I've found this using search, but I just want someone else to back it. What I want to do is install the ADP 1.5 unrooted version by HTC. I want to do this on my normal US T-Mobile G1. All I need to do is update to the Engineering SPL, and flash the Nbh of 1.1 then to 1.5, correct? I've rooted before so I know most of what I'm doing, I just don't want to brick it. Thanks in advance!
There is no nbh for ADP1 firmware as no nbh is needed (feature of the engineering bootloader is that this is not needed). Everything you need is available as update.zip files. Root (requires RC29 nbh file), run the update.zip for the SPL, then install the ADP1 v1.5 firmware. Why would you want to write 1.1 first?? Makes no sense. Go straight to 1.5. Also, ADP1 firmware, by definition, gives you root access, so there is no such thing as ADP1 "unrooted" firmware. "unrooted" is a stupid word anyways.
I JUST found out about the Hard SPL (after Googling about various SPLs due to the various recent threads on this subject). I had the Engineering bootloader to begin with, but I just downloaded and installed the HardSPL. In other words, I used the Wiki.
Hardspl is redundant since you don't need nbh files at all with engineering spl.
Related
I rooted my phone using the "one click" root method (from standard Rogers 1.5 firmware) (http://zenthought.org/system/files/asset/2/flashrec-1.1.1-20090908.apk) and then updated to the latest radio:
•2.22.19.26I
•Baseband Version: 62.50S.20.17H_2.22.19.26I
•http://sapphire-port-dream.googlecode.com/files/ota-radio-2_22_19_26I.zip
I initiall got the box with the arrow then the phone continued to the Rogers boot screen and has been stuck there for 20 minutes at least! So i took out the battery and turned it back on again and it get stuck on the Rogers screen still!
Have I bricked it!?! I thought you can only brick it when you update the SPL ... all I did was update the radio. Please HELP!
Thanks in advance.
Do you have a RA or Cyan recovery?
If so, try booting into it. You know, Home+Power.
yes when i did the "one step" root, it made a recovery image ... but when I press home+power it still sits on the Rogers screen!
the power+camera button combination doesn't work either.
--
If it helps I was following the instructions step by step from: http://www.maximumpc.com/article/howtos/howto_hack_your_android_g1_phone?page=0,2
If you have a Rogers Dream you should be following the guide here:
http://wiki.cyanogenmod.com/index.php/Full_Update_Guide_-_Rogers_Dream_EBI1_to_CyanogenMod
You have a radio that is incompatible with your rom and recovery. You should be able to fix this by just flashing the radio for rogers phone again.
Boot into fastboot on your phone using camera and power on and check what SPL you have (hboot 1.33.00??).
according to that guide I bricked my phone:
2.Be very careful of any upgrade or mod instructions that require you to install an HTC "Recovery" zip/image, a replacement radio, or anything that might cause a difference of versions thereby bricking your phone.
eg: you currently have an EBI1 system and recovery image. If you boot an EBI0 radio image you will no longer be able to boot your phone.
Click to expand...
Click to collapse
That guide should really say "thereby possibly bricking your phone". I will make the change. If you want me to try to help you fix your phone I can but you will need to tell me what version your spl is.
I would appreciate your help! except that I can't boot into recovery mode/fast boot mode or any other mode, therefore can't check spl version.
I knew that you wouldn't be able to get into recovery but I thought you would still be able to get into fastboot. You can also try holding back while powering on. Without getting into one of these modes I'm afraid there's not much we can do.
Its sorta a long shot but you could try this: (its for the magic but its worth a shot as a last resort)
http://forum.xda-developers.com/showthread.php?t=548218
http://forum.xda-developers.com/showthread.php?t=572683
FLASH RADIO FIRST THEN FLASH SPL. LOOK BELOW FOR INSTRUCTIONS.
you are supposed to update radio and spl. you cannot choose one. first flash radio and when it says to reboot, reboot and it will reboot back into recovery when done. then flash the spl. same steps as above. then wipe data, wipe ext file system, then repair ext. after that flash the rom again. the radio and the spl is from the same site you used.
hope this helped. you should do research before flashing anything. i'm glad i did before flashing a new radio and spl. also once you get sorted out, flash the same recovery image i have (in signature) and make a nandroid backup for cyanogen or a donut rom and make a bart backup for hero rom (i recommend MLIGN 3.2B but switch to the Hero 2.1 ROM when they fix everthing) so you can switch those out. it is safe and I did it a lot of times.
