SO, you want to install custom ROMs on your AT&T HTC One X?
Well, you can now by changing CID on the AT&T HTC One X to 11111111, which will allow you to unlock bootloader using HTCDev.com.
Before we begin, you will need a rooted AT&T HTC One X, please see Root Any HTC One X! (If this root method doesn’t give you root, you might have a newer software version where HTC blocked root, you will have to wait until another root method is out)
NOTE: Unlocking Bootloader will erase all your settings and apps so make sure you make a backup of your apps using Titanium Backup app, backup SMS text using SMS Text Backup app, and I highly recommend using GMail for contacts (make a dummy account just for contacts). Also make a backup of your storage to your hard disk just in case.
If you have a non-AT&T One XL model, then skip Step 5 through Step 9 and start at Step 9.5.
Step 1. Download OneXRootATT.zip and unzip, you will find a bunch of files. Copy the file CWM-SuperSU-v0.87.zip to your AT&T HTC One X by connecting as a disk drive.
Sponsored Links
Download OneXRootATT.zip
Sponsored Links
Step 2. Change USB connection type back to “Charge Only”.
Step 3. Next, make sure “USB debugging” is checked ON under Settings->Developer options.
Step 4. For Windows, make sure you have drivers installed, you should see something like “My HTC” or “Android ADB”. If you see Android 1.0 with exclamation mark, install drivers.
Download HTC One X 32-bit Windows drivers
Download HTC One X 64-bit Windows drivers
Step 5. Open a command prompt (or terminal for Mac and Linux) and type:
cd Downloads
cd OneXRootATT
adb shell
su
dd if=/dev/block/mmcblk0p4 of=/sdcard/mmcblk0p4
exit
exit
adb pull /sdcard/mmcblk0p4
For Linux, change all “adb” with “./adb-linux”.
For Mac, change all “adb” with “./adb-mac”.
Step 6. Open the mmcblk0p4 file (in OneXRootATT folder) with any HEX editor. (You can google for your OS) Then find the line “CWS__001”.
Step 7. Change “CWS__001” to “11111111”.
Step 8. Save the modified file as “mmcblk0p4MOD“.
Step 9. Next type:
adb push mmcblk0p4MOD /sdcard/mmcblk0p4MOD
adb shell
su
dd if=/sdcard/mmcblk0p4MOD of=/dev/block/mmcblk0p4
exit
exit
Step 9.5
adb reboot bootloader
fastboot oem readcid
fastboot oem get_identifier_token
For Linux, change all “adb” with “./adb-linux” and “fastboot” with “./fastboot-linux”.
For Mac, change all “adb” with “./adb-mac” and “fastboot” with “./fastboot-mac”.
Step 10. Copy the token to your clipboard exactly like shown here:
Step 11. Go to HTCDev.com and login, if you don’t have an account already go ahead and register. Once logged in, choose “All Other Supported Models” and click on “Begin Unlock Bootloader”.
Step 12. Next scroll down to bottom and click on “Proceed to Step 5”.
Step 12. Next scroll down to bottom and click on “Proceed to Step 8”.
Step 13. Next scroll down to bottom and paste your token.
Step 14. If you copied the token correctly, you should get “Token Submitted Successfully!” message.
Step 15. Go to your e-mail inbox and download Unlock_code.bin.
Step 16. Copy the file Unlock_code.bin to the OneXRootATT directory.
Step 17. Go back to command prompt/terminal and type:
fastboot flash unlocktoken Unlock_code.bin
Step 18. Your phone should now ask you if you want to “Unlock bootloader”. Use Volume Up button to choose “Yes” and hit the Power button. Your phone will reboot.
Step 19. Once rebooted, make sure “USB Debugging” is checked ON under Settings->Developer Options then type the following in command prompt/terminal:
adb reboot bootloader
Step 20. Next type:
fastboot flash recovery openrecovery-twrp-2.1.7-evita.img (updated with TWRP 2.2)
fastboot flash recovery openrecovery-twrp-2.2.0-evita.img
fastboot erase cache
This will flash a custom TWRP recovery to your AT&T One X.
Step 21. Next choose “RECOVERY” on your phone and Hit the Power button to enter TWRP recovery.
