yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
The issue is in the backup/restore mechanism on the HOX.

What gets backed up/restored per app is determined SOMEWHERE on the device.

When we back up com.android.settings it only backs up /data/data/com.android.settings/files/wallpaper and /data/system/wallpaper.xml

The script uses a timing exploit. Basically it restores:

/data/data/com.android.settings/files/a/somefile

the exploit is that the "a" directory is created world-writeable. The script QUICKLY creates a symbolic link to /data/local.prop AFTER the a directory is created and BEFORE somefile is copied into that directory. Then, when somefile is copied, it's pushed to /data/local.prop with WR permissions and the fun begins.

Issue is our phones will not backup nor restore ANYTHING in the /files directory EXCEPT wallpaper.

I've successfully used "wallpaper" to trick the system into creating a WR directory named wallpaper. We can do what we want inside there....but useless as the system won't backup or restore anything except the directory itself.

We may be able to use the theory behind this exploit with another apk.

com.android.providers.telephony is nice. Does full backup/restore....we can create WR directories, etc. and get them restored. But everything is owned by RADIO and I can't find anything juicy that a symlink with owner RADIO will help us with.

Sorry I'm rambling......
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
If somebody is on a stock rooted 1.85,

Do

adb backup -all

It will be a huge backup of system and data, but what the hay, somebody on 2.20 dl the backup and restore it, then try 1.85 manual root method of beaups and see if the com.Redmond.vdmc restored....if so it may root.........

It will be large, but somebody on 2.20 can then restore the backup and attempt to root the phone with the manual 1.85 method......alternatively, you just backup com.Redmond

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] pololance:
Long shot, but can we remove that wallpaper directory and replace it with a file named wallpaper and restore that?

I'm at work doing this blind, but when I get home I'll delve into it head-first.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Yes of course. Its actually looking to restore a file, not a directory. But we can't place a symlink in "files directory" because we don't have permissions for that.
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
Quick question, if we can get one 2.20 One X rooted, can we then just do a backup and distribute that file to all of us? If so than what is the deference between that and someone who was rooted on 1.85 and upgraded but kept root?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
No. There are many 2.2 phones that are rooted, mine included. Backups to my knowledge just back up apk's and what's in /data/data. Key to root is su binary located in /system/xbin
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
could we place the necessary files within like the wallpaper directory, and then push them to xbin?
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
oh okay, sorry for bothering you.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
It's no bother. That's what this thread is for :)
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
has anyone opened their One X? What medium is the data saved in? Because on some phone you crack them open and it's just an sdcard fused to the board?
[AT&T, Rogers HTC One X, Telstra One XL] stew1411:
That's the case here. If you watch a YouTube video of the one x tear down, they point out the integrated SD card on the board.

Sent from my HTC One X using Xparent Blue Tapatalk 2
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
so what happens if we stick the SD card into a card reader? are we able to edit files are is it no different than going through the USB port?
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
HTC stopped doing this awhile back, its a soldered on chip now
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
Beaups -

What are you using to decrypt/extract/modify your hox backups?
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Does anyone know of a jtag solution?

I couldn't seem to find anything about jtag and the one x.
[AT&T, Rogers HTC One X, Telstra One XL] Shryvone21:
Ha stupid thing to say but how can I get root on 2.20 without the su?
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Sprinkle it with grass seed and fertilizer:)

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] Shryvone21:
Ha and then I wait for it to sprout(says my bald enviorment science teacher)
[AT&T, Rogers HTC One X, Telstra One XL] pololance:
Anybody familiar with the NFC exploit achieved just recently on the GSIII?

Not sure if we have the same vulnerability as that device does currently...
[AT&T, Rogers HTC One X, Telstra One XL] billydroid:
From what I gathered from reading, we are all susceptible to 0day exploit. Which runs with escalated privileges. Could someone comment if this is useful
[AT&T, Rogers HTC One X, Telstra One XL] pololance:
Definitely. Zero-day basically means the vulnerability is so new that there isn't a patch for it yet.

The GSIII actually used a couple zero day exploits to gain root access.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
But it doesn't mean our devices are succeptible. Depends what NFC code is shared between hox and GS3. Has anyone researched?
[AT&T, Rogers HTC One X, Telstra One XL] TonyBoes:
http://labs.mwrinfosecurity.com/blog/2012/09/19/mobile-pwn2own-at-eusecwest-2012/

Not a lot of info has been released for it. I they will give more once Samsung patches it.
[AT&T, Rogers HTC One X, Telstra One XL] pololance:
BIG EDIT: (Pulled from NFCForum) Open and standards-based: The underlying layers of NFC technology follow universally implemented ISO, ECMA, and ETSI standards

So, no proprietary code. All NFC devices use the same code.
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
And from what I understand the guys that discovered it are waiting for Samsung to patch the exploit before they release publicly how they achieved it
[AT&T, Rogers HTC One X, Telstra One XL] billydroid:
These are the guys who did it. They have a framework program called "Mercury" 'for Android to find bugs/exploits. They also explain what they did to gain access to the sgs3.

http://labs.mwrinfosecurity.com/tools/2012/03/16/mercury/
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Underlying layers and the code are two different things. obviously the protocols are standardized but leaving holes open for exploit are not. That's the equivalent of saying every computer with ethernet is vulnerable to every virus in the wild, regardless of what software it's running, because ethernet is standardized.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I think the vulnerability that gave them escalated privileges was not related to the NFC exploit at all...they used a seperate NFC exploit to deliver it is all. So that's why they are waiting samsung alone to patch it.

Added: doesn't mean the exploit isn't on other phones tho, I'm curious to see the actual privilege exploit myself

OMG! It is??

^^^Proper out of context tactics:)

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] Zoide_:
Maybe someone can use Mercury to look for vulnerabilities in the HTC One X?
[AT&T, Rogers HTC One X, Telstra One XL] pololance:
I've tried a couple and haven't gotten anything back, like XRay for example.

I have Mercury downloaded, installed and ready to go...just forgot to bring my USB cable to work with me.
[AT&T, Rogers HTC One X, Telstra One XL] mishicki:
I will look into this as soon as I have my virtual box up and running, hopefully tonight. I will post anything that I find as soon as possible.:good:
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
You have the hopes of everyone a part of and following this thread, no pressure :D
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
To be a "realist" I'm sure AT&T has patched all previous exploits. Don't get your hopes up.
[AT&T, Rogers HTC One X, Telstra One XL] PUfelix85:
Has anyone had any luck with Mercury? Unfortunately I have had no success connecting the app and my computer. I am not sold on it as a solution as of yet.
[AT&T, Rogers HTC One X, Telstra One XL] doc_v15:
Does anyone have know the Android Ultimate Toolbox pro software for PC?

http://xdaforums.com/showthread.php?t=1886562

Maybe we can use it? Add some genius tweaks maybe? Just an idea
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Has anyone tried the universal HTC exploit? It half worked on my One S. I managed to get superuser in /system/app and Su.bin but none of the apps get superuser permissions.

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Universal HTC exploit is confirmed to not work on the HOXL.
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
Could you somehow hijack the transfer app from internal to sd card storage feature to allow data to be written to the internal storage?
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
writes to /mnt/sdcard
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
How do carriers write to the system partition then? Do they have a signature as well?

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] timdorr:
The bootloader will write to the system from a ROM zip file. But it will only do so for signed zips. Once the zip is modified (for example, to add su), the signature is no longer valid. And a valid signature that the bootloader will accept can only be generated using HTC's signing certificate, which they have locked up somewhere in the company.

In addition, it's also set to only accept ROMs of the same version or higher than whatever is currently installed. So, that's why we can't just go back to 1.85 and root from there before going back to 2.2.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
if the device was S-off then you could push an earlier hboot version across with an earlier RUU and enjoy rooted stuff, but with 2.40 and without s-off there is no known way to achieve root without unlocked bootloader
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
What I'm saying is though, do carriers send their zip back to HTC to get it signed, or do they have a copy of the certificate as well?

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] E:V:A:
What bootloader is doing this check? If its after PBL and before hboot, and unless they have also enabled secure JTAG, this could be an interesting attack vector for those who have been messed up by flashing new ROMs. Basically, it should be possible to change this version-check bits with JTAG so that we can revert... But JTAG of HOXL won't be pretty, but at least possible... In addition it may be possible with USB-based JTAG if they support that standard. However, this is still a bad solution since it would not be available to the "public".
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
It's Hboot versions that block us from using different ruu's. As far as firmware versions go, as long as they have the same Hboot version we can flash anyone one we want if we have supercid. So all its looking for is proper signature and matching cid. Supercid get us past cid and mainver checks. If the ruu has a lower Hboot ver, then you just get a bootloader error. That's why, when they released firmware version 2.20, which had a new Hboot(1.14 previously 1.09) included in it, they also changed the Hboot partition(mmcblk0p12) from being just a signature protected partition, to a Write Protected partition. It would have been a HUGE vulnerability because with a signature protected only partition, it is very easy to downgrade hboots to earlier versions. Also, making sure that p12, couldn't be corrupted, they also closed off the possibility of us intentionally bricking the device into a vulnerable state.

