yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Yes, on firmware 2.2x and up, p12(hboot) is write protected so your not able to anything to it....untouchable.

On 1.85 and below p12 is a signed partition, so you can write to it but if you send ANYTHING unsigned, it's a brick.
[AT&T, Rogers HTC One X, Telstra One XL] ck4794:
i'm not a programmer of any kind, and i don't claim to have any expertise here. but it more sounded like he was saying delete and replace the boot loader, as opposed to edit it. understand you can't edit a write protected file, but does that mean you can't remove it all together and replace it?
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Write protection means no deleting.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Write protected are untouchable, ne edits, no replacing, no deleting, no moving, no nothing at all.......what makes it even better is p12 write protects itself, so even if we breached the chain of trust, p12 may very well still be write protected.....

Rambling on here, but for rooting, we're mostly looking to find exploits within the android ecosystem, the OS itself. Any information pertaining to these other types of exploits have been explained and discussed VERY thoroughly in our S-Off thread....there's a lot of pages, but if your interested in learning more, in great detail I recommend going over and start reading. It's great knowledge, and like I said, covers this type of information thoroughly:)
[AT&T, Rogers HTC One X, Telstra One XL] themacman1000:
Question: Is it possible to replace the ROM in the RUU and have it push a custom (non-rooted) ROM to the device? Or would we need that pesky HTC key to do that?

I remember something similair being available on the HTC Aria for a while before S-OFF was discovered.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
short answer: no.

long answer: would require signing with HTC key
[AT&T, Rogers HTC One X, Telstra One XL] earhog:
I believe official RUUs are signed... And we are never going to be able to do that.. would be like signing your own Xbox/console game
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
I am not an expert, or developer, but this is getting a bit repetitive.

We ABSOLUTELY CANNOT:

1. Flash any ROM's (rooted, non rooted, pickled, etc.) whatsoever.

2. Modify an OTA Update.

3. There is NOT a factory image as far as I know, when you factory reset it just formats /data and (probably) /cache.

4. Sign anything because we do not have HTC's key.

5. Mess with the bootloader.
[AT&T, Rogers HTC One X, Telstra One XL] twistedddx:
The RUU creates a zip which most assume we can modify, but we can not. At the start of the zip is a signature that becomes invalid if you edit the zip at all.

This effects RUU's,OTA and any other form of official update.

If you tried to alter the zip in 7zip you will get a "not implemented" message because it can not fix the signature. The 7zip limitation is not an issue as such, but the signature is.
[AT&T, Rogers HTC One X, Telstra One XL] themacman1000:
It all comes down to not having the HTC key. Just like I thought. :(
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Yeah, it sucks. The most likely method now is if someone can find an exploit in the OS itself.
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
is there, perhaps, a type of app that is automatically given the permissions we need? I don't mean one that gives us root, but the question is are there apps you can download from the play store that our OS just automatically gives the correct permissions? Things like a battery manager? or Wifi Status manager? Even a game so that it can add ads (angry birds). Do any of these type of apps write info to somewhere that we can exploit?
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
It has to be a system app. I think it was beanups who mentioned before that apps you download are installed to /usr for the same reason you don't use root as your main account.
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
oh well..sorry for asking something that was already answered, just trying to brain storm on something we may have overlooked. What about the Themes and such that you can download through sense? I imagine they are kept in the same spot so does that mean they are by default in /usr or is there somewhere else that frivolous things like that(that come already on the device) are stored?
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
any downloaded go to /usr, same with any other file that downloads updates or anything really... short of finding an exploit for JB that exists in ICS there isn't all that much we can do as it all leads to dead ends
[AT&T, Rogers HTC One X, Telstra One XL] h1m:
Since I'm not as knowledgable about this as others in this thread, this is a question to anyone that may have the answer. How optimistic do you think we are achieving root?
[AT&T, Rogers HTC One X, Telstra One XL] tylerdurdin:
I would never say never because we have incredible Devs here. On the other hand, this device has seemed to cover all the bases. Not to mention the lack of interest in the device itself, I am not optimistic at all. Will it EVER? Probably. I just think most of us will have moved on, especially with a Nexus that may actually be worth buying right around the corner. The OneX + now makes this phone rather irrelevant. Still is a beautiful device, but I think we are dying a slow death right now.

