S-Off with rEVOlution - Thunderbolt Android Development

Alright, just bought a Thunderbolt as of Friday night and didn't get to root it until 11AM Saturday due to random issues (It was just a pain between ADB not wanting to work, EasyRoot freezing, etc.) so I figured I'd post this method.
All credit goes to Saboture for writing his guide for the EVO using the same method and for helping me.
Please note: This method does NOT root your phone, but unlocks your bootloader (sets flag to S-OFF) and flashes a recovery so that you can simply install a rooted ROM. Do this at your own risk! I am not responsible for any bricked phones or issues, all that good jazz. Also, only Windows and Linux are supported (At this time.)
Step one: Install HTC Fastboot drivers (The utility will not work if you have HTC Sync installed.) Link: http://downloads.unrevoked.com/HTCDriver3.0.0.007.exe
Step two: As always, make sure your phone is at least charged to 80%, but 100% is fully recommended. Plug your phone into your computer and set to Charge Mode.
Step three: Go to http://revolutionary.io and scroll down and click the proper download link. The file will start to download (Or you will get a prompt depending on browser) Followed by a Beta Key menu opening on the website. From here, input the basic information (Serial Number, H-Boot version, etc.) Once this is done, you will get a beta key.
Step four: Once done downloading Revolutionary-0.4, extract the contents of the folder and run .exe
Step five: If drivers are installed and your phone is properly connected, follow the onscreen instructions (and install the custom recovery for ease of use) After a full reboot sequence...done! Your S flag is now set to off!
Now you've unlocked your phone, simply flash a ROM in recovery (Following proper methods such as loading radios and all that goodness.)
Hope this helps those who are as frustrated as I was!

kekeke. Good write up man. Hopefully this will do as you hope and save some others the trouble.

lol nice post... if you would would have looked at the top of the page you might have saved yourself some time rooting and also writting this thread
http://forum.xda-developers.com/showthread.php?t=996616
see the big red letters at the top of the post?
OUTDATED
Augest 14 2011
Unrevoked and AlpharevX released a new version of their http://revolutionary.io/ tool, use it, and preserve your data.

