yashsingh1/xdaforums huggingface dataset:
[HTC One X] ChronoWerX:
This will work for you?

http://onexroot.com/one-x-root/root-any-htc-one-x-windowsmaclinuxattinternationalone-click-method/

My devices is still unroot after this
[HTC One X] theliquid:
I think this is the exploit which was posted here previously ... This doesn't work for the international version, as you can see in the comments ... :/

And this gives normally only temp-root.

The "real" exploit is here:
[HTC One X] tids2k:
Has anyone got OTG working ?
[HTC One X] MySam:
Still waiting for SE Asia 1.29.707.xx

http://db.tt/CompiYU7
[HTC One X] Evil-Dragon:
Just thought i'd drop this in as a personal experience while trying to get my phone into APX mode. I did manage to get a 'unrecognised driver' prompt when i was doing the following:

1) Unplug the usb cable

2) Reboot into Hboot and choose 'Power Off'

3) Press both Volume keys

4) Plug in the USB cable

5) Press and hold the Multitasking touch key

6) Power on the phone

I have been unable to replicate the unrecognised driver prompt again, which is really annoying but it's worth mentioning and care in mind it's a real juggle to manage to hold all the keys while doing this. It could just be a timing issue so maybe it's worth others having a go or trying other touch keys. USBDeview gave the following information about it:

Port_#0002.Hub_#0009	Unknown Device	Unknown	No	No	No	No	19/05/2012 09:27:31	19/05/2012 17:14:31	0000	0000	0.00	00	00	00	Hub 6, Port 2	USB	(Standard USB Host Controller)	Unknown Device	6.1.7601.17586	USB\VID_0000&PID_0000\6&1bb4e2b7&0&2
[HTC One X] retschy:
I got this after your steps
[HTC One X] Evil-Dragon:
That's why i said i can't replicate it, i've just been trying again with no luck.
[HTC One X] pdagenius:
Nope - not with my phone either :mad:
[HTC One X] GabrielSousa:
you know if unlimited.io team is working on s-off HOX ? (revolutionary.io only works on Qualcomm)
[HTC One X] riemervdzee:
@EVE, Hmm ****, finally been reading the last messages. Just had the hope we could get something going, then we end up with posts like these :-/

Should have said it then, but screw the bounty. Never liked donations to be honnest..

If you are still there (or any other), got any pointers on serial connections with the phone? I think I'm going to attempt to get one via headjack. Any papers/topics etc. on how others did it is quite welcome.

Edit: My biggest question is, should we try a 4 contact jack-plug? I would say we only need tx, rx and ground. I tried a 3 contact plug just very quickly the other day with an oscillator, but I couldn't get any signal back.
[HTC One X] smoke2:
Did you updated your firmware to version 1.29.401.11 with new h-boot 0.95?

I still not because is there a bigger chance to do s-off on h-boot version 0.94?

Am I right?
[HTC One X] BeciMester:
Just one more week and my final exams are over. I'm following this thread since day one and can't wait to finally contribute something. :)

I'll do a detailed comparison of the old and new hboots if nobody does it until then. I think the only reason for HTC to update the hboot is to fix something, hopefully some vulnerability they've found and we haven't (yet!). It'll be interesting to see. Also the code Evil-Dragon posted about entering nvflash mode is worth an investigation.

And for the record: I'm completely against the idea of a bounty. It's not what XDA should be about. If we keep paying people for discovering things we'll just end up with another XTC-clip with a greedy wanker behind it. :rolleyes: I think E:V:A is right and I'm sad to see him go.

You know the tale of the wise man who was asked why money corrupts people. He said 'Look out the window, what do you see?' The asker said 'The street. People. A mother with her baby. An old man on the bench.' The wise man then said 'Look into the mirror, what do you see now?' The asker said 'I see myself.' The wise man then said 'See, both are the same sheet of glass. All it takes is a thin layer of silver and you instantly can't see anything but yourself.'
[HTC One X] globatron:
I will have to make the same response as IEFtm on this one. It would be very unlikely and for the same reason, our experience is also with Qualcomm devices.
[HTC One X] tids2k:
@xmoo where did u get the NVIDA Technical Reference Guide snippet from ... ???
[HTC One X] kfasheldon:
Hi, no idea if this HP's but looks like a promising development to me.

