Related
This NEEDS to be stickied in here so everyone can use it.
I copied this from the i9000 forum.
Ok before we get started I need to make this REALLY clear. This did not work for my i9000 at first…. I cannot guarantee you will find your code…. If your device freezes (to many attempts) I am sorry but I cannot be held responsible.
Using ADB
Step 1. – Get the file
You need to have root
Code:
adb shell
su
dd if=/dev/block/bml3 of=/sdcard/bml3.bak
mount USB storage and copy the file off the internal SD card
Step 2. – Find the code
Try this
Originally Posted by rbnet.it
Try this: http://www.multiupload.com/2IAYWWGF8A
It's a win32 executable. Run the program from command line with the blockdevice backup as parameter:
c:\sgux.exe bml3.bak
IT returns the unlock code fory your phone.
It's based on the tip posted on this thread by rhcp0112345.
It's works with european sgs.
Click to expand...
Click to collapse
OR
Open the file in a HEX editor
Search for SSNV
At the end of this block of data there should be a string of numbers
(my unlock code started at 0x18005a)
The format will be numbers.unlockcode.numbers
Step 3. – Enter the code
As far as I know the *#0111*code# and #7465625*638*Code# codes don’t work so you MUST
Power down your phone
Put in a SIM card from another carrier
Power up your phone
When it boots up it will ask for the unlock code that you found above
Step 4. – Flash back (IF THE CODE DIDN'T WORK)
Flash back to an older firmware (I9000XXJF7 with 513.pit worked for me)
Now enter the unlock code you generated in Step 2.
PLEASE give credit to
rhcp0112345 for finding the file and giving me (and others) a place to start
rbnet.it and marcopon for the cool utility to extract it
galaxysguy for starting the other thread and confirming that I was looking at the right code
Click to expand...
Click to collapse
Think this is the 3rd post I've seen on this, but this has been CONFIRMED to work!
sweet, just unlocked mine!! thanks guys!
ill make sure this gets stickied
Hi,
I have used this procedure but was unsuccessful since I don't have the SIM from another carrier? Which method did you use? also I am currently running JH3 firmware.
thanks
TZ
tzones said:
Hi,
I have used this procedure but was unsuccessful since I don't have the SIM from another carrier? Which method did you use? also I am currently running JH3 firmware.
thanks
TZ
Click to expand...
Click to collapse
you NEED another sim from another carrier to invoke the message to enter the unlock code.
Error: unable to find file <bml3.bak>. can some1 help? thx
i had sgux.exe and bml3.bak copy to drive c: "windows 7"
Yep, put an old no longer working TMobile sim in, it asked for my code and voila! worked like a champ.
file not found on JH3
_____________________
did a direct copy and paste of string from thread and it copied properly.
Unlocked successfully from JH3!!!!
Yeah *****es!!!!
akachay said:
Error: unable to find file <bml3.bak>. can some1 help? thx
i had sgux.exe and bml3.bak copy to drive c: "windows 7"
Click to expand...
Click to collapse
Krad said:
file not found on JH3
Click to expand...
Click to collapse
Remember after opening adb, type su enter
then
cat /efs/nv_data.bin >> /sdcard/nv_data.bin
mount your card, and transfer nv_data.bin along with sgux.exe to your c :\ drive
then open command prompt, and cd C:\ [ENTER]
C:\sgux.exe nv_data.bin [ENTER] and you should get your code.
Make sure you have su (superuser) working, you can tell if there's a #in the adb prompt
If there's no # in the adb prompt, then open adb, type su [ENTER] look at your phone, and wait for the Super User prompt to pop and enable/give permissions.
The Bishop said:
Yep, put an old no longer working TMobile sim in, it asked for my code and voila! worked like a champ.
Click to expand...
Click to collapse
Thanks for this mail since I was under the impression that it requires a working SIM. Can't believe that my phone is unlocked!!
nice guide... but why are there so many different unlock guides lol
Honestly, I just found a guide that I thought had the best instructions and made a thread about it, hoping that it would be stickied, becasue this does not need to fade away off the first page. If it were stickied, it'd be even better. I contacted the person over this board, but they have yet to reply.
Extracting the unlock code on Ubuntu
Once you get the file off of your phone you can use hexdump and grep to find the unlock code easily:
cat bml3.bak | hexdump -C | grep -A 10 SSN
Ideally we could figure out how to do this directly on the phone using busybox, but I haven't figure that out yet.
Bad ass! worked like a charm on JH3.
i need help, i havent been able to get my phone unlocked.
I've tried all the methods (except Paying for a code) and none have worked !!!
I tried this one and it gave me the code but when i put in the TMO sim and entered "the code" it came back as no good.
Now, sgux.exe states looking for code and then it moves to the next command line (as if it was finished) but it doesnt find the code.
Help me plz !!
PS: I got the files out of the phone, both the bml3.bak and the nv_data.bin !
I9000 unlock instructions
1. Power on the phone and go to Applications->Settings->About Phone->USB
settings
2. Select Mass Storage
3. Connect the phone to USB cable
4. Swipe down the top notification bar then tap “USB Connected” then select
MOUNT
5. Copy update.zip file to phone mass storage root
6. Power off the phone
7. Press Volume Up+Home+Power on key to start the phone into recovery
mode
8. Go to “apply sdcard:update.zip” using volume keys then select it using
home key
9. Power on the phone then go to Andoid Market and install Terminal
Emulator
10. Run Terminal Emulator
11. Type cat /efs/nv_data.bin >> /sdcard/nv_data.bin into terminal then type
Enter
12. Connect the phone to PC in USB Storage Mode then copy nv_data.bin file
to your pc
13. Open nv_data.bin file with any hex editor (ex. Hex workshop) then go to
address 00181460
14. There are the codes
15. Power on the phone with any unaccepted sim card inside then type in the
first code to unlock the phone
I9000 drivers
I9000 drivers
This solution is is not working for me. The problem is that the Update.zip says:
E: Signature verfication failed
Installation aborted
Any advice? How to install that update.zip package?
cellularhut said:
I9000 unlock instructions
1. Power on the phone and go to Applications->Settings->About Phone->USB
settings
2. Select Mass Storage
3. Connect the phone to USB cable
4. Swipe down the top notification bar then tap “USB Connected” then select
MOUNT
5. Copy update.zip file to phone mass storage root
6. Power off the phone
7. Press Volume Up+Home+Power on key to start the phone into recovery
mode
8. Go to “apply sdcard:update.zip” using volume keys then select it using
home key
9. Power on the phone then go to Andoid Market and install Terminal
Emulator
10. Run Terminal Emulator
11. Type cat /efs/nv_data.bin >> /sdcard/nv_data.bin into terminal then type
Enter
12. Connect the phone to PC in USB Storage Mode then copy nv_data.bin file
to your pc
13. Open nv_data.bin file with any hex editor (ex. Hex workshop) then go to
address 00181460
14. There are the codes
15. Power on the phone with any unaccepted sim card inside then type in the
first code to unlock the phone
Click to expand...
Click to collapse
Fantastic find if it works, my phone is unlocked so I can't test it but thanks a lot for sharing!!! Priceless
N.B. The first 8 steps are the process for rooting your phone, since you need to be root to do step 11. If you already have a rooted phone, start from step 10.
tyxerakias said:
fantastic find if it works, my phone is unlocked so i can't test it but thanks a lot for sharing!!! Priceless
n.b. The first 8 steps are the process for rooting your phone, since you need to be root to do step 11. If you already have a rooted phone, start from step 10.
Click to expand...
Click to collapse
1000000000000000% working tested before post here !!!!!
I am following 100% tutorial but I am unable to unlock my I9000. Look at the screenshot for the error that I encounter.
I have put the update.zip in root of phone memory, root of MicroSD etc but no chance. Do I need to root the phone or what's the problem?
