yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
He says that cause the 1st of there exploits to be finished has to do with modifying hboot and we all know that will cause a brick. On the new ota hboot is wp so it it won't cause a brick but it simply won't write....

Me and beaups are in contact and working with these guys. So stay tuned. :) also keep in mind this might not work, so don't get to excited like I have been knowen to do in the past, lol:D
[AT&T, Rogers HTC One X, Telstra One XL] omario8484:
So I have yet another question...can is HTC allowed to let us unlock our bootloader at this point or ddoes att not let them...do yyou guys think they'll let us unlock it soon enough via HTC dev ...and if they do somewhere in the future would that help us be able to root this device with 2.2

Thanks for any clarifications Im jjust coming and recovering from being an hHTC inspire flashaholic oh and if tthe boot loader stays locked will it be kinda nearly impossible to get root aand flash rom's et
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Unlocking the bootloader will get root no probs.

However, AT&T insists that their version of the HOX stays locked down.

The Rogers Canadian version is the exact same hardware, but the bootloader is unlock able.

Sent from my NeoMax Rezound
[AT&T, Rogers HTC One X, Telstra One XL] omario8484:
Ingram

So as long as this bootloader is locked getting root on this might be very difficult? So there's nothing we can work with in terms of the rogers model?

And even if we did manage to get root would we be able to flash rom's or would we have to stay on stock rooted
[AT&T, Rogers HTC One X, Telstra One XL] XNine:
All of your questions can be answered by simply looking at the Development section here.

The Rogers model won't help us, yes, we can root if bootloader is unlocked, yes, we can ROM if we have root/unlock.
[AT&T, Rogers HTC One X, Telstra One XL] saketh91:
but i already unlocked my hox with 2.20 using htcdev and do you think i can root my phone now?
[AT&T, Rogers HTC One X, Telstra One XL] xaey:
With an unlocked bootloader, yes you can root.
[AT&T, Rogers HTC One X, Telstra One XL] :
I'm confused you posted this

How did you manage to unlock through HTC dev?

Sent from my HTC One XL using Forum Runner
[AT&T, Rogers HTC One X, Telstra One XL] dalewest:
So... what's your thinking on this? Is there light at the end of the tunnel, or is that a train headed our way?
[AT&T, Rogers HTC One X, Telstra One XL] eortizr:
Is funny, I just swap my S3 for a HOX last night cuz I got tired of making tweaks,overclocking and theming TW just to get a decent experience and the phone I got came with 2.20, but I can't complaing 2.20 is running really, really, really good, and it feels way faster than TW on S3, the main reason I want to root is to get emoji fonts and the camera mod.
[AT&T, Rogers HTC One X, Telstra One XL] omario8484:
Wait you unlocked your hox with 2.2 via HTC dev? How Am I missing something here
[AT&T, Rogers HTC One X, Telstra One XL] roeiboot:
yea, i like to know as well... tried last week and was told here it's not unlockable yet.
[AT&T, Rogers HTC One X, Telstra One XL] eraste:
Me to tried 2 hours ago all stock att 2.20, got error 160 as usual mid not allowed
[AT&T, Rogers HTC One X, Telstra One XL] jasonr803:
just a question but, with (hopefully) the new JellyBean update possibly coming one day, will this 2.20 root have anything to do with unlocking that bootloader to be able to root?
[AT&T, Rogers HTC One X, Telstra One XL] dalewest:
Anyone who did not have root prior to 2.2, or who bought a device that came with 2.2 (as I did), will NOT be able to root their device until someone can figure out how to turn off Security in HBOOT (S-Off). Until then, we are SOL. :(
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Every possible exploit is blocked?!
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
Nope. There's a super secret one that I'm charging $1000 a person to get a hold of... :D

YES every known exploit is blocked.

4.03 is locked down super tight, that combined with the write protection on partitions instituted by HTC screws us pretty good.

