Database Info

[GUIDE] Rooting and flashing your patched Hero. (Windows) [Updated: 12/19]

Constructive criticism is welcome.
This is my first guide and it's quite late here so I'm going to go through this lightly first, and more in detail later.
Note: I am NOT responsible for any damage your phone may or may not receive. It is your fault for following this guide, not my fault for writing it. Just for the sake of saving you from a headache, I would recommend backing up your contacts before starting this guide.
Phase 1: Prepping your CDMA Hero for rooting/flashing.
1. Ensure that USB debugging and installing apps from unknown sources is enabled. You can do this by going into Settings> Applications Check unknown sources. From there go into Development and ensure that "Enable USB debugging" is checked.
2. Mount your SD card on your computer by plugging in the USB cable, and dragging down the notification area. BACKUP YOUR DATA! ALWAYS!
3. After your data is backed up, Safely remove hardware (I find it annoying to get the "this disk may contains errors" every time i plug it in) your Hero. Using your notification area, unmount your SD card.
4. On your hero, navigate to Settings> SD card and phone storage> unmount SD card. Then format your card. It should Auto re-mount after this.
5. Download FlashRec (great tool!) and Amon-RA's recovery image. Place them onto the root of your SD card (not in any folders, just drag and drop them.) Unmount your SDcard.
6. I used Linda File manager (from the market), but you can use one of your choice. Navigate to the root of your SDcard (you'll probably start there, if you dont just click sdcard.) Open flashrec with the installer, and wait until it's finished.
7. Open FlashRec, and attempt to make a backup (i simply named mine "/sdcard/backup"). If it success proceed to the next step. if not, refer to post 2.
8. In FlashRec, type "/sdcard/recovery-RA-heroc-v1.5.2.img" without the quotes. Linux is Case-sensitive, so the capital letters have to be included. tap "download recovery image". Wait for it to finish, when it does reboot into recovery mode by powering off your phone. After it's off, hold HOME and the power button. You should see some green text on a black background.
9. First things first, Make a nandroid backup. It can, and will save your ass at some point in time. Before you flash ANYTHING to your phone, ALWAYS do a nandroid backup. Congratulations, you can now flash a custom ROM!
Phase 2:Flashing your custom ROM
Since I love Flipz and his work so much I'll be using his ROM in my guide (let me know if you have a problem with it Flipz).
0. Do a nandroid backup before you even think about downloading a ROM
1. Download Fresh 1.0.
2. Do not unzip it, leave it as it is and copy it to the root of your SD card. You can do this either from recovery mode (by enabling usb mode) or through the notification bar. Proceed to recovery mode by holding HOME+END CALL (or just disable USB mode) and select "flash update from .zip" Select the Fresh ROM and wait. It should automatically reboot after it finishes installing.
3. Be patient while it's booting, it took me about 5 minutes for the first boot, after that it gets much faster. Once it loads, everything should be all fine and dandy. If it's not, well aren't you glad you made your backup? Just proceed back into recovery and do a nandroid restore.
4. You can now delete all those .apks and .zips and whatnot. Mount your SD card on the computer, and move your backed up files back onto your card.
5: Enjoy! If you don't like the clear lock, Flipz has a patch on his website (geekfor.me) to replace it with a clear screen. This should keep all of your contacts and settings in place, but I make no promises.
Sources:
The Unlockr

How to unpatch your Sprint CDMA Hero.
Phase 1: Installing the SDK/Drivers
1. Download the SDK from Google. Create a folder at the root of your C:\ drive called android (it doesn't have to be your C:\, you can put it anywhere, but this guide will use "C:\android" as it's path.)
2. If using Windows Vista or earlier, proceed to the next step.
3. Download the driver for your system.
Windows 7 32Bit
Windows 7 64bit
To find out which drivers are right for your system, go into your control panel, and change the view type to small icons. Click on system, and check and see if it says 64-bit Operating System or 32-bit Operating System. Extract the contents into:
C:\Program Files (x86)\HTC\HTC Driver\Driver Files\Vista_x64 (for the Windows 7 64-bit)
or
C:\Program Files (x86)\HTC\HTC Driver\Driver Files\Vista_x86 (for the Windows 7 32-bit)
4. If you have not plugged your Hero into the computer yet, it's as simple as navigating to where you extracted the contents of the archive, and right clicking androidusb.INF (should be the second from the top) and clicking install.
5. Ensure that USB debugging is enabled by navigating to Settings>Applications>Devolopment. If it does not have a check next to it, tap it. Plug your phone in and wait for the drivers to install.
6. In Windows, navigate to the command prompt.
XP: Start>run type "cmd" and press enter.
Vista or later: Start/"orb" in the search box right above it, type "cmd" and press enter.
if you see a window pop up with "C:\Windows\system32\cmd.exe" if you have done this correctly.
7. type "cd \android\tools" and press enter. now type "adb devices". It should start a daemon, and show you a series of numbers. If it does, then congratulations! your drivers are installed properly! I'll come back and add later how to reinstall the drivers if they do not install correctly.
Phase 2: Unpatching your Hero
Ensure that you have an adaptor to plug your SDcard into your computer. I didn't use an adaptor when i did this, but I highly recomend it just to make things easier. If your phone or SDcard or computer or toaster blows up, catches fire, shoots lazer beams and burns your curtains, or causes any damage to your or anything else I take no responsibility.
1. Backup all of the data from your memory card onto your computer. Navigate to Settings> SD and phone storage. Unmount your SD card and format it.
2. Go to Settings> Applications> Devolopment and ensure USB debugging is enabled.
3. Open command prompt, as you did in Phase 1, and navigate to "C:\android\tools". Type "adb shell" and press enter. Now you're in your phones console. Type "cat /sys/class/mmc_host/mmc1/mmc1:*/cid"
4. Copy down the code you get EXACTLY. Double, triple, and qraduple check. If the code is wrong, you may destroy your SD card.
5. Reverse the code.
Example:
123456789
Would become
987654321
6. replace the first two numbers/letters with zero zero. (007654321). Now on your PC, navigate to Here. Copy the number (with the zeros in place!) to the box that says CID. Click continue and wait for the email with your goldcard key. Save it to your computer.
7. Download this hex editor and install it. run it (requires administrative priveledges), and put your SDcard into your computer, or mount your SDcard.
8. In the hex editor, click on the extra tab, and open both your SDcard and the Goldcard you downloaded earlier. Ensure that "Open as read only" is unchecked when you open your SDcard. Sector size should be at "512 (Hard Disks/Floppy Disks)".
9. Go to the Goldcard tab, and press Ctrl+A to highlight all of it, then press Ctrl+C to copy it. Go to your SDcard tab, and select from 00000000 to 00000170. Now click on the edit>paste write.
10. click File>save. Remove and replace your SDcard, or unmount and remount your phone. If you can navigate into the drive, congratulations you have a Goldcard.
Phase 3: Downgrading your Hero.
1. Download the1.29 RUU. Plug your phone into the USB port with your goldcard inserted. Have your phone powered on when you do this, and ensure that it is not locked.
2. Ensure that you have HTC Sync installed, and that it connects to your phone.
3. Run the RUU and wait for it to finish. After it is finished, proceed to post 1.

If we simply want to upgrade to a different ROM or the new 1.5.2 recovery.img then can we simply pick up on your instructions from that point??
Thanks for your post. The only thing I think you are missing (for a totally new user doing this) is explaining how to boot into recovery mode when you are ready to flash the new ROM.
There is one other thing that I think would be great to have added to a post like this and that is an explanation of how to restore your programs after flashing a new ROM. Do you just reinstall them or is there a way to restore files and be able to keep your screen looking mostly the same?