Holy crap just realized this question is in the tank.... Apologies.... Sorry sorry.
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
Other than hardware, how different is the One X+ from our phone? Is there the possibility that a root exploit found for the One X+ will work on our phone or vice versa?
[AT&T, Rogers HTC One X, Telstra One XL] jfellon:
I was poking around on my phone n I found dev/log in that directory all the files are writeable events,radio,main,system none of them are readable I thought I would throw this out there I'm on stock 2.20
[AT&T, Rogers HTC One X, Telstra One XL] Luisit0:
Well they say the intl One X is already a completely diff phone and it's the most similar to this one, so I wouldn't count on a One X+ root method to work here... Just my thoughts though

Sent from the One u wish u had ;)
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
internaltional is closer to it than the HOX(L) so no luck with that, if anything at all it'd have to be a leaked rom that would have the exploits unpatched
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
So our best bet is that whatever JB update we are scheduled to get, is leaked a couple of days early?
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
well it sure seems that way for the time being, unless there is a universal JB exploit out there we could use on ICS (doubt it but it worked with gingerbreak and froyo... to some extent)
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
Would it be possible to somehow extract the HTC signature from the zip, without actually touching the zip, then using that key? The using the key bit is easy, just the extracting that is difficult/impossible.

Sent from my locked, tampered ville
[AT&T, Rogers HTC One X, Telstra One XL] :
Short answer no.

Sent from my Nocturnalized One XL using Forum Runner
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
long answer: the device would be obselete by the time we get the key through that method, plus it would be easier and quicker to gain access to HTC's network and take the key... not that I endorse that of course
[AT&T, Rogers HTC One X, Telstra One XL] DAN1EL34:
i hope the official jelly bean update for the one x will be able to get root access
[AT&T, Rogers HTC One X, Telstra One XL] twistedddx:
The zip is signed. The signature is basically unique to the EXACT zip it is signing. You can't use that signature on anything except the original zip. That is the whole point of it.

HTC use this method to ensure you can not flash anything other than exactly what they wanted on your phone.

Think of the signature as a way for the phone to prove only HTC could have created the zip.

For us to be able to correctly sign a zip we created we would need to work out HTC's master key. Give us to year 2050 and we could get it. But for now try to think of something else.
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
I tried a root method and have busybox and dexdump in xbin but no su, is that what normally happens when a root fails, or do they usually not install anything?
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
may I inquire as to which method you used?
[AT&T, Rogers HTC One X, Telstra One XL] ck4794:
you make it sound like htc is the responsible party for the locked phone. i thought htc decided to unlock their phones, and it was at&t that required it to be locked?
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
I believe it was one by beaups or something. A 1.85 one. Idk for sure
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
oh okay, I probably know which one you used. Yeah it does give us the files we need for root, but it's a bit like having a car with tires, but no lug to install them. We've got everything but still can't go anywhere.
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
Oh, okay. I just found Todd couldn't delete them, so I wondered how they got there without root. Haha, thanks tho!
[AT&T, Rogers HTC One X, Telstra One XL] stew1411:
Yes, AT&T requires the phone to be locked, so HTC locked it for them. That was the requirement for HTC to be able to sell their phones via AT&T. Its kind of like buying a car. Japan may allow that car to have a huge motor, but for the company to sell its car in the states, they have to put a substandard motor in it to pass the states' safety regulations. So the manufacturer has to modify their phone to get carrier approval.

Sent from my HTC One X using Xparent Blue Tapatalk 2
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
Expanding on what was just said, though the fault lies with HTC for locking the phone, we cannot blame them for conforming to a requirement set by AT&T that most users of their devices won't even care about. Though I do not know what percentage of cellular cutomers members of XDA and other like minded sites make up. I can tell you that we are not the majority. So though the locked AT&T bootloaders is a major annoyance and roadblock for us. It was a good business decision on HTC's part. For root access we would be better off getting into contact with HTC, but to prevent this from happening again, we'd be better off talking to AT&T and getting them to change their standards.