My feeling is, we're stuck until AT&T/HTC allows us to unlock the boot loader.
[AT&T, Rogers HTC One X, Telstra One XL] eraste:
So no one could confirm statements from earlier that HTC dev was allowing unlocks now? Don't think it was ever answered, I'm on 2.20 stock will try when I get home and report back unless someone else does
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
It won't work, in order to block any addresses, we need root access to edit hosts files. How would blocking it via router work anyway? The phone checks via mobile data for OTA updates. Also I'm sure you simply can't modify the build.prop and change version numbers, when it trys to flash the package with the modded build.prop it could probably tell it's 2.20. And the part about spoofing an OTA update? We're working on that, but it likely the package is signed, so it might not work, even for other reasons.
[AT&T, Rogers HTC One X, Telstra One XL] cafonez:
I was thinking if completely rebuilt, can we take the new build and modify the security portions before the build and rebuild with version 2.20 or 2.21 for example. I am just not sure how the keys come into play, if hboot would block an overwrite if keys mismatched. if the security portions are rebuilt.

I lack knowledge in knowing if the hboot is in the actual android os source from htc or if the hboot is completely seperate then the android build. unsure if the android os itself can push an hboot. this is where i lack a lot of knowledge.

But I was thinking similar to the type of spoofing keys/fw that is ongoing in the gaming scene. For example, lets say you try to connect to game online with the competitor to the xbox (didnt name for direct reasons), but you can spoof the proper keys on the fly to make it look official, passes the check, and bam your not forced to update. but what if with the at&t update lets say you spoof the proper keys, by a simple copy and paste from the http headers that are sent, i think a program "charles" can do this or any type of reverse proxy spoof (like man in the middle) and force the phone to connect directly to the local network, create an update directory on local host, keys match, force update. > then I guess the tricky part is still the hboot, I dont know if hboot does another type of firmware/key check before it can be overwritten, i imagine it must and is why its so difficult to get it done.

but if someone can get source to hboot, rebuild and change the version in the hboot source and push an overwrite through a local network att update spoof.

another idea I have would be if the processor can be slowed down enough to inject code, kinda like another type of gaming exploit. thus forcing an update that doesnt need to be verified by the firmware.

sorry if im ranting, just some ideas.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Hboot is a wp partition
[AT&T, Rogers HTC One X, Telstra One XL] cafonez:
Does the at&t official carrier update allow it to be unprotected for update purposes? if so, is there a key that does this and would reverse proxy local dns spoof work if the key is copy and pasted on the fly?
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
No, there is no way. Sorry. Power on wp is protected and there is no point after about 0.001 of the phone powering on that it ever becomes unprotected. 0.001 is a generous number I'm guessing too.
[AT&T, Rogers HTC One X, Telstra One XL] awolfcw:
Not being completely stupid I might not know everything I have 2.20 and you can't perform and update via WiFi because everytime I tried it said network not ready can someone correct me or am I in the wrong ??
[AT&T, Rogers HTC One X, Telstra One XL] :
It checks over mobile connection and downloads on WiFi
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Please don't let this discourage you cafonez! We need to be creative as possible for root since all other exploits have been patched. Once again ALL other root methods in the open do not work, we need an original method, no matter how crazy!
[AT&T, Rogers HTC One X, Telstra One XL] metalhead2791:
I don't mean to be spam this thread n I really appreciate all the work that's going on trying to root 2.20 n so before I say anything.. Kudos to you devs :)

Umm so it's been over 2 months since 2.20, what are the chances that root is impossible? Don't mean to sound pessimistic.. Just wondering.. Lol
[AT&T, Rogers HTC One X, Telstra One XL] :
If people would stop asking "what are the chances of root" and actually try to help instead of cluttering up threads, it.might get done a lot faster.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Whether it is possible to achieve root is unknown.

The unknown cannot be calculated.

Your guess is as good as mine.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] cafonez:
I took the newest ruu, opened it up and am going to try opening all the nb0, and go through the files just to see how it would push an update normally through the offline package. Maybe has been tried before but I am going to see how far I can go with it.

Also noticed a lot of se linux going to start looking at normal se linux exploits see if anyway to push to droid to gain access to wp dirs.

Last thought would be manually removal of the actual storage chip and mounting on a linux box just to see what can be viewed.

Not sure if it would be encrypted if booted outside of the phone. Wonder if so, if could emulate the actual android os stock rom let it mount the storage chip then find a way to hotswap it once it's decrypted on the fly by the android os...

