Database Users

Nand Unlock and R/W ? - BusyBox Installation

Alright so, I wanted to use an app called ANIMMOD - ROOT, basically it changes the animations of the slide, however it needs busybox to run, so I went to market and installed "BusyBox" i beleive its an installer...I ran the app and it says make sure i have Nand Unlocked and R/W access, i did a google search to find out if i was unlocked and apparently im not because in hboot it says S-ON...
Now my question is how do i nand unlock? what is it? and whats R/W access??

"NAND" probably refers to S-ON (inside the bootloader), which refers to messing about with the core of the system. The opposite is obviously S-OFF. In order to S-OFF your legend (which will also give you R/W access to /system, which is what the app requires), you need to flash a custom HBOOT from alpharev.nl. However, the img's at alpharev.nl don't support any HBOOTs from 1.00 and below, if I recall correctly.
BE ADVISED; if something goes wrong with flashing the custom HBOOT, you will 100% brick your phone without any chance of recovery unless you've got a JTAG or other similar device.
In my opinion it isn't really worth it, as the potential risks outweigh the gains.

Yeah its not worth it! Thanks for the reply! Much appreciated

sal_911 said:
Yeah its not worth it! Thanks for the reply! Much appreciated
Click to expand...
Click to collapse
No problem. Hope the forums are treating you well. Stick around and read up on stuff if that kind of thing interests you.

Oh, I nearly forgot.
Unless I'm grossly misinformed you can kind of write to /system using blay0's /system overlay. Search the forums for it.
I've not used it so I can't make any promises that it will work for you, but blay0 definitely knows what he's doing, so I trust him.

Thanks!!! I love this forum...it made my dead legend come alive (I was basically usb bricked )

sal_911 said:
Thanks!!! I love this forum...it made my dead legend come alive (I was basically usb bricked )
Click to expand...
Click to collapse
Holy crap. Fortunately I've never bricked my Legend and I hope I never do. Thankfully, xda-dev exists.

[Q] Got my MT4G replaced by HTC. Should I root?

I today got my MT4G replaced. It bricked because of that eMMC chip issue. I must carrier unlock it to use it. Now to that one of the options is to root and get the S-OFF.
But, I am worried about the same thing happening again. What will happen if it again becomes a paper weight? Should I use unlockyourphone.com or something?
Plus, it has 2.3.4 preinstalled. so is it possible to root it or do I need to downgrade?

Please check here to determine your eMMC chip type and only if you have the good chipset, will you be alright to root without fear of a brick.
Why pay for someone to unlock your phone when you can do it in 20 minutes even if u have to set-up ADB...?
You will have to downgrade first to Froyo, yes.
**********But first check the link to see what chipset you have***********

And even if you have the "bad" chipset - it'll still be better to root and unlock. Only a small percentage of "bad" chips are actually bad and prone to failure.

Ok. I have a bad chip even after the replacement. wat to do now?

sagarparmar said:
Ok. I have a bad chip even after the replacement. wat to do now?
Click to expand...
Click to collapse
up to you. We cannot answer that. If you do everything correctly you shouldn't have a problem. but if you want to play it safe. get accustom to Espresso.

Don't worry too much about bad emmc chips. not all "bad" chips are bad. it simply means there is a higher chance of you getting a bad uhh phone. But most "bad" chips are able to flash perfectly fine.
Both good and bad chips have been known to brick, but the bad one is slightly more susceptible to bricking.
Mine is bad and I've been flashing non stop since Michael Jackson was still bad
Sent from my HTC Glacier using XDA App

Haha
And one more thing, are there any cases where non-rooted phones also got bricked?
Let's say, I get PIN for unlocking and then it bricks. Is it safe to even own MT4G? I am more worried because I am using it outside the states. If I were a tmo customer, I could always get a replacement.

