Related
Just curious, what happens if I follow the rooting steps in the other thread but only do this:
adb push /directory_you_placed_asroot2/asroot2 /data/local/
adb shell
chmod 0755 /data/local/asroot2
/data/local/asroot2 /system/bin/sh
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /system/bin
cat sh > su
chmod 4755 su
At this point, what state is the phone in? Do I have full root access to the file system? What are the issues/concerns if I don't proceed with flashing the recovery image. Just trying to understand the process and what each step is for. I understand the part above but can't understand why you have to flash a recovery image and can't just use the phone after root is achieved.
Thanks in advance. FYI...all I want to do with root access is delete some system files, nothing more.
mobilehavoc said:
Just curious, what happens if I follow the rooting steps in the other thread but only do this:
adb push /directory_you_placed_asroot2/asroot2 /data/local/
adb shell
chmod 0755 /data/local/asroot2
/data/local/asroot2 /system/bin/sh
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /system/bin
cat sh > su
chmod 4755 su
At this point, what state is the phone in? Do I have full root access to the file system? What are the issues/concerns if I don't proceed with flashing the recovery image. Just trying to understand the process and what each step is for. I understand the part above but can't understand why you have to flash a recovery image and can't just use the phone after root is achieved.
Thanks in advance. FYI...all I want to do with root access is delete some system files, nothing more.
Click to expand...
Click to collapse
You don't have to flash the recovery image. I believe from that code you would have root and can run programs that require root. However, you would be unable to flash a new rom or any other update.zip (which means no auto apps2sd), partition your sd card easily or backup your phone in case something goes wrong. I suppose you are probably just asking for the sake of asking and knowledge but this is why a recovery image is HIGHLY recommended.
chuckhriczko said:
You don't have to flash the recovery image. I believe from that code you would have root and can run programs that require root. However, you would be unable to flash a new rom or any other update.zip (which means no auto apps2sd), partition your sd card easily or backup your phone in case something goes wrong. I suppose you are probably just asking for the sake of asking and knowledge but this is why a recovery image is HIGHLY recommended.
Click to expand...
Click to collapse
thanks. So if I don't flash the recovery image, I can't update to cooked ROMs or do the stuff you suggested but will the phone otherwise function normal? i.e. I can update to a Sprint/HTC update, I can factory reset the phone (assuming that'll kill root), etc.? I may do the whole process with the recovery image later but don't need it right now.
I only need to do this as a stopgap until Sprint/HTC releases an update.
mobilehavoc said:
thanks. So if I don't flash the recovery image, I can't update to cooked ROMs or do the stuff you suggested but will the phone otherwise function normal? i.e. I can update to a Sprint/HTC update, I can factory reset the phone (assuming that'll kill root), etc.? I may do the whole process with the recovery image later but don't need it right now.
I only need to do this as a stopgap until Sprint/HTC releases an update.
Click to expand...
Click to collapse
Well, I wouldnt recommend doing a sprint update either. That will cause you to lose root most likely. The only way then to keep root is wait until we get a dump of the update and then cook a rom that includes root, in which case you would need to flash the recovery image. Updates usually fix the exploits we use to gain root.
chuckhriczko said:
Well, I wouldnt recommend doing a sprint update either. That will cause you to lose root most likely. The only way then to keep root is wait until we get a dump of the update and then cook a rom that includes root, in which case you would need to flash the recovery image. Updates usually fix the exploits we use to gain root.
Click to expand...
Click to collapse
What he said...but yes, at the steps you quoted, mobilehavoc, you are capable of root access (you don't actually have it until you run that "su" command ). That allows you to read and modify otherwise locked away files and tweak to your hearts content!
Ive rooted and played around some but very little and followed everyones instructions very closely ( thank you for teaching a newbie ). Now how do I go back to original state that I backed up ( think I did ).
When I press the power and volume down button I get to the droid on skateboard, then I press the Home for recovery. I get the screen with all the options and I go to nandroid v2.2 restore and press trackball. It says restore latest backup press home to confirm. I do that and get the following error
Error : run 'nandroid-mobile.sh restore' via console.
What does this mean? Do i have to be tethered to PC and run this command from cmd prompt?
I am now lost again, any help is appreciated
Grinder16 said:
Ive rooted and played around some but very little and followed everyones instructions very closely ( thank you for teaching a newbie ). Now how do I go back to original state that I backed up ( think I did ).
When I press the power and volume down button I get to the droid on skateboard, then I press the Home for recovery. I get the screen with all the options and I go to nandroid v2.2 restore and press trackball. It says restore latest backup press home to confirm. I do that and get the following error
Error : run 'nandroid-mobile.sh restore' via console.
What does this mean? Do i have to be tethered to PC and run this command from cmd prompt?
I am now lost again, any help is appreciated
Click to expand...
Click to collapse
Just to confirm since it wasn't mentioned, you did a Nandroid backup earlier right? can you confirm that there's a folder on your sdcard called "nandroid"?
thecodemonk said:
Just to confirm since it wasn't mentioned, you did a Nandroid backup earlier right? can you confirm that there's a folder on your sdcard called "nandroid"?
Click to expand...
Click to collapse
Dont see that folder - I guess that is not good. Any ideas?
Grinder16 said:
Dont see that folder - I guess that is not good. Any ideas?
Click to expand...
Click to collapse
You must do a backup BEFORE you can do a restore..
To clarify for everyone, here's a breakdown of the steps:
adb push /directory_you_placed_asroot2/asroot2 /data/local/
This copies the asroot2 program to the /data/local folder on your phone.
adb shell
This logs you into the phone. From here on out, you are no longer executing Windows commands from a DOS shell - you are actually executing Linux commands on the phone.
chmod 0755 /data/local/asroot2
This changes the permissions on the asroot2 program so that it can be executed.
/data/local/asroot2 /system/bin/sh
This actually runs the root exploit and creates a file called /system/bin/sh that we will later turn into su.
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
This unmounts the /system partition and remounts it as writeable.
cd /system/bin
This puts you into the /system/bin folder.
cat sh > su
This creates the su program.
chmod 4755 su
This changes the persmissions on the su file to allow it to be executed.
theresthatguy said:
You must do a backup BEFORE you can do a restore..
Click to expand...
Click to collapse
I thought I had. What are the steps? I have a flash recovery image on my SD card. I have followed all instructions that I could find
Grinder16 said:
I thought I had. What are the steps? I have a flash recovery image on my SD card. I have followed all instructions that I could find
Click to expand...
Click to collapse
Boot to the recovery image then select "nandroid backup"
jonnythan said:
Boot to the recovery image then select "nandroid backup"
Click to expand...
