yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] meohman1:
Yep - that's the boat I'm in, too - "The problem is for those of us that ran the RUU to 1.85 in the few hours AFTER the boot loader unlock was discovered and didn't root before AT&T closed off the exploit. We have no way to root, therefore no way to unlock. We are, in essence, stuck. No tutorial on existing methods will help us. Until a new exploit is published, we can't do squat."

Just have to wait for root and be patient! It is a good thing that the stock ROM is not bad.

As a side note, does anybody else with the stock 1.85 RUU notice that you get a red frame around the screen sometimes when the screen changes and can you see a dot on the screen when you use your finger to scroll or whatever (right after you lift your finger and right where your finger was)?

Mike
[AT&T, Rogers HTC One X, Telstra One XL] imstill@g:
You need to go to developers options to turn those things off
[AT&T, Rogers HTC One X, Telstra One XL] meohman1:
Thanks - that did it! Got rid of the touch target thing!

Mike
[AT&T, Rogers HTC One X, Telstra One XL] mbaran:
any progress?
[AT&T, Rogers HTC One X, Telstra One XL] gtung99:
Yea i can't stand it now that all these new stuff are out and I can't install it on my phone! :)

I'm considering of exchanging my phone but most of the stores around me are out. I also don't want to pay the $35 dollar restocking fee....I got two weeks left so hopefully a root will be out before then.
[AT&T, Rogers HTC One X, Telstra One XL] agentdr8:
They shouldn't charge you a restocking fee if you're exchanging a "defective" handset for a working one. That being said, they will usually try their best to not swap out a handset if it doesn't exhibit whichever behavior you're using as your "defective" reasoning.

So it would be best to make sure the phone doesn't power on at all if you plan on swapping.

I've got until the end of the week to swap mine; if a new root exploit isn't found by then, I'll be finding a way to exchange it.
[AT&T, Rogers HTC One X, Telstra One XL] kennethpenn:
Hey guys. I wanted to apologize for the incident here. I never intended to undercut anyone or make jcase look like an idiot. I simply wanted to stop the flood of “this isn't working for me" messages. I had good intentions, but jcase is correct in saying that moderators shouldn't mess with users' posts without rule breakage. It won't happen again.
[AT&T, Rogers HTC One X, Telstra One XL] mbaran:
any other smart devs want to try to get at this for 1.85? I can provide SSH access and linux to a device? The more heads maybe it can get going. seems like we're all waiting on one person.
[AT&T, Rogers HTC One X, Telstra One XL] meohman1:
Bump - gotta keep this on Page 1. Those of us stuck on 1.85 with no root and no unlock are watching and hoping!

Mike
[AT&T, Rogers HTC One X, Telstra One XL] mainecrab:
I seem to have an earlier rom and this worked for me. I used a script from another site that looks to have come from this source from me reading how the exploit works. I have root without issue at this moment so mayber if you are on an older version it still works. I did verify with rootchecker and I can su to root with adb but cannot remount for some reason, but at least I was able to do what I needed to do with mounting root writeable to fix some email issues to my liking.

Maine
[AT&T, Rogers HTC One X, Telstra One XL] mbaran:
Are you on 1.85?
[AT&T, Rogers HTC One X, Telstra One XL] Guster730:
Bump. I'm stuck on 1.85 locked and no root :( Hopefully a workaround for 1.85 is released soon.
[AT&T, Rogers HTC One X, Telstra One XL] relic120:
Does this mean the root method is no longer working at all for anyone, or just those poor schmucks who upgraded to 1.85? For instance, I'm still on 1.73 can I wipe and root will still work or no?
[AT&T, Rogers HTC One X, Telstra One XL] meohman1:
Yes you can, but to go to a new ROM based on 1.85, you'll need to follow all the instructions or you will end up stuck with 1.85 with no root and a locked bootloader!

I'm one of the poor schmucks who upgraded to 1.85 right before AT&T closed the root exploit, then I wake up to find I can't root or unlock!

Mike
[AT&T, Rogers HTC One X, Telstra One XL] agentdr8:
Make absolutely sure you use the SuperCID (and not the ROGER001) for unlocking/relocking/RUUing, otherwise you'll be in my boat and be stuck with a locked bootloader and no way of re-unlocking.
[AT&T, Rogers HTC One X, Telstra One XL] redpoint73:
This method no longer works for anyone.