Bricking should be very rare for stock phones. The only way I can think to brick would be to pull the battery during an OTA update.
Sent from my HTC Glacier using xda premium

I only want Sim unlock. I can do it via gfree. So here is what I am thinking.
First gain temp root with visionary and then push gfree (Follow 9 steps as per guide.) Any idea if ./gfree -f is required? Because I only want sim unlock(without root / s-off), I want to run ./gfree -S directly. Is this possible?
I am currently on 2.3.4 stock image. I will have to downgrade to 2.2 and follow the guide. But will I be able to again update to 2.3.4? Will lose the sim unlock?
THANKS IN ADV

sagarparmar said:
I only want Sim unlock. I can do it via gfree. So here is what I am thinking.
First gain temp root with visionary and then push gfree (Follow 9 steps as per guide.) Any idea if ./gfree -f is required? Because I only want sim unlock(without root / s-off), I want to run ./gfree -S directly. Is this possible?
I am currently on 2.3.4 stock image. I will have to downgrade to 2.2 and follow the guide. But will I be able to again update to 2.3.4? Will lose the sim unlock?
THANKS IN ADV
Click to expand...
Click to collapse
I do believe that that is possible. When I first did got root I used the root.sh method not the gfree method. Afterward I wanted to be able to Sim Unlock too. So a few months ago I did the gfree -S and my phone was fine. Granted I already had root, but I don't think that should be an issue. Also, back up your sd card first. Not sure why, but when I did the gfree it borked my sd card. I wasn't able to restore to my previous backup. I had to start over and reformat my sd.
Lol! Just realized I thanked your post while my computer was being a slow PoS!

I thanked your post and my PC was working fine

help unrooting (before warranty expires)

I need to return my g2 for warranty reasons (part of the touchscreen doesn't respond) but I'm having alot of trouble unrooting it.
the bootloader never recognized the pc10IMG.zip on my sd card.
I'm wondering if it's an issue with my bootloader?
I have S-OFF
HBOOT-0.76.2000 (PC1010000)
MICROP-0425
RADIO-26.03.02.26_M
eMMC-boot
any help will be greatly appreciated!

after having this issue for about 3 months, I've finally got it.
Formated a 2 gb sdcard and used that instead, it worked.

My rom is now stock, and so is my recovery, but the bootloader still looks the same, with fastboot and the skateboarding androids and everything.
is that the stock bootloader? I can't really remember, would like to make sure before I send it in.

Yes the bootloader is stock.
The only thing you might need to change is S-OFF back to S-ON
-Nipqer

s- on is a must *from experience*

MRguyandhis2 said:
s- on is a must *from experience*
Click to expand...
Click to collapse
What experience ?
I've swapped 3 g2's on hardware defects, no issues, very smooth process. I'm about to swap my last g2 for a cracked camera lens cover, if the warrantee is still valid. Yes, I received this g2 as a warrantee replacement, and notified them of the crack on arrival.
I keep reading about people having issues with warrantte, but never specifics.

lucky I didn't send it in yet, I completely forgot to check for S-off.
I'll have to check later, looks like I'm not sending it back till Saturday anyhow, but it's not as if I can actually use it while it's on stock since I'm on at&t and it's locked
when I was rooted with gfree, it unlocked itself, but now it's locked again, anyway to unlock it without voiding warranty? if not it's hardly going to matter.
Update: I put my sim in it and it's still unlocked! Hooray!
>update (again) : I can make calls, but no data
>>update: I'm absent minded sometimes.. that was because I needed to set att's apn
Also:
How do I check exactly (sorry, noob question) I can look for it a little more thoroughly tomorrow

don't think they care about the root, sent mine in many times with rooted roms and they seem to send my replacements and I'm on t-mobile, but just to be sure I don't think they care about S-on or off they might just care if the rom is significantly different like sense roms

I'm just really trying to make sure I get it unrooted correctly.
according to the guy on the phone, If I don't qualify for the warranty, my options will be to either pay for the repair, or pay $34 for their diagnostics on it (WTF?).
and the repair is going to be $100, since they'll going to replace the whole screen, even though I'm pretty sure the only issue is with the ribbon cable.
It's not going to hurt to make sure I have S-On, and it could potentially save me a lot of cash, so I might as well do it.
I'm pretty sure I only have to type something into the terminal emulator to find out?
not sure what that was though..