Click to collapse
Can you provide those steps? Sorry but complete newbie here
"I get the screen with all the options and I go to nandroid v2.2 restore and press trackball. It says restore latest backup press home to confirm. I do that and get the following error"
Go there but select Backup instead of Restore.
Turn the phone off, hold the Home key, and turn it on. When you get to the screen with the green text select nandroid backup.
NOTE: This is a work in progress. While I have completed this guide myself SEVERAL times to ensure accuracy, It is possible that typos or errors in understanding exist. Please use at your own risk, and expect NOTHING from me. I will do my best to update this guide and improve the formatting as I find time. Feel free to leave feedback!
I cannot stress this enough: always have backups of any important information. While we may not be able to do full image-based backups until after root, you can still make sure we aren't deleting needed data. While yes, Google should hold your most important data and allow you to sync at any time, what would you do if Google went down? And I've even had trouble using the "Offline" function for some of the Apps. Therefore, Make a copy of everything on your SD card and read this excellent guide from Lifehacker about how to backup Google Apps data: Lifehacker
You will need an SD card. I recommend AT LEAST an 8GB Class 4. Most actually recommend a Class 6 for use with apps2sd, but I just wanted to let you know that it would still work with a Class 4. For those unaware, apps2sd allows you to save internal phone memory by placing after-market applications onto your SD card. Most users notice a speed benefit from this.
If you would like to purchase a Class 6 SD card, you can get a one here with three sizes available (4GB, 8GB, 16GB):
A-DATA MicroSDHC Class 6 Turbo With SD Adapter
To ensure the best possible load, perform a factory reset, and WIPE your SD card!
Code:
Menu > Settings > Security > Factory data reset > Reset phone > Erase everything
TRUE FACTORY RESET (UN-ROOT)
If you, like me, have already rooted and are trying to perform this process over again, you will unfortunately have to download the original ROM and flash it in Windows.
Download: RUU_Hero_C_Sprint_1.29.651.1_signed_release.exe
Run in Windows (I used XP through VMWare Fusion), and this will return the phone to the TRULY factory loaded state. Any other Factory data reset will simply reload the last ROM image saved, which, if you rooted and loaded MoDaCo, would be MoDaCo. I am encouraging you to follow this process to avoid any problems that may exist while the phone is rooted or loaded with the unofficial ROM. And even if you perform this process as a first-time rooter, it certainly wont hurt!
ROOT HERO [MAC]
(This is the process that allows modifications to occur on your phone):
The guide I follow and can verify is this:
Rooting CDMA Hero [Mac]
I do not use Windows as a primary platform, so I would recommend following this guide if you are on Windows:
How to root the CDMA Hero (DETAILED Windows guide)
You should be able to return to this guide after you have successfully completed the root process on Windows. Continue from the section "NANDROID BACKUP" below.
Per the purpose of this guide, I will detail my exact steps from the "Rooting CDMA Hero [Mac]" post. Thanks ajones7279!
Plug in your phone
Download Android SDK: http://developer.android.com/sdk/index.html
Unpack, Rename the extracted folder to "AndroidSDK" (This is case sensitive!), and Move it to "Applications" (I consider the Android SDK a set of applications.)
Open TextEdit, Click Format>Make Plain Text, then copy and paste the following:
Code:
export PATH=${PATH}:/Applications/AndroidSDK/tools
Save as: ".bash_profile"
On Phone: Go to Settings > Applications > Development>USB Debugging and make sure the option is checked.
On your Mac: Download asroot2: http://zenthought.org/tmp/asroot2
Save this file into: /Applications/AndroidSDK/tools
Open Terminal and run the following commands (You can copy and paste):
Code:
cd /Applications/AndroidSDK/tools
adb push asroot 2 /data/local
adb shell chmod 0755 /data/local/asroot2
adb shell
/data/local/asroot2 /system/bin/sh
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /system/bin
cat sh > su
chmod 4775 su
exit
exit
At this point, the phone has root access.
Download: http://rapidshare.com/files/303797523/recovery-RA-heroc-v1.2.3.img
Save this file into: /Applications/AndroidSDK/tools
Go back to your terminal and type:
Code:
adb push recovery-RA-heroc-v1.2.3.img /sdcard/
adb shell
su
flash_image recovery /sdcard/recovery-RA-heroc-v1.2.3.img
exit
exit
adb shell reboot recovery
Now, the phone will reboot into recovery mode. To preserve our freshly rooted state, we will make a Nandroid backup.
NANDROID BACKUP
*NOTE: These steps assume that you have already entered Recovery Mode on the phone through Terminal "adb shell reboot recovery" or the "Quick Boot" app.*
On phone: Using the trackball, scroll down and select "Nandroid v2.2 backup". This will create a backup of the phone in its freshly rooted state to your SD card, under the nandroid directory.
After it completes the backup, we want to make sure that we have the backup "backed up" by copying it to our Mac (Just in case anything happens to the SD card!).
Select "USB Mass storage on"
After your SD Card appears, copy the contents of the "nandroid" folder to anywhere you wish on your Mac (You are using Time Machine right?)
Once the copy is complete, eject the sdcard in mac and select "USB Mass storage off" on the phone.
NOTE: Nandroid does not backup the contents of your SD card. If you don't want to lose what's on your SD card, MAKE A BACKUP COPY!
From this point forward, if you do something that seems to really mess with the phones functionality, you can simply go back to your Nandroid backup!
RESTORE NANDROID BACKUPS
Select "Nandroid v2.2 restore" *THIS WILL ERASE EVERYTHING ON YOUR PHONE*
Your phone will be returned to the condition it was in as of the last Nandroid backup. You can control which backup is restored by deleting the unwanted, time-stamped folders within the "nandroid" directory on your SD card. If you leave only one time-stamped backup folder, that is the backup that will be restored.
Note that this will leave the custom Recovery ROM we loaded (recovery-RA-heroc-v1.2.3.img) in place.
I actually perform a Restore after every Backup. While this takes extra time, you know your Backup is intact and not corrupted in any way!
If you are looking for a complete factory reset, you will need to scroll up to "TRUE FACTORY RESET (UN-ROOT)"
PREPARE SD CARD FOR APPS2SD (A2SD)
For those unaware, apps2sd allows you to save internal phone memory by placing after-market applications onto your SD card. Most users notice a speed benefit from this.
Select "Wipe SD: fat32+ext2+swap" *THIS WILL ERASE EVERYTHING ON YOUR SDCARD*
Select "USB Mass storage on"
The mounted drive should now be empty. Double-check that it was partitioned correctly by opening Disk Utility and verifying 3 partitions on the sdcard: NONAME, disk1s2, and disk1s3. Close Disk Utility.