The one-click method works for 1.73 and 1.82

http://xdaforums.com/showthread.php?t=1644167
[AT&T, Rogers HTC One X, Telstra One XL] mbaran:
bump for any developer love to help us stuck!
[AT&T, Rogers HTC One X, Telstra One XL] mainecrab:
This worked for me on 1.73. I performed this on my last post so supposedly after this was not supposed to work. On the 31st is when I did mine
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
The evo 4G LTE has root. I'm going to RUU to 1.85 and try the exploit and report back.
[AT&T, Rogers HTC One X, Telstra One XL] Pumpiron579:
Thanks Gunnyman, you very Brave
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
I have unlocked bootloader so I can root 1.85 regardless. :)
[AT&T, Rogers HTC One X, Telstra One XL] Pumpiron579:
Dang, I am locked, thought you were.
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
well if it works we can all rejoice. I'm doing a nandroid backup now

---------- Post added at 11:42 AM ---------- Previous post was at 11:14 AM ----------

No dice. Upon reading the thread it looks like the same exploit from 1.73. I didn't achieve root. Sorry guys. :(
[AT&T, Rogers HTC One X, Telstra One XL] meohman1:
Thanks for trying!

Mike
[AT&T, Rogers HTC One X, Telstra One XL] mbaran:
The Evo 4g lte root is the same one we use for 1.73 where it removes /data/local/tmp and links it to /data/local.prop to set world read and set adb shell to debug mode.

That exploit was closed in 1.85.
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
Yes I know and reported as much.
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
I wonder if the 1.88 is rootable with the old exploit. most likely not but you never know. 1.88 is Asian so i wonder if it'll even install without supercid... Sorry guys just trying to help you get unstuck :( Since my BL is unlocked i wonder if i can hex edit the original CID and try to install the 1.88. If so then i could try the older root exploit on the 1.88. I guess the first issue is whether you can install 1.88 without supercid.... thoughts?
[AT&T, Rogers HTC One X, Telstra One XL] mbaran:
I wouldn't think so, but it's worth a shot.
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
yeah wont hurt to try. Worse case is it doesnt work. ;)
[AT&T, Rogers HTC One X, Telstra One XL] Zarboz:
Won't work without super cid
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
Thats what i thought. Was gonna try anyway when i got home from work but if you are sure it wont work i wont bother changing my cid back. Maybe an update will be out soon for you guys, should be one real soon. They said one was supposed to be out at the end of May. :confused: I know an update alone wont fix you but it could help.

I asked Paul Obrien via twitter a couple of days ago about his root exploit for 1.85 but he never replied to me. He had mentioned something about having one and jcase told him to hold on to it because he was releasing his (this) version. Chances are though he isnt making it public for the few people stuck on 1.85. Probably saving it for newer software..
[AT&T, Rogers HTC One X, Telstra One XL] Guster730:
Still stuck on 1.85...
[AT&T, Rogers HTC One X, Telstra One XL] ChiefSpoonS:
Why is this thread still open?
[AT&T, Rogers HTC One X, Telstra One XL] meohman1:
There are a few of us (quite a few) who are stuck with stock 1.85 and can't root. We are waiting on a new root exploit.

Please bear with us!

Mike
[AT&T, Rogers HTC One X, Telstra One XL] ChiefSpoonS:
Sorry came out rude

Won't they open a new thread?
[AT&T, Rogers HTC One X, Telstra One XL] ThaDeanesta:
Exploit

We could still use this exploit.

First, examine the packets and see what AT&T ready2Go is giving out... (Handshakes, encryption, etc;)

Then we can edit our Network's DNS to re-direct the domain to our own computer, and run a program to send the root over.

Im thinking its an aweful lot of work, but if we're DESPRATE, this would work on 1.85 :D
[AT&T, Rogers HTC One X, Telstra One XL] Pumpiron579:
Lets get it done. If you need any volunteers, count me in
[AT&T, Rogers HTC One X, Telstra One XL] tyshemi:
There is a bounty now as well so cash money if it works
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
Because technically it the app is still vulnerable, and I am not done but if you want it close just let me know.
[AT&T, Rogers HTC One X, Telstra One XL] TKTAB911:
Well two notes...

