[GUIDE] How to get root/flash custom roms with HTCDEV unlock - G2 and Desire Z General

I know some people out there will use the new "official" htcdev.com unlock option for the G2/DZ, but they will still need to do **** to get root or flash custom roms.
I REALLY RECOMMEND USING THE XDA METHOD OF ACQUIRING ROOT AND S-OFF
S-OFF is possible! We can relock the bootloader to allow a downgrade
Go to FASTBOOT USB mode (where you got the unlock token code, and unlocked the bootloader)
Code:
fastboot oem lock
You can then downgrade by following this guide
And get S-OFF with this guide
DO NOT LOCK THE BOOTLOADER IF YOU DON'T WANT TO ROOT PROPERLY!
LOCKING THE BOOTLOADER WILL CAUSE THE REST OF THIS GUIDE TO FAIL!
-------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------
First, some background as to why these methods are needed.
The HTC 'official' unlock method lets /system be written (given root access) in any mode.
The boot partition, and recovery are only writeable in fastboot mode though. So we need to flash a recovery through fastboot, flash a custom rom, then flash its boot image to be able to boot it.
GAINING ROOT ON STOCK ROM
Gaining Temp Root
DHD USERS WITH SENSE 3.x WILL HAVE TO USE TACOROOT
1. Download the attached files, unzip them, and place the files in your platform-tools folder. To elaborate, place the fre3vo file inside of the fre3vo.zip file in your platform-tools directory.
2. Run the following command to verify the exploit has access to what it needs. (Only the first line is the command. The second line should be the result returned if all goes well.)
Code:
> adb shell cat /dev/msm_rotator
[I]/dev/msm_rotator: invalid length[/I]
4. If you received the same message, you're good to continue on. If not... I'd recommend going back to #g2root and asking them. (I am just passing along the information after all).
5. Run the following commands from your platform-tools directory.
Code:
> adb push fre3vo /data/local/tmp
> adb shell
$ chmod 777 /data/local/tmp/fre3vo
$ /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
6. After you enter that command, with luck you should see something similar to the last few lines in the following displayed. (It may take a minute or two. From what I can tell, this appears to be the quickest method as the exploit seems to be found in the latter regions.)
Code:
[I]Buffer offset: 00000000
Buffer size: 8192
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba90000...
Potential exploit area found at address fbb4d600:a00.
Exploiting device...[/I]
7. If you did get kicked out of adb shell, open it again. You should now see the lovely # instead of $, thus granting you temp root. Go ahead and exit out of shell to proceed to the next stage.
Code:
> adb shell
# exit
Getting Perm-Root
1. Download the attached file, "Vision-fre3vo-temp-root.zip".
2. Extract the contents to your platform-tools directory.
3. Run the following commands in command prompt while in platform-tools directory:
Code:
> adb push su /data/local/tmp/
> adb push busybox /data/local/tmp/
> adb push fixsu.sh /data/local/tmp/
> adb install SuperUser.apk
> adb shell chmod 755 /data/local/tmp/fixsu.sh
> adb shell chmod 755 /data/local/tmp/busybox
> adb shell /data/local/tmp/fixsu.sh
Note: If you get permission denied errors on busybox when trying to run fixsu.sh, please let me know.
4. Reboot phone, you should now have perm-root.
FLASHING A CUSTOM ROM
Flashing a custom recovery
Note: this only needs to be done once
1. Download a custom recovery: Latest Clockworkmod, Clockworkmod Touch, 4ext Touch
2. Place the recovery img in the folder with fastboot.exe (which you used to unlock your device), rename the recovery to recovery.img
3. Reboot phone to fastboot mode: Either pull battery and hold TRACKPAD and press power, or run 'adb reboot bootloader' from a cmd/terminal
4. Run
Code:
> fastboot flash recovery recovery.img
[I]sending 'recovery' (4930 KB)...
OKAY [ 0.851s]
writing 'recovery'...
OKAY [ 0.819s]
finished. total time: 1.670s[/I]
Flashing a custom rom
1. Download the rom.zip you wish to run.
2. Extract boot.img from the zip and place it in the folder with fastboot.
3. Copy the rom.zip to your sdcard
4. Flash the rom.zip from your sdcard
5. Reboot to fastboot mode (as above)
6. Run from a cmd/terminal
Code:
> fastboot flash boot boot.img
[I]sending 'boot' (4096 KB)...
OKAY [ 0.711s]
writing 'boot'...
OKAY [ 1.085s]
finished. total time: 1.798s[/I]
7. Reboot, you will now have a custom rom!
Credits:
Setherio, seeing as I ripped off half his guide.
Pierre_ja, helping figure out how to go about this.
If you get stuck with any of this, join #G2ROOT on freenode
-Nipqer

I'll try this ASAP. This bootloader have only brought me a **** load of headache, hope this works..
Thanks!

