yashsingh1/xdaforums huggingface dataset:
[HTC One X] nitrous²:
You know that there's NO hard-, software which isn't vulnearable or which hasn't got an exploit, don't you? No need to be pessimistic or realistic :D if we keep staying constructive and productive, somehow this will be done ;) call me a dreamer, but... let's just try to give our best, ok? This would be fine. I just think the One X hasn't got the attention it has actually deserved. Its release date was too close to the release of the gs3. HTC's great devs are mostly familiar with Qualcomm processors. Never before they've worked with a Tegra 3 processor. The available Tegra 3 devices (Asus TFXXX[T]) don't have the problem with S-Off/On, it's enough for them to be unlocked. So none of the devs who managed bootloader unlock on this Tegra devices faced this problem. This and many other avoidable reasons caused the lack of development and it's surely one of the reasons why we didn't got s-off yet.
[HTC One X] Lloir:
I have just cleaned the thread up NO MORE off topic!
[HTC One X] Lloir:
After a free way so people dont need to send they're phones anywhere
[HTC One X] nitrous²:
Link to original Thread.

I posted him to ask him how he did it. It was a week ago and he didn't answered until now. My idea was to do this and try to load PJ46DIAG.zip without rebooting. As you know, if you have superCID you don't need a Javacard. Even if I don't have the correct DIAG, at least we'd have a way to load the DIAG until the correct one is out...somehow...
[HTC One X] singcheng:
S-OFF via hboot upgrade

TRY AT YOUR OWN RISK. NOT VERIFIED.

I found is an article HERE for S-OFF via HBOOT upgrade. I don't have a CID HTC_621 (taiwan) so I can't try it. Neither I can verify its reliability.

I briefly translate it into english:

TRY AT YOUR OWN RISK. Neither the author or me will be responsible for your device.
[HTC One X] :
Read somewhere that the diag file can't be leaked because it will be traced back to the guy who leaked it. Now can we get it and make our own diag file based on it?
[HTC One X] Lloir:
your welcome to discuss the methods here, but PLEASE either show the reasons why or at least link it for me please? I've been looking into this and got a couple of ideas....
[HTC One X] lenthele:
hboot

Hey Guys!

Dunno if its worth much but I downloaded the ENG HBoot File you linked in the first post and opened it in a hex editor and poked a little bit around. I found this:

Settings memory area 10B 00 01 00 Disable patches 0A 00 01 00 Settings memory area 2 Settings memory area 2 first Settings memory area 2 second Settings memory area 2 third 0B 00 01 01 Settings memory area 3 Flash Code memory area 0B 00 01 02
Patch Code memory area 0B 00 01 03 Enable patches 0A 00 01 01 Final Integrity check 0B 00 01 FF%d: SD init
%d: SD init fail !!!%d:SD FAT32 init OK Checking key-card...Checking key-card...
%d: Not key-card !!!%d: Key-card DMCID.dat Open '%s' file success !!!
hFile = 0x%x, file_size = 0x%x
Read '%s' (%d != %d B)
AT@CID=0: Change CID to '%s'4: Change CID to '%s'Alloc data buffer failOpen '%s' file fail###[ End CDMA Cust Mode ]###

It looks like thats the part where it checks for a "key-card". Probably this Java Card??
[HTC One X] nitrous²:
I'm not on hboot 1.39, but you could try it with following commands:

D:\fastboot>adb shell
root@android:/ # hexdump -C /dev/block/mmcblk0|grep EBT
[HTC One X] lenthele:
When my phone receives the JB update (stupid branding -.- ) I will root it and have a look, maybe I can find something :)
[HTC One X] matt95:
don't think so, they would have already tried it :)
[HTC One X] Lloir:
i'm still poking and prodding my HOX+ for ideas plus doing research, not found anything that's not already been mentioned here...by the way people are welcome to make new threads in this section for development purposes....like porting FireFox OS and so on.
[HTC One X] backXslash:
QXDM

I poked a bit on my phone. It's the international version, HBOOT 1.30.0000 CID HTC__001.

Anyway, there's a fastboot command called "fastboot oem enableqxdm".

QXDM is a piece of software designed to talk directly with the modem. Has anyone looked at that avenue? If not, I intend to right now.

I'll post findings when I can.

---------- Post added at 04:15 PM ---------- Previous post was at 03:46 PM ----------

OK, turns out, (at least with my setup), the phone WILL allow you to enable QXDM mode. The command "fastboot oem enableqxdm 1" completes successfully.

