Database Users

[Root+ROM+RUU] This will root your TB and install BAMF 1.5nte and the leaked RUU.

All root credit still goes to AndIRC and crew. ​
Rooting The ThunderBolt – Updating The Radio – And Installing BAMF 1.5
From Adrynalyne: This totally awesome wtfomgroflbbq ungodly large PG05IMG.zip contains the latest of everything 1.13.605.7 has to offer plus engineering hboot for s-off, BAMF 1.5, BAMF 4.4.2 kernel, clockwork, and custom boot splash by gadget!
Pros
Root with read/write access to /system
Ability to downgrade and flash any RUU (i.e. signed firmware)
S-OFF
Fully unlocked bootloader
Latest RUU installed
BAMF 1.5nte installed
Cons
Voids warranty
Could brick your phone if you aren’t careful
Its an RUU, IT CAN BREAK YOSELF.....FOO!!!
Its an RUU, IT CAN BREAK YOSELF.....FOO!!!
Its an RUU, IT CAN BREAK YOSELF.....FOO!!!
The method of rooting your Android device as described in the article herein is solely for enthusiasts and not for the faint of heart.
IT WILL WIPE YOUR DATA. IT WILL WIPE YOUR DATA. IT WILL WIPE YOUR DATA.
Android Police and Team AndIRC and Adrynalyne disclaim all liability for any harm that may befall your device, including, but not limited to: bricked phones, voided manufacturer warranties, exploding batteries, etc.
The instructions below assume you already have a strong familiarity with adb command lines – this is not for beginners.
Credits
Adrynalyne for the Custom RUU, BAMF, and Kernel
Scotty2, jamezelle, jcase, and all of Team AndIRC
dsb9938 for writing this, testing, boot ani, and just being an overall great guy
Testers, especially ProTekk and Trident
Gadget for boot splash and ani
Thanks to scotty2 for WPThis
Busybox was pulled from a CyanogenMod ROM, source should be available here
psneuter was pulled from somewhere, credit to scotty2, source here
All firmware credit goes to 911sniper
If I missed anyone in the credits, it was unintentional and I will fix it soon. Lots of people had their hands in on this project.
Please read the instructions in full before you start. Also, make sure your battery is fully charged before taking the plunge.
Step 1
First, download these files:
RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.01 03_2r_NV_8k_1.37_9k_1.52_release_165253 (md5sum : aae974054fc3aed275ba3596480ccd5b) THIS IS THE DOWNGRADE RUU USED IN STEP 4:
Multiupload mirror
GalaxySense mirror
DroidSite mirror
Mirrors for the package (contains busybox, wpthis, psneuter, su, readme.txt, misc.img, and hbooteng.nb0) (md5sum : 3b359efd76aac456ba7fb0d6972de3af) THIS IS THE EXPLOITS FILE:
Multiupload mirror
GalaxySense mirror
DroidSite mirror
BAMF/Leaked RUU mirrors (md5sum : ede0dc842ab676080befe2ae01c74cd3) THIS IS THE CUSTOM RUU USED IN STEP 7:
Single Source
Step 2
Note that adb is required.
Push misc.img, busybox, and psnueter using the following commands:
Code:
adb push psneuter /data/local/
adb push busybox /data/local/
adb push misc.img /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox
Step 3
This step will gain temp root and flash the custom misc.img. Run:
Code:
adb shell
Now the shell should display "$".
Run:
Code:
/data/local/psneuter
You will now be kicked out of adb, and adb will restart as root.
Let’s confirm the md5 of misc.img:
Code:
adb shell
At this point, the shell should display "#".
Now run:
Code:
/data/local/busybox md5sum /data/local/misc.img
Output should be "c88dd947eb3b36eec90503a3525ae0de." If it’s anything else, re-download the file and try again.
Now let’s write misc.img:
Code:
dd if=/data/local/misc.img of=/dev/block/mmcblk0p17
exit
Step 4
Here you will rename the downgrade RUU (RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.01 03_2r_NV_8k_1.37_9k_1.52_release_165253) as PG05IMG.zip and place it on your SD card (put the phone in drive mode and just copy it with your OS). Then, run the following command:
Code:
adb reboot bootloader
Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.
Step 5
Set up the two part exploit, to gain root and unlock MMC.
Push wpthis, busybox, and psnueter:
Code:
adb push psneuter /data/local/
adb push busybox /data/local/
adb push wpthis /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox
adb shell chmod 777 /data/local/wpthis
Gain root (this will once again throw you out of adb):
Code:
adb shell
/data/local/psneuter
Unlock MMC:
Code:
adb shell
/data/local/wpthis
exit
Step 6
Please pay attention – this is very important. This step involves a small chance of bricking if you mess up.
To push the eng bootloader:
Code:
adb push hbooteng.nb0 /data/local/
adb shell
/data/local/busybox md5sum /data/local/hbooteng.nb0
If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb" exactly, stop, delete it, and re-download it. Otherwise, continue.
Now we will write the new bootloader.
Code:
dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18
Confirm proper write:
Code:
/data/local/busybox md5sum /dev/block/mmcblk0p18
If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb," try again; if it still doesn’t work, seek help from http://chat.andirc.net:9090/?channels=#root. DO NOT REBOOT.
Reboot.
Step 7
Now, put the custom leaked RUU (Adrynalyne.1.5.PG05IMG.zip) on your SD card by putting the phone in drive mode and copying it with your OS. Now rename it to PG05IMG.zip.
Then using an md5sum type program, check the md5sum and make sure it matches ede0dc842ab676080befe2ae01c74cd3, if it does not, redownload it. (Here is a free windows md5summer).
Next, run this command:
Code:
adb reboot bootloader
Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.
After it flashes, you will be running BAMF 1.5nte with S-OFF on the latest leaked RUU.
Please Note: One of the TP images will be bypassed while flashing, this is normal. Also, on first boot, there will be no boot sound, this is normal.
Please make a nand backup in Rom Manager after you go thorugh phone set up.
Rom Manager, SuperUser, and Titanium Backup are already installed.
ClockWork Recovery 3.0.2.5 is already installed.
If you have problems, come to the chat: irc.andirc.net #root or use http://chat.andirc.net:9090/?channels=#root.
.

