Database Info

[GUIDE] How to downgrade 1.7x/1.8x/2.x to 1.32.405.6

DO NOT USE THIS IF YOUR PHONE CAME WITH GINGERBREAD Or newer Software. Use the Ace Hack Kit for DHD ​
How to downgrade to 1.32.405.6 WWE
HTC - Quietly S-OFF. Again.​
About:
The problems started when HTC released their 1.72.405.3 OTA update. That update could not be rooted, and many people got stuck in stock roms. Now a downgrade method has arrived! After this process, you can use any root (+ S-OFF) method you want. Basically your device will be just like any other Desire HD with older build version. Downgrading will completely reset your device to factory defaults, so remember to back up all important data (such as contacts, game saves and sms messages).
System requirements:
HTC Sync (or ADB drivers)
Desire HD with build number 1.72 or higher
[Warning] Telus DHDs may lose sound because the 1.32.405.6 is not fully compatible with the sound chip. Just start using a custom ROM, and it will work fine.
How to downgrade:
Section 1
Disable any antivirus software
If you have a branded / regional (like Indian or Vodaphone) device, you have to make a Goldcard. Use "mmc2" instead of "mmc1"!!
Download the attached file and extract it
Get stock 1.32 PD98IMG.zip ROM, mirror
Put the PD98IMG.zip into your SD card. Do not put it into a folder, and do not extract it.
Click to expand...
Click to collapse
Section 2a [For Froyo ROMs, 1.7x and 1.8x]
Connect Desire HD to a computer. Charge only, USB Debugging enabled!
Open up a cmd and go to Downgrade folder, execute commands:
Code:
adb push psneuter /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/psneuter
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/psneuter
adb shell
Click to expand...
Click to collapse
Section 2b [For Gingerbread ROMs, 2.x]
Connect Desire HD to a computer. Charge only, USB Debugging enabled!
Open up a cmd and go to Downgrade folder, execute commands:
Code:
adb push misc_version /data/local/tmp
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
Click to expand...
Click to collapse
Section 3
If you got "#" in the result, you have temporary root! Proceed with commands:
Code:
cd /data/local/tmp
./misc_version -s 1.31.405.6
Close the CMD. Reboot while holding volume down, it will go to the bootloader
Follow the instructions (start the update)
Done. You can now click my thanks button! Proceed with old S-OFF methods, and remove the PD98IMG.zip from your SD. I recommend Radio S-OFF for new users.
Click to expand...
Click to collapse
Big thanks: Scotty2, Guhl and the fre3vo team
Downloadcount for Downgrade package v1 is 15808, and for v2 it is 32012.

FAQ:
Q: Will I lose all my settings and applications?
- Yes, so make a backup with MyBackup Pro.
Q: I have done Radio S-OFF and SuperCID, do I need this?
- No, with those you do not need this kind of trickery.
Q: I have flashed a custom ROM with e.g. 1.84 build number, do I need this?
- No, with ClockworkMod you can jump between builds freely.
Q: It says '#' but I still cannot use root applications!
- That is normal, this method only gives root in command line. Just go ahead and downgrade.
Q: Is my phone Froyo or Gingerbread?
- Check it in Settings -> About -> Software information -> Android version. 2.2 is Froyo and 2.3 is Gingerbread.
Q: How do I navigate to downgrade folder?
- You can read this short and easy explanation.
Click to expand...
Click to collapse
Troubleshooting:
- "Main version is older"? You did not type everything correctly. Please try it again and see if any errors come up.
- "Error opening backup file"? You did not use "Charge only" -connection, or your SD card is faulty.
- "CID mismatch/CID incorrect"? Your device is branded. Just make a Goldcard, put the PD98IMG.zip to the card again and go to the bootloader.
- "Model ID incorrect"? Some Telus DHDs get this, just make a Goldcard.
- "Failed to set prot mask (Inappropriate ioctl for device)"? Use Gingerbread method to downgrade.
- Zip will not load in bootloader? Format your SD card to FAT32, no quick format! You can also try another SD.
- Problems while making Goldcard? See this post.
- PD98IMG.zip md5sum is: C3D244A9F056E48EE3851A14FF52204C
Click to expand...
Click to collapse
If you like my work, please consider: (or just hit the thanks button )

Am I missing something or is it your link that just ain't there ?? lol

mcnob said:
Am I missing something or is it your link that just ain't there ?? lol
Click to expand...
Click to collapse
He's most likely updating it as we type - hate clutter so lets sit back and wait
http://forum.xda-developers.com/showpost.php?p=10428859&postcount=162

mcnob said:
Am I missing something or is it your link that just ain't there ?? lol
Click to expand...
Click to collapse
Look:
http://forum.xda-developers.com/showpost.php?p=10428115&postcount=54
but you should use DHD RUU (not desire Z) and lower version numer (since unbranded rootable version for DHD is 1.32.405.6)

Great work to everyone involved, now finally those lame "root doesn't work" posts will vanish

Excellent
So has any one tried it?

Got temp root trying to flash old ruu...lets see

I have temproot working. Currently downloading the RUU file on my REALLY slow internet...
I think there is a couple of small errors?
cd /data/local/tmp
./misc-version -s 1.31.405.3
should be
cd /data/local/tmp/
./misc_version -s 1.31.405.3
also, the psneuter is a .txt file, just remove the .txt extension to use the file.

robE9 said:
Got temp root trying to flash old ruu...lets see
Click to expand...
Click to collapse
Second confirmation for temp root but I've ran out of time to flash RUU

"So, rebooted in bootloader, loaded pd98img.zip....checked it but after says Main Version is older ! Update Fail ! Press power to reboot.
Any ideeas to try ?

Once i am home again I shall donate a crate of beer to the team!!

