[HTC One X] nitrous²:
IHTC One X+ Infos will be adapted to this as soon as possible.

Names for the devices are:

Model ID: PM35110

Model Name: S728e

aka One X+

Model ID: PJ46100 aka

Model Name: S720e

aka One X​

So as the title says, we're facing the problem of not having S-OFF yet, although the One X (S720e) has been released nine months ago. The One X+ is newer but since it has the same processor family, it's accountable to this project. It's possible to unlock the bootloader via HTCdev but it doesn't gives us S-OFF. The Unlock via HTCdev gives us only partially control over Bootloader and Recovery. Since it's release date, some great Devs including Xmoo, Football, Mike1986 and more tried to disable the security check. Unfortunatly without a solution for the masses. Also the One X+ (S728e) is relatively new on the market, so THIS is maybe the first thread in the world regarding S-OFF on the S728e Unlike on other HTC phones, on which hardware solutions like the XTC-Clip, or software solutions like revolutionary or any similar software did the job, on the One X they're not going to work. At the moment the only known method is the official HTC's way.

Ways to set the devices S-OFF​

--------------DIAG + JAVCARD Route--------------​

Infos I could gather. At the moment these infos are only valid for the S720e:

Radio (The Radiomodule on S720e is an Intel X-Gold 626 chip [XMM6260]) location (xmoo's post Radio) Documentation of the Radio chip and direct download:

Possible Hboot location (blubber's post Hboot):

CID Check needs to be bypassed (xmoo's post CID check)

Partiton list (Football's post Partition list)

Mike1986's Partition Info (mike1986's post One X Partition Info)

Mike1986's addition (mike1986's post Addition)

This is how HTC does it:

[YOUTUBE]7EueLGDqIpo[/YOUTUBE]

My attempt (tried also on locked bootloader with the same output)

[YOUTUBE]oaqdskTjgk8[/YOUTUBE]

Things you'll need for this trick:

- USB OTG-Y-Cable. You can also build your own with this guide : How to make external powered OTG Cable

- USB SD Cardreader

- MicroSD Javacard (if you can bypass cid check, the Javacard is not needed) Xmoo said this one is used by HTC: GO-Trust® Secure microSD Java. It costs 980 US Dollars together with the SDK. Also, even if you have the Javacard you have to build the Application environment.

- 5V+ Power supply (Standard wall charger)

- PJ46DIAG.zip= clean S58 Data program specificly for the S720E/S728e. The correct DIAG has tot have a size of 964kb or 941kb and must contain the string "clean s58..." which can be checked with hexedit or any similar hex editor.

The procedure:

1. Put PJ46DIAG.zip on the Secure MicroSD Javacard

2. Plug it into the USB SD Cardreader

3. Plug the Cardreader into the female end of USB OTG-Y-Cable

4. Plug the OTG-Y-Cable into the USB port of the phone

5. Plug the cable onto the power supply

6. Reboot into bootloader

7. Once in Bootloader the file will be load by the phone and you'll land in S58 Menu. Clean S58 Data and you've successfully set your device S-Off

And here's the problem with this method. 1. A Javacard is really hard to get. I've never saw one, no one I know has ever saw one :D 2. The Diag file can't be leaked. The ones I've attached here are useless as Xmoo said and maybe proved. I have attached them though. So anyone interested and willing to help can investigate them.

As we know, the Diag file's for the One X can't be leaked. They're spread to choosen HTC-Repair centres, so a leak will easily be traced back. This would bring the affected people in some serious trouble. But this is interesting. These guys over on pdacentre use the official method. It's suspicious, kind of. For now, this is the only know method. It cost's around 2000 rubel (65€ | 85$) + shipping depending on your location. Of course this isn't an appropriate solution. Another thing; Why do we need a Javacard? Well, because the DIAG files will only work on devices with SuperCID (11111111) not on normal CID (HTC__XXX). So another way is to bypass the CID check.

Rough diagram of a Javacard

Copyright © 2011 GOTrust Technology Inc., All rights reserved.

TOOLBOX

The DIAG files I've linke don't have any function except from superwipe. They're only meant to be used as a test file to check if we can load such DIAG files.:

How do I know that I have the correct DIAG file? ;

The clean DIAG has a size of 964kb or 941kb. Or look at the image above. If your DIAG is called like them it could be the correct one also. But to be really sure, do the following;

Download any HEXeditor you can get. Open the DIAG file with the HEXeditor and search for keywords like "clean", "s58", . If you find these two strings in the DIAG file, it could be the correct one. We'd appreciate it if you could upload the file.

"clean s58"

Known and working DIAG files for the One X

What's already been done:

--------------Alternative APX MODE Route--------------​

Alright Folks! TripNRaVer has made something rudimentary, awesome, fascinating...words can't describe....Work!! Here You go, APX DRIVERS FOR THE ONE X

PLEASE read on the threads I've linked, before you start discussion. People really did some great development.