Well, my boot loader says S-off, and I can't figure out how to make it S-on since I don't have a part-7[something].bin on my SDcard.
from what I can find, I think I can make it S-on by using the official RUU, but I'm having trouble finding this, and almost tried to flash an ruu from the european HTC Hero (aka G2) by mistake.
[it's quite annoying that people call that the forums label that phone the G2 even though I don't think htc or any other carrier does in any case]
any help here? can I use somebody else's backup or would that result in a brick?
any alternative methods?
Update:
well apparently I can "Use gfree to set secu_flag = 1 and CID = T-MOB010 (or your corresponding original CID)."
although I'm not sure exactly how to do that.
I pretty sure it means that I could Gfree to gain temporary root, and then use the Terminal emulator to open up and modify a particular file in the system, and change the value of the parameter "secu_flag" to 1 (I'm not a complete n00b)
as for the CID, I think I may already have it set correctly, but it never hurts to check.
Am I on the right track?

almost right track.
Use psneuter to get temp-root, then run
./gfree -s on -c TMOB_010 (or whatever the cd is meant to be)
though psneuter only works for adb shell so you can't use term emulator to unroot.
and gfree only works on the 1.19 rom.
-Nipqer

If the screen is broken I believe all they do is change the screen and flash sense back on to it. I sent mine in with the screen not working and got the phone back with sense installed again + s-off. It looks like (for mine) they didn't care that it was rooted simply because it was a hardware fault and therefore did not matter whether it was rooted or not.
It is up to you whether or not you want to risk it, but with mine it was ok
Will check back with this thread when I get back from work in case I can help further!
Sent from my HTC Vision using XDA App

video
Zedomax has a guide on how to unroot the g2 on youtube. (not allowed to post a link)

I still can't get the S-off
Zedomax's video tutorial was pretty useless, he did the same thing I did, then booted into the bootloader and said "wierd it still says S-off..."
as for the the psneuters thing:
$ adb shell /data/local/tmp/psneuter kept getting permission denied
eventually I gave up and used vissionary to temp root.
then I pushed and did the chmod 777 step with gfree
but "# /data/local/tmp/gfree -s on -c T-MOB010" led to "/data/local/tmp/gfree: permission denied"
maybe I should try the "rage against the cage" root method?
I'm on 1.19.531 btw

Potential way to unlock bootloader?

Since we are using engboot, write protection seems to be off, so it appears you can use dd to write to normally write protected partitions such as the bootloaders (ex: "dd if=/sdcard/aboot of=/dev/block/sdd10"). In my testing I was successfully "dd" a backed up aboot (secondary bootloader) partition and also write to the modem partition and have it stick (which means write protection should be off akaik). If you were to "dd" the Chinese bootloaders, you might be able to flash and re-partition onto the Chinese firmware and then use the CROM service to unlock the bootloader from there. I personally don't know too much about this type of stuff and haven't tried to actually "dd" the Chinese bootloader, but for those more knowledgeable, could this potentially work?
Partitions likely needed are:
- rpm (Resource and Power Manager / Primary Bootloader) located at /dev/block/sdd1 (/dev/block/bootdevice/by-name/rpm)
- aboot (AP Bootloader / Secondary Bootloader) located at /dev/block/sdd10 (/dev/block/bootdevice/by-name/aboot)
- xbl (Extended Bootloader) located at /dev/block/sdb1 (/dev/block/bootdevice/by-name/xbl)
- ? located at /dev/block/sdc1
Modifying the bootloader is dangerous and could permanently brick your device. I take no responsibility if you try this and it breaks your device.
Edit 5: Additional Details

qwewqa said:
Since we are using engboot, write protection seems to be off, so it appears you can use dd to write to normally protected partitions (ex: "dd if=/sdcard/aboot of=/dev/block/sdd10"). In my testing I was successfully dd a backed up aboot (secondary bootloader) partition and also write zeros to the modem partition and have it stick (which means write protection should be off). If you were to dd a Chinese bl/ap, you might be able to flash/re-partition onto the Chinese firmware and then use the CROM service to unlock the bootloader from there. I personally don't know too much about and haven't tried to actually dd the Chinese bootloader, but for those more knowledgeable, would this work?
Edit: Modem partition sticks after reboot.
Click to expand...
Click to collapse
@Binary100100 you probably know somebody that knows little bit more about this, tell them to check it out

Magnifik81 said:
@Binary100100 you probably know somebody that knows little bit more about this, tell them to check it out
Click to expand...
Click to collapse
Nope. Don't know anyone specific.

