Database Users

[how to]change your MID without the eng bootloader

this thread is for the folks who wish tochage their MID in order to fully convert a device and recieve OTA updates. the method described here is not the only way to skin the cat,but as long as your careful the risk is very minimal, its quick and easy and doesnt require any hboot downgrades,eng hboot install,data loss,or having to run an ruu.
please note that s-off is required!
credits:
-beaups for schooling me on the echo command protocol
-kdj67f for dumping partitions from his java card s-offed phone
-davehasninjas for dumping rumrunner s offed partitions
-andybones for testing on a vzw device
standard disclaimer: use this information at your own risk. it has been tested,but copying the command incorrectly could have consequences. if you melt your phone into a smoldering little pile of aluminum goo, its not my fault.
IF you are an advanced user with adb/fastboot set up and some basic knowlede of the cmd window,you can skip to #2
1)set up adb
-download this file
-install drivers: if you have htc sync installed,you should allready have drivers. if not,you can install htc sync,or install these modified htc drivers from revolutionary (driver mirror)
-unzip your miniadb_v1031.zip file. this is native funtionality in windows 7. you otherwise may need a utility such as "7-zip" to extract,or unzip it. place the unzipped folder onto the root of your C drive on your PC. root means the top level,not inside any folders. so just copy and paste,or drag and drop the folder onto C with everything else that is there. you may want to rename it to "miniadb_m7" since youll be putting some device specific files in here.
-open a command window. on windows 7,click the start bubble in the lower left and type "command" in the search box. xp i believe is similar or the same. doing this should open a small black command window.
-change to your miniadb_m7 directory. type the following at the prompt in your cmd window:
cd c:\miniadb_m7
your command promt should change to "c:miniadb_m7>" provided you: 1)unzipped the miniadb_v1031 zip file,and 2)put the folder on your c drive,and 3)entered the name of the folder correctly ("miniadb_m7" in this case)
-now make sure usb debugging is checked in developer options(you will need to turn it on first),and plug your phone into your PC with a usb cable
-make sure your phone is being recognized- type:
adb devices
if your drivers are installed correctly,this should return your phones serial number. you should hear the "found device" noises when you plug your phone in. if it starts installing drivers,wait for it to finish before typing the adb devices command.
if you get your serial number back,then enter this command:
adb reboot bootloader
this should take your phone to the "fastboot" screen,wich is white with colored letters. this is one mode of your bootloaders interactive modes. at the top youll see fastboot devices as confirmation youre in fastboot.
now enter:
fastboot devices
again,this should return your phones serial number. you should hear the "found device" noises when you plug your phone in. if it starts installing drivers,wait for it to finish before typing the adb devices command.
if you get your serial number back,you can enter the following to boot back to the phones OS:
fastboot reboot
and now,youve installed adb/fastboot and tested youre phones drivers. if at either spot,you have trouble and dont get your serial number back,there is some sort of connection issue. use these steps to troubleshoot:
troubleshooting connectivity issues:
-try a reboot of the PC
-try different usb cables and ports
-dont use a usb hub
-dont use usb 3.0
-make sure nothing capable of comunicating with the phone is enabled and running. htc sync,pdanet,easy tether,and even itunes have all been known to cause issues.
-windows 8 has been known to have issues. try a windows 7 or older machine
failing the above,
-i use these drivers for fastboot and adb(donwload and run as admin): http://downloads.unrevoked.com/HTCDriver3.0.0.007.exe (mirror)
failing that,try manually updating the drivers in the following manner:
-put the phone in fastboot mode(select fastboot from the hboot menu)
-open device manager on the PC
-plug in phone,watch for it to pop up in device manager.
-update drivers with device manager,pointing the wizard to the extracted
driver download folder from above
note that you can check the connectivity of the phone,and make sure drivers are working by in the following manner:
-open cmd window. change to directory containing adb/fastboot utilities
-adb with the phone in the booted OS,usb debug enabled,enter:
adb devices in a cmd window
-fastboot with phone in fastboot,enter:
fastboot devices in cmd window
in either case,a properly connected phone with working drivers installed should report back the phones serial number.
Click to expand...
Click to collapse
this process,in your cmd window,should look something like this:
Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Scott>[COLOR="red"]cd c:\miniadb_m7[/COLOR]
c:\miniadb_m7>adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
FAxxxxxxxxxx device
c:\miniadb_m7>[COLOR="red"]adb reboot bootloader[/COLOR]
c:\miniadb_m7>[COLOR="red"]fastboot devices[/COLOR]
FAxxxxxxxxxx fastboot
c:\miniadb_m7>[COLOR="red"]fastboot reboot[/COLOR]
rebooting...
finished. total time: 0.037s
c:\miniadb_m7>
2)change your MID
warning: *do not try and type the command. please copy and paste it
-AT&T,developer,google play MID:
enter the following:
adb shell
su (if needed to get a # prompt)
Code:
[B]echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x31\x00\x32\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384[/B]
(the above is one big long command. make sure you copy it all,and dont get extra spaces when you paste it.)
exit
adb reboot bootloader
fastboot getvar mid (or getvar all)
verify PN0712000 for modelid
fastboot reboot
________________________________________________________________________________________
-t mobile MID:
enter the following:
adb shell
su (if needed to get a # prompt)
Code:
[B]echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x31\x00\x33\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384[/B]
(the above is one big long command. make sure you copy it all,and dont get extra spaces when you paste it.)
exit
adb reboot bootloader
fastboot getvar mid (or getvar all)
verify PN0713000 for modelid
fastboot reboot
________________________________________________________________________________________
-HTC_Europe MID:
enter the following:
adb shell
su (if needed to get a # prompt)
Code:
[B]echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384[/B]
(the above is one big long command. make sure you copy it all,and dont get extra spaces when you paste it.)
exit
adb reboot bootloader
fastboot getvar mid (or getvar all)
verify PN0710000 for modelid
fastboot reboot
________________________________________________________________________________________
your command window should look like this:
Code:
c:\miniadb_m7>[COLOR="red"]adb shell[/COLOR]
[email protected]:/ # [COLOR="Red"]echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x33\x00\x31\x00\x30\x00\x
30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384[/COLOR]
00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384 <
17+0 records in
17+0 records out
17 bytes transferred in 0.009 secs (1888 bytes/sec)
[email protected]:/ # [COLOR="red"]exit[/COLOR]
exit
c:\miniadb_m7>[COLOR="red"]adb reboot bootloader[/COLOR]
c:\miniadb_m7>[COLOR="red"]fastboot getvar all[/COLOR]
(bootloader) version: 0.5
(bootloader) version-bootloader: 1.44.0000
(bootloader) version-baseband: 4A.17.3250.20
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.27.531.8
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HTxxxxxxxxxx
(bootloader) imei: xxxxxxxxxxxxxxx
(bootloader) meid: 00000000000000
(bootloader) product: m7_ul
(bootloader) platform: HBOOT-8064
(bootloader) modelid: PN0731000 [COLOR="Blue"]<-looky[/COLOR]
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 4175mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: dirty-f188f379dbbfee373cd551f7bc62b8435
getvar:all FAILED (unknown status code)
finished. total time: 0.092s
c:\miniadb_m7>[COLOR="Red"]fastboot reboot[/COLOR]
rebooting...
(bootloader) hbootpreupdate: 11
finished. total time: 7.288s
some other useful links:
remove tampered banner: http://forum.xda-developers.com/showthread.php?t=2477792
change lock status flag(lock/unlock bootloader): http://forum.xda-developers.com/showthread.php?t=2475914

i dont think im going to add any more MIDs in the above post,as i dont think many(any?) will be flip flopping to something other than those 3. it could be dnagerous to try and convert m7_ul to m7_u or m7_wlv
if you need to change to something different let me know,and i can put it here,so all the comands are in one place. this post is for reference only.
for HTC_Europe international m7_ul PN0710000
Code:
echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384
for m7_u PN0711000
Code:
echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x31\x00\x31\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384
for other gsm international m7_ul PN0714000
Code:
echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x31\x00\x34\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384
for verizon,m7_wlv PN0731000
Code:
echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x33\x00\x31\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384
*please note that neither sprint nor vzw devices can be converted to gsm or vice versa
for sprint, m7_wls PN0720000
Code:
echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x32\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384
*please note that neither sprint nor vzw devices can be converted to gsm or vice versa
for htc one dual sim PN0751000
Code:
echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x35\x00\x31\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384

@scotty1223
My MID is currently: PN0711000 and i want to change it to: PN0710000
Can you add the correct command line in adb shell?

Great!
Please make for MID: PN0710000.

Kudos 2 u man. Another really useful post. I would appreciate the code for PN0710000 also as I am currently planning on converting to the google edition, but would like to know the code to revert back to the above if I need to return to HTC at sometime. Much more convienient (and less risky) than using eng boot method to change.

