Related
[GUIDE] Downgrade G2 (2.3.X) & DZ (2.3.X) & mT4g (2.3.4) & DHD w/ S-ON to Stock Froyo
This guide is written for anyone who has "Stock Gingerbread" and wants to downgrade their phone which originally had "Stock Froyo". The following is a list of phone models this guide is intended for and that are known to work:
Working Phone Models:
G2 (Vision)
Desire Z (Vision)
myTouch 4G (Glacier)
Desire HD (Ace)
It should also be noted, this guide WILL NOT work with the following:
myTouch 4G Slide (Doubleshot)
Desire HD (Ace) w/ Sense 3.x (a recent OTA update as patched this method).*
*See these threads for a fix for the Desire HD (Ace) w/ Sense 3.x:
[GUIDE] Downgrade from 3.13 (Sense 3.0) roms
Temp root on Desire HD (Ace) with Sense 3.x
Special Notes
If you have used HTCDEV unlock your phone, please visit the following guide prior to using this guide, otherwise you will not be able to downgrade.
[GUIDE] How to get root/flash custom roms with HTCDEV unlock written by Nipqer
strawmetal has been kind enough to make an amazing PDF for each of the various phone models this guide supports which may be easier to read and follow for some users. I highly recommend taking a look at these files, especially if you are finding yourself a little confused during this guide (as this guide is written for multiple devices though he has PDFs for each device individually).
STRAWMETAL's Downgrade From Gingerbread to Froyo Guides and Tools
HTC Desire Z-G2 Downgrade & Root *Recently Updated*
Table of Contents
Introduction
Gaining Temp Root
Changing Version Number to Allow Downgrade and Gaining SuperCID with a Goldcard
Temp-Rooting to Backup (*Optional*)
Downgrading
Manual Downgrade
Fastboot Downgrade
Sources
Troubleshooting
Change Log
Attachments
I) Introduction
This guide is written with the assumption that the user has previously used "adb". If you are unfamiliar with "adb" or do not even know what "adb" is, download the Android SDK (found at http://developer.android.com/sdk/index.html). There are a couple guides to help you get started setting up the Android SDK and understanding ADB. If you have not installed the Android SDK or you are unfamiliar with ADB, please take some time and read a couple guides to get a basic understanding of it.
[GUIDE] ADB Workshop and Guide for everyone
[HOW-TO] ADB for Dummies(How-To Learner's Guide)
How To Set Up ADB/USB Drivers for Android Devices
I - 1) Gaining Temp Root
Download the attached files, unzip them, and place the files in your platform-tools folder. To elaborate, place the fre3vo file inside of the View attachment fre3vo.zip file in your platform-tools folder and the misc_version file inside the View attachment misc_version_01.zip file in your platform-tools folder.
Make sure you have your sdcard inserted in your phone, and you are NOT in USB Storage Mode, and your sdcard is NOT FULL.
Run the following command to verify the exploit has access to what it needs. (Only the first line is the command. The second line should be the result returned if all goes well.)
Code:
[B]> adb shell cat /dev/msm_rotator[/B]
[I]/dev/msm_rotator: invalid length[/I]
If you received the same message, you're good to continue on. If not… refer to the troubleshooting section of the guide before you continue.
Run the following commands from your platform-tools directory.
Code:
[B]> adb push fre3vo /data/local/tmp
> adb shell
$ chmod 777 /data/local/tmp/fre3vo
$ /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF[/B]
After you enter that command, you should see something similar to the last few lines in the following displayed.
(It may take a minute or two. From what I can tell, this appears to be the quickest method as the exploit seems to be found in the latter regions.)
Code:
[I]Buffer offset: 00000000
Buffer size: 8192
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba90000...
Potential exploit area found at address fbb4d600:a00.
Exploiting device...[/I]
If the exploit works, you will be kicked out of ADB shell, proceed to Step #8.
If the above does not work, and fails, you can try the following, and hopefully one will work, try the following (you must reboot your phone before you try another set):
Code:
[B]$ /data/local/tmp/fre3vo -debug -start 10000000 -end 1FFFFFFF
$ /data/local/tmp/fre3vo -debug -start 20000000 -end 2FFFFFFF
$ /data/local/tmp/fre3vo -debug -start 30000000 -end 3FFFFFFF
$ /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF
$ /data/local/tmp/fre3vo -debug -start E0000000 -end EFFFFFFF[/B]
If you did get kicked out of adb shell, open it again. You should now see # instead of $, thus granting you temp root. Go ahead and exit out of shell to proceed to the next stage.
Code:
[B]> adb shell
# exit[/B]
I - 2) Changing Version Number to Allow Downgrade and Gaining SuperCID with a Goldcard
If you followed the first portion of this, you should of unzipped View attachment misc_version_01.zip ad View attachment flashgc.zip in the platform-tools directory.
If you haven't done that yet, do that now and then run the following commands from your platform-tools directory.
Code:
[B]> adb push misc_version /data/local/tmp/misc_version
> adb push flashgc /data/local/tmp/flashgc
> adb shell chmod 777 /data/local/tmp/*
> adb shell
# cd /data/local/tmp
# ./misc_version -s 1.00.000.0[/B]
[I]--set_version set. VERSION will be changed to: 1.00.000.0
Patching and backing up partition 17...[/I]
[B]# ./flashgc[/B]
*Note: If you get the following error, please make sure your sdcard is inserted in your phone and is NOT mounted to your computer (ie: make sure you are NOT in USB Storage Mode). This is a fairly common error and/or oversight many people tend to miss. Please double check this before continuing.
