Database Users

OTA 2.2 Update With Root Made Easy

NOTE: For those of you that are looking to root thier Inc and already have the latest 2.2+ OTA released in November, these steps will not work. Changes have been made to the ROM so until a new root application has been developed by the unrEVOked team, I am afraid you are left with a stock phone. Sorry. If new updates come out, I will try to post them here.
NOTE: I have uploaded the 2.1 and 2.2 RUUs to Rapidshare and updated the links.
First, let me say that I did not come up with this nor did I create any of the tools. I am passing all this on in a single thread to let people know how update thier Droid Incredible to the OTA 2.2 and have root access if they have it in any of the following conditions:
1. Stock 2.1 without root or unrEVOked Forever
2. Stock 2.1 with root and no unrEVOked Forever
3. Stock 2.1 with root and unrEVOked Forever
4. Stock 2.2 without root and with unrEVOked Forever
5. Stock 2.2 without root and no unrEVOked Forever
6. Custom ROM with root and S-OFF
7. Getting free WiFi Tethering on 2.2
8. Removing unwanted preloaded applications.
NOTE: This may work with custom ROMs, but I have not verified it.
NOTE: SOME PEOPLE, INCLUDING ME HAVE HAD THE PROBLEM OF BEING STUCK IN HBOOT AFTER LOADING A ROM IMAGE. IF THIS HAPPENS TO YOU AFTER LOADING THE 2.1 OR 2.2 ROM, DO NOT PANIC, JUST REAPPLY THE ROM AND ALL WILL BE FINE. FOR SOME REASON THE ROM DOES NOT LOAD CORRECTLY ON THE FIRST TRY BUT DOES ON THE SECOND.
I am passing this on because I loaded the OTA 2.2 without unrEVOked forever loaded on my phone. What a mess. I tried everything (I thought) to try and downgrade it back to stock 2.1 but with no luck. If you do not know, unrEVOked3 cannot currently root a 2.2 updated Droid Incredable and if you have not used unrEVOked forever, you can not get clockworkmod recovery to reload on the phone. I tried the 2.1 RUU to downgrade, but never could get it to connect to the phone. I then tried to use the 2.1 PB31IMG.zip to load and the HBoot loader would just tell me that it was an older image and not load it. I thought I was hosed until the unrEVOked team breaks the code on the 2.2 HBoot loader until I got pointed in the right direction (sort of).
TNS201 pointed me to the following thread: http://forum.xda-developers.com/showthread.php?t=768295
I gave this a try and still could not downgrade my phone. I searched around and after much trial and error, I was able to put together the correct steps to downgrade my phone and then applied unrEVOked3, unrEVOked forever, the OTA 2.2 update, and then reroot the phone. Anyway, here is what I have come up with:
** NOTE: THIS WILL TOTALY WIPE YOUR PHONE CLEAN!!! BACKUP ANYTHING YOU WANT BACK ON THE PHONE!!! **
Condition 1
1. Go to the following link and follow the instructions: http://forum.xda-developers.com/showthread.php?t=709220 Only do the steps for getting ADB loaded on your computer!
This will get ADB loaded on your computer which you will need when doing customizations to the phone. It will also walk you through rooting your phone and doing a lot of other things. Good thread for us noobs.
2. Download unrEVOked Forever from here: http://unrevoked.com/rootwiki/doku.php/public/forever
3. Copy the file to the root of your sdcard.
4. Reboot your phone into clockworkmod recovery and load the unrEVOked Forever zip file. This will turn S to off and allow unsigned images to be loaded.
When you reboot your phone, you will have a fully rooted and S-OFF stock 2.1 Droid Incredible.
NOTE: If you are having troubles downloading the OTA 2.2 RUU, use this link to download the ROM. Just delete the "_2.2" from the file name and go straight to step 12. http://rapidshare.com/files/418523008/PB31IMG_2.2.zip
To load 2.2, do the following:
5. Download the OTA 2.2 RUU from here: http://rapidshare.com/files/418527589/RUU_Incredible_VERIZON_WWE_3.21.605.1_Radio_2.15.00.07.28_2k4k_NV_1.50_PRL58006_release_1433.exe
6. Connect your phone to your computer and ensure you have USB DEBUG turned on and CHARGE ONLY selected.
7. Run the RUU and update your phone to 2.2. If the RUU updates your phone, go on to step 15. If the RUU will not connect to your phone Go to step 8.
8. Start the RUU.
9. Go to your computers temp directory and locate the folder that contains the file rom.zip.
10. Once you locate this file, copy it to any folder (or your desktop).
11. Rename rom.zip to PB31IMG.zip
12. Copy PB31IMG.zip to the root of your phones sdcard.
13. Reboot your phone into HBoot. HBoot will load and then load PB31IMG.zip. This will take a while, so be patient.
14. Follow the instructions to have HBoot install PB31IMG.zip.
Whether you used the RUU or HBoot and PB31IMG.zip, at this point, you should have 2.2 loaded on your phone, but you will no longer have root. You will have S-OFF.
To regain root access, do the following:
15. Download clockworkmod recovery from here: http://downloads.unrevoked.com/forever/recovery/clockworkmod/PB31IMG.ZIP
16. Download the payload update from here: http://forum.xda-developers.com/attachment.php?attachmentid=388592&d=1282834695
17. Download superuser from here: http://dl.dropbox.com/u/6408470/su-releases/su-2.3.4-ef-signed.zip
18. Copy all three files to the root of the phones sdcard.
19. Reboot your phone into HBoot. HBoot will load and then load PB31IMG.zip.
20. Follow the instructions to have HBoot install PB31IMG.zip. Since the phone is still S-OFF, this will reload clockworkmod recovery on the phone.
21. Boot the phone into recovery and load the two zip files downloaded in steps 16 and 17. This will root the phone and reload superuser.
If all went well, when the phone reboots, it should now be loaded with 2.2 and have full root and S-OFF. Enjoy.
Condition 2
1. Do steps 2 through 21 under Condition 1.
Condition 3
1. Do steps 5 through 21 under Condition 1.
Condition 4
** NOTE: THIS ONE DOES NOT WIPE YOUR PHONE!! **
1. Do steps 15 through 21 under Condition 1.
Condition 5
This is a tuffer one and requires the phone to be downgraded to 2.1 before upgrading it back to 2.2. Anyway, here are the steps:
NOTE: YOU MUST USE THE 2.1 RUU I HAVE LINKED AND THE MTD0.IMG FILE I HAVE ATTACHED OR THIS MAY NOT WORK!!!
NOTE: If you are having troubles downloading the 2.1 RUU, use this link to download the ROM. Just delete the "_2.1" from the file name and go straight to step 5 after completing step 1 and 2 (skip step 3 and 4). http://rapidshare.com/files/418141003/PB31IMG_2.1.zip.html
1. Do steps 1 and 2 under Condition 1.
2. Download the attached zip file. It contains the files I had a hard time finding.
3. Download the 2.1 RUU file from here: http://rapidshare.com/files/418525132/RUU_Incredible_Verizon_WWE_1.22.605.2_Radio_1.00.03.04.06_hboot_0.79_.exe
4. Follow steps 8 through 11 under condition 1 to get a good copy of the 2.1 ROM.
5. Copy the 2.1 ROM to the c:\android-sdk-windows\tools folder.
6. Unzip the files downloaded in step 2 to the c:\android-sdk-windows\tools folder.
7. Copy the unrevoked-forever.zip to the c:\android-sdk-windows\tools folder.
Note: At this point, you should have the following files copied to your c:\android-sdk-windows\tools folder:
PB31IMG.zip (this is the 2.1 ROM)
unrevoked-forever.zip (will set S-OFF)
rageagainstthecage-arm5.bin (this is a root exploit - gives you temperary root)
mtd0.img (need to research this one)
flash_image (this flashes images)
7. Connect your phone to your computer and ensure you have USB DEBUG turned on and CHARGE ONLY selected.
8. Open a command promt window and change to the c:\android-sdk-windows\tools folder.
9. Enter adb push unrevoked-forever.zip /sdcard/ and then press enter.
10. Enter adb push flash_image /data/local/ and then press enter.
11. Enter adb push rageagainstthecage-arm5.bin /data/local/tmp/ and then press enter.
12. Enter adb push mtd0.img /sdcard/ and then press enter.
13. Enter adb push PB31IMG.zip /sdcard/ and then press enter.
14. Enter adb shell and then press enter.
15. Enter cd /data/local/tmp/ and then press enter.
16. Enter chmod 777 /data/local/tmp/rageagainstthecage-arm5.bin and then press enter.
17. Enter cd /data/local/ and then press enter.
18. Enter chmod 777 /data/local/flash_image and then press enter.
19. Enter cd /data/local/tmp/ and then press enter.
20. Enter ./rageagainstthecage-arm5.bin and then press enter. You will now see some text on your cmd prompt screen explaining the exploit. Wait for the adb shell to go away, and it will dump you into your windows command prompt again (no shell) should look something like this:
C:\android-sdk-windows\tools>
21. Enter adb shell and then press enter. You will see you now have a # instead of a $ prompt.
22. Enter cd /data/local and then press enter.
23. Enter ./flash_image misc /sdcard/mtd0.img and then press enter. This will flash your misc partition with Toast's mtd-eng.img and should return you to a # prompt.
24. Enter reboot bootloader and press enter.
25. HBoot will load. Select bootloader and HBoot will then load PB31IMG.zip.
26. Follow the instructions to have HBoot install PB31IMG.zip.
Once it is finished, select restart. You now are on the stock 2.1 build of Android. Now you can follow steps 3 through 21 under condition 1 and get your phone loaded back with 2.2 and have root and S-OFF.
Condition 6
1. Do steps 5 through 21 under Condition 1.
Condition 7
The following steps will allow you to use the 3G Mobile Hotspot that comes with the OTA 2.2 update and not have Verizon charge you for using it:
1. On your phone, bring up the dialer and dial ##778. This will load EPST.
2. Select EDIT.
3. Enter 000000 for the password.
4. Select SECURITY.
5. Select the username that has [email protected].
6. Edit the username to read [email protected] (delete "dun.").
7. Click the back button to return to the list.
8. Select M.IP DEFAULT PROFILE.
9. Repeat steps 5 and 6.
10. Click on MENU and select COMMIT.
At this point, your phone will reboot and you will be able to use the 3G Mobile Hotspot application to get free WiFi tethering. Enjoy.
Condition 8
I have so far found three options for removing the preloaded apps. They all require the phone to be rooted. Here they are:
1. The first way is to get Titanium Backup. You will also need to donate (as little as $3.99) to get full functionality of Titanium Backup, but it is well worth it. If you do not want to physically remove the application, you can use the FREEZE function and the application will be removed from the app list, but physically will still be on the phone. If you really want to get it off, you can uninstall and then deleted from the phone. All of this through a user interface that is pretty easy to use. By the way, it also does backups of apps and data.
2. Another option is to get Root Explorer. You have to pay for this one. It will let you mount the system folders on the phone as read/write and allow you to move and/or delete apps from the apps folder on the phone. This is a good app and worth having even if you do not use it to remove apps.
3. The final way is to use ADB and the command prompt to remove or move any application you do not want. This is tried and true, but combersome. You do not have to buy it, but there is no GUI to help you out.
My thanks to all the folks here on XDA that made it possible for us to release the possibilities of the Droid Incredable. As I stated above, I did not create the apps or the steps, I just put them together for others to use. I wish I could thank all the individuals that made this possible, but I did not get thier IDs, so in lew of an individual thank you, I am posting this group THANK YOU. Keep up the good work!