Nerekan said:
Great!
Please make for MID: PN0710000.
Click to expand...
Click to collapse
I think this is the command for "PN0710000"
Code:
echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384
but wait scotty1223 to confirm my theory.....
see U!

electronical said:
@scotty1223
My MID is currently: PN0711000 and i want to change it to: PN0710000
Can you add the correct command line in adb shell?
Click to expand...
Click to collapse
zaphodbeeb said:
Kudos 2 u man. Another really useful post. I would appreciate the code for PN0710000 also as I am currently planning on converting to the google edition, but would like to know the code to revert back to the above if I need to return to HTC at sometime. Much more convienient (and less risky) than using eng boot method to change.
Click to expand...
Click to collapse
what model/variant do you guys have? if this is another variant of m7_u,let me know if you run into any snags or issues with the conversion to google play,wich is an m7_ul. id really appreciate reports of success or failure for OTAs.
id like to convert my dads m7_u(PN0711000) to HTC__001 and PN0712000 so he could recieve european updated. not sure if OTAs will catch some other flag since the m7_u has no provisions for LTE.
feel free to post here or pm me anything you learn while converting,and if you intend to OTA or not
ervius said:
I think this is the command for "PN0710000"
Code:
echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384
but wait scotty1223 to confirm my theory.....
see U!
Click to expand...
Click to collapse
looks fine- x30 = 0 so just need to replace the 31,wich obviously = 1

I have a m7_ul.

zaphodbeeb said:
I have a m7_ul.
Click to expand...
Click to collapse
and are PN0711000?
edit:
i see,you are international. outside the us m7_ul is the PN710000. had some MID confusion,lol.. move along,nothing to see here

OK I have a uk HTC one my current mid is PN0710000
I would like the gpe MID is this the att developer edition you have listed on the first page?
Edit also guessing you need root?

ngagephone said:
OK I have a uk HTC one my current mid is PN0710000
I would like the gpe MID is this the att developer edition you have listed on the first page?
Edit also guessing you need root?
Click to expand...
Click to collapse
correct,to the best of my knowledge,the GPE shares PN0712000 along with dev edition,att,and canadian variants.
yes,you need root and s-off.

Thank you

Just clarify,
If I have an US T-mobile One, I wanna convert to International version as I can get the x.xx.401.xx OTA, I have to change my CID to HTC_001 and MID to PN0710000. Is this correct?
Sent from my HTC ViperOne

tommy0411 said:
Just clarify,
If I have an US T-mobile One, I wanna convert to International version as I can get the x.xx.401.xx OTA, I have to change my CID to HTC_001 and MID to PN0710000. Is this correct?
Sent from my HTC ViperOne
Click to expand...
Click to collapse
correct

That's one neat hack. Thank you for this!
Sent from my HTC One using Tapatalk

io53 said:
That's one neat hack. Thank you for this!
Sent from my HTC One using Tapatalk
Click to expand...
Click to collapse
glad it was helpful. basically the same idea as hex editing p4 to change cid with evita and ville,so its not a new concept. all i did was locate the mid and apply the same idea

Is the MID on the same place in the GE bootloaders?
Sent from my HTC One using Tapatalk

io53 said:
Is the MID on the same place in the GE bootloaders?
Sent from my HTC One using Tapatalk
Click to expand...
Click to collapse
The mid is not located in the bootloader,it's in p6. I'm fairly certain the mid is in the same location,but I've not checked it. You're welcome to dump it and we can verify.
Sent from my HTC One VX using Tapatalk

Change MID to 710000 from 714000 (S-off)
scotty1223 said:
this thread is for the folks who wish tochage their MID in order to fully convert a device and recieve OTA updates. the method described here is not the only way to skin the cat,but as long as your careful the risk is very minimal, its quick and easy and doesnt require any hboot downgrades,eng hboot install,data loss,or having to run an ruu.
please note that s-off is required!
credits:
-beaups for schooling me on the echo command protocol
-kdj67f for dumping partitions from his java card s-offed phone
-davehasninjas for dumping rumrunner s offed partitions
-andybones for testing on a vzw device
standard disclaimer: use this information at your own risk. it has been tested,but copying the command incorrectly could have consequences. if you melt your phone into a smoldering little pile of aluminum goo, its not my fault.
IF you are an advanced user with adb/fastboot set up and some basic knowlede of the cmd window,you can skip to #2
1)set up adb
-download this file
-install drivers: if you have htc sync installed,you should allready have drivers. if not,you can install htc sync,or install these modified htc drivers from revolutionary (driver mirror)
-unzip your miniadb_v1031.zip file. this is native funtionality in windows 7. you otherwise may need a utility such as "7-zip" to extract,or unzip it. place the unzipped folder onto the root of your C drive on your PC. root means the top level,not inside any folders. so just copy and paste,or drag and drop the folder onto C with everything else that is there. you may want to rename it to "miniadb_m7" since youll be putting some device specific files in here.
-open a command window. on windows 7,click the start bubble in the lower left and type "command" in the search box. xp i believe is similar or the same. doing this should open a small black command window.
-change to your miniadb_m7 directory. type the following at the prompt in your cmd window:
cd c:\miniadb_m7
your command promt should change to "c:miniadb_m7>" provided you: 1)unzipped the miniadb_v1031 zip file,and 2)put the folder on your c drive,and 3)entered the name of the folder correctly ("miniadb_m7" in this case)
-now make sure usb debugging is checked in developer options(you will need to turn it on first),and plug your phone into your PC with a usb cable
-make sure your phone is being recognized- type:
adb devices
if your drivers are installed correctly,this should return your phones serial number. you should hear the "found device" noises when you plug your phone in. if it starts installing drivers,wait for it to finish before typing the adb devices command.
if you get your serial number back,then enter this command:
adb reboot bootloader
this should take your phone to the "fastboot" screen,wich is white with colored letters. this is one mode of your bootloaders interactive modes. at the top youll see fastboot devices as confirmation youre in fastboot.
now enter:
fastboot devices
again,this should return your phones serial number. you should hear the "found device" noises when you plug your phone in. if it starts installing drivers,wait for it to finish before typing the adb devices command.
if you get your serial number back,you can enter the following to boot back to the phones OS:
fastboot reboot
and now,youve installed adb/fastboot and tested youre phones drivers. if at either spot,you have trouble and dont get your serial number back,there is some sort of connection issue. use these steps to troubleshoot:
this process,in your cmd window,should look something like this:
Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Scott>[COLOR="red"]cd c:\miniadb_m7[/COLOR]
c:\miniadb_m7>adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
FAxxxxxxxxxx device
c:\miniadb_m7>[COLOR="red"]adb reboot bootloader[/COLOR]
c:\miniadb_m7>[COLOR="red"]fastboot devices[/COLOR]
FAxxxxxxxxxx fastboot
c:\miniadb_m7>[COLOR="red"]fastboot reboot[/COLOR]
rebooting...
finished. total time: 0.037s
c:\miniadb_m7>
2)change your MID
warning: *do not try and type the command. please copy and paste it
-AT&T,developer,google play MID:
enter the following:
adb shell
Code:
[B]echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x31\x00\x32\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384[/B]
(the above is one big long command. make sure you copy it all,and dont get extra spaces when you paste it.)
exit
adb reboot bootloader
fastboot getvar mid (or getvar all)
verify PN0712000 for modelid
fastboot reboot
________________________________________________________________________________________
-t mobile MID:
enter the following:
adb shell
Code:
[B]echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x31\x00\x33\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384[/B]
(the above is one big long command. make sure you copy it all,and dont get extra spaces when you paste it.)
exit
adb reboot bootloader
fastboot getvar mid (or getvar all)
verify PN0713000 for modelid
fastboot reboot
________________________________________________________________________________________
your command window should look like this:
Code:
c:\miniadb_m7>[COLOR="red"]adb shell[/COLOR]
[email protected]:/ # [COLOR="Red"]echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x33\x00\x31\x00\x30\x00\x
30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384[/COLOR]
00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384 <
17+0 records in
17+0 records out
17 bytes transferred in 0.009 secs (1888 bytes/sec)
[email protected]:/ # [COLOR="red"]exit[/COLOR]
exit
c:\miniadb_m7>[COLOR="red"]adb reboot bootloader[/COLOR]
c:\miniadb_m7>[COLOR="red"]fastboot getvar all[/COLOR]
(bootloader) version: 0.5
(bootloader) version-bootloader: 1.44.0000
(bootloader) version-baseband: 4A.17.3250.20
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.27.531.8
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HTxxxxxxxxxx
(bootloader) imei: xxxxxxxxxxxxxxx
(bootloader) meid: 00000000000000
(bootloader) product: m7_ul
(bootloader) platform: HBOOT-8064
(bootloader) modelid: PN0731000 [COLOR="Blue"]<-looky[/COLOR]
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 4175mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: dirty-f188f379dbbfee373cd551f7bc62b8435
getvar:all FAILED (unknown status code)
finished. total time: 0.092s
c:\miniadb_m7>[COLOR="Red"]fastboot reboot[/COLOR]
rebooting...
(bootloader) hbootpreupdate: 11
finished. total time: 7.288s
some other useful links:
http://forum.xda-developers.com/showthread.php?t=2477792
http://forum.xda-developers.com/showthread.php?t=2475914&highlight=+how+to+lock+unlock
Click to expand...
Click to collapse
Hi,
I'm on Hboot 1.55 and I'm s-off MID =714000 and CID =11111111. Please guide me to change the MID to 710000 as i need OTA from CID HTC__001. Urgent help would be very welcomed...Many many thanks.. Eng method fails with remote parsing error (error 24)
---------- Post added at 03:08 PM ---------- Previous post was at 03:07 PM ----------
Hi,
I'm on Hboot 1.55 and I'm s-off MID =714000 and CID =11111111. Please guide me to change the MID to 710000 as i need OTA from CID HTC__001. Urgent help would be very welcomed...Many many thanks.. Eng method fails with remote parsing error (error 24)