Code:
Error opening backup file.
Code:
[B]# sync[/B]
Double check and make sure everything looks good so far by running the following command (still in adb shell).
Code:
[B]# dd if=/dev/block/mmcblk0p17 bs=1 skip=160 count=10[/B]
[I]1.00.000.010+0 records in
10+0 records out
10 bytes transferred in 0.001 secs (10000 bytes/sec)[/I]
BE SURE TO BACKUP ANY DATA!!!***
I - 3) Temp-Rooting to Backup
If you have nothing to back up or don't care to back anything up, proceed to the next section.
Credit goes to Nipqer from #g2root for providing me with this method.
Download the attached file: View attachment Vision-fre3vo-temp-root.zip
Extract the contents to your platform-tools directory.
Run the following commands in command prompt while in platform-tools directory:
Code:
> adb push su /data/local/tmp/
> adb push busybox /data/local/tmp/
> adb push fixsu.sh /data/local/tmp/
> adb install SuperUser.apk
> adb shell chmod 755 /data/local/tmp/fixsu.sh
> adb shell /data/local/tmp/fixsu.sh
Download a backing up application such as...
Titanium Backup
MyBackup Root
Make a backup!
I - 4) Downgrading
Download the Stock Rom for your device:
G2: PC10IMG_Vision_TMOUS_1.19.531.1_Radio_12.21.60.09b_26.02.01.15_M2_release_149459_signed.zip (Link not working last time I checked... hopefully it will come back up).
Mirrors:
Vision_G2_1.19.531.1_PC10IMG.zip (Working as of April 2023)
MD5: 531c08dc402e15577b947bf4cd22aec2
Desire Z: PC10IMG.zip
Mirrors:
PC10IMG.zip
Vision_DZ_1.34.405.5_PC10IMG.zip
Vision_DZ_1.34.405.5_PC10IMG.zip
MD5: 2ff42897cd27e0db425a2cf36c8bd078
myTouch 4G: PD15IMG.zip
Mirrors:
http://cmw.22aaf3.com/glacier/stock/1.17.531.2/PD15IMG.zip
http://goo-inside.me/ruu/glacier/fu....140e_26.03.02.26_M_release_155771_signed.zip
Glacier_mT4G_1.17.531.2_PD15IMG.zip
Glacier_mT4G_1.17.531.2_PD15IMG.zip
MD5: 49d07f0ee7de1765a6a84cb12fa53110
Desire HD: RUU_Ace_HTC_WWE_1.24.405.1_Radio_12.27.60.14b_26.02.00.29_M4_release_151852_signed.zip
Mirrors:
Ace_DHD_1.24.405.1_PD98IMG.zip
Ace_DHD_1.24.405.1_PD98IMG.zip
MD5: a107b30a4b397c9238ddc7f4571c2ee8
Follow either Manual Downgrade OR Fastboot Downgrade.
I - 4a) Manual Downgrade
Rename the downloaded rom to it's proper update name:
(Please note, the filenames MUST be all uppercase except for the extension, and if file extensions are hidden, do not include ".zip"):
G2: "PC10IMG.zip"
Desire Z: "PC10IMG.zip"
myTouch 4G: "PD15IMG.zip"
Desire HD: "PD98IMG.zip"
Place the zip file in the root of your sdcard.
Reboot your phone into bootloader by typing the following command:
Code:
[B]> adb reboot bootloader [/B]
After your phone has entered bootloader, press the power button. It will then scan for the associated rom file and ask you to update by pressing a key.
Press the key it requests to perform the update.
DO NOT INTERRUPT THIS PROCESS.
Your phone will reboot once or twice - this is completely normal.
This process will take roughly 5-10 minutes so make sure your phone is plugged in, either to an outlet or your computer.
Once the process is finished, it will ask you to reboot by pressing a key. Press the associated key and it will reboot into the Stock Froyo rom!
After booting into Android 2.2, DO NOT update the OTA that is around 70MB. That is the update to Gingerbread. There is one update that will come before that, that is a lot smaller in size, which is the WiFi-Calling update - that update is okay to install.
I - 4b) Fastboot Downgrade
Rename the downloaded stock rom "StockRom.zip" (if extensions are hidden, rename it "StockRom").
Place the downloaded stock rom zip file in your platform-tools directory.
Download the attached file View attachment fastboot.zip. In the zip archive there are three folders, "windows", "mac", and "linux".
Extract the file from the associated with your operating system and place it in platform-tools directory.
In command prompt, type the following command to reboot into bootloader:
Code:
[B]> adb reboot bootloader[/B]
Make sure your device is recognized by typing the following command.
Code:
[B]> fastboot devices[/B]
If you device is recognized, it should return a serial/model number.
Code:
[B]> fastboot oem rebootRUU[/B]
Your phone should now reboot into a black screen with a gray/silver "HTC" logo on it.
Next we flash the Stock Rom. This may take a few minutes as it transfers the file to the phone then attemps to update (downgrade).
Code:
[B]> fastboot flash zip StockRom.zip[/B]
In rare cases the flash stops and the user gets a warning to repeat the flash immediately - no panic, just run the "fastboot flash zip StockRom.zip" (only this command, not the rebootRUU one) again and it will work.
When it finishes, wait a minute or two (just in case) then reboot your phone by typing:
Code:
[B]> fastboot reboot[/B]
After booting into Android 2.2, DO NOT update the OTA that is around 70MB. That is the update to Gingerbread. There is one update that will come before that, that is a lot smaller in size, which is the WiFi-Calling update - that update is okay to install.
