yashsingh1/xdaforums huggingface dataset:
[Verizon HTC One (M7)] jntdroid:
The CID is the same for each phone per carrier, though, I believe. For example, I remember with T-Mobile it was TMOB010 or something like that. I guess maybe it could be a combination of the two. But if you can change the CID, you can basically make your One be from any carrier in the world - short of the radio differences... and that's why you can trick htcdev.com into thinking it's ok to send you the unlock_code.bin.

Though I believe you have to be S-Off to touch the CID or risk a straight up brick. But my HTC hack-knowledge is not only rusty, but JETBD (just enough to be dangerous... ;)). So I could be off or missing some key info!
[Verizon HTC One (M7)] GrayBoltWolf:
I don't think this guy is ever going to reply. Time to drag FlyHalf into this....
[Verizon HTC One (M7)] Aldo101t:
if you can get temp root you can super CID
[Verizon HTC One (M7)] 123421342:
If this is the case then unlock should be trivial. Knowing verizon, and they did learn from the DNA, they made attaining temp root very difficult.
[Verizon HTC One (M7)] Aldo101t:
yes, i neglected that fact, you are right, this phone is way different.
[Verizon HTC One (M7)] jcase:
perf_event should be patched, but really isn't meaningful. (as I said previously) gaining root was not going to be an issue on this device, and it was not. Issue is that we can not (yet) write to system to install su.

(Yes, I said root is achieved by more than one person on this device).
[Verizon HTC One (M7)] jcase:
No you can't, HTC started write protecting that block shortly after our DNA unlock. Too many ppl used that for the end result of an exploit, got abused too much and they fixed it.
[Verizon HTC One (M7)] jcase:
I'm not seeing how this is possible, but my ears are available on freenode or andirc if needed.
[Verizon HTC One (M7)] buckmarble:
So you achieved temp root. I modified the perf_event exploit to the best of my knowledge and I believe you are correct that it has been patched in the vzw kernel. I'm not at all surprised that they did. After all patching it was a matter of changing 3 characters. So the next step in utilizing the temp root is what in your mind? Cid change? Try to use it to trigger another exploit? Are you able to Mount and write to any other partitions besides system? If you need assistance testing anything let me know. Twitter is [MENTION=2967322]buckmarble[/MENTION]. I can DM an email there if you follow
[Verizon HTC One (M7)] jcase:
Yes I have another HTC root, not verified on this phone but on a similar device, seems it should work on this one, I believe others have a seperate root as well.

CID change should not be possible with root alone
[Verizon HTC One (M7)] buckmarble:
See my edit above
[Verizon HTC One (M7)] jcase:
**Odds are it will remain unlockable. This is certainly changable with an update
[Verizon HTC One (M7)] buckmarble:
My available to test. Just let me know
[Verizon HTC One (M7)] jcase:
If (and an IF) the source I was pointed to is actually what was shipped on the Verizon HTC One (I doubt it), then they did not patch the perf event exploit. I would be extremely shocked, but who knows.

https://git.kernel.org/cgit/linux/k.../?id=8176cced706b5e5d15887584150764894e94e02f
[Verizon HTC One (M7)] buckmarble:
Ya. The ge 4.3 source patched the int event_id with u64 event_id closing the exploit. So they obviously are working to patch it
[Verizon HTC One (M7)] Grnlantern79:
I had heard that you (jcase) would not be working on helping us with this phone it is great to see you here!!!!!
[Verizon HTC One (M7)] jcase:
I dont plan on doing anything for it, and i stand by it. Just commenting on posts
[Verizon HTC One (M7)] Grnlantern79:
Oh that sucks, any reason?

---------- Post added at 06:47 PM ---------- Previous post was at 06:39 PM ----------

Your a bad ass for sure wish we had you on this device you make this **** look easy.
[Verizon HTC One (M7)] moosc:
What sucks there is no plans for a DEV EDITION VZW HTC ONE. Sound's like we are screwed. Could this be the end of carrier phones being unlocked or rooted? Have the carriers finally out smarted the developers?

Sent from my Galaxy Nexus using Xparent Cyan Tapatalk 2
[Verizon HTC One (M7)] chad0989:
Eh, you can likely still send it off to have it JTAGed. Have someone hook it up, change the CID and you'll be able to unlock on htcdev.
[Verizon HTC One (M7)] cstrife999:
Dude... The phone has barely been out a week calm down... Things take time. Chill the heck out.
[Verizon HTC One (M7)] andybones:
the java card might work, as mentioned jtagging which has been around for quite some time, but the htc one is a mess to take apart and put back together expect damage.

also it's only been a VERY short period of time, the people working on this have lives as well, and want this just as badly as us.

