yashsingh1/xdaforums huggingface dataset:
[HTC Pico (Explorer)] #define:
Thats what i am saying man.. look at these offsets in the hboot.s file.. specifically the 'readsecureflag' and 'writesecureflag' strings.. Becimester, the dev who located the S-OFF check in WFS hboot, did something like this only.. Searched for the strings S-ON and S-OFF in hboot(we have IDAPro so we dont have to load it in memory like he did), and then traced them back to a function.. So we have the offsets of everything related to S-ON/S-OFF present in an hboot file.. Have a look and try to find something.. I'm looking too.. Fortunately, I have a subject in this semester about registers and their working.. So I'm studying for exams and helping here at the same time.. A very nice example of "two birds with one stone".. :D

Anyway, back to topic.. If you need, get a hold of Becimester's patched hboot and an original hboot of WFS and compare them to see what has changed.. And how he changed it.. Compare the *.s files of both those hboots.. and see whats different.. That'll help us start where to look.. And also show us how he made the "magic function" to always return 0.. Will take time, but thats just how it is.. The two phones are much more similar than we thought..
[HTC Pico (Explorer)] #define:
Ok.. Yes, you can flash a NEWER hboot.. (Try flashing the newer hboot i uploaded..) But it should be signed by HTC, ie, shouldnt be tampered with.. Actually, HTC signs and encrypts their bootloader files in a very weird way.. So even if you try to flash a messed up hboot.img, it'll just give you a signature error.. So no hard bricks.. Also, you cannot DOWNGRADE hboots(atleast not on Pico).. If you try to flash an older hboot, then also it'll give you error.. So again, no hard bricks..

HTC phones are almost impossible to hard brick through software without S-OFF..
[HTC Pico (Explorer)] #define:
Also, try to analyze a dump of the 'misc' partition.. When you unlock your bootloader, in the process, one value is changed in the 'misc' partition, to display the string Unlocked instead of Locked.. And when we again lock it, the same function is set to display Relocked instead of Locked.. So if we were to, suppose, delete the Relocked string reference, then we could make our bootloaders say Locked instead of Relocked..

There is also something about S-ON/S-OFF in there.. If someone can, please post a dump of the 'misc' partition here..
[HTC Pico (Explorer)] #define:
Alright.. Here's some files..

http://www.mediafire.com/?ght7h8p0uc0500p

http://www.mediafire.com/?brxn6w75ndf7wa4

One is the original hboot version 1.03.0000, ie, the one I'm working on, and the chain_payload.7z is the modified hboot to change the version string(the pic i put up a couple days ago).. The machine code of the HBOOT v1.03.0000 is posted in post#123...

For those who feel wild(JK :D), have a go at it.. Extract the chain-payload.7z file, and the *.img file that comes out of it, boot from it using the command :

fastboot boot chain_payload.img

Only people with their phones having hboots version 1.03.0000 should try this.. will NOT work for others..
[HTC Pico (Explorer)] Sachin Thomas:
I have already compared them. And they differ only by two lines of code. But I don't know how to trace back to the function using the offset of the string

If what I've understood is right, to print the string "S-ON" on the screen, it's address should first be loaded into a register. So we are actually looking for some kind of load instruction that refers to the string "S-ON"

But we don't know anything about that instruction and the addressing mode used by that instruction
[HTC Pico (Explorer)] #define:
Yes thats correct.. We are looking for "ldr" or "str..." And remember that the first thing the hboot does when booting is the s-on/off check.. So its function, or function call, should be somewhere in the first few hundred lines only..

Also, could you post the lines of code that differ in the comparison you did?? Just out of curiosity.. :good:
[HTC Pico (Explorer)] DanceOff:
That's why I love htc :D

I hard bricked my previous android three times ie. Completely dead n no response at all !!

I will try tomorrow !

Can upload the hboot for me please ?
[HTC Pico (Explorer)] #define:
Post #130... :good:
[HTC Pico (Explorer)] Sachin Thomas:
These are the lines that differ

Original:

8b5c: eb00c6bd	bl	0x3a658
8b60: e3500000	cmp	r0, #0

Patched:

8b5c: e3a00000	mov	r0, #0
8b60: e8bd8010	pop	{r4, pc}

And here's a graph which shows the cross references to the magic function in WFS hboot
[HTC Pico (Explorer)] #define:
This graph... Can u make 1 for our hboot?? Or u jst found it??
[HTC Pico (Explorer)] Sachin Thomas:
Every subroutine has it's own graph. We can't make a graph for our hboot because we don't know the address of the magic function yet. I posted this only to show that there are multiple ways to reach the same function
[HTC Pico (Explorer)] #define:
Ok...
[HTC Pico (Explorer)] #define:
Does anybody know how to reassemble an hboot.s file back to an hboot.img/hboot.bin file??

