[HOW-TO] downgrade HBOOT 0.93 to 0.80 again - Desire Android Development

After my new Desire updated by OTA to 2.2, my HBoot upgraded to 0.93.001
As a result, I am no longer to root it again or flashing any cooked rom.... It is such a nightmare for me. So I decided went to HTC service center and asking for a factory restore to Android 2.1, unfortunately the guy stated that due to my personal's fault - to hack the bootloader, there is no way to downgrade the software anymore. I need to pay extra money for a circuit board replacement. I am so angry with the replied, my phone actaully working fine with OTA 2.2 version (it is official release for Taiwan), all I want to do is requested for downgrade to official 2.1, why I need to replace a circuit board????
Anyway after a few hours, I figure out a solution and now working fine with Hboot 0.8 and then re-flashed to customized cooked FroYo rom
Here is the steps: (be careful, I am not responisable for any demage due to these procedures, also you need to have basic knowledge on using Android adb tools)
0.) Download this good program: http://evo4g.me/downloads/evo-root.zip (Credit goes to djR3Z)
Download this file to "PB99IMG.zip" http://shipped-roms.com/shipped/Bra...8U_4.06.00.02_2_release_126984_signed_txt.zip
1.) Make a NEW Goldcard (best using FAT32 format micro SD 4GB or 2GB)
http://www.klutsh.com/dlfiles/GoldCardTool-0.0.5.rar
2.) Find your CID ==> e.g HTC__622 (someone said all 11111111 also worked, but if you can query, why not to input your own?)
fastboot oem boot <--- run this command, will show your own CID
3.) http://ks33673.kimsufi.com/misc/
and Create your own "mtd0.img"
>adb push flash_image /data/local/
>adb push rageagainstthecage-arm5.bin /data/local/tmp/
>adb push mtd0.img /sdcard/
>adb push PB99IMG.zip /sdcard/
>adb shell
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
chmod 0755 /data/local/flash_image
cd /data/local/tmp
./rageagainstthecage-arm5.bin
If you see:
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3319, 3319}
[*] Searching for adb ...
[+] Found adb as PID 74
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] [email protected] so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$
> adb shell
# <---- you will see this good prompt
cd /data/local
./flash_image misc /sdcard/mtd0.img <---- make sure your connected to PC not in Disk drive mode
5.Shutdown your device
6.Hold volume DOWN and press power button
7.Wait until PB99IMG.ZIP was found and verfied. If that fails, check if you named the file the right way and it’s located in the root of your SD.
8.Press volume UP to start the update.
9.Wait until all steps are done. DON’T POWER OFF YOUR DEVICE!
10.After the downgrade progress has finished press volume UP to reboot.
Now you back to 2.1 with HBoot 0.80
(Please remember to delete the file PB99IMG.zip from your SDcard / folder)
If you want root again:
Navigate to http://www.unrevoked.com for rooted as usual

Interesting, a root exploit for froyo has been found? Though any downgrade of hboot is unnecessary. The rooting allows you to fix the misc partition which will let you flash any RUU you want.

My Desire show : Main Version is older! Update Fail!

setupspeed said:
My Desire show : Main Version is older! Update Fail!
Click to expand...
Click to collapse
what is the issue?
tell me what steps being failed...

hkfriends said:
what is the issue?
tell me what steps being failed...
Click to expand...
Click to collapse
read PB99IMG.ZIP finish , then checking PB99IMG.ZIP => fail

setupspeed said:
read PB99IMG.ZIP finish , then checking PB99IMG.ZIP => fail
Click to expand...
Click to collapse
Have u flashed Mtd0.img ok?

hkfriends said:
Have u flashed Mtd0.img ok?
Click to expand...
Click to collapse
Mtd0.img ok , pursuant step => still fail

better add some screenshoot bro

I have got hboot 0.93 with vodafone froyo and an amoled-display (no slcd).
Do the method of
android-tutorials.org/dev/?page_id=78
work (sorry, can't post the hole link because I an new registered, add www)?
Or do I have to use the method from post #1 in this thread?

cordezz said:
I have got hboot 0.93 with vodafone froyo and an amoled-display (no slcd).
Do the method of
android-tutorials.org/dev/?page_id=78
work (sorry, can't post the hole link because I an new registered, add www)?
Or do I have to use the method from post #1 in this thread?
Click to expand...
Click to collapse
Try teppic74's tool, i think it will be more easy and the same as mine too!
http://forum.xda-developers.com/showthread.php?t=768256