Just rambling some thoughts around. Will see how far I can get tonight.
[AT&T, Rogers HTC One X, Telstra One XL] :
All the ruu does is send the zip to the phone, and then it gets flashed. The sd card is also soldered to the board on the phone
[AT&T, Rogers HTC One X, Telstra One XL] cafonez:
Has anyone tried modding the Rom.zip already and let the ruu send the nodded one with a modded hboot? I see the hboot images in there and some other files with signed in the file name. Thinking of extracting the signed files and repackaging them. Will search google to see how many times this has been tried w diff hboots.
[AT&T, Rogers HTC One X, Telstra One XL] :
You can't modify the zip without breaking the signature
[AT&T, Rogers HTC One X, Telstra One XL] PUfelix85:
If one were to pull the battery out of the internals and try to mount the phone's internal memory on a Linux box with the phone off would the phone boot itself due to USB power or could the internal memory be mounted?
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
The internals of the phone have their own security barriers, which is why s-off has not been achieved yet.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] PUfelix85:
That is what I thought. I wish I knew more and was able to contribute a greater amount to the discussion.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
There was an s-off thread somewhere that covers a lot of technical details in great depth.

I didn't understand 90% of it :) But still a good read.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] earhog:
Mod Edit: Off-topic discussion removed. Not sure what this has to do with the One X. Please refrain from off-topic discussion. If it's not related to the One X, don't post it here.
[AT&T, Rogers HTC One X, Telstra One XL] Zoide_:
This one: http://xdaforums.com/showthread.php?t=1639972
[AT&T, Rogers HTC One X, Telstra One XL] hapticxchaos:
From my experience with HTC (which isn't much) modded update zips or hacking the ota isn't plausible. I say this because, as far as android has come, if we could just hack the ota process or flash any zip root wouldn't be so hard to come by, and I'm sure if any exploit of that caliber was possible itve been patched quicker n you can say give me an iPhone.

I'd say our best bet is some sort of local exploit. Which if the devs have been digging, leaves more hope for a jb exploit. Assuming HTC ever updates us

Y'all should get ahold of djrbliss man is a genius or perhaps the guy who ported ICS to the moto droid 3? He was good too.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
You can downgrade hboot once you have s-off.

The method of temp bricking to flash a hacked hboot doesn't work here, if that's what you were thinking about.

Sent from my HTC Rezound

---------- Post added at 04:49 PM ---------- Previous post was at 04:35 PM ----------

I brought up the idea of OTA spoofing because 18th.abn said that it appears that the stock recovery does not check for a signature when installing an OTA.

So if we could get a modified zip into the cache folder that the stock recovery flashes the OTA from...

However, we obviously can't just write to that folder without root.

So I was thinking of tricking the OTA updater program into downloading a fake update. Obviously, there will be some form of network authentication to verify that it is indeed downloading an official update, so we would have to figure out how to circumvent that.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] earhog:
Mod Edit: Off-topic post removed.

Please refrain from off-topic discission.
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Really for that to even be plausible, we would have to have the ota for jb to exist, then we could redirect the download site to a local computer. That would put the necessary files into /cache to flash an update, but we could spoof it to download the ota locally from there right?
[AT&T, Rogers HTC One X, Telstra One XL] hapticxchaos:
I feel confident you need root to do that

---------- Post added at 10:25 AM ---------- Previous post was at 10:24 AM ----------

Really?? No check??
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
OK, so, somebody said they saw that it was signed so that's dead. BUT in the last ota that upgraded hboot, the hboot is in a seperate zip and that is 100% signed with HTC pvt sig and gets updated so that's double squashed..........