papubhai said:
Hi,
I'm on Hboot 1.55 and I'm s-off MID =714000 and CID =11111111. Please guide me to change the MID to 710000 as i need OTA from CID HTC__001. Urgent help would be very welcomed...Many many thanks.. Eng method fails with remote parsing error
Click to expand...
Click to collapse
you just enter the adb command in the second post for 710000. if you need more guidance than what the OP states,you maybe not should do this.
im not sure you should do this,anyway. there is likely a reason the eng method failed. what variant is 714000?
if you are m7_ul it should be ok to switch to 710000.but if you are something else(m7_u,m7_wls,etc) it may not be safe to convert to that cid/mid

[How to] flash Lollipop on Desire 820 dual sim Non-Indian variant. Fix Wrong Variant

Hi guys, so a friend of mine got a Desire 820 dual sim few days back. Device came in a very messy condition in terms for software. It was already Super CID'd & S-OFFed, no option to update software & around 200 languages. So i tried different threads to fix the issue & upgrade the phone to Lollipop.
I was able to get it back to stock Indian KK RUU 1.22.720.1 assuming that it was an Indian variant based on its id A51_DTUL but it was not the case.. After downloading the 1.22.720.10 update, it was giving me error like Modified System or Wrong Variant
Cut short i managed to identify / fix the problem & successfully upgraded the phone to Android L
Story line is that most of the guides available for 820 dual sim Lollipop upgrade are for the Indian variant with MID 0PFJ10000. Problem occurring is with its Chinesse sibbling with MID 0PFJ11000 & this is where the phone wont allow you to do software updates.
RUU is just checking the CID while in the OTA updater-script they have plenty of checks before flashing it.
So in the below KK updater-script, you can see that first it is checking for the current firmware, then CID & then MID
PHP:
mount("ext4", "EMMC", "system", "/system");
assert(file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.1:user/release-keys" ||
file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.10:user/release-keys");
assert(file_getprop("/system/build.prop", "ro.aa.taskid") == "402794" ||
file_getprop("/system/build.prop", "ro.aa.taskid") == "447333");
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_cid(getprop("ro.cid"), "00000000" , "11111111" ,
"22222222" , "33333333" , "44444444" , "55555555" , "66666666" ,
"77777777" , "88888888" , "99999999" , "HTC__038") == "t");
);
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_mid("full", "0PFJ10000") == "t");,
assert(check_mid("simple", "0PFJ10000") == "t");
This is point where we get Wrong Variant or Modified System error on device other than 0PFJ10000 MID.
So inorder to get rid of this error & getting all the updates automatically while keeping your ROM in stock status. These are the requirements / guidelines.
Required:
S-OFF
Root
Super CID
I assume you already know about fastboot commands stuff
So before proceeding, verify that you phone is A51_DTUL & the processor type is hTCBmsm8939 with 2GB of RAM. You can do this by booting into bootloader & run command fastboot getvar all
1st step, change MID of your device -> from 0PFJ11000 to 0PFJ10000. Run the following ADB commands:
PHP:
adb shell
su
echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384
exit
exit
adb reboot bootloader
Now once the commands are successful, to verify the MID in fastboot again verify it with command fastboot getvar MID. It should now be 0PFJ10000
So we killed the BUG :laugh:
2nd step:
2a. download Indian KK RUU from this thread -> Thanks to sshivampp & robinsahlot
2b. Rename the downloaded ZIP to “0PFJIMG.zip” or to 0PFJIMG.txt incase you are unable to copy it
2c. Copy the 0PFJIMG.txt / zip file to the External SD card & do change the extension back to .zip incase you had to change it to .txt
2d. Reboot into bootloader & dont forget to disable Fastboot option under power settings
2e. Press Vol up for update once prompted
You will lot of checks & update prompts on the screen
Once successful, reboot the phone & check for software updates. You should now be able to install all the OTAs without any errors
Special thanks to h1dd3n_sn1p3r for his initial guide on upgrading to Android L.
And our dexter, Mr. scotty1223 for his amazing guides & work. Through which i was able to figure out MID change part

Lovely! Thanks for credit towards me!
Excellent find bro ?

Any one knows MID of HK variant?

help
Hey, thanks for this post, i have tried every solution posted in this site, but anyone of them worked, this one seems the most effective one, but i cant change the MID! I copy the code, hit enter, the window closes, but when i reboot the phone and check de getvar mid, it doesnt change! what can i do? i have the phone in S-OFF, rooted and super CID... the phone was unlocked, tried this way, but now is relocked, tried this one also but its the same MID ..thaks for the help u can give me
ok i try some of the code, just to avoid the window from closing and it says this :
adb shell
adb server is out of date. killing...
* daemon started successfully *
error: device not found...

gpcga said:
Hey, thanks for this post, i have tried every solution posted in this site, but anyone of them worked, this one seems the most effective one, but i cant change the MID! I copy the code, hit enter, the window closes, but when i reboot the phone and check de getvar mid, it doesnt change! what can i do? i have the phone in S-OFF, rooted and super CID... the phone was unlocked, tried this way, but now is relocked, tried this one also but its the same MID ..thaks for the help u can give me
ok i try some of the code, just to avoid the window from closing and it says this :
adb shell
adb server is out of date. killing...
* daemon started successfully *
error: device not found...
Click to expand...
Click to collapse
What is the current MID of your device? also is it Qualcomm processor? If you boot the phone nornally with ADB debugging. is it detected? as from the last line it seems device is not connected or not detected

I changed the recovery
Hello, the phone didn't connect because of the recovery, I flashed another one, and that was it. Thanks, I have the stock lollipop 5.0.2 now. This is the only solution that worked fast and effective.
fshami said:
What is the current MID of your device? also is it Qualcomm processor? If you boot the phone nornally with ADB debugging. is it detected? as from the last line it seems device is not connected or not detected
Click to expand...
Click to collapse

Would this method work on my Chinese Desire 820t?

sponmagnet said:
Would this method work on my Chinese Desire 820t?
Click to expand...
Click to collapse
This thread is for the non-indian variants with Qualcomm chipset.. all details in first post. So if u have the same mid OPFJ11xxx then go a head & try.. be sure ur hardware specs match as i mentioned in the guide

Can anybody post instructions of how to change MID to TW variant? (-> from 0PFJ10000 to 0PFJ12000)

Prowler_gr said:
Can anybody post instructions of how to change MID to TW variant? (-> from 0PFJ10000 to 0PFJ12000)
Click to expand...
Click to collapse
PHP:
adb shell
su
echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x32\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384
exit
exit
adb reboot bootloader

I am getting error
"adb shell
adb server is out of date. killing...
* daemon started successfully *
error: device not found..."
Device is connected !!!
I tried everything but nothing works...
I want my phone to run on lollipop
please help me

shubhamkanwaria said:
I am getting error
"adb shell
adb server is out of date. killing...
* daemon started successfully *
error: device not found..."
Device is connected !!!
I tried everything but nothing works...
I want my phone to run on lollipop
please help me
Click to expand...
Click to collapse
Check if USB debugging is enabled.. and after connecting the phone, all drivers are installed properly

fshami said:
Check if USB debugging is enabled.. and after connecting the phone, all drivers are installed properly
Click to expand...
Click to collapse
USB debugging is enabled and all drivers are properly installed but still same error.

shubhamkanwaria said:
USB debugging is enabled and all drivers are properly installed but still same error.
Click to expand...
Click to collapse
If your phone is booted, still adb devices command is not showing your device?
Sent from my HTC One E9PLUS dual sim using XDA-Developers mobile app

fshami said:
If your phone is booted, still adb devices command is not showing your device?
Sent from my HTC One E9PLUS dual sim using XDA-Developers mobile app
Click to expand...
Click to collapse
Thank you so much... i got it... Now my phone running on lollipop.....