Yay a tester. let me know how it works.
We've had 1 person get root, and 2 flash custom roms with this, but I'd appreciate any feedback.
-Nipqer

fixsu.sh permissions denied
good to know that xda has people like you to help out
couldn't get root here's the result
C:\Android SDK\android-sdk\platform-tools>adb shell cat /dev/msm_rotator
/dev/msm_rotator: invalid length
C:\Android SDK\android-sdk\platform-tools>adb push fre3vo /data/local/tmp
869 KB/s (9796 bytes in 0.011s)
C:\Android SDK\android-sdk\platform-tools>adb shell
$ chmod 777 /data/local/tmp
chmod 777 /data/local/tmp
$ chmod 777 /data/local/tmp/fre3vo
chmod 777 /data/local/tmp/fre3vo
$ /data/local//tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
/data/local//tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 802160640
smem_len: 3145728
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 0
bits_per_pixel: 32
activate: 16
height: 80
width: 48
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Buffer offset: 00000000
Buffer size: 8192
Scanning region faa90000...
Scanning region fab80000...
Scanning region fac70000...
Scanning region fad60000...
Scanning region fae50000...
Scanning region faf40000...
Scanning region fb030000...
Scanning region fb120000...
Scanning region fb210000...
Scanning region fb300000...
Scanning region fb3f0000...
Scanning region fb4e0000...
Scanning region fb5d0000...
Scanning region fb6c0000...
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba80000...
Potential exploit area found at address fbb6e200:e00.
Exploiting device...
C:\Android SDK\android-sdk\platform-tools>adb shell
# exit
exit
C:\Android SDK\android-sdk\platform-tools>adb push su /data/local/tmp/
1205 KB/s (22228 bytes in 0.018s)
C:\Android SDK\android-sdk\platform-tools>adb push busybox /data/local/tmp/
1683 KB/s (1372660 bytes in 0.796s)
C:\Android SDK\android-sdk\platform-tools>adb push fixsu.sh /data/local/tmp/
109 KB/s (560 bytes in 0.005s)
C:\Android SDK\android-sdk\platform-tools>adb install Superuser.apk
1060 KB/s (196521 bytes in 0.181s)
pkg: /data/local/tmp/Superuser.apk
Success
C:\Android SDK\android-sdk\platform-tools>adb shell chmod 755 /data/local/tmp/fi
xsu.sh
C:\Android SDK\android-sdk\platform-tools>adb shell /data/local/tmp/fixsu.sh
/data/local/tmp/fixsu.sh: /data/local/tmp/busybox: permission denied
/data/local/tmp/fixsu.sh: /data/local/tmp/busybox: permission denied
/data/local/tmp/fixsu.sh: /data/local/tmp/busybox: permission denied
/data/local/tmp/fixsu.sh: /data/local/tmp/busybox: permission denied
C:\Android SDK\android-sdk\platform-tools>adb shell chmod 755 /data/local/tmp/fi
xsu.sh
C:\Android SDK\android-sdk\platform-tools>adb shell /data/local/tmp/fixsu.sh
/data/local/tmp/fixsu.sh: /data/local/tmp/busybox: permission denied
/data/local/tmp/fixsu.sh: /data/local/tmp/busybox: permission denied
/data/local/tmp/fixsu.sh: /data/local/tmp/busybox: permission denied
/data/local/tmp/fixsu.sh: /data/local/tmp/busybox: permission denied
C:\Android SDK\android-sdk\platform-tools>
Click to expand...
Click to collapse

Hmm, I wonder why thats happening...
Want to join the IRC channel so we can sort this out?
-Nipqer

how do i join?
EDIT: i'll do a full factory restore, format sdcard and try this out again

Go to http://webchat.freenode.net/
choose a nickname, in channels enter #G2ROOT (with the hash)
-Nipqer

Hi Guys.
I'm @ work, but gonna try this in my break asap.

Sorry if I have missed something, but don't you need the eng hboot in order to use "fastboot flash" ?
Sent from my Desire Z running CM7.

I've done everything as above.
Everything went just fine.
But when I start SetCPU, It comes up with "root acces not detected" did you allow setcpu through superuser permissions?
In the superuser app (which is visible) I can't edit anything?
Also, it's not showing a pop up with "allow"
Am I doing something wrong?

C:\>cd android
C:\Android>cd platform-tools
C:\Android\platform-tools>adb shell
adb server is out of date. killing...
* daemon started successfully *
$ fastboot flash recovery recovery.img
fastboot flash recovery recovery.img
fastboot: permission denied
$
$ exit
exit
C:\Android\platform-tools>fastboot flash recovery recovery.img
< waiting for device >

steviewevie said:
Sorry if I have missed something, but don't you need the eng hboot in order to use "fastboot flash" ?
Sent from my Desire Z running CM7.
Click to expand...
Click to collapse
the hboot htc provides for the unlock supports fastboot commands, took us a while to figure that out at #g2root.
---------- Post added at 05:11 PM ---------- Previous post was at 05:08 PM ----------
wm6.5 said:
C:\>cd android
C:\Android>cd platform-tools
C:\Android\platform-tools>adb shell
adb server is out of date. killing...
* daemon started successfully *
$ fastboot flash recovery recovery.img
fastboot flash recovery recovery.img
fastboot: permission denied
$
$ exit
exit
C:\Android\platform-tools>fastboot flash recovery recovery.img
< waiting for device >
Click to expand...
Click to collapse
you have to boot in fastboot mode to be able to issue fastboot commands:
from shell ($ or #) while the phone is connected to the computer:
Code:
exit
adb reboot bootloader
from normal win cmd (the > prompt):
Code:
adb reboot bootloader

petarpLab said:
the hboot htc provides for the unlock supports fastboot commands, took us a while to figure that out at #g2root.
Click to expand...
Click to collapse
Ok, cool, thanks for the info. That's something useful it does then.
Sent from my Desire Z running CM7.

