yashsingh1/xdaforums huggingface dataset:
[HTC Desire 526] BigCountry907:
[MENTION=7093822]webag.youtag[/MENTION]

I installed the mentioned app and used the code.

It shows in the app that the oem is turned on.

But It isn't setting the last byte of the FRP to 01 so ultimatly it will not work.

I tested and still get.

bigcountry@bigcountry-G551JW:~$ fastboot oem get_identifier_token

...

(bootloader) [KillSwitch] : /dev/block/bootdevice/by-name/frp

(bootloader) [KillSwitch] Last Byte is 0X00, disable unlock

(bootloader) [KillSwitch] oem unlock Turn Off!

OKAY [ 0.082s]

finished. total time: 0.082s

bigcountry@bigcountry-G551JW:~$

The app lacks permissions to write to the frp partition.

Anyone working on unlocking the boot-loader needs to use the method I posted previously.

And also note: If you reboot the phone then you need to flash the frp partition again.

During re-boot the bit gets set back to 00.

So in a nutshell.

Edit your frp. Make 00 = 01.

Then dd flash the frp.

Then adb reboot download.

Then fastboot oem get_identifier_token.

Problem is there still is a change required in the pg2fs partition / TO Avoid the CID Not Allowed Error

[MENTION=2379569]supermaxkato[/MENTION]

Not sure about the prl.

But I have noticed that the security system is tricky.

It will show you in adb shell that you have written the changes to the partition successfully.

But due to the read only protection the partition never really gets written.

Basically instead of giving an error it is writing to a NULL device successfully.
[HTC Desire 526] webag.youtag:
I was looking around and saw a post! (Rare I know)

Have you tried hboot instead of fastboot?also, I have no computer (sad). I am able to get temp root with "kingroot-4.8.2" I am able to use hex edit to change frp from 00 to 01. Is there a way to get identifier token without a PC? Maybe in configuration files or prop files?
[HTC Desire 526] webag.youtag:
Can you please upload your unlocked boot loader bigcountry907?
[HTC Desire 526] DankHeals:
Any more progress on this, gentlemen?
[HTC Desire 526] rfunderburk39:
When I follow the OP and get to the step:

"fastboot flash recovery Twrp-526-NO-TOUCH.img"

I receive the following error:

FAILED (remote: 9: SD_SECURITY_FAIL recovery and bootloader isn't BL_UNLOCK)

finished. total time: 2.762s

Steps taken:

-frp.img (Pulled from the device, edited & reflashed back with dd command, adb shell reports successful)

-pushed super.zip to device

-rebooted using fastboot to download mode

-attempted to flash TWRP & get the fail with the same error multiple times

Any suggestions or clues? I've attempted this several times, following the OP step by step.

Thanks for the help
[HTC Desire 526] BigCountry907:
[MENTION=3157339]rfunderburk39[/MENTION]

You have to unlock the BOOTLOADER first.

Currently I can only unlock it with the xtc-2 clip.

But I'm working on it.

Surprisingly my desire 530 was able to be s-off using TWRP recovery.

If i can somehow capture the commands passed from the xtc-2 clip to the twrp recovery we can replicate it.

Other than that were looking at cooking a qfil / qpst flashable rom.

Not easy.

does anyone know how to log all commands sent to TWRP?
[HTC Desire 526] supermaxkato:
BigCountry907, is the desire 530 you were able to root with twrp the verizon version? If so, did you have to unlock the bootloader first? Because I don't see it on htcdev.
[HTC Desire 526] rfunderburk39:
[MENTION=7006025]BigCountry907[/MENTION] I misunderstood the OP, I thought the frp.img edit was a work around of the Java Card.

I will look into the logging of the the TWRP commands. Let me know if I can help out in other ways.
[HTC Desire 526] BigCountry907:
[MENTION=3157339]rfunderburk39[/MENTION]

It gets you one step closer but still at the end it fails.

Verizon implements some major security.

I could really use some help.

I got alot together. The entire qcom msm8909 source + manuals you name it.

I was amazed today when i unlocked a desire 530 with the xtc-2 clip and it used [MENTION=1162986]Captain_Throwback[/MENTION] twrp to s-off the device.

The beauty of this is it proves S-Off is possible through twrp recovery.

It was my belief that the recovery did not have high enough permissions to write to the radio and get s-off.

Apparently if you know the right commands in the TWRP #shell it's possible.

So how deep into linux / android do you go?

My next best attempt is to generate a service rom using QPST to flash in EDL mode.

Ever make a partition.xml file???