Wish I had the $175 for my insurance deductible, I'd give it a try. All in all, it should work. The hardware is the same.

thescorpion420 said:
Wish I had the $175 for my insurance deductible, I'd give it a try. All in all, it should work. The hardware is the same.
Click to expand...
Click to collapse
Well, if it WORKS, I'm sure the bounty on unlocking the bootloader is a lot higher than $175! ?

DOMF said:
Well, if it WORKS, I'm sure the bounty on unlocking the bootloader is a lot higher than $175!
Click to expand...
Click to collapse
Lets start a thread . . . I am willing to contribute $25.00 :good: into a pool with others here at XDA to the developer who can produce an unlocked bootloader that is rooted with a decent rom that works great and better than stock, something that will fix all of the untold bugs and address the known issues.
Anyone else?

serendipityguy said:
Lets start a thread . . . I am willing to contribute $25.00 :good: into a pool with others here at XDA to the developer who can produce an unlocked bootloader that is rooted with a decent rom that works great and better than stock, something that will fix all of the untold bugs and address the known issues.
Anyone else?
Click to expand...
Click to collapse
$25? Hell think about how much we spend on the phone itself and bill every month.. I'd easily pledge $100 for an unlocked bootloader with twrp support.
That's the 1 thing I don't understand.. this is the most highly sought after phone right now with 0 developer support. I understand the limitations with the locked bootloader but other phones have overcome the same through the works of various motivated individuals. There is no one even interested in trying it seems on ANY carrier forum. Instead we have countless threads with people more interested in getting the nougat update early which will hardly provide anything useful compared to an unlocked bootloader with working root.

serendipityguy said:
Lets start a thread . . . I am willing to contribute $25.00 :good: into a pool with others here at XDA to the developer who can produce an unlocked bootloader that is rooted with a decent rom that works great and better than stock, something that will fix all of the untold bugs and address the known issues.
Anyone else?
Click to expand...
Click to collapse
"Start?" It was started ages ago and it thousands of dollars. https://forum.xda-developers.com/tmobile-s7-edge/how-to/bounty-unlocked-bootloader-s7edge-t3339857

bdvince said:
$25? Hell think about how much we spend on the phone itself and bill every month.. I'd easily pledge $100 for an unlocked bootloader with twrp support.
That's the 1 thing I don't understand.. this is the most highly sought after phone right now with 0 developer support. I understand the limitations with the locked bootloader but other phones have overcome the same through the works of various motivated individuals. There is no one even interested in trying it seems on ANY carrier forum. Instead we have countless threads with people more interested in getting the nougat update early which will hardly provide anything useful compared to an unlocked bootloader with working root.
Click to expand...
Click to collapse
Root right now is just too impractical for most people. I'm still rooted, but for most people it isn't worth the hassle and trade-offs, for many it's worse than stock. I think most people who are really into root probably switched devices. Switching to android N could actually prevent bootloader unlock in this way, unless root for N comes out. That is if this unlock method could actually work, hard to say without anyone experienced in bootloaders and write protection though.

I'd like to find someone with a sm-g9350 to DD a dump of sdd10.

thescorpion420 said:
I'd like to find someone with a sm-g9350 to DD a dump of sdd10.
Click to expand...
Click to collapse
Sdd1 is the primary bootloader, probably also necessary.

Came to the realization that the Chinese bootloader is v2 where all US models are v4. I'd imagine the Chinese nougat update will make it v4, so we wait to try.