Whats up with the Moto Droid? When are ROMS going to be pushed? and are you going to wright and Guide for Droid like this one?

saintirish said:
If we simply want to upgrade to a different ROM or the new 1.5.2 recovery.img then can we simply pick up on your instructions from that point??
Thanks for your post. The only thing I think you are missing (for a totally new user doing this) is explaining how to boot into recovery mode when you are ready to flash the new ROM.
There is one other thing that I think would be great to have added to a post like this and that is an explanation of how to restore your programs after flashing a new ROM. Do you just reinstall them or is there a way to restore files and be able to keep your screen looking mostly the same?
Click to expand...
Click to collapse
As far as I know, you just have to reinstall your programs. This guide will also work for loading ROMs other then Freshhh, but some ROMs require you to do a wipe before you install them. Check to see if that specific ROM requires a wipe before doing an install. Yes, I have used this method to upgrade from RA's 1.2.3 to 1.5.2 with no problems.
@_Chris_Kirkland said:
Whats up with the Moto Droid? When are ROMS going to be pushed? and are you going to wright and Guide for Droid like this one?
Click to expand...
Click to collapse
I have no idea about Droid modding, as I don't have a Droid. I'm not to fond of the idea of writing a guide for a phone I don't have because I wouldn't be able to verify that it works with minimal problems.

Alright, I've completed the basics of how to do this. I'll add a problems and solutions section once people start having problems.

great job, this should help folks out a good deal.

That's my intention. Just trying to make things easier for those who aren't so good with the console. I think I'm gonna go ahead and do the Win7 driver workaround now.

In step 8 of the guide I can follow along up to step 8 but when I type in the text I don't see the download option.

jfoster38122 said:
In step 8 of the guide I can follow along up to step 8 but when I type in the text I don't see the download option.
Click to expand...
Click to collapse
You're talking about the FlashRec step right?
Could you tell me exactly what you can see?

So this is probably an obvious question, but I apparently not to me, but is the guide to perform a downgrade for people who have not rooted and flashed their phone? Because I was able to downgrade to 1.29 ruu after having flashed my phone with Fresh 1.0, is it because I flashed a custom rom that I could downgrade to 1.29 or is there something different now?

mark920 said:
So this is probably an obvious question, but I apparently not to me, but is the guide to perform a downgrade for people who have not rooted and flashed their phone? Because I was able to downgrade to 1.29 ruu after having flashed my phone with Fresh 1.0, is it because I flashed a customer rom that I could downgrade to 1.29 or is there something different now?
Click to expand...
Click to collapse
This is a guide to try and simplify patching, but it also covers a section on how to downgrade a phone that Sprint/HTC patched so that the 1.29 RUU method wouldn't work.

How does someone get a phone that was patched by sprint/htc to not allow the 1.29ruu to work on the phone?

mark920 said:
How does someone get a phone that was patched by sprint/htc to not allow the 1.29ruu to work on the phone?
Click to expand...
Click to collapse
Ether get a newer Hero, or run the software update in the phone. I ran the software update >_>

abcdfv said:
You're talking about the FlashRec step right?
Could you tell me exactly what you can see?
Click to expand...
Click to collapse
Once I enter the recovery image in, the 2 options are "Flash Recovery Image" and "Restore Backup Image"
There's no download recovery image option.
- JustPyro

It may have been updated since I used it... I'll look into it
EDIT: Click on FlashRecovery image.

Excellent work! I just want to let you know that the link for the RUU 1.29 does not work (at least for me). Great guide though.

Link updated.

OBSOLETE.

I've combined toastcfh's and TheBiles how-to's in this tutorial, so if you've already rooted using TheBiles previous method, skip to step 9. I'll make this a bit more presentable when I get home from work today. I just thought this would be helpful to those who aren't comfortable with using adb.
I'm not responsible for damages to your phone, yada yada yada, you know the drill.
IF YOU HAVE A PROBLEM THAT HASN'T BEEN ADDRESSES IN THE SECOND POST, LET ME KNOW. OTHERWISE, SEE SECOND POST FOR FAQ'S. Follow these directions exactly as they are written and you won't run into any snags. It'll save us both a lot of time.​This tutorial entails making the root process as fast and easy as possible, that means we won't be backing up any of your stuff (you can if you want, of course) nor will we be doing a nandroid backup, and even better, we won't be using adb to push files. With that being said, let's get started.​
Step 1. Connect your phone to your pc via usb, then pull down the notification bar at the top of your screen and open the tab that says Charge Only and select Disk Drive then click done.
Step 2. Download this file http://link.geekfor.me/rootedromzip and put it on the root of your sd card by going to the start menu of your computer and opening up My Computer, then drop the file into the icon that reads Removable Disk. This is the root of your sd card. Remember that if you don't already know.
Step 3. Right click on the Removable Disk icon and select Eject. We're gonna flash the debug image now, say goodbye to any pic's, music, apps, texts, etc that you may have.
Step 4. Power down your phone.
Step 5. Hold down the volume down and power key simultaneously and keep holding it down until you see 3 android dudes on skateboards.
Step 6. It's going to give you some options, whether or not to install the PC36IMG.zip, select yes (volume up is yes) for any prompt you get.
Step 7. Once you've rebooted you will officially have root access. Congrats, but that's not all. There's a few more steps to gain -full- root access.
Step 8. Navigate to the root of your sd card and rename the PC36IMG.zip file whatever you want, doesn't matter. Just don't name it update. To rename the .zip file, right click on PC36IMG.zip and select rename.
Step 9. Download these files:
PC36IMG.zip -http://sdx-downloads.com/sdx/evo/troot/eng-PC36IMG.zip
mtd-eng.zip - http://forum.xda-developers.com/attachment.php?attachmentid=342668&d=1276481802
flash_image.zip - http://forum.xda-developers.com/attachment.php?attachmentid=342667&d=1276481776
recovery.img - http://files.androidspin.com/downloads.php?dir=amon_ra/RECOVERY/&file=recovery-RA-evo-v1.7.0.1.img
PLEASE NOTE SOME OF THE MIRRORS YOU ARE DOWNLOADING THESE FILES FROM ARE NAMED SOMETHING DIFFERENT, SO YOU WILL HAVE TO RENAME THEM ACCORDINGLY. The only one that I know of was the PC36IMG.zip file, it was named something else when I downloaded it. So name it accordingly. Right click, select Rename, then type in "PC36IMG" only, your pc adds the .zip.
Step 10. Extract the flash_image.zip and mtd-eng.zip files, do so by right clicking on them, then select Extract To flash_image\ and Extract To mtd-eng\ Open the newly extracted folders and take the flash_image file AND the mtd-eng file inside and drop them into the root of your sd card. (we remember how to do that, don't we.)
Step 11. Open up the Android Market and download the terminal emulator app by Jack Palevick, it's free.
Step 12. Make sure your sd card is no longer mounted to the computer, do so by pulling down the notification bar and switching Disk Drive to Charge Only.
Step 13. Open the terminal emulator app and type in these commands exactly as they are written. If you get an error, try again.
Note: After each line is completed, hit enter. A # sign means you've run the commands successfully.
Code:
[B]su
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/mtd-eng.img[/B]
Step 14. Remount your phone, and drop the PC36IMG.zip file onto the root of your sd card. MAKE SURE YOU USE THE CORRECT PC36IMG.ZIP FILE THAT YOU DOWNLOADED FROM STEP 9. Power down your phone.
Step 15.
Hold volume down and power to boot into hboot.
- It should now find and verify the PC36IMG.zip on the root of your sdcard. It'll show a blue status bar on the top right of the screen.
- After a minute or so it will ask u if u wanna flash Select YES.
- After it flashes the PC36IMG.zip it will ask if you wanna reboot. Select YES.
Click to expand...
Click to collapse
Step 16. Once your phone has rebooted, put the recovery.img file you downloaded earlier on the root of your sdcard.
Note: If the recovery image is named something other than "recovery.img" then rename it by right clicking and typing in "recovery" as the name.
Step 17. Still know how to use terminal emulator? Open it up and type in these commands. Make sure your USB connection is in Charge Only mode first.
Code:
[B]su
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery.img[/B]
*INTERMISSION*
Take uh break, eat uh cookie.
If you've made it this far and you've had no errors, then you now have full root access as well as a legit recovery.
Time to flash a ROM and the latest radio.
Step 18. Power down your phone and power it back on by holding down the Volume Up and Power key.
Step 19. Select BOOTLOADER then select Recovery.
Step 20. Select Wipe: Select wipe data factory reset then select wipe dalvik cache.
Step 21. Downlaod any ROM you'd like, I'm running BuglessPete's Bugless Beast ROM, here's the link if you want to run this one as well http://bit.ly/az4cWq
Step 22. Download the latest radio here http://link.geekfor.me/radio139000531
Step 23. In recovery mode, select the USB-MS toggle option, this mounts your sd card to your pc.
Step 24. Move your newly downloaded ROM and radio to the root of your sd card by dropping them onto the Removable Disk icon on your computer.
Step 25. Press the power key to disable USB-MS toggle.
Step 26. Select Flash Zip From Sdcard.
Step 27. Select the ROM you downloaded and you will be prompted whether or not you want to flash the file, follow through with the power key.
Step 28. Select flash zip from sdcard, then select the latest radio .zip file that you just downloaded and flash that mf'er.
Step 29. Try not to freak out when you see a static image of a phone with green arrows circling around it. Wait...
Step 30. Select Reboot System Now.
And that's it, you're done!
ALL CREDIT GOES TO THESE GUYS! toastcfh, keishou, maejrep, Paul, Amon_Ra, Koush, TheBiles, and anybody else I forgot.
Grammatical errors? I just worked a 12 hour shift and got right on this, I have to be in bed in about an hour, so **** you.