"omg, no one-click method!?"
jk, this will be a nice time-saver for those just getting their Thunderbolts. Great job compiling this all into one package!

Sweet!

Nice job! Gotta love how the Android community is always trying to help the non-tech savvy be awesome too.
Sent from a bit of awesomeness...

Great job this will come in handy if I decide to root the wifes phone. Mine has been rooted for a while now.

this isnt working so well for me... flashing the last part and boot failed and its stuck on mdm9k

lllboredlll said:
this isnt working so well for me... flashing the last part and boot failed and its stuck on mdm9k
Click to expand...
Click to collapse
Please post back and let us know how things work out after you get the new phone. Sorry you had to have what I think is a bad nand chip that wouldn't take a flash.
D

dsb9938 said:
Please post back and let us know how things work out after you get the new phone. Sorry you had to have what I think is a bad nand chip that wouldn't take a flash.
D
Click to expand...
Click to collapse
well just for the record ... i hold no one accountable but myself or vzw on this one.... what a weird experience.... all the flashing and modding i've done over the last 5 years or so and I kill this phone right out of the gate... it literally made it 2hrs 45 minutes before i had a funeral for it lol

lllboredlll said:
well just for the record ... i hold no one accountable but myself or vzw on this one.... what a weird experience.... all the flashing and modding i've done over the last 5 years or so and I kill this phone right out of the gate... it literally made it 2hrs 45 minutes before i had a funeral for it lol
Click to expand...
Click to collapse
Thanks. I think we did all we could. Happy to help with the new one.
Sent from my ThunderBAMF using the XDA app.

Thank you for this.. Made ROOTING my wife's phone a breeze!

desire hd build 2.36.405.8 downgrade problem

using method in http://forum.xda-developers.com/showthread.php?t=905003
Uploaded with ImageShack.us
can't do anything else.

Do a factory reset and try again.

Done
i do a factory reset but the same problem

Try using another SD card, make sure to format it first

And don't give up. I had to repeat this procedure many times with three sd cards, and after a few hours it finished successfully

hey ı have same problem but I make this 3 times another SD card but still I didn't downgrade

Try this steps:
a. Download 'Downgrade_v2.zip', extract it and place into C:\ (for example, C:\downgrade\).
b.
adb push misc_version /data/local/tmp
adb push GingerBreak /data/local/tmp
adb shell chmod 777 /data/local/tmp/misc_version
adb shell chmod 777 /data/local/tmp/GingerBreak
adb shell
./data/local/tmp/GingerBreak
c. If you see "#", you got a temporary root!
d. Enter:
cd /data/local/tmp
./misc_version -s 1.31.405.6
e. Next, you must download PD98IMG.zip and put into SD card (don't extract it or put in folder!)
f. Reboot your Desire HD and hold VOL-
g. Choose 'Yes' and downgrade is begin!
I checked this steps and my Desire HD is downgraded successfully.
-----
Downgrade_v2.zip - multiupload .com / OYKBRXIYT2
ROM for downgrade to 1.32 - multiupload .com / BTJ8KY0KH9

suroegin said:
Try this steps:
a. Download 'Downgrade_v2.zip', extract it and place into C:\ (for example, C:\downgrade\).
b.
adb push misc_version /data/local/tmp
adb push GingerBreak /data/local/tmp
adb shell chmod 777 /data/local/tmp/misc_version
adb shell chmod 777 /data/local/tmp/GingerBreak
adb shell
./data/local/tmp/GingerBreak
c. If you see "#", you got a temporary root!
d. Enter:
cd /data/local/tmp
./misc_version -s 1.31.405.6
e. Next, you must download PD98IMG.zip and put into SD card (don't extract it or put in folder!)
f. Reboot your Desire HD and hold VOL-
g. Choose 'Yes' and downgrade is begin!
I checked this steps and my Desire HD is downgraded successfully.
Click to expand...
Click to collapse
I did not see # I made everything but it didnt start i will be record a video to show this problem

youtubecom/watch?v=itf8dWTFqII

same problem!!! dunno what to doo

same here error: device not found
any solutions?

ahmettuncez said:
http://www.youtube.com/watch?v=itf8dWTFqII
Click to expand...
Click to collapse
Just watched this.
Either,
a). Your firmware is not 2.36, likely 2.37/2.42 - you can not downgrade yet.
b). You need to do a full factory reset and try again - same happens --> read a).
c). Your not waiting long enough can take 30 seconds - 5 minutes - try b). then read a).
@johi69 - a "device not found" error simply means,
a). plug in your phone
b). you do not have the android SDK installed - install it
c). you do not have USB debugging enabled - enable it - Settings > Applications > Development.

Does built number 2.36.405.8 means 2.37???
and what happens with the phone if you try to downgrade and fails is everything back as it was?

pahildo said:
Does built number 2.36.405.8 means 2.37???
and what happens with the phone if you try to downgrade and fails is everything back as it was?
Click to expand...
Click to collapse
no, 2.36 is ok, it's not 2.37
if you fail, nothing is gonna happend(before i downgrade, i've tried at least 5 times)
just follow the steps, one by one, and I'm not responsible if you brick your device, do at your own risk but if you follow all steps, and you know what you are doing, it should be safe, for me it was.
before you start downgrade, do a factory reset of your phone.
links to downgrade:
http://forum.xda-developers.com/showthread.php?t=905003

