[Windows Phone 8x by HTC] grilledcheesesandwich:
So I was able to make a decompressed extracted dump of the UEFI cab update package. After extracting the 2_UEFI.bin file from the cab update, I ran it through some PC bios extraction tools. Just my luck it worked.

This package is only partially extracted. And readable.

MORE STUFF ON POST#2

here is picture attached here

PLEASE MAKE NO!!!! ATTEMPT TO FLASH ANY OF THESE FILES. UNLESS YOU KNOW WHAT YOUR DOING.

FULL DUMP CAN BE DOWNLOADED HERE

View attachment 2891910

Here are some strings from EBL module that was extracted from a Vondafone UEFI update cab.

EblCheckRefurbishResult

[FAT_ERROR] fat_get_next_cluster: allocate %d bytes for FAT table sector buffer fail!

[FAT_ERROR] fat_get_next_cluster: read FAT table sector[%d] fail!

fat_read_disk [FAT_ERROR] fat_get_skip_cluster: allocate %d bytes for FAT table sector buffer fail!

[FAT_ERROR] fat_get_skip_cluster: read FAT table sector[%d] fail!

[FAT_ERROR] fat_open_file: can not alloc heap for the file description!

[SSD-PLAT] ReadSector failed, please probe removable media first.

[SSD-PLAT] ReadSector failed, please probe removable media first.

[SSD-PLAT] WriteSector failed, please probe removable media first.

[SSD-PLAT] WriteSector failed, please probe removable media first.

EblEMMCInformation: Not found hTC Sdcc extention protocol!! (%r)

EblEMMCInformation: Not found hTC Sdcc extention protocol!! (%r)

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\EmbeddedPkg\Ebl\hTC\tz.c !EFI_ERROR (gBS->LocateProtocol(&gQcomPmicVregProtocolGuid, 0, (void**)&PmicVregProtocol))

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\EmbeddedPkg\Ebl\hTC\tz.c !EFI_ERROR (gBS->LocateProtocol(&gQcomPmicVregProtocolGuid, 0, (void**)&PmicVregProtocol))

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\EmbeddedPkg\Ebl\hTC\tz.c !EFI_ERROR (gBS->LocateProtocol (&gEfiCpuArchProtocolGuid, 0, (void **)&CpuArch))

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\EmbeddedPkg\Ebl\hTC\tz.c !EFI_ERROR (gBS->LocateProtocol (&gEfiTzeLoaderProtocolGuid, 0, (void**)&TzeLoader))

[SECURITY] TZ_HTC_SVC_READ_SIMLOCK_MASK modified ret = %d, mask = 0x%X

[SECURITY] TZ_HTC_SVC_READ_SIMLOCK_MASK modified ret = %d, mask = 0x%X

[SECURITY] TZ_HTC_SVC_UPDATE_SIMLOCK: TZ NOT return updating record index

[SECURITY] TZ_HTC_SVC_UPDATE_SIMLOCK: TZ NOT return updating record index

[SECURITY] secure_get_simlock_upgrade_magic, ret=%d (0x%x, 0x%x, 0x%x)

[SECURITY] secure_get_simlock_upgrade_magic, ret=%d (0x%x, 0x%x, 0x%x)

[SECURITY] TZ_HTC_SVC_EMMC_WRITE_PROT set magic (0x%X, %d) ret = %d

[SECURITY] TZ_HTC_SVC_EMMC_WRITE_PROT set magic (0x%X, %d) ret = %d

[SECURITY] TZ_HTC_SVC_EMMC_WRITE_PROT get magic 0x%X 0x%X ret = %d

[SECURITY] TZ_HTC_SVC_EMMC_WRITE_PROT get magic 0x%X 0x%X ret = %d

hash: %a 2 [1: sha1 | 2: sha256] [src address] [src len] [digest addr] [digest len]

hash: %a 2 [1: sha1 | 2: sha256] [src address] [src len] [digest addr] [digest len]

aes: %a 3 [0: aes128 | 1: aes256] [0: ECB | 1: CBC | 2: CTR] [0: encrypt | 1: decrypt] [iv addr] [key addr] [src addr] [len] [dest addr]

aes: %a 3 [0: aes128 | 1: aes256] [0: ECB | 1: CBC | 2: CTR] [0: encrypt | 1: decrypt] [iv addr] [key addr] [src addr] [len] [dest addr]