Problems flashing a ROM after you've completed the process?
This is more than likely on account of the Dev who made the ROM not signing it, tell them if they sign it that you'll love them forever. Or switch to Koush's recovery. This is pretty much guaranteed to work, as Koush's recovery has a toggle signature verification feature. http://forum.xda-developers.com/showthread.php?t=702214 Or, if you've the know-how, sign it yourself. http://forum.xda-developers.com/showthread.php?t=473580
ATTENTION: To the few getting the not enough space error when flashing the recovery image, Amon Ra has addressed the issue here, to no avail according to those who have tried his alternative recovery. At least we now know what the cause of the error is. Thanks again, Amon Ra.
Amon_RA said:
You have a bad block in your recovery (like a bad sector on your harddisk), these bad blocks are skipped when flashing. A bad block means you have less usable space on your recovery partition, hence the not enough space left to flash this recovery...
I made this recovery specially for you, it's 1MB less than the normal recovery (left out the evo charging stuff), all functions of the normal recovery should still work. Could you please give it a try and let me know?
Code:
fastboot flash recovery tiny-recovery.img
OR
flash_image recovery /sdcard/tiny-recovery.img
Click to expand...
Click to collapse
Bad block? Not enough space on sd error when trying to flash the recovery image? Try these.
Amon_RA said:
Could you please try to flash recovery-RA-evo-v1.7.0.2.img and use fastboot to flash :
Code:
fastboot erase recovery
fastboot flash recovery recovery-RA-evo-v1.7.0.2.img
I'll most likely not make my recovery compatible with Koush's rommanger because I would need to almost rewrite it fully.
Click to expand...
Click to collapse
tlisak25 said:
If people are still having problems tell them to unroot and start from scratch without doing system update from Sprint thanks for all or your help
Click to expand...
Click to collapse

In on this.
Will try this out right now and edit my post later.
[Edit]
Oh, so the only difference is instead of using ADB you're using the "terminal emulator" app.
It's a good guide and am sure it works. But if you know how to use ADB, I'd actually prefer ADB. It's much easier to type on your keyboard.
But GREAT guide none-the-less. For people who don't know how to use ADB.

It's not so much that people can't fiure out how to use ADB as it is they can't figure out how to install and run it. Even when I first got into Android I had no clue it was used through a cmd prompt for the first 2 weeks.

arozer said:
In on this.
Will try this out right now and edit my post later.
[Edit]
Oh, so the only difference is instead of using ADB you're using the "terminal emulator" app.
It's a good guide and am sure it works. But if you know how to use ADB, I'd actually prefer ADB. It's much easier to type on your keyboard.
But GREAT guide none-the-less. For people who don't know how to use ADB.
Click to expand...
Click to collapse
Exactly. Also, it's for those who rooted using TheBiles Idiot Proof method and were confused as to whether or not they could follow through with toastcfh's part 2nd part on gaining full root access.

Re: (How-To) FULL ROOT WITHOUT ADB.
ADB is just easier, in my opinion. I like bring able to easily copy and paste and type with a real keyboard. Plus, it's just good to know how to use. Not that I don't use the terminal on the phone, though! BTEP, for the win.
-------------
Sent from my HTC EVO 4G using Tapatalk Pro.

TheBiles said:
ADB is just easier, in my opinion. I like bring able to easily copy and paste and type with a real keyboard. Plus, it's just good to know how to use. Not that I don't use the terminal on the phone, though! BTEP, for the win.
-------------
Sent from my HTC EVO 4G using Tapatalk Pro.
Click to expand...
Click to collapse
Totally agreed. But this method is meant to make rooting as fast and easy as possible (for those who don't know how to neither set up, nor use adb, as setting it up as well as familiarizing yourself with it takes time) Although learning adb is a definite must.

i'm a "noob" and ive had my evo since the release and have been tring to acomplish full root without any luck using adb bs this is the easiest most well explaid way to do so and i am more greatful than words could express. if i can find a way to donate with out a credit card i will gladly help ur cause keep up the great work

bdd123456789 said:
i'm a "noob" and ive had my evo since the release and have been tring to acomplish full root without any luck using adb bs this is the easiest most well explaid way to do so and i am more greatful than words could express. if i can find a way to donate with out a credit card i will gladly help ur cause keep up the great work
Click to expand...
Click to collapse
I'm just glad it helped. Lol If there's anyone you should donate to, it's toastcfh. Without him, we wouldn't have root.

The download link for the PC36IMG.zip in step #9 is broken...I am assuming that the PC36IMG.zip in step 9 is different than the PC36IMG.zip in step 2. If its no different, then I will just proceed downloading the rest of the files and go from there, but If so can I get a mirror link?

nol3n said:
The download link for the PC36IMG.zip in step #9 is broken...I am assuming that the PC36IMG.zip in step 9 is different than the PC36IMG.zip in step 2. If its no different, then I will just proceed downloading the rest of the files and go from there, but If so can I get a mirror link?
Click to expand...
Click to collapse
Just a second, I'll get you a link.

the recovery.img link in step #9 is broken as well...

nol3n said:
The download link for the PC36IMG.zip in step #9 is broken...I am assuming that the PC36IMG.zip in step 9 is different than the PC36IMG.zip in step 2. If its no different, then I will just proceed downloading the rest of the files and go from there, but If so can I get a mirror link?
Click to expand...
Click to collapse
http://www.joeyconway.com/sdx/evo/troot/eng-PC36IMG.zip
Got it from toastcfh's thread. Should work. I'll update the link now.

Go damn it. -.- I'll update them all now. Thanks for the heads up.

thx for the hard work.

Lol Not really doing much but stealing links. They're all updated now.

evo root
I did the idiot guide but cant get ADB working on my windows 7. Should I go ahead and try this? Thx!

crpercodani said:
It's not so much that people can't fiure out how to use ADB as it is they can't figure out how to install and run it. Even when I first got into Android I had no clue it was used through a cmd prompt for the first 2 weeks.
Click to expand...
Click to collapse
Exactly! It took me 2 solid days of searching for the required driver for my laptop. I finally got it to work last night. None of the instructions on xda worked. The USB remover listed here didn't work, the driver in the SDK kit didn't work, nothing worked. I finally found another download for the USB remover and another link to a 32-bit driver that finally worked.

kevinniven said:
I did the idiot guide but cant get ADB working on my windows 7. Should I go ahead and try this? Thx!
Click to expand...
Click to collapse
It's pretty much the fastest/easiest (if you don't have adb set up) way to get full root access on your Evo, so...yes, that'd be a good idea. Lol

S
kevinniven said:
I did the idiot guide but cant get ADB working on my windows 7. Should I go ahead and try this? Thx!
Click to expand...
Click to collapse
Oh yeah, start from step 9 since you're coming from the first part of TheBiles Idiot Proof guide.