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
If that's the case, than could it be possible to make a zip containing all of the necessary files for root and send them to an HTC dev to get it signed?
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
I feel like that would be against there "contract", or whatever it is, with at&t. Haha
[AT&T, Rogers HTC One X, Telstra One XL] Zoide_:
How do signatures work? Could we add the su binary and remove something else / add a junk file such that the total number of bits is the same as in the original zip? I'm guessing this is too easy so it won't work :p
[AT&T, Rogers HTC One X, Telstra One XL] alejobog:
can not install an older version and not more, always get the same error, I'm installing the 2.33 of this forum and get the error, thanks

http://forums.team-nocturnal.com/showthread.php/1005-RUU-One-X-XL-LTE-RUU-s
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
I wonder how much money it would take for them to say yes.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] RomsWell:
Might wanna get with the fellas who s offed the rezound. Service mode might be the only method. And the wire trick wasent all that hard or dangerous. Just food for thought.
[AT&T, Rogers HTC One X, Telstra One XL] timdorr:
I'm actually curious about this as well. What signing method are they using? If it's something as simple as an MD5 signature, then it should be relatively simple to create a collision and implement a similar signature. But I assume it's slightly more sophisticated than that.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
There's another thread where they're trying to get s-off.

Wire trick won't work on One Series. (non removable battery)

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Wiretrick has been covered many many times. Its fairly simple and can be done on the one X, but it doesnt offer us any type of vulerability.
[AT&T, Rogers HTC One X, Telstra One XL] Zoide_:
Does anyone know how the updates are signed, and whether it might be worth looking into circumventing that?
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
they are signed exactly the way a ruu is, if there is even 1 byte changed in the package it is no longer signed....even if the package remains the exact same size, the change of information in the 1 byte, changes the signature so these methods sadly dont offer any realistic options. Sorry to be the one with the gun in here atm guys, Im happy this place is flowing and keep the ideas coming......I have my hox on 2.20 (less the hboot) right now unrooted and working on it too atm:)

---------- Post added at 08:00 PM ---------- Previous post was at 07:32 PM ----------

Oh Schnaap! I got a new working method of symlink to build.prop(temp root) on 1.85...........testing on 2.20 shortly

local.prop, sorry:)
[AT&T, Rogers HTC One X, Telstra One XL] timdorr:
But what method is used for signature? MD5? SHA-1? Something else? If it's MD5 or something else old, it's weak and a collision can be generated. It's just a matter of priming the hash registers for the last block and figuring out what to put in that block to generate a colliding file.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Having trouble getting the symlink on 2.20........will be working on this rest of the day.....
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
I couldn't find it via google, but I'm sure it's NOT md5, but rather something stronger like AES 256 or something very strong.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
its a htc private key, its not generated for each signed file but the same private key they use to sign all their files per device
[AT&T, Rogers HTC One X, Telstra One XL] timdorr:
But the key question is: What format is that key in?
[AT&T, Rogers HTC One X, Telstra One XL] :
Not in a format that can be bruteforced: it is a 256 bit signature that we aren't getting into
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Lol I have no idea why I said AES. Yeah HTC has their own specific keys and it's next to impossible for us to bruteforce it.

I'm sure a jtag method would work, but it's so inconvenient that it's not even worth it.
[AT&T, Rogers HTC One X, Telstra One XL] jorgegrajales090:
Hi! This is my first post. I have an AT&T HOX I'm interested on this and I have some intermediate experience with linux commands and I am a programmer. Actually experimenting with Mercury framework.

Mercury shell tool has write permisions in the folder /data/data/com.mwr.mercury and busybox can be copied there. Executing ln /system/build.prop /data/data/com.mwr.mercury/build.prop (symlink I think) runs succesfully. This helps with that trouble or I am in the wrong way?

I think that linking that file in some place that can be changed I can change the Model ID or ROM version to downgrade with RUU. Is this possible?

Thanks.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Can't downgrade hboot without s-off.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] jorgegrajales090:
Ok. Thanks.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I'm concluding, that any form of using adb backup/restore for root exploit is a dead end....I covered it like a politician with a prostitute today,(which means probably not as well as I thought:p)

Sent from my HTC One X+ p_type 0.91.0
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I don't think its dead just yet. Unlikely, yes.
[AT&T, Rogers HTC One X, Telstra One XL] eortizr:
Mod Edit: Please refrain from.off-topic discission. This thread is about gaining root for 2.20, not about the S3.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Edited

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] doc_v15:
Does mobile odin pro support at&t one x? Maybe we can try that

Sent from my Nexus S
[AT&T, Rogers HTC One X, Telstra One XL] billydroid:
No, odin is for Samsung phones
[AT&T, Rogers HTC One X, Telstra One XL] Shryvone21:
So are we stuck again?

