Root What's up with Drive?

[scotty85]

Speaking of code, is it just me or are the

 tags broke for the forums?

I've been using the "Code" button but it inserts ([HIGH][/HIGH]) instead of CODE. :confused:[/QUOTE]

definately not just you. theyve been that way for a long time.. at least a  year. i just change it manually whenever i need to insert code. 

also thot i should mention,that youll need to be [COLOR="Magenta"]locked[/COLOR] and non-tampered for any of the promotions(or the fingerprint scanner on the one max ;)) to work. i found a few folks in the xda threads that mistakenly thot that if they unlocked via the "not htcdev" method that they were as good as [COLOR="Magenta"]locked[/COLOR],wich is not the case. the flag itself is what is being checked,and the commands are legitimately changing that. ie,it doesnt matter how you achieved it,but you cannot be [COLOR="Magenta"]unlocked[/COLOR] nor can you be running a faux hboot that is displaying[COLOR="Magenta"] locked[/COLOR]/not displaying [B]tampered[/B]. if the flags are set,it doesnt matter what your hboot screen physically displays. hope that last bit makes sense :o

 

[Granite1]

I think I'll try to remove the *Tampered banner and *Lock the bootloader, and see if it will give me the Drive space while on Viper.

I'm at work, so it might take a while to get to it.

 

[EarlyMon]

Thanks scotty!

No, I didn't see the second post.

I decided that someone had to see if that 0x01 mattered and take the chance - so I changed it to zero and took the phone down, around and sideways. No problem.

So I set it back.

 

[EarlyMon]

Ok, just changing those flags on Viper and turning off SuperSU didn't do it.

Going to try the stock recovery and the original rom.

I might have to start over, no idea if the firewater hboot is a problem now.

Or - if I've tripped a flag or something on their side and they've logged my IMEI as busted.

I also never got the dialog with the Store's drive, so I just tried to sideload the original - still no mention of the promo.

Nandroiding... nandroiding... lol'ing... nandroiding...

And I did look for that tampered post but kept getting other threads that just wanted to monkey the red text at boot. Which I knew going in wasn't the answer.

Eh - some days, I got no search!

 

[EarlyMon]

That's the ticket!

echo -ne '\x00' | dd of=/dev/block/mmcblk0p6 bs=1 seek=5314564
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796

stock recovery, original rom, even rooted, and bang - REDEEM!

Well, so much for me being clever.

Otherwise, my original steps were good - I missed the most important part on that tampered for sure.

And to be clear - did it with the firewater hboot.

Anyone need the stock recovery or are we all good?

Thanks scotty!

 

[Granite1]

That's the ticket!

echo -ne '\x00' | dd of=/dev/block/mmcblk0p6 bs=1 seek=5314564
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796

stock recovery, original rom, even rooted, and bang - REDEEM!

Well, so much for me being clever.

Otherwise, my original steps were good - I missed the most important part on that tampered for sure.

And to be clear - did it with the firewater hboot.

Anyone need the stock recovery or are we all good?

Thanks scotty!

What stock recovery version do you have?

I only found the 1.54.651.8 Stock recovery, but not the .10 to match the firmware.

 

[EarlyMon]

What stock recovery version do you have?

I only found the 1.54.651.8 Stock recovery, but not the .10 to match the firmware.

Easy peasy, grab that full OTA firmware package I linked above (that you linked me to originally), unzip, profit.

My original intent on the offer was to upload and link it myself (did I mention that I have lots of cloud space lol) but you can do what I did and not have to wait.

 

[Granite1]

Easy peasy, grab that full OTA firmware package I linked above (that you linked me to originally), unzip, profit.

My original intent on the offer was to upload and link it myself (did I mention that I have lots of cloud space lol) but you can do what I did and not have to wait.

I swear I'm braindead sometimes.

Probably should find a copy in the wild to link here for future reference. I'll keep searching around later this evening. Gotta jump off for a few hours, work beckons.

 

[scotty85]

I decided that someone had to see if that 0x01 mattered and take the chance - so I changed it to zero and took the phone down, around and sideways. No problem

saaaaayyyy whaaaaa

well,now im really curious,lol... its got to be a flag of some sort. got a mind to set it on my m7 and see if i can figure out the change. thing is ive never seen a phone NOT have it.

as you prolly deduced,you can bring tampered simply by writing back the 04(or anything really,tho id stick with what the phone had) instead of an 00.

took me forever to find that lil bugger! if you ever have a need, ive located the flags on s2,s3 and s4 phones as well,and some of the older stuff like the DHD,OG inc,and evo.

if i were the hex editing type,id leave the tampered flag and hex edit both the black and pink blocks to say something clever

 

[Chief YYZ]

Alright, so I'm trying to sort out some of the information I'm getting from all the different threads. Both the ones Scotty linked above, and on xda.