Noticed sensation xl (runnymede) just got s-off solution , someone has patched bootloader and succeeded in bypassing s-on and cid checks so all stock and custom roms should work , all parts can be flashed , maybe he has ideas that would work here
[HTC One X] pdagenius:
Maybe someone from this thread who has been looking at our hboot could pm the Sensation XL chap for some help?

Sent from my Galaxy Tab 10.1 with Tapatalk
[HTC One X] riemervdzee:
Anyhoowz...., I think I'm going to try a serial connection tomorrow at university. Maybe something interesting pops up, first thought is still the jack. But maybe it is also obtainable via pogo? Anyone know the internal serial names for pogo and/or jack used in the kernel?

Cheers, R
[HTC One X] Sentinel196:
Back on topic, it was mentioned a week or so ago that Cotulla (from DFT, the guys who cracked the HD2) are onboard and helping out. Any news from them in the IRC channels?
[HTC One X] broncogr:
Thread cleaned.

Stay on topic please...
[HTC One X] Evil-Dragon:
Tried contacting HTC about Apx mode. Guess what. They won't tell. Period. I guess it's back to figuring it out ourselves.
[HTC One X] Sybregunne:
Anybody with a rooted phone willing to try something else?

open up /etc/permissions

then look for the file platform.xml

add the following line:

<assign-permission name="android.permission.DIAGNOSTIC" uid="shell" />

theoretically this should give adb diagnostic permissions. :D

try to dd to hboot if you dare. :D
[HTC One X] mattman83:
DD is just a dump, correct? If you can give me an exact command I'm happy to.

M.
[HTC One X] keroro430:
dd will also write something. What a good try!
[HTC One X] tids2k:
what do u mean by internal names are u referring to the resistors or Pins ?
[HTC One X] co@ch:
dd what to hboot? A dump of a S-OFF hboot? :confused:
[HTC One X] mattman83:
An S-OFF HBOOT is no different to an S-ON HBOOT. You want whatever partition contains the S-OFF flag ;) Or as done on Desire, a modified HBOOT that ignores the flag.

M.

Edit - change made in permissions... someone give me an adb line to test. Not familar with DD (something harmless would be even better :p)
[HTC One X] co@ch:
So what's the use of the HBOOT 0.43 S-OFF rfs.img stated in 1st post? :confused:
[HTC One X] mattman83:
Not much.

M.
[HTC One X] themono:
Unless you can figure out a way to mod it to ignore the s-on flag, as mentioned above, and then figure out a way to flash it. I can do neither of these things, but to someone much more talented than me it's not totally useless.
[HTC One X] Appsdroid:
HTC Customer Reations Team

Hi Guys

Just for reference ive had a long conversation with a HTC Customer Realtions Manager relating to a complaint i made about HTC responses to my enquiries relating to s-off and apx mode.

Hes written a complete report and is sending it across to the Management Team for review etc. One of the main points i made was the phone is released not fit for purpose. I purchased this phone with the understanding id be able to use apps off the android market. Any apps requiring s-off or root no longer function on this phone which means the phone is not fit for the purposes for which i purchased it. Im not convinced ill get anything back from this but im thinking the more complaints they have relating to this the more likely someone will get off their arse and give some advice. I dont expect them to make my phone s-off but i dont expect them to make it so difficult for me to do myself. Ill keep you posted if i do hear anything.
[HTC One X] Chezbel:
I suppose this link is technically off topic since it is mostly related to HTC Vision, but it might give someone an idea and for those without much experience in this area it may be a useful learning tool.