Sent from unrooted and plain HTC one x 2.20:/
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
By the looks of it, yes. Maybe S-OFF can save everyone, though.

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] Shryvone21:
May you please send a link to the post:)? Thanks.

Sent from unrooted and plain HTC one x 2.20:/
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
It's in this General section.

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] PeartFan40:
Just a reminder to refrain from off-topic discussion. Thanks! :)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"If you choose not to decide, you still have made a choice"
[AT&T, Rogers HTC One X, Telstra One XL] ronii1123:
Jason Dunn from HTC is going to be at the Big Android BBQ, someone should give him a visit if they got tickets :P
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
Mod Edit: Look up...see my post? The one right above this one? PLEASE refrain from off-topic chatter. This is the third time I've had to remind you. Next time it will come in the form of an infraction.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
that isnt acheiving root for the community. even if you then used the ADB restore/backup prompts I bet there would be some code somewhere either in hboot or in the system tying a device ID to that restore image
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
I thought of that, but wouldn't it be easier to navigate a back-up from a 2.20 device with root and replace whatever markers are built in with either a blank one or one for your device?
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
No.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
given that someone has a rooted 2.20 device with the backup made and then restored that another device, which would probably have broken permissions due to device identifying tags for that specific device (meaning the one the restore was made from) however I dont believe that identifying partitions would be copied over in the restore. this method seems kinda half and half at the moment until we get someone to test its functionality... I personally doubt it will work
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
The backup exploit has nothing to do with backing up and restoring root files. You can't do that. Its simply a timing attack to create a symlink creating a local.prop file. Similar to every other exploit we've dealt with in the hox.
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
Are there any apps out there that have permission to write to the internal storage? Or are att apps the only ones that have that permission?
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
Perhaps we could use one of the built in HTC Sense plugins as our attack front for a method similar to the AT&T Bloatware exploit? Perhaps Twitter for Sense or Stocks?
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
Idk how logical it is, but is there any way you could boot a rooted rom off sd storage then edit internal storage that way? I'm guessing you would need su for that too
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
If we could boot up rooted roms, then...

I know you're trying to help, and we appreciate it, but please think about what you just said.
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
I was referring to a way to bypass the bootloader, I may not know much about phones but i am very familiar with pc's, and I know its possible with them so it was a shot. And I thought about what I said, obviously it was taken wrong.

---------- Post added at 12:24 AM ---------- Previous post was at 12:12 AM ----------

And as far as the rom being rooted, it wouldn't have to be. I was getting at if the stock os wasn't running, there would be nothing denying us permission to edit it.
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Sorry I misunderstood, but HBoot also stops us from doing anything much as well. You're talking about something like a livecd? Yeah, our bootloader is pretty locked down, and we won't be able to edit anything without the right permissions.

Once again, didn't mean to come off as rude.
[AT&T, Rogers HTC One X, Telstra One XL] Zoide_:
Is there any way to contact someone from HTC and ask them for help? After all, HTC seems to be pretty open to people tinkering with their phones (http://htcdev.com/), and our phones are only locked down due to AT&T's fault.

I'm sure HTC would not publish a way to circumvent these things openly, but perhaps they wouldn't mind it if someone provided unofficial assistance off the record.
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
Yea, like a boot from livecd/USB type thing. No way to completely whipe the phone either then? Bootloader and all?

---------- Post added at 12:44 AM ---------- Previous post was at 12:39 AM ----------

Any way to make a virus in our favor? As in to disable the bootloader completely, then work from there? Just a thought.
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
Yea it doesn't work like that, you disable the boot loader and you have yourself a nice brick
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
tried that, fastboot is locked down to a few commands unless bootloader is unlocked
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
Once bricked there's no way to replace it with the old version? An unlocked version?
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
the eMMC doesnt qualify for the the eMMC brick bug, so there is no way to achieve root through that if that is what you are getting at
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
i guess that is the technical term for what I was meaning? Lol, just tossing up thoughts.
[AT&T, Rogers HTC One X, Telstra One XL] iceman99393:
On the xperia play cdma the bootloader was locked, yet we could install cwm and restore a nandroid of a stock rooted Rom. Then again we had root....hmmm
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
What if you wipe the BL in the OS, and remake the bl, without rebooting? I'm quite sure you get a brick if you reboot without a bl. But while you're in the OS, the bootloader doesn't matter.

Sent from my locked, tampered ville