I really want to get 1.6 on my device, (Rogers Dream) but I really don't want to flash the SPL, because if I brick that I have to buy a totally new Dream, no warranty.
What to do!
edit: I booted with camera and power and it says hboot is 1.33.0009, does this mean I don't have to risk bricking when I root? The tutorial is for 1.33.0010.
AndroidNoobie said:
FLASH RADIO FIRST THEN FLASH SPL. LOOK BELOW FOR INSTRUCTIONS.
you are supposed to update radio and spl. you cannot choose one. first flash radio and when it says to reboot, reboot and it will reboot back into recovery when done. then flash the spl. same steps as above. then wipe data, wipe ext file system, then repair ext. after that flash the rom again. the radio and the spl is from the same site you used.
hope this helped. you should do research before flashing anything. i'm glad i did before flashing a new radio and spl. also once you get sorted out, flash the same recovery image i have (in signature) and make a nandroid backup for cyanogen or a donut rom and make a bart backup for hero rom (i recommend MLIGN 3.2B but switch to the Hero 2.1 ROM when they fix everthing) so you can switch those out. it is safe and I did it a lot of times.
Click to expand...
Click to collapse
1) This is for ROGERS Dreams, they use different radios and SPLs to regular HTC Dreams/G1's. So your instructions would brick ROGERS Dreams.
2) You don't have to flash the radio and SPL at the same time. They are independant, however the 1.33.2005 requires the 26i radio. If you're on 1.1 and you upgrade to a 1.5/1.6 ROM you should update the radio, but there's no reason to change the SPL from stock unless you want to flash builds the require extra space in the NAND.
if im using the dwang 1.13 flash, will the sapphire radio update work with the g1? is it compatible?
sorry what does updating the radio do for you?
Will we lose the ability to flash a new Rom? Ie. does the perfected SPL remove the ability of the recovery?
I have root now and I am running a custom rom, but I only care about being able to flash roms, wireless tether isn't as important as functioning Bluetooth.
If you flash that update you'll get perfected SPL. Means no custom ROMs or root. Link me somewhere I can download the file, so I can make instructions how to install with engineerings SPL.
You can put on cursorsense 1.2.0 till people come out with a fix for other roms.
it is based off of the rogers rom and is rooted w/o perfect spl
I can't seem to find the guide for this. I know it can be done....or am I crazy. I rooted a friends phone this weekend. Tried to use unrevoked but it wouldnt work until I down graded froyo. He's rooted now. But still want to downgrade his hboot. And for the life of me I can't find the guide.
Sent from your moms house on the mothafn' now network.
http://forum.xda-developers.com/showthread.php?t=764062
I think maybe this is what you want. It installs the eng hboot and amon ra recovery in one shot. The updated file with ra 1.8 is in post 18 in that thread. There's a guide in the first post. The only thing I can think to add is that you'll want to have a rom on the sd card ready to go. The reason being, it might boot loop after the install (mine did) and the only way I know to get out of it is to flash a new rom (or reflash the current one).
I can't post the link or i would just do that.
In the EVO 4G Android Development section, the post you want is called 'ENG bootloader (0.76 needed for CM6) extended fastboot commands'
How to successfully downgrade to eng hboot .76.2000
zikronix said:
I can't seem to find the guide for this. I know it can be done....or am I crazy. I rooted a friends phone this weekend. Tried to use unrevoked but it wouldnt work until I down graded froyo. He's rooted now. But still want to downgrade his hboot. And for the life of me I can't find the guide.
Sent from your moms house on the mothafn' now network.
Click to expand...
Click to collapse
Zikronix, I have just downgraded my HBOOT from .97 to 0.76.2000. (In fact done this a couple times both from 2.02 and .97). In case you still need this.. below are the steps.
1. Got my replacement EVO today (hboot .97, 3.29.651 build, 1.71 PRI)
2. Rooted it with this method using default (clockworkmod recovery)
3. Rebooted and flashed Amon_ra recovery (optional.. my preference)
4. Copied the correct Eng hboot file (renamed as PC36IMG.zip) to my sdcard, rebooted to bootloader, Eng hboot zip was flashed, I accepted update, done. Rebooted into recovery.