shubhamkanwaria said:
Thank you so much... i got it... Now my phone running on lollipop.....
Click to expand...
Click to collapse
glad to help

fshami said:
Hi guys, so a friend of mine got a Desire 820 dual sim few days back. Device came in a very messy condition in terms for software. It was already Super CID'd & S-OFFed, no option to update software & around 200 languages. So i tried different threads to fix the issue & upgrade the phone to Lollipop.
I was able to get it back to stock Indian KK RUU 1.22.720.1 assuming that it was an Indian variant based on its id A51_DTUL but it was not the case.. After downloading the 1.22.720.10 update, it was giving me error like Modified System or Wrong Variant
Cut short i managed to identify / fix the problem & successfully upgraded the phone to Android L
Story line is that most of the guides available for 820 dual sim Lollipop upgrade are for the Indian variant with MID 0PFJ10000. Problem occurring is with its Chinesse sibbling with MID 0PFJ11000 & this is where the phone wont allow you to do software updates.
RUU is just checking the CID while in the OTA updater-script they have plenty of checks before flashing it.
So in the below KK updater-script, you can see that first it is checking for the current firmware, then CID & then MID
PHP:
mount("ext4", "EMMC", "system", "/system");
assert(file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.1:user/release-keys" ||
file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.10:user/release-keys");
assert(file_getprop("/system/build.prop", "ro.aa.taskid") == "402794" ||
file_getprop("/system/build.prop", "ro.aa.taskid") == "447333");
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_cid(getprop("ro.cid"), "00000000" , "11111111" ,
"22222222" , "33333333" , "44444444" , "55555555" , "66666666" ,
"77777777" , "88888888" , "99999999" , "HTC__038") == "t");
);
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_mid("full", "0PFJ10000") == "t");,
assert(check_mid("simple", "0PFJ10000") == "t");
This is point where we get Wrong Variant or Modified System error on device other than 0PFJ10000 MID.
So inorder to get rid of this error & getting all the updates automatically while keeping your ROM in stock status. These are the requirements / guidelines.
Required:
S-OFF
Root
Super CID
I assume you already know about fastboot commands stuff
So before proceeding, verify that you phone is A51_DTUL & the processor type is hTCBmsm8939 with 2GB of RAM. You can do this by booting into bootloader & run command fastboot getvar all
1st step, change MID of your device -> from 0PFJ11000 to 0PFJ10000. Run the following ADB commands:
PHP:
adb shell
su
echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384
exit
exit
adb reboot bootloader
Now once the commands are successful, to verify the MID in fastboot again verify it with command fastboot getvar MID. It should now be 0PFJ10000
So we killed the BUG :laugh:
2nd step:
2a. download Indian KK RUU from this thread -> Thanks to sshivampp & robinsahlot
2b. Rename the downloaded ZIP to “0PFJIMG.zip” or to 0PFJIMG.txt incase you are unable to copy it
2c. Copy the 0PFJIMG.txt / zip file to the External SD card & do change the extension back to .zip incase you had to change it to .txt
2d. Reboot into bootloader & dont forget to disable Fastboot option under power settings
2e. Press Vol up for update once prompted
You will lot of checks & update prompts on the screen
Once successful, reboot the phone & check for software updates. You should now be able to install all the OTAs without any errors
Special thanks to h1dd3n_sn1p3r for his initial guide on upgrading to Android L.
And our dexter, Mr. scotty1223 for his amazing guides & work. Through which i was able to figure out MID change part
Click to expand...
Click to collapse
sorry .. this is no more available .. please check the next replay #18

fshami said:
Hi guys, so a friend of mine got a Desire 820 dual sim few days back. Device came in a very messy condition in terms for software. It was already Super CID'd & S-OFFed, no option to update software & around 200 languages. So i tried different threads to fix the issue & upgrade the phone to Lollipop.
I was able to get it back to stock Indian KK RUU 1.22.720.1 assuming that it was an Indian variant based on its id A51_DTUL but it was not the case.. After downloading the 1.22.720.10 update, it was giving me error like Modified System or Wrong Variant
Cut short i managed to identify / fix the problem & successfully upgraded the phone to Android L
Story line is that most of the guides available for 820 dual sim Lollipop upgrade are for the Indian variant with MID 0PFJ10000. Problem occurring is with its Chinesse sibbling with MID 0PFJ11000 & this is where the phone wont allow you to do software updates.
RUU is just checking the CID while in the OTA updater-script they have plenty of checks before flashing it.
So in the below KK updater-script, you can see that first it is checking for the current firmware, then CID & then MID
PHP:
mount("ext4", "EMMC", "system", "/system");
assert(file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.1:user/release-keys" ||
file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.10:user/release-keys");
assert(file_getprop("/system/build.prop", "ro.aa.taskid") == "402794" ||
file_getprop("/system/build.prop", "ro.aa.taskid") == "447333");
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_cid(getprop("ro.cid"), "00000000" , "11111111" ,
"22222222" , "33333333" , "44444444" , "55555555" , "66666666" ,
"77777777" , "88888888" , "99999999" , "HTC__038") == "t");
);
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_mid("full", "0PFJ10000") == "t");,
assert(check_mid("simple", "0PFJ10000") == "t");
This is point where we get Wrong Variant or Modified System error on device other than 0PFJ10000 MID.
So inorder to get rid of this error & getting all the updates automatically while keeping your ROM in stock status. These are the requirements / guidelines.
Required:
S-OFF
Root
Super CID
I assume you already know about fastboot commands stuff
So before proceeding, verify that you phone is A51_DTUL & the processor type is hTCBmsm8939 with 2GB of RAM. You can do this by booting into bootloader & run command fastboot getvar all
1st step, change MID of your device -> from 0PFJ11000 to 0PFJ10000. Run the following ADB commands:
PHP:
adb shell
su
echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384
exit
exit
adb reboot bootloader
Now once the commands are successful, to verify the MID in fastboot again verify it with command fastboot getvar MID. It should now be 0PFJ10000
So we killed the BUG :laugh:
2nd step:
2a. download Indian KK RUU from this thread -> Thanks to sshivampp & robinsahlot
2b. Rename the downloaded ZIP to “0PFJIMG.zip” or to 0PFJIMG.txt incase you are unable to copy it
2c. Copy the 0PFJIMG.txt / zip file to the External SD card & do change the extension back to .zip incase you had to change it to .txt
2d. Reboot into bootloader & dont forget to disable Fastboot option under power settings
2e. Press Vol up for update once prompted
You will lot of checks & update prompts on the screen
Once successful, reboot the phone & check for software updates. You should now be able to install all the OTAs without any errors
Special thanks to h1dd3n_sn1p3r for his initial guide on upgrading to Android L.
And our dexter, Mr. scotty1223 for his amazing guides & work. Through which i was able to figure out MID change part
Click to expand...
Click to collapse
my data before :
D:\HTC\fastboot>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 3.19.0.0000
(bootloader) version-baseband: 01.01.010_U1030481_08.01.41119
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.22.720.1
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HC4ANYC01045
(bootloader) imei: 355386060878133
(bootloader) imei2: 355386060878141
(bootloader) meid: 00000000000000
(bootloader) product: a51_dtul
(bootloader) platform: hTCBmsm8939
(bootloader) modelid: 0PFJ11000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: ed7d3c37
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) mfg-name:
all: Done!
finished. total time: 0.022s
D:\HTC\fastboot>
and do :
D:\HTC\fastboot>adb shell
[email protected]_a51dtul:/ $ su
[email protected]_a51dtul:/ # echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x30\x0>
17+0 records in
17+0 records out
17 bytes transferred in 0.005 secs (3400 bytes/sec)
[email protected]_a51dtul:/ # exit
[email protected]_a51dtul:/ $ exit
so the data after :
D:\HTC\fastboot>fastboot getvar mid
mid: 0PFJ10000
finished. total time: 0.002s
D:\HTC\fastboot>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 3.19.0.0000
(bootloader) version-baseband: 01.01.010_U1030481_08.01.41119
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.22.720.1
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HC4ANYC01045
(bootloader) imei: 355386060878133
(bootloader) imei2: 355386060878141
(bootloader) meid: 00000000000000
(bootloader) product: a51_dtul
(bootloader) platform: hTCBmsm8939
(bootloader) modelid: 0PFJ10000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: ed7d3c37
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) mfg-name:
all: Done!
finished. total time: 0.034s
D:\HTC\fastboot>
checked update .. 70.01MB .. downloaded .. but still got the msg (your system modified contact htc)
#Note : i was downloaded the ruu that you mention .. just changed mid then checked update
any help ??