[GUIDE] Root DHD with any RUU Shiprom

Thanks sxrsxrsx and sorry for my bad english.
Step 1. download RUU shiprom at: http://forum.xda-developers.com/showthread.php?t=824357
Step 2. Run it and no flash. Press key: Win + R or Start -> Run: %temp%
Step 3. You'll see a directory like: {ED95101E-EF94-42DB-92DE-4FB4470739CA} and find the file rom.zip ( or download rom RUU Asia 2.37.707.3 : https://rapidshare.com/files/3144048228/rom.zip )
Step 4. Unzip rom.zip and replace the file recovery.img : https://rapidshare.com/files/1790416276/recovery3026ace.img
Step 5. Zip all and overwrite the file rom.zip
Step 6. Connect with USB cable and Flash ROM RUU into DHD ( if you see CID incorrect next step 13 )
Step 7. After flashing. Boot DHD into Recovery mode (Hold Volume down and Power)
Step 8. Download root.rar : http://www.megaupload.com/?d=OOY9KHU6
Step 9. Go to: mount and storage (mount /sdcard, /system, /data)
Step 10. Connect USB cable with DHD.
Step 11. Go to root folder. and run command in cmd.
adb push su /sdcard/su
adb push superuser.apk /sdcard/superuser.apk
adb push psneuter /data/local/tmp
adb shell chmod 777 /data/local/tmp/psneuter
adb shell /data/local/tmp/psneuter
adb shell
cp /sdcard/su /system/bin/
cp /sdcard/superuser.apk /system/app/
ln -s /system/bin/su /system/xbin/su
chmod 06555 /system/bin/su
Step 12. unmount the /system, data, sdcard. Reboot your phone and enjoy it
----
Step 13. please use shiprom same rom of your DHD. You can flash any rom after rooted and S-OFF
Make Goldcard
Link: http://www.addictivetips.com/mobile/how-to-make-gold-card-for-htc-desire-hd/
Download downgrade tools: http://forum.xda-developers.com/attachment.php?attachmentid=591335&d=1304969547
CMD:
adb push misc_version /data/local/tmp
adb push GingerBreak /data/local/tmp
adb shell chmod 777 /data/local/tmp/misc_version
adb shell chmod 777 /data/local/tmp/GingerBreak
adb shell
./data/local/tmp/GingerBreak
cd /data/local/tmp
./misc_version -s 1.31.405.6
Go back step 6.
If you need help, please pm me on Y!M: thangtn03

which one do i download from: http://forum.xda-developers.com/showthread.php?t=824357 ?

nt1303 said:
Thanks for sxrsxrsx and sorry for my bad english.
Step 1. download RUU shiprom at: http://forum.xda-developers.com/showthread.php?t=824357
Step 2. Run it and no flash. Press key: Win + R or Start -> Run: %temp%
Step 3. You'll see a directory like: {ED95101E-EF94-42DB-92DE-4FB4470739CA} and find the file rom.zip
Step 4. Unzip and replace the file recovery.img : http://www.megaupload.com/?d=5OBLG2WY
Step 5. compressed and overwrite the file rom.zip
Step 6. Connect with USB cable and Flash ROM RUU into DHD
Step 7. After flashing. Boot DHD into Recovery mode (Hold Volume down and Power)
Step 8. Download root.rar : http://www.megaupload.com/?d=OOY9KHU6
Step 9. Go to: mount and storage (mount /sdcard, /system, /data)
Step 10. Connect USB cable with DHD.
Step 11. Go to root folder. and run command in cmd.
adb push su /sdcard/su
adb push superuser.apk /sdcard/superuser.apk
adb push psneuter /data/local/tmp
adb shell chmod 777 /data/local/tmp/psneuter
adb shell /data/local/tmp/psneuter
adb shell
cp /sdcard/su /system/bin/
cp /sdcard/superuser.apk /system/app/
ln -s /system/bin/su /system/xbin/su
chmod 06555 /system/bin/su
Step 12. unmount the /system, data, sdcard. Reboot your phone and enjoy it
Click to expand...
Click to collapse
Step 4. Unzip and replace the file recovery.img : http://www.megaupload.com/?d=5OBLG2WY <-----Cannot unzip
Please explain Step 12
Thanks for the guide though

I get this error?? i tried the 2.36.405.8 and 2.37.707.3
If i go into Menu > settings > About phone > software information it says
Android version 2.3.3 and build number 2.37.61.11
Why is this not working for me

cash27 said:
Step 4. Unzip and replace the file recovery.img : http://www.megaupload.com/?d=5OBLG2WY <-----Cannot unzip
Please explain Step 12
Thanks for the guide though
Click to expand...
Click to collapse
I dont think you extract the recovery.img.
It's the rom compressed folder you extract and then you replace the recovery.img and then re-rar the file and replace the one in the temp folder.
I think thats right anyway

thats what i meant to say... could not extract rom.zip
Never mind.... i tried using 7zip, that did not work, but winrar did

cash27 said:
thats what i meant to say... could not extract rom.zip
Click to expand...
Click to collapse
Are you using win rar? i had no problems using winrar.

just edited my own post. You are absolutely right on

How does one mount and unmount in steps 9 and 12? is it a command? if so whats the syntax?

not sure, still stuck at my previous post.

I think you can use the downgrade method with your build

I am getting a signature error, will try with a goldcard and post results
EDIT: Same error Pic Attached

cash27 said:
I am getting a signature error, will try with a goldcard and post results
EDIT: Same error Pic Attached
Click to expand...
Click to collapse
i tried with a goldcard too, this didnt work .... I tried the downgrade method and that didnt work either -.-.............
I just want to get rid of the stupid freaking pre-installed orange apps.

As always, I am pessimistic about these kind of guides.
This time for a good reason: you cannot just replace signed recovery with unsigned recovery in rom.zip. The resulting package can only be flashed with S-OFF.

Would you happen to know if there is any development being done on this build? From what i have been reading in the forums...and please correct me if i am wrong, but very few people seem to have 2.43.661.