Now I've just gotta get the phone into diagnostic mode. On CDMA phones, that's ##3424#, which obviously doesn't work on the One X+.

Any ideas?
[HTC One X] casserly:
If I understand your question correctly, and you mean the diagnostic menu, then I use: *#*#4636#*#*

Hopefulle thats what you meant. Good luck :)
[HTC One X] TripNRaVeR:
Thanks but i meant after the issued commands ;)

People who want to help testing commands use the following vold.fstab

## Vold 2.0 fstab for endeavor

#######################
## Regular device mount
##
## Format: dev_mount <label> <mount_point> <part> <sysfs_path1...>
## label - Label for the volume
## mount_point - Where the volume will be mounted
## part - Partition # (1 based), or 'auto' for first usable partition.
## <sysfs_path> - List of sysfs paths to source devices
######################

# Mounts the first usable partition of the specified device
dev_mount sdcard2 /mnt/sdcard auto /devices/platform/sdhci-tegra.2/mmc_host/mmc1
dev_mount sdcard /storage/sdcard0 emmc /devices/platform/sdhci-tegra.3/mmc_host/mmc0
dev_mount usb /mnt/usb auto /devices/platform/tegra-ehci

the reason why the current s-off method will not work is because fastboot boot boot.img is removed by htc.. seems they get clever:eek:
[HTC One X] superchilpil:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

I did try those commands, I assume that vold. fstab wouldn't work on my device

Slithered from my HTC One X+
[HTC One X] TripNRaVeR:
It will work just fine..
[HTC One X] virtualflyer:
False and 0 = http://pastebin.com/UTKCAqki nothing seems to happen as a matter of fact, haven't checked memory in settings though

False and 1 = http://pastebin.com/L3b9KhWW com.android.media has stopped and sd not available in settings, memory phone memory and usb memory both unavailable, app memory 32gb

True and 0 = http://pastebin.com/V0vXkFH5 same as the second one but now it finds also phone memory in settings which wasn't available

True and 1 = http://pastebin.com/XQ5mGdX4 same as the second one but now it finds also phone memory in settings which wasn't available

I'm not able anymore to modify build.prop will look into it now, but I wanted to start sharing these things.

As about your latest post, haven't seen it before trying

edit: managed to got it working using es instead of solid explorer

Seems that just a combination of the two is lethal when one or the other one on don't seem to do anything special
[HTC One X] TripNRaVeR:
Cool so we know that the commands work and we maybe have a new starting point. Thanks for testing tough! This is very helpfull espec. the phone memory cause maybe that can help us.
[HTC One X] virtualflyer:
R: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

I'll try to help whenever is needed

Sent from my wonderful One X ruined by the worst phone producer... h....t.....c.....
[HTC One X] dilster97:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

http://db.tt/rViNipR0

My dropbox link for a HTC One X DIAG.zip

HTC One X Viper X 3.3.7

XM-kernel #115

Backup: O2 XDA IIs WM 2003 SE 4.21
[HTC One X] Lloir:
KEEP ON TOPIC

This is getting stupid guys!! I would think people who use this forum can read! SO READ THE SECTION RULES, my patience is wearing very thin now!!
[HTC One X] Stephen:
Moderator Warning

This is the last time we will clean up this thread. If we have to clean up this thread again INFRACTIONS WILL BE GIVEN. You have been warned.
[HTC One X] backXslash:
Is there any reason we wouldn't be able to use AT commands to directly force the radio to set itself S-OFF?

I've found these, and they apply to most any phone I suppose, but specifically to the X-GOLD XMM6260 in the international One X+.

This is documentation of the chip itself.

This is a guide on how to talk to the chip.

And this is just a run down of the HBOOT analysis of the HTC G2 aka Vision. However, it does have a few gems, like the AT command to set the radio S-OFF, "AT@SIMLOCK=7,0".

I'm going to look at this further, but does anyone know if the S-OFF flag is controlled by the Tegra 3 chipset (i.e. the processor) or the radio?

I remember the gfree S-OFF exploit for the Desire Z, where in it sent the commands to the radio to reboot itself without rebooting the phone, and it would come back up without write protection enabled, so you could force it to set itself S-OFF. My point being, the exploit we're looking for should have very little to do with the Tegra chipset, and much more to do with the radio chipset. (Assuming I'm right, and please tell me if I'm not.)
[HTC One X] TripNRaVeR:
Update on fuse protection:

https://github.com/TripNRaVeR/tripn...mmit/87a0a9df1335a33cfe509e12eca697c8c5eaa82a
[HTC One X] sieempi:
apxer

Tool to reboot into APX. I've tested it on 2 alive devices and got out by pressing power button for ~15 seconds. Although I haven't had any issues, this is still an unexplored app - risky!

