yashsingh1/xdaforums huggingface dataset:
[HTC One X] Thunder07:
OK so i just spoke with Show-p1984...

and his take is that we need SBK to get nvflash working....

however, we don't have that yet and it must be cracked...

but considering how we can't get into APX mode yet, its not worth cracking as who's gonna be making use of it??
[HTC One X] feraay:
That will mean htc self doesnt use nvflash mode ^^

Cant say anything about PSP

But if u get a way to bypass cid check would be great ^^

Back to asus they are able to backup a

Factory_config.img

Everyone heard of this by HTC devices ??? Would be to easy
[HTC One X] Thunder07:
the drivers are correct...

and they're giving the 0x4 error as expected,

what's messing is the SBK...

plus about your psp suggestion,

some changes are only applied to the ram and are reversed on restart...

we need to find a way to make them permanent.
[HTC One X] Vcek:
Just wanted to mention this glitch i've found earlier in the bootloader, could miraculously lead to finding a security exploit. Confirmed on S-ON hboot 1.39 by "attempt-flashing" a custom-made zip file.
[HTC One X] Thunder07:
this is not a glitch,

i've found this earlier and used it to confirm that the radio is no longer flashed through the bootloader but through the OS,

and this way when OTA is send, they just change the number through the bootloader, but change the actual radio through the OS.

also this is some of the test i've done a while ago into this

in this test i send a zip containing kernel & android-info.txt

do not this is with a unlock bootloader,

you can even flash the recovery this way...

though if i recall correctly, either the kernel or the recovery didn't flash, though it said it did :/
[HTC One X] Emba4:
problem with that is that nvflash requires a loader file to be sent first before you can do anything and we dont have that loader or a work around like they have for the transformer with wheelie
[HTC One X] Thunder07:
BTW, the s-off Diag is meant to contain the string "Clean S58"...

this don't... so be careful, i don't think its an s-off...

i know xmoo posted the size for it as well but i cant find it anywhere.
[HTC One X] xmoo:
Correct!

Old screenshot,

964KB
[HTC One X] feraay:
Read a bit about nb0 files

Sounds not so Bad

Some important files in the NB0 file

After you unpack the NB0 file, you will get a lot of files.

The most important file is mlf file, the file define what partition to be flashed.

For example, the content of F0X-1280-0-7003-A01.mlf is listed in the following:

[Package Download Profile]

PROFILE VER = 0.1

MODEL = ADR

PROJECT = F0X

PLATFORM = Q1

[Package Info]

/*-----------------------------------------------------------------------------

UPDATE_FLAG_NULL = 0x00

UPDATE_FLAG_QCSBL = 0x01

UPDATE_FLAG_OEMSBL = 0x02

UPDATE_FLAG_AMSS = 0x04

UPDATE_FLAG_CEFS = 0x08

UPDATE_FLAG_APPSBOOT = 0x10

UPDATE_FLAG_ANDROID_BOOT = 0x100

UPDATE_FLAG_ANDROID_SYSTEM = 0x200

UPDATE_FLAG_ANDROID_USER_DATA = 0x400

UPDATE_FLAG_ANDROID_RECOVERY = 0x800

UPDATE_FLAG_ANDROID_SPLASH = 0x1000

UPDATE_FLAG_ANDROID_HIDDEN = 0x2000

UPDATE_FLAG_ANDROID_FTM = 0x4000

Modem: QCSBL + OEMSBL + AMSS +

Host*: APPSBOOT + ANDROID_BOOT + ANDROID_SYSTEM + ANDROID_RECOVERY +

ANDROID_SPLASH + ANDROID_HIDDEN + ANDROID_FTM = 0x7B17

-------------------------------------------------------------------------------*/

FLAG = 0x7B17

[Firmware File Name]

FILENAME_FLASH_HEX = "F0X-0-1280-NPRG7627.hex"

FILENAME_FLASH_BIN = "xxx.bin"

FILENAME_PARTITION = "F0X-0-1280-partition.mbn"

