TESTING: Rooting your One X without unlocking the bootloader (Windows / Mac / Linux)

[Guest ste1164]

Tried on my mac but I need to use an RUU now as I got system UI crashed and constant reboots :(

[Guest Mike Penz]

Hey. I've a One X (Tegra 3) and i'm still S-ON and never used HTC Dev. I also use a Mac. So what will i have to do, and what can happen if it fails?

Is it save? (S-ON should protect me right?)

Can i loose all my installed settings/apps?

I'm only a bit carful because i love my OneX and i have not that much money to buy a new one.

[Guest ste1164]

Hey. I've a One X (Tegra 3) and i'm still S-ON and never used HTC Dev. I also use a Mac. So what will i have to do, and what can happen if it fails?

Is it save? (S-ON should protect me right?)

Can i loose all my installed settings/apps?

I'm only a bit carful because i love my OneX and i have not that much money to buy a new one.

I lost my settings and apps because I did something wrong :P Im not 100% sure how to run the command on a mac.

[Guest PaulOBrien]

Tried on my mac but I need to use an RUU now as I got system UI crashed and constant reboots :(

Edit the script and redo the final step. It's been interrupted.

P

[Guest SozzaSinnian]

what can happen if it fails?

In the first post of this thread:

You use this at your own risk! Worst case scenario, you'll have to reflash with a RUU (make sure you have one handy!

Can i loose all my installed settings/apps?

I'm pretty sure when you do an RUU you will lose your data as it does a complete restore, However I am not 100% on this as never had to use one yet.

[Guest jeckyllhavok]

So, anyone with s-on and locked bootloader got it working?

[Guest Piccaruse]

Thought this might help.

The last two are the latter part of the script I ran seperatly, thought that might've helped.

[Guest starbase64]

Hi,

don't work on TMO Germany 1.28.111.10.

D:\Handy\HTC One X\root-one-x-tegra>adb kill-server

D:\Handy\HTC One X\root-one-x-tegra>adb wait-for-device

* daemon not running. starting it now *

* daemon started successfully *

D:\Handy\HTC One X\root-one-x-tegra>ECHO.


D:\Handy\HTC One X\root-one-x-tegra>echo HTC One X Tegra 3 Root Script by Paul O

'Brien- includes script from kennethpenn

HTC One X Tegra 3 Root Script by Paul O'Brien- includes script from kennethpenn

D:\Handy\HTC One X\root-one-x-tegra>echo Follow paulobrien and modaco on Twitter

for more Android fun!

Follow paulobrien and modaco on Twitter for more Android fun!

D:\Handy\HTC One X\root-one-x-tegra>ECHO DON'T TOUCH THE DEVICE OR UNPLUG WHILE

ROOTING!

DON'T TOUCH THE DEVICE OR UNPLUG WHILE ROOTING!

D:\Handy\HTC One X\root-one-x-tegra>ECHO PUSH FILES

PUSH FILES

D:\Handy\HTC One X\root-one-x-tegra>adb push busybox /data/local/busybox

1106 KB/s (837916 bytes in 0.739s)

D:\Handy\HTC One X\root-one-x-tegra>adb push su /data/local/su

1703 KB/s (91980 bytes in 0.052s)

D:\Handy\HTC One X\root-one-x-tegra>adb push Superuser.apk /data/local/Superuser.apk

842 KB/s (570342 bytes in 0.661s)

D:\Handy\HTC One X\root-one-x-tegra>adb shell chmod 777 /data/local/busybox

D:\Handy\HTC One X\root-one-x-tegra>adb shell chmod 755 /data/local/su

D:\Handy\HTC One X\root-one-x-tegra>adb shell chmod 755 /data/local/Superuser.apk

D:\Handy\HTC One X\root-one-x-tegra>adb shell mv /data/tigps/aiding /data/tigps/aiding.old

D:\Handy\HTC One X\root-one-x-tegra>adb shell ln -s /data /data/tigps/aiding

D:\Handy\HTC One X\root-one-x-tegra>adb shell rm /data/local.prop  1>nul

D:\Handy\HTC One X\root-one-x-tegra>ECHO.