C:\adb>adb push flash_image /data/local/
adb server is out of date. killing...
* daemon started successfully *
774 KB/s (26172 bytes in 0.033s)
C:\adb>adb push rageagainstthecage-arm5.bin /data/local/tmp/
478 KB/s (5392 bytes in 0.011s)
C:\adb>adb push mtd0.img /sdcard/
1807 KB/s (655360 bytes in 0.354s)
C:\adb>adb push PB99IMG.zip /sdcard/
1550 KB/s (144169877 bytes in 90.807s)
C:\adb>adb shell
$ chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
$ chmod 0755 /data/local/flash_image
chmod 0755 /data/local/flash_image
$ cd /data/local/tmp
cd /data/local/tmp
$ ./rageagainstthecage-arm5.bin
./rageagainstthecage-arm5.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3319, 3319}
[*] Searching for adb ...
[+] Found adb as PID 671
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] [email protected] so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$
C:\adb>adb shell
adb server is out of date. killing...
* daemon started successfully *
# cd /data/local
cd /data/local
# ./flash_image misc /sdcard/mtd0.img
./flash_image misc /sdcard/mtd0.img
# exit
exit
C:\adb>
-------------------------------------------------------------
my step , correct?

Yes, seems corrected..
have you made gold card?
what is your phone? OEM or branded?
what is the original Hboot version?
setupspeed said:
C:\adb>adb push flash_image /data/local/
adb server is out of date. killing...
* daemon started successfully *
774 KB/s (26172 bytes in 0.033s)
C:\adb>adb push rageagainstthecage-arm5.bin /data/local/tmp/
478 KB/s (5392 bytes in 0.011s)
C:\adb>adb push mtd0.img /sdcard/
1807 KB/s (655360 bytes in 0.354s)
C:\adb>adb push PB99IMG.zip /sdcard/
1550 KB/s (144169877 bytes in 90.807s)
C:\adb>adb shell
$ chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
$ chmod 0755 /data/local/flash_image
chmod 0755 /data/local/flash_image
$ cd /data/local/tmp
cd /data/local/tmp
$ ./rageagainstthecage-arm5.bin
./rageagainstthecage-arm5.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3319, 3319}
[*] Searching for adb ...
[+] Found adb as PID 671
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] [email protected] so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$
C:\adb>adb shell
adb server is out of date. killing...
* daemon started successfully *
# cd /data/local
cd /data/local
# ./flash_image misc /sdcard/mtd0.img
./flash_image misc /sdcard/mtd0.img
# exit
exit
C:\adb>
-------------------------------------------------------------
my step , correct?
Click to expand...
Click to collapse

hkfriends said:
Yes, seems corrected..
have you made gold card?
what is your phone? OEM or branded?
what is the original Hboot version?
Click to expand...
Click to collapse
gold card => yes
My phone => HTC Desire
Hboot version => 0.93.0001

i have this error "error writing misc: Permission denied"
in this step: "./flash_image misc /sdcard/mtd0.img"

Noob question
Using your method wont brick my phone right? My phone details are below:
Unit: HTC Desire
ROM: FroYo OTA (Unbranded)
BOOTLoader: 0.93
Software:2.13.707.1
Kernel:2.6.32.15

Just use my tool instead, it's much easier.

Doesn't Unrevoked3, the tool that is used to root phones, support hboot 0.93 on unbranded / unlocked phones? So this step is un-necessary on unbranded / unlocked phones?

Did it work at all?
Hi,
I too want to downgrade my HTC Desire from 2.2 to 2.1 because after the upgrade to 2.2 with hboot 0.93 my desire has stopped connecting to the H or 3g network.
Did this guide work for anyone at all?

HI
CAN SOME HELP ME TO GET THE ROM IMAGE VERSION 2.13.707.1 I NEED THE EXE. FILE THATS THE ONLY WAY I KNOW TO INSTALL THE ROM!!!!
MY PHONE TRIED TO UPGRADE FROM THE PHONE SOMETHING WENT WRONG AND IT SWITCH ON AND GET STUCK IN WHITE SCREEN WITH htc GREEN LOGO . . . I TRIED TO INSTALL THE ROM FROM MY COMPUTER THE LATEST BUT THE IMAGE ON THAT IS 2.10.405.2 . I REALLY APPRECIATE IF SOMEONE CAN HELP ME

black screen
I got a black screen after downgrade. Also after restart the phone
Desire

Related

[Q] Need Help? Not getting "kicked out" of shell?