One, Root Bounty - http://xdaforums.com/showthread.php?t=1699379

Two, I've always thought if you can manage to edit the apk and change simply where it redirects [ex, somewhere on the phone?] then that'd be enough to ehh get what is wanted :b lol. I know zip about building apks & programming stuff like that. So just an idea.

Although, What's stated above about redirecting it via some DNS server, I'd think it may be difficult to crack the encryption [if there is one].
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
Editing would change signature.

Redirecting it is a possibility I have looked at, but is not something I can test until I can find a reasonably priced used device.
[AT&T, Rogers HTC One X, Telstra One XL] dkirchik:
In order for redirecting of the apk, it'd have to install to /data/install/ ?

If that's correct how would one make the apk to write to a read only file system?
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
data is not read only
[AT&T, Rogers HTC One X, Telstra One XL] Skizzy034:
Where was the app install in Ready-2-Go? Was it in the setup wizard that it was taken out of? Or do you get to it after you do the initial setup of Ready-2-Go?
[AT&T, Rogers HTC One X, Telstra One XL] Tiffany84:
I don't even see it. I never tried the first root method but I went through the setup last night and I didn't see the option to install apps so I'm guessing that whole feature was removed due to this exploit.
[AT&T, Rogers HTC One X, Telstra One XL] eraste:
Same here ready to go from pc offered no apps to install, people ran off to the blogs and websites bragging and got this shut down for us. Some times silence is better than blabbing, and I guarantee whoever blabbed successfully did the hack so it didn't hurt them just all the others who are now stuck on 1.85. Ahh I'm ranting sorry my .02 cents lol.
[AT&T, Rogers HTC One X, Telstra One XL] Tiffany84:
Well don't quote me on this but I think whenever someone finds an exploit there required to report it. Android Police ran the article right before this method came out.
[AT&T, Rogers HTC One X, Telstra One XL] eraste:
I see I was under the impression some user(s) here blabbed, bragged thus drawing more attention to the exploit. It didn't last long ATT was paying close attention to this one shut it down fast. Same as with bootloader unlock trick. Not even 3 minutes after initial post it was all over the internet and ranking on page 1 (google search) for keywords ATT HTC one x bootloader unlocked. Apparently HTC doesn't care as it still works I'll bet ATT is furious though lol.
[AT&T, Rogers HTC One X, Telstra One XL] Tiffany84:
Ya, I was wondering if HTC maybe left that partition writable to allow us to unlock the bootloader if someone figured it out since AT&T blocked them from allowing us to do it because the people using the International One X are unable to change the cid.
[AT&T, Rogers HTC One X, Telstra One XL] dkirchik:
That's actually a really smart valid point. I had never thought of that. Awe HTC may be looking out for us :eek:
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
Jcase here's the Pcap you asked for http://dl.dropbox.com/u/53072/shark_dump_1339202845.pcap
[AT&T, Rogers HTC One X, Telstra One XL] robertmoore208:
Gunnyman, you are pretty awesome :)
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
all it took was a little time. I hate that there isn't root for 1.85 an android phone without root is just a faster prettier iphone. and what's the point of that ?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Actually it's even worse because all iPhone versions are jailbreakable (rooted). ;). Unrelated but I had to switch back to my iPhone 4 while HTC fixed my glass. Damn that screen is tiny. I find the hox battery life to be better and its definitely faster and nearly as smooth as the iPhone 4. Glad I have my hox back.
[AT&T, Rogers HTC One X, Telstra One XL] 00_MACKIE_00:
I lucked up and received my web order yesterday from AT&T, came with 1.73. Within an hour, I was rooted and had dealt with unlocking the bootloader and also installed CWM which I think I will change to TWRP.

However, I am pretty happy just running stock for now. Don't see the need to flash any RUU's or anything else for now.
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
Update:

Put a a couple hours into it today, I think we can re-exploit Ready2Go, just need more time to tinker.

First off, I found it, it belonged to me, it was my find and my research. I spent a couple days on it after a friend (designgears) asked me to. I did it without ever seeing the phone, it was a pain in the butt.

I shared it with a few people to help test and refine it, they were awesome and kept their mouths shut until I was ready. Truly awesome testers, took my jumbled idea, and confirmed it worked.

I wrote and published it on Android Police, I also notified all involved Vendors ahead of time. It was my research and my choice. I was not required to report it, nor am I required to share it with anyone in the community. Both were my choice.

