yashsingh1/xdaforums huggingface dataset:
[One (M7) Original Android Development] russel5:
Man calm down, just check, that not complicated, you will not be killed for it
[One (M7) Original Android Development] ParanormalBat:
Or will he?
[One (M7) Original Android Development] Theshawty:
Another thing showing nothing flashed: The build date of my hboot is exactly the same as before, so yeah..
[One (M7) Original Android Development] maarawoe:
Don't be so pessimistic...:(
[One (M7) Original Android Development] Theshawty:
This is the harsh truth, mate, really no need to sugar coat it.
[One (M7) Original Android Development] russel5:
are you try revone?
[One (M7) Original Android Development] zaphodbeeb:
please try revone. The suspense is killing me.
[One (M7) Original Android Development] Theshawty:
Nope, because nothing's changed so revone still won't work.
[One (M7) Original Android Development] zaphodbeeb:
Just 4 fun?
[One (M7) Original Android Development] russel5:
you people are strange, 600 pages waiting for a miracle in the form of S-OFF, and when you are asked to try a small thing, you give up.
[One (M7) Original Android Development] whiper:
How does WP for mmcblk0p12 and other partitions work? mmcblk0 is one big flash area. Maybe we can write directly to this area? Or Access the emmc directly? How can software protect this if i am able to load my own kernel with device drivers?
[One (M7) Original Android Development] horsetastic:
Look guys. I don't know how else I can spell this out to you all.

I HAVE PERSONALLY ALREADY TRIED ALL THIS STUFF AGES AGO NOW AND NOTHING WILL WORK. I'M NOT BEING HARSH, I'M NOT BEING PESSIMISTIC! I ALREADY KNOW 100% THAT YOU CANNOT WRITE TO, DELETE, EDIT OR OTHERWISE MMCBLK0P12! IT CAN'T BE TOUCHED UNLESS S-OFF!!!

LISTEN TO ME!!!!!

---------- Post added at 09:14 PM ---------- Previous post was at 09:12 PM ----------

some partitions are WP at a very early boot stage. The ones HTC don't want people ****ing with.... HBoot among other partitions is a big factor. Some partitions are flashable with root permissions and some can be played with regardless.... You can't edit mmblk0 either. Tried it....
[One (M7) Original Android Development] Theshawty:
Listen to The War Horse, guys. He has personally tried EVERYTHING! Everything in the form of software. It DIDN'T FLASH.
[One (M7) Original Android Development] whiper:
Is there an explanation how this protection works? The Recovery contains a kernel with the emmc device driver. Or is there any Hardware protection?
[One (M7) Original Android Development] horsetastic:
Literally everything inside and outside of the box lol.... No point in wasting time over such things...
[One (M7) Original Android Development] adz63:
Woooo now lets see if I can do this . I'm pants with adb etc lol
[One (M7) Original Android Development] CheesyNutz:
1 thing do i put my phone in to bootloader mode ? or what
[One (M7) Original Android Development] monkboy24:
Ok guys somebody should make a video of the process for us :D:thumbup:
[One (M7) Original Android Development] ggogolewski:
It is working! I have CID: T-MOB101 :D

Tkanks!!
[One (M7) Original Android Development] mikep1993:
worked like a charm. no issues.

just had to run -t to remove the tampered flag twice.

thousand thanks!!!

cheers ;)
[One (M7) Original Android Development] Diamondback:
You guys really rock! :highfive:

Worked like a charm! :good:

(Ex) HTC__102 One
[One (M7) Original Android Development] dirtbikerr450:
Is there any difference between fuses S-OFF and This?
[One (M7) Original Android Development] cschmitt:
Worked perfectly the first time on ATT 32GB CWS_001 with 1.44.0000 HBOOT.

Was able to 'fastboot oem writecid 11111111', no issues. Thanks a million!