Please review Post #1 and try ship rom same your DHD rom.
Ex: My DHD from Korea , i try flash shiprom KT_KR and work it for me. After rooted and S-OFF, i can flash any shiprom 1.x or 2. WWE.

nt1303 said:
Please review Post #1 and try ship rom same your DHD rom.
Ex: My DHD from Korea , i try flash shiprom KT_KR and work it for me. After rooted and S-OFF, i can flash any shiprom 1.x or 2. WWE.
Click to expand...
Click to collapse
I tried with RUU_ACE_TELUS_WWE_1.84.661.1_R_Radio_12.35d.60.140f_26.06.03.24_M2_release_168987_signed
but when i modified the rom.zip file and put it i the directory, it would start but would give a signature error.
I tried with and without a goldcard, the result was the same: Error 132 signature

cash27 said:
I tried with RUU_ACE_TELUS_WWE_1.84.661.1_R_Radio_12.35d.60.140f_26.06.03.24_M2_release_168987_signed
but when i modified the rom.zip file and put it i the directory, it would start but would give a signature error.
I tried with and without a goldcard, the result was the same: Error 132 signature
Click to expand...
Click to collapse
I flashing multi ruu shiprom without any error. You try downgrade command and reflash you same firmware...

cash27 said:
I tried with RUU_ACE_TELUS_WWE_1.84.661.1_R_Radio_12.35d.60.140f_26.06.03.24_M2_release_168987_signed
but when i modified the rom.zip file and put it i the directory, it would start but would give a signature error.
I tried with and without a goldcard, the result was the same: Error 132 signature
Click to expand...
Click to collapse
I reuploaded file recovery.img , you can try relash...

nt1303 said:
I reuploaded file recovery.img , you can try relash...
Click to expand...
Click to collapse
Same error, but thank u for your effort

1st time attempt to root, stuck at visionary+

Hi all,
I appreciate this forum is cram packed with info, but for me as a newb...I can't see the woods for the trees :-(
I have a stock Orange D-HD ( A2.3.3 with sense 2.1 ) and basically just want to unlock it to use an O2 sim.
I have previously flashed WM6 cooked roms onto Kaisers / Hermes & Himyies so do understand the basic principle. And I grasp the basic point about rooting as I have flashed a Superpad device too.
http://forum.xda-developers.com/showthread.php?t=964996
So I started to follow the above tutorial thread and downloaded Visionary+ and S-OFF etc.
But even though I set USB root debugging, when I run Visionary+ to temp-root, my DHD just runs the triange message a few seconds and then just goes blank.
Is there an alternative way to root instead of visionary+ ???
Someone pls help me get past the first hurdle and root my device
Thanks

I got stuck too but...
Did u try ticking the 'root on startup or reboot' option? then restart. it may take a few goes, u'll probably notice Superuser has been installed then Temproot should happen next reboot. Permroot's the same, may take a few times to stick. To test if ur root has worked try installing Titanium Backup from market, u'll need it once ur rooted.

If you have a Stock HTC with Android 2.3.3 you need to downgrade the software version first before you can use visionary.
[GUIDE] How to downgrade 1.7x/1.8x/2.x to 1.32.405.6

ahh ok, will do.
None of this was mentioned in the guide link I mentioned in the original post. It would be worthwhile for that guide to be modded to reflect the fact a downgrade is needed.
"Open up a cmd and go to Downgrade folder"...is this done on the PC or the phone??? don't understand...

hey, have you created a goldcard mentioned in section 1 of the tutorial?

ermm,, nope
I wasn't sure I needed to as it seemed to be related to branded phones. Mine is locked to orange at present....but it doesn't have an orange splash screen or any orange logo on the phone casing. Thought if my 'build' number had '405' in the middle...that this meant I didn't need a goldcard creating...
wrong or right peeps??

ebod said:
None of this was mentioned in the guide link I mentioned in the original post.
Click to expand...
Click to collapse
Ehem......
wid0w said:
If your Desire HD is running stock firmware 1.7x, please check this guide in order to downgrade:
http://forum.xda-developers.com/showthread.php?t=905003
Click to expand...
Click to collapse
and
wid0w said:
Basic Setup
...
- Desire HD with lower than 1.7x stock ROM
...
Click to expand...
Click to collapse
I think the guide captures every detail.

for3st said:
Ehem......
and
I think the guide captures every detail.
Click to expand...
Click to collapse
All very well if you understand what a rom is. My software page is full of 2.50 , 2.6 type numbers and nothing below 1.7....hence my comment.
Also, I've made a goldcard out of a spare 1gb sd, and copied PD98img.zip to it. So for the next bit....do I now put that goldcard in my HTC and connect to the PC whilst set in USB debugging enabled mode.
Then do I put this lot below into the win-xp pc 'run' box line by line or one whole lump?:-
adb push misc_version /data/local/tmp
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF

ebod said:
All very well if you understand what a rom is. My software page is full of 2.50 , 2.6 type numbers and nothing below 1.7....hence my comment.
Also, I've made a goldcard out of a spare 1gb sd, and copied PD98img.zip to it. So for the next bit....do I now put that goldcard in my HTC and connect to the PC whilst set in USB debugging enabled mode.
Then do I put this lot below into the win-xp pc 'run' box line by line or one whole lump?:-
adb push misc_version /data/local/tmp
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
Click to expand...
Click to collapse
one by one......