II) Sources:
#g2root: http://fishporn.ca/vision.gingerbread.root.html
Using fre3vo: http://therootofallevo.com/forums/viewtopic.php?f=6&t=120
[GUIDE] ADB Workshop and Guide for everyone
[HOW-TO] ADB for Dummies(How-To Learner's Guide)
How To Set Up ADB/USB Drivers for Android Devices
[ROM]Ace Test & Stock ROMS [RE-UPLOADED]
Instructions for flashgc
Temp-Root Backup Post by Nipqer
[GUIDE] How to get root/flash custom roms with HTCDEV unlock
flashgc by skorgon
Various Chats I've had with individuals.
If anyone needs further help and would prefer messaging me, feel free.
AIM: IgnorantNihilist
G-Talk: [email protected]
MSN: [email protected]
III) Troubleshooting
Cimer said:
[...] If [the downgrade] does not work, Right click your Command prompt, Select All, Right click again. Then go to pastebin.com, paste there, Scroll down, name it and hit submit. After that post the link here and we'll take a look at it.
EVERYONE: If you want a faster diagnostic please do this in advance and other people can see your mistakes.
Click to expand...
Click to collapse
You can also join the IRC channel #g2root on irc.freenode.net and ask questions in there. If you are unfamiliar with IRC, you can go to http://webchat.freenode.net and pick an alias, for channel type in #g2root and enter the reCAPTCHA and connect.
I wanted to give credit to specific individuals whom have helped write this guide, provided important feedback to further improve this guide, and/or in any other way further improved this guide. I think these invidiuals should be recognized, as if it were not for them, this would wouldn't be as elaborate, dynamic, and informative as it is. So a special thanks to, Cimer, strawmetal petarpLab, iDylan1357, asharma5290, guhl, pierre_ja, and skorgon from #g2root. And I would also like to recognize and give a major thanks to Nipqer whom offers a lot of support with constant responses helping assist those whom ask for help both in this thread as well as on IRC. And he is always making sure I keep this as updated as it can be.
IV) Change Log
2023/04/14
I'm no longer supporting this thread anymore however I will try to update it if someone messages me with an issue. I don't have time anymore unfortunately. I did however update the downgrade ROM for the G2. The link in the mirror is currently hosted on my google drive. If there's a problem let me know in a private message.
2013/06/14
Update ratherphallic.co.cc links to ratherphallic.tk. -Nipqer
2012/11/11
Made some minor changes (grammar, spelling, layout/format).
Added links to guides which fix the issue with Desire HD (Ace) w/ Sense 3.x
2012/05/22
Changed "fastboot" attachment to have 3 folders ("windows","linux",and "mac") each with "fastboot" in it instead of having "fastboot-linux", "fastboot-mac", and "fastboot-windows.exe".
Changed fastboot portion of guide to reflect change to attachment for easier usability.
2012/04/21
Updated strawmetal's PDF document for G2/Desire Z Downgrade.
Added link to strawmetal's tools used in his PDF Guide.
2012/03/07
Added a PDF file that strawmetal was kind enough to make for Vision users.
Added links to attached files in the guide where I reference them.
2012/02/03
Changed link to the Stock Vision (G2) Rom and added mirrors.
Changed link to the Stock Vision (Desire Z) Rom and added mirrors.
Added mirrors to the Stock Glacier (myTouch 4G) Rom.
Changed link to the Stock Ace (Desire HD) Rom and added mirrors.
2012/02/03
Added a guide to help individuals whom have used the "official" htcdev.com unlocker method.
2012/02/03
Fixed link for the G2, Desire Z, and Desire HD (thanks to repast & cmstlist.
2012/04/13
Possible exploit found for Desire HD updated to latest OTA update (which patched our current method).
2012/01/28
Fixed link for myTouch 4G as megaupload has been taken down. Also added mirrors for myTouch 4G Stock Rom.
2011/12/20
Clearified which phone models this guide is intended for as well as noting that the Doubleshot does not work.
Made note that a recent OTA patch for the Ace, giving it Sense 3.x, has patched this method and this method will no longer work on Ace models which have Sense 3.x
2011/12/17
Added new goldcard generator and simplified the guide.
2011/10/27
Changed the download link for the Desire HD.
Added MD5 checksums next to the rooms.
2011/10/26
Re-added the manual downgrade method due to people having issues with the fastboot method.
2011/10/23
Fixed a slightly error in code during the temp-root backup section. Had "adb install install Superuser.apk", replaced it with "adb install Superuser.apk"
2011/10/22
Added a method to be able to backup data prior to downgrading! (thanks to Nipqer from #g2root)
2011/10/20
Added Desire HD.
Changed the downgrading method to use fastboot rather than manually downgrading.
Added "Creating A Goldcard" method from http://www.thinkthinkdo.com/trac/project1/attachment/wiki/pierre_ja/flashgc_instructions
2011/08/26
Changed modified version number for each device to 1.00.000 as it is more universal and works for each one.
Made it more clear to extract the attached files and place them in the platform-tools directory for use.
2011/08/06
Added a couple links to ADB guide.
2011/08/05
Added myTouch 4G
Added link to an "adb" guide.