C:\>adb push revone /data/local/tmp
2383 KB/s (646704 bytes in 0.265s)

C:\>adb shell
127|shell@android:/ $ cd /data/local/tmp
cd /data/local/tmp
shell@android:/data/local/tmp $ chmod 755 revone
chmod 755 revone
shell@android:/data/local/tmp $ ./revone -P
./revone -P
Gaining root access (thanks to Dan's motochopper)...Success.
revone successful - please reboot to continue.
1|shell@android:/data/local/tmp $ su
su
root@android:/data/local/tmp # reboot
reboot

C:\>adb shell
shell@android:/ $ su
su
root@android:/ # cd /data/local/tmp
cd /data/local/tmp
root@android:/data/local/tmp # ls
ls
revone
root@android:/data/local/tmp # ./revone -s 0 -u -t
./revone -s 0 -u -t
revone successful.
root@android:/data/local/tmp # reboot bootloader
reboot bootloader

C:\>fastboot oem readcid
...
(bootloader) cid: CWS__001
OKAY [ 0.011s]
finished. total time: 0.014s

C:\>fastboot oem writecid 11111111
...
(bootloader) Start Verify: 0
OKAY [ 0.042s]
finished. total time: 0.044s

C:\>fastboot reboot-bootloader
rebooting into bootloader...
OKAY [ 0.038s]
finished. total time: 0.040s

C:\>fastboot oem readcid
...
(bootloader) cid: 11111111
OKAY [ 0.011s]
finished. total time: 0.013s
[One (M7) Original Android Development] :
WORKS :)
[One (M7) Original Android Development] sophos9:
Q: Once S-OFF is achieved, is it persistant or does it need to be done again for each ROM update? :silly:
[One (M7) Original Android Development] lucky_strike33:
We don't even know what fuses s off method is???
[One (M7) Original Android Development] dirtbikerr450:
His method is out, check his thread
[One (M7) Original Android Development] baadnewz:
persistence paid off. im s-off and supercid
[One (M7) Original Android Development] dirtbikerr450:
you will have it no need to do it again
[One (M7) Original Android Development] david279:
Reporting sucess on my Sprint One running CM 10.1
[One (M7) Original Android Development] phonepersonality:
S-OFF Acquired on my TMOUS phone.

I had to get a bit creative with the -P command initially though.

It didn't like the upper case 'P' at first so I used a lower case 'p', which it claimed was 'unrecognized' but still accepted.

Then I went through the entire process and didn't get S-OFF.

So I tried again using the upper case 'P' and it took this time around.

Now I'm gonna work on eliminating the 'tampered' designation as that's still showing.
[One (M7) Original Android Development] adyscorpius:
The comment is okay! its as under:

chown root:root revone

and has to be done inside /data/local/tmp
[One (M7) Original Android Development] Blindie:
working fine with german unbrandet htc one cid 102
[One (M7) Original Android Development] jonas2295:
Successful s-off and super cid on my O2 germany branded device.

Note: after achieving s-off (step 5 etc) my phone crashed for some time. buttons blinking without power button pressed etc.

it rebooted itself and everything fine..

was running a 4.2.2 ROM..

Thanks so much guys!
[One (M7) Original Android Development] descenpet:
generally you shouldn't run into problem, unless you are on dev-edition and it broke your dialer or something like that. in most cases, even if you forget, someone would be able to tell you the original number if you post which carrier you bought it from.
[One (M7) Original Android Development] scotty1223:
yes,you can flash any.you dont technically need a stock ruu to flash something else, but i personally dont wish to change all my firmware until there is an ruu to get back to stock us t mobile.
[One (M7) Original Android Development] descenpet:
ya this is really fast. i thought the exploit would take some time to execute like on older phones. all the commands ran in under a second. :D
[One (M7) Original Android Development] daddioj:
i am on dev now from AT&T and dialer not broke?
[One (M7) Original Android Development] wzu7:
got this error, what to do @ my mistake ?!
[One (M7) Original Android Development] Vicpdx18:
By slowly doing the steps I gained S-off on my AT&T HTC One on the first time! Also went back a few steps and did the -t and now ***tampered*** is gone!

HTC One with CID-CWS_001
[One (M7) Original Android Development] descenpet:
cid 11111111 will allow you to flash other region's RUU/firmware. if you are not going to do that, there is no benifit in making yours super cid. if you want to set it to 11111111, just use fastboot oem writecid 11111111
[One (M7) Original Android Development] Huey85:
Do you have more than one USB device plugged in? if you do, unplug all but your phone. If you don't unplug your phone, restart your computer and try again.
[One (M7) Original Android Development] METHOD1911:
Thanks for replying. I was worried about that. I don't have a dev phone and my dialer is working.

One method1911
[One (M7) Original Android Development] descenpet:
i don't know. there was one guy who said his dev edition dialer won't work with super cid. mine works fine but mine is originally asian wwe.
[One (M7) Original Android Development] altimax98:
Worked flawlessly on a TMobile One that already had a unlocked bootloader through the Dev site running 4.2.2
[One (M7) Original Android Development] NJGSII:
x2 on this.