5. Flashed my favorite root ROM (this is necessary bcos the change on hboot does something funky to your existing rom, so you can only reboot into bootloader ... not sure why, some dev should be able to explain more)
6. Done.
Sorry for the probably dumb question, but I'm unclear on something.
I know that the new SPL with the OTA Froyo update is perfected. Does that mean that we can't:
A. Flash a custom recovery?
B. Install a custom rom?
C. Apply SAPPIMG if I seriously **** something up?
D. MOST IMPORTANT - nandroid back to where I am now?
I really want to try the official update with new radio but I want to be able to nandroid back to where I am now if I decide for some reason that the update irritates me. Can someone shed some light?
Well the word "perfected" refers to the ability to get unrestricted access to the nand (the storage of the device). With a perfected spl, you have no access to nand + others important instructions. Which means that you cannot flash/erase any of the fun partitions, e.g. spl, radio or recovery. Nor can you flash/erase system, boot ect...
On some non-perfected spl, you had the restriction of the above, but you could load("boot") your images and therefore easily boot a custom recovery and do whatever you wanted.
With perfected spl the option of booting an img is not there.
On some devices, like the magic, we have engineering spl, which ignores the s-off flag. S-on/s-off refers to "security" off/on. With security off you have unrestricted access to the nand.
On some other devices, you have modified spl/hboot, E.g. The Desire device.
Their hboot will simply ignore the s-off flag and give you unrestricted access on the nand + the other fun commands, e.g erase and boot.
Now you aske, Ignore the s-off flag???
Yes, the s-off flag (called "secuflag" ) is actually set in something called Radio NVRAM.
This operate in a lower level then the radio image you flash.
The non + perfected spl reads this flag and behaves accordingly.
The modified hboot + eng hboot simply ignores it.
Going back to the magic device.
As long we can get root on the system, we can flash our own custom recovery. From the custom recovery we can flash the eng spl. And wooooot... we have unrestricted access to nand.
Remember, that the spl, radio and system all are simply partitions on the nand. With root we can flash what ever we want.
The only problem can be, if the 2.2 update has a radio img that do not play nicely with the current eng spl. But will still be able to load a custom recovery wit root access... so the option to flash custom roms will always be there if we can get root on the system.
Last i checked, the android 2.2 is no problem to root using a special exploid.
So don't worry... all is good :0)
Applying a sappimg, is a feature built in all spl. You can ALWAYS flash a sappimg.zip from fastboot if you have same cid nr as the sappimg.zip and the main-version of the phone is the same or lower of what you are trying to flash!
So don't worry :0)
What is goldcard used for?
A good question. Goldcards are used to skip the CID check. E.g. my nordic magic with cid HTC-Y13 can flash the Rogers update with CID ROGER001.
But still, the main-version check still applies :0)
No more knowledge from me today... my hands hurts
mumilover said:
Well the word "perfected" refers to the ability to get unrestricted access to the nand (the storage of the device). With a perfected spl, you have no access to nand + others important instructions. Which means that you cannot flash/erase any of the fun partitions, e.g. spl, radio or recovery. Nor can you flash/erase system, boot ect...
On some non-perfected spl, you had the restriction of the above, but you could load("boot") your images and therefore easily boot a custom recovery and do whatever you wanted.
With perfected spl the option of booting an img is not there.
On some devices, like the magic, we have engineering spl, which ignores the s-off flag. S-on/s-off refers to "security" off/on. With security off you have unrestricted access to the nand.
On some other devices, you have modified spl/hboot, E.g. The Desire device.
Their hboot will simply ignore the s-off flag and give you unrestricted access on the nand + the other fun commands, e.g erase and boot.
Now you aske, Ignore the s-off flag???
Yes, the s-off flag (called "secuflag" ) is actually set in something called Radio NVRAM.
This operate in a lower level then the radio image you flash.
The non + perfected spl reads this flag and behaves accordingly.
The modified hboot + eng hboot simply ignores it.
Going back to the magic device.
As long we can get root on the system, we can flash our own custom recovery. From the custom recovery we can flash the eng spl. And wooooot... we have unrestricted access to nand.
