yashsingh1/xdaforums huggingface dataset:
[HTC Sensation] ichigo_kurosaki:
so have you rooted your device? device needs to be rooted before using rumrunner. if not, you need first to execute the step 1 of rumrunner s-off..the execution of temproot.bat.:) or, you can skip worry about s-offing via rumrunner now..just install your first custom rom after rooting (viperS 5.2.1 for the sense 5 rom for sensation) and you can perform rumrunner s-off even when you are running a custom rom. that's the beauty of it.:) i have s-offed mne via that method and at that time i was running viperS5.1.0, which was reported to work with rumrunner.:D
[HTC Sensation] Deejay2k1:
Hi.

Yes the device is rooted and the bootloader is also unlocked. When I want to install viperS5 I am stuck at this step:

ViperS Install Instructions

Make sure you are running latest firmware that came with 3.33 RUU, if you are S-OFF flash it via bootloader from HERE, if your are S-ON, relock your bootloader and flash 3.33 RUU from HERE.

Downloaded a file called "OTA_PYRAMID_ICS_HTC_Europe_3.33.401.55-3.33.401.53_release_2930515ou0tuy0vbi8us83.zip" and want to flash it via recovery but it failes. How and what do I need to install the atest 3.33 RUU firmware?
[HTC Sensation] rzr86:
forget that part

you have already ics firmware

i suggest to use 4ext recovery

make a nandroid from 4ext just in case

format all partitions except sdcard from 4ext

enable smartflash from 4ext(because you are on S-ON)

flash the rom

done
[HTC Sensation] Deejay2k1:
OK installed the latest ViperS and running rumrunner again with the same error:

Checking for updates......

Test 1: Rebooting into bootloader

Waiting for fastboot (5/120)

Waiting

Test 2: Booting device

Waiting for ADB (43/120)

must ferment longer...

must sanitize, skunky rum is nasty

hold please..............................................

[------------------------------------------------------------]

Rebooting into bootloader (again)

Waiting for fastboot (5/120)

FATAL: Download updated package at ....

Press ENTER to exit
[HTC Sensation] rzr86:
can you tell me which runrunner tool did you download?
[HTC Sensation] Deejay2k1:
Yes I can it is "rumrunner_HTC_0.5.0".

Downloadet it from the officisal rumrunner.us Site unter Downloads:

HTC Universal Downloads

Windows	0.5.0	rumrunner_HTC_0.5.0.zip - 20.2 MB

The Device Specific Downloads is no one for the HTC Sensation.

Meanwhile I also tried it on an other pc with the same error.
[HTC Sensation] rzr86:
you have the right tool but i don't know what is wrong

unfortunately i am out of ides:(
[HTC Sensation] Deejay2k1:
Could it be something with the root access? I see that supersu is installed and for example AdAway is working without any problems. Also SU pops up so that I can grant the access for this app.

In the settings I saw that supersu is grated for apps ad adb or how it is caled
[HTC Sensation] rzr86:
you need root so it is fine from this side

check if you have enabled usb debugging mode
[HTC Sensation] Deejay2k1:
Hi.

Yes usb debugging is also on. I am really confused whats the problem. Is there maybe another way or solution to get S-OFF?
[HTC Sensation] ichigo_kurosaki:
usb debugging access from PC

ok. so let's assume you have the USB Debugging enabled on your seny and you have met all the requirements. did you encounter a time during the process when the phone notifies you that your PC is asking permission whether you want to allow USB debugging from your PC? i think that is called RSA pass. if you have checked that "always allow from this computer" and clicked OK, then you shouldn't have any problem. try disconnecting your seny, disable and re-enable USB Debugging and reconnect to computer. something like this:

sorry if this is not a sensation image. lol..this image came from my nexus rooting guide that i made. but you should get the idea.:)
[HTC Sensation] rzr86:
some user here in sensation forum mentioned that is rumrunner's server issue

i think it has been reported to rumrunner

edit: http://xdaforums.com/showthread.php?t=2751187&page=8
[HTC Sensation] ling751am:
Nice guide

But I can use Windows 8 to do these things

Just need to install required drivers, and run cmd as Administrator
[HTC Sensation] rzr86:
are you asking for something?
[HTC Sensation] ichigo_kurosaki:
Afaik, windows 8 currently causes problems..this guide works best on windows 7. :) but if anybody can come up with solutions for windows 8, feel free to drop me a PM and i will update my guide to include steps for windows 8.:D
[HTC Sensation] rzr86:
there are already guides how to set up adb/fastboot on w8 OS
[HTC Sensation] lucio.riboli:
I all, I was looking for long time a wire trick free S-OFF and finally I hope I've found it.

