firmware is not installed by HBOOT at all, but by TrustZone (a hardware virtualization layer by ARM - it's not a Qualcomm thing, all newer ARM cores have it), so this exploit won't work.

The HTC Butterfly is an eMMC-based device, so the MPU is embedded into the memory, not the processor. For this reason, a hardware-based attack (shorting out the power supply to the memory) might work. There is also a vulnerability in TrustZone, which might be exploited by software means, but it has nothing to do with loading a hacked APSBL.

Sorry. :(

This doesn't mean that the exploit won't work on the HTC Explorer (MSM7225A) however. That chip is NAND-based and doesn't have TrustZone yet. Any ideas on what causes the HBOOT to revert so we might patch that out?
[HTC Pico (Explorer)] #define:
Could you elaborate TrustZone??

ғг๏๓ ҭђє ғเรђ™
[HTC Pico (Explorer)] no.human.being:
Can't tell you more than you find on the ARM website. You know we talked about Iguana and HBOOT/Android running concurrently on the same hardware in a time-sliced manner on top of a virtualization layer. The virtualization layer was custom-made by Qualcomm and was mostly in firmware.

Now on the newer ARM processors (ARMv7 = ARM Cortex) this virtualization layer is the same for every ARM (no longer SoC-specific) and is implemented mostly in hardware.

The thing is, the people at the HTC Butterfly found out that the eMMC is already protected before APSBL (HBOOT) even runs for the first time. So APSBL (HBOOT) can no longer update the Radio or itself on these phones. A lower-level component (SBL, bootloader of the Radio) has to do it. After SBL is through, the MPU is already configured and the "Radio area" write-protected. Contrary to our chipset, it is only write-protected. They can read everything (including the secu_flag) when the phone is booted, but they can't write to it.

On the other hand, on our chipset, we can't even read most of the Radio area. The Radio (Iguana) is intercepting reads via the NAND MMU. They probably set a null-pointer to these pages. Whenever the virtual address is accessed (read or written), the MMU fires an interrupt that Iguana can then handle (return the NAND content on a read access, write the content to NAND on a write access, return 0xff or some other "manipulated content" on read).

This probably means that on the newer chips, fixed storage is no longer behind an MMU (memory management unit), but only an MPU (memory protection unit). An MPU can only permit or reject requests, while an MMU can do more "sophisticated stuff" (e. g. address translation, interrupt handling, ...).
[HTC Pico (Explorer)] #define:
How long has it been around??

Because the Explorer is an ARM Cortex - A5, and their website lists this under TrustZone..

ғг๏๓ ҭђє ғเรђ™
[HTC Pico (Explorer)] no.human.being:
Yes, but TrustZone might only be that bad in conjunction with eMMC memory. I'm not sure.

The thing is, eMMC has a memory protection mechanism built into the memory itself that can't be reset without power-cycling the memory and the memory power supply is handled by a GPIO that's under control of TrustZone. On the other hand, NAND is protected by a dedicated NAND MMU on the SoC, which monitors addresses hitting the EBI2 (slow bus).

The NAND MMU can always be reconfigured by a trusted piece of software, while the eMMC protection requires you to power-cycle the eMMC device to reconfigure memory protection. That's the major difference. You can reconfigure the NAND MMU at any time (at least on the MSM7227), but eMMC protection only at boot. And this happens before APSBL (HBOOT) is even loaded, so hacking APSBL (HBOOT) makes no sense on an eMMC device with TrustZone (without TrustZone you could reset the eMMC from aARM). However, it might make sense on a NAND device. That depends on whether aARM can still configure the NAND MMU on a TrustZone-enabled device, like it could on the early devices. If it can, the exploit will probably have success once you prevent the bootloader from reverting. If if can't (e. g. only mARM can configure the MMU), chances are you're out of luck. In that case, the MMU will be under Iguana's control and HBOOT won't be able to configure the MMU.
[HTC Pico (Explorer)] ghori1989:
I have the 1.01.0000 hboot on my device. I downloaded the "s-off" hboot and flashed it. It did not do anything. The phone is still s-on

I dont mind if i brick this device as i cant find the stock t-mobile RUU for it.

