Dumping flash from HTC Desire 510

[Spork Schivago]

Re: Dumping flash from HTC Desire 510

fastboot oem ? shows this:

C:\adb>fastboot oem ?
...
(bootloader)  #. <command>        : <brief description>
(bootloader) security_emmc_command:
(bootloader)  1. check_emmc_mid     : no desc.
(bootloader)  2. get_ext_csd_emmc    : no desc.
(bootloader)  3. get_sector_info_emmc  : no desc.
(bootloader)  4. get_wp_info_emmc    : no desc.
(bootloader)  5. load_emmc        : no desc.
(bootloader)  6. send_wp_info_emmc    : no desc.
(bootloader) security_command:
(bootloader)  1. boot          : no desc.
(bootloader)  2. cirfwflash       : no desc.
(bootloader)  3. clearaspflag      : no desc.
(bootloader)  4. erase_phone_storage   : no desc.
(bootloader)  5. eraseconfig       : no desc.
(bootloader)  6. battinfo        : no desc.
(bootloader)  7. gotohboot        : no desc.
(bootloader)  8. heap_test        : no desc.
(bootloader)  9. heap          : no desc.
(bootloader) 10. keytest         : no desc.
(bootloader) 11. powerdown        : no desc.
(bootloader) 12. readcid         : no desc.
(bootloader) 13. readconfig       : no desc.
(bootloader) 14. readimei        : no desc.
(bootloader) 15. readimei2        : no desc.
(bootloader) 16. readmeid        : no desc.
(bootloader) 17. readpid         : no desc.
(bootloader) 18. readsecureflag     : no desc.
(bootloader) 19. rebootRUU        : no desc.
(bootloader) 20. refurbish        : no desc.
(bootloader) 21. copyFotaBoot      : no desc.
(bootloader) 22. reset          : no desc.
(bootloader) 23. resetgift        : no desc.
(bootloader) 24. resethtcdebugflag    : no desc.
(bootloader) 25. task          : no desc.
(bootloader) 26. writecid        : no desc.
(bootloader) 27. writeimei        : no desc.
(bootloader) 28. writeimei2       : no desc.
(bootloader) 29. writemeid        : no desc.
(bootloader) 30. writepid        : no desc.
(bootloader) 31. writesecureflag     : no desc.
(bootloader) 32. dsiw          : no desc.
(bootloader) 33. dsir          : no desc.
(bootloader) 34. clear_atsdebug     : no desc.
(bootloader) 35. read_atsdebug      : no desc.
(bootloader) 36. dmesg          : no desc.
(bootloader) 37. last_dmesg       : no desc.
(bootloader) 38. get_identifier_token  : no desc.
(bootloader) 39. checkKeycardID     : no desc.
(bootloader) 40. readusername      : no desc.
(bootloader) 41. writeusername      : no desc.
(bootloader) 42. get_tamper_flag     : no desc.
(bootloader) 43. checkHWSecurity     : no desc.
(bootloader) 44. checkSbl1        : no desc.
(bootloader) 45. pmic8226_led_test    : no desc.
(bootloader) 46. MRW           : no desc.
(bootloader) 47. MRR           : no desc.
(bootloader) 48. off-mode-charge     : no desc.
(bootloader) 49. readredeemrecord    : no desc.
(bootloader) chipset_security_command:
(bootloader)  1. erase_nfc_record    : no desc.
(bootloader)  2. felicacal        : no desc.
(bootloader)  3. felicasetparam_secure  : no desc.
(bootloader)  4. felicagetparam_secure  : no desc.
(bootloader)  5. felicaponhigh_secure  : no desc.
(bootloader)  6. felicaponlow_secure   : no desc.
(bootloader)  7. lock          : no desc.
(bootloader)  8. ats           : no desc.
(bootloader)  9. ddr2gbh         : no desc.
(bootloader) 10. ddr2gstatus       : no desc.
(bootloader) 11. enableqxdm       : no desc.
(bootloader) 12. gencheckpt       : no desc.
(bootloader) 13. get_temp        : no desc.
(bootloader) 14. ramdump2gbh       : no desc.
(bootloader) 15. rtask          : no desc.
(bootloader) 16. validateimeihash    : no desc.
(bootloader) 17. to_sbldload       : no desc.
OKAY [ 0.431s]
finished. total time: 0.431s

The fastboot oem writesecureflag 0 errored out with a permission denied, but I could read the secure flag as 3 (the highest). The eMMC things do stuff. I didn't try the ones that I thought would erase it, but I was able to load the eMMC using load_emmc command. It wanted a length and start address. Then it told me where it was loaded into memory.