Now temp bricking and rooting is 100% possible but the problem is for it to work, the temp brick has to be because of a borked partition and without root, there hasn't been a way to bork a partition. So, like I've mentioned if you can kill a partition that puts the phone in qshusb WITH emmc then it can be rooted...........so why doesn't everybody just start running tons of weird exploits that do anything, who cares what, for ANY device....just plug in your phones and start running any batch file you can find in Google.......first person to brick that fu#$%r and can get an emmc window obviously will get there hand in the bounty jar:)

*****DO IT******THEN**YOU**CAN**SAY**YOUR*A*HACKER************

---------- Post added at 02:21 AM ---------- Previous post was at 01:28 AM ----------

Is everybody bricked:rolleyes:
[AT&T, Rogers HTC One X, Telstra One XL] cafonez:
If ota stock recovery can write and hboot will ignore signature if thinks a stock recovery than DNS spoofing will work with a man in the middle as long as it truly believes it's an authenticated server.... Charles reverse proxy can do exactly that. Problem I ran into is exactly as someone stated early is that it checks first via mobile data. I had turned mobile data off n used WiFi to check for updates, sure enough I saw the 4 g flashing instead of it using WiFi....

However, break the ruu down to the exact files from the temp dir on windows make it look like an att update on your computer with and write it so hboot flashes a nodded stock recovery, again that is based on the theory it doesn't check for Sig on an ota from the actual file...

I found some scripts from HTC in the breakdown from the ruu that has some cid scripting, also some line about showing password was set to N, I changed to Y and will run it, maybe it shows some root password for the file sys .. haven't been home all day but will be soon and plan on messing with this for a few hours
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Mobile data is no issue. You just pull your sim card and update checks work just fine. We know this from the 1.85 root method.
[AT&T, Rogers HTC One X, Telstra One XL] cafonez:
Thanks for the tip. Going to turn my comp into a hotspot, connect phone to it without the sim card. Wait for the string it sends for the update and the response from the server. Copy it. See if it leaks the layout of how it is on the official server. Try to mimic the folders, and do local DNS spoof, using reverse proxy to send the auth string from local DNS, let phone think it's the official update server run a modified unpacked ruu with proper dir layout see if it can write to the folder and see if a flash happens. That's a big if, if it doesn't look for a Sig match if it thinks the servers been authenticated. Just an idea, don't want to get anyone's hopes up. Going to post results.
[AT&T, Rogers HTC One X, Telstra One XL] nugzo:
Good Luck! Thank you for your efforts. Thanks to everyone for your efforts.
[AT&T, Rogers HTC One X, Telstra One XL] billydroid:
Apparently there is a vulnerability in flash player. Not sure if it could be of use

http://www.fortiguard.com/encyclope...h.player.copyrawdatato.memory.corruption.html

This a better write up on it.

http://msisac.cisecurity.org/advisories/2012/2012-068.cfm
[AT&T, Rogers HTC One X, Telstra One XL] :
I think we went over this. It was either patched with the version of flash installed, or flash not being installed in /system, it's somewhere in this thread. I'll look around

http://xdaforums.com/showthread.php?p=32054566&highlight=flash#post32054566

http://xdaforums.com/showthread.php?p=32063436&highlight=flash#post32063436

http://xdaforums.com/showthread.php?p=32060979&highlight=flash#post32060979
[AT&T, Rogers HTC One X, Telstra One XL] billydroid:
I don't remember this being spoken about. I follow this thread closely. We are running a earlier version of flash, so I don't see how it's patched. This is rather recent discovery
[AT&T, Rogers HTC One X, Telstra One XL] :
Here are the links.

http://xdaforums.com/showthread.php?p=32054566&highlight=flash#post32054566

http://xdaforums.com/showthread.php?p=32063436&highlight=flash#post32063436

http://xdaforums.com/showthread.php?p=32060979&highlight=flash#post32060979

If flash is installed in /data/app, rather than /system/app, I don't know if the exploit would work. (also has to have escalated privileges, not just installed in /system)

If there is a newever version installed in /system/app then you would need root to downgrade it to a vulnerable version
[AT&T, Rogers HTC One X, Telstra One XL] billydroid:
It's in the system and pre-installed.We are running an exploitable version as well

Also no one ruled out a java exploit or flash exploit
[AT&T, Rogers HTC One X, Telstra One XL] :
If I understand the exploit correctly, it is similar to a buffer overflow, which is a type of memory corruption to gain escalated privileges.

