[One (M7) Original Android Development] spaboleo:
Hey,

first of all...I'm not a developer, but reading along in this thread kept me thinking :D

Though 1:

How does the htcdev unlock routine actually work on the phone side?

fastboot flash unlocktoken Unlock_Code.bin

So unlocktoken is the name of a partition, I guess?

In a video that I watched to get to know the htcdev-unlock process it took the phone 0.151s to transfer and flash the code.

Is it somehow possible to hijack this routine or the "unlocktoken" partition?

What if a faulty code is provided?

Is the phone somehow unprotected while the unlocktoken is flashed? Is it checked afterwards? I mean it has to...or can the phone access the file on the computer? I assume it has to be written to the unlocktoken partition first.

How does is it executed then? Or is the unlocktoken partition (if it is a partition) supervised somehow, so that new incoming bins are executed automagically?

What if the length of the token is increased so that processing it will consume more time? Time, which (if there really is less protection) can be used to smuggle code in?

Thought 2:

What about USB to Go?

What about Goldcards, like with the HTC Desire? Or more like a Gold-USB-Stick?

That allowed to disable the CID-check and let everyone downgrade to versions of other carriers? And by that downgrade the HBOOT? If I am recalling that correctly...

Thought 3:

How does HTC equip the phone with the software in the first place?

As far as I know production processes like this, they take a batch of phones, connect them on a tray and let them be flashed all at once, followed by a few quick software checks.

Is a different Port than the USB-One used, before the phone's case is fully disabled? I can't really imagine, why they would integrate a second port that is otherwise useless, to be honest. It would only increase cost.

Or is there a hardware lock, like a circuit that needs to be closed in order to allow this low-level flashing?

And if the phones are no longer positioned on the "flashing tray" the open circuits are no longer hot-wired?

In a "Drop-Test Video" of the HTC One (which I generally find stupid, but somehow still watch them when considering to buy a new phone) I saw that the metal cover of the speaker flunked off. It was clipped secured in place via snap-lock connectors. Maybe that's an option?

Or is this done solely via Software?

Thought 4:

I checked the long list of some fastboot commands of the HTC Rezound (http://xdaforums.com/showthread.php?t=1617964).

Am I assuming correctly that they depend on the bootloader version? So HTC could have defined their own commands? Hence the command:

fastboot [b]oem[/b] ...

And I guess the execution of the interesting ones is determined via the security flag?

Yet, there must be some way for the guys in the service department to access some sort of log from the phone, without actually unlocking the bootloader of the phone each time, right?

If there is some command that creates a log, that will obviously be a larger amount of data to write.

Might it be possible to sneak some commands in, while this is written and if it is written onto a protected partition?

Thought 5:

What about erasing the whole eMMC?

Won't this erase the bootloader and it's security features as well?

And then wouldn't it be possible to downgrade via RUU? No wait...then there wouldn't be any bootloader to accept the commands to flash, right?

Sorry guys for my crazy and probably pretty naive thoughts :) :eek:

Would still be nice to hear some feedback :fingers-crossed:

All the best