Database Info

How To Root An AT&T HTC One X [No Longer Working]

This root was rendered unusable at this time due to AT&T disabling the Ready2Go app installation feature. Working on a work around now.
Original content:
http://www.androidpolice.com/2012/0...the-att-htc-one-x-on-version-1-85-or-earlier/

Hope you get your One X soon dude!
Confirmation number: 8PH11891CA483914J

In! Thanks Justin!
Billy

Damn, thanks a lot!

jcase said:
Now comes the timing critical part, you have to use ATT Ready2Go to Download "AT&T Mark the Spot", and interrupt the install process right after the download has finished. Easiest way is to reboot the device, but we have found other ways to do it.
Click to expand...
Click to collapse
OK, so when exactly do we reboot? There is no download status bar or whatnot, and I have rebooted right when it says install started to no avail. Do we have to do it before that point?
<---Not a noob, just crappy at timing.

id10terrordfw said:
OK, so when exactly do we reboot? There is no download status bar or whatnot, and I have rebooted right when it says install started to no avail. Do we have to do it before that point?
<---Not a noob, just crappy at timing.
Click to expand...
Click to collapse
You need to reboot right after the download is done. I haven't had a chance to do this in person, I just found it in the firmware and asked others to test for confirmation. Hopefully someone can chime in and tell us what visual indicators show when to do the reboot.
Some testers got it first try, some took 3-4 tries.

id10terrordfw said:
OK, so when exactly do we reboot? There is no download status bar or whatnot, and I have rebooted right when it says install started to no avail. Do we have to do it before that point?
<---Not a noob, just crappy at timing.
Click to expand...
Click to collapse
I'm with you on this one. I've been trying this for last hour but to no avail. The minute it says in status bar that it's installing, I tried command. I tried when I press finish on phone and LTE signals go up and down and even tried as soon as I was done with att site but can't get it to work. I've restarted 20 times and this startup sounds I think is now annoying other people in the office

jcase said:
You need to reboot right after the download is done. I haven't had a chance to do this in person, I just found it in the firmware and asked others to test for confirmation. Hopefully someone can chime in and tell us what visual indicators show when to do the reboot.
Some testers got it first try, some took 3-4 tries.
Click to expand...
Click to collapse
Hah, well now I just feel dumb as I am on try 10 or so. I must not be able to hit the timing right at all. I'll keep at it, as I am constant as the northern star.

Don't feel dumb, it is very timing critical, with few real indicators of when to pull it off.
Maybe xfinrodx or designgears can chime in on this one

noobsquared said:
I'm with you on this one. I've been trying this for last hour but to no avail. The minute it says in status bar that it's installing, I tried command. I tried when I press finish on phone and LTE signals go up and down and even tried as soon as I was done with att site but can't get it to work. I've restarted 20 times and this startup sounds I think is now annoying other people in the office
Click to expand...
Click to collapse
Turn your ringer off, it will silence the startup sound. At least I can help with that!

id10terrordfw said:
Turn your ringer off, it will silence the startup sound. At least I can help with that!
Click to expand...
Click to collapse
Thanks, but everytime I do factory reset...it comes back on?
I might be doing something dumb.
After I get permission denied error, I try to start at the process of tryping:
Code:
adb shell ln -s /data/local.prop /data/install/com.att.android.markthespot.apk
but when I do that after uninstalling AT&T Mark the spot, it gives me erorr:
link failed File exists
So I do a factory reset and then try again from scratch.
Is there an easier way to repeat the process?
Edit: I figured it out, just delete the file like this:
Code:
adb shell rm -r /data/install/com.att.android.markthespot.apk
Hope that's the right way of doing it.
Thank you.

I have been deleting the file from data/install
adb shell
cd data/install
rm com.att.android.markthespot.apk
exit
then repeat the process...i'm in double digits on attempts...going to have to walk away from it for a bit.

going on 10x for me and still nothing. Any suggestions?

id10terrordfw said:
OK, so when exactly do we reboot? There is no download status bar or whatnot, and I have rebooted right when it says install started to no avail. Do we have to do it before that point?
<---Not a noob, just crappy at timing.
Click to expand...
Click to collapse
No worries. Here's the way I did it back when I did it:
Open 2 cmd windows
adb devices on both (to make sure daemon is running)
In first shell type adb reboot but do not execute (obviously!)
In second window, cd /data/install
Enter ls -l
Now tell Ready2Go to install.
In that second window SPAM "up arrow - enter" to repeatedly execute ls -l. Observe the .apk file growing in size. When it stops growing it's probably done downloading (It is 3801413 bytes as of today). Go back to that first window IMMEDIATELY and hit enter on that adb reboot you typed in. It's a small apk so you need to be fast.
This was my method. Hopefully it works for you!

noobsquared said:
Thanks, but everytime I do factory reset...it comes back on?
I might be doing something dumb.
After I get permission denied error, I try to start at the process of tryping:
Code:
adb shell ln -s /data/local.prop /data/install/com.att.android.markthespot.apk
but when I do that after uninstalling AT&T Mark the spot, it gives me erorr:
link failed File exists
So I do a factory reset and then try again from scratch.
Is there an easier way to repeat the process?
Edit: I figured it out, just delete the file like this:
Code:
adb shell rm -r /data/install/com.att.android.markthespot.apk
Hope that's the right way of doing it.
Thank you.
Click to expand...
Click to collapse
Um, why are you doing a factory reset?
---------- Post added at 12:11 PM ---------- Previous post was at 12:10 PM ----------
xfinrodx said:
No worries. Here's the way I did it back when I did it:
Open 2 cmd windows
adb devices on both (to make sure daemon is running)
In first shell type adb reboot but do not execute (obviously!)
In second window, cd /data/install
Enter ls -l
Now tell Ready2Go to install.
In that second window SPAM "up arrow - enter" to repeatedly execute ls -l. Observe the .apk file growing in size. When it stops growing it's probably done downloading (I think it was around 5MB but it's been a while). Go back to that first window IMMEDIATELY and hit enter on that adb reboot you typed in. It's a small apk so you need to be fast.
This was my method. Hopefully it works for you!
Click to expand...
Click to collapse
I will give that a shot, and I should have thought of that. Thanks!

xfinrodx said:
No worries. Here's the way I did it back when I did it:
Open 2 cmd windows
adb devices on both (to make sure daemon is running)
In first shell type adb reboot but do not execute (obviously!)
In second window, cd /data/install
Enter ls -l
Now tell Ready2Go to install.
In that second window SPAM "up arrow - enter" to repeatedly execute ls -l. Observe the .apk file growing in size. When it stops growing it's probably done downloading (It is 3801413 bytes as of today). Go back to that first window IMMEDIATELY and hit enter on that adb reboot you typed in. It's a small apk so you need to be fast.
This was my method. Hopefully it works for you!
Click to expand...
Click to collapse
Good advice, was the first person to test it for me. I confirmed it with 4 users before posting, and all got it eventually.

id10terrordfw said:
I will give that a shot, and I should have thought of that. Thanks!
Click to expand...
Click to collapse
I was the first one I'm aware of who used this exploit a couple weeks ago. I won't claim that the process is clean, but it should work for you if you do it the way I intended the instructions to read... Good luck!

Thanks for all the help but I think this red bull is not working today.
Here is what I did:
First CMD:
Code:
adb shell
cd /data/install
ls -l <- it only gives me the file name..it doesn't tell me the size.
Also, I delete the file and run the first command in second CMD and right after that I see this in ls -l:
[email protected]:/data/install $ ls -l
ls -l
lrwxrwxrwx shell shell 2012-05-25 12:16 com.att.android.markthesp
ot.apk -> /data/local.prop
Second CMD:
Execute:
Code:
adb shell ln -s /data/local.prop /data/install/com.att.android.markthespot.apk
Wait to execute:
Code:
adb reboot

xfinrodx said:
No worries. Here's the way I did it back when I did it:
Open 2 cmd windows
adb devices on both (to make sure daemon is running)
In first shell type adb reboot but do not execute (obviously!)
In second window, cd /data/install
Enter ls -l
Now tell Ready2Go to install.
In that second window SPAM "up arrow - enter" to repeatedly execute ls -l. Observe the .apk file growing in size. When it stops growing it's probably done downloading (I think it was around 5MB but it's been a while). Go back to that first window IMMEDIATELY and hit enter on that adb reboot you typed in. It's a small apk so you need to be fast.
This was my method. Hopefully it works for you!
Click to expand...
Click to collapse
Great Idea !!!.... If you could post the exact size of the file , we can probably try to script it...( I have an idea in mind as mentioned below , but not sure if it works the way I intended in android )
for Ex:
szie=`ls -l /data/install/com.att.android.markthespot.apk | awk '{print $4}'`
while [ "$szie" -lt <size-of-apk> ];do
echo "waiting......"
done
adb reboot

dharani1234 said:
Great Idea !!!.... If you could post the exact size of the file , we can probably try to script it...( I have an idea in mind as mentioned below , but not sure if it works the way I intended in android )
for Ex:
szie=`ls -l /data/install/com.att.android.markthespot.apk | awk '{print $5}'`
while [ "$szie" -lt <size-of-apk> ];do
echo "waiting......"
done
adb reboot
Click to expand...
Click to collapse
If you can get a working script, that was reliable I would love to post it in the OP. To get an idea of the size, you could install the app, and do adb shell ls -l /data/app/<filename>

[TUT] Downgrade/Unbrick Ville S4

Introduction​
This should work on the S4 version of the HTC One S. I do not recommend trying this on the S3 version..
Nobody is responsible for the outcome of your phone except you. You know the possible risks and you took them
DO NOT ATTEMPT UNLESS YOU ARE COMFORTABLE WITH THIS OR KNOW WHAT YOU ARE DOING
DO NOT ATTEMPT TO DOWNGRADE IF YOU TOOK THE JB OTA. IT HAS BEEN REPORTED TO PERMANENTLY BRICK PHONES ON THE EVITA SIDE
DO NOT ATTEMPT UNLESS YOU HAVE LINUX INSTALLED.. Ubuntu 12.04 or higher preferred - 32/64 bit!
You can use a livecd or wubi. No virtualbox
This guide assumes your Bootloader is unlocked, You have Recovery Installed, and USB Debugging is ENABLED. Please enable USB debugging before continuing​
Creating the brick​
Prerequisites: killp4.. included in the unbrick package
unbrick package: http://dl.dropbox.com/u/40181085/ville.zip
A backed up p4!
*MAKING A NANDROID BACKUP WILL DO NOTHING FOR YOU.. BUT I DO RECOMMEND HAVING ONE AT ALL TIMES*
1. Place killp4 on your /sdcard
2. Download adb and enable USB debugging (adb is in the android SDK, or search Google for a download)
3. Open your command line and type the following
Code:
$ adb shell
$ su
# dd if=/dev/block/mmcblk0p4 of=/sdcard/bakp4
# exit
$ exit
COPY bakp4 to a SAFE location ON YOUR COMPUTER and UNMOUNT your USB storage
4. Kill your phone
Code:
$ adb shell
$ su
# dd if=/sdcard/killp4 of=/dev/block/mmcblk0p4
# exit
$ exit
5. Reboot your phone. The charging light will no longer be on, and you should be stuck on a black screen.
Enumerating your partitions​Q: What does enumerate mean?
A:
Code:
enumerate - to specify one after another.
Synonym: list
Prerequisites: Ubuntu 12.04 or higher. 32/64 bit
unbrick package: http://dl.dropbox.com/u/40181085/ville.zip
A null p4 or the bakp4 you acquired earlier.
a null p4 is included in the unbrick package if you didn't save your backup.. you will need to hex edit your IMEI into this file. the offset is 0x21c, it's after 11111111, which is the SuperCID
1. Open up 3 terminal windows
2. On your first window, type
Code:
$ watch -n 1 lsusb
3. Now, hold power down on your phone for about 10 seconds*,OR until you see (QDL mode) disappear and let go, Then go to your second window and repeatedly run the following command
*On the HTC One X you have to hold power for 10 seconds, on the EVO 4G LTE it is ~30 seconds. This number may vary
Code:
$ ls /dev/sd*
You should go from seeing this..
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
to seeing this...
4. Make note of the following.
for me, my devices was listed as /dev/sdb, yours may be listed as /dev/sdc or even /dev/sdd.
make note of /dev/sd*4 and /dev/sd*12
5. Make sure Linux sees the phone
Code:
$ sudo dmesg | grep "qcserial"
You should see "Qualcomm USB modem converter detected" as the last line of the output. If not, you can unplug and replug the USB cable or run...
Code:
$ sudo modprobe qcserial
to reload the driver
6. Reset the driver
Code:
$ sudo modprobe -r qcserial
7. create the block device
Code:
$ sudo mknod /dev/ttyUSB0 c 188 0
8. Open a third Terminal window and navigate to where you stored the ville folder. I saved it to my desktop, so my code is
Code:
$ cd Desktop/ville
$ chmod +x emmc_recover
9. Now we restore the hboot.. replace /sdc12 with your device location that we discovered in step 3 and 4
Code:
$ sudo ./emmc_recover -f ./hboot.nb0 -d /dev/sdc12 -c 24576
You can hit enter at all of the prompts here. If it stalls at "Waiting for /dev/sdc12, hold the power button down on your phone about 10 seconds, or until your see "Qualcomm. Inc. Gobi Wireless Modem (QDL mode) disappear from your terminal window, then release it. 10 seconds or less after you do this, emmc_recovery will see your phone and proceed. Flashing Hboot will take several minutes, as it has to load data in ~23K chunks followed by a reset after each.
or you can open a new terminal window and run the following command IF AND ONLY IF the phone doesn't reset out of QDL mode
Code:
$ sudo ./emmc_recover -r
10. Once that is finished. We have to reset the qcserial driver again.
Code:
$ sudo modprobe -r qcserial
11. And then recreate the block device
Code:
$ sudo mknod /dev/ttyUSB0 c 188 0
12. Now we restore the original mmcblk0p4 that you should have saved as "bakp4"
Code:
$ sudo ./emmc_recover -f ./bakp4 -d /dev/sdc4 -c 24576
13. Again, if it hangs, hold your phone's power button for about 10 seconds, then release. This file will flash very quickly (it's only 1K) and once it completes, you'll immediately notice that your charging light turns back on. You should see "Qualcomm, Inc." or "Qualcomm, Inc. Gobi Wireless modem (QDL mode) disappear from your terminal screen.
14. Press the thanks button for yarrimapirate. As these are his tools/methods
special thanks to
beaups (for helping me understand how to enumerate the partitions)
18th.abn (for getting me the 1.09 hboot and also agreeing to help me)
and yarrimapirate (not only for the scripts which he made for the Evo 4G LTE, but also agreeing to help me in this project and buying a one x with his own money)

This is why it is easier on evita.. http://db.tt/kCeCpDAE
I made a version for you guys.. http://db.tt/ar4sbw6V
Place on your sdcard
open terminal emulator
Code:
$ su
# dd if=/sdcard/mmcblk0p23 of=/dev/block/mmcblk0p23
reboot to fastboot and lock your bootloader. And then run the RUU
You can download the edited version. USE WITH CAUTION

Just finished downgrading from 1.14 to 1.06.
I started with Jet and replaced the bakp4 after it was created with my own and replaced the hboot with the 1.06 version for the One S. Jet got stuck and kept giving me "Failed to flash hboot" so I jumped over to the manual instructions and finished it that way.
Thanks mikeyinid for bringing to my attention that we can do this and being the first guy to try it with the One S. Thanks absolutelygrim for all your hard work and instructions.

dc211 said:
Just finished downgrading from 1.14 to 1.06.
I started with Jet and replaced the bakp4 after it was created with my own and replaced the hboot with the 1.06 version for the One S. Jet got stuck and kept giving me "Failed to flash hboot" so I jumped over to the manual instructions and finished it that way.
Thanks mikeyinid for bringing to my attention that we can do this and being the first guy to try it with the One S. Thanks absolutelygrim for all your hard work and instructions.
Click to expand...
Click to collapse
Jet has a few bugs right now, some users have reported it working, I haven't gotten it to work for me. Failed at flashing hboot, manual method has always saved them

Nice work! This should be on the dev forum. Please request a moderator move it there where those in need have a better chance to find it.

You should mention that Linux is needed earlier on in the OP so people don't brick then realize they can't unbrick cus they don't have Linux. People won't read the whole thing before they jump in.
Sent from my HTC One S using xda premium

Behold_this said:
Nice work! This should be on the dev forum. Please request a moderator move it there where those in need have a better chance to find it.
Click to expand...
Click to collapse
And maybe sticked.
Send from a phone.

which hboot does this downgrade to? i am currently on 1.14.001 can mine be downgraded?

sherry478 said:
which hboot does this downgrade to? i am currently on 1.14.001 can mine be downgraded?
Click to expand...
Click to collapse
It downgrades you to 1.06

sherry478 said:
which hboot does this downgrade to? i am currently on 1.14.001 can mine be downgraded?
Click to expand...
Click to collapse
Yes it can. I downgraded mine from 1.14 to 1.06.
Sent from my HTC One S using xda premium

How easy is this to do if you never used linux? and also can it be done in Virtualbox?

Darknites said:
How easy is this to do if you never used linux? and also can it be done in Virtualbox?
Click to expand...
Click to collapse
Yes and no. LiveCd or install only

absolutelygrim said:
Yes and no. LiveCd or install only
Click to expand...
Click to collapse
Thanks, I see if I got the balls to do it tomorrow lol.

Darknites said:
How easy is this to do if you never used linux? and also can it be done in Virtualbox?
Click to expand...
Click to collapse
Follow grims instructions and it's simple, for anyone
Sent from my HTC One S using xda premium

mikeyinid said:
Follow grims instructions and it's simple, for anyone
Sent from my HTC One S using xda premium
Click to expand...
Click to collapse
Ya it does seem easy but I never used Linux before and the idea of bricking it to do it just sounds wrong to me lol but the idea of having to use an app or fastboot in till my next phone is no fun lol.
Will I need to download anything other then whats in the OP to go with the linux install?

Darknites said:
Ya it does seem easy but I never used Linux before and the idea of bricking it to do it just sounds wrong to me lol but the idea of having to use an app or fastboot in till my next phone is no fun lol.
Will I need to download anything other then whats in the OP to go with the linux install?
Click to expand...
Click to collapse
Nope.. Should work right off a clean install

absolutelygrim said:
Nope.. Should work right off a clean install
Click to expand...
Click to collapse
Thanks again I get everything sorted tonight to try tomorrow.

Linux running off a usb stick will work right? Think I got puppy linux sitting around my room somewhere.

diabolusmiles said:
Linux running off a usb stick will work right? Think I got puppy linux sitting around my room somewhere.
Click to expand...
Click to collapse
Haven't tried it on puppy.. I prefer using debian based versions

I haven't tried yet, but downgrading hboot like this, does it mean we can run the old ruu?
Sent from my HTC One S using xda premium

[Q] GT-P3110 updated to JB.. now yellow text overlay (factory mode?)

i did OTA update on my mom's galaxy tab 2 7.0 today
the update seems to have worked fine with the exception that there is a yellow text overlay on the home screen
the overlay disappears when running apps or even entering "settings"
the yellow text is located in a transparent box on top of the home screen
its contents are:
PDA: P3110xxxxxxx
Phone: N/A
CSC: P3110xxxxxxxx
H/W : MP 0.600
RF Cal Date: N/A
SMD : 01P, PBA : 04N
CAMERA : N/A, FrontCAM : N/A
TSP : 17
TSK : N/A
Band : N/A, CH : N/A
UART : N/A, USB: N/A
UN : CM808Exxxxxxxx
BATT_LEVEL: 87
Wifi is turned off by default but if I turn it off I seem to have internet access no problem.
Aside from the text, the tab is still usable, but just annoying as hell.
When returning to home screen, sometimes there would be a few seconds delay before the yellow text overlay shows up
Does anyone have any idea how to fix this please?

actng said:
i did OTA update on my mom's galaxy tab 2 7.0 today
the update seems to have worked fine with the exception that there is a yellow text overlay on the home screen
the overlay disappears when running apps or even entering "settings"
the yellow text is located in a transparent box on top of the home screen
its contents are:
......
Wifi is turned off by default but if I turn it off I seem to have internet access no problem.
Click to expand...
Click to collapse
I have exactly the same problem with my friend's tab 2 7.0" (P3110). Some people were lucky enough and the fix described in this thread worked for them, but not for me, unfortunately. I still suggest you to try, though.

[SOLVED]
I've found the solution.
1) backup /efs/FactoryApp and /efs/imei
2) remove /efs/FactoryApp and /efs/imei
3) reboot
4) if device is rooted
Code:
su
echo -n ON > /efs/FactoryApp/keystr
echo -n ON > /efs/FactoryApp/factorymode
reboot
if device is not rooted, you have to have adb tool from android sdk, after installing sdk run SDK Manager (if it doesn't start, use sdk\tools\android insted) you have to select and install Extras/Google USB Driver, then
4.1) reboot into recovery mode
4.2) install Google USB driver from driver manager (there is a guide for this but I can't post external links yet)
4.3)
Code:
adb shell
4.4) run commands:
Code:
mount /efs
mount -o remount,rw /efs
echo -n ON > /efs/FactoryApp/keystr
echo -n ON > /efs/FactoryApp/factorymode
reboot
This did it for me.

Question
My apologies if the question sounds silly. But trying to figure out how to execute these commands? Are these executed on the device itself? Or are they executed on a computer with the device tethered via USB? I think it is the latter, but if you could confirm, that will be appreciated. What utility is used for executing these commands?
I have Galaxy Tab 7.7, so these instructions may not work ... but I will do some trial and error once I know how to get started.
thanks in advance

ADB works only on computer.
So computer.

TabUser77 said:
My apologies if the question sounds silly. But trying to figure out how to execute these commands? Are these executed on the device itself? Or are they executed on a computer with the device tethered via USB?
Click to expand...
Click to collapse
It depends, if your device is rooted, install terminal emulator (any will do) and proceed according to the first batch of instructions in the beginning of my post. If your device is not rooted proceed according to the second part of my post, you'll have to install SDK and use adb utility from the SDK, this implies tethering your device via USB and typing those commands in adb shell environment.
I have no idea if this instructions will help with Tab 7, but if you backup everything before deleting (changing) it most probably won't do any harm. But, of course, I can't guarantee that.

AlexCzar said:
It depends, if your device is rooted, install terminal emulator (any will do) and proceed according to the first batch of instructions in the beginning of my post.
Click to expand...
Click to collapse
My bad ... did not realize that the terminal emulator is an android app .... will try this our. I have a rooted tab.

You beat me to the answer
__
Sent from my GT-I9300 using xda app-developers app

AlexCzar said:
You beat me to the answer
__
Sent from my GT-I9300 using xda app-developers app
Click to expand...
Click to collapse
Btw: Still searching for the solution for my Galaxy Tab 7.7 Model SCH-i815. May I ask you how you came to figuring out your solution? Anything you can do to redirect me to figuring out how to solve this problem?
Thanks in advance

I googled a lot, after all proposed solutions didn't work I sinthesized my own based on those provided - just randomly poked mentioned files and directories - deleted, changed contents and so on. Just don't forget to backup everything before you do that.
Sent from my GT-I9300 using xda app-developers app

Easy way just did it
Rooted phones only go into root explorer root
Efs
Factory app
Factory mode text file
Text editor
Change it to either on or off whatever is opisite of what is there
Save and exit might ask if you want to backup the file just say yes
Restart phone and it will go through prompts
And it will be gone
Sent from sprint note 3 rooted

AlexCzar said:
I've found the solution.
1) backup /efs/FactoryApp and /efs/imei
2) remove /efs/FactoryApp and /efs/imei
3) reboot
4) if device is rooted
Code:
su
echo -n ON > /efs/FactoryApp/keystr
echo -n ON > /efs/FactoryApp/factorymode
reboot
if device is not rooted, you have to have adb tool from android sdk, after installing sdk run SDK Manager (if it doesn't start, use sdk\tools\android insted) you have to select and install Extras/Google USB Driver, then
4.1) reboot into recovery mode
4.2) install Google USB driver from driver manager (there is a guide for this but I can't post external links yet)
4.3)
Code:
adb shell
4.4) run commands:
Code:
mount /efs
mount -o remount,rw /efs
echo -n ON > /efs/FactoryApp/keystr
echo -n ON > /efs/FactoryApp/factorymode
reboot
This did it for me.
Click to expand...
Click to collapse
Worked, thank god, (and you of course). Had to realize that I needed to go in and delete everything prior to typing out the commands in the terminal emulator, but once I did, that stupid yellow text went away. Again, thanks!

[UNLOCK/ROOT] AT&T 3.18 - XPwn - Testing

GO HERE AFTER CAREFULLY FOLLOWING THIS PROCEDURE TO INSTALL ROMS, S-OFF, ETC.
delacerda said:
Confirmed! Stock AT&T OneX on 3.18 JB 4.1.1. SuperCID 11111111 , HTC Dev bootloader unlocked, TWRP recovery installed, perm rooted.
Click to expand...
Click to collapse
nhshah7 said:
Got SuperCID and about to unlock after I backup some data.
Thank you so much!
Here is what I did and what worked for me:
Copy oneXchopper, ownage, and busybox files to folder with ADB (this is if you have the android sdk)
Code:
adb push oneXchopper /data/local/tmp/xpwn
adb push busybox /data/local/tmp/busybox
adb push ownage /data/local/tmp/phase1.sh
adb shell chmod 755 /data/local/tmp/xpwn /data/local/tmp/busybox
adb shell
(within ADB shell)
ln -s /data/local/tmp/busybox /data/local/tmp/sed
/data/local/tmp/xpwn
You will see this:
[+] This may take a few minutes.
[+] Success!
2+0 records in
2+0 records out
1024 bytes transferred in 0.001 secs (1024000 bytes/sec)
2+0 records in
2+0 records out
1024 bytes transferred in 0.001 secs (1024000 bytes/sec)
2+0 records in
2+0 records out
1024 bytes transferred in 0.008 secs (128000 bytes/sec)
exit (will exit from shell)
adb reboot bootloader
This will reboot you to the bootloader. If you have the android SDK, you can confirm superCID via the command "fastboot getvar cid".
Next step, hit up HTCdev.com for an unlock code!
Thanks man
Click to expand...
Click to collapse
Root on the ATT 3.18 firmware for HTC One XL and SuperCID. Linux only for now due to laziness.
Here ya go, just extract and run pwn.sh. This automated method is untested, however I have done it manually to my own phone last night.
Just to clarify, this is a temp root which sets your CID to SuperCID allowing a bootloader unlock via HTCDev. It does NOT install Superuser or anything of that sort.
I'm not responsible for bricks, warranty voiding, etc. and please let me know if this works or if I need to tweak some things. It SHOULD handle everything automatically.
Thanks to Dan Rosenberg for Motochopper, which I modified very slightly for use in this script.
Thanks also to the people who paid the bounty. You guys are awesome and probably just bought me something nice. Not sure what yet
One more thanks to Daft Punk for providing some decent music to listen to while I worked on this. I was up all night to get lucky xD
A backup of mmcblk0p4 is made in /sdcard/backup.cid. You can run /data/local/tmp/xpwn manually and restore this backup should things go wrong.
dd if=/sdcard/backup.cid of=/dev/block/mmcblk0p4
This script is sponsored, created, and fueled by absolute hatred of AT&T. Enjoy your HTC Dev unlock!
UPDATE: There is now a Windows auto-pwn script available, thanks to Megadoug13.
You can get it from HERE
I am unable to test or really work with this because I have no Windows box, so contact Megadoug13 if it doesn't work.
The instructions I received with this package are as follows:
Megadoug13 (via email) said:
Just double click "ONLY ONE X" have usb debugging on. and when the phone gets into bootloader it wont tell you that your cid is 11111111. just get your token id and then submit at htcdev. this is only the cid change script. oh make sure to unzip it lol. dont click on anything BUT "ONLY ONE X"
Click to expand...
Click to collapse

myusernam3 said:
Root on the ATT 3.18 firmware for HTC One XL and SuperCID. Linux only for now due to laziness.
Here ya go, just extract and run pwn.sh. This automated method is untested, however I have done it manually to my own phone last night.
I'm not responsible for bricks, warranty voiding, etc. and please let me know if this works or if I need to tweak some things. It SHOULD handle everything automatically.
Thanks to Dan Rosenberg for Motochopper, which I modified very slightly for use in this script.
A backup of mmcblk0p4 is made in /sdcard/backup.cid. You can run /data/local/tmp/pwn manually and restore this backup should things go wrong.
dd if=/sdcard/backup.cid of=/dev/block/mmcblk0p4
This script is sponsored, created, and fueled by absolute hatred of AT&T. Enjoy your HTC Dev unlock!
Click to expand...
Click to collapse
Well well that's sooner than I thought. Good job man. Now to see if other users report success with this.
Sent from Xparent Red using my Venomized Evita

ImagioX1 said:
Well well that's sooner than I thought. Good job man. Now to see if other users report success with this.
Sent from Xparent Red using my Venomized Evita
Click to expand...
Click to collapse
Thank you. As I said, though, I have no clue if the automated method works due to not having a test dummy.
If you need to do it manually, the two scripts "pwn.sh" and "ownage" have everything you need to do in them. Just read them.

myusernam3 said:
Thank you. As I said, though, I have no clue if the automated method works due to not having a test dummy.
If you need to do it manually, the two scripts "pwn.sh" and "ownage" have everything you need to do in them. Just read them.
Click to expand...
Click to collapse
I'll see if I can talk the wife into letting me try it on hers. Awesome job man. Thanks
Sent from my One X using Tapatalk 2

myusernam3 said:
Thank you. As I said, though, I have no clue if the automated method works due to not having a test dummy.
If you need to do it manually, the two scripts "pwn.sh" and "ownage" have everything you need to do in them. Just read them.
Click to expand...
Click to collapse
I'm on hboot 1.09 soff already so no need for me to test. If yall don't mind me making a suggestion I would suggest you pm venomtester and ask him to try your script. He has a riff box and can jtag the phones in case of a brick.
Sent from Xparent Red using my Venomized Evita

ImagioX1 said:
I'm on hboot 1.09 soff already so no need for me to test. If yall don't mind me making a suggestion I would suggest you pm venomtester and ask him to try your script. He has a riff box and can jtag the phones in case of a brick.
Sent from Xparent Red using my Venomized Evita
Click to expand...
Click to collapse
Shot him a PM, we'll see what happens.

