yashsingh1/xdaforums huggingface dataset:
[HTC One X] O_G:
MOD Notice​

Please people, lets keep this thread on topic. Show some respect to the OPs wishes. He might not be able to hand out infractions, but i can. No more OT.​
[HTC One X] Drefsab:
I know I will probably get a warning for posting this but you guys might want to message trip to advise if you guys meant him at all because he has posted:

Noeri ... ‏@TripNRaVeR

no more s-off development for me, not going to risk warnings when trying to discuss gaining s-off, the policy there is to risky for me

@TreeBoommm i didnt get warned, but 1 or 2 posts of me where removed to, and when i get a warning i'm banned, so i'm just quiting to be safe

I've replied with:

@TripNRaVeR think their comments were more aimed at people like me who while trying to be helpful may not be contributing any code or such.

Id hate to see the only promising development towards S-OFF in a long time to die because the dev is scared of getting banned because users might reply to him (like my offer to help with the custom made kernel for older hboots like mine).
[HTC One X] O_G:
Nobody is going to get banned if they stay on topic and follow the rules. The warning i posted was a general one, not aimed at a individual user. Any user is free to post in this thread if they are contributing to the discussion. Its when it goes off topic is when we have the problem. I have no intention of preventing a user from posting here, if they feel their post has been deleted wrongly, please contact a member of the moderation team for action. We will look into it.

Now for your post. I was very clear that i wanted this to continue on topic, so why post this here? A PM to myself or a member of the moderation team would of cleared this up. The only reason i am going to leave it at that is i understand you are concerned about the development of this thread, i hope i have cleared that up now. So please, on topic only!
[HTC One X] MrT69:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

I don't know if this will help but this Problem remember me to an problem I have had years ago as I have build a custom Rom for Desire HD.

My ROM Bootes but with lot of errors. This was the reason why I have rebuild a boot.img where I set every security to root with full r/w permissions for everything. Also the system permissions I set to root with full r/w (0777) to everything.

I would not recommend this for daily usage but for access some files which are normaly not accessable this might work.

The Phone was starting without Problems. But it was DesireHD and it was long time ago.
[HTC One X] TripNRaVeR:
I tried setting everything rw, still the secure key cannot be read, therefore it is something interesting. Problem that it must be readable at boot and not at running system. We really need an extended recovery to get more access
[HTC One X] Thunder07:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

Secure key is something interesting...

It's referred to as sbk in Asus transformer,

Without it apx=useless

Like I was in connect with someone with apx not more than a month ago (as pm'ed you about it) and had to find out about it the hard way (you know I was excited I found a apx but couldn't do anything with it), I was also connected to his pc remotely so I knew it was genuine.

Sent from my EndeavorU
[HTC One X] Mr_S:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

http://xdaforums.com/showthread.php?p=36134906

Something like this

Sent from a dark place
[HTC One X] nitrous²:
AW: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

Couldn't this be done via UART? This should allow you to debug the boot process. Samsung devices got their bootloaders hacked this way.

Thank people as long as you can...
[HTC One X] MrT69:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

Intersting.

At the moment I'm waiting for some informations and I plan to force my HOX to run into APX Mode by killing the hboot Partition. I cross my fingers that this will help to run into APX :)

Do you know more about the APX Mode?

BTW - i know that it is possible to read the key within APX MODE. OK, better to say it should be possible :)
[HTC One X] Thunder07:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

We don't uave access to UART,

Also this would make kernel debugs so much easier.....(or so I hear) But as I said we don't have/have access to it

Just that you'll be stuck in it forever without the ability to run a single cmd if you don't find your sbk,

Note it might be the same or it might be different, for each phone, if it's different the chances are no one but HTC will ever be able to fix your phone,

So I wouldn't risk it just yet.

Also if by killing you mean dd /dev/null

Well show-p tried that on mmcblk0,

He ended up with a green screen asking for rom.zip,

Which means the hboot wasn't touched...