I dont use Visionary+ , it just dont work in my phone,end me up using manual method. Plus S-off and Engineering S-off.
First of all, DOWNGRADE UR PHONE TO 1.32
Gaining Radio S-OFF:
This method will get you the Radio S-OFF flag while SIM-unlocking it and setting up SuperCID, which means
1. This method will root your phone for the process if it isn’t already rooted. If you just want to permanently root your phone
2. Make sure you have ADB installed on your computer. Also, if you have previously installed VISIONary on your phone in order to root it, uninstall it first before proceeding.
3. Download Desire HD S-OFF Toolkit and unzip its contents to your computer. Put it in your adb folder
4. Enable USB Debugging on your phone from Settings > Applications > Development.
5. Connect your phone to your computer via USB.
6. Launch a Command Prompt/Terminal window on your computer, navigate to the folder where you extracted the files in Step 3 and enter the following commandsne by one , press enter after each line
adb push su /sdcard/su
adb push Superuser.apk /sdcard/Superuser.apk
adb push rage /data/local/tmp/rage
adb push busybox /data/local/tmp/busybox
adb push root /data/local/tmp/root
adb push gfree /data/local
adb shell chmod 0755 /data/local/tmp/*
adb shell chmod 777 /data/local/gfree
7. Install Terminal Emulator app on your phone from the Android Market and launch it.
8. Enter the following command in Terminal Emulator on your phone:
/data/local/tmp/rage
9. In a while, you will see the output “Forked #### childs”. Now press ‘Menu’ and tap ‘Reset Term’ to exit Terminal Emulator.
10. Launch Terminal Emulator again. You will notice that it force-closes. Don’t worry and just launch it again, and you should have a root shell indicated by the # prompt instead of $.
11. Now enter the following commands in Terminal Emulator:
/data/local/gfree -f
sync
/data/local/tmp/root
sync
If you get a ‘mkdir: /system/xbin already exists’ error during the process, ignore it and proceed.
12. Wait patiently while the process finishes. Once it is complete, reboot your phone.
You should now have Radio S-OFF, SIM-unlock and SuperCID all set on your phone. If you just want to install ClockworkMod recovery and custom ROMs etc., you are all good to go and do not need to gain Engineering S-OFF. You may simply install ClockworkMod Recovery, find a custom ROM of your choice and flash it to your phone from recovery.
Gaining Engineering S-OFF:
You should attempt to gain Engineering S-OFF if and only if you want to gain absolute access to your Desire HD including the ability to flash a radio or edit all your phone’s partitions the way you want. If you are not absolutely sure what you are about to do, we recommend that you do NOT proceed.
1. Make sure you have already gained radio S-OFF by following the above-mentioned steps.
2. Download the Engineering HBoot for HTC Desire HD and extract the contents of the zip files.put in adb folder
3. Enable USB debugging (if not already enabled) and connect your phone to the computer.
4. On your computer, launch Command Prompt/Terminal, navigate to the folder where you extracted the files in Step 2 and enter these commands:
adb push hboot-eng.img /data/local
5. Finally, launch Terminal Emulator on your phone and enter these commands, being EXTREMELY careful not to make any mistake here:
su
dd if=/data/local/hboot-eng.img of=/dev/block/mmcblk0p18
Make sure to allow when Super User access is requested. Wait till the process is finished and you’re done!
You now have the Engineering S-OFF HBoot installed and with this, you have absolute control over your HTC Desire HD. You can now flash radios of your choice to your phone and have access to modify all its partitions as well as unbrick it in certain circumstances where no other method would revive your device.
Click to expand...
Click to collapse

rohithksaj said:
one by one......
Click to expand...
Click to collapse
...but I get lost here : "•Open up a cmd and go to Downgrade folder, execute commands:"i.e. I don't understand a 'cmd' is an where I open it from..
EDIT : okay finally at 1.32 & rooted ( yey!)
wanting to check whether the S-OFF info is right but having a mare trying to get bootloader screen to stop from tripping to HBOOT and running the PD98IMG ( even though I took out the goldcard ).
Is there some specific combination to hold vol-down and power for a set number of seconds? I've tried 10+ times and can't stop it going onto the HBOOT update thingy :-(

Ok folks...back to my painful rooting excercise
I'm still in this thread
http://forum.xda-developers.com/showthread.php?t=964996
..trying to eastablish whether or not my S-OFF info is correct before proceeding further. The thread says :-
"Testing Eng S-off and Radio S-OFF
1. Power Down Your Device
2. Go to Bootloader
3. If it says Ace PVT ENG S-OFF your phone is ENG S-OFF.
4. use Volume down to get to system info and tap power button to select
5. check CID for CID-11111111 (if you have this all is done 100%)
6. Reboot
"
how can I check my "CID-11111111" info ? where is it displayed?

DOH STUPID STUPID STUPID!!!!!
Before I made my goldcard I put a copy of pd98img.zip on my SD card....and although I took out the goldcard...when I put the normal SD back in, I neglected to recall it had a copy of pd98img.zip still sat on it.
Thats why I couldn't access bootloader.
Anyways, I have the right S-OFF info so its now onwards the next step