Anything else that you want me to test let me know :cool:
[HTC Pico (Explorer)] anu007:
s-0n

guys so how i can check that my phone is s-off or s-on
[HTC Pico (Explorer)] kirmaniarslan:
Your phone should be S-On because there is no method discovered for htc pico to S-Off :silly::silly:
[HTC Pico (Explorer)] tatiraju.rishabh:
Same what arslankirmani told :P

If you really wish to see it, power off your phone, remove battery, re-insert it, then power on your phone by pressing Lock + VolumeDown.

You'll enter a white screen which is called Bootloader, it will show wheter the phone is s-on or s-off. If your rom provides the feature, you can directly reboot to bootloader.
[HTC Pico (Explorer)] nicat93:
Are we going to see our pico s-offed before we die :confused:
[HTC Pico (Explorer)] #define:
No..

Now where did I send this from?
[HTC Pico (Explorer)] :
What wud b the benefits of an S-Off phone ?

:D sorry new to htc

and one more thing

like samsung phones have Odin if they get bricked ...is there anything similar for htc devices specifically pico....

Sent while waiting for my pico :D
[HTC Pico (Explorer)] nicat93:
I want S-OFF because of an application called freedom. Which is used to buy ingame stuff without paying anything :P. It requires S-OFF without S-OFF it works but GooglePlay doesn't work sometimes. And if you delete freedom without stopping it from it's menu(Without S-OFF you can't go to menu in the program) you can't use GooglePlay anymore. So that is why I need S-OFF :(

-----------------------EDIT-------------------

Looks like new versions of freedom doesn't need S-OFF. Soooooo YEAAAAAAHHHHH I can use it !!!!!!!
[HTC Pico (Explorer)] reshampanth:
Confused :/

I am running cm10.1 without S-Off. Any risks??:eek:
[HTC Pico (Explorer)] #define:
No risk..

Now where did I send this from?
[HTC Pico (Explorer)] reshampanth:
:D:D Thanks ;) I just didn't wanna brick or burn nand or stuff ;P

Just for Safety :victory:
[HTC Pico (Explorer)] no.human.being:
Qualcomm chips have "download mode", which is basically like "Odin mode" for Exynos/OMAP. It's proprietary and undocumented though. Don't know if there are any applications to use it. Would have to reverse-engineer the protocol to create such an application.

Btw. Heimdall is better than Odin.
[HTC Pico (Explorer)] #define:
[MENTION=4799442]Sachin Thomas[/MENTION] once mentioned the download mode, during his experimentation(dissasembly) with the hboot..

PS : long time no see.. :)

Now where did I send this from?
[HTC Pico (Explorer)] Sachin Thomas:
It was seven vibrations followed by a power down (and reboot into recovery as the device was connected to USB). I'm not sure whether it was download mode.

For the last few months I was too busy with my studies and project work and now my PC is dead :(
[HTC Pico (Explorer)] <JohnCarter>:
bump !!

sorry guys might be vague thingy..

but i tried gfree(used to achieve s-off on htc vison)

this was the command set :

shell@android:/data/local # ./gfree -f
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.38.6-gf9c359f
New .modinfo section size: 204
Attempting to power cycle eMMC... Failed.
Module failed to load: No such file or directory

so the problem is afaik and see above is with power cycle eMMC , and as no.human.being said " The NAND MMU can always be reconfigured by a trusted piece of software, while the eMMC protection requires you to power-cycle the eMMC device to reconfigure memory protection. "

i think we have nand MMU. as power cycling did not succeed for pico.
[HTC Pico (Explorer)] no.human.being:
Yes, the HTC Explorer has NAND storage (and therefore a NAND MMU in the SoC). GFree won't work.
[HTC Pico (Explorer)] <JohnCarter>:
#just asking : if power cycle is for emmc , then what's the procedure for a basic nand mmu ?
[HTC Pico (Explorer)] jotha:
Thread cleaned

Now this thread had been totally derailed.

Last time I checked OP it was NOT about roms, superuser or recovery flashing!