aes encryption with SW key: %a 8 [0: aes128 | 1: aes256] [0: ECB | 1: CBC | 2: CTR] [0: encrypt | 1: decrypt] [key id] [iv addr] [src addr] [len] [dest addr]

aes encryption with SW key: %a 8 [0: aes128 | 1: aes256] [0: ECB | 1: CBC | 2: CTR] [0: encrypt | 1: decrypt] [key id] [iv addr] [src addr] [len] [dest addr]

set ddr mpu config: %a 11 [index] [read vmid mask] [write vmid mask] [start] [end]

set ddr mpu config: %a 11 [index] [read vmid mask] [write vmid mask] [start] [end]

enable_hw_auth

disable_jtag

blow_boot_cfg

blow_sec_key

hide_hwkey

checksbl1

je board_evm

evm

EVM8960

ke board_evm2

evm2

EVM28960

board_evita

evita

EVITA board_accord_wl

accord_wl

PM2310000

board_accord_wr

accord_wr

PM2330000

board_accord_u

accord_u

PM2320000

board_accord_ul

accord_ul

PM2321000

board_accord_td

accord_td

PM2350000

[ERR] partition_update offset is not emmc sector[%d] aligment! Offset[%d]

htc_pg_sanity_check pg %a: calculated checksum 0x%x is mismatched (header checksum 0x%x)

pg %a: calculated checksum 0x%x is mismatched (header checksum 0x%x)

htc_pg_hdr_get

htc_pg_hdr_set

htc_pg_part_hdr_get

htc_pg_alloc_map

htc_pg_find_best_alloc

htc_pg_alloc

htc_pg_part_reduce_size

htc_pg_fix_part_hdr_add

htc_pg_part_hdr_set

htc_pg_part_traverse

htc_pg_link_size

htc_pg_part_update

htc_pg_part_clear

htc_pg_part_read

htc_pg_update_crc

htc_pg_part_modify

htc_pg_part_modify:

part %a,

offset %d,

len %d,

is_erase %d,

update_crc %d

htc_pg_part_modify:

part %a,

offset %d,

len %d,

is_erase %d,

update_crc %d

htc_pg_free_size

htc_pg_part_crc

check_pgfs

check_boardinfo

chipset_setting_init

chipset_reset

chipset_get_device_id

chipset_set_device_id

read_simlock

write_simlock

EMBEDDED BOOT LOADER COMMANDLINE INTERFACE

I think some of the more experienced gurus form the Windows Mobile days can input more knowledge here.

EblBoardInfoCommand

write_simlock_password

read_simlock_password

radio_init_secure_smem

ClearSimLockCode

AddSimLockCode

EnableSimLock

DisableSimLock

HTC

USB BLDR

HandleSetupPkt

HandleUSBEvent

**** Both TX and RX needs to be queued, but only one can be queued. SOMETHING MAY GO WRONG **** OnBoard_USB_Init OnBoard_USB_Write

**** Both TX and RX needs to be queued, but only one can be queued. SOMETHING MAY GO WRONG ****

OnBoard_USB_Read

detectUsbCable

0 . 0 . 0 . 0

PIKS

MSM8960

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\Build\Msm8960\RELEASE_RVCT31\ARM\EmbeddedPkg\Ebl\Ebl\DEBUG\AutoGen.c

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\Build\Msm8960\RELEASE_RVCT31\ARM\EmbeddedPkg\Ebl\Ebl\DEBUG\AutoGen.c

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\Build\Msm8960\RELEASE_RVCT31\ARM\EmbeddedPkg\Ebl\Ebl\DEBUG\AutoGen.c

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\Build\Msm8960\RELEASE_RVCT31\ARM\EmbeddedPkg\Ebl\Ebl\DEBUG\AutoGen.c

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\Build\Msm8960\RELEASE_RVCT31\ARM\EmbeddedPkg\Ebl\Ebl\DEBUG\AutoGen.c

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\Build\Msm8960\RELEASE_RVCT31\ARM\EmbeddedPkg\Ebl\Ebl\DEBUG\AutoGen.c

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\Build\Msm8960\RELEASE_RVCT31\ARM\EmbeddedPkg\Ebl\Ebl\DEBUG\AutoGen.c

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\Build\Msm8960\RELEASE_RVCT31\ARM\EmbeddedPkg\Ebl\Ebl\DEBUG\AutoGen.c

c:\apollo_bsp\accord_u_gdr2_00_s\wp\uefi\edk2\Build\Msm8960\RELEASE_RVCT31\ARM\EmbeddedPkg\Ebl\Ebl\DEBUG\AutoGen.c