Thanks
erreterr said:
I am following 100% tutorial but I am unable to unlock my I9000. Look at the screenshot for the error that I encounter.
I have put the update.zip in root of phone memory, root of MicroSD etc but no chance. Do I need to root the phone or what's the problem?
Thanks
Click to expand...
Click to collapse
Please read my post above. By doing this, you are rooting your phone.
It seems that the update.zip has not been properly signed, I see that it contains a new busybox, maybe the OP tried to optimise it and failed?
Use the original update.zip from the FAQ (http://www.multiupload.com/JHIFK9K80P) to root your phone, then continue from step 9.
The same happens with the file that I downloaded from your posted link!!!
Whats going wrong here?
Tyxerakias said:
Please read my post above. By doing this, you are rooting your phone.
It seems that the update.zip has not been properly signed, I see that it contains a new busybox, maybe the OP tried to optimise it and failed?
Use the original update.zip from the FAQ (http://www.multiupload.com/JHIFK9K80P) to root your phone, then continue from step 9.
Click to expand...
Click to collapse
No idea. Have you rooted your phone already? Have you installed any mods or firmwares?
No need to root
You dont need to root your phone to get to Step 11. The Terminal Emulator I installed from the Market let me do Step 11 directly.
All I then just did was email the nv_data.bin file to my inbox and later just open it in Textpad.
So, it was a bad tutorial. I tried to go step by step but now I begin from step 11 and everything is OK. My first I9000 unlocked like a charm
Thanks
knkartha said:
You dont need to root your phone to get to Step 11. The Terminal Emulator I installed from the Market let me do Step 11 directly.
All I then just did was email the nv_data.bin file to my inbox and later just open it in Textpad.
Click to expand...
Click to collapse
Huh. Interesting. I would have thought /efs is a protected folder.
I have a Bell one, i asked their staff when i bought my phone if i still on WARRANTY when i unlock the phone by Bell, they said yes.
Anybody know if i will lose my phone WARRANTY after i unlock the phone? Or can i lock it back if my phone have any problem in the future?
Thanks
could somebody point out which value in the address 00181460 says the unlock code?
erreterr said:
The same happens with the file that I downloaded from your posted link!!!
Whats going wrong here?
Click to expand...
Click to collapse
you should put the update.zip file on your internal sd card directory.
i encountered the same error when i put the update.zip file in the external sd card
erreterr said:
So, it was a bad tutorial. I tried to go step by step but now I begin from step 11 and everything is OK. My first I9000 unlocked like a charm
Thanks
Click to expand...
Click to collapse
which of the values in the said address gives the unlock code?
Hi,
I have a NSPRO box and read the unlock code, but as I insert it, it doesn't unlock the phone.
As this didn't work, I tried your method, and the code that showes up is the same as read by NSPRO box, and... it still doesn't work.
Attached is the printscreen of the HEX area where the code is. I've noticed it says "18146D" and not "181460" as your indicated. Could this be the reason why the code doesn't work?
Please help...
Samsung Vibrant SGH-T959 Recovery Mode
I've tried all sorts of button combinations to get the Samsung Vibrant T959 into recovery mode. I think since this device is a T-Mobile phone, the firmware has been modified for VolUp+VolDn+Pwr recovery mode.
As of now, the only way I know how to get the phone into recovery mode is by using the Android SDK and sending off a command: adb reboot recovery
I've been putting together an Android SDK & Rooting tutorial as well as other Samsung Vibrant T959 findings here: jordanpeterson.me/content/t-mobile-samsung-vibrant-sgh-t959
Sorry.. the external references aren't working.. Good spam rules on new users.
Thanks
Jordan
It worked great, althoug the address on my I9000 was 00181462. My suggestion is try to find closest address to the given by the tuturial....
Thanks for everything
Don't need to root the device. Download terminal emulater from Market. Went straight to step 10. Works like a charm. Thanks for the instructions.
Sent from my GT-I9000M using XDA App
ATTENTION! this thread is OUTDATED
unrevoked has always been a finicky program,3.22 working fine for some,not so much for others.recent updates seemd to have made it even worse, i see alot of issue and fustration with it lately. as such, i do not recomend this method any longer.
IMO,at this time htcdev is the best way to root,downgrade,and achieve s-off. while it technically does void your warranty,and wipe your data,it has thus far at least proven to be reliable. i doubt may original droid incredibles have factory warranty left anyway it does not use unrevoked,or any otehr root tools or programs,just htcs own unlock(you can giggle loudly,or silently,as you use their unlock to achieve s-off
the original home of the hctdev method is here, on android forums.
it is also here: http://forum.xda-developers.com/showthread.php?t=1600904 but not as well supported since im not here as much.
_______________________________________________________________________________________________________________________
*outdated guide:
i wasnt sure if this should be here,or in development,so feel free to move it if you feel its in the weong spot. i cant take credit for any of this,i just took it all from different places and put it all here. unfortunately,i cant gaurantee that this will work for everyone. but several have succesfully downgraded and regained s-off.
its intended for someone who has no adb experinece,and is overwhelmed at the thot of downloading and installing the SDK. if your proficient at adb,your welcome to pull flash_image and mtd0 out,and place them in tools,platform tools,or wherever you usually push files from,rather than changing to the mini-adb_inc directory.
thots and feed back are welcome. ive had this guide up here on AF for a few days. ill try and provide support here as well,but please underdstand computer time is limited these days and i dont make it here as often. in otherwords,please help each other out
_______________________________________________________________________________________
PLEASE NOTE: this thread is for the original droid incredible. NOT the incredible 2(vivow) or incredible S(vivo)
for info on downgrading the inc 2 to .97 hboot so you can root with revolutionary,see this thread here in the inc 2 all things root subforum
if you DO have an original droid incredible,aka Inc 1,then procede
_________________________________________________________________
**********************************************************
_________________________________________________________________
READ THIS: i dont mean to sound like i dont want to be bothered with questions. however,folks are having basically the same issues thru-out the 600+ posts,so i can almost gauarntee if you have a prollem,it has been covered. please try and search for some answers before jumping to the end and posting. answering the same things over and over is just making the thread even longer and harder to search.
if you do have trouble and need to post questions about ADB commands,please provide a copy of your entire session in the command window along with the question. its usually pretty easy to see what went wrong when we can see the whole thing.
copy everything in the command window,and paste it into a code box by:
-right click in the command window,click mark.
-highlight everything in white. hit enter.
-then,in your "reply to thread" box here,click the "#" up top
-right click and "paste" everything between the
Code:
tags.
_________________________________________________________________
i cant take credit for any of this,i just took it all from different places and put it all here. unfortunately,i cant gaurantee that this will work for everyone. but several now have rooted 2.3.4,and 1 has succesfully downgraded and gained s-off.
its intended for someone who has no adb experinece,and is overwhelmed at the thot of downloading and installing the SDK. if your proficient at adb,your welcome to pull flash_image and mtd0 out,and place them in tools,platform tools,or wherever you usually push files from,rather than changing to the mini-adb_inc directory.
thots and feed back are welcome. there will prolly be several edits of this as i try to clarify it,and make it a lil better. but for now im tired and 5am comes early ;)
[B]first and foremost,giving proper credit to all that deserve it:[/B]
*alpharev and unrevoked for all they for the root community :cool:
-efizzle for getting the ball rolling in [URL="http://forum.xda-developers.com/showthread.php?t=1286223"]this thread[/URL] on xda by figuring out that an older version of unrevoked would get superuser access on 2.3.4
-iowabowtech for point me in the direction of [URL="http://forum.xda-developers.com/showthread.php?t=768295&highlight=ota"]this thread[/URL] that i collected the misc image,and parts of the guide. also for his support answering questions.