BlackTigerX said:
Great work to everyone involved, now finally those lame "root doesn't work" posts will vanish
Click to expand...
Click to collapse
You still will not have permanent root of 1.72/1.75! but this does allow you to downgrade and attain root on older Firmware

robE9 said:
"So, rebooted in bootloader, loaded pd98img.zip....checked it but after says Main Version is older ! Update Fail ! Press power to reboot.
Any ideeas to try ?
Click to expand...
Click to collapse
Did you get #, and did you run the misc_version executable? Did you write the version number correctly there?
ghostofcain said:
You still will not have root of 1.72/1.75! but this does allow you to downgrade and attain root on older Firmware
Click to expand...
Click to collapse
That is right. The psneuter gives temporary root, but as scotty2 said, it kind of shoots the current rom in the head while doing that..

i tried again with _ instead of - at version and now its updating hope will be ok

.. PD98IMG.zip to apply the file gives me an error
View attachment 483907​
Any ideas?. Thanks!

Is it possible to flash the PD98IMG without using an SD card?
My DHD bricked mine http://forum.xda-developers.com/showthread.php?t=895593

apside said:
.. PD98IMG.zip to apply the file gives me an error
Any ideas?. Thanks!
Click to expand...
Click to collapse
What error? I cannot find error in that screenshot.
xdario said:
Is it possible to flash the PD98IMG without using an SD card?
My DHD bricked mine http://forum.xda-developers.com/showthread.php?t=895593
Click to expand...
Click to collapse
The RUU itself might work, but I would not bet on it. Just get a new SD.

apside said:
.. PD98IMG.zip to apply the file gives me an error
View attachment 483907​
Any ideas?. Thanks!
Click to expand...
Click to collapse
dont write "reboot bootloader" just reboot by power buton and press down the volume button until you are in bootloader
Btw the downgrade was succesfull, i just rooted with visionary thx guys a lot :X

at me work fine

I'm waiting for Hboot 0.98.0002 S-OFF

My Desier S hboot is 0.98.0002,so I can't s-off my decive
please help me...thx...
PS:my RUU is 1.47......so http://forum.xda-developers.com/showthread.php?t=1173083 can't used...

Evilier said:
My Desier S hboot is 0.98.0002,so I can't s-off my decive
please help me...thx...
PS:my RUU is 1.47......so http://forum.xda-developers.com/showthread.php?t=1173083 can't used...
Click to expand...
Click to collapse
u need to use search button... its a yellow thing up

Evilier said:
My Desier S hboot is 0.98.0002,so I can't s-off my decive
please help me...thx...
PS:my RUU is 1.47......so http://forum.xda-developers.com/showthread.php?t=1173083 can't used...
Click to expand...
Click to collapse
Hi, you might wanna try to flash this ROM to get back to old Hboot
http://www.4shared.com/file/bAebAgjC/RUU_Saga_HTC_Europe_1284011_Ra.html
It may or may not work on your s-on device but worth to try.

ofc he can downgrade with s-on
i did the same, he is just too lazy to use search function

Blezz said:
ofc he can downgrade with s-on
i did the same, he is just too lazy to use search function
Click to expand...
Click to collapse
actually he cant with his radio the temp root using gingerbreak dosent work, so there is no way to downgrade, i have tried every method and have had no luck, but i am sure alpharevx will sort it out eventually

Blezz said:
ofc he can downgrade with s-on
i did the same, he is just too lazy to use search function
Click to expand...
Click to collapse
People like this annoy me. As the OP already stated, he can't downgrade with s-on. Just because YOU did, doesn't mean he can. His stock RUU is too new (1.47) and there is no exploit to get temp root yet for this RUU, so downgrading is not possible.
Agreed, he should use the search function, there are about 3 threads of people trying to s-off their 1.47 device. But in his defence, all 3 of those threads are filled with morons like yourself telling people they can do it. Newsflash, you can't.... yet

I'm waiting to :-(
Hope it will no take very long time ahah

Evilier said:
My Desier S hboot is 0.98.0002,so I can't s-off my decive
please help me...thx...
PS:my RUU is 1.47......so http://forum.xda-developers.com/showthread.php?t=1173083 can't used...
Click to expand...
Click to collapse
Hi Evilier.
I just have few questions regarding to your phone, since its one of the "new" software, do you have the Wi-Fi Death Grip? More info can be found here.
And can you tell me which of the v1.47 do you have? Which country I mean.
Well this is going to be a stretch, since you're on the "new" phones software version, can you update/RUU to the latest (RUU_Saga_hTC_Asia_WWE_1.48.707.1_Radio_20.28I.30.0 85AU_3805.06.02.03_M_release_199476_signed)? Then double check if you still have the so could Wi-Fi Death Grip. Thanks a lot.

+ 1 for a method to unlock/root the "new " firmware. Please devs do your magic
Sent from my HTC Desire S using XDA App

davidreece said:
actually he cant with his radio the temp root using gingerbreak dosent work, so there is no way to downgrade, i have tried every method and have had no luck, but i am sure alpharevx will sort it out eventually
Click to expand...
Click to collapse
Davidreece, I'm on the same wagon here... Tried every thinkable method but simply no joy
Did anyone of you test the ROM suggested by Yungyeh?

jakmor said:
Davidreece, I'm on the same wagon here... Tried every thinkable method but simply no joy
Did anyone of you test the ROM suggested by Yungyeh?
Click to expand...
Click to collapse
i have actually managed it i used fre3vo from this thread
http://forum.xda-developers.com/showthread.php?t=1150006
but i combined the instructions with post 4 from the downgrade thread ( part where you have to chmod the version file then change the version.
first download http://forum.xda-developers.com/attachment.php?attachmentid=591335&d=1304969547
and also this
http://forum.xda-developers.com/attachment.php?attachmentid=661246&d=1311240968
extract them to the same folder then open a command prompt in that folder and follow these instructions
Instructions:
1. adb push fre3vo /data/local/tmp
2. adb push misc_version /data/local/tmp
3. adb shell chmod 777 /data/local/tmp/fre3vo
4. adb shell chmod 777 /data/local/tmp/misc_version
5. Run the binary via 'adb shell /data/local/tmp/fre3vo'
If all goes well, you'll be kicked back to your computer's command prompt.
run 'adb shell' and you should have a '#' prompt instead of $
6. cd /data/local/tmp
./misc_version -s 1.27.405.6
From here you can then install the update/downgrade from the ruu exe for your phone from http://forum.xda-developers.com/showthread.php?t=1002506
then you can just follow the alpharevx instructions as normal because you will be able to run gingerbreak etc, this works on the latest updates as i couldnt use gingerbreak to downgrade due to the vodafone uk update and i am now on a custom rom and s offed
hope this helps everyone.