nabilovetch said:
my data before :
D:\HTC\fastboot>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 3.19.0.0000
(bootloader) version-baseband: 01.01.010_U1030481_08.01.41119
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.22.720.1
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HC4ANYC01045
(bootloader) imei: 355386060878133
(bootloader) imei2: 355386060878141
(bootloader) meid: 00000000000000
(bootloader) product: a51_dtul
(bootloader) platform: hTCBmsm8939
(bootloader) modelid: 0PFJ11000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: ed7d3c37
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) mfg-name:
all: Done!
finished. total time: 0.022s
D:\HTC\fastboot>
and do :
D:\HTC\fastboot>adb shell
[email protected]_a51dtul:/ $ su
[email protected]_a51dtul:/ # echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x30\x0>
17+0 records in
17+0 records out
17 bytes transferred in 0.005 secs (3400 bytes/sec)
[email protected]_a51dtul:/ # exit
[email protected]_a51dtul:/ $ exit
so the data after :
D:\HTC\fastboot>fastboot getvar mid
mid: 0PFJ10000
finished. total time: 0.002s
D:\HTC\fastboot>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 3.19.0.0000
(bootloader) version-baseband: 01.01.010_U1030481_08.01.41119
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.22.720.1
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HC4ANYC01045
(bootloader) imei: 355386060878133
(bootloader) imei2: 355386060878141
(bootloader) meid: 00000000000000
(bootloader) product: a51_dtul
(bootloader) platform: hTCBmsm8939
(bootloader) modelid: 0PFJ10000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: ed7d3c37
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) mfg-name:
all: Done!
finished. total time: 0.034s
D:\HTC\fastboot>
checked update .. 70.01MB .. downloaded .. but still got the msg (your system modified contact htc)
#Note : i was downloaded the ruu that you mention .. just changed mid then checked update
any help ??
Click to expand...
Click to collapse
Good you've changed CID & MID. Now download & flash the RUU i mentioned. Once flashed then your device will do updates
Sent from my HTC One E9PLUS dual sim using XDA-Developers mobile app

fshami said:
Good you've changed CID & MID. Now download & flash the RUU i mentioned. Once flashed then your device will do updates
Sent from my HTC One E9PLUS dual sim using XDA- mobile app
Click to expand...
Click to collapse
i do factory reset and reflash ruu using sd card ..
still got the msg (your software is modified, contact htc)

[GUIDE][MM][6.12.1540.4] HTC One M8 to Developer Edition with Original RUU EXE File

Device MUST be S-OFF!
Requirements
HTC Fastboot and ADB : Google Drive
Firmware : Google Drive
RUU EXE : http://www.htc.com/us/support/htc-one-m8/news/
First Step
Change your MID and CID from yours to Developer Edition.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Open your Command Prompt on your installation folder with "Left Shift + Right Mouse Click"
MID Change
adb.exe shell
su (if needed to get a # prompt)
Code:
echo -ne '\x30\x00\x50\x00\x36\x00\x42\x00\x31\x00\x32\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384
exit (if you have #, 2 times)
adb.exe reboot-bootloader
CID Change
htc_fastboot.exe oem writecid BS_US002
htc_fastboot.exe reboot-bootloader
htc_fastboot.exe oem rebootRUU (you have to see black screen with green HTC logo)
Flash firmware-6.12.1540.4
htc_fastboot.exe flash zip firmware-6.12.1540.4.zip (you have to get error, try again this time it will do)
htc_fastboot.exe reboot-bootloader ( do this when firmware process done, you have to see a green bar at 100%)
htc_fastboot.exe erase cache
Flash 6.12.1540.4 RUU
You have to open RUU EXE which downloaded from htc news website.
Wait until UNCOMPRESSING done.
You have to see "License Agreement", DO NOT close this window.
Open your file explorer or run command and type %TEMP% , and click ENTER
You have to be in there "C:\Users\*your pc name*\AppData\Local\Temp"
Find last edited Folder, it must have "corecomp.ini" , "dotnetinstaller.exe" , "ISBEW64.exe" and another Folder.
Open this folder and copy "rom.zip" into your installation folder where htc_fastboot.exe exist.
htc_fastboot.exe oem rebootRUU (you have to see black screen with green HTC logo)
htc_fastboot.exe flash zip rom.zip (first you have to get error, but the process restart automatically)
You have to wait about 5-10 minutes until all processes done.
htc_fastboot.exe reboot-bootloader
htc_fastboot.exe erase cache
PRESS volume down button to do Factory Reset and PRESS power button to select.
Phone restart automatically, when the factory reset done
All done, be happy

Boss pls help me
HTC M8 Sprint
CID : BS_US002
MODEL : OP6B70000
Pls help Me .... when i am try to flash firmware-6.12.1540.4 then error massage
C:\Users\MONOAR\Desktop\One_M8_All-In-One_Kit_v\data>fastboot.exe flash zip firm
ware-6.12.1540.4.zip
< waiting for device >
target reported max download size of 1826414592 bytes
error: cannot load 'firmware-6.12.1540.4.zip': No error
[email protected]

monoar30 said:
HTC M8 Sprint
CID : BS_US002
MODEL : OP6B70000
Pls help Me .... when i am try to flash firmware-6.12.1540.4 then error massage
C:\Users\MONOAR\Desktop\One_M8_All-In-One_Kit_v\data>fastboot.exe flash zip firm
ware-6.12.1540.4.zip
< waiting for device >
target reported max download size of 1826414592 bytes
error: cannot load 'firmware-6.12.1540.4.zip': No error
[email protected]
Click to expand...
Click to collapse
dunno if i m reading that paths wrong but it looks you did something wrong related to the filepaths of the firmware and adb itself. - go into your folder were adb is located. might be inside your One-M8-All-In-One_Kit folder ....then paste the firmware zip in just the same folder. ( location of adb ) ....after that, navigate to that adb location/folder, (you should actually be there because you have just copied the firmware zip into that folder ..so skip that .... press shift + right mousebutton on empty space inside of the folder ( so dont start any program or click on a file, just hold shift and press the right mousekey to open die normal windows dialog window where you can change the view of the folder or add new files etc. )
by using the shift+right mouse key combi, u will see another option inside of that dialog apart from the common stuff you normally have listed. -> "open command prompt right here" ( or something similar, dunno the exact wording in english )
so click that order, it will open up the windows console (cmd) -> make your phone reboot to the bootloader by writing "adb reboot-bootloader" ( i guess it should be obvious that your phone needs to be connected via usb allready )
- ( you can also just hold the power button on your phone and pick bootloader at the boot-menu, just as you like.
- arrived at bootloader, make sure you phone shows "fastboot-usb"
- write "fastboot oem rebootRUU" inside the cmd window -> phone should boot into the RUU modus.
- write "fastboot flash zip firmware-6.12.1540.4.zip" (not fastboot".exe" - just fastboot ... ) -> make sure you use the correct name of the zip. - you need use the filename of the firmware that you ve copied into the adb folder at the beginning. - to prevent issues, you should rename the firmware zip to something simple. - like just firmware.zip or firm.zip, without that versionsnumber. - its just easier for you to write that into the cmd window and you will be sure that issues might be not related to some wrong written filename.
done.
edit: @sceryavuz is htc_fastboot anything special or just the normal adb? if it is different, may you explain to me what it is?

What is the advantage of the Developer edition?

Can I do this with a vzw m8? I want to see if this helps me run GPE and AOSP roms without the cellular issues I've been having. Also, can I change back as well?
Sent from my HTC6525LVW using XDA-Developers mobile app

edit: @sceryavuz is htc_fastboot anything special or just the normal adb? if it is different, may you explain to me what it is?[/QUOTE]
htc_fastboot you need this for flashing firmware. Security reasons. You can't flash recovery, for example with this.
fastboot it's for everithing else, other than firmware.
For me it was like that, at least..

vladaxx said:
What is the advantage of the Developer edition?
Click to expand...
Click to collapse
It is the full unlocked rom, you can do anything with Developer Edition without any errors. This is the most stable version.
Dan Tekle said:
Can I do this with a vzw m8? I want to see if this helps me run GPE and AOSP roms without the cellular issues I've been having. Also, can I change back as well?
Sent from my HTC6525LVW using XDA-Developers mobile app
Click to expand...
Click to collapse
I don't know if it is work or not? I have AT&T device and it works. Sprint and verizon device may have specific modem.
_moelle said:
dunno if i m reading that paths wrong but it looks you did something wrong related to the filepaths of the firmware and adb itself. - go into your folder were adb is located. might be inside your One-M8-All-In-One_Kit folder ....then paste the firmware zip in just the same folder. ( location of adb ) ....after that, navigate to that adb location/folder, (you should actually be there because you have just copied the firmware zip into that folder ..so skip that .... press shift + right mousebutton on empty space inside of the folder ( so dont start any program or click on a file, just hold shift and press the right mousekey to open die normal windows dialog window where you can change the view of the folder or add new files etc. )
by using the shift+right mouse key combi, u will see another option inside of that dialog apart from the common stuff you normally have listed. -> "open command prompt right here" ( or something similar, dunno the exact wording in english )
so click that order, it will open up the windows console (cmd) -> make your phone reboot to the bootloader by writing "adb reboot-bootloader" ( i guess it should be obvious that your phone needs to be connected via usb allready )
- ( you can also just hold the power button on your phone and pick bootloader at the boot-menu, just as you like.
- arrived at bootloader, make sure you phone shows "fastboot-usb"
- write "fastboot oem rebootRUU" inside the cmd window -> phone should boot into the RUU modus.
- write "fastboot flash zip firmware-6.12.1540.4.zip" (not fastboot".exe" - just fastboot ... ) -> make sure you use the correct name of the zip. - you need use the filename of the firmware that you ve copied into the adb folder at the beginning. - to prevent issues, you should rename the firmware zip to something simple. - like just firmware.zip or firm.zip, without that versionsnumber. - its just easier for you to write that into the cmd window and you will be sure that issues might be not related to some wrong written filename.
done.
edit: @sceryavuz is htc_fastboot anything special or just the normal adb? if it is different, may you explain to me what it is?
Click to expand...
Click to collapse
htc_fastboot is stock fastboot that released by htc. You can use your fastboot already have. htc_fastboot check all zip or img file for compatibility.
null0seven said:
edit: @sceryavuz is htc_fastboot anything special or just the normal adb? if it is different, may you explain to me what it is?
htc_fastboot you need this for flashing firmware. Security reasons. You can't flash recovery, for example with this.
fastboot it's for everithing else, other than firmware.
For me it was like that, at least..
Click to expand...
Click to collapse
Yes, mostly agreed (security and compatibility reasons). You can flash TWRP with htc_fastboot