No one else had a say in it. It was my research, my property and my choice to notify the vendor. Don't go blaming stuff on the blogs that allow me to publish, and if you want to blame me for what I did with my property, well ... I will just laugh at you.

If no one likes what I did, then you know.... why don't you find your own?

Not in the US.
[AT&T, Rogers HTC One X, Telstra One XL] eraste:
I think you took what I was talking about out of context good sir. I in no way would ever blame you for anything! I follow your work and am inspired. I was under the impression before (not now) that people bragging (not anything YOU wrote posted, etc but other people) was the reason ATT found out so fast and thus immediately shut the exploit down. I didn't mean any foul toward you or your associates in my posts just was expressing my feelings on the frustration others were feeling after upgrading and being stuck on 1.85. I know little about development and would never pretend to know more, development is your area of expertise! Hope you continue to provide great work to the community!
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
No worries, I've just gotten some hate mail over this device this weekend, and its tipping me over.

I notified the OEM/Carrier/Dashwire myselg, yes we bragged prior to the initial root being public (we found it right before the initial root became publish) but we didn't say how.
[AT&T, Rogers HTC One X, Telstra One XL] eraste:
Na you would never get hatemail from me you have an elite brain between your shoulders if I had half the development knowledge you had I would own a shop here in town lol
[AT&T, Rogers HTC One X, Telstra One XL] Tiffany84:
Don't worry about the haters jcase. There are always going to be those types of people. I and MANY, MANY others respect and greatly appreciate what u do. I completely understand and respect your decision and can't wait for u to find the next exploit. Hopefully your still willing to help even after having some idiots send u those messages. If not, I completely understand that as well and I am still very thankful for all u do for the community.
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Wow, that's no good man. Keep your head up though!! I hope you become a permanet fixture around the soon!! Thanks again and I hope you can help all those stuck with out root!
[AT&T, Rogers HTC One X, Telstra One XL] PeartFan40:
As this mod is no longer working, and the thread has lost momentum, I'm closing the thread. Will re-open upon request.

Thread Closed.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"If you choose not to decide, you still have made a choice"
[AT&T, Rogers HTC One X, Telstra One XL] xfinrodx:
Looks like it's 3801413 bytes. I have an old log from when I originally did it, and ls -l should absolutely show file size for it. Just installed from the market and the current apk is the same size.
[AT&T, Rogers HTC One X, Telstra One XL] dharani1234:
I can try ... but I am unlocked and rooted on 1.73 ... so trying to stay out of trouble ...
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
nah that important, it's reliable enough to work with patience.
[AT&T, Rogers HTC One X, Telstra One XL] gtung99:
I tried this about 20 times, everytime i'm either a millisec too fast or too slow....i can't time it right at the exact time since it downloads fast and installs fast too.

Any easier method to this?
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
You can see if you can locate a larger app in the list of att ready2go apps and substitute it
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
lsing in there while it's downloading looks like it immediately overwrites the symlink we created. What is that link accomplishing? It literally gets deleted before the app starts downloading. I can see it with the rapid ls -l sequence....
[AT&T, Rogers HTC One X, Telstra One XL] jtwlbz:
i don't see sdcard/data/install directory even if i downloaded app from ready2go and uninstalled it.

anybody?
[AT&T, Rogers HTC One X, Telstra One XL] id10terrordfw:
Because you are adding /sdcard. It is just /data/install.

---------- Post added at 01:19 PM ---------- Previous post was at 01:18 PM ----------

I can verify the size as the same.
[AT&T, Rogers HTC One X, Telstra One XL] xfinrodx:
That's because the directory is /data/install. (absolute path name, no misunderstanding)
[AT&T, Rogers HTC One X, Telstra One XL] Gromet:
I have tried this over 30 times now... cannot get the reboot timing down...

GRRRRRR....