FILENAME_QCSBLHDCFG = "F0X-0-1280-qcsblhd_cfgdata.mbn"

FILENAME_QCSBL = "F0X-0-1280-qcsbl.mbn"

FILENAME_OEMSBLHD = "F0X-0-1280-oemsblhd.mbn"

FILENAME_OEMSBL = "F0X-0-1280-oemsbl.mbn"

FILENAME_AMSSHD = "F0X-0-1280-amsshd.mbn"

FILENAME_AMSS = "F0X-0-1280-amss.mbn"

FILENAME_CEFS = "cefs_modem.mbn"

FILENAME_APPSBOOTHD = "F0X-0-1280-appsboothd.mbn"

FILENAME_APPSBOOT = "F0X-0-1280-appsboot.mbn"

FILENAME_ANDROID_BOOT = "F0X-0-1280-7003-boot.img"

FILENAME_ANDROID_SYSTEM = "F0X-0-1280-7003-system.img"

FILENAME_ANDROID_USER_DATA = "F0X-0-1280-7003-userdata.img"

FILENAME_ANDROID_RECOVERY = "F0X-0-1280-recovery.img"

FILENAME_ANDROID_SPLASH = "F0X-0-1280-7003-splash.img"

FILENAME_ANDROID_HIDDEN = "F0X-0-1280-7003-hidden.img"

FILENAME_ANDROID_FTM = "F0X-0-1280-ftm.img"

[NV Item]

QCN FILENAME = "NV.xml"

NV DEFINITION = "NVDefinition.xml"

CUSTOM_NV = "F0X_7003_NV.xml"

[CEFS BACKUP FILE]

FILE NUMBER = 0

FILE NAME = NULL

The "FLAG" porperty defines what partition to be flashed, and "Firmware File Name" section defines the partition images.

Looks like it would be theoretically possible
[HTC One X] lenthele:
The problem is that we cannot unpack the nb0 file... Tried it with solutions I found on the Internet, but they all didn't work because they were designed for different devices...

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] MikeS.:
Can't we just flash the .nb0 like this:

fastboot flash hboot diag.nb0

Some people downgraded their HBOOT this way.

Go to Forum Link

Or can we just flash the files inside the .nb0, instead of the boot.img we flash F0X-0-1280-7003-hidden.img ?

I am not able to test this right now.
[HTC One X] mike-ac:
For .nb0 unpacking

http://www.freeyourandroid.com%2Fguide%2Fhow_to_unpack_an_nb0_file&anno=2

But i don´t know if it works with your .nb0 files :silly:
[HTC One X] starbase64:
working link: http://www.freeyourandroid.com/guide/how_to_unpack_an_nb0_file
[HTC One X] Lloir:
right guys, I'm whacking this post here to ask if you can please try and stop going off topic and posting useless posts which serve nobody..i have just cleaned the thread up again, i do think I'm quite easy going.. (if anyone has issues with this post feel free to pm me)

thanks

-Lloir

X\X+ Dev Discussion mod
[HTC One X] Thunder07:
ok.... i know we already established the PJ40 diag is not the s-off one but,

a quick check showed the PJ40 diag is no more than a diag we already have,

its actually is the same as the 1st diag in the 2nd post (of nitrous²) on the 1st page...

just that the zip size is different due to resize or the removal of android-info.txt

so whatever that does, this does :p
[HTC One X] lenthele:
Doesn't work for me... Got an error. Something with negative array exception

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] feraay:
was the sigtool of sensation xe already tried?

Resign the changend rom.zip

have not found if it was tried allready

If yes sry

http://xdaforums.com/showthread.php?p=26318538
[HTC One X] Lloir:
Right I've told off for being so "easy going" so I've nuked EVERYTHING non-dev related. This will be the only warning from this point on. Anything Off topic or nothing to do with dev, will be deleted and passed onto some one higher up.

thanks guys and please KEEP ON TOPIC

-Lloir
[HTC One X] MikeS.:
PJ46*KEY.img

Hi after some reading, I've found something interesting (at least for me).