D:\Handy\HTC One X\root-one-x-tegra>ECHO REBOOT

REBOOT

D:\Handy\HTC One X\root-one-x-tegra>adb reboot

D:\Handy\HTC One X\root-one-x-tegra>adb wait-for-device

D:\Handy\HTC One X\root-one-x-tegra>adb shell "echo ro.kernel.qemu=1 > /data/local.prop"

D:\Handy\HTC One X\root-one-x-tegra>ECHO Reboot again... note that when device returns it may appear to be bootlooping, don't panic!

Reboot again... note that when device returns it may appear to be bootlooping, don't panic!

D:\Handy\HTC One X\root-one-x-tegra>adb reboot

D:\Handy\HTC One X\root-one-x-tegra>adb wait-for-device

D:\Handy\HTC One X\root-one-x-tegra>ECHO AGAIN!?

AGAIN!?

D:\Handy\HTC One X\root-one-x-tegra>adb shell "mount -wo remount rootfs /"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "mount -o remount,rw -t ext4 /dev/block/mmcblk0p12 /system"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "cat /data/local/busybox > /system/xbin/busybox"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "chmod 777 /system/xbin/busybox"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "/system/xbin/busybox --install -s /system/xbin"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "busybox cp /data/local/Superuser.apk /system/app/Superuser.apk"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "busybox cp /data/local/su /system/xbin/su"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "chown 0.0 /system/xbin/su"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "chmod 06755 /system/xbin/su"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "chmod 644 /system/app/Superuser.apk"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "rm /data/local.prop"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "rm /data/tigps/aiding"

D:\Handy\HTC One X\root-one-x-tegra>adb shell "mv /data/tigps/aiding.old /data/tigps/aiding"

D:\Handy\HTC One X\root-one-x-tegra>adb reboot

D:\Handy\HTC One X\root-one-x-tegra>

cheers

starbase64

[Guest kruppin]

I have both S-on and locked bootloader, and unfortunately it didn't work.. :( And what is "/data/tigps/aiding" ? why not use the same (tmp) as the at&t hack? Wierd it works on that phone but not this one.. Or maybe it did in the first versions? I have FW 1.29.. Ans why is the partition table so different? :P p12 and p33? Sure it's a very different phone, but still.

Edit: I haven't read anything about the AT&T variant, but maybe the reason why this works is that it hasn't S-ON?

Edited May 9, 2012 by kruppin

[Guest ste1164]

I tried and got this error rm failed for /data/local.prop, No such file or directory

[Guest PaulOBrien]

I tried and got this error rm failed for /data/local.prop, No such file or directory

That's expected.

P

[Guest ste1164]

That's expected.

P

Oh in that case it didn't work on a mac :( must have been just your S-OFF device. I used the command sh then chose the root-mac.sh file and got nothing.

[Guest sibbor]

Mr. O'Brien, what can I do to assist?

See a few posts back for full details.

Running everything manually on Ubuntu 12.04, via adb, I'm getting all files pushed but got issues with the fs:

sibbor@ubuntu:~$ adb shell "mount -wo remount rootfs /"

error: insufficient permissions for device

sibbor@ubuntu:~$ adb shell "cat /data/local/busybox > /system/xbin/busybox"

error: insufficient permissions for device

Edited May 9, 2012 by sibbor

[Guest PaulOBrien]

Looks like it's not gonna happen on s-on then... :-(

P

[Guest marco1958]

Operation not permitted on the remount. Anybody has a setuid root mount executable? Push that along with the other stuff and try remount with 1551 root mount? Just an idea. So close :) Or does push remove permission?

[Guest Namtaffy]

am I being dumb or is there code in init.rc that detects if adb is in root mode and resets the usb connection? it's about halfway down the file? or am I talking out of my butt (which is highly likely :) ) either that or it resetting to handle the new root instance of adb maybe?