davidreece said:
i have actually managed it i used fre3vo from this thread
http://forum.xda-developers.com/showthread.php?t=1150006
but i combined the instructions with post 4 from the downgrade thread ( part where you have to chmod the version file then change the version.
first download http://forum.xda-developers.com/attachment.php?attachmentid=591335&d=1304969547
and also this
http://forum.xda-developers.com/attachment.php?attachmentid=661246&d=1311240968
extract them to the same folder then open a command prompt in that folder and follow these instructions
Instructions:
1. adb push fre3vo /data/local/tmp
2. adb push misc_version /data/local/tmp
3. adb shell chmod 777 /data/local/tmp/fre3vo
4. adb shell chmod 777 /data/local/tmp/misc_version
5. Run the binary via 'adb shell /data/local/tmp/fre3vo'
If all goes well, you'll be kicked back to your computer's command prompt.
run 'adb shell' and you should have a '#' prompt instead of $
6. cd /data/local/tmp
./misc_version -s 1.27.405.6
From here you can then install the update/downgrade from the ruu exe for your phone from http://forum.xda-developers.com/showthread.php?t=1002506
then you can just follow the alpharevx instructions as normal because you will be able to run gingerbreak etc, this works on the latest updates as i couldnt use gingerbreak to downgrade due to the vodafone uk update and i am now on a custom rom and s offed
hope this helps everyone.
Click to expand...
Click to collapse
This part got me all excited in the pants a little. I tried it, but the fre3vo script is hanging at "Frame Buffer handle: 4" for about 5 minutes now.
I will try factory reset on my 1.47 RUU and try once more.
@davidreece: can you confirm what RUU version you had when this worked for you?

davidreece said:
i have actually managed it i used fre3vo from this thread
http://forum.xda-developers.com/showthread.php?t=1150006
but i combined the instructions with post 4 from the downgrade thread ( part where you have to chmod the version file then change the version.
first download http://forum.xda-developers.com/attachment.php?attachmentid=591335&d=1304969547
and also this
http://forum.xda-developers.com/attachment.php?attachmentid=661246&d=1311240968
extract them to the same folder then open a command prompt in that folder and follow these instructions
Instructions:
1. adb push fre3vo /data/local/tmp
2. adb push misc_version /data/local/tmp
3. adb shell chmod 777 /data/local/tmp/fre3vo
4. adb shell chmod 777 /data/local/tmp/misc_version
5. Run the binary via 'adb shell /data/local/tmp/fre3vo'
If all goes well, you'll be kicked back to your computer's command prompt.
run 'adb shell' and you should have a '#' prompt instead of $
6. cd /data/local/tmp
./misc_version -s 1.27.405.6
From here you can then install the update/downgrade from the ruu exe for your phone from http://forum.xda-developers.com/showthread.php?t=1002506
then you can just follow the alpharevx instructions as normal because you will be able to run gingerbreak etc, this works on the latest updates as i couldnt use gingerbreak to downgrade due to the vodafone uk update and i am now on a custom rom and s offed
hope this helps everyone.
Click to expand...
Click to collapse
Thanks for the tip. But I'm a little confused at step 5. I'm the ultimate Android noob so please excuse my stupidity, but what exactly did the step mean by "Run the binary via 'adb shell /data/local/tmp/fre3vo"?
How exactly does one "run the binary? I typed in the 'adb shell /data/local/tmp/fre3vo' command for this step and I get
fre3vo by #teamwin
Please wait...
At this point I can't type anything and actually waited...but after about 15 minutes, nothing is happening. Could you point me in the right direction?

vankox said:
Thanks for the tip. But I'm a little confused at step 5. I'm the ultimate Android noob so please excuse my stupidity, but what exactly did the step mean by "Run the binary via 'adb shell /data/local/tmp/fre3vo"?
How exactly does one "run the binary? I typed in the 'adb shell /data/local/tmp/fre3vo' command for this step and I get
fre3vo by #teamwin
Please wait...
At this point I can't type anything and actually waited...but after about 15 minutes, nothing is happening. Could you point me in the right direction?
Click to expand...
Click to collapse
You appear to be doing exactly the correct thing...just be patient...(although I admit it does say a few minutes).
See this refined guide....http://forum.xda-developers.com/showpost.php?p=16104882&postcount=16
I'd be tempted to reboot the phone and start at the beginning again, (although the first two steps may well error as the files will be already there - ignore that and proceed).

first of all many thanks for all the guides, secondly i've followed all the steps and everything works fine but when i run the .exe to actually downgrade it always says that i'm under 30% of phone charge (battery is fully loaded). I made a gold card and everything also... strange..

ratss123 said:
first of all many thanks for all the guides, secondly i've followed all the steps and everything works fine but when i run the .exe to actually downgrade it always says that i'm under 30% of phone charge (battery is fully loaded). I made a gold card and everything also... strange..
Click to expand...
Click to collapse
Just grasping at straws here....Try to fully charge the battery and then power down device and remove the battery, allow both the battery and the device to cool down.
Try again.
Now, again I'm not sure but a full factory reset from HBOOT may remove the existing battery stats....so you could try that?

ben_pyett said:
Just grasping at straws here....Try to fully charge the battery and then power down device and remove the battery, allow both the battery and the device to cool down.
Try again.
Now, again I'm not sure but a full factory reset from HBOOT may remove the existing battery stats....so you could try that?
Click to expand...
Click to collapse
uhm didn't work also with factory reset.... keeps saying it's less then 30%..
lol so near to the s-off and then it doesn't work for something like that!!