Changed title from "[GUIDE] Downgrade G2 2.13.531.8 (2.3.3 T-Mobile Rom w/ S-ON) & DZ 2.3.3 w/ S-ON" to "[GUIDE] Downgrade G2 (2.3.3) & DZ (2.3.3) & mT4g (2.3.4) w/ S-ON to Stock Froyo"
V) Attached Files
View attachment misc_version_01.zip
View attachment fre3vo.zip
View attachment fastboot.zip
View attachment Vision-fre3vo-temp-root.zip
View attachment flashgc.zip
Wow first guide. Nice! I hope this helps people who have 2.3.3 so they can stop asking how to downgrade
Sent from my HTC Vision using XDA App
Sweet, now I can finally get my phone replaced. Accidentally blew out my LED and was scared of asking for a new one for fear of being unable to root. Thanks for the peace of mind I'll be using this in a few days
Just some suggestions to avoid confusion when you run the command
Code:
adb shell cat /dev/msm_rotator
you should get the return of
Code:
/dev/msm_rotator: invalid length
you do not need to enter in this line.
Also after entering
Code:
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
or one like it and it fails (It should not) you need to reboot the phone between these attempts.
Thanks for writing the guide! We just posted the log lol
Late side note: I've recently read an article on how root exploits are not credited to their original inventors. Just letting everyone know that agrabren should be credited as well for his work with Fr3v0, and his willingness to help during the process
Thanks for the tips Cimer, I edited the post, hopefully that clarifies it a bit more.
I've been a quiet browser here on XDA for quite a while but I believe that was actually the first post I made =3 It took me a while to try to get it formatted... fluently / tried to make it easy to read and follow.
And hey, if it wasn't for you all posting the logs from #g2root, I would of never gotten my G2 back to being rooted. I think I had like 8 different pages open when I was doing it, reading the chat log, reviewing the pastebin data, et cetera. But it worked, after searching every day, the trick has been found.
On a side note, I picked the range "-start FAA90000 -end FFFFFFFF" because it appears that the exploit is most likely within that range. It was for yours "FBB47C00:1400", mine was "FBB4D600:A00", and a friend of mine was also an FBB*.
Does it work for the european desire Z ?
ilbeppez said:
Does it work for the european desire Z ?
Click to expand...
Click to collapse
Personally, I have no idea. I don't imagine it would hurt the phone any if you tried. I know you would have to change the version number (when using misc_version) to a different number, one that would be equivalent to the stock rom that came with the phone. As for the exploit itself, I don't see any harm it could do to try (though I'm no expert). Just be sure to reboot your phone after each attempt of using fre3vo.
ilbeppez said:
Does it work for the european desire Z ?
Click to expand...
Click to collapse
Give me a second, Guhl made a post about this...
http://forum.xda-developers.com/showpost.php?p=15825944&postcount=27
Should explain things for Desire Z users.
Cimer said:
Give me a second, Guhl made a post about this...
http://forum.xda-developers.com/showpost.php?p=15825944&postcount=27
Should explain things for Desire Z users.
Click to expand...
Click to collapse
Ok
thanks
Thank you. I have been searching for this.
Setherio, please divide a section for 2.3.3 DZ owners. the appropriate PC10IMG.zip for them is
http://www.multiupload.com/GH26HXLLES (md5 2ff42897cd27e0db425a2cf36c8bd078)
the mics_version command is: /data/local/tmp/misc_version -s 1.33.405.5
the push command is: adb push PC10IMG.zip /sdcard/
petarpLab said:
Setherio, please divide a section for 2.3.3 DZ owners. the appropriate PC10IMG.zip for them is
multiupload.com/GH26HXLLES (md5 2ff42897cd27e0db425a2cf36c8bd078)
the mics_version command is: /data/local/tmp/misc_version -s 1.33.405.5
the push command is: adb push PC10IMG.zip /sdcard/
Click to expand...
Click to collapse
Thanks for the information. I updated the guide.
thanks a lot
Incase anyone did not know already gfree is the best way to root after the downgrade...visionary bricks phones. You can find gfree in the xda wiki.
Sent from my HTC Vision using XDA App
Great guide. My first downgrade and I haven't bricked my phone
Thanks to all people that made it possible
Cimer said:
Incase anyone did not know already gfree is the best way to root after the downgrade...visionary bricks phones. You can find gfree in the xda wiki.
Sent from my HTC Vision using XDA App
Click to expand...
Click to collapse
So AMT is ok for rooting after downgrade?
This package contains:
- gfree
- gfree_verify
- Superuser
- Busybox
- flash_image
- psneuter
- root_psn
- misc_version
- GingerBreak APK
Click to expand...
Click to collapse
trzype said:
Great guide.
My first downgrade and I haven't bricked my phone
Thanks to all people that made it possible
Click to expand...
Click to collapse
Thank you Glad it helped you.
trzype said:
So AMT is ok for rooting after downgrade?
Click to expand...
Click to collapse
Yes. I downgraded and rooted, went ahead and installed Cyanogen nightly. As did a couple others I've talked to who have downgraded as well.
Used AMT. Got some error about 1.34 and "Double" but cliked Continue button anyway. Everything went fine.
Setherio said:
I downgraded and rooted, went ahead and installed Cyanogen nightly. As did a couple others I've talked to who have downgraded as well.
Click to expand...
Click to collapse
I'm going for Virtuous 2.0.0. Can't live without Sense UI
Thanks again
Should I rename the stock Rom to just PC10IMG before I push it to sd card or can I just put it on sd card before hand
Sent from my HTC Sensation 4G using XDA Premium App
Got it worked great thanks
Thank you so much worked like a charm - Peace
Hi all,
I appreciate this forum is cram packed with info, but for me as a newb...I can't see the woods for the trees :-(
I have a stock Orange D-HD ( A2.3.3 with sense 2.1 ) and basically just want to unlock it to use an O2 sim.