However, you might have more luck doing that with trips planned development kernel, still too risky at this stage.

Sent from my EndeavorU
[HTC One X] TripNRaVeR:
I have gained access to some neat tools!

The tool is also able to boot into diag58, currently i'm running it userspace and can freely set everything i want. I tried entering diag58 but it was waiting on modem. Going to try to read the secure key, it has basicly acces to everything.
[HTC One X] MrT69:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

Found this:

http://a500bootloaderflash.tk/sbkcalc/

May be lcd047 could help at this point also for the HOX.
[HTC One X] Thunder07:
unfortunately our sbk is very much different,

" It should be a 16 character long string containing only hexadecimal characters"

our only CPUID is one number long :/

i think ours is referred to as sbk v2 as well and it's yet to be cracked.

:crying::crying::crying:

i know guys i'm shooting down everything you're coming up with..

but i have to before someone starts a discussion & fill the thread with it...

i've been there and tried ALOT of stuff
[HTC One X] TripNRaVeR:
Set odm production mode from 0x00000001 to 0x00000000 and we have what we want. How?

Well that isnt as easy as expected..

Somewhere during boot there is a check if we are in production mode or not. If we are in production mode then all locks are set. If we arent in production mode all locks are off and we have s-off.

Then we remove the check and its done. We know that the flag can be set in the fuse directory. However it requires a kernel patch, the write protection can be turned of for that section.

Where to find it?

Look at nv-tegra git, there is bootloader source and try to find it (probably htc renamed it)
[HTC One X] blubbers:
tried that back in may, but i couldn't get the fuses to be writeable, tried this instead;

endeavoru-2.6.39-86aa44d/arch/arm/mach-tegra/tegra_odm_fuses.c

static bool fuse_odm_prod_mode(void)
{
u32 odm_prod_mode = 0;

clk_enable(clk_fuse);
get_fuse(ODM_PROD_MODE, &odm_prod_mode);
clk_disable(clk_fuse);
return false;
return (odm_prod_mode ? true : false);
}
[HTC One X] TripNRaVeR:
You also need to have the vdd_fuse voltage line enabled to gain write acces, you can find the source in my kernel tree on github

Edit:

https://github.com/TripNRaVeR/tripn...mmit/254f1fe1089ea480353d0a443752d4ea27624646

Somehow this brings the device into APX mode when u have a ENG kernel, these bricks somehow could be usefull to gain s-off.

If we write the fuses correctly it is done.
[HTC One X] MrT69:
Also for the A500 Series - but Tegra chipset.

Some interesting informations and also the links within:

http://projects.pappkartong.se/a500/
[HTC One X] TripNRaVeR:
And another thing that also belongs here, have full acces to my device right now during APX mode.

http://xdaforums.com/showpost.php?p=37133727&postcount=4973
[HTC One X] TripNRaVeR:
Got this key out of the 0.40 hboot

0x15d15b4fb63ee0b
[HTC One X] xmoo:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

I got 2 ENG and 2 MFG HBOOTs for you as .img to play with.
[HTC One X] TripNRaVeR:
That would be very usefull!

Another update, anyone knows about decrypting?

You can do this:

The hboot/bootloader partitions are encrypted with AES128 CBC you can decrypt them with libgcrypt (?)

Use the secure_boot_key to do that.. want to have youre secure_boot_key for HOX?

Take youre UID and start "decompiling" it

split it in groups of 4 like this:

for each part, take the ascii values and multiply those with 100 raised to the position.e.g.

UID 89AB will give the following

56*100**3 + 57*100**2 + 65*100**2 + 66*100**0 = 56576566.

Enjoy decrypting and post results please

ps. to actually get the BCT use this: (you need root for now)

use dd from mmcblk0 and then decrypt it using the obtained secure_boot_key

addition

this could mean s-off if it all works out
[HTC One X] Jhinta:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

Rase with positon ? You do mean 3,2,1,0 in you exemple and not 3220 right ?