http://tjworld.net/wiki/Android/HTC/HackingTools
[HTC One X] xmoo:
Guys, Ill be back from holidays this weekend. Than ill be back.
[HTC One X] Appsdroid:
Hi Guys

Come across this im not sure it will help at all but thought it might be worth checking

http://www.htcdev.com/devcenter/downloads

Its a link to the htc one x source code from htc thought we might be able to pin point certain features etc
[HTC One X] Nubzori:
Old news ;)
[HTC One X] techmatlock:
So is apx mode most likely going to be accessed via pogo pins?
[HTC One X] theliquid:
We can't be sure until someone manages to access it ...
[HTC One X] smoke2:
Please answer me :confused:

Do you updated your firmware to the newest version 1.29.401.11 with new hboot 0.95?

Im afraid that on the newer version will be harder to do s-off.

Am I right?

Thank you.
[HTC One X] Polarfuchs:
That's equal. We haven't S-Off with hboot 94 as well. So why care about upgrading
[HTC One X] smoke2:
So why then HTC change hboot version in latest OTA update?
[HTC One X] colin_404:
Maybe they needed to change Hboot to fix the disappearing sd card storage problem,(or maybe not).
[HTC One X] Rekoil:
When it comes to matters about things that can't be downgraded (but can be upgraded at any time), then it is always best to stay on the lowest possible version so as to make sure you are able to get to the exploitable version when one appears. If it turns out there's an exploit for 0.43, but not for 0.94 or 0.95, (or 0.94, but not 0.95, then 0.43 people can upgrade, but 0.95 guys are in the dark again). In these circumstances, those who have upgraded will be sore out of luck, same goes for the Radio, since it can't be downgraded it's best to stay on original version until we know for certain which version is needed for a certain exploit.

There are of course exceptions to this, like, say a certain version was just completely unusable, then you should of course upgrade, but the only problem with HBOOT 0.43 is that you can't use "fastboot boot", and that is a minor inconvenience for me, certainly not worth potentially missing out on S-OFF :)

Unlikely scenario, /mnt/sdcard storage problem has probably got to do with something much higher up. It is, for example, not present in the early CM9 roms that TripNRaVeR have put together.
[HTC One X] Sybregunne:
this in theory gives diagnostic privileges to adb shell... and adds the shell uid to the input and diag gid.

dd is a powerful command and can be used to perform bi-directional writing. There was a dumped hboot out there that someone modified to ignore the s-on flag... all you have to do is to dd it to the correct partition.

dd if="input_file" of="output_file" in linux some (if not all) devices are treated as files for easy input.

so for example you can issue:

dd if="kernel-boot.img" of=/dev/block/mmcblk0p4

check here for more info on partitions... http://xdaforums.com/showthread.php?t=1551581
[HTC One X] pdagenius:
Am very happy to try and enable dd with adb but can you clarify the test you are suggesting please. Would the kernel-boot.img be the kernel boot.img for the rom I am using - eg I am using bricked kernel? What would we expect from a successful command? Thanks
[HTC One X] blubbers:
this won't give you access to the hboot partition because the kernel doesn't even know about the hboot partition
[HTC One X] Arthas92:
i'm not learn much about kernel and mobile

But some time like C, we can access to other data by the address(like you have address x of an variable and you can access to the address x+n)

i know it is difference between address in program, logical partition or hardware address,.... the type of partition effect to the way it store file to

but can we access to the hboot partition by the real begin address on the flash chip and use it to write in to there by the kernel or some thing lika that?
[HTC One X] blubbers:
if you don't have a device node pointing to the corresponding address on the device, you cannot read nor write to it.

http://xdaforums.com/showpost.php?p=25788378&postcount=1295
[HTC One X] pdagenius:
So is it a waste of time trying advice dd commands or not? Am confused.
[HTC One X] blubbers:
yes, unless you tell the kernel where the hboot partition is and got some exploit to disable the protection that disables read (and write) access
[HTC One X] Ga73:
Probably no help for our phones but nice to see another htc device getting s-off..

