[AT&T, Rogers HTC One X, Telstra One XL] mar72der:
Hello,

i want to get S-Off and so tried severval ways to change the cid but had no luck.

My HOXL:

- Current ROM ViperXL 3.28

- Bootloader unlocked

- Recovery TWRP 2.6

(bootloader) version: 0.5

(bootloader) version-bootloader: 2.14.0000

(bootloader) version-baseband: 1.27a.32.45.15_2

(bootloader) version-cpld: None

(bootloader) version-microp: None

(bootloader) version-main: 3.17.162.7

(bootloader) version-misc: PVT SHIP S-ON

(bootloader) serialno: HTxxxxxxx

(bootloader) imei: xxxxxxxxx

(bootloader) product: evita

(bootloader) platform: HBOOT-8960

(bootloader) modelid: PJ8311000

(bootloader) cidnum: VODAP102

(bootloader) battery-status: good

(bootloader) battery-voltage: 4161mV

(bootloader) partition-layout: Generic

(bootloader) security: on

(bootloader) build-mode: SHIP

(bootloader) boot-mode: FASTBOOT

(bootloader) commitno-bootloader: dirty-97c9a06e

(bootloader) hbootpreupdate: 11

(bootloader) gencheckpt: 0

I tried:

- echo -ne "11111111" | dd of=/dev/block/mmcblk0p5 bs=1 seek=20 <- failed write protection

- Hex edit the mmcblk0p4 <- adb said ok, but cid hasn´t changed

- oneXChopper exploit (changed cid in ownage) and tried it

C:\>adb push oneXchopper /data/local/tmp/xpwn

2294 KB/s (1283460 bytes in 0.546s)

C:\>adb push busybox /data/local/tmp/busybox

2278 KB/s (811432 bytes in 0.347s)

C:\>adb push ownage /data/local/tmp/phase1.sh

96 KB/s (296 bytes in 0.003s)

C:\>adb shell chmod 755 /data/local/tmp/xpwn /data/local/tmp/busybox /data/local

/tmp/phase1.sh

C:\>adb shell ln -s /data/local/tmp/busybox /data/local/tmp/sed

link failed File exists

C:\>adb shell "/data/local/tmp/xpwn"

[+] This may take a few minutes.

[+] Success!

2+0 records in

2+0 records out

1024 bytes transferred in 0.026 secs (39384 bytes/sec)

2+0 records in

2+0 records out

1024 bytes transferred in 0.003 secs (341333 bytes/sec)

2+0 records in

2+0 records out

1024 bytes transferred in 0.002 secs (512000 bytes/sec)

C:\>adb reboot bootloader

error: device not found

C:\>fastboot oem readcid

< waiting for device >

...

(bootloader) cid: VODAP102

OKAY [ 0.027s]

finished. total time: 0.028s

If your CID is 11111111, then the exploit worked! Thanks to Dan Rosenberg for cr

eating the MotoChopper exploit and myusernam3 for modifying it for the One X!

C:\>pause

Drücken Sie eine beliebige Taste . . .

- jet (ubuntu desktop 12.04 from live CD and persitant USB stick on a Laptop and a PC)

it looks like i´m not able to brick the phone, instaed of boot into download mode the hoxl is boot right into the rom

JET - Jewel/Evita Toolkit v0.3.3beta

This tool will put backup critical partition data and then put your phone

into QHSUSB mode, where it will then downgrade your HBOOT.

Before running this script, you should have TWRP loaded onto your phone.

Plug your phone in via USB and ensure USB debugging is enabled.

Press Enter to continue...

Preparing...

This phase backs up /dev/block/mmcblk0p4 from your phone to this machine. In

addition, we will fetch your IMEI from the phone and use it to create an

additional partition 4 replacement to use as a failsafe. In the

event something goes wrong, you'll have a way to unbrick manually.

Please stand by...

Backing up mmcblk0p4 to /sdcard/bak4

Rebooting to bootloader...

Getting IMEI value...

Building failsafe P4 file...

Success. Rebooting phone.

Rebooting to recovery...

Waiting 45s for recovery...

Pulling /dev/block/mmcblk0p4 backup from phone...

Applying SuperCID mod to backup P4.

Success.

Phase 2

Now that we have backups, we're going to intentionally corrupt the

data on /dev/block/mmcblk0p4. This will cause the phone to enter

Qualcomm download mode (or QHSUSB if you prefer).

The process can't be stopped after this. Continue?

[Y]es or [N]o?y

Do NOT interrupt this process or reboot your computer.

Corrupting /dev/block/mmcblk0p4...

24 KB/s (1024 bytes in 0.041s)

Rebooting...

Success.

Your phone should now appear to be off, with no charging light on.

Press Enter to continue...

Device detection started...

Waking Device...

Even the manual way to "brick" the hoxl and downgrade the hboot failed.
​

Is there any way to change the cid at this moment?

Thanks for helping.