S-off and CID has been changed.
[One (M7) Original Android Development] Vicpdx18:
is their a way to change back cid if you write 111111111
[One (M7) Original Android Development] hasoon2000:
Yes. I'll update my toolkit to support this feature

Sent From My HTC One via Someone's Room ;)
[One (M7) Original Android Development] aki0306:
i just got the S-OFF

thank u so much!

i always got error code 6

i flashed arhd10.1

and got the s-off
[One (M7) Original Android Development] descenpet:
you should be able to write anything with same command.
[One (M7) Original Android Development] pauley:
Yup, I just changed mine to BS_US001 to make it the developer's edition :)
[One (M7) Original Android Development] mrjasenr:
Same here. 3 minutes Woot Woot!
[One (M7) Original Android Development] ls1024:
Help!

China Telecom Edition failed!

D:\htc.Android>adb shell

adb server is out of date. killing...

* daemon started successfully *

root@android:/ # cd data/local/tmp

cd data/local/tmp

root@android:/data/local/tmp # ls -l

ls -l

-rwxr-xr-x root root 646704 2013-06-08 09:53 revone

root@android:/data/local/tmp # su

su

root@android:/data/local/tmp # ./revone -P

./revone -P

revone failed (error code = 1

1|root@android:/data/local/tmp # ./revone -s 0 -u

./revone -s 0 -u

revone successful.

root@android:/data/local/tmp # exit

exit

root@android:/data/local/tmp # exit

exit

D:\htc.Android>adb reboot bootloader

adb server is out of date. killing...

* daemon started successfully *

D:\htc.Android>fastboot getvar all

(bootloader) version: 0.5

(bootloader) version-bootloader: 2.23.0000

(bootloader) version-baseband: 1.00.30.0422

(bootloader) version-cpld: None

(bootloader) version-microp: None

(bootloader) version-main: 1.02.1401.1

(bootloader) version-misc: PVT SHIP S-ON

(bootloader) serialno: HCxxxxxxxxxxx

(bootloader) imei: xxxxxxxxxxxxxxxxxx

(bootloader) meid: xxxxxxxxxxxxxxxxx

(bootloader) product: m7cdwg

(bootloader) platform: HBOOT-8064

(bootloader) modelid: PN0751000

(bootloader) cidnum: HTCCN702

(bootloader) battery-status: good

(bootloader) battery-voltage: 4041mV

(bootloader) partition-layout: Generic

(bootloader) security: on

(bootloader) build-mode: SHIP

(bootloader) boot-mode: FASTBOOT

(bootloader) commitno-bootloader: dirty-8cf17c3a8c

(bootloader) hbootpreupdate: 11

(bootloader) gencheckpt: 0

all: Done!

finished. total time: 0.051s
[One (M7) Original Android Development] tjsooley:
Why. Give yourself super cid and flash what you want.
[One (M7) Original Android Development] Roeni:
If people would never try something just because someone says they're about to fail we would never had made it through the stone age... ;)
[One (M7) Original Android Development] maarawoe:
maybe a stupid question as I am am new to htc and its hboot....

as we can't write to wp partition, is there any chance to trick the hboot version or verification in memory to pass?
[One (M7) Original Android Development] zaphodbeeb:
I'll make a cup of tea. Surely someone will flash this soon. This is all too much excitement for me.
[One (M7) Original Android Development] AnumEndzeit:
huehuehue, i flashed it and tried revone. It didnt work. Why? Because hboot isnt a file, its a packed image file meaning it contains many more files inside it. Point is, if you change the hex data of the .img it only does that; the data of the compressed file but nothing within it. Thats why it flashed because that 1.54 hboot is still just that but with a different identifier. All the files inside pointed to an upgrade of existing files.

Still dont get it? Lets look at a briefcase. Inside it, it has documents, lets say passports. The passports will only allow you to certain countries. So you want to change the passport but you cant. Instead, you try to stick a sticker onto the briefcase to make it look like something else but the passport is the same and it has no effect. Get it?
[One (M7) Original Android Development] whiper:
You have to flash 1.44 hboot, no modified 1.54
[One (M7) Original Android Development] Spartn:
What is this hboot, is it original 1.54, modified somehow, or 1.44, modified to shows as 1.54? I was trying to flash diffrent hboots and it rebooted my phone each time after a while.