Thanks, I have a question on condition 4
4. Stock 2.2 without root and with unrEVOked Forever
If I do the steps and since I am not loading RUU (I manually updated the offical OTA and have S-off) will this still wipe my phone clean? Looks like all I am doing is loading clockwork back on and load superuser..etc, that shouldn't wipe all the data right?

Scblacksunshine said:
Thanks, I have a question on condition 4
4. Stock 2.2 without root and with unrEVOked Forever
If I do the steps and since I am not loading RUU (I manually updated the offical OTA and have S-off) will this still wipe my phone clean? Looks like all I am doing is loading clockwork back on and load superuser..etc, that shouldn't wipe all the data right?
Click to expand...
Click to collapse
No, in the case of having 2.2 already loaded and S-OFF, you are correct, the phone will not get wiped. The steps will root the phone and load superuser back on.

confirmation
Can anyone confirm option 4 working??

RBurn said:
Can anyone confirm option 4 working??
Click to expand...
Click to collapse
Those are steps I used to get root back on my phone after I update to 2.2. As I stated, I messed up the first time and did not load unrEVOked forever and could not root the phone, so I had to downgrade to 2.1 first and then go through the rooting process. That time I made sure to load unrEVOKED forever. After that, all went well.
Sent from my HTC Incredible.

RBurn said:
Can anyone confirm option 4 working??
Click to expand...
Click to collapse
I did option 4 early this morning. Worked perfectly.
Thank-you to all involved.

Thanks for the write up =)
I am trying condition five and on step 18 and after running ./rageagainstthecage-arm5.bin it exectues so I move to step 18 and type adb shell but it remains, $ not root(#). Does anyone know if This has worked yet?

also Im running Ubuntu 10.04 if that makes a difference

adb shell
cd /data/local/tmp
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
cd /data/local
chmod 0755 /data/local/flash_image
cd /data/local/tmp
./rageagainstthecage-arm5.bin
This worked

PimpShit420 said:
adb shell
cd /data/local/tmp
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
cd /data/local
chmod 0755 /data/local/flash_image
cd /data/local/tmp
./rageagainstthecage-arm5.bin
This worked
Click to expand...
Click to collapse
I tried this and it did not work for me. It looked as if it did. It gave me the proper prompt, but on reboot, no root access. I had to use chmod 777 instead of chmod 0755.

PimpShit420 said:
Thanks for the write up =)
I am trying condition five and on step 18 and after running ./rageagainstthecage-arm5.bin it exectues so I move to step 18 and type adb shell but it remains, $ not root(#). Does anyone know if This has worked yet?
Click to expand...
Click to collapse
I made a mistake, the line should have had 777 after chmod, not 0755. I have updated the instructions. If other individuals that use 0755 instead of 777 get the above to work, let me know. I do not know what the difference is. All I know is 0755 did not work for me. I had to use 777. I think I will do some research on chmod.
Hope other individuals find this helpful.

well I got to root in the shell and everyting seemed to work up until I tried to flash the PB31IMG, is says the main version is older and just reboots

I dont know what the difference is but it could be we are running different OS, windows vs linux but I have no clue

PimpShit420 said:
well I got to root in the shell and everyting seemed to work up until I tried to flash the PB31IMG, is says the main version is older and just reboots
Click to expand...
Click to collapse
This is the problem I had. Try 777 instead of 0755 after each of the chmod commands. That is what worked for me.

you were right, the first time 0755 gave me root but did not let me flash the PB file, the second time 0755 didnt work, and 777 did but it still says update fail

chmod 0755 vs chmod 777
PimpShit420 said:
I dont know what the difference is but it could be we are running different OS, windows vs linux but I have no clue
Click to expand...
Click to collapse
Well, I looked the chmod 777 and chmod 0755 commands up. Both commands change the read/write state for a file. 0755 changes the permissions for a specific group and user. 777 changes the permissions for everyone. You can find an explanation here: http://ss64.com/bash/chmod.html
0755 did not work for me, but 777 did. I am going to keep the instructions as they are unless I get feedback that 0755 is working for other people. If I do, I will add them as an alternative.