Thats aboot where im at.

oh yea and JTAG TOO.
[HTC Desire 526] rfunderburk39:
Tommorrow my time will be limited during the day, but I can look into "qcom msm8909 source + manuals" & the ability to log TWRP commands and see what I can find.

Interesting about the 530, I was not aware that was possible.

I've used linux for about 20 years, and would consider my knowledge to be good, with the ability to usually get to source of a problem and/or find a solution slash work around.

I've never created a partition.xml, but would be happy to look into it.

I do have quite a bit of past JTAG experience but that was using a serial port not USB, which I assume you are referencing.
[HTC Desire 526] BigCountry907:
[MENTION=2379569]supermaxkato[/MENTION]

No my Desire 530 is Metro-Pcs.

I took one of the verizon 526 and activated it then used the phone number to port to Metro Pcs.

With the port it cost $70 for the Desire 530 + 1 month of unlimited service. Essentially the Desire 530 was free.

Any Verizon HTC most likely will have the same security scheme.

[MENTION=3157339]rfunderburk39[/MENTION]

This is good news. I would be grateful to have help on this.

It is difficult to know what kind of experience people have some don't even know how to use adb.

I will start another thread with all the information I know so far.

And I have the MSM8909 source code. Not just the kernel but the "Qualcomm Chipcode" Board Support Package.

And many qcom manuals.

This should be very helpful to us.

I will name the new thread "{WIP} {ROM} MSM8909 Service Rom From Source / QPST Root + Unlock + Unbrick"

I will post all current information there.
[HTC Desire 526] rfunderburk39:
Something potentially worth trying:

-Grab the Settings.apk (and .odex) from the 526+ or 626, just make sure its the same version of android.

-Push those to device

-adb shell

-su

-mount -o rw,remount,rw /system

-exit

-exit

-adb push Settings.apk /system/priv-app/Settings/

-adb push Settings.odex /system/priv-app/Settings/arm/

-Open >settings>developer options on the device

-check and see if the option “OEM Unlock” appears

-reboot into "download mode" and see if the settings stick.

-run fastboot oem get_identifier_token

Granted this holds the possibility of bricking the phone, but more than likely will not stick on a reboot & the Settings.apk will be replaced with the device original.
[HTC Desire 526] BigCountry907:
I will test on mine.

Give me an hour
[HTC Desire 526] BigCountry907:
Well I replaced the settings files with the settings files from the unlocked ruu for the 526.

It's a no-go the settings app crashes on boot.

This would only add the oem_unlocking option.

We can get the same result by changing the last byte 00 of the FRP.img to 01 and then in a root shell

to pull

dd if=dev/block/bootdevice/by-name/frp of=/sdcard/frp.img

to push

dd if=/sdcard/frp.img of=dev/block/bootdevice/by-name/frp

This will work to get a Unlock Token but the HTC-DEV site will reject it.

ERROR = CID Not Allowed.

If you can find a way to write the pg2fs partition I can make this work.
[HTC Desire 526] rfunderburk39:
I didn't think it would work, just an outside chance. Hoped it may give a different token, that in turn would pass over at HTC-DEV.

Back when I had other HTC devices, I used a tool here on XDA [TOOL] HTC Easy Unlock Bootloader Tool. It doesn't appear to be maintained any longer, its based around Windows *.bat files (easy enough to edit)

https://xdaforums.com/showthread.php?t=2133336

and SimpleGoldCard

https://xdaforums.com/showthread.php?t=970157

SimpleGoldCard would access a site, after downloading that, you select it in the SimpleGoldCard application & it would create the image.

https://huygens.hoxnet.com/goldcard.html

I haven't had time to read through these post just yet, the method may no longer be valid. But worth a look, and I will be reading through these today to see.

Also I will see what I can find about a work-a-round of the the writing to pg2fs partition
[HTC Desire 526] BigCountry907:
[MENTION=3157339]rfunderburk39[/MENTION]

The good thing about others getting involved is we all have different ways of accomplishing things.

The more ideas the better.

I have made the gold card. They don't work anymore. I haven't had any luck anyway.

I wrote a bash script to get the gold card if you want to play with it.

Today I figured out a way to unlock and change the verizon SPC / MSL code.

With that and the phone in service programming mode I can read and write the NV items.

NV = Non Volatile Memory. Im sure you know that but some people might not.

NV= it never gets erased or overwritten.

I dumped the NV off of my unlocked / s-off 526.

If any of that security is in the NV we might have a winner.

Since I can successfully write the backup NV to my device too.

I hope that I can write it to a locked device.

Who knows what will happen.