LOAD Unofficial MoDaCo 1.2c Core ROM
Forum Post: Unofficial MoDaCo 1.2
Download: Unofficial MoDaCo 1.2c Core
Save this file into: your SD card. (the root of your SD card, probably named "NONAME" if you didn't change it. You can change it to whatever you want though.)
Save the file as: "update.zip" (Or rename it)
Eject your sdcard and Select "USB Mass storage off"
Select "Apply sdcard:update.zip"
Select "Reboot system now"
If it successfully loaded, you now have a fresh load of the Unofficial MoDaCo 1.2c ROM! Congrats!
I would recommend that you create another Nandroid backup. Scroll back up to "NANDROID BACKUP" and follow the steps over again and come back to this point.
Now you are ready for the workarounds!
Guide: Workaround Issues (Unofficial MoDaCo 1.2c)
Why'd you make another guide?
nice guide man, no need to respond why you made another guide, the more the merry, nicely detailed as well
Shhhhhh.
I was just curious because there are like six...
I made another guide because while many of the forum posts acomplish bits and pieces, my guide provides the overall picture. Root, ROM, and Backup. And my upcoming "Workarond Issues" guide will collect scattered information in a similar fashion.
I find it ironic that I thanked you for your contribution and you find this guide excessive. Would you prefer that I removed the guide?
No not at all. Yours is nice and concise. There's just a lot, that's all. That's why I said it would be nice if a moderator could have merged all the ones that were already written at the end of mine. Didn't mean any harm.
Ah, I see what you mean. To be honest, I am also making this guide for self reference. If most all of the information I need is together its easier to help myself as well as my friends and the community. Thanks again for all your contributions.
Just to raise awareness, Nandroid does NOT back up your apps if you are using AppsToSD as in MoDaCo. You must back up your apps separately.
True, thanks for the heads up. I'll work on a separate guide that details how to backup your other apps. I believe that anything after-market can be backed up and restored through ASTRO though, and this is much easier for most than adb and Terminal commands (push/pull).
The whole 1.56.651.2 Firmware update is also making me wait to post any further guides, as some of my worksarounds may prove useless. It looks like we still have the Apps Renaming and Reverting issue though, and I didn't see the Sprint admin adress such issues specfically.
?
ok i did the update to the hero. and now found out about rooting(im new to all this) do i run that program you put in the beginning with windows? and then does that rom resolve the issue with battery with sms and other things the OTA update fixed? or should i get another rom or .img idk what to call it really and what does RUU stand for?
Alright,
A couple things to add to this guide, for the complete noob, as I can try to explain it a little more clear.
This should be done prior to doing anything within the guide.
First, connect your phone to your computer and mount your sd card. This can be done by connecting the usb cable, then on your phone, drop down the menu and chose, connect to p.c., Mount SD card. Make a folder and backup your entire sd card to this folder. Once done, delete everything off the card. if you don't, you will run into format and partitions errors later in the guide.
Eject the sd card on the computer, and end usb sharing on the phone. remove the USB cable from the computer.
Next, on the phone Go to Settings > Applications > Development>USB Debugging
Make sure that USB debugging is NOT CHECKED. If its checked later in the guide you will run into errors pushing the files onto the phone.
At this point you can start the guide from the beginning, under the main heading Root Hero [MAC]
I am running OSX 10.6.2 so i ran into a couple of issues.
Next. Under the part where you have to create the .bash file. This file should be saved in your user folder.
/Users/USERNAME where USERNAME is the name of your user account.
For instance my User account is Hamspiced so my user folder is:
/Users/Hamspiced/
when saving the file, uncheck "if no extension is provided, use .txt".
Next, I couldn't copy paste the code because it wasn't parsed properly. This is what i had to do.
And this should be a direct copy paste into terminal. If you don't know how to access terminal click the spyglass in the upper right hand of the screen, and type in terminal. then you should be able to directly copy paste this text.
Code:
cd /Applications/AndroidSDK/tools
./adb push asroot2 /data/local
./adb shell chmod 0755 /data/local/asroot2
./adb shell
/data/local/asroot2 /system/bin/sh
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /system/bin
cat sh > su
chmod 4775 su
exit
exit
As stated you should have root access on the phone. you can verify this by downloading Terminal emulator from the Market, then running the app. Once inside the app if you hold Menu, you should bring up the onscreen keyboard. if you type in "su" (stands for super user) it will change the prompt from $ to #. If yours does not change, start over, something went wrong. If it did change then you can proceed to the next part of this guide.
Next the guide is trying to put the recovery Image to your phone. This doesnt restore your phone, it just puts the recovery portion to it, and it allows you to do all the cool things to your phone, like allow you to create backups, restore backups, and load customs roms.
again i ran into issues with parsing the correct format so these are copy pastes from terminal.
Code:
./adb push recovery-RA-heroc-v1.2.3.img /sdcard/
./adb shell
su
flash_image recovery /sdcard/recovery-RA-heroc-v1.2.3.img
exit
exit
adb shell reboot recovery
If you get an access denied error pushing the recovery image, its because you had debugging turned on prior to connecting your phone to the computer. it must be off, then turned on once the phone is connected.
This will result in headaches, and endless google searching with no results.
Follow the rest of the guide regarding the Nandroid backup this backs up the entire phone settings. you want to save the raw phone backup as well as the backup after you load the rom. both are incredibly important!
Prepare SD Card for Apps2sd….
If when you checked Disk Utility and your SD card didnt partition properly follow these steps.
You must erase everything on your sd card for these steps to work. I ran into errors creating the partition. What i had to do was in the recovery mode chose factory recovery. when the phone restarted i had to go to Settings>Security>Factory Data Reset.
This restored EVERYTHING. THe phone, Sd Card, Etc. Everything was lost, however since in the begining, we made a backup of the SD card, and then we made a backup of our phone, we are fine.
Restart the phone in recovery mode once this finishes and restarts. (Hold Home and Power to turn on)
Next chose Part SD: fat32+ext2+swap this will partition the card properly. Then choose restart phone.
Once the phone restarts, we have to go through the normal steps that we did once we first received the phone for its first bootup. connect it to the computer, transfer over the Nandroid backup that should be saved from the first time you saved it on your phone. then restart the phone again in recovery mode.
Now you need to restore the nandroid backup. since you transferred it over, its the only nandroid backup there is, it will restore the phones origional settings. from here you can load the official MoDaCO rom fine on the SD card that is now formatted properly.
These are about all the issues and resolutions i ran into. Hopefully it helps someone else.