PimpShit420 said:
you were right, the first time 0755 gave me root but did not let me flash the PB file, the second time 0755 didnt work, and 777 did but it still says update fail
Click to expand...
Click to collapse
Are you using 777 for each chmod command?
Also, I was reading through the steps and found an error with step 16. It said the following:
16. Enter chmod 777 /data/local/tmp/rageagainstthecage-arm5.bin and then press enter.
It should have said this:
16. Enter chmod 777 /data/local/rageagainstthecage-arm5.bin and then press enter.
I have updated the steps on post 1.

Thanks very much for this thread!
My phone was in Condition 3. Instructions worked for me!

BNG303 said:
Thanks very much for this thread!
My phone was in Condition 3. Instructions worked for me!
Click to expand...
Click to collapse
Your welcome. I am glad it helped.

bagery77 said:
I did option 4 early this morning. Worked perfectly.
Thank-you to all involved.
Click to expand...
Click to collapse
Glad this helped. I wanted to give everyone a one stop shop for updating and root for 2.2. Also hoped everyone would not have to go though all that I did.

Want to root my legend 2.2 ota... wwe_3.15.405.3-2

I read many thread but didn't find clear answer for this question.
I have a vodafone htc legend with froyo updated trought ota
I would, root it and install HTC rooted rom.
any body can help with the steps and tools need it?
thanks a lot

follow this http://android.modaco.com/content/htc-legend-legend-modaco-com/323201/downgrading-from-froyo-ota/

it is not rooting, it is downgrade, what's not same

rolks said:
it is not rooting, it is downgrade, what's not same
Click to expand...
Click to collapse
he have official froyo... then he must downgrade first or what??
FIRST HAVE TO DOWNGRADE
follow this http://android.modaco.com/content/htc-legend-legend-modaco-com/323201/downgrading-from-froyo-ota/
Click to expand...
Click to collapse
THEN U CAN ROOT
http://theunlockr.com/2010/06/07/how-to-root-the-htc-legend/

Great!
If I undertood right...
First downgrade (this is something we could not avoid) then root.
Let me try!
Ill back!
Thanks

MontseCat said:
Great!
If I undertood right...
First downgrade (this is something we could not avoid) then root.
Let me try!
Ill back!
Thanks
Click to expand...
Click to collapse
i followed these steps and now i have rooted legend with BlaYo ROM B 0.2...
GOOD LUCK

I tried yesterday and having some troubles with Android sdk, doesn't work I don't know if any trouble with its installation.
Need to read carefully the instalation process and try again.
The only issue is find time for ths... its chrismas so, some familiar meetings
I'll back!

Oh!
I tried once again with not succes.
when running "crackin"...
starts with...
"Copying tools"
"adb" is not recogniced as command internal or external
program or file executable...
And remainds with same message for serveral lines till finish!!
Nothing happens.
I installed the android sdk package and added the hack4legend-v5.zip contenst on android-sdk-windows\tootls folder
Obviously I am doing something wrong but I am not able to locate where the problem or mistake is!!
any idea?
thanks

I downgraded my Legend from the OTA 2.2.
Now the ROM version is 1.31 which should be correct, but the HBOOT version still is 1.00, which is according to this guide (http://forum.xda-developers.com/showthread.php?t=746454 ) the wrong one, it should be 0.43.... any ideas on this one?
Edit: @MontseCat: have you installed your USB drivers? The come with HTC Sync from the HTC homepage. Otherwise you can check adb functionality by opening a console window, running 'cd C:\Absolute\Path\containing\adb.exe\' (for Windows users, I guess Linux users know how to use cd) and then 'adb devices'. This should show a number refering to your device, opposed to simply nothing if it is not working.

nae64 said:
Edit: @MontseCat: have you installed your USB drivers? The come with HTC Sync from the HTC homepage. Otherwise you can check adb functionality by opening a console window, running 'cd C:\Absolute\Path\containing\adb.exe\' (for Windows users, I guess Linux users know how to use cd) and then 'adb devices'. This should show a number refering to your device, opposed to simply nothing if it is not working.
Click to expand...
Click to collapse
Sorry I don't follow you at all.
I currently have my legend working with HTC Sync, witout problems, so don't undesrtand, shall I remove an reinstal it after installed android sdk to?? or..
thanks

No, that was just my problem at first when I had to move to a Windows PC for the downgrade, adb requires HTC Sync. So you should be fine.
But now that I read your problem again, my solution would not even fit I guess your tools directory does not contain the adb.exe. But the directory platform-tools in the android-sdk folder does. I just copied over the contents of the hack zip to platform-tools and did it from there... what ever, now I am having the problem i described above...

nae64 said:
I downgraded my Legend from the OTA 2.2.
Now the ROM version is 1.31 which should be correct, but the HBOOT version still is 1.00, which is according to this guide (http://forum.xda-developers.com/showthread.php?t=746454 ) the wrong one, it should be 0.43.... any ideas on this one?
Edit: @MontseCat: have you installed your USB drivers? The come with HTC Sync from the HTC homepage. Otherwise you can check adb functionality by opening a console window, running 'cd C:\Absolute\Path\containing\adb.exe\' (for Windows users, I guess Linux users know how to use cd) and then 'adb devices'. This should show a number refering to your device, opposed to simply nothing if it is not working.
Click to expand...
Click to collapse
Hmm my HBOOT version is 1.01
Sent from my HTC Legend using XDA App

Okay, thank you very much, root completed successfully even with HBOOT v1.00

nae64 said:
... But the directory platform-tools in the android-sdk folder does. I just copied over the contents of the hack zip to platform-tools and did it from there... what ever, now I am having the problem i described above...
Click to expand...
Click to collapse
I done as you said and succed,
Now the problem is
CR--rw----
So fails
the message at the end is xxxx permision denied.
I don't konw how to put an image of the scren. sorry
what whall I do now?

MontseCat said:
I done as you said and succed,
Now the problem is
CR--rw----
So fails
the message at the end is xxxx permision denied.
I don't konw how to put an image of the scren. sorry
what whall I do now?
Click to expand...
Click to collapse
- Temproot with VISIONary r13 (install the downloaded file as per a normal APK)
- Once you are temprooted, connect via 'adb' and do 'su' (to get root) then '/data/local/flash_image misc /data/local/misc1-2.img'
You should then be able to downgrade in the normal way.

janarp said:
- Temproot with VISIONary r13 (install the downloaded file as per a normal APK)
- Once you are temprooted, connect via 'adb' and do 'su' (to get root) then '/data/local/flash_image misc /data/local/misc1-2.img'
You should then be able to downgrade in the normal way.
Click to expand...
Click to collapse
Ok I Istalled the Visionary and temorary root,
I don't know how to connect via 'adb' and do su...
so, just stoped here and waiting next instruction. Sorry work as neel!!

[HOW-TO] ADB for Dummies(How-To Learner's Guide)

janarp said:
[HOW-TO] ADB for Dummies(How-To Learner's Guide)
Click to expand...
Click to collapse
even with this guide I didn't succed!!!
What I done is just temporary root with visionary then run again the adb but remains the same,
sorry I don't see where lost!!

