yashsingh1/xdaforums huggingface dataset:
[HTC Incredible S] knightrocker:
Hey guys. I was thinking , where exactly is the radio installed? Does it have a seperate partition or is it in the root with the rest of the stuff. I kno there is a folder /etc/firmware. Is that it ?

If it is, is it nand locked? If not why dont we just edit the radio directly to remove the nand lock using adb or something?
[HTC Incredible S] mikelodean7:
sorry for my nooby question, but my IS wich is s-on (unfortunately) cant be perm rooted until the bootloader is open(or something like that. but i AM able to go to the recovery. so am i able to flash my IS permanently? so, if i am able to go to the recovery, i just have to flash the radio, kernel and rom so thats how its works... (roughly)

but while the bootloader and recovery is signed we cant take it that easy .. is my recovery still "locked" even if i can go to that "recovery menu" they are these commun phrases "reboot; flash update.zip; wipe; something else"
[HTC Incredible S] timbo007up:
If it was that simple.... We would be done on day one. As far as I know the firmware is flashed on the radio chip, so not directly accessible. If you want to look into the firmware extract it from Rom.zip.

I appreciate the thinking, but it is locked up pretty good, so no easy way to get trough. We have tried loads of things, so don't point the obvious methods. This is security is way above your thinking, and also above mine. We have to wait until the real pro's come up with something.

All currently known methods are overlooked, tested and all fail in exploiting.

No offense but I'm getting tired of people not reading or doing at least some research before posting. I must say: I started with this process only a month ago and scotty2 has given me a lot of info. I am willing to share but when people don't even read one or 2 pages back I'm also getting in the mood to not giving info at all. * yesterday another topic started with exactly the question/statement what has already been overlooked in here... Just take little time to read and don't think your the first who found something. When you know it has not been mentioned before talk in the appropriate topic if you have something that adds something. Otherwise just stay put. Im not saying that you cannot post anything but... Oh well why do I keep trying... ****** mode off*
[HTC Incredible S] knightrocker:
U kno what. Ur good at explaining, not at all confusing, or maybe thats just me :D

Now i have more questions of u dont mind. In the quoted text u said secu_flag=1. Where did u find this? Can u name the particular file? Im pretty sure its in some file without an extension.

Also, u said u are trying to exploit the radio, which most probably means u have a rom with just the radio and nothing else, if u do, pleasebcould you post it for me. I would like to do a file comparison with some of the folders in the root.
[HTC Incredible S] knightrocker:
Ok. Sorry bro. I didn mean to bug any of u, i will stop now.

Its just that, well, i have been around amazing devs a long tme now. And the thing is people who kno a lot tend to overlook small details. So i thought i could help with that.

Im so sorry. No more ideas from my side. I will wait and hope like i always do. I guess im never really a help anywhere. Damn i wish i was still a diamond dev.

EDIT: Timbo. Were u talking to me or that mike guy? Even if it wasnt me, i guess u want me to stop anyway right? Im am pretty much useless especially wen i wannna help :'(
[HTC Incredible S] androf:
Idk whom he was talking to but I find your questions and his answer very informative

I would love for this discussion to continue
[HTC Incredible S] jettyjane:
i can understand devs annoy with people who dont read and just post..

this thread here is for devs to update infos.. please dont turn this into a spam thread.. so please.. i plead u.. yes you!!

to make it better for both devs and people like me who dont know a single thing..

i have open up a new thread http://xdaforums.com/showthread.php?p=12644041 for you guys to post QUESTIONS & DISCUSS there..

and i also hope devs will look at that thread as well.. to answer those question havent been overlook.. thanks!

cheers!
[HTC Incredible S] lucas.g:
Where is the "like" button? I am tired just reading. ;)
[HTC Incredible S] timbo007up:
Nah, wasnt against u, i'm just a little tired and fed up from this. Was more a general input before it started again (since its been a few pages already :P)

As i can see the other people like to see your questions and the explanations. And ofc we always overlook some kind of basics and its also good for me (and a lot of others) to go back 2 basic. So please dont stop :) the more you (and everybody) learn now, the less u need to know on your next phone. So please dont stop spitting out those ideas :P

*was in the bus after a frustrating day, im not always fair than :P*

But to answer your question about the secu_flag : its not in a file, think its inside the radio firmware, but not totally sure. Currently i only know that its set somewhere trough the radio, but the exact location i'm not aware of. At least its something that cannot be accessed/set easily trough kernel/android.

