Database Info

[How to] [Linux] Root Hboot 2.02

For anyone having issues with running this in linux.
I used zikronix guide and modified it for use in a linux support thread. The original thread can be found here:
http://forum.xda-developers.com/showthread.php?t=829045
This is my setup:
-I made sure to show my .bashrc profile and path to my tools folder if you needed help getting that setup as well... If not please ignore.
Code:
[email protected]:~$ cat .bashrc | grep adb
alias start-adb='sudo /usr/local/android-sdk/tools/./adb start-server'
alias kill-adb='sudo /usr/local/android-sdk/tools/./adb kill-server'
[email protected]:~$ cat .bashrc | grep android-sdk
export PATH="/usr/local/android-sdk/tools/:${PATH}"
[email protected]:~$