I cant test till i get home from work.

I will post a thread on how to change the SPC and how to dump and write the NV Tonight.
[HTC Desire 526] rfunderburk39:
I would be game to give the Gold Card a a try.

Writing to the NV sounds promising.
[HTC Desire 526] BigCountry907:
[MENTION=3157339]rfunderburk39[/MENTION]

http://www.mediafire.com/file/x75azxc2yn6orpy/Auto-Key-HTC.zip

Here is my master script.

There are a ton of tools incorporated.

Alot of it needs patched. Its a work in progress.

./HTC.sh is the main script.

./akey.sh is the original main script.

Everything in the script is notated well.

You should have no trouble making the things work that you want to use.

Just add them to a menu. Everything is written as a function.

Check this folder for goldcard stuff.

/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/goldcard-script
[HTC Desire 526] supermaxkato:
BigCountry907, open sesame door unlocks NV items, is that the method you used? But what I'm not able to do is change the prl through NV items. Do you know of a way (through NV or another method)?
[HTC Desire 526] BigCountry907:
[MENTION=2379569]supermaxkato[/MENTION]

You will need to follow my instructions here. ( AFTER I COMPLETE THEM )

https://xdaforums.com/desire-526/general/guide-msl-spc-unlock-diag-mode-qpst-t3545527

I have to look at changing the prl.

I just did the open sesame door. I need to see what all it unlocks.

Right now I am using QPST Software Download ---- Use the Backup and Restore Tabs. Backup makes a .xqcn file you can edit and write to the device using the restore .xqcn in the Software Download tool.
[HTC Desire 526] gogovroom:
I have a VZW Desire 526 that I've been dying to root for a little over a year now. I made an account and subscribed to this thread in hopes of the outcome. I am not very experienced with adb but for real, anything I can do to help please don't hesitate to ask and I will do my best to deliver. I'm excited to see this happening after such a long wait. :good:
[HTC Desire 526] rfunderburk39:
Ran the script, interesting work, with lots of potential.

Not a lot that I can do, being the request for BusyBox and I am unable to install BusyBox.
[HTC Desire 526] BigCountry907:
rfunderburk39

Busybox is needed for some things to work.

But most of the scripts will still work fine.

From the projects menu select use current project and a whole new menu system will come up with many many more options.

If there is anything specific you want to do or if you need to track down where something is called in the code just let me know.

I pretty much know it by heart.

I was going to release it to the public but started rewriting it with upgraded tools and never finished.

The akey.sh is the original script i wrote.

the htc.sh is the new version.

It wont take much to patch it up for certain things to work.
[HTC Desire 526] loonix:
[MENTION=7006025]BigCountry907[/MENTION]

Just wanted to check in and say I have followed both of your bootloader unlock threads for the 526 and say thanks for sharing your work. Any more updates to the possibility of doing this without the clip?

.
[HTC Desire 526] BigCountry907:
Check out this tread. This is the progress I have made.

https://xdaforums.com/desire-526/or...sm8909-service-rom-source-qpst-t3544178/page6

:cowboy:
[HTC Desire 526] BigCountry907:
Ureeekkkaaaa.....

I think I got it.

Needs more testing but its coming soon.

The bootloader unlock.
[HTC Desire 526] supermaxkato:
Awesome; thanks for all of your work! Glad to test and report back whenever you upload it!
[HTC Desire 526] BigCountry907:
[MENTION=2379569]supermaxkato[/MENTION]

Get an 8gb SD Card ready.

I will have a test image for you some time today.

What operating system do you have on your PC?

Can you Run Ubuntu, or if not maybe a Ubuntu Live CD?

If your running windows What Version?

This is getting exciting.
[HTC Desire 526] supermaxkato:
Only Windows XP. Looking forward to it!
[HTC Desire 526] supermaxkato:
BigCountry907 , I'll be up for a little while if you are still working on it. 8gb card is locked and loaded. :)
[HTC Desire 526] BigCountry907:
[MENTION=2379569]supermaxkato[/MENTION]

Well I have kinda bad news for you.

You will not be able to do this in windows.

Windowz Suckz. I was trying to make it work but it won't.

Basically you have to take a rom build that I created and flash it block by block to a 8gb SD Card.

In ubuntu we can do this very very easily.

I will post all instructions.

Start here. Make a Ubuntu bootable USB.

https://www.ubuntu.com/download/desktop/create-a-usb-stick-on-windows

Let me know when your done.

I know this will work on any pc so if you make the drive right you should have no trouble with ubuntu.

You will need a USB SD card adapter.