Furthermore currently looking up a way to use kexec (same method as the X10) to root. But its still in its early stages. Were not even getting it to boot yet. Hopefully this will come soon, but its something totally new for the HTC devices, so it will take time to develop.

Hope everybody is happy again :) im not disliking the input in here (completely the opposite!) but its more about that people start other topics about whats already been discussed in here. Bah just bad day, sorry guys (and maybe girls?) :P

*edit:

its called the thanks button :P thumbs up!
[HTC Incredible S] timbo007up:
*edit2: jenny great idea! will keep track of that one *bookmarked*

edit: fail quote/edit :P
[HTC Incredible S] cursordroid:
Thinking of getting an Incredible S when they are available at Best Buy.

I always get the idiot-proof warranty from them, so I can make some mistakes...

What would happen if I ran a gold card install of a non-signed RUU like this one:

PG32IMG_Vivo_W_CT_HTCCN_CHS_CT_1.30.1401.3_Radio_Radio_CT_0_99_50_0323_2_NV_NV_MFG_eMMC_CT_1.98_test_180717

from: http://xdaforums.com/showthread.php?t=1008447

This RUU doesn't have a signed bootloader or radio, so technically shouldn't it be vulnerable to standard exploits?
[HTC Incredible S] Hawkysoft:
@cursordroid, as timbo said... we tried everything thats known so far.... so fill in the answer

and we got 1 option so far left, and someone is workin on that

and else we gotta think of a new way

now please leave this thread clean
[HTC Incredible S] smokestack76:
I deleted what i can right now. Stop posting links for other forums. And stop flaming.

All of you should know better than what that other site wants you to do. Stay on topic.
[HTC Incredible S] vido.ardes:
Thanks for cleaning up the thread smokestack.

First of all, we don't want to come across as douchebags. Asking questions is how we all learn, and I have no problem answering. The thing is we want to keep this thread clean for devs to discuss the problems and potential solutions, so can we please keep this strictly for technical discussion. It gets difficult when the thread is clogged up with questions that are fairly basic in nature, and don't really further the progress.

That being said I want people to ask and to learn. There is a Q&A thread over here where I have posted a FAQ (in this post) to answer most of the questions that keep getting asked, but if you have any more questions feel free to post them, just please do it in that thread not this one. Remember, the search is your freind, and people will always be happier to answer you questions if you can show you have done some research yourself.

I have also updated the first post on where we are with the rooting / unlocking process, so anyone one who thinks they can help can get up to speed there.
[HTC Incredible S] Hawkysoft:
Update: Does not work

stopping all services from the phone except adb, and run wpthis exploit
[HTC Incredible S] knightrocker:
Ahh ... Goapk beat you guys to root :P you guys can take a break ...

Now you must find a way to s-off ... I kno this is the dev thread ... But i think this is important enough to post here :)
[HTC Incredible S] cursordroid:
Anyone can root a phone with S-OFF, that's not the point here. They have phones with S-OFF for some reason, which we do not.

Comments like this don't help development.
[HTC Incredible S] knightrocker:
:P Sorry :'(
[HTC Incredible S] cursordroid:
Didn't meant to flame you about this... No harm intended.
[HTC Incredible S] knightrocker:
Its k :) does any1 kn owhere the question thread went ?

Btw .. is s-on the same as nand lock ?
[HTC Incredible S] vido.ardes:
Gaining root once your S-OFF is pretty simple, I am surprised it took so long. Gettin S-OFF is hard. Very hard.

S-ON means the NAND is locked, the Q&A thread is stickied
[HTC Incredible S] knightrocker:
Thank you ... Stickied huh ... So thats why idon see it ... Thank you again ... It is my favourite thread :)
[HTC Incredible S] bonethankz:
how can we know is our device is s-on or s-off?

sorry for my stupid question, im new to this
[HTC Incredible S] madmaxx82:
Please post those question in the stickied Questions and Discussions thread:

http://xdaforums.com/showthread.php?t=1021989
[HTC Incredible S] tzm41:
That phone is said to be s-offed by XTC clip, a kind of gold card generator. Only a couple hundreds of RMB.
[HTC Incredible S] nikhil007mmus:
I heard searc's bootloader is also signed but se are themselves going 2 unlock the bootloader in some months .. can HTC do that with the 2.3 update ??? And Motorola defy has also got a signed bootloader still its gt custom roms ?? Neone tried that method to root ?? Wt Abt zroot or soc is it implemented it ..
[HTC Incredible S] timbo007up:
First of all this should go in the questions topic.