http://www.xda-developers.com/android/more-s-off-for-the-remaining-htc-devices-sensation-xl/
[HTC One X] blubbers:
too bad we can't remove our battery easily, maybe the device would enter nvflash if hboot is corrupt
[HTC One X] mikep1993:
is it already possible to access those partitions with a custom kernel or are there custom kernels with the option to read those partitions?
[HTC One X] blubbers:
no, i've tried that
[HTC One X] mikep1993:
is there a way how we are able to gain temp-root without htc dev? I think not. right?
[HTC One X] Evil-Dragon:
I've done all the work i can on this now so i'm offering it up to someone else to have a look through and work on it further. It's 80-85% disassembled but alot of it is code and ascii strings, you will need to find the hboot entry point, define the data, arrays, etc..

It's very new to me so this is as far I as I can get with it, i've practically worn out my C key on my keyboard converting it all to ARM code.

If you want to work on it further you'll need IDA 6.1.11, please feel free to share back any discoveries you make: https://www.box.com/s/5ba363df4b7d103d33b2

Press thanks if you found this useful. :)
[HTC One X] ste1164:
Not at the moment PaulOBrien tried a temp root method similar to that of the s4 one x but it did not work unfortunately :(
[HTC One X] blubbers:
ever considered "begin-selection", select a large region, and hit C? ;)
[HTC One X] Evil-Dragon:
Yes, however I didn't want to convert all the hboot to code there was some data and ascii strings that would have been converted that I didn't want converted. Some of it was done this way.
[HTC One X] wwwalex:
Thank you mate. We do appriciate your contribution.

I extracted hboot_0.43.0000.img from rom.zip (exec RUU) and it has a some kind of header:

00000000: 01 E1 BD DC-FE 78 08 20-BD 2F 68 FB-A0 DD C9 25
00000010: 65 C2 85 F7-2A A0 7C C5-B0 88 0E FB-DB 24 6B 35
00000020: 6B 9A 22 25-1A F9 51 78-51 CF 63 C4-9F AC F2 B0
00000030: 41 FA 1B 04-7E DB 49 A2-7D 47 1B 31-55 73 22 AF
00000040: A8 5C 76 C1-5D BB 26 CB-B6 10 F1 30-2F E7 BD 3E
00000050: 2D 42 23 D7-8A E5 7B 5F-F0 1D 52 27-FC C4 0A E1
00000060: 90 CE E0 E0-66 FC 54 03-6E 33 D4 32-14 4A B6 55
00000070: 21 E1 72 FF-8B E7 A5 94-2F CD 4A 2C-E1 A5 E8 53
00000080: F1 29 DF 60-2B 64 57 87-F4 03 54 A7-41 EF FA 63
00000090: 14 FF 5C 6B-BB D2 C4 AF-34 77 E2 31-83 E0 D9 27
000000A0: 92 CF 99 B8-14 0F 26 56-F8 F3 E6 1E-A3 C9 43 BB
000000B0: 18 ED 86 E4-61 BD B9 BE-37 3A 64 0E-E5 57 58 4E
000000C0: B8 E9 56 CF-B4 69 D7 2D-3E 3B D0 76-F3 85 63 2A
000000D0: 56 20 3D 62-11 4A F6 19-BD DE C4 7F-D9 C6 27 22
000000E0: 4F DC 0A AC-22 0A 57 AF-73 26 21 16-60 35 CD C5
000000F0: C6 87 B2 A3-F0 93 A4 6F-A4 F7 5C A2-6E 09 E5 51

After it hboot is same as yours at beggining.

What is this header about?
[HTC One X] Evil-Dragon:
Could you send me that version? That is why the data referenced in mine was wrong.
[HTC One X] blubbers:
All .img's are signed, the first 255 bytes. It won't fix your reference problem by removing the signature
[HTC One X] Kickasskev:
I mailed this guy asking if he could help out here, but he said he tried a way for the one s and he bricked it, he says its lenghty and time consuming to break down and decompile everthing, not the easiest of jobs with the phones being more and more advanced

was worth a try
[HTC One X] mikep1993:
Had a try with him earlier today without luck. After that he tried it with a htc one s.

