Database Info

****ROOT EVO After July 1 OTA Update

I tried every method, read every thread in every forum in an effort to root my EVO. Nothing worked. I was driving myself mad and spending tons of time. I Eventually I came across a post which directed me to XDA Developers Thread ---==={ROOT GUIDE}===--- | 1.47.651.1 ROOT, post 579 by SharkUW . I have used this on my own phone and I don't see a reason why it wouldn't work. I modified some of the instructions to make it clearer. The instructions may not be exact, and there is some seat-of-the-pants involved, but I got it to work. Use it at your own risk.
Prerequisites (follow in order)
Android-SDK developers program. I loaded it to C:
JAVA SE Development (use correct bit – 32 or 64). loaded in C:
Microsoft .NET Framework V 4.0
Reboot your phone and do a factory reset. Erase everything
Set phone to Charge Only and USB debugging
Open the stock browser and sign-in with your PCS phone number. Leave running.
Shutdown the phone, then restart
Make sure ADB is functional on your computer. You should be able to "adb shell" (confirming adb is working, exit shell if you're in it).
Extract the Do_root.zip (link below) and place all these files into the SAME folder as adb.exe. I have not included the appropriate PC36IMG.zip. Get it here. http://forum.xda-developers.com/showthread.php?t=701835 Leave the name as "eng-PC36IMG.zip". Place that in the SAME directory as well as the .zip.
Open a command prompt on your computer. point directory to Android-SDK directory\tools and a list will come up… click on "root.bat” and click RUN.
If it hangs for more than 30 seconds with the browser ****, CTRL+C, yes to kill the bat and just run it again.
Follow the directions. Your phone is going to reboot. It is then going to do a little **** and reboot into the boot loader. Keep track of the Command screen and wait because some steps take a while and there is no way of telling if it’s working. Nothing lasted more than 5 minutes. Eventually it will be in a "bootloader" and ask if you want to reboot. Say Yes with a Volume UP.
The .bat is now done. You have root. (not sure if next part is true) You now need a custom recovery to flash a proper ROM beyond the scope of this guide.
In original instructions but I’ve found the following Recovery step and code is not necessary: Now take the last step and flash the recovery.img that will already be on the root of your sdcard. To do this, after the PC36IMG flash:
Code:
adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery.img
To check for root do ADB Shell and should get #.
If you're all advancedy you can put on a different recovery image.
IMPORTANT If you get a message here about "not writing bad block", flash it again until you get 0 errors. I don't know how common it is, but personally my recovery has issues with flashing. Do NOT let that be a bad flash.
Attached Files
do_root.zip (4.07 MB, 49 views)
________________________________________
Last edited by SharkUW; 7th July 2010 at 01:06 AM.

Going to try it tomorrow and hope it works. Thanks

Where are the attached files?

Can't find the do_root.zip file. Seems there is no attachment, please re-post. Thanks.

I tried to attach the do_root.zip file and a link to Toast 2 file. If that doesn't work, go to the referenced post #579 here: http://forum.xda-developers.com/showthread.php?t=718889&page=58.

Have you tried this SimpleRoot? I just did it, and it worked flawlessly.

Vivix729 said:
Have you tried this SimpleRoot? I just did it, and it worked flawlessly.
Click to expand...
Click to collapse
Simpleroot ftw.

mattrb said:
Simpleroot ftw.
Click to expand...
Click to collapse
QFT. I did simple root (I still setup adb and ensured it was working first) and then flashed the rooted Stock 1.47 ROM in about 40 min. I think most people that are running into issues with Simpleroot do not have adb setup properly or they did something inadvertently and need to clear out the files/cache and need to start over from scratch.

gmanvbva said:
QFT. I did simple root (I still setup adb and ensured it was working first) and then flashed the rooted Stock 1.47 ROM in about 40 min. I think most people that are running into issues with Simpleroot do not have adb setup properly or they did something inadvertently and need to clear out the files/cache and need to start over from scratch.
Click to expand...
Click to collapse
I did simple root and it worked fine too. I don't think the issue is adb being setup since he has an adb file in his download.

Update from a few days ago.
Just got a new SDHC card and simpleroot worked. The SDHC that came with my phone died. I placed a spare in there that was a 2gd regular micro and Hboot would not ready the IMG for nothing.
If simple root is not working then it's the Sh!tty card acting up.
Happy ending for me.

I just got my phone yesterday did the ota simpleroot and seems like it worked fine
but now i dont know what to do next
to get custom roms or froyo 2.2 or anything lol

Awesome post |OP|.
My desktop is Windows 7 x64 and doesn't play nicely with the standard tools.
I was forced to adapt your root.bat script to an OSX friendly BASH script.
The only requirement is that you download the android SDK from developer.android.com/sdk/index.html (apparently, I'm too new to post links).
The steps I took to get root:
Unzip the android SDK
follow |OP|'s instructions, unzipping the contens of do_root into [sdk-root]/tools/
unzip the attached bash script to the [sdk-root]/tools/
run my bash script from the [sdk-root] folder instead of root.bat - type "./root.sh" without the double-quotes
Grab a copy of Froyo while your phone is being rooted

[Guide] How to gain root on 2.2 for Mac

*******UPDATED 8/31/10 *******
This rooting method was adapted from regaw_leinad's method and toastcfh's method. By following these steps you will successfully downgrade your phone back to android 2.1 in order to gain root.
I don't trust unrevoked as I have had problems with it in the past.

I am not responsible for any damages to your phone.
special thanks to:
regaw_leinad
Sebastian Krahmer
Toastcfh
amon_ra
FILES YOU WILL NEED:
copy and paste into browser
Code:
sdx-downloads.com/sdx/evo/troot/eng-PC36IMG.zip
evo4g.me/downloads//count.php?target=evo-root.zip
files.androidspin.com/downloads.php?dir=amon_ra/RECOVERY/&file=recovery-RA-evo-v1.8.0.img
developer.android.com/sdk/index.html
You will need the Android SDK in order to communicate between your computer and your phone. Download it (last link above) and follow the setup instructions that it comes with.
Unzip the contents of the evo-root.zip and put all the files from it into the tools folder located in the android sdk folder.
Rename the eng-PC36IMG.zip to PC36IMG.zip and then put it the tools folder located in the android sdk folder. DO NOT UNZIP IT!

******* PC36IMG.zip md5sum~ fe8aba99893c766b8c4fd0a2734e4738 *******
Move the recovery-RA-evo-v1.8.0.img into the android sdk folder as well.
Make sure usb debugging is enabled on your device. To do so go to Settings > Applications > Development > and make sure the check box is checked.
Plug your phone into the computer. Select "Charge Only" from the notifications bar.
Open up terminal and navigate your way into the android sdk folder.
Code:
cd /
cd asdk
Push all the files onto your phone.
Code:
tools/adb push /asdk/tools/flash_image /sdcard/
tools/adb push /asdk/tools/rageagainstthecage-arm5.bin /data/local/tmp/
tools/adb push /asdk/tools/mtd-eng.img /sdcard/
tools/adb push /asdk/tools/PC36IMG.zip /sdcard/
tools/adb push /asdk/tools/recovery-RA-evo-v1.8.0.img /sdcard/
Note that the PC36IMG.zip will take longer than the other files to transfer to the sdcard because it is a large file.

Now we will make rageagainstthecage.bin executable.
Code:
tools/adb shell
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
You should see this (below) after it has made the change.
Code:
$
Now to use the rooted shell.
Code:
cd /data/local/tmp
./rageagainstthecage-arm5.bin
You will now see some text on your terminal screen describing the exploit. 

Wait for the adb shell to finish the process. At this point it may or may not terminate the current shell session in terminal. If it does then it should look like this:
Code:
users-iMac:asdk user$
If it doesn't it will return to
Code:
$
in that case you need to exit the current session. To do so type
Code:
exit

Now we need initiate a new shell which should now have root permissions.
Enter the following:
Code:
tools/adb shell
and you will see you now have a
Code:
#
instead of
Code:
$
Now we need to flash the mdt-eng.img in order for it to let us install a custom recovery
Code:
adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/mtd-eng.img
That will flash your misc partition with Toast's mtd-eng.img


This should return you to
Code:
#
Now boot into hBoot
Code:
reboot bootloader
This will reboot your phone into hBoot. It will scan for the PC36IMG.img. When it asks yes or no, select yes.
It should then reflash your phone into the engineering build.
When it asks to reboot select yes.
You will need to flash custom recovery in order to be able to flash other custom roms or modifications. I use Amon_RA's recovery because it works great and has NEVER caused me any problems.
Now, open up terminal and get back into the android sdk folder
Code:
cd /
cd asdk
Since we have already pushed the recovery onto the sdcard we only need to flash the recovery onto the phone so that we can use it
Code:
adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery-RA-evo-v1.8.0.img
Now lets rename that PC36IMG.zip file again
Code:
mv /sdcard/PC36IMG.zip /sdcard/eng-PC36IMG.zip
that way your phone doesn't try to flash it when you go into recovery each time
And last but not least we need to boot into it to flash a custom rom
Code:
reboot recovery
Your phone should then reboot into Amon_RA's recovery and you may now head over to the dev forum to find your new favorite custom rom.

very nice! can anyone confirm this? my buddy wants me to root his 2.2 and i would like to try this.

To make life easier for some people add this to your post mate, and apply it yourself if you would like.
Here is how to add your sdk/tools directory to your .bash_profile file so you won't have to navigate to the folder each time.
Download this so you'll be able to see your hidden files http://www.mediafire.com/?diimft1ninn Run it, check "Show Hidden Files" then click Restart finder. Now, navigate to your home folder (/Users/UserName/) and see if there's a .bash_profile already there. If not, create with textedit.
Now add this to the file: export PATH=${PATH}:/Path/Of/Your/Sdk/Tools/Folder
Mine is /Users/bmxrider4444/Documents/Android/SDK/tools
Now do not save it as rich text. If yours is in rich text, click on "Format" in the menu bar, and click "make plain text". Now save it as .bash_profile and uncheck "if no extension is provided, use .txt".
Now you can go back to Ghost and uncheck "Show all hidden files" and restart finder again (special thanks to ajones7279 for these steps)
Enjoy!
Just as clarification as to what this does, it enables you to run adb commands and other commands without having to navigate to the /android/tools/ folder every time you want to run adb or whatever.

does this work?

seekis said:
At this point we need to push the recovery onto the sdcard
Code:
tools/adb push "location of recovery-RA-evo-v1.8.0.img" /sdcard/
Click to expand...
Click to collapse
This is great! Thanks for the guide - I am planning on rooting my Wife's EVO but have been waiting for an easier method than the other one posted. Question on the above where we write "location of recovery-ra-evo-v1.8.0.img". Is that the exact code, or should we be adding a directory or folder location into this line? I rooted my 2.1 EVO on my Mac a couple months ago and don't remember this step. Once again - very much appreciate the help.
One last question - would it make more sense to have a custom ROM already on your SD Card prior to rooting, so that you can flash it right after you flash AMON-RA for the first time? Probably doesn't matter but thought i'd ask.

^^ same question as above, plus one other n00b question - does this method unlock NAND?
[edit] I was not insinuating that randymac88 is a n00b; I, however, am

seekis said:
I don't trust unrevoked as I have had problems with it in the past.

I am not responsible for any damages to your phone.
Click to expand...
Click to collapse
Don't trust us with the unrevoked 3.x/unrevoked forever application combo that's worked for thousands of users without sideeffects on regaw's post?
You should note to everyone that your method will screw up their PRI, reverting it back to 1.34. By using unrevoked and unrevoked forever, you can keep 1.40.

randymac88 said:
This is great! Thanks for the guide - I am planning on rooting my Wife's EVO but have been waiting for an easier method than the other one posted. Question on the above where we write "location of recovery-ra-evo-v1.8.0.img". Is that the exact code, or should we be adding a directory or folder location into this line? I rooted my 2.1 EVO on my Mac a couple months ago and don't remember this step. Once again - very much appreciate the help.
One last question - would it make more sense to have a custom ROM already on your SD Card prior to rooting, so that you can flash it right after you flash AMON-RA for the first time? Probably doesn't matter but thought i'd ask.
Click to expand...
Click to collapse
Thats not the exact code no. I just put that as a place holder you are suppose to put in the location of where you have the recovery.img. For example, the exact command for me would be:
Code:
/Users/seekis/Downloads/recovery-ra-evo-v1.8.0.img
Don't trust us with the unrevoked 3.x/unrevoked forever application combo that's worked for thousands of users without sideeffects on regaw's post?
You should note to everyone that your method will screw up their PRI, reverting it back to 1.34. By using unrevoked and unrevoked forever, you can keep 1.40.
Click to expand...
Click to collapse
As far as using unrevoked, I stated that I, ME, MYSELF, has had issues with it. not that anybody else has. By all means go and use it if you would like. I will not. It is true that you will loose PRI 1.40, but seeing as how even after installing the OTA from HTC my phone still didn't update it to 1.40, I don't see the issue.

rsage said:
^^ same question as above, plus one other n00b question - does this method unlock NAND?
[edit] I was not insinuating that randymac88 is a n00b; I, however, am
Click to expand...
Click to collapse
i believe it does unlock nand seeing as how i adapted it from toasts method

Hey Seekis - question, I'm stuck here. I keep getting "permission denied", or "operation not permitted" when trying to make the exploit executable at this step:
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
Am I missing something? I've tried a million times and can't seem to get past this. I've successfully pushed all the files onto the sdcard.
I've also have had some trouble finding the exact root path to these files. I've been able to navigate, but I would think a lot of users would have some trouble.
Regardless, many thanks for getting this posted...
EDIT: I pushed the rageagainstthecage file to the sdcard by mistake. Will try again tomorrow.

ok i got rid of that step by moving the file into the android sdk and pushing it with all the other files

Okay now I appear to be in big trouble as I've just messed up my wife's phone, and its probably going to be unusable for a while until I get this figured out (assuming I do!).
I got through most of the process. I flashed the PC36IMG.zip file; however when it asked to reboot, it just dumped me back into the bootloader. Whenever I say reboot, it just takes me back to the bootloader. Pull the battery, same thing - bootloader. Yikes.
I don't know how to get to the next step because I can't get into a booted rom in order to flash the amon-ra recovery. Am I totally effed? Can anyone help me here?
EDIT: Okay reflashed the PC36IMG.zip file, and it rebooted into the stock ROM. Onward! Phew!!

The wife's EVO is now fully rooted running Baked Snack 1.5 w/Netarchy's kernel. Touch and go there for a minute, but it all worked out. No 1.40 PRI, but I don't really care about that right now.
Woot! Thanks Seekis!!

do u have to push the pc36img with adb every time or will drag and drop work or copy and paste work?

FoxHound630 said:
do u have to push the pc36img with adb every time or will drag and drop work or copy and paste work?
Click to expand...
Click to collapse
You can mount the card on your system and copy paste it over as well, yes.

randymac88 said:
Okay now I appear to be in big trouble as I've just messed up my wife's phone, and its probably going to be unusable for a while until I get this figured out (assuming I do!).
I got through most of the process. I flashed the PC36IMG.zip file; however when it asked to reboot, it just dumped me back into the bootloader. Whenever I say reboot, it just takes me back to the bootloader. Pull the battery, same thing - bootloader. Yikes.
I don't know how to get to the next step because I can't get into a booted rom in order to flash the amon-ra recovery. Am I totally effed? Can anyone help me here?
EDIT: Okay reflashed the PC36IMG.zip file, and it rebooted into the stock ROM. Onward! Phew!!
Click to expand...
Click to collapse
Had the same issue. When i first booked into the bootloader i had to select recovery then flash PC36IMG.zip. Then boot loop. Then i went back into the bootloader and it automagically read in the PC36IMG.zip and flashed it, then i got stock 2.1 root. Just a few minutes of "oh crap"

I'm stuck. I got as far as flashing PC36IMG.zip, which was successful, as my phone now runs 2.1, but it doesn't appear I'm rooted. When I go back into the adb shell, I'm getting the $ prompt, and running
Code:
cat /sdcard/flash_image > /data/flash_image
gives me a permission denied error. Help!

atom_jack said:
I'm stuck. I got as far as flashing PC36IMG.zip, which was successful, as my phone now runs 2.1, but it doesn't appear I'm rooted. When I go back into the adb shell, I'm getting the $ prompt, and running
Code:
cat /sdcard/flash_image > /data/flash_image
gives me a permission denied error. Help!
Click to expand...
Click to collapse
i dont know what to tell you other than try again. this happened to me the first time through as well. i dont know why. i just started from the top and it worked the second time through.

seekis said:
i dont know what to tell you other than try again.
Click to expand...
Click to collapse
So after you flash PC36IMG.zip you should automatically get a root (#) prompt when going into the shell? ie, I'll have rooted 2.1 yes?
seekis said:
this happened to me the first time through as well. i dont know why. i just started from the top and it worked the second time through.
Click to expand...
Click to collapse
Aha. Ok, I will keep trying til it gives me a root shell, I guess. I also tried unrevoked3 but that didn't seem to work.

Success!! So, I stupidly assumed that all PC36IMG.zip's were the same, and was using the one from the original 2.2 PC thread. Once I got the correct one, voila!
You might want to post the md5 of the one you are using, so there's no confusion for others. Also, you missed a tiny step when you first start up hboot - you have to select fastboot for it to start scanning for PC36IMG.zip.
Thanks!

[Q]How to install Flash ClockworkMod Recovery on M701 (Apad)?

Hi all!
I finally managed to ROOT an aPad M701 using z4Root.apk
Now I want to make an image of my entire ROM tablet, I've heard that under the ROM manager app is a tool called "Flash ClockworkMod Recovery" that has to be installed in order to make a full ROM backup.
The problem is that everytime I try to install it a screen pops out telling me to choose from the list my model of phone (I'm on an aPad tablet), since I'm not on a phone, I'm unable to continue with the process!
Any method or workaround for installing Flash ClockworkMod Recovery on Haipads/aPads M701?
Thanks in advance for the help.

Custom Recovery Image
On Team Telechips website there is a custom Clockwork recovery image toward the bottom of the page.
Use the .bat file they include in their ZIP file or push the .img file to /nand and flash. You will then be able to back up everything with the custom m701 clockwork application.
If the .bat file doesn't work for you, try opening it up as text and use the commands as a guide to push via adb.

Thanks a lot for the reply Clookeno but I dont know where to start with this, do you know any step by step guide I can use to achieve this?
Again thanks for the info.

Adb push issues
Clookeno said:
On Team Telechips website there is a custom Clockwork recovery image toward the bottom of the page.
Use the .bat file they include in their ZIP file or push the .img file to /nand and flash. You will then be able to back up everything with the custom m701 clockwork application.
If the .bat file doesn't work for you, try opening it up as text and use the commands as a guide to push via adb.
Click to expand...
Click to collapse
I'm trying this and when using adb push to /nand I'm getting back "failed to copy 'recovery.m701.img' to '/nand/recovery.m701.img': Read-only file system"
I'm currently running Haipads 2.2 version and I was looking at testing out CM6 version, but can't seem to get the img file over.
And Ideas?

read only file
adb shell mount -o remount,rw /dev/block/mtdblock3 /system

The /nand folder needs to be read-writeable....since you use z4root go into temporary root and the push the file into /nand folder

Locobox said:
Thanks a lot for the reply Clookeno but I dont know where to start with this, do you know any step by step guide I can use to achieve this?
Again thanks for the info.
Click to expand...
Click to collapse
Locobox, there likely isn't a step-by-step guide for the procedure because it has a .bat file which is basically a executable file in windows that runs a set of commands in the DOS prompt for you. Basically you just double click the install_recovery.bat file and it puts the ADB commands in for you to push the recovery image to your tablet.
If you right click the .bat file and click edit you will see the following ADB commands:
adb push recovery.m701.img /nand/recovery.m701.img
adb shell sync
adb shell flash_image recovery /nand/recovery.m701.img
adb shell sync
adb shell reboot recovery
If you are familiar with ADB you can also copy the .img file to your sd card and flash it from there.
i recommend you have root access and the ADB utility.
Sorry it took so long to reply, work has been killing me lately....

poole699 said:
I'm trying this and when using adb push to /nand I'm getting back "failed to copy 'recovery.m701.img' to '/nand/recovery.m701.img': Read-only file system"
I'm currently running Haipads 2.2 version and I was looking at testing out CM6 version, but can't seem to get the img file over.
And Ideas?
Click to expand...
Click to collapse
poole699,
I have tried everything you can think of to put CM6 on the 2.2 Haipad firmware (which is really a modded 2.1) and had no luck. Either the system directories are all messed up or they locked the ability to edit it somehow. If you figure it out let me know because i have wanted to try it for a while.
I have a working team telechips 2.2 with market and correct orientation settings but it took ALOT of trial and error. If you go that route make sure you back-up your pointercal file because if you do not you will likely have to go back to an official release, save it, and try the telechips mod again...
Good luck

Clookeno said:
Locobox, there likely isn't a step-by-step guide for the procedure because it has a .bat file which is basically a executable file in windows that runs a set of commands in the DOS prompt for you. Basically you just double click the install_recovery.bat file and it puts the ADB commands in for you to push the recovery image to your tablet.
If you right click the .bat file and click edit you will see the following ADB commands:
adb push recovery.m701.img /nand/recovery.m701.img
adb shell sync
adb shell flash_image recovery /nand/recovery.m701.img
adb shell sync
adb shell reboot recovery
If you are familiar with ADB you can also copy the .img file to your sd card and flash it from there.
i recommend you have root access and the ADB utility.
Sorry it took so long to reply, work has been killing me lately....
Click to expand...
Click to collapse
Thanks again for the info, but I'm not familiar with ADB. The procedure seems difficult for me hope this thread helps a lot of other users!
Again thanks for the response.

M701 Screen Flip
Hi guys, I've got a bit of a problem with my M701 tablet. I did a factory reset the other day and now the digitizer is inverted. The screen works fine but when I touch the top it senses the bottom & left = right.
This is a complete pain in the arse.
I plugged the unit into a keyboard via the usb port as a workaround until I could get into it to try to resolve the issue but I'm now stuck in a loop at the sign in to google bit. Every time I sign in it takes me back to the sign in page.
This is also a complete pain in the arse.
It doesn't have clockworkmod installed and so when I tried to install update.zip as per the above post, it comes up with 'E:Failed to verify whole-file signature' error message and aborts.
Again, a complete... you get the picture...
So, I'm slightly frustrated with it to say the least and was wondering if any of you intelligent types could either point me in a suitable direction that doesn't involve the bin. Or a window...
Many thanks in advance.

Help
Locobox said:
Hi all!
I finally managed to ROOT an aPad M701 using z4Root.apk
Now I want to make an image of my entire ROM tablet, I've heard that under the ROM manager app is a tool called "Flash ClockworkMod Recovery" that has to be installed in order to make a full ROM backup.
The problem is that everytime I try to install it a screen pops out telling me to choose from the list my model of phone (I'm on an aPad tablet), since I'm not on a phone, I'm unable to continue with the process!
Any method or workaround for installing Flash ClockworkMod Recovery on Haipads/aPads M701?
Thanks in advance for the help.
Click to expand...
Click to collapse
How were you able to root your apad with Z4? I was not able to find the setting to activate the USB Debugging?
Thanks,
~b

is there development in the forums for the Apad line? im looking at getting a m702 the next 1 up, well i want to find a tablet rom maybe alowing me to run gingerbread on it,
any help?

ljohnso16 said:
is there development in the forums for the Apad line? im looking at getting a m702 the next 1 up, well i want to find a tablet rom maybe alowing me to run gingerbread on it,
any help?
Click to expand...
Click to collapse
I'm not sure if this of help to you, but I have a M701 2Gb (probable fake version), I've messed around with the basics on my exploring Android type thread:
http://forum.xda-developers.com/showthread.php?t=1004824
I've put recovery on both 2.1 and 2.3 roms (need different versions). Any other q's then let me know, I don't know much yet but learning the best i can.
A very useful place for info on the M701 is here:
http://www.androidtablets.net/forum/groups/11-haipad-m701-m701-r.html

More Detailed Perm Root Instructions

I take no credit whatsoever for obtaining root or anything development related.
I simply took BCNice20's instructions and added more detail for less experienced users. In fact I copied most of this directly from his thread and added more detail.
I take absolutely no responsibility for your phone if you brick it, if it melts, if it sleeps with your wife, or if it burns your house down.
Proceed at your own risk.
If you need to get started with the SDK and ADB start here
Step 1
Temp root your device using Visionary or Z4 (I prefer Visionary)
If you are already temp rooted skip this step
Step 2
Download the file linked at this address http://www.thebcblends.com/shift/Shift-root.zip
Extract the contents to the root of your SD card.
If you are having trouble extracting download 7-Zip
Once installed connect your phone to your computer as a disk drive
right click on the shift-root.zip, select extract here, then use the dropdown to locate your device, more specifically your SD card
Once you have extracted the file to the root of your sd card change your connection type back to charge only
Step 3
If you have followed my other thread you already have adb working
Open the cmd prompt and paste the following
Code:
cd C:\AndroidSDK\platform-tools
hit enter
type
Code:
adb shell
hit enter
you will see this
Code:
$
no type
Code:
su
hit enter
Superuser will prompt you to click allow on your phone. Click it quickly to allow permissions!
Now you will see
Code:
#
you have root permissions.
Step 4
Verifying md5sum
Make sure you copy and paste this exactly
Code:
md5sum /sdcard/Shift/hboot_orig.bin
then hit enter
Your result should look like this 386c19451e8dd18f9b98fad6b11be4c0 hboot_orig.bin make sure the numbers match. You may have some extra path in front of hboot_orig.bin.
Next copy and paste this exactly
Code:
md5sum /sdcard/Shift/hboot_eng.nb0
then hit enter
Your result should look like this 60ec1006e6ec2e8acb370d6aad35b17e hboot_eng.nb0 make sure the numbers match. You may have some extra path in front of hboot_eng.nbo.
If these do not match do not proceed. Delete the file placed on the root of your sd card and repeat step 2 and redownload.
Step 5
Now we're going to flash the eng spl. This is where the unpleasant things can happen.
Make sure you are in adb shell with superuser(root) permission. This was explained in Step 3.
If you are not in adb shell with root permissions then do not proceed. Do not pass go, do not collect $200.
Now DO NOT REBOOT until you are instructed to do so!!
Now paste this exactly into cmd prompt
Code:
dd if=/sdcard/Shift/hboot_eng.nb0 of=/dev/block/mmcblk0p18
and hit enter
You have flashed the eng spl. Now we will make sure it flashed properly.
Step 6
Check the md5 of new flash hboot and restore if necessary
run this command to pull the newly flashed hboot to your sdcard
type
Code:
dd if=/dev/block/mmcblk0p18 of=/sdcard/Shift/hboot_check.nb0
in the command prompt and hit enter
now we check the md5 to see if it matches
Enter
Code:
md5sum /sdcard/Shift/hboot_check.nb0
in the command prompt and hit enter
it should read 60ec1006e6ec2e8acb370d6aad35b17e
if the md5sum matches then congratulations its safe to reboot!! you can skip the next bit and continue on to step 7
if you absolutely cannot get the eng hboot to flash right then run this to restore the stock hboot
Type
Code:
dd if=/sdcard/Shift/hboot_orig.bin of=/dev/block/mmcblk0p18
in the command prompt and hit enter
then pull it to check md5
Type
Code:
dd if=/dev/block/mmcblk0p18 of=/sdcard/Shift/hboot_check1.bin
in the command prompt and hit enter
then check the md5sum
Type
Code:
md5sum /sdcard/Shift/hboot_check1.bin
in the cmd prompt then hit enter
it should read 386c19451e8dd18f9b98fad6b11be4c0
if it doesnt keep trying until it does but DO NOT!! reboot till it matches
Step 7
check hboot and perm root!!
ok now reboot your phone into bootloader
turn off phone and hold power+vol down till it boots into bootloader
look at the top and make sure it says s off
if so reboot the phone back into android
put the phone into airplane mode
Go to setting, applications, manage applications and uninstall superuser
Next temp root with visionary
after you are temp rooted then attempt to perm root with visionary
your phone will reboot and you are now officially perm rooted any changes you make will now stick on reboot
**Edit Recovery Added**
Download ROM Manager from the Market. (Pay for the donate version!)
Open ROM Manger and install recovery.

Im having problems on the CMD prompt. On the command line Im getting C:\users\Dizidi> instead of C:\>. Did I miss a step somewhere?

dizidi said:
Im having problems on the CMD prompt. On the command line Im getting C:\users\Dizidi> instead of C:\>. Did I miss a step somewhere?
Click to expand...
Click to collapse
Nope, that's sounds right.
Next you'll want to
Code:
cd C:\AndroidSDK\platform-tools

dizidi said:
Im having problems on the CMD prompt. On the command line Im getting C:\users\Dizidi> instead of C:\>. Did I miss a step somewhere?
Click to expand...
Click to collapse
You may want to learn some basic DOS commands first. See:
http://www.lsi.upc.edu/~robert/teaching/foninf/doshelp.html#chdir

dizidi said:
Im having problems on the CMD prompt. On the command line Im getting C:\users\Dizidi> instead of C:\>. Did I miss a step somewhere?
Click to expand...
Click to collapse
Type cd\ to get to the c:
The command prompt just started out in your user directory. You can just do the cd\Android......... stuff. Using cd\ it doesn't matter which directory you're in when you start.
Sent from my HTC EVO Shift 4G using XDA App.

Im such a noob, thanks guys. forgot to type in "cd".

Good Job typing this up!
Although I have rooted many phones before through adb it is helpful to see it wrighting in simple English

Thought I'd add that I needed to download an app like BusyBox in order to get md5sum to work.

Getting a lot of PM's for help so I'm bumping this back to page one

Any quick instructions for the 2nd part of that post, installing recovery?

tcd2004 said:
Any quick instructions for the 2nd part of that post, installing recovery?
Click to expand...
Click to collapse
First follow BCNice's instructions for backing up your Wimax Keys. You need to be in adb shell, then paste and enter. That easy!
After that place this file on the root of your sd card.
Disconnect from the computer then power down your shift.
Enter the bootloader by pressing power and volume down. The bootloader should recognize the zip and flash it automatically. Select yes to reboot when prompted.
Connect to your computer and remove the zip from your sd card.
If you want to verify your recovery is now working power down and turn back on by pressing power and holding the volume down button. You should now be looking at Clockwork Recovery.

BrandoKC said:
Enter the bootloader by pressing power and volume down. The bootloader should recognize the zip and flash it automatically. Select yes to reboot when prompted.
Click to expand...
Click to collapse
I'm not sure why, but I cannot for the life of me get this to work.
SD Checking...
Loading PG06IMG.zip
No Image!

idaed said:
I'm not sure why, but I cannot for the life of me get this to work.
SD Checking...
Loading PG06IMG.zip
No Image!
Click to expand...
Click to collapse
Delete the file off of your SD card and follow the instructions included in the Wiki Just download the fastboot file linked in the wiki and put it in the same folder you put adb in.

Thank for this guide!!!!!!!!!!!!!!!

I am now rooted . Thank you BrandoKC. I know you copied the instructions from bcnice20 ( Thank you bcnice20), but you dumbed it down enough for me to get brave. I'm a total noob to Android. It was a bit nerve racking, but I got it on the first shot. Thanks to everyone. Now it's time to OC my Shift .

Is there a video guide to root my shift?
HTC Evo Shift 4G

Thans for the more detailed guide! I'm now permarooted in under an hour
Sent from my PG06100 using XDA App

for some reason.. whenever I do temp root with visionary or z4... It says its rooting.. then my phone "restarts" does the sprint 4g slaph screen and gets stuck on the big 4G logo...
I ran visionary when I first got the shift(temp root to run titanium backup) but now it's not working. anyone know why?

Uninstall superuser, reboot, rerun Visionary
Sent from my PG06100 using XDA Premium App

BrandoKC said:
Uninstall superuser, reboot, rerun Visionary
Sent from my PG06100 using XDA Premium App
Click to expand...
Click to collapse
ah, gotcha. will try thanks.

Root vtab1008 honeycomb (masterkey)

!!!UPDATE!!!!
Sorry I lost my root files. I still have the base code i used to make them. I am trying to work with @saurik to get vtab1008 working with the cydia impactor so that this process will be eaiser. sorry about not keeping up here.
The linux root is still working.
!!!!!!!!!!!!!!!!!!!!!!!!!!!
I was able to get the VTAB1008 HONEYCOMB ROOTED. This device is no longer doomed to a rootless existence.
ROOT AT YOUR OWN RISK! I AM IN NO WAY RESPONSIBLE IF THIS BREAKS SOMETHING.
----WINDOWS ROOT (This worked for me)----
!!Some people have had problems with 64 bit systems.!!
https://dl.dropboxusercontent.com/u/...nys Root.zip (restored by grnsl2)
Download the latest java sdk http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html
(if it installs anywhere but C:\Program Files\Java\jdk1.7.0_45\bin\jdb change the path in the runme.bat)
Setup ADB
Follow instructions at http://www.google.com/url?sa=t&rct=...5IAx2Xg-VjGm5pQ&bvm=bv.57155469,d.cGU&cad=rja
for the inf file use the one in the skinnys root,zip
!!!THIS STEP IS VERY IMPORTANT ^ IF YOU ARE HAVING ISSUES YOU MAY HAVE NOT COMPLETED THIS STEP!!!
Run Exploit
open command prompt (windows 7 type cmd in start menu and press enter)
CD to location you extracted the zip
example: cd "C:\Users\skinny\Downloads\Skinnys Root"
type "runme.bat"
You will see a ton of data on the screen after a minute your tablet will show android.app.Activity
Paste the following into the shell (the prompt should have changed to look like >)
Code:
stop in android.os.MessageQueue.next()
Touch your tablets screen (the prompt should change to <1> main [1]
Paste the following into the shell
Code:
print java.lang.Runtime.getRuntime().exec("/system/bin/sh /data/local/tmp/rootme.sh")
Wait until you see something like Java.lang.Runtime.getRuntime().exec("/system/bin/sh /data/local/tmp/rootme.sh") = "Process[id=1265]"
Code:
exit
Press enter to reboot
----LINUX ROOT----
Get Linux on a live usb stick to run exploit (skip if you have a linux system)
Download 32bit kubuntu from http://www.kubuntu.org/getkubuntu/download
Get a thumbdrive at least 2 gig
Launch unetbootin
Select bubble next to diskimage
Choose ISO
Click on ...
Browse to the kubntu iso downloaded at A.
Set drive to your usb drive letter.
The next step will erase your thumb drive!!!!!
Click OK
Process will complete and ask you to reboot (reboot)
Select the thumbdrive at startup (i don't know what type of computer you are using but most systems you can press f8, f11, f12 or f2 tp get the boot prompt)
(For more information read this guide http://sourceforge.net/apps/trac/unetbootin/wiki/guide)
Select Default at the kubuntu boot prompt
Select Try Ubuntu
Get kubuntu linux setup for the exploit (skip if you already have android tools on linux)
Press alt+f2
Type "konsole" and press enter
Paste the following commands in.
Code:
sudo chown kubuntu:kubuntu /opt
mkdir /opt/exploit/
cd /opt/
wget http://dl.google.com/android/adt/adt-bundle-linux-x86-20131030.zip -O adt.zip
unzip adt.zip
mv adt-bundle-linux-x86-20131030/ adt/
echo 'export PATH=$PATH:/opt/adt/sdk/build-tools/android-4.4:/opt/adt/sdk/platform-tools' >> ~/.bashrc
source ~/.bashrc
sudo su -c "echo 'deb http://ppa.launchpad.net/webupd8team/java/ubuntu saucy main
deb-src http://ppa.launchpad.net/webupd8team/java/ubuntu saucy main' > /etc/apt/sources.list.d/oracle-java.list"
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys EEA14886
sudo apt-get update
sudo apt-get -y install git
cd /opt/exploit/
sudo apt-get -y install oracle-java7-installer
Accept Java license agreement to install java 7
Run Exploit
Plug in your tablet
Enable debugging mode (Settings -> Applications -> Development -> USB debugging)
Paste the following commands in your linux console (if following steps use the konsole that you have been running commands in).
If you are not using /opt/adb/sdk for your android devlopemnt use your dir on the 3rd step
Code:
git clone [url]https://github.com/raymondhardy/mkbreak.git[/url]
wget 'http://goo.gl/Ox8qDx' -O Superuser-3.1.3-arm-signed.zip #thanks to @Munk0
unzip Superuser-3.1.3-arm-signed.zip
cp system/bin/su mkbreak/
cp system/app/Superuser.apk mkbreak/
cd mkbreak
./doit.sh /opt/adt/sdk
You will see a ton of data on the screen after a minute your tablet will show android.app.Activity
Paste the following into the shell (the prompt should have changed to look like >)
Code:
stop in android.os.MessageQueue.next()
Touch your tablets screen (the prompt should change to <1> main [1]
Paste the following into the shell
Code:
print java.lang.Runtime.getRuntime().exec("/system/bin/sh /data/local/tmp/rootme.sh")
Wait until you see something like Java.lang.Runtime.getRuntime().exec("/system/bin/sh /data/local/tmp/rootme.sh") = "Process[id=1265]"
Code:
exit
Press enter to reboot
If you get stuck at any part of this process please post a reply with information about the problem you are having.
PROOF OF ROOT
Thanks and credit goes out to.
robertmillan
Jay Freeman (saurik)
PoC by Pau Oliva
Vinogans for leading me to masterkey exploit

NICE!!! Any instruction changes for windows?

gnoober said:
NICE!!! Any instruction changes for windows?
Click to expand...
Click to collapse
Not yet i suspect someone will make a better root later on as of now this is linux only. This exploit uses of linux commands for injecting code into a system application to gain root.

I will be updating the first post later on with steps and screenshots on how to do this on a ubuntu live instance (I may even throw in a shell script so you run it and then wait forever while it does the setup and starts the root. I will see what i can do.)

skinnyquiver said:
I will be updating the first post later on with steps and screenshots on how to do this on a ubuntu live instance (I may even throw in a shell script so you run it and then wait forever while it does the setup and starts the root. I will see what i can do.)
Click to expand...
Click to collapse
Awesome! Nicely done! Guess I'm gonna have to dig out the VTab and give this a shot. Thinking it's gonna need a charge!
Sent from my LG Optimus G using Tapatalk

I updated the steps and re-rooted my tablet with them several times to verify that they worked. Let me know if they work for you
dandrumheller said:
Awesome! Nicely done! Guess I'm gonna have to dig out the VTab and give this a shot. Thinking it's gonna need a charge!
Sent from my LG Optimus G using Tapatalk
Click to expand...
Click to collapse

gnoober said:
NICE!!! Any instruction changes for windows?
Click to expand...
Click to collapse
Got this working on windows (does not look very pretty but it works.

Hey skinnyquiver, that is awesome... my vtab has already gained like 5mm of pure dust. However, i gonna digg it out these days, install stock recovery to update it to honeycomb finally and then reroot this thing...
Btw, the paragraph above windows instructions still says linux only...
_________________________
tapatalked from GalaxyS3

FadeFx said:
Hey skinnyquiver, that is awesome... my vtab has already gained like 5mm of pure dust. However, i gonna digg it out these days, install stock recovery to update it to honeycomb finally and then reroot this thing...
Btw, the paragraph above windows instructions still says linux only...
_________________________
tapatalked from GalaxyS3
Click to expand...
Click to collapse
try to root it with master key exploit I am talking about the the version .57 .. then before updating to honeycomb grab the update.zip the one that belong to honey comb ... try to do this

vinogans said:
try to root it with master key exploit I am talking about the the version .57 .. then before updating to honeycomb grab the update.zip the one that belong to honey comb ... try to do this
Click to expand...
Click to collapse
i am currently charging... my device is rooted with frozen updater, firmware is currently 1.9.56 so i am not sure what is the update path, will i get the honeycomb firmware immediately or do i have to update to .57 first?
_________________________
tapatalked from GalaxyS3

FadeFx said:
i am currently charging... my device is rooted with frozen updater, firmware is currently 1.9.56 so i am not sure what is the update path, will i get the honeycomb firmware immediately or do i have to update to .57 first?
_________________________
tapatalked from GalaxyS3
Click to expand...
Click to collapse
u will have to update to .57 then u will get honeycomb update ..

vinogans said:
u will have to update to .57 then u will get honeycomb update ..
Click to expand...
Click to collapse
Thats bad, but i will give that a try. However, i cant promise that i will succeede and it will take me some days as i am quite busy with my real life as well
_________________________
tapatalked from GalaxyS3

So it's certainly exciting to see root for this guy after owning it now for a couple of years.
I believe with root we'll be able to get rid of some bloat and stuff unneeded but I'm assuming we'll stay on Honeycomb.
I'd like to figure out what the real upside to this is.
Sent from my DROID RAZR HD using Tapatalk

grnsl2 said:
So it's certainly exciting to see root for this guy after owning it now for a couple of years.
I believe with root we'll be able to get rid of some bloat and stuff unneeded but I'm assuming we'll stay on Honeycomb.
I'd like to figure out what the real upside to this is.
Sent from my DROID RAZR HD using Tapatalk
Click to expand...
Click to collapse
You should be able to use this root with the 5.7 before going to honeycomb. This way you can have gingerbead rooted if your device came with the 5.7 update. I would like to get this running cm9 or cm10. The first problem with this is it will require a new kernal. I am going to be moving this weekend so it will be a while until I can get a build env to work on this. I plan on using this tablet to learn all about android rom making. Hope I don't brick it.

As Vizio has not released the kernel source I think we may want to look at using the xo-3 kernel.

Everything seems like it works, everything says 'success', but root checker is showing no root. I had force closes on the System UI before rebooting it a second time.
I tried it straight from a factory reset, just to be sure, same issue.I'm on 3.2.1 on this Vtab.
Not sure what is missing? Anything I should check?

unqualified said:
Everything seems like it works, everything says 'success', but root checker is showing no root. I had force closes on the System UI before rebooting it a second time.
I tried it straight from a factory reset, just to be sure, same issue.I'm on 3.2.1 on this Vtab.
Not sure what is missing? Anything I should check?
Click to expand...
Click to collapse
What os do u use? Check if adb is working
_________________________
tapatalked from GalaxyS3

unqualified said:
Everything seems like it works, everything says 'success', but root checker is showing no root. I had force closes on the System UI before rebooting it a second time.
I tried it straight from a factory reset, just to be sure, same issue.I'm on 3.2.1 on this Vtab.
Not sure what is missing? Anything I should check?
Click to expand...
Click to collapse
I had this problem also in the first time .. try to check if java is installed and working well .. try to check if ADB driver is identified on ur pc ..
I am thinking it is just a java problem .. did u type the commands in the shell " just wondering " this will not work if u didnt type the commands and follow the steps ..

vinogans said:
I had this problem also in the first time .. try to check if java is installed and working well .. try to check if ADB driver is identified on ur pc ..
I am thinking it is just a java problem .. did u type the commands in the shell " just wondering " this will not work if u didnt type the commands and follow the steps ..
Click to expand...
Click to collapse
Thanks for all the suggestions! I was surprised so many people responded on such a forgotten tablet.
I did enter the two commands in the shell (copied and pasted the exact commands) at the appropriate times, and they appeared to work.
I wasn't able to do the ADB setup exactly per the link on the OP, because my computer already recognizes the VTAB1008 under debugging mode, and runs ADB. If I try to uninstall and manually install the generic driver from the Skinny Root zip, it re-discovers and says the current driver is 'more current'. However, since 'adb devices' recognizes the vtab, and all the commands appear to be working, I should be good to go with ADB, right? Or is the generic driver from the Skinny Root zip file a critical component?
I also uninstalled Java SDK for x86 and re-installed for 64 just in case, but that didn't fix it.
Also tried disabling antivirus, no luck...
Is there a basic way to check whether java is working correctly? Or to read the java output as it is running the commands? Maybe something would show up there.
Thanks again

Do u see superuser app installed? If so, what does it output when you open it?
_________________________
tapatalked from GalaxyS3