Step 22. Once in TWRP recovery, select “Install” and find the file you copied over in Step 1 CWM-SuperSU-v0.87.zip.
Step 23. Install the file and reboot.
Step 24. Once rebooted, you will find SuperSU app.
Sign up for our One X Root Newsletter here so you don't miss a single tip!
Subscribe via RSS
im having trouble with the driver part. when i check its only “Android Phone” with an exclamation mark, not “android 1.0” what am i doing wrong? i installed the drivers for it but it ended up under “Android Devices” not “ADB Interface. I eventually got all the way up to where we have to type “fastboot oem readcid” and then i get stuck at “waiting for device”. PLEEZ HELP!!
ill just try to do it on the mac XD i just have to know, when exactly do you have to type “chmod 755 *”???
Hmmm… is there any exclamation marks? that’s the one you have to update drivers.
on the mac i get up to “/adb-mac pull /sdcard/mmcblk0p4” and then i get a whole bunch of crap :
Android Debug Bridge version 1.0.25
-d – directs command to the only connected USB device
returns an error if more than one USB device is present.
-e – directs command to the only running emulator.
returns an error if more than one emulator is running.
-s – directs command to the USB device or emulator with
the given serial number. Overrides ANDROID_SERIAL
envivornment variable.
-p – simple product name like ‘sooner’, or
a relative/absolute path to a product
out directory like ‘out/target/product/sooner’.
If -p is not specified, the ANDROID_PRODUCT_OUT
environment variable is used, which must
be an absolute path.
devices – list all connected devices
connect : – connect to a device via TCP/IP disconnect : – disconnect from a TCP/IP device
device commands:
adb push – copy file/dir to device
adb pull – copy file/dir from device
adb sync [ ] – copy host->device only if changed
(see ‘adb help all’)
adb shell – run remote shell interactively
adb shell – run remote shell command
adb emu – run emulator console command
adb logcat [ ] – View device log
adb forward – forward socket connections
forward specs are one of:
tcp:
localabstract:
localreserved:
localfilesystem:
dev:
jdwp: (remote only)
adb jdwp – list PIDs of processes hosting a JDWP transport
adb install [-l] [-r] – push this package file to the device and install it
(‘-l’ means forward-lock the app)
(‘-r’ means reinstall the app, keeping its data)
adb uninstall [-k] – remove this app package from the device
(‘-k’ means keep the data and cache directories)
adb bugreport – return all information from the device
that should be included in a bug report.
adb help – show this help message
adb version – show version num
DATAOPTS:
(no option) – don’t touch the data partition
-w – wipe the data partition
-d – flash the data partition
scripting:
adb wait-for-device – block until device is online
adb start-server – ensure that there is a server running
adb kill-server – kill the server if it is running
adb get-state – prints: offline | bootloader | device
adb get-serialno – prints:
adb status-window – continuously print device status for a specified device
adb remount – remounts the /system partition on the device read-write
adb reboot [bootloader|recovery] – reboots the device, optionally into the bootloader or recovery program
adb root – restarts the adbd daemon with root permissions
adb usb – restarts the adbd daemon listening on USB adb tcpip – restarts the adbd daemon listening on TCP on the specified port
networking:
adb ppp [parameters] – Run PPP over USB.
Note: you should not automatically start a PPP connection.
refers to the tty for PPP stream. Eg. dev:/dev/omap_csmi_tty1
[parameters] – Eg. defaultroute debug dump local notty usepeerdns
adb sync notes: adb sync [ ]
can be interpreted in several ways:
– If is not specified, both /system and /data partitions will be updated.
– If it is “system” or “data”, only the corresponding partition
is updated.
Andrews-MacBook-Pro:OneXRootATT andrewgluchowski$
HOW DO I FIX THIS?!?!?!
sorry for the nonsense of posted btw 🙁 im having a little trouble with this.
^same problem =/
Just went into my files and did it myself.
What do u mean???
Same problem !!
make sure ur usb be is on charge only mode.
Hey max, sorry to be a pain in the ass with all these questions but
I unlocked the bootloader and stuff I think, but my phone was still rooted after it restarted. Is that normal?
still rooted after unlocking? I don’t get what you are trying to do?
