How to Unlock Bootloader and Root AT&T HTC One X/HTC One XL!

SO, you want to install custom ROMs on your AT&T HTC One X?

Well, you can now by changing CID on the AT&T HTC One X to 11111111, which will allow you to unlock bootloader using HTCDev.com.

Before we begin, you will need a rooted AT&T HTC One X, please see Root Any HTC One X! (If this root method doesn’t give you root, you might have a newer software version where HTC blocked root, you will have to wait until another root method is out)

NOTE: Unlocking Bootloader will erase all your settings and apps so make sure you make a backup of your apps using Titanium Backup app, backup SMS text using SMS Text Backup app, and I highly recommend using GMail for contacts (make a dummy account just for contacts).  Also make a backup of your storage to your hard disk just in case.

If you have a non-AT&T One XL model, then skip Step 5 through Step 9 and start at Step 9.5.

Step 1. Download OneXRootATT.zip and unzip, you will find a bunch of files.  Copy the file CWM-SuperSU-v0.87.zip to your AT&T HTC One X by connecting as a disk drive.

Sponsored Links


Download OneXRootATT.zip

Sponsored Links

Step 2. Change USB connection type back to “Charge Only”.

Step 3. Next, make sure “USB debugging” is checked ON under Settings->Developer options.

Step 4. For Windows, make sure you have drivers installed, you should see something like “My HTC” or “Android ADB”.  If you see Android 1.0 with exclamation mark, install drivers.

Download HTC One X 32-bit Windows drivers

Download HTC One X 64-bit Windows drivers

 

Step 5. Open a command prompt (or terminal for Mac and Linux) and type:

cd Downloads

cd OneXRootATT

adb shell

su

dd if=/dev/block/mmcblk0p4 of=/sdcard/mmcblk0p4

exit

exit

adb pull /sdcard/mmcblk0p4

For Linux, change all “adb” with “./adb-linux”.

For Mac, change all “adb” with “./adb-mac”.

Step 6. Open the mmcblk0p4 file (in OneXRootATT folder) with any HEX editor. (You can google for your OS)  Then find the line “CWS__001″.

Step 7. Change “CWS__001″ to “11111111″.

Step 8. Save the modified file as “mmcblk0p4MOD“.

Step 9. Next type:

adb push mmcblk0p4MOD /sdcard/mmcblk0p4MOD

adb shell

su

dd if=/sdcard/mmcblk0p4MOD of=/dev/block/mmcblk0p4

exit
exit

Step 9.5

adb reboot bootloader

fastboot oem readcid

fastboot oem get_identifier_token

For Linux, change all “adb” with “./adb-linux” and “fastboot” with “./fastboot-linux”.

For Mac, change all “adb” with “./adb-mac” and “fastboot” with “./fastboot-mac”.

Step 10. Copy the token to your clipboard exactly like shown here:

Step 11. Go to HTCDev.com and login, if you don’t have an account already go ahead and register.  Once logged in, choose “All Other Supported Models” and click on “Begin Unlock Bootloader”.

Step 12. Next scroll down to bottom and click on “Proceed to Step 5″.

Step 12. Next scroll down to bottom and click on “Proceed to Step 8″.

Step 13. Next scroll down to bottom and paste your token.

Step 14. If you copied the token correctly, you should get “Token Submitted Successfully!” message.

Step 15. Go to your e-mail inbox and download Unlock_code.bin.

Step 16. Copy the file Unlock_code.bin to the OneXRootATT directory.

Step 17. Go back to command prompt/terminal and type:

fastboot flash unlocktoken Unlock_code.bin

Step 18. Your phone should now ask you if you want to “Unlock bootloader”.  Use Volume Up button to choose “Yes” and hit the Power button.  Your phone will reboot.

Step 19. Once rebooted, make sure “USB Debugging” is checked ON under Settings->Developer Options then type the following in command prompt/terminal:

adb reboot bootloader

Step 20. Next type:

fastboot flash recovery openrecovery-twrp-2.1.7-evita.img (updated with TWRP 2.2)

fastboot flash recovery openrecovery-twrp-2.2.0-evita.img
fastboot erase cache

This will flash a custom TWRP recovery to your AT&T One X.

Step 21. Next choose “RECOVERY” on your phone and Hit the Power button to enter TWRP recovery.