I recommend testing it on faulty devices.

(it's useless, though, as we don't have the SBK..)

Download
[HTC One X] HEshghi:
ok all works to me

i go to apx mode by running your batch file

update apx driver with tripnraver apx driver and successfil installed

run nvflash.exe and then go to device by holding power key fo 15 s

but my device stay in read only mod
[HTC One X] backXslash:
The apxer app doesn't seem to like my International HOX+. It just reboots the phone, though I do get a message:

Kernel release: 3.1.10-BLADE

Module magic patched!

Then the phone just reboots as normal. However, there are a few programs out there that claim to be able to either pull down your SBK when the phone is in APX mode, OR at least tell you what version of SBK the phone is using.

Can / has anyone kicked a HOX+ into APX?
[HTC One X] ereneren564:
[UBUNTU]

if your usb driver is mounted onto /XXX, have you tried to change the permission of /XXX ?

you could change the permission by doing a :

sudo chmod a+rwx /XXX

maybe it can do something ^_^
[HTC One X] HEshghi:
ok i do it;

and done, then go to sd card dir at linux(Partedmagic) and delete some data and copy a 200mb file(from a dir in sd card) and paste it in other directory in sd card and linux OS do it succesfully;

But when unplug/unmount the hox then plug/mount it see no operation done at sd card memory and all data stayed untouched :(
[HTC One X] HEshghi:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

I tried it in recovery(twrp2.3.3) by mount option several times, so in android booted and mount usb storage from notification status bar and do it (chmod) several times and write operation several times and all for several times, nothing happens (don't write)
[HTC One X] wildstang83:
Come on guys, if you can't give good help or advice, just don't post.
[HTC One X] matt95:
i've got a faulty device so i wanted to ask if there's something i can try for you? i would like to sacrifice it for a good sake :)
[HTC One X] matt95:
yeah i'll do it right now ;)

---------- Post added at 11:14 AM ---------- Previous post was at 11:13 AM ----------

i don't know what i did but my phone was UNLOCKED and now it says LOCKED and not RE-LOCKED! :D pretty strange!

---------- Post added at 11:24 AM ---------- Previous post was at 11:14 AM ----------

here's a picture
[HTC One X] matt95:
i'll write what i did in a few minutes

---------- Post added at 12:30 PM ---------- Previous post was at 12:01 PM ----------

ok, i was in the HTC black screen (the one that comes up when you are flashing a new HBOOT or RUU), actually i was flashing a RUU but then suddenly the RUU came up with an error 152, that means that i've ****ed up my radio, in fact you can see that in the HBOOT my radio isn't present... however i was stucked there and i couldn't find a way out of it... so i tried flashing my UnlockCode.bin...

i tried 3-4 times and suddenly my phone rebooted in bootloader with that word LOCKED :) now (stupid me) i am in the same situation as before but the trick seems not to work every time... now i'm still stuck in the black HTC screen trying to do it again...

---------- Post added at 01:15 PM ---------- Previous post was at 12:30 PM ----------

some infos

version: 0.5a
version-bootloader: 1.39.0000
version-baseband: 5.1204.162.29
version-cpld: None
version-microp: None
version-main: 3.14.401.31
serialno: HT23ZW122157
imei: ...
product: endeavoru
platform: HBOOT-T30S
modelid: PJ4610000
cidnum: HTC__203
battery-status: good
battery-voltage: 3730mV
devpower: 29
partition-layout: None
security: on
build-mode: SHIP
boot-mode: RUU
commitno-bootloader: None
hbootpreupdate: 2
gencheckpt: 0

---------- Post added at 01:32 PM ---------- Previous post was at 01:15 PM ----------

ok i've just flashed my firmware zip and i'm back to bootloader finally :)
[HTC One X] TToivanen:
Nope. You somehow made it visible I guess
[HTC One X] matt95:
ok, then i'll try so see what happens

---------- Post added at 04:07 PM ---------- Previous post was at 03:59 PM ----------

here's the output, nothing at all
[HTC One X] feraay:
Hello i belive we know keycard as withecard;javacard with diag file.....