I have previously flashed WM6 cooked roms onto Kaisers / Hermes & Himyies so do understand the basic principle. And I grasp the basic point about rooting as I have flashed a Superpad device too.
http://forum.xda-developers.com/showthread.php?t=964996
So I started to follow the above tutorial thread and downloaded Visionary+ and S-OFF etc.
But even though I set USB root debugging, when I run Visionary+ to temp-root, my DHD just runs the triange message a few seconds and then just goes blank.
Is there an alternative way to root instead of visionary+ ???
Someone pls help me get past the first hurdle and root my device
Thanks
I got stuck too but...
Did u try ticking the 'root on startup or reboot' option? then restart. it may take a few goes, u'll probably notice Superuser has been installed then Temproot should happen next reboot. Permroot's the same, may take a few times to stick. To test if ur root has worked try installing Titanium Backup from market, u'll need it once ur rooted.
If you have a Stock HTC with Android 2.3.3 you need to downgrade the software version first before you can use visionary.
[GUIDE] How to downgrade 1.7x/1.8x/2.x to 1.32.405.6
ahh ok, will do.
None of this was mentioned in the guide link I mentioned in the original post. It would be worthwhile for that guide to be modded to reflect the fact a downgrade is needed.
"Open up a cmd and go to Downgrade folder"...is this done on the PC or the phone??? don't understand...
hey, have you created a goldcard mentioned in section 1 of the tutorial?
ermm,, nope
I wasn't sure I needed to as it seemed to be related to branded phones. Mine is locked to orange at present....but it doesn't have an orange splash screen or any orange logo on the phone casing. Thought if my 'build' number had '405' in the middle...that this meant I didn't need a goldcard creating...
wrong or right peeps??
ebod said:
None of this was mentioned in the guide link I mentioned in the original post.
Click to expand...
Click to collapse
Ehem......
wid0w said:
If your Desire HD is running stock firmware 1.7x, please check this guide in order to downgrade:
http://forum.xda-developers.com/showthread.php?t=905003
Click to expand...
Click to collapse
and
wid0w said:
Basic Setup
...
- Desire HD with lower than 1.7x stock ROM
...
Click to expand...
Click to collapse
I think the guide captures every detail.
for3st said:
Ehem......
and
I think the guide captures every detail.
Click to expand...
Click to collapse
All very well if you understand what a rom is. My software page is full of 2.50 , 2.6 type numbers and nothing below 1.7....hence my comment.
Also, I've made a goldcard out of a spare 1gb sd, and copied PD98img.zip to it. So for the next bit....do I now put that goldcard in my HTC and connect to the PC whilst set in USB debugging enabled mode.
Then do I put this lot below into the win-xp pc 'run' box line by line or one whole lump?:-
adb push misc_version /data/local/tmp
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
ebod said:
All very well if you understand what a rom is. My software page is full of 2.50 , 2.6 type numbers and nothing below 1.7....hence my comment.
Also, I've made a goldcard out of a spare 1gb sd, and copied PD98img.zip to it. So for the next bit....do I now put that goldcard in my HTC and connect to the PC whilst set in USB debugging enabled mode.
Then do I put this lot below into the win-xp pc 'run' box line by line or one whole lump?:-
adb push misc_version /data/local/tmp
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
Click to expand...
Click to collapse
one by one......
I dont use Visionary+ , it just dont work in my phone,end me up using manual method. Plus S-off and Engineering S-off.
First of all, DOWNGRADE UR PHONE TO 1.32
Gaining Radio S-OFF:
This method will get you the Radio S-OFF flag while SIM-unlocking it and setting up SuperCID, which means
1. This method will root your phone for the process if it isn’t already rooted. If you just want to permanently root your phone
2. Make sure you have ADB installed on your computer. Also, if you have previously installed VISIONary on your phone in order to root it, uninstall it first before proceeding.
3. Download Desire HD S-OFF Toolkit and unzip its contents to your computer. Put it in your adb folder
4. Enable USB Debugging on your phone from Settings > Applications > Development.
5. Connect your phone to your computer via USB.
6. Launch a Command Prompt/Terminal window on your computer, navigate to the folder where you extracted the files in Step 3 and enter the following commandsne by one , press enter after each line
adb push su /sdcard/su
adb push Superuser.apk /sdcard/Superuser.apk
adb push rage /data/local/tmp/rage
adb push busybox /data/local/tmp/busybox
adb push root /data/local/tmp/root
adb push gfree /data/local
adb shell chmod 0755 /data/local/tmp/*
adb shell chmod 777 /data/local/gfree
7. Install Terminal Emulator app on your phone from the Android Market and launch it.
8. Enter the following command in Terminal Emulator on your phone:
/data/local/tmp/rage
9. In a while, you will see the output “Forked #### childs”. Now press ‘Menu’ and tap ‘Reset Term’ to exit Terminal Emulator.
10. Launch Terminal Emulator again. You will notice that it force-closes. Don’t worry and just launch it again, and you should have a root shell indicated by the # prompt instead of $.
11. Now enter the following commands in Terminal Emulator:
/data/local/gfree -f
sync
/data/local/tmp/root
sync
If you get a ‘mkdir: /system/xbin already exists’ error during the process, ignore it and proceed.
12. Wait patiently while the process finishes. Once it is complete, reboot your phone.
You should now have Radio S-OFF, SIM-unlock and SuperCID all set on your phone. If you just want to install ClockworkMod recovery and custom ROMs etc., you are all good to go and do not need to gain Engineering S-OFF. You may simply install ClockworkMod Recovery, find a custom ROM of your choice and flash it to your phone from recovery.