-sele and the crew in the "rescue squad" on [URL="http://api.viglink.com/api/click?format=go&drKey=1153&loc=http%3A%2F%2Fandroidforums.com%2Fthunderbolt-all-things-root%2F418539-thunderbolt-root-unroot-thread.html&v=1&libid=1318297929451&out=http%3A%2F%2Fwww.thunderboltforums.com%2F&ref=http%3A%2F%2Fandroidforums.com%2Fthunderbolt-all-things-root%2F&title=Thunderbolt%20Root%2FUnroot%20Thread%20-%20Android%20Forums&txt=HTC%20Thunderbolt%20Forum&jsonp=vglnk_jsonp_13182980284911"]the thunderbolt forum[/URL] for what i like to call the "mini-adb" concept.
-rooter28 for testing and keeping me updated as he made progress. hopefully he will stop in and help answer questions :)
-mkreiger for fearlessly jumping in to be the second official tester
-lovejess for finding a mac download for unrevoked 3.22
-gkinsella2 for contributing the mac specific instructions
-whomever origianlly came up with the images and guide linked above. if i can figure out who this was,ill add you in later.
*special thanks to sdrawcab for his invaluable support in helping answer questions and prollems
-prolly more,im sure there will be several edits of this.
1)[B][I]download these files[/I][/B],and save them somewhere you can easily find them:
[U]unrevoked 3.22[/U] [url=http://www.multiupload.com/WMGYYGL97Z]unrevoked 3.22[/url]
[U]mirror:[/U] [URL="https://www.box.net/shared/8e3nb5l5lnjjuh6vbqt7"]unrevoked 3.22 mirror[/URL]
md5: [COLOR="red"]5760fbe8ed6d44752e78433252f2d5b2[/COLOR]
[U]unrevokeds modified usb drivers[/U] [url=http://unrevoked.com/rootwiki/doku.php/public/windows_hboot_driver_install]public:windows_hboot_driver_install [RootWiki][/url]
[U]mini-adb_inc[/U](contains misc image,flash image,and some basic adb tools)[url=http://www.multiupload.com/0G635MCZS2]Multiupload.com - upload your files to multiple file hosting sites![/url]
md5: [COLOR="red"]a793cc0142e1cd18f60849894bbc47cd[/COLOR]
[U]mirror:[/U][url]http://www.mediafire.com/?o6c4kq4wyccuom5[/url]
mirror md5: [COLOR="Red"]7c5211686a20b558ccd660c782f82e2b[/COLOR]
[I]*clockwork and zergrush included in mirror[/I]
[U]PB31IMG for 2.2[/U] (2.2 downgrade) [url=http://www.mediafire.com/?uvha2u2pv3xp8d5]PB31IMG.zip[/url]
[U]mirror:[/U] [url]http://pvillecomp.com/?page_id=22[/url]
md5: [COLOR="red"]31bb1611a0fa8197d447c0438426717e[/COLOR]
[U]clockwork 5.0.2.0[/U] [url=http://www.multiupload.com/FGEU9VPGKF]Multiupload.com - upload your files to multiple file hosting sites![/url]
[U]mirror:[/U][url]http://pvillecomp.com/?page_id=28[/url]
md5: [COLOR="Red"]e8ac35ddc1c37000bb0852d1f380b5bb[/COLOR]
**make sure to check the md5 sums match those listed!**
if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: [url=http://www.md5summer.org/]Home of the MD5summer[/url]
2)[B][I]root with unrevoked 3.22[/I][/B]
-go to settings/applications and [U]uncheck[/U] "fastboot". having this checked will prevent you from getting to hboot via power/vol down.
-open the recovery-clockwork-5.0.2.0-inc_PB31IMG download. extract it first if you need to. inside there is an image called "recovery-clockwork-5.0.2.0-inc". right click on this image,then click "copy". navigate to a directory you can easily find it,then right click in that directory,then "paste". alternatively,you can drag it from the extracted folder to a convienient spot(i personally like to drag files around,but its fine either way).
-use your md5 summer to verify the md5 of just the image,not the whole .zip. it should be: [COLOR="Red"]ea382ca5809cb872d0582aa22741d592[/COLOR]
-install the drivers as described on unrevokeds page above.
-unplug your phone.
-extract the contents of the unrevoked 3.22 .zip. open the folder, right click on "reflash" and run as administrator if possible.
-click on "file" in the corner of the relfash window
-click custom recovery
-navigate to,and select your "recovery-clockwork-5.0.2.0-inc" image and select it. at the bottom of your reflash app window, it should now say "recovery:custom" and "waiting for device"
-make sure usb debugging is checked ON in settings/applications/development.
-plug in your phone and place it in charge only mode. assuming you installed the drivers correctly,unrevoked 3.22 will start. let it do its thing. it will reboot a couple of times. when its finished,it may leave you on a blank screen. if this is the case,pull the battery and reboot.
-you [I]should[/I] now have the superuser app in your app drawer. if so,go to settings/applications/manage apps/superuser and clear data. test that superuser is working and granting permissions by downloading rom manager,and using it to flash the newest clockwork recovery. alternatively,download and run a "root checker" or any of your favorite "root only" apps and make sure they work.
-once you get "successfully flashed clockwork recovery" boot to it and make a backup,since downgrading to get s-off [U]WILL[/U] wipe all your data. boot back into the operating system.
*[I]special note to slcd users[/I]: this version of unrevoked is installig an old, non-compatible version of clockwork,so you will just see a black screen if you do not install newer clockwork as described above.
-if you plan to install a custom rom after downgrading,now is a good time to download titaium backup,and its pro key(WELL worth the $$) and do a batch backup of all your user apps and app data(no system data)
*at this point,you could just enjoy root access without doing anything else. if all you care about is using a couple of root only apps,and deleting some bloatware,you can remain rooted and s-on if youd like. id personally reccomend to downgrade and become s-off in case future OTAs knock out your root access.
3)[B][I]prepare to downgrad[/I]e[/B]
-extract the mini-adb_inc .zip. place the extracted folder on the root of your c drive. it comtains mtd0,flash_image,and some adb tools.
-place the 2.2 downgrade on the root of your sd card,and verify it is named "PB31IMG". now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting [U]WILL[/U] wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.
[U]special notes on hboot flashing PB31IMG files[/U] a common issue folks are having is the PB31IMG is not being found by hboot.
*there are only 2 reasons a PB31IMG is not found on the root of the sd card:
a)not named correctly. the phone muse see exactly "PB31IMG.zip". due to the way windows automatically adds and hides file extensions,it is usually correct to name the file "PB31IMG" with windows. common errors are for the file to be named "PB31IMG.zip.zip" after manually tying in the ".zip". on rarer occasions,it may not be adding/hiding the file extension,resulting in the file actually beening seen by the phone as "PB31IMG" :eek: [I]check your file with a file manager on your phone[/I] and see how its seeing it.
b)sd card not formatted FAT32. if it is plain FAT or anything else,PB31IMG is invisible. on rare occasion,i have seen claims that a bad sd card,or card that needs reformatted(even tho it may be FAT32) will have the same affect.
*this has been addressed [U]several[/U] times in the thread,skim thru it for more information.
4)[B][I]downgrade with adb[/I][/B]. make sure your phone is charged to 100% before starting.
-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in [B]bold[/B] so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.
at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.
-make sure phone is plugged in and usb debugging checked on,in charge only mode
-at the promt in your command window:
[B]cd c:mini-adb_inc [/B] [COLOR="Blue"]this should change your command promt to "mini-adb_inc",indicating youre using that directory.[/COLOR]
[B]adb devices[/B] [COLOR="blue"]this should output your phones serial number,indicating its recognized[/COLOR]
[B]md5sums mtd0.img [/B] [COLOR="blue"]it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839
[/COLOR]
[B]md5sums flash_image[/B] [COLOR="blue"]again,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a[/COLOR]
[COLOR="Red"]*both those numbers must match exactly. if they do then you can procede.