Check PR key file : [%s]PJ46PKEY.img
Read Key File Data OK %X %d
Write PR Key Data OK
Check DP key file : [%s]PJ46DKEY.img
Write DTCPIP Key Data OK
Check ZIP file USB Dongle
Test PJ46DIAG.zip

So, is it possible, that we need a 2nd, 'KEY' file, which only allows us to flash the DIAG-file?

Sorry, if it's not dev related.
[HTC One X] lenthele:
Actually there are two different Key files (PJ46PKEY.img and PJ46DKEY.img)! Where did u find this?

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] MikeS.:
I've just opened the diag.nb0 with a text editor, approximately in the center of the file is an area that contains some text lines.
[HTC One X] Fightspit:
I found also this:

config.s.driverType:crypto
config.s.default_stack_size:2048
config.s.mem.1.size:128
smx.name:Software Cryptography Driver
smx.vendor:TL
smx.description:Secure Driver for TL Software Cryptography.0!0

A lazy Google search gives this http://www.google.com/search?btnG=1&pws=0&q=Secure+Driver+for+TL+Software+Cryptography

Edit#1:

A couple of lines later...

config.s.driverType:customx
config.s.default_stack_size:4096
config.s.heap_size:131072
config.s.powerChangeStackSize:0
config.s.lazy_instantiation:false
config.s.multi_instance:false
config.s.multi_session:false
config.s.multi_command:false
config.s.custom.allow_nw_clients:false
config.s.mem.1.address:0xBFFF7C00
config.s.mem.1.size:1024
config.s.mem.2.address:0xBFFF8000
config.s.mem.2.size:12288
config.s.mem.3.address:0xBFFFB000
config.s.mem.3.size:1024
config.s.mem.4.address:0xBFFFB400
config.s.mem.4.size:1024
config.s.mem.5.address:0xBFFFB800
config.s.mem.5.size:1024
config.s.mem.6.address:0xBFFFBC00
config.s.mem.6.size:1024
smx.name:HTC Security
smx.vendor:HTC
smx.description:Secure Driver for HTC Security

Edit#2

config.s.lazy_instantiation:true
config.s.multi_instance:false
config.s.multi_session:true
config.s.multi_command:true
config.s.default_stack_size:1024
config.s.heap_size:8192
smx.name:SampleService
smx.vendor:TRUSTED LOGIC
smx.description:Sample Service
config.data.widevine_key:deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5deadbee5
config.data.widevine_key.size:1024

A dead bee could be the key ??? lol ^^
[HTC One X] pandaball:
Chanced upon this while looking for something else entirely. Might be useful: http://su3.me/all-about-htc-phones-bootloader-security-system/
[HTC One X] deadwilder:
maybe something useful. Trip wrote new powerboard and due to that as he says

http://xdaforums.com/showpost.php?p=36719110&postcount=256

maybe APX? maybe finally access to hidden partitions?

check this thread http://xdaforums.com/showthread.php?t=2092946
[HTC One X] Thunder07:
someone posted this before on another thread, not sure if its the same person, someone else or what.

but long story short.... i don't see any new information on the table.... or do you??

ya this would almost guarantee us an s-off... but it will only work with unlocked bootloader... and at this very moment i'm not gonna argue with that, however,

it will finally give us for access to everything on the phone.. to allow those with knowledge find an exploit for everyone :highfive:
[HTC One X] marice22:
deadbee5 reminds me of this:

http://www.ps3devwiki.com/wiki/Flash:0FACE0FF_DEADBEEF

Ps3 magic number :)
[HTC One X] TripNRaVeR:
Not sure if this is any help but maybe you can do something with it.

mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22

[ 3.379131] Adding recovery (SOS) as MMC partition 21: offset 7864320 bytes, size: 8388608 bytes
[ 3.379475] Adding boot (LNX) as MMC partition 22: offset 16252928 bytes, size: 8388608 bytes

boot size of mmc0 is 4194304

Tried to mount recovery as yaffs2 but that failed, mmcblk0p4 cannot be mounted with current progress, mmcblk0p5 can be mounted as soon as i have correct filesystem, it gives error about filesystem.