Related

HTC ARIA 2.2.2 downgraded and rooted

HTC ARIA FIX FOR THOSE THAT UPGRADED TO 2.2.2
By kibby Ndemo
ALPHAREVX
Requirements:
• ADB Installed on your system. See our guide on what is ADB and how to install it.
• HTC Sync software installed in order to download necessary drivers. (Once the drivers are installed, remove HTC Sync from your system.)
• AlphaRevX.
Instructions:
1. To begin, make sure USB debugging is enabled in you device under Settings > Applications > Development.
2. Download AlphaRevX and extract the files to a folder. (A form will show up on the download page, keep it opened.)
3. Connect your device to the system and run Aplharev.exe.
4. You will be asked to enter a Beta key at this stage. Simple copy the serial number that shows up in the brackets in the prompt as shown in the screenshot above, and paste it into the form on the download page.
5. Hit the Generate Key on that form and once you have the key, enter it into the prompt to see a Beta key accepted message.
6. The application will start the S-Off procedure and should complete in around 90 seconds. Incase it does not start, wait fro around 15 minutes and re-do the whole process.
After doing the above procedure downgrade to HTC aria 2.1 then you be able to root you aria once more and flash any files. Please donate to alpharev too they made it possible.you can find the old 2.1 ruu in xda
PS I have done it and it works.
Man talk about timing. My fr008 aria bit the dust and I had to get another via ins. well it came factory with 2.2.2. I was pissed off about that and started looking for a fix and found one here. I will have to wait till tomorrow or Monday to try it because the unit they sent me has a bad ear piece and they are sending a new one but I will post my results when I get my new, new phone. Thanks for the work on this.
No link to file do I need to search XDA or did you forget to attach it.
tbone22 said:
Man talk about timing. My fr008 aria bit the dust and I had to get another via ins. well it came factory with 2.2.2. I was pissed off about that and started looking for a fix and found one here. I will have to wait till tomorrow or Monday to try it because the unit they sent me has a bad ear piece and they are sending a new one but I will post my results when I get my new, new phone. Thanks for the work on this.
No link to file do I need to search XDA or did you forget to attach it.
Click to expand...
Click to collapse
it's all over these forums
www.alpharev.nl/x/beta
ferariboy said:
HTC ARIA FIX FOR THOSE THAT UPGRADED TO 2.2.2
By kibby Ndemo
ALPHAREVX
Requirements:
• ADB Installed on your system. See our guide on what is ADB and how to install it.
• HTC Sync software installed in order to download necessary drivers. (Once the drivers are installed, remove HTC Sync from your system.)
• AlphaRevX.
Instructions:
1. To begin, make sure USB debugging is enabled in you device under Settings > Applications > Development.
2. Download AlphaRevX and extract the files to a folder. (A form will show up on the download page, keep it opened.)
3. Connect your device to the system and run Aplharev.exe.
4. You will be asked to enter a Beta key at this stage. Simple copy the serial number that shows up in the brackets in the prompt as shown in the screenshot above, and paste it into the form on the download page.
5. Hit the Generate Key on that form and once you have the key, enter it into the prompt to see a Beta key accepted message.
6. The application will start the S-Off procedure and should complete in around 90 seconds. Incase it does not start, wait fro around 15 minutes and re-do the whole process.
After doing the above procedure downgrade to HTC aria 2.1 then you be able to root you aria once more and flash any files. Please donate to alpharev too they made it possible.you can find the old 2.1 ruu in xda
PS I have done it and it works.
Click to expand...
Click to collapse
Why would anyone want to downgrade to 2.1 after having S-OFF!? (Rhetorical question). Once you have S-OFF, you can flash superuser, clockworkmod and custom roms without needing to downgrade to 2.1 then rooting again. Also attn1 already made a thread here on what to do after AlpharevX: http://forum.xda-developers.com/showthread.php?t=1122694.
HTC ARIA
He is very right i jumped the gun too soon
ferariboy said:
Try flashing the htc aria after s-off then that will answer your question please do research before bloging something you dont have an idea about
Click to expand...
Click to collapse
fastboot?
characters
ferariboy said:
Try flashing the htc aria after s-off then that will answer your question please do research before bloging something you dont have an idea about
Click to expand...
Click to collapse
Uh no, Theonew is exactly right. Not only is he right, but he gave a link showing exactly what he was talking about. In an ultimate showing of irony, you blasted someone for not doing his research when it's actually you who hasn't done his research.
Once you have S-OFF you don't need to use the 2.1 RUU or Unrevoked. It's a waste of time. You can push Clockwork recovery to your phone via fastboot, then flash whatever you want. It takes literally 2 seconds to flash Clockwork in this manner after you have S-OFF.
ferariboy said:
HTC ARIA FIX FOR THOSE THAT UPGRADED TO 2.2.2
By kibby Ndemo