[/COLOR]
[B]adb push flash_image /data/local/[/B]
[B]adb push mtd0.img /sdcard/[/B]
[B]adb shell[/B] [COLOR="Blue"]your prompt should change to a #. if it changes to a $,then type[/COLOR] [B]su[/B] [COLOR="blue"]note your phone may pop up a message asking you to allow permissions the first time you do this. if it does check "always" and touch "allow" on the superuser request on the phone screen.[/COLOR]
[B]cd /data/local[/B]
[B]chmod 0755 /data/local/flash_image[/B]
[B]cd /data/local[/B]
[B]./flash_image misc /sdcard/mtd0.img[/B]
[COLOR="blue"]you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off[/COLOR]
[B]exit[/B] [COLOR="Blue"]to get out of your adb shell,and back to the "mini-adb_inc" prompt[/COLOR]
[B]adb reboot bootloader[/B] [COLOR="blue"]this will boot your phone to "fastboot" select "bootloader" with the power button.[/COLOR]
hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.
let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.
*[I][U]special note:[/U][/I] if your phone does not fully boot after running PB31IMG,dont panic. its happened to quite a few users,for some reason. simply pull your battery,boot to hboot via power/volume down and run PB31IMG again.
download unrevoked forever from here: [url=http://www.unrevoked.com/recovery/]unrevoked3 recovery reflash tool, v3.32[/url]
run it as you did the previous version. before plugging in your phone,make sure "disable phone security is checked" in the file menu. this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.
[I][U]*unrevoked 3.32 note:[/U][/I] if you check the "disable phone security" box as described above,and unrevoked still fails to turn s-off,you are not lost.[U]simply flash the s-off tool in recovery[/U]. you can find it here: [url=http://unrevoked.com/rootwiki/doku.php/public/forever]public:forever [RootWiki][/url]
if you wish to return to where you were,sign into google,download rom manger,flash the latest clockwork recovery. boot to recovery,then restore the back you made before we started.
optionally,you can now install the custom rom of your choice,along with a new recovery and radio if you desire. :)
and heres what you will see when entering the commands(the red are my copy/paste's):
[CODE]Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:UsersScott>[COLOR="Red"]cd c:mini-adb_inc[/COLOR]
c:mini-adb_inc>[COLOR="red"]adb devices[/COLOR]
List of devices attached
HT07DHJ02777 device
c:mini-adb_inc>[COLOR="red"]md5sums mtd0.img[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:mini-adb_inc]
mtd0.img 34307be744275f1db1dd16af04c37839
c:mini-adb_inc>[COLOR="red"]md5sums flash_image[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:mini-adb_inc]
flash_image 0098a7dd6600b55fac34fc6645be5d7a
c:mini-adb_inc>[COLOR="red"]adb push flash_image /data/local/[/COLOR]
1547 KB/s (76044 bytes in 0.048s)
c:mini-adb_inc>[COLOR="red"]adb push mtd0.img /sdcard/[/COLOR]
1662 KB/s (655360 bytes in 0.385s)
c:mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
$ [COLOR="red"]su[/COLOR]
su
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]chmod 0755 /data/local/flash_image[/COLOR]
chmod 0755 /data/local/flash_image
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]./flash_image misc /sdcard/mtd0.img[/COLOR]
./flash_image misc /sdcard/mtd0.img
# [COLOR="red"]exit[/COLOR]
exit
$ [COLOR="red"]exit[/COLOR]
exit
c:mini-adb_inc>[COLOR="red"]adb reboot bootloader[/COLOR]
c:mini-adb_inc>
other info:
-unrevoked 3.22 for mac can be found here: http://downloads.unrevoked.com/recovery/3.22/Reflash.dmg at this point youre on your own converting the adb commands. if someone wants to translate,or make a mac adb guide,ill gladly add it in
-until we put together a mac specific guide,directions for modifying the rest of it to work on a mac are found in post #629,here: http://androidforums.com/incredible...-3-4-root-downgrade-s-off-13.html#post3623666 courtesy of gkinsella2. mac users(and everyone else ) make sure to click the thanks button on his post!
______________________________________________________________________________________
*last and not least,this is a direct copy/paste of the AF thread,so any references to pages numbers are references to THAT thread on AF
the zergRoot method
this is for folks who for whatever reason,unrevoked 3.22 does not work to get them root access.
this could also be used if youve got a replacement device thats not setup,and you could care less about installing a recovery. this still requires unrevokeds drivers to be set up,so you can root with unrevoked 3.32 after downgrading,but otherwise,it prolly is a lil quicker since you dont need to download and run unrevoked 3.22.
alternately,use this if you just like ADB if your proficient in adb,feel free to remove the images from mini-adb_inc,and place them and the zergRush tool into whatever folder you typically push files from.
like above,this is intended for someone whose never installed ADB or entered command lines before.
1)download these files,and save them somewhere you can easily find them:
unrevokeds modified usb drivers public:windows_hboot_driver_install [RootWiki]
mini-adb_inc(contains misc image,flash image,and some basic adb tools)Multiupload.com - upload your files to multiple file hosting sites!
md5: a793cc0142e1cd18f60849894bbc47cd
PB31IMG for 2.2 PB31IMG.zip
md5: 31bb1611a0fa8197d447c0438426717e
zergRush tool from xda: Revolutionary - zergRush local root 2.2/2.3 - xda-developers
md5: 12c52b97e75e73595b325c03610b3380
**make sure to check the md5 sums match those listed!**
if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: Home of the MD5summer
3)prepare to downgrade
-extract the mini-adb_inc .zip. place the extracted folder on the root of your c\ drive. it comtains mtd0,flash_image,and some adb tools.
-extract zergRush.zip. take the image inside,and either copy/paste or drag it into your mini-adb_inc folder
-place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG. now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting WILL wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.
4)downgrade with adb. make sure your phone is charged to 100% before starting.
-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.
at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.
-make sure phone is plugged in and usb debugging checked on in charge only mode
-at the promt in your command window:
cd c:\mini-adb_inc this should change your command promt to "mini-adb_inc",indicating youre using that directory.
adb devices this should output your phones serial number,indicating its recognized
md5sums mtd0.img it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839
md5sums flash_image again,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a
md5sums zergRush again,output stuff, then this number: 3cf8a3fbceb667121d91f4ef1a66684c
*all those numbers must match exactly. if they do then you can procede.
adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush
this will cause zergRush to start,and it shoudl say "found a gingerbread!" followed by a bunch of other funny stuff.
last thing it says will be: Killing ADB and restarting as root... enjoy!
you should then be returned to your "mini-adb_inc>" prompt
adb push flash_image /data/local/
adb push mtd0.img /sdcard/
adb shell your prompt should change to a #
cd /data/local
chmod 0755 /data/local/flash_image
cd /data/local
./flash_image misc /sdcard/mtd0.img
you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off
exit to get out of your adb shell,and back to the "mini-adb_inc" prompt
adb reboot bootloader this will boot your phone to "fastboot" select "bootloader" with the power button.
hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.
let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.
download unrevoked forever from here: unrevoked3 recovery reflash tool, v3.32
run unrevoked(extract the contents,right click on "reflash",run as adminstrator if possible). this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.
and heres what you should see when entering the commands(my copy/pastes are in red):
Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Scott>[COLOR="Red"]cd c:\mini-adb_inc[/COLOR]
c:\mini-adb_inc>[COLOR="red"]adb devices[/COLOR]
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
HT117HJ00242 device
c:\mini-adb_inc>[COLOR="red"]md5sums mtd0.img[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
mtd0.img 34307be744275f1db1dd16af04c37839
c:\mini-adb_inc>[COLOR="red"]md5sums flash_image[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
flash_image 0098a7dd6600b55fac34fc6645be5d7a
c:\mini-adb_inc>[COLOR="red"]md5sums zergRush[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
zergRush 3cf8a3fbceb667121d91f4ef1a66684c
c:\mini-adb_inc>[COLOR="red"]adb push zergRush /data/local/[/COLOR]
1150 KB/s (21215 bytes in 0.018s)
c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
$ [COLOR="red"]chmod 755 /data/local/zergRush[/COLOR]
chmod 755 /data/local/zergRush
$ [COLOR="red"]/data/local/zergRush[/COLOR]
/data/local/zergRush
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00015108
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219e4 0x006c
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd158bf 0xafd1ace3
[*] Sending 149 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!