Worked like a charm now s- off again running pre rooted 1.47.401 European Rom many thanks
Sent from my HTC Desire S using XDA App

ratss123 said:
uhm didn't work also with factory reset.... keeps saying it's less then 30%..
lol so near to the s-off and then it doesn't work for something like that!!
Click to expand...
Click to collapse
do you know anyone with the same device so that you could try to swap batteries for the update in case your has failed?

ben_pyett said:
do you know anyone with the same device so that you could try to swap batteries for the update in case your has failed?
Click to expand...
Click to collapse
no sadly i don't, tried to run it also on another pc but it's the same.. there is also another thing, few days ago i tried to run the .exe hoping that it would downgrade, later i found out that i've got hboot 92 so i waited for a new method.. When i tried I didn't get any error message, just thath obviusy it couldn't downgrade... today i tried again and I keep gettint low battery....

[UPDATED]how to root 1.47.161.2 hboot 002 (and possibly others)

sorry about all the updates i am trying to remember as i go along with the help of the comments below, we will get this working as i know it does
i have actually managed it i used fre3vo from this thread
http://forum.xda-developers.com/showthread.php?t=1178912
but i combined the instructions with post 4 from the downgrade thread ( part where you have to chmod the version file then change the version.
first download http://forum.xda-developers.com/attachment.php?attachmentid=591335&d=1304969547
and also this
http://forum.xda-developers.com/attachment.php?attachmentid=661246&d=1311240968
extract them to the same folder then open a command prompt in that folder and follow these instructions pressing enter at the end of each step
(big thanks to Jorgen2009 for cleaning up the instructions)
Instructions:
1. adb push fre3vo /data/local/tmp
2. adb push misc_version /data/local/tmp
3. adb shell chmod 777 /data/local/tmp/fre3vo
4. adb shell chmod 777 /data/local/tmp/misc_version
5. reboot the phone with the cable attached to the computer
6. adb shell (this gives a $-prompt)
7. /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF (when everything is OK you'll go back to your own prompt, not the phones)
8. adb shell (you'll have a #-prompt now, cause the the is temp-rooted)
9. /data/local/tmp/misc_version -s 1.27.405.6
10. install the earliest RUU version you can find. I used RUU_Saga_HTC_Europe_1.28.401.1_Radio_20.28b.30.080 5U_38.03.02.11_M_release_177977_signed
11. after rebooting your phone has the old HBOOT (0.98.0000)
12. enable USB Debugging (Settings - Applications - Development) and reboot the phone again
13. Run the AlphaRevX binary and don't install the CWM recovery, we'll use 4EXTRecovery lateron
congratulations, your phone is now S-OFF!
download the latest EXT4Recovery from here
adb reboot bootloader
fastboot flash recovery [PATH TO recovery.img]
fastboot reboot-bootloader
go to the recovery and install any ROM you like
hope this helps everyone.
as usuall not my fault, brick yadda yadda
credit to sethario, the fre3vo dev team and Jorgen2009

davidreece said:
i have actually managed it i used fre3vo from this thread
http://forum.xda-developers.com/showthread.php?t=1150006
but i combined the instructions with post 4 from the downgrade thread ( part where you have to chmod the version file then change the version.
first download http://forum.xda-developers.com/attachment.php?attachmentid=591335&d=1304969547
and also this
http://forum.xda-developers.com/attachment.php?attachmentid=661246&d=1311240968
extract them to the same folder then open a command prompt in that folder and follow these instructions
Instructions:
1. adb push fre3vo /data/local/tmp
2. adb push misc_version /data/local/tmp
3. adb shell chmod 777 /data/local/tmp/fre3vo
4. adb shell chmod 777 /data/local/tmp/misc_version
5. Run the binary via 'adb shell /data/local/tmp/fre3vo'
If all goes well, you'll be kicked back to your computer's command prompt.
run 'adb shell' and you should have a '#' prompt instead of $
6. cd /data/local/tmp
./misc_version -s 1.27.405.6
From here you can then install the update/downgrade from the ruu exe for your phone from http://forum.xda-developers.com/showthread.php?t=1002506
then you can just follow the alpharevx instructions as normal because you will be able to run gingerbreak etc, this works on the latest updates as i couldnt use gingerbreak to downgrade due to the vodafone uk update and i am now on a custom rom and s offed
hope this helps everyone.
as usuall not my fault, brick yadda yadda
Click to expand...
Click to collapse
Brilliant and well done. .
could you please add exactly which 1.47 version that you achieved this on and from which country.
also get this useful thread added to the INDEX sticky thread that we have be either PM' ing threads OP or adding post in that Thread.
Sent from my HTC Desire S using XDA Premium App

ben_pyett said:
Brilliant and well done. .
could you please add exactly which 1.47 version that you achieved this on and from which country.
also get this useful thread added to the INDEX sticky thread that we have be either PM' ing threads OP or adding post in that Thread.
Sent from my HTC Desire S using XDA Premium App
Click to expand...
Click to collapse
not sure exactly what 1.47 as its gone now but as i said in my post im on a vodafone uk if that helps
also just to make it clear, none of this is my own work guys a lot brighter than me figured all the hard stuff out, i just fitted the different bits together

davidreece said:
not sure exactly what 1.47 as its gone now but as i said in my post im on a vodafone uk if that helps
also just to make it clear, none of this is my own work guys a lot brighter than me figured all the hard stuff out, i just fitted the different bits together
Click to expand...
Click to collapse
All the same, Putting the bits together, writing the guide and having the balls to try all of these steps on your own device is worthy of thanks and just a little praise
Sent from my HTC Desire S using XDA Premium App

thanks ben just glad to put something back instead of leeching all the devs hard work all the time