Anyone knows the various filesystems for all partitions?
[HTC One X] feraay:
AW: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

You mean something like this??

Ah OK you mean the Format of filesystem?

Code:

[partition]

name=BCT

id=2

start_location=0x00

size=0x400000

[partition]

name=PT

id=3

start_location=0x400000

size=0x200000

[partition]

name=EBT

id=4

type=bootloader

start_location=0x600000

size=0x400000

[partition]

name=DIA

id=5

type=bootloader

start_location=0xA00000

size=0x400000

[partition] (Board Information)

name=BIF

id=6

start_location=0xE00000

size=0x200000

[partition]

name=GP1

id=7

start_location=0x1000000

size=0x200000

### WLAN firmware ###

[partition]

name=WLN

id=8

start_location=0x1200000

size=0x600000

#filename=wlan.img

### WLAN Data + MFG Data ###

[partition]

name=WDM

id=9

start_location=0x1800000

size=0x200000

filename=WDM.img

### Radio Calibration Data ###

[partition]

name=RCA

id=10

filesystem_type=ext3

start_location=0x1A00000

size=0x600000

### Linux Kernel OS ###

[partition]

name=LNX

id=11

start_location=0x2000000

size=0x800000

filename=boot.img

### Recovery ###

[partition]

name=SOS

id=12

start_location=0x2800000

size=0x800000

filename=recovery.img

### PG1FS ###

[partition]

name=PG1

id=13

start_location=0x3000000

size=0x1000000

### PG2FS ###

[partition]

name=PG2

id=14

start_location=0x4000000

size=0x1000000

### PG3FS ###

[partition]

name=PG3

id=15

start_location=0x5000000

size=0x1000000

### Software Info ###

[partition]

name=SIF

id=16

start_location=0x6000000

size=0x400000

filename=SIF.img

### Splash1 ###

[partition]

name=SP1

id=17

start_location=0x6400000

size=0x400000

### Reserve1 ###

[partition]

name=RV1

id=18

start_location=0x6800000

size=0x1C00000

### System ###

[partition]

name=APP

id=19

filesystem_type=ext3

start_location=0x8400000

size=0x50000000

filename=system.img

### Cache ###

[partition]

name=CAC

id=20

filesystem_type=ext3

start_location=0x58400000

size=0x14000000

### Internal SD ###

[partition]

name=ISD

id=21

start_location=0x6C400000

size=0x650000000

### Userdata ###

[partition]

name=UDA

id=22

filesystem_type=ext3

start_location=0x6BC400000

size=0x89400000

filename=userdata.img

### Memory dump ###

[partition]

name=DUM

id=23

start_location=0x745800000

size=0x200000

### MISC Partition ###

[partition]

name=MSC

id=24

start_location=0x745A00000

size=0x200000

### Radio File System ###

[partition]

name=RFS

id=25

start_location=0x745C00000

size=0x600000

### Develop Log ###

[partition]

name=DLG

id=26

start_location=0x746200000

size=0x1600000

### PDATA for MASD ###

[partition]

name=PDT

id=27

start_location=0x747800000

size=0x200000

[partition]

name=GPT

id=28

type=GPT

start_location=0x747A00000

#size=0xFFFFFFFFFFFFFFFF

size=0x200000

Gesendet von meinem HTC One X mit Tapatalk 2
[HTC One X] Braindamage1989:
Keep in mind this is the data from an ENG ROM that was released before the HOX got shipped. The partition table could be changed!

For those who care:

Someone managed to make changes to p9, at the radio version (don't know who and where, but know how he did). While this partition normally is write protected, so thats a good start (although it doesn't have any effect).

Also more to come soon!
[HTC One X] TripNRaVeR:
Is there any change we could know how they are formatted currently? Like /system ext4 /data ext4 recovery? boot?
[HTC One X] Thunder07:
This is a much older list I've got from the debug rom Xmoo posted awhile ago,

while they aren't very useful the boot/system are listed as "filesystem_type=basic"

and so are the Internal storage and devlog...

can't you just mount it as RAW file system??

