yashsingh1/xdaforums huggingface dataset:
[HTC One X] ken-ywk:
the OTA update is out and I wonder to update it or not, just scare that when the S-OFF is out but the updated version cannot get S-OFF.

Will have this posibility?
[HTC One X] itchy67x:
It's possible but nobody knows for sure :p
[HTC One X] steve36:
with the posts you,ve been doing about it mate thought ye had one
[HTC One X] abc27:
Edit: Nevermind
[HTC One X] :
My latest device, sent from me what?... :p lol

Sent from my Desire HD
[HTC One X] SB13X:
Yeah what he said....
[HTC One X] KingOfNV:
Can help this?

Support for Android

The long awaited Android support in IDA is ready!

The new version can disassemble Android bytecode (Dalvik).

http://www.hex-rays.com/products/ida/6.1/index.shtml
[HTC One X] lckuok:
just reading the link you posted,

ok i'm copying word by word, i find this kinda fishy ><

"the boot.zip provided has a file inside named "click me to flash.bat", after that your device will show s-off and you have fully unlocked"

now i'm trying to read through the post first before i do anything
[HTC One X] DarkMio:
Nope. Dalvik ist the VM, which isn't that, what we need. The Dalvik is the booted Userinterface and the process to let an App run on different Hardware. What we need is it for ARM, which decompiles bytecode, that run processes directly on / to the chip.
[HTC One X] pdagenius:
I couldn't download the boot.rar file - maybe I need to register on the site? If you have downloaded it then maybe you can post it for us all to look at?
[HTC One X] miniudavid:
I found that you cant do nothing without points or something to download..
[HTC One X] abc27:
A friend of mine has access to IDA. If you'd like, just tell me what you need him to do and I can forward it to someone who has the time and capability to look in to things?
[HTC One X] lckuok:
one of the post did mention it didn't work for him

anyhow, yes no points no download, bleh
[HTC One X] starbase64:
Hi,

here is the boot.rar from this site:

http://htc.zol.com.cn/109/33080_1083270.html

Download: http://dl.dropbox.com/u/8252379/boot.rar

cheers

starbase64

---------- Post added at 08:59 PM ---------- Previous post was at 08:57 PM ----------

Hi,

you must a reply first to download files :D

cheers

starbase64
[HTC One X] lckuok:
wth, i made a reply and it didn't let me download ><

anyhow gonna try it tmr, just done watching the dumb s3 show gonna head to bed
[HTC One X] JeckyllHavok:
can anyone with a chineese language pack installed translate the bat file?
[HTC One X] starbase64:
Hi,

echo is an irrelevant command, you need:

gfan.com\fastboot flash boot gfan.com\boot.img

or

fastboot flash boot boot.img (if all in same folder)

cheers

starbase64
[HTC One X] theliquid:
The only question is: does flashing the boot.img really work for us?
[HTC One X] miniudavid:
Anyone tried it?
[HTC One X] Evil-Dragon:
EDIT: I'm a dumb****. nb0 files are packed partitions. The .img file should just be the hboot partition. I really need to read more.
[HTC One X] pdagenius:
Can someone who can look at the file in an intelligent way advise further on what this may do before we end up with a pile of bricks.
[HTC One X] crucky:
I think only when you unlocked via htcdev.com -.- so only users with unlocked bootloader can flash this and get s-off i think :mad:
[HTC One X] pdagenius:
I am unlocked but not prepared to take the chance without more authorative info.

Edit: It needs input from a dev.
[HTC One X] visor:
I'm hoping that some of you will find this useful - an ARM decompiler - http://pel.hu/armu/ (originally found here: http://chdk.setepontos.com/index.php?topic=5100.0)
[HTC One X] JeckyllHavok:
anyone knows a good live cd with all neded tools on board, then i can extract
[HTC One X] spitzofren:
Attempting extract now using unyaffs. I will report my findings.
[HTC One X] co@ch:
We're still looking for someone who can open the beast to remove the battery, isn't it?