c:\mini-adb_inc>[COLOR="red"]adb push flash_image /data/local/[/COLOR]
1547 KB/s (76044 bytes in 0.048s)
c:\mini-adb_inc>[COLOR="red"]adb push mtd0.img /sdcard/[/COLOR]
1017 KB/s (655360 bytes in 0.629s)
c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]chmod 0755 /data/local/flash_image[/COLOR]
chmod 0755 /data/local/flash_image
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]./flash_image misc /sdcard/mtd0.img[/COLOR]
./flash_image misc /sdcard/mtd0.img
#[COLOR="red"] exit[/COLOR]
exit
c:\mini-adb_inc>[COLOR="red"]adb reboot bootloader[/COLOR]
c:\mini-adb_inc>
edit:apparently the zergRush tool has changed. ive included the new md5s,so hopefully there wont be any more confusion like the old md5s caused earlier. be aware of this,however, in case they do change again. you are right to be cautious if it doesnt match,so ill do my best to keep up with it.
This does work, but god I wish it was all ADB it was all so easy before unrevoked it didn't work the first time it gave me SU and root but no s-off then unrevoked would not run again due to new firmware. I did full downgrade to 2.2 and followed all directions ADB is so simple but unrevoked took 2 hours of just missing around to get s-off which included flashing 2.2 in hboot again starting over, running what I could run again in ADB without the gingerbreak since I was now on froyo, it was mostly just repushing the files and binary. But after all that unrevoked ran and gained root and s-off. Worst root I have ever done but people its all about making smart decisions before you do it if you make a mistake and get stuck, get help or trouble shoot but use you head before you battery pull and make sure you read before you hit anything.
If I helped you in any way please use the thank you button
sorry you had such issue with unrevoked. usually thats the easy part most folks are confused by adb and running commnads and wish it was all automated!
just a couple things that may help folks in the future:
-if you dont want to fool with unrevoked 3.22 in 3.2.4 use the "zergRoot"method in post 2. its all adb up to the downgrade. once you get to this point,you could easily roll yourself all the way back to the shipping firmware(assuming amoled screen) if you wanted,and then use an adb method(if one exists,im not that flamiliar with the inc). you dont have to go back to 2.2. i just picked that cause most folks are familiar with it,and with using unrevoked 3.32 to root/s-off it
-there have been a few complaints of unrevoked not giving s-off on 2.2. before you start,make sure "disable phone security" is checked in the file menu. if s-off still fails,but gives you root and a recovery,its worked for everyone thus far to just run the "forever" .zip in recovery,no real need to reflash the 2.2 ruu and run unrevoked multiple times.
-last and not least unrevoked is not ever going to give s-off in the 2.3.4(unless they release a new version for 2.3.4),as is uses an unsupported baseband,thats why the 2.2 downgrade is needed. folks that have no intention of backing up or returning to 2.3.4 and are fairly savy like the poster above,id strongy encourage to just use directions in post 2,its a lil quicker to not have to mess with unrevoked 3.22. its mainly included for the folks that want to make a nandroid or run tibu prior to the downgrade(plus zergRoot hadnt come out yet,when i originally put this together )
once your back on 2.2 you could even just use z4root to get get root access,install rom manager and clockwork,then flash the forever patch. once you can downgrade,there are alot of ways to skin the cat
Worked after a few tries!
Thanks Scotty for this writeup. I thought for a minute that things wouldn't work, but a third try proved fruitful.
Here's a few tips that I can add to things.
Things failed for me at the restore 2.2 part - HBOOT would not recognize the zip file as correct.
I am on a Win XP machine... Format the sd card to fat 32 using something other than Windows - I used a little program called "fat32format.exe". Windows seems to have a problem formatting sd cards correctly, so that could have been it.
Once I made sure the sd card was formatted, I put the 2.2 zip (PB31IMG) back on the sd card and started over using the zergRush method.
If you have tried this before, you will have to remove two directories from the /data/local/tmp directory. These are sh and boomsh. Thanks to ieftm in this forum for this tidbit of info.
If your zergRush is giving you problems stating:
[-] Cannot copy boomsh.: Permission denied
Then use this method to fix as I stated in paragraph above: remove sh and boomsh
Once these directories were removed and the zergRush was completed, the downgrade commenced just as described.
Side note - Unrevoked 3.32 installed Unrevoked forever automatically onto my DInc, so there was no reason to do the additional forever installation. You may have the same results.
For anyone else that can't seem to get things working, the search is your friend. It took me a while of hacking away at things, but eventually they all turned up roses...
Good Luck!
problems install roms
I have a problen,I can't install a Rom error e: can't open/sdcard/primexl3d.zip, why?
saosinalm:
First off, that's the wrong name for the downgrade zip according to the instructions that scotty posted above. Make sure the file is titled correctly and follow his instructions from beginning to end. I believe when mine succeeded my file title was "PB31IMG.zip" but in his instructions he leaves off the ".zip" at the end.
If there is an error in the process, you will have to start over from about step 3. You can't just start back from where you left off if you reboot the phone. Make sure you check your MD5's once you download, then you won't have to go back over that step.
I found the zergRush method easier, but I am more comfortable with adb...
I would suggest re-reading the instructions and following closely - he walks you through things really well.
I have one question....
Why root a phone? I had my phone rooted and honestly it was a complete waste of time. NONE of the Roms I downloaded ever worked properly, the apps never worked, and it was nothing but trouble for me. My phone always "force close" my apps too. No offense to the developers I just didn't see a benefit.
Am I wrong?
epescina:
That's really best answered differently depending on the type of person you are. If you like to play around and experiment with things or like learning how things work, maybe this works for you. Some people do it to get a custom look that no one else has, some do it to try and get better performance out of their phone that may have been bloated with apps out of the factory, and others are learning about developing apps and programming with it. Every person is different. Maybe it's just not for you, but others on this board can't live without it. To each his (her) own...
saosinalm said:
I have a problen,I can't install a Rom error e: can't open/sdcard/primexl3d.zip, why?
Click to expand...
Click to collapse
what are you trying to do exactly? no part of this guide requires you to flash a rom. so if youre tryingto root,be more specific what youre having trouble with, and if this is just a general question about flashing roms,you might do some research and/or post a new thread where more people will see it
epescina said:
I have one question....
Why root a phone? I had my phone rooted and honestly it was a complete waste of time. NONE of the Roms I downloaded ever worked properly, the apps never worked, and it was nothing but trouble for me. My phone always "force close" my apps too. No offense to the developers I just didn't see a benefit.
Am I wrong?
Click to expand...
Click to collapse
i personally have the opposite experience. while there are a couple minor issues with the rom that i run,i feel my phone is faster and more pleasureable after root. i love htc phones,but hate htc sense,so i root mainly root so i can run AOSP based firmware.
but as was said,to each his(her) own
scotty1223 said:
i personally have the opposite experience. while there are a couple minor issues with the rom that i run,i feel my phone is faster and more pleasureable after root. i love htc phones,but hate htc sense,so i root mainly root so i can run AOSP based firmware.
but as was said,to each his(her) own
Click to expand...
Click to collapse
I too hate the HTC Sense and wish I could change the overall layout of my phone. When I did load a new ROM that changed the layout it always seemed to be screwed up for one reason or another.