I give my phone 6 months if not unlocked by then I move on.

Patiece is a Virtue.

and besides this one is worth the wait.
[Verizon HTC One (M7)] OldManJames:
Java card would most likely work if you are really desperate for unlock. I'd wait though. Bet this phone is unlocked by early October at worst.
[Verizon HTC One (M7)] andybones:
isnt java card doen thu usb compared to jtagging which takes the phone apart?

with the htc one i dont really want anyone taking the phone apart.
[Verizon HTC One (M7)] jntdroid:
+1000... Would rather leave it stock than risk that.

Sent from my phone
[Verizon HTC One (M7)] OldManJames:
Yea JTAG would require taking the phone completely apart. I wouldn't trust someone random person on the internet to do that to this phone or any other.
[Verizon HTC One (M7)] Lykarsis:
Javacard would be wonderful, my friend sent her Verizon one to someone in Montana and it worked great. I just can't afford to be without my phone for more than an hour or two due to my side job. So I have to wait for software s-off or until someone starts offering the service in my area.
[Verizon HTC One (M7)] Gornul:
I've never come across the term "Javacard" previously, maybe because both of my previous phones were already hacked by the time I bought them. What's the deal, exactly?
[Verizon HTC One (M7)] Lykarsis:
The way I understand it, it is basically j-tag, only through the SIM slot rather than contact points on the CPU. Not totally sure about that though.
[Verizon HTC One (M7)] GrayBoltWolf:
I want to know the same.

What is javacard and is it possible to do it yourself?
[Verizon HTC One (M7)] Gornul:
I hesitated to ask a larger question initially, but I never heard of j-tag either. By the time I came to the Incredible and later the Rezound, root/unlock/S-OFF was attainable directly for the home user with nothing more than (maybe) a blank microSD card and possible a USB cable. All I can tell about either of these terms is that they sound more complicated, if it's something an end-user would have to send their phone away to accomplish.
[Verizon HTC One (M7)] Lykarsis:
J-tag is a process whereby the phone is taken apart and two contacts are soldered to certain points on the CPU. Then the firmware for the phone is flashed onto it at the most basic level. This is how you would repair a device that has been hard bricked. But with a simple change in the software that is flashed, the security flag is flashed as off, this is how s-off is achieved. Both j-tag and javacard require expensive proprietary hardware and are probably not something anyone inexperienced should attempt even if they do get ahold of the hardware.
[Verizon HTC One (M7)] thepolishguy:
This.

I googled it and everything. Any one have a link?
[Verizon HTC One (M7)] Gornul:
Post above yours covers it pretty well.
[Verizon HTC One (M7)] AttackManatee:
Java Card Info Links

There is a bit of info about the Java Card S-OFF method in these threads:

1.54 Hboot S-off now possible!!!!

http://xdaforums.com/showthread.php?t=2413830

Purchased a JavaCard for S-OFF

http://xdaforums.com/showthread.php?t=2427960

Here a are few links of info and examples which were submitted in the threads listed above:

Go-Trust Secure MicroSD Java

http://www.go-trust.com/products/microsd-java/

Wikipedia - Java Card

https://en.wikipedia.org/wiki/Java_Card

YouTube - Java Card S-OFF HTC One (Verizon) - Sonic2756

https://www.youtube.com/watch?v=sF1CxtbPhV4

YouTube - Java Card S-OFF HTC One - 1.54 Boot Loader

https://www.youtube.com/watch?v=AVSGqXn4wX0

YouTube - Java Card S-OFF HTC One X

https://www.youtube.com/watch?v=7EueLGDqIpo

FoneFunShop S-OFF Service [U.K.]

http://www.fonefunshop.co.uk/cable_picker/97585_HTC_One_M7_S-OFF_Service.html

Sonic2756 HTC S-OFF Service [U.S.A.]