The dmesg shows the writesecureflag message:

(bootloader) [168855305] fastboot_command:[oem writesecureflag 0]
(bootloader) [168855322] fb_cmd_oem:writesecureflag 0
(bootloader) [168855373] register_debug_console: new entry ptr=0x10602b40
(bootloader) [168855400] [JAVACARD_ERR] SD/USBDISK Init error

Maybe if I put a MicroSD card in?

[Spork Schivago]

Re: Dumping flash from HTC Desire 510

the DCIM folder is the destination for stuff taken by the camera!
so you may want to check the date on the image and try and find out who she is.
be carefull about your legal situation though - your not supposed to have that personal image, and showing it around could be a problem.

They all say they're from November 26th, 2016, but when I run the fastboot oem <whatever the gettime function was>, it shows the current date as 12-31-2014, probably from me removing the battery. So I'm pretty certain they were put here on the 26th of November, 2016.

Going through the dmesg log, from when it was booting (before I started typing commands), I see some weird stuff:

(bootloader) [1468580] [PGFS] partition_read_pgfs: pg1fs_simlock
(bootloader) [1478226] read_simlock(1018): BB96D15E, F1D6A6BE
(bootloader) [1478453] radio_init_secure_smem(866): C9F35678, 0
(bootloader) [1479742] [PGFS] partition_read_pgfs: pg1fs_simlock
(bootloader) [1489354] read_simlock_password(294): 40, 6D, D8, C4
(bootloader) [1489387] unlock_rec[0] = 0x10a09000
(bootloader) [1489400] [PGFS] partition_read_pgfs: pg1fs_simunlock
(bootloader) [1499039] unlock_rec[1] = 0x10a0a000
(bootloader) [1499052] [PGFS] partition_read_pgfs: pg1fs_simunlock
(bootloader) [1508680] simlock_passwd 0x10a08000
(bootloader) [1509113] secure_update_simlock ret = 0
(bootloader) [1509174] final simlock 0
(bootloader) [1509333] secure_set_simlock ret = 0

Think we can use that for something?

I also see:

(bootloader) [1468580] [PGFS] partition_read_pgfs: pg1fs_simlock
(bootloader) [1478226] read_simlock(1018): BB96D15E, F1D6A6BE
(bootloader) [1478453] radio_init_secure_smem(866): C9F35678, 0
(bootloader) [1479742] [PGFS] partition_read_pgfs: pg1fs_simlock
(bootloader) [1489354] read_simlock_password(294): 40, 6D, D8, C4
(bootloader) [1489387] unlock_rec[0] = 0x10a09000
(bootloader) [1489400] [PGFS] partition_read_pgfs: pg1fs_simunlock
(bootloader) [1499039] unlock_rec[1] = 0x10a0a000
(bootloader) [1499052] [PGFS] partition_read_pgfs: pg1fs_simunlock
(bootloader) [1508680] simlock_passwd 0x10a08000
(bootloader) [1509113] secure_update_simlock ret = 0
(bootloader) [1509174] final simlock 0
(bootloader) [1509333] secure_set_simlock ret = 0

Wonder if there's some special USB to MicroSD card that can make it do funky stuff.

**EDIT:
I ran:

 fastboot oem load_emmc 2048 0
...
(bootloader) addr=0x11004000, len=2048, start_set=0
OKAY [ 0.000s]
finished. total time: 0.000s

and now I'm doing a ramdump to MicroSD.

It's dumping:

0HB_LOG.RAM
0HB_LAST.RAM
0LAST_K.RAM
0OCIMEM.RAM
0CODERAM.RAM
0DATARAM.RAM
0OMSGRAM.RAM
0LPM.RAM
0DDRCS0.RAM
0WCN0.RAM
0SECSMEM.RAM
0SMEM.RAM
0TZ.RAM

I wonder if that eMMC that I loaded is in one of those files....

[goontron]

Re: Dumping flash from HTC Desire 510

^Well, you have verified you have no sim-pin.