Back on topic, which are we holding out the most hope for? Root? unlocked bootloader? or S-OFF?
[AT&T, Rogers HTC One X, Telstra One XL] usaff22:
s-off now. If JB comes out, probably root. Or if there is a sudden rise in AT&T One X users who all send HTC an email, unlocked bootloader via HTC.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I'm hoping for any and all;)
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Amen to that. The problem I can see is that Jelly Bean is supposed to be coming to us by Christmas time. Do you think AT&T will patch the hell out of it so we're still stuck like we are now? Honestly, I think that since it will be the first release of jellybean we have a high chance of an exploit. As of right now all known ICS exploits don't work, and we need to find a One X specific one (if there is any).

Can we perhaps find a vulnerability in the stock internet application that would allow us to download to the system partition?
[AT&T, Rogers HTC One X, Telstra One XL] ck4794:
http://xdaforums.com/showthread.php?t=1909478

question, somebody said we needed leaked jelly bean to find an exploit? that link i found today in one of my random news feeds on facebook for some random thing i liked years ago. is that what you were looking for?
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Not a dev, but any non-official roms aren't much use to us as of yet, since we have no idea what AT&T are going to do with the official updates they push out in December time. We can find exploits in these leaks, but it's not guaranteed to be there at launch.
[AT&T, Rogers HTC One X, Telstra One XL] 95neon1025:
yea true i guess thats the best place to start is eliminating was that wont work now cuz i dont wanna start a new thread for one question. can u get the international version to work on the AT&T network? or atleast one with the tegra 3 to work on the AT&T network
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
Please stay on topic people.
[AT&T, Rogers HTC One X, Telstra One XL] saketh91:
seems to be a good idea but did u test it.will it brick the phone by any chance
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
His idea was hypothetical.

How we actually implement it and test it comes later, if we think it might work.
[AT&T, Rogers HTC One X, Telstra One XL] 95neon1025:
Is it possible to put the pc168.img (or whatever it is) on the root of the sd card and then attempt to use that in anyway possible? and the thing with the "corrupt" ruu file sounds like it would brick the phone unless you can prove us wrong.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Flashing an older RUU as is won't work because of the mainver.

If we change the mainver, the RUU probably won't be properly signed anymore, and would also be rejected.
[AT&T, Rogers HTC One X, Telstra One XL] 95neon1025:
oh is that the error that you try to get through htcdev? is that what your talking about?
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
No, every RUU has a version number called mainver.

You can only flash a RUU with the same or higher mainver as the one on your phone currently.

The mainver is in a text file in the RUU zip file.

If you change that, however, it would likely no longer match HTCs signature and would be rejected by the phone.

Sent from my NeoMax Rezound
[AT&T, Rogers HTC One X, Telstra One XL] Arrow44:
Complete and utter noob

Hey guys, I just got my first Android device a week ago and LOVE IT!! (Been an IOS guy for a while and wanted to try something different.) I have no knowledge of Android but really want to help (sometimes I used to help pod2g). If anyone needs any help and think im capable of helping, please ask. Although I am familiar with linux (backtrack and ubuntu dual booted on my laptop)
[AT&T, Rogers HTC One X, Telstra One XL] l3vi47h4n:
I have done it on my EVO 3d and it worked great on that phone. You had to change the main ver, then flash the RUU that was the same as the updated version (same signature) but you would stop it in a certain time in the flash, this would "semi brick" the phone. You then had to boot linux to manually flash an uncorrupted file, hboot I think, then it would let you run the lower RUU no problems. I'll try to find the thread.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Changing mainver isnt going to get you there. Even if you could change mainver and keep the package signed, its going to check hboot version as well. It will see that ur trying to downgrade and kick back. Even phones that have supcid on the 2.2x will get get past mainver. And still get booted back.

Hboot is p12 and u cannot edit its ver. Because it is now wp.
[AT&T, Rogers HTC One X, Telstra One XL] XNine:
That sounds really risky, and unless someone has expendable cash to blow on a test phone for this, I wouldn't think this is a good option.