Or at least a built in sd card reader.

The usb sd adapter will be the best.

I have one of these and it works like a charm.

https://www.walmart.com/ip/Mobile-J...35&wl11=local&wl12=25173066&wl13=2561&veh=sem

Cheap too.

Other usb adapters or the built in sdcard reader might work.

So make ubuntu bootable flash drive ( To regular USB Stick )

And get the usb card reader.

If your computer is pretty good like 2 GHz dual core processor or better then use ubuntu 16.04

Otherwise go here and use 14.04.5

http://releases.ubuntu.com/?_ga=1.30783423.1478272420.1485720751
[HTC Desire 526] supermaxkato:
BigCountry907

I found my old knoppix bootable linux CD-rom. Could I use this?

I am downloading the 14.04.5 ubuntu just in case you don't think my CD will work. Let me know.

Once I get this running do you have a download link for your rom?

Also, is there an RUU for this phone that will get me back to stock if I don't do this correctly?
[HTC Desire 526] BigCountry907:
The Diamond SD Card

Since there used to be a so called Gold Card for the HTC Devices we will call this the Diamond Card.

It worth more than gold but like an uncut diamond a little rough around the edges.

This Sd Card will not make any permanent changes yet so don't worry about causing a brick.

Theres no chance of it.

This is an interesting thing that I discovered wile building the Service Rom.

[MENTION=2379569]supermaxkato[/MENTION]

And anyone else who will test and report back follow the instruction below.

Step 1

Download the rom package.

http://www.mediafire.com/file/whuvrbarr25i5r5/TARGET-test1.zip

Unzip the file where ever you like and rename the folder TARGET.

Step 2

Open up ubuntu or linux Live CD or USB is ok but ( NO WINDOWS )

Open up a terminal window.

cd to the TARGET folder.

Step 3

On your computer.

Plug in your SD Card to a USB Adapter with a blinking led preferably.

Any sd reader should work.

Step 4

Type the following command in the terminal.

sudo python msp.py

Step 5

Look in the output for your sd card location.

Like /DEV/SDC

Then run the command using your sd card location that you found above.

When you do this it will write the image to the SD Card ( Or you harddrive "ouch" if you pick it )

Just check the size and you know what size the sd card is. Pick that one.

sudo python msp.py -r rawprogram0.xml -d /dev/sdc

Your screen will look like this.

Notice the size of the disk.

Select y to write the disk.

Thie script will finish faster than the actual Write.

You can watch for your sd card reader to stop blinking or let it sit a good 20 min.

Dont touch it.

After 20 min or if it stops blinking for a wile unplug the usb adapter and then plug it back in.

You should get bombarded with a bunch of disks mounting just close them.

You will get some permissions errors too. Its ok.

Your sd card is ready DO NOT PATCH !!!!!!!

Turn off your phone.

Put the SD CARD in it.

Hold volume down and power to boot into Download Mode.

Awesome you have fastboot with S-off and Unlocked Privileges. Sweet.

Post a photo of your screen in download mode wile booted to the sd card.

Select System Info

You will see It shows the version of the bootloaders.

sbl1 0.1.130.1.6

tz 2.5.0181.03

RPM 17.0.5

On the main screen you see

htc_a13wl PVT s-off

CID = 11111111

LK- 1.0.0.0000

Radio 1.04.C51061@50707

Os 1.06.617.6

If you boot the device into download mode without the sd card in you will see your normal scree.

Notice the radio and os and bootloader versions are different.

That tells me we are indeed booted off the SD Card.

Now you can't write anything because the emmc is not mounted. ( THE SD CARD IS )

But all the fastboot commands work.

If I can modify the kernel and swap the emmc and sd card then we can boot from the sd card.

And write the emmc.

Check it out.

Basically we need to do this.

https://translate.google.com/transl...2016/08/build-qualcomm-modem.html&prev=search
[HTC Desire 526] supermaxkato:
BigCountry907 , sounds like this process will give us a kind of temporary bootloader unlock? Because it goes away if we boot without the sd card, right? So since this is all well beyond me, I think I might wait until others can help you make this permanent.

Unless me going through this process will help somehow?
[HTC Desire 526] BigCountry907:
[MENTION=2379569]supermaxkato[/MENTION]

It gives SUPER CID & S-OFF & BOOTLOADER UNLOCK.

It is as easy as boot into linux and run two commands. Thats as easy as it gets.

Maybe you can permanently unlock your phone.

You have to try to know what you can accomplish.

I very much enjoy sharing my experiences but I try to do it in a way that makes people have to learn something.