So please guys stay on topic and post your questions about other things than s-off in the respective threads in Q&A subforum.

cheers
[HTC Pico (Explorer)] no.human.being:
Afaik the page tables are stored in volatile memory (RAM). You can modify them there. The problem is that you need the appropriate privileges to do so.

NAND-based Qualcomm chips have a kind of "virtualization layer" and all "user code" (including the bootloader and operating system) executes inside. If you want to have control over the NAND MMU, you have to "break out" of that virtual environment somehow and execute code in the context of the hypervisor.

The problem is that this is all confidential and proprietary so we don't really know how this all works, where the data structures are stored, in what format they are, etc. It's all undocumented. The Qualcomm chip is specified in terms of the "virtual environment" it provides, since that is all that the OEM and the developer will ever see. What's below doesn't matter to the customer. Only the hardware and Qualcomm-internal firmware will need to take care of these low levels of operation, so it is not disclosed. And that's why it's hard to break. It's complete "security through obscurity".
[HTC Pico (Explorer)] t-mobile_mda:
hi guys..

where is the S-ON part in Pico..? in hboot..? or where..? i want to compare it with hex match.. i have a device with S-ON. and i can do it S-OFF with special card.. before the action i wanna take backup which part has S-ON..
[HTC Pico (Explorer)] t-mobile_mda:
guys i have riff and pico with s-on. and i can s-off it with special S-OFF card.. now i will backup riff dump all partioans, then S-off then again backup full dump with riff and compare with hex compare..maybe it can he usefull for S-OFF..
[HTC Pico (Explorer)] #define:
Looking forward to your results..

Could you please give some details about the s-off card??
[HTC Pico (Explorer)] t-mobile_mda:
this card does S-OFF mostly HTC Devices..

arm-none-eabi-objdump -D -b binary -m armv5 hboot.img > hboot.s

this command is not working for me.. when i enter this command i m getting Read-only file system.

---------- Post added at 02:59 PM ---------- Previous post was at 02:49 PM ----------

and the final question,

how can i take necessary file (hboot or radio or another) for S-OFF with adb shell.?
[HTC Pico (Explorer)] noahvt:
Hey guys!

since the pico and golfu are sort off similar i would like to know how you achieved the s-off (if you have done it?) htc is not willing to help us out with it : \
[HTC Pico (Explorer)] Parth_14:
We havent achieved it yet! :/
[HTC Pico (Explorer)] noahvt:
:( i think htc doesn't really care about these devices anymore (send a e-mail about it and reaction was that they don't support it) has anyone tried it with the xtc clip?

EDIT: even diag mode doesn't work in my c
[HTC Pico (Explorer)] noahvt:
I might have a solution for the desire c : put PL01DIAG.nbh on a gold card and let hboot do the rest!

It might work on pico (with a different nbh ofcourse)
[HTC Pico (Explorer)] abhiparmar92:
Can u plz explain what's the gold card??
[HTC Pico (Explorer)] klavyeteur:
A Gold card is a special SD card which when inserted into your device allows you to flash RUU files with a different CID to your own device (for flashing not verified data files)

S-OFF/S-ON

Security-ON/OFF. Making your device S-OFF means, you are able to write to the /system partition of your device while Android is booted up. With S-ON devices, you can only write and modify files on the /system partition in recovery mode.

http://xdaforums.com/showthread.php?t=805247

similar devices, developers do not help you ask? like htc desire ? sorry for my english
[HTC Pico (Explorer)] noahvt:
tried it: got SECURITY FAIL, UPDATE FAIL!, PRESS POWER TO REBOOT
[HTC Pico (Explorer)] t-mobile_mda:
my device S_OFFed with special DIAG file.. Cleaan S58.. we need to find DIAG files..
[HTC Pico (Explorer)] abhiparmar92:
But which is ur device??
[HTC Pico (Explorer)] t-mobile_mda:
HTC Pico (Explorer)..
[HTC Pico (Explorer)] Sachin Thomas:
So, S-OFF using DIAG file doesn't require an engineering sim on a GSM device?
[HTC Pico (Explorer)] abhiparmar92:
So u have S-OFFed htc explorer?
[HTC Pico (Explorer)] swordfish:
So guys you are making S-OFF possible for pico