Edit:

Basically since dd is the method used to update the kernel on some phones ( I know some Samsung do anyway)

I do t think they have a partition type?

note i removed alot of the partitions as they serve no use to my point,

if you want them listed let me know.

[device]
type=hsmmc
instance=3

[partition]
name=EBT
id=4
type=bootloader
allocation_policy=sequential
filesystem_type=basic
start_location=0x600000
size=0x400000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=hboot.img

### Radio Calibration Data ###
[partition]
name=RCA
id=10
type=data
allocation_policy=sequential
filesystem_type=ext3
start_location=0x1A00000
size=0x600000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0

[partition]
name=BIF
id=6
type=data
allocation_policy=sequential
filesystem_type=basic
start_location=0xE00000
size=0x200000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
#filename=board_info.bin

### Linux Kernel OS ###
[partition]
name=LNX
id=11
type=data
allocation_policy=sequential
filesystem_type=basic
start_location=0x2000000
size=0x800000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=boot.img

### Recovery ###
[partition]
name=SOS
id=12
type=data
allocation_policy=sequential
filesystem_type=basic
start_location=0x2800000
size=0x800000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=recovery.img

### System ###
[partition]
name=APP
id=19
type=data
allocation_policy=sequential
filesystem_type=ext3
start_location=0x8400000
size=0x50000000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=system.img

### Cache ###
[partition]
name=CAC
id=20
type=data
allocation_policy=sequential
filesystem_type=ext3
start_location=0x58400000
size=0x14000000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0

### Internal SD ###
[partition]
name=ISD
id=21
type=data
allocation_policy=sequential
filesystem_type=basic
start_location=0x6C400000
size=0x650000000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0

### Userdata ###
[partition]
name=UDA
id=22
type=data
allocation_policy=sequential
filesystem_type=ext3
start_location=0x6BC400000
size=0x89400000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=userdata.img

### Develop Log ###
[partition]
name=DLG
id=26
type=data
allocation_policy=sequential
filesystem_type=basic
start_location=0x746200000
size=0x1600000
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
[HTC One X] TripNRaVeR:
I have no clue, i'm trying for a while now to find them.

Mounting mmcblk0p5 as ext4 errors out, choosing yaffs or yaffs2 starts mounting it but fails with dev 187... some numbers here and then it stops
[HTC One X] Lloir:
Little bit of cleaning done AGAIN
[HTC One X] TripNRaVeR:
Maybe this is usefull to;

http://pastebin.com/0vsRFSeA

just changed the boot partition on mmcblk0boot1 forced read only value from 1 to 0

update:

mmcblk0/mmcblk0boot0/force_ro 0

mmcblk0/mmcblk0boot0/ro 0

mmcblk0/mmcblk0boot1/force_ro 0

mmcblk0/mmcblk0boot1/ro 0

this is basicly what we need correct?
[HTC One X] MrT69:
Don't know if you know this page:

https://devtalk.nvidia.com/default/board/105/

But this seems to be very interesting:

https://devtalk.nvidia.com/default/...failure-to-flash-os-image-to-cardhu-dev-kit-/

BUT (...wtf is there always a damn BUT...) it seems that it is a process to become a member of this board. It should takes day's to weeks until someone will get access to this forum.

Also the download for the JB Devel Image and Files is restricted only to members.

This would be the Link:

https://developer.nvidia.com/rdp/as...r-cardhu-jb-10-windows-2012-10-20-11617556exe

but it is restricted and only possible to users of the dev board.

This is the Page for the Android Dev Tools:

https://developer.nvidia.com/tegra-android-development-pack

I guess this would be the file:

tegra-osinstaller-cardhu-jb-10-windows-2012-10-20-11617556.exe

I have already done a search but did not found this file within the web.
[HTC One X] Lloir:
Having a conversation about the Nvidia\Tegra website DOES NOT = Development...nor does a random conversation about some old files and where to get them.
[HTC One X] TripNRaVeR:
Note sure if you allready know,

The key(s) to set S-Off and some other settings can be found here:

/sys/firmware/fuse

Normally that dir is hidden but if you chmod it then the contents are visible. Almost everything can be read if you change permissions. Only the security key cannot be read.