"arm-none-eabi-as" doesnt work, because the file isnt disassembled properly..
[HTC Pico (Explorer)] Sachin Thomas:
Why should we reassemble? We can just make the change in a hex editor
[HTC Pico (Explorer)] #define:
I am trying that..

I was thinking we'd make changes in the hboot.s file, reassemble parts of the hboot.s file(parts with the changes), and change the corresponding values in the hboot.img(original)...

We could make changes in the original hboot, but we wouldnt know what to change, since its all hex values.. if we change the code and then reassemble, the hex values would automatically change in the binary file, and we'll just have to replace the original values with the new ones..
[HTC Pico (Explorer)] Sachin Thomas:
I think IDA has a feature that allows us to patch the code within it. I remember having used it for an x86 binary. Don't know whether it works for ARM. I just had to type the new instruction and it automatically generated op codes and other stuff
[HTC Pico (Explorer)] #define:
Tried that.. Not working for ARM.. Or maybe I am doing it wrong.. Will try again tonight.. In the meantime, please try and find some other way to reassemble..
[HTC Pico (Explorer)] SifJar:
Reassembling is unnecessary. Just assemble the replacement code (make a file with just the lines you want to replace, assemble that file) then copy the bytes with a hex editor to the correct place in the original HBOOT.img.

For example, with the code Sachin Thomas posted (the WFS code), the original HBOOT would have at 0x8b5c the following bytes:

eb 00 c6 bd e3 50 00 00

To patch the HBOOT, you'd just open the IMG in a hex editor, go to 0x8b5c, check those bytes are what is found there, then replace them with these:

e3 a0 00 00 e8 bd 80 10

To get these bytes for replacement, you'd make a .S file with the following:

mov r0, #0
pop {r4, pc}

Assemble that file and you'll get a file with the 8 bytes you need to put in the HBOOT to replace the original bytes. Replace the 8 bytes in HBOOT.img and you're done; the file is patched.

This is a better way to do it anyway, as it ensures no other bytes are touched at all, whereas with a full disassemble and re-assemble, it's possible some part of the code could get damaged in some way (mis-translated to ASM or back to binary).

EDIT: Of course, these values are for the WFS patch, not for Explorer. Values will obviously be different for Explorer.
[HTC Pico (Explorer)] #define:
Yes.. I figured it out just 5 mins before you posted this... :D (coincidence?)

Just like how we do with the exploit.. And the values for Explorer arent very different from WFS...
[HTC Pico (Explorer)] immortal_yash:
any progress???
[HTC Pico (Explorer)] #define:
Nt yet.. juggling between finding the "magic" function in the hboot, and exams.. so its going a little slow.. bt we have a lot of help and support now.. shouldn't be very long before we have s-off.... :thumbup:
[HTC Pico (Explorer)] vimjam:
awesome , work & progress everyone

brings back memories when REVOLUTIONARY used to support s-off for htc devices
[HTC Pico (Explorer)] cute_prince:
@ bhargz16 / Sachin Thomas

Do you have the patched (S-OFFed) hboot file of WFS by Beci_Mester and also the corresponding orignal (Unpatched) hboot file ? Can you post it here ?
[HTC Pico (Explorer)] Sachin Thomas:
View attachment hboot_unpatched.img

View attachment hboot_patched.img
[HTC Pico (Explorer)] cute_prince:
Yupee!!!....Hey folks, I located the S-OFF / S-ON checking routine :cool:

The routine is located at ROM:0000B6E0 :good:

See the rectangled portion below ...

The following image shows comparison between an unpatched and a patched (S-OFFed) hboot of Desire S .. See how they have changed the very same routine so that the function always return 0 (S-OFF)

They have used immediate instruction mov R0,#0 which will ALWAYS store 0 into R0 register and return it .

Now after applying the same changes we also will get S-OFF :)
[HTC Pico (Explorer)] #define:
Bro 1 thanks button isnt f****** enough!!!!
[HTC Pico (Explorer)] #define:
Got it guys!! Phone shows s-off!!!!! I'm tryng to take a picture... Will post in a couple minutes!!
[HTC Pico (Explorer)] Sachin Thomas:
Great news :good:

Now the only thing that's left to be fixed is the infinite loop, which is the most difficult part :)
[HTC Pico (Explorer)] #define:
Got S-OFF!!!

Alright guys.. The moment we've all been waiting for.. Atleast I have.. An S-OFFed HTC Explorer...