I'm probably just misunderstanding what some of the people who post are trying to do or mean by what they say. Mostly stuff like:

also the one max has to have its bootloader locked,and NOT displaying the tampered banner in order for its fingerprint scanner to work. folks in these situations can leave the bootloader locked,and unlock momentarily if they wish,and lock right back.

...and other comments on xda threads, etc.

So either people are running custom roms and recoveries on locked bootloaders? (I thought that would get you stuck in bootloader every boot.) Or they've gone back completely to stock for the fingerprint thing? Or something else I'm totally missing...

Since I'm fully aware some of the things I think I know are probably wrong, I'm trying to get my head around the cold hard facts.

1: What will stop a locked HTC bootloader from loading the OS? For example if you DO have everything else stock, but flashed a custom recovery, will that do it? Any single piece of firmware unsigned (LOL, are individual pieces even signed?) or not matching other firmware? (Granite mentioned that.) Basically, can you have anything not exactly matching what you would find in an RUU and still boot locked?

2: What triggers the Tampered flag? Does it just pop up on unlock, or do you have to actually flash something? Since I've gone through these processes several times on a few different HTC phones, you'd think I'd notice when it happens, but you'd be wrong!

Thanks guys!

 

[EarlyMon]

Alright, so I'm trying to sort out some of the information I'm getting from all the different threads. Both the ones Scotty linked above, and on xda.

I'm probably just misunderstanding what some of the people who post are trying to do or mean by what they say. Mostly stuff like:

...and other comments on xda threads, etc.

So either people are running custom roms and recoveries on locked bootloaders? (I thought that would get you stuck in bootloader every boot.) Or they've gone back completely to stock for the fingerprint thing? Or something else I'm totally missing...

Since I'm fully aware some of the things I think I know are probably wrong, I'm trying to get my head around the cold hard facts.

1: What will stop a locked HTC bootloader from loading the OS? For example if you DO have everything else stock, but flashed a custom recovery, will that do it? Any single piece of firmware unsigned (LOL, are individual pieces even signed?) or not matching other firmware? (Granite mentioned that.) Basically, can you have anything not exactly matching what you would find in an RUU and still boot locked?

2: What triggers the Tampered flag? Does it just pop up on unlock, or do you have to actually flash something? Since I've gone through these processes several times on a few different HTC phones, you'd think I'd notice when it happens, but you'd be wrong!

Thanks guys!

You can temp root some phones and make some rom changes with the stock firmware. Not a lot but some.

If you're s-on the rules get mega-strict about the sequence and possibilities of things, but with custom recovery you can do quite a bit.

With s-off you can do more because with bootloaders, it's not just the lock, it's the security behind it.

And s-off means that the encrypted signature security - is off.

So you can do anything, including creating a true, unsolvable brick.

The basic deal here to get Drive isn't as tough as I thought, or as confusing.

Different people report different combinations of things working here but they're all minor variations on the same idea and don't take long.

I'll post back with the simple, general instructions for everyone when I get home. I'm waiting to pick up my wife right now lol.

It shouldn't be too long.

 

[scotty85]

just to add to what em has said...

Alright, so I'm trying to sort out some of the information I'm getting from all the different threads. Both the ones Scotty linked above, and on xda.

I'm probably just misunderstanding what some of the people who post are trying to do or mean by what they say. Mostly stuff like:

...and other comments on xda threads, etc.

So either people are running custom roms and recoveries on locked bootloaders? (I thought that would get you stuck in bootloader every boot.) Or they've gone back completely to stock for the fingerprint thing? Or something else I'm totally missing...

while s on,you cannot lock the bootloader while running a custom rom,kernel,or recovery. doing so will lock you into bootloader with the security warning

while s off,the sky is the limit. the phone does no security checks and has no write protections whatsoever,so you can remain locked and run custom roms,kernels and recoveries.

also,the tampered flag is never tripped. this only happens while s on.

the one max actually does check the lock flag and the tampered flag and will NOT allow use of the fingerprint scanner while they are unlocked and/or tampered. while s off,these flags can be reset,allowing a custom recovery,kernel and rom to be ran and the fingerprint scanner remain functional. those guys were really happy to discover this,lol. prior,they had to relock and run an ruu and remain unrooted in order to make the scanner work again.

Since I'm fully aware some of the things I think I know are probably wrong, I'm trying to get my head around the cold hard facts.

1: What will stop a locked HTC bootloader from loading the OS? For example if you DO have everything else stock, but flashed a custom recovery, will that do it? Any single piece of firmware unsigned (LOL, are individual pieces even signed?) or not matching other firmware? (Granite mentioned that.) Basically, can you have anything not exactly matching what you would find in an RUU and still boot locked?

while s on,anything custom at all will lock you into bootloader. any mods to boot,system,or recovery,as well as any mismatches in firmware or other write protected partitions. this is why modding verizon phones is so dangerous... there are ALOT of factors that could trip the tampered flag,locking you down if you tried to re-s on. with vzw youve no way to re-unlock,and no signed ruu to run,so basically youre stuck with an unrecoverable(via conventional flashing) non booting device.

so basiclly,the answer is no. you cannot run anything custom while s on if you wish to remain locked.

