Database Info

[ROOT] HTC One X AT&T 2.20 Firmware - X-Factor root exploit

I have successfully rooted the AT&T HTC One X running build 2.20.
In the previous build (1.85), S-ON was only partially enforced, so it was possible to modify the /system partition without having unlocked the bootloader, in order to install su and Superuser.apk. This was changed in build 2.20: full S-ON is now in effect. As a result, it is no longer possible to write to /system even after remounting it as writable, since the S-ON feature has NAND-locked the storage.
In other words, it's impossible have a "permanent root" on 2.20 in the traditional sense without unlocking the bootloader.
I have prepared an exploit that gains temporary root access by leveraging two vulnerabilities and uses these newly gained root privileges to overwrite the CID ("superCID"), so that it's possible to unlock the bootloader via HTC's website. I'm sorry if you'd prefer to not unlock your bootloader this way, but there are no other options for root access available.
===========
DISCLAIMER
===========
This exploit modifies the CID of your device. Doing so likely voids your warranty, and may be in violation of your contract with AT&T (I am not a lawyer). Additionally, while this exploit has been tested and has not been observed to cause any negative side effects in practice, I am in no way responsible if it turns your device into an expensive paperweight.
=============
INSTRUCTIONS
=============
1. Download the exploit from:
http://vulnfactory.org/public/X_Factor_Windows.zip
Edit: Linux/Mac version available here. Thanks to Jesse Osiecki (@jesseosiecki) for suggesting I support this and providing me with a working version (that I ended up re-writing):
http://vulnfactory.org/public/X_Factor_Linux_OSX.zip
2. Extract the entire zip file.
3. Connect your device via USB, ensure you have the latest HTC USB drivers installed (only on Windows), and ensure USB debugging mode is enabled.
4. Double-click "run.bat", or if running Linux or OSX, open a terminal, change directories to the extracted exploit, and run "./run.sh".
5. Follow the instructions printed by the exploit. You will need to authorize two backup restorations during the exploit's execution.
6. If the exploit is successful, it will print "[+] Set CID!". If it does not print this, the exploit has failed, so please do not continue.
7. The exploit will automatically reboot into bootloader mode. Press enter after bootloader mode is finished booting, and the exploit will print your CID. If the exploit was successful, it should return "11111111" as your CID.
8. If your CID was successfully set, press enter to generate an unlock token.
9. Visit htcdev.com, navigate to the "Bootloader unlock" section, choose "All other supported models" from the drop-down menu, and provide the unlock token when asked.
10. After unlocking the bootloader, you can flash a custom recovery partition via fastboot, boot into recovery mode, and use a recovery ADB shell or install from an update.zip to install Superuser and su (I do not provide support for custom recoveries, but this is a straightforward process that other people can help with).
======
NOTES
======
I am not affiliated with any Android forum or group, including XDA - this is just where I've chosen to publish this exploit.
Portions of this exploit are similar in concept to the ADB backup/restore exploit published by Bin4ry, but the vulnerability used in this exploit is entirely distinct from Bin4ry's.
========
CREDITS
========
Thanks to Michael Coppola for pointing me at the vulnerable driver I leverage for the second phase of the exploit, and props for independently discovering the same vulnerability I used. Thanks to jcase and P3Droid for their continuing support - I owe you guys beers.
======
Paypal
======
http://goo.gl/zBGb0

Awesome job!

Thanks for this djrbliss .. root.. yeah!!

Great work man! Congrats.
And welcome to all the new ROM flashers

Well, seems like here's the proof.
I take back my doubts, very nice job!

the one xl is my first android device so i got some questions
by temp root you mean when you shut off the phone we need to do it again?
and i guess there will be a perm root soon because of this exploit am i right?
also ty very much djrbliss
for achieving this :].