Gaining Engineering S-OFF:
You should attempt to gain Engineering S-OFF if and only if you want to gain absolute access to your Desire HD including the ability to flash a radio or edit all your phone’s partitions the way you want. If you are not absolutely sure what you are about to do, we recommend that you do NOT proceed.
1. Make sure you have already gained radio S-OFF by following the above-mentioned steps.
2. Download the Engineering HBoot for HTC Desire HD and extract the contents of the zip files.put in adb folder
3. Enable USB debugging (if not already enabled) and connect your phone to the computer.
4. On your computer, launch Command Prompt/Terminal, navigate to the folder where you extracted the files in Step 2 and enter these commands:
adb push hboot-eng.img /data/local
5. Finally, launch Terminal Emulator on your phone and enter these commands, being EXTREMELY careful not to make any mistake here:
su
dd if=/data/local/hboot-eng.img of=/dev/block/mmcblk0p18
Make sure to allow when Super User access is requested. Wait till the process is finished and you’re done!
You now have the Engineering S-OFF HBoot installed and with this, you have absolute control over your HTC Desire HD. You can now flash radios of your choice to your phone and have access to modify all its partitions as well as unbrick it in certain circumstances where no other method would revive your device.
Click to expand...
Click to collapse
rohithksaj said:
one by one......
Click to expand...
Click to collapse
...but I get lost here : "•Open up a cmd and go to Downgrade folder, execute commands:"i.e. I don't understand a 'cmd' is an where I open it from..
EDIT : okay finally at 1.32 & rooted ( yey!)
wanting to check whether the S-OFF info is right but having a mare trying to get bootloader screen to stop from tripping to HBOOT and running the PD98IMG ( even though I took out the goldcard ).
Is there some specific combination to hold vol-down and power for a set number of seconds? I've tried 10+ times and can't stop it going onto the HBOOT update thingy :-(
Ok folks...back to my painful rooting excercise
I'm still in this thread
http://forum.xda-developers.com/showthread.php?t=964996
..trying to eastablish whether or not my S-OFF info is correct before proceeding further. The thread says :-
"Testing Eng S-off and Radio S-OFF
1. Power Down Your Device
2. Go to Bootloader
3. If it says Ace PVT ENG S-OFF your phone is ENG S-OFF.
4. use Volume down to get to system info and tap power button to select
5. check CID for CID-11111111 (if you have this all is done 100%)
6. Reboot
"
how can I check my "CID-11111111" info ? where is it displayed?
DOH STUPID STUPID STUPID!!!!!
Before I made my goldcard I put a copy of pd98img.zip on my SD card....and although I took out the goldcard...when I put the normal SD back in, I neglected to recall it had a copy of pd98img.zip still sat on it.
Thats why I couldn't access bootloader.
Anyways, I have the right S-OFF info so its now onwards the next step
Hey guys,
Im trying to downgrade my phone but im stuck at the line where you downgrade the version "/data/local/tmp/misc_version -s 1.00.000.0". After typing adb shell i get the "#" sign but then it immediately goes to c:\androidsdk\tools folder and when i try to type the line im stuck at it says no path exsists.
I dont know if it matters but also after typing the line" /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF " it does take me a few tries of typing adb shell before it actually connects and show the "#" sign
all the other commands have worked fine though
So is there something that im doing wrong or could do differently?
Thanks for the help
If it falls out of the shell - there's no point in entering the instruction. Try to execute it and make it stick in the shell, showing "#" sign when you type.
In the worst case, connect the commands and write "adb shell /data/local/tmp/misc_version -s 1.00.000.0" as a single line.
Thanks a lot but I realized that my default connection type was set to disk drive and after the last line that worked it actually disconnects the phobe
I'm successfully rooted now and love it
Sent from my HTC Glacier using XDA
I've tried to downgrade my HTC DZ but I can't get pass the exploit to gain temp root.
I can't pass this:
PHP:
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
I've tried every set (give from strawmetals Guide) and of course I rebooted every time before trying a new set.
Infos:
Android Version: 2.3.3.
Sense: 2.1
Software-Number: 2.42.405.4
I hope anyone can help me with this
The guide at wiki.cyanogenmod.com is foolproof.
Sent from Spaceball One.
or there is a couple of other exploits you can use, zergRush and tacoroot both work
-Nipqer
Have you tried changing the adressess, if I remember right, it's expected (!) that the exploit will work between those two, but not necessarily. Also, what output do you get?
If you have successfully unlocked your HTC One M7 Bootloader, you will see the following text at the top of your Bootloader screen:
Code:
*** UNLOCKED ***
And, if you installed a custom recovery, it will change to the following:
Code:
*** TAMPERED ***
*** UNLOCKED ***
You can get rid of your TAMPERED text and/or change your LOCKED, RELOCKED or UNLOCKED status. This guide applies to all HTC One M7 Hboot versions.
Minimum requirements:
1. Your HTC One must be S-OFF.
2. Your device must be rooted.
There are different ways of achieving the same results, but this is the easiest (and safest) method using a tool called revone: http://forum.xda-developers.com/showthread.php?t=2314582. Note that revone is primarily intended to be used to S-OFF but it also has some very useful additional features, which are exactly what we're going to use here. You will find all the commands in the original revone thread but if you're having difficulties, then this guide for "noobs" should be helpful.