Help! Im trying to root my Droid2 and i admit im a noobie when it comes to this... I followed the procedure to root the droid2 from this site but when i get to running the rageagainstthecage-arm5.bin, i do not get "kicked out" back to the the c: prompt where the sdk tools are saved.. Any suggestions?? Any help would be much appreciated. See below for at clip of the command window .
C:\SDK\tools>adb shell
$ cd data/local/tmp
cd data/local/tmp
$ chmod 0755 rageagainstthecage-arm5.bin
chmod 0755 rageagainstthecage-arm5.bin
$ ./rageagainstthecage-arm5.bin
./rageagainstthecage-arm5.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3815, 3815}
[*] Searching for adb ...
[+] Found adb as PID 27135
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$ cd
cd
cd: HOME not set
$ kill-server
kill-server
kill-server: permission denied
$ adb shell stop
adb shell stop
adb: permission denied
$ #
#
$

Already 4 Days, Please Help me! (Trying to Root My Lg Optimus One Android Phone)

Hi!
My phone is LG Optimus One. It's v10e.
I am new at this. This is my first android phone. I want to move the applications to SD Card. Because phone memory is not enough. So, i am trying to root my phone. Aldready 4 days. It's killing me. I aldready tried to root with different ways approximately 100 times. Every time same problems.
1- I tried to root 30-35 times with SuperOneClick 1.7
The problem is; when i hit the "Root" button, it's coming down to "Running psneuter..." and then, nothing! Nothing happens. Nothing changes. There is the details;
SuperOneClick v1.7.0.0
Killing ADB Server...
* server not running *
OK
Starting ADB Server...
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
OK
Waiting for device...
OK
Pushing psneuter...
1529 KB/s (585731 bytes in 0.374s)
OK
chmod psneuter...
OK
Running psneuter...
OK
***IF IT KEEPS LOOPING, TRY DISABLING USB DEBUGGING NOW***
Killing ADB Server...
OK
Starting ADB Server...
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
OK
Waiting for device...
OK
Running psneuter...
Click to expand...
Click to collapse
This is what i have with SuperOneClick 1.7. Is there any way to handle this? Please tell me, how can i figure it out?
2- I tried to root approximately 70 times with "Android SDK, OptimusRoot, then opening CMD window" way.
There was some guides from some forums. The guides are approximately same. I can't post the the links because, posting outside links not permitted for new users. I don't know how to post links.
I did everything in that guide. Every prerequisites fulfilled. Than opened a CMD window. Then, this...
C:\Users\Seyhan>cd c:\android-sdk-windows\platform-tools
c:\android-sdk-windows\platform-tools>adb push rageagainstthecage-arm5.bin /data
/local/tmp/rageagainstthecage
43 KB/s (5392 bytes in 0.120s)
c:\android-sdk-windows\platform-tools>adb push su /data/local/tmp/
641 KB/s (26264 bytes in 0.040s)
c:\android-sdk-windows\platform-tools>adb push busybox /data/local/tmp/
1710 KB/s (1926944 bytes in 1.100s)
c:\android-sdk-windows\platform-tools>adb shell
$ chmod 4755 /data/local/tmp/rageagainstthecage
chmod 4755 /data/local/tmp/rageagainstthecage
$ chmod 4755 /data/local/tmp/busybox
chmod 4755 /data/local/tmp/busybox
$ cd /data/local/tmp
cd /data/local/tmp
$ ./rageagainstthecage
./rageagainstthecage
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3341, 3341}
[*] Searching for adb ...
[+] Found adb as PID 1927
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$
c:\android-sdk-windows\platform-tools>adb shell
error: device not found
c:\android-sdk-windows\platform-tools>
Click to expand...
Click to collapse
it's coming to here;
[*] adb connection will be reset. restart adb server on desktop and re-login.
then nothing happens. Usb connection is removing itself, but not connecting after remove. Every time same problem. I can't get the "#". If anyone knows something about this, please help me. This is already a death battle for me. If anybody can help me with root my phone, i can't explain how i will be thankful.
Thanks for your interests.
did u try with z4root?
may be this will help
i think you will have to downgrade from v10e.
try the official forum in xda
I already tried z4root but its not working on v10e. Where can i open a thread for downgrade from v10e?