Thanx davidreece, great find!
Unfortunately it's not working for me I get stuck at point 5 running the fre3vo binary. I waited 20 minutes for it to complete, but it's still saying "please wait" with a blinking cursor. For the record, I'm using this rom: RUU_Saga_HTC_Europe_1.47.401.4_Radio_20.28I.30.085 AU_3805.06.02.03_M_release_199410_signed. That could be the problem perhaps.
I also noticed that the the fre3vo link from your article is a bit older then the fre3vo version on the fre3vo thread. Of course i tried that one too, but it gives the same result for me
Any ideas?
Cheers

not a clue jorgen sorry i should maybe add the words "some"
just a thought when you ran the fre3vo command where you in adb shell or at the command prompt >, i seem to remember it happened to me the first time i tried it but i cant remember how i got it wrong, ithink you have to enter the adb shell command first then enter /data/local/tmp/fre3vo next or it may be enter them both together as one line i cant really remember, i was so surprised it worked if anyone else gets this to work could you please clarify the fre3vo steps and i will update the main post thanks, hope this helps, also i only used the link version not any newer one

davidreece said:
not a clue jorgen sorry i should maybe add the words "some"
just a thought when you ran the fre3vo command where you in adb shell or at the command prompt >, i seem to remember it happened to me the first time i tried it but i cant remember how i got it wrong, ithink you have to enter the adb shell command first then enter /data/local/tmp/fre3vo next or it may be enter them both together as one line i cant really remember, i was so surprised it worked if anyone else gets this to work could you please clarify the fre3vo steps and i will update the main post thanks, hope this helps, also i only used the link version not any newer one
Click to expand...
Click to collapse
I tried both methods, both with the same result. It's great to see however it worked for you. It means there is at least a possibility to get S-OFF on updated devices

jorgen2009 said:
I tried both methods, both with the same result. It's great to see however it worked for you. It means there is at least a possibility to get S-OFF on updated devices
Click to expand...
Click to collapse
really sorry i falsly got your hopes up, maybe ask in the fre3vo forum maybe im just getting it wrong, it was 4am here when i succeeded so its all a bit hazy

jorgen2009 said:
Thanx davidreece, great find!
Unfortunately it's not working for me I get stuck at point 5 running the fre3vo binary. I waited 20 minutes for it to complete, but it's still saying "please wait" with a blinking cursor. For the record, I'm using this rom: RUU_Saga_HTC_Europe_1.47.401.4_Radio_20.28I.30.085 AU_3805.06.02.03_M_release_199410_signed. That could be the problem perhaps.
I also noticed that the the fre3vo link from your article is a bit older then the fre3vo version on the fre3vo thread. Of course i tried that one too, but it gives the same result for me
Any ideas?
Cheers
Click to expand...
Click to collapse
Eureka i have updated the instructions jurgen also redownload my fre3vo link just in case it was different, i knew i had to do something else, please let me know if it works now

I remember seeing in the original fre3evo thread there was a series or range of hex addresses to try if the first default one didn't achieve root
Sent from my HTC Desire S using XDA Premium App

I am stuck on instructions step 5. it says unable to chmod -debug: No such file or directory. My Bootloader version is 0.98.0002. In my understanding instructions step 5 is confusing as first i wrote it with step 4 and then i realize that first write adb shell chmod 777 etc etc. Am i doing right?

maroof.saeed said:
I am stuck on instructions step 5. it says unable to chmod -debug: No such file or directory. My Bootloader version is 0.98.0002. In my understanding instructions step 5 is confusing as first i wrote it with step 4 and then i realize that first write adb shell chmod 777 etc etc. Am i doing right?
Click to expand...
Click to collapse
sorry maroof not sure whats wrong maybe ask in the original thread linked at the 1st post

maroof.saeed said:
I am stuck on instructions step 5. it says unable to chmod -debug: No such file or directory. My Bootloader version is 0.98.0002. In my understanding instructions step 5 is confusing as first i wrote it with step 4 and then i realize that first write adb shell chmod 777 etc etc. Am i doing right?
Click to expand...
Click to collapse
Hello, you're right there appears to is a slight mistake above, from my understanding of this the commands they should be entered as I've shown below from your PC within a command shell window with a <RETURN> at the end of every line.
Code:
C:\Program Files\Microsoft Support Tools> [B]adb shell [/B]
$ [B]chmod 777 /data/local/tmp/fre3vo[/B]
$ [B]chmod 777 /data/local/tmp/misc_version[/B]
$ [B]/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF[/B]

davidreece said:
sorry maroof not sure whats wrong maybe ask in the original thread linked at the 1st post
Click to expand...
Click to collapse
Thanks for the reply but the thing is that am i doing the right way as i wrote in my last thread that first i mix 4th step and fifth but then i realize and did the same as in 4th step? If its right then offcourse i 'll ask someone in the original thread.

davidreece said:
Eureka i have updated the instructions jurgen also redownload my fre3vo link just in case it was different, i knew i had to do something else, please let me know if it works now
Click to expand...
Click to collapse
That did the trick!! I'm running Saga LBC Mod as we speak!! The steps I followed after downloading the bits from the first post for this were the following:
adb push fre3vo /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
reboot the phone with the cable attached to the computer
adb shell (this gives a $-prompt)
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF (when everything is OK you'll go back to your own prompt, not the phones)
adb shell (you'll have a #-prompt now, cause the the is temp-rooted)
/data/local/tmp/misc_version -s 1.27.405.6
install the earliest RUU version you can find. I used RUU_Saga_HTC_Europe_1.28.401.1_Radio_20.28b.30.0805U_38.03.02.11_M_release_177977_signed
after rebooting your phone has the old HBOOT (0.98.0000)
enable USB Debugging (Settings - Applications - Development) and reboot the phone again
Run the AlphaRevX binary and don't install the CWM recovery, we'll use 4EXTRecovery lateron
congratulations, your phone is now S-OFF!
download the latest EXT4Recovery from here
adb reboot bootloader
fastboot flash recovery [PATH TO recovery.img]
fastboot reboot-bootloader
go to the recovery and install any ROM you like
Big thanx again to David!