Here I have attached a picture..

The credits : (necessary)

1) no.human.being -> the awesome and patient dev who wrote the exploit code to basically S-OFF any HTC phone.. And helping me out with every little query, every noobish question, with all his heart..

2) cute_prince -> another awesome dev who located the S-ON/S-OFF routine check in our phone..

3) Sachin Thomas -> helping find the S-ON/S-OFF check by bringing the WFS codes here.. And clearing a lot of doubts I had..

4) Me -> as tester and taking pictures, and posting updates..... ;)

And everyone else who helped and supported..

Now we just have to figure out the problem of the phone hanging up..
[HTC Pico (Explorer)] satvik7star:
Sorry to spam but I am so freaking HAPPY. Was wandering this thread for the past month everyday. Infinity thanks to cute_prince, bhargz16 and sachin thomas(sorry if m missing someone)
[HTC Pico (Explorer)] #define:
Becimester's working on it... We'll also get it soon enough...
[HTC Pico (Explorer)] Red Devil:
Amazing stuff..Still cant believe it !!!!!! :D ...

Now you members will have to deal with Noobs like me hard bricking their phones..
[HTC Pico (Explorer)] DanceOff:
When it comes be sure to post it in DEVELOPMENT section and ask moderators to sticky it!!
[HTC Pico (Explorer)] #define:
Dnt worry bout spam bro.. Its the general section anyway.. And its fine with me, as long as it doesnt go off topic..
[HTC Pico (Explorer)] Sachin Thomas:
But most of the team members believe that it's impossible without on chip debugging via JTAG :(
[HTC Pico (Explorer)] no.human.being:
Oh guys you're amazing! And it seems like you did a good job in documenting all your progress. I'm gonna check back later and read the whole f*cking lot. Great job! Having contributed to this feels just so good. :D

And btw, I didn't exactly write an exploit to S-OFF any HTC phone. I just wrote an exploit that allows you to load an arbitrary APSBL (Application Processor Secondary Boot Loader). All the hard HBOOT reverse engineering stuff was done by BeciMester. ;)

EDIT: Btw, on our phone, HBOOT will only lock up (enter an infinite loop) when there is no SD card present. If an SD card is present, it will check for a file called "PG76DIAG.nbh" on the SD card (it's an HTC diagnostic file containing an ENG HBOOT executable image) and then (not depending on whether the file is present or not) restore the original HBOOT from the Radio, which will either boot into the ROM or enter the HBOOT menu (when Vol-Down is held). When this happens, the phone will revert to S-ON.
[HTC Pico (Explorer)] #define:
On explorer it locks up irrespective of the sdcard present... i tried both with and without card...

EDIT : Hey why does it lock up?? I missed that...
[HTC Pico (Explorer)] heavy_metal_man:
Nice job guys :D now we have 2 devices at this stage. Maybe we can pool together and work out just what is making the hboot fall back to s-on.
[HTC Pico (Explorer)] #define:
Yes bro.. thats the hope... :good:
[HTC Pico (Explorer)] #define:
Alright guys.. Now I need some help.. As you all probably know, there are several different versions of HBOOTs in HTC Pico... Now the S-ON/S-OFF check routines are located at different places in different HBOOT versions.. Now we got S-OFF in HBOOT v1.03.0000.... The help needed is that we need different hboots.. So if you have any "hboot.img" files, other than v1.03.0000, then post them here.. So everybody can have S-OFF...
[HTC Pico (Explorer)] #define:
Dont worry bro.. NHB is here.. I gave him the link to our thread.. So he's here to help.. We'll get more and more support now.. We're gonna join forces with the WFS team... So we can all work together on both the phones..
[HTC Pico (Explorer)] cute_prince:
@bhargz16,

I noticed there is no "Security Warning !!!" message :good:

bro upload the patched hboot :)
[HTC Pico (Explorer)] xpmode:
I have 1.02, how do I pull the hboot from my phone?
[HTC Pico (Explorer)] #define:
Ya I noticed that.. Its strange... I also just got it that one time... Dont know if I should be worried or what.. :confused:

Anyways, here's the patched hboot...
[HTC Pico (Explorer)] Gladiator00:
I also have 1.02.0000 HBOOT.. How to pull it out..?
[HTC Pico (Explorer)] siddharth1102:
Bhargav bro i have hboot.img from ruu n its not decompiling extracting properly. So, need some help that which software r u using to extract it??

P.s. Its 7xx kb can u tell me out whats size of the extracted one. If u want i can download different ruu's to give u hboot's.