Guess it's subjective. I think I haven't turned off USB Debugging since shortly after I got the phone and didn't run into any problems. It's always on before I plug it in and I haven't ran into any errors while pushing a file to my sd card. Also didn't erase my sd card before I formatted (did back it up though of course) and everything went smooth. Dunno. It's always good to hear from diff people though. Also just edited my thread, thanks for the heads up.
need help rooting htc hero from sprint
i have 1.5 firmware bb version is 1.04.01.09.21 kernel version 2.6.27-533ce29dhtc [email protected] build number1.56.651.2 cl85027software 1.56 cant get root on this device can someone please help me
quis5550 said:
i have 1.5 firmware bb version is 1.04.01.09.21 kernel version 2.6.27-533ce29dhtc [email protected] build number1.56.651.2 cl85027software 1.56 cant get root on this device can someone please help me
Click to expand...
Click to collapse
Try here
http://forum.xda-developers.com/showthread.php?t=581686&highlight=root+mac
First, excellent guide! Personally, I used Universal Androot (snipurl.com/uaroot) to root my Hero, but this was a huge help in getting the SDK installed!
I'm running into a problem while trying to do the Nandroid backup. When I try to flash the recovery image, I get the following error message....
AJBlue98$ ./adb shell
$ cd /sdcard/
$ su
# flash_image recovery recovery-RA-herocv1.6.2.img
flash_image: not found
Click to expand...
Click to collapse
I even try the command with the leading "./" and I get essentially the same thing...
# ./flash_image recovery recovery-RA-herocv1.6.2.img
./flash_image: not found
Click to expand...
Click to collapse
I'm running the latest official Sprint 2.1 ROM on my Hero and Terminal on Mac OS X Snow Leopard 10.6.4 on a late-2009, 17 in. MacBook Pro. Oh, and I installed the Android SDK into another directory (had it installed before I found this tutorial), so here's my $PATH...
-bash: type: /opt/local/bin:/opt/local/sbin:/Users/AJBlue98/soylatte/bin:/Users/AJBlue98/android-sdk-mac_86:/opt/local/bin:/opt/local/sbin:/opt/local/bin:/opt/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/texbin:/usr/X11/bin: not found
Click to expand...
Click to collapse
Am I missing something? I'll really appreciate the help!
—Adam
ajblue98 said:
First, excellent guide! Personally, I used Universal Androot (snipurl.com/uaroot) to root my Hero, but this was a huge help in getting the SDK installed!
I'm running into a problem while trying to do the Nandroid backup. When I try to flash the recovery image, I get the following error message....
I even try the command with the leading "./" and I get essentially the same thing...
I'm running the latest official Sprint 2.1 ROM on my Hero and Terminal on Mac OS X Snow Leopard 10.6.4 on a late-2009, 17 in. MacBook Pro. Oh, and I installed the Android SDK into another directory (had it installed before I found this tutorial), so here's my $PATH...
Am I missing something? I'll really appreciate the help!
—Adam
Click to expand...
Click to collapse
yeah, you're missing the "flash_image" binary on your phone lol search xda for it and push it to /system/bin, then try the command again.
regaw_leinad said:
yeah, you're missing the "flash_image" binary on your phone lol search xda for it and push it to /system/bin, then try the command again.
Click to expand...
Click to collapse
Thanks, regaw_leinad, for the lead! I found a copy of the flash_image file and copied it to my Android SDK folder, but when I try to push it to my phone, I get this:
AJBlue98$ ./adb push flash_image /system/bin
failed to copy 'flash_image' to '/system/bin/flash_image': Permission denied
failed to copy 'flash_image' to '/system/bin/flash_image': Read-only file system
Click to expand...
Click to collapse
(I rebooted the phone and tried again after my original post. The error message changed. BTW I'm connected via USB with debugging turned on and "Charge only" selected as my connection type.)
I've tried running adb as root, but I get this:
AJBlue98$ ./adb root
adbd cannot run as root in production builds
Click to expand...
Click to collapse
Again, any help will be greatly appreciated!
—AJBlue98
ajblue98 said:
Thanks, regaw_leinad, for the lead! I found a copy of the flash_image file and copied it to my Android SDK folder, but when I try to push it to my phone, I get this:
(I rebooted the phone and tried again after my original post. The error message changed. BTW I'm connected via USB with debugging turned on and "Charge only" selected as my connection type.)
I've tried running adb as root, but I get this:
Again, any help will be greatly appreciated!
—AJBlue98
Click to expand...
Click to collapse
ok type
adb shell
then
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
to mount it as r/w
then try the flash image command again.
Adb root or adb remount won't work, because your boot.img isn't patched yet.
regaw_leinad said:
ok type
adb shell
then
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
to mount it as r/w
then try the flash image command again.
Adb root or adb remount won't work, because your boot.img isn't patched yet.
Click to expand...
Click to collapse
Okay, I did that. I'm still charge-only and debugging turned on, and here's what happened.
(N.B.: I'm on a Mac, so I have to include "./" before running an application in the current directory. Also, I'm including "AJBlue98" in front of my "$" prompts to differentiate my Mac's local prompts from the adb shell prompts.)
AJBlue98$ ./adb shell
$ mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
mount: Operation not permitted
Click to expand...
Click to collapse
So I tried these few things...
$ su
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
# cd /sdcard/
# mv flash_image /system/bin
failed on 'flash_image' - Cross-device link
# exit
$ exit
AJBlue98$ ./adb shell su mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
Permission denied
AJBlue98$ ./adb push flash_image /system/bin
failed to copy 'flash_image' to '/system/bin/flash_image': Permission denied
Click to expand...
Click to collapse
Now I'm completely flummoxed. As always, please help and thanks in advance!
Update: I got frisky, so I tried this, just for the heck of it...
AJBlue98$ ./adb shell
$ su
# cd /sdcard
# ./flash_image recovery /sdcard/recovery-RA-heroc_v1.2.3.img
./flash_image: permission denied
# chmod 755 ./flash_image
# ./flash_image recovery /sdcard/recovery-RA-heroc_v1.2.3.img
./flash_image: permission denied
# su ./flash_image recovery /sdcard/recovery-RA-heroc_v1.2.3.img
Permission denied
Click to expand...
Click to collapse
Update 2:
I got some help at irc.twit.tv from a good soul in the #twitlive channel, who pointed me to ROM Manager (downloadable from the Market). That just did the whole backup, hey-presto, no flash_image BS required.
Thanks for the help anyway, all!
ajblue98 said:
Okay, I did that. I'm still charge-only and debugging turned on, and here's what happened.
