S-Off ~ What are the requirements to figure it out? - HTC One X+

Nothing changed since this thread opened, got a new question just jump to page 2
I am well aware that till now unless you have a developer phone with CID 11111111 you can't gain SuperCID which will make you able to S-Off your device (For those who are not aware what is S-Off , Its making the security on your bootloader "off" hence enabling you to flash your roms without the need to fastboot flash your boot.img)
But on a developer side, what do the devs need for the "Great Dream" of S-Off to be achieved for all of us?
Files, source codes , exploits. What exactly?
I am aware that this topic has seen the light of day more than once, but every time this topic is opened, no more than a week later its "dead". Why is it THAT impossible to figure out?
I am vaguely aware that it has something to do with the "Tegra 3" chip, but why? If it has something to do with the "Source Code" is there a class talking about security that the devs just removes from the equation then flashes it instead?
I am quite interested in this topic and I tried to look around, but I don't really know the process of what is actually going on under the hood. So Any general help/discussion is welcomed (and encouraged) . If anyone with any "IDEA" about how its done wanna join in (even if he isn't quite sure) or if a DEV from another device did it and can help please do. It's basically a GENERAL discusison that might help brainstorm some ideas .
As always, links to other threads explaining the whole process is welcomed, but just please don't reply with "IDK" because that's basically considered spam
I Also found this out : HTCDev.com uploaded a couple of source codes about their kernel : http://www.htcdev.com/devcenter/downloads which includes the HOX+ if that will be of any help.
Final words: I know that this thread won't probably magically just solve it, But it's just mostly for me and other users to learn
Edit: Since its not really a Q&A Section and more of a general discussion in my opinion so I posted it in general because I want all devs to just talk, since its not really an "Answer the question" thread. MODs you can move the thread if you find it in the wrong section, thank you.
~Ghandour

---

SuperCID is not a prerequisite to S-Off. Infact it's the other way round, you need to remove the security flag (S-Off) before you have the nessesary permission to modify your Carrier-ID. .
There are ways for end users to attain S-Off but it's either very pricey (Buying a SETool box/Card/Credits and using LGTool to S-Off) or very risky (Sending your phone to someone who already has the equipment to S-Off your phone and hope they dont steel it) lol
Sent from my HTC One X+ using Tapatalk

---

AndroHero said:
SuperCID is not a prerequisite to S-Off. Infact it's the other way round, you need to remove the security flag (S-Off) before you have the nessesary permission to modify your Carrier-ID. .
There are ways for end users to attain S-Off but it's either very pricey (Buying a SETool box/Card/Credits and using LGTool to S-Off) or very risky (Sending your phone to someone who already has the equipment to S-Off your phone and hope they dont steel it) lol
Sent from my HTC One X+ using Tapatalk
Click to expand...
Click to collapse
OH I forgot to mention, I am well aware that you can S-Off your device using expensive equipment (javacard) and so forth and so on, but this thread was meant for pure normal S-Off the old fashioned way, which you can do without any fancy equipment. Because I am sure that the other phones that can be "S-Off"ed don't really require you to buy all those tools. ^^

---

They can but it's alot harder for us because of our Tegra SOC's.
I've always wondered why we dont start a donation thread, we could raise the money for the equipment and give it to a trusted member to buy (Someone like lloir but with more time) Then the members who donated could send their phone to this trusted member and get it S-Off'd...
Sent from my HTC One X+ using Tapatalk

---

AndroHero said:
They can but it's alot harder for us because of our Tegra SOC's.
I've always wondered why we dont start a donation thread, we could raise the money for the equipment and give it to a trusted member to buy (Someone like lloir but with more time) Then the members who donated could send their phone to this trusted member and get it S-Off'd...
Sent from my HTC One X+ using Tapatalk
Click to expand...
Click to collapse
Well there is a thread about sending your phone to the US to an XDA Member with a java card somewhere around but that's not the point at all....
The thread was meant to understand why is it hard? Why can't it be achieved? What is the issue exactly? (From a developer's point of view)

---

I found this thread : http://forum.xda-developers.com/showthread.php?t=2057105
EDIT: This thread is helpful however the thread remains unsolved. What exploits do the dev try to find when trying to figure out a way to S-Off the device? Leaked DIAG zips ?
Because I am aware that the "S-ON" Policy is mostly only done by HTC. So How are other phones exploited? For example, the HTC One has a fully functional FULL S-OFF : http://forum.xda-developers.com/showthread.php?t=2473644
So Does this App contains the "Diag" zip found in the app or what? Any dev explanation would be helpful.

---

Attaining SuperCID
I attempted attaining SuperCID by combining this method with this information about the HOX+. It does not appear to have changed anything, so it looks like that part of the memory can't be modified, which probably rules out any method similar to that.