[Q] help!!! rooting!!! sgs4g

rooting phone soc 1.7 when it gets to this point:
SuperOneClick v1.7.0.0
Killing ADB Server...
OK
Starting ADB Server...
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
OK
Waiting for device...
OK
Pushing rageagainstthecage...
159 KB/s (5392 bytes in 0.033s)
OK
chmod rageagainstthecage...
OK
Running rageagainstthecage...
do i wait for the last one (Running rageagainstthecage...) to say ok? it has been over 20 min and it still sit there i wanna make sure before making any move.
Djveneko said:
rooting phone soc 1.7 when it gets to this point:
SuperOneClick v1.7.0.0
Killing ADB Server...
OK
Starting ADB Server...
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
OK
Waiting for device...
OK
Pushing rageagainstthecage...
159 KB/s (5392 bytes in 0.033s)
OK
chmod rageagainstthecage...
OK
Running rageagainstthecage...
do i wait for the last one (Running rageagainstthecage...) to say ok? it has been over 20 min and it still sit there i wanna make sure before making any move.
Click to expand...
Click to collapse
Try the psneuter option, It works fine for me.
fknfocused said:
Try the psneuter option, It works fine for me.
Click to expand...
Click to collapse
+1
Rage against the cage seemed to hang on me too when I first rooted my sgs4g. I just stopped it after it ran for a while and switched to psneuter method. Psneuter worked for me--and quickly. Good luck.
Sent from my SGH-T959V using XDA Premium App
Thanks!!
Sent from my SGH-T959V using XDA App
Psnueter works no problems.newbie here been tryin for 2 days to root. Just came from iphone so thats what I'm used to.any help greatky appreciated
Sent from my SGH-T959V using XDA App
My pc removed 1.7 because rage showed up as a virus. There is a 1.8 on cnet
Sent from my SGH-T959V using XDA Premium App
Either options work, I've tried both ways and they work, not always the first run but it's all trial and error =)
Sent from my SGH-T959V using XDA Premium App
Rooting SGS4G
I ran DoomLord v4 script. But i ran into a small problem. I am on 2.3.6 gingerbread.
---------------------------------------------------------------
Easy rooting toolkit (v4.0)
created by DooMLoRD
using exploit zergRush (Revolutionary Team)
Credits go to all those involved in making this possible!
---------------------------------------------------------------
[*] This script will:
(1) root ur device using latest zergRush exploit (21 Nov)
(2) install Busybox (1.18.4)
(3) install SU files (binary: 3.0.3 and apk: 3.0.6)
(4) some checks for free space, tmp directory
(will remove Google Maps if required)
[*] Before u begin:
(1) make sure u have installed adb drivers for ur device
(2) enable "USB DEBUGGING"
from (Menu\Settings\Applications\Development)
(3) enable "UNKNOWN SOURCES"
from (Menu\Settings\Applications)
(4) [OPTIONAL] increase screen timeout to 10 minutes
(5) connect USB cable to PHONE and then connect to PC
(6) skip "PC Companion Software" prompt on device
---------------------------------------------------------------
CONFIRM ALL THE ABOVE THEN
Press any key to continue . . .
--- STARTING ----
--- WAITING FOR DEVICE
--- creating temporary directory
mkdir failed for tmp, File exists
--- cleaning
rm failed for *, No such file or directory
--- pushing zergRush
562 KB/s (23060 bytes in 0.040s)
--- correcting permissions
--- executing zergRush
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00000118
[+] Found a Samsung, running Samsung mode
[*] Scooting ...
[*] Sleeping a bit (~40s)...
[*] Waking !
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[+] Overseer found a path ! 0x0001d338
[*] Sleeping a bit (~40s)...
[*] Waking !
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x40219cd4 0x0054
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd19403 0xafd390ef
[*] Sleeping a bit (~40s)...
[*] Waking !
[*] Popping 24 more zerglings
[*] Sending 173 zerglings ...
+++ LOG: write failed (errno=14)
+++ LOG: write failed (errno=14)
+++ LOG: write failed (errno=14)
****REMOVED 160 or so lines of this "+++ LOG: write failed (errno=14)"
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!
--- WAITING FOR DEVICE TO RECONNECT
if it gets stuck over here for a long time then try:
disconnect usb cable and reconnect it
toggle "USB DEBUGGING" (first disable it then enable it)
--- DEVICE FOUND
--- pushing busybox
1564 KB/s (1075144 bytes in 0.671s)
--- correcting permissions
--- remounting /system
--- checking free space on /system
28 KB/s (439 bytes in 0.015s)
df: /mnt/.lfs: Function not implemented
--- Free space on /system : 76744 bytes
--- no cleanup required
--- copying busybox to /system/xbin/
2099+1 records in
2099+1 records out
1075144 bytes transferred in 0.280 secs (3839800 bytes/sec)
--- correcting ownership
--- correcting permissions
--- installing busybox
--- pushing SU binary
986 KB/s (22228 bytes in 0.022s)
--- correcting ownership
--- correcting permissions
--- correcting symlinks
--- pushing Superuser app
1739 KB/s (785801 bytes in 0.441s)
--- cleaning
--- rebooting
ALL DONE!!!
Press any key to continue . . .
My problem is "+++ LOG: write failed (errno=14)" and "df: /mnt/.lfs: Function not implemented" does all these errors means the script partially failed? My other error is in Root Check it says "ADB Shell Default User:
ADB shell setting for standard access, stored in default.prop, is configured as: shell (non root) user - ro.secure=1" besides a few other minor things. If you want i can post the root check log as well. I loved doomlord script. went smoothly except for those small minor bugs. Can that all be fixed or should i run SuperOneClick? Thanks for any help.
Do you have Superuser on your phone?
Yes superuser is there. Here's a Root Check log. As you can see there seems like a few errors including "ADB shell setting for standard access, stored in default.prop, is configured as: shell (non root) user - ro.secure=1" so i am trying to figure out if i need to rerun the batch file, try superoneclick or if its fine left alone. I have superuser cause i opened it. But its 3.06, i used Doomlord's root v4, which uses superuser 3.06 and busybox 1.18.4. SuperOneClick uses more recent one. Thats why im not sure if it's ok or not. Thanks for the response
Congratulations! You have root access!
Superuser Application Status:
Superuser application - version 3.0.6 - is installed!
System File Properties for Root Access:
Alternative Location
Check Command: ls -l /sbin/su:
Result: /sbin/su: No such file or directory
Analysis: File /sbin/su does not exist.
Alternative Location
Check Command: ls -l /system/xbin/sudo:
Result: /system/xbin/sudo: No such file or directory
Analysis: File /system/xbin/sudo does not exist.
Standard Location
Check Command: ls -l /system/bin/su:
Result: -rwsr-sr-x root root 22228 2011-11-10 12:53 su
Analysis: Setuid attribute present and root user ownership present. Root access is correctly configured for this file! Executing this file can grant root access!
Standard Location
Check Command: ls -l /system/xbin/su:
Result: lrwxrwxrwx root root 2012-04-14 22:28 su -> /system/bin/su
Analysis: File: su is a symbolic link pointing to another file: /system/bin/su
Root User ID and Group ID Status:
Root user id:
uid=0(root)
Root group id:
gid=0(root)
System Environment PATH: /sbin /vendor/bin /system/sbin /system/bin /system/xbin
ADB Shell Default User:
ADB shell setting for standard access, stored in default.prop, is configured as: shell (non root) user - ro.secure=1
You're good to go.
What about all those errors and the ro.secure=1? Do i have a lower access root or just normal to get errors? Cause i was thinking of trying superoneclick but if it seems fine i can leave it alone. Thanks for the very quick response.
What is your ultimate goal? Do you want a custom ROM or Kernel? If so, none of this matters as it will be overwritten when you flash.
I just wanted to be sure i got full root access, ATM i just want stock firmware with full root. But i did want to upgrade to a custom rom. Preferably CM9 if it ever shows up for the SGS4G. I have cyanogen on my tablet. Do you know if they will release that to this phone? Since i doubt samsung will ever release Ice Cream Sandwich for this. Thanks
CM7 will come first and we have some intelligent dedicated devs working on it for all of us. But our current custom ROM's are awesome and beat the hell out of stock I must say!