Full HTC Desire HD (sense 3.0/android 2.3.5) guide to root, S-OFF/Sim Unlock

Aahk2 is out please use that method instead, fully automated and much easier :
http://forum.xda-developers.com/showthread.php?t=2367322
Warning thanks to hacktrix2006:
hacktrix2006 said:
Also before anyone continues make sure you run cat /proc/kmsg | grep 'mmc0:0001' If you have a M4G2DE EMMC stop do no use clockworkmod recovery or even try to root as you will fry your EMMC.
If you have SEM04G EMMC then your safe to continue.
If your using the PD98IMG.zip from the retired AAHK just remember its no longer support.
Personally i would use the firmware.zip file from the tutorial which is included in the http://tau.shadowchild.nl/files/ace-tools.zip its safer that way just remember to backup your boot.img as its important if you want to boot back into sense 3.0.
Click to expand...
Click to collapse
THIS GUIDE IS MAINLY this guide (http://tau.shadowchild.nl/attn1/?cat=6) SIMPLIFIED TO SOME EXTENT. with parts that werent included in the guide added to the guide and resources added to the ace-tools folder that would have to be downloaded separately.
PREFACE:
Download this and unzip it somewhere (reccommend C:\ root folder): http://www.multiupload.nl/MXW371YT87
Full HTC Desire HD guide to root, S-OFF/Sim Unlock
1.Unlock the bootloader at http://htcdev.com/bootloader/
2.Copy your Unlock_code.bin file that you got in the email to the ace-tools folder.
step 2.2: reboot into fastboot
step 2.3: execute in cmd-prompt "fastboot flash unlocktoken Unlock_code.bin"
3.Download rooted stock rom: http://www.multiupload.nl/20T9R21IGY
(link to rom thread: http://forum.xda-developers.com/showthread.php?t=1382235&highlight=rooted+stock )
step 3.2 Make a effen GOLDCARD!!!
3.3 copy the ROM zip file to your SD card.
4.Install recovery image:
Open cmd and type:
•cd (eg cd C:\ace-tools)
Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.
In cmd:
•fastboot flash recovery recovery1.img
5.boot into recovery through bootloader and Install the ROM you placed on the SD card, (via install zip fileselect the rom zip)
6.Reboot the phone, ensure the rom is working fine and you have root access you can test this by turning on usb debugging then:
•Adb shell
•Su
You should see the $ turn into a #. If this happens, congrats you have root access.
Then type this:
•Exit
Then again:
•Exit
Then:
•Adb push boot.img /data/local/tmp
•adb shell
root
dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
•adb pull /data/local/tmp/boot.img
•adb push goldcard /data/local/tmp
•adb shell
root
chmod 775 /data/local/tmp/goldcard
•adb shell
root
cat /sys/class/mmc_host/mmc2/mmc2:*/cid
take note of the string of numbers and letters that appear.
then:
•adb shell /data/local/tmp/goldcard -c -o /data/local/tmp/goldcard.img
•adb shell
root
dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
•adb push misc_version /data/local/tmp
•adb shell chmod 775 /data/local/tmp/misc_version
•adb shell /data/local/tmp/misc_version -s 1.11.111.1
7.If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
•Fastboot oem lock
Then type:
•fastboot oem rebootRUU
•fastboot flash zip firmware.zip
•fastboot reboot-bootloader
unlock the bootloader again using the Unlock_code.bin you got from HTC:
•fastboot flash unlocktoken Unlock_code.bin
then flash boot.img in ace-tools folder:
•fastboot flash boot boot.img
next:
•fastboot flash recovery recovery.img
8.boot to recovery again then:
•adb push gfree /tmp/
•adb shell chmod 775 /tmp/gfree
•adb shell /tmp/gfree -f
reboot to bootloader and you should see it says S-OFF at the top of the screen, if It does congrats your done.
VICTORY:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I have also posted this over at modaco:
http://www.modaco.com/topic/361797-...-30android-235-guide-to-root-s-offsim-unlock/

Nice work

Report it with the little orange triangle.

bananagranola said:
Report it with the little orange triangle.
Click to expand...
Click to collapse
updated first post again, opened thread in QandA section, thought it was more appropriate, ill leave it to the mods to decide which section it should be in, this thread is based on my experiences last night .

Step 3 reduced, to simpify method even further.

Does not work for me... got bootloop after flashing ROM. Any ideas?

Guide worked for me!!!!!
Hi all, reporting back my experience with this guide...
Prior to using this guide, I was already HTCDEV unlocked, rooted and custom rom (SVHD V1.3.0)
I basically followed this guide with a few little needed changes.
1st I backed up my rom using 4ext recovery.
1. same
2. same
3. same
4. There was no file named "recovery1.img" in ace-tools, so I just flashed the "recovery.img" (If you already have custom recovery flashed, I don't think you need to do this step but I did it anyway).
5. Because I was already on custom rom with different kernel (boot.img) than stock (rooted) rom, before I reboot into recovery, I extracted boot.img from stock rooted zip downloaded from the link and flashed it from fastboot (if you don't do this your rom may not boot).
5a. reboot into recovery and flashed rom
6. there was a typo in the line
"• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img"
there is an extra space between local & /tmp/ at the end of line, the command line should read
• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local/tmp/goldcard.img"
7. If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
• Fastboot oem lock<------ phone rebooted itself after this command so needed to go back to bootloader fastboot (I did a quick battery pull)
Then type:
• fastboot oem rebootRUU
everything else was good....
My Hboot screen is the same as OP screen shot.
I reflashed the 4ext recovery I previously had, then did a system restore of my backup and booted into SVHD with out a hitch.
I pretty sure that's all, I hope this helps.
androidmodd said:
I probably won't ever update this.
THIS GUIDE IS MAINLY this guide (http://tau.shadowchild.nl/attn1/?cat=6) SIMPLIFIED TO SOME EXTENT. with parts that werent included in the guide added to the guide and resources added to the ace-tools folder that would have to be downloaded separately.
PREFACE:
Download this and unzip it somewhere (reccommend C:\ root folder): http://www.multiupload.nl/MXW371YT87
Full HTC Desire HD guide to root, S-OFF/Sim Unlock
1. Unlock the bootloader at http://htcdev.com/bootloader/
2. Copy your Unlock_code.bin file that you got in the email to the ace-tools folder.
3. Download rooted stock rom: http://www.multiupload.nl/20T9R21IGY
(link to rom thread: http://forum.xda-developers.com/showthread.php?t=1382235&highlight=rooted+stock )
copy the ROM zip file to your SD card.
4. Install recovery image:
Open cmd and type:
• cd <the directory of the ace-tools folder> (eg cd C:\ace-tools)
Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.
In cmd:
• fastboot recovery1.img
5. boot into recovery through bootloader and Install the ROM you placed on the SD card, (via install zip fileselect the rom zip)
6. Reboot the phone, ensure the rom is working fine and you have root access you can test this by turning on usb debugging then:
• Adb shell
• Su
You should see the $ turn into a #. If this happens, congrats you have root access.
Then type this:
• Exit
Then again:
• Exit
Then:
• Adb push boot.img /data/local/tmp
• adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
• adb pull /data/local/tmp/boot.img
• adb push goldcard /data/local/tmp
• adb shell chmod 775 /data/local/tmp/goldcard
• adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
take note of the string of numbers and letters that appear.
then:
• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img
• adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
• adb push misc_version /data/local/tmp
• adb shell chmod 775 /data/local/tmp/misc_version
• adb shell /data/local/tmp/misc_version -s 1.11.111.1
7. If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
• Fastboot oem lock
Then type:
• fastboot oem rebootRUU
• fastboot flash zip firmware.zip
• fastboot reboot-bootloader
unlock the bootloader again using the Unlock_code.bin you got from HTC:
• fastboot flash unlocktoken Unlock_code.bin
then flash boot.img in ace-tools folder:
• fastboot flash boot boot.img
next:
• fastboot flash recovery recovery.img
8. boot to recovery again then:
• adb push gfree /tmp/
• adb shell chmod 775 /tmp/gfree
• adb shell /tmp/gfree -f
reboot to bootloader and you should see it says S-OFF at the top of the screen, if It does congrats your done.
VICTORY:
View attachment 1858622
I have also posted this over at modaco:
http://www.modaco.com/topic/361797-...-30android-235-guide-to-root-s-offsim-unlock/
help me out if you feel like it by signing up to dropbox with my refferal link:
Always have your stuff when you need it with @Dropbox. Sign up for free! http://db.tt/G8qfL77X
Click to expand...
Click to collapse