(N.B.: I'm on a Mac, so I have to include "./" before running an application in the current directory. Also, I'm including "AJBlue98" in front of my "$" prompts to differentiate my Mac's local prompts from the adb shell prompts.)
So I tried these few things...
Now I'm completely flummoxed. As always, please help and thanks in advance!
Update: I got frisky, so I tried this, just for the heck of it...
Update 2:
I got some help at irc.twit.tv from a good soul in the #twitlive channel, who pointed me to ROM Manager (downloadable from the Market). That just did the whole backup, hey-presto, no flash_image BS required.
Thanks for the help anyway, all!
Click to expand...
Click to collapse
sweet, glad you got it worked out
there were a few errors in what you did above, but looks like you got everything working without it, so that's good
*******UPDATED 8/31/10 *******
This rooting method was adapted from regaw_leinad's method and toastcfh's method. By following these steps you will successfully downgrade your phone back to android 2.1 in order to gain root.
I don't trust unrevoked as I have had problems with it in the past.
I am not responsible for any damages to your phone.
special thanks to:
regaw_leinad
Sebastian Krahmer
Toastcfh
amon_ra
FILES YOU WILL NEED:
copy and paste into browser
Code:
sdx-downloads.com/sdx/evo/troot/eng-PC36IMG.zip
evo4g.me/downloads//count.php?target=evo-root.zip
files.androidspin.com/downloads.php?dir=amon_ra/RECOVERY/&file=recovery-RA-evo-v1.8.0.img
developer.android.com/sdk/index.html
You will need the Android SDK in order to communicate between your computer and your phone. Download it (last link above) and follow the setup instructions that it comes with.
Unzip the contents of the evo-root.zip and put all the files from it into the tools folder located in the android sdk folder.
Rename the eng-PC36IMG.zip to PC36IMG.zip and then put it the tools folder located in the android sdk folder. DO NOT UNZIP IT!
******* PC36IMG.zip md5sum~ fe8aba99893c766b8c4fd0a2734e4738 *******
Move the recovery-RA-evo-v1.8.0.img into the android sdk folder as well.
Make sure usb debugging is enabled on your device. To do so go to Settings > Applications > Development > and make sure the check box is checked.
Plug your phone into the computer. Select "Charge Only" from the notifications bar.
Open up terminal and navigate your way into the android sdk folder.
Code:
cd /
cd asdk
Push all the files onto your phone.
Code:
tools/adb push /asdk/tools/flash_image /sdcard/
tools/adb push /asdk/tools/rageagainstthecage-arm5.bin /data/local/tmp/
tools/adb push /asdk/tools/mtd-eng.img /sdcard/
tools/adb push /asdk/tools/PC36IMG.zip /sdcard/
tools/adb push /asdk/tools/recovery-RA-evo-v1.8.0.img /sdcard/
Note that the PC36IMG.zip will take longer than the other files to transfer to the sdcard because it is a large file.
Now we will make rageagainstthecage.bin executable.
Code:
tools/adb shell
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
You should see this (below) after it has made the change.
Code:
$
Now to use the rooted shell.
Code:
cd /data/local/tmp
./rageagainstthecage-arm5.bin
You will now see some text on your terminal screen describing the exploit.
Wait for the adb shell to finish the process. At this point it may or may not terminate the current shell session in terminal. If it does then it should look like this:
Code:
users-iMac:asdk user$
If it doesn't it will return to
Code:
$
in that case you need to exit the current session. To do so type
Code:
exit
Now we need initiate a new shell which should now have root permissions.
Enter the following:
Code:
tools/adb shell
and you will see you now have a
Code:
#
instead of
Code:
$
Now we need to flash the mdt-eng.img in order for it to let us install a custom recovery
Code:
adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/mtd-eng.img
That will flash your misc partition with Toast's mtd-eng.img
This should return you to
Code:
#
Now boot into hBoot
Code:
reboot bootloader
This will reboot your phone into hBoot. It will scan for the PC36IMG.img. When it asks yes or no, select yes.
It should then reflash your phone into the engineering build.
When it asks to reboot select yes.
You will need to flash custom recovery in order to be able to flash other custom roms or modifications. I use Amon_RA's recovery because it works great and has NEVER caused me any problems.
Now, open up terminal and get back into the android sdk folder
Code:
cd /
cd asdk
Since we have already pushed the recovery onto the sdcard we only need to flash the recovery onto the phone so that we can use it
Code:
adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery-RA-evo-v1.8.0.img
Now lets rename that PC36IMG.zip file again
Code:
mv /sdcard/PC36IMG.zip /sdcard/eng-PC36IMG.zip
that way your phone doesn't try to flash it when you go into recovery each time
And last but not least we need to boot into it to flash a custom rom
Code:
reboot recovery
Your phone should then reboot into Amon_RA's recovery and you may now head over to the dev forum to find your new favorite custom rom.
very nice! can anyone confirm this? my buddy wants me to root his 2.2 and i would like to try this.
To make life easier for some people add this to your post mate, and apply it yourself if you would like.
Here is how to add your sdk/tools directory to your .bash_profile file so you won't have to navigate to the folder each time.
Download this so you'll be able to see your hidden files http://www.mediafire.com/?diimft1ninn Run it, check "Show Hidden Files" then click Restart finder. Now, navigate to your home folder (/Users/UserName/) and see if there's a .bash_profile already there. If not, create with textedit.
Now add this to the file: export PATH=${PATH}:/Path/Of/Your/Sdk/Tools/Folder
Mine is /Users/bmxrider4444/Documents/Android/SDK/tools
Now do not save it as rich text. If yours is in rich text, click on "Format" in the menu bar, and click "make plain text". Now save it as .bash_profile and uncheck "if no extension is provided, use .txt".
Now you can go back to Ghost and uncheck "Show all hidden files" and restart finder again (special thanks to ajones7279 for these steps)
Enjoy!
Just as clarification as to what this does, it enables you to run adb commands and other commands without having to navigate to the /android/tools/ folder every time you want to run adb or whatever.
does this work?
seekis said:
At this point we need to push the recovery onto the sdcard
Code:
tools/adb push "location of recovery-RA-evo-v1.8.0.img" /sdcard/
Click to expand...
Click to collapse
This is great! Thanks for the guide - I am planning on rooting my Wife's EVO but have been waiting for an easier method than the other one posted. Question on the above where we write "location of recovery-ra-evo-v1.8.0.img". Is that the exact code, or should we be adding a directory or folder location into this line? I rooted my 2.1 EVO on my Mac a couple months ago and don't remember this step. Once again - very much appreciate the help.