No Media

Media changed

Access Denied

Write Protected

Not started

Already started

Aborted

Unsupported

Not Found

Warning

Delete

Failure

Warning

Write Failure

No Response

Bad Buffer Size

No mapping

Warning Unknown Glyph

Warning Buffer Too Small

Volume Full

Invalid Parameter

ICMP Error

TFTP Error

Load Error

Device Error

Protocol Error

Out of Resources

Success

Volume Corrupt

Time out

Not Ready

Snapdragon S4 Processor

GPT PARTITIONS

FFFFFFFF-FFFF-FFFF-FFFF-000000000010

540B4740-D799-497D-9F02-B36D2E958EB0

B7A9BDA8-368C-46BC-B2C7-67501F0E6B52

9183C552-0934-4FD6-AF26-13FE14244223

320D3B19-80D9-467A-99BC-AB2B85287574

A053AA7F-40B8-4B1C-BA08-2F68AC71A4F4

E35F99CF-0025-4252-A608-CAAA1289CAF4

69B4201F-A5AD-45EB-9F49-45B38CCDAEF5

0732095D-CD4E-4492-B229-28D4ECCEC1B6

F0B4F48B-AEBA-4ECF-9142-5DC30CDC3E77

E5C3DF3F-556D-478e-AFE3-DABA98C52897

EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

ebd0a0a2-b9e5-4433-87c0-68b6b72699c7

098DF793-D712-413D-9D4E-89D711772228

400FFDCD-22E0-47E7-9A23-F16ED9382388

DEA0BA2C-CBDD-4805-B4F9-F428251C3E98

E6536BC2-6DA4-495D-A83B-79F93701E799

638FF8E2-22C9-E33B-8F5D-0E81686A68CB

0A288B1F-22C9-E33B-8F5D-0E81686A68CB

EBBEADAF-22C9-E33B-8F5D-0E81686A68CB

3A6A228E-FC35-4A46-A869-4C511F7CE5EC

6BB94537-7D1C-44D0-9DFE-6D77C011DBFC

8C6B52AD-8A9E-4398-AD09-AE916E53AE2D

2373E6C7-FCBE-42B1-B44A-10DDAF18388D

543C031A-4CB6-4897-BFFE-4B485768A8AD

530C3197-F4D2-408F-B886-778ED6CDFDAD

05E044DF-92F1-4325-B69E-374A82E97D6E

74DA3EE7-D422-487C-A573-CE03C261362F

A44D2E89-8B5A-4F42-8FE5-FD36333A3BFF

PARTITION IMAGES

%a:\hTCIMG\QC\MSM8960\%04x\rfg_0.img

%a:\hTCIMG\QC\MSM8960\%04x\rfg_1.img

%a:\hTCIMG\QC\MSM8960\%04x\modem_st1.img

%a:\hTCIMG\QC\MSM8960\%04x\rfg_2.img

%a:\hTCIMG\QC\MSM8960\%04x\modem_st2.img

%a:\hTCIMG\QC\MSM8960\%04x\rfg_3.img

%a:\hTCIMG\QC\MSM8960\%04x\rfg_4.img

%a:\hTCIMG\QC\MSM8960\%04x\rfg_5.img

%a:\hTCIMG\QC\MSM8960\%04x\rfg_6.img

%a:\hTCIMG\QC\MSM8960\%04x\rfg_7.img

%a:\hTCIMG\QC\MSM8960\%04x\disk.img

%a:\hTCIMG\QC\MSM8960\%04x\radio.img

%a:\hTCIMG\QC\MSM8960\%04x\sbl1.mbn

%a:\hTCIMG\QC\MSM8960\%04x\sbl2.mbn

%a:\hTCIMG\QC\MSM8960\%04x\sbl3.mbn

%a:\hTCIMG\QC\MSM8960\%04x\uefi.mbn

%a:\hTCIMG\QC\MSM8960\%04x\rpm.mbn

%a:\hTCIMG\QC\MSM8960\%04x\winsecapp.mbn

%a:\hTCIMG\QC\MSM8960\%04x\tz.mbn

%a:\hTCIMG\QC\MSM8960\%04x\gpt_main0.bin

%a:\hTCIMG\QC\MSM8960\%04x\fat16.bin

%a:\hTCIMG\QC\MSM8960\%04x\MainOS.bin

%a:\hTCIMG\QC\MSM8960\%04x\fat_FFU.bin

%a:\hTCIMG\QC\MSM8960\%04x\UserData.bin

%a:\hTCIMG\QC\MSM8960\%04x\sdata.bin

%a:\hTCIMG\QC\MSM8960\%04x\misc.bin

%a:\hTCIMG\QC\MSM8960\%04x\mfg.bin