In the following I will assume a Windows-PC:
1. Restart your phone to start from scratch, make sure 'TempRoot on boot' (or sth along this line...) is NOT checked
2. Run the crackin.bat, which you put (along with all other files in that download) into the directory containing the adb.exe (which is, at least for me, the platform-tools directory)
3. when it fails (it will), TempRoot using VISIONary, leaving everything unchecked (no System Read Write, even if that seems like a good idea)
4. on your PC, go to a Terminal (Windowsbutton + R, enter 'cmd' without quotes, press enter) , navigate to the folder crackin.whatever is in using the cd command like in my following example, but with the correct, full path
Example: 'cd "C:\\Programm Files\Android\andorid-sdk\platform-tools"' (again, without the single quotes (preserve doublequotes))
5. in that same Terminal Window, enter 'adb shell' (again, without quotes). The prompt should change to a dollar sign. Then enter 'su' (you know, without quotes...), and when the prompt changes to a '#', the TempRoot was successful and we can resume. Make sure to leave that Terminal open, you can use it again when rooting.
6. On a Windos System (32bit preferred) run the RUU.something.exe and follow these steps.
7. follow the main rooting guide, in which you will have to open a Terminal Window in the directory you unzipped. This is done with the same method I described above (opening cmd, 'cd' command)
I hope this makes it more clear =)
Edit: btw, this is a full guide, feel free to pick out the stuff you need, because I really did not understand what your problem was =) as a rooting guide I used this: http://forum.xda-developers.com/showthread.php?t=746454

MontseCat said:
even with this guide I didn't succed!!!
What I done is just temporary root with visionary then run again the adb but remains the same,
sorry I don't see where lost!!
Click to expand...
Click to collapse
i belive u have same folder names like me...
first i connect my phone with pc then i open command (start and type cmd)
Code:
cd C:\android-sdk-windows-1.1_r1\tools
then
Code:
adb shell
and then
Code:
su
and then follow nae64 post
point 6 and 7

Root - MT4G

Is there any way to root the MT4G without using a computer?
Sent from my HTC Glacier using XDA App

Yes. I was able to using visionary r14 & terminal emulator.
Find Grankins thread on rooting for step by step.
Sent from my HTC Glacier using XDA App

pvchip3 said:
Is there any way to root the MT4G without using a computer?
Sent from my HTC Glacier using XDA App
Click to expand...
Click to collapse
Fast easy and fairly safe way, Visionary Plus r14. One click root for temp and perma-root. Usually I do not recommend the 'easy way' method because I think everyone should learn how to actually root the 'hard way' just in case.. but I have to admit Visionary Plus works perfectly on the MT4G and is fast and simple as well as fairly safe. I suggest you use the temp root option first, this way if there is any issues with your device a simple reboot will fix it.

Thanks guys I now have S=OFF and this a new replacement from TMO
Sent from my HTC Glacier using XDA App

What all did you do?

PostaHTC said:
What all did you do?
Click to expand...
Click to collapse
i cannot speak of the person @ hand
The three needed items
you download VISIONary.apk
download the Root.sh file .zip and sore the folder with the script file inside the folder on the root of the SD card
download Terminal Emulator from the Android Market
How to do it
Run VISIONary and temp root w/ visionary.sh and set system to r/w after root checked
go into the Term Emul and type "SU". The $ sign should change to a #
if it does
cd /sdcard/root
sh root.sh
Click to expand...
Click to collapse
reboot into bootloader and make sure s=off.

Ok do I every hit Perm-Root?

PostaHTC said:
Ok do I every hit Perm-Root?
Click to expand...
Click to collapse
i never did. Once you turn s=off it will not check for that. after you reboot you will need to hit temp root one more time.

I'm trying it as we speak....
I temp-root?
Then I run the commands?
Then I temp-root one last time
Then Turn Off and S should be off....RIGHT?

I did a recent root though perm one. It was through a youtube video and a guide from this forum! look for perm root and s=off thread. its posted by the person who did ultimate true root and s=off.
and use visionary r11, if you dont like the manual way. thats really quick and good as well. but i dont take any responsibility though for any bricking to your phone from this suggestion xD.

PostaHTC said:
I'm trying it as we speak....
I temp-root?
Then I run the commands?
Then I temp-root one last time
Then Turn Off and S should be off....RIGHT?
Click to expand...
Click to collapse
I need to know what you have done so far
steps are:
Download files, temp root, run sh root.sh, reboot, no need to perm root from visonary
edit:
Go here:
http://forum.xda-developers.com/showthread.php?t=858996
And get the eng boot (optional steps at thhe end of the guide), its a must if you wanna start playin around with ur phone
Sent from my rooted glacier running CM7 and grankin's oc kernel

I'm doing the first steps to get S-Off but it's still S-On

I'm uploading a video to show you wat I'm doing

PostaHTC said:
I'm uploading a video to show you wat I'm doing
Click to expand...
Click to collapse
So, still no progress?
I need details though, like, what files have you downloaded, what steps, and everything.
Details bro, details.

http://www.youtube.com/watch?v=M6DrLUau8mE

PostaHTC said:
http://www.youtube.com/watch?v=M6DrLUau8mE
Click to expand...
Click to collapse
k, I saw the vid, the problem is you are still running bootloader version 0.86 and we want to be on eng bootloader, 0.85.
Ok, try this:
First off: we need the SDK, get it from google here: http://developer.android.com/sdk/index.html
Download the version that works for you, once it downloads (it is a .zip), extract it on your C:/ directory and for working purposes we will rename it to: "androidsdk". you have to launch the SDK manager, let it update and then read what follows:
Alternative Root Process
First, uninstall visionary and superuser and restart your device to wipe out temp root.
Second, download MT4G Modperm.zip and unzip its contents to your sdk platform - tools directory. (will be at C:/androidsdk/platform-tools
MT4G Modperm.zip: http://www.mediafire.com/?eaw0q0zjc7rrrwh
MD5Sum: 3ea4a7a6ddee711d12f7350ce60fae33
Then:
Windows Users:
1a. Using Explorer navigate to the root of your sdk. Hold shift and right mouse click on the platform-tools folder. Select "Open command window here". Or, open a command prompt, type:
cd /androidsdk/
cd platform-tools/
2a. Type "adbbat" + enter. Wait till the batch file finishes. (this will only work if the file we downloaded (MT4G mod perm) is extracted at C:/androidsdk/platform-tools (make sure that you do not create an extra folder within the platform-tools directory)
2. Disconnect your phone from the PC.
3. Open terminal emulator on the phone and type "/data/local/rage" + enter. Wait for "Forked XXXXXXXX children" to appear and then close the terminal.
4. Start terminal back up. It should force close.
5. Start terminal back up, again. This time it should stay open and you should have a "#" prompt instead of a "$" prompt. Then type "/data/local/temp.sh"
6. When the script finishes run /data/local/rage again and sit tight. The phone should start acting weird and do a soft reboot. Then right after everything loads it should do a hard reboot. (the phone might not reboot twice, if it does not, then you can reboot manually into bootloader and S=Off and Hboot 0.85 should be there)
7. Enjoy root!

PostaHTC said:
http://www.youtube.com/watch?v=M6DrLUau8mE
Click to expand...
Click to collapse
you didn't read what i said.
Run Visionary.sh after root should be checked
as well as
set system r/w after root.
Both of those HAVE to be checked.
As far as why you still have s=on, i have no clue.
I followed the method posted @ the unlockr (the first time i rooted my phone) link to the unlcokr. The second time i rooted my phone i followed the Wiki posted via Cyanogen Link to their Wiki page, and both of them worked perfectly.
If you want me to make a YouTube video for you showing you how to get s=off i will be more than glad to.

everest.deth said:
k, I saw the vid, the problem is you are still running bootloader version 0.86 and we want to be on eng bootloader, 0.85.
Click to expand...
Click to collapse
the first time i rooted my phone i didn't flash the Engineering Bootloader. The only current reason you need that is to flash slash images.

neidlinger said:
i cannot speak of the person @ hand
The three needed items
you download VISIONary.apk
download the Root.sh file .zip and sore the folder with the script file inside the folder on the root of the SD card
download Terminal Emulator from the Android Market
How to do it
Run VISIONary and temp root w/ visionary.sh and set system to r/w after root checked
go into the Term Emul and type "SU". The $ sign should change to a #
if it does
reboot into bootloader and make sure s=off.
Click to expand...
Click to collapse
that didnt work for me. infact, anything that involves visionary doesnt work for me

sheek360 said:
that didnt work for me. infact, anything that involves visionary doesnt work for me
Click to expand...
Click to collapse
You could try Cyanogen's method.

