[HTC Desire 526] wassti:
no custom recovery until we get s-off.

Also, just because I could, I tried the cyndia impactor with no success as well.

Basic info on the device I'm using

HTC Desire 526

HTCD100LVWPP

htc_a13wlpp

bootloader version 1

android version 5.1

buildID LMY470 release-keys

Verizion Wireless

so running cat /proc/emmc reveals:

dev: size erasesize name
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 01af7c00 00000200 "reserve_1"
mmcblk0p5: 00040000 00000200 "mfg"
mmcblk0p6: 017afc00 00000200 "pg2fs"
mmcblk0p7: 00040000 00000200 "rpm"
mmcblk0p8: 00200000 00000200 "tz"
mmcblk0p9: 00400000 00000200 "aboot"
mmcblk0p10: 00a00000 00000200 "sp1"
mmcblk0p11: 00008000 00000200 "ddr"
mmcblk0p12: 00100000 00000200 "rfg_0"
mmcblk0p13: 00100000 00000200 "rfg_1"
mmcblk0p14: 00100000 00000200 "rfg_2"
mmcblk0p15: 00100000 00000200 "rfg_3"
mmcblk0p16: 00100000 00000200 "rfg_4"
mmcblk0p17: 00100000 00000200 "rfg_5"
mmcblk0p18: 00100000 00000200 "rfg_6"
mmcblk0p19: 00100000 00000200 "rfg_7"
mmcblk0p20: 00180000 00000200 "fsg"
mmcblk0p21: 03b00400 00000200 "radio"
mmcblk0p22: 00a00000 00000200 "tool_diag"
mmcblk0p23: 00500000 00000200 "wcnss"
mmcblk0p24: 00000400 00000200 "limits"
mmcblk0p25: 00447c00 00000200 "reserve_2"
mmcblk0p26: 00100000 00000200 "misc"
mmcblk0p27: 00001000 00000200 "debug_config"
mmcblk0p28: 00180000 00000200 "modem_st1"
mmcblk0p29: 00180000 00000200 "modem_st2"
mmcblk0p30: 00040000 00000200 "pdata"
mmcblk0p31: 01600000 00000200 "persist"
mmcblk0p32: 00004000 00000200 "sec"
mmcblk0p33: 00100000 00000200 "cdma_record"
mmcblk0p34: 00000400 00000200 "fsc"
mmcblk0p35: 00002000 00000200 "ssd"
mmcblk0p36: 00020000 00000200 "rfg_8"
mmcblk0p37: 00020000 00000200 "rfg_9"
mmcblk0p38: 00020000 00000200 "rfg_10"
mmcblk0p39: 00020000 00000200 "rfg_11"
mmcblk0p40: 00020000 00000200 "rfg_12"
mmcblk0p41: 00020000 00000200 "rfg_13"
mmcblk0p42: 00020000 00000200 "rfg_14"
mmcblk0p43: 00020000 00000200 "rfg_15"
mmcblk0p44: 00004000 00000200 "control"
mmcblk0p45: 00010000 00000200 "extra"
mmcblk0p46: 00140400 00000200 "local"
mmcblk0p47: 00040000 00000200 "skylink"
mmcblk0p48: 02800000 00000200 "carrier"
mmcblk0p49: 00080000 00000200 "frp"
mmcblk0p50: 01000000 00000200 "vzw_quality"
mmcblk0p51: 01000000 00000200 "vzw_logger"
mmcblk0p52: 01400000 00000200 "fataldevlog"
mmcblk0p53: 01e00000 00000200 "devlog"
mmcblk0p54: 00a00000 00000200 "ramdump"
mmcblk0p55: 00a00000 00000200 "battery"
mmcblk0p56: 01000000 00000200 "absolute"
mmcblk0p57: 003a4800 00000200 "reserve"
mmcblk0p58: 03000000 00000200 "hosd"
mmcblk0p59: 02000000 00000200 "boot"
mmcblk0p60: 02000000 00000200 "recovery"
mmcblk0p61: 18000000 00000200 "cache"
mmcblk0p62: a0000000 00000200 "system"
mmcblk0p63: 00500000 00000200 "cota"
mmcblk0p64: 00500000 00000200 "apppreload"
mmcblk0p65: f8000000 00000200 "userdata"

For quick reference,

Recovery mmcblk0p60

aboot mmcblk0p9

boot mmcblk0p59

system mmcblk0p62

I will try to make some dumps of these so we can start messing with things that Verizon obviously doesn't want to. (that partition marked vzw_logger makes me want to root this even more lol)

I haven't messed with android in quite some time, but after poking around on the forums a bit I did notice something that may work in the m9 forums, something called a java card and xtc2 cable, I'll look into them more...

edit #2:

after being fueled by mountain dew and newport menthol 100's all night it feels as though I have made little progress. it's almost 6am and I'm still s-on with no root.

Verizons modified settings apk doesn't allow us to set the flag to allow for htc dev unlock, I've been looking into forcibly making the change, however without root I just get permission denied

I also can't even attempt to boot into a custom recovery as its s-on

If anyone has a temp root somehow, I think/hope this code should work to allow the htc dev unlock to work, however, I've also seen on some of the nexus 6+9 that the actual bit for this is stored in aboot or possibly in persist.

adb shell
cd /data/data/com.android.providers.settings/databases
sqlite3 settings.db
update system set value=1 where name='oem_unlock_enable';
.quit

at this point I feel as though I'm in an endless loop, I can't seem to dump anything without root and I can't even begin to attempt perma-root/s-off without a dump first. Any insight here would be greatly appreciated. (even a temp root would allow me to make the dumps) (I just get permission denied with everything I've tried, dd, cat, oem saveprt2sd, mount and tar, ect)

edit # idk anymore

"root genius" from http://www.shuame.com/en/root/ also doesn't work (although it looks like its just a flashy ui for kingroot lol) (i also tried the Chinese version 3.0 to no avail)

also tried pingpong root as some had success with the verizon one m9, didnt work...

DO NOT USE PINGPONG ROOT, results in a soft-brick

another edit,

I emailed HTC asking them for either a stock ruu for our device, or for a workaround for not being able to use the htcdev unlock. (I really dislike verizon right now, well, I always have because of crap like this lol)

aaaaannnnndddd... its bricked.... lol can still get into recovery so hopefully i can get this thing back on its feet (doesnt even get to the verizon splash screen :( )

edit #420: no more brick :D boots up just fine now, still no root.

I am in process of chatting (escalating) with HTC about what they can do for us to bypass verizons misguidance in this matter.

I should also be able to get a stock ruu soon :)