yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] S-trace:
Yes, You can lock your bootloader.

Just carefully read all posts in this thread to completely understand what are You going to do, then connect turned off Evo to PC, wait for a while and use script from post #8 of this thread as ./adbflasher exportfs emmc to Your Linux box, then use Your favorite HEX editor to write correct data into all partitions that was changed during unlocking process.

Writing on partition 3 0x00000000 at offset 0x8404 for locked is only really needed thing (You may even use CWM and flashable package from post #18 to do this), and Bootloader will locked, but if You can now completely restore all data that was erased during unlocking process - why don't do this?

Then just flash full RUU PG86IMG.zip with Your favorite version of ROM.
[HTC EVO 3D] abhi_nagpure:
HTC Dev workaround

Sorry Buddy

I have been busy with some other work, so couldn't reply,

I am trying http://xdaforums.com/showthread.php?p=34583031 this method to get Temproot than edit mmcblk0p3 for unlock my handset

Also to let you know as I was talking to HTC Service guys they are saying that motherboard replacement is nothing to do with unlocking bootloader process.

will the above process work for EVO 3D please look into it, & verify.

Thanks

---------- Post added at 11:34 AM ---------- Previous post was at 11:30 AM ----------

Can you send me your mmcblk0p3 so I can try editing it in meanwhile cz I am still not completely familiarized with Hex Editors
[HTC EVO 3D] abhi_nagpure:
Hey I have managed to get temp root with method described here

http://xdaforums.com/showthread.php?t=1986346

I am sending you my mmcblk0p3.img please look into it.

I am also doing it, please let me know what happens
[HTC EVO 3D] ravione:
Hi Guys!

I have a similar problem. My motherboard died right after I've taken my phone out of a box so I'm very lucky guy ;)

Now I'm stuck on stock 4.0.3 android with sense 3.6, hboot 1.53.0007. I'm also in contact with HTCdev but till now they haven't been much help. At the start my phone was on a 2.3 and only thing I did after the mainboard problem is to update via OTA to ICS. I'm willing to be a test subject to any new fixes or to give any information I can about my phone. Is there any way to downgrade bootloader to 1.49 so we can use revolutionary instead of HTCdev way?
[HTC EVO 3D] abhi_nagpure:
Revolutionary way doesn't give you perm. Root so We are trying to get it some other way.

I managed to get temp root successfully with above process
[HTC EVO 3D] ravione:
Maby I'm mistaken but I thought that revolutionary gives you S-off and unlocks the bootloader. After all that and all you need to do is to install recovery and flash custom rom wich is already rooted. At least that was the case with my old Desire.. Or am I wrong?
[HTC EVO 3D] abhi_nagpure:
Revolutionary gives you S-OFF so you can freely install any rom you want.

But for Permanent Root you have to unlock your device through HTCDEV.com,

As far as I know their is no tool for perm. root for EVO 3D
[HTC EVO 3D] S-trace:
Another research! ^_^

Your image is very interesting. It have found next differences:

0x424 - 4 bytes differs (as for all un/relocked images I have seen before) - let's call those bytes as security_key (because it's placed near "security" word). I have seen only 2 locked images from "clean" board, and this key was same.

0x824 - 4 bytes differs (as for every image I seen) - let's call those bytes as simlock_key (because it's placed near "simlock" word)

0xC24 - 4 bytes differs (as for another image from MOBO-replaced phone) - let's call those bytes as simunlock_key (because it's placed near "simunlock" word). I think it's can be different for SIM-locked phones. Not sure.

0x8400 0x03 - I'm never seen this before! It's placed right before 0x8404 - HTCL/HTCU offset. It was 0x00 on all images I'd seen before, including another MOBO-replaced phone (and owner of it had successfully unlocked it via HTCDEV - I have seen HTCL in image).