glad it worked, i knew it was in there somewhere is it ok if i add your instructions to the first post to save confusion

@david
Of course it is, let the S-OFF-ing begin (again)

jorgen2009 said:
That did the trick!! I'm running Saga LBC Mod as we speak!! The steps I followed after downloading the bits from the first post for this were the following:
adb push fre3vo /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
reboot the phone with the cable attached to the computer
adb shell (this gives a $-prompt)
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF (when everything is OK you'll go back to your own prompt, not the phones)
adb shell (you'll have a #-prompt now, cause the the is temp-rooted)
/data/local/tmp/misc_version -s 1.27.405.6
install the earliest RUU version you can find. I used RUU_Saga_HTC_Europe_1.28.401.1_Radio_20.28b.30.0805U_38.03.02.11_M_release_177977_signed
after rebooting your phone has the old HBOOT (0.98.0000)
enable USB Debugging (Settings - Applications - Development) and reboot the phone again
Run the AlphaRevX binary and don't install the CWM recovery, we'll use 4EXTRecovery lateron
congratulations, your phone is now S-OFF!
download the latest EXT4Recovery from here
adb reboot bootloader
fastboot flash recovery [PATH TO recovery.img]
fastboot reboot-bootloader
go to the recovery and install any ROM you like
Big thanx again to David!
Click to expand...
Click to collapse
all worked well but while installing RUU_Saga_HTC_Europe_1.28.401.1. Its gives an error saying CUSTOMER ID Error. Now what

maroof.saeed said:
all worked well but while installing RUU_Saga_HTC_Europe_1.28.401.1. Its gives an error saying CUSTOMER ID Error. Now what
Click to expand...
Click to collapse
are you using the exe version of the ruu, if you are maybe try making your sdcard into a gold card

[Q] Help with S-Off and Rooting my HTC Merge

I understand there are other threads about this however I do feel my situation is either unique or I've missed something in the other threads.
I've got an HTC Merge through US Cellular. I upgraded to Gingerbread 2.3.4 as soon as it was released through USC's website. Now I'd like to root and all that other stuff.
1.: I didn't S-off before the update. Does anyone know how to properly S-off 2.3.4 Gingerbread on a USC HTC Merge?
2.: I've never rooted a phone before, but I'm pretty sure I've read about it plenty and I'm ready to give it a shot. What's the best way to do this on my current phone?
3.: What are some good modded ROMs available for this device, if any exist at all? I've been interesting in Cyanogen Mod but as far as I've seen it's not supported on the Merge yet.
If anyone can assist me I'd appreciate it greatly. Thanks in advance. =)