ALPHAREVX
Requirements:
• ADB Installed on your system. See our guide on what is ADB and how to install it.
• HTC Sync software installed in order to download necessary drivers. (Once the drivers are installed, remove HTC Sync from your system.)
• AlphaRevX.
Instructions:
1. To begin, make sure USB debugging is enabled in you device under Settings > Applications > Development.
2. Download AlphaRevX and extract the files to a folder. (A form will show up on the download page, keep it opened.)
3. Connect your device to the system and run Aplharev.exe.
4. You will be asked to enter a Beta key at this stage. Simple copy the serial number that shows up in the brackets in the prompt as shown in the screenshot above, and paste it into the form on the download page.
5. Hit the Generate Key on that form and once you have the key, enter it into the prompt to see a Beta key accepted message.
6. The application will start the S-Off procedure and should complete in around 90 seconds. Incase it does not start, wait fro around 15 minutes and re-do the whole process.
After doing the above procedure downgrade to HTC aria 2.1 then you be able to root you aria once more and flash any files. Please donate to alpharev too they made it possible.you can find the old 2.1 ruu in xda
PS I have done it and it works.
Click to expand...
Click to collapse
Even though I switched to the atrix, I kept my aria just for this
Sent from my "Emo" rooted Motorola Atrix! Emo Thinks Possible™
nice share M8, even if it was copied directly from Addictivetips.com
im interested to know other peoples experience with this... all good i hope
only for curiosity, i didnt upgrade to 2.2 OTA
zedbra said:
nice share M8, even if it was copied directly from Addictivetips.com
im interested to know other peoples experience with this... all good i hope
only for curiosity, i didnt upgrade to 2.2 OTA
Click to expand...
Click to collapse
I really didn't have any need to either. I was perfectly happy with a fully rooted Aria running CM 7.0.3, but curiosity got the best of me, plus I had just ordered a HTC Incredible S, so I decided to 'practice' the AlphaRevX process on my Aria.
Installed the Froyo 2.2.2 update and then ran AlphaRevX and it went without a hitch. Got CWM reinstalled and superuser reinstalled and it was a really painless.
Nice!! thanks for the feedback M8
not to stray off topic, but now with S-Off achieved is it possible to downgrade HBoot with .zip file?? or is this sticky which can only be done using a box??
i may upgrade anyway just for kicks, but it would be great if we could downgrade HBoot again too
zedbra said:
Nice!! thanks for the feedback M8
not to stray off topic, but now with S-Off achieved is it possible to downgrade HBoot with .zip file?? or is this sticky which can only be done using a box??
i may upgrade anyway just for kicks, but it would be great if we could downgrade HBoot again too
Click to expand...
Click to collapse
AlphaRevX is able to overwrite HBOOT 1.02 and replace it with their own that has S-OFF. It looks like they set the HBOOT version very high, so that 'downgrading' with say a RUU will fail. So if you find a way to replace this special HBOOT, you will loose S-OFF.
yah after reading a bit i see the Alpharev hack is a pached HBOOT. so i believe you are correct, removing it will make it S-On again. too bad
Theonew said:
Why would anyone want to downgrade to 2.1 after having S-OFF!? (Rhetorical question). Once you have S-OFF, you can flash superuser, clockworkmod and custom roms without needing to downgrade to 2.1 then rooting again. Also attn1 already made a thread here on what to do after AlpharevX: http://forum.xda-developers.com/showthread.php?t=1122694.
Click to expand...
Click to collapse
This is what I want to do, but I need some help.
After using AlpharevX, I'll get S-OFF. Then, I just want to root the phone and be able to do a nandroid backup. I don't want to flash any ROM at this time.
The link you posted to does not have a clockworkmod listed for Aria. Which one do I use?
i would use THIS One. finally Clockwork without the recovery screen during charging
once you aquire S-off you can install Clockwork using Android Flasher
amlothi said:
This is what I want to do, but I need some help.
After using AlpharevX, I'll get S-OFF. Then, I just want to root the phone and be able to do a nandroid backup. I don't want to flash any ROM at this time.
The link you posted to does not have a clockworkmod listed for Aria. Which one do I use?
Click to expand...
Click to collapse
It does have it listed for Aria. The Aria is codenamed as Liberty. It's ClockworkMod is here: http://forum.xda-developers.com/attachment.php?attachmentid=591945&d=1305031790. You can get android flasher from here: http://forum.xda-developers.com/showthread.php?t=794638. Unzip it, run it, select recovery at the side and click begin (Your phone will go into fastboot), find recovery.img (extracted from ClockworkMod), select it, click begin, and your done. You now have ClockworkMod 2.5.0.1 installed. To root, just go here: http://forum.xda-developers.com/showthread.php?t=1122694 and follow the "To Root" steps and then you will be rooted. To do the nandroid backup, just start ClockworkMod (Instructions in the previous link - "How to start ClockworkMod") and select nandroid.