Second:

This is a different phone from a different manufacturer, Its not that easy to port from one kind of bootloader to another. We are trying though and are trying every possible method. But even porting takes time.

And OFC HTC can unlock the bootloader, but they probably wont do that. We are going to get there the hard way...

And zroot is a method that doesnt work, tried that ages ago ;)

What u mean by soc, dont know that what is used there, and cannot find it on google easyliy, can u provide a link?
[HTC Incredible S] vido.ardes:
If by SOC you mean SuperOneClick, yes we have tried every known method, please read the first post and FAQ for an explanation of what we have tried so far
[HTC Incredible S] Brucew0617:
We are looking at your hard work, and look forward to your big result:D
[HTC Incredible S] tsuishui:
i am happy with my incredible s rooted (HK Chinese version, S-OFF), just use the one click method from goapk.com (a Chinese forum).
[HTC Incredible S] itandy:
Just curious. How can you get a S-OFF IS in HK? I live in HK too but my IS is S-ON. I have mine from Smartone.
[HTC Incredible S] jeweettoch:
Please people, there are plenty of other topics to discuss the S-OFF root access (i.e. http://xdaforums.com/showthread.php?t=1026011).. try using this topic only for S-ON..
[HTC Incredible S] lyfkevin:
yea, im wondering how did u get s-off too:eek:

i bought it from wilson, those are s-on :(
[HTC Incredible S] knightrocker:
Dude ... Please understand ... This isnt the place to talk of this ... This is a dev thread ...
[HTC Incredible S] tsuishui:
sorry, my phone is from htc hk... not retail version
[HTC Incredible S] bl4ckluna:
can you give me your email .i get the xtc-clip files in shenzhen guangdong china i want to send it to you .and can i join the root is team?
[HTC Incredible S] jkoljo:
How do you think that you will get around eMMC write protection with a custom kernel? Are you trying to load a kernel which supports more GPIOs or what's the current approach?

It seems that HTC implemented the same kind of security features on this phone that they did on new Desire HDs. Even Rage does not work.
[HTC Incredible S] vido.ardes:
Getting round the eMMC write protection is proving a bit of a ***** at the moment, bin4ry is toiling away hard at it now, although he belives the wpthis exploit may still be of use so he has gone back to that now. The psnueter gives us temp root still.
[HTC Incredible S] jkoljo:
Alright, as I suspected, they are using same approach as on new Desire HD phones.

eMMC is locked, the eMMC power GPIO seems blocked, RATC is blocked but psneuter works. Did you know that the reset-eMMC approach (wpthis) was ultimately blocked by the radio? The kernel has something to do it, but actually it is the radio that you are fighting against. Just to give you a heads up :)

Why am I so sure about it? Because when someone is using old Desire HD ROM which normally allows wpthis to work + old radio, the whole radio S-OFF process works. Then when he or she flashes a new radio with additional security measures in fastboot, wpthis cannot unlock the eMMC anymore. S-OFF unlocks the most part of eMMC (rw state), but it leaves partitions such as radio config still ro, so we have to use wpthis to get Radio S-OFF even when we have ENG S-OFF.
[HTC Incredible S] vido.ardes:
Yeah, but seeing as though it was the HBoot that tells the radio whether it's S-ON or S-OFF, the idea with the kernel was to allow us to get a eng HBoot in there to do the dirty work for us. Or so the theory goes anyway :P Thanks for the heads up anyway, any insight we can get will help.
[HTC Incredible S] jkoljo:
Check my edit..

It is not hboot that tells the device whether it is S-OFF, actually the radio does. Hboot launches -> hboot asks radio whether we are S-OFF or S-ON -> radio reads @secuflag -> radio answers -> hboot sets security state accordingly.

That process cannot be intercepted as far as I know. Either hboot or @secuflag has to be modified, but you already knew that.. :)
[HTC Incredible S] vido.ardes:
I may be wrong, but I thought it was the HBoot that sets the flag on the radio? I know it is in the radio, but I thought the HBoot still controlled it?
[HTC Incredible S] jkoljo:
The flag is stored in radio configuration partition, and it is the radio that reads it. Hboot is the one which sets the phone's security state, but it first has to ask "what does the flag say" from radio.

Do you have IRC channel set up? Maybe we can discuss more :)
[HTC Incredible S] vegetaleb:
Hey guys, can someone give us a hand to build a recovery image on SE Arc?