[GUIDE] How to root Android 2.2 on the EVO 4G Outdated

The rooting method for the EVO 4G is close to the same as the Droid 2, just recently created by Sebastian Krahmer at http://c-skills.blogspot.com/, but with a little variation.
Here is the step-by-step I just did on my brother's (dwizzy130) EVO 4G that came with 2.2 from Sprint.
I am NOT responsible for any damages (bricking, not working, basically anything that goes wrong) This has been tested and works. Over the next few days, I will be cleaning this post up and making the steps more clear.
Special thanks to:
Sebastian Krahmer for the exploit
dwizzy130 (my brother) for letting me test on his EVO (since I don't have one)
The unrevoked team for their methods
Toastcfh for his mtd-eng.img
Topgun966 over at evo4g.me for hosting the files
djR3Z over at TheDroidDemos.com just made a GREAT video walkthrough that should make this MUCH easier for all of you. He spent a TON of time making it yesterday, so please give him lots of thanks!
VIDEO WALKTHROUGH (2 parts)
Make sure your phone is unplugged from your computer until I tell you to plug it in!
If you already have the Android SDK and HTC Sync set up on your computer, skip to Step 4 now
Step 1: Download the Android SDK here
Step 2: Extract the Android SDK zip. Move the contents of the extracted zip to C:\
Your Android tools folder path should now be C:\android-sdk-windows\tools
Step 3: Download HTC Sync 2.0.40 here
Run the installer. Move on once installed. If reboot is required, do so and then move on.
Windows 7 Users:
Go to your start menu, then control panel. When that is open, (if you are in category view mode) click on "Uninstall a program" and then choose HTC Sync to uninstall. If you are in Icon view mode choose "Programs and Features" and then click on HTC Sync to uninstall. This will load the proper drivers needed for unrevoked3.
Other Windows Version Users:
Go to your start menu, then control panel. When that is open, select Add/Remove Programs, and then choose HTC Sync to uninstall. This will load the proper drivers needed for unrevoked3.
Next,
Download my evo-root.zip.
It contains a few files necessary to root the EVO.
Unzip the contents of the zip to your android sdk tools folder.
Download the unrevoked-forever.zip
Place this zip in your tools folder as well, as a zip, not extracted.
Download this PC36IMG.zip || Mirror(This is the same as running an RUU, so it will delete all of your user data when we use it later in the guide, so backup everything you want to save on your phone first)
MD5: e52f6ec4f8f5fd6dc251ef19ee19750b
Put this zip in your sdk tools folder as well, as a zip, not extracted.
After unzipping the contents of evo-root.zip to your android sdk tools folder and placing the PC36IMG.zip and unrevoked-forever.zip in the folder, move on.
Step 4: Make sure USB Debugging is ON (checked) on your EVO. Go to Settings > Applications > Development > and make sure it is checked.
Step 5: Plug your phone into the computer via USB, Make sure that the connection type in the Notification Pull-Down Bar is "Charge Only", not "Disk Drive" or else this won't work.
If your computer asks you to restart after the new drivers were installed, do that now.
Step 6: Open up a command promt from your android-sdk/tools folder.
Windows 7 users:
Open up the android sdk folder and hold shift and right click on the tools folder. You will see an option that says "Open command window here" Choose that one and you will be set. the command prompt should read something like C:\android-sdk-windows\tools>
Other Windows Version Users:
Go to the start menu, go to All Programs, then Accessories, and click on command prompt. Once open type
Code:
cd C:\android-sdk-windows\tools
Once ready, type these commands in cmd prompt from your adb tools directory. After every line press enter.
Code:
adb push unrevoked-forever.zip /sdcard/
adb push flash_image /data/local/
adb push rageagainstthecage-arm5.bin /data/local/tmp/
adb push mtd-eng.img /sdcard/
adb push PC36IMG.zip /sdcard/
Note: the PC36IMG.zip will take longer than expected to transfer to the sdcard. It is a BIG file.
Now we chmod a few things. After every line press enter. It should repeat what you typed in and then return you to a blank line with an $ for everything in adb shell
Code:
adb shell
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
chmod 0755 /data/local/flash_image
Ok now for the root shell.
*
(still in adb shell)
Code:
cd /data/local/tmp
Code:
./rageagainstthecage-arm5.bin
You will now see some text on your cmd prompt screen explaining the exploit.
Wait for the adb shell to go away, and it will dump you into your windows command prompt again (no shell) should look something like this:
C:\android-sdk-windows\tools>
Once that dumps you out of the shell, type
Code:
adb shell
and you will see you now have a
Code:
#
instead of
Code:
$
now type
Code:
cd /data/local
./flash_image misc /sdcard/mtd-eng.img
that will flash your misc partition with Toast's mtd-eng.img.
This should return you to a blank line with #.
If you get an "Out of memory error" with a huge list of weird lines, here's how to fix it.
Reboot your phone normally.
Open a command prompt and go backwards in this guide until you see the big red * and start from there.
Once it is flashed correctly, move on:
Type
Code:
reboot bootloader
Remember how you pushed that huge PC36IMG.zip to your sdcard earlier? This is where that comes in handy. Once you booted into hboot, Select "bootloader" with your volume up/down buttons and hit the power button. Let it sit for a little bit while it loads the PC36IMG.zip. This can take up to 5 minutes. When it finally asks if you want to apply this zip, choose YES. (Remember, this is the same as running an RUU, so it will delete all of your user data).
If this doesn't work (ie the PC36IMG.zip does NOT load) backup all of your sdcard contents onto your computer, reformat your sdcard to FAT32, redownload the PC36IMG.zip, and drag and drop it onto the sdcard, then reboot into the bootloader and try again. This should fix the issue.
Once it is finished, select restart. You now are on the stock 2.1 build of Android.
Next step, mount your sdcard on your computer, and delete the PC36IMG.zip from it. This is because the next step requires using hboot, and you don't want to sit and wait while it loads up again, just for you to say "no" to the install. Please follow this step, for it saves 5-10 minutes of waiting ahead.
I worked extensively with Matt Mastracci, so this rooting guide will use the unrevoked method to root 2.1. This is what worked for me testing on my brother's EVO, so if you do end up trying something else to root 2.1 with, PLEASE do not post it here or ask questions, for I will only support the unrevoked team.
Now open up your web browser on your computer and navigate to Unrevoked
Choose the correct operating system to download for.
*
Make sure you install the modified android usb driver that comes with the unrevoked3 install (see the html file included when you extract the exe)
Once downloaded and extracted, run the program on your computer.
Make sure your EVO is plugged in with USB DEBUGGING ON!
It will reboot to the bootloader, and it will wait for you to use volume down to select HBOOT USB. (the last option)
After you have selected it (by pressing the power button) let the unrevoked3 program handle the rest of the flashing.
If you have had any trouble with the bootloader freezing or not moving for over 3 minutes, you most likely forgot to uninstall HTC Sync (as directed at the beginning of this guide), or you need to install the modified hboot drivers that come with the unrevoked3 program, OR a nasty combination of the both.
For the modified drivers and explanation on how to install them, open the "hboot driver.htm" file that gets extracted when you extract the reflash_package.exe. It will explain everything. You will have to reboot your phone after you install the drivers. Once you have repaired this go back to the big blue *
As soon as it is booted into recovery, you are done with that.
Next in recovery go to
Code:
install zip from sdcard
then
Code:
choose zip from sdcard
and choose the
Code:
unrevoked-forever.zip
This will flash the unrevoked forever hboot unlock.
_____________________________________________________________________
Part 2
Note: This section would not have been possible without the amazing testing and help of cilio87. He earns a gold star *
Now it's time to finish up the process and flash the stock 2.2 build of Android. You need to do this before any custom ROM in order to re-update the partitions we downgraded in the rooting process.
Step 1: Download either the update zip with
ClockWorkMod recovery included
or
Amon_RA's recovery included
This is the most up-to-date version of Amon_RA recovery that allows you to back up WiMAX partition.
(Either zip contains the final touches to the root process, one flashes clockworkmod recovery, and the other respectively, Amon_RA's recovery)
Extract the 3 files inside the zip to your desktop.
If you are still in recovery (from part one or the guide) go back to the main menu of recovery on your phone (if you aren't already at the main menu, hit vol up & down at the same time) Select
Code:
Reboot System Now
Let the Rom load, and when it gets to the sign in screen for Google, just skip everything and let the ROM boot.
If you are already on a custom rom, boot into it and follow from here.
Once It is fully booted, mount your sdcard onto your computer, and copy the 3 files you extracted from the zip to the sdcard.
Once copied, Unmount your sdcard from the computer.
Step 2: Unplug your phone from the computer. Power it off completely. Now while holding VOLUME DOWN turn on the phone with the power button, continuing to hold volume down. This will boot into hboot. You can release the buttons once you get to the hboot menu. Then use the power button to click on bootloader. This will scan the sdcard for the new PC36IMG.zip you just copied to the sdcard. When it asks "Do you want to start update?" Hit Volume Up for Yes. It will reload the zip and then start the flash. Once the flash is complete (may take 5 or so minutes) Choose NO when it asks you to reboot.
Step 3: After choosing NO to the reboot, you will see a menu again. Select Bootloader from the menu, then use the Volume Down button to hover over "Recovery" and press Power to click on it.
If your phone gets stuck at the White EVO 4G screen, pull your battery, and then power on while holding volume down again. It should boot to the bootloader again, where you can select recovery.
Once you are booted into this custom recovery, go to
Code:
Install Zip from sdcard / Flash zip from sdcard (Amon_RA)
and then (clockworkmod only)
Code:
choose zip from sdcard
You will then see the 2.2-root.zip. Click on that and accept the flash.
Once that flash is complete, return to the main menu of recovery and Select
Code:
Reboot System Now
You now have stock Android 2.2 with root and all updated partitions!
If you would like the flash_image binanry so you can flash new recovery images quickly from adb shell, flash the zip that is attached below as a normal zip in recovery AFTER you have completed this entire guide.
IN ORDER TO FLASH CM6 OR DAMAGE CONTROL, YOU NOW NEED TO FLASH THE ENG SPL. LOOK FOR IT IN THE EVO 4G ANDROID DEVELOPMENT FORUM.
Here is the ENG SPL
Good Luck!
Dan Wager

Awesome! Good job on everyone that worked on it. Finally no more people asking about it

Yes! I look forward to the rest of your post
Sent from my PC36100 using XDA App

Great news everyone!
Eagerly awaiting.

Awesome xD
Sent from my HTC Evo 4G using XDA app.

Oh thanks! Gonna be watching this all night! This is gonna be AWESOME!!

Vandam500 said:
Finally no more people asking about it
Click to expand...
Click to collapse
if only you were right...

I love the xda forums, good job to everyone involved, another reason I love my evo.
Sent from my PC36100 using XDA App

I wish I didn't just take my xanax. Ughhhh

Vandam500 said:
Awesome! Good job on everyone that worked on it. Finally no more people asking about it
Click to expand...
Click to collapse
I'll add with another question that will "end"
Will this allow me to have PRI 1.40?

Stop with the irrelevant posts! We don't need a hundred pages of nothing! Start a thank you thread if you want! Leave this one for the op and instructions and the files! Makes things easier for everyone so we don't have to go thru hundreds of posts to piece together relevant information!
NOTICE THE TITLE OF THE THREAD IT SAYS GUIDE LET IT BE JUST THAT!

Details---
I've heard the process is more than a simple click like simple root or unrevoked... But at least we have root.
It will be nice to see the detailed failsafe guide so I don't go around bricking phones and hopefully an automated prog is made to make it a breeze.

A great help!
Having a B-day tomorrow, and have searched the month of August for a complete method to root my froyo 2.2
Thank you in advance for your expertise and assistance..

well, i followed the droid2 guide and it worked all the way up to giving me the # sign... but the cp commands are failing. but since i have #, can i just run unrevoked 3.1 at this point? or do i need to succeed in the entire driod2 tutorial?

Thank you
OMG you guys are the best devs ever ill be stuck to this like glue once again XDA is the best forum on the planet.

edufur said:
well, i followed the droid2 guide and it worked all the way up to giving me the # sign... but the cp commands are failing. but since i have #, can i just run unrevoked 3.1 at this point? or do i need to succeed in the entire driod2 tutorial?
Click to expand...
Click to collapse
no, once you get to that point you have other stuff to do.
just wait til the guide comes out... We've waited how long for this thing? an extra hour or so won't kill you. (hopefully)

Yeah, almost done writing the guide. Try not to give out anymore details yet, I should be posting the full guide shortly.

sprink0281 said:
Stop with the irrelevant posts! We don't need a hundred pages of nothing! Start a thank you thread if you want! Leave this one for the op and instructions and the files! Makes things easier for everyone so we don't have to go thru hundreds of posts to piece together relevant information!
NOTICE THE TITLE OF THE THREAD IT SAYS GUIDE LET IT BE JUST THAT!
Click to expand...
Click to collapse
And your message is wholly important? Yes, the title says "guide" but that means that the original post will contain the guide. This is a forum, not a wiki. (I know my message doesn't help at all either)
Hooray, root on 2.2!

please make it easy for us newbies too please

Greenfieldan said:
please make it easy for us newbies too please
Click to expand...
Click to collapse
I'm getting the basics out tonight and will make it an easy read like my Hero rooting guide tomorrow sometime, because I am exhausted tonight.

[GUIDE] How To S-Off; Permanent Root; Custom Recovery

How to Achieve Permanent Root and S-Off:​
To get permanent root, you need to S-Off. So lets start with that first. This process will NOT wipe your device. It also works for OS X users. This guide will work on software version 1.55.605.2 (which as of 04/19/2014 is the latest OTA) and below.
--- S-OFF Instructions ---​First, you'll need to download adb, enable its use and setup debugging.
adb is part of the android SDK. You can download it here (OS X users must scroll down and download the OS X version). It does not need to be installed, just unzip it into its own folder. You can also download a zip that contain only adb and fastboot.
once you have adb, you'll need to download the drive for your M8, which can be had from HTC's driver page:
http://www.htc.com/us/software/htc-sync-manager/.
Then install it. It will install the driver necessary for adb to work. After the installation is finished, uninstall HTC Sync immediately (do this regardless of whether or not you need it; you can reinstall it later if you still want it). This will leave the driver package installed, but remove HTC sync.
Now, back to the phone. Disable all security you have on, including PINs, Pattern Locks, passwords, etc. If you have an exchange forced security policy, you will need to disable the account. You can readd it later.
Enable access to developer options. Jump into the Settings. Then you’re going to scroll down to the bottom and tap on ‘About’, next tap on ‘Software Information’. Now you’ll need to tap on ‘More’, which will give you a new menu. Now just tap on the build number 9 times and you’ll enable Developer options.
Go into developer options menu and enable USB Debugging.
Next, go to Security page and enable "Unknown sources".
Now install weaksauce from here:
http://forum.xda-developers.com/showthread.php?t=2699089
If you followed the directions correctly, you should have SuperSU installed and root access. (You can use superuser as well).
Plug in your phone into your computer. Its best to use the factory cable provided with the phone. Use a USB 2.0 type port if possible (USB3.0 ports typically have a blue tab; I have personally used a USB 3.0 Device on Windows 8.1u to perform this without any problems, but your mileage may vary).
Your phone will ask if you if you trust your computer (RSA). Choose "Always Allow".
Ensure adb is working by opening a command prompt (terminal on OS X), navigate to the adt-bundle-[XXXXX]/sdk/platform-tools and typing "adb devices" without quotes. Your phone should show up. Ensure the working directory is the directory that adb is in. Otherwise, transferring firewater may fail. On Windows, you can shift-right-click inside the folder adb is in and click open command prompt to open a cmd in that directory.
Now go download firewater from here:
http://firewater-soff.com/instructions/ Make sure to use the weaksauce method (second method). Do NOT use the temproot method.
The firewater file should be called "firewater" without any quotes or extensions (like .bin). Ensure your browser did not partially download or corrupt it.** Make sure its in the same folder as adb. Then follow directions on the firewater site. Be aware the yes/no prompt is case sensitive, so make sure to answer it with an uppercase Y as in "Yes" not "yes". During the process, you will need to enable adb shell to get root. Make sure your phone screen is on so you can see the root request. Grant it and the S-Off process will continue. Otherwise, it will hang there and eventually time out. Sometimes, the process will fail and the phone will reboot. This is okay. Just restart the process. It can sometimes take multiple tries.
When completely successfully, you now have S-OFF. Your phone's bootloader is also unlocked in the process; you do NOT need to perform any additional steps to unlock the bootloader. However, you do not have permanent root. The root that weaksuace provides goes away on reboot and must be reapplied again on startup.
**The filesize seems to vary depending on what OS/browser is used to download it. It should be around 4,519,496 (on disk) in size. If you can't execute firewater, try redownloading it.
Getting permanent root:
-Flash a custom recovery and flash a zip with su.
-[Optional] Return to stock recovery This option is for people who don't want a custom recovery.
Be aware, once rooted and S-Off'ed, you do NOT need the kernel module that enables system write access*. All system changes will survive hard reboots (adb reboot).
-- Recovery Rooting: --​
Move the supersu zip onto your internal sdcard. It can be downloaded here:
http://forum.xda-developers.com/showthread.php?t=1538053
You can use Superuser as well. Its your preference, but this guide uses SuperSU.
Uninstall weaksauce. It's no longer needed.
Uninstall SuperSU. It will be reinstalled when you flash the supersu zip. If you have SuperSU Pro installed, you can leave that in place, as that app only holds a key.
From adb, type:
adb reboot bootloader
Flash a custom recovery. CWM and TWRP are available. Use the fastboot method. Follow the directions here:
TWRP - http://teamw.in/project/twrp2/226
CWM - http://forum.xda-developers.com/showthread.php?t=2708520
Reboot into Recovery
Flash the supersu zip you downloaded.
Reboot and you're done. You have s-off and permanent root.
You can delete the downloaded supersu zip off your internal sdcard; its not longer needed.
-- Manual Root --​Perform all steps noted in section "Recovery Rooting" above.
-Download the stock recovery:
http://forum.xda-developers.com/showthread.php?t=2723112
-Ensure the stock recovery img file is in the same folder as fastboot.
-Run the following command from command line: "fastboot flash recovery stockrecovery.img" without the quotes.
-Wait for the process to finish
-Reboot the phone. You now have the stock recovery along with root. With the stock recovery installed, you can now accept OTAs provided you haven't modified/deleted any stock system files. Any new OTAs you take will remove any files/folders you added to the system partition and will remove your root. However, with S-off, this can be undone. If you lost loot after taking an OTA, simply start from the beginning of the section "Recovery Rooting".
-- Common Tweaks --
All of these are optional and are NOT required. However, you may find some benefit to them.​-- Wifi Tether Enabled --​This is unnecessary if you are on a More Everything plan or are paying for hotspot/tethering. You can force enable the native tethering application:
http://forum.xda-developers.com/showthread.php?t=2708548
-- Device Wipe after ten attempts --​I really dislike this "feature". Here is how to disable it. This works regardless if you enabled the security or its mandated by an exchange policy.
I use Root Explorer to make this change, but you can use any text editor. Make sure to mount system as R/W. Root explorer can do this from within the app.
Edit this file:
/system/customize/ACC/default.xml
change this:
Code:
<item type="integer" name="devicepolicy_max_fail_passwords_for_wipe">10</item>
to this
Code:
<item type="integer" name="devicepolicy_max_fail_passwords_for_wipe">0</item>
Reboot and its disabled.
-- Power Saver Mode --​Enable "Power Saver" mode using these directions. It's disabled and hidden by default.
http://forum.xda-developers.com/showthread.php?t=2701909
-- *Unsecured Kernel --​By default, the stock kernel prevents write access to /system. S-off and root should allow you to makes changes to system. However, some people have reported difficulties using ROM toolbox and other mods (like changing boot animations). In some cases, these issues can be resolved by flashing an insecure kernel:
http://forum.xda-developers.com/showthread.php?t=2708686
-- HTC Sense Broswer --​The stock ROM now includes Chrome as the default browser and omits the Sense Browser. Users who prefer the Sense Browser can download it here:
http://forum.xda-developers.com/showthread.php?t=2708597
-- HTC Flashlight --​The stock HTC flashlight app.
http://forum.xda-developers.com/showthread.php?t=2697025
-- Disable HTC Sync Virtual CDROM --​This disables the virtual CD-ROM from mounting.
http://forum.xda-developers.com/showthread.php?t=2709386
-- Donations --​Don't forget to donate to the developers involved in getting you here. Donations for firecracker go to [email protected] (paypal). Donations for weaksuace go to [email protected] (paypal). If I missed anyone, let me know.

FAQ​Been getting some interesting PMs. Here is some of the popular questions.
Do I need a Java card for this?
No. You just need a PC/Mac, a USB 2.0 cable and the M8. Since a public S-off method is now available, that method is obsolete and its not recommended anymore.
Do I have to change or reset my CID?
No, that is only necessary for people who s-off'ed via a Javacard.
Do I need to do any of this if I S-off'ed via Javacard?
No, this method ends with the same result.
Can I reverse this and return to completely stock?
Yes, absolutely none of the stuff done here is permanent. You can unroot, relock the bootloader, and S-On as many times as you want. You can flash an HTC RUU to return to completely stock in one go. Note: Be careful with S-On'ing a device. If you S-On a device via a newer RUU and that RUU has no known exploits, you may not be able to S-Off again until an exploit is found.
Do I need to unlock my bootloader after this?
No, the firewater exploit will S-Off and unlock your bootloader.
Will this work on a Mac?
Yes, please read the directions more carefully.
Will this work on USB 3.0 ports as that is all I have?
Usually. On OS X, I've had success using a USB 3.0 port (since recent MBPs only include USB 3). On Windows, the answer seems to be maybe, depending on your OS. Your best bet would be to try on a Windows 8,8.1,8.1u1 machine as that OS includes native support for USB 3.0; that way you aren't relying on vendor specific driver support like on Win7 or below. I have personally done this exploit on USB3 on a Surface Pro.
Will this brick my phone?
There is always a chance, but I have honestly never heard of such a thing happening. Worst case is usually a full reset of the phone.
Will this wipe/format the external SDcard?
No.
How do I flash this via ODIN?
This has absolutely nothing to do with ODIN. That is for Samsung devices. You should not even have ODIN running when do any part of this guide.
How to I convert to a Google Play edition ROM?
Wait for a developer to make one. I will post a link here if/when that happens.
See here:
http://forum.xda-developers.com/showthread.php?t=2716306
Does this affect Google Wallet or ISIS?
Yes and no. Google wallet works just fine. ISIS will detect its rooted and refuse to work. You'll need to shield root from ISIS to use it. Directions on how to do that can be found via google.
Will this work on non-Verizon HTC M8's?
Yes, though you will need to use a different recovery.
Will this unlock my device for other carriers?
No....because your device is already unlocked in its stock form. AWS band rules force Verizon to keep all their LTE devices unlocked.
Will this jailbreak my device?
No. Wrong type of phone.
I can get red triangle exclamation mark with a black screen. How do I fix this?
You are in the stock recovery. Hold power and volume up and you will get a menu. You can choose reboot system now to get out of there.

appreciate the write up. ill check back here when i find a reason to unlock it

Has anyone done it yet? It's just sitting at "adb wait-for-device push firewater /data/local/tmp" for at least 5 minutes now.

sfreemanoh said:
Has anyone done it yet? It's just sitting at "adb wait-for-device push firewater /data/local/tmp" for at least 5 minutes now.
Click to expand...
Click to collapse
I have done everything mentioned in this guide. And it works just fine.
Make sure you are connected via USB2. Also make sure your phone is on and unlocked (as in, no security PIN, pattern, password etc.). Is USB debugging on?
When you type "adb devices" from command prompt, is your device listed?

Yeah, nvm, it's fine now. When I first connected it via debugging, I didn't hit the "Always allow" option on my phone, so after the adb reboot it wasn't allowed to reconnect. Just had to disable debugging and re-enable it, it's all set now.

sfreemanoh said:
Yeah, nvm, it's fine now. When I first connected it via debugging, I didn't hit the "Always allow" option on my phone, so after the adb reboot it wasn't allowed to reconnect. Just had to disable debugging and re-enable it, it's all set now.
Click to expand...
Click to collapse
Cool. I'll add that to the guide.

I have not had time to thank and will.
At work and going to hook it up when I get home this morning so I hope no one screws with you guys and gets it pulled.
Very much appreciate all the work they put into it.
Thank you very much for the dummy proof write up
These guys around here are getting to good.
Thank you thank you thank you.

Worked Perfect! Thank you guys!

thank you so much! now i can sleep at night knowing that verizon doesn't have control of my device anymore haha!!

Im happy to see that s-off was achieved and Im going to unlock my phone right now
but quick question, I'm new to this s-off stuff so I don't know how it works entirely.
But once we unlock the bootloader
is there any way to lock it again in case we need to send the phone to HTC?
sorry for the noob question but just a question that popped into mind.

So I don't quite understand. I am S-off with the Unofficial CMWR from InvisibleK and I flashed SuperSU zip v1.94. Do I need the system write access kernel module to write to system or no?
Great guide by the way. Thanks

I have been trying for the past hour, but I cannot get adb to connect. Am I missing a step?
I downloaded the htc synch, installed the drivers, uninstalled synch. I already had weaksauce root. I downloaded sdk, extracted the bundle. I downloaded firewater, moved it to the same folder with adb.
Everytime I try to run adb it just scrolls and then closes almost immediately. I thought it was my java at first. I updated that. The computer says I'm connected through HTC drivers. I'm debugged/unknown sources...
Running windows 8.1 64bit. I don't know what else to do at this point.

blacknet101 said:
Im happy to see that s-off was achieved and Im going to unlock my phone right now
but quick question, I'm new to this s-off stuff so I don't know how it works entirely.
But once we unlock the bootloader
is there any way to lock it again in case we need to send the phone to HTC?
sorry for the noob question but just a question that popped into mind.
Click to expand...
Click to collapse
Absolutely. Everything in this guide can be reversed. You can return everything back to stock via an RUU.
nicholi2789 said:
So I don't quite understand. I am S-off with the Unofficial CMWR from InvisibleK and I flashed SuperSU zip v1.94. Do I need the system write access kernel module to write to system or no?
Great guide by the way. Thanks
Click to expand...
Click to collapse
You do not. I have modified and added a few system files and they have persisted through several hard reboots.

MultiDev said:
Absolutely. Everything in this guide can be reversed. You can return everything back to stock via an RUU.
Click to expand...
Click to collapse
Hmmm! Thanks for the reply buddy! may i ask? Where can we find these RUU files? In case we need to go back to Stock?

JelloB said:
I have been trying for the past hour, but I cannot get adb to connect. Am I missing a step?
I downloaded the htc synch, installed the drivers, uninstalled synch. I already had weaksauce root. I downloaded sdk, extracted the bundle. I downloaded firewater, moved it to the same folder with adb.
Everytime I try to run adb it just scrolls and then closes almost immediately. I thought it was my java at first. I updated that. The computer says I'm connected through HTC drivers.
Running windows 8.1 64bit. I don't know what else to do at this point.
Click to expand...
Click to collapse
Java has nothing to do with adb. You don't need it installed to any of this guide.
You need to use adb from a shell. On, windows, you need to open a command prompt. Type "cmd" with the start screen open and hit enter. Then at the prompt, use the "cd" command to navigate to the correct directory where adb is located.

When i run the "adb wait-for-device push firewater /data/local/tmp" command it come back with "failed to copy 'firewater' to '\data\local\tmp': Read-only file system". I'm lost. I have root access and everything.

MultiDev said:
Java has nothing to do with adb. You don't need it installed to any of this guide.
You need to use adb from a shell. On, windows, you need to open a command prompt. Type "cmd" with the start screen open and hit enter. Then at the prompt, use the "cd" command to navigate to the correct directory where adb is located.
Click to expand...
Click to collapse
I knew I was missing something simple. It's been a while since I've used adb. Will try now...thanks.

trying to modify the default.xml to get rid of the 10 try's and wipe pattern lock and it doesn't appear I have access to read write from it still... trying with the ES note editor when going to the file with ES File Explorer. I've ran the wp_mod.ko as directed and I haven't rebooted.
I'm wondering if I'm missing something, or maybe there's a better way to do it via command line?

blacknet101 said:
Hmmm! Thanks for the reply buddy! may i ask? Where can we find these RUU files? In case we need to go back to Stock?
Click to expand...
Click to collapse
They are available from HTC. I'll have to find the exact links. Also, many android sites will host them too.
Slimfast35 said:
When i run the "adb wait-for-device push firewater /data/local/tmp" command it come back with "failed to copy 'firewater' to '\data\local\tmp': Read-only file system". I'm lost. I have root access and everything.
Click to expand...
Click to collapse
You need root access to write there, shell does not normally have access. Beaware that weaksauce takes a minute or two before after a restart before enabling root again. So wait till you have access again before trying it.
meest said:
trying to modify the default.xml to get rid of the 10 try's and wipe pattern lock and it doesn't appear I have access to read write from it still... trying with the ES note editor when going to the file with ES File Explorer. I've ran the wp_mod.ko as directed and I haven't rebooted.
I'm wondering if I'm missing something, or maybe there's a better way to do it via command line?
Click to expand...
Click to collapse
You do not need the kernal module actually; I have removed that from the guide. I haven't used ES Note before, but no matter what, you must mount system as R/W before you can change anything. Its by default R/O or Read Only. Root explorer has a button that auto mounts it and then you can make your edit.

[Super Guide] Alcatel ideal (4060A)

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
DISCLAIMER
I am not responsible for bricks, cats being both alive and dead, heat death of the universe, etc. I've attempted to minimize the chance of damage, but you will use this guide at your own risk.
Thanks to [mention]ejwith9953[/mention] for getting TWRP working correctly
Thanks to [mention]forgottonhacker[/mention] for proofreading and formatting
ABOUT
WINDOWS ONLY GUIDE
THIS GUIDE IS FOR THE PEOPLE SEEKING TO INSTALL TWRP AND OBTAIN A FIX FOR SOFT-BRICKED DEVICES
STEP 1
On a DESKTOP:
Download CURE_4 and extract to desktop (or a folder to your preference).
[Download Links at Bottom of Post]
On your PHONE:
Go to Settings > About phone > tap build number, till it says your a developer.
Go to Settings > Developer Options and enable OEM unlock, and USB debugging
Reboot Device
STEP 2
Connect Device to PC
Open your extracted folder and run START_HERE.bat
Let it run, it will copy files, execute temp root exploit, and open a new CMD window.
In the new window, copy/paste commands individually.
Code:
adb shell
run-as -s1
su
dd if=/data/local/tmp/twrp.img of=/dev/block/mmcblk0p25
When you see the following:
Code:
26404+0 records in
26404+0 records out
Get ready to pull out the battery ( reboot recovery does NOT work )
Put the battery back in and hold the PWR and VOL UP at the same time, when you see Alcatel splash let go of power but continue to hold volume up.
Say hello to TWRP!
STEP 3
Now we are going to install SuperSU it’s easy from here don’t fret!
IMPORTANT
BACKUP /SYSTEM PARTITION IN TWRP AND MAKE A COPY ON YOUR PC
Now that you have a backup go back and tap install. Tap on "up a level" then sdcard.
Find SuperSu.zip and swipe to install!
Reboot system! (this may take a few minutes so don’t freak out)
Verify that SuperSu got installed.
Go back to the extracted folder on your computer and run CLEANUP.bat
SOFT FIX
Boot up to custom recovery tap wipe > advanced wipe
Select Dalvik cache and Cache, then SWIPE to wipe
Go back to the Home Screen
Tap Advanced > fix permissions and Swipe
REBOOT AND ENJOY
If this fix did not work for you please do contact me as I have another method, I will be putting up a debloated version of the ROM soon.
I will be adding more to the guide, so make sure to turn on your notifications!
DOWNLOADS
Stock-ish ROM EXTRACT FROM ZIP FIRST! then flash as /system
password: fax
Dropbox  Google  Box.net  Mega
​EDIT: On payday going to buy another one of these phones for stock firmware.

Reserved

Broken Download Link
The Link to download the Code-4 package is broken, and it makes me oh-so-sad!!! Help!

WowTheDog said:
The Link to download the Code-4 package is broken, and it makes me oh-so-sad!!! Help!
Click to expand...
Click to collapse
try now. also "cure-4" XD

Cure-4 download link not working.
I tried to say...
faxanidu said:
try now. also "cure-4" XD
Click to expand...
Click to collapse

The cure-4 thing is missing again, can we get a hold of that?

Omg everyone flagging as malware give me a bit

Hey, it all worked, I had a soft bricked phone, and its booting now. I did the commands in OSX, I just opened the START_HERE.bat and saw your adb commands. The only hangup was that I couldn't push Supersu.zip to /sdcard/ because it wasn't writable for some reason, but I just pushed it to the tmp path from the other commands instead.
Thanks so much!

Good brother my problem is that I have my soft brick phone and I do not know what to do to revive it, do you have any idea how to repair it?

ericcorp said:
Hey, it all worked, I had a soft bricked phone, and its booting now. I did the commands in OSX, I just opened the START_HERE.bat and saw your adb commands. The only hangup was that I couldn't push Supersu.zip to /sdcard/ because it wasn't writable for some reason, but I just pushed it to the tmp path from the other commands instead.
Thanks so much!
Click to expand...
Click to collapse
Odd it pushes supersu automatically. Might had something to do with the soft brick. Your welcome though! Spread the word!

sanpuyon said:
Good brother my problem is that I have my soft brick phone and I do not know what to do to revive it, do you have any idea how to repair it?
Click to expand...
Click to collapse
Follow guide fixes soft brick also just reboot it. let it sit awhile then plug it in. Should be a able to get ADB shell

faxanidu, I just tried on my dead device and I got twrp :good: but won't complete boot after fixing permission tho. Hey that's good enough for me, congrats on what you did! Just gonna wait till a rom gets put up.
To get started I did have to do some steps in oem recovery like I said from the other thread, otherwise my device shows as unauthorized tho, enable adb, then rock volume back and forth till I get mounted /system, then hit reboot. It seems I've tried just doing one or the other but it would still be unauthorized. Just sayin, and again like I told you I don't really know what I'm doing
Thanks again, and if you have any further advice or tips, I'm all ears
edit: I didn't have supersu show up either but I put it on an sdcard and installed it that way.

i am too afraid to try this, is this safe? if i brick my phone, how do i flash stock firmware
---------- Post added at 03:24 AM ---------- Previous post was at 02:59 AM ----------
faxanidu said:

Good news everyone! I have built a massive guide for the alcatel ideal! install custom recovery and more now! also fix for soft bricked phones! just follow this guide.
WIndows only
Thanks to ejwith9953 with getting TWRP working correctly, he is the bomb!
So dont forget to thank him!
STEP 0
DISCLAIMER! I am not responsible for bricks, cats being both alive and dead, heat death of the universe, etc. Ive minimized the chance of damage as much as possible, but still use this guide at your own risk.
​
STEP 1​​Goto settings > about phone > tap build number, till it says your a developer.
Goto settings > developer Options. slide on OEM unlock, and USB debugging
Download CURE_4 to your computer and extract folder to desktop (or somewhere).
Reboot phone.
Links are at bottom!
STEP 2​​Open your extracted folder, run START_HERE.bat
Let it run, it will copy files, execute temp root exploit, and open a new CMD window.
In the new window type in these codes from top to bottom letting each one finish. ( or copy/paste )
Code:
adb shell
run-as -s1
su
dd if=/data/local/tmp/twrp.img of=/dev/block/mmcblk0p25
When you see:
26404+0 records in
26404+0 records out
your ready to pull out the battery ( reboot recovery does NOT work )
Put the battery back in and hold the PWR and VOL UP at the same time, when you see alcatel let go of power but continue to hold volume up.
Welcome to custom recovery my friends!
STEP 3​​Now we are going to install SuperSU its easy from here dont fret! but first!
click backup, under partitions uncheck everything EXCEPT system. Now swype to backup.
Now that you have a backup go back and click install. click "up a level" then sdcard.
scroll down and click SuperSu.zip. Swipe to install! Now Reboot system! (this may take a few minutes so dont freak)
check that SuperSu installed, did it? great! go back to the extracted folder on your computer and run CLEANUP.bat
STEP 4 -SOFTFIX ONLY​​Boot up to custom recovery click wipe > advanced wipe
checkmark Dalvik cache and Cache, the SWIPE to wipe ( sounds dirty )
now click BACK all the way to main screen. now click advanced.
click fix permissions And Swipe. Now REBOOT. hopefully that will boot your phone if not let me know. i dont
have an extra one to purposfully softbrick to test. but ill have a debloated pre rooted ROM for you
to use soon regardless
More to the guide will be coming, for now this is the basics. im going to bed see you all later!
LINKS!
password: fax
Dropbox  Google  Box.net  Mega
​
EDIT: 4 links encrypted
Click to expand...
Click to collapse
faxanidu said:
Click to expand...
Click to collapse
Thank you! i am now happily running twrp, though with some mods, i rooted with kingroot first then ran the commands
Now we wait for lineage os or cm13

For some reason I can't do this on my working phone. when it comes to the "getting uid" screen, everything that runs says "missing second argument" then I try entering the commands it says "run-as: Package '-s1' is unknown"?

scohut said:
For some reason I can't do this on my working phone. when it comes to the "getting uid" screen, everything that runs says "missing second argument" then I try entering the commands it says "run-as: Package '-s1' is unknown"?
Click to expand...
Click to collapse
What the? Never had that problem can't reproduce plz send screenshot

faxanidu said:
Good news everyone! I have built a massive guide for the alcatel ideal!
Click to expand...
Click to collapse
Thank you so much for this.
I started and misread the text as a lowercase "L" instead of the number one for the "run-as -s1" part of the code. I wasn't sure how to correct it when I got an error, so I started over and ran the START_HERE.bat again. When the new cmd window opens, I can't type anything. It reads:
# Device:Alcatel_4060A
-Getting uid 0->Ok.
-Checking permissive run-as.->Ok
# turn off/on the bluetooth.....................................................
..............←[s←[0;34m
[email protected]:/data/local/tmp #
Click to expand...
Click to collapse
I'm not sure how to start over to get back on track for the adb shell code.
I know, it's pretty bad that I didn't get past the first part of Step 2. Any help is appreciated.

faxanidu said:
What the? Never had that problem can't reproduce plz send screenshot
Click to expand...
Click to collapse
this..

Rush-O-Matic said:
Thank you so much for this.
I started and misread the text as a lowercase "L" instead of the number one for the "run-as -s1" part of the code. I wasn't sure how to correct it when I got an error, so I started over and ran the START_HERE.bat again. When the new cmd window opens, I can't type anything. It reads:
I'm not sure how to start over to get back on track for the adb shell code.
I know, it's pretty bad that I didn't get past the first part of Step 2. Any help is appreciated.
Click to expand...
Click to collapse
That happens rarely just reboot and start again

faxanidu said:
That happens rarely just reboot and start again
Click to expand...
Click to collapse
And it reads what?

scohut said:
this..
Click to expand...
Click to collapse
Looks like exploit.sh for corrupted or something plus if you have any mods like exposed might interfere with it. The script dumps info it need to patch see policy then creates run-as with info.
Edit: I'm basically using dirty cow exploit. Works on everything