Stepwise procedure:
1. You need adb and fastboot. Download both in a single package: http://goo.gl/T6InE - credits to mike1986. Extract the folder "mini-sdk" and place it at C:/
2. Download revone: http://revolutionary.io/revone. Place it in your adb and fastboot folder, for example, C:/mini-sdk/
3. Connect your HTC One to your PC via USB cable. Boot up your HTC One and leave it on its homescreen. Test if the USB connection is working by clicking on the Start button > Run > type "CMD". This will open the Command Prompt window. From there, type:
Code:
cd c:\
cd mini-sdk
adb devices
You should see the serial number of your phone to confirm successful adb connection. This is what i get:
Code:
C:\Documents and Settings\Administrator>cd c:\
C:\>cd mini-sdk
C:\mini-sdk>adb devices
List of devices attached
FA36******** device
4. Now, you need to copy revone to your phone. In the same Command Prompt window, type:
Code:
adb push revone /data/local/tmp/
Here is my log to confirm that revone has been successfully copied:
Code:
C:\mini-sdk>adb push revone /data/local/tmp/
2893 KB/s (648208 bytes in 0.218s)
5. Now, open an adb shell by simply typing:
Code:
adb shell
You should see the following:
Code:
C:\mini-sdk>adb shell
[email protected]:/ #
If you see the $ symbol instead of the # symbol, type su (your HTC One needs to be rooted otherwise this won't work).
6. Use the Command Prompt to move to the folder where you placed revone on your phone and and set new permissions:
Code:
cd /data/local/tmp
chmod 755 revone
Here is what it looks like on my Command Prompt window:
Code:
[email protected]:/ # cd /data/local/tmp
cd /data/local/tmp
[email protected]:/data/local/tmp # chmod 755 revone
chmod 755 revone
7. Now, you can finally remove the TAMPERED text and switch between LOCKED, RELOCKED or UNLOCKED. Following from above, if you want to get rid of the TAMPERED text, type:
Code:
./revone -t
If you want to set the Bootloader as LOCKED, type:
Code:
./revone -l
If you want to set the Bootloader as RELOCKED, type:
Code:
./revone -r
If you want to set the Bootloader as UNLOCKED, type:
Code:
./revone -u
After you've made the changes according to what you want, you can now reboot the device and check if the changes have been applied. Type:
Code:
exit
exit
adb reboot bootloader
You should now be in the Bootloader menu and you can confirm the changes.
If this was useful, just click on the THANKS button!
tried it but stuck here
c:\sdk>adb push revone /data/local/tmp/
then it just sits there any ideas?
nathlynn22 said:
tried it but stuck here
c:\sdk>adb push revone /data/local/tmp/
then it just sits there any ideas?
Click to expand...
Click to collapse
Make sure your phone is on its homescreen (not bootloader or fastboot). Did you follow step 2 and 3? Did you see your serial no. after typing adb devices?
electronical said:
Make sure your phone is on its homescreen (not bootloader or fastboot). Did you follow step 2 and 3? Did you see your serial no. after typing adb devices?
Click to expand...
Click to collapse
yeah mate followed it all just in the end tried couple more times as revone thread said it can crash ETC SO ALL SORTED NOW THANKS. sorry about useless post
Hi, I havev a problem during the procedure :
"You should see the following:
Code:
C:\mini-sdk>adb shell
[email protected]:/ #
If you see the $ symbol instead of the # symbol, type su (your HTC One needs to be rooted otherwise this won't work)."
I see the $ symbol, but when I type su, nothing happend, error " "su"is not recognized as an internal or external command"
I need to reflash a modded recovery to root device ?
I want to return 100% stock
EDIT : the response was : YES ! thanks for your work !
@electronical
thanks for this very easy to understand tutorial buddy
... Note that revone is primarily intended to be used to S-OFF (applicable only if you have Hboot 1.44)...
Click to expand...
Click to collapse
So does that apply only to S-OFF'ing or to everything?
EDIT: I found another method and I successfully reset the TAMPERED flag
worked perfectly. thanks for the great guide :highfive:
commencal661 said:
So does that apply only to S-OFF'ing or to everything?
EDIT: I found another method and I successfully reset the TAMPERED flag
Click to expand...
Click to collapse
By "... Note that revone is primarily intended to be used to S-OFF (applicable only if you have Hboot 1.44)..." what i meant is that you can use revone to S-OFF only if the device has Hboot 1.44, otherwise Rumrunner is required in order to S-OFF.
It's simple enough, but to avoid the remote possibility of anyone else having the same confusion, i have edited that bit of info out. However, it's important to keep in mind that you can't S-OFF with revone if your device has Hboot 1.54 or above. But if your device is already S-OFF, you can use revone to remove the tampered flag and lock/relock/unlock, irrespective of your Hboot version.
Perfect!! Great and simple to follow tutorial.
Thanks!
electronical said:
If you have successfully unlocked your HTC One M7 Bootloader, you will see the following text at the top of your Bootloader:
Code:
*** UNLOCKED ***
And, if you installed a custom recovery, it will change to the following:
Code:
*** TAMPERED ***
*** UNLOCKED ***
You can get rid of your TAMPERED text and/or change your LOCKED, RELOCKED or UNLOCKED status. This guide applies to all HTC One M7 Hboot versions.
Minimum requirements:
1. Your HTC One must be S-OFF.
2. Your device must be rooted.
There are different ways of achieving the same results, but this is the easiest method using a tool called revone: http://forum.xda-developers.com/showthread.php?t=2314582. Note that revone is primarily intended to be used to S-OFF but it also has some very useful additional features, which are exactly what we're going to use here. You will find all the commands in the original revone thread but if you're having difficulties, then this guide for "noobs" should be helpful.