0x9400 - 16 bytes differs (as for every image I seen) - let's call those bytes as device1_key

0x9410 - another 16 bytes differs (as for every image I seen) and it's repeated 265 times - let's call those bytes as device2_key

0xA800 - device2_key repeated 32 times

0xAD00 - 256 bytes, I have seen data in this offset only in another MOBO-replaced image. Let's call it mobo_key

0xB100 - mobo_key again.

It's crazy idea, but what if mobo_key is Unlock_code.bin for Your board? Please try to flash it using fastboot flash unlocktoken Unlock_code.bin

Or it's fastboot oem get_identifier_token ? Please try to do this and post results?

Here is 3 versions of Your image:

unlocked - just HTCU written at 0x8404

fixed - just 0x00 writen at 0x8400

unlocked fixed - all of this done
[HTC EVO 3D] abhi_nagpure:
I tried every thing I guess no luck cz it still says LOCKED.

I am attaching herewith workthrough

I have also got mmcblk0p4 & mmcblk0p31 out so I can try supercid & downgrade method.

But still I want to try out everything possible on hboot 1.53 cz their are many people with same problem & we could help them.

0x8400 0x03 - I'm never seen this before! It's placed right before 0x8404 - HTCL/HTCU offset. It was 0x00 on all images I'd seen before, including another MOBO-replaced phone (and owner of it had successfully unlocked it via HTCDEV - I have seen HTCL in image).

how did he got unlocked through HTCDEV can you ask him

& for my info can revolutionary method gives me perm. root or not. please tell me
[HTC EVO 3D] S-trace:
If You mean S-OFF by the words "permanent root" - NO. You need 1

.49

.0007/1.49.0008 HBOOT.

Can You write image to partition, cold reboot Your Evo, read partition to another image, then do diff /sdcard/mmcblk0p3.img.written /sdcard/mmcblk0p3.img.now ? if files are identical - data was stored in memory, if differs - we are out of luck, S-ON blocks write access to thoose memory areas.

I have asked him how did he unlocked and waiting for answer.

And You didn't showed fastboot oem get_identifier_token

Oh, are You really using windows? It's bad(

Warning: next are unsafe and may BRICK Your Evo. But, if You really want...

Try booting Your PC to Ubuntu from HTC Unbricking project, then do wire trick from Junoputbear S-OFF method (if Your Evo will go into QHSUSB_DLOAD and detects as USB drive - You are lucky, because in such mode You will have full write access to Your Evo's internal memory from PC), then write edited mmcblk0p3.img.

You can also try to write Junoputbear HBOOT (1.53.7777 or something like this, NOT 1.49.0007 coming with HTC Unbricking project) using tols from HTC Unbricking project.
[HTC EVO 3D] abhi_nagpure:
is it right that I can downgrade hboot to 1.49. To get revolutionary method S-Off, but then I can only flash any Rom through recovery but cant get full root access.

And I guess I can't really get ubuntu on my pc cz I haven't used linux from 5-6 years and now can't format my pc now.

About unlock identifier can it help if I give u my handsets both the serial nos.

Yes my handset has two different serial nos one in battery compartment and phone identity in about menu.
[HTC EVO 3D] S-trace:
Man, what are You want from Your Evo? I had locked bootloader with Revolutionary S-OFF 7 mounth, and haven't any problems with it. I unlocked mine bootloader only to use fastboot boot command. And WHAT ARE YOU CALL "FULL ROOT"???

It's no need to format HDD, just use Unetbootin and write image to USB Flash drive, then boot from it - HDD will be untouched.
[HTC EVO 3D] abhi_nagpure:
I had nexus s before this and was using MIUI on it.

I just want to use MIUI on my EVO with superuser rights nothing else.

Full root means can I use Titanium backup and other apps which need root access

Thats all I wanna do :rolleyes:
[HTC EVO 3D] S-trace:
To use miui You will need only flash it, AFAIK it based on stock kernel.

How You can access partitions over ADB, can't You temporory put Superuser.apk and su binary to /system, even if it will last only until reboot?
[HTC EVO 3D] abhi_nagpure:
So if we succeed in unlocking bootloader Su will be there even if I reboot.