cid incorrect update fail

hy guys
I want to downgrade my htc desire z, and i am follwing all the steps only the thing is that on ./flashgc it gives me this: permission denied.
and finally and the most important, when i begin to downgrade it gives me this message: CID Incorrect update fail.
please help me
amiraria said:
hy guys
I want to downgrade my htc desire z, and i am follwing all the steps only the thing is that on ./flashgc it gives me this: permission denied.
and finally and the most important, when i begin to downgrade it gives me this message: CID Incorrect update fail.
please help me
Click to expand...
Click to collapse
Can you post the original post you are following? You might need to create your own goldcard.
CID Incorrect update failed
iSkanky said:
Can you post the original post you are following? You might need to create your own goldcard.
Click to expand...
Click to collapse
after doing all the settings as instruction shows i started writing the cammonds like below:
> adb shell cat /dev/msm_rotator
/dev/msm_rotator: invalid length
> adb push fre3vo /data/local/tmp
> adb shell
$ chmod 777 /data/local/tmp/fre3vo
$ /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
Buffer offset: 00000000
Buffer size: 8192
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba90000...
Potential exploit area found at address fbb4d600:a00.
Exploiting device...
> adb shell
# exit
> adb push misc_version /data/local/tmp/misc_version
> adb push flashgc /data/local/tmp/flashgc
> adb shell chmod 777 /data/local/tmp/*
> adb shell
# cd /data/local/tmp
# ./misc_version -s 1.00.000.0
--set_version set. VERSION will be changed to: 1.00.000.0
Patching and backing up partition 17...
./flashgc (In this part when i am writing this code i will get this massage: ./flashgc permission denied, then i countinued typing the rest of the codes).
# sync
# dd if=/dev/block/mmcblk0p17 bs=1 skip=160 count=10
1.00.000.010+0 records in
10+0 records out
10 bytes transferred in 0.001 secs (10000 bytes/sec) (here also instead of getting 10000 bytes/sec i get 5000 bytes/sec)
(here i downloaded PC10IMG.zip and copied to my sdcart)
(then for Fastboot Downgrade i wrote these codes)
> adb reboot bootloader
> fastboot devices
(My device is recognized by typing the above command)
> fastboot oem rebootRUU
(but after finishing all the procedure it will give me this error: CID Incorrect update failed)
flashgc is not working and it gives the error: CID incorrect
amiraria said:
after doing all the settings as instruction shows i started writing the cammonds like below:
> adb shell cat /dev/msm_rotator
/dev/msm_rotator: invalid length
> adb push fre3vo /data/local/tmp
> adb shell
$ chmod 777 /data/local/tmp/fre3vo
$ /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
Buffer offset: 00000000
Buffer size: 8192
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba90000...
Potential exploit area found at address fbb4d600:a00.
Exploiting device...
> adb shell
# exit
> adb push misc_version /data/local/tmp/misc_version
> adb push flashgc /data/local/tmp/flashgc
> adb shell chmod 777 /data/local/tmp/*
> adb shell
# cd /data/local/tmp
# ./misc_version -s 1.00.000.0
--set_version set. VERSION will be changed to: 1.00.000.0
Patching and backing up partition 17...
./flashgc (In this part when i am writing this code i will get this massage: ./flashgc permission denied, then i countinued typing the rest of the codes).
# sync
# dd if=/dev/block/mmcblk0p17 bs=1 skip=160 count=10
1.00.000.010+0 records in
10+0 records out
10 bytes transferred in 0.001 secs (10000 bytes/sec) (here also instead of getting 10000 bytes/sec i get 5000 bytes/sec)
(here i downloaded PC10IMG.zip and copied to my sdcart)
(then for Fastboot Downgrade i wrote these codes)
> adb reboot bootloader
> fastboot devices
(My device is recognized by typing the above command)
> fastboot oem rebootRUU
(but after finishing all the procedure it will give me this error: CID Incorrect update failed)
Click to expand...
Click to collapse
I even made a goldcard but i dont know how to use it, i mean the file name is Goldcard.img, i dont know whether i should place it in the related folder or not ? what should be the extension of the file.
one thing more: my device is htc desire z 2.3.3 . and i downloaded the ( Desire Z: PC10IMG.zip
Mirrors:
PC10IMG.zip
Vision_DZ_1.34.405.5_PC10IMG.zip
Vision_DZ_1.34.405.5_PC10IMG.zip) the first one is it correct or not? or i should download the (G2: PC10IMG_Vision_TMOUS_1.19.531.1_Radio_12.21.60.09b _26.02.01.15_M2_release_149459_signed.zip
Mirrors:
Vision_G2_1.19.531.1_PC10IMG.zip
Vision_G2_1.19.531.1_PC10IMG.zip
MD5: 531c08dc402e15577b947bf4cd22aec2)
please help me