[Q] Alternate methods of migration from G2 Hboot to DZ Hboot

Alright here is the deal. I've noticed a new requirement popping up lately with a lot of Sense 3 roms requiring the DZ Hboot. However, the method for doing so on the Virtuous ROM website requires the use of ADB, something that I have long had difficulty understanding how to properly utilize. As such, I've tried to find alternative ways of getting things done without the use of ADB.
This being said I've been puzzling lately if I can take the PC10IMG.zip off of the Virtuous migration instructions, drop it onto root of my SD card, flash it via CWM (or do i need to do this in bootloader?), then load whatever nandroid I had previously saved. It looks to me that this is just what you're doing with the ADB guide but remotely. Am I correct in this assumption?
So here is my plan.
1: Drop PC10IMG.zip onto root.
2: Reboot into bootloader
3: Run Fastboot (which I assume tries to flash any .zip called PC10img
4: At this point I start to run into questions. Will the phone be hug on the HTC screen as there is nothing installed? Will I have to use ADB to get back into recovery, or can I just pull the battery and power back on holding vol-down?
Edit: Right also I've seen this method posted in the Honeysense thread.
1. Download the PC10IMG.zip from the link above
2. Place it on the root of your SD
3. Boot into Bootloader
4. Choose the appropriate options
5. Remove the PC10IMG from the root, or else you cant boot into clockwork mod.
BTW, THIS ALSO CHANGES THE RADIO, SO YOU WILL HAVE TO FLASH A DIFFERENT RADIO
Click to expand...
Click to collapse
Several questions:
What are "appropriate options" (just imagine that I'm a gibbering retard and need to be shown how to pee every 2 hours), and also what other radios are there? Where do I get them? Can I flash them directly via CWM as a zip file? How do I remove the PC10IMG from the root of my SD without being able to access a file explorer of some kind?
I'm afraid I'm moving in the morning and may not be able to respond for a couple days, but if anyone has explored alternate methods of getting this other Hboot (I would like to try out some Sense3 roms, I've heard good things) onto the G2, that would be super if you could tell me how you did it in excruciating detail.
Edit 2: Well somehow I managed by the grace of the internet gods to finally get ADB to actually work and be recognized as installed on my computer. Command prompt shows my phone serial as being plugged in and everything so I guess this request is somewhat moot as despite my general need for having my hand held when doing new and scary stuff with my phone, I should be able to follow the guide posted on virtuousrom.com

[GUIDE] Simplest way to root your desire z

First downgrade your firmware version to 1.34.405.5 or below, you can do this by copying 1.34.405.5_PC10IMG.zip which you can download from here and rename it to "PC10IMG.zip".
Then boot into bootloader, you can do this through adb by typing "adb reboot bootloader" or you can just power off your phone, pull out your battery and then restarting it with both power button and volume down button pressed together.
Make sure you have enabled USB debugging in your phone.
It will automatically detect the image and will install it on your phone.
Now fill in your information and let your phone get started for the first time.
Now follow this guide:
Your phone is rooted by now.
Download ROM manager and flash clockworkmod recovery.
Now your are good to go.
Hit the thanks button if you find my post useful.
You can download the android sdk and g2_root from the following links.
Android sdk is needed for adb.
Android SDK:
- http://developer.android.com/sdk/index.html
G2 Root (Pack
- http://www.mediafire.com/?jmdqt1z03msaybl
Remember to turn off your pc antivirus before doing this because it may detect rage as a virus and won't allow you to run it.
This guide is completely unneccessary, and also lacking.
You cannot just do a straight downgrade to 1.34, you need to temp-root and modify your misc partition first.
Also, if you're gonna bother using adb a little, you may as well run everything in cmd/terminal, as you can copy/paste instead of having to type the commands onto the phone.
-Nipqer
Nipqer said:
This guide is completely unneccessary, and also lacking.
You cannot just do a straight downgrade to 1.34, you need to temp-root and modify your misc partition first.
Also, if you're gonna bother using adb a little, you may as well run everything in cmd/terminal, as you can copy/paste instead of having to type the commands onto the phone.
-Nipqer
Click to expand...
Click to collapse
Someone asked for a tutorial for noobs who just want to get their phone rooted without bothering about anything. That's why I posted it.
And the above mentioned tutorial is 100% working as far I have tested it.
ajhavery said:
Someone asked for a tutorial for noobs who just want to get their phone rooted without bothering about anything. That's why I posted it.
Click to expand...
Click to collapse
You took somebody else's YouTube video, and just added a couple lines of text, that are too vague, and would completely confuse a noob. I don't see how this in any way is better than:
http://forum.xda-developers.com/showthread.php?t=1178912
and
http://forum.xda-developers.com/wiki/index.php?title=HTC_Vision#Rooting_the_Vision_.28G2.2FDZ.29_and_DHD