http://htc.s26tech.com/
[Verizon HTC One (M7)] thepolishguy:
Thanks. I saw that and read it. But I meant a link to see what it looks like or where you buy one or how to make one.
[Verizon HTC One (M7)] GrayBoltWolf:
I am sure you have to get a professional to program it and then run it properly.
[Verizon HTC One (M7)] Gornul:
My bad, thought you mighta just opened the thread before that post went up and just not seen it.
[Verizon HTC One (M7)] jova33:
can this be done from the comfort of my own home?
[Verizon HTC One (M7)] Lykarsis:
If you want to spend the money, and have the necessary instructions, I don't see why not. That being said, I am only repeating what other people, who know what they're talking about said. I could be totally off base.
[Verizon HTC One (M7)] jova33:
well i mean, i've got 0 XP with soldering, so can I just go buy a soldering iron and make this happen, or is this something that I should never be messing with?
[Verizon HTC One (M7)] Lykarsis:
I would say don't even try. For one, you would have to take the phone apart, which is borderline impossible without destroying it in the case of the One, and two, if you have no experience, you risk frying your CPU. On top of that, a riff box, which is the machine you would need for j-tag, costs about $250 last I heard.
[Verizon HTC One (M7)] OldManJames:
If this thread is the first time you have heard of JTAG its definitely not a good thing to spend a bunch of money on and try.
[Verizon HTC One (M7)] 123421342:
Yeah do not try this at home especially with the One which is damn impossible to take apart. An exploit will be out hopefully because this isn't a verizon-specific issue.
[Verizon HTC One (M7)] jova33:
Oh, Damn
[Verizon HTC One (M7)] dspcap:
Has anyone asked Sonic if you have to take the phone apart or it's done through USB?
[Verizon HTC One (M7)] PapaSmurf6768:
I'm 99.99% sure it's done by USB.
[Verizon HTC One (M7)] cbrown245:
In the video it looks like it is done through the usb port .
[Verizon HTC One (M7)] santod040:
Javacard is done via a micro SD card with special software on it.

The One has no SD slot so it has to use an otg cable and something to read the card.
[Verizon HTC One (M7)] Lykarsis:
Had a thought today. I'm sure someone has thought of it before, but just in case, is it possible to work out which part of the code you get from your phone and send to HTC Dev is the CID? If so, is it possible to change that to a different number so that HTC Dev will give you a working unlock file?

Sent from my HTC One
[Verizon HTC One (M7)] tracyde:
After looking at one of the Unlock.bin files I think HTC is using a form of PGP encryption, where they keep a private key and sign the devices CID via the htcdev website creating the bin file. Then once the bin file is flashed to the device, hboot uses the public key to decode and evaluate the bin file. Someone please chime in it you think I am wrong, but I think that is what they are doing.
[Verizon HTC One (M7)] GrayBoltWolf:
Is that the one I sent you?

Would it help to compare to someone else's?
[Verizon HTC One (M7)] josh995:
From my research online, an HTC javacard with 500 credits costs around $1,300 and one with 1000 credits costs around $1,900.

So it's quite an investment. However if you charge...say $25 or so to s-off someones phone and you do it 500 times, you're making quite a nice profit.

Sent from my HTC One.
[Verizon HTC One (M7)] tracyde:
It was the one you sent me.

If I am right then only comparing a few unlock files for collisions would not work, we would need more than HTC has generated to date. Plus PGP has been around for ages, it would be more effective imho to attack their implementation since that would be weaker than the actual encryption scheme. Look for a key left in the filesystem or embedded in an apk. If we had that, an offline attack would be possible, although that would still take a long time since we don't have details.

The part that I doesn't fit in with my idea are the existence of JavaCards. So I could be wrong, but either way I think the bin files are signatures or another type of encrypted payload.
[Verizon HTC One (M7)] 123421342:
It's more simple than that. You can flash anything that is signed. The java cards are signed so they will always work.
[Verizon HTC One (M7)] replica9000:
Well buying from a 3rd party doesn't work. Figured it didn't hurt to try

Error Code: 160.

Error Reason: MID Not Allowed.
[Verizon HTC One (M7)] replica9000:
So here's a thought. What if we flood Verizon's Twitter and Facebook pages with post about how upset we are with getting this phone 6 months after everyone else, and how they had the nerve to lock it down on top of that.
[Verizon HTC One (M7)] Gornul:
They will laugh and go back to sitting on fat piles of money. Somehow, we power users are such a tiny portion of their business that they don't need to appease us, yet simultaneously so numerous that we could destroy their network if we were allowed to do what we want.

(phoneposting)
[Verizon HTC One (M7)] drwolcot:
I was able to unlock mine via HTCDev.. just waiting for a GPE port :good:
[Verizon HTC One (M7)] spectralblu:
Another me too post :)

Just picked up my brand new HTC One from the Verizon store after reading that you could unlock it. Got my unlock .bin from HTCDev and am happily unlocked!
[Verizon HTC One (M7)] GrayBoltWolf:
Unlocked and rooted over here. :D

---------- Post added at 04:41 PM ---------- Previous post was at 04:09 PM ----------

Working on de-bloating currently while FlyHalf does his stuff.
[Verizon HTC One (M7)] jova33:
What about S-Off or whatever? I don't have the device, so I don't even know what that means.
[Verizon HTC One (M7)] Crocosaurus:
Confirmed as well.