It utilizes a temp root to change the CID and therefore unlock
The unlock is permanent, the root is temporary
Though after you unlock, just flash a SuperUser zip and you will get permanent root

Temp root is being used to spoof the CID and unlock the bootloader in order to flash a custom recovery, and thus custom ROMs that are then rooted. This is a permanent root solution.

speednir123 said:
the one xl is my first android device so i got some questions
by temp root you mean when you shut off the phone we need to do it again?
and i guess there will be a perm root soon because of this exploit am i right?
also ty very much djrbliss
for achieving this :].
Click to expand...
Click to collapse
This will fully root your phone. Just follow instructions to root, Super CID, unlock BL then flash recovery.
The root itself is a different manner than 1.85 but the whole process after should be the same. This is a method to get you to unlock the BL.

Stupid question. Will this method work on Mac?
Sent from my HTC One X using xda app-developers app

It's not working for me, dammit
/system/bin/sh: /data/local/tmp/pwn: cannot execute - Permission denied
Sent from my HTC One X using Tapatalk 2

Yes! Finally!
Sent from my HTC One X using xda app-developers app

h1m said:
Stupid question. Will this method work on Mac?
Sent from my HTC One X using xda app-developers app
Click to expand...
Click to collapse
Well the bat file won't run obviously, but if you open up the bat and step through the commands it will work just fine.

ty guys for answering
i got another question does some one got
a step by step about the flash recovery stuff cause it's really confusing

Finally, you are the man!!! I've been following the think tank religiously every day for 2 months.
Sent from my HTC One X using Xparent Blue Tapatalk 2

Thanks for the work you put in on this, and congrats to all you 2.20 guys. Will send my donation I pledged this evening.

So this will work with the new HBOOT as well then? Say if someone uses the 2.20 RUU or got an ATT HOXL with the updated bootloader that came with 2.20 ?
Example - I can flash the 2.20 RUU to get a "fresh start" for my phone ( I have the older hboot , unlocked with S-On, never took the 2.20 update), run this, re-unlock, and then put CM10 back on and everything will function as it does now ?
Sent from my One X using Tapatalk 2

billydroid said:
It's not working for me, dammit
/system/bin/sh: /data/local/tmp/pwn: cannot execute - Permission denied
Sent from my HTC One X using Tapatalk 2
Click to expand...
Click to collapse
Sorry, made a small mistake. I've uploaded a new version to the same URL, please re-download and try again.

Thanks a lot man, massive help!! Will get to downloading right after I charge up!!
Sent from my HTC One X using xda premium

jakew02 said:
So this will work with the new HBOOT as well then? Say if someone uses the 2.20 RUU or got an ATT HOXL with the updated bootloader that came with 2.20 ?
Example - I can flash the 2.20 RUU to get a "fresh start" for my phone ( I have the older hboot , unlocked with S-On, never took the 2.20 update), run this, re-unlock, and then put CM10 back on and everything will function as it does now ?
Sent from my One X using Tapatalk 2
Click to expand...
Click to collapse
Why would you want to. Then you would have to flash boot.img separately which isn't that big of a deal but still annoying.

[Q] Can i update my firmware to 2.20

Hi Guys
Sorry for asking the same old question again..
I just got my AT&t HTC One x from US shipped over to India by my cousin.
It is locked to AT&t and i am unable to use a local network sim in it
I know i need to root it and turn S-off in order to unlock it.
The phone is on Firmware 1.85? and i have tried the ways mentioned in xda to root it but i guess when i click "Check for updates" it doesn't work.
So my question is
Can i manually by connecting the phone to Computer,update firmware to 2.20 so that i can root it that way?
And is it possible to unlock the BOOTLOADER w/out rooting so that phone gets unlocked to other carriers?
please help me out guys i have tried everything to make it work.. thank you

Unlocking the bootloader/rooting/dancing in circles WILL NOT sim unlock the phone.
You will need to use an online sim unlocking service (usually about 20 bucks) to get the unlock code