{OUTDATED}[Guide][Stock ROM] The original non-Prime conversion thread

Update March 8 2017: As you can probably tell, this is very old. I have not worked on the device in several months and I have no idea if these methods are still safe. Please proceed with caution. I will be using one of these on a daily basis in the near future, so I probably will get back into development, and hope to release new content for the phone to help out the community. Please accept this as an official warning that the following is probably out of date and that you should be very careful should you decide to try it. The original post in it's entirety is spoilered below. You have been warned.
Update: A new update was released for the Prime model, V6.6, which replaces the preloader and completely breaks SPFT. If you unlocked your bootloader (so you can use fastboot) in any capacity before taking that update, there may be hope for you yet, but as of right now V6.6 is unsupported. Update: If you used this method to safely* take* the V6.6* update*, this will still work.
Update: I just checked the stats, and this has been downloaded more than 3 thousand times. I never thought my humble little conversion guide would help out so many people. I have also added a new mirror at [REDACTED], so anyone in North America who was having trouble with the Europe mirror, give that one a shot. It should be faster! I have updated all links in the guide to use the new North America mirror, and added a separate Europe mirror link after each link.
Hello! This is a tutorial for converting the Amazon Prime Edition BLU R1 HD to the OEM BLU version. This will overwrite the relevant partitions on your Amazon version of the device with the non-Amazon version. The physical model number on your device will still be a tell (obviously), but besides that, there will be no way to tell your device apart from the regular model! You can also use this method to convert non-Prime to Prime version, and undo OTAs or system modifications. This will restore a 100% out of the box image from either edition on your device.
This will work if you have software version...
V12
V6.1
V6.4
V6.5
SAFE V6.6 FROM THIS THREAD
This will NOT work on software version...
V6.6
The V6.6 update brought a new preloader that breaks our ability to use SPFT. I am currently working on ways to reverse the damage, but as of right now, there is no way to convert (or downgrade) from software V6.6
You can use this on any 16/2 R1 HD with supported software version to...
Convert to the non-Prime OEM version
Convert to the Prime version
Remove ads (via conversion to non-Prime version)
Unroot
Downgrade to V6.1
Downgrade to V12
Undo system alterations/tampers
Restore the system image to the way it was when you first opened the box
Unbrick a device (if bricked because of bad system/recovery/boot image)
There are a handful of reports about this working flawlessly on the 8/1 model as well. I have not personally tested this, so there is still some risk factor.
This only overwrites the system, recovery, and boot partitions. Any other partitions that have been altered will not be restored. In most cases, other partitions should not have been altered, so this is not a concern. I have a full system backup of all partitions, but there is currently evidence to suggest that it is not safe to flash all of the partitions, so I will not release that backup until more is known.
You *should* be able to safely pull this off without wiping your data. This does not require your phone to be rooted or have any other modifications. You can pull it straight out of the box and do this process! If your phone is rooted, you'll lose it. This will make your phone EXACTLY like the non-Prime version comes out of the box! You can also convert a non-Prime device (or a converted Prime device back) to a Prime device using the same method, but I'm not exactly sure why you would want to. I did this all on Linux, but the Windows should work fine too as long as you have drivers dealt with. If you don't have drivers dealt with, I'm not your guy. I'll just tell you to use a better operating system. You'll also need an archive program that can deal with tar.gz files, because that's how my computer zipped them.
And the standard disclaimer: If this bricks your phone or makes it become sentient and plot with other sentient phones to murder your entire family, it's not my fault. That's all on you, buddy.
Ok, without further ado, on to the tutorial!
First, you need these things. Some of the files are quire large, so it might take a while to download:
You'll need the latest version of Smart Phone Flash Tools, or SPFT for short. You can download that from this site, or from [REDACTED]. Please use the latest version for your OS.
You'll need to download the system image. If you're converting to the non-Prime version, [REDACTED]. If you're converting to the Prime version, [REDACTED]
You need the scatter file. This will tell SPFT where the partitions are. This is the same for both variants, so just download [REDACTED]
Once you have those things, you can start actually flashing your phone:
Power your phone completely OFF! This will not work if your phone is powered on. SPFT writes directly to the phone's memory, bypassing all security measures the phone has, so it requires the phone to be completely OFF to get safe and exclusive access to the memory. DO NOT PLUG IN YOUR PHONE YET!
Extract SPFT into a folder on your computer. If you can't figure out how to do that, please stop tinkering with your phone. It's only a matter of time until you break something.
Extract the system image into the same folder you put SPFT in. The three files (boot.img, recovery.img, system.img) should be in the same folder as all the other SPFT files, including the binaries.
Run SPFT. On Windows, simply double clicking the SPFT executable should do the trick. On Linux, you must run the flash_tool.sh script as root. Open a terminal emulator, cd to the SPFT folder, and run `sudo ./flash_tool.sh`. If you recieve an error about permissions, run `chmod +x flash_tool.sh` and try the first command again.
Go to the Download tab in SPFT and click the Scatter-loading button on the far right side. DO NOT click the Download Agent button. When the file picker dialog pops up, find and open the r1hd-spft-scatter.txt file you downloaded earlier.
You should see a list of partitions. Only three of them (boot, recovery, system) should be checked, and the location should point to the files you extracted from the tar.gz file earlier. If this is not the case, double-click the location block of the boot, recovery, and system partitions, and select the boot.img, recovery.img, and system.img files from your filesystem respectively. After selecting the files, the boxes should check themselves.
From the dropdown in the upper left of the partition list, make sure Download Only is selected. Any other option could damage your device.
Click the Download button in the upper left.
While your phone is OFF, plug it into your computer with a data safe USB cable. The cable that came in the box from the factory is ideal, but any good quality cable will work just fine.