2: What triggers the Tampered flag? Does it just pop up on unlock, or do you have to actually flash something? Since I've gone through these processes several times on a few different HTC phones, you'd think I'd notice when it happens, but you'd be wrong!

Thanks guys!

unlocking the bootloader does not casue tampered. basically,anything non-stock(within,or outside of boot,system,and recovery),as well as firmware mismatches. you could flash a signed firmware package,and if it didnt match the other parts of your phone,you would be tampered if you were s on.

the most common causes of the flag set are installing or booting a recovery image,installing a non-stock boot image(kernel) or system.

further,installing a custom rom or kernel will casue the warning! this build blah blah text to display during boot,and installing a custom recovery will casue it to display while booting recovery.

so i guess the key thing to remember,is that while s off anything is possible. s on is a different ball of string,but then,you couldnt use any of the link threads while s on,as all those partitions are strictly write protected.

hope that helps,holler if you need any further clarifications

 

[Chief YYZ]

Thanks EM and Scotty.

Scotty that really did clear a few things up for me, I didn't realize S-OFF allowed you to lock and still run custom. I guess I thought of it as hboot not checking any further with a locked bootloader, never occurred to me S-ON would be necessary as well to get you stuck.

Really just a point of curiosity, is the tampered flag tripped during checks when booting, or is it immediate in an S-ON device. Really can't see how it matters, I'm just curious what is doing the checking for "tamperationing" the bootloader, or some real time security?

 

[EarlyMon]

saaaaayyyy whaaaaa

well,now im really curious,lol... its got to be a flag of some sort. got a mind to set it on my m7 and see if i can figure out the change. thing is ive never seen a phone NOT have it.

as you prolly deduced,you can bring tampered simply by writing back the 04(or anything really,tho id stick with what the phone had) instead of an 00.

took me forever to find that lil bugger! if you ever have a need, ive located the flags on s2,s3 and s4 phones as well,and some of the older stuff like the DHD,OG inc,and evo.

if i were the hex editing type,id leave the tampered flag and hex edit both the black and pink blocks to say something clever

Just so we're clear - the entire HTC community owes you a huge debt of gratitude and that goes for me too.

Anyone can say in hindsight that they could have done it, they have the skills, etc etc, but being the one to do it is a whole 'nother thing.

I hope everyone reading knows that that ought to mean a lot about scotty coming from me - I play the root airhead sometimes, mostly it's all good fun for me. But I've had a hand helping in nearly every aspect of Android development over the years and I develop for a living.

The entire staff has unyielding admiration for scotty.

He has a special place as a bud and on our staff - he could have made mod LONG ago but he's chosen to be THE One True HTC Guide and not face other distractions.

I stopped counting (and yes, I decided to count for a while) when the total value of phones that scotty went in and saved for people exceeded $10,000 - no lie. And I didn't start counting until he'd been doing it a while and stopped counting long ago.

Plus add in the successful roots, s-offs, saves of silly attempts at false insurance claims by getting things fixed - scotty has been there for all of us.

I hereby dedicate this thread to you, Sir Scotty!

Now - that all said:

I knew it would, under other circumstances, be a monumentally STUPID thing to play with that \x01 value.

But you were curious, and I've never had bad luck - so I figured the worst that would happen is I'd be out my shiny new phone (and no insurance lies ok - I'd just be out).

But I decided to take that risk because of all the times you and others had taken the risks for me.

I know for a fact - whether by common sense or as a developer myself - that the \x01 is somehow important. No one writes firmware with values in bytes for the fun of it.

All I learned and passed on is - it seems to be safe to investigate further for guys like scotty, without fear of bricking an M8. My stuff worked - I did not test everything.

Do not decide to play like I did, please.

And now, back to our thread.

Stand by Chief XYZ, the next posts are what you want to know.

 

[EarlyMon]

Thanks EM and Scotty.

Scotty that really did clear a few things up for me, I didn't realize S-OFF allowed you to lock and still run custom. I guess I thought of it as hboot not checking any further with a locked bootloader, never occurred to me S-ON would be necessary as well to get you stuck.

Really just a point of curiosity, is the tampered flag tripped during checks when booting, or is it immediate in an S-ON device. Really can't see how it matters, I'm just curious what is doing the checking for "tamperationing" the bootloader, or some real time security?

Scotty (and others who know as well), if you're cool with it, I'm going to edit this and answer from my point of view.

Not because it's better - but because I've found that multiple points of view help with the understanding of odd bodkins and other orthodontia.

So - stand by - as you read this, I'm editing in my version of the answer(s).

~~~~~~ And the edit follows below this line ~~~~~~~~~

So - I'm not going to say the same things in different ways, that's often helpful and often just silly.

I am going to recap some of what scotty said from a different point of view and that will help with my way of adding on answers to your questions.

I've written firmware, scotty has not. But in this case, scotty has a firmware developer's understanding of hboot - and I do not. I do have a systems programming understanding of it, so between the two points of view, I think we'll get close to a good picture.

I'm not going to talk about tampered and so forth - I turn to scotty for that anyway and have nothing to add.

I want to take a moment and take about cyber security.

Stock hboot has very good cyber security. It frustrates us, but it really protects users more than HTC or carriers.

I'm almost unique in that I *always* use the phrase "encrypted signature security" when talking about s-on/s-off and here's the story on that.

All crypto systems have locks and keys. The front door to your house is a crypto system. Your car ignition is a crypto system. Anything with a lock and a key is a crypto system.

When we think about good locks and bad locks - and that's how we've all discussed the subject all our lives (this is a good combination lock for my locker, that brand sucks) - we say we're talking about the lock - but - we're really talking about the strength of key system.

Can the lock be fooled easily by a key not its own? Can it be forced open? Can it be picked?

If you think about it - those are descriptions of the key quality of the lock, not the lock per se.

Here's why that's important:

You can steal my keys and figure out that I drive a Ford and have a house or apartment. But you don't know which one. And if I make the key really complicated, you're going to fail making an unauthorized copy. (I'm thinking of that $250 Ford wants for my combination mechanical/computer chip key lmao!)

Got it? Sure you do - it's what you know, just with the crypto point of view.

If you want, take a second, meditate on that, so you got it. If you really already got it, meditate on being cool enough to get it that quickly.

Spoiler

Welcome back!

If you grok what I just laid down about car and house keys and locks being crypto systems, something you already know all about - then you're ready to grok the HTC hboot (and virtually all others - HTC was here first ok ).

So - I like to start with the basics - your bootloader is locked. Forget rooting - savor the idea - your bootloader is locked.

So what happens with a stock phone and an OTA??? :dontknow:

Actually - the answer is really simple - it isn't that the bootloader is just locked - the bootloader contains all of the firmware management junk - and the bootloader CONTAINS THE LOCK.

That's so big, I'll repeat it - THE BOOTLOADER CONTAINS THE LOCK.

But what's behind the lock? Read on, this is the good part.

So - how can you even boot up your phone? How can you get an OTA update?

Just like your car or front door - a lock implies a key.

The OTA zip files that we warn people to be careful about - devs only, wait for your version - those are zip files of the bytes that streamed in during the OTA - and that stream, whether over the air or in a PC zip file - contains the key.

If it didn't, the bootloader would not let the new bytes in - the door is locked.

And - it's a software key - meaning - it's not a program, it's a stream of bits that the bootloader either plays bad-part-of-town-bouncer with - or it hears, Open sez-a-me!

You know from flashing - check the MD5 value before installing new goodies. If they don't match, you had a bad download, don't goof with it, download again. In fact, we can even say that the MD5 value is the key to good flashing.

So - what's an MD5 value? Quite simply (because it is quite simple), it's a way of counting ones and zeros in a file so that you get a number. It's not normal counting, it's actually a kind of moron counting. Normal counting would be "189,342 ones and 167, 289 zeros." So you could change one bit and the count would fail. But with real counting, you can change two bits, get the same counting, and have a messed up file. Or a thousand changes - with normal counting, any even number of screw ups would give you the same count. But no one can out-think what a moron will do next - so with moron counting, change anything and the MD5 total fails.

Thanks for hanging in - that's not a tangent, it's really central ok, and here's why:

How do you use an MD5 value?

The dev makes a count and prints it. You make a count. You compare the dev's printed count with your own. If they match, you let the new file into your TWRP installer. If they don't - you stop it right there. But if it's good, you tell TWRP and everything with you new package, Open sez-a-me!

That is a crypto key process.

How does it relate to the bootloader lock?

Simple.

The bootloader expects to get any number of updates over the phone's life.

And it's the bootloader.

When you or the phone is in the bootloader - who is it going to ask, "Hey - wth is the correct number over here?"

You could do that with you web page and your brain - but the poor little bootloader is all alone.

So - how do deal with that?

You could just make that a constant number. And tell the bootloader at the factory what that number is.

And any fool could find and copy that number - in other words, any fool could find and copy that key.

That's no lock at all. Someone malicious or an out of control download would let a really bad OTA in with that and brick your phone. The constant key would say - Use me! - but the following bits could be completely hosed.

So - you need a new and unique key each time, but you cannot let the bootloader know all the possible keys.