Currently, S-Off has not been achieved for this phone. And as already mentioned, bootloader unlock will not get you SIM unlock, and no free hack/mod method currently exists. You either need to use a paid unlock service, or if your cousin is currently an AT&T account holder, he can ask AT&T for the SIM unlock code (he will need the IMEI number of the phone, and maybe other info).
If you want root and unlocked bootloader for other reasons (flashing custom ROMs and other mods) there is no reason to upgrade to 2.20. Root method exists for 1.85. You need to root, SuperCID, then unlock the bootloader. Then you can install a custom recovery and flash custom ROMs.
Upgrading to 2.20 is not recommended. The 2.20 RUU will upgrade your hboot, which plugs the holes by which kernels and radios can be flashed from recovery. You will have to flash the boot.img separately every time your flash a ROM. No benefit to updating to 2.20, and actually lose ability to do some things.
If you still want root and bootloader unlock, refer to my index for links to root methods, etc.: http://forum.xda-developers.com/showthread.php?t=1671237
And no, bootloader unlock is not possible without root (temp root in case of 2.20) on the AT&T One X.

area51avenger said:
Unlocking the bootloader/rooting/dancing in circles WILL NOT sim unlock the phone.
You will need to use an online sim unlocking service (usually about 20 bucks) to get the unlock code
Click to expand...
Click to collapse
Dancing in circles? ok got your point.
redpoint73 said:
Currently, S-Off has not been achieved for this phone. And as already mentioned, bootloader unlock will not get you SIM unlock, and no free hack/mod method currently exists. You either need to use a paid unlock service, or if your cousin is currently an AT&T account holder, he can ask AT&T for the SIM unlock code (he will need the IMEI number of the phone, and maybe other info).
If you want root and unlocked bootloader for other reasons (flashing custom ROMs and other mods) there is no reason to upgrade to 2.20. Root method exists for 1.85. You need to root, SuperCID, then unlock the bootloader. Then you can install a custom recovery and flash custom ROMs.
Upgrading to 2.20 is not recommended. The 2.20 RUU will upgrade your hboot, which plugs the holes by which kernels and radios can be flashed from recovery. You will have to flash the boot.img separately every time your flash a ROM. No benefit to updating to 2.20, and actually lose ability to do some things.
If you still want root and bootloader unlock, refer to my index for links to root methods, etc.: http://forum.xda-developers.com/showthread.php?t=1671237
And no, bootloader unlock is not possible without root (temp root in case of 2.20) on the AT&T One X.
Click to expand...
Click to collapse
Thank you for a detailed answer. The reason i though it would unlock the sim was cause i had used other htc phones earlier and when you root them the S-off was achieved so thats why.. anyhow.. thank you for enlightening my dumb bum.

You're not dumb. Just ignorant. Now you have been enlightened. You still have a great phone, you just might have to pay a little bit so you can unlock and use it
Sent from my HTC One X using xda app-developers app

area51avenger said:
You're not dumb. Just ignorant.
Click to expand...
Click to collapse
The word "ignorant" has always sounded like a pejorative word to me. But I had to look up the definition, figuring maybe I don't really know the literal meaning of the word. Which turned out to be the case. One of the definitions of ignorant is "Lacking knowledge, information, or awareness about something in particular" which seems to exactly fit this situation. I guess I gave myself the English lesson for the day!
Every phone is different, and HTC in particular is always changing around their security measures. So the OP is not dumb in any way, but was just missing some particular pieces of information.

Htc one xl 2.40.841.4 root??

Hi, I am another noob on this forum and I have been looking around for a root for my htc one xl which was updated to the latest software version: 2.40.841.4.
I tried to unlock the bootloader through htcdev.com but it does no recognise the device after going through all those steps.
Can anyone please tell me how I can do this if it is possible. If not, is there anything I can do? I really badly want to root my device.
Thanks
Device info:
Career: Telstra
Android version: 4.0.4
Software version: 2.40.841.4

infectedprof said:
Hi, I am another noob on this forum and I have been looking around for a root for my htc one xl which was updated to the latest software version: 2.40.841.4.
I tried to unlock the bootloader through htcdev.com but it does no recognise the device after going through all those steps.
Can anyone please tell me how I can do this if it is possible. If not, is there anything I can do? I really badly want to root my device.
Thanks
Device info:
Career: Telstra
Android version: 4.0.4
Software version: 2.40.841.4
Click to expand...
Click to collapse
Did you use X-Factor root exploit to change your CID first?