I'm just a little confused.

I knew that to gain a custom Rom the first step is to do S-OFF.

Insted here I've read that to S-OFF my phone I must have Viper S.

There is somethings I've not understood!

My phone is locked, s-on and completely stock.

What I have to do to flash a custom rom without htc dev or jbear S-off?

Ps. Sorry for my english, I hope everything is clear!
[HTC Sensation] ichigo_kurosaki:
No. S-off is optional. You can still use custom roms even while s-on as i have too when i was a noob. The only limit of being s-on is that you can't use roms outside of your firmware version as the recovery CAN'T write into the /boot partition of your system. so example you are currently on ics, you can also only use ics-based roms. For you to use roms like jb or kitkat, you must flash the bootimg manually, or use 4Ext recovery touch which has a Smartflash feature which can bypass the limits of s-on (you have to enable it). While.s-off gives you full access to any modifications on your phone and you can use roms above ics.

Now, on another note, we know the wiretrick s-off and requires you to be stock, which is quite a pain if you are already rooted. So in comes the rumrunner s-off. It is the only wiretrick free s-off that works on Sensation. And yes you can use it even while you are on a custom.rom and i highly.recommend using ViperS5 as i have also done. It worked.perfectly for me. To use viperS, since it is a jb rom you need to have 4ext recovery with smartflash enabled (everything you need is in my guide.:D). :)
[HTC Sensation] lucio.riboli:
First thanks for your answer!

Unbelievable! I‘ve read a thousand pages in android italian forums and I‘ve never heard that!

Many users are being stuck into jbear wiretrick and they don't know that it's possible flash rom s-on.

Wait a moment, can I flash a custom rom without super cid? And it's possible change cid without be s-off?

I'd like to flash Revelation rom; how can I do that without wiretrick and htc dev? My phone is locked, s-on and completely ICS stock.
[HTC Sensation] rzr86:
you can flash custom rom without S-OFF and supercid

cid you can change only with S-OFF

only way to flash custom rom without wiretrick and htcdev is this guide

or see here

http://xdaforums.com/showthread.php?t=2751187
[HTC Sensation] lucio.riboli:
Ok, I just want to understand how I can do that.

My phone is locked, s-on and completely ICS stock.

Let me know if I had understood all.

1) use temproot.bat,

2) flash/ install custom recovery (4ext touch)

3) flash viper s 5

4) do s-off via rumrunner

5) change cid.

Right?
[HTC Sensation] rzr86:
actually you can do rumrrunner method with stock rom too

some users succeded with stock rom

follow these steps

1) use temproot.bat

2)do s-off via rumrunner

3)flash a custom recovery

4)flash a custom rom

changing cid is optional
[HTC Sensation] lucio.riboli:
Ok, I'll try!
[HTC Sensation] ichigo_kurosaki:
Well that's why i was on a constant research until someone at the.rumrunner s-off thread gave me a headsup that rumrunner works for htc seny too and it's been recommend that if you are already running a custom rom that rumrunner works on viperS5 rom. Although you may try with other roms. There's no.harm if rumrunner fails so it's fine. I am uneasy with joupunutbear so we are lucky there's this. I wrote the guide according to.how i did things on my end.:)
[HTC Sensation] lucio.riboli:
Hi guys,

when I must perform temp_root_remove.bat?
[HTC Sensation] rzr86:
after achieving S-OFF
[HTC Sensation] lucio.riboli:
It doesn't work!

I tried twice but it continued to fail; It asked me to download last version from rumrunner.us...

Any ideas?

EDIT:

Nothing to do; I tried a third time but the result was the same. I was stucked at the second reboot.

The error is: FATAL: download updated package at www.rumrunner.us

I've unistalled all the antivirus software! Probably there is something I've not understood.

Some one can help me???
[HTC Sensation] lucio.riboli:
I've done about 4 cicles of temp root/temp root remove.

Now my Sensation seems slow at the boot.

In your opinion, did I make some wrong?
[HTC Sensation] rzr86:
it has beed metioned that it was rumrunner's server issue

i assume until now it would had been fixed
[HTC Sensation] ichigo_kurosaki:
I never really trusted that temproot execution that's why i said in my guide that you can perform rumrunner for later and just unlock and root. I did after all emphasize that the safest, fail-safe way is to.perform it while you are.in a custom rom (recommended ViperS5.x)..so i think just root your phone first (follow the guide) and after, have a custom rom then do rumrunner. No need to execute temproot since you are already rooted.
[HTC Sensation] lucio.riboli:
Ok, but I had no problem with temp root.

I've read that some users were able to s-off without flash a custom rom first.

What kind of procedure did they follow?
[HTC Sensation] rzr86:
use the temp root(if they aren't rooted)

run rumrunner to perform S-OFF

remove temp root

done
[HTC Sensation] lucio.riboli:
I've a problem with rumrunner. No problem with temp root. (Seems take much time at first start, but I'm not sure).

I've searched by Google and I've found that some users has the same problem on other devices.

Seems that rumrunner doesn't work with firewalls, antivirus, antispywares or malwares.

I've deactiveted all possible, but still doesn't work.

I don't know how to solve the problem. I don't want to use both Htc dev than Jbear.
[HTC Sensation] rzr86:
what is the issue with rumrunner?
[HTC Sensation] lucio.riboli:
http://xdaforums.com/showpost.php?p=54826715&postcount=57
[HTC Sensation] rzr86:
it has been mentioned that is rumrunner's server issue

if you ca nreport it in their site

otherwise follow this S-OFF guide

http://xdaforums.com/showthread.php?t=1661631

it doesn't require htcdev unlock method

i will send you the files via pm
[HTC Sensation] lucio.riboli:
What does mean rumrunner's server issue?

I can't report they, cause I'not htc dev unlocked.
[HTC Sensation] rzr86:
i don't know exactly mate

someone reported before but i don't know if they fixed it

it never happened to me
[HTC Sensation] radhx:
Hi,

I have HTCDev unlocked / rooted / S-ON Sensation XE on ViperS 5.3.0 with latest ext4 recovery 1.0.0.6 RC3.

I have -

1] taken nandroid backup.

2] checked that ADB is working fine.

3] Disabled Firewall and Antivirus.

4] checked that Fast-boot is OFF and USB debugging is ON.

Can I just run the rumrunner executable to get my phone S-OFF?

Do I require an internet connection to do this, and before that, is it mandatory to remove SIM card and use spare SD card?

Thanks & Regards.
[HTC Sensation] rzr86:
you can use rumrunner method

iti isn't necessary to remove simcard and i think it requires internet connection

by the way what do you mean by fastboot is OFF?
[HTC Sensation] jmcclue:
unchecked in settings
[HTC Sensation] radhx:
Yes, fast boot is unchecked in settings.

Thanks, I will give rumrunner a try and get back.
[HTC Sensation] radhx:
I'm on Win8.0

Connected to net via Wi-Fi.

Have disabled Antivirus as well as Firewall.

XE is connected to PC.

"adb devices" displays my device id.

Executing soju.exe as admin.

In the beginning itself I'm encountering error -

----

Checking for updates......

ERROR: Cannot check for updates

Press ENTER to exit

----

Please help.

Thanks & Regards.
[HTC Sensation] radhx:
How I wish there was a rumrunner package without update check....

Update check doesn't serve much other than hampering the s-off process for the unfortunates like me. :p

One can always get the latest package from the site.

Rumrunner package used for HTC Sensation XE Z715e -

HTC Universal

Windows	0.5.0	rumrunner_HTC_0.5.0.zip - 20.2 MB

I can access rumrunner.us site without any issues. Net is connected.

Tried out various methods mentioned on the other forums too including HTC One, M7, ....

Using phone's internet with USB tethering...

Way back in 2014, somebody mentioned changing the Router IP which worked for him, but not explained how.

I Don't know how to do that...

Tried with disabled Antivirus/Firewall as well as adding exception for soju.exe in Antivirus and full access in Firewall.

No luck. Getting stuck at "Cannot check for the updates".

Any suggestions please?

Thanks & Regards.
[HTC Sensation] ichigo_kurosaki:
too bad. the remaining way to achieve soff is to go back to stock and do the wiretrick. else, try your luck on a windows 7 pc.:)
[HTC Sensation] Successfuldiver:
This was a great guide! After 20+ shameless attempts, following this guide, to a tee, gave me my unlock token for htcdev. The problem I have is that the directions said i would need 4ext recovery updater oe control to finish the install of 4ext touch & they were right! But all i was provided with was the 4ext recovery updater apk & the 4ext touch requires the zip version, so i'm stuck because ive searched high & low & cant find it. suggestions?
[Android Apps and Games] tattoowood:
As I said, I'm searching for an app that let's u use your phone as a TV remote
[Android Apps and Games] edisile:
https://play.google.com/store/apps/details?id=com.adi.remote.phone

Try this
[Android Software/Hacking General [Developers Only]] E:V:A:
@makers_mark

Very nice work! This is actually more interesting than it seem. It's also a way to inspect binary code in unknown blobs. Another thing to notice is that you can probably automate the correct image size, for images that you know contain vertical lines. If you look at the padlock image sequence, you see that the images contain parts that are "sloping" either upward or downward, this can be used to look for the correct direction to increment/decrement the size counter.