If that sounds impossible, you're following along perfectly.

For decades, it was impossible. Until one day, a cryptanalyst solved it.

And it's a parlor trick.

Suppose Granite and I come to you in chains, locked and say - unlock us. And we each have different locks needing different keys.

We want to be unlocked - but only by you because we only trust you.

So when we were all together at the factory, you were issued a master key. Just one. And some keymaking tools. Very secret keymaking tools. Only you know about them - not us.

And when Granite and I come to you - we're carrying little locked boxes in our hands. His is blue. Mine is blue. And we don't have the key for them. And Scotty pops out with the same deal. And so does... KOLIO.

And so we say - "Hey bud! It's Granite and Early and KOLIO and Scotty! Hooray! "

And you say, with a really stern face and tone of voice - "Show me your boxes!"

And Scotty and Granite do, along with KOLIO.

But I don't have one. Or it's the wrong color. Or it's bent. So you say to me, "Get lost hoser! You big fakir, you're not Early. Early carries the One True Blue Box!"

I'm gone, done, erased.

So then you say, "Wow, hi guys! You might be Granite and Scotty and KOLIO - let's check!"

And you take out your master key - it does not fit Granite's box. You eject him from the game as a total fakir, right there.

You try your master key in Scotty's box and you say, "It works! Holy cow! Let's look inside!"

Inside - you find instructions on how to make the key to break Scotty's lock, free him from his chains, and let him past you.

You take the instructions, use your secret tool, make the key - and try it on Scotty's chain locks.

But uh oh, it doesn't work. So you say, "I'm not fooled. You might have started out as Scotty but you're all screwed up now! None shall pass!"

Finally - you get to KOLIO. He has a box. Your key works on it. Inside are key making instructions. You put them into your Acme Secret Keymaker by HTC - and you get a key. You put that key into the lock on KOLIO's chains, and it works!

You unchain him and say, "You are the one I have been set to await. You are now the master. Pass the gate with my blessing - change whatever you like on the other side - even me! You have said and I have heard, Open sez-a-me!"

Now - you are the bootloader, and Granite, Scotty, KOLIO and I claimed to be good HTC software and firmware that were downloaded correctly, contained no malware from the process and could be entrusted to change the phone you guarded.

Even though you didn't have the one true key - you had the secret process to create, verify, and use the one true key, and let only the good one of us pass.

And we didn't know our own keys. We didn't even know the key to unlock the box we carried. And we don't know what our key instructions mean. We don't know what's in that box.

So you can't ask us.

And one of us can visit you as often as necessary, each time with different contents in that box - in other words - a different actual key.

And that is a better crypto system done with a parlor trick.

You, the bootloader don't have our key, but you have the key to our key. We don't have the key to our key or know the instructions inside the box, and we don't even know what The Secret Key Maker is.

The One True KOLIO update could visit you a hundred times, with a different key instruction each time - therefore - needing a different key each time.

And you would not need to know his key.

And an outsider could watch everything except your secret key making process - because that's behind your locked door - and never see the pattern to figure how to make counterfeit key-making instruction.

And in the crypto world, governed by maths both geniused and moroned, we call that system of numerical master keys, key-making instructions, and final keys -

Encrypted signature security.

And instead of metaphors like people and boxes and brass keys, we call the keys - signatures. And we scramble them like eggs so they can't be figured out. And we call the scrambled numbers - encrypted signatures.

Of course, we're going to encrypt (scramble) the signature - so we can leave that word out and agree that the important part is Signature.

And as long as you, the bootloader, are commanded to be ON the job by HTC, then HTC, we, you, and the users say - you are S-ON.

You only permit things that pass the encrypted signature security (I'll show you mine if you show me yours parlor trick) things to operate.

So what does that all mean?

I don't know how many people here remember the old days of Windows and DOS and hard drives.

Easy to lose everything, everything was the C: drive. Today we're back to that because it's pretty safe - but not in the early days.

So - in the early days - you took your new PC with it's Windows C: drive and you did the Super Expert Cool Really Expert Trick - you separated that one disk into C: and D: drives.

OMG PWNIES - there's only one disk! But it's like there's two. It's like - all - all - WOW!

And then if your Windows got borked or you accidentally erased your C: drive - you did not care. Because using the Super Expert Cool Really Expert Trick you went and put all of your documents and spreadsheets on the D: part of the hard disk drive. You reformat and reinstall your Window to C: and presto! Your files were still there, safe and sound! Majicks! Majicks!

But with a borked C: part of the disk, the D: part was useless ones and zeros.

You have to be a little bit old to remember that.

So my point - your stuff was divided into two parts on one thing.

Don't worry - I didn't lose you, here it comes -

Android = embedded (no disk, just flash storage), real-time Linux + Dalvik Virtual Machine (soon to become ART) + apps that run inside the Dalvik or through the ART, and use Linux system services