[goontron]

Re: Dumping flash from HTC Desire 510

Do "fastboot oem list_partition_emmc"

[gabiz_ro]

Re: Dumping flash from HTC Desire 510

I can give you the eMMC pinouts for the OPCV200 Desire 510. This is the OPCV100. I think I even posted the pinouts on the first page, thinking the board would be the same, but it's not.

How does that Z3x work? Do you need to hook up to the JTAG TAPs or can you do it all over the USB cable or something? Maybe the 0PCV200 is CDMA and the 0PCV100 is GSM? I also have the JTAG pinouts for the OPCV200, but I think you do as well, if you have the Z3x. They're in the c:\Program Files\Z3X\EasyJTAG\PinoutsJTAG\HTC_Desire_CDMA.jpg file.

I think you might find problems with hooking up to the JTAG interface though. I think the issue is something with the Vcc dropping after so many seconds.

Thanks and please keep me posted on your progress.

OPCV200 is GSM
I'll connect to EMMC directly (clk,cmd,dat0,1.8V,2.8V gnd) not via CPU.
There is adapter that supply EMMC with 1.8V and 2.8V but sometimes require to have USB cable conected to keep PMIC (phone power IC) alive.
But since only one data pin is used for reading take some long time to dump full 8GB or more or less chip.

(bootloader) [1468580] [PGFS] partition_read_pgfs: pg1fs_simlock
(bootloader) [1478226] read_simlock(1018): BB96D15E, F1D6A6BE
(bootloader) [1478453] radio_init_secure_smem(866): C9F35678, 0
(bootloader) [1479742] [PGFS] partition_read_pgfs: pg1fs_simlock
(bootloader) [1489354] read_simlock_password(294): 40, 6D, D8, C4
(bootloader) [1489387] unlock_rec[0] = 0x10a09000
(bootloader) [1489400] [PGFS] partition_read_pgfs: pg1fs_simunlock
(bootloader) [1499039] unlock_rec[1] = 0x10a0a000
(bootloader) [1499052] [PGFS] partition_read_pgfs: pg1fs_simunlock
(bootloader) [1508680] simlock_passwd 0x10a08000
(bootloader) [1509113] secure_update_simlock ret = 0
(bootloader) [1509174] final simlock 0
(bootloader) [1509333] secure_set_simlock ret = 0

That is normal,is related to simlock.
Some of them are sim free aka network unlocked some of them are sim locked,network locked by operator.Will work only wit sim card from that operator,when insert another sim from other network will require unlock code.
https://forum.xda-developers.com/sho...75&postcount=6

[diif]

Re: Dumping flash from HTC Desire 510

Notice most are Windows yeah? A Linux boxen would be able to understand the filesystems that Windows needs special software to read, and can even make sense of the partition table, which again, needs compatibility layers for Windows. On Linux, a partition table image "GPT.bin" would help. Otherwise the data you are looking for is on either a Jffs2, FAT (on real early devices), or EXT filesystem.

That specialized software is there because being a Unix/Linux/BSD engineer is hard.


Now: Spork. Are you just trying to unlock the phone for use? If so you can wipe data from fastboot.

So all these data recovery specialists are wasting their time and money when all they need to do is switch to Linux ?
No, the software repairs bad blocks, organises the Nand into order and does lots more than just read the filesystem. It's specialised as it does specialised tasks. Even a Linux box would need similar software.

[stj]

Re: Dumping flash from HTC Desire 510

simlock is interesting - for future use i mean.
it's the lock that forces the phone to only work on a specific carriers sim.

[Spork Schivago]

Re: Dumping flash from HTC Desire 510

^Well, you have verified you have no sim-pin.

Where do you see that there's no sim-pin? I thought the simlock_passwd 0x10a08000 would mean there was a sim-pin. I'm trying to understand some of the stuff from the dmesg log and some of the fastboot oem commands.

It's a bit hard to find info on them. Like the fastboot oem load_emmc <len> <start> command...I've googled and see where people run it, but I can't find much info on it. I think maybe because different manufacturers might implement different functions there. For example, one manufacturer's load_emmc command was something like <size> <start sector> <end sector> <something else> or something like that.

I wonder stuff like is length in bytes, megabytes, sectors, etc? I wonder if there's a function to read the memory address via fastboot. When I run fastboot oem load_emmc 2048 0, it gives me an address where it's been loaded into memory....

There's a RAM dump feature, maybe it dumps where it was loaded into memory? One of the dump files is around 1GB in size...