Well maybe this poor guy could help us: http://xdaforums.com/showthread.php?t=1606088 ;)
[HTC One X] spitzofren:
"Can't determine flash layout, perhaps not a yaffs2 image"
[HTC One X] Evil-Dragon:
Thanks. I thought it was just me.
[HTC One X] mike1986.:
I decompiled that boot.img and it seems to be from very old base. Nothing extraordinary there, I highly doubt that kernel can bring us s-off. But I can be wrong.
[HTC One X] Dunc001:
Don't know how to use it yet but I have IDA Pro 6.1 with Hex Rays 1.5 which I'm pretty sure includes the ARM decompiler. If anyone wants to jump on chat/IRC later and talk me through I can see if I can decompile hboot for you...
[HTC One X] starbase64:
do you want to try it?
[HTC One X] ali3nfr3ak:
flashing this boot.img does not bring s-off, just tried it, my bootloader is unlocked via htcdev
[HTC One X] JeckyllHavok:
Just an idea, but when this works, would it be possible to flash this through ruu in download mode to gain s-off on a locked device? (http://xdaforums.com/showthread.php?t=1632200)
[HTC One X] starbase64:
boot.img unlocked via htcdev? :confused:
[HTC One X] ali3nfr3ak:
no i mean unlocked bootloader ,
[HTC One X] starbase64:
the unlocked bootloader is necessary for s-off.

brings the boot.img s-off?
[HTC One X] KingOfNV:
I Understand it so

At first you Unlock via HTCdev and then S-Off via the boot.ing
[HTC One X] starbase64:
perhaps, but no one has tested it.
[HTC One X] ali3nfr3ak:
before and after shots
[HTC One X] starbase64:
does not work? :(
[HTC One X] ali3nfr3ak:
no...

assuming that this command is right

fastboot flash boot boot.img
[HTC One X] starbase64:
cmd says "write ok"?
[HTC One X] ali3nfr3ak:
D:\ADB>fastboot flash boot boot.img

sending 'boot' (4282 KB)...

OKAY [ 0.655s]

writing 'boot'...

(bootloader) Format partition LNX done

OKAY [ 0.498s]

finished. total time: 1.154s
[HTC One X] MarcoHD:
I can confirm it. Flashing this boot.img don't give us s-off.
[HTC One X] Evil-Dragon:
Zero surprises there.
[HTC One X] Arkaknio:
I confirm it too. I have unlocked bootloader (0.43 HBOOT) and flashing this **** didn't give me S-OFF.

Waste of time :(:(
[HTC One X] Supaiku:
Pretty sure it's under wraps as they moved to avoid getting caught for dodging taxes... (the address used to be on their store's taobao site, but doesn't seem to be now... they'll give it to me for this though:p They keep their devices elsewhere anyhow) I'll contact them this evening and see about going on Saturday. :)
[HTC One X] pdagenius:
The NVflash route still sounds a good bet to me . Maybe someone will still be able to get this to work via the pogo pin dock.
[HTC One X] KingOfNV:
Hmmm...

After Unlock via HTCdev do exactly the Steps?

Copy from Website:

Looks like already unlocked, but not the S-OFF, unlock not yet fully, that is the official solution, and S-OFF, in essence, but other.

The official solution Brush must be brushed into the ROM package BOOT.IMG, otherwise the card screen or WIFI error.

Brush BOOT.IMG tutorial:

1, first download the adb, casually extract it to where if I extract it to C root directory (the back to extract it to C drive, for example.)

2, download the ROM extract boot.img or provide one to the: boot.rar (size 4737k)

Casually after downloading unzip to a directory you can.

Restart the phone into fastboot mode (hold down the volume - and the boot keys, cell phone upper left corner of a bunch of English, that is representatives enter hboot mode; press the power button, enter fastboot mode).

4, connect your phone to your computer, point your computer desktop [Start] - [run] in the pop-up box, type cmd press Enter, the command prompt window will pop up, at the prompt, type CD C: ADB (carriage return) , and then input to fastboot devices (carriage return),

Display a blank ie phone is not connected to be reseated, and vice versa successful connection (series of figures, the IO port code), and then find the boot.img extracting something out of just downloaded, double-click my brush into the point. bat "can be.