^Important

So - what is Linux? It's exactly like Windows or Mac OS X - an operating system, meaning libraries (with services) (maybe you've heard of DLL files for Windows - OS X and Linux has the same deal, different names) and a REALLY TINY piece of software.

You have a computer, a phone, a toaster, a fridge, I don't care - and it has hardware and software.

What is the bridge? It's easy to say "hardware and software" - see, I just did it again - but how do you make them come together?

A special piece of tiny software called a kernel ties software and hardware together.

Without the kernel - you got nothing.

So - the freaking point already?

Your phone doesn't have an old school hard disk.

But it does have flash storage that does the same job - storage.

So - let's split it up, just like the old school Really Expert Trick - and make the one thing two, just like C: and D: on one hard disk.

Of course we're all cool and stuff, so we'll call them images and partitions and whatnot.

So - even though the kernel is part of the operating system - we can put it in its own deal.

We put it in the boot image area (because the first thing that the kernel does tying the hardware and software together is to boot up the operating system on the hardware).

And so - here's the next parlor trick - the boot image area (fancy name for the kernel C: drive ) - has an encrypted signature.

If you don't open its locks, you don't boot.

You can lock down a 1 or 2 GB Android operating part by just putting the encrypted lock on the area where the kernel is.

And you can lock down installing things on a stock phone by putting an encrypted lock on the update stream, whether OTA or zip file.

You can brute force things and copy whatever you like wherever you like.

No lock is perfect.

But if the keys fail, the keeper of the secrets - the bootloader - shuts itself down permanently so you can never get the key making secret.

And that is called a hard brick.

Or you can brute force a little and it'll send the phone into an endless loop of try to boot - fail - try to boot - fail - etc etc - until you fix the problem.

It's such a good idea that you put that scheme onto other parts of the storage as well - where the radio stuff is - where the bootloader itself is - the whole enchilada.

But once the phone passes all of the locks and boots up, you, the bootloader, can get out the way and not slow anything down.

You trust it. It gets to run.

So - HTC used to sorta lock things but turned a blind eye to all of our rooter antics. Even though they had s-on, they did it enough to save bad downloads and fooling it was no big deal. Getting unlocked and s-off was just tedious work but that's all. (My first unlock/s-off took 78 precise steps. I am not making that number up.)

But one day - they changed they minds and really went to Crypto Town.

We were screwed. There was much sadness in the land. We could not get around them.

We mounted a public petition and it went viral worldwide.

HTC's CEO stepped up to the plate and said -

"You want it? We listen. But here's the deal. We ship it our way so normal people are safe from malware and OTAs. But we let you come to us, get yet another secret key and unlock your bootloaders - so you can all go to Root City. If we do, you say good things about us. Do we have a deal?"

There was much rejoicing in the land.

We got what we asked for - precisely what we asked for - and we stood down the publicity attack, seeing their side of it too, to protect regular users. Anyone can get a bad download. And it's not a BlackBerry, so no, you do not get to erase whatever you like and get sympathy from us.

Enter the HTCdev program - and The Big Surprise.

We got EXACTLY what we asked for and they gave exactly what they promised - The Unlocked Bootloader.

But they revealed something we'd never seen and never dreamed of - The Unlocked Bootloader With S-On.

We didn't even know to imagine such a thing possible. Be careful what you ask for, you just might get it.

So - with that - you can "unlock the bootloader" - but really, it simply says - hey, it's not one of the encrypted signature areas - you can flash and change there.

But the encrypted signature areas - those are still s-on - so you can do nothing there. Only our approved ones and zeros.

So, s-on unlocked means - no signature security on recovery, flash away - no encrypted signature security on the rest of the rom - flash away. Everything else. Ours. Not yours. Radios - ours. Kernels - ours (and by extension, what roms work with our kernels). And any other firmware - ours. And we'll just update the bootloader whenever we like so if you get close to the secret key maker, we'll distribute a new one.

And despite our whining, as we have scotty and a scant few like him, most HTC rooters really can get by with an s-on unlocked bootloader.

But the real deal - turn off the gatekeeper part of the bootloader altogether.

Put him on vacation.

Tell him that he is to no longer ever check an encrypted signature ever again.

Not even if he gets replaced by a new bootloader who thinks he can.

That is The Crypto Key Magic - that is permanent s-off.

The tampered flags, text, unlocked, locked, etc etc, all messages for the humans. You, so you know they'll know, and them, so they'll know.

You might fool a tech with changing the words on the hboot screen on that - but you can't fool the factory or software from the factory that can really check.

So, with s-off, yes, you can lock the phone again.

It won't mean anything because at the end of the day, the key maker says, "All shall pass."

Whether new hboot, recovery, whatever dude - with s-off, all shall pass.

And because other software - like, oh, I don't know, let's say an app like Drive - is flying at about 30,000 feet above the bootloader, it don't see so good. It can see the secret tampered and unlocked flags. But it won't see the s-off hiding below them.