He doesn't have to xfactor
Sent from my HTC One X using xda app-developers app

ImagioX1 said:
Did you use X-Factor root exploit to change your CID first?
Click to expand...
Click to collapse
Yep I tried that, but it just recognise the device. I installed htc sync and stopped all the background processes. Yet it's still not working.

area51avenger said:
He doesn't have to xfactor
Sent from my HTC One X using xda app-developers app
Click to expand...
Click to collapse
What should I do then?
Thanks

change your cid back maybe? since only the at&t htc one xl needs to do supercid.

DvineLord said:
change your cid back maybe? since only the at&t htc one xl needs to do supercid.
Click to expand...
Click to collapse
How would I accomplish that?

Doesn't all he have to do is unlock his bootloader through HTCdev.com he has a good cid not att one so it'll work than he can flash a recovery than flash a Rom than have root

omario8484 said:
Doesn't all he have to do is unlock his bootloader through HTCdev.com he has a good cid not att one so it'll work than he can flash a recovery than flash a Rom than have root
Click to expand...
Click to collapse
Yes.
I suggest the OP try to re-install the HTC drivers, try a different USB port, even a different computer, if possible.

redpoint73 said:
Yes.
I suggest the OP try to re-install the HTC drivers, try a different USB port, even a different computer, if possible.
Click to expand...
Click to collapse
Sorry for the very late reply, but I did install all the drivers correctly. Tried it on my linux laptop and windows desktop, but still no success. I read all steps clearly to. But nothing is happening

And again I am on the latest software. I coincidently updated it when I received it without knowing there will be no root or exploits available for the software version yet.

Oh keep in mind that I am updated to the latest default software update.

infectedprof said:
And again I am on the latest software. I coincidently updated it when I received it without knowing there will be no root or exploits available for the software version yet.
Click to expand...
Click to collapse
I think you are still misunderstanding. No exploit is needed for any version of this phone aside from the US AT&T version.
All you need to do is unlock the bootloader, than either flash SU or flash a rooted ROM, in order to get root.
If you are having problems unlocking the bootloader, try a different USB port, and keep trying. I believe some folks have had to do it several times in order to get it to unlock.
Is adb able to see the device at all?

It is evident that the OP needs to read the tutorials that are available more closely.
1. Before you proceed any further, please make sure (130%) that your ADB and Android SDK folders are configured and set up properly. If those aren't set up properly, then you cannot proceed any further. Good way to check is to type in "adb devices" when you think you have everything set up.
2. Go to HTCDev.com and follow the instructions there closely. Read them first, print them, read them again, then execute it step by step. This will allow you to get your unlock token to have your bootloader unlocked. Remember, this will void your warranty.
3. Once you're unlocked, go to TWRP's homepage and download the latest version of TWRP. Do not use CWM as it is not recommended for the HOXL. Once you have that, push it to your device through fastboot to have a custom recovery.
4. Find a ROM that is compatible with the HOXL and flash through recovery. Remember to make a backup of your current stock ROM, in case you need it later.
Those are the steps in a nutshell. Again, keep reading and asking questions if you don't understand something. As long as they're educated questions, you shouldn't get any flak from the members here . Good luck!

I tried that and adb does not come up with any recognised devices.

infectedprof said:
I tried that and adb does not come up with any recognised devices.
Click to expand...
Click to collapse
As long as the usb port on your computer is picking up the phone, this usually indicates that your drivers aren't up-to-date. Try running HTC Sync again to make sure there aren't any new drivers or even check for a newer version of HTC Sync.

It says that all my drivers are up to date already.