So if you remember your basic math for the slope of a line:

m = Δy/Δx = (y2 - y1)/(x2 - x1)

you can plug some pixel values in and get the slope, and subsequently the direction for the counter.

Obviously the most difficult part will be to detect what is a "line" when there are other pixels there.
[Android Software/Hacking General [Developers Only]] makers_mark:
Thank you, you can imagine my excitement the first time I had the logo I was looking for come across my screen :)

I was trying to think of a way to automatically choose "the right image", but cognitive dissonance kicked in and I figured that people would rather see lots of images. Kind of kidding, but I wanted it to work for almost all images, and my expectations kept leading me back to nothing.

Here is something, i forgot to mention, I found this is in the n72013 4.02 bootloader that I don't ever remember seeing on the device. It is the ASUS logo, with their slogan underneath it. But it is not all there, I've checked and checked and this is how it is in the hex editor too. It is located at the very bottom, right about the last Google logo, width is 600.
[Android Software/Hacking General [Developers Only]] E:V:A:
^^ And as you see above, the sloping lines is probably the remainder of the "missing" pieces. For some reason the image has been split and pieces moved around, just like for any other file. This is probably because you have extracted this as a blob from memory or EMMC in which case these pieces may have been shuffled around by internal MMC wear leveling. But the way these pieces are linked together should be via inodes and you'll need some better tools to read these. (It should be some kind of address immediately following an incomplete image.) Another possibility could be that the screen driver FW like to read images in pieces...
[Android Software/Hacking General [Developers Only]] makers_mark:
I was thinking that this data was from the factory download, but I just checked and you are indeed right. It is not in the bootloader.img from google, but only on my mmcblk0p12. As for the white lines surrounding it, the bottom lines are the Google logo (at 518 pixels) and the upper white areas are the up/down arrows and the second unlock icon. Your point was still well received! And thanks for your insight:good:

Here is the same image (I cropped out the upper irrelevant stuff, but the same data) at 518 width.
[Android Software/Hacking General [Developers Only]] Antagonist42:
If you haven't read it yet, try a search for ARM_ELF.pdf

If the partition you're reading (like a boot.img) is an ELF file it will give you the offsets for the start of files (that's how I found my systems initial splash image) and the byte size for that file and any other files in that partition ;) ie. Boot code, splash screen, text data.

Throw a boot.img/recovery.img into a hex editor (I use HxD) and alter the displayed byte count from standard 8/16/32 etc to 320 (or your screens pixel width) and scroll through and you'll see the data layout roughly of your splash screen (really basic way to find it)

Bashing away at my HTC Desire C
[Android Software/Hacking General [Developers Only]] makers_mark:
If only it would of been that easy...;)

But, if you are dealing with a non-rle images, you absolutely can see it's "likeness" in a hex editor with your width set correctly. An image that is run length encoded bears no resemblance to anything, except some of them do look like random waves, but that's another story.

Those images were the first things I noticed in my N7 bootloader, not what I wanted though. But since the non-rle images were in a rgb24 pixel format, with 3 bytes per pixel, my battery charging icon that is 340 pixels wide could only be seen correctly (in a hex editor) at 340*3=1020 for the width. That's one of the things I like about 010 editor, I think Hxd will only go up to 512 for the width, 010 editor goes up to 1024.
[Android Software/Hacking General [Developers Only]] Antagonist42:
Ah yes, I'd forgotten about .rle :banghead: can't see it but can find it.

You will find the address of them in the ELF data, especially the splash and battery charge on power up, it's in (I think, off top of my head) hboot, if you know the partitions offsets from 0x00000000 (or you have a full nand dump) there's pointers to them ;)

Bashing away at my HTC Desire C
[Android Software/Hacking General [Developers Only]] makers_mark:
You must be referring to the kernel, I am talking about the bootloader in the OP. There is no elf header/data in the bootloader, they are typically proprietary and written in machine code &| assembly language.
[Android Software/Hacking General [Developers Only]] Antagonist42:
You've spiked my curiosity now, especially as I've not been able to work at my PC in a while :D

Is now off to see where it's pointed at from....