Thanks.

[Spork Schivago]

Re: Dumping flash from HTC Desire 510

Do "fastboot oem list_partition_emmc"

I've tried that and the fastboot oem read_emmc, both are invalid commands and error out. I even check the dmesg log, just to make sure it doesn't register and I'm using invalid parameters or something. Those two functions just don't exist or aren't enabled.

There's stuff on using this xtc-2clip. If I understand it correctly, it's a cable that hooks to the PC and also to the phone, in the MicroSD slot or maybe the USB port.

I found a few websites that claim to sell the xtc-2clip, but I can't tell which one is the real website. I think it's this one, and this is what it says:

Offline mode – create files manually

If you need to create service files on your PC with no XTC 2 Clip software installed, you can manually create these files for:

IMEI change/repair – imei.txt
Security level change – sf.txt
CID change – cid.txt
Please note, that unlike the above mentioned files, SIM lock configuration ‘config.dat' is a binary file and you may need to use a hex editor to create it. Therefore, we recommend you to use XTC 2 Clip software to create/manage this file.

Note! You can use the "Notepad" software in order to create/modify files.

I've seen a website that can create this config.dat file, but they say the bootloader needs to be unlocked first (or maybe the phone needs to be s-off'd first, I dunno). But I wonder if there's anything I can do with that info. I've seen the phone in one menu or another actually try to load stuff like the imei.txt and sf.txt files or something like that....It was either when I clicked on the SIM Lock menu function or when I did weird stuff and went into Recovery and then hit the Power and Volume UP button's to get into some menu.

Here's the website with the instructions I mentioned:
http://xtc-2-clip.com/how-xtc-2-clip-works/

[Spork Schivago]

Re: Dumping flash from HTC Desire 510

OPCV200 is GSM
I'll connect to EMMC directly (clk,cmd,dat0,1.8V,2.8V gnd) not via CPU...

Okay, thanks. Let me know how it works. If the boards were similar enough, I could just use those pinouts, but my board here is too different. If I pulled the flash, I could figure out the eMMC pinouts. I believe I know the pinouts on the BGA chip. Maybe I can order a broken phone with the OPCV100 and remove the flash and figure them out that way?

(bootloader) [1468580] [PGFS] partition_read_pgfs: pg1fs_simlock
(bootloader) [1478226] read_simlock(1018): BB96D15E, F1D6A6BE
(bootloader) [1478453] radio_init_secure_smem(866): C9F35678, 0
(bootloader) [1479742] [PGFS] partition_read_pgfs: pg1fs_simlock
(bootloader) [1489354] read_simlock_password(294): 40, 6D, D8, C4
(bootloader) [1489387] unlock_rec[0] = 0x10a09000
(bootloader) [1489400] [PGFS] partition_read_pgfs: pg1fs_simunlock
(bootloader) [1499039] unlock_rec[1] = 0x10a0a000
(bootloader) [1499052] [PGFS] partition_read_pgfs: pg1fs_simunlock
(bootloader) [1508680] simlock_passwd 0x10a08000
(bootloader) [1509113] secure_update_simlock ret = 0
(bootloader) [1509174] final simlock 0
(bootloader) [1509333] secure_set_simlock ret = 0

That is normal,is related to simlock...

So those passwords listed there can't help in anyway? If I had the sim card, I couldn't unlock it with any of those passwords?

Thanks.

[stj]

Re: Dumping flash from HTC Desire 510

when a fone uses the term "simlock" it's about locking the fone to the sim in some way.
the common way is to lock it to the carrier i.d. so you cant get a subsidised fone and put the competition's sim in it.

another level you can set yourself is to set the fone to only accept the exact sim - probably based on it's IMSI.

it has nothing to do with locking out the user, only locking out unwanted sims.

one other thing, the sim has a microcontroller in it everything to do with the sim pin and puk codes is handled inside the sim - the fone just acts as a terminal to get input and relay messages.

[Spork Schivago]

Re: Dumping flash from HTC Desire 510

If I could find away to turn the S-On to S-Off without losing data, I think I can install a patched HBoot without destroying data, install a custom recovery, and away we go.