Re-enter the bootloader, you will find has become the S-OFF, already complete to unlock. I wish you all happy! !
[HTC One X] Supaiku:
The thread seems to be about the Chinese GUI based HTCdev Unlocker tool, and does not provide S-OFF, but instead only unlock the boot loader. Look at the screenshots...

EDIT... the bottom does say flashing the boot will give you S-OFF... but doubt it's true...
[HTC One X] Drefsab:
why are people still posting this stuff, flashing a boot.img is old news it doesnt give us S-OFF. There are pages and pages of this stuff all confirmed not to work lets move onto something a little more productive?

Perhaps we can look at getting someone brave enough to crack open the phone remove the battery and seeing if we can force APX mode?
[HTC One X] slapshot30:
Have you guys looked into the amaze/vivid/etc s off method?
[HTC One X] leith51:
Well I just done another exchange on a hox (one of the 7 I had upto now) all because t-mobile hoxs still on 1.26 :mad: so still on 0.43 hboot... But this time the driver didn't take the other one so now I have 2(one spare) as long as they don't pick up that it not been returned and put it down to lost if we still in same boat in a month I will strip it open and run every test possible on it
[HTC One X] co@ch:
That's why my last post:
[HTC One X] Rekoil:
Did someone take this fine gentleman up on his offer? Otherwise I believe I have access to the Hex-Rays ARM decompiler as well.

Oh, and we should look into mempodroid for rooting without HTCDev, I bet it would work considering we're running 2.6.39, the kernel which introduced the hole we're exploiting. It is possible it has been patched by HTC, but I doubt it.
[HTC One X] ytwytw:
I did, but how can we do the wire trick on HOX?

---------- Post added at 05:15 PM ---------- Previous post was at 05:13 PM ----------

S4 HOX has 3.0+ kernel :(
[HTC One X] Rekoil:
Yeah but there's no such thing as an S4 "HTC One X". It is really an entirely different phone... in more sensible countries (like Australia) it isn't even being marketed as the "HTC One X" instead being called the "HTC One XL". They share the same case, and maybe the same screen, but I bet that's it. They have different application processors, different radios, different flash memory and most likely different bootloaders (I obviously can't actually confirm this).

No offense meant but you don't really belong in this thread :P And what I mean by that is that whatever we discover for S-OFF'ing the "HTC One X" probably won't apply for the "HTC One XL", which is what you have.
[HTC One X] KingOfNV:
On China Websites you find it under HTC s720 or s720e.
[HTC One X] karoodee:
I have thought about that, too, but I don't know how I can get the offsets needed for it :-/
[HTC One X] blubbers:
The decompiler is for x86 only
[HTC One X] Rekoil:
There is a Hex-Rays ARM decompiler as well.

EDIT: links to sales pdf and ARM decompilation comparison

http://www.hex-rays.com/products/decompiler/compare_arm0.shtml

http://www.hex-rays.com/products/ida/support/orderforms/computereu.pdf
[HTC One X] Dunc001:
Pretty sure Hex Rays 1.5 does x86 and ARM but I could be wrong. When I run it and select new project there are several ARM options in the mobile device tab?
[HTC One X] blubbers:
it can disassemble ARM, yes, but not decompile it. the decompiler is for x86 only. unless you have $2500 for an ARM decompiler license ;p
[HTC One X] Rekoil:
Or?
[HTC One X] blubbers:
like i said, $2500. there is no "free" ARM decompiler around ;)
[HTC One X] Rekoil:
No, you said there is no ARM decompiler :P

It just so happens that at iDroidProject we have come across someone with access to this license. I will try my bestest to get said person to decompile our HBOOT.
[HTC One X] blubbers:
i didn't say that it does not exist, see the word "around"

it just does not exist publicly for "free"

would be cool if that person really does have the ARM license

been analysing hboot 0.43 for the past days in IDA, about 50% done.

since it is in binary format and i do not have a memory map, it is alot of manual work because the auto analysis only disassembles 5%
[HTC One X] ytwytw:
No more HTC ONE XL

They would be all called one x...

The only exception will be sprint version, called evo one, or sth like that...