Like helping you with homework but not giving you the whole answer.

This way the community keeps learning and together we can grow and develop solutions faster.

This is the safest possible way to learn about these things.

You can only mess up your External SD Card at this point.

Learn what to do with the sd card without messing it up and you have the answer of what to do to the phone.
[HTC Desire 526] loonix:
Will be trying this tomorrow. I am hoping this works even with the Android 6.x updates pushed in December by big red. Wish I had seen this sooner over the weekend.

And amazing work here [MENTION=7006025]BigCountry907[/MENTION] There is tremendous amount of information you have poured on in your threads. Haven't started the lessons yet but I am hoping to do that this week.

.
[HTC Desire 526] supermaxkato:
Thank you....

I will give a try too BigCountry907 . Thanks for all of your investment here!

loonix , I did not take the 6.0 update so we can compare and see if this brings different results.
[HTC Desire 526] supermaxkato:
First time working with Ubuntu and I can't get it to see my laptop hard drive. And so I can't CD to the target folder to start this process. A google search gave me some commands that did not work. Any suggestions for me [MENTION=1072728]bigcountry[/MENTION] or anyone else?

Also, [MENTION=251096]loonix[/MENTION] did you have success yet?
[HTC Desire 526] BigCountry907:
[MENTION=2379569]supermaxkato[/MENTION]

Just put the Target directory or any files you need on the flash drive or CD you are booting from and access them there.

The sd card will work no matter what version of Android you are using.

Boot into Download Mode only. ( The s-off and unlocked is only when booted from the sd) NOT Permanent.

You can Flash any RUU like you are S-off and also do commands like [fastboot oem writemid] [fastboot oem writecid] and everything works.

Unfortunately this only changes the partitions on the sd card.

This past friday I got a Engineering Boot loader [Little Kernel] for the 526.,

This will give us even more commands and features.

I am working these things out. It may take running a combination of partitions from the sdcard and the normal emmc.

To change partitions on the emmc.

And then there is this project.

https://xdaforums.com/android/software-hacking/locked-fish-hack-to-boot-want-device-t3578373

That I have ported to my desire 526 and have working.

If I can combine FisH with my SD Card then I can Boot TWRP.

At which point I will have a root access shell.

Then I can modify the cid and most likely be able to generate a good unlock code.
[HTC Desire 526] :
I don't know what is the problem but when i wrote the first command you gave in the thread , it says no such directory found.

so i used the ls command to search the directories and i didn't find the bootdevice folder in the directory /dev/block

Note : i have roted my phone with Kingoroot and adb shell recognize the Su but i want to unlock bootloader and get twrp [MENTION=7006025]BigCountry907[/MENTION]
[HTC Desire 526] BigCountry907:
[MENTION=6994372]Cursed[/MENTION]

This root method is only for people that can unlock the bootloader with a JAVA CARD.

To Unlock the bootloader and install supersu you will need to go to this thread.

I'm working on simplifying the method. It works and will be released soon.

https://xdaforums.com/desire-526/general/verizon-htc-desire-526-boot-loader-root-t3587118
[HTC Desire 526] :
I already got root but i want to unlock the bootloader. I guess i will wait until you finish your thread. good luck buddy
[HTC Desire 526] BigCountry907:
The SD-CARD unlock is posted and working.

I just TESTED it again and it worked flawlessly.

Maybe the Super CID is blacklisted for some other HTC Devices but not the DESIRE 526.

I have no reason to post something that wont work.

And If I say it is tested it is.

Try the SD Card Unlock.

I patched the TWRP so touch will work now.

Will post new TWRP now.

http://www.mediafire.com/file/g3h14psl1m40wmi/TWRP.img

After your boot loader is unlocked you can flash this TWRP.

The Touch Screen is Patched.

Everything is TESTED and VERIFIED working.
[HTC Desire 526] jcase:
I will offer $1000 to the bonafide charity of your choice if you can prove your method works in the next 72hours. I'm a big fan of charity bounties, and have made this offer many times on XDA and elsewhere.

Your method doesn''t work on normal devices because:

a) CID 11111111 is blocked on htcdev.com

b) writing to where CID is protected by writeprotection, applied at boot time by aboot

c) FiSH requires the device to be rooted, and selinux to be disabled (per FiSH FAQ)

Your method could work on your phone because you already used another tool to remove write protection by setting it s-off.

If you want to take me up on my charity bounty offer, set your phone's MID and CID back to stock, RUU an official signed firmware, set the phone back locked, set the phone back s-on. Then do it, without using another tool to defeat the write protection.