%a:\hTCIMG\QC\MSM8960\%04x\modem_fsg.bin

%a:\hTCIMG\QC\MSM8960\%04x\dpp.bin

%a:\hTCIMG\QC\MSM8960\%04x\efiesp.bin

%a:\hTCIMG\QC\MSM8960\%04x\eblogs.bin

RUU CONFIGURATION

THESE VARABLES CAN BE USED TO IN THE ACDUCONF.TXT

[getvzwmid] Query VZW model ID

[getmeid] Query device MEID vzwisLTE

[getdevinfo] Return device Model ID and CID to RUU

[getimei] Return device IMEI to RUU

[blversion] Return bootloader version to RUU wdata

[readconfig ] Read i-th config data or read all config data if no i supplied getmeid getvzwmid

[task TaskNum] Executing task command

[set SetNum SetValue] Executing set command password ResetDevice

[ResetDevice] Reseting the device

[wdata Length Checksum] Writing NBH file format data to device

[ruustart] Enter RUU special command mode

[progress Percentage] Show progress bar and percentage on screen for RUU use readconfig Ask radio to start refurbish startrefurbish getimei task blversion

[password PassWord] RUU password verification getdevinfo progress set Check the refurbish result checkrefurbishresult

[vzwisLTE] Check the device is LTE or not ruustart

FixVoltageMSMC1

FixVoltageMSMC2

KitlIP DCVSParam[0]

DCVSParam[1]

DCVSParam[2]

DCVSParam[3]

DCVSParam[4]

DCVSParam[5]

DebugMethod

PowerSavingDisable

DriverDisable

FixedIdleTime

DriverLocalZone

PagingPoolSize

DebugFlag

DriverFlag

PassiveKitlDbg

HookDebug

ApSwitch

KitlNetMask

FixFreqLevel

USBFlags

RadioDebugFlags

SensorDebugFlags

BootloaderFlags

DLLLowFlags

DummyFlags

SpyFlags

DllBreakPoint

DemFatalCount

AutoFocusTest

DebugBattery

secure erase secure trim

QUALCOMM OEM

STILL NOT SURE ABOUT THESE STRINGS

Q6:

VDDCX:

Krait:

RFSKUIDField_D0

RFSKUIDField_D1

RFSKUIDField_D2

RFSKUIDField_D3

RFSKUIDField_D4

RFSKUIDField_D5

RFSKUIDField_D6

RFSKUIDField_D7

EngineerID

KEK

PK

DPP

HTC OEM SECURE KEYS

fs0:\SecureBootPolicy.p7b

db pDPP.enc

OEM_DB_CLEAR.enc

OEM_KEK_CLEAR.enc

OEM_PK_CLEAR.enc

OEM_DBX_CLEAR.enc

PCBIDField

FunctionSKUField

ssd

delfile

crwfile

fs0:\enc.img

fs0:\ori.img

SKUIDChecksum

fs0:\OEM_dbx_2011.bin

fs0:\OEM_db_2012.bin

fs0:\OEM_KEK.bin

fs0:\OEM_PK.bin

fs3:\pDPP.tmp

fs3:\OEM_DB_CLEAR.tmp

fs3:\OEM_KEK_CLEAR.tmp

fs3:\OEM_PK_CLEAR.tmp

fs3:\OEM_DBX_CLEAR.tmp

var midr

fs0:\keystore.dat

v

w

dbx

CurrentPolicy

QULCOMM SECURE

RFG_0

SBL1

MODEM_FS1

RFG_1

SBL2

MODEM_FS2

RFG_2

SBL3

RFG_3

RFG_4

RFG_5

RFG_6

RFG_7

SDATA

MISC

MODEM_FSG

UEFI

RPM

RADIO

BDP

WINSECAPP

DPP

EFIESP

EBLOGS

MainOS

PLAT

TZ

Data

X

ROM UPDATE UTILITY

HTCIMAGE

GPT_HEADER TOUCH_FW_UPDATE

ACDUIMG.nbh

ACDUNV.nbh

ACDUDIAG.nbh

ACDUCONF.txt

ACDUDIAG.nbh

HTCIMAGE

simunlock