For example the lastest rom (Cyanogen) I absolutely loved but it didn't have market and I never could find out how to load it!
scotty1223 said:
i personally have the opposite experience. while there are a couple minor issues with the rom that i run,i feel my phone is faster and more pleasureable after root. i love htc phones,but hate htc sense,so i root mainly root so i can run AOSP based firmware.
but as was said,to each his(her) own
Click to expand...
Click to collapse
Couple of quick questions (which might appear silly):
"place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG"
#1) What do we rename "PB31IMG.zip" to? The directions simply state to rename it.
#2) Move it to the root of the external sdcard or internal sdcard?
tia, and I hope these questions weren't too ridiculous.
kjy2010 said:
Couple of quick questions (which might appear silly):
"place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG"
#1) What do we rename "PB31IMG.zip" to? The directions simply state to rename it.
#2) Move it to the root of the external sdcard or internal sdcard?
tia, and I hope these questions weren't too ridiculous.
Click to expand...
Click to collapse
It should be named PB31IMG.zip
It all depends how you rename it, if you use your pc it may not show the.zip extension if you have "show extensions" turned off. So on your pc it may just say PB31IMG even though it is really a zip. Sometimes when extensions are off people end up naming it PB31IMG.zip.zip wich will not work. It is best to have your pc show extensions you can do that by going to controll pannel / folder options / view tab uncheck hide extensions for known file types.
cmlusco said:
It should be named PB31IMG.zip
It all depends how you rename it, if you use your pc it may not show the.zip extension if you have "show extensions" turned off. So on your pc it may just say PB31IMG even though it is really a zip. Sometimes when extensions are off people end up naming it PB31IMG.zip.zip wich will not work.
Click to expand...
Click to collapse
wow lol ok, that just seems common sense, but I guess you never know who your audience is
Which sdcard should the file be on?
kjy2010 said:
wow lol ok, that just seems common sense, but I guess you never know who your audience is
Which sdcard should the file be on?
Click to expand...
Click to collapse
It should be on the removable sd not the internal storage if thats what you were asking.
cmlusco said:
It should be on the removable sd not the internal storage if thats what you were asking.
Click to expand...
Click to collapse
thanks again, just making certain. going for my third try now!
---------- Post added at 01:20 PM ---------- Previous post was at 01:14 PM ----------
I'm getting an unmatched number on zergRush
"md5sums zergRush again,output stuff, then this number: 795275fb9c41ebd5b9fe7ab19108c52b"
I get "4bf71b766a9603fa7db98e71e3f3b470"
??
It states:
"*all those numbers must match exactly. if they do then you can procede."
What do you do if they don't match?
Sorry for the n00b questions, been dealing with nothing but HC since June.
I would try redownloading and then check it again. If its still wrong i would contact the op scotty and ask him, as he is the one who provided the original md5.
cmlusco said:
I would try redownloading and then check it again. If its still wrong i would contact the op scotty and ask him, as he is the one who provided the original md5.
Click to expand...
Click to collapse
thanks, d/l it three times already what a PITA
I get a md5 of
3cf8a3fbceb667121d91f4ef1a66684c
for the zergrush file in the zip and.
12c52b97e75e73595b325c03610b3380
for the zip it self, different than both of your guys.
Edit. I believe that the zergrush file has been updated since this post to include more phones so that is probably why the md5 is different.
When returning to stock, I found this the most simple way to do it.
You will need:
AAHK
Your carrier's branded RUU (I'm using the Orange UK one found here
A computer with Windows on it (Annoying, I know), however this is just needed for the RUU exe process, not for AAHK
Disclaimer: I'm not responsible for anything you do to your device! I recommend making a backup of AAHK's file you will be editing before you start editing it
1. Download and open AAHK, entering the passcode (read the manual)
2. Type "o" and press enter
3. Type "s" and press enter
4. Find the closest generic RUU to your device, but DO NOT SELECT IT
5. Remember the CID of the one you chose (for me it's HTC__001, as I chose the UK generic one)
6. Close the terminal
7. Select your respective file that runs AAHK (.sh for Linux, .cmd for windows [I think])
8. Open it in a text editor
9. Use a find tool within the file to find the CID of your closest generic RUU, which should look a little like this:
Code:
elif [ "$inp" = "0" ]; then
cid="HTC__001"
dlFlash
10. Find your CID for your carrier, this thread is very useful: http://forum.xda-developers.com/showthread.php?t=1195475
11. Change the CID within the AAHK text file, to match your carrier's CID, for example my carrier's CID is ORANG001, so my text would now read this:
Code:
elif [ "$inp" = "0" ]; then
cid="ORANG001"
dlFlash
12. Save and close that file
13. Open AAHK in a terminal again, entering the passcode and then selecting "o" and "s"
14. Go to your generic RUU again (Don't worry that the CID hasn't changed in the terminal, it will have done in the code)
15. Now select that RUU, and let it download, but DO NOT YET SELECT FLASH "y", and DO NOT CLOSE AAHK
16. Download this PD98IMG http://cmw.22aaf3.com/ace/stock/1.32.405.6/PD98IMG.zip
17. Copy it to your AAHK folder, within the folder named PD98IMG, where there will be the one you just downloaded
18. Select the one that AAHK downloaded(will be called something like "PD98IMG_GB2" and rename it to "BACKUP_ZIP"
19. Select the one you just downloaded from my link, and rename it to what you just renamed the other one from, so it will be something like "PD98IMG_GB2"
20. Return to AAHK, that you left open, and now select "y" to flashing the RUU and "y" to setting S-ON
21. Wait for the phone to finish rebooting, returning to the stock, unbranded froyo RUU. You're not done yet.
22. When the phone is done turn on USB debugging, open a second terminal and run
Code:
adb shell getprop ro.cid
It should return your carrier's branded CID. If not, you did something wrong, re-root using AAHK and do the process again. ONLY IF IT does, then continue
23. Now you need to flash your branded RUU. If you need to, boot a Windows computer now and download it. Else, just open it
24. Accept everything it says about readmes and things, if you're nervous, read them
25. Let it flash, once it's done it should reboot the device
26. Again, enable USB debugging, open a second terminal and run:
Code:
adb shell getprop ro.cid
If it returns your carrier's branded CID, you're good, continue. Else, re-root and start again
27. Your phone should now prompt a software update if the RUU is older than the current version, accept and install these
28. Hit the thanks button, it took me a while to figure out and put this together
Thanks to attn1 for the AAHK, Chris Moyles for the Toby Lerone references on radio stations and Real Radio Northwest for providing me with background music for most of the time I was writing it.
You are done, now go do whatever you were going to do, whether it be warranty or trading it in
Any chance of re upping the Orange UK Firmware. As all the ones i have tried that said they was orange was telsa. Thanks in advance
hacktrix2006 said:
Any chance of re upping the Orange UK Firmware. As all the ones i have tried that said they was orange was telsa. Thanks in advance
Click to expand...
Click to collapse
I don't have the exe anymore, and it seems Goo doesn't either
You could try torrenting it from this site, appears to have it
http://bitsnoop.com/ruu-ace-orange-uk-1-40-61-2-radio-1-q24244672.html
Sent from my Galaxy Nexus using Tapatalk 4 Beta
Quinny899 said:
I don't have the exe anymore, and it seems Goo doesn't either
You could try torrenting it from this site, appears to have it
http://bitsnoop.com/ruu-ace-orange-uk-1-40-61-2-radio-1-q24244672.html
Sent from my Galaxy Nexus using Tapatalk 4 Beta
Click to expand...
Click to collapse
Thank you will give it a go.
Edit: Na its not working nothing there.(Seeder wise)
I managed to get a copy in the end, Install all the OTA's and then Nandroid the whole phone and made a new rom.zip for orange.
So its now the latest firmware 2.3.5 with the Latest Hboot as well that came with the OTA's.
This guide is compiled of various guides and threads that I've read and I want
to sum it all up in one post so you can root your HTC Dream (G1)
*many if not all rooting guides are incomplete or missing download links – I will do my best to keep links
posted and alive!