# adbd on at boot in emulator

on property:ro.kernel.qemu=1

	start adbd

# This property trigger has added to imitiate the previous behavior of "adb root".

# The adb gadget driver used to reset the USB bus when the adbd daemon exited,

# and the host side adb relied on this behavior to force it to reconnect with the

# new adbd instance after init relaunches it. So now we force the USB bus to reset

# here when adbd sets the service.adb.root property to 1.  We also restart adbd here

# rather than waiting for init to notice its death and restarting it so the timing

# of USB resetting and adb restarting more closely matches the previous behavior.

on property:service.adb.root=1

	write /sys/class/android_usb/android0/enable 0

	restart adbd

	write /sys/class/android_usb/android0/enable 1

Edited May 9, 2012 by Namtaffy

[Guest Fstluxe]

Dear Paul,

One x WWE @1.29

HTC One X Tegra 3 Root Script by Paul O'Brien- includes script from kennethpenn

Follow @paulobrien and @modaco on Twitter for more Android fun!

DON'T TOUCH THE DEVICE OR UNPLUG WHILE ROOTING!

PUSH FILES

909 KB/s (837916 bytes in 0.900s)

781 KB/s (91980 bytes in 0.115s)

705 KB/s (570342 bytes in 0.789s)

REBOOT

Reboot again... note that when device returns it may appear to be bootlooping, d

on't panic!

AGAIN!?

C:\Users\FPC\Downloads\r3-root-one-x-tegra\root-one-x-tegra>

Ass you can see it pushes the files, but after that nothing...

I thought you where using the exploit, So what is the exploit?

after its rebooted I dont get Superuser..

Edited May 9, 2012 by Fstluxe

[Guest kruppin]

Too bad. :( But why is it working on the S4 variant and not the tegra one? Wierd. Either they don't have "real" s-on, or maybe they want people to root (since at&t wont allow unlocking) so they can charge money to fix faulty devices through warranty. :P

[Guest Namtaffy]

Dear Paul,

One x WWE @1.29

HTC One X Tegra 3 Root Script by Paul O'Brien- includes script from kennethpenn

Follow @paulobrien and @modaco on Twitter for more Android fun!

DON'T TOUCH THE DEVICE OR UNPLUG WHILE ROOTING!

PUSH FILES

909 KB/s (837916 bytes in 0.900s)

781 KB/s (91980 bytes in 0.115s)

705 KB/s (570342 bytes in 0.789s)

REBOOT

Reboot again... note that when device returns it may appear to be bootlooping, d

on't panic!

AGAIN!?

C:\Users\FPC\Downloads\r3-root-one-x-tegra\root-one-x-tegra>

Ass you can see it pushes the files, but after that nothing...

I thought you where using the exploit, So what is the exploit?

after its rebooted I dont get Superuser..

I think the exploit is using a file with root permissions created in init.rc to push the property "ro.kernel.qemu=1" into local.prop so that adb has root access to run the rest of the script

[Guest Fstluxe]

thats pretty gay..

[Guest c4b4l3]

bat file manually execute command by command

after reboot

error at @adb shell "echo ro.kernel.qemu=1 > /data/local.prop" == Permissions denied

[Guest kruppin]

Actually, I think it DOES work.. But after a real reboot it's gone again (s-on). I tried not removing the local.prop, and when I adb shell I get # and can mount system without problem. But with that local.prop there, the phone seems to restart as soon as it's booted. With S-ON I don't think this'll ever work. It's wierd it does on the AT&T variant.

[Guest PaulOBrien]

Basically writing the local.prop gives you temproot, but makes the device think it's running in the emulator, which breaks all sort of stuff hence the reboots. The fipside is you have temproot, so hopefully you can remount /system rw and put permroot on.

S-ON, like we've seen in the past, seems to prevent writing to /system, so unfortunately that's a no-go. Very strange they didn't go that route on the AT&T One X but hey!

P

[Guest Fstluxe]

Don't worry guys, I got cotulla on this case to get the device S-off.

Within weeks we have a fully S-off device.

[Guest kickasskev]

Paul, will there ever be a way to unlock the bootloader without going through htcdev or am I just wainting for false hopes?

Also is the root without unlocked bootloader a total no go now in your opinion or do you think this also may be possible in future?