Don't want to a be downer or anything but I'm pretty sure you can't just replace the bootloader, even if write protection is off on the Eng kernel. Even if you did replace it you'll have probably bricked your phone.
Sent from my SM-G935T using Tapatalk

dogredwing1 said:
Don't want to a be downer or anything but I'm pretty sure you can't just replace the bootloader, even if write protection is off on the Eng kernel. Even if you did replace it you'll have probably bricked your phone.
Click to expand...
Click to collapse
The thinking is that since the devices are virtually the same hardware wise, there is a chance the bootloader could be replaced. I do agree that there is a good chance of hard bricking though. I haven't done any testing other than apparently successfully dding a backed up version of the same bootloader.

If I wasn't on nougat I would try it if someone posted instructions and devs confirmed the directions are correct..
Sent from my SM-G935T using Tapatalk

I was actually playing with the bootloader, and found this thread when I went to post. I'm going to be pulling fastboot commands also to see if I can find anything interesting. I'm tired of not being able to use a custom kernel

My device is on nougat. Bit I can easily downgrade and test if someone has a rock solid idea. I don't mind bricking as the device has a cracked screen and I have my s6 edge plus to use until the s8 drops...
Sent from my SM-G935T using Tapatalk

Count me in as well!
I have a theory that we can open the BL file in WinRAR and extract the rpm.mbn file from G9350 odin file,
and flash to our device. But I cannot determine which one is for aboot. I have not tested this yet.

aaron007 said:
Count me in as well!
I have a theory that we can open the BL file in WinRAR and extract the rpm.mbn file from G9350 odin file,
and flash to our device. But I cannot determine which one is for aboot. I have not tested this yet.
Click to expand...
Click to collapse
What I know is:
RPM = Resource and Power Manager = Primary Bootloader
ABoot = AP Bootloader = Secondary Bootloader
I believe the boot process is "RPM > ABoot > boot.img (Main OS)", so both the rpm and aboot file would be needed. Also I think the partition layout in the Chinese version is slightly different, so a flash and repartition would be needed after replacing bootloader to actually root. I don't know what the chances success are though, the devices are virtually the same hardware wise, and the Chinese rom with the U.S. bootloader works according to the Verizon fourm, but there is a chance there are other differences what might prevent this from working.
Flippy125 said:
I was actually playing with the bootloader, and found this thread when I went to post. I'm going to be pulling fastboot commands also to see if I can find anything interesting. I'm tired of not being able to use a custom kernel
Click to expand...
Click to collapse
Isn't fastboot disabled on the s7. Also, were your results the same?

qwewqa said:
What I know is:
Isn't fastboot disabled on the s7. Also, were your results the same?
Click to expand...
Click to collapse
Yes, found that out when I started playing with it more. I'm currently reading sdd10 line by line. I did find an entry "Device is unlocked! Skipping verification...". I'm starting to think we need to look into recovery-side exploits. I'm too scared to try and mess with the bootloader too much.
EDIT: If we can find a way to get fastboot working, possibly piggybacking off of Odin, I found a command written in the aboot code 'fastboot oem unlock-go'
EDIT2: Using that command requires some sort of key. May be a dead end.
EDIT3: I'd be willing to test modifying the recovery image to see if it triggers the bootloader's hash checking. If anything, this could lead to writing a custom boot image that would open TWRP.

S-Off Achieved by Firewater Devs

https://www.xda-developers.com/firewater-devs-htc-u11-s-off/
https://twitter.com/firewaterdevs/status/889118758865960961
Exciting.:good:
don't bug them, but this is good news.

riggsandroid said:
https://www.xda-developers.com/firewater-devs-htc-u11-s-off/
https://twitter.com/firewaterdevs/status/889118758865960961
Exciting.:good:
don't bug them, but this is good news.
Click to expand...
Click to collapse
We will need to learn how to work around having temporary S-Off, so paying attention to the new flashing instructions is going to be important.

nice! :good:
no we can install AOSP to replace the factory version, and or install Lineage OS