If dd..not rebooted his phone , then it seems, something was written to the partition, even the result he got confirmed success..strange :)
[One (M7) Original Android Development] zaphodbeeb:
Does that mean all this excitement is over then?
[One (M7) Original Android Development] whiper:
It must be possible to write. You know the S3 emmc bug? There was a bootloader patch from Samsung which modified the emmc firmware during boot. Custom recovery runs in kernel mode and has full privileges to access hardware. So it must be possible to alter the complete flash memory.
[One (M7) Original Android Development] AnumEndzeit:
Yep. Trust me, there's a reason why exploits exist and why they're complicated to find and execute. If you still don't believe me, if hboot 1.54 was released in June then why would it take developers four months to find something so simple and instead use an exploit?
[One (M7) Original Android Development] whiper:
From Samsung i only know WP filesystems. I never noticed a WP partition. How should this be implemented. And with custom kernels i could do what i want
[One (M7) Original Android Development] horsetastic:
lol I know right.... like an experienced dev wouldn't try dd'ing before anything else!!

---------- Post added at 09:28 PM ---------- Previous post was at 09:27 PM ----------

HTC lock things down a lot more than Samsung.... Just how it is.
[One (M7) Original Android Development] zaphodbeeb:
I dont care. I already got s-off.
[One (M7) Original Android Development] whiper:
Why should he? Revone is a tool for using with locked bootloader. We want to get s-off with unlocked bootloader and try to downgrade hboot to keep revone work.
[One (M7) Original Android Development] horsetastic:
lol, I know what revone is man. And tbh as non of you have clearly used the search button I'll tell you a bit about me. I have personally tried probably more than ANYONE here to gain a downgrade from hboot 1.54 to 1.44. If you used teh search function just once EVER you'd see multiple tests by me trying all the things being mentioned here and more.
[One (M7) Original Android Development] zaphodbeeb:
So whats the next idea then?
[One (M7) Original Android Development] Jonny:
The correct way, otherwise people would mess their phones up big time. Theshawty knows as well as I do (if not better) that Samsung should have enabled WP on the IMEI but no, they don't... and the result, idiots who can't be bothered reading end up winging because they're IMEI is corrupt.

Trust me, no matter how bad it seems from this angle of trying to get S-OFF, HTC did the right thing with WP.
[One (M7) Original Android Development] Theshawty:
Very true. And as a result, RootSU almost lost his mind ;)
[One (M7) Original Android Development] O_G:
Thread Cleaned​

This has got way out of hand. Remember this is a dev thread, so keep posts focussed that way. Also personal insults will not be tolerated! If a post needs a moderators attention, then report it. Dont start bickering between yourselves! its just makes a mess of the thread.​
[One (M7) Original Android Development] whiper:
I need a bit more info how the revone exploit works.

Now I understand why mmcblk0p12 isn't writeable. The feature is called "power on write protect" and is an eMMC feature.

When the eMMC chip is resetted - during boot process - the complete nand is writeable.

Then hboot protects some regions by enabling "hardware" write protection through eMMC features.

What we need is to reset the emmc, then complete nand is flashable.

But how does revone work? If emmc is protected we are unable to write into. Does the exploit remove write protection?

Or has hboot 1.44 a bug and reads some data from writeable nand?
[One (M7) Original Android Development] Spartn:
i've got 2 information, one out of topic and the other one is related a bit ;)

- had a call with HTC because of my phone, they asked for imei, i did tell them(why not?) and they told me that i don't have warranty for the motherboard just because they have in system information saying i asked for a code to unlock bootloader via htcdev -fortunately in my country there is no low allowing disclaim warranty, even if someone hits a button agree on htc webpage :D

- called a mobile service for s offing my phone and they told me that they don't have java card for this 1.54..but if my display is cracked, then it's pretty easy for them downgrade/flash hboot, so phone will have 1.44, but they don't advise to open the phone just because of downgrading hboot as display might break easily while opening htc one
[One (M7) Original Android Development] Theshawty:
So this service company you called, are they basically using a riff box (JTAG) to downgrade? That would make sense because that works. All that is required is opening the phone and then soldering the riff box contacts to the JTAG pads in the phone.
[One (M7) Original Android Development] Spartn:
does someone know if its possible to use QHSUSB mode for loading/flashing hboot by using usb to serial cable.. i have read somewhere that the QHSUSB mode is used by vendors to load bootloader

edit: seems to be able to reach the phone right way in that mode, qcom tool(s) needed, otherwise hard to recover the phone
[One (M7) Original Android Development] whiper:
If phone is opened there's no problem to attach to emmc reset pin to reset write protection and flash hboot.