Verstuurd van mijn EndeavorU met Tapatalk
[HTC One X] TripNRaVeR:
True but that is my view.. both could be right here so best way to go is to try both methods.
[HTC One X] Jhinta:
http://xdaforums.com/showthread.php?t=1810618

0x045CD601 0xAA481000 0xB701F402 0xD4132Justtobesure:cyclops:

a forgot still need to try to decrypt it

some more info http://projects.pappkartong.se/a500/#download
[HTC One X] Thunder07:
where do we get the UID from??

and what is the address and size of mmcblk0 that we are dd'ing??
[HTC One X] Jhinta:
most likely usb uid and even maby or only apx uid can be a diverance.

and its for bct file as i read , but i dont know whitch file already are public or found trip you got some files dumpt ? ore know of that are already online?
[HTC One X] Thunder07:
Trip said dump BCT which is found somewhere in the mmcblk0

dumping the whole thing=useless
[HTC One X] TripNRaVeR:
hal-get-property --udi "$(hal-find-by-property --key 'info.product' --string 'HTC One X')" --key 'usb_device.serial'

download bct here:

http://www.datafilehost.com/download-b7a1e658.html
[HTC One X] Thunder07:
ok....

so i just tried decypting with no luck

and this is how i've done it,

didn't know which one is the uid so i did it twice once with VID and 2nd with PID

and with both 3,2,1,0 configuration & 3,2,2,0

48*(1000000) + 66*(10000) + 66*100 + 52*1

48*(1000000) + 66*(10000) + 66*10000 + 52*1

49*(1000000) + 100*(10000) + 57*(100) + 55

49*(1000000) + 100*(10000) + 57*(10000) + 55

after getting the answer i used 2 different aes decryption apps to decypt btc.ing and used the answer as password when i was prompted

both give me the error, not aes encrypted or password is invalid :/
[HTC One X] eppeP:
I guess some of you have started to figure this out, but just to be clear as there seems to be some confusion.

The SBK is chosen by the manufacturer.

Acer have choosen to (for some of their models) base the SBK on the UID. This does not neccessarilly mean that this is the way it is for any for any devices by any other manufacturer, or even for other models from Acer. It could be that they have chosen to do it the same way, but it is highly unlikely.
[HTC One X] TripNRaVeR:
Using nvflash on a Asus tf201 makes you get the SBK the same way based on UID. Toshiba SBK also the same way.
[HTC One X] blubbers:
this gets you the same as

cat /sys/devices/platform/android_usb/usb_serial_number

or

adb devices

which device is the bct from?

either way, we don't have access to the bct/ebt partitions as they are somehow masked, even to the kernel; or you could dump them from the raw block device mmcblk0
[HTC One X] backfromthestorm:
That's not the correct ID then if its the same as the device ID is it?

Hence it's under dummy_usb_serial_number in /platform/android_usb/
[HTC One X] MrT69:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

I don't know if this might be important but JB devices seems currently have no chance to managed with NVFLASH.

Every other Tegra3 device i.e. A500 can be flashed but all discussion ends with "...if you have JB installed no chance"
[HTC One X] backfromthestorm:
androidboot.sf=1 androidboot.skunum=0 androidboot.cid=HTC__001 androidboot.mid=PJ4610000 androidboot.serialno=HT242W104819 androidboot.mb_serialno=419G223L11977 androidboot.bootloader=1.39.0000 last_off_event=pmu_poweroff start_on_event=none hw_rst_reason=0x0 sw_rst_reason=0x0 project_phase=A radioflag=0x0 ats=0 hlog.ofs=296 un.ofs=0 HBootTemp=0 androidboot.engid=0x0

In proc/cmdline there lists two serial numbers, one is the device id from adb devices, the other isn't, or is that the motherboard id?
[HTC One X] eppeP:
At the risk of going slightly of topic, would you care to share some sources for this statement?