ranger4740 said:
Hi all, reporting back my experience with this guide...
Prior to using this guide, I was already HTCDEV unlocked, rooted and custom rom (SVHD V1.3.0)
I basically followed this guide with a few little needed changes.
1st I backed up my rom using 4ext recovery.
1. same
2. same
3. same
4. There was no file named "recovery1.img" in ace-tools, so I just flashed the "recovery.img" (If you already have custom recovery flashed, I don't think you need to do this step but I did it anyway).
5. Because I was already on custom rom with different kernel (boot.img) than stock (rooted) rom, before I reboot into recovery, I extracted boot.img from stock rooted zip downloaded from the link and flashed it from fastboot (if you don't do this your rom may not boot).
5a. reboot into recovery and flashed rom
6. there was a typo in the line
"•adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img"
there is an extra space between local & /tmp/ at the end of line, the command line should read
•adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local/tmp/goldcard.img"
7.If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
•Fastboot oem lock<------ phone rebooted itself after this command so needed to go back to bootloader fastboot (I did a quick battery pull)
Then type:
•fastboot oem rebootRUU
everything else was good....
My Hboot screen is the same as OP screen shot.
I reflashed the 4ext recovery I previously had, then did a system restore of my backup and booted into SVHD with out a hitch.
I pretty sure that's all, I hope this helps.
Click to expand...
Click to collapse
Thanks, ill update first post again.

After using this unlock and S-off method, I have been able to update my radio using the PD98IMG.ZIP via bootloader. file found on this post http://forum.xda-developers.com/showthread.php?p=39412003
Sent from my HTC Desire HD using xda app-developers app

vonski said:
Does not work for me... got bootloop after flashing ROM. Any ideas?
Click to expand...
Click to collapse
For your issue, you had already flashed custom Rom and boot.IMG before this guide? I think You need to flash the boot.IMG from the rom.
Sent from my HTC Desire HD using xda app-developers app

problems at step 8
androidmodd said:
I probably won't ever update this.
THIS GUIDE IS MAINLY this guide (http://tau.shadowchild.nl/attn1/?cat=6) SIMPLIFIED TO SOME EXTENT. with parts that werent included in the guide added to the guide and resources added to the ace-tools folder that would have to be downloaded separately.
PREFACE:
Download this and unzip it somewhere (reccommend C:\ root folder): http://www.multiupload.nl/MXW371YT87
Full HTC Desire HD guide to root, S-OFF/Sim Unlock
1. Unlock the bootloader at http://htcdev.com/bootloader/
2. Copy your Unlock_code.bin file that you got in the email to the ace-tools folder.
3. Download rooted stock rom: http://www.multiupload.nl/20T9R21IGY
(link to rom thread: http://forum.xda-developers.com/showthread.php?t=1382235&highlight=rooted+stock )
copy the ROM zip file to your SD card.
4. Install recovery image:
Open cmd and type:
• cd <the directory of the ace-tools folder> (eg cd C:\ace-tools)
Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.
In cmd:
• fastboot recovery1.img
5. boot into recovery through bootloader and Install the ROM you placed on the SD card, (via install zip fileselect the rom zip)
6. Reboot the phone, ensure the rom is working fine and you have root access you can test this by turning on usb debugging then:
• Adb shell
• Su
You should see the $ turn into a #. If this happens, congrats you have root access.
Then type this:
• Exit
Then again:
• Exit
Then:
• Adb push boot.img /data/local/tmp
• adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
• adb pull /data/local/tmp/boot.img
• adb push goldcard /data/local/tmp
• adb shell chmod 775 /data/local/tmp/goldcard
• adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
take note of the string of numbers and letters that appear.
then:
• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img
• adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
• adb push misc_version /data/local/tmp
• adb shell chmod 775 /data/local/tmp/misc_version
• adb shell /data/local/tmp/misc_version -s 1.11.111.1
7. If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
• Fastboot oem lock
Then type:
• fastboot oem rebootRUU
• fastboot flash zip firmware.zip
• fastboot reboot-bootloader
unlock the bootloader again using the Unlock_code.bin you got from HTC:
• fastboot flash unlocktoken Unlock_code.bin
then flash boot.img in ace-tools folder:
• fastboot flash boot boot.img
next:
• fastboot flash recovery recovery.img
8. boot to recovery again then:
• adb push gfree /tmp/
• adb shell chmod 775 /tmp/gfree
• adb shell /tmp/gfree -f
reboot to bootloader and you should see it says S-OFF at the top of the screen, if It does congrats your done.
VICTORY:
View attachment 1858622
I have also posted this over at modaco:
http://www.modaco.com/topic/361797-...-30android-235-guide-to-root-s-offsim-unlock/
help me out if you feel like it by signing up to dropbox with my refferal link:
Always have your stuff when you need it with @Dropbox. Sign up for free! http://db.tt/G8qfL77X
Click to expand...
Click to collapse
Hi I am having problems from step 8 onwards
8. boot to recovery again then:
• adb push gfree /tmp/
• adb shell chmod 775 /tmp/gfree
• adb shell /tmp/gfree -f
When i type adb push gfree /tmp/ in CMD I get
c:\ace-tools>adb push gfree /tmp/
adb server is out of date. killing...
ADB server didn't ACK
* failed to start daemon *
error:
c:\ace-tools>
Any ideas I can not seem to get past it