When I type in “fastboot oem readcid” it says Waiting for device and then does nothing. What did I do wrong? haha
nothing just update the drivers in device manager.
And then it comes up saying the Android 1.1 driver did not install…. in my device manager it says the drivers are installed…
whenever I do ‘fastboot oem readcid’ i get “waiting for device”. in device manager Android 1.0 has an exclamation point next to it. I have updated the drivers, and removed and reintstalled them. Any ideas?
try updating drivers while “waiting for device”, you should see it go once drivers are updated.
I figured it out. When it says “waiting for device” go to device manager, Android 1.0 will have an exclamation point next to it. Right click it, hit update driver, browse my computer, let me pick from a list of device drivers on my compter, Android USB devices, and then HTCxxx. Successfully rooted and running with only one flaw, but ill figure that out later.
Just followed all your steps and all went well. Thanks for developing such an excellent tutorial!
WIll this work for the rogers version as well?
Thanks
Dan
Yes.
Thanks
Would I skip the step with changing the file to 11111111 with the hex editor?
Dan
exactly!
Thanks for your help! It worked perfectly.
Dan
I have software version 1.85 on my at&t HTC one XL. I have rooted the phone using a different method. Should this method of unlocking the bootloader work for me?
yes unlocking bootloader works regardless of version you have.
Thats what I was thinking, just wanted to make sure before I started. Thanks
I keep getting stuck at step 17. When I but the code in just sit there…any idea of what i can do?
Nvm…got it…plugged my phone directly into computer…thanks man!!!!
All works! Thx a lot!!!
keeps telling me that “su” is not found in step 9…
You have to have a rooted phone first.
Hey max,
I’m getting this problem as well
I type this in: /adb-mac pull /sdcard/mmcblk0p4 and then I get all of this stuff:
Android Debug Bridge version 1.0.25
-d – directs command to the only connected USB device
returns an error if more than one USB device is present.
-e – directs command to the only running emulator.
returns an error if more than one emulator is running.
-s – directs command to the USB device or emulator with
the given serial number. Overrides ANDROID_SERIAL
envivornment variable.
-p – simple product name like ‘sooner’, or
a relative/absolute path to a product
out directory like ‘out/target/product/sooner’.
If -p is not specified, the ANDROID_PRODUCT_OUT
environment variable is used, which must
be an absolute path.
devices – list all connected devices
connect : – connect to a device via TCP/IP disconnect : – disconnect from a TCP/IP device
device commands:
adb push – copy file/dir to device
adb pull – copy file/dir from device
adb sync [ ] – copy host->device only if changed
(see ‘adb help all’)
adb shell – run remote shell interactively
adb shell – run remote shell command
adb emu – run emulator console command
adb logcat [ ] – View device log
adb forward – forward socket connections
forward specs are one of:
tcp:
localabstract:
localreserved:
localfilesystem:
dev:
jdwp: (remote only)
adb jdwp – list PIDs of processes hosting a JDWP transport
adb install [-l] [-r] – push this package file to the device and install it
(‘-l’ means forward-lock the app)
(‘-r’ means reinstall the app, keeping its data)
adb uninstall [-k] – remove this app package from the device
(‘-k’ means keep the data and cache directories)
adb bugreport – return all information from the device
that should be included in a bug report.
adb help – show this help message
adb version – show version num
DATAOPTS:
(no option) – don’t touch the data partition
-w – wipe the data partition
-d – flash the data partition
scripting:
adb wait-for-device – block until device is online
adb start-server – ensure that there is a server running
adb kill-server – kill the server if it is running
adb get-state – prints: offline | bootloader | device
adb get-serialno – prints:
adb status-window – continuously print device status for a specified device
adb remount – remounts the /system partition on the device read-write
adb reboot [bootloader|recovery] – reboots the device, optionally into the bootloader or recovery program
adb root – restarts the adbd daemon with root permissions
adb usb – restarts the adbd daemon listening on USB adb tcpip – restarts the adbd daemon listening on TCP on the specified port
networking:
adb ppp [parameters] – Run PPP over USB.