I can't seem to find anything but failed attemts for Toshiba (except those models without SBK). For the tf201 the only method I can find seems to rely on using a patched bootloader to, I presume, generate pre-signed RCM messages while the SBK is still available. Which would seem to be a quite convoluted way of doing things if the SBK (or the algorithm to generate it) is known.
[HTC One X] TripNRaVeR:
The bct file is from the HTC One X... only encrypted.
[HTC One X] ExoticMe:
can it be decrypted ?
[HTC One X] blubbers:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

No, it is not encrypted, the data is not random and can be decoded using some bct decoder
[HTC One X] The_Genius:
If some one will give me an output of first 32-128 bit how the file header may look like, I will decrypt the rest.
[HTC One X] eppeP:
There is nothing to decrypt, as have already been stated the file is not encrypted.

The first 16 bytes is the signature (an AES128 CMAC built using the SBK or, as in this case where no SBK is set, an all zero key).

The signature matches the following 6112 bytes of unencrypted data.
[HTC One X] TripNRaVeR:
So if i understand you correctly this file is good as is and can be used as is with nvflash..?

We have the bct and cfg for nvflash then.

edit:

some crazy tought, just want to make sure

is there some way to change version number of hboot?

if yes we can just flash the ENG hboot as long as it has a higher version number then the current one..?
[HTC One X] Thunder07:
not without direct access to partitions....

the thing i've noticed is that in all OTA's firmware.zip and ruu.zip

they'd include both mainvar & radio version in android-info.txt but not the hboot's...

which means the hboot checks for it's own version from within itself and not from a fixed location which we could change... well, you can always risk bricking your hboot and editing the 1st few lines and see if it works

having said that... we dont have access to any of the partitions to verify..

you could atleast release a full access read only kernel which we can use to look for the location of these values.. though i've been having for sometime for full access kernel

with all that said,

i know the hboot "checks for hboot version" before updating itself...

though we don't know if its just a fake print or is it done for real..

as a hboot always contains a higher mainver(which is definitely checked).. so whats the use of checking for hboot version if the update will fail anyway when mainver is lower.
[HTC One X] TripNRaVeR:
Then we change the mainver of a firmware package? Firmware package isnt signed so that wont be a problem.
[HTC One X] Thunder07:
yes and no...

if you set the mainver higher it will flash.. if you set it lower it wont...

however.. if the package contains something like recovery & kernel it wont check for a signature...

but throw in a hboot(or anything else for that matter) and it will fail verifying the signature... (let me look for my attempts)

i've tried it, it doesnt work like that,

if they weren't no one would have needed to wait for their carrier to release an ota,

we would have just changed the CID in the package and VOLA!!

i was more thinking of editing the mainver in the partitions and then attempting something like that.

... keep in mind... the hboot check thing is only a theory, they most likely have a check for it, i just think its a bit of a waste.

Edit:

i dont remember this far...

but i think neither the recovery nor the kernel flashed this way, though it said they flashed.

i think they attempts that worked were done with locked bootloader.
[HTC One X] xmoo:
If it is correct what you say, then they changed it aswell.

BEcause one of the easiest s-off methods back in the days was replacing the hboot.

I believe ENG and MFG don't have secuflag on. I haven't seen any ENG/MFG phones with S-ON. So theoretically it should be able to provide s-off.
[HTC One X] Lloir:
Thread cleaned....for the love of god STOP GOING OFF TOPIC either contribute to the current topic or keep your fingers away from the keyboard

thanks

-Lloir
[HTC One X] blubbers:
i don't know about that, but if you can replace the hboot, you can replace it with a modified SHIP hboot as well... i've already uploaded a patched hboot a few months ago

http://xdaforums.com/showthread.php?p=25819078#post25819078
[HTC One X] scotty1223:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

The radio secureflag has nothing to do with Eng s off.

An Eng,dev,or patched hboot is just ignoring the radio, the secure flag is still on.

