[GUIDE] Unlock the bootloader of OnePlus X without using fastboot & wiping userdata - OnePlus X Q&A, Help & Troubleshooting

[GUIDE] Unlock the bootloader of OnePlus X without using fastboot & wiping userdata
Introduction
As we know, the official way to unlock the bootloader of OnePlus X is through fastboot.
For a untouched device, the status of the bootloader should be:
Code:
fastboot oem device-info
...
(bootloader) Device tampered: [COLOR="Red"]false[/COLOR]
(bootloader) Device unlocked: [COLOR="Red"]false[/COLOR]
To unlock the bootloader, you need to enable 'OEM unlocking' under Developer options first, then via bootloader/fastboot interface:
Code:
fastboot oem unlock
It'll eventually erase the userdata.
Then the status of the bootloader should be:
Code:
fastboot oem device-info
...
(bootloader) Device tampered: [COLOR="Red"]false[/COLOR]
(bootloader) Device unlocked: [COLOR="Red"]true[/COLOR]
Inspired by the findings on similar devices, we can actually unlock the bootloader of OnePlus X without using fastboot, while keeping the userdata intact.
How-to
Warning!
It is dangerous! This whole thing is basically one giant hack - which is not intended to be done by normal users. It is messing with the bootloader partition, so it is possible that something goes wrong and you will have a nice & costly brick in your pocket. Be prepared to revive the device from a hard-brick.
1.
Enable 'OEM unlocking' under Developer options. You may need to tap the Build number 7 times under About phone to get the Developer options under Settings.
2.
We need root access (kinda expected!). To root the device without unlocking bootloader, use KingRoot. Use the Android version.
Now there is a catch! KingRoot can root the device, cause the latest build of Oxygen OS (2.2.1 ATM) contains such vulnerabilities which can be exploited by the root exploits used by KingRoot. But we can't ensure about future.
See here for more info.
3.
After being rooted, use adb shell or any terminal emulator to dump the 'aboot' i.e bootloader partition in internal sdcard:
Code:
su
dd if=/dev/block/platform/msm_sdcc.1/by-name/aboot of=/sdcard/aboot.img
4.
Now we need to modify the dumped image using hex-editor. For OnePlus X:
Code:
Unlock Bit Position - 0x000FFE10 Hex
Tamper Bit Position - 0x000FFE14 Hex
'00' means false, '01' means true. So to set the bootloader as unlocked, we just need to change the following:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Save the modified image as 'abootmod.img' inside your sdcard.
5.
Now its time to flash back the modded bootloader. Execute the following from adb shell or any terminal emulator:
Code:
su
dd if=/sdcard/abootmod.img of=/dev/block/platform/msm_sdcc.1/by-name/aboot
Do a reboot & voila! You have unlocked the bootloader! Don't just believe me - check the status of the bootloader to ensure.
Note
1. We can also reset the tamper bit using this procedure.
2. If you prefer GUI, then you can use this fantastic app by @wanam.
3. This is tested on an Asia/EU (E1003) variant of OnePlus X running Oxygen OS 2.2.1. Please test & post feedback to ensure compatibility.
4. I'm not providing pre-modified images as it increases the risk of bricking the devices having older/newer bootloaders - please do it yourself. The offsets should be unchanged in future, though.
Credits
1. @osm0sis
2. @segv11
3. @Mnt-XDA
4. My sister - for risking her device for this experiment.
5. Users of XDA & OnePlus forums.
Happy tinkering! :highfive: :good:

---

Reserved for future.

---

Where is the 000FFE14 hex ?
Found 000FFE10 hex but no 14?
Can you provide the aboutmod.img?
Sent from my ONE E1003 using XDA-Developers mobile app

---

sifatrhmn said:
Where is the 000FFE14 hex ?
Found 000FFE10 hex but no 14?
Can you provide the aboutmod.img?
Click to expand...
Click to collapse
It is on the same line of OOOFFE10 after four positions you will see 1 it is 000FF14 change that to O

---

shravanv3 said:
It is on the same line of OOOFFE10 after four positions you will see 1 it is 000FF14 change that to O[/QUOTE
where can i found line of bootloader on another device ?
there is somthing special to identified the bootloader line ?
thanks
Click to expand...
Click to collapse

---

deleco said:
shravanv3 said:
It is on the same line of OOOFFE10 after four positions you will see 1 it is 000FF14 change that to O[/QUOTE
where can i found line of bootloader on another device ?
there is somthing special to identified the bootloader line ?
thanks
Click to expand...
Click to collapse
No 000FF10 is for bootloader
Click to expand...
Click to collapse

---

shravanv3 said:
deleco said:
No 000FF10 is for bootloader
Click to expand...
Click to collapse
excuse me but cant understand
i mean line to identified the bootloader to change 00 to 10
where can i found it on another devices ?
hope you can understand me now
thanks
Click to expand...
Click to collapse