They should share the same *type* of boot loader, take sensation as example... One solution works for all the sensation line products

They are all different phone but the exploits used are all the same, so it doesn't really matter

And since It's Qualcomm S4, higher chance to get s-off I guess
[HTC One X] mattman83:
The One XL still exists, and will be offered via Telstra in Australia.. It's just AT&T who want to confuse the rest of the world.

M.
[HTC One X] Root-Maniac:
At I'm gonna get flamed but IM getting the at&t one s will I come here for development?
[HTC One X] invasion2:
Nope. Different chips and stuff. I'd stay at S. Check here every now and then.
[HTC One X] Root-Maniac:
I met one x... Still no go??? Thanks for your response
[HTC One X] ytwytw:
Well, Rogers call it one x too,

And no htc sites call it one XL anymore
[HTC One X] invasion2:
Lol oh...then idk. I'm no expert on that stuff. Sorry.
[HTC One X] TeniusGG:
in Htc Hongkong Website,it still call HTC ONE XL,and its price about $700

and it's not a Contract Phone,and no operator logo
[HTC One X] Wiingy:
Nice work c4b4l3, hopefully somebody with IDA experience and help you get some progress
[HTC One X] pdagenius:
Isn't encouraging that the words "backdoor" and "NVflash recovery mode" are very prominent!

Edit: You would think there must be an easy way to enter this mode. I can't imagine this just being carried out during assembly to flash 100s of phones for a particular country's phone network provider. Even the white card method would seem very time consuming. Pogo pins?
[HTC One X] JeckyllHavok:
wonder what RCK is
[HTC One X] f4flake:
Latest Tegra development pack here....

http://developer.nvidia.com/tegra-android-development-pack

---------- Post added at 08:46 AM ---------- Previous post was at 08:44 AM ----------

Check out this page re hacking the bootloader of the Toshiba AC100

http://tosh-ac100.wetpaint.com/page/Bootloader
[HTC One X] pdagenius:
This looks positive to me and possibly the sort of thing we need to do but don't know enough to pursue it.

Maybe if the right person from here contacts the guy over on the toshiba forum we might get a bit further.

Sent from my Galaxy Tab 10.1 with Tapatalk
[HTC One X] Rekoil:
You're not getting my point mate, it doesn't matter what AT&T call it, it is still a very different phone. There's no sense arguing about this mate.

EDIT: And if we're gonna go there anyway:

http://www.htc.com/au/smartphones/htc-one-xl/

http://www.htc.com/hk-tc/smartphones/htc-one-xl/
[HTC One X] Arthas92:
if it so hard to S-off

so can we modify the RUU or file update to fake the information

and let the RUU help we pass the CID or S-ON
[HTC One X] xmoo:
I remember with the DHD. The RUU of the test roms did not do a cid check.

So I ran the RUU en replaced the update.zip. This way I de-branded couple of phones without rooting or goldcard. Havn't tried on the One X tho.
[HTC One X] cityuk:
thats a good idea, can a ruu be modded to take away the check?? or will it break the firmware signature?
[HTC One X] avensakias:
I see light in the ending of the tunel.!!

:):):):):):):):):):):):):):):):):):):):):););):):):););)

S-OFF is coming.!!!

Keep up guys.

Sent from my HTC One X
[HTC One X] MarcoHD:
Can't see your tunel
[HTC One X] avensakias:
Trying to find an ENG S-OFF RUU OF OUR HTC ONE-X.

NOW WHAT YOU SEE.??

Sent from my HTC One X
[HTC One X] JeckyllHavok:
There are Eng Ruus?
[HTC One X] P1n3apqlExpr3ss:
I have a One X from HTC that had a local carrier's firmware flashed on top. It is essentially a pre-retail carrier unit. HT23

It is s-off, confirmed both by booting into the boot menu and by CID getter displaying 11111111. My main CID (according to CID getter) is the carrier's so I'm still stuck on 1.26...

Let me know if I can be of any use

Oh, and if anyone wants to help me out xD

http://xdaforums.com/showthread.php?p=25658506
[HTC One X] KingOfNV:
A question for the Gold Card.