Remember, that the spl, radio and system all are simply partitions on the nand. With root we can flash what ever we want.
The only problem can be, if the 2.2 update has a radio img that do not play nicely with the current eng spl. But will still be able to load a custom recovery wit root access... so the option to flash custom roms will always be there if we can get root on the system.
Last i checked, the android 2.2 is no problem to root using a special exploid.
So don't worry... all is good :0)
Applying a sappimg, is a feature built in all spl. You can ALWAYS flash a sappimg.zip from fastboot if you have same cid nr as the sappimg.zip and the main-version of the phone is the same or lower of what you are trying to flash!
So don't worry :0)
What is goldcard used for?
A good question. Goldcards are used to skip the CID check. E.g. my nordic magic with cid HTC-Y13 can flash the Rogers update with CID ROGER001.
But still, the main-version check still applies :0)
Click to expand...
Click to collapse
Wow, thank you very much for the prompt and extremely detailed reply! That's exactly what I needed to know.
So since it's already been verified that the superoneclick root method works on mt3g with ota 2.2, I'll be fine if I decide I'm not happy.
Cool, that's what I needed to know.
Thanks!
Glad i could clarify :0)
This guide tells you how to create a goldcard very easily giving you the ability to flash custom rom and root again. Guide found here: http://android.modaco.com/content/general-discussion/305672/creating-a-goldcard/. There is a standalone pc application which allows creating a gold card. Link for app found here: http://android.modaco.com/content/software/308798/pc-application-goldcardtool/.
Note: Does not work for Aria but made here since at the time it wasn't tested.
Thanks ECEXCURSION for the link.
Very interesting, thanks for the guide! I don't need a GoldCard, but it's interesting to read none the less.
Just found this in that thread. Someone made a stand-alone PC application to generate GoldCards: http://android.modaco.com/content/software/308798/pc-application-goldcardtool/
theonew said:
This guide tells you how to create a goldcard very easily giving you the ability to flash custom rom and root again. Guide found here: http://android.modaco.com/content/general-discussion/305672/creating-a-goldcard/. Please post your results.
Click to expand...
Click to collapse
Did you actually try this yourself?
Making a gold card won't help you root the Aria.
drumist said:
Making a gold card won't help you root the Aria.
Click to expand...
Click to collapse
Didn't think so but I tried it anyway. Created the gold card but the RUU failed when it tried to write the hboot.
drumist said:
Making a gold card won't help you root the Aria.
Click to expand...
Click to collapse
Oh.. Thought that was the purpose of a goldcard.
My mistake.
What is it that's holding one back from writing to the hboot?
m a r k said:
What is it that's holding one back from writing to the hboot?
Click to expand...
Click to collapse
HTC implemented a new hboot in the latest official 2.2.2 update for the Aria. The new hboot version is 1.0.2.0000. This hboot can not be overwritten by flashing back to the original RUU. The new hboot also fixed the exploit that was used to root the Aria previously.
To date the Aria with the new hboot is un-rootable without hardware.
m a r k said:
What is it that's holding one back from writing to the hboot?
Click to expand...
Click to collapse
HTC devices have a security flag that allows the phone's NAND memory to be written to. This is referred to as the S-ON/S-OFF flag. In order for the NAND memory which houses the HBOOT loader and ROM to be written to, the security flag needs to be OFF. The HBOOT loader can control this flag and when an official HTC signed RUU is used, the HBOOT loader will turn the flag OFF and allow the RUU contents to be written to the NAND memory.
Previous versions of the HBOOT had an exploit in it that allowed rooting and installing a custom recovery, i.e. ClockworkMod and this is how custom ROMs were installed. The current HBOOT version no longer has this exploit available via software. The only way a new HBOOT or Recovery module can be written to the Aria is if the security flag is turned OFF and as of now the only way to do that is to use the XTC Clip device.
tpbklake said:
HTC devices have a security flag that allows the phone's NAND memory to be written to. This is referred to as the S-ON/S-OFF flag. In order for the NAND memory which houses the HBOOT loader and ROM to be written to, the security flag needs to be OFF. The HBOOT loader can control this flag and when an official HTC signed RUU is used, the HBOOT loader will turn the flag OFF and allow the RUU contents to be written to the NAND memory.