Step 22. Once in TWRP recovery, select “Install” and find the file you copied over in Step 1 CWM-SuperSU-v0.87.zip.

Step 23. Install the file and reboot.

Step 24. Once rebooted, you will find SuperSU app.

 

VN:F [1.9.20_1166]
Rating: 9.3/10 (3 votes cast)
How to Unlock Bootloader and Root AT&T HTC One X/HTC One XL!, 9.3 out of 10 based on 3 ratings

Want to stay updated on latest HTC One X Root news?
Sign up for our One X Root Newsletter here so you don't miss a single tip!
Categories: One X Root.
Check out other custom ROMs!
Recent Android News from HighOnAndroid.com

55 Responses to How to Unlock Bootloader and Root AT&T HTC One X/HTC One XL!

  1. Andrew says:

    im having trouble with the driver part. when i check its only “Android Phone” with an exclamation mark, not “android 1.0″ what am i doing wrong? i installed the drivers for it but it ended up under “Android Devices” not “ADB Interface. I eventually got all the way up to where we have to type “fastboot oem readcid” and then i get stuck at “waiting for device”. PLEEZ HELP!!

  2. Andrew says:

    on the mac i get up to “/adb-mac pull /sdcard/mmcblk0p4″ and then i get a whole bunch of crap :
    Android Debug Bridge version 1.0.25

    -d – directs command to the only connected USB device
    returns an error if more than one USB device is present.
    -e – directs command to the only running emulator.
    returns an error if more than one emulator is running.
    -s – directs command to the USB device or emulator with
    the given serial number. Overrides ANDROID_SERIAL
    envivornment variable.
    -p – simple product name like ‘sooner’, or
    a relative/absolute path to a product
    out directory like ‘out/target/product/sooner’.
    If -p is not specified, the ANDROID_PRODUCT_OUT
    environment variable is used, which must
    be an absolute path.
    devices – list all connected devices
    connect : – connect to a device via TCP/IP disconnect : – disconnect from a TCP/IP device
    device commands:
    adb push – copy file/dir to device
    adb pull – copy file/dir from device
    adb sync [ ] – copy host->device only if changed
    (see ‘adb help all’)
    adb shell – run remote shell interactively
    adb shell – run remote shell command
    adb emu – run emulator console command
    adb logcat [ ] – View device log
    adb forward – forward socket connections
    forward specs are one of:
    tcp:
    localabstract:
    localreserved:
    localfilesystem:
    dev:
    jdwp: (remote only)
    adb jdwp – list PIDs of processes hosting a JDWP transport
    adb install [-l] [-r] – push this package file to the device and install it
    (‘-l’ means forward-lock the app)
    (‘-r’ means reinstall the app, keeping its data)
    adb uninstall [-k] – remove this app package from the device
    (‘-k’ means keep the data and cache directories)
    adb bugreport – return all information from the device
    that should be included in a bug report.

    adb help – show this help message
    adb version – show version num

    DATAOPTS:
    (no option) – don’t touch the data partition
    -w – wipe the data partition
    -d – flash the data partition

    scripting:
    adb wait-for-device – block until device is online
    adb start-server – ensure that there is a server running
    adb kill-server – kill the server if it is running
    adb get-state – prints: offline | bootloader | device
    adb get-serialno – prints:
    adb status-window – continuously print device status for a specified device
    adb remount – remounts the /system partition on the device read-write
    adb reboot [bootloader|recovery] – reboots the device, optionally into the bootloader or recovery program
    adb root – restarts the adbd daemon with root permissions
    adb usb – restarts the adbd daemon listening on USB adb tcpip – restarts the adbd daemon listening on TCP on the specified port
    networking:
    adb ppp [parameters] – Run PPP over USB.
    Note: you should not automatically start a PPP connection.
    refers to the tty for PPP stream. Eg. dev:/dev/omap_csmi_tty1
    [parameters] – Eg. defaultroute debug dump local notty usepeerdns

    adb sync notes: adb sync [ ]
    can be interpreted in several ways:

    – If is not specified, both /system and /data partitions will be updated.

    – If it is “system” or “data”, only the corresponding partition
    is updated.
    Andrews-MacBook-Pro:OneXRootATT andrewgluchowski$

    HOW DO I FIX THIS?!?!?!
    sorry for the nonsense of posted btw :( im having a little trouble with this.