Bashing away at my HTC Desire C
[Android Software/Hacking General [Developers Only]] E:V:A:
@makers_mark So I was sitting in the bar the other day...and suddenly realized where you got that name from. :p
[Android Software/Hacking General [Developers Only]] makers_mark:
Here is the mmcblk0p12 from the Nexus 7 2013 and the whole bootloader.img from the factory download. I don't know if it would help you, I imagine you have a device to check, but I have the logo locations already if it would help you out any.

There are 4 locations of the image (the splashscreen isn't drawn all at once, it places the logo and the lock from different places in the bootloader) in the partition mmcblk0p12 they are all 43768 bytes long:

307760 o----c 351528

2390104 o----c 2433872

3075424 o----c 3119192

3166732 o----c 3210500​

In the factory image there are three locations, they are:

1183172 o----c 1226940

3265516 o----c 3309284

3950836 o----c 3994604​

[MENTION=4372730]E:V:A[/MENTION]

If you were at a bar and you figured out where I got my name from, you'd have to be right!
[Android Software/Hacking General [Developers Only]] Antagonist42:
Came across this, simply because it's for LCD screens but explains the different encoding methods ;)

http://www.demmel.com/download/ilcd/2d_rle_appnote.pdf

Bashing away at my HTC Desire C
[Android Software/Hacking General [Developers Only]] makers_mark:
The possibilities are endless when it comes to run length encoding. The three different methods that I've found probably aren't the only ones being used. Most people probably confuse rle with the old microsoft file format, but actually rle these days is a method of encoding. So, if you want to have 3 bytes for the count and 3 bytes for the color, you can do it. But if you notice, all three of the methods are 4 or 8 byte reads. No 3, 6, 10.... I wrote an arbitrary decoder for rlimager, but took it out because I don't see them ever using rle that doesn't add up to 4 or 8. Like 2 bytes count 3 bytes color, would be a more efficient way to encode 3 byte color, as opposed to 1 byte count 3 byte color (like they use). But it would be horribly slow. Here is the arbitrary decoder:

void arbitrary(int bytesofcount, int bytesofcolor)
{
unsigned int i, j, k, totalperpixel = bytesofcount+bytesofcolor;
unsigned long times, count, counttotal;
unsigned char color, instream[totalperpixel];
unsigned char colorbyte[bytesofcolor];

while(read(0,instream,totalperpixel)){
for (i = 0; i<bytesofcount; i++){
count = instream[i];
if (i > 0) {
counttotal = (count << 8) | counttotal;
} else {
counttotal = count;
}
}
for (j=0; j<bytesofcolor;j++){
color = instream[j+i];
colorbyte[j] = color;
}
for (times=0;times< counttotal;times++) {
for (k=0;k<bytesofcolor;k++){
write(1, &colorbyte[k], 1);
}
}
count=0;
}
}

But in the end, there are countless ways to run length encode an image. I've seen vertical encodings, diagonal, and horizontal. I've just simply found 3 used to encode images in some bootloaders...
[Android Software/Hacking General [Developers Only]] Antagonist42:
Just flicked through a power point doc on image encoding including rle for tv transmission, it can be done with the bitmap fields as well!!

With any luck they'll keep it simple ;)

Thought the LCD doc may come in handy as just for the screen being lcd, I don't think I've come across anything on screen images and encoding in Qualcomm docs so it's probably down to manufacturer how they do it (samsung and LG may use same as used on their TV's they make :confused: )

Bashing away at my HTC Desire C
[Android Software/Hacking General [Developers Only]] makers_mark:
I think they'll keep it simple, as they have for this reason: The images that are run length encoded in android, usually so far, are meant to be decoded and displayed instantaneously. If you go to a more complex algorithm to encode images in a run length fashion it is only practical for storage! I went back and forth about whether to write this guide for weeks before ever releasing any of this information, because I feared they would change it up to something that would be almost impossible to figure out, barring a leak. Then I came to the realization that they are pressed for speed on boot, and I don't think they want to make it any more complex, and if they do, oh well the game is on again.

I think that is part of the reason that the nexus 5 and 4 which use the 1 byte count 3 byte color, encode the whole bootloader screen in one pass. Because that method of decoding is easily the slowest, so instead of decoding the android at specified location, then the text, then the buttons..... They just draw the whole screen. I really think they're trying to save as much time as possible when it comes to these decoding algorithms.