[GUIDE] Downgrade G2 (2.3.X) & DZ (2.3.X) & mT4g (2.3.4) & DHD w/ S-ON to Stock Froyo

[GUIDE] Downgrade G2 (2.3.X) & DZ (2.3.X) & mT4g (2.3.4) & DHD w/ S-ON to Stock Froyo
This guide is written for anyone who has "Stock Gingerbread" and wants to downgrade their phone which originally had "Stock Froyo". The following is a list of phone models this guide is intended for and that are known to work:
Working Phone Models:
G2 (Vision)
Desire Z (Vision)
myTouch 4G (Glacier)
Desire HD (Ace)
It should also be noted, this guide WILL NOT work with the following:
myTouch 4G Slide (Doubleshot)
Desire HD (Ace) w/ Sense 3.x (a recent OTA update as patched this method).*
*See these threads for a fix for the Desire HD (Ace) w/ Sense 3.x:
[GUIDE] Downgrade from 3.13 (Sense 3.0) roms
Temp root on Desire HD (Ace) with Sense 3.x
Special Notes
If you have used HTCDEV unlock your phone, please visit the following guide prior to using this guide, otherwise you will not be able to downgrade.
[GUIDE] How to get root/flash custom roms with HTCDEV unlock written by Nipqer
strawmetal has been kind enough to make an amazing PDF for each of the various phone models this guide supports which may be easier to read and follow for some users. I highly recommend taking a look at these files, especially if you are finding yourself a little confused during this guide (as this guide is written for multiple devices though he has PDFs for each device individually).
STRAWMETAL's Downgrade From Gingerbread to Froyo Guides and Tools
HTC Desire Z-G2 Downgrade & Root *Recently Updated*
Table of Contents
Introduction
Gaining Temp Root
Changing Version Number to Allow Downgrade and Gaining SuperCID with a Goldcard
Temp-Rooting to Backup (*Optional*)
Downgrading
Manual Downgrade
Fastboot Downgrade
Sources
Troubleshooting
Change Log
Attachments
I) Introduction
This guide is written with the assumption that the user has previously used "adb". If you are unfamiliar with "adb" or do not even know what "adb" is, download the Android SDK (found at http://developer.android.com/sdk/index.html). There are a couple guides to help you get started setting up the Android SDK and understanding ADB. If you have not installed the Android SDK or you are unfamiliar with ADB, please take some time and read a couple guides to get a basic understanding of it.
[GUIDE] ADB Workshop and Guide for everyone
[HOW-TO] ADB for Dummies(How-To Learner's Guide)
How To Set Up ADB/USB Drivers for Android Devices
I - 1) Gaining Temp Root
Download the attached files, unzip them, and place the files in your platform-tools folder. To elaborate, place the fre3vo file inside of the View attachment fre3vo.zip file in your platform-tools folder and the misc_version file inside the View attachment misc_version_01.zip file in your platform-tools folder.
Make sure you have your sdcard inserted in your phone, and you are NOT in USB Storage Mode, and your sdcard is NOT FULL.
Run the following command to verify the exploit has access to what it needs. (Only the first line is the command. The second line should be the result returned if all goes well.)
Code:
[B]> adb shell cat /dev/msm_rotator[/B]
[I]/dev/msm_rotator: invalid length[/I]
If you received the same message, you're good to continue on. If not… refer to the troubleshooting section of the guide before you continue.
Run the following commands from your platform-tools directory.
Code:
[B]> adb push fre3vo /data/local/tmp
> adb shell
$ chmod 777 /data/local/tmp/fre3vo
$ /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF[/B]
After you enter that command, you should see something similar to the last few lines in the following displayed.
(It may take a minute or two. From what I can tell, this appears to be the quickest method as the exploit seems to be found in the latter regions.)
Code:
[I]Buffer offset: 00000000
Buffer size: 8192
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba90000...
Potential exploit area found at address fbb4d600:a00.
Exploiting device...[/I]
If the exploit works, you will be kicked out of ADB shell, proceed to Step #8.
If the above does not work, and fails, you can try the following, and hopefully one will work, try the following (you must reboot your phone before you try another set):
Code:
[B]$ /data/local/tmp/fre3vo -debug -start 10000000 -end 1FFFFFFF
$ /data/local/tmp/fre3vo -debug -start 20000000 -end 2FFFFFFF
$ /data/local/tmp/fre3vo -debug -start 30000000 -end 3FFFFFFF
$ /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF
$ /data/local/tmp/fre3vo -debug -start E0000000 -end EFFFFFFF[/B]
If you did get kicked out of adb shell, open it again. You should now see # instead of $, thus granting you temp root. Go ahead and exit out of shell to proceed to the next stage.
Code:
[B]> adb shell
# exit[/B]
I - 2) Changing Version Number to Allow Downgrade and Gaining SuperCID with a Goldcard
If you followed the first portion of this, you should of unzipped View attachment misc_version_01.zip ad View attachment flashgc.zip in the platform-tools directory.
If you haven't done that yet, do that now and then run the following commands from your platform-tools directory.
Code:
[B]> adb push misc_version /data/local/tmp/misc_version
> adb push flashgc /data/local/tmp/flashgc
> adb shell chmod 777 /data/local/tmp/*
> adb shell
# cd /data/local/tmp
# ./misc_version -s 1.00.000.0[/B]
[I]--set_version set. VERSION will be changed to: 1.00.000.0
Patching and backing up partition 17...[/I]
[B]# ./flashgc[/B]
*Note: If you get the following error, please make sure your sdcard is inserted in your phone and is NOT mounted to your computer (ie: make sure you are NOT in USB Storage Mode). This is a fairly common error and/or oversight many people tend to miss. Please double check this before continuing.
Code:
Error opening backup file.
Code:
[B]# sync[/B]
Double check and make sure everything looks good so far by running the following command (still in adb shell).
Code:
[B]# dd if=/dev/block/mmcblk0p17 bs=1 skip=160 count=10[/B]
[I]1.00.000.010+0 records in
10+0 records out
10 bytes transferred in 0.001 secs (10000 bytes/sec)[/I]
BE SURE TO BACKUP ANY DATA!!!***
I - 3) Temp-Rooting to Backup
If you have nothing to back up or don't care to back anything up, proceed to the next section.
Credit goes to Nipqer from #g2root for providing me with this method.
Download the attached file: View attachment Vision-fre3vo-temp-root.zip
Extract the contents to your platform-tools directory.
Run the following commands in command prompt while in platform-tools directory:
Code:
> adb push su /data/local/tmp/
> adb push busybox /data/local/tmp/
> adb push fixsu.sh /data/local/tmp/
> adb install SuperUser.apk
> adb shell chmod 755 /data/local/tmp/fixsu.sh
> adb shell /data/local/tmp/fixsu.sh
Download a backing up application such as...
Titanium Backup
MyBackup Root
Make a backup!
I - 4) Downgrading
Download the Stock Rom for your device:
G2: PC10IMG_Vision_TMOUS_1.19.531.1_Radio_12.21.60.09b_26.02.01.15_M2_release_149459_signed.zip (Link not working last time I checked... hopefully it will come back up).
Mirrors:
Vision_G2_1.19.531.1_PC10IMG.zip (Working as of April 2023)
MD5: 531c08dc402e15577b947bf4cd22aec2
Desire Z: PC10IMG.zip
Mirrors:
PC10IMG.zip
Vision_DZ_1.34.405.5_PC10IMG.zip
Vision_DZ_1.34.405.5_PC10IMG.zip
MD5: 2ff42897cd27e0db425a2cf36c8bd078
myTouch 4G: PD15IMG.zip
Mirrors:
http://cmw.22aaf3.com/glacier/stock/1.17.531.2/PD15IMG.zip
http://goo-inside.me/ruu/glacier/fu....140e_26.03.02.26_M_release_155771_signed.zip
Glacier_mT4G_1.17.531.2_PD15IMG.zip
Glacier_mT4G_1.17.531.2_PD15IMG.zip
MD5: 49d07f0ee7de1765a6a84cb12fa53110
Desire HD: RUU_Ace_HTC_WWE_1.24.405.1_Radio_12.27.60.14b_26.02.00.29_M4_release_151852_signed.zip
Mirrors:
Ace_DHD_1.24.405.1_PD98IMG.zip
Ace_DHD_1.24.405.1_PD98IMG.zip
MD5: a107b30a4b397c9238ddc7f4571c2ee8
Follow either Manual Downgrade OR Fastboot Downgrade.
I - 4a) Manual Downgrade
Rename the downloaded rom to it's proper update name:
(Please note, the filenames MUST be all uppercase except for the extension, and if file extensions are hidden, do not include ".zip"):
G2: "PC10IMG.zip"
Desire Z: "PC10IMG.zip"
myTouch 4G: "PD15IMG.zip"
Desire HD: "PD98IMG.zip"