  3. Zachbnonymous says:

    When I type in “fastboot oem readcid” it says Waiting for device and then does nothing. What did I do wrong? haha

  4. Zachbnonymous says:

    And then it comes up saying the Android 1.1 driver did not install…. in my device manager it says the drivers are installed…

  5. Joe says:

    whenever I do ‘fastboot oem readcid’ i get “waiting for device”. in device manager Android 1.0 has an exclamation point next to it. I have updated the drivers, and removed and reintstalled them. Any ideas?

    • Max says:

      try updating drivers while “waiting for device”, you should see it go once drivers are updated.

      • Joe says:

        I figured it out. When it says “waiting for device” go to device manager, Android 1.0 will have an exclamation point next to it. Right click it, hit update driver, browse my computer, let me pick from a list of device drivers on my compter, Android USB devices, and then HTCxxx. Successfully rooted and running with only one flaw, but ill figure that out later.

  6. John says:

    Just followed all your steps and all went well. Thanks for developing such an excellent tutorial!

  7. Dan says:

    WIll this work for the rogers version as well?

    Thanks

    Dan

  8. Dan says:

    Thanks

    Would I skip the step with changing the file to 11111111 with the hex editor?

    Dan

  9. Dan says:

    Thanks for your help! It worked perfectly.

    Dan

  10. Bob says:

    I have software version 1.85 on my at&t HTC one XL. I have rooted the phone using a different method. Should this method of unlocking the bootloader work for me?

  11. K Pearce says:

    I keep getting stuck at step 17. When I but the code in just sit there…any idea of what i can do?

  12. K Pearce says:

    Nvm…got it…plugged my phone directly into computer…thanks man!!!!

  13. Vadim says:

    All works! Thx a lot!!!

  14. yamnutz says:

    keeps telling me that “su” is not found in step 9…

  15. Andy says:

    Hey max,
    I’m getting this problem as well

    I type this in: /adb-mac pull /sdcard/mmcblk0p4 and then I get all of this stuff:
    Android Debug Bridge version 1.0.25

    -d – directs command to the only connected USB device
    returns an error if more than one USB device is present.
    -e – directs command to the only running emulator.
    returns an error if more than one emulator is running.
    -s – directs command to the USB device or emulator with
    the given serial number. Overrides ANDROID_SERIAL
    envivornment variable.
    -p – simple product name like ‘sooner’, or
    a relative/absolute path to a product
    out directory like ‘out/target/product/sooner’.
    If -p is not specified, the ANDROID_PRODUCT_OUT
    environment variable is used, which must
    be an absolute path.
    devices – list all connected devices
    connect : – connect to a device via TCP/IP disconnect : – disconnect from a TCP/IP device
    device commands:
    adb push – copy file/dir to device
    adb pull – copy file/dir from device
    adb sync [ ] – copy host->device only if changed
    (see ‘adb help all’)
    adb shell – run remote shell interactively
    adb shell – run remote shell command
    adb emu – run emulator console command
    adb logcat [ ] – View device log
    adb forward – forward socket connections
    forward specs are one of:
    tcp:
    localabstract:
    localreserved:
    localfilesystem:
    dev:
    jdwp: (remote only)
    adb jdwp – list PIDs of processes hosting a JDWP transport
    adb install [-l] [-r] – push this package file to the device and install it
    (‘-l’ means forward-lock the app)
    (‘-r’ means reinstall the app, keeping its data)
    adb uninstall [-k] – remove this app package from the device
    (‘-k’ means keep the data and cache directories)
    adb bugreport – return all information from the device
    that should be included in a bug report.

    adb help – show this help message
    adb version – show version num

    DATAOPTS:
    (no option) – don’t touch the data partition
    -w – wipe the data partition
    -d – flash the data partition

    scripting:
    adb wait-for-device – block until device is online
    adb start-server – ensure that there is a server running
    adb kill-server – kill the server if it is running
    adb get-state – prints: offline | bootloader | device
    adb get-serialno – prints:
    adb status-window – continuously print device status for a specified device
    adb remount – remounts the /system partition on the device read-write
    adb reboot [bootloader|recovery] – reboots the device, optionally into the bootloader or recovery program
    adb root – restarts the adbd daemon with root permissions
    adb usb – restarts the adbd daemon listening on USB adb tcpip – restarts the adbd daemon listening on TCP on the specified port
    networking:
    adb ppp [parameters] – Run PPP over USB.
    Note: you should not automatically start a PPP connection.
    refers to the tty for PPP stream. Eg. dev:/dev/omap_csmi_tty1
    [parameters] – Eg. defaultroute debug dump local notty usepeerdns

    adb sync notes: adb sync [ ]
    can be interpreted in several ways:

    – If is not specified, both /system and /data partitions will be updated.

