yashsingh1/xdaforums huggingface dataset:
[Wildfire General] n!k:
I read about this the other day; it claimed (somewhere I can't find again) that it worked with any HBOOT. This is not software S-Off though, at it costs around U$ 150.

Scroll to the middle of the page; there is a mention of the white card -aka mega card.

http://blog.rebelsimcard.com/tag/android-phone-unlock

According to this page, there seem to be some 'official' HTC white cards, and the clip replicates these.

Looking at the install from my non-technical point of view, it looks like this white card could well be a sim card, and the clip emulates it (hence the contacts), but I am prolly wrong :)

There are 2 vids on youtube showing it:

http://www.youtube.com/watch?v=6wj9nnlRSww&NR=1

http://www.youtube.com/watch?v=xfr0c0MaxY8&NR=1
[Wildfire General] sethxp:
Also diag(nostic) file is needed, when you enter hboot what files are checked on sd card? Its clearly written on the screen, on of them is example PC49DIAG.*** then with authorization command from smart card you can clear flags, set cid, clear simlock...
[Wildfire General] jokage:
My girlfriend's dad got her a htc wildfire coming from Italy (unlocked) it ran a italian version of 2.1 with a strange baseband. When I tried to root it, I couldn't help but notice her hboot said S-off and it still does. Does this occur only on the free-sim versions? Or is that luck?
[Wildfire General] NickHu:
Here's my theory: There's some kind of hardware-based security unlock, like the XTC Clip, or a JTAG, or whatever. If you bought that phone pre-unlocked, perhaps is was unlocked by such method. This does not mean that using an unlock code will give you S-OFF.
[Wildfire General] BlasBlas:
The thing is that s off with hardware tools is not a challenge. usefull for debugging unbricking etc but almost nobody has them that's why unrevoked and alpharev are so great they do it just with software, make it user-friendly so every one can use it. And that is as important as getting it done. But you need to find a way to talk to some parts that are closed unless you've got the keys like the clip fakes, etc. As far I discompiled it and understand it you need to get access to at@ commands and then it is just one command but I just began with it and i'am not going to have a lot of time in the following 2 weeks so I hope they get it done. That they find a way that HTC has forgotten to close.
[Wildfire General] BlasBlas:
If you got soff you can flash any version you want you don't need to root just flash a Android that is prerooted. Soff gives the same flashing possibility as the nexus one and s. You're free !
[Wildfire General] ErwinP:
Which brings us back to one of the questions in the first page of this toppic :-) can you share some of your "sources" wich you think is usefull in learning to understand the internal structure of android, and especialy the root proces? Because when one tries to google for it, you get lots and lots of crap :p

It's not that I have any hope to find a solution (in contrary), but it has no other reason then to satisfy my thirst to know how tis "operating system" does what it does, and why it is so geniously good :-)

Thanks in advance!

Erwin
[Wildfire General] beastaki23:
but how since hboot 1.01.001 is not routable, yet thousands of users can install custom roms? I thought that the only way to install one was s-off or clockworkmod or other recoveries...
[Wildfire General] kevin2516:
no.... s-off is only needed to do stuff to /system partition when your phone is booted, or to do other stuff like fastboot.

you only need to be rooted with a custom recovery to flash roms.

since the new hboot can't be rooted, you can't flash roms.
[Wildfire General] BlasBlas:
That is because all that people have the old hboot that has a weak spot once you get past it you can do everything most people install clockwork mod that makes the process userfriendly but you need to get past hboot once rooting is the same you have to write to read only but hboot can set it to writable , replace recovery etc once you have replace recovery you can flash everything because recovery has write rights but recovery is locked by hboot. You don't need to get s off but you have to find a way of fooling hboot. Soff would be great that's like disabling hboot you don't need a recovery mod to flash custom roms etc ...
[Wildfire General] n!k:
I agree with ErwinP, I and a number of ppl need to understand how the phone boots (from when you turn it on) so that we know our options.

I found this, but it is not specific to HTC; although the names are not the same, the process is probably the same.

http://www.androidenea.com/2009/06/android-boot-process-from-power-on.html

Am I right to think, looking at this picture:

That the BOOT ROM is like a bootstrap, hardcoded in the hardware and not modifiable.

The BOOT LOADER is HBOOT, writeable with the right permissions (signature), located in the NAND.

Separate to this, there is some radio software which stores some flags such as S-OFF, network lock, etc which is not reacheable by software-only means, ie it needs some extra hardware such as XTC clip, Megacard, Whitecard, HTC Service card, etc.

And then there is the kernel which loads Froyo, which is useful only if rooted.