In case it helps anyone, I also had to turn off "Fast boot" under Settings -> Power in order to boot into fastboot.
[Verizon HTC One (M7)] GrayBoltWolf:
Hopefully Moonshine is compatible, but we don't know yet.
[Verizon HTC One (M7)] samstudent:
Happily unlocked and rooted. I'm guessing Verizon is going to stop the unlock via HTCDev so do it now.
[Verizon HTC One (M7)] GrayBoltWolf:
Found a de-bloat script and trying to modify it. Also waiting on the author's permission to post it.
[Verizon HTC One (M7)] JediMindTrixx:
Unlocked... Waiting for recovery... :)
[Verizon HTC One (M7)] Flyhalf205:
We have

CWM - http://xdaforums.com/showthread.php?t=2416273

or

TWRP - http://xdaforums.com/showthread.php?t=2416431
[Verizon HTC One (M7)] JediMindTrixx:
Thanks for the links!!! :)
[Verizon HTC One (M7)] jova33:
So what happens when VZW gets their One blocked from HTC dev? Will later buyers still be able to unlock their HTC One?
[Verizon HTC One (M7)] J.Guido85:
I've never used htcdev and usually do adb and such for unlocking...Just an explanation on what this does....Thanks!
[Verizon HTC One (M7)] slacka-vt:
The HTCDev site provides a bin file you can flash to unlock your phone via ADB in recovery. No hacks necessary. There's directions on the HTCDev site. Quite nifty but it doesn't unlock the boot loader so you have to manually flash boot.img for custom ROMS
[Verizon HTC One (M7)] spectralblu:
From my understanding, you're not normally able to unlock the phone (unlike a nexus device, where you just `fastboot oem unlock`). The HTCDev site instructs you to grab a device identifier off of your device and generates a .bin file that it sends back. Then you're able to use `fastboot flash unlocktoken Unlock_code.bin` to trigger the device to bring you to the unlock screen. Without support from the HTCDev site, you won't be able to get the .bin file, preventing you from unlocking your phone.
[Verizon HTC One (M7)] dmdubois:
unlocking this phone wouldn't complicate a switch in sim cards, would it? i have to take this to verizon tomorrow to switch lines, and would rather avoid any malfeasance on their part if they could tell the phone was unlocked.
[Verizon HTC One (M7)] jfp2004:
Just bought one of these earlier. I'd like to have it unlocked before Verizon inevitably locks it down (assuming they care enough about this phone..) but I had one question first. I read somewhere that unlocking it will make you unable to access the phone's storage on a computer without using adb commands? Like I couldn't just connect it and drag and drop files...is that true or was that just some misinformation from a blog? Thanks!
[Verizon HTC One (M7)] slacka-vt:
Definitely not true.
[Verizon HTC One (M7)] jcardona1:
Flyhalf has this posted in his CWM recovery thread. What does this mean? Is this only during the process of flashing the recovery?
[Verizon HTC One (M7)] slacka-vt:
I haven't read the thread but it sounds like you can't mount external storage while in recovery.
[Verizon HTC One (M7)] HolyAngel:
Not only that but that they did it a day or two *after* the phone released! And they removed the fm radio feature, and the built-in power save mode, among other things..

Could possibly work, but I doubt it. We'd probably need a petition or something.
[Verizon HTC One (M7)] replica9000:
Well there would have to be a lot of us to do it, not just a couple posts here and there. Is VZW afraid that a few people might use there root access and unlimited data to tether and bring down the network? Even though 95% of their customers apparently never use more than 2GB of data.
[Verizon HTC One (M7)] HolyAngel:
Right? I don't get it.. verizon let it happen the first couple days, how ya gonna turn that off? They should've just let it go, now they're letting themselves be the bad guys. I/we should be able to void our own warranty if we like.

And yeah, would definitely need at least a couple thousand signatures :/

Hopefully the devs can work their magic tho, trying to do all i can to help the current efforts going on.
[Verizon HTC One (M7)] replica9000:
I did message HTC about this.
[Verizon HTC One (M7)] antp121:
That wouldn't work. When it came to the Droid X2, I was doing everything I could in attempt to unlock the bootloader. Emails, tweets, letters in the mail, filing issues with the bbb, literally everything. Nothing came of it except letting me upgrade early so they didn't have to hear my whining every day lol
[Verizon HTC One (M7)] josh995:
Squat. Nothing would come of it. As was mentioned, the dev community is so small compared to the total number of subscribers. And what you're suggesting has been done before with no effect. :(
[Verizon HTC One (M7)] jbh00jh:
I agree with what you are trying to do but as it has been posted many times over the years, XDA members are less than

1% of VZW customers so you have no impact on thier marketing decisions. 90% of thier customers probably think we are nuts for trying to alter our phones in the first place.