    – If it is “system” or “data”, only the corresponding partition
    is updated.

  16. iheartroot says:

    I’m a big fan Zedomax!
    Question…
    Should Step 20. be:
    fastboot flash recovery openrecovery-twrp-2.2.0-evita.img
    ???
    We want to flash, not just “fastboot boot openrecovery-twrp-2.2.0-evita.img”, right?

  17. rosty says:

    When i type in su it says not found, and for the dd if=/dev/block/mmcblk0p4 of=/sdcard/mmcblk0p4 it says permission denied (Step 5)

    • Dan says:

      which software version are you on? If you go to settings -> about phone -> software information and it says 2.20 as the leading numbers in your software version, you will not be able to use this work around.

  18. luis yonaldo says:

    When I type in “fastboot oem readcid” it says Waiting for device and then does nothing. im on linux
    HELPPPPPP PLEASE!

  19. krishna says:

    I have Android 4.0.4 HTC Sense version 4.0 can i still “Unlock Bootloader and Root AT&T HTC One X”.

    • Dan says:

      if in your “About Phone” under “Software number” it says “2.20.502.7 710RD” or something with the leading 2.20, then no. Your phone does not have the ability to root at this time.

  20. martin says:

    i have 2.20 AT&T ver. i hope max you will find something to root my HOX

  21. Rodrigo Mora says:

    Actually I have Software number 1.85.502.3 710RD and I am getting su: not found. I have already tried http://onexroot.com/one-x-root/how-to-root-one-x/ with no luck since I get Error Code: 160.
    Error Reason: MID Not Allowed. from the HTC Dev page after trying to unlock the bootloader. Do you know of any other options to unlock the bootloader and root this phone?

  22. fawwaz says:

    how long realistically do you think it will be before they will find a way to root the HTC ONE X AT&T running android 2.20

    • Max says:

      not sure but it sucks att did that, I would advise if you can still return your phone do return it and get a rootable phone like GS3.

  23. dustin says:

    hi, can you help me out quick, I follow ur sited, and I “boot” the twrp instead of “flashing” it, cuz i followed the instruction on the website instead of video, i just copied and i notice it said boot. I can’t get back into bootloader by adb boot bootloader. HELP PLZ
    I followed the website instruction and it’s near last step already.wtf :( plz help

  24. Elian says:

    Greetings Friends!

    I have an HTC AT & T One X 16gb (

    My problem is that I get TAPERED ****** *** LOCKED ***

    We try several ways to unlock and no ah I worked, will have a manual that can help me?

    I want to change the ROM

  25. neo says:

    Dear Max,
    I hv a HTC One X AT&T with 1.85 firmware on 4.0.3
    will this method root my phone??

  26. Zenna says:

    I need help I’m going to pull my hair out!
    I’m using HTC ONE XL Telstra (international version I think)
    it’s running on 4.1.1 -I’ve read elsewhere you can root a device thats running above 1.85?
    I’ve unlocked bootloader but until I root my device I can’t flash ROMS
    Everytime I try to root it though command can’t access busybox/superuser/you name it!
    It comes up with permission denied or no such file or directory

    What can be done?!?!

  27. Ishaan says:

    does this give me superCID?
    Thanks

  28. Sathis K Mittapelli says:

    HI,

    I am unable to download the OneXRootATT.zip from the given link.

    I am getting web page not found error.

    Thanks and Regards,
    Sathish.

  29. Ricardo says:

    You said in HTC One X with OTA update you need to have a rooted phone to do this, but how can u root it if the bootloader isn’t unlocked?? i want to root my phone but in step 5 when type “su” i gives me this error:

    /system/bin/sh: su: not found

    any ideas?

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>