Clean s58 diag to rewrite secure flags

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] matt95:
how do i do that? :(

---------- Post added at 03:43 PM ---------- Previous post was at 03:24 PM ----------

take a look right here

i think i've caught the moment when the lock is open
[HTC One X] Lloir:
I'am dissapointed with the posts i just had to delete including the one's from TWO RC's you both should know better!!

KEEP

ON

TOPIC
[HTC One X] backXslash:
Sorry in advance if this isn't strictly "useful" Lloir, but...

I had a thought the other day, could we not use a similar exploit to the "adb restore exploit" Saurik used to root the Google Glass combined with this seeming "hole" in the RUU restore? That exploit (and a few similar ones like the one used on the Galaxy Note 2 and SGS3) basically replaces all or part of a file mid-stream, after the flashers have verified their hashes. Then, when the write verify inevitably fails, you just stop it from overwriting the flashed file with an old one, reboot, and voila.

The idea applies to us like this: If you place the device into RUU mode, and the RUU flasher does it's thing, all we really need to do is extract that flasher, and make our own modified version of it. I think you may even be able to just hook it to GCC and step through the processes it's using to get a better idea of when to start and stop it. We allow the flasher to start flashing an RUU, which "opens the lock" on the NAND memory, then we allow it run right up to the point that it flashes something like HBOOT. When it confirms the check signatures of the HBOOT image, it will start to flash, then we just inject our modified HBOOT and terminate the flash. This will probably end with the phone being a nightmarish mess user partition and radio wise, but it SHOULD also leave us in a workable state with the phone, with a working recovery and/ or HBOOT, but with the NAND lock also turned off. From there, we should just be able to read and modify what we please when we please, and get the phone back to a more "ordered", workable state.

I'm 100% game to test this on my phone, if I can get a more experienced hand to collaborate with me.
[HTC One X] scotty1223:
thats an interesting proposition for sure. i want to say that the phone will brick when it tries to boot,as its now runing an unsigned hboot while s-on. however,if the nand lock has truly been temporarily lifted,maybe that is incorrect. its possible the phone may boot un-write protected,then brick on the next reboot(assuming s-on).when write protections and boot checks are re-applied.

so i guess the next question,is just that... assuming the trick works to get an unsigned hboot and boot nand-unlocked,are the boot checks still being done? will the phone boot to recovery or into the OS so the radio secure flag can be written?

id test as well,if anyone with a bit more kowledge than us thinks it has a chance of working :)
[HTC One X] sieempi:
I doubt that will work, all the checking and actual flashing is done by hboot. The so called ruu flasher only issues fastboot flash zip rom.zip.

We need to fully disassemble hboot and analyze it. Any ideea about the entrypoint and loading address for load it in IDA?

via xda app
[HTC One X] backXslash:
As I recall, there was a trick used by the guys who did the MyTouch Slide 3G, where they uploaded an HBOOT that just straight up ignored S-ON, and didn't bother checking anything.

As far as flashing and checking being done by HBOOT itself, is the file uploaded to memory, checked THEN flashed? How is the whole thing accomplished? What is there isn't room on the device for the uploaded file? Isn't RUU supposed to be "disaster recovery" pretty much? You'd think it'd talk back and forth with the flasher on the PC, then agree that everything is in order and say "Ok, gimmie".

How's it all work?
[HTC One X] scotty1223:
Well,hboot isn't the only thing doing checking. Signitures are checked on several partitions by the one after,to make everything legit. if something finds an unsigned file of importance(like hboot) the result is "do not boot" mode,wich is basically a potentially unrecoverable dead phone :eek:

The ruu is intended to be disaster recovery,but its not possible without hboot. that's a good point made above,hboot itself is doing all the installing- its only possible to write hboot,or any partition from another device,when hboot is dead,under very specific circumstances.
[HTC One X] backXslash:
I'll go find the diagram I'm thinking of in a sec, but it pertains the how the original iPhone hackers broke the chain of trust from the hardware to the kernel in iOS. It sounds like we need to do something similar. Do you know what the chain would be? And where a convenient place would be to break it?
[HTC One X] scotty1223:
sorry,no idea. what little i know i know from listening in on discussions in the HOXL thread. the tegra 3 devices are a different animal... id just love to find a solution,as an unfortunate repair incident left my factory s-off endeavor_u s on,and i absolutely hate it this way :mad:
[HTC One X] Ambious:
Couldn't you - in theory - use this method to flash an upgraded hboot on a device that otherwise doesn't have an update available for it (bypassing CID checks?)