Sent from my 4G LTE HTC One
[Verizon HTC One (M7)] sparky697:
Hate to say it but its looking more and morelike if you want an unlocked phone on VZW you're gonna have to fork out the cash for a Dev edition or leave them for a less restrictive carrier.
[Verizon HTC One (M7)] replica9000:
I would have bought that one if it was compatible with Verizon's network.

Someone also has a Javacard thing going right now, but that means sending the phone out to get S-Off.
[Verizon HTC One (M7)] jova33:
Do they at least have root for this phone?
[Verizon HTC One (M7)] cstrife999:
Can't root without unlock. So unless you're in the group that unlocked day one no.
[Verizon HTC One (M7)] calash:
Can you go into more detail for us Noobs to HTC. Coming from Motorola the idea that you need to be unlocked to root seems odd, all we needed was a way to write the SU binary to the /system/bin, give it permissions, and we had root with no unlock. (I over-simplify the days of hard work it took to find the exploits, but the point is valid)

I am curious as to why this same mentality does not work with HTC. Is the \system partition mounted differently?
[Verizon HTC One (M7)] CNexus:
To root you need an unlocked bootloader or an s-off exploit because all of the newest Android phones come with something called system write protection which prevents modifications to the system partition.

So even if an exploit is found which allows you to recount /system as read/write instead of read only, any changes you make wouldn't stick permanently. S-off or unlocked is the only way to gain root.
[Verizon HTC One (M7)] Loglud:
No not necessarily true. What he is talking about is the ability to use a fastboot boot command to boot an insecure kernel. Luckily this is not the only way to root. There are hundreds of exploits out there that allow you to run the rootspawn code so all that need to happen is find the one that the current kernel has not patched.

As for boot loaders, as it happens you have some one who bought a javacard. This card contains two things (according to what I have heard though I've never heard of then having two things inside a micro ad card so most likely there's just one) a microprocessor and a small memory bank. Also from what I read these micro processors are prone to side channel attacks meaning it is possible to DUMP the programming code off the javacard meaning you could have the s-off algorithm on hand. If you've followed me up to this point you know where I'm going. By dumping the algorithm and pulling the key well, you have free unlocks for everyone.
[Verizon HTC One (M7)] jcase:
yes
[Verizon HTC One (M7)] GrayBoltWolf:
Since when have we had root for bootloader-locked people?
[Verizon HTC One (M7)] sanders539:
I already have two posts on twitter about it. I know it's nothing big. But just knowing that they know I am upset makes me feel better.

Sent from my phone using an app

---------- Post added at 04:26 PM ---------- Previous post was at 04:18 PM ----------

IIRC, it is more of a temp root. So once a reboots occurs, root is lost.

Sent from my phone using an app
[Verizon HTC One (M7)] jcase:
Last week to the best of my knowledge
[Verizon HTC One (M7)] GrayBoltWolf:
Cool. I assume it hasn't been released.
[Verizon HTC One (M7)] sanders539:
I could be way off base with that assumption, as I think I saw we had temp a couple weeks back. It would be cool if had permanent root now though. Someone working on getting root may need to clarify.

Sent from my phone using an app
[Verizon HTC One (M7)] cbrown245:
Where is this temp root ?
[Verizon HTC One (M7)] andybones:
there is no temp-root, sorry
[Verizon HTC One (M7)] jcase:
yes there is, there are at least two that i know of being used for development atm
[Verizon HTC One (M7)] santod040:
Was gonna say this ^^^ but didn't feel it was my place.

Thanks for confirming what you had posted previously. :)
[Verizon HTC One (M7)] cbrown245:
Sorry but where is it ? I am looking to help where I can .
[Verizon HTC One (M7)] jcase:
I've not seen any posted publicly, they offer no advantage outside of further research.
[Verizon HTC One (M7)] cbrown245:
Gotcha ,
[Verizon HTC One (M7)] andybones:
Not publicly and that was my point, sorry I should have specified.
[Verizon HTC One (M7)] Zwitterion:
Damn. I'd love temp root, just to debloat the damn phone.
[Verizon HTC One (M7)] crazyg0od33:
same - Unless something is going wrong / my battery dies, I'm not really rebooting the phone anyway