[HTC 10 Questions & Answers] zzi:
[S-ON+LOCK+status:mod] Another boot loop (with detailed debug info)

Hi all,

My dear phone decided to join the boot loop group. The phone was working fine (90% charged), I plugged it into USB power from the HTC quick charger, and it appeared the charger was not fully seated. The phone near the USB connector and USB charger metal shell started to get warm/hot, so I unplugged it. Then, I noticed the left and right softkeys were not working. I thought there was a power glitch so I rebooted the phone, and it started the boot loop.

This phone was a completely stock HTC 10. Never rooted, never reflashed after factory.

Important note to devs:

Initial: Software status: Official / LOCKED / S-ON

Now: Software status: Modified / LOCKED / S-ON

Here's the rundown:

- I can access the white bootloader screen reliably

- I can send commands from fastboot and fastboot-mac (HTC) to the bootloader

- I can't get adb to recognize the phone in any menu or configuration

- I was able to flash hosd with "./fastboot-mac flash hosd 2.51.617.11-imgs/hosd_signed.img"

- "Boot to download mode"

--- I attempted get the SD card prompt by renaming these images to "2PS6IMG.zip" on the SD card root

------ I formatted a 128GB uSD as 18GB FAT32 partition (can 128GB cards be used?)

------ "2PS6IMG_PERFUME_WL_N70_SENSE80GP_VZW_MR_NA_Gen_Unlock_2.51.617.11.zip"

------ "2PS6IMG_PERFUME_WL_O80_SENSE90GP_MR_NA_Gen_Unlock_3.16.617.2.zip""

------ no prompt appeared

--- The download mode always shows the smaller gray HTC logo

------ Most times, the phone will reboot after 5 seconds

------ Some times, the phone will stay showing the gray logo and stop boot looping

--- I was able to write a few bytes to the boot partition (this process is repeatable on my phone)

------ I entered the bootloader (white screen)

------ I prepped "> fastboot_mac flash boot twrp.img"

------ I selected "BOOT TO DOWNLOAD MODE"

------ I pressed PWR on the phone and enter on the keyboard almost simultaneously

------ A black screen is loaded with the following red text (similar to the M8's red boot warning):

Failed to boot to download mode

Press volume up or down to back to menu

[htc download logo]

This build is for

development purposes only

Do not distribute outside of HTC

without HTC's written permission.

Failure to comply may

lead to legal action.

------ I pressed VOL DOWN and am taken back to the bootloader (white screen)

------ Now the bootloader says "Software status: Modified" and a fourth line "*** Security Warning ***"

------ The "Software status" change is permanent after rebooting, the security warning is not

------ I'm thinking a dev more experienced than me can use this as a new exploit, since it appears there is a small time gap either in the bootloader or the download mode that allows writes while LOCKED + S-ON

------ I'll try to get a picture of this soon

- "Boot to recovery mode"

--- this mode always shows the smaller gray HTC logo for 3 secs, reboots, shows same logo for 5 secs, reboots again

> fastboot-mac oem get_identifier_token

FAILED (remote: unknown command)

> fastboot-mac getvar all

INFOversion:0.5

INFOramdump-mode:false

INFOvariant:Surf eMMC

INFOsecure:yes

INFOversion-baseband:

INFOversion-bootloader:

INFOmax-download-size:	0x20000000

INFOpartition-type:cache:ext4

INFOpartition-size:cache:	0xe000000

INFOpartition-type:userdata:ext4

INFOpartition-size:userdata:	0x61b000000

INFOpartition-type:system:ext4

INFOpartition-size:system:	0xef000000

INFOserialno:FA646BNxxxxx

> fastboot reboot emergency # does not cause any different action

> fastboot-mac getvar cid # no output in bootloader

cid:

> fastboot-mac getvar mid # no output in bootloader

mid:

Issues:

- I don't know the CID/MID (only that this is an HTC direct to USA, factory unlocked phone)

- I don't know the exact software version on the phone (only that its 2.xx.617.x and I applied every prompted update except Oreo)

- I don't know if 128GB uSD cards can work for the "2PS6IMG.zip" option

- I don't know if I enabled OEM unlock in the dev menu (I was goofing around in the dev menu last month, so I'm pretty sure it is, in preparation for some phone hacking in the near future)

- How do I verify or check to make sure the NAND/eMMC is working okay and there is not a hardware failure?

--- is flashing the hosd_signed.img enough?

- Of course, there is a bunch of critical data on this phone that, like many others, I need to recover

--- I'll do whatever is necessary so I can get access to the data partition on this phone again

Thoughts?