Granted It's not as important as S-OFF, but it would be very useful to a lot of us unlucky users who are still stuck with ICS....
[HTC One X] schnurzelat:
I have found something and want to share.

In this video http://www.youtube.com/watch?v=oaqdskTjgk8 some guy tries to flash the pj46diag.zip files with an y-cable. An error message came up, that u32g.hdr is missing. In some ROM's it is included. e.g. http://xdaforums.com/showthread.php?t=1989308

If this was a stupid idea, never mind.
[HTC One X] Stephen:
Moderator Warning,

This thread is not a general chat thread. Keep posts development only. This is your final warning. Any further deviation and infractions will be given and this thread may be closed!
[HTC One X] Lloir:
thread locked for cleaning! as people seem to think this is a discussion section about rules and so on
[HTC One X] Stephen:
Moderator Update

Please not this thread is now in the general section. We will be a bit more relaxed in the moderation of this thread but will still keep a close eye on it. General chat will still not be allowed.

The goal of this thread is to acheive S-off for this device.
[HTC One X] Stephen:
This was removed as it was felt that the dev section did not fulfil its purpose. It was orgionally intended for devs to do high level testing etc but ended up being a simple chat thread, so it was removed and the thread was put into the general section instead.
[HTC One X] Mechanodeus:
Java card Over-Network

It is possible to use the java card (or whatever card with a PJ46DIAG.zip or PJ46IMG.zip file on it) over the network/ip?
[HTC One X] Jhinta:
Yep it's like a virtual usb , see it as you cable is the internet . Some of the online site work like this . So highly possible

Verstuurd vanaf mijn HTC One X met Tapatalk 4
[HTC One X] Mechanodeus:
So the pc will act like a virtual usb and the hox will think its a regular sdcard plugged in?

As far as I searched on the internet, this is very difficult or even not possible at all.

Do you know how could I do that?

Thanks.
[HTC One X] MosesTheTool:
Wow that is a brilliant idea! I was considering purchasing a Javacard for unlocking HTC devices, and if i could do this online, I could charge people for the service until I get my money back or something.

How is it done? (online)
[HTC One X] matt95:
It isn't cheap
[HTC One X] Mechanodeus:
I wouldn't risk it considering how expensive is a card like that. Paying 500 euros or 1000 as I heard and trying to get your money back... What if nobody is interested or you only get 10 people? :))

My intention is to unlock my phone as a friend of mine is willing to do it online but not to borrow it.
[HTC One X] MosesTheTool:
I know it's not cheap, but if people will pay me a couple bucks for S-OFF, and there will be enough people, I will get the cash back ;)

But how can you connect the YCable online to S-OFF over the internet??
[HTC One X] Jhinta:
Ycable is just a normal cable with power , and there are all kinds of software for it just Google it . Here is 1 http://usbip.sourceforge.net

Verstuurd vanaf mijn HTC One X met Tapatalk 4
[HTC One X] matt95:
Man, there's no way to get S-OFF, one java card will work only once, you can't use it multiple times so you will s-off only your devices with a 1000$ java card, it isn't worth it....... this has been discussed thousand times already

and no one will pay for s-off, here on xda we do not work like that
[HTC One X] Mechanodeus:
Yep. That's the big question. But the answer that I am searching for a wile.. who know who has it.

After you purchase a Java card take into consideration that you still need an s58 Clean S-OFF file (PJ46DIAG.zip) on it, file that even my friend with a javacard doesn't have it.

---------- Post added at 11:30 PM ---------- Previous post was at 11:22 PM ----------

A javacard works more than one time. Believe me, I had it one time in my hands.

Now I want to be able to use it online and play a little bit with it.

If someone can get the s58 file for hox, my friend will s-off for free. He's living in Germany and the phones can be sent by post or even better if we find a way to do it online.
[HTC One X] matt95:
I red once that java card works only with one device and can't S-OFF every device out there...
[HTC One X] Mechanodeus:
Javacards works with all htc devices, but it has a limited number of use (1000 times if it's a new one). If you want to use it with HOX, you need the diag.zip file for hox; the same for hox+ or other model.
[HTC One X] DeeZZ_NuuZZ:
he meant not that its possible to s-off only hox he meant that you can't s-off even with this online method all hox who are here on xda and those owners want s-off...
[HTC One X] MosesTheTool:
I can get the files!! ! It will cost me some money but I CAN get them. Talk to me in PM please