[OnePlus X Q&A, Help & Troubleshooting] SkandaH:
[GUIDE] Unlock the bootloader of OnePlus X without using fastboot & wiping userdata

Introduction

As we know, the official way to unlock the bootloader of OnePlus X is through fastboot.

For a untouched device, the status of the bootloader should be:

fastboot oem device-info
...
(bootloader) Device tampered: [COLOR="Red"]false[/COLOR]
(bootloader) Device unlocked: [COLOR="Red"]false[/COLOR]

To unlock the bootloader, you need to enable 'OEM unlocking' under Developer options first, then via bootloader/fastboot interface:

fastboot oem unlock

It'll eventually erase the userdata.

Then the status of the bootloader should be:

fastboot oem device-info
...
(bootloader) Device tampered: [COLOR="Red"]false[/COLOR]
(bootloader) Device unlocked: [COLOR="Red"]true[/COLOR]

Inspired by the findings on similar devices, we can actually unlock the bootloader of OnePlus X without using fastboot, while keeping the userdata intact.

How-to

Warning!

It is dangerous! This whole thing is basically one giant hack - which is not intended to be done by normal users. It is messing with the bootloader partition, so it is possible that something goes wrong and you will have a nice & costly brick in your pocket. Be prepared to revive the device from a hard-brick.

1.

Enable 'OEM unlocking' under Developer options. You may need to tap the Build number 7 times under About phone to get the Developer options under Settings.

2.

We need root access (kinda expected!). To root the device without unlocking bootloader, use KingRoot. Use the Android version.

Now there is a catch! KingRoot can root the device, cause the latest build of Oxygen OS (2.2.1 ATM) contains such vulnerabilities which can be exploited by the root exploits used by KingRoot. But we can't ensure about future.

See here for more info.

3.

After being rooted, use adb shell or any terminal emulator to dump the 'aboot' i.e bootloader partition in internal sdcard:

su
dd if=/dev/block/platform/msm_sdcc.1/by-name/aboot of=/sdcard/aboot.img

4.

Now we need to modify the dumped image using hex-editor. For OnePlus X:

Unlock Bit Position - 0x000FFE10 Hex
Tamper Bit Position - 0x000FFE14 Hex

'00' means false, '01' means true. So to set the bootloader as unlocked, we just need to change the following:

Save the modified image as 'abootmod.img' inside your sdcard.

5.

Now its time to flash back the modded bootloader. Execute the following from adb shell or any terminal emulator:

su
dd if=/sdcard/abootmod.img of=/dev/block/platform/msm_sdcc.1/by-name/aboot

Do a reboot & voila! You have unlocked the bootloader! Don't just believe me - check the status of the bootloader to ensure.

Note

1. We can also reset the tamper bit using this procedure.

2. If you prefer GUI, then you can use this fantastic app by [MENTION=3562083]wanam[/MENTION].

3. This is tested on an Asia/EU (E1003) variant of OnePlus X running Oxygen OS 2.2.1. Please test & post feedback to ensure compatibility.

4. I'm not providing pre-modified images as it increases the risk of bricking the devices having older/newer bootloaders - please do it yourself. The offsets should be unchanged in future, though.

Credits

1. [MENTION=4544860]osm0sis[/MENTION]

2. [MENTION=4551856]segv11[/MENTION]

3. [MENTION=5381511]Mnt-XDA[/MENTION]

4. My sister - for risking her device for this experiment.

5. Users of XDA & OnePlus forums.

Happy tinkering! :highfive: :good: