Jump to content

TESTING: Rooting your One X without unlocking the bootloader (Windows / Mac / Linux)


Guest PaulOBrien

Recommended Posts

Guest Mike Penz

Hey. I've a One X (Tegra 3) and i'm still S-ON and never used HTC Dev. I also use a Mac. So what will i have to do, and what can happen if it fails?

Is it save? (S-ON should protect me right?)

Can i loose all my installed settings/apps?

I'm only a bit carful because i love my OneX and i have not that much money to buy a new one.

Link to comment
Share on other sites

Guest ste1164

Hey. I've a One X (Tegra 3) and i'm still S-ON and never used HTC Dev. I also use a Mac. So what will i have to do, and what can happen if it fails?

Is it save? (S-ON should protect me right?)

Can i loose all my installed settings/apps?

I'm only a bit carful because i love my OneX and i have not that much money to buy a new one.

I lost my settings and apps because I did something wrong :P Im not 100% sure how to run the command on a mac.

Link to comment
Share on other sites

Guest PaulOBrien
Tried on my mac but I need to use an RUU now as I got system UI crashed and constant reboots :(

Edit the script and redo the final step. It's been interrupted.

P

Link to comment
Share on other sites

Guest SozzaSinnian

what can happen if it fails?

In the first post of this thread:

You use this at your own risk! Worst case scenario, you'll have to reflash with a RUU (make sure you have one handy!

Can i loose all my installed settings/apps?

I'm pretty sure when you do an RUU you will lose your data as it does a complete restore, However I am not 100% on this as never had to use one yet.

Link to comment
Share on other sites

Guest Piccaruse

Thought this might help.

onex.png

The last two are the latter part of the script I ran seperatly, thought that might've helped.

Link to comment
Share on other sites

Guest starbase64

Hi,

don't work on TMO Germany 1.28.111.10.


D:\Handy\HTC One X\root-one-x-tegra>adb kill-server

D:\Handy\HTC One X\root-one-x-tegra>adb wait-for-device

* daemon not running. starting it now *

* daemon started successfully *

D:\Handy\HTC One X\root-one-x-tegra>ECHO.


D:\Handy\HTC One X\root-one-x-tegra>echo HTC One X Tegra 3 Root Script by Paul O

'Brien- includes script from kennethpenn

HTC One X Tegra 3 Root Script by Paul O'Brien- includes script from kennethpenn

D:\Handy\HTC One X\root-one-x-tegra>echo Follow paulobrien and modaco on Twitter

for more Android fun!

Follow paulobrien and modaco on Twitter for more Android fun!

D:\Handy\HTC One X\root-one-x-tegra>ECHO DON'T TOUCH THE DEVICE OR UNPLUG WHILE

ROOTING!

DON'T TOUCH THE DEVICE OR UNPLUG WHILE ROOTING!

D:\Handy\HTC One X\root-one-x-tegra>ECHO PUSH FILES

PUSH FILES

D:\Handy\HTC One X\root-one-x-tegra>adb push busybox /data/local/busybox

1106 KB/s (837916 bytes in 0.739s)

D:\Handy\HTC One X\root-one-x-tegra>adb push su /data/local/su

1703 KB/s (91980 bytes in 0.052s)

D:\Handy\HTC One X\root-one-x-tegra>adb push Superuser.apk /data/local/Superuser.apk

842 KB/s (570342 bytes in 0.661s)

D:\Handy\HTC One X\root-one-x-tegra>adb shell chmod 777 /data/local/busybox

D:\Handy\HTC One X\root-one-x-tegra>adb shell chmod 755 /data/local/su

D:\Handy\HTC One X\root-one-x-tegra>adb shell chmod 755 /data/local/Superuser.apk

D:\Handy\HTC One X\root-one-x-tegra>adb shell mv /data/tigps/aiding /data/tigps/aiding.old

D:\Handy\HTC One X\root-one-x-tegra>adb shell ln -s /data /data/tigps/aiding

D:\Handy\HTC One X\root-one-x-tegra>adb shell rm /data/local.prop  1>nul

D:\Handy\HTC One X\root-one-x-tegra>ECHO.


D:\Handy\HTC One X\root-one-x-tegra>ECHO REBOOT

REBOOT

D:\Handy\HTC One X\root-one-x-tegra>adb reboot

D:\Handy\HTC One X\root-one-x-tegra>adb wait-for-device

D:\Handy\HTC One X\root-one-x-tegra>adb shell "echo ro.kernel.qemu=1 > /data/local.prop"

D:\Handy\HTC One X\root-one-x-tegra>ECHO Reboot again... note that when device returns it may appear to be bootlooping, don't panic!

Reboot again... note that when device returns it may appear to be bootlooping, don't panic!

D:\Handy\HTC One X\root-one-x-tegra>adb reboot

D:\Handy\HTC One X\root-one-x-tegra>adb wait-for-device

D:\Handy\HTC One X\root-one-x-tegra>ECHO AGAIN!?

AGAIN!?

D:\Handy\HTC One X\root-one-x-tegra>adb shell "mount -wo remount rootfs /"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "mount -o remount,rw -t ext4 /dev/block/mmcblk0p12 /system"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "cat /data/local/busybox > /system/xbin/busybox"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "chmod 777 /system/xbin/busybox"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "/system/xbin/busybox --install -s /system/xbin"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "busybox cp /data/local/Superuser.apk /system/app/Superuser.apk"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "busybox cp /data/local/su /system/xbin/su"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "chown 0.0 /system/xbin/su"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "chmod 06755 /system/xbin/su"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "chmod 644 /system/app/Superuser.apk"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "rm /data/local.prop"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "rm /data/tigps/aiding"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "mv /data/tigps/aiding.old /data/tigps/aiding"

D:\Handy\HTC One X\root-one-x-tegra>adb reboot

D:\Handy\HTC One X\root-one-x-tegra>

cheers

starbase64

Link to comment
Share on other sites

Guest kruppin

I have both S-on and locked bootloader, and unfortunately it didn't work.. :( And what is "/data/tigps/aiding" ? why not use the same (tmp) as the at&t hack? Wierd it works on that phone but not this one.. Or maybe it did in the first versions? I have FW 1.29.. Ans why is the partition table so different? :P p12 and p33? Sure it's a very different phone, but still.

Edit: I haven't read anything about the AT&T variant, but maybe the reason why this works is that it hasn't S-ON?

Edited by kruppin
Link to comment
Share on other sites

Guest ste1164

That's expected.

P

Oh in that case it didn't work on a mac :( must have been just your S-OFF device. I used the command sh then chose the root-mac.sh file and got nothing.

Link to comment
Share on other sites

Guest sibbor

Mr. O'Brien, what can I do to assist?

See a few posts back for full details.

Running everything manually on Ubuntu 12.04, via adb, I'm getting all files pushed but got issues with the fs:


sibbor@ubuntu:~$ adb shell "mount -wo remount rootfs /"

error: insufficient permissions for device

sibbor@ubuntu:~$ adb shell "cat /data/local/busybox > /system/xbin/busybox"

error: insufficient permissions for device

Edited by sibbor
Link to comment
Share on other sites

Guest marco1958

Operation not permitted on the remount. Anybody has a setuid root mount executable? Push that along with the other stuff and try remount with 1551 root mount? Just an idea. So close :) Or does push remove permission?

Link to comment
Share on other sites

Guest Namtaffy

am I being dumb or is there code in init.rc that detects if adb is in root mode and resets the usb connection? it's about halfway down the file? or am I talking out of my butt (which is highly likely :) ) either that or it resetting to handle the new root instance of adb maybe?


# adbd on at boot in emulator

on property:ro.kernel.qemu=1

	start adbd

# This property trigger has added to imitiate the previous behavior of "adb root".

# The adb gadget driver used to reset the USB bus when the adbd daemon exited,

# and the host side adb relied on this behavior to force it to reconnect with the

# new adbd instance after init relaunches it. So now we force the USB bus to reset

# here when adbd sets the service.adb.root property to 1.  We also restart adbd here

# rather than waiting for init to notice its death and restarting it so the timing

# of USB resetting and adb restarting more closely matches the previous behavior.

on property:service.adb.root=1

	write /sys/class/android_usb/android0/enable 0

	restart adbd

	write /sys/class/android_usb/android0/enable 1

Edited by Namtaffy
Link to comment
Share on other sites

Guest Fstluxe

Dear Paul,

One x WWE @1.29

HTC One X Tegra 3 Root Script by Paul O'Brien- includes script from kennethpenn

Follow @paulobrien and @modaco on Twitter for more Android fun!

DON'T TOUCH THE DEVICE OR UNPLUG WHILE ROOTING!

PUSH FILES

909 KB/s (837916 bytes in 0.900s)

781 KB/s (91980 bytes in 0.115s)

705 KB/s (570342 bytes in 0.789s)

REBOOT

Reboot again... note that when device returns it may appear to be bootlooping, d

on't panic!

AGAIN!?

C:\Users\FPC\Downloads\r3-root-one-x-tegra\root-one-x-tegra>

Ass you can see it pushes the files, but after that nothing...

I thought you where using the exploit, So what is the exploit?

after its rebooted I dont get Superuser..

Edited by Fstluxe
Link to comment
Share on other sites

Guest kruppin

Too bad. :( But why is it working on the S4 variant and not the tegra one? Wierd. Either they don't have "real" s-on, or maybe they want people to root (since at&t wont allow unlocking) so they can charge money to fix faulty devices through warranty. :P

Link to comment
Share on other sites

Guest Namtaffy

Dear Paul,

One x WWE @1.29

HTC One X Tegra 3 Root Script by Paul O'Brien- includes script from kennethpenn

Follow @paulobrien and @modaco on Twitter for more Android fun!

DON'T TOUCH THE DEVICE OR UNPLUG WHILE ROOTING!

PUSH FILES

909 KB/s (837916 bytes in 0.900s)

781 KB/s (91980 bytes in 0.115s)

705 KB/s (570342 bytes in 0.789s)

REBOOT

Reboot again... note that when device returns it may appear to be bootlooping, d

on't panic!

AGAIN!?

C:\Users\FPC\Downloads\r3-root-one-x-tegra\root-one-x-tegra>

Ass you can see it pushes the files, but after that nothing...

I thought you where using the exploit, So what is the exploit?

after its rebooted I dont get Superuser..

I think the exploit is using a file with root permissions created in init.rc to push the property "ro.kernel.qemu=1" into local.prop so that adb has root access to run the rest of the script

Link to comment
Share on other sites

Guest c4b4l3

bat file manually execute command by command

after reboot

error at @adb shell "echo ro.kernel.qemu=1 > /data/local.prop" == Permissions denied

Link to comment
Share on other sites

Guest kruppin

Actually, I think it DOES work.. But after a real reboot it's gone again (s-on). I tried not removing the local.prop, and when I adb shell I get # and can mount system without problem. But with that local.prop there, the phone seems to restart as soon as it's booted. With S-ON I don't think this'll ever work. It's wierd it does on the AT&T variant.

Link to comment
Share on other sites

Guest PaulOBrien

Basically writing the local.prop gives you temproot, but makes the device think it's running in the emulator, which breaks all sort of stuff hence the reboots. The fipside is you have temproot, so hopefully you can remount /system rw and put permroot on.

S-ON, like we've seen in the past, seems to prevent writing to /system, so unfortunately that's a no-go. Very strange they didn't go that route on the AT&T One X but hey!

P

Link to comment
Share on other sites

Guest Fstluxe

Don't worry guys, I got cotulla on this case to get the device S-off.

Within weeks we have a fully S-off device.

Link to comment
Share on other sites

Guest kickasskev

Paul, will there ever be a way to unlock the bootloader without going through htcdev or am I just wainting for false hopes?

Also is the root without unlocked bootloader a total no go now in your opinion or do you think this also may be possible in future?

Link to comment
Share on other sites

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.