Bootloader is unlocked now
[HTC Incredible S] Hawkysoft:
erhm dude we are busy enough... sorry...
[HTC Incredible S] raskal:
i am buisy, too :D
[HTC Incredible S] telectroguy:
came across this link for gold card generation not sure if this might me of any help for S-ON phones...fyi im a newbie..

theunlockr.com/2010/03/10/how-to-create-a-goldcard/
[HTC Incredible S] knightrocker:
Did u try it out? It might work ...
[HTC Incredible S] Hawkysoft:
the goldcard is only good for flashin original roms so far...

u cant s-off with it...
[HTC Incredible S] vido.ardes:
First off, apologies for going a little quiet, we have still been working on it I promise!

Bad news is, it will probably stay quiet for a little while. I know bin4ry is very busy in his personal life at the moment (and is still developing for the X10), timbo has some very important work to do for his college course and I have some strict work deadlines to meet in April, and we have a lot of public holidays coming up in the UK so I want to spend as much time as I can with my fiancée (I think I have been ignoring her a little for the past few weeks :o).

We are almost at the point where we have exhausted all current avenues of investigation, and it feels like we are no closer to reaching the goal. I personally have been looking at this for several hours every single day for the past 6 weeks, and am going a bit code blind, so I for one will be stepping back for a while. I will probably doing some quite ROM development, so will hopefully return with a nice surprise for those of you lucky enough to be S-OFF, but you probably won't see much from me on the rooting front for at least a week or two.

Maybe someone else will step into the breach with fresh ideas, but for now I am spent.Good luck to anyone who tries picking it up in the mean time, you never know bin4ry might publish a solution tomorrow :D

If you are interested in just having root access (no customisation of systems files) for apps like Titanium Backup and Root Explorer, jrywu has written a great guide for you to be able to do just that over in this thread.
[HTC Incredible S] walda:
Am i right that with TempRoot the restored Data from TitaniumBackup are not overwritten after a Reboot. Only System-Files, right?

So for daily use it would be enough? Ok, no CustomRoms, no Nandroid, but Backups.
[HTC Incredible S] knightrocker:
Great. This just keeps getting better and better :P

Looks like bin4ry is our last hope. Has any1 tried contacting unrevoked? Are they working on it?
[HTC Incredible S] vido.ardes:
The backups are stored on the SDcard, so they will only be wiped when you physically delete them. If you just want root, this will work with 90% of root apps.

If they are, they don't seem to want to talk about it. I don't want sound rude, they have done great things for the android community but they seem very cliquey, they don't seem to want to discuss anything with anyone outside their team.
[HTC Incredible S] walda:
No, i meant... when making a backup of a TempRooted IS and want to restore things back from SD Card. They are kept then after Reboot in Data-Partition?
[HTC Incredible S] vido.ardes:
Sorry, I see what you mean. It's hard to say, but I am pretty certain they wouldn't now I think about it
[HTC Incredible S] walda:
So the backup would be useless ;)

Or you keep it till its Permrooted :D
[HTC Incredible S] vido.ardes:
Try it, you never know it might work
[HTC Incredible S] CamoGeko:
Why does HTC tighten the security on the new handsets? Do they really not realize we are pushing the android community forward and increasing their worldwide sales at the same time.

Or they just like to keep devs working hard lol
[HTC Incredible S] Brucew0617:
Keep going! I'm looking forward to your achievement!:D
[HTC Incredible S] doublecheese:
Ok, to root the Inc S , as far as I understand the only possible solution right now is to use the XTC Clip to get S-OFF and then Root the device like which I did.

Yesterday I finally rooted my Inc S and it seems to be working pretty well with applications that need Root Permissions... All I need now is custom roms or a WWE European Rom, because my ROM is ASIAN WWE

If anybody interested in S-OFF`ing his Inc S, just PM if you`re in Istanbul area (for free ofcourse)
[HTC Incredible S] yoworld:
can't wait for it
[HTC Incredible S] qvert:
its because they want to protect the brand

nothing else
[HTC Incredible S] walda:
I think for a RUU+Goldcard no S-OFF etc is needed. Am i wrong?
[HTC Incredible S] raitchison:
There is much speculation there, I think it's a combination of reasons:

1. If you can load custom ROMs it allows you to get more usable life out of your device. The handset makers and carriers want you to buy a new phone every year just like the iDevice users do.