Place the zip file in the root of your sdcard.
Reboot your phone into bootloader by typing the following command:
Code:
[B]> adb reboot bootloader [/B]
After your phone has entered bootloader, press the power button. It will then scan for the associated rom file and ask you to update by pressing a key.
Press the key it requests to perform the update.
DO NOT INTERRUPT THIS PROCESS.
Your phone will reboot once or twice - this is completely normal.
This process will take roughly 5-10 minutes so make sure your phone is plugged in, either to an outlet or your computer.
Once the process is finished, it will ask you to reboot by pressing a key. Press the associated key and it will reboot into the Stock Froyo rom!
After booting into Android 2.2, DO NOT update the OTA that is around 70MB. That is the update to Gingerbread. There is one update that will come before that, that is a lot smaller in size, which is the WiFi-Calling update - that update is okay to install.
I - 4b) Fastboot Downgrade
Rename the downloaded stock rom "StockRom.zip" (if extensions are hidden, rename it "StockRom").
Place the downloaded stock rom zip file in your platform-tools directory.
Download the attached file View attachment fastboot.zip. In the zip archive there are three folders, "windows", "mac", and "linux".
Extract the file from the associated with your operating system and place it in platform-tools directory.
In command prompt, type the following command to reboot into bootloader:
Code:
[B]> adb reboot bootloader[/B]
Make sure your device is recognized by typing the following command.
Code:
[B]> fastboot devices[/B]
If you device is recognized, it should return a serial/model number.
Code:
[B]> fastboot oem rebootRUU[/B]
Your phone should now reboot into a black screen with a gray/silver "HTC" logo on it.
Next we flash the Stock Rom. This may take a few minutes as it transfers the file to the phone then attemps to update (downgrade).
Code:
[B]> fastboot flash zip StockRom.zip[/B]
In rare cases the flash stops and the user gets a warning to repeat the flash immediately - no panic, just run the "fastboot flash zip StockRom.zip" (only this command, not the rebootRUU one) again and it will work.
When it finishes, wait a minute or two (just in case) then reboot your phone by typing:
Code:
[B]> fastboot reboot[/B]
After booting into Android 2.2, DO NOT update the OTA that is around 70MB. That is the update to Gingerbread. There is one update that will come before that, that is a lot smaller in size, which is the WiFi-Calling update - that update is okay to install.
II) Sources:
#g2root: http://fishporn.ca/vision.gingerbread.root.html
Using fre3vo: http://therootofallevo.com/forums/viewtopic.php?f=6&t=120
[GUIDE] ADB Workshop and Guide for everyone
[HOW-TO] ADB for Dummies(How-To Learner's Guide)
How To Set Up ADB/USB Drivers for Android Devices
[ROM]Ace Test & Stock ROMS [RE-UPLOADED]
Instructions for flashgc
Temp-Root Backup Post by Nipqer
[GUIDE] How to get root/flash custom roms with HTCDEV unlock
flashgc by skorgon
Various Chats I've had with individuals.
If anyone needs further help and would prefer messaging me, feel free.
AIM: IgnorantNihilist
G-Talk: [email protected]
MSN: [email protected]
III) Troubleshooting
Cimer said:
[...] If [the downgrade] does not work, Right click your Command prompt, Select All, Right click again. Then go to pastebin.com, paste there, Scroll down, name it and hit submit. After that post the link here and we'll take a look at it.
EVERYONE: If you want a faster diagnostic please do this in advance and other people can see your mistakes.
Click to expand...
Click to collapse
You can also join the IRC channel #g2root on irc.freenode.net and ask questions in there. If you are unfamiliar with IRC, you can go to http://webchat.freenode.net and pick an alias, for channel type in #g2root and enter the reCAPTCHA and connect.
I wanted to give credit to specific individuals whom have helped write this guide, provided important feedback to further improve this guide, and/or in any other way further improved this guide. I think these invidiuals should be recognized, as if it were not for them, this would wouldn't be as elaborate, dynamic, and informative as it is. So a special thanks to, Cimer, strawmetal petarpLab, iDylan1357, asharma5290, guhl, pierre_ja, and skorgon from #g2root. And I would also like to recognize and give a major thanks to Nipqer whom offers a lot of support with constant responses helping assist those whom ask for help both in this thread as well as on IRC. And he is always making sure I keep this as updated as it can be.
IV) Change Log
2023/04/14
I'm no longer supporting this thread anymore however I will try to update it if someone messages me with an issue. I don't have time anymore unfortunately. I did however update the downgrade ROM for the G2. The link in the mirror is currently hosted on my google drive. If there's a problem let me know in a private message.
2013/06/14
Update ratherphallic.co.cc links to ratherphallic.tk. -Nipqer
2012/11/11
Made some minor changes (grammar, spelling, layout/format).
Added links to guides which fix the issue with Desire HD (Ace) w/ Sense 3.x
2012/05/22
Changed "fastboot" attachment to have 3 folders ("windows","linux",and "mac") each with "fastboot" in it instead of having "fastboot-linux", "fastboot-mac", and "fastboot-windows.exe".
Changed fastboot portion of guide to reflect change to attachment for easier usability.
2012/04/21
Updated strawmetal's PDF document for G2/Desire Z Downgrade.
Added link to strawmetal's tools used in his PDF Guide.
2012/03/07
Added a PDF file that strawmetal was kind enough to make for Vision users.
Added links to attached files in the guide where I reference them.
2012/02/03
Changed link to the Stock Vision (G2) Rom and added mirrors.
Changed link to the Stock Vision (Desire Z) Rom and added mirrors.
Added mirrors to the Stock Glacier (myTouch 4G) Rom.
Changed link to the Stock Ace (Desire HD) Rom and added mirrors.
2012/02/03
Added a guide to help individuals whom have used the "official" htcdev.com unlocker method.
2012/02/03
Fixed link for the G2, Desire Z, and Desire HD (thanks to repast & cmstlist.
2012/04/13
Possible exploit found for Desire HD updated to latest OTA update (which patched our current method).
2012/01/28
Fixed link for myTouch 4G as megaupload has been taken down. Also added mirrors for myTouch 4G Stock Rom.
2011/12/20
Clearified which phone models this guide is intended for as well as noting that the Doubleshot does not work.
Made note that a recent OTA patch for the Ace, giving it Sense 3.x, has patched this method and this method will no longer work on Ace models which have Sense 3.x
2011/12/17
Added new goldcard generator and simplified the guide.
2011/10/27
Changed the download link for the Desire HD.
Added MD5 checksums next to the rooms.
2011/10/26
Re-added the manual downgrade method due to people having issues with the fastboot method.
2011/10/23
Fixed a slightly error in code during the temp-root backup section. Had "adb install install Superuser.apk", replaced it with "adb install Superuser.apk"
2011/10/22
Added a method to be able to backup data prior to downgrading! (thanks to Nipqer from #g2root)
2011/10/20
Added Desire HD.
Changed the downgrading method to use fastboot rather than manually downgrading.
Added "Creating A Goldcard" method from http://www.thinkthinkdo.com/trac/project1/attachment/wiki/pierre_ja/flashgc_instructions
2011/08/26
Changed modified version number for each device to 1.00.000 as it is more universal and works for each one.
Made it more clear to extract the attached files and place them in the platform-tools directory for use.
2011/08/06
Added a couple links to ADB guide.
2011/08/05
Added myTouch 4G
Added link to an "adb" guide.
Changed title from "[GUIDE] Downgrade G2 2.13.531.8 (2.3.3 T-Mobile Rom w/ S-ON) & DZ 2.3.3 w/ S-ON" to "[GUIDE] Downgrade G2 (2.3.3) & DZ (2.3.3) & mT4g (2.3.4) w/ S-ON to Stock Froyo"
V) Attached Files
View attachment misc_version_01.zip
View attachment fre3vo.zip
View attachment fastboot.zip
View attachment Vision-fre3vo-temp-root.zip
View attachment flashgc.zip