SPFT should start overwriting your phone. If you receive an error from SPFT, unplug your phone, close SPFT, and repeat steps 4 through 9. The whole process takes about 10 minutes, after which you should see a window with a large green checkmark. Once you see that window, you can safely unplug your phone and start it up. You're all done!
And as a bonus, I've also included a guide for unlocking the bootloader, getting custom recovery, and rooting the device after you've done this in post #2. That makes this your one stop shop for getting a brand new Prime phone out of the box!!
HUGE THANKS TO @mrmazak FOR THEORIZING THIS METHOD AND GETTING ME THE NON-PRIME SYSTEM IMAGE TO USE!
As always, if you have any questions, just ask in a thread reply or send me a private message on XDA. And by the way, hit the Thanks button in the lower right corner of the post if my guide helps you. It motivates me to keep this up to date and write more helpful guides. If you feel like giving me even more motivation and help fund future development, [REDACTED].
{OUTDATED}[GUIDE][OEM][Stock] Bootloader Unlock, TWRP, and root!
Update March 8 2017: As you can probably tell, this is very old. I have not worked on the device in several months and I have no idea if these methods are still safe. Please proceed with caution. I will be using one of these on a daily basis in the near future, so I probably will get back into development, and hope to release new content for the phone to help out the community. Please accept this as an official warning that the following is probably out of date and that you should be very careful should you decide to try it. The original post in it's entirety is spoilered below. You have been warned.
Ok, now you've converted your brand new Prime phone to the non-Prime version. How do you unlock this sucker? The conversion process actually unlocks the standard unlock method from the factory, so it's VERY simple! No hoops to jump through or anything. You'll need adb and fastboot. You can get those as part of the official Android developer kit, your distro's repos (on Linux) or Homebrew (on Mac). Of course, this guide works for the normal non-converted non-Prime version as well. This WILL wipe your phone, so make sure you back up any important data before doing this.
This guide is for the OEM (non-Prime) version. If you have the Prime version, convert it to OEM using the guide above BEFORE doing this guide.
The standard disclaimer from above still applies.
This guide is broken up into two parts. Unlocking the bootloader, and rooting the phone. If you are preparing to install Magisk, do the bootloader unlock, skip the rooting part and move on to the Magisk guide. You do not need the files above if you are only unlocking the bootloader. If your bootloader is already unlocked, skip the bootloader unlocking part and skip to rooting the phone. If you are preparing to install Magisk and your bootloader is already unlocked, you shouldn't be here. Also please note that the bootloader can sometimes re-lock itself after completing a conversion/restore from the guide above, especially to/from the Prime version, so if you're not sure, play it safe and re-unlock your bootloader.
Part 1 - Unlocking the bootloader:
Boot up your phone. If you haven't already gone through the initial setup process, go through it. The bootloader unlock process will wipe your phone, so skip as many questions as possible so you don't waste your time.
Open the Settings app, go to About device, fine the Build number (it's toward the bottom), and tap on it 8-10 times (until it says you are now a developer. If it says there's no need and you're already a developer, you can skip to the next step)
Go back to the main Settings menu. You should see a new option where About device used to be, Developer options! Click on it.
Toward the top of the long list of developer options, there is an option called "OEM unlocking". If it's switched off, switch it on. If it's switched on, switch it off and back on again. You may get a warning saying that device protection features won't work. Click Enable and proceed. You may also be prompted to enter your password/PIN/pattern lock if you have one.
Scroll down a little bit to reveal USB debugging. Switch it on if it's not already.
Connect your phone to your computer using a data safe cable. Do not disconnect it until the very end.
On your computer, open a terminal emulator (or Command Prompt with ADB access) and run `adb reboot bootloader`. If you get a message complaining about keys or authorization, check your phone. There should be a window asking for permission for your computer to access the device. Allow it and run the command again.
Your phone will reboot into fastboot mode.
On your computer, run `fastboot oem unlock`. On the phone you will get a warning message talking about the implications of unlocking the bootloader. Press Volume Up to accept them. If everything goes smoothly, your bootloader should now be unlocked. You're not ready to flash quite yet! Flashing at this stage WILL brick your phone, so it's important that you continue following the guide carefully.
On your computer, run `fastboot reboot`. Your phone should reboot anywhere from 3 to 5 times. If it reboots more than that, your phone is bricked and you need to start again by following the guide above again.
Once Android starts up again, you should see the setup wizard. Your bootloader is now unlocked!
Part 2 - rooting the phone:
BEFORE YOU PROCEED: If you want your phone to be encrypted AND rooted, it's important that you unlock the bootloader using the steps above first, then use the encryption APK to encrypt your phone BEFORE installing TWRP and rooting your device. This device is an exception to the general rule of flashing TWRP first and then rooting afterwards. Repeat, if you want your phone encrypted and rooted, unlock the bootloader FIRST, then encrypt SECOND, then flash TWRP THIRD, and root your phone LAST.
This is the guide for rooting the actual phone. You must unlock the bootloader using the steps above before doing this part.
First, you'll need these things on your computer.
The TWRP image for the R1 HD. You can download [REDACTED]).
A copy of the latest SuperSU zip from Chainfire. You can get it from the official forum post, or Chainfire's website.
Linux Users: On Linux, you must add `sudo` to the beginning of all fastboot commands, because most Linux distributions will not give you enough access to the hardware without being root.
And finally, the guide:
Hold Volume Up and Power until the phone turns on with the boot menu. Once the boot menu appears, use the volume keys to scroll to [Fastboot Mode] and press the power button to select it. It's the middle option.
On your computer, cd to the folder where you downloaded twrp-3.0.2-1-r1hd-lopestom.img and do `fastboot flash recovery twrp-3.0.2-1-r1hd-lopestom.img`.
On your computer, do `fastboot boot twrp-3.0.2-1-r1hd-lopestom.img`.