2. Since most of the phones (regardless of who makes them) are burdened by some sort of custom UI and nearly all of them are packed with bloatware, they want to make it difficult to get rid of the useless (at best) BS.

3. Carriers don't like rooted phones because it allows people to do things like tether without paying.

4. People do break their phones and get them replaced under warranty, how much of an impact this is is debatable, the manufacturers have to know that with a proper supported method of rooting (i.e. "fastboot oem unlock") they all but eliminate any chance of breaking a phone during rooting.
[HTC Incredible S] CamoGeko:
Hands up everyone who thinks this handset is better than a Desire HD...

+1
[HTC Incredible S] walda:
Wait for the Sensation ;)
[HTC Incredible S] vido.ardes:
Please don't turn this into a DHD vs IS vs Sensation thread, there are plenty of threads like that in the General Section
[HTC Incredible S] qvert:
so in fact all new devices will have the same security

the Desire S

the Wildfire S

the Sensation

so it doesnt help to wait
[HTC Incredible S] CamoGeko:
Nah, I wanted a more manageable and crisper screen. Thats why I got an IS.

Swyped with the Incredible S and XDA app.
[HTC Incredible S] venezia64:
Guys, what about this new exploit found in the volume manager of Gingerbread 2.3.3. The author says it might also work on Froyo (if not, then we can just use the gb OTA release a couple days ago)

http://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html
[HTC Incredible S] qvert:
let's hope :-)
[HTC Incredible S] venezia64:
I just tried both version that Stealth posted on twitter without any luck.

His answer:

I'm not good enough to modify the source code for our device so I leave this honor to the others ;)

Update: from Stealth

Sorry for raising hopes for nothing :s
[HTC Incredible S] risq:
Even if its a temp root - does that not open the door to downgrade it, a bit like the Desire HD situation? I presume, all be it the hardware identical that it isn't possible to just put desire HD firmware on the incredible S?

I want this phone, but until I see it rooted and a few ROMs, Cynogen mainly, I'll hold off.
[HTC Incredible S] timbo007up:
DHD firmware will not work! Tried already, but indeed, it gives us the possibility to downgrade for sure!
[HTC Incredible S] manutd_ken:
how to s-off and root~:confused:
[HTC Incredible S] Hawkysoft:
@manutd_ken
[HTC Incredible S] touchpro247:
This is what happens when you try and temproot GB with psneuter.
[HTC Incredible S] jkolner:
Perhaps we can get root with the GingerBreak when the Inc S gets the official OTA upgrade to Gingerbread...
[HTC Incredible S] touchpro247:
As far as I know. GingerBreak only temproots the IS on GB.
[HTC Incredible S] knightrocker:
Has any1 with gingerbread tried downgrading with timbo's method after the update ... Does psneuter work after that?
[HTC Incredible S] timbo007up:
As long as you can acquire temp-root, you can downgrade with that method. Only the beginning is a little different, when somebody with an S-ON GB can confirm this works, I will update the howto.

I know this works since it was also possible with the DHD.
[HTC Incredible S] telectroguy:
**Bloat Freezer working on Temp root**

sorry for reposting it..just want everyone to know.Good news!!guys , i just found that bloat freezer dose work on my IS (S-ON)with temp-root (be sue to check compatibility mode in settings) . and to add to it the apps are not comming back after restarting the phone . its like i temp rooted the phone and installed bloat freezer , enabled compatibility mode , frooze plurk ,amazon mp3 . and restarted the phone . after restarting the apps dosent show up in the launcher , which means the apps are still froozen . however to unfreeze them i still need to temp root my phone and go into bloat freezer and unfreeze them , which is all what i need at the moment , i can save batteery life , can somebody else please..confirm this too..)
[HTC Incredible S] Araf:
can you please share the detail steps?

thanks
[HTC Incredible S] touchpro247:
I can confirm it works, but after the downgrade my IS would not boot pass the HTC splash screen. I had to re-install a Gingerbread rom.
[HTC Incredible S] chisum14:
NOW, can't root IS ?

How long can roOt IS?
[HTC Incredible S] timbo007up:
Hmm that's weird... It flashes but don't start... Have u tried a factory reset? before and/or after the update? But to be honest this is getting off topic, so please pm me about this, will update the guide as soon this is figured out.

Anyhow I wonder who is the first to bypass the security! We will see :) as I hear from binary he is making progress the most, but perhaps there are more we don't know about. Hmmm.... Gl all anyhow!