Wow first guide. Nice! I hope this helps people who have 2.3.3 so they can stop asking how to downgrade
Sent from my HTC Vision using XDA App

Sweet, now I can finally get my phone replaced. Accidentally blew out my LED and was scared of asking for a new one for fear of being unable to root. Thanks for the peace of mind I'll be using this in a few days

Just some suggestions to avoid confusion when you run the command
Code:
adb shell cat /dev/msm_rotator
you should get the return of
Code:
/dev/msm_rotator: invalid length
you do not need to enter in this line.
Also after entering
Code:
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
or one like it and it fails (It should not) you need to reboot the phone between these attempts.
Thanks for writing the guide! We just posted the log lol
Late side note: I've recently read an article on how root exploits are not credited to their original inventors. Just letting everyone know that agrabren should be credited as well for his work with Fr3v0, and his willingness to help during the process

Thanks for the tips Cimer, I edited the post, hopefully that clarifies it a bit more.
I've been a quiet browser here on XDA for quite a while but I believe that was actually the first post I made =3 It took me a while to try to get it formatted... fluently / tried to make it easy to read and follow.
And hey, if it wasn't for you all posting the logs from #g2root, I would of never gotten my G2 back to being rooted. I think I had like 8 different pages open when I was doing it, reading the chat log, reviewing the pastebin data, et cetera. But it worked, after searching every day, the trick has been found.
On a side note, I picked the range "-start FAA90000 -end FFFFFFFF" because it appears that the exploit is most likely within that range. It was for yours "FBB47C00:1400", mine was "FBB4D600:A00", and a friend of mine was also an FBB*.

Does it work for the european desire Z ?

ilbeppez said:
Does it work for the european desire Z ?
Click to expand...
Click to collapse
Personally, I have no idea. I don't imagine it would hurt the phone any if you tried. I know you would have to change the version number (when using misc_version) to a different number, one that would be equivalent to the stock rom that came with the phone. As for the exploit itself, I don't see any harm it could do to try (though I'm no expert). Just be sure to reboot your phone after each attempt of using fre3vo.

ilbeppez said:
Does it work for the european desire Z ?
Click to expand...
Click to collapse
Give me a second, Guhl made a post about this...
http://forum.xda-developers.com/showpost.php?p=15825944&postcount=27
Should explain things for Desire Z users.

Cimer said:
Give me a second, Guhl made a post about this...
http://forum.xda-developers.com/showpost.php?p=15825944&postcount=27
Should explain things for Desire Z users.
Click to expand...
Click to collapse
Ok
thanks

Thank you. I have been searching for this.

Setherio, please divide a section for 2.3.3 DZ owners. the appropriate PC10IMG.zip for them is
http://www.multiupload.com/GH26HXLLES (md5 2ff42897cd27e0db425a2cf36c8bd078)
the mics_version command is: /data/local/tmp/misc_version -s 1.33.405.5
the push command is: adb push PC10IMG.zip /sdcard/

petarpLab said:
Setherio, please divide a section for 2.3.3 DZ owners. the appropriate PC10IMG.zip for them is
multiupload.com/GH26HXLLES (md5 2ff42897cd27e0db425a2cf36c8bd078)
the mics_version command is: /data/local/tmp/misc_version -s 1.33.405.5
the push command is: adb push PC10IMG.zip /sdcard/
Click to expand...
Click to collapse
Thanks for the information. I updated the guide.

thanks a lot

Incase anyone did not know already gfree is the best way to root after the downgrade...visionary bricks phones. You can find gfree in the xda wiki.
Sent from my HTC Vision using XDA App

Great guide. My first downgrade and I haven't bricked my phone
Thanks to all people that made it possible
Cimer said:
Incase anyone did not know already gfree is the best way to root after the downgrade...visionary bricks phones. You can find gfree in the xda wiki.
Sent from my HTC Vision using XDA App
Click to expand...
Click to collapse
So AMT is ok for rooting after downgrade?
This package contains:
- gfree
- gfree_verify
- Superuser
- Busybox
- flash_image
- psneuter
- root_psn
- misc_version
- GingerBreak APK
Click to expand...
Click to collapse

trzype said:
Great guide.
My first downgrade and I haven't bricked my phone
Thanks to all people that made it possible
Click to expand...
Click to collapse
Thank you Glad it helped you.
trzype said:
So AMT is ok for rooting after downgrade?
Click to expand...
Click to collapse
Yes. I downgraded and rooted, went ahead and installed Cyanogen nightly. As did a couple others I've talked to who have downgraded as well.

Used AMT. Got some error about 1.34 and "Double" but cliked Continue button anyway. Everything went fine.
Setherio said:
I downgraded and rooted, went ahead and installed Cyanogen nightly. As did a couple others I've talked to who have downgraded as well.
Click to expand...
Click to collapse
I'm going for Virtuous 2.0.0. Can't live without Sense UI
Thanks again

Should I rename the stock Rom to just PC10IMG before I push it to sd card or can I just put it on sd card before hand
Sent from my HTC Sensation 4G using XDA Premium App

Got it worked great thanks

Thank you so much worked like a charm - Peace

1st time attempt to root, stuck at visionary+

Hi all,
I appreciate this forum is cram packed with info, but for me as a newb...I can't see the woods for the trees :-(
I have a stock Orange D-HD ( A2.3.3 with sense 2.1 ) and basically just want to unlock it to use an O2 sim.
I have previously flashed WM6 cooked roms onto Kaisers / Hermes & Himyies so do understand the basic principle. And I grasp the basic point about rooting as I have flashed a Superpad device too.
http://forum.xda-developers.com/showthread.php?t=964996
So I started to follow the above tutorial thread and downloaded Visionary+ and S-OFF etc.
But even though I set USB root debugging, when I run Visionary+ to temp-root, my DHD just runs the triange message a few seconds and then just goes blank.
Is there an alternative way to root instead of visionary+ ???
Someone pls help me get past the first hurdle and root my device
Thanks

I got stuck too but...
Did u try ticking the 'root on startup or reboot' option? then restart. it may take a few goes, u'll probably notice Superuser has been installed then Temproot should happen next reboot. Permroot's the same, may take a few times to stick. To test if ur root has worked try installing Titanium Backup from market, u'll need it once ur rooted.