You can use www.htcdev.com now, I just unlocked my bootloader yesterday

Cthdarren said:
You can use www.htcdev.com now, I just unlocked my bootloader yesterday
Click to expand...
Click to collapse
I'm sure he was waiting a few months for you to confirm that for him
Sent from my HTC One XL

How do these people even dig these threads out

[Q]10.4.2.18 firmware and unlock

I recently got a tf300t which came already with 10.4.2.17 JB firmware.
At the moment I'm not plannig to install custom ROMs basically because I understand that I should unlock the bootloader and lose the warranty doing so.
The device is notifying that an update (the .18 firmware, I guess) is available, but before upgrading I want to be sure that in the future I will able to unlock the bootloader and then install custom ROMs.
Can someone please reassure me about it?
I'm sorry if this sounds as a dumb question, but I'm pretty new to this tablet and in the past I lost the ability to gain root access for another device beacuse of an OTA update.

Malobestino said:
I recently got a tf300t which came already with 10.4.2.17 JB firmware.
At the moment I'm not plannig to install custom ROMs basically because I understand that I should unlock the bootloader and lose the warranty doing so.
The device is notifying that an update (the .18 firmware, I guess) is available, but before upgrading I want to be sure that in the future I will able to unlock the bootloader and then install custom ROMs.
Can someone please reassure me about it?
I'm sorry if this sounds as a dumb question, but I'm pretty new to this tablet and in the past I lost the ability to gain root access for another device beacuse of an OTA update.
Click to expand...
Click to collapse
If you're already on 10.4.2.17, upgrading to 10.4.2.18 won't affect your ability to unlock. Some people (like myself) are unable to unlock for unknown reasons, but upgrading from .17 to .18 shouldn't make a difference(10.4.2.18 doesn't really change much). If you're able to unlock, you should be able to do it on either .17 or .18. If you're unable to unlock, you then wouldn't have been able to do it on either version.

reffu said:
If you're already on 10.4.2.17, upgrading to 10.4.2.18 won't affect your ability to unlock. Some people (like myself) are unable to unlock for unknown reasons, but upgrading from .17 to .18 shouldn't make a difference(10.4.2.18 doesn't really change much). If you're able to unlock, you should be able to do it on either .17 or .18. If you're unable to unlock, you then wouldn't have been able to do it on either version.
Click to expand...
Click to collapse
Thank you for your answer.
This inability to unlock somewhat scares me.
Is this connected in someway to the production date of the device (which maybe could retrieved from the serial number)?

Malobestino said:
Thank you for your answer.
This inability to unlock somewhat scares me.
Is this connected in someway to the production date of the device (which maybe could retrieved from the serial number)?
Click to expand...
Click to collapse
I'm not sure, I know I and several others have been unable to unlock. There are various theories as to why (ASUS unlock server problems, serial number not in their database, certain serial numbers don't work, etc...). Worst case scenario is that when you try to unlock, it gives you the error "Unknown error occurs, which may be a network connection issue. please wait and try again later" and nothing happens. Personally, I'm pretty sure my problem has to do with the fact that the serial number in settings is different from the one on the bottom of the tablet (the one on the sticker). Unfortunately for me, there is no way to change the internal serial number without being rooted, and no way to root on JB (for now) without being unlocked.

reffu said:
If you're already on 10.4.2.17, upgrading to 10.4.2.18 won't affect your ability to unlock. Some people (like myself) are unable to unlock for unknown reasons, but upgrading from .17 to .18 shouldn't make a difference(10.4.2.18 doesn't really change much). If you're able to unlock, you should be able to do it on either .17 or .18. If you're unable to unlock, you then wouldn't have been able to do it on either version.
Click to expand...
Click to collapse
you say you are unable to unlock can you tell me why? I was on ics and upgraded and now on .17 and wanted to unlock everywhere I look I find a file .13 but nothing for .17 or 18

danyal241 said:
you say you are unable to unlock can you tell me why? I was on ics and upgraded and now on .17 and wanted to unlock everywhere I look I find a file .13 but nothing for .17 or 18
Click to expand...
Click to collapse
Go to:
http://www.asus.com/Tablet/Transformer_Pad/ASUS_Transformer_Pad_TF300T/#download
Under choose OS , select android, go to utilities, the second file should say "Unlock Device App: Unlock boot loader." download the file, copy it to the tablet and open it in file manager. If you have install from other sources enabled it should bring up an install dialog and install an app called unlock tool. Open this app, scroll and click through all of the terms of agreement, and click unlock, If its going to work, this is where the unlock will happen.