I am getting confused. Sorry on my nexus I just once unlocked bootloader flashed CWM and then just flashed MIUI every week.

I thought I'll need to unlock bootloader first, then S-OFF, then flash CWM, then MIUI and done with my old way.
[HTC EVO 3D] ravione:
HTCdev unlock

Hi guys!

I finally managed to get response from HTC regarding my phone! They said that I should send them my original serial number and token identifier form HTCdev and thay will create a new token identifier for my device based on this info, and share the new token with me, so I can use the new token to unlock my device! :D And now I'm waiting for my unlock code :D So all you guys that have problems unlocking their phone after motherboad change, simply call or mail HTC about your problem..

I hope this will help. Cheers!
[HTC EVO 3D] jcase:
It is my understanding, and experience that /dev/block/mmcblk0p3 is write protected on S3/S4 phones. So I have to go out on a limb and ask, are you already s-off? A s-on user should not be able to write to /dev/block/mmcblk0p3 .

ie I see no way in heck this could work on a truly locked device (both ""locked"" and s-on).
[HTC EVO 3D] S-trace:
Any more questions?

This tread is so small, does it so hard to read it completely before posting?
[HTC EVO 3D] jcase:
Well it was so ridiculous I had to ask. If you are s-off install an eng boot and have a full command set
[HTC EVO 3D] tekken1972:
Does this method work on HTC Desire S?
[HTC EVO 3D] m0fizor:
So, basically i will need to do the following:

1. Relock the bootloader using "fastboot oem lock"

2. Write the original RUU using HBOOT

3. Use the script from post #18 to changed the bootloader status from relocked to locked

Am i right?

The problem that i have with the phone is that i have 2 lines where the digitizer does not work anymore ( http://i.imgur.com/CssCn.png ). The screen works perfectly, but the digitizer (i think) it's down. I don't think it will be necessary to lock the bootloader since it's a hardware problem that is not caused by unlocking the bootloader.
[HTC EVO 3D] S-trace:
No, You aren't right because after writing RUU You will have stock recovery, and so can't use script from post 17.

Correct sequence is:

1. Relock the bootloader using "fastboot oem lock"

2. Use the script from post #18 to changed the bootloader status from relocked to locked

3. Write the original RUU using HBOOT
[HTC EVO 3D] Dadovvv:
For me esiest way to get status locked after using htcdev metod is: i was on 1.53.0007 hboot ***unlocked** after that i use wiretrick to get status *** JuopunutBear*** and S-OFF then i just flash original PG86IMG file and my status changed to ***locked*** trough adb push comand fastboot writesecureflag 3 to gain S-ON.
[HTC EVO 3D] scotty1223:
i have found this to work on the rezound as well(hex editing mmcblk0p3). i have always been unlocked since s off. i changed tolocked then back to unlocked again to verify. i found HTCU at 0x8404 as described in the OP.

i will test on some other htcdev phones as well :)

thanks for your info :cool:
[HTC EVO 3D] scotty1223:
S-trace,is your package device specific? would it work for other devices sharing mmcblk0p3 lock flag location?

if its device specific,how would we modify to work with other devices? im sure users of all htcdev unlock devices will be interestred :)
[HTC EVO 3D] S-trace:
Package as-is is device-specefic.

It may be not device-specefic if You will remove model check (if grep -q shooteru /default.prop ; then ui_print "Shooteru device!" ; else ui_print "This is not shooteru device!" ; exit 1 ; fi) from it.

Because Security_record filled with zeroes I can't be sure on unknown locked device if 0x8404 adress is correct (but can verify it on relocked or unlocked device - checking during patch isn't implemented in script yet however) for it. I think adress may vary even on same device with different HBOOT, but not sure about it - I haven't seen images of Security_record from 1.53.0007 HBOOT of Evo 3D GSM or ony other phone yet.