@monoar30 @_moelle @Dan Tekle @null0seven @sceryavuz
hey guys just to make it sense
you can't convert CDMA ( device) firmware to GSM firmware
sprint and Verizon can't be converted to any other GSM firmware
HTC_fastboot used to flash big .zip as you can flash any thing by regular fastboot but RUU.zip needs to be flashed by HTC_fastboot

Did anyone with Verizon M8 manage to install it?
I managed to change CID, MID and install firmware without any errors, but when I try to flash rom.zip it says file is too large. Also the device doesn't recognize SIM card when on Developer Edition firmware. I guess this is because of the hardware difference, we won't be able to get this ROM working.

M.Ned said:
Did anyone with Verizon M8 manage to install it?
I managed to change CID, MID and install firmware without any errors, but when I try to flash rom.zip it says file is too large. Also the device doesn't recognize SIM card when on Developer Edition firmware. I guess this is because of the hardware difference, we won't be able to get this ROM working.
Click to expand...
Click to collapse
you are lucky if your device still working
read the post above yours
you can't flash GSM firmware on CDMA device because the hardware is different

i have a verizon htc one M8, unlocked, S-OFF, SuperCID, rooted, boot loader unlocked working with GSM carrier in India, I unlocked couple more LTE bands etc. Can I flash this as I don't have the CDMA only device?

Chandresh204 said:
i have a verizon htc one M8, unlocked, S-OFF, SuperCID, rooted, boot loader unlocked working with GSM carrier in India, I unlocked couple more LTE bands etc. Can I flash this as I don't have the CDMA only device?
Click to expand...
Click to collapse
if your device hardware match the GSM variant then you can
if didn't then you can't

(bootloader) version: 0.5
(bootloader) version-bootloader: 3.19.0.0000
(bootloader) version-baseband: 1.29.214500021.24_2G
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main:
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: FA**************
(bootloader) imei: 99**************
(bootloader) imei2: Not Support
(bootloader) meid: 99**************
(bootloader) product: m8_whl
(bootloader) platform: hTCBmsm8974
(bootloader) modelid: 0P6B12000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: 76df2b54
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
all: Done!
finished. total time: 0.017s
--------------------------------------------------------------------------------
Successfully able to change my cid as well as mid as previous its was 0P6B70000
So now i am still not able to install developer version rom
And Successfully flashed firmware-6.12.1540.4.zip
{F:\Utility\Softwares\Mobile Flushing\HTC one m8>fastboot flash zip firmware-6.12.1540.4.zip
sending 'zip' (31625 KB)...
OKAY [ 1.994s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) zip info parsing...
(bootloader) checking model ID...
(bootloader) checking custom ID...
(bootloader) start image[hboot] unzipping for pre-update check...
(bootloader) total_image_number=8
(bootloader) start image[hboot] flushing...
(bootloader) [RUU]WP,hboot,0
(bootloader) [RUU]WP,hboot,99
(bootloader) [RUU]WP,hboot,100
(bootloader) ...... Successful
(bootloader) current_image_number=0
(bootloader) current_image_number=1
(bootloader) current_image_number=2
(bootloader) current_image_number=3
(bootloader) current_image_number=4
(bootloader) current_image_number=5
(bootloader) current_image_number=6
(bootloader) current_image_number=7
FAILED (remote: 90 hboot pre-update! please flush image again immediately)
finished. total time: 3.177s
F:\Utility\Softwares\Mobile Flushing\HTC one m8>fastboot flash zip firmware-6.12.1540.4.zip
sending 'zip' (31625 KB)...
OKAY [ 2.004s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) zip info parsing...
(bootloader) checking model ID...
(bootloader) checking custom ID...
(bootloader) total_image_number=16
(bootloader) start image[adsp] unzipping & flushing...
(bootloader) [RUU]UZ,adsp,0
(bootloader) [RUU]UZ,adsp,11
(bootloader) [RUU]UZ,adsp,21
(bootloader) [RUU]UZ,adsp,33
(bootloader) [RUU]UZ,adsp,43
(bootloader) [RUU]UZ,adsp,54
(bootloader) [RUU]UZ,adsp,65
(bootloader) [RUU]UZ,adsp,75
(bootloader) [RUU]UZ,adsp,88
(bootloader) [RUU]UZ,adsp,98
(bootloader) [RUU]UZ,adsp,100
(bootloader) [RUU]WP,adsp,0
(bootloader) [RUU]WP,adsp,100
(bootloader) ...... Successful
(bootloader) current_image_number=0
(bootloader) start image[pg2fs_spcustom] unzipping & flushing...
(bootloader) [RUU]UZ,pg2fs_spcustom,0
(bootloader) [RUU]UZ,pg2fs_spcustom,45
(bootloader) [RUU]UZ,pg2fs_spcustom,99
(bootloader) [RUU]UZ,pg2fs_spcustom,100
(bootloader) ...... Successful
(bootloader) current_image_number=1
(bootloader) start image[rpm] unzipping & flushing...
(bootloader) [RUU]UZ,rpm,0
(bootloader) [RUU]UZ,rpm,100
(bootloader) [RUU]WP,rpm,0
(bootloader) [RUU]WP,rpm,100
(bootloader) ...... Successful
(bootloader) current_image_number=2
(bootloader) start image[sbl1] unzipping & flushing...
(bootloader) [RUU]UZ,sbl1,0
(bootloader) [RUU]UZ,sbl1,100
(bootloader) signature checking...
(bootloader) verified fail
(bootloader) ..... Bypassed
(bootloader) current_image_number=3
(bootloader) start image[sbl1] unzipping & flushing...
(bootloader) [RUU]UZ,sbl1,0
(bootloader) [RUU]UZ,sbl1,100
(bootloader) signature checking...
(bootloader) verified fail
(bootloader) ..... Bypassed
(bootloader) current_image_number=4
(bootloader) start image[sbl1] unzipping & flushing...
(bootloader) [RUU]UZ,sbl1,0
(bootloader) [RUU]UZ,sbl1,100
(bootloader) signature checking...
(bootloader) [RUU]WP,sbl1,0
(bootloader) [RUU]WP,sbl1,100
(bootloader) ...... Successful
(bootloader) current_image_number=5
(bootloader) start image[sbl1] unzipping & flushing...
(bootloader) [RUU]UZ,sbl1,0
(bootloader) [RUU]UZ,sbl1,100
(bootloader) signature checking...
(bootloader) verified fail
(bootloader) ..... Bypassed
(bootloader) current_image_number=6
(bootloader) start image[sdi] unzipping & flushing...
(bootloader) [RUU]UZ,sdi,0
(bootloader) [RUU]UZ,sdi,100
(bootloader) [RUU]WP,sdi,0
(bootloader) [RUU]WP,sdi,100
(bootloader) ...... Successful
(bootloader) current_image_number=7
(bootloader) start image[sensor_hub] unzipping & flushing...
(bootloader) [RUU]UZ,sensor_hub,0
(bootloader) [RUU]UZ,sensor_hub,100
(bootloader) [RUU]WP,sensor_hub,0
(bootloader) [RUU]WP,sensor_hub,4
(bootloader) [RUU]WP,sensor_hub,8
(bootloader) [RUU]WP,sensor_hub,12
(bootloader) [RUU]WP,sensor_hub,16
(bootloader) [RUU]WP,sensor_hub,20
(bootloader) [RUU]WP,sensor_hub,24
(bootloader) [RUU]WP,sensor_hub,28
(bootloader) [RUU]WP,sensor_hub,32
(bootloader) [RUU]WP,sensor_hub,36
(bootloader) [RUU]WP,sensor_hub,40
(bootloader) [RUU]WP,sensor_hub,44
(bootloader) [RUU]WP,sensor_hub,48
(bootloader) [RUU]WP,sensor_hub,52
(bootloader) [RUU]WP,sensor_hub,56
(bootloader) [RUU]WP,sensor_hub,60
(bootloader) [RUU]WP,sensor_hub,64
(bootloader) [RUU]WP,sensor_hub,68
(bootloader) [RUU]WP,sensor_hub,72
(bootloader) [RUU]WP,sensor_hub,76
(bootloader) [RUU]WP,sensor_hub,80
(bootloader) [RUU]WP,sensor_hub,84
(bootloader) [RUU]WP,sensor_hub,88
(bootloader) [RUU]WP,sensor_hub,92
(bootloader) [RUU]WP,sensor_hub,96
(bootloader) [RUU]WP,sensor_hub,100
(bootloader) ...... Successful
(bootloader) current_image_number=8
(bootloader) start image[sp1] unzipping & flushing...
(bootloader) ...... Successful
(bootloader) current_image_number=9
(bootloader) start image[tp] unzipping & flushing...
(bootloader) ..... Bypassed
(bootloader) current_image_number=10
(bootloader) start image[tp] unzipping & flushing...
(bootloader) ..... Bypassed
(bootloader) current_image_number=11
(bootloader) start image[tz] unzipping & flushing...
(bootloader) ...... Successful
(bootloader) current_image_number=12
(bootloader) start image[wcnss] unzipping & flushing...
(bootloader) ...... Successful
(bootloader) current_image_number=13
(bootloader) start image[radio] unzipping & flushing...
(bootloader) trying to rename MBA
(bootloader) ...... Successful
(bootloader) current_image_number=14
(bootloader) start image[rcdata] unzipping & flushing...
(bootloader) ...... Successful
(bootloader) current_image_number=15
OKAY [ 59.617s]
finished. total time: 61.621s }
---------------------------------------------------
and when i am flashing rom.zip then its saying
F:\Utility\Softwares\Mobile Flushing\HTC one m8>fastboot flash zip rom.zip
load_file: could not allocate 1574717756 bytes
error: cannot load 'rom.zip'
so what should i do