---

WindyCityRockr said:
I attempted attaining SuperCID by combining this method with this information about the HOX+. It does not appear to have changed anything, so it looks like that part of the memory can't be modified, which probably rules out any method similar to that.
Click to expand...
Click to collapse
Alright, So the issue we are talking about here is that the memory doesn't become saved. So the exploit basically will make it become saved.
So can't we talk about repeating the process over and over and over again till it actually works? Can't we remove the usb in the middle of the process and force a hard reboot?
Tell you what, I think i might try this out. Let's hope the phone keeps on running QQ
"Theoratically" speaking, what if we copy all that partition of the storage to our PC, format the partition then we push it. I know there will be a huge risk of break but in theory can this work without breaking the phone?

---

Ghand0ur said:
Alright, So the issue we are talking about here is that the memory doesn't become saved. So the exploit basically will make it become saved.
So can't we talk about repeating the process over and over and over again till it actually works? Can't we remove the usb in the middle of the process and force a hard reboot?
Tell you what, I think i might try this out. Let's hope the phone keeps on running QQ
"Theoratically" speaking, what if we copy all that partition of the storage to our PC, format the partition then we push it. I know there will be a huge risk of break but in theory can this work without breaking the phone?
Click to expand...
Click to collapse
Im willing to try whatever you want with my AT&T HOX+. Its a second phone that i dont use anyways. Just let me know what you want me to try. I would love S-OFF on it because then it might become useful to me.

---

m1ke420 said:
Im willing to try whatever you want with my AT&T HOX+. Its a second phone that i dont use anyways. Just let me know what you want me to try. I would love S-OFF on it because then it might become useful to me.
Click to expand...
Click to collapse
Well I admit that I don't have experience with development yet so I can't ask you to brick your phone with "false" claims So That's out of the question for me. HOWEVER, If any exploit is discovered since I have an international phone , AT&T will be required to test it as well.. But that's not for the near future on my part .. haha and generally speaking if any dev wants you to risk your phone before he risks his then he is not worthy imo.
Anyway back to topic:
Now for the general understanding @WindyCityRockr This post : http://forum.xda-developers.com/showthread.php?t=1671396 says that you pull a file edit it with HEX Code editor and then push it again. I read somewhere that someone changed the paritition setup so basically the "SDCard" became a whole different partition. Can you elaborate on what file you pulled and tried? Where to find it if the location changed?
EDIT: I found it in the root section /dev/block/ the mmc files are there
What I understand is that the "unlock_code.bin" gained from HTCDev makes you gain partial unlock, Did anyone try to edit that file? I mean Maybe the key answer lies in that file. Maybe if you can edit this file then you flash it maybe you gain S-Off?
Now generally speaking, if you are unlocked with S-ON, on other devices where you can use an app to gain S-Off, do you need to relock your bootloader and flash RUU and stock recovery before you try to S-Off your device? What will happen if you dont.
Anyway I will try to load up the file and inspect it abit then report back
Would be a pleasure if more devs join in.

---

Problem with S-Off on OneX/X+ exists because of different hardware between this phones and any other HTCs. For now there is no way to restore Your phone even with JTAG (tegra has disabled JTAG). No one know what is exactly needed to repair baseband/IMEI after direct flashing eMMC. We can restore phone, but baseband is still dead. We know also there are 3 chips needed to be paired. CPU, eMMC and XGold 626. If You change only one of them- phone has no IMEI, being SIM locked or boot only in bootloader. There is also problem with bootloader- is locked. That's why You can't totaly brick Your phone. There is no way to change anything in bootloader, so We can't S-off phone. Probably even with Java card. I have some diag files for OneX, but not working. We stuck. We need to know how to get SBK for Tegra 3

---

kwaku85 said:
Problem with S-Off on OneX/X+ exists because of different hardware between this phones and any other HTCs. For now there is no way to restore Your phone even with JTAG (tegra has disabled JTAG). No one know what is exactly needed to repair baseband/IMEI after direct flashing eMMC. We can restore phone, but baseband is still dead. We know also there are 3 chips needed to be paired. CPU, eMMC and XGold 626. If You change only one of them- phone has no IMEI, being SIM locked or boot only in bootloader. There is also problem with bootloader- is locked. That's why You can't totaly brick Your phone. There is no way to change anything in bootloader, so We can't S-off phone. Probably even with Java card. I have some diag files for OneX, but not working. We stuck. We need to know how to get SBK for Tegra 3
Click to expand...
Click to collapse
Alright, just let me comment or rather ask about some few points.
-I get that the international version and AT&T are different , one having LTE and the other dont, so does that mean that the S-Off here will be different between the international and the AT&T? If so, which is easier?
-You said if you change only one you become sim-locked, So did anyone succeed in changing one permenantly?
-There was a thread saying that you can make a backup of your IMEI folder and paste it , shouldn't that fix the IMEI issue?
-So you are saying even with a Java card and the original DIAGs we can't S-Off? How is that possible even though there are people who actually succeeded in doing so ?
So all these issues will be solved if we get the SBK? [Secure Boot Key] ?