saucernerp said:
Hi I am having problems from step 8 onwards
8.boot to recovery again then:
•adb push gfree /tmp/
•adb shell chmod 775 /tmp/gfree
•adb shell /tmp/gfree -f
When i type adb push gfree /tmp/ in CMD I get
c:\ace-tools>adb push gfree /tmp/
adb server is out of date. killing...
ADB server didn't ACK
* failed to start daemon *
error:
c:\ace-tools>
Any ideas I can not seem to get past it
Click to expand...
Click to collapse
Hmm that's a problem with ADB on your computer, it can be for a number of reasons, but try restarting your PC checking for background ADB related plugins/processes and try running the commands again.
If it still doesn't work try another PC if available.

androidmodd said:
Hmm that's a problem with ADB on your computer, it can be for a number of reasons, but try restarting your PC checking for background ADB related plugins/processes and try running the commands again.
If it still doesn't work try another PC if available.
Click to expand...
Click to collapse
Thats great thanks got a bit futher now
OK I killed all of the ADB plugins and this is what I now get
c:\ace-tools>adb push gfree /tmp/
2916 KB/s (722728 bytes in 0.242s)
c:\ace-tools>adb shell chmod 775 /tmp/gfree
c:\ace-tools>adb shell /tmp/gfree -f
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x00015398 (86936)
Section index for section name string table: 41
String table offset: 0x000151df (86495)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x000011cc (4556)
-- size: 0x000000c4 (196)
Kernel release: 2.6.32.21
New .modinfo section size: 196
Attempting to power cycle eMMC... Failed.
Module failed to power cycle eMMC.
c:\ace-tools>
I am still show as "ACE PVT SHIP S-ON RL
Anything else

ranger4740 said:
Hi all, reporting back my experience with this guide...
Prior to using this guide, I was already HTCDEV unlocked, rooted and custom rom (SVHD V1.3.0)
I basically followed this guide with a few little needed changes.
1st I backed up my rom using 4ext recovery.
1. same
2. same
3. same
4. There was no file named "recovery1.img" in ace-tools, so I just flashed the "recovery.img" (If you already have custom recovery flashed, I don't think you need to do this step but I did it anyway).
5. Because I was already on custom rom with different kernel (boot.img) than stock (rooted) rom, before I reboot into recovery, I extracted boot.img from stock rooted zip downloaded from the link and flashed it from fastboot (if you don't do this your rom may not boot).
5a. reboot into recovery and flashed rom
6. there was a typo in the line
"•adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img"
there is an extra space between local & /tmp/ at the end of line, the command line should read
•adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local/tmp/goldcard.img"
7.If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
•Fastboot oem lock<------ phone rebooted itself after this command so needed to go back to bootloader fastboot (I did a quick battery pull)
Then type:
•fastboot oem rebootRUU
everything else was good....
My Hboot screen is the same as OP screen shot.
I reflashed the 4ext recovery I previously had, then did a system restore of my backup and booted into SVHD with out a hitch.
I pretty sure that's all, I hope this helps.
Click to expand...
Click to collapse
Did you read this post about the errors in the guide I wrote?

androidmodd said:
Did you read this post about the errors in the guide I wrote?
Click to expand...
Click to collapse
HI
Yep I have read through everything over the last two days and followed all the steps just stumbling at the last hurdle

I'm sorry, you'll have to wait for someone better at this than I am to help, did you ensure that you HTC-Dev unlocked before attempting this step?

androidmodd said:
I'm sorry, you'll have to wait for someone better at this than I am to help, did you ensure that you HTC-Dev unlocked before attempting this step?
Click to expand...
Click to collapse
Gfree failed to cycle eMMC at the end of the s-off procedure, so something's gone wrong.
I don't pretend to be an expert with DHD, and this is a bit different from working with HTC legend.
Just checking that you did the hboot update to version 2.00.029 (htcdev) and unlocked.
It sounds like it might be a hardware fault with phone. I have heard about lots of DHD users with fried eMMC but never with legend.
Sent from my HTC Desire HD using xda app-developers app

ranger4740 said:
Gfree failed to cycle eMMC at the end of the s-off procedure, so something's gone wrong.
I don't pretend to be an expert with DHD, and this is a bit different from working with HTC legend.
Just checking that you did the hboot update to version 2.00.029 (htcdev) and unlocked.
It sounds like it might be a hardware fault with phone. I have heard about lots of DHD users with fried eMMC but never with legend.
Sent from my HTC Desire HD using xda app-developers app
Click to expand...
Click to collapse
Yep I'm on HBOOT 2.00.0029 and my eMMC says boot next to it I just can not get cid to change from ORANG001 and sim is still lock
Bloody ORANGE
everything seemed to work fine until the final stages.
I have even tried Easy Radio tool but this fails after trying to push and I have also tried the Ultimate Multi Tool which allows me to Flash and check status but will not S-Off or Super CID or sim Unlock it just fails at the final stage
Ideas anyone

What radio are you on, you have to have a certain radio to exploit with.

hacktrix2006 said:
What radio are you on, you have to have a certain radio to exploit with.
Click to expand...
Click to collapse
HI
Radio is show as 26.14.04.28_M
Cheers