Probably with a FUSE mount tool (fusermount) we can maybe read the contents. Also the other flags can be usefull i guess.

edit:

look for

/sys/firmware/fuse/secure_boot_key

edit 2:

fuse filesystems require the file

fuse.conf

add this to

/system/etc/fuse.conf

add the following into the file:

user_allow_other

edit 3:

to unmount

fusermount -u /sys/firmware/fuse

or

fusermount -z /sys/firmware/fuse

Both dont work because it -seems- that they are mounted with the "root" flag, i have no clue at this point how to remove it.
[HTC One X] TripNRaVeR:
Can you read secure_boot_key? I can read everything and change permissions except that file. Not able to get any write acces now.

edit:

with old hboot you can maybe try fastboot -c androidboot.mode=mfg boot boot.img, that brings you in manufactory mode
[HTC One X] TripNRaVeR:
Try it setting engid=0x1 and maybe you also need to remove the identification as a SHIP build. My kernel is loaded as a ENG kernel.

I will build a 2.6.39.4 kernel only for purposes of getting s-off.

Meaning setting ENG as default, using HTC Engineering ID as identification, override boot mode as MFG etc etc.

Then we should have at least an correct enviroment to work on, when we use this road to S-OFF, i strongly believe there is a very easy way to gain S-Off. It is stored on mmcblk0.

Yesterday i enabled mmcblk1 card that worked correctly but there wasnt anything special on it.

I had;

- tegra-sdhci.0

- tegra-sdhci.2

- tegra-sdhci.3

All of them are stored on mmcblk0, strang thing tough, tegra-sdhci.1 is NOT found on mmcblk0, maybe there is the answer? I dont know, but i suggest this being investigated further. mmcblk0 and mmcblk1 can be enabled and accessed now. If people are interested i enable them and upload the kernel, it brakes audio tough because the device address is moved.
[HTC One X] Thunder07:
ya that would be great... the massive disadvantage is that we have practically no access to any of the partitions such we're limited to what we can do... but once we have access... s-off will be much easier, hopefully.

when you can you do post it here or PM me anyway :)

also... how hard is it for you to create a similar kernel for HOX+??

in all honestly, it doesnt even have to boot.. it just need to give us the same lvl of access through adb... do our thing and reboot into a normally working kernel... but that's for later :p

however, the next step is finding a n exploit which everyone can use to avoid using htcdev all together

Ill Be Expecting You :cool:
[HTC One X] TripNRaVeR:
When i use mmcblk0boot0 and ..boot1 i have rw acces, can set ro and force_ro to 0.

Would there be any possibillity to flash/update stuff at that moment? Can i mount that **** in recovery, then remove ro/force_ro and write to the partitions?

Asus tablets use that method to write the unlocked bootloader/boot.img from recovery.

Another thing, when i mount the MISC partition correctly, with the proper filesystem, the phone keeps rebooting after init lol. Is this the hboot protection? If that is the case then i can skip that method and hack fuse.

Oh ps. for those wanting to run MFG mode, you need a mfg ramdisk. You can find it in RUU released in feb 2012 (quick guess), the one with hboot0.96.
[HTC One X] Thunder07:
this is what i was hoping for... though i thought up of an even safer way...

though it's may require few extra steps....

you need to access the MISC partition,

look for mainver, hboot ver and cid ( they should be in MISC)

change mainver/hboot to something like 0.01 and cid to superCID (not sure if there is a variable for hboot version, the check might be done directly from the hboot)

then lock bootloader and flash ENG 0.03 hboot

s-off and flash a newer hboot

but are you really asking us... you're the one with access to them, not us :p
[HTC One X] Lloir:
Seriously guys.............KEEP ON TOPIC!!! thread cleaned! YET AGAIN, i'm quite easy going,

READ THIS

this point on-wards infractions are a huge possibility