..Gromet
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
OK so I've tried this 50 times, no dice. I am doing the rapid ls trick and have even timed it perfectly a couple times (I think). I still cannot understand how creating a link that immedately gets overwritten by an APK does anything. Specifically how does that allow us to write to test.prop? I'm confused and unrooted :(
[AT&T, Rogers HTC One X, Telstra One XL] gtung99:
I timed it perfected, right when the notication bar says "installing " i did a db reboot, still I get a permission denied afterwards. This is after 30 tries, i'm wondering if this really works on 1.85. Anyone else for the forum acutally got it to work following the steps?
[AT&T, Rogers HTC One X, Telstra One XL] xfinrodx:
Make sure you are following all of the steps every try. Also, experiment a little with timing. Try leaving it a bit longer - or try the original idea and interrupt during download. There should be about a full 3-5 second window of opportunity for reboot using the "Pro Tip" method in the OP. If all else fails, wait for a script and enjoy your Friday! :D
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I really think there is a command either missing or contains errors in the directions. Again, no linux expert but I don't see how this works, when the symlink gets overwritten in the download and we don't even bother touching it again.
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
The symlink redirects the file to /data/local.prop, which is then made word writable, then installed, then deleted. We have to interupt it before it is deleted, but after it made world writable.
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
No command is missing, and the symlink is not overwritten. Identical directions were provided for four people independently, before being published. Several had issues along the way with timing, but all ended up with root.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Thanks for responding. How does giving us access to local.prop (world writeable) give us access to create and write the root adb line to file "/data/local/test.prop" per your instructions. This is where I'm confused.
[AT&T, Rogers HTC One X, Telstra One XL] NJGSII:
Tried at least 20 times and thought I had the timing perfect on the last one using xfinrodx's method and still got permission denied upon the next step.

I'll try again in a few.
[AT&T, Rogers HTC One X, Telstra One XL] gtung99:
Something isn't right...there are lots of us who have timed this thing perfectly after about 30 + tries. Have anyone acutally got this to work?
[AT&T, Rogers HTC One X, Telstra One XL] xfinrodx:
+1 This works. I've done it multiple times, usually with 0-2 "misses" each time. If there's no script and people are still having major problems with this later tonight or this weekend I'll go back to stock and make a video to demonstrate timing and command order visually.
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
1000000000000000 apologies, soo glad you caught that!

Absolutely right, I typo'ed in teh directions and it has now been corrected.

it is /data/local.prop

adb shell "echo 'ro.kernel.qemu=1' > /data/local.prop"
[AT&T, Rogers HTC One X, Telstra One XL] NJGSII:
That was probably the problem.

xfinrodx said we had a 3-5 second window and when I timed it perfectly upon seeing the download complete I still got an error.

Retrying now.
[AT&T, Rogers HTC One X, Telstra One XL] xfinrodx:
Now I feel stupid! I reread that OP about 5 times. I went over my log and missed that too. Oh well, send me all your email addresses and I'll issue a full refund of your purchase price of this method to everyone. Oh wait.... ;) Sorry jcase, I should have caught it too.
[AT&T, Rogers HTC One X, Telstra One XL] designgears:
I have been working on a guide script for this exploit. You only have to hit enter a few times, should make getting the timing down a lot easier!
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
You feel stupid? I feel stupid, I wrote the damn thing.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Can you just help me understand?

We create a link in /data/install

Readytogo deletes the link

Download of app starts and size grows

We magically get permission to /data/local/test.prop

How?

I'd just like to learn. Thanks!

edit: You type faster than I do!!!! I'll give the new commands a go, thanks!!!
[AT&T, Rogers HTC One X, Telstra One XL] xfinrodx:
I pioneered the process! You gave me the aerial map and instruction, but I've done it - and I missed that step. Yeah, I feel stupid too! Pity party, shall we? :p
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
It doesn't delete it if you reboot in time.

You make link,

ready2go downloads file to that link, which redirects it to /data/local.prop

then runs chmod 666 on the link which follows to the file

now if you kill the process, ie by rebooting

the file still exists and is world writable.

It is no different than any other symlink attack making a local.prop, i've published ~10 different ones.
[AT&T, Rogers HTC One X, Telstra One XL] NJGSII:
got passed the step, but now I have other problems.

adb is running with root now, but when I go to push SU I get an error saying it failed due to it being a read only system.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
OK, thanks. Here's what is happening for me. Link is made. I go into /data/install directory. Repeated ls -l I see only a symlink. Once the download starts, the link vanishes for a couple seconds (via ls -l the directory is totally empty for a second) and then the file appears and grows as the download is in process. I'll play with my timing some more, but I'm still a little confused.
[AT&T, Rogers HTC One X, Telstra One XL] jcase:
did you run

adb remount

?

if that doesn't work (it should )try

adb shell mount -o remount,rw /system