To port this script to another device You will need to change next lines:

if grep -q shooteru /default.prop ; then ui_print "Shooteru device!" ; else ui_print "This is not shooteru device!" ; exit 1 ; fi) # Target device codename (shooter for Evo 3D CDMA for example and so)

partition="/dev/block/mmcblk0p3" # Partition which hold Security_record

adress="33796" # Decimal value of 0x8404 - offset for HTCU or so
[HTC EVO 3D] scotty1223:
cool :cool:

thanks for your hard work and info. ill click the thanks button as soon as im allowed more thanks ;)
[HTC EVO 3D] darkfloo:
Does this work with revolutionnary bootloader ?
[HTC EVO 3D] S-trace:
Yes, it should.
[HTC EVO 3D] scotty1223:
yes,it should work find to change the lock status flag.

however,you will need to flash a stock hboot back in order to see the change in the banner,as the revolutionary hboot is a patched hboot that basically ignores the flag,displaying the revolutionary banner,rather than unlocked,locked,or relocked.

if you rooted via revolutionary,youre lock status flag has likely never changed. i.e.,when you flash a stock hboot,it should be locked irregaurdless.
[HTC EVO 3D] scotty1223:
thanks you again,s trace,i have modified the script to not do any device checks,and tested it on my rezound,gsm 3d on 1.53 hboot,and my sensation. i have a friend who has verified the lock flag location on the cdma 3d on hboot 1.58,i will ahve him test the zips as well.:cool:
[HTC EVO 3D] darkfloo:
So to lock my bootloader I have to :

Fast boot oem lock

Flash the rename zip

Flash the ruu.

I'm I wrong?
[HTC EVO 3D] scotty1223:
yes you are wrong. No longer any need for "fastboot OEM lock"

-flash lock_bootloader.zip from post 17

-Run ruu (as .exe,PxxxIMG hboot file,or from fastboot)

-Fastboot oem write secureflag 3 (if you're turning s on)

If you need to lock or unlock the bootloader without doing any other mods,just flash the Appropriate zip :)
[HTC EVO 3D] darkfloo:
So know i'm locked (thanx s-trace). But how i get S-on ? I write fastboot oem write secureflag 3? I have read that can brick my phone , and i need to sell it so I realy want to d'ont brick it . ( Sorry to ask lot of question , Noob inside)
[HTC EVO 3D] S-trace:
Yes, You will get brick after fastboot oem write secureflag 3 if You have installed modified (Revolutionary/Junoputbear) HBOOT.

Just flash 1.49.0007 HBOOT and it will be fine, and next owner of Your Evo will can do S-OFF by Revolutionary easily, if he want it.
[HTC EVO 3D] scotty1223:
verified lock flag,and tested zips on verizon incredible 4g :)
[HTC EVO 3D] kyogoku:
Hi,

I'm interesting in this because it can make the bootloader locked instead of relock right?

My device is s-on, unlock via HTCdev and rooted. Right now it use 4EXT Recovery.

My question is can I use the same steps you give? Or is there special steps for my device?

Total noob inside so a guide would be appreciated.

Thx in advance.
[HTC EVO 3D] S-trace:
Just try to flash zips from #18 - query (should print Your current status of bootloader, and then lock - should be flashed successfully. I don't know how those zips can operate with S-ON device, if You get verify error during locking bootloader - looks like You will need to get S-OFF, lock bootloader and then flash stock HBOOT and get back S-ON.
[HTC EVO 3D] scotty1223:
i believe mmcblk0p3 is write protected while s on(or else s-off would have been easy-the radio secureflag i believe is 0x8400). im not sure if the zips will give an error,or if they will appear to have worked,without actually changing anything. in either case,i do not believe it will work without being s off.

kyogoku,if you try it,please report back the results so i dont need to turn one of mine s on in order to find out :D

s trace,again this is a hell of a find. ive posted the zips in a couple other forums,and your work is helping out folks with other devices now as well. :cool:

last and not least, lock flag location verified,and zips tested working on htc jetstream tablet
[HTC EVO 3D] krazykipa:
THANK YOU, s-trace!