Can it be that it does not work with the Gold Card at the fixed memory because it has not actually shared partition Android 3.0 (USB mass storage function) are more only at HTC?
[HTC One X] Polarfuchs:
So is that the way to get S-Off at least on rooted/htc-dev unlocked phones?

http://alpharev.nl/
[HTC One X] Supaiku:
So I just asked about S-OFF at the store I bought my phone from (with the S-OFF pics at the bottom of their page), and it seems they just put the pics up as they do with all their other phones, despite not actually being able to do it with the One X.

First I talked to one person, then I talked to another, and he checked their machine, which didn't have anything for the One X, and then searched some forums, and came up with nothing. He said he'd contact me if he find anything out. But that was a dead end. Flash marketing.
[HTC One X] xmoo:
the ruu was modified itself. So if anyone want to try. Nothing can go wrong.
[HTC One X] JeckyllHavok:
does it need to be unlocked? or will it work with locked phones, too
[HTC One X] xmoo:
As I said, the phones were branded and S-on.

So download 0.96.401.2

plugin your device, press next etc. Till your to the part that it will try to flash.

Then locate rom.zip (Probably in C:/Users/YourComputerUsername/AppData/Local/Temp).

Delete it, and pase the rom.zip of the stock rom you want to flash. Then on the RUU press next for it to flash.

I've tried this with stock rom, not with custom.
[HTC One X] cityuk:
did it work??

will it write a older radio?
[HTC One X] Arkaknio:
This is a dead-end street. I give up, I'm going to sell the phone and wait for the SIII.

Sensation was S-OFF one year later, so notice that maybe u can wait the same for the One X.

Thank you guys.
[HTC One X] JeckyllHavok:
Can i with locked bloader take a backup of my rom (german 1&1 branding where no ruu is available for) just in case
[HTC One X] cityuk:
bye then
[HTC One X] co@ch:
adb.exe backup -all

http://stadt-bremerhaven.de/android-komplettes-smartphone-backup-ohne-root/

Be aware that setting it to -all will save also the internal memory, so the backup.ab file could reach some GB.. :rolleyes:
[HTC One X] Electronic Punk:
The Sensation did not take a year to S-Off.
[HTC One X] xmoo:
FFS please read people... You don't flash the real test rom...

I believe the test rom RUU's don't do a CID check, cause the test devices are most of the times SuperCID. So why checking CID when you know there is no CID :P
[HTC One X] Supaiku:
And actually, it's even trickier, because how would you use the white card even if there was one for the One X?
[HTC One X] mickfitz:
Please don't go.

Your contributions in this forum will be missed and a huge blow to the community.
[HTC One X] cityuk:
any links for test rom?
[HTC One X] Hilton.Swart:
Your negativity doesn't contribute at all, why even post that?

I haven't even got this Phone as I'm waiting for carrier to release it, yet still monitor this thread more than any other on XDA. The reason I haven't posted here yet is to avoid appointment to myself, and not interfere with the dev's working on this.

That said, don't visit here again if you have outdone yourself in getting a phone with "currently" no S-OFF mechanism.

In the mean time, we'll keep reading this thread and looking for answers ourselves.

To the Guys working hard on this, taking time out of their day to help others... Thank you, Keep up the hard work!
[HTC One X] Micropot:
Please check your CID. Someone was posting he had 1&1 branding aswell but had HTC__002 CID (rom version x.xx.401.x) so he did a hard reset an everything from 1&1 gone.
[HTC One X] JeckyllHavok:
Mine is HTC__102
[HTC One X] blubbers:
we do not need a S-OFF or engineering hboot.