S off via an Eng or patched hboot swap is not possible on today's complicated phones... We need radio s off.
[HTC One X] TripNRaVeR:
Can you please make a 1.33 patched hboot? I want to test a couple of things. Would be nice if you could make one. It needs to be 1.33 tough.
[HTC One X] blubbers:
sure, can you upload it? only got 1.31/1.36/1.39

btw, what is the status of getting into/out of APX? would love to check it out
[HTC One X] Thunder07:
get the ENRC2B kernel and try this "adb reboot forced-recovery"

im guessing Trip didn't announce it.. since he doesn't have a way out of it ...

BE CAREFULL, TRY ON YOUR OWN RISK
[HTC One X] TripNRaVeR:
I'm sorry i meant 1.36. Little mistake.
[HTC One X] jotha:
Again removed irrelevant and trivial information.

C'mon guys, we try to maintain here a level ABOVE the common and trivial knowledge. So please guys (especially MrT69), if you can't keep that level there, just keep out of the discussion and play somewhere else. This isn't your playground here.

We are really starting to loose our patience. This is the last time that this will stay without any infraction.
[HTC One X] farhanito:
hi, i'm no dev.. but i think my phone has something interesting..

my one x can get in and out of APX mode.

http://xdaforums.com/showpost.php?p=37356013&postcount=5195

but currently it's completely read-only.

i'm not sure this would help. but if you guys need something to test, just point me the direction..

btw, i tried nvflash from Trip's thread
[HTC One X] Emba4:
not sure if itll be any help but i have access to an s-off one x+, just let me know if anyone wants me to try anything out on it or dump anything
[HTC One X] jotha:
After Lloir had to clean again some totally OT- or irrelevant posts I issued the first infractions today. You'll never learn, huh?
[HTC One X] Lloir:
Re: Goal: S-off HOX+ and maybe the HOX (TEGRA3)

I would like to remind you all to read the section rules. For the very final time!!
[HTC One X] backXslash:
True it's for another chipset so the S-OFF portion won't work, but (and I may be wrong) I don't see a reason the SuperCID thing won't work for us, provided we find the right partition to edit.

http://xdaforums.com/showthread.php?p=26516911#post26516911

This is for the One X, and it's also confirmed to work on the One S, and they're editing /dev/block/mmcblk0p4 with root permissions. I'm ASSUMING that means that S-ON is only partially enforced. If we could get SuperCID, that's be a huge step in the right direction, would it not? Does anyone know what that partition actually is, and what the analogous partition on the One X+ is?

__________

Upon further investigation, /dev/block/mmcblk0p1 through /dev/block/mmcblk0p11 are all -something- though none of them contains strings for my CID or IMEI. HOWEVER, /dev/block/mmcblk0p9 DOES contain the string value for the last RUU flashed, which in my case is 1.17.401.1, with the entire rest of the file being padding.

There are more partitions, beyond 11. They actually go up to 20, as per ls -la /dev/block/, but everything beyond 11 seems to be excessively large.

-------

Sorry for the continuous posting, but I'm investigating. Anyway, the command "ls -la /dev/block/platform/sdhci-tegra.3/by-name/" yields a partition map with names.