if you have adb set up and working,and have some knowledge of it,you can use drellisdees directions in this post,along with the new zergRush temp root tool from alpharev/unrevoked. donate to them both if it works for you.
download the zergRush tool from this post:http://forum.xda-developers.com/showthread.php?t=1296916 and place the file thats inside the .zip into the same folder as your other exploits(tools or platform-tools in ost cases)
below is his post,modified slightly,with the zergRush directions(bold) in place of the originaly froyo directions.
i also removed the parts about downloading your carriers RUU,and backing up your system for vzw since you said you were USC.
assuming you want to remain on rooted GB,just use the same RUU that you used to upgrade at the end where it says to run your carriers RUU.
drellisdee said:
Well, ask and you shall receive!!!
I got s-off on vzw merge. However, altell or USC ones it will require supercid or a goldcard to flash ruu from another carrier.
Tested and working CWM recovery I made for merge and latest radio hboot zips after s-off.
You must verify all Md5sums after downloading to computer (don't even think about downloading on phone) before flashing or risk a brick!!!!! Windows users can get one here & linux users can just type md5sum (name of file) into terminal.
Md5's
8cd1ca796e755b6b72f35e5686dc973a PD42IMG_cw_recovery_gnm.zip
97e35ecc802081b67e27d6cc8323cf81 PD42IMG_radio_1.08.00.320.zip
cc2e7c077fddd017d7b0db614661c535 PD42IMG_1.49.605.1_no_system.zip
4fe37c64b21d1d4542a801779fad5c57 misc-downgrade.img
6d37a0f3526295ebb779f4465a328c96 rom.zip (leaked 1.23.605.1)
http://www.mediafire.com/file/6b2jatt0445h41g/PD42IMG_cw_recovery_gnm.zip
http://www.mediafire.com/file/gbayon7dkmaq98i/PD42IMG_radio_1.08.00.320.zip
I am exploring a goldcard method that will allow flashing of the vzw ruu 1.23.605.1 that can be s-off'ed to allow other carriers merge's to be able to downgrade to s-off.
How to on s-off will be coming soon .... stay posted
Ok how to guide for s-off.
Files needed:
MISCIMG Downgrade http://www.mediafire.com/file/f7c3boee7ixa3i9/misc-downgrade.img
VZW leak 1.23.605.1 ruu.zip http://forum.xda-developers.com/showpost.php?p=8237592&postcount=2
Exploits http://www.mediafire.com/file/e9w92clv6l71el3/exp.zip
HEADS UP: This guide will reflash your phone and cause loss of all non-backed up data
Goldcard is required for ALL NON-VZW phones
Read how to make one here : http://www.mikesouthby.co.uk/2010/0...yo-official-ota-for-network-branded-handsets/
I used the app goldcard helper from market and if you use it skip right to the step of "Go to this page and enter this new number into the SD Card Serial (CID) field" and enter the output of the sdcard cid for mmc2 into the goldcard generator site.
After goldcard is made via directions in link above or if on vzw branded device you can skip the goldcard part. Next rename the vzw leak ruu.zip to PD42IMG.zip and place it on root of sdcard.
Next from dir you downloaded stuff to unzip the exp.zip and copy the exp folder to your android sdk platform-tools dir (if using windows) linux users should have adb in path so this shouldn't be needed just open terminal from download dir. Make sure the phone is in usb mode charge-only from this point on with usb-debugging turned on (settings/applications/development).
Code:
[B]adb push zergRush /data/local/
adb shell[/B] [I]this will change your promt to a $[/I]
[B]chmod 755 /data/local/zergRush
/data/local/zergRush[/B]
Next we backup our existing misc partition.
Code:
adb shell
dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
/data/local/busybox md5sum /sdcard/misc-stock.img
/data/local/busybox md5sum /dev/block/mmcblk0p17
Make sure the md5sum of the misc-stock.img matches the one from /dev/block/mmcblk0p17
Next we use temp root to flash a misc.img that I hex edited to allow downgrading FW. misc-downgrade.img needs to be in platform-tools dir for windows users.
Code:
adb push misc-downgrade.img /sdcard/
adb shell
dd if=/sdcard/misc-downgrade.img of=/dev/block/mmcblk0p17
sync
Next power off your phone and boot it holding vol_dn + power.
Let the PD42IMG.zip complete ( will do hboot + radio then self reboot and restart to finish the rest)
Once rebooted into the 1.23.605.1 firmware
Code:
adb push exp /data/local
adb shell
chmod 0755 /data/local/psneuter
chmod 0755 /data/local/wpthis
chmod 0755 /data/local/gfree
/data/local/psneuter (to get temp root again)
adb shell
/data/local/wpthis (to disable emmc write protect)
/data/local/gfree -f (this will supercid, simunlock, and s-off phone)
rm /sdcard/PD42IMG.zip (remove/delete the leaked FW so hboot wont load it again)
Reboot into bootloader and verify you have s-off
If so reboot into android and use your carrier's RUU to replace your FW. You will not lose s-off. If on vzw unzip the PD42IMG_1.49.605.1_no_system.zip and add your system.img from your memory card we dumped earlier to the zip. Rezip and rename to PD42IMG.zip and place on root of sdcard and reboot into hboot to flash it just like we did earlier. This will restore the shipped 1.49.605.1 hboot, radio, boot.img, stock recovery.img, and system.img.
After you have upgraded backup you can use the clockwork recovery.img I made and rename it to PD42IMG.zip (make sure to delete the old PD42IMG.zip on your sdcard) and place it on root of sdcard and flash via hboot just like the other PD42IMG.zip's. Then you will have s-off and a custom recovery. Remember to remove/rename/move the PD42IMG.zips when done as they will flash if you enter hboot. Recovery can be entered via bootloader by picking recovery or via "adb reboot recovery".
Flashing this zip via clockwork recovery will install root (su & superuser.apk), busybox & symlink applets, flash & dump image. signed_merge_su_eng_toolkit.zip
After you have root on your release firmware:
The following commands will restore your stock misc.img
from a root # shell: (will need to type su after adb shell and accept superuser pop-up)
Code:
adb shell
dd if=/sdcard/misc-stock.img of=/dev/block/mmcblk0p17
sync
Special thanks to Scotty2 & Tmzt who wrote and developed the wpthis & gfree exploits for the G2 without these s-off for lexikon wouldn't have been possible for me.
My donation link is below if anyone wants to toss me a donation. Took me about a week to port RA recovery to merge only to fail as it had issues then to setup the board files for lexikon for cm7 to do a clockwork recovery and not to mention dumping partitons and working on the s-off stuff and goldcard.
Click to expand...
Click to collapse

I got as far as the /data/local/zergRush and got this error:
[-] Cannot copy boomsh. : Permission denied.
adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush
Any ideas?
Thanks

kclive said:
I got as far as the /data/local/zergRush and got this error:
[-] Cannot copy boomsh. : Permission denied.
adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush
Any ideas?
Thanks
Click to expand...
Click to collapse
that error comes from running zergrush twice. http://androidforums.com/merge-all-...simunlock-supercid-htc-merge.html#post3522248

pls how can i run this commands with miniadb, i dont hav access to the whole android sdk tool...and besides, the zergrush binary link above aint workin..any other alternative dload link pls??

akins47 said:
pls how can i run this commands with miniadb, i dont hav access to the whole android sdk tool...and besides, the zergrush binary link above aint workin..any other alternative dload link pls??
Click to expand...
Click to collapse
zergrush is broken with newer builds. fre3vo worked for some. i would recomend you htcdev unlock in order to gain root access for downgrade.
follow directions here to htcdev unlock:
http://androidforums.com/merge-all-things-root/635459-unlock-htcdev.html
then follow directions here:
http://androidforums.com/merge-all-things-root/434029-root-s-off-simunlock-supercid-htc-merge.html
using the "htcdev" step 5 in post#2

[Q] How to downgrade Sensation xe hboot 1.19 s-on

How to downgrade the Sensation xe
hboot version is older
My Sensation xe hboot 1.19.000 s-on
I can not get the s-off please help me to thank all