I was thinking that because of this thread:
https://forum.xda-developers.com/sho....php?t=2585070

The person wants to unlock the bootloader so he can flash a custom recovery without losing data. The explain the process a bit, but his phone is already set to S-Off. From what I've read, I can use that Sunshine website or that HTCDev script to turn S-Off, but they all involve erasing all the data. Sunshine says it's to prevent unauthorized access to the phone, which would imply maybe it's possible without erasing the data or something?

[goontron]

Re: Dumping flash from HTC Desire 510

So all these data recovery specialists are wasting their time and money when all they need to do is switch to Linux ?
No, the software repairs bad blocks, organises the Nand into order and does lots more than just read the filesystem. It's specialised as it does specialised tasks. Even a Linux box would need similar software.

So Badblocks, something that is done in the kernel, then unknowns that you seem to fail listing, and yet you have these that also suggest otherwise. (hint, read the review)

Now, for say a BREW device or iDevice, yeah, you will need special software. For an Android device, no.

[diif]

Re: Dumping flash from HTC Desire 510

So Badblocks, something that is done in the kernel, then unknowns that you seem to fail listing, and yet you have these that also suggest otherwise. (hint, read the review)

Now, for say a BREW device or iDevice, yeah, you will need special software. For an Android device, no.

Sorry to disagree again but if you skip past the single obviously fake Amazon review and head to their youTube channel you see that software is required.
http://www.allbalancetech.com/produc...re-for-ds3000/
And looking at this software it's very limited in it's function.
The software/hardware I was looking at is about £1500 but does all flash types from all devices.

[goontron]

Re: Dumping flash from HTC Desire 510

Well, we will find out. I'm about to do it myself with a torn apart SD/MMC adapter, the eMMC out of a Motorola Droid Razr, and my shoddy micro soldering skills. ill post another thread on the subject and drop a link to it here.

[diif]

Re: Dumping flash from HTC Desire 510

Well, we will find out. I'm about to do it myself with a torn apart SD/MMC adapter, the eMMC out of a Motorola Droid Razr, and my shoddy micro soldering skills. ill post another thread on the subject and drop a link to it here.

Excellent, I'll keep an eye out for it. Whilst I'm not doubting reading it should work, I think the hard part will be mounting then reading the dump.
The expensive stuff I was looking at is here. http://rusolut.com/
Good luck.

[gabiz_ro]

Re: Dumping flash from HTC Desire 510

So those passwords listed there can't help in anyway? If I had the sim card, I couldn't unlock it with any of those passwords?

Thanks.

Nothing usefull.
You can see final result
final simlock 0
That means is not simlocked,if something differs and final result is 1 by example phone will not accept sim card from other network,only from one that is locked to.

[Spork Schivago]

Re: Dumping flash from HTC Desire 510

Excellent, I'll keep an eye out for it. Whilst I'm not doubting reading it should work, I think the hard part will be mounting then reading the dump.
The expensive stuff I was looking at is here. http://rusolut.com/
Good luck.

I don't think it will be hard with a phone running Android. I think they're using a common file system. I know with some routers, the firmware file at least, we were able to extract the file system part and mount it in Linux. I'd imagine that router extracts the file system image from the firmware file that gets uploaded to the router, and then just writes the image directly to NAND.

With something like the 3DS, I don't think we could just mount anything extracted from the NAND, not without specialized software. Same with the Rigol power supply.

I could be wrong though. I'm interested in seeing the outcome.

[Spork Schivago]

Re: Dumping flash from HTC Desire 510

Nothing usefull.
You can see final result
final simlock 0
That means is not simlocked,if something differs and final result is 1 by example phone will not accept sim card from other network,only from one that is locked to.

Hmmm. So, a lot of phones normally come locked, even if you buy them straight out, right? With my wife's phone, we paid full price and it was locked to AT&T. We were allowed an unlock code from them because we paid full price. Only a few phones (maybe Google phones, for example) come carrier unlocked, correct?

Could this imply that perhaps the person did something to remove the simlock? Maybe ran some sort of script on it or something?

[goontron]

Re: Dumping flash from HTC Desire 510

Hmmm. So, a lot of phones normally come locked, even if you buy them straight out, right? With my wife's phone, we paid full price and it was locked to AT&T. We were allowed an unlock code from them because we paid full price. Only a few phones (maybe Google phones, for example) come carrier unlocked, correct?

Could this imply that perhaps the person did something to remove the simlock? Maybe ran some sort of script on it or something?

And if you buy from the Mfg. Like my Moto G is unlocked. I bought it from Motorola's website.