wm6.5 said:
C:\>cd android
C:\Android>cd platform-tools
C:\Android\platform-tools>adb shell
adb server is out of date. killing...
* daemon started successfully *
$ fastboot flash recovery recovery.img
fastboot flash recovery recovery.img
fastboot: permission denied
$
$ exit
exit
Click to expand...
Click to collapse
You need to run fastboot from your PC, not the phone
Sent from my Desire Z running CM7.

wm6.5: I don't know if SetCPU can work on stock roms with root. You might need a different kernel for it.
-Nipqer

Nipqer said:
Yay a tester. let me know how it works.
We've had 1 person get root, and 2 flash custom roms with this, but I'd appreciate any feedback.
-Nipqer
Click to expand...
Click to collapse
You sir, just made my day!
Guide works like a charm! thank you!

Nipqer, thanks Mate.
Got everything sorted out on G2root on irc!
Your guide is the .... thanks again!

Thanks this saved me! The guys on g2root irc are way too helpful! Much thanks to them, no thanks to HTC unlocker for wasting a day of my life.

Is there any way of getting S-Off after you've used the HTC Dev Unlock?

No, not yet. As soon as we have figured out a way I'll update the OP.
-Nipqer

Related

2.2: cannot downgrade

hi.
i'm trying to root my HTC Legend (stock froyo) but i'm stuck to the downgrade step.
i've created the gold card but when i try to downgrade i get always this:
Code:
C:\Program Files (x86)\Android\android-sdk\tools>crackin.bat
"Copying tools"
2301 KB/s (698452 bytes in 0.296s)
1190 KB/s (76044 bytes in 0.062s)
2413 KB/s (655360 bytes in 0.265s)
"Freeing primary PERM linker"
rm failed for /data/DxDrm/fuse/*, No such file or directory
rm failed for /data/DxDrm/fuse, No such file or directory
rmdir failed for /data/DxDrm/fuse/, No such file or directory
cannot create /data/DxDrm/fuse: directory nonexistent
Unable to chmod /data/DxDrm/fuse: No such file or directory
"Freeing secondary PERM linker"
rmdir failed for /data/DxDrm/fuse/, No such file or directory
rmdir failed for /data/DxDrm, No such file or directory
link failed Permission denied
"Rebooting to normal mode to unlock CHMOD links"
rmdir failed for /data/dontpanic, Permission denied
rm failed for /data/DxDrm, No such file or directory
link failed File exists
link failed Permission denied
"Rebooting to normal mode to downgrade ROM"
/dev/mtd/mtd0: Permission denied
cr--rw---- 1 1001 2002 90, 0 Mar 5 17:17 /dev/mtd/mtd0
error writing misc: Permission denied
"Freeing links"
rm failed for /data/DxDrm, No such file or directory
rm failed for /data/dontpanic, Permission denied
any idea?
- Get visionary+
- Temproot your legend with it
- Use commandline with adb on your pc to flash misc1-2.img.
type the following commands from the folder where you have adb;
Code:
adb shell
su
accept the notification on your phone if one comes up
and then in the command line type this;
Code:
/data/local/flash_image misc /data/local/misc1-2.img
That should be enough to make it possible to run the 1.31 RUU.
same problem here..try many way as stated!!
Azaruc said:
- Get visionary+
- Temproot your legend with it
- Use commandline with adb on your pc to flash misc1-2.img.
type the following commands from the folder where you have adb;
Code:
adb shell
su
accept the notification on your phone if one comes up
and then in the command line type this;
Code:
/data/local/flash_image misc /data/local/misc1-2.img
That should be enough to make it possible to run the 1.31 RUU.
Click to expand...
Click to collapse
thanks for your answer.
please, tell me if i'm right.
i should follow these downgrade steps http://forum.xda-developers.com/showthread.php?t=725430 till the end when i keep receiving the reported error, then i should install visionary, temproot, and from a command prompt (starting from the "tools" directory of the android SDK? and the misc1-2.img goes there?) i should type those command.
and then?
run the RUU_Legend_HTC_WWE_1.31.405.5_R_Radio_47.26.35.04_ 7.05.35.26L_release_126592_signed.exe?
thanks man!
i did it!
I get error [171] anyone have any idea what is the reason ??
please hepl
I tried every way i managed o find
hboot - 1.00.0000
radio-7.13.35.05
soft 3.14.161.1
kernel 2.6.32.17
Azaruc said:
- Get visionary+
- Temproot your legend with it
- Use commandline with adb on your pc to flash misc1-2.img.
type the following commands from the folder where you have adb;
Code:
adb shell
su
accept the notification on your phone if one comes up
and then in the command line type this;
Code:
/data/local/flash_image misc /data/local/misc1-2.img
That should be enough to make it possible to run the 1.31 RUU.
Click to expand...
Click to collapse
i get permissions denied on the last step
/data/local/flash_image misc /data/local/misc1-2.img
help please?
Ohh c'mom dude! What does "adb shell" return? What does "su" return?
Sent from my HTC Legend
chris.chhoeu said:
i get permissions denied on the last step
/data/local/flash_image misc /data/local/misc1-2.img
help please?
Click to expand...
Click to collapse
Did you get the # symbol after the su command? If not, then you have to do temp root again.
What does ADB say? Do you have Debug Mode eneabled?
Sent from my HTC Legend using XDA App
temproot on boot or temproot now pls ?? thanks m8
"Temproot now"
Sent from my HTC Legend using XDA Premium App