If I understand BlasBlas right, HBOOT version does not matter as long as you have S-Off.

So would it be worth finding a phone unlocker who has XTC clip or similar and ask him just to S-Off the phone?

Then we would be able to root the phone, run any android tools, and get the information that we need from inside the fortress ?

Or am I talking entirely from my backside ? :)
[Wildfire General] beastaki23:
is there any way to unzip and repack an official ota rom and sign it In orded to be able to install it from official android recovery?

when i do so, it appears signature failure.
[Wildfire General] ramdroid77:
turning off signature verification is exactly what unrevoked is doing if I'm not mistaken ;)
[Wildfire General] beastaki23:
unfortunately i am running under hboot 1.01.001, so no that option for me :/
[Wildfire General] ramdroid77:
I know. but I think the signature checks are the only problem here, and reason why you need unrevoked. if it's so easy to just flash a fake ROM then people wouldn't really need to wait for root access to desperately :rolleyes:
[Wildfire General] beastaki23:
lol...indeed. but still, I was thinking tha since it is the official rom, it wouldn't matter (the recovery) singing it somehow myself...
[Wildfire General] cybertyk:
Ok so this leads on to some questions i now have.

when you boot in to recovery the s-on becomes s-off as your able to install to the system folder. which makes me wonder, does that mean if s-off while booted does that mean you could install a rom while the phone is booted in to a rom. if that makes sence.

im sorry for my poor english i am however a tad dislexic sorry for the bad writing.
[Wildfire General] reqmon:
Stupid question, but i need a clear answer:

Will AlphaRev enable updated phones to be rooted and S-OFFed?
[Wildfire General] kevin2516:
no, you need to be rooted to use alpharev and get s-off.
[Wildfire General] ErwinP:
Because I notice some confusion, this is how I think it works.

Normally you have an HBOOT which gets signals form the @secuflag that it has to be Security-on. This means that when you boot your ROM, you won't be able to write in the protected system folders (data, system, ...).

On a normal out-of-the-box wildfire, the only thing does have those write-permissions is recovery - it has no constraints at all, and is allowed to mount the systemfolders and change it. However, the HBOOT controlles the access to recovery, and normaly you won't be able to go in to it. Unless there is a HTC-signed update.zip on your SDcard. The sign confirms to HBOOT that it is genuine, on which HBOOT reacts by going into recovery and let recovery do its work to change your system, using the HTC-signed update.

Thing you can do from this point of view:

1. give HBOOT the signal that it must be S-off. The problem here is that @secuflag is in a very important part of your cellphone that controlls it signal (the radio) and you don't wanne mess in here.

2. gain access to recovery. That is wat unrEVOked did. they used an weakness of HBOOT that gived it temporarly S-OFF, and that allow to write there own recovery which allowed to 1. access it any time and 2. give the order to install updates that are not signed by HTC.

3. sing our self-made ROMs like HTC does, so that it looks genuin. It is however not been possible to hack the key which HTC uses to sign its updates. It seems that finding out that key is extremly difficult.

4. Change your HBOOT so that it doesn't give a **** about @secuflag and is S-OFF any time. This is what AlphaRev tries to do. It is however not easy because if something goes wrong, you wont have a bootloader anymore which means that you wont be able to start up your system nor recovery.

Voila,

Hope I'm right about that kind of things, and that it helps to clear up some things to others
[Wildfire General] beastaki23:
ok, and now for an (possible) offtopic question: what does the combination: volume up & power button do?anything helpfull from that? it just vibrates 3 times and the green led is on.and then stucks.
[Wildfire General] MarkPower:
Wait, I'm confused.

so unrevoked gets you root.

And alphaboot gets you s-off?
[Wildfire General] beastaki23:
As i know, unrevoked gets you root plus a custom recovery with s-off and other futures (back up, restore etc). alpharev supposibly will get you s-off, but i think you will need to be rooted to apply this.
[Wildfire General] 3xeno:
That's about it. Its AlphaRev BTW. ;)
[Wildfire General] MarkPower:
Oh. That makes things clear. Thanks.
[Wildfire General] n!k:
Sorry to come at it again, but would it be reasonable to think that once your phone is S-Off (through XTC clip or whatever) then you have more privileges to try to extract the signature which would validade any HBOOT?

Looking at the PS3 developments, there is bound to be a master key to sign all the HBOOTs, since updates are not proprietary to a specific phone/ IMEI nr.