reffu said:
Go to:
http://www.asus.com/Tablet/Transformer_Pad/ASUS_Transformer_Pad_TF300T/#download
Under choose OS , select android, go to utilities, the second file should say "Unlock Device App: Unlock boot loader." download the file, copy it to the tablet and open it in file manager. If you have install from other sources enabled it should bring up an install dialog and install an app called unlock tool. Open this app, scroll and click through all of the terms of agreement, and click unlock, If its going to work, this is where the unlock will happen.
Click to expand...
Click to collapse
Thanks could you also point me to which file I need to flash and how to obtain root?
Sent from my LT18i using xda app-developers app

Bootloader Unlock from HTCDev

Hello all,
Has anyone tried to unlock the Bootloader by following the steps given by HTC in HTCdev.com?
Is it the same as S-Off ?

I have done it, and no it isn't the same as S-Off. Unlocking the bootloader allows root access and access to only some system areas. Critical areas such as the radio firmware are still locked down as far as I understand. when the bootloader is unlocked the phone is still in an S-On state. You can still flash custom roms and poke around a bit with S-On
S-Off allows access to all the areas, even the critical ones and is much more dangerous as far as accidentally making your phone inoperable.

royalcrown said:
I have done it, and no it isn't the same as S-Off. Unlocking the bootloader allows root access and access to only some system areas. Critical areas such as the radio firmware are still locked down as far as I understand. when the bootloader is unlocked the phone is still in an S-On state. You can still flash custom roms and poke around a bit with S-On
S-Off allows access to all the areas, even the critical ones and is much more dangerous as far as accidentally making your phone inoperable.
Click to expand...
Click to collapse
Thanks. I am unable to obtain Temproot on Sunshine. The prompt says unlocking Bootloader from HTCdev.com and then trying a different root method might work. Any tips on this?

pai.pradeep said:
Thanks. I am unable to obtain Temproot on Sunshine. The prompt says unlocking Bootloader from HTCdev.com and then trying a different root method might work. Any tips on this?
Click to expand...
Click to collapse
There's a tutorial on YouTube, on how to use HTC.dev to unlock the bootloader. It shows a HTC 10 but still the same process.
The only part that will give you a headache is the bootloader token (which is covered in the video) I suggest you read up more and watch videos on the entire process and what the meaning of it all is.

henslo said:
There's a tutorial on YouTube, on how to use HTC.dev to unlock the bootloader. It shows a HTC 10 but still the same process.
The only part that will give you a headache is the bootloader token (which is covered in the video) I suggest you read up more and watch videos on the entire process and what the meaning of it all is.
Click to expand...
Click to collapse
Will do, thanks!
I had done it long ago on my Desire HD following one of the online Tutorials but have since forgotten.

pai.pradeep said:
Will do, thanks!
I had done it long ago on my Desire HD following one of the online Tutorials but have since forgotten.
Click to expand...
Click to collapse
It's still the same as back then. Last one I done was the HTC Droid DNA.
Here's the YouTube video I used for reference.

pai.pradeep said:
Thanks. I am unable to obtain Temproot on Sunshine. The prompt says unlocking Bootloader from HTCdev.com and then trying a different root method might work. Any tips on this?
Click to expand...
Click to collapse
Haven't used Sunshine, just got back to Android a month ago from IOS. Good luck

I am submitting the form with the unlock token on HTCdev website and get the success message, but I never receive the email with the attachment! Account is registered to an gmail-account. Checked all folder including spam. I am using chrome as browser, tried two different computers (win 10, win 7) . I am not getting any response? The submitted token varies every time its generated even on the same PC. I thought the token is something like a guid, so there fore it should be the same every time generated? Thanks for your help!