Well nice work n reply ASAP i can at least edit those lines :)
[HTC Pico (Explorer)] Lt.Win:
Good job people. Now we pool our resources together and get this stuff done. Once and for all. Then we can laugh in HTC's face. :D
[HTC Pico (Explorer)] SifJar:
I don't think you can pull it off the phone, I think you need to extract it from an RUU.
[HTC Pico (Explorer)] #define:
Post that .img file only.. Thats what we need...

EDIT : And if you're willing to download RUUs to give different hboots, then please do.. I have very slow speeds here.. (Around 30 kbps) and I'm using those to download AOKP ICS source..
[HTC Pico (Explorer)] satvik7star:
I have hboot 1.00.0000blah blah. I made a nandroid backup of my stock rom. There is a boot.img inside it. Does that include the hboot?
[HTC Pico (Explorer)] #define:
Whats the size of that file?? If its 768.4 kb (or 768432 bytes), then post it here.. If its in MB, then its the kernel..
[HTC Pico (Explorer)] DanceOff:
No.

You made me laugh. :p

FYI it contain kernel ie. Ramdisk and zimage
[HTC Pico (Explorer)] #define:
Ok guys.. Some news.. I just tried to use the patched hboot.img without the SD card inserted in the phone, and it seems that if the HBOOT doesnt get an SD card to scan for "backup" files, it just skips booting into the patched hboot, and boots directly into the ROM instead..

Now this behaviour is different than the last time I tried to boot from the patched hboot.. During the time we changed the version of the hboot.. At that time the output was different than now.. And it seems this one has stuck.. Without an SD card, even after booting from the patched hboot, it just skips directly to the ROM...
[HTC Pico (Explorer)] cute_prince:
That happened to me for the first time only.. On the second try i was able to get into patched hboot even without SD card inserted .
[Acer Iconia A500] sleeplessnights:
Grettings everyone, I have been facing an issue for quite sometime now regarding my S3 and my wireless N-Extender (Cisco RE1000), whenever I'm connected to my router i get full speed internet and everything is fine, However when im connected to my extender I do get full signal but no internet, the extender works perfectly with my iPhone 4, but none of my android devices (S3,Acer iconia tab A501,Asus transformer TFT101), I tried using a static Ip address to no avail, and using Wifi fixer app didn't fix the problem either. Your help would be greatly appreciated.

Thank You!
[Sprint HTC EVO 4G LTE] juaxoo:
I've been trying to root my HTC Evo 4G LTE phone and I've run into some problems. I was able to root the phone with no problem, however I wasn't able to get S-OFF due to my HBOOT version. I flashed CWM 10 rom so that I could get Jelly Bean on my phone but every time I booted my phone up, it would just hang on the boot logo.

I researched a little more and I found out that I didn't have the right kernel to run that Rom. I read that I was suppose to Flash the boot.img from the Rom I wanted to install using the Flash Image GUI app. I did so, and when my phone rebooted, it goes straight to the Bootloader / Fastboot screen automatically. I can not get it to load the Rom I flashed.

Can anyone help me or lead me in the direction to get the rom to load correctly?

Thanks
[Sprint HTC EVO 4G LTE] T3CHW0LF:
I had the same problem when I first Jumped ship from Sense. Since you have S-ON you need to also flash the kernel of any aosp rom. So first things first do you have the android development tools installed on your computer?
[Sprint HTC EVO 4G LTE] juaxoo:
Yes I do. I am using a Mac if that helps in any way
[Galaxy Ace S5830 General] jumbobombo:
Heyyyy here's my story

I was on miracle rom with sd card partitioned via cwm and s2e installed

Used that rom for ages.. Flawless :D

Then saw PAC rom by Nims

Another epic rom used it it was amazing.... must try!!

So in this rom everything worked but the sd card partitioned was not recognized :confused:

No sd card partition found blah blah

Tried a lot of sh*t and the conclusion was sd card is not partitioned.

And so due lack of space i restored my CWM backup of miracle rom and voila my partition is alive :p

So sometimes a backup can partition your sd card :D

This really cracks me up :p

- - Greetings From India
[Galaxy Ace S5830 General] CallMeVentus:
You could've just posted that in OT....

Sent from Ursa's claws.
[Galaxy Ace S5830 General] codeknight11:
View attachment 1434487

My upcoming projects -

nOOb-Lite rom

CyanoETA rom, problem? :cool:
[Galaxy Ace S5830 General] eagleeyetom:
Damn. You are fast.
[HTC One X] laurent56480:
Hello,

We no longer have the cube animation when changing tab, for exemple in the application menu or in the clock menu.

Nobody has a solution ?

Thanks
[HTC One X] vbaros:
It's removed from Jelly Bean.
[HTC One X] laurent56480:
So it stay like this in the final version ?
[HTC One X] matt95:
probably it will
[Galaxy S III Q&A, Help & Troubleshooting] alias_neo:
Anybody else seeing issues with emails not loading if you swipe between them?

I had Paranoid Android for a while and the issue didn't exist there but I'v just switched back to the latest UK build of Stock (DLJ4 I believe) and the issue is back, it's driving me mental.

I'm hoping if anyone has come across the problem, that they've got a solution.
[Galaxy S III Q&A, Help & Troubleshooting] daniel_gsp:
x2

actually came here trying to find a solution or a fix to this situation...
[AT&T, Rogers, Bell, Telus Samsung Galaxy S III] vinuneuro:
In the past flashing through odin completely wiped and reset the device. Now for some reason it's just changing the version of the rom, kernel, modem, etc leaving everything else intact.
[AT&T, Rogers, Bell, Telus Samsung Galaxy S III] mrhaley30705:
Whether or not it gets wiped depends on a line of code in the cache file that's flashed with Odin. All the Odin stuff for us doesn't have it coded to wipe. There is a way to edit that so it does wipe, but i don't remember what it is. Just do a factory reset, should be the same effect.
[Galaxy S III Q&A, Help & Troubleshooting] sleeplessnights:
Grettings everyone, I have been facing an issue for quite sometime now regarding my S3 and my wireless N-Extender (Cisco RE1000), whenever I'm connected to my router i get full speed internet and everything is fine, However when im connected to my extender I do get full signal but no internet, the extender works perfectly with my iPhone 4, but none of my android devices (S3,Acer iconia tab A501,Asus transformer TFT101), I tried using a static Ip address to no avail, and using Wifi fixer app didn't fix the problem either. Your help would be greatly appreciated.

Thank You!
[Galaxy S III Q&A, Help & Troubleshooting] JJEgan:
Not working on any Android suggest contact Cisco/ or Cisco forums .

jje
[Motorola Atrix 2] jm2k7:
wtf, I'm having problems and I get this error randomly,

"SIM not allowed MM#3" I get this error and it stops working the sim card.

I have to be constantly alternating between airplane mode and normal, so it stays.

I had this error from 2.3.6 and now in the new 4.0.4 ota remains,

is hardware problem?, clarified that this phone will not I have an AT & T simcard, this phone I bought and brought to another country with another operator.

They are freed buy phones that AT & T, I wonder if it's a problem with the AT & T bloatware that interferes with this.

:(
[TouchPad Development] shumash:
This is a build of the ParanoidAndroid 1.6a framework to the HP Touchpad.

ParanoidAndroid is an ICS ROM, based on CM9, that allows users to enjoy tablet or phone UI, or hybrid.

Most apps have several different UI's for various layouts, choose which interface you prefer.

FULLY compiled from source. (See post #2 for build instructions)

Current with tenderloin CM9 repo w/ all functions

100% easy install; just wipe cache and dalvik.

HW acceleration

I'm just a furniture mover... anything you like or appreciate in this ROM is 100% the work of the CM and PA teams. We owe a great deal of praise and thanks to those spirited, dedicated developers and contributors who keep our TP alive and well, especially jcsullins, OaT, SGA, _Dorregaray_, & BIGSimon.

Once CM10 for tenderloin is stable, I will try to compile the latest PA version for the TP.

From one of the PA creators, molesarecoming...

​

Screenshots:

Downloads

10/26:

ParanoidAndroid 1.6a for Tenderloin Google Docs Direct Link

You will

need

to install a unique gapps package, as Google blocks market access with non-standard DPIs. (Fixed GAPPS) gapps fixed direct link

User Notes/Bugs

If you don't see navigation buttons in the navbar, go to Settings->System->Navigation Bar->Softkeys and click the checkbox

In the settings, you will see a new pane for Paranoid Settings. Here you can adjust the default GUI and DPI for all system or user apps, or even each app individually ( I suggest a default dpi of 155, it matches perfectly with the 9.7" screen)

Long press of power button does NOT bring up a reboot menu, it just reboots. I suggest downloading Quick Reboot to get the same functions.

When you open an application, you'll see three dots appear in the Recent button in the navbar. Short press produces the recent apps list, long press gives you the application's option menu.

Processor OC settings don't persist. It always defaults to 1188 max,, 384 min. (this is funky, sometimes they do, sometimes they don't)

Special thanks are due to:

rohan who got me started

mateorod who got me finished, is a tremendous resource for XDA-Developers and without whose help and support this ROM would not exist.