!!READ AND FOLLOW DIRECTIONS!! DO AT OWN RISK. I AM NOT RESPONSIBLE
FOR BRICKING YOUR PHONE.
I've compiled all of the files necessary and uploaded them to my drop
box
INDEX:
-|1|: Setting up adb and fastboot
-|2|: Rooting
-|3|: Changing hboot versions
-|4|: No recovery?
-|5|: Un-Root
*This guide assumes you are using Windows but Linux and iOS will be able to use most of it.
---------------------------------------------------------------------------------------------------------------------------------------------------------------
First off thanks to Demkantor since he was my sensai in a way (wax on wax off style)
Then thanks to HTCDreamOn, EzTerry, Cyanogenmod and all the developers out there that make all of this possible!
This is the optional ADB and Driver setup. I recommend you follow it through as it would make things easier in the future. This is more a reference post.
---------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------
1: ADB and Fastboot setup with HTC Drivers
------------------------------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------
In order to do certain things that pertain of flashing radios and hboots you are going to need ADB and
fastboot. This is also useful for The Google Bypass if you dont have data or an activated sim card.
Go ahead and download this zip
Extract the zip file straight to your local disk. (You should get something like this
afterwards "X:\Android" x being the letter of your local disk)
Now that you have that on your local disk. Go to X:\Android and install HTCDriver3.0.0.007.exe. (This
has most if not all HTC USB drivers)
Finally add a path in order to access ADB and Fastboot from cmd on the computer.
Click on the Start button and right click "My Computer" and choose
"Properties".
Now you should be in "System Properties" under the
"General" tab, go to the "Advanced" tab and click
"Environment Variables".
Now you'll be in "Environment Variables", Now under the
"System Variables" scroll down to "Path" and highlight
it by clicking on it and now click "edit".
IMPORTANT be sure to not delete ANY of the
variable values already in the "Variable Value" section. Now that that is
clear, go ahead and ADD this to the "Variable Value"
section: ";X:\Android" (Obviously replace X with your appropriate local disk letter and without
quotations)
You now have setup ADB and Fastboot.
But in order to use ADB and Fastboot you must go back to "Start" click or search
for run, type in cmd and you will now have command prompt open.
NOTE: I will not post what the command are since all you have to do is type in "adb" or "fastboot" in the command prompt and it will show you the sub
commands for each perspective command.
---------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------
2: Rooting
------------------------------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------
-----------------
Step 1
-----------------
Assuming you're not on stock Android 1.0 follow steps 1-6, if already on android 1.0 skip to step 7 (1 when item is hidden).
This link is for RC29 (US)
*Optional is the update.zip as it seems to not work for some other wise you can skip the update.zip flash*
But if you need RC7 (UK) then use this link
Now plug in your phone and go to USB-MS. Go ahead and right click your USB-MS drive that appears
on your computer and hit "Format..". Now under file system be sure to set it
as FAT32 then hit format. Depending on how much memory your SD card is will
effect how long it will take. Once it is done move the DREAIM.NBH and update.zip into the
root of the SD card.
*only do this step if you got the update.zip file otherwise skip this step* Now power down your phone and boot up into Recovery mode (Home+Power).
You'll see an exclamation point with a triangle if you booted correctly. At this point
press "ALT+L" then you want to wipe all data so press
"ALT+W" then press "ALT+S" to
apply the update from the SD card.
Power down your device and boot it back up into fastboot mode (Camera+Power). It'll prompt you
if you'd like to install update hit prompted button and wait, this may take a bit and it won't be done
untill it prompts you that it is done so do not worry if it seems like its taking long and DO
NOT battery pull while it is installing.
Power down and now boot normally. You now have android 1.0 stock.
Sign-in into google.
GOOGLE BYPASS METHOD : only necessary if you do not
have data or an activated sim card or no sim card at all. But Wifi is required.
("<enter>" is actually the actual enter button so when it says "<enter>" press the enter button AKA return button)
Power on your phone but do not press anything. Plug your phone in via USB.
Slide your keyboard up type this is: "<enter>setprop persist.service.adb.enable 1<enter>". (Since you are on 1.0 this actually a command to enable USB Debugging although
you can't see anything)
Your pc will detect another device and begin installing drivers. (This is what HTC drivers installer was
for so your device will be installed correctly)
Now open cmd via run on your computer. Type in "adb devices" and it should show your device.
Example :
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\Owner>adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
HT844GZ64748 device
C:\Documents and Settings\Owner>adb devices
List of devices attached
HT844GZ64748 device
C:\Documents and Settings\Owner>
Click to expand...
Click to collapse
(You only see this: "adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *" when its the first adb command your run when you open cmd)
type: telnetd<enter>
now on the computer using the command prompt type: adb forward tcp:23 tcp:23
then press enter
type: telnet localhost
press enter and you should see a # as you should have a root shell (while in this shell in order to backspace you must press the "Delete" button on your keyboard as pressing backspace will not do anything)
type: setprop app.setupwizard.disable 1
press enter
type: ps
press enter, this will show all the running processes
on the right column look for "com.android.setupwizard" then once that is located follow that line on to the second column from the left, the number in that column is the PID
type: kill PID
replace PID with the number that you found from the second column
It should now be at the home screen, if not press the "Emergency Call" button and press back and then you should be able to unlock the phone with the "Menu" button.
Now you can go to the settings connect with wifi and then bring down the notification that says you need to set up your account to sign in with your google email
Go to the market and download "TelNet" app. Once you have
it installed, go to USB-MS and put this recovery image onto the root of your SD card. reboot your device but do not press
anything or unlock the screen.
Once booted up slide your keyboard up, will unlock the device, and press the enter button twice and
type this in "telnetd" then hit enter (It’ll be a contact search but it’s okay). Now
go open Telnet app, and hit connect. If you did the telnetd part correctly you
will be prompted with a #. Otherwise you'll get a connection failed message, if
so reboot device and attempt the telnetd command again.
Type these commands in on your phone:
Press enter after each line
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
cd sdcard
flash_image recovery recovery.img
cat recovery.img > /system/recovery.img
Click to expand...
Click to collapse
You now successfully flashed Amon_RA_ Recovery. :good:
You may reboot into your new recovery (power on holding home button) and flash a custom ROM. But
I do suggest upgrading your bootloader and radio first as the amount of ROMs available to you will be
much greater!
-----------------
Step 2
-----------------
Okay so now we will be updating to radio2.22.23.02 and DangerSPL.
Reboot into recovery mode (POWER+HOME), plug your phone in via USB and toggle USB-ms and delete everything off your SD card and placethese files onto the root of your SD card. Exit USB toggle.
Scroll down to wipe data and do so.. than go to "flash .zip file" now the first file you want to flash is the radio2.22.23.02 let finish then press home+back to apply update, it should reboot back to recovery after this.
Now go to wipe again and do so.. the next file you want to flash is the G1 Spl (Hard SPL) so flash the .zip file and let finish than press home+back to apply update.
Go to wipe data 1 more time. now go to flash zip and select the "Danger SPL.zip" let finish and press home+back to apply update.
Power back on into bootloader (camera+power) and check if device says.
Dream PVT 32b ENG S-off
HBOOT 1.33.2005 (drea10000)
CPLD-4
RADIO 2.22.23.02
APR 20, 2009, 15:30:43
Click to expand...
Click to collapse
If so you can move on to the next part!
-----------------------------------------*
Step 3
-----------------------------------------
Again delete the old files off your sd card and place these files on it!!
Quick note this is the last radio update for this section, radio2.22.27.08, now if you want radio update 2.22.28.25 refer to the changing hboot section and it will have the steps to do so.
Radio 2.22.28.25 may have better reception in your area but will drain your battery quicker.
Boot up into recovery mode, go to flash zip from sd and select Ohsaka superwipe. wait till finish then go to power down!! now boot back up into recovery again.