G2 2.3.4 OTA 1-Click temp-root

Thanks for the move orb3000
EDIT:
Apparently I can't post links either... what gives??? Going to have to do this the ghetto way I guess..
Anyway, I made a nice little .bat to temp-root the 2.3.4 OTA for the T-Mobile G2 (HTC Vision) for all you lazy people out there, or the people who are just tired of playing with the cmd (like myself).
It's on media fire... www(dot)mediafire(dot)com/?xwurdlpcw61oxiz
Just unzip and run "rootg2.bat"
It uses fre3vo, as it is the only method that currently works. If this for some reason does NOT work for you, edit rootg2.bat and change the address set to one of the following after a reboot
FAA90000 -end FFFFFFFF
10000000 -end 1FFFFFFF
20000000 -end 2FFFFFFF
30000000 -end 3FFFFFFF
F0000000 -end FFFFFFFF
E0000000 -end EFFFFFFF
Find one that works?? Great! Now you have a bat juuuuuust for you.
Long time lurker, first time poster, micro sized developer.
how to install
hi, i'm not very good with this. can you let me know how to install the g2root file on my g2? by the way, is this a permanent root? thx
tntx said:
hi, i'm not very good with this. can you let me know how to install the g2root file on my g2? by the way, is this a permanent root? thx
Click to expand...
Click to collapse
It says in the title this is a temporary root, not permanent. Check the [REF] Sticky is either General or Development for guides that will help you through the proces. DO NOT attempt root until you are sure you know what you are doing. READ and SEARCH!
Does anyone know of a way to temp-root on-device, without having to hook up to a PC?
After the message "daemon started successfully" the adb just hangs at that line, no crash, just doesn't advance any further. I can't input any commands either. I waited for over an hour to see if it would proceed, but not as such. Any ideas?
RebelScum75 said:
Does anyone know of a way to temp-root on-device, without having to hook up to a PC?
Click to expand...
Click to collapse
Hi!
I know that there is none
Have fun - Guhl
will this also work for the desire z ?
no dude ive been looking forever "finally had a reason to root the darn thing but i dont think there is one at least not that i have found--i work for verizon now anyways left my tmo--lol-----
dianlb50 said:
will this also work for the desire z ?
Click to expand...
Click to collapse
yes, basically same phone
Did this work for anyone?
Sent from my T-Mobile G2 using XDA App
I'm having issues getting this to work. I have tried the various addresses with no solid confirmation of whether it worked or not, aside from running the app "Root Check" or attempting to use an app that requires root, and finding that the phone is indeed, not rooted.
The results vary however at best, the process appears to have gone through smoothly. Daemon was successful, it successfully locates the region, and finally successfully dismounts and and remounts, which leaves us at the stage where it says press any key to continue.
Are there additional steps? What conditions must be met in order for this to work other than turning on debugging mode? Must the usb cord remain connected? Does the temp root end once the cord is unplugged? The guide above didn't exactly give any clear cut step-by-step directions and so I am feeling as if I'm not doing something because the guide doesn't mention it.
Can someone who has successfully temp-rooted their G2 v2.3.4 post a list of steps needed from start to finish? Example:
1) Enable USB debugging on phone.
2) Plug phone into computer via USB cord.
3) Unzip g2root.zip into a folder of your choice.
4) Run g2root.bat.
5) If successful, you will see (fill in the blank)
6) If successful, go to step 7, if unsuccessful, reboot computer/phone and retry step 1
Something like the above direct would be extremely useful to a few of us. Thanks!