He is a great man :) it was worth a try.
[HTC One X] wwwalex:
Thanks. I would expect signature at the end of image actually :)

Wouldn't 0x100 shift caused by signutare at the beggining of file affect IDA's analysis? (excluding those refs which are bond to PC probably)
[HTC One X] galaxys2Tav:
Just fort id give you my imput to what i have done with htc i mailed them asking about the s-off to wich there reply was if you load a custom rom after unlocking with htcdev.com it will change to s-off automaticly.

I then went on to tell the person this was not the case and it stays at s-on no matter what. I then asked if there was anyother in which she could help and to reply with they would speak to there line manager tomorrow and i would receive an email tomorrow with help on how to get s-off.

What is needed specificly and i can always try and get it.

P.s sorry if i sound stupid its just im new with htc but i no i need s-off
[HTC One X] blubbers:
Most of the offsets are relative
[HTC One X] 1000moths:
Sounds like this is the standard answer from HTC support agents now, I have no doubt they're getting hammered with this question and are just throwing everyone the old "i'll ask my supervisor to mail you" line. I wouldn't hold your breath for that answer ;) I got told to tweet HTC dev about S-OFF, no response whatsoever.

Also reading the very last section of the FAQ on the bootloader unlock site:

"Why is my security still on (S-On) after I have unlocked my bootloader?

Your device is shipped with Security on (S-ON) to protect your system software configuration (such as the bootloader, radio, boot, recovery, system and others). After you have unlocked the bootloader, however, you will have lifted the restrictions on boot, recovery and system. This means you can customize boot, recovery and system images on your phone as you desire. You can easily see that you have successfully unlocked the bootloader by looking at the top of the screen when entering the bootloader screen. Security is left on to protect things like the radio, and SIM lock."

NEVER going to get S-OFF from HTC as carriers would go apeshite.
[HTC One X] mattman83:
That's the important part. It's not HTC policy - it's carrier policy. They might be able to negotiate on future handsets but they aren't going to be able to back out of a locking agreement on a phone that's already on the market. (why HTC are bound by these agreements and not, say, samsung, I have NFI)

Yet another reason to hate US carriers.

M.
[HTC One X] KrisPerry:
Not just US
[HTC One X] wwwalex:
Ok... what virtual address hboot is loaded on? I found many references to 0x80000000 base in hboot_0.94

Entry point isn't clear yet neither...
[HTC One X] kazgor:
whats it to do with the carries if we have unbranded (simfree) handsets.. see now we've paid for the phone fully.

anyway... i can't help, but this thread been great to read... so you all keep poking and peeking and fingers cross it all cracks open.
[HTC One X] kfasheldon:
OK.. while trying to re-flash my phone after messing up, I tried to re-lock (fastboot oem lock) and it put up 3 messages, 1 succeed, 2 failed, on reboot of phone it read locked.

Yes!! Locked not re-locked ! I forgot I had not flashed stock recovery ! So triued to unlock, it worked but I could not flash stock recovery, failed, but I could re-lock with same LOCKED message, if I then went from HBoot to Fastboot I got a new menu SECURITY .. bellow locked a message SECURITY WARNING, if I select SECURITY menu then I get a new screen , KEYCARD failed, and reboots.

Anyway the LOCKED was enough to get the phone swapped as its two weeks old, any way after charging and attempting RUU again it locked on black HTC screen most times it booted.

Still maybe this menu holds a key to S-OFF, and maybe the relock failing can be replicated, it seems to have sent only 1 of 3 parts if the file across, so if you phone is bricked maybe you can give it a shot for htc service cover by part re-locking in some way.

http://dl.dropbox.com/u/7526938/IMAG0439.jpg

http://dl.dropbox.com/u/7526938/IMAG0384.jpg
[HTC One X] mattman83:
US carriers are the ones with the biggest demands. They are also the reason we end up with 2-3 variants of every phone because each carrier wants and exclusive version. I'm not aware of anywhere else in the world you get so many handsets modified from the global version to be exclusive to a carrier.