Subscribed and will test this once my phone is charged.
Sent from my Transformer Prime TF201 using Tapatalk HD
EDIT: Windows Manual method added from this post
nhshah7 said:
Okay, since people are having issues with the manual methods for Windows, I'm going to recommend installing using the Android SDK. @myusernam3, please remove the code from the OP and the other thread and replace it with a link to this post.
DISCLAIMER: Please read this post 4 times over before you attempt this procedure. It may render your phone unusable (read: a brick) if you don't follow it correctly. I and anyone else associated with this exploit is not responsible for any issues that may arise from this process, such as if you brick your phone. Proceed at your own risk, and with extreme caution. This procedure is not for those who don't want to take the time to read and understand how this works.
Download the android SDK and install it. Once that's done, open the android SDK manager and download platform-tools.
Navigate to C:\Program Files (x86)\Android\android-sdk\platform-tools to make sure adb.exe and fastboot.exe are there.
Download the files in the OP and then copy oneXchopper, ownage, and busybox to the platform-tools folder.
Once the files are moved over, you need to open a command prompt window. In windows explorer open to that folder (platform-tools), hold down the shift button and right click anywhere in the folder (not on a file). Then click Open command prompt window here. You should then see a command prompt window open to the platform tools window.
Plug in your phone and make sure USB debugging is enabled (Settings, developer options - enable this if it asks you, make sure USB debugging is checked). Now back in the command prompt, type "adb devices". It should show you HTCxxxxxxxxxx. That confirms that your phone and adb can see each other. If not, make sure you have the correct drivers installed. You can google around for help with this if you have trouble.
With that, we're ready to start typing in commands!
Type the following commands in one line at a time, minus the stuff in parenthesis. When you get to the first adb shell line, hit enter, then type the following line by line:
chmod 755 /data/local/tmp/xpwn /data/local/tmp/busybox
ln -s /data/local/tmp/busybox /data/local/tmp/sed line
/data/local/tmp/xpwn
You'll see a bunch of lines of code (see below)
Once this is all done, type in "exit", then "adb reboot bootloader" (at the bottom of the code quote)
Code:
adb push oneXchopper /data/local/tmp/xpwn
adb push busybox /data/local/tmp/busybox
adb push ownage /data/local/tmp/phase1.sh
adb shell
(within ADB shell)
chmod 755 /data/local/tmp/xpwn /data/local/tmp/busybox
ln -s /data/local/tmp/busybox /data/local/tmp/sed
/data/local/tmp/xpwn
You will see this:
[+] This may take a few minutes.
[+] Success!
2+0 records in
2+0 records out
1024 bytes transferred in 0.001 secs (1024000 bytes/sec)
2+0 records in
2+0 records out
1024 bytes transferred in 0.001 secs (1024000 bytes/sec)
2+0 records in
2+0 records out
1024 bytes transferred in 0.008 secs (128000 bytes/sec)
exit (will exit from shell)
adb reboot bootloader
You should now be in the bootloader. type in "fastboot getvar cid" and it should show you that your CID is "11111111". If so, it worked! From here, you can follow the instructions here to unlock your bootloader (go to htcdev.com and follow instructions for unlocking a device. in the dropdown device list, select the bottom "other" option).
From there you have to flash TWRP (download link: http://techerrata.com/browse/twrp2/evita - NOTE download 2.3.3.1 because some roms don't flash via TWRP 2.5.0.0). Instructions on how to flash are here (http://techerrata.com/browse/twrp2/evita). you should install via the "Download - Recovery Image Method" - run the fastboot command from the platform-tools folder command prompt above. Your phone should be in bootloader ("adb reboot bootloader" will get you there if you are in android). Copy the downloaded recovery image file to the platform-tools folder, then input the command at the website above (fastboot flash recovery...). Once it flashes successfully, use the up/down volume buttons to select bootloader (on the phone itself), then select recovery via pressing the power button to select. In recovery, make sure you have your rom loaded on your phone first. then go to wipe, and click factory data reset and wipe system. then hit the home button, hit install then install the rom you want. (this is assuming you want to install a rom, not just root.
After unlocking, it will wipe your SD card and you will lose all your sd card data and will have to load a rom to the SD card after unlocking it. it will boot up into the stock rom after you unlock so you can do that here after unlocking and/or flashing TWRP. Alternatively, you can flash SuperSU in recovery to obtain root in the stock rom, then obtain S-Off (see sticky in Developer sub-threads). If you want to use CM or any rom in the Original Android sub-thread, you will have to downgrade your touch-panel firmware. There are stickies in the Original Android Development sub-thread for this.
Good luck!
Click to expand...
Click to collapse

nhshah7 said:
Subscribed and will test this once my phone is charged.
Sent from my Transformer Prime TF201 using Tapatalk HD
Click to expand...
Click to collapse
Best of luck. I'd be happy to take any feedback and if it doesn't work I will resolve it.
If you have TeamViewer or similar we could also walk through doing the whole process manually (5 minutes or so)

I am down to try it here in a few. I'll get my linux machine going tonight and post back.
Sent from my HTC One X using xda app-developers app

Just took a look at the download, do you have a windows script I can use? Or could you provide me with the commands? Thanks!
Sent from my Transformer Prime TF201 using Tapatalk HD

nhshah7 said:
Just took a look at the download, do you have a windows script I can use? Or could you provide me with the commands? Thanks!
Sent from my Transformer Prime TF201 using Tapatalk HD
Click to expand...
Click to collapse
Read the shell script pwn.sh, it has all the commands in it. You can open it in Wordpad (Notepad eats the line endings).
adb push oneXchopper /data/local/tmp/xpwn
adb push busybox /data/local/tmp/busybox
adb push ownage /data/local/tmp/phase1.sh # Yes, it needs to be named this, That's what oneXchopper executes instead of copying su.apk.
adb shell chmod 755 /data/local/tmp/xpwn /data/local/tmp/busybox
adb shell ln -s /data/local/tmp/busybox /data/local/tmp/sed
adb shell "/data/local/tmp/xpwn"
adb reboot bootloader # Your CID should now be 11111111
EDIT: Oh f***, I left out a quotation mark in the script that's run on the phone.
Edit that before you push it! The line starting with "./sed" should be
./sed 's/CWS__001/11111111/' /data/local/tmp/cid > /data/local/tmp/newcid

Good work!

iElvis said:
Good work!
Click to expand...
Click to collapse
Not good work. The .tar.gz that was up a second ago might break stuff. The new one should be fine though.

myusernam3 said:
Not good work. The .tar.gz that was up a second ago might break stuff. The new one should be fine though.
Click to expand...
Click to collapse
I meant finding a way to edit CID.