lrwxrwxrwx root root 2013-02-19 11:08 APP -> /dev/block/mmcblk0p12

lrwxrwxrwx root root 2013-02-19 11:08 CAC -> /dev/block/mmcblk0p13

lrwxrwxrwx root root 2013-02-19 11:08 DLG -> /dev/block/mmcblk0p18

lrwxrwxrwx root root 2013-02-19 11:08 DUM -> /dev/block/mmcblk0p15

lrwxrwxrwx root root 2013-02-19 11:08 LKM -> /dev/block/mmcblk0p20

lrwxrwxrwx root root 2013-02-19 11:08 LNX -> /dev/block/mmcblk0p4

lrwxrwxrwx root root 2013-02-19 11:08 MSC -> /dev/block/mmcblk0p16

lrwxrwxrwx root root 2013-02-19 11:08 PDT -> /dev/block/mmcblk0p19

lrwxrwxrwx root root 2013-02-19 11:08 PG1 -> /dev/block/mmcblk0p6

lrwxrwxrwx root root 2013-02-19 11:08 PG2 -> /dev/block/mmcblk0p7

lrwxrwxrwx root root 2013-02-19 11:08 PG3 -> /dev/block/mmcblk0p8

lrwxrwxrwx root root 2013-02-19 11:08 RCA -> /dev/block/mmcblk0p3

lrwxrwxrwx root root 2013-02-19 11:08 RFS -> /dev/block/mmcblk0p17

lrwxrwxrwx root root 2013-02-19 11:08 RV1 -> /dev/block/mmcblk0p11

lrwxrwxrwx root root 2013-02-19 11:08 SIF -> /dev/block/mmcblk0p9

lrwxrwxrwx root root 2013-02-19 11:08 SOS -> /dev/block/mmcblk0p5

lrwxrwxrwx root root 2013-02-19 11:08 SP1 -> /dev/block/mmcblk0p10

lrwxrwxrwx root root 2013-02-19 11:08 UDA -> /dev/block/mmcblk0p14

lrwxrwxrwx root root 2013-02-19 11:08 WDM -> /dev/block/mmcblk0p2

lrwxrwxrwx root root 2013-02-19 11:08 WLN -> /dev/block/mmcblk0p1

This is from CM10.1, with the latest BLADE kernel, radio 3.1204.167.31 and HBOOT 1.35. Does anyone know what's what here?
[HTC One X] Giblet-dono:
The reason the SuperCID won't work for us, was also unclear to me for a long time..

Someone finally explained why.

The CID Is not saved the same way as with qualcomm chips!

A different location or way of saving data, not traditionally on a partition.

So this will not help/work us in any way
[HTC One X] sieempi:
my research on hox

Actually some info is stored on a partition that is not easily accesible in android (DIA not mapped). CID, for example, along with IMEI are stored, I believe, @ 00a00015.

This is a hexdump -C of /dev/block/mmcblk0

00a00000 48 54 43 2d 42 4f 41 52 44 2d 49 4e 46 4f 21 40 |HTC-BOARD-INFO!@|
00a00010 9e 00 00 00 48 54 43 5f 5f 30 33 32 33 35 33 34 |....HTC__0323534|
00a00020 xx xx xx xx xx xx xx xx xx xx xx 00 23 05 00 00 |xxxxxxxxxxx.#...|-> imei not
00a00030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| shown

I believe a lot of other flags are found in this area. It would be nice to map this to a partition in a custom kernel for easier access.

I even tried the following:

dd if=/dev/block/mmcblk0 bs=1 skip=10485780 count=8 of=/sdcard/a.bin (a.bin has the actual CID)

hexedit a.bin to supercid

dd if=/sdcard/a.bin of=/dev/block/mmcblk0 bs=1 seek=10485780 count=8 (patch with supercid)

but due to some protection mechanisms I don't yet understant, the changes are not submitted to emmc. (we need a tegra3 advisor)

I think this might be the place to hit if we, somehow, get access to rw.

If anyone is having heavy stuff to test, I'm willing to be the rat test. So far I'm trying to force into apx with TripNRaVeR's buggy rom version for further insights, but I've been "unfortunate" so far.

PS: each time I'm running fastboot oem boot my phone doesn't boot, nor says anything, but gets stuck in fastboot - it needs a forced poweroff; any ideea why? (I don't recall to have this issue with other phones)

PS2 @ teemo: that is NOT linux LNX partition, but a part of DIA partition which is hidden to android!
[HTC One X] Lloir:
i would like to point out the following

1) This thread is for the HOX AND HOX+

2) Your crap does NOT = development or anything of the sort