-HobbesG2
Hello, I think this is my first post over here.
enable usb debugging on the phone
Plug phone into computer via USB
kill adb if it is already running:
Code:
./adb kill-server
start adb server as root:
Code:
sudo ./adb start-server
sample output:
Code:
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
Code:
./adb wait-for-device
and wait for this command to exit
Code:
./adb push /PUT/PATH/TO/G2ROOT/HERE/fre3vo /data/local/tmp
sample output:
Code:
218 KB/s (9796 bytes in 0.043s)
Code:
./adb -d shell chmod 777 /data/local/tmp/fre3vo
Code:
./adb -d shell /data/local/tmp/fre3vo -debug -start fb040000 -end FFFFFFFF
sample output:
Code:
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 2fd00000
smem_len: 300000
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 0
bits_per_pixel: 32
activate: 16
height: 80
width: 48
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Frame Buffer handle: 4
Buffer offset: 002ee000
Buffer size: 8192
Scanning region fb040000...
Scanning region fb130000...
Scanning region fb220000...
Scanning region fb310000...
Scanning region fb400000...
Scanning region fb4f0000...
Scanning region fb5e0000...
Scanning region fb6d0000...
Scanning region fb7c0000...
Scanning region fb8b0000...
Scanning region fb9a0000...
Scanning region fba90000...
Potential exploit area found at address fbb54e00:1200.
Exploiting device...
Code:
adb wait-for-device
Code:
./adb -d remount
sample output:
Code:
remount succeeded
verify you have root:
Code:
./adb -d shell id
output:
Code:
uid=0(root) gid=0(root)
Or you could verify it worked by executing 'adb shell' and if you have a # prompt rather than $, it worked.
This will stick until you reboot. Unplugging the cable will not affect it (unless you're currently running the commands)
This is not exactly a true temp-root, as it just gives adb root access, but you should be able to remount /system as rw and push su and SuperUser.apk to the right places to get a proper temp-root.
-Nipqer
Nipqer said:
you should be able to remount /system as rw and push su and SuperUser.apk to the right places to get a proper temp-root.
Click to expand...
Click to collapse
could you please describe how to do that? where do i get these packages from?
Getting closer but still not quite there. The reason why I was not having confirmations before was because I was running the rootg2.bat file directly rather than doing it through the cmd prompt, aka Start --> Run --> [type cmd]. After having ran the .bat file via the cmd prompt, I was able to apply, and confirm via the steps that were mentioned.
Problem is, I'm still not exactly truly temp-rooted, as none of my apps that require root or are designed to check root, show me as rooted. Is this because superuser and/or busybox are not operating as if they are rooted due to something I'm not aware of?
I already have the latest Superuser/Elite and BusyBox installed onto my phone via the Market. Do I have to push them into a specific folder that simply installing them from market wont do automatically?
Any thoughts?
After I get this nailed down, I will write a comprehensive explaination for others to do this as well.
Here is a true temp-root which works with fre3vo.
Just read the readme file.
-Nipqer
any update on this one?
i hope this makes rooting easier...
Nipqer said:
Here is a true temp-root which works with fre3vo.
Just read the readme file.
-Nipqer
Click to expand...
Click to collapse
I see this method listed for the Sensation, has it been proven to work for G2, stock OTA 2.3.4?
Wondering the same.
If you are running 2.3.x, and use fre3vo, then run that zip I posted, you will have proper temp-root.
It will stick until a reboot, but then you can just redo everything.
Yes it's proven to work.
-Nipqer