Except, the msisac site says

The logged on user wouldn't be root if flash isn't running with escalated privileges? But, it also can execute arbitrary code, in theory giving root. Now, how do you go about the exploit?
[AT&T, Rogers HTC One X, Telstra One XL] billydroid:
True but there could be more to it. That's why I'm asking
[AT&T, Rogers HTC One X, Telstra One XL] ck4794:
the issue came up, was talked about, couple of guys said hey this might work, a couple of other guys said you can't do that... nobody offered up proof either way. i don't think anybody ACTUALLY TRIED IT.
[AT&T, Rogers HTC One X, Telstra One XL] :
Well go try it. I think they might have been talking about a different flash exploit then. Nothing I said is stopping you, or anyone else from doing it.

I think someone would need to recreate this exploit to test out for themselves, before we can rule it out, to see what permissions they get and what exactly they can do.
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
I originally brought the idea up since I know that on desktops on ANY platform (GNU/Linux, OSX, and Windows) flash is being exploited. In order for us to gain root via flash, the apk needs to be in the system folder and have an exploit that gets root privledges.

As said before, you're welcome to try it.

If you want you can also try to find an exploit in the default internet browser as I believe its installed in /system/.

EDIT: seems like flash 11.1 is in the system folder. If you can find a 11.1 exploit that gets elevates privledges then you're golden ponyboy.
[AT&T, Rogers HTC One X, Telstra One XL] alejobog:
this works?

http://xdaforums.com/showthread.php?t=1933849
[AT&T, Rogers HTC One X, Telstra One XL] brwnohno:
Maybe if you had root.
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
On the first page its requirements say you have to be rooted
[AT&T, Rogers HTC One X, Telstra One XL] WTFunk:
Try taking out your sim and manually pushing the day forward, I believe that's how some people bypassed the time problem while trying to root.
[AT&T, Rogers HTC One X, Telstra One XL] stoopid2001:
Generally if you reset the time on the phone to 24 hours ahead it will reattempt.
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
Sometimes if that doesn't work you can clear the cache for the clock app and it will help
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
There is no modifying the ruu. I rarely use the word here, but it is IMPOSSIBLE TO MODIFY RUU. No mainver edits or anything else is going to allow it to flash. If even one byte is changed that Rom.zip is worthless. Thank you for the time your spending on it, and this isn't discouragement but an effort to save you a lot of time.........Also, no ruu will ever modify the security flag either.

---------- Post added at 02:35 AM ---------- Previous post was at 02:28 AM ----------

Mod Edit [profanity removed] ;)

I know I'm just the [bleep] lately, but I'm an [bleep] with the best intentions:rolleyes:
[AT&T, Rogers HTC One X, Telstra One XL] qingcai:
from my understanding, when you do ruu update, ruu do send the zip file to the cellphone, but the cellphone verify the signature on the cellphone side. if you dont have right signature of the zipfile, the cellphone will tell you update fail. change the ruu will not make it happen, in windows phone community, they have hacked RUU, but still need to make s-off.
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
Has anyone tried the flash exploit?

---------- Post added at 05:36 PM ---------- Previous post was at 05:26 PM ----------

Just checked, flash does not seem to be installed on /system/app, but a lot of apps are, like dropbox for sense and other things that could possibly have an exploit, htc hub being a major one. We may want to see if we can achieve root via this sense an exploit seems like our best bet.
[AT&T, Rogers HTC One X, Telstra One XL] c5satellite2:
What about dropbox instead of flash?
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Could we possibly fake an update for a system app to attempt some sort of exploit?
[AT&T, Rogers HTC One X, Telstra One XL] nhshah7:
The updates to \system\app go to \data\app. That won't work either.
[AT&T, Rogers HTC One X, Telstra One XL] jorgegrajales090:
Is this the emmc mode that you mention?

imageshack.us/a/img831/9318/img7139c.jpg
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Pretty sure that's hboot...

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
So if worst comes to worst, when we receive the jb update ota, could we take it apart and pull the battery while it's flashing to bork a partition
[AT&T, Rogers HTC One X, Telstra One XL] h1m:
Pull battery?
[AT&T, Rogers HTC One X, Telstra One XL] ringnutz:
Exactly why I mentioned taking it apart...