Maybe it is possible to boot an hboot temporary via fastboot?

edit: How to enter QDL mode? For Samsung you need a 301kOhm jig to enter download mode. If there's an option on htc one this would be the resolution
[One (M7) Original Android Development] Spartn:
i tried to use linux programs from different HTC model and it was trying to put the phone to that mode, but the phone started after a while, so not sure if possible

but i have read that 2 people already had a phone in QHSUSB mode, one of them had a luck and the phone recovered from that mode itself after 1 day (he mentioned that the phone just woke up because of alarm he had setup) and the other person he was advised to apply for warranty -not sure if he was able to bring the phone up without service...anyway it seems there is a way to put htc one to qhsusb mode somehow
[One (M7) Original Android Development] zaphodbeeb:
Hi,

you may find this thread of interest. It explains how the motochopper exploit works.

http://xdaforums.com/showthread.php?p=40873964
[One (M7) Original Android Development] Spartn:
you think 301kOhm jig will not work on HTC one?

EDIT: http://xdaforums.com/showthread.php?t=2331454 check this out -one of the persons with QDL mode
[One (M7) Original Android Development] maarawoe:
Its very hw specific....

I believe some wire trick will be much more real for htc1 as it works for some other htc phones.... The problem is that this monolith brick can't be opened :)
[One (M7) Original Android Development] horsetastic:
motochopper is just root access.... Which we can get by su or whatever.... Not an issue with that really.... Not sure if the frambuffer issue with it on the new hboot has any baring on the success of revone...

I still think as yet our best bet is for someone to try using Y-Cable to flash an old 1.29 rom.zip with the hboot somehow removed all together... So that everything else gets downgraded but HBoot... Then maybe revone might work somehow if the other security partitions are downgraded.... Or moonshine might work.... (though to be fair I'm pretty sure it wont work lol)

Other than that I'm unsure currently what else is an option.
[One (M7) Original Android Development] zaphodbeeb:
Im no expert but reading through the motochopper thread, it details of how the exploit works and what can be exploited (or could previously). As I understand it, it was primaraly used to obtain root, but the thread also details other vulnerabilities. I dont think revone only uses its root exploit potential, as I think it is still called even if your device is already rooted when doing the revone preparation and s-off modes. Apologies if this is rubbish, just reading between lines mostly.
[One (M7) Original Android Development] Theshawty:
I really wish you had a y cable :p you might write history :D

>> Sent from the abyss <<
[One (M7) Original Android Development] zaphodbeeb:
or at least write to NAND!
[One (M7) Original Android Development] Swanseatom:
Just posted my HTC one to funfoneshop in sheffield for S-OFF.

When i get it back downgrading by RUU and installing revone is recommended for the commands right?

Shame I'm selling the handset, do love the phone just can't get used to it over samsung and have many other devices.

What you guys think i should try get for my one s-off?
[One (M7) Original Android Development] horsetastic:
On that link there's kernelchopper..... might be worth a dabble with.... Or perhaps getting hold of motochopper source and seeing what's stopping it working with the new HBoot.... I'm assuming it's to do with offsets etc... If you're right and it's used for the prep perhaps we could modify it to work somehow....

Haha, I dunno man. I don't think it's possible.... If Goldcard means you dont have to have signed zips then we can do almost anything...

Looking around I found this http://xdaforums.com/showthread.php?t=611433 and although it's for windows phone it somehow bypasses CID, HBoot everything checks really.... Previously they had to use Goldcard to roo then move on from there. But it seems with this thing they can do anything..... Not looked in to the file yet though.

Maybe.... But I doubt it
[One (M7) Original Android Development] whiper:
What can we do with an powered usb otg cable? Boot from USB?

I think without hardware it's hard to overwrite WP flash. Any exploit like motochopper only gives access you can gain with unlocked bootloader too.

We need an exploit to remove emmc hardware write protection like reset emmc. Or an reboot when the emmc chip is already locked and ignores WP commands from hboot.

Or putting one in download mode ...