1. Get S-OFF

2. Replace Froyo with a rooted one, or Eclair

3. Get Root

4. Have a proper look at HBOOT

5. Get the keys :)

Simple or simpleton :p ?
[Wildfire General] ErwinP:
It would be awsome if that should work: there is someone here who has S-off. And he offered to be of any help, so if you know what to do, you can contact him!

I think however it isn't that simple. It is mentioned that some people from the UnrEVOked dev team have S-off, but have to do it hardware-matticly (donno how you say that propperly, sorry). And it looks like the S-off doesn't get them any further.

But from my point of view (which doesn't mean much, givin the fact that i'm way to new on this) it is deffenitly worth trying!

Erwin
[Wildfire General] NickHu:
That's like trying to turn toast into bread, do you really think it's that simple?

And no, there isn't a universal HBOOT key, providers like T-Mobile and 3 make their own OTA updates, and they send them to HTC to get them signed.
[Wildfire General] n!k:
Well I don't know this is why I am asking. Do you see anything wrong behind my reasonning? If so, let me know and I will try to come with something better.

There I disagree. If they send their OTA updates to HTC for signature, then there is only one way to sign them, which HTC knows.

If I can download a rom from shipped-roms and install it on my T-Mobile to debrand it, then the key which signed this rom is accepted my my phone which recognises it: there is only one signing key.

I am not sure whether HBOOTs are linked to providers. Mine is 1.01.001, like many others here.

I am happy to find somewhere with an XTC clip around here to get my phone S-Off if it helps, but I would not know which tools to use for 4. and 5.
[Wildfire General] NickHu:
*facepalm*

The updates on shipped-roms are provided by HTC...
[Wildfire General] n!k:
You fail to get my point here.

I know that all the updates are provided and signed by HTC.

The only way so far to install a non-HTC update is to root the phone and replace recovery with one which does not check the signature.

What I am hinting at, is that ANY official HTC update will work on my phone (probably with the use of a goldcard to CID it OFF), which means that I think that there is ONE SIGNING KEY only for all the HBOOTS out there, and that this key is not specific to a particular phone serial nr or IMEI.

Like for the PS3, get the key, and you can sign any HBOOT for any Wildfire.

If there is no hope to root the latest HBOOT, then get an old 0.80, rename it 1.50, sign it with the HTC key, et voilà.

The only problem is to get the key, so once again my question is, are there any tools out there that in cunjuction with S-OFF would give you root on HBOOT 1.01.001 so that we get a chance to find this key, or is it a no-no ?
[Wildfire General] beastaki23:
I thought it too, but I believe that it would be much easier if you "tricked" your phone as rooted that your actuall hboot version is not 1.01.0001 but it is 0.01.0001, so it will update to 0.80.0007 when you install the eclair version. it is the same idea which worked well for downgrading the froyo to eclair (see the post "a noobs guide to downgrade...") . So does anybody knows where is hboot stored in our device? He would be most helpfull
[Wildfire General] HCDR.Jacob:
If we could write to bootloader like that, we wouldn't have this issue. Just sayin'
[Wildfire General] m32:
Post here Your results of command (from shell):

cat /sys/class/mmc_host/mmc1/mmc1:*/cid

this will dump Your CID.

Thanks
[Wildfire General] m32:
SPL = HBOOT = secondary program loader

IPL = AMMS BOOT = initial program loader which loads SPL and protects NAND, it is executed in ARM9 processor

for more detailed description see http://tjworld.net/wiki/Android/HTC/Vision/HbootAnalysis
[Wildfire General] m32:
in ROM @ 8f00000 after initial code it copies itself to 9c00000

RSA key exists in two parts - public which is stored in HBOOT and private which is used by HTC/GOOGLE (Nexus) to sign HBOOT.

Finding public key is rather out of our resources - RSA challenge :(

in android sources legacy bootloader is stored in bootable/bootloader/legacy

include/boot/boot.h:#define SIGNATURE_SIZE 256

libc/crypto.c: return RSA_verify(pubkey, signature, SIGNATURE_SIZE, digest);
[Wildfire General] NickHu:
OH!! That makes much more sense. But there's no way we're ever going to get that key. I'm assuming it uses RSA1024 (There's no good reason not to), so the signature would take about... 1,500 MILLION years of CPU time for a modern computer to crack? If you've got that time, be my guest ;) Of course, I've heard that signature collision is possible, but also incredibly difficult. The best way is just to wait for an exploit; nothing's perfect.
[Wildfire General] cybertyk:
Can't. There be a custiom bootloader?
[Wildfire General] beastaki23:
for a custom bootloader, you should trick your phone to install it. and this means to sign it like htc...so if you get there, its easier just to install 0.80.0001 as a 1.50.0001.
[Wildfire General] ionut.micu:
I own a desire z, which I have upgraded, and become un-rootable (just like a wildfire), but on the desire z section we have a thread that helps us to downgrade and get S-OFF.