One last question - would it make more sense to have a custom ROM already on your SD Card prior to rooting, so that you can flash it right after you flash AMON-RA for the first time? Probably doesn't matter but thought i'd ask.
^^ same question as above, plus one other n00b question - does this method unlock NAND?
[edit] I was not insinuating that randymac88 is a n00b; I, however, am
seekis said:
I don't trust unrevoked as I have had problems with it in the past.
I am not responsible for any damages to your phone.
Click to expand...
Click to collapse
Don't trust us with the unrevoked 3.x/unrevoked forever application combo that's worked for thousands of users without sideeffects on regaw's post?
You should note to everyone that your method will screw up their PRI, reverting it back to 1.34. By using unrevoked and unrevoked forever, you can keep 1.40.
randymac88 said:
This is great! Thanks for the guide - I am planning on rooting my Wife's EVO but have been waiting for an easier method than the other one posted. Question on the above where we write "location of recovery-ra-evo-v1.8.0.img". Is that the exact code, or should we be adding a directory or folder location into this line? I rooted my 2.1 EVO on my Mac a couple months ago and don't remember this step. Once again - very much appreciate the help.
One last question - would it make more sense to have a custom ROM already on your SD Card prior to rooting, so that you can flash it right after you flash AMON-RA for the first time? Probably doesn't matter but thought i'd ask.
Click to expand...
Click to collapse
Thats not the exact code no. I just put that as a place holder you are suppose to put in the location of where you have the recovery.img. For example, the exact command for me would be:
Code:
/Users/seekis/Downloads/recovery-ra-evo-v1.8.0.img
Don't trust us with the unrevoked 3.x/unrevoked forever application combo that's worked for thousands of users without sideeffects on regaw's post?
You should note to everyone that your method will screw up their PRI, reverting it back to 1.34. By using unrevoked and unrevoked forever, you can keep 1.40.
Click to expand...
Click to collapse
As far as using unrevoked, I stated that I, ME, MYSELF, has had issues with it. not that anybody else has. By all means go and use it if you would like. I will not. It is true that you will loose PRI 1.40, but seeing as how even after installing the OTA from HTC my phone still didn't update it to 1.40, I don't see the issue.
rsage said:
^^ same question as above, plus one other n00b question - does this method unlock NAND?
[edit] I was not insinuating that randymac88 is a n00b; I, however, am
Click to expand...
Click to collapse
i believe it does unlock nand seeing as how i adapted it from toasts method
Hey Seekis - question, I'm stuck here. I keep getting "permission denied", or "operation not permitted" when trying to make the exploit executable at this step:
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
Am I missing something? I've tried a million times and can't seem to get past this. I've successfully pushed all the files onto the sdcard.
I've also have had some trouble finding the exact root path to these files. I've been able to navigate, but I would think a lot of users would have some trouble.
Regardless, many thanks for getting this posted...
EDIT: I pushed the rageagainstthecage file to the sdcard by mistake. Will try again tomorrow.
ok i got rid of that step by moving the file into the android sdk and pushing it with all the other files
Okay now I appear to be in big trouble as I've just messed up my wife's phone, and its probably going to be unusable for a while until I get this figured out (assuming I do!).
I got through most of the process. I flashed the PC36IMG.zip file; however when it asked to reboot, it just dumped me back into the bootloader. Whenever I say reboot, it just takes me back to the bootloader. Pull the battery, same thing - bootloader. Yikes.
I don't know how to get to the next step because I can't get into a booted rom in order to flash the amon-ra recovery. Am I totally effed? Can anyone help me here?
EDIT: Okay reflashed the PC36IMG.zip file, and it rebooted into the stock ROM. Onward! Phew!!
The wife's EVO is now fully rooted running Baked Snack 1.5 w/Netarchy's kernel. Touch and go there for a minute, but it all worked out. No 1.40 PRI, but I don't really care about that right now.
Woot! Thanks Seekis!!
do u have to push the pc36img with adb every time or will drag and drop work or copy and paste work?
FoxHound630 said:
do u have to push the pc36img with adb every time or will drag and drop work or copy and paste work?
Click to expand...
Click to collapse
You can mount the card on your system and copy paste it over as well, yes.
randymac88 said:
Okay now I appear to be in big trouble as I've just messed up my wife's phone, and its probably going to be unusable for a while until I get this figured out (assuming I do!).
I got through most of the process. I flashed the PC36IMG.zip file; however when it asked to reboot, it just dumped me back into the bootloader. Whenever I say reboot, it just takes me back to the bootloader. Pull the battery, same thing - bootloader. Yikes.
I don't know how to get to the next step because I can't get into a booted rom in order to flash the amon-ra recovery. Am I totally effed? Can anyone help me here?
EDIT: Okay reflashed the PC36IMG.zip file, and it rebooted into the stock ROM. Onward! Phew!!
Click to expand...
Click to collapse
Had the same issue. When i first booked into the bootloader i had to select recovery then flash PC36IMG.zip. Then boot loop. Then i went back into the bootloader and it automagically read in the PC36IMG.zip and flashed it, then i got stock 2.1 root. Just a few minutes of "oh crap"
I'm stuck. I got as far as flashing PC36IMG.zip, which was successful, as my phone now runs 2.1, but it doesn't appear I'm rooted. When I go back into the adb shell, I'm getting the $ prompt, and running
Code:
cat /sdcard/flash_image > /data/flash_image
gives me a permission denied error. Help!
atom_jack said:
I'm stuck. I got as far as flashing PC36IMG.zip, which was successful, as my phone now runs 2.1, but it doesn't appear I'm rooted. When I go back into the adb shell, I'm getting the $ prompt, and running
Code:
cat /sdcard/flash_image > /data/flash_image
gives me a permission denied error. Help!
Click to expand...
Click to collapse
i dont know what to tell you other than try again. this happened to me the first time through as well. i dont know why. i just started from the top and it worked the second time through.
seekis said:
i dont know what to tell you other than try again.
Click to expand...
Click to collapse
So after you flash PC36IMG.zip you should automatically get a root (#) prompt when going into the shell? ie, I'll have rooted 2.1 yes?
seekis said:
this happened to me the first time through as well. i dont know why. i just started from the top and it worked the second time through.
Click to expand...
Click to collapse
Aha. Ok, I will keep trying til it gives me a root shell, I guess. I also tried unrevoked3 but that didn't seem to work.
Success!! So, I stupidly assumed that all PC36IMG.zip's were the same, and was using the one from the original 2.2 PC thread. Once I got the correct one, voila!
You might want to post the md5 of the one you are using, so there's no confusion for others. Also, you missed a tiny step when you first start up hboot - you have to select fastboot for it to start scanning for PC36IMG.zip.