[ROOT] LG Intuition & LG Spectrum ICS

Source: http://www.androidpolice.com/2012/0...root-the-lg-intuition-and-lg-spectrum-on-ics/
If you find this useful please follow me (jcase) on twitter ( https://twitter.com/teamandirc/ ).
Here you go, root for both the new LG Intuition and the LG Spectrum running ICS. The vulnerability is a simple permission bug allowing us to setup a symlink to local.prop (yes yet again). While the bug is the same, the procedure is slightly different, so I will have the instructions separate.
With the LG Intuition, they did seem to attempt to mitigate this attack. Not by setting correct permissions, but by dropping adbD to the shell user if it runs as root, even if ro.kernel.qemu=1 is set. They failed, they give us enough time to run one command before dropping the root privileges, in our case a script to root the phone.
LG Spectrum ICS Root (for the leaked ICS rom):
Expect this to be patched in the release rom. Leaked ICS rom has locked bootlaoders, ie no recovery at this point.
Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
adb shell
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit
adb reboot
adb wait-for-device shell
$ echo 'ro.kernel.qemu=1' > /data/local.prop
$ exit
adb reboot
adb wait-for-device remount
adb push su /system/xbin/su
adb shell
# chown 0.0 /system/xbin/su
# chmod 06755 /system/xbin/su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot
Once rebooted, install Superuser from the market and enjoy.
LG Intuition Root
Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
lgroot.sh ( http://dl.dropbox.com/u/8699733/lgroot/lgroot.sh )
adb push su /data/local/tmp/su
adb push lgroot.sh /data/local/tmp/lgroot.sh
adb shell
$ chmod 777 /data/local/tmp/lgroot.sh
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit
adb reboot
You may have to unplug/replug your phone to get some computers to pick it up again after this reboot.
adb wait-for-device shell
$ echo 'ro.kernel.qemu=1' > /data/local.prop
$ exit
Here is the important part, you will have to execute the next to commands one after the other. We want the second command to be fired off as soon as adbD comes up, before it drops root privileges. This may take some a few minutes, and after the second command is complete you may have to unplug/replug you phone to get your computer to see it again.
adb reboot
adb wait-for-device /data/local/tmp/lgroot.sh
(Here is where you may have to unplug/replug, but only after the second command has ran).
adb wait-for-device shell
$ su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot
Once rebooted, install Superuser from the market and enjoy.
Thanks!
Dude, it has been killing me not having root since I managed to get the leaked ICS installed. But I tried this, and just wasn't having any luck. I tried to make a .bat file for it, no go. So i tried inputting it line by line and i keep getting hung up at the $ echo 'ro.kernel.qemu=1' part. Just wondering if anyone else is having this problem.
Also, since yesterday whenever I check for a software update, I'm getting an "error occurred during download". I was wondering if I would even be able to get the final ICS OTA when it finally is available.
Thanks again jcase!
LostCauseSPM said:
Dude, it has been killing me not having root since I managed to get the leaked ICS installed. But I tried this, and just wasn't having any luck. I tried to make a .bat file for it, no go. So i tried inputting it line by line and i keep getting hung up at the $ echo 'ro.kernel.qemu=1' part. Just wondering if anyone else is having this problem.
Also, since yesterday whenever I check for a software update, I'm getting an "error occurred during download". I was wondering if I would even be able to get the final ICS OTA when it finally is available.
Thanks again jcase!
Click to expand...
Click to collapse
Which specific ICS version do you have, I had a couple different leaks to work with.
jcase said:
Which specific ICS version do you have, I had a couple different leaks to work with.
Click to expand...
Click to collapse
build #: IMM76D
Still tweeking on it. Just updated all my drivers, too. I'm not a total newb, but I'm no pro, either.
jcase said:
Source: http://www.androidpolice.com/2012/0...root-the-lg-intuition-and-lg-spectrum-on-ics/
LG Intuition Root
Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
lgroot.sh ( http://dl.dropbox.com/u/8699733/lgroot/lgroot.sh )
adb push su /data/local/tmp/su
adb push lgroot.sh /data/local/tmp/lgroot.sh
adb shell
$ chmod 777 /data/local/tmp/lgroot.sh
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit
adb reboot
You may have to unplug/replug your phone to get some computers to pick it up again after this reboot.
adb wait-for-device shell
$ echo ‘ro.kernel.qemu=1’ > /data/local.prop
$ exit
Here is the important part, you will have to execute the next to commands one after the other. We want the second command to be fired off as soon as adbD comes up, before it drops root privileges. This may take some a few minutes, and after the second command is complete you may have to unplug/replug you phone to get your computer to see it again.
adb reboot
adb wait-for-device /data/local/tmp/lgroot.sh
(Here is where you may have to unplug/replug, but only after the second command has ran).
adb wait-for-device shell
$ su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot
:crying:
Once rebooted, install Superuser from the market and enjoy.
Click to expand...
Click to collapse
i tried but as soon as i entered adb shell it kick me off and haven't been able to try since
jcase said:
Which specific ICS version do you have, I had a couple different leaks to work with.
Click to expand...
Click to collapse
Ive got the spectrum, btw. Still trying to make a nice, clean, automated .bat, but it keeps failing now at the remount command.
---------- Post added at 07:37 PM ---------- Previous post was at 07:24 PM ----------
And now is saying "rm failed for /data/vpnch..."
When the remount fails, I get a "remount failed: operation not permitted" message.
Hope this is useful to you.
LostCauseSPM said:
Ive got the spectrum, btw. Still trying to make a nice, clean, automated .bat, but it keeps failing now at the remount command.