I was wandering if the method used to downgrade desire z could be adapted and used to downgrade wildfire, and of course obtain S-OFF.
[Wildfire General] antonio1475:
Thanks for the help. I will wait for some expert say this can work in Wildfire, because apart of the different RUU, the files used may be Desire Z specific, right?

:)
[Wildfire General] m32:
wildfire threads about s-off are pointing to thread mentioned by U, in simplicity:

fastboot boot hackspl.img

hackspl.spl.img modifies important pointers - and viola, after few clicks U have s-off and cid=supercid - but which one htc ? htc-hero http://xdaforums.com/showthread.php?t=559806

on wildfire ? is much more complicated, as on never devices - like desire - or I did not find proper places to apply simple pokes - just without dual serial/usb cable analyse makes it more complicated, can't what i'm doing wrong - just because messages are send sometimes per usb and sometimes per serial (debug)

:) first step is ROM:g_cKeyCardSecurityLevel - must be eual to 1, when U want set cid to any other value than obtained from mfg or mfg2 or proprly signed code

after relocating HBOOT this value is stored at :9C06E048

tia
[Wildfire General] MartinEve:
Afraid it's the latter; public key cryptography doesn't work like this, the keys are not embedded in the final binary, but rather a signature from which it can be shown that the specific piece of code was signed with a specific key. The only part of they key that can be seen is the public component, which can be used to verify the signing, but not to sign. To reverse the key is not computationally feasible if the developers have deployed proper security procedures (PS3 did not).
[Wildfire General] ionut.micu:
I decided to try this method on my girlfriend wildfire.

After pushing the files in the phone I tried to open psneuter with adb shell

The first error was:

ionutm@ionutm-Inspiron ~ $ adb shell /data/local/tmp/psneuter
property service neutered.
killing adbd. (should restart in a second or two)

and the second:

ionutm@ionutm-Inspiron ~ $ adb shell /data/local/tmp/psneuter
mmap() failed. Operation not permitted

Despite this errors when I entered in adb shell I had temporary root (#) :)

But whan I trieb to change the "misc_version" version to 1.24.405.1 this happened:

# /data/local/tmp/misc_version -s 1.24.405.1
--set_version set. VERSION will be changed to: 1.24.405.1
Patching and backing up partition 17...
Error opening input file.

I know that this files are for G2/Desire Z, but maybe somebody with more knowledge can modify this files and make them work for wildfire.

I used this method to downgrade my Desire Z (including HBOOT)
[Wildfire General] n!k:
Thank you for your input Martin. I am aware of that.

I was just hoping that perhaps they had made a mistake implementing the cryptography (hell, why not? SONY did it :p) that would make finding the signing key easier.

The only way to find it out would be to decompile HBOOT, no ? Admitedly, it is easier to flash any HBOOT with S-OFF but i could not find anywhere where this was mentioned to be possible (ie HBOOT downgrade)
[Wildfire General] sethxp:
Downgrade HBOOT when phone is S-OFF is possible, tested myself with buzz1root package.
[Wildfire General] xtam:
so can someone correct me if i am wrong (because i didnt read everything in this topic)

if having S-OFF we can downgrade HBOOT=

all we need is S-OFF ?

BTW ...do you think guys from alpharev or unrevoked are tracking thoughts in this thread ?
[Wildfire General] n!k:
So I guess we are getting somewhere here.

Even though its all talk no action, we came to the conclusion that

1. You can downgrade 2.2 to 2.1, even though HBOOT is not downgraded in the process

2. You can downgrade HBOOT once your phone is S-OFF

3. At present, to S-OFF your phone, you either need to jtag it or get an XTC clip which does it for you, emulating something called a white card or mega card or HTC Factory Card, which looks like SIM card inserted in the SIM slot.