Thanks!
This method we will use nandroid's recovery option in ClockworkMod
Requirements:
Rooted myTouch 3G 1.2 with USB Debugging
ClockworkMod Recovery Installed (can be install from ROM Manager)
Universal Androot apk saved to your AndroidSDK tools folder
(I will be doing this in adb)
Create the recovery folders
Code:
mkdir /sdcard/clockworkmod
mkdir /sdcard/clockworkmod/backup
mkdir /sdcard/clockworkmod/backup/Stock
Mount the SD card so you can access it on your computer.
Now extract SAPPIMG_Sapphire_T-Mobile_US_2.10.531.4_release_signed.zip (from shipped-roms) [FYI: I had to use 7zip for this] into clockworkmod/backup/Stock.
Now we are down with that unmount it and return to adb.
Once your phone has remounted the SD card do:
Code:
cd /sdcard/clockworkmod/backup/stock
md5sum * > nandroid.md5
cd ../../../
cat /system/bin/flash_image > flash_image
(If you do not have flash_image post here in this thread and I will pm you a link to it)
Reboot the phone and boot into recovery mode (hold home when powering on)
Once in there
**DO A FULL WIPE**
then restore the "Stock" backup from the restore menu,
It should get past boot and system then fail on /data THIS IS NORMAL
It is not safe to reboot your phone
Set up your phone and all that good stuff, then re-enable adb debugging.
in a command prompt cd to your androidsdk/tools folder and run
Code:
adb install UniversialAndroot.apk
and reroot your phone (bare with me)
once that is done do
Code:
adb shell
su
be sure to click allow on the Superuser Permission pop up that shows up on the phone
Code:
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /system/app
rm Superuser.apk
cd ..
cat /sdcard/flash_image > flash_image
chmod 0700 flash_image
./flash_image recovery /sdcard/clockworkmod/backup/Stock/recovery.img
rm flash_image
mount -o ro,remount -t yaffs2 /dev/block/mtdblock3 /system
exit
unroot your phone via universal androot and uninstall it via the applications menu
reboot and done!
I have done this a couple times and every time it worked like a charm.
Hey there, I get to inputting the md5 command, but I get cannot create nandroid.md5: permission denied
What am I doing wrong?
Using a SAPPIMG.zip is not at all unsafe and is faster and easier.
Well, I have been trying to use the sappimg.zip from unlockr's guide and on the t-mobile dev forums, but yet all of them end up giving me a Main version is older! error.
I cant seem to find the solution.
I've had the same problem. I have made the gold card a million times (worked rooting the phone) and now it tells me the older error. Thought it would be easier reverting back, guess that's not true.
Anyways, can I get the flash_image file?
getting past the "older version" error
what i did to get past the "older version" error, was this:
step1: re-use gold card and the 1.5 version sappimg.zip from unlockr.com
step2: reboot using the original sappimg for t-mobile (i wont link from the post but i found it on XDA aka use search)
this will reload EVERYTHING as stock MT3g1.2 including original splash, and recovery images.
if you want to revert it to stock, try this: http://forum.xda-developers.com/showthread.php?t=641174, it may help
The safer way is to NOT BOTHER.
The update schedule is to run from today through the 25th inclusive. That's 11 days. The average length of time that any particular user will have to wait is therefore 5.5 days. Chances are that the update will be posted by tonight or tomorrow (latest), and 10 minutes later, it will be fixed so that it doesn't rob you of root (keep your options open!).
So... you save about 5 days of waiting (average) and end up with your options wide open. OR, you can commit to the average and end up locked out, possibly forever.
I like the way you think...
Sent from my T-Mobile myTouch 3G using XDA App
Need eng spl
bartcrusades said:
well, i have been trying to use the sappimg.zip from unlockr's guide and on the t-mobile dev forums, but yet all of them end up giving me a main version is older! Error.
I cant seem to find the solution.
Click to expand...
Click to collapse
just got through doing the same thing tried goldcard method and still got main version older....then i got it right...flash eng spl i beleive it was 0010 then do the sappimg.zip it works and when you finish the update your 0013 spl is back...then used universal androot installed superuser then installed rom manager and made backup of stock then put my phone back the way it was hopefully when the update comes out and i do think it will be a long time before it does i can restore backup of stock unroot with universal androot and uninstall superuser. At least thats the plan. If you want to do this look for kennys posts in the sappimg thread his directions are what i used.
That is the correct way to do it. Eng spl then tmo stock image. When done its back to completely stock.
Sent from my T-Mobile myTouch 3G using XDA App
hey i do not have flash_image can u post up a link? thanks.
I understand there are other threads about this however I do feel my situation is either unique or I've missed something in the other threads.
I've got an HTC Merge through US Cellular. I upgraded to Gingerbread 2.3.4 as soon as it was released through USC's website. Now I'd like to root and all that other stuff.
1.: I didn't S-off before the update. Does anyone know how to properly S-off 2.3.4 Gingerbread on a USC HTC Merge?
2.: I've never rooted a phone before, but I'm pretty sure I've read about it plenty and I'm ready to give it a shot. What's the best way to do this on my current phone?
3.: What are some good modded ROMs available for this device, if any exist at all? I've been interesting in Cyanogen Mod but as far as I've seen it's not supported on the Merge yet.
If anyone can assist me I'd appreciate it greatly. Thanks in advance. =)
if you have adb set up and working,and have some knowledge of it,you can use drellisdees directions in this post,along with the new zergRush temp root tool from alpharev/unrevoked. donate to them both if it works for you.
download the zergRush tool from this post:http://forum.xda-developers.com/showthread.php?t=1296916 and place the file thats inside the .zip into the same folder as your other exploits(tools or platform-tools in ost cases)
below is his post,modified slightly,with the zergRush directions(bold) in place of the originaly froyo directions.
i also removed the parts about downloading your carriers RUU,and backing up your system for vzw since you said you were USC.
assuming you want to remain on rooted GB,just use the same RUU that you used to upgrade at the end where it says to run your carriers RUU.
drellisdee said:
Well, ask and you shall receive!!!
I got s-off on vzw merge. However, altell or USC ones it will require supercid or a goldcard to flash ruu from another carrier.
Tested and working CWM recovery I made for merge and latest radio hboot zips after s-off.
You must verify all Md5sums after downloading to computer (don't even think about downloading on phone) before flashing or risk a brick!!!!! Windows users can get one here & linux users can just type md5sum (name of file) into terminal.