Stuck in KF boot screen - details

Received my KF about a week ago. Just tried to root it yesterday. That was successful. The instructions I was using said this: "This will “root” your Kindle Fire. You can actually stop here but I recommend you to go to the next steps to install TWRP Recovery, which will allow you to install/backup/restore ROMs and also “unroot” your Kindle Fire when needed easily." So, silly me, without doing further research, went on to the next steps. I almost immediately got stuck, here is the code, ending with the -bash where I was stuck.
Zach:~ Zbhest$
Zach:~ Zbhest$ cd Downloads/KindleFireRootMacLinux
Zach:KindleFireRootMacLinux Zbhest$ mkdir ~/.android
mkdir: /Users/Zbhest/.android: File exists
Zach:KindleFireRootMacLinux Zbhest$ cp adb_usb.ini ~/.android/.
Zach:KindleFireRootMacLinux Zbhest$ cp adb_usb.ini ~/.android/
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac kill-server
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac devices* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
08EC002600000001 device
Zach:KindleFireRootMacLinux Zbhest$ sh runmemac.sh
---------------------------------------------------------------
Easy rooting toolkit (v2.0)
created by DooMLoRD
Modified for Kindle Fire for Linux/Mac by Max Lee at RootKindleFire.com
using exploit zergRush (Revolutionary Team)
Credits go to all those involved in making this possible!
---------------------------------------------------------------
[*] This script will:
(1) root ur device using latest zergRush exploit (10 Nov)
(2) install Busybox (1.18.4)
(3) install SU files (binary: 3.0.3 and apk: 3.0.6)
[*] Before u begin:
(1) enable USB DEBUGGING
from (Menu\Settings\Applications\Development)
(2) enable UNKNOWN SOURCES
from (Menu\Settings\Applications)
(3) [OPTIONAL] increase screen timeout to 10 minutes
(4) connect USB cable to PHONE and then connect 2 computer
---------------------------------------------------------------
--- STARTING ----
--- WAITING FOR DEVICE
--- cleaning
rm failed for *, No such file or directory
--- pushing zergRush
1836 KB/s (23056 bytes in 0.012s)
--- correcting permissions
--- executing zergRush
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00015118
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[+] Overseer found a path ! 0x000151e0
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x40119cd4 0x0054
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd195bb 0xafd39357
[*] Popping 24 more zerglings
[*] Sending 173 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!
--- WAITING FOR DEVICE TO RECONNECT
if it gets stuck over here for a long time then try:
disconnect usb cable and reconnect it
toggle USB DEBUGGING (first disable it then enable it)
--- DEVICE FOUND
--- pushing busybox
4634 KB/s (1075144 bytes in 0.226s)
--- correcting permissions
--- remounting /system
--- copying busybox to /system/xbin/
2099+1 records in
2099+1 records out
1075144 bytes transferred in 0.038 secs (28293263 bytes/sec)
--- correcting ownership
--- correcting permissions
--- installing busybox
--- pushing SU binary
1508 KB/s (22228 bytes in 0.014s)
--- correcting ownership
--- correcting permissions
--- correcting symlinks
--- pushing Superuser app
5116 KB/s (785801 bytes in 0.149s)
--- cleaning
--- rebooting
--- WAITING FOR DEVICE
5382 KB/s (3104805 bytes in 0.563s)
Error: Could not access the Package Manager. Is the system running?
All Done, Kindle Fire ROOTED!!!
Check out RootKindleFire.com for more cool hacks!
Zach:KindleFireRootMacLinux Zbhest$
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac root
restarting adbd as root
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac remountremount succeeded
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac push su /system/xbin/su
260 KB/s (22228 bytes in 0.083s)
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac shell chmod -6755 /system/sbin/su
Bad mode
Zach:KindleFireRootMacLinux Zbhest$ .adb./adb-mac shell chown 0.0 /system/xbin/su
-bash: .adb./adb-mac: No such file or directory
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac shell chown 0.0 /system/xbin/su
Zach:KindleFireRootMacLinux Zbhest$ cd Desktop/kindleFireRootNew
-bash: cd: Desktop/kindleFireRootNew: No such file or directory
Zach:KindleFireRootMacLinux Zbhest$ cd desktop/kindlefirerootnew
-bash: cd: desktop/kindlefirerootnew: No such file or directory
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac push su /system/xbin/su
877 KB/s (22228 bytes in 0.024s)
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac root
adbd is already running as root
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac remountremount succeeded
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac push su /system/xboin/su
264 KB/s (22228 bytes in 0.081s)
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac shell cown 0.0 /system/xbin/su
cown: not found
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac shell chown 0.0 /system/xbin/su
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac shell chmod 06755 /system/xbin/su
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac install Superuser.apk
3818 KB/s (785801 bytes in 0.200s)
pkg: /data/local/tmp/Superuser.apk
Success
Zach:KindleFireRootMacLinux Zbhest$ ./adb-mac shell
# su
# idme bootmode 4002
<idme> write 4002 to offset 0x1000
# reboot
Zach:KindleFireRootMacLinux Zbhest$ ./fastboot-mac -i 0x1949 boot twrp-blaze-2.0.0RC0.img
-bash: ./fastboot-mac: No such file or directory
And now my Mac does not recognize my KF. When I unplug my KF it appears bricked (will not turn on), but when it is plugged into a wall outlet I can do the hard reset, it charges, but does not go past the KF boot screen.
Also, ADB does not recognize any devices.
Additionally, I have a windows 7 machine. I was going to attempt to pick up where I left off, but as my KF is listed as an "unknown device," I cannot update drivers (or do not know how to do so manually). I also installed this little number: http://forum.xda-developers.com/showthread.php?t=1430038
And I currently have linux loaded on my W7 machine. When I try to use the "normal_boot" command, which is advised, I get:
"Resetting bootmode to standard boot...
< waiting for device >
"
So, yeah. That is where I am at. I WOULD go on to the other directions in firekit, but would prefer not to completely void the warranty using the "usb boot mode trick".
If windows 7 is the key here, I may need a walk through for driver installation and such. Otherwise, I am not totally disinclined to call customer service and ask for a replacement. Apparently they have been good about replacing rooted kindles?
Same issue right now... already tried reinstalling windows/firekit liveusb but nothing works=\ Is there any news on this problem?
http://support.microsoft.com/kb/315539/en-us
http://forum.xda-developers.com/showpost.php?p=20855280&postcount=54
I did read all those threads about such problem before. Just no matter what i do those drivers won't install. I only get unknown device on 7/xp and cannot change it coz when i manually select those drives windows says that there no device info in it=\ Thanks for help anyways
did you select adb_usb.ini ? it's just the folder with this file in it. selecting just the folder is usually enough. if you want to select the file: the driver file is android_winusb.inf. there is the harware info
if you have xp available then use this machine - it's easier
Yeah i did select that inf file (it was only one selectable in folder anyway) but it still says same stuff. I have xp right now if that gonna change something
yes xp is easier to handle because:
only 32bit -> only 1 driver version
no user access control -> don't need to do every thing as administrator
please check the following:
you have a .android folder under your user directory - in this folder is adb_usb.ini - the file has entries for device 0x1949 and 0x18D1 - if not run install.bat from the driver set i provided
check your device manager and delete every entry with kindle or adb
unplug and replug your kf - select the driver i provided manually
Got those 0x1949 and 0x18D1 in adb_usb file. And i only have unknown device every time i plug kindle in, no adb kindle at all
right click unknown device - update driver - select android_winusb.inf
if this don't work we have to cleanup old drivers -> could help per teamviewer if you like
When i try to update driver and manually use inf you provided it says that there no device info there=\ And i got unknown device since fresh windows install so idk what driver can cause it -.- I could ve try teamviewer but my windows is not english so it gonna be quite useless.
what language ?
Well it's in russian +there no laptop drivers yet coz im using xp only for this god dam kindle
ok your right - with russian i have a problem
will try to describe you the steps:
disconnect and power off (pwr ~30sec) your KF
open a command prompt
type "set devmgr_show_nonpresent_devices=1"
type "start devmgmt.msc"
Click Show hidden devices on the View menu in Device Manager
uninstall every entry with kindle, android phone or adb device
power down computer and power on again (no restart)
tell me if your done - we will resume ...
ok i did everything step by step tho there was none of adb/android phone/kindle so i just deleted my unknown device.
ok - lets resume:
you may want to delete your old driver set previously downloaded - it must be faulty
now download the one from this post and extract it to c:\
now plugin your kf (don't power it on - will do it by itself)
if you' asked
-choose browse my computer for driver software
-Then select have disk
-Then select browse
-direct to where you downloaded the usb driver i attached
-Select okay and okay
just in case you'r not asked:
-Go to device manager
-right click on the exclamation mark kindle
-Choose update driver software
-choose browse my computer for driver software
-choose let me pick from a list of devices on my computer
-Then select have disk
-Then select browse
-direct to where you downloaded the usb driver i attached
-Select okay and okay
if this don't work eighter then i would think you have a faulty cable !
try an other one ...
Nope still same=\ Guess i will look for new cable tomorrow then tho this one was just fine today at transfering stuff (dam you nokia!). Well thanks for trying to help anyway.
you have the nokia cable - i have the same one
tell me the status your kf now
stuck at boot screen ?
some other tricks:
http://forum.xda-developers.com/showpost.php?p=20945694&postcount=506
if you'r stuck in wrong bootmode:
with adb:
adb shell su -c "idme bootmode 4000"
adb reboot
with fastboot:
fastboot -i 0x1949 oem idme bootmode 4000
fastboot -i 0x1949 reboot
or
fastboot -i 0x18d1 oem idme bootmode 4000
fastboot -i 0x18d1 reboot
or
fastboot oem idme bootmode 4000
fastboot reboot
if you issue the fastboot commands and get <waiting for device> over some while power the kf off (pwr ~30sec) and on. at some point it should recognize the command
Yeah it same as before=\ I have same problem as topic starter aka device in fastboot and windows won't recognize it and install correct drivers. Fastboot commands won't work coz i don't have correct drivers and all they do is stuck on waiting for device/
xx time later = IT WORKS!!! for some weird reason it picked kindle up nothing changed in windows yet it works! Thanks again for your help time to flash recovery again.
courious - just tested on mine
when i switch to fastboot it is recognised as "android adb interface"
not the composite thing !
and i have the same drivers on xp
perhaps you want to try this one:
http://forum.xda-developers.com/showthread.php?t=1428428
sorry - no more ideas ...
UPDATE: hurraaa !!! - wish you all the best and good luck !!!