Now do a manual wipe of data and cache.
Now flash the radio2.22.27.08 file.. let finish than flash the hboot1.33.0013d file and let it finish! then reboot the device for update to apply.
Power off the device, then reboot into bootloader (camera+power) and check if device says.
Dream PVT 32b SHIP S-on
HBOOT 1.33.0013d (drea10000)
CPLD-4
RADIO 2.22.27.08
OCT 21,2009,22:33:27
Click to expand...
Click to collapse
*If so you now have updated both your radio and SPL and you can now flash any ROM you'd like.
But if you'd like you can follow the next step and install a custom ROM and I will show you how to partition your SD card as well.
-----------------------------------------*
Step 4
-----------------------------------------
Okay so now that you have completed step 3 you can flash a custom rom but now we must partition the SDcard.
Reboot into recovery mode and go to Partition SDcard
Partition SD. Press home.
Now I have 4GB micro SD hc. My partition settings are*
Swap: 128mb (swap is not needed and is purely optional)
Ext: 576mb ( or whichever option is closest to that I can't remember, this is for apps2ext so you can save your apps to your sd card)
Rest: FAT32 (this will once again delete everything but you should have all your backed up data on your pc)
This is what I have for my partitionings and it's works fine for me and it should for you too!
Once that is done go to SD:ext2 to ext3 and once that is done upgrade the ext3 to ext4. You now have a partitioned SD card with EXT4!!
Now all that is needed is to flash the custom ROM. I am currently running this ROM.
Now return to toggle USB-ms and place the ROM zip file from the link above as well with Ohsaka superwipe from the previous step (download it once again)
Go to flash zip file and flash Ohsaka superwipe.
Power down. Reboot into recovery.
Now return to flash zip file and flash the ROM which should be named FroyoCreamSandwhich. Once it is done it will prompt you to press HOME+BACK do so.
Now reboot your phone normally and allow it to boot up (it may take a bit the first time but this is normal when you flash a new ROM). You will now be given the option to sign in create an new account or skip (although I believe it has the option to connect to wifi built in). You now have flashed your New ROM!!!!
---------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------
3: Changing HBOOT version
------------------------------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------
This option is for which ever reason you need the flash recovery/radio/etc you need the Engineer SPL. which is the SPL from step 2 in rooting. although since if you are already rooted and have the latest HBOOT then that route is not the way to go.
So in order to go back to that engineer SPL all you need to do is flash Engineering SPL zip in recovery.
Then you can proceed to update radio/ recovery etc and then flash back to the latest HBOOT which is 0013d so just download
Hboot0013dand flash it through fastboot with this command: fastboot flash hboot hboot.img
--------------------------------
No Recovery?
--------------------------------
Download: http://d-h.st/v9b2erpqfyd7/orange-1.58.73.2.nbh
Like always place the file in the same folder as the fast boot directory.
Enter fastboot and run "fastboot flash nbh orange-1.58.73.2.nbh"
Wait for it complete the flash
Boot into boot loader again and you will have an engineer SPL 1.42.2000
Now you can flash any hboot/recovery/radio via fastboot.
--------------------------------
Unroot
--------------------------------
ldrifta said:
---------------------------------------------------------------------------------------------------------------------------------------------
5~Un-Rooting
---------------------------------------------------------------------------------------------------------------------------------------------
Download these files...
DREAIMG.nbh
update.zip
Now would be a good time to un partition your sd card since there will no longer be a custom recovery..
1. first you take the "DREAIMG.nbh" file and the first "update.zip" file and place on root of sdcard!
2. start phone in recovery mode (home+power) do a quick wipe of everything! than flash the update.zip file.. wait for finish than reboot or power off.. whatever prompts tell you. than make sure device is powered off after finished installing!
3. power on via fastboot (camera+power) and wait for selection to pop up asking to install the update! press confirmation button to apply and let it work its magic!!
Now your phone will be on stock android 1.0 firmware! you have 2 options..
a. wait for automated updates.. could take up to 48 hrs..
b. flash updates to 1.5 and or 1.6 via stock recovery!
if you chose option b than you are smart! lol who wants to wait for updates for a G1 nowadays? lol
ok so now to apply updates via stock recovery you do what you would normally do.
Download these files...
Stock 1.5 (OTA)
Stock 1.6 (OTA)
(the stock 1.5 and 1.6 files are also "update.zip" so be sure not to mix them up and confuse the proccess!!)
1. Place files on root of sd.. DO NOT RENAME FILES, the stock recovery will only flash an "update.zip" so please dont make any changes to file.names...
2. boot into recovery mode (home+power) and wait for screen with yellow triangle and this thing ! now press alt+L together untill you see more words pop up on screen..
3. Now press alt+w to wipe the data on phone... (just do it dont ask why) lol after wipe is complete press alt+s to apply update! once it's finished reboot your device and you are ready to go!!
unfortunately the 1.6 i provided is not the DMD40, you still have to wait for that automatic update lol i have the 1.6 before the update... it is the official tmobile firmware its just not the latest.. never really bothered to search for latest one..
Click to expand...
Click to collapse
if any of those links are down post a reply and i will get a mirror up as soon as possible!
Hi mate, welcome to the G1 forums, good comprehensive guide, added to The G1 Oracle :good:
Thanks for this, watching for the rest with baited breath! You have written up the bit I have done but really cant seem to get through the next phase properly lol.
Your welcome guys. I ran up with some problems and my pc isn't available so ill try finishing this soon (probably in my iPod).
Okay yes this is perfect I can generate the links via the Dropbox app so hopefully this should be done soon!
Wow phew that took longer than expected (about 3 hours) safari is a horrible browser. Kept on crashing. Finally did all of it on notes and just pasted it on, revised and posted I hope this helps out! I will have the next steps up soon but for now you should be able to root your htc g1 with no problems what so ever have fun rooting guys. :laugh: I'm heading off to sleep. I'm exhausted. Later.:silly:
HTCDreamOn said:
Hi mate, welcome to the G1 forums, good comprehensive guide, added to The G1 Oracle :good:
Click to expand...
Click to collapse
Thanks!
I decided to finish up the rooting part since there was activity on the topic. Feel free to look over it just in case I may have missed something. I doubt it but hey we're not all perfect. Exhausted but pretty satisfied on how things are coming out. Mainly I'm happy to see that this is on the G1 oracle and that this this is recognized as a contribution to the g1 forums!
luggag3 said:
Thanks for this, watching for the rest with baited breath! You have written up the bit I have done but really cant seem to get through the next phase properly lol.
Click to expand...
Click to collapse
The rest is up for rooting! Have fun rooting!
Can anyone repost the file from part 1? It doesnt work...
Good work, thread stickied.
Thank you,
mf2112
XDA Moderator
duse1986 said:
Can anyone repost the file from part 1? It doesnt work...
Click to expand...
Click to collapse
Which one?
duse1986 said:
Can anyone repost the file from part 1? It doesnt work...
Click to expand...
Click to collapse
Sorry for the incovienience but since majority of this post was made on my iPod using notes since safari is higly unreliable with desktop version sites. This the format of notes is kept when copying to the post editor. Thus this is how the link was copied:
https://www.dropbox.com/s/y3slprukiqrt9nv/
EXAMPLE.DOC
Click to expand...
Click to collapse
Instead of like this:
https://www.dropbox.com/s/y3slprukiqrt9nv/EXAMPLE.DOC
Click to expand...
Click to collapse
Thus making it believe that there is a "RETURN" in the link giving you a 404 error. I fixed this along with some other 404 error links but it is all fixed. Either way next time there is a link that is not working quote it and I'll have it back up.
So I am no longer using my G1 but I will still finish this guide. I'm sorry for the wait guys.
Sent from my Nexus 4 using xda app-developers app
Nice guide.. you left 'adb shell' in the bypass google section
Thnxxx