alwayskangel said:
How to downgrade the Sensation xe
hboot version is older
My Sensation xe hboot 1.19.000 s-on
I can not get the s-off please help me to thank all
Click to expand...
Click to collapse
Can you try the following method?? It worked for some users.
Required downloads:
First download the official Gingerbread RUU with hboot1.17 for your device . I will not post any link for the RUU . Search it on the forum. Please choose your RUU according to your career and geographical location.
Setting up your PC:
Set Up your PC with ADB and FASTBOOT .
Get fastboot and adb tool for windows here or Get Fastboot and adb for linux here.
Download universal misc_version and unzip to obtain the misc_version file.
Download tacoroot
Place both the misc_version and tacoroot.bin files in the same directory as adb on your pc.
Procedure:
Check the version number for your gingerbread RUU
For example I am using this RUU: RUU_PYRAMID_HTC_WWE_1.03.405.3_R_Radio_10.58.00.30.08 9BU_3809.05.04.10_M_release_194964_signed.exe
The version is the part highlighted in green.
Boot your sensation up to android if it's not already on, with usb debugging enabled and connect it to the PC.
Run the following adb commands
adb push tacoroot.bin /data/local
adb push misc_version /data/local
adb shell chmod 755 /data/local/tacoroot.bin
adb shell chmod 755 /data/local/misc_version
adb shell /data/local/tacoroot.bin --setup
At this point your device will reboot to recovery
Simultaneously press Volume Up, Volume Down and Power
Reboot your device
Run the following command
adb shell /data/local/tacoroot.bin --root
Your device will reboot, do not worry if it does not boot fully, it doesn't matter for this procedure, and it is a side effect of this root exploit.
Run the following command:
adb shell /data/local/misc_version -s 1.03.405.3
Note that the number in green is the version number retrieved in step 1.
Reboot to fastboot:
adb reboot bootloader
Run your RUU from Windows PC. You have a linux PC then extract the ROM.zip and rename it into PG58IMG.zip and then place it on the root of your SDCARD. Reboot your phone into bootloader. It will prompt for update. Follow the on screen guide.
After this you will have hboot1.17 which is supported by revolutionary to S-OFF.

is that work on sensation z710e?

musarraf172 said:
Can you try the following method?? It worked for some users.
Required downloads:
First download the official Gingerbread RUU with hboot1.17 for your device . I will not post any link for the RUU . Search it on the forum. Please choose your RUU according to your career and geographical location.
Setting up your PC:
Set Up your PC with ADB and FASTBOOT .
Get fastboot and adb tool for windows here or Get Fastboot and adb for linux here.
Download universal misc_version and unzip to obtain the misc_version file.
Download tacoroot
Place both the misc_version and tacoroot.bin files in the same directory as adb on your pc.
Procedure:
Check the version number for your gingerbread RUU
For example I am using this RUU: RUU_PYRAMID_HTC_WWE_1.03.405.3_R_Radio_10.58.00.30.08 9BU_3809.05.04.10_M_release_194964_signed.exe
The version is the part highlighted in green.
Boot your sensation up to android if it's not already on, with usb debugging enabled and connect it to the PC.
Run the following adb commands
adb push tacoroot.bin /data/local
adb push misc_version /data/local
adb shell chmod 755 /data/local/tacoroot.bin
adb shell chmod 755 /data/local/misc_version
adb shell /data/local/tacoroot.bin --setup
At this point your device will reboot to recovery
Simultaneously press Volume Up, Volume Down and Power
Reboot your device
Run the following command
adb shell /data/local/tacoroot.bin --root
Your device will reboot, do not worry if it does not boot fully, it doesn't matter for this procedure, and it is a side effect of this root exploit.
Run the following command:
adb shell /data/local/misc_version -s 1.03.405.3
Note that the number in green is the version number retrieved in step 1.
Reboot to fastboot:
adb reboot bootloader
Run your RUU from Windows PC. You have a linux PC then extract the ROM.zip and rename it into PG58IMG.zip and then place it on the root of your SDCARD. Reboot your phone into bootloader. It will prompt for update. Follow the on screen guide.
After this you will have hboot1.17 which is supported by revolutionary to S-OFF.
Click to expand...
Click to collapse
First of all thank you very
But I still can not get HBOOT downgrade
The flash PG58IMG.zip message is
(HBOOT version is old)
May be MY flash version is 1.18.0000
Download 1.17.0000 RUU try again
Thank you again

i try it but not working for me.
i am unlocked by htcdev
my hboot is 1.23.0000
s-on

I still can Not the get HBOOT downgrade
The flash PG58IMG.zip message is
(HBOOT version is the old)
It is a pity that I can only continue to wait for a better way
thank you very much

musarraf172 said:
Can you try the following method?? It worked for some users.
Required downloads:
First download the official Gingerbread RUU with hboot1.17 for your device . I will not post any link for the RUU . Search it on the forum. Please choose your RUU according to your career and geographical location.
Setting up your PC:
Set Up your PC with ADB and FASTBOOT .
Get fastboot and adb tool for windows here or Get Fastboot and adb for linux here.
Download universal misc_version and unzip to obtain the misc_version file.
Download tacoroot
Place both the misc_version and tacoroot.bin files in the same directory as adb on your pc.
Procedure:
Check the version number for your gingerbread RUU
For example I am using this RUU: RUU_PYRAMID_HTC_WWE_1.03.405.3_R_Radio_10.58.00.30.08 9BU_3809.05.04.10_M_release_194964_signed.exe
The version is the part highlighted in green.
Boot your sensation up to android if it's not already on, with usb debugging enabled and connect it to the PC.
Run the following adb commands
adb push tacoroot.bin /data/local
adb push misc_version /data/local
adb shell chmod 755 /data/local/tacoroot.bin
adb shell chmod 755 /data/local/misc_version
adb shell /data/local/tacoroot.bin --setup
At this point your device will reboot to recovery
Simultaneously press Volume Up, Volume Down and Power
Reboot your device
Run the following command
adb shell /data/local/tacoroot.bin --root
Your device will reboot, do not worry if it does not boot fully, it doesn't matter for this procedure, and it is a side effect of this root exploit.
Run the following command:
adb shell /data/local/misc_version -s 1.03.405.3
Note that the number in green is the version number retrieved in step 1.
Reboot to fastboot:
adb reboot bootloader
Run your RUU from Windows PC. You have a linux PC then extract the ROM.zip and rename it into PG58IMG.zip and then place it on the root of your SDCARD. Reboot your phone into bootloader. It will prompt for update. Follow the on screen guide.
After this you will have hboot1.17 which is supported by revolutionary to S-OFF.
Click to expand...
Click to collapse
it don't work for 3.32.709.108