I have verified that this manual method works on the HTC Vivid/Raider aka Holiday (I have a Raider with HBOOT 1.85.0029 originally from Rogers). The unlock string is in the exact same partition and offset.

I just followed the steps in post #1 and it worked like a charm. Went from ** *UNLOCKED *** to *** LOCKED *** at the top of bootloader. Next step will be to run RUU, turn S-ON and send this thing back to HTC under warranty (my volume down button broke XD)
[HTC EVO 3D] scotty1223:
lock flag location verified,and zips tested successfully on my touch 4g slide(doubleshot) on 1.45 hboot.

also,verified that flashing lock,unlock,or relock zips while s-on results in harmless error.

thanks again,s trace,im running out of phones to try and check :D
[HTC EVO 3D] k1llacanon:
U really need to put that post into plain English no idea what your on about. Get a bit of it though
[HTC EVO 3D] scotty1223:
i understood him just fine. if youre not familiar with hex editing important partitions,you might want to use the zips provided in post 17,as all you need to do is flash them in recovery.

if you have a different device,i have put up posts entitled "reset your lock status flag" in the following forums:

-rezound

-sensation

-inc4g lte

-jetstream

-mytouch 4g slide

the above threads contain the zips that are NOT doing device checks.

a couple posts up,krazykipa verified the lock location of vivid/raider/velocity so the "universal" zips should work on that device as well(i did not post in that forum,not having one of those devices to test)

if you have a different device,i can help you dump mmcblk0p3 and check the flag location(you must be unlocked or relocked)
[HTC EVO 3D] NilayS:
Can this trick (Flashing an unlocked boot img) be used to revive a softbricked phone having a re-locked bootloader ?
[HTC EVO 3D] scotty1223:
if the phone is s on,then no. this only works for s off devices. you have an s off device,with a custom recovery,this may be of some value,but none really that would not be obtainable with other methods.

prolly want to describe the nature of your soft brick in an appropriate device forum. i can take a look if you want to pm me a link
[HTC EVO 3D] NilayS:
PM Sent.
[HTC EVO 3D] mpgrimm2:
Just to be sure that I didn't miss it, I read through the whole thread...

Q: Has the query/locking etc zip from post 17 (or 18) been verified on the EVO3D CDMA yet?

(i thought some part of the script that checks for shooteru had to be edited).

Sent from my "Up all night, Sleep all day" EVO3D!
[HTC EVO 3D] scotty1223:
the zips from this thread won't work,as they are doing device checks for shooter_u. You can modify the zip yourself,as s trace described to me,or look in the forums I mentioned above for my threads,which contain zips with the device check removed.

we have verification the lock flag location on shooter,so the zips with device check removed work fine :)
[HTC EVO 3D] mpgrimm2:
Thanks for the confirmation Scotty. I heard about it through Ramjet73 and came here to get a better idea. I overlooked his link to your post over at Androidforums with the edited zip. Someone called him a "link Ninja" elsewhere and I am starting to agree.
[HTC EVO 3D] scotty1223:
lock flag location verified,and zips tested on htc amaze :)

thanks again,s trace!
[HTC EVO 3D] scotty1223:
lock flag location verified,and zips tested on cdma evo LTE 4g,hboot 2.09.0000. thanks s trace! :D
[HTC EVO 3D] S-trace:
Thank You for hard work on it!

Where do You got so many phones to test it? Are You workin in service center?)
[HTC EVO 3D] scotty1223:
lol no,phones are just my hobby. i watch craiglist and ebay and pick them up when they pop up cheap :)

and you did all the hard work- i just check the phones based on your work and instruction :D
[HTC EVO 3D] scotty1223:
lock flag verified,and zips tested on S4 one S. :cool:

S-trace,i sent you a PM so as not to clutter this thread too much,id appreciate your advice/feedback on something :)
[HTC EVO 3D] scotty1223:
lock flag location and zips confirmed and tested on DNA and HOXL(evita) thanks again s trace! :cool:
[HTC EVO 3D] krazykipa:
Due to the fact that there is no public S-OFF for the HTC One V (primou) (yet...) I have no way of verifying this for 100%, but I figured I would post this anyway if it helps anybody in the future.