[Gen8v2, A70B/A70IT2 Froyo] HOWTO: Enable SDE menus without Archos SDE firmware

Hi All,
As some may know, current Official SDE for gen8 doesn't work on the new Froyo Gen8 v2 devices (currently: A70b / A70it2).
As we do on Gen9, there is a way to enable SDE menu in recovery for the new Archos A70S/A70it2. It's quite easy and safe, it has been used multiple times on gen9 and only use Archos commands (except of course temp root that is done by using psneuter).
Disclaimer: I'm not responsible if you blow your device with this, I'm only using existing Archos commands but this is not an official Archos release. Use at your own risks.
If you don't know about SDE, check my Gen9 thread here, it has some pictures that could help (70it2 menus are not exactly the same but are similar).
So, to enable it:
1) You must have adb working, I won't detail how to install or use it here. "adb shell" should give you a '$' prompt, if it doesn't, check your adb installation first.
2) Unzip content of the attached file to a directory (or platform-tools if adb is not in your PATH)
3) Launch enable_sde.bat script (or enable_sde.sh for linux, don't forget to chmod 755 it)
4) It should display something like this:
Code:
5800 KB/s (557962 bytes in 0.093s)
4625 KB/s (2564188 bytes in 0.541s)
5000 KB/s (728825 bytes in 0.142s)
property service neutered.
killing adbd. (should restart in a second or two)
Generating KD...
Updating KD (3293269 bytes)...
0
100
4) If it worked properly (check file sizes, some had troubles with adb push), reboot in recovery with power+vol+, you should now see the SDE boot menu. If you go to recovery, you should see the and if you go to recovery, you should see the "Developer Edition Menu". If it doesn't work for you, please report in this thread.
Next step is to install a rooted build, you can find one here.
Cheers,
LeTama
Flawless victory...excellent.
Hello!
i get the following error:
Code:
D:\test>enable_sde.bat
D:\test>adb push psneuter /tmp
failed to copy 'psneuter' to '/tmp/psneuter': Permission denied
D:\test>adb push init_zImage /tmp
failed to copy 'init_zImage' to '/tmp/init_zImage': Permission denied
D:\test>adb push init-cpio.gz /tmp
failed to copy 'init-cpio.gz' to '/tmp/init-cpio.gz': Permission denied
D:\test>adb shell chmod 755 /tmp/psneuter
chmod: /tmp/psneuter: No such file or directory
D:\test>adb shell /tmp/psneuter
/bin/sh: /tmp/psneuter: not found
D:\test>ping 127.0.0.1 -n 5 -w 1000 1>nul
D:\test>adb shell /usr/bin/kd_flasher -i /tmp/init-cpio.gz -k /tmp/init_zImage
Generating KD...
cannot open kernel file: No such file or directory
mkflashimage failed
D:\test>adb shell sync
D:\test>
it is an archos A70it2.
Honeycomb or Froyo model ?
This one is for Froyo, I changed title to reflect it, sorry. Check my sig for the Honeycomb one...
Ok, it is the honeycomb model I will try the other one - thx!

Hungover Root [Roots latest version without flashing anything]

Well, I know it's not particularly important since Zergrush still works but I've found an exploit of file permissions on the latest update.
This root causes things to break until you undo it due to it drops you into emulator mode on your phone. This isn't doing anything bad but a lot of things crash and only a few things really work...like ADB. So this is when you install su / superuser.apk and then you just undo it and reboot. Then you'll have superuser installed on your device. This should theoretically work for all samsung Galaxy S devices (Captivate, Vibrant, Epic 4G, etc) so feel free to try and link to this in those forums.
Story behind the root: I was drunk and bored, a friend had the Captivate, and I decided to look and find this.
Instructions! (The fun part!)
Download the .zip file and run the following commands:
Code:
adb push Hungover.sh /data/local/tmp/Hungover.sh
adb shell chmod 755 /data/local/tmp/Hungover.sh
adb shell ./data/local/tmp/Hungover.sh --recovery
After it reboots into recovery hold vol down+vol up + power and it should reboot. After its back up and running do this:
Code:
adb shell ./data/local/tmp/Hungover.sh --setup
after it reboots again, press Volume+, Volume- and Power at the same time, and reboot the system.
One more time with feeling:
Code:
adb shell ./data/local/tmp/Hungover.sh --root
****
After it reboots, run:
adb remount
adb push SuperUser.apk /system/app/
adb push su /system/xbin/su
adb shell "chmod 04755 /system/xbin/su ; chmod 755 /system/app/SuperUser.apk ; ./data/local/tmp/Hungover.sh --undo"
Then you will have root! Do whatever the hell you want at this point! :)
Download:
https://dl.dropboxusercontent.com/u/15069134/Hungover.zip
Changelog:
[code] Initial release 1.0
Credits:
Me for finding the exploit.
mechapanda for letting me potentially break his phone.
This post is mine for ****s and giggles.
It was fun watching my fun go through qemu, although i can't say i'd feel the same if i wasn't doing this on purpose.
Fails on Karbonn A37
Fails on Karbonn A37 with the following error.
C:\android-sdk\platform-tools>adb push Hungover.sh /data/local/tmp/Hungover.sh
486 KB/s (1993 bytes in 0.004s)
C:\android-sdk\platform-tools>adb shell chmod 755 /data/local/tmp/Hungover.sh
C:\android-sdk\platform-tools>adb shell ./data/local/tmp/Hungover.sh --recovery
/system/bin/sh: ./data/local/tmp/Hungover.sh: No such file or directory
dockers said:
Fails on Karbonn A37 with the following error.
C:\android-sdk\platform-tools>adb push Hungover.sh /data/local/tmp/Hungover.sh
486 KB/s (1993 bytes in 0.004s)
C:\android-sdk\platform-tools>adb shell chmod 755 /data/local/tmp/Hungover.sh
C:\android-sdk\platform-tools>adb shell ./data/local/tmp/Hungover.sh --recovery
/system/bin/sh: ./data/local/tmp/Hungover.sh: No such file or directory
Click to expand...
Click to collapse
're read the OP mate... It's for Galaxy S phones ! So it won't work for your phone
Sent from my SGH-I897 using Tapatalk 2

Categories

Resources