iElvis said:
I meant finding a way to edit CID.
Click to expand...
Click to collapse
Well, thanks for the compliment. May as well post this cheap, lame way I did it in the thread for people who'd prefer to do it manually.
This is to be run on your HOXL after pushing Busybox and oneXchopper, and obtaining root.
dd if=/dev/block/mmcblk0p4 of=/data/local/tmp/cid
dd if=/dev/block/mmcblk0p4 of=/sdcard/backup.cid
./sed 's/CWS__001/11111111/' /data/local/tmp/cid > /data/local/tmp/newcid
dd if=/data/local/tmp/newcid of=/dev/block/mmcblk0p4

Do I have the balls? Been drinking but hopefully I don't turn the phone into slingshot ammo. Lemme find my laptop.....
-Sugardaddy

Arrow44 said:
Do I have the balls? Been drinking but hopefully I don't turn the phone into slingshot ammo. Lemme find my pc.....
-Sugardaddy
Click to expand...
Click to collapse
I'm not entirely sure what happens if you manage to corrupt mmcblk0p4, but a backup is made during the CID changing process.
If the phone still boots after that, there's still hope.

myusernam3 said:
I'm not entirely sure what happens if you manage to corrupt mmcblk0p4, but a backup is made during the CID changing process.
If the phone still boots after that, there's still hope.
Click to expand...
Click to collapse
If this screws up I am SOL because I just got a refurbished one from AT&T

Arrow44 said:
If this screws up I am SOL because I just got a refurbished one from AT&T
Click to expand...
Click to collapse
If you'd prefer (and if you can trust me with TeamViewer or a similar program) I can try and do it manually, just to make sure nothing goes wrong.

myusernam3 said:
If you'd prefer (and if you can trust me with TeamViewer or a similar program) I can try and do it manually, just to make sure nothing goes wrong.
Click to expand...
Click to collapse
Well Im in Backtrack right now and if what you say is correct all i should do is run the script?

Transferring files

I really can't seem to copy files off my moto g and on to the computer like a regular SD card, my files that are copied aren't visible on my desktop.
Sent from my XT1032 using xda app-developers app

Which OS do you have on your computer? On Windows I have no problem using MTP out of the box. On Ubuntu 13.10 I had to do some console jacking to get the thing work, but it is working well now.

debaj said:
Which OS do you have on your computer? On Windows I have no problem using MTP out of the box. On Ubuntu 13.10 I had to do some console jacking to get the thing work, but it is working well now.
Click to expand...
Click to collapse
nvm I tried it on my desktop and files transfer easily thx though

debaj said:
Which OS do you have on your computer? On Windows I have no problem using MTP out of the box. On Ubuntu 13.10 I had to do some console jacking to get the thing work, but it is working well now.
Click to expand...
Click to collapse
You used mtpfs?

manudo said:
You used mtpfs?
Click to expand...
Click to collapse
Yes, though I did not need to install any extra software, 13.10 comes preinstalled with everything you need. I did the following steps:
1. Create a mount point in the file system for the phone (in my case /media/motog/)
2. Uncomment the user_allow_other line in /etc/fuse.conf
3. Add my user to the "disk" group (debaj is my username):
Code:
usermod -a -G disk debaj
3. Get the model id by connecting the phone to the computer and running the mtp-detect command. You need the PID from the following snippet:
Code:
Listing raw device(s)
Device 0 (VID=22b8 and PID=2e76) is UNKNOWN.
(Don't forget to press ctrl+c after you get the PID since collecting all the info can take a long time and we need nothing from there)
4. Create a file named 99-android.rules in /etc/udev/rules.d/ with the following content:
Code:
ENV{ID_MODEL}=="XT1032", ENV{ID_MODEL_ID}=="2e76", ACTION=="add", RUN+="/usr/bin/sudo -u debaj /usr/local/sbin/go-mtpfs -allow-other=true /media/motog"
ENV{ID_MODEL}=="XT1032", ENV{ID_MODEL_ID}=="2e76", ACTION=="remove", RUN+="/bin/umount /media/motog"
5. Reboot (logging in and out is not enough, maybe there is some commands which reload the fuse config and the udev rules but I did not bother to find them). I had a very good fight to get the thing working, I hope I didn't miss any steps.

debaj said:
Yes, though I did not need to install any extra software, 13.10 comes preinstalled with everything you need. I did the following steps:
1. Create a mount point in the file system for the phone (in my case /media/motog/)
2. Uncomment the user_allow_other line in /etc/fuse.conf
3. Add my user to the "disk" group (debaj is my username):
Code:
usermod -a -G disk debaj
3. Get the model id by connecting the phone to the computer and running the mtp-detect command. You need the PID from the following snippet:
Code:
Listing raw device(s)
Device 0 (VID=22b8 and PID=2e76) is UNKNOWN.
(Don't forget to press ctrl+c after you get the PID since collecting all the info can take a long time and we need nothing from there)
4. Create a file named 99-android.rules in /etc/udev/rules.d/ with the following content:
Code:
ENV{ID_MODEL}=="XT1032", ENV{ID_MODEL_ID}=="2e76", ACTION=="add", RUN+="/usr/bin/sudo -u debaj /usr/local/sbin/go-mtpfs -allow-other=true /media/motog"
ENV{ID_MODEL}=="XT1032", ENV{ID_MODEL_ID}=="2e76", ACTION=="remove", RUN+="/bin/umount /media/motog"
5. Reboot (logging in and out is not enough, maybe there is some commands which reload the fuse config and the udev rules but I did not bother to find them). I had a very good fight to get the thing working, I hope I didn't miss any steps.
Click to expand...
Click to collapse
Dude, haha. I asked if you used mtpfs not how to use it but thanks anyway.
Sent from my XT1034 using XDA Premium 4 mobile app