S-OFF is something most carriers would ask for, but the US carriers are the ones with the weight to actually make HTC do it.

With S-OFF you can (theoretically) modify the radio and do naughty things to their network. Of course, XDA would never be a party to that kind of behaviour, but that's the reasoning. Without S-OFF the radio partition is locked.

M.
[HTC One X] artymarty:
Yeah,

I can drive to a phone tower in a car with a ladder strapped to the roof, climb up and smash it. So let's padlock all the ladders up and wheel clamp all the cars in the country. Remember xda members - "people don't wreck phone networks, ladders, s-off phones and cars do!"

lol

:p

Sent from the future using tipi-tapa-talk 37
[HTC One X] Evil-Dragon:
It is legit, it's in the hboot:

sub_ROM_5C24+12E STMIA R1!, {R2-R5,R7}
sub_ROM_5C24+130
sub_ROM_5C24+130 loc_ROM_5D54 ; CODE XREF: sub_ROM_5C24+12C^
sub_ROM_5C24+130 LDR R2, =(aSecuriyReset - 0x5D5E)
sub_ROM_5C24+132 LDR R1, [R3]
sub_ROM_5C24+134 LDR R6, [R4,R5]
sub_ROM_5C24+136 ADD R2, PC ; "SECURIY RESET"
sub_ROM_5C24+138 MUL.W R5, R0, R1
sub_ROM_5C24+13A ; ---------------------------------------------------------------------------
sub_ROM_5C24+13A ADD.W R9, R1, #0x3C0000
sub_ROM_5C24+13C ; ---------------------------------------------------------------------------

It needs a white card to reset it though. Shame.
[HTC One X] BeciMester:
Guys, it's 100% real. All the hboots I've disassembled so far (Desire, WFS, and now HOX) are full of spelling errors. I dunno if it's due to space constraints, lazyness or ignorance. If you look that string up, it IS spelled 'securiy'.

I'm on my 1X...
[HTC One X] broncogr:
Thread cleaned

Back on topic please
[HTC One X] MySam:
It may be intentional to make string searches harder? it reminds me of hacking Glu games.
[HTC One X] leith51:
It's possible that its been done on purpose
[HTC One X] BeciMester:
That, or Taiwanese programmers can't spell English well. :D

I'm on my 1X...
[HTC One X] Chezbel:
To be more accurate most programmers can't spell very well. We're only saved because the compiler and assembler find the "important" spelling mistakes, LOL
[HTC One X] tids2k:
We can try to patch hboot where it tries to find the white card with the code.
[HTC One X] mattman83:
Then you just need to figure out how to write the new hboot :D But yeah, that's the most likely way to do it. Given we possibly can't even find some partitions (who still thinks there's an actual radio partition?) I don't think we're going to find the flag & a way to change it.

M.
[HTC One X] Rekoil:
If we could do that then we wouldn't need the white card...
[HTC One X] raimondomartire:
someone have tested this http://forum.gsmhosting.com/vbb/f83...erl-script-free-standalone-unlimited-1175785/
[HTC One X] theliquid:
Goldcards don't work with the HOX ... (cause of the missing SD-Slot)
[HTC One X] Evil-Dragon:
If the hboot can interact with it then it's stored somewhere and can be interacted with. I believe that the radio is different though this time it's flashed via rom images.
[HTC One X] ximonx:
Gold cards and White cards are two seperate things, does anyone know if white cards change between handsets, or is a white card universal? The xtc-clip acts as a white card, maybe we only need the DIAG file for the HOX for the xtc-clip to work (on a forum there is a rar file with instructions, schematics and firmware to diy one)
[HTC One X] KrisPerry:
Can additional storage drives be mounted via the USB port