Ok - I felt like it was all there and at the end, I felt like maybe I got obtuse again.

I'll stop here.

I hope that this point of view answers some questions, was actually understandable and as fun to read as it was to write.

In my fevered brain, you all got it and loved it.

If in reality you didn't, my bad.

If you did, my eternal thanks for reading - because writing this was not easy!

BTW - change brands, it's all still the same story. We have names for these things with HTC because HTC went the professional crypto route. It's not that other bootloaders don't do all this - they just do it with less discipline and more confusion.

HTCs are not weird in the world of bootloaders. In fact, only Nexi (lock or not without an encrypted signature key) and an HTC (next level up) really do any of this stuff correctly in the first place.

^Not an opinion even if it sounds like one. :rofl:

PS - for every rule there's an exception. The LTEvo could be s-on and still flash a non-HTC kernel. Doesn't misprove anything if you can think of an example here or there that go against what Scotty or I have said. Just means that HTC has made a lot of models, a lot of locks, a lot of keys - and for every rule, there's an exception.

But overall - that's the deal.

PPS - the whole HTC bootloader unlock did in fact center around our forums. Our mod at the time, and my pal, novox77 wrote up a clear analysis of how they did s-on with an unlocked bootloader. That removed the confusion and he was quoted far and wide - that's when the petition went from a niche story to viral, and only then did HTC respond.

So my telling of that story is as firsthand as you can get without being novox77. And like Steven58 in the epic GNex thread, novox77 and I talked real-time about that throughout.

I'm proud to have worked with novox77 - he may be gone from our rolls due to work, but he is not forgotten, and he is another unsung hero in the history of HTC rooting.

 

[Chief YYZ]

I knew it would under other circumstances be a monumentally STUPID thing to play with that \x01 value.

But you were curious, and I've never had bad luck - so I figured the worst that would happen is I'd be out my shiny new phone (and no insurance lies ok - I'd just be out).

But I decided to take that risk because of all the times you and others had taken the risks for me.

I know for a fact - whether by common sense or as a developer myself - that the \x01 is somehow important. No one writes firmware with values in bytes for the fun of it.

All I learned and passed on is - it seems to be safe to investigate further for guys like scotty, without fear of bricking an M8. My stuff worked - I did not test everything.

Yeah, ballsy dude. Thanks for that!

Stand by Chief XYZ, the next posts are what you want to know.

But I want to know EVERYTHING!!!!!!

Can you get that in tonite?

BTW: Respect the Rush, and get it right!

https://www.youtube.com/watch?feature=player_embedded&v=1eSlvoO3Vw8

 

[EarlyMon]

It's late and I've finished my silly story.

Please give me until a crazy end-of-half-year tomorrow or Saturday to give you the simple "How to do Drive" instructions.

And I hope you hope what I wrote isn't mind-numbingly boring as all hell.

And I hope hope everyone reads and groks my thread dedication to Scotty.

He's probably embarrassed - but - I just thought that everyone, even people who already thought he was cool, get the picture on just how cool he is.

 

[scotty85]

He's probably embarrassed -

maybe a little

this is the kind of stuff that i really enjoy. i like snooping around in the inner workings and i like to help folks out whove gotten into a jam. ive never thot about it in terms of dollars,but that number makes me feel pretty good

em i love your anolgy! i giggled as i read it and now im late getting into the shower to get ready for work. doh! oh well

only thing id maybe say a bit differently,is that the gatekeeper is not gone. he may be on vacation,but hes still there. every time hes presented with box to check,he looks at the security flag(its early and im at a loss for coming up with a clever analogy that fits into yours lol ) and as long as he finds the 00 at 8400 he says "im not checking your box! all shall pass! im in vacation". if he wakes up one morning and finds the 03,hes got to start opening the boxes again and making his keys,only allowing kolio and those with the correct key instructions to pass.

further,if he wakes up one morning and sees the 03,he also says,uh oh,i better have a look at things,and as the phone boots he checks a few things,those things also check some things,and so on(partitions are enumerated so each does its own checks on others as the phone boots) and if any of them find something they dont like they look at the lock flag. if they find the HTCU they may let things slide(and set the tamper flag so that banner appears). if they find 00s or an HTCL,then they say "oh snap! weve been infiltrated! lock it down!" and there you are in bootlaoder,displaying a tampered banner,and showing a security warning. they are protecting themselves from further infiltration,so you stay there until you tell them its ok(by unlocking the bootloader) or until you run a signed ruu(meeting all the gatekeepers criteria for main version,cid,etc and has the correct key instructions) and everyone is satisfied with all the partitions. they will then let the phone boot.

hope that adds a little info and not confusion

 

[Granite1]

I've said it before and I'll say it again:

I'm humbled and privileged to be among the ranks with EarlyMon and Scotty.

There are others, and trust me, novoxx77 will never be forgotten. That post right there EM will be linked for future reference. It's that good.

If I can't crack an HTC nut, I PM Scotty immediately. He really is THAT GOOD!

Cyber security was part of last semesters studies in my Intro to Networking class. I know we use MD5 as a means of checking the integrity of a download, but at one time it was an encryption tool itself. It was severely flawed, but the unique sum it produced continued to be of use.

The bootloader uses Public Private Key encryption then EM?

 

[EarlyMon]

The bootloader uses Public Private Key encryption then EM?

As always, I could be wrong and it could be the simpler private key encryption.

However - the word signature is there and no one has been able to figure out how to generate them. And it's definitely been tried. There's about 250 bytes there in the payloads that will make you suck your thumb or drive you to drink.

So, while I could be fooled about what they did, I think I have a firm basis to assert that yes, it's some sort of public or public private key encryption.

And here is the fantasy - if someone could figure out HTC's encryption algorithm exactly, we wouldn't need s-off. The devs would publish the tool, or sell the service for a fee, and then our private dev payloads could use that. I don't know if that's been abandoned, but I haven't read about anyone approaching it from that side in quite some time.

As for being humbled to be around me, bah. Like you, I'm so bright my mom decided to call me son.

 

[Granite1]

As always, I could be wrong and it could be the simpler private key encryption.

However - the word signature is there and no one has been able to figure out how to generate them. And it's definitely been tried. There's about 250 bytes there in the payloads that will make you suck your thumb or drive you to drink.

So, while I could be fooled about what they did, I think I have a firm basis to assert that yes, it's some sort of public or public private key encryption.

And here is the fantasy - if someone could figure out HTC's encryption algorithm exactly, we wouldn't need s-off. The devs would publish the tool, or sell the service for a fee, and then our private dev payloads could use that. I don't know if that's been abandoned, but I haven't read about anyone approaching it from that side in quite some time.

As for being humbled to be around me, bah. Like you, I'm so bright my mom decided to call me son.

250bit encryption key would take forever to brute force crack. Don't think they'll get anywhere with that tactic.

Well put my friend, thank you.

 

[Chief YYZ]

First of all thank all of you for all the help you've given me.

I think I'm good to actually do it, just in no rush at the moment.

Sorry if I wasn't clear before, I meant the "everything" as a joke, as in: please post the sum total of your Android and Linux knowledge for me before you go to bed.

 

[EarlyMon]

First of all thank all of you for all the help you've given me.

I think I'm good to actually do it, just in no rush at the moment.

Sorry if I wasn't clear before, I meant the "everything" as a joke, as in: please post the sum total of your Android and Linux knowledge for me before you go to bed.

I understood that going in.

Just felt like i running my yapper.

 

[Granite1]

I'm posting this here as we've had the conversation about the ##SCRTN# code EM mentioned above.

Long story short, I lost pretty much all radio functionality in my phone since yesterday afternoon.

I swapped out My father-in-law's old GNex with my retired LTEvo. Easy procedure, did it all online. After I got his phone hooked up, went to make a call on my M8, no dice. Checked my Airave, working fine. LTEvo worked fine, wifes Note2 worked fine.

Hmmm, decided to update the PRL, then Profile. No dice. Now the signal started to cycle, full bars, then slowly drop until no service, then roaming, back to full service. Repeat.

Did a ##SCRTN#, no MSL required, reset, rebooted. Hands Free Activation started on reboot, went through. Calls work again, no texts tho. Same oscillating signal, just wouldn't kick out of the funk it was in.

Called Sprint, did another ##SCRTN#, no dice. They refreshed on their end, no dice. Then we tried ##"Enter your MSL here"# went to the MSL menu. We edited my Mobile Directory Number, rebooted, then did a Profile update. As soon as the Profile updated, BOOM!! I was text bombed and had about 5 voicemails!

If you go into that menu with your phone working properly, select "View Mode" when the pop up appears. DO NOT select "Edit Mode". If you play with stuffs in here, you'll need a Sprint tech to get you back working. Warning has been delivered.
Make note of your Mobile Directory Number (MDN), and your MSID. Write them down, as these are tied to your device in Sprint's network.

I don't think changing the MDN would be catastrophic, as we did it with mine and the Profile update restored the original number. I just don't trust playing with stuff in there. So tread lightly if you choose to check this little menu out.

 

[Chief YYZ]

Easy.

I will not put actual code here, just my steps. Scotty has linked the code already [post=6619987]here[/post]

Started with S-OFF unlocked bootloader

Flashed Root_Inception Nandroid (stock rooted ROM)
Left TWRP in place
Booted to Android OS
adb lock bootloader
(I already removed tampered flag--not cosmetic, used Scotty's flag removal--but would have here if I had not)
adb reboot bootloader--confirm locked/no tampered
reboot--with volume/power, since fastboot commands don't work while locked
open drive, redeem
adb unlock bootloader
adb reboot bootloader--confirm unlocked/no tampered
Flash current Nandroid.
Clear data from drive app to get the correct usage to show in the menu(may have fixed on it's own eventually, but killing and restarting the app didn't work)

Done.

So it would seem the only requirements are:
1) Stock ROM
2) Locked Bootloader
3) No tampered flag

Thanks again EM, Scotty, Granite, for all the help and knowledge!!!!