So...there's no way to modify the HBoot itself in the last update (hypothetically speaking if we can keep the package signed) to allow for flashing/rooting....?
[AT&T, Rogers HTC One X, Telstra One XL] l3vi47h4n:
Downgrade Post

http://xdaforums.com/showthread.php?t=1547695&highlight=downgrade

the post has since been updated and doesn't include the old manual version, perhaps we can find the original (much harder method that first came out) and use that. It didnt include any specially made kits.

HTCs phones are EXTREMELY hard to permanently brick, sometimes it is very hard to restore, but restoration is usually possible. I will try if I have time and can hold on to the One X I have, no promises though.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
In pre 2.2x hox and older htc fones like the 3d, hboot partitions were signed partitions. So crashing them was as simple as flashing an unsigned hboot. But NOW, hboot is write protected. Big difference is with it wp, your not going to be able to crash it because you can no longer write ANYTHING to it. You HAVE TO disable wp. I know it sux but thats the position htc has put in your laps.
[AT&T, Rogers HTC One X, Telstra One XL] l3vi47h4n:
>FFFFFFFFFFUUUUUUUUUUUUUUUUUUUUU-.jpg
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
The signed hboot on a ruu is in a temp rom.zip that gets pushed to your phone then flashed during ruu. There is no way to modify it without losing its sig. (That i have seen i will add:rolleyes:)
[AT&T, Rogers HTC One X, Telstra One XL] sproutd:
Gunny. Sent you a PM
[AT&T, Rogers HTC One X, Telstra One XL] dalewest:
There's hope folks

Looks like there's some potential over at The S-Off Campaign thread.

*fingers crossed*
[AT&T, Rogers HTC One X, Telstra One XL] ackliph:
I SIM unlocked my phone today thinking it might just let me get a bootloader unlock.

It didn't work, but SIM unlocking my phone did change my token (attachment contains both tokens). HTH :confused:
[AT&T, Rogers HTC One X, Telstra One XL] borets.boris:
A different token is generated every time you go through the process, even if everything else stays the same. At least in my experience.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Non official ruu's could be helpful. This one in particular isn't, since its for the international one x.
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
Not sure if there's more to it, but the carrier might physically brand the device (eg. AT&T logo on my One X). They also might install carrier specific apps, such as AT&T hotspot and other nonsense. Does anyone know if the baseband is different for each carrier?

EDIT: AT&T can also add/remove system options, such as the option for sideloading apps that are not on the market.
[AT&T, Rogers HTC One X, Telstra One XL] CHRISTOPHERg:
Yes is different between carriers
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
If it were for our device, than finding an exploit in a leaked rom would be extremely helpful.
[AT&T, Rogers HTC One X, Telstra One XL] timdorr:
I wouldn't be so hopeful for JB being more hackable than ICS. JB implements full ASLR (ICS only implements a partial ASLR), which means many ROP exploits are now impossible. The surface area for exploits is dramatically smaller in JB, so I don't see there being much hope with that version. Realistically, we have to hope for a screwup by AT&T again with the /system/ apps.
[AT&T, Rogers HTC One X, Telstra One XL] :
Just an idea... If every one is talking about mass emailing htc and/or at&t why doesn't someone write a program/script that would automatically email both of them throughout the day and distribute that program/script to everyone
[AT&T, Rogers HTC One X, Telstra One XL] ThisWasATriumph:
Because thats illegal?
[AT&T, Rogers HTC One X, Telstra One XL] jorgegrajales090:
Hi everyone.

Someone have tried to run an script/exploit attached to .pdf or .tiff? I have read some information about vulnerabilities from this two files, specially in .pdf. May be a buffer overflow or a simple script that copies su to xbin folder.

In the case of .pdf HTC has a pdf viewer PdfViewer.apk (com.htc.pdfviewer) located in system/app folder.

This would have some possibilities to work? If yes, I can put some work on this.