Md5's
8cd1ca796e755b6b72f35e5686dc973a PD42IMG_cw_recovery_gnm.zip
97e35ecc802081b67e27d6cc8323cf81 PD42IMG_radio_1.08.00.320.zip
cc2e7c077fddd017d7b0db614661c535 PD42IMG_1.49.605.1_no_system.zip
4fe37c64b21d1d4542a801779fad5c57 misc-downgrade.img
6d37a0f3526295ebb779f4465a328c96 rom.zip (leaked 1.23.605.1)
http://www.mediafire.com/file/6b2jatt0445h41g/PD42IMG_cw_recovery_gnm.zip
http://www.mediafire.com/file/gbayon7dkmaq98i/PD42IMG_radio_1.08.00.320.zip
I am exploring a goldcard method that will allow flashing of the vzw ruu 1.23.605.1 that can be s-off'ed to allow other carriers merge's to be able to downgrade to s-off.
How to on s-off will be coming soon .... stay posted
Ok how to guide for s-off.
Files needed:
MISCIMG Downgrade http://www.mediafire.com/file/f7c3boee7ixa3i9/misc-downgrade.img
VZW leak 1.23.605.1 ruu.zip http://forum.xda-developers.com/showpost.php?p=8237592&postcount=2
Exploits http://www.mediafire.com/file/e9w92clv6l71el3/exp.zip
HEADS UP: This guide will reflash your phone and cause loss of all non-backed up data
Goldcard is required for ALL NON-VZW phones
Read how to make one here : http://www.mikesouthby.co.uk/2010/0...yo-official-ota-for-network-branded-handsets/
I used the app goldcard helper from market and if you use it skip right to the step of "Go to this page and enter this new number into the SD Card Serial (CID) field" and enter the output of the sdcard cid for mmc2 into the goldcard generator site.
After goldcard is made via directions in link above or if on vzw branded device you can skip the goldcard part. Next rename the vzw leak ruu.zip to PD42IMG.zip and place it on root of sdcard.
Next from dir you downloaded stuff to unzip the exp.zip and copy the exp folder to your android sdk platform-tools dir (if using windows) linux users should have adb in path so this shouldn't be needed just open terminal from download dir. Make sure the phone is in usb mode charge-only from this point on with usb-debugging turned on (settings/applications/development).
Code:
[B]adb push zergRush /data/local/
adb shell[/B] [I]this will change your promt to a $[/I]
[B]chmod 755 /data/local/zergRush
/data/local/zergRush[/B]
Next we backup our existing misc partition.
Code:
adb shell
dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
/data/local/busybox md5sum /sdcard/misc-stock.img
/data/local/busybox md5sum /dev/block/mmcblk0p17
Make sure the md5sum of the misc-stock.img matches the one from /dev/block/mmcblk0p17
Next we use temp root to flash a misc.img that I hex edited to allow downgrading FW. misc-downgrade.img needs to be in platform-tools dir for windows users.
Code:
adb push misc-downgrade.img /sdcard/
adb shell
dd if=/sdcard/misc-downgrade.img of=/dev/block/mmcblk0p17
sync
Next power off your phone and boot it holding vol_dn + power.
Let the PD42IMG.zip complete ( will do hboot + radio then self reboot and restart to finish the rest)
Once rebooted into the 1.23.605.1 firmware
Code:
adb push exp /data/local
adb shell
chmod 0755 /data/local/psneuter
chmod 0755 /data/local/wpthis
chmod 0755 /data/local/gfree
/data/local/psneuter (to get temp root again)
adb shell
/data/local/wpthis (to disable emmc write protect)
/data/local/gfree -f (this will supercid, simunlock, and s-off phone)
rm /sdcard/PD42IMG.zip (remove/delete the leaked FW so hboot wont load it again)
Reboot into bootloader and verify you have s-off
If so reboot into android and use your carrier's RUU to replace your FW. You will not lose s-off. If on vzw unzip the PD42IMG_1.49.605.1_no_system.zip and add your system.img from your memory card we dumped earlier to the zip. Rezip and rename to PD42IMG.zip and place on root of sdcard and reboot into hboot to flash it just like we did earlier. This will restore the shipped 1.49.605.1 hboot, radio, boot.img, stock recovery.img, and system.img.
After you have upgraded backup you can use the clockwork recovery.img I made and rename it to PD42IMG.zip (make sure to delete the old PD42IMG.zip on your sdcard) and place it on root of sdcard and flash via hboot just like the other PD42IMG.zip's. Then you will have s-off and a custom recovery. Remember to remove/rename/move the PD42IMG.zips when done as they will flash if you enter hboot. Recovery can be entered via bootloader by picking recovery or via "adb reboot recovery".
Flashing this zip via clockwork recovery will install root (su & superuser.apk), busybox & symlink applets, flash & dump image. signed_merge_su_eng_toolkit.zip
After you have root on your release firmware:
The following commands will restore your stock misc.img
from a root # shell: (will need to type su after adb shell and accept superuser pop-up)
Code:
adb shell
dd if=/sdcard/misc-stock.img of=/dev/block/mmcblk0p17
sync
Special thanks to Scotty2 & Tmzt who wrote and developed the wpthis & gfree exploits for the G2 without these s-off for lexikon wouldn't have been possible for me.
My donation link is below if anyone wants to toss me a donation. Took me about a week to port RA recovery to merge only to fail as it had issues then to setup the board files for lexikon for cm7 to do a clockwork recovery and not to mention dumping partitons and working on the s-off stuff and goldcard.
Click to expand...
Click to collapse
I got as far as the /data/local/zergRush and got this error:
[-] Cannot copy boomsh. : Permission denied.
adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush
Any ideas?
Thanks
kclive said:
I got as far as the /data/local/zergRush and got this error:
[-] Cannot copy boomsh. : Permission denied.
adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush
Any ideas?
Thanks
Click to expand...
Click to collapse
that error comes from running zergrush twice. http://androidforums.com/merge-all-...simunlock-supercid-htc-merge.html#post3522248
pls how can i run this commands with miniadb, i dont hav access to the whole android sdk tool...and besides, the zergrush binary link above aint workin..any other alternative dload link pls??
akins47 said:
pls how can i run this commands with miniadb, i dont hav access to the whole android sdk tool...and besides, the zergrush binary link above aint workin..any other alternative dload link pls??
Click to expand...
Click to collapse
zergrush is broken with newer builds. fre3vo worked for some. i would recomend you htcdev unlock in order to gain root access for downgrade.
follow directions here to htcdev unlock:
http://androidforums.com/merge-all-things-root/635459-unlock-htcdev.html
then follow directions here:
http://androidforums.com/merge-all-things-root/434029-root-s-off-simunlock-supercid-htc-merge.html
using the "htcdev" step 5 in post#2