Once TWRP boots up, dismiss the prompt about mounting the system, go to Reboot, then choose Recovery. Your device will reboot back into TWRP. I know this step seems odd, but just trust me.
Make a backup if you want. It's not a bad idea, but seeing how you just unlocked your bootloader so your data is gone and we have the images in case you somehow brick the system, I doubt you actually need it.
In TWRP, go to Advanced, then ADB Sideload. Slide the confirmation slider all the way to the right to confirm.
On your computer, cd to the folder where you downloaded SuperSU and run `adb sideload [SuperSU-zip-name.zip]`, replacing the last argument with the name of the SuperSU zip you downloaded, of course. If your computer says "waiting for device" for a long time, cancel with Ctrl+C, run `adb kill-server`, then run the first command again but with `sudo` in front this time.
Reboot the phone. If everything worked correctly, you should now have a rooted phone with SuperSU, bootloader unlocked, and custom recovery! Yay for cheap phones!
As always, if you have any questions, just ask in a thread reply or send me a private message on XDA. And by the way, hit the Thanks button in the lower right corner of the post if my guide helps you. It motivates me to keep this up to date and write more helpful guides. If you feel like giving me even more motivation and help fund future development, [REDACTED].
reserved 3
reserved 4
reserved 5
Can you verify the image you uploaded for the non-Prime version? I'm getting unexpected EOF errors when extracting in Windows using 7Zip and TarTool, and I'm also getting an "operation not permitted" error when extracting using the built in Archive Utility in OS X.
abs0lute said:
Can you verify the image you uploaded for the non-Prime version? I'm getting unexpected EOF errors when extracting in Windows using 7Zip and TarTool, and I'm also getting an "operation not permitted" error when extracting using the built in Archive Utility in OS X.
Click to expand...
Click to collapse
Yeah, that's because the image isn't fully uploaded. My internet is very slow, so it's taking a while to upload. Sorry about that. I was hoping it would be finished by the time I finished writing this, but alas, nope. I will have all files uploaded by tomorrow, along with .md5 files so you can verify the checksums, so come back then. Again, sorry. I guess I should have posted this _after_ I got those uploaded. Oh! And I have North America mirrors coming within the next couple months. It seems a little oxy-moronic to host files for a US only device on an EU server, but unfortunately, servers in the US are significantly more expensive.
ColtonDRG said:
Yeah, that's because the image isn't fully uploaded. My internet is very slow, so it's taking a while to upload. Sorry about that. I was hoping it would be finished by the time I finished writing this, but alas, nope. I will have all files uploaded by tomorrow, along with .md5 files so you can verify the checksums, so come back then. Again, sorry. I guess I should have posted this _after_ I got those uploaded. Oh! And I have North America mirrors coming within the next couple months. It seems a little oxy-moronic to host files for a US only device on an EU server, but unfortunately, servers in the US are significantly more expensive.
Click to expand...
Click to collapse
No problem - thanks for your work on this!
abs0lute said:
No problem - thanks for your work on this!
Click to expand...
Click to collapse
Just finished uploading the non-Prime version. I will start the other upload before sleeping and update the post removing the warning when I awaken, assuming everything has gone well. You're free to attempt a non-Prime conversion now. Just don't do it the other way around yet.
Sent from my LG G4 using XDA Labs
Can't wait to give this a shot. Well, at least after someone else reports success first...
followed post 1 convert to non prime steps on windows, did not do the bootloader unlock steps.
phone booted up ok, followed by android is upgrading x of 37.
phone working and no ad's on lock screen
the amazon apps are still there but appear to be disabled, causing errors at first boot.
disabled or uninstall the apps. - used cleanmaster
everything seems ok now
Hello, I have now finished uploading the files, so you can now safely flash away! Enjoy! @abs0lute
bupkis said:
Can't wait to give this a shot. Well, at least after someone else reports success first...
Click to expand...
Click to collapse
I report success. Of course I did everything in the guide here before posting it. I'm not irresponsible. It's completely safe. I just finished uploading the files, so please go ahead and give it a shot.
ColtonDRG said:
I report success. Of course I did everything in the guide here before posting it. I'm not irresponsible. It's completely safe. I just finished uploading the files, so please go ahead and give it a shot.
Click to expand...
Click to collapse
ok, away we go! :laugh:
When I try to download the scatter file it just opens the file in a new browser window.
>nevermind, figured it out...success!
...on to bootloader unlock, TWRP, root...
bupkis said:
...
When I try to download the scatter file it just opens the file in a new browser window.
...
Click to expand...
Click to collapse
Yeah, that's a problem with my server configuration. I'll fix it later. For now, you can save the file by opening it in a browser window and pressing Ctrl+S
I have completed the process successfully-TWRP, root, no ads but do still have all the Amazon apps so something is screwy but not the end of the world.
bupkis said:
I have completed the process successfully-TWRP, root, no ads but do still have all the Amazon apps so something is screwy but not the end of the world.
Click to expand...
Click to collapse
Nope, it's not screwy. The non-Amazon version does include a lot of the Amazon apps. You can uninstall some of them the normal way (they're pre-installed user apps), and others you can either disable or uninstall using your favourite system app remover.
Anyone else missing Encrypt section in Settings > Security after converting to non-prime?
When I try to load the scatter, SPFT says "Error: Initializing scatter file failed. Please check the name of scatter file which you load is legal." I downloaded it from both the primary link and your mirror, same error. Any ideas? Thanks.
EDIT: Looks like I downloaded the oldest version, not the newest version of SPFT. Whoops! I'll leave my mistake on here to help others who may assume the first link is the right one.
notfix said:
Anyone else missing Encrypt section in Settings > Security after converting to non-prime?
Click to expand...
Click to collapse
It is missing. How peculiar. I will attempt to implement a workaround in a little bit. Sorry about that.
Update: The Encryption activity exists on the phone, we just can't get to it from the settings menu. You can launch it by manually launching com.android.settings.Settings$CryptKeeperSettingsActivity using your preferred method for launching arbitrary activities. I will release an app that will launch this activity for you ASAP!