Shakil Murm said:
(bootloader) product: m8_whl
Click to expand...
Click to collapse
Your device is m8_whl and this RUU is meant for m8_ul or m8_ul_ca only.
Return to stock .. if you're lucky you still can use your device but lose the ability to connect to 3G/4G/LTE.
(because you most probably already bricked the radio after your flash the firmware which is not meant for your device variant)

ckpv5 said:
Your device is m8_whl and this RUU is meant for m8_ul or m8_ul_ca only.
Return to stock .. if you're lucky you still can use your device but lose the ability to connect to 3G/4G/LTE.
(because you most probably already bricked the radio after your flash the firmware which is not meant for your device variant)
Click to expand...
Click to collapse
i'm trying to tell them that this method works on GSM devices only but no one read
please @sceryavuz ADD IT TO OP THIS METHOD WORKS ON GSM DEVICES ONLY NO VERIZON OR SPRINT
please ckpv5 am i right or not ??

RUU Not Working?
Hi,
I followed your instructions and the Developer Edition rom flashed and appears to be working fine, thanks very much.
After setting the phone up I wanted to try and test flashing again with RUU_M8_UL_M60_SENSE70_MR_BrightstarUS_WWE_6.12.1540.4.exe . The process fails after "Verifying information on your Android phone. Please wait..." with ERROR 170 USB CONNECTION ERROR. I've checked and the USB connection seems to be fine. Is this to be expected?
Thanks again.

0graham0 said:
Hi,
I followed your instructions and the Developer Edition rom flashed and appears to be working fine, thanks very much.
After setting the phone up I wanted to try and test flashing again with RUU_M8_UL_M60_SENSE70_MR_BrightstarUS_WWE_6.12.1540.4.exe . The process fails after "Verifying information on your Android phone. Please wait..." with ERROR 170 USB CONNECTION ERROR. I've checked and the USB connection seems to be fine. Is this to be expected?
Thanks again.
Click to expand...
Click to collapse
run the RUU while the device boot into fastboot and use USB 2 not USB 3
Sent from my HTC One M8 using XDA Labs

ahmed.ismael said:
run the RUU while the device boot into fastboot and use USB 2 not USB 3
Click to expand...
Click to collapse
ah, that did the trick. thanks very much.

I was unable to flash the rom.zip with google's fastboot.exe (recogniced wrong size, header error, etc.....)!
Use htc_fastboot.exe found in the same temporary folder as rom.zip!

Worked for me. Why flash firmware first??
OP instructions worked for me . Was coming from US AT&T / Cingular (Cricket?)
Why did we flash firmware zip firmware and THEN flash the RUU pulled from the temp folder?

i need downgrade u ultra dual sim for oreo to noguet

Code:
Send: fastboot getvar all
(bootloader) kernel: lk
(bootloader) product: htc_ocedugl
(bootloader) version: 1.0
(bootloader) max-download-size: 1579200000
(bootloader) serialno: xxxxxxxxxxxx
(bootloader) slot-count: 0
(bootloader) current-slot:
(bootloader) imei: xxxxxxxxxxxxxxx
(bootloader) version-main: 1.64.401.10
(bootloader) boot-mode: download
(bootloader) version-baseband: [email protected]
(bootloader) version-bootloader: 1.0.0.0000
(bootloader) mid: 2PZF20000
(bootloader) cid: HTC__A07
all:
finished. total time: 0.006s
htc_fastboot finished. total time: 0.106s
i need stock rom or ruu.

Try this RUU
https://www.androidfilehost.com/?fid=3700668719832236904

thanks ur reply
minhnewpro said:
Try this RUU
https://www.androidfilehost.com/?fid=3700668719832236904
Click to expand...
Click to collapse
i trying it now.

please help me imei null.
I'm a little weak to speak English. Sorry for my english.
i installed this rom Link. 2PZFIMG_OCEAN_[email protected]70515_56.34_release_507305_signed_2_4.zip than after setup i locked BL. imei null.

https://androidfilehost.com/?fid=962187416754474071 i install this room. again imei null.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb devices
List of devices attached
C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
error: no devices/emulators found
C:\Program Files (x86)\Minimal ADB and Fastboot>mke2fs -t ext4 /dev/block/bootdevice/by-name/persist
'mke2fs' is not recognized as an internal or external command,
operable program or batch file.
Click to expand...
Click to collapse
i hate this mistake.

Adream09 said:
i hate this mistake.
Click to expand...
Click to collapse
10. After flashing, your device can boot into Android but no signal or IMEI received, dont worry, continue these steps
11. Reboot into download mode, reflash TWRP, then boot to TWRP
12. At cmd windows, type
Code:
adb devices
adb shell
mke2fs -t ext4 /dev/block/bootdevice/by-name/persist
13. Reboot device to check if IMEI received
14. If IMEI received, you should reflash stock recovery from RUU.zip, but reflash the RUU is recommended.
If not, try to format the persist partition manually again (step 12)
15. Done

thanks ur reply
minhnewpro said:
10. After flashing, your device can boot into Android but no signal or IMEI received, dont worry, continue these steps
11. Reboot into download mode, reflash TWRP, then boot to TWRP
12. At cmd windows, type
Code:
adb devices
adb shell
mke2fs -t ext4 /dev/block/bootdevice/by-name/persist
13. Reboot device to check if IMEI received
14. If IMEI received, you should reflash stock recovery from RUU.zip, but reflash the RUU is recommended.
If not, try to format the persist partition manually again (step 12)
15. Done
Click to expand...
Click to collapse
thanks bro

Fire HD 8 2015 (5th Gen) debrick

I have 3 of these, so I'm being a little carefree.
I went into recovery and adb sideload flashed an older version, causing that one to go into a preloader loop (not a big deal)
I'd love to recover that one and it appears I can do so using some of the techniques found here https://forum.xda-developers.com/amazon-fire/development/unbrick-fire-7-5th-gen-downgrade-t3388747
I can definitely handshake at the beginning and read/write. On one of my working tablets I went into fastboot and ran `fastboot getvar all` and was able to see some partition sizes and offsets.
I've tried writing some things to the tablet stuck in preloader mode, but still not getting that one back to adb or fastboot. Some examples:
./write_mmc.py $((0x2000000)) boot.img
./write_mmc.py $((0x1F00000)) lk.bin
./write_mmc.py $((0x1500000)) tz.img
I can keep banging away at this but if anyone has a few more hints, I really could use a clue by four. Thanks!
PS: I imagine that these models (THEBES) could get some of the same goodness as the amonet versions but it has been low on people's priority.

paklids said:
I have 3 of these, so I'm being a little carefree.
I went into recovery and adb sideload flashed an older version, causing that one to go into a preloader loop (not a big deal)
I'd love to recover that one and it appears I can do so using some of the techniques found here https://forum.xda-developers.com/amazon-fire/development/unbrick-fire-7-5th-gen-downgrade-t3388747
I can definitely handshake at the beginning and read/write. On one of my working tablets I went into fastboot and ran `fastboot getvar all` and was able to see some partition sizes and offsets.
I've tried writing some things to the tablet stuck in preloader mode, but still not getting that one back to adb or fastboot. Some examples:
./write_mmc.py $((0x2000000)) boot.img
./write_mmc.py $((0x1F00000)) lk.bin
./write_mmc.py $((0x1500000)) tz.img
I can keep banging away at this but if anyone has a few more hints, I really could use a clue by four. Thanks!
PS: I imagine that these models (THEBES) could get some of the same goodness as the amonet versions but it has been low on people's priority.
Click to expand...
Click to collapse
Hi,
So looks like you downgraded the Preloader to version that has non-patched rw commands:good:
I can try to help you. If you want, just PM me.
Regards.