Previous versions of the HBOOT had an exploit in it that allowed rooting and installing a custom recovery, i.e. ClockworkMod and this is how custom ROMs were installed. The current HBOOT version no longer has this exploit available via software. The only way a new HBOOT or Recovery module can be written to the Aria is if the security flag is turned OFF and as of now the only way to do that is to use the XTC Clip device.
Click to expand...
Click to collapse
Well done - nice summary of the situation.
I have rooted the updated Aria with my XTC clip. There is a guy that frequents the IRC channel in my thread who has a cell phone store and an XTC clip. I've coached him through a couple of updated Aria roots and he's competent to do the job. He won't charge much, and whoever wants him to do the work will have to pay a modest fee plus return shipping. All he would need is the device - no case, no batter cover, no battery, no sim, no sdcard, no cables - no box. This makes shipping in a small padded envelope via USPS cheap - even insured.
Anyone interested should stop by the IRC channel in my sig.
OP: please update post #1 so a lot of people don't spin their wheels on that process - it's futile.
tpbklake said:
HTC devices have a security flag that allows the phone's NAND memory to be written to. This is referred to as the S-ON/S-OFF flag. In order for the NAND memory which houses the HBOOT loader and ROM to be written to, the security flag needs to be OFF. The HBOOT loader can control this flag and when an official HTC signed RUU is used, the HBOOT loader will turn the flag OFF and allow the RUU contents to be written to the NAND memory.
Previous versions of the HBOOT had an exploit in it that allowed rooting and installing a custom recovery, i.e. ClockworkMod and this is how custom ROMs were installed. The current HBOOT version no longer has this exploit available via software. The only way a new HBOOT or Recovery module can be written to the Aria is if the security flag is turned OFF and as of now the only way to do that is to use the XTC Clip device.
Click to expand...
Click to collapse
After I went through the AlphaRev flashing process, I learned the truth of the previous HBOOT's exploit is that it let you gain temporary NAND unlock.
While it's unlocked and once you got temporary root permission from, for example, the famous RageAgainstTheCage, then you are allowed to put su and SuperUser.apk to your system partition to gain permanent root permission, and flash recovery image to recovery partition as well.
The above is basically how Unrevoked works, imo. As for AlphaRev, it needs your device to be rooted already. It gets temporary NAND unlock first, then flashes and runs a boot image with a NAND module that would add some extra partitions, including HBOOT of course, to the MTD table in order to flash an hacked HBOOT/SPL into your device.
The new 1.x HBOOT has that exploit patched, both Unrevoked and AlphaRev won't work anymore. This thread I found might be the last hope that doesn't involve XTC Clip:
How-To [Root] The myTouch 3GS if you updated to Offical 2.2.1 and lost root
ladios said:
After I went through the AlphaRev flashing process, I learned the truth of the previous HBOOT's exploit is that it let you gain temporary NAND unlock.
While it's unlocked and once you got temporary root permission from, for example, the famous RageAgainstTheCage, then you are allowed to put su and SuperUser.apk to your system partition to gain permanent root permission, and flash recovery image to recovery partition as well.
The above is basically how Unrevoked works, imo. As for AlphaRev, it needs your device to be rooted already. It gets temporary NAND unlock first, then flashes and runs a boot image with a NAND module that would add some extra partitions, including HBOOT of course, to the MTD table in order to flash an hacked HBOOT/SPL into your device.
The new 1.x HBOOT has that exploit patched, both Unrevoked and AlphaRev won't work anymore. This thread I found might be the last hope that doesn't involve XTC Clip:
How-To [Root] The myTouch 3GS if you updated to Offical 2.2.1 and lost root
Click to expand...
Click to collapse
The problem with this solution is it requires an HTC engineering hboot. Here is a thread posted by ATTN1 when the Aria was first released stating that a Liberty eng-hboot doesn't exist:
http://forum.xda-developers.com/showpost.php?p=6910622&postcount=12
tpbklake said:
The problem with this solution is it requires an HTC engineering hboot. Here is a thread posted by ATTN1 when the Aria was first released stating that a Liberty eng-hboot doesn't exist:
http://forum.xda-developers.com/showpost.php?p=6910622&postcount=12
Click to expand...
Click to collapse
It's worth to try. I don't think anyone has tried this on Aria before. Previously we just tried to install an old RUU with gold card hoping the hboot would be downgraded, but this is different.