Unbricking Zenfone 3 ZE552KL (dm-verity) AND mistakes not to make when rooting

Preamble
Hello, all.
Soooo I've never posted on this forum before. I've mainly leeched the invaluable info for my personal gain. I'm sure many a googler has come here trying to figure out how to root their phone. And I'm sure many a "swimmer" in Schitz Creek has come here via Google to figure out how to save their device from what had been perceived as an upgrade. I'm speaking, of course, of trying to root/unlock a phone and finding said phone "bricked".
Well, it’s time to give back.
Because yesterday, I was neck deep in Schitz Creek. After a series of dumb decisions and a lack of knowledge, I bricked the phone I’d bought for my wife’s birthday. I was just trying to be able to delete the Asus bloatware and install titanium backup and greenify. By the way, since when did Facebook become a system app? How is this a thing? Anyways, my wife deserves better battery life. And it’s fun to feel like Cyber MacGuyver by rooting a phone. But the situation went awry. My wife kept telling me that everything was going to be alright, but I know the limitations of my knowledge.
Brief aside: I'm decently computer/phone savvy, but I would, in no way, consider myself an advanced user. Sure, to my family, I'm a computer wizard. But that doesn't mean a whole lot. To them, opening up a command prompt in Windows is seen as an act of magic. And I haven't had my planeswalker spark yet. However, I have successfully rooted, and in most cases unlocked the bootloader, for several phones (HTC desire, Galaxy S3 [three different models over three years], Asus Zenfone 5, LG G4 [once pre-motherboard-death and once post (after a downgrade)], and now the ZE552KL). So I know how to at least fumble my way around adb, fastboot, odin, and various recoveries. As long as you’re at this level, or willing to learn, then you should be able to follow these instructions. End aside.
Mistakes not to make
Let’s get down to brass tacks. I made two big mistakes that you shouldn’t make. Both mistakes stemmed from the basic mistake of using a root method other than this one: https://forum.xda-developers.com/zenfone-3/help/guide-how-to-root-zenfone-3-ze552kl-t3471524
The problem with not using this EXACT method is that some of the files/programs which you need to use have specific versions which will ensure an easypeasy root. Honestly, if you properly follow the instructions in the above post, you will most likely not run into any problems. The only addition I can make is that instead of steps 6 and 7, you might find it easier to install SuperSU.zip through TWRP instead of pushing and sideloading.
Mistake 1: Not using the proper TWRP file and SuperSU file
For some reason, there are multiple versions of these files. Your SuperSU file should be 4.8MB. Using the wrong SuperSU will break the dm-verity. Your TWRP should NOT be the latest experimental version. It should be the one from November or earlier of 2016. Using the wrong TWRP will leave you unable to use the touchscreen. Trust me. I know from experience.
Mistake 2: KEEP TWRP READ ONLY
Disabling read only has no current benefits. It will just break the dm-verity. Your device will still be able to be written to if you keep TWRP read only. I have no idea why it’s called “read only”.
How to unbrick the phone
I’m sure some of you skipped straight to here. While I can’t blame you, please at least read the above paragraph. It will help you.
First I will describe the situation the phone was in, and then I will explain how I saved it. Before I continue, I want to give a big shout out to Niemer. Without their helpful post, I would’ve had no idea what to do. Thanks!
Situation the phone was in
--TWRP could not be used because the touchscreen wasn’t working.
--The dm-verity was messed up (i.e. “not started in enforcing mode").
Before you look at the solutions, make sure that your phone shows up in the windows device manager as an ADB device/ASUS ADB device/ADB composite device/etc. no matter which step you’re in. Google it to figure out how if you don’t already know.
The solution
Part 1 - Create and flash a system image which will restore your dm-verity
step 1. download the latest system “update” from the asus drivers website. I have a WW version of the phone, so I downloaded “WW_V13.20.10.152”. It’s a 1.76GB file, so be patient. I haven’t tested this method with other versions of the phone, but they should work in theory.
step 2. go into the updater script file (META_INF → com → google → android → updater-script). Open it with notepad ++.
step 3. delete from the beginning of the file up until the line “ui_print("Target: asus/WW_Phone/ASUS_Z012D:6.0.1/MMB29P/13.20.10.152-20161222:user/release-keys");”
The code that you are deleting checks to make sure that your phone is the proper model. But there is a good chance that it will mistakenly identify your phone as a phony. So we need to get rid of this code.
step 4. save the updater-script file
step 5. create a copy of the modified system update zip file. You should now have two 1.76GB files (or maybe slightly different if your phone is a CN, JP, or other model. Once again, I have a WW version of the phone). Name one of the files “realupdate.zip” and name the other “dmsaver.zip”. The names aren’t actually important.
step 6. enter dmsaver.zip. delete these four files: file_contexts, system.new.dat, system.patch.dat, and system.transfer.list. Exit out of the file. It should now be about 60MB.
step 7. turn on your ZE552KL and enter fastboot mode
step 8. in a cmd screen from your main folder (i.e. the one with adb, fastboot, and all the other files, including the ones you just created), type in the command “fastboot flash system dmsaver.zip”
step 9. if successful, you have just restored the dm-verity. You should now no longer get that sinister red text which has been ruining all your fun.
Part 2 - Install a proper version of TWRP
(This is only important if your version of TWRP won’t let you do anything because you can’t use your touch screen)
Download the version of TWRP that is included in the how-to-root post I linked to above. Also, you can download the oldest version (NOT the newest) from a sharing website which is linked to in a post on the ASUS website. It’s not in english though. Flash it to your phone in fastboot mode using the “fastboot flash recovery” command. Make sure you turn your phone off before turning it back on, or your recovery might not activate correctly.
Part 3 - Install a new version of your system.
Go into TWRP and install the zip file “realupdate.zip” that you created in Part 1 - step 5.
Part 4 - Root your phone
Follow the instructions in the link I posted earlier. It comes from this website, so you know it’s good. This time, though, you probably don’t need to unlock the bootloader
Part 5 - Breathe a sigh of relief
Parting words
I really hope this guide can be of assistance to you. The full procedure for fixing “my” phone wasn’t really recorded anywhere (although once again, big shout out to Niemer for their post). I went through hundreds of iterations of seemingly random fastboot, recovery, and adb actions before everything worked out. Because of this, I feel quite fortunate to have saved the phone, and I really wanted to give back. This community has been super helpful to me over the last seven years, and this is my chance to reciprocate. I sincerely hope that this post will help you.
I hope I didn’t forget anything. I have a sneaking suspicion that I did. In any event, if you have any questions, please post them, and I’ll try to be of assistance. Happy rooting!
thank you man but i start Part1 step8 "fastboot flash system dmsaver.zip" it's successful then i go into TWRP and install the zip file “realupdate.zip” dm-verity show again.
Thank again.
Raw firmware
I have the same issue. My phone was branded "tim italy". When i bought it, I flashed the WW version via asus flash tool, and I'm currently able to update till the last M version, which is the ......152.
If i try to update to Android N, my phone will not boot, giving me the corruption message and shutting down after 10 seconds. I also tried to perform the dm restore procedure; the dm error disappeared but the system is stuck on the Asus boot screen
I believe that the only solution is to flash a Nougat RAW firmware via asus Flash tool. Does Anyone have a download link for the N version ?
thank you, you helped me, now im on N
I guess the version matters then. So be careful with which firmware you download/install. If anyone has success with other versions, please share how you did it
I am stuck on Step 8. i put the 2 zips in where my adb and fastboot is located, and then proceed to type 'fastboot flash system...' and then it wont let me flash, any help?
Device Locked
When I flash the dmsaver.zip, receive the error "FAILED (remote: not allowed in locked state)". Apparently this with the bootloader locked, but I already unlocked before. Someone can help me unlock the bootloader again?
Further hyperlinks & solution ideas
Check out my solution and Ideas in those in links I posted in this thread at 4th of septembre 2017:
https://forum.xda-developers.com/ze...-zenfone-3-zoom-ze553kl-t3657239#post73661437
The hyperlinks in my post might also be useful, I hope.
Would be glad about your feedback, if it helped! :good:
how do you update the script file ..can u just post the file that u made somehow or email it or attach it to a message?
cant get it to work followed the instructions still getinf error code 7 trying to install lineage os
If you have lineage OS version not is a zip file but all the images (boot.img, system.img, ...) then you could try to flash the images through ADB...
if someone have the no verity issue, can you try a method for me please?
it consists on:
re-flash the rom kernel via fastboot
and run:
Code:
fastboot oem reset-dm-verity
Followed all the steps and twrp still has no touch function.
Tried all different twrp versions.
OS Version is a key
Hi everybody that has the same issue, I hope you read that so you can fix your problem.
So what I did was downloading old version of OS that autor mentioned "WW-13.20.10.152". It is necessary to download this version even if there are more newer versions. Then follow tutorial and you should be fine.
So again, thanks OP for posting this. You helped me a lot!

Categories

Resources