Stepwise procedure:
1. You need adb and fastboot. Download both in a single package: http://goo.gl/T6InE - credits to mike1986. Extract the folder "mini-sdk" and place it at C:/
2. Download revone: http://revolutionary.io/revone. Place it in your adb and fastboot folder, for example, C:/mini-sdk/
3. Connect your HTC One to your PC via USB cable. Boot up your HTC One and leave it on its homescreen. Test if the USB connection is working by clicking on the Start button > Run > type "CMD". This will open the Command Prompt window. From there, type:
Code:
cd c:\
cd mini-sdk
adb devices
You should get the serial number of your phone. This is what i get:
Code:
C:\Documents and Settings\Administrator>cd c:\
C:\>cd mini-sdk
C:\mini-sdk>adb devices
List of devices attached
FA36******** device
4. Now, you need to copy revone to your phone. In the same Command Prompt window, type:
Code:
adb push revone /data/local/tmp/
Here is my log to confirm that revone has been successfully copied:
Code:
C:\mini-sdk>adb push revone /data/local/tmp/
2893 KB/s (648208 bytes in 0.218s)
5. Now, open an adb shell by simply typing:
Code:
adb shell
You should see the following:
Code:
C:\mini-sdk>adb shell
[email protected]:/ #
If you see the $ symbol instead of the # symbol, type su (your HTC One needs to be rooted otherwise this won't work).
6. Use the Command Prompt to move to the folder where you placed revone on your phone and and set new permissions:
Code:
cd /data/local/tmp
chmod 755 revone
Here is what it looks like on my Command Prompt window:
Code:
[email protected]:/ # cd /data/local/tmp
cd /data/local/tmp
[email protected]:/data/local/tmp # chmod 755 revone
chmod 755 revone
7. Now, you can finally remove the TAMPERED text and switch between LOCKED, RELOCKED or UNLOCKED. Following from above, if you want to get rid of the TAMPERED text, type:
Code:
./revone -t
If you want to set the Bootloader as LOCKED, type:
Code:
./revone -l
If you want to set the Bootloader as RELOCKED, type:
Code:
./revone -r
If you want to set the Bootloader as UNLOCKED, type:
Code:
./revone -u
After you've made the changes according to what you want, you can now reboot the device and check to see if the changes have been applied. Type:
Code:
exit
exit
adb reboot bootloader
You should now be in the Bootloader and you can confirm the changes.
If this was useful, just click on the THANKS button!
Click to expand...
Click to collapse
This is very useful and it works. I am able to S-OFF (Windows 8, 32Bits) and removed the "tempered" and change "unlocked" to "locked" just like original. Crushalot, thanks for this, but can you point out how I can remove the "red descriptions (the development purpose...)" on boot screen and the Tell HTC, please?
Wait to hear from you
Hi there, first of all amazing guide, I've been trying to remove all flags but seemed way too hard to do it , but as easy as it may be I'm kinda stuck here. When I run the adb device command I don't get anything, it doesn't find any device :S any idea what's going on? Also, I'm trying to get my phone to stock for warranty purpose after I've done this if I have available the 4.2 or 4.3 update (I don't remember which one) and I run it through TWRP will this unroot the phone?
THANX http://forum.xda-developers.com/images/smilies/laugh.gif
Ricky-Lim said:
This is very useful and it works. I am able to S-OFF (Windows 8, 32Bits) and removed the "tempered" and change "unlocked" to "locked" just like original. Crushalot, thanks for this, but can you point out how I can remove the "red descriptions (the development purpose...)" on boot screen and the Tell HTC, please?
Wait to hear from you
Click to expand...
Click to collapse
Removing the red banner: http://rumrunner.us/hboots/
Tamiis said:
Hi there, first of all amazing guide, I've been trying to remove all flags but seemed way too hard to do it , but as easy as it may be I'm kinda stuck here. When I run the adb device command I don't get anything, it doesn't find any device :S any idea what's going on? Also, I'm trying to get my phone to stock for warranty purpose after I've done this if I have available the 4.2 or 4.3 update (I don't remember which one) and I run it through TWRP will this unroot the phone?
Click to expand...
Click to collapse
See link above for removing red banner. To go back to 100% stock: http://forum.xda-developers.com/showthread.php?t=2358738
electronical said:
Removing the red banner: http://rumrunner.us/hboots/
See link above for removing red banner. To go back to 100% stock: http://forum.xda-developers.com/showthread.php?t=2358738
Click to expand...
Click to collapse
Hi, I used the rumrunner hboot. Red banner removed. OK
I want to go back to 100% stock but I don't want to brick my device!!
I'm in 3.62.401.1 stock rom with the rumrunner hboot.
thanks
Thanks mate!
The "-s 0 -t" from revones description really had me disoriented, didn't seem to work, but your commands worked perfectly! Thanks a lot!!
Hi i followed the commands, I can get rid of the tampered flag but I get an error when I try ./revone -l
[email protected]:/data/local/tmp # ./revone -l
./revone -l
revone v0.2.1
revone failed (error code = -1)
Any idea?
If I am s-off with rumrunner... Can I use this guide to remove tampered? Or is only for renove s-off phones?
Sent from my HTC One using Tapatalk 4
Can this be done in Terminal Emulator?
Sent from my Nexus 7 using xda app-developers app
I s-offed a while ago with revone. I need to send in for warranty. Just looking to get unlocked removed. I already flashed stock recovery. Do I need to have a custom recovery to run -l command?
If so, can I still flash stock recovery after I relock the device?
what is it?
commencal661 said:
So does that apply only to S-OFF'ing or to everything?
EDIT: I found another method and I successfully reset the TAMPERED flag
Click to expand...
Click to collapse
what is the another method bro? thanks