Step 5-6, hboot installs LIBEIMG.zip. We can extract the rom.zip from RUU and rename it.
Step 7-9, DO NOT REBOOT and get into stock recovery. These must be the key if this happens to work.
Step 10, apply update.zip which is a clockworkmod flashable zip.
Again, it's worth to try, as they got this work on stock 2.2.1 espresso with hboot 1.x. We just need to make an MISC.img to let people try.
ladios said:
It's worth to try. I don't think anyone has tried this on Aria before. Previously we just tried to install an old RUU with gold card hoping the hboot would be downgraded, but this is different.
Step 5-6, hboot installs LIBEIMG.zip. We can extract the rom.zip from RUU and rename it.
Step 7-9, DO NOT REBOOT and get into stock recovery. These must be the key if this happens to work.
Step 10, apply update.zip which is a clockworkmod flashable zip.
Again, it's worth to try, as they got this work on stock 2.2.1 espresso with hboot 1.x. We just need to make an MISC.img to let people try.
Click to expand...
Click to collapse
Sign me up...it's worth a shot.
Sorry for the double post.
I did the following:
Created a gold card.
Obtained update.zip(clockwork).
Extracted rom.zip from the original 2.1 RUU.
Downloaded superoneclick v1.9.1.
Put update.zip and rom.zip on the gold card.
Unmounted the goldcard.
Ran superoneclick and got success on shell root.
Used adb shell and poked around.
My question:
How do we get around not having the engineering recovery package for the Aria?
Im keeping my eye on what happens here.
A$$h4t said:
Sorry for the double post.
I did the following:
Created a gold card.
Obtained update.zip(clockwork).
Extracted rom.zip from the original 2.1 RUU.
Downloaded superoneclick v1.9.1.
Put update.zip and rom.zip on the gold card.
Unmounted the goldcard.
Ran superoneclick and got success on shell root.
Used adb shell and poked around.
My question:
How do we get around not having the engineering recovery package for the Aria?
Click to expand...
Click to collapse
I did a little research about the mtd0.img that was mentioned in the referenced thread and found some posts about creating a mtd0.img (misc.img) for the HTC Desire. There is even a web site that lets you input the appropriate values from your phone and it generates one for you. Don't know if it will work on the Aria, but it may be a place to start. Just Google HTC+Desire mtd0.img and you'll find the various posts. That would be the misc.img that ladios mentioned.
tpbklake said:
I did a little research about the mtd0.img that was mentioned in the referenced thread and found some posts about creating a mtd0.img (misc.img) for the HTC Desire. There is even a web site that lets you input the appropriate values from your phone and it generates one for you. Don't know if it will work on the Aria, but it may be a place to start. Just Google HTC+Desire mtd0.img and you'll find the various posts. That would be the misc.img that ladios mentioned.
Click to expand...
Click to collapse
I'm unclear on this as I thought the CID was much longer than 8 characters yet the image creator only requires 8.
A$$h4t said:
I'm unclear on this as I thought the CID was much longer than 8 characters yet the image creator only requires 8.
Click to expand...
Click to collapse
We can use hex editor to make our own.
Open android-info.txt extracted from the rom.zip you are using
On the line begin with "cidnum: ", there's an 8-character CID number, copy that
On the line begin with "mainver: ", that's the rom version, eg. 1.35.707.5, then 707 would be the rom's region code
Use a hex editor to open mtd0.img extracted from espresso-eng.zip
At 0x0000, overwrite the CID number with the one you found in android-info.txt
At 0x00A0, overwrite the version number with 1.01.XXX.1 where XXX is the region code, eg. 1.01.707.1
Save and use it
To whom who also want to try, please use the files in this post and follow the instructions in How-To [Root] The myTouch 3GS if you updated to Offical 2.2.1 and lost root.
Liberty version of needed files:
(1) Engineering package: liberty-eng.zip is attached.
(4) Stock firmware: Download LIBEIMG_Liberty_hTC_Asia_WWE_1.35.707.5_Radio_47.41.35.10_7.09.35.13_release_138500_signed.zip and rename it to LIBEIMG.zip
(5) ClockworkMod Recovery: Download recovery-clockwork-2.5.0.7-liberty.zip and rename it to update.zip