---

Ghand0ur said:
Alright, just let me comment or rather ask about some few points.
-I get that the international version and AT&T are different , one having LTE and the other dont, so does that mean that the S-Off here will be different between the international and the AT&T? If so, which is easier?
-You said if you change only one you become sim-locked, So did anyone succeed in changing one permenantly?
-There was a thread saying that you can make a backup of your IMEI folder and paste it , shouldn't that fix the IMEI issue?
-So you are saying even with a Java card and the original DIAGs we can't S-Off? How is that possible even though there are people who actually succeeded in doing so ?
So all these issues will be solved if we get the SBK? [Secure Boot Key] ?
Click to expand...
Click to collapse
International and AT&T are different. International has Tegra3 CPU, AT&T is standard Snapdragon phone. It's just OneS in One X skin. So. probably for this last OneS S-Off solution should be working after some modifications. Need to ask some good devs. This version is also supported for JTAG flashing, IMEI repair etc.
Almost all HTCs has standard Qualcomm processors (even HTC One) and similar construction. International OneX is different. Completly different CPU (and GPU), different and locked by Nvidia bootloader. Security flags are in bootloader, so, We can't even touch it.
-I never heard about anyone who change any of this parts and bring phone to live. If anyone can do this- probably We can do everything else, incluging Bootloader security status changing (S-on/off)
-Yes, backup will help. But only if You still have original parts on Your PCB. If You change anything important- backup will not help You. To check how it's working We need to get 2 OneX with same version of SW, clean and not touched. Make backups and look inside. Mayby We can find differences and make solution for EFS repair. The sad things is 90% of broken OneX has HW problem, not SW.
- Still I have not Java card (White Card), but it's probably some universal device for new HTC models, but I'm affraid it can not work with International OneX, because of additional Tegra3 security. But mayby Java Card has some Tegra Security unlock instruction inside. Who knows
- I know some people just buy unlocked devices (for devs). Like I said before, I don't know how Java card is working, if it can disable Tegra security, then bootloader can be fully unlocked.
- Fater get SBK We can unlock bootloader, but for IMEI repair We need to understand OneX EFS construction, to know what should be change to see our IMEI and whole Radio back
For now I'm waiting for Z3X team progres on repair Nvidias HTC, they can directly flash eMMC, now, They're working on repair broken IMEI etc. That's the goal now.

---

Correction: ATT Model is Tegra 3
Sent from my HTC One X+ using Tapatalk 4

---

sixcarnage said:
Correction: ATT Model is Tegra 3
Sent from my HTC One X+ using Tapatalk 4
Click to expand...
Click to collapse
No way! http://www.gsmarena.com/htc_one_x_at&t-4614.php

---

AT&T One X has snapdragon cpu
AT&T One X"+" has Tegra3
Sent from my HTC One X+ using xda app-developers app

---

This is a One X+ thread go talk about One X elsewhere. AT&T One X+ is a Tegra 3 model.
Sent from my HTC One X+ using Tapatalk 4

---

sixcarnage said:
This is a One X+ thread go talk about One X elsewhere. AT&T One X+ is a Tegra 3 model.
Sent from my HTC One X+ using Tapatalk 4
Click to expand...
Click to collapse
Chillax bro, LoLzZzZ (so swag, i know) . Well Since both phones do have similar hardware, except the AT&T One X , So the ideas are joined. So even if you own a tegra 3 HOX, it's fine that you post here if you have something to say. I think he just misread the forum , its fine

---

Yeah, sorry, I was reading posts on HOX and HOX+ forums and just wrote on bad section. Sorry again, but HOX and HOX+ are similar phones. HOX+ has a little better CPU. S-off problem is same, Nvidia security is probably same. So, We still can't do anything.
I don't know much about programming, but if We can unlock bootloader via HTCdev, then must be some backdoor on Nvidia security, or mayby seucrity is disabled during bootloader unlocking operation. Mayby this is the way. Or mayby this part of bootloader security is somewhere else and Nvidia key not blocking this. I don't know. Any Dev is needed here.

---

Gotta love it when I resurrect an old thread (oh resurrect. Such a big word)
I've been wondering for quite a while about this question.
Turing on "Power saving" mode in the sense rom, turns down your CPU to 1.3GHZ, which means it UNDERCLOCKS your device. Correct me If I am wrong, if you are S-On you neither can underclock nor overclock your cpu . Right?
I know this has been thought by other great developers before, but is there no way to de-compile just the power saving function and inspecting to see how it gains the S-Off access? I mean the answer must be there.