I'm going to add some details to the thread so peeps know where I'm coming from and where I'm going:
This unit, if you want to get into adb you'll need to enable adb debugging in the menu. After that you cannot reboot directly into fastboot mode, but you can hop over to recovery and then do it from there:
`adb reboot recovery` then select `reboot to recovery`
When the unit is stock (in my case v5.6.1.0) and on adb - the lsusb is:
Bus 005 Device 124: ID 1949:0212 Lab126, Inc.
& on fastboot lsusb reports:
Bus 005 Device 003: ID 0bb4:0c01 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo
(Hey...that looks familiar! I had an HTC Magic that I rooted the first day I owned it)
What did I do to put this unit in preloader loop? I booted into revocery and used adb sideload to flash (I *think*) update-kindle-32.5.2.2_user_522054520.bin . After that the screen went black and I could see it rebooting because the USB would come up and then back down. lsusb would then report:
Bus 001 Device 105: ID 0e8d:3000 MediaTek Inc.
I hope this helps any of you follow along in case you are trying to recover your Fire HD 8 5th gen (2015)

Oh, and here are the details I gathered from the known working tablet:
fastboot getvar all
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0xFFFFFFFFFFFFFFFF
(bootloader) prod: 1
(bootloader) serialno: FFFFFFFFFFFFFFFF
(bootloader) partition-offset:userdata: 5ec80000
(bootloader) partition-size:userdata: 173bfbe00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-offset:cache: 4f280000
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-offset:system: 4280000
(bootloader) partition-size:system: 4b000000
(bootloader) partition-type:system: unknown
(bootloader) partition-offsetersisbackup: 3280000
(bootloader) partition-sizeersisbackup: 1000000
(bootloader) partition-typeersisbackup: unknown
(bootloader) partition-offset:MISC: 3200000
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-offsetKB: 3100000
(bootloader) partition-sizeKB: 100000
(bootloader) partition-typeKB: unknown
(bootloader) partition-offset:KB: 3000000
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) partition-offset:recovery: 2800000
(bootloader) partition-size:recovery: 800000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-offset:boot: 2000000
(bootloader) partition-size:boot: 800000
(bootloader) partition-type:boot: unknown
(bootloader) partition-offset:UBOOT: 1f00000
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-offset:TEE2: 1a00000
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-offset:TEE1: 1500000
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-offsetMT: 1100000
(bootloader) partition-sizeMT: 400000
(bootloader) partition-typeMT: unknown
(bootloader) partition-offsetRO_INFO: 1008000
(bootloader) partition-sizeRO_INFO: 20000
(bootloader) partition-typeRO_INFO: unknown
(bootloader) max-download-size: 52429824
(bootloader) kernel: lk
(bootloader) product: THEBES
(bootloader) version: 0.5
(bootloader) unlocked: not unlocked
(bootloader) production: Unknown
all: Done!!

So I did confirm that you can get the tablet (in my case tablet number 2) into preloader mode by booting to recovery and side loading the update that I mentioned before. For reference:
md5sum update-kindle-32.5.2.2_user_522054520.bin
615019d226954c2e4e2f98613151bc75 update-kindle-32.5.2.2_user_522054520.bin

paklids said:
I have 3 of these, so I'm being a little carefree.
...
I've tried writing some things to the tablet stuck in preloader mode, but still not getting that one back to adb or fastboot. Some examples:
./write_mmc.py $((0x2000000)) boot.img
./write_mmc.py $((0x1F00000)) lk.bin
./write_mmc.py $((0x1500000)) tz.img
I can keep banging away at this but if anyone has a few more hints, I really could use a clue by four. Thanks!
PS: I imagine that these models (THEBES) could get some of the same goodness as the amonet versions but it has been low on people's priority.
Click to expand...
Click to collapse
paklids said:
So I did confirm that you can get the tablet (in my case tablet number 2) into preloader mode by booting to recovery and side loading the update that I mentioned before. For reference:
md5sum update-kindle-32.5.2.2_user_522054520.bin
615019d226954c2e4e2f98613151bc75 update-kindle-32.5.2.2_user_522054520.bin
Click to expand...
Click to collapse
You gotta be careful with write_mmc.py and ensure that you have the addresses right! Those can be quite tricky, you should go through the Fire HD 2014 thread which has the same chipset:
https://forum.xda-developers.com/fire-hd/development/unbrick-fire-hd-6-7-flashing-lollipop-t3405797
You will need to replace TZ/LK to the version you had before the downgrade. Then it should boot, and you may be able to root FireOS via KingRoot or something (if it's vulnerable). If your preloader version changed, then you cannot do anything since there is no way to write preloader via write_mmc.py. I think the recent scripts by @k4y0z can query the versions of PL/TZ/LK, see if you can do that too, just to make sure that PL does not need to be replaced, and to get an idea which versions you are dealing with.
Edit: Here is how you can see which versions of PL/TZ/LK you have (remove the junk - I copied this from another script):
Code:
tee_version=$((`adb shell getprop ro.boot.tee_version | dos2unix`))
lk_version=$((`adb shell getprop ro.boot.lk_version | dos2unix`))
pl_version=$((`adb shell getprop ro.boot.pl_version | dos2unix`))

Just a note for anyone else, sometimes running ./handshake.py as a regular user will just continue waiting. I ran it as root and it completed quickly. This isn't uncommon with a number of linux distributions (I'm on Debian 9 Stretch) because of the permissions on /dev/tty type devices. It's always recommended that if you can run it as a regular user, then that is better. It may be possible to use sudo to do this as well.

bibikalka said:
You gotta be careful with write_mmc.py and ensure that you have the addresses right! Those can be quite tricky, you should go through the Fire HD 2014 thread which has the same chipset:
https://forum.xda-developers.com/fire-hd/development/unbrick-fire-hd-6-7-flashing-lollipop-t3405797
You will need to replace TZ/LK to the version you had before the downgrade. Then it should boot, and you may be able to root FireOS via KingRoot or something (if it's vulnerable). If your preloader version changed, then you cannot do anything since there is no way to write preloader via write_mmc.py. I think the recent scripts by @k4y0z can query the versions of PL/TZ/LK, see if you can do that too, just to make sure that PL does not need to be replaced, and to get an idea which versions you are dealing with.
Edit: Here is how you can see which versions of PL/TZ/LK you have (remove the junk - I copied this from another script):
Code:
tee_version=$((`adb shell getprop ro.boot.tee_version | dos2unix`))
lk_version=$((`adb shell getprop ro.boot.lk_version | dos2unix`))
pl_version=$((`adb shell getprop ro.boot.pl_version | dos2unix`))
Click to expand...
Click to collapse
Yup, thebes and ariel share same CPU
So, now that we know Preloader is vulerable, we can flash a prerooted system.img (Yes, will take a lot of time).
Probably Amazon patched up this in latest preloaders but downgrading the Preloader and then restoring correct TZ, LK and flash the rooted system img may do the trick
Regards.

Rortiz2 said:
Yup, thebes and ariel share same CPU
So, now that we know Preloader is vulerable, we can flash a prerooted system.img (Yes, will take a lot of time).
Probably Amazon patched up this in latest preloaders but downgrading the Preloader and then restoring correct TZ, LK and flash the rooted system img may do the trick
Regards.
Click to expand...
Click to collapse
This is too slow. The first order of business would be to update LK/TZ and see if it boots. If it does, then just do Kingroot: https://forum.xda-developers.com/showpost.php?p=63061585&postcount=4
If PL also has downgrade protection, it will still not boot. Then RPMB needs to be cleared for which we don't have a procedure (yet).

bibikalka said:
This is too slow. The first order of business would be to update LK/TZ and see if it boots. If it does, then just do Kingroot: https://forum.xda-developers.com/showpost.php?p=63061585&postcount=4
If PL also has downgrade protection, it will still not boot. Then RPMB needs to be cleared for which we don't have a procedure (yet).
Click to expand...
Click to collapse
any one cant root this ?