Looking at nr3, it looks like it is going to be difficult to do this with software only, as it seems that in order to access the special mode to "clear the S58 security", some device/emulator needs to be present in the SIM slot.

http://www.youtube.com/watch?v=nLFqGKzrtyg
[Wildfire General] sethxp:
Correct, you run diagnostic file from sd card and select clean flags, when clean flags is executed phones wait for command and authorization from smard card, if theire received security is off, if not properly received you end with error.
[Wildfire General] n!k:
Can we assume that the phone is using something like AT commands to talk to the SIM card, like those documented below?

http://www.tjworld.net/wiki/Android/HTC/Vision/RadioATCommands

If XTC clip manages to emulate a whitecard, it can't be that complicated :p

but there is surely some sort of hardware needed (a SIM ribbon connector to start with for sure). Perhaps a bit of an old USB cable and some soldering :D
[Wildfire General] xtam:
or similar to this:
[Wildfire General] ramdroid77:
if this XTC clip is guaranteed to work on future phones as well it might be a worthy investigation. otherwise it's really too expensive :rolleyes:
[Wildfire General] sethxp:
its sold as is, no warranty for future models, warranty cover only mechanical/electronical defects from manufacture.
[Wildfire General] xtam:
especially knowing that unrevoked can in near future do it programatically.

or not.
[Wildfire General] chrisund123:
Wish I had your confidence in unrevoked :lol:
[Wildfire General] m32:
perhaps U can send output of shell commands:

fastboot oem boot

and

cat `find /sys/devices -name cid -print`

why ?

he has device cid unlocked so there is no need to find proper sha256 of this part of data, unlocking other parts is a piece of cake

if he would not provide this data - then I must deply decompile and understand other parts of hboot - that is what i wont do
[Wildfire General] sethxp:
Ok i will try it tomorrow.

Edit:

$ cat `find /sys/devices -name cid -print`

cat `find /sys/devices -name cid -print`

find: permission denied

cat /sys/class/mmc_host/mmc1/mmc1:*/cid

1b534d30303030301000e6b38400a54a

... INFOsetup_tag addr=0xBC900100 cmdline add=0x9C0734CC

INFOTAG:Ramdisk OK

INFOTAG:smi ok, size = 0

INFOTAG:hwid 0x1

INFOTAG:skuid 0x24903

INFOTAG:hero panel = 0x0

INFOTAG:engineerid = 0x0

INFOMCP dual-die

INFOMCP dual-die

INFOTAG:mono-die = 0x0

INFODevice CID is super CID

INFOCID is super CID

INFOBackup CID is empty

INFOsetting->cid::11111111

INFOserial number: *edited*

INFOcommandline from head: no_console_suspend=1 console=null

INFOcommand line length =483

INFOactive commandline: board_buzz.disable_uart3=0 board_buzz.us

INFOb_h2w_sw=0 board_buzz.disable_sdcard=0 diag.enabled=0 board_

INFObuzz.debug_uart=0 smisize=0 userdata_sel=0 androidboot.emmc=

INFOfalse androidboot.baseband=3.35.20.10 androidboot.cid=11111

INFO111 androidboot.batt_poweron=good_battery androidboot.carrie

INFOr=ALL androidboot.mid=PC49***** androidboot.keycaps=qwerty a

INFOndroidboot.mode=normal androidboot.serialno=*edited* and

INFOroidboot.bootloader=1.01.0001 zygote_oneshot=off no_console_

INFOsuspend=1 console=null

INFOaARM_Partion[0].name=misc

INFOaARM_Partion[1].name=recovery

INFOaARM_Partion[2].name=boot

INFOaARM_Partion[3].name=system

INFOaARM_Partion[4].name=cache

INFOaARM_Partion[5].name=userdata

INFOpartition number=6

INFOValid partition num=6

FAILED (status read failed (Too many links))
[Wildfire General] xtam:
so having this values what you can do with that ? m32 ?
[Wildfire General] Sgt-Hartley:
First of all I'm new here so hello. I have 2 wildfires both using the current HTC stock 2.2.1 Rom and the current hboot, one I had unlocked at my local phone shop and the other is locked to three UK, the unlocked one is s-off and the locked one is s-on just wondered if I could be off any help with the s-off handset. Though my laptop is not due back until Wednesday 16th Jan.
[Wildfire General] BarclayTech:
BUMP ^_^ lolololololol
[XPERIA X10 Q&A, Help & Troubleshooting] TheHurf:
Hi guys,

Quick question re the new xRecovery for X10 HD phones?

When you hold down the power button on the FeeX10 beta3 ROM you get the option to reboot and then the option to reboot or go into recovery; has anybody tested to see if this fix launches the recovery mode i.e. you go into the xRecovery console on reboot without having to press anything?

I ask as I'm using an X10i (or HD, whichever) and I can't access xRecovery now I'm running FreeX10's ROM, so in light of the new hotfix I'd like to know if this works before taking the time to reflash my phone and start from scratch with 2.2

Many thanks in advance, and kudos as always to the fab work by the developers.
[XPERIA X10 Q&A, Help & Troubleshooting] Buddha:
you must use the oldfashion way.. tapping the back button several times.