Note: you should not automatically start a PPP connection.
refers to the tty for PPP stream. Eg. dev:/dev/omap_csmi_tty1
[parameters] – Eg. defaultroute debug dump local notty usepeerdns
adb sync notes: adb sync [ ]
can be interpreted in several ways:
– If is not specified, both /system and /data partitions will be updated.
– If it is “system” or “data”, only the corresponding partition
is updated.
it’s Android Debug Bridge version 1.0.26 actually on my cmd
I’m a big fan Zedomax!
Question…
Should Step 20. be:
fastboot flash recovery openrecovery-twrp-2.2.0-evita.img
???
We want to flash, not just “fastboot boot openrecovery-twrp-2.2.0-evita.img”, right?
Thanks iheartroot. You’re right.
When i type in su it says not found, and for the dd if=/dev/block/mmcblk0p4 of=/sdcard/mmcblk0p4 it says permission denied (Step 5)
which software version are you on? If you go to settings -> about phone -> software information and it says 2.20 as the leading numbers in your software version, you will not be able to use this work around.
When I type in “fastboot oem readcid” it says Waiting for device and then does nothing. im on linux
HELPPPPPP PLEASE!
try adding “sudo” before the command.
I have Android 4.0.4 HTC Sense version 4.0 can i still “Unlock Bootloader and Root AT&T HTC One X”.
if in your “About Phone” under “Software number” it says “2.20.502.7 710RD” or something with the leading 2.20, then no. Your phone does not have the ability to root at this time.
i have 2.20 AT&T ver. i hope max you will find something to root my HOX
Actually I have Software number 1.85.502.3 710RD and I am getting su: not found. I have already tried http://onexroot.com/one-x-root/how-to-root-one-x/ with no luck since I get Error Code: 160.
Error Reason: MID Not Allowed. from the HTC Dev page after trying to unlock the bootloader. Do you know of any other options to unlock the bootloader and root this phone?
Not sure why, you will have to ask HTC what that code is.
how long realistically do you think it will be before they will find a way to root the HTC ONE X AT&T running android 2.20
not sure but it sucks att did that, I would advise if you can still return your phone do return it and get a rootable phone like GS3.
hi, can you help me out quick, I follow ur sited, and I “boot” the twrp instead of “flashing” it, cuz i followed the instruction on the website instead of video, i just copied and i notice it said boot. I can’t get back into bootloader by adb boot bootloader. HELP PLZ
I followed the website instruction and it’s near last step already.wtf 🙁 plz help
Dustin,
See my earlier comment, or just follow the video instead of the website for step 20
Or download Goo Manager from the Play Store, open it and hit Menu, Install Openrecovery and it will install Twrp…
Greetings Friends!
I have an HTC AT & T One X 16gb (
My problem is that I get TAPERED ****** *** LOCKED ***
We try several ways to unlock and no ah I worked, will have a manual that can help me?
I want to change the ROM
Dear Max,
I hv a HTC One X AT&T with 1.85 firmware on 4.0.3
will this method root my phone??
I need help I’m going to pull my hair out!
I’m using HTC ONE XL Telstra (international version I think)
it’s running on 4.1.1 -I’ve read elsewhere you can root a device thats running above 1.85?
I’ve unlocked bootloader but until I root my device I can’t flash ROMS
Everytime I try to root it though command can’t access busybox/superuser/you name it!
It comes up with permission denied or no such file or directory
What can be done?!?!
does this give me superCID?
Thanks
HI,
I am unable to download the OneXRootATT.zip from the given link.
I am getting web page not found error.
Thanks and Regards,
Sathish.
You said in HTC One X with OTA update you need to have a rooted phone to do this, but how can u root it if the bootloader isn’t unlocked?? i want to root my phone but in step 5 when type “su” i gives me this error:
/system/bin/sh: su: not found
any ideas?
i feel like kiss your forehead right now, worked every step of the way! thanks mehn!!!
Im having a bit of trouble with the drivers. i download them but the computer wont recognize and thus wont update them help
I did the procedimento to adb shell , then when I put YOUR gives me the error not fount…. I can say that ?
I am having trouble with su. after adb shell when i write su and enter it say’s su not found ??
I am having trouble with su. after adb shell when i write su and enter it say’s su not found ?? What to do? Thank you.