If you have a Stock HTC with Android 2.3.3 you need to downgrade the software version first before you can use visionary.
[GUIDE] How to downgrade 1.7x/1.8x/2.x to 1.32.405.6

ahh ok, will do.
None of this was mentioned in the guide link I mentioned in the original post. It would be worthwhile for that guide to be modded to reflect the fact a downgrade is needed.
"Open up a cmd and go to Downgrade folder"...is this done on the PC or the phone??? don't understand...

hey, have you created a goldcard mentioned in section 1 of the tutorial?

ermm,, nope
I wasn't sure I needed to as it seemed to be related to branded phones. Mine is locked to orange at present....but it doesn't have an orange splash screen or any orange logo on the phone casing. Thought if my 'build' number had '405' in the middle...that this meant I didn't need a goldcard creating...
wrong or right peeps??

ebod said:
None of this was mentioned in the guide link I mentioned in the original post.
Click to expand...
Click to collapse
Ehem......
wid0w said:
If your Desire HD is running stock firmware 1.7x, please check this guide in order to downgrade:
http://forum.xda-developers.com/showthread.php?t=905003
Click to expand...
Click to collapse
and
wid0w said:
Basic Setup
...
- Desire HD with lower than 1.7x stock ROM
...
Click to expand...
Click to collapse
I think the guide captures every detail.

for3st said:
Ehem......
and
I think the guide captures every detail.
Click to expand...
Click to collapse
All very well if you understand what a rom is. My software page is full of 2.50 , 2.6 type numbers and nothing below 1.7....hence my comment.
Also, I've made a goldcard out of a spare 1gb sd, and copied PD98img.zip to it. So for the next bit....do I now put that goldcard in my HTC and connect to the PC whilst set in USB debugging enabled mode.
Then do I put this lot below into the win-xp pc 'run' box line by line or one whole lump?:-
adb push misc_version /data/local/tmp
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF

ebod said:
All very well if you understand what a rom is. My software page is full of 2.50 , 2.6 type numbers and nothing below 1.7....hence my comment.
Also, I've made a goldcard out of a spare 1gb sd, and copied PD98img.zip to it. So for the next bit....do I now put that goldcard in my HTC and connect to the PC whilst set in USB debugging enabled mode.
Then do I put this lot below into the win-xp pc 'run' box line by line or one whole lump?:-
adb push misc_version /data/local/tmp
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
Click to expand...
Click to collapse
one by one......

I dont use Visionary+ , it just dont work in my phone,end me up using manual method. Plus S-off and Engineering S-off.
First of all, DOWNGRADE UR PHONE TO 1.32
Gaining Radio S-OFF:
This method will get you the Radio S-OFF flag while SIM-unlocking it and setting up SuperCID, which means
1. This method will root your phone for the process if it isn’t already rooted. If you just want to permanently root your phone
2. Make sure you have ADB installed on your computer. Also, if you have previously installed VISIONary on your phone in order to root it, uninstall it first before proceeding.
3. Download Desire HD S-OFF Toolkit and unzip its contents to your computer. Put it in your adb folder
4. Enable USB Debugging on your phone from Settings > Applications > Development.
5. Connect your phone to your computer via USB.
6. Launch a Command Prompt/Terminal window on your computer, navigate to the folder where you extracted the files in Step 3 and enter the following commandsne by one , press enter after each line
adb push su /sdcard/su
adb push Superuser.apk /sdcard/Superuser.apk
adb push rage /data/local/tmp/rage
adb push busybox /data/local/tmp/busybox
adb push root /data/local/tmp/root
adb push gfree /data/local
adb shell chmod 0755 /data/local/tmp/*
adb shell chmod 777 /data/local/gfree
7. Install Terminal Emulator app on your phone from the Android Market and launch it.
8. Enter the following command in Terminal Emulator on your phone:
/data/local/tmp/rage
9. In a while, you will see the output “Forked #### childs”. Now press ‘Menu’ and tap ‘Reset Term’ to exit Terminal Emulator.
10. Launch Terminal Emulator again. You will notice that it force-closes. Don’t worry and just launch it again, and you should have a root shell indicated by the # prompt instead of $.
11. Now enter the following commands in Terminal Emulator:
/data/local/gfree -f
sync
/data/local/tmp/root
sync
If you get a ‘mkdir: /system/xbin already exists’ error during the process, ignore it and proceed.
12. Wait patiently while the process finishes. Once it is complete, reboot your phone.
You should now have Radio S-OFF, SIM-unlock and SuperCID all set on your phone. If you just want to install ClockworkMod recovery and custom ROMs etc., you are all good to go and do not need to gain Engineering S-OFF. You may simply install ClockworkMod Recovery, find a custom ROM of your choice and flash it to your phone from recovery.
Gaining Engineering S-OFF:
You should attempt to gain Engineering S-OFF if and only if you want to gain absolute access to your Desire HD including the ability to flash a radio or edit all your phone’s partitions the way you want. If you are not absolutely sure what you are about to do, we recommend that you do NOT proceed.
1. Make sure you have already gained radio S-OFF by following the above-mentioned steps.
2. Download the Engineering HBoot for HTC Desire HD and extract the contents of the zip files.put in adb folder
3. Enable USB debugging (if not already enabled) and connect your phone to the computer.
4. On your computer, launch Command Prompt/Terminal, navigate to the folder where you extracted the files in Step 2 and enter these commands:
adb push hboot-eng.img /data/local
5. Finally, launch Terminal Emulator on your phone and enter these commands, being EXTREMELY careful not to make any mistake here:
su
dd if=/data/local/hboot-eng.img of=/dev/block/mmcblk0p18
Make sure to allow when Super User access is requested. Wait till the process is finished and you’re done!
You now have the Engineering S-OFF HBoot installed and with this, you have absolute control over your HTC Desire HD. You can now flash radios of your choice to your phone and have access to modify all its partitions as well as unbrick it in certain circumstances where no other method would revive your device.
Click to expand...
Click to collapse

rohithksaj said:
one by one......
Click to expand...
Click to collapse
...but I get lost here : "•Open up a cmd and go to Downgrade folder, execute commands:"i.e. I don't understand a 'cmd' is an where I open it from..
EDIT : okay finally at 1.32 & rooted ( yey!)
wanting to check whether the S-OFF info is right but having a mare trying to get bootloader screen to stop from tripping to HBOOT and running the PD98IMG ( even though I took out the goldcard ).
Is there some specific combination to hold vol-down and power for a set number of seconds? I've tried 10+ times and can't stop it going onto the HBOOT update thingy :-(

Ok folks...back to my painful rooting excercise
I'm still in this thread
http://forum.xda-developers.com/showthread.php?t=964996
..trying to eastablish whether or not my S-OFF info is correct before proceeding further. The thread says :-
"Testing Eng S-off and Radio S-OFF
1. Power Down Your Device
2. Go to Bootloader
3. If it says Ace PVT ENG S-OFF your phone is ENG S-OFF.
4. use Volume down to get to system info and tap power button to select
5. check CID for CID-11111111 (if you have this all is done 100%)
6. Reboot
"
how can I check my "CID-11111111" info ? where is it displayed?

DOH STUPID STUPID STUPID!!!!!
Before I made my goldcard I put a copy of pd98img.zip on my SD card....and although I took out the goldcard...when I put the normal SD back in, I neglected to recall it had a copy of pd98img.zip still sat on it.
Thats why I couldn't access bootloader.
Anyways, I have the right S-OFF info so its now onwards the next step