---------- Post added at 07:37 PM ---------- Previous post was at 07:24 PM ----------
And now is saying "rm failed for /data/vpnch..."
When the remount fails, I get a "remount failed: operation not permitted" message.
Hope this is useful to you.
Click to expand...
Click to collapse
add [email protected] to gltak and hit me up.
lahegry said:
i tried but as soon as i entered adb shell it kick me off and haven't been able to try since
Click to expand...
Click to collapse
unplug/replug, The intuition is very touchy. Might need to do it from another system or with another cable.
jcase said:
unplug/replug, The intuition is very touchy. Might need to do it from another system or with another cable.
Click to expand...
Click to collapse
i don't think i'm fast enough, i just can't type faster than it kicks me off
lahegry said:
i don't think i'm fast enough, i just can't type faster than it kicks me off
Click to expand...
Click to collapse
Place the two commands into a batch file/shell script, or setup teamviewer and msg me on gtalk
so this is just I've come up with tonight, the exploit still fails line by line, so I made a batch file just for that command, and I think I may be misunderstanding that "adb mount - o" command you recomended.
Wow, this chrome is NOT liking this txt box, keeps jumping backwards for some reason. C'mon Google...
I've got the intuition and here is what I'm coming up with using cmd prompt in windows:
C:\android-sdk\platform-tools>adb push su /data/local/tmp/su
2642 KB/s (380532 bytes in 0.140s)
C:\android-sdk\platform-tools>adb push lgroot.sh /data/local/tmp/lgroot.sh
10 KB/s (164 bytes in 0.015s)
C:\android-sdk\platform-tools>adb shell
[email protected]:/ $ chmod 777 /data/local/tmp/lgroot.sh
chmod 777 /data/local/tmp/lgroot.sh
[email protected]:/ $ rm /data/vpnch/vpnc_starter_lock
rm /data/vpnch/vpnc_starter_lock
[email protected]:/ $ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
[email protected]:/ $ exit
exit
C:\android-sdk\platform-tools>adb reboot
C:\android-sdk\platform-tools>adb wait-for-device shell
[email protected]:/ $ echo `ro.kernel.qemu=1' > /data/local.prop
echo `ro.kernel.qemu=1' > /data/local.prop
> exit
exit
> adb reboot
adb reboot
> adb wait-for-device /data/local/tmp/lgroot.sh
adb wait-for-device /data/local/tmp/lgroot.sh
> adb wait-for-device shell
adb wait-for-device shell
>
I believe I see where the mistake is, but don't know how to fix it.
---------- Post added 30th September 2012 at 12:02 AM ---------- Previous post was 29th September 2012 at 11:57 PM ----------
actually I don't see my mistake and I should be doing all this in PTP mode correct?
Try now, something was altering my post
arnshrty said:
I've got the intuition and here is what I'm coming up with using cmd prompt in windows:
C:\android-sdk\platform-tools>adb push su /data/local/tmp/su
2642 KB/s (380532 bytes in 0.140s)
C:\android-sdk\platform-tools>adb push lgroot.sh /data/local/tmp/lgroot.sh
10 KB/s (164 bytes in 0.015s)
C:\android-sdk\platform-tools>adb shell
[email protected]:/ $ chmod 777 /data/local/tmp/lgroot.sh
chmod 777 /data/local/tmp/lgroot.sh
[email protected]:/ $ rm /data/vpnch/vpnc_starter_lock
rm /data/vpnch/vpnc_starter_lock
[email protected]:/ $ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
[email protected]:/ $ exit
exit
C:\android-sdk\platform-tools>adb reboot
C:\android-sdk\platform-tools>adb wait-for-device shell
[email protected]:/ $ echo `ro.kernel.qemu=1' > /data/local.prop
echo `ro.kernel.qemu=1' > /data/local.prop
> exit
exit
> adb reboot
adb reboot
> adb wait-for-device /data/local/tmp/lgroot.sh
adb wait-for-device /data/local/tmp/lgroot.sh
> adb wait-for-device shell
adb wait-for-device shell
>
I believe I see where the mistake is, but don't know how to fix it.
---------- Post added 30th September 2012 at 12:02 AM ---------- Previous post was 29th September 2012 at 11:57 PM ----------
actually I don't see my mistake and I should be doing all this in PTP mode correct?
Click to expand...
Click to collapse
Correction needed for Intuition
First of all, thank you!!!
For Intuition, where the 'important part' is, the second command returns an error.
I was able to succeed by running
adb reboot
adb wait-for-device shell
then wait for the # to appear, and quickly paste and execute:
/data/local/tmp/lgroot.sh
took a few tries, but I am rooted! :laugh:
krapman said:
First of all, thank you!!!
For Intuition, where the 'important part' is, the second command returns an error.
I was able to succeed by running
adb reboot
adb wait-for-device shell
then wait for the # to appear, and quickly paste and execute:
/data/local/tmp/lgroot.sh
took a few tries, but I am rooted! :laugh:
Click to expand...
Click to collapse
Just wondering how you guys like this device? I was just debating on switching to verizon and this device stands out as the most interesting to me... so I had to look here to see if anybody rooted it.
Anybody try any different roms? or think there may be a Jelly Bean update for it?
/system/bin/sh su not found
any help with this was having an issue with the echo command but got past that but now it's giving me this error
davieslacker said:
Just wondering how you guys like this device? I was just debating on switching to verizon and this device stands out as the most interesting to me... so I had to look here to see if anybody rooted it.
Anybody try any different roms? or think there may be a Jelly Bean update for it?
Click to expand...
Click to collapse
It's an amazing device I love it and im rooted. used the steps above and it worked. I am sure it will get jelly bean love eventually. No roms yet. But LG added a lot of customization to the device form what developers usually add as mods.
Will there be a single click method for root on the intuition. I can't seem to get this method to work
Exploit still works on the final version of ICS for the LG Spectrum
Just updated my phone. Couldn't wait for the OTA rollout, updated via the Verizon Wireless Update Util on my comp. Root worked no problem. Thanks again Jcase!
What did you update your phone to?
Sent from my VS950 4G using xda app-developers app

Categories

Resources