it is easy to make one

this is actual code from one-x hboot 0.43

ROM:8E009A38 isSecurityOn: @ CODE XREF: sub_8E009A50+4p
ROM:8E009A38 @ sub_8E009A74+4_p ...
ROM:8E009A38
ROM:8E009A38 @ FUNCTION CHUNK AT ROM:8E00888C SIZE 00000016 BYTES
ROM:8E009A38
ROM:8E009A38 PUSH {R4,LR}
ROM:8E009A3A BL sub_8E01683C
ROM:8E009A3E CBZ R0, loc_8E009A44
ROM:8E009A40 MOVS R0, #1 @ security is on
ROM:8E009A42 B locret_8E009A4C
ROM:8E009A44 @ ---------------------------------------------------------------------------
ROM:8E009A44
ROM:8E009A44 loc_8E009A44: @ CODE XREF: isSecurityOn+6j
ROM:8E009A44 BL loc_8E00888C
ROM:8E009A44 @ ---------------------------------------------------------------------------
ROM:8E009A48 .byte 0xC0 @ +
ROM:8E009A49 .byte 0xF3 @ ¾
ROM:8E009A4A @ ---------------------------------------------------------------------------
ROM:8E009A4A ASRS R0, R0, #1
ROM:8E009A4C
ROM:8E009A4C locret_8E009A4C: @ CODE XREF: isSecurityOn+Aj
ROM:8E009A4C POP {R4,PC}
ROM:8E009A4C @ End of function isSecurityOn

changing

ROM:8E009A40 MOVS R0, #1 @ security is on

to

ROM:8E009A40 MOVS R0, #0 @ security is off

will make the phone as good as S-OFF

what we need is a way to flash a modified hboot on a S-ON device!
[HTC One X] Polarfuchs:
So we need root without HTC-dev unlock to flash the modified hboot?
[HTC One X] Micropot:
Send a pm
[HTC One X] doublecheese:
I think I found out HERE why Raskal from XTC CLIP is not spending his time getting a S-OFF method for HTC One X .

As far I understand he is trying to start a war against the people who cloned his XTC Clip and Raskal will sue them . He is obviously loosing alot of money and trying to rescue his ship .

Although I have been talking with him many times when I first bought the XTC Clip to S-OFF my Incredible S and also asking him when to get S-OFF for HTC Sensation, I have PM'd him now but I doubt he will give me a reply soon.

I hope he gets in contact with those Chinese shops and figure out a way to use it with his XTC Clip
[HTC One X] ytwytw:
I see what your mean...

Something like back to HTC Dream time...

But you still need a ENG hboot to mod,

and how do you pass the signature check during the flash?!
[HTC One X] blubbers:
no, the goal is to flash hboot with or without htcdev, with S-OFF we can always revert the phone back to the way it was before htcdev unlock

the problem is, the kernel doesn't even know that there is a hboot partition. so we would need another way to have r/w access to the hboot partition. how, is the big question
[HTC One X] Polarfuchs:
And simply swapping the kernel doesn't work, because we first would need to unmask the partition to "learn" the new kernel, where it can find the partition?!
[HTC One X] blubbers:
most s-off methods work like this, find some exploit to flash a modified hboot with an invalid/no signature

modifying the hboot is the easy part! but it is of course not the only way to s-off a phone

---------- Post added at 02:52 PM ---------- Previous post was at 02:50 PM ----------

the partition table is hard-coded inside hboot. hboot controls what the kernel knows about partitions and if it has write access
[HTC One X] JeckyllHavok:
anyone got a link to the 0.96.401.2 ruu, all links i find here seem to be dead
[HTC One X] ytwytw:
mhmmmm, I am thinking should I sell my Rogers One X, then get a int'l One X?!

Just feel so boring and alone LOL
[HTC One X] Polarfuchs:
Is is normal that I have phone from amazon.de and a cid with 001 (WWE) instead of 102 (Germany)?
[HTC One X] blubbers:
yeah, thats the problem..
[HTC One X] ytwytw:
Well, 001 will be consider a unbrand phone

102 could be branded by local provider

So you have WWE is good for you
[HTC One X] xmoo:
http://www.filefactory.com/file/11o...96.401.2_Radio_0.120201.21.10_test_240060.exe

http://www.bergfiles.com/i/bf49eb2312h32i0

http://115.com/file/e77z53o2
[HTC One X] KingOfNV:
Its normal

My One X (Saturn)

CID HTC_001

Can we use the non-permanent sub-root method and not HTCdev unlock method ???
[HTC One X] JeckyllHavok:
Thank you but the first too seems off, the third needs an account (i'm sorry but my chinese is not that good)
[HTC One X] KingOfNV:
I need Googletranslation for Chines Websites.
[HTC One X] nikorette:
Can we flash the modified soff hboot (unsigned) from ruu mode? If it will flash anything why can't we flash the soff hboot?