Thanks.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
If PDF viewer is in /system/app, yes its worth working on.....
[AT&T, Rogers HTC One X, Telstra One XL] stoopid2001:
I'm running clean rom 5.0 on 1.85, but pdf viewer is in /system/app.
[AT&T, Rogers HTC One X, Telstra One XL] brwnohno:
On stock 2.20 PDF viewer is in system/app
[AT&T, Rogers HTC One X, Telstra One XL] :
Oh...didn't know that:)
[AT&T, Rogers HTC One X, Telstra One XL] RobAndroid:
There are quite a few apk's in /system/app. One of them I see (stock 2.20) is "install_flash_player.apk"...

There's also Facebook and Twitter clients, maybe they're older ones with exploits available?
[AT&T, Rogers HTC One X, Telstra One XL] themacman1000:
I just bought the HOX last Friday, hasn't even arrived yet. Reading this thread makes me a bit sad. I'm really hopeful for an exploit in a system app or an over looked exploit in ICS or JB itself.

Keep the ideas flowing!
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
Flash has been used as an exploit before
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I "believe" the app itself needs to run with elevated privileges on order for it to be used for exploit. Just being in system/app doesn't mean it runs as system. Some things they just put there so you can't remove them :)
[AT&T, Rogers HTC One X, Telstra One XL] xPIN34PPL3Sx:
Is package installer.apk in system/app? Maybe we could use that to install an app that has the right permissions.
[AT&T, Rogers HTC One X, Telstra One XL] nickeedoo:
It aren't. :(
[AT&T, Rogers HTC One X, Telstra One XL] Skizzy034:
I remember back when we were trying to find root for 1.85 someone had said that the Ready 2 Go app exploit may still have been able to be used if it was modified or something like that but it was never looked into I don't think because Beaups found a different root method. Maybe it can still work?
[AT&T, Rogers HTC One X, Telstra One XL] eortizr:
When you get. Send it back and get any other phone. The HOX will not be rootable ever.
[AT&T, Rogers HTC One X, Telstra One XL] :
I'm just going to leave this quote right here

Sent from my Nocturnalized One XL using Forum Runner
[AT&T, Rogers HTC One X, Telstra One XL] themacman1000:
Derp
[AT&T, Rogers HTC One X, Telstra One XL] sarichter:
Not true... they will allow the bootloader unlock eventually. Only when the HOX becomes old news... which will be sooner rather than later with the new HTC phones coming out this winter.
[AT&T, Rogers HTC One X, Telstra One XL] themacman1000:
Agreed. Once it ain't fresh, they'll hopefully lighten up.
[AT&T, Rogers HTC One X, Telstra One XL] blessedswine:
i was on phone with AT&T support and supposedly when the new One X+ is out the bootloader will be able to be unlocked, take that with a grain of salt of course tech support rarely knows what they are talking about. ok now to buisness i have a One Xl that is running 2.20 and another with 1.85 anything i can do to help let me know.
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
So how can y'all translate this into a method of rooting 2.20? Since that is the topic of this thread
[AT&T, Rogers HTC One X, Telstra One XL] 10ndavis:
He just said he had two phones and is willing to help.. Seems to be a lot more on topic than

Just sayn.
[AT&T, Rogers HTC One X, Telstra One XL] alejobog:
The best thing is that a developer telling you how much money comes to realize ROOT and got the money
[AT&T, Rogers HTC One X, Telstra One XL] ECEXCURSION:
Huh.

Sent from my HTC One XL
[AT&T, Rogers HTC One X, Telstra One XL] Jackal239:
Is the SD card in the One X mountable?

If so, is it possible to format it into a goldcard? If that can be done, wouldn't it be possible to push anything into the system folders?
[AT&T, Rogers HTC One X, Telstra One XL] Shryvone21:
I got this one guys!

Quick answer(also is obvious) is no.

Sent from unrooted and plain HTC one x 2.20:/
[AT&T, Rogers HTC One X, Telstra One XL] Jackal239:
Awww darn. I could have sworn when I read through it that you could mount the SD Card in Linux. I figured if you could format it via an outside system you could make it into a gold card. Then you could trigger the device resets from console.

Out of curiosity what prevents this?
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Well for starters, nobody knows the algorithm to create gold cards for newer phones.