I did a backup of both mmcblk0p3 and my entire NAND (mmcblk0) and could not locate the string "HTCU" all on its own. Bummer, right?

The locking process is done a little differently on this phone it seems. mmcblk0p3 is the SBL and does not contain the bootloader lock flag. Instead, mmcblk0p7 is the partition of interest. I've flipped my device between unlocked and re-locked and found the change occurs at offsets 7E00 and 7E02. The full block 7E00 - 7E03 reads 15 08 84 19 on an unlocked device, and 11 08 85 19 on a relocked device.

The weird part is that every other device in this thread has the lock flag as a nice simple string, but on the One V the flags translate to:

..…. (re-locked)

..„. (unlocked)

Going by prior art, I assume overwriting this with 00 00 00 00 would return you to factory locked, but alas, without S-OFF there is no way to know :( I had no luck rooting the device with standard android exploits (maybe I was just impatient :P), so I had no way of reading this partition with a locked bootloader still intact.
[HTC EVO 3D] scotty1223:
oops,forgot to come inform you lock flag verified on m7(htc one) lock zips worked fine with hboot 1.44 and cw recovery(not twrp) have not tested on 1.54,1.55 hboots yet.

also possibly of some interest is the location of the "tampered" flag,wich lives in pg2fs,or mmcblk0p7,

on the rezound(and presumably other qalcom s3 devices) the flag is at 00430404,folloing a 68 25 32 C6 starting at 00430400.

for tampered you have an 02,and for no banner you have a 00.

it used to be this flag was easily eliminated by flashing an older,then newer hboot,but 2.28 seemed to be a lil more stubborn and remained tampered despite some different hboot and firmware flashes. changing the flag like above worked to eliminate it.

m7(and presumably other qualcom s4 devices) has the flag in the same partition,but at 00411804,following the 68 25 32 C6 at 0411800.

on my htc one t mobile version(m7_ul),it seems tampered is 02,but on vzw(m7_wlv) looks to be 04. again,00 should be no banner.

i think you can locate the flag if its in different offests by locating the 68 25 32 C6 ,or its equivalent h%2Æ . the flag should be the offset imediately following (0x or 00)

home someone else may find that useful or interesting as i did :)
[HTC EVO 3D] skulldreamz:
Screw Samdung.... I would gladly take a sledge hammer to those plastic pos phones. I actually gave the s6 a chance and you need about 10 GB of ram to have mediocre multitasking. My 2 cents. They do have a amazing camera though, I'll give them that
[T-Mobile, Samsung Galaxy SIII] pezlomd:
How long does it usually take to charge your s3 fully? I ask because mine has always charged very fast but lately its taking sooo long to charge and I dont know why..what do you guys think?
[T-Mobile, Samsung Galaxy SIII] koolboyztn:
with the standard charger came with S3, usually took around 2h30 to fully charge.
[T-Mobile, Samsung Galaxy SIII] pezlomd:
Mine used to charge super fast but now its taking soooo long.. its takin me an unusually long amount of time.. any body know what could be up ?
[T-Mobile, Samsung Galaxy SIII] chrisram88:
I can't really tell you a time exact but not that long. Last night I was at 50% plugged it in and charged completely in bout 45 - 1hr. I usually don't touch it tho.
[T-Mobile, Samsung Galaxy SIII] ZachLL88:
Takes me a about 2hrs. With the charging accessories that came with my phone. Are you using the original charging accessories?
[T-Mobile, Samsung Galaxy SIII] psykhotic:
Rogue app.
[T-Mobile, Samsung Galaxy SIII] pezlomd:
Yes everything I use is official samsung came outta the box.. I had been flashin quite a few roms then went back to complete stock lj4 and it just seems like its taking way too long to charge.. ive never noticed this problem infact I was always alarmed at how fast it would charge