Kisakuku said:
We will need to learn how to work around having temporary S-Off, so paying attention to the new flashing instructions is going to be important.
Click to expand...
Click to collapse
Well they'll for sure dig a little bit further until they release it. So let's see if temporary may become permanent on the initial, or any follow up, release. First of I'm glad to see that they found out how to do it. Those are the great news many have been waiting for.
Sent from my htc_pmeuhl using XDA Labs

5m4r7ph0n36uru said:
Well they'll for sure dig a little bit further until they release it. So let's see if temporary may become permanent on the initial, or any follow up, release. First of I'm glad to see that they found out how to do it. Those are the great news many have been waiting for.
Sent from my htc_pmeuhl using XDA Labs
Click to expand...
Click to collapse
Unfortunately the only way to get permanent S-OFF is an updated firmware that supports it. I was reading about it in the XTC2Clip forums. The product manager said that HTC may backtrack on it though because it's causing problems but didnt go into any further details. Also, it's impossible to set the phone back to factory right now. If you unlock the bootloader, the only thing that you can do is set the relocked flag thanks to temporary S-OFF which sucks considering HTC went back on their "U11 warranty even with unlocked bootloader" selling point. They say they are working on fixing that problem as well as adding SIM unlock in a future software update for the clip.
Things that the XTC2Clip can do right now with all the modules on the U11 (a 175 USD investment) - change CID, MID, downgrade firmware with temp S-OFF, unlock bootloader, etc.
If we don't get an engineering leak or HTC doesn't change course and put S-OFF back in, I doubt we will see it for awhile from the SunShine devs. Just because they got temp S-OFF doesn't mean they can make a nice easy to use tool. The phone now not only checks when the command is issued, it checks at boot and resets the flag. Trusted Reboot only works on that boot. It's going to be very easy to brick since the device goes right back to S-ON. If something wasn't successful, you've got a brick as soon as it reboots just like when people forgot to flash a RUU to go back to stock before going back to S-ON after modifying the firmware.
HTC engineering leaks have happened in the past when S-OFF couldn't be achieved so we will have to wait and see.

EtherealRemnant said:
Unfortunately the only way to get permanent S-OFF is an updated firmware that supports it. I was reading about it in the XTC2Clip forums. The product manager said that HTC may backtrack on it though because it's causing problems but didnt go into any further details. Also, it's impossible to set the phone back to factory right now. If you unlock the bootloader, the only thing that you can do is set the relocked flag thanks to temporary S-OFF which sucks considering HTC went back on their "U11 warranty even with unlocked bootloader" selling point. They say they are working on fixing that problem as well as adding SIM unlock in a future software update for the clip.
Things that the XTC2Clip can do right now with all the modules on the U11 (a 175 USD investment) - change CID, MID, downgrade firmware with temp S-OFF, unlock bootloader, etc.
If we don't get an engineering leak or HTC doesn't change course and put S-OFF back in, I doubt we will see it for awhile from the SunShine devs. Just because they got temp S-OFF doesn't mean they can make a nice easy to use tool. The phone now not only checks when the command is issued, it checks at boot and resets the flag. Trusted Reboot only works on that boot. It's going to be very easy to brick since the device goes right back to S-ON. If something wasn't successful, you've got a brick as soon as it reboots just like when people forgot to flash a RUU to go back to stock before going back to S-ON after modifying the firmware.
HTC engineering leaks have happened in the past when S-OFF couldn't be achieved so we will have to wait and see.
Click to expand...
Click to collapse
Yeah that's exactly what I thought but didn't explicitly state in my post above.
Sent from my htc_pmeuhl using XDA Labs

EtherealRemnant said:
Unfortunately the only way to get permanent S-OFF is an updated firmware that supports it.
Click to expand...
Click to collapse
Unless the development fuse isn't blown.

Patiently waiting

Kisakuku said:
Unless the development fuse isn't blown.
Click to expand...
Click to collapse
Which helps practically nobody. So again, it's back to the drawing board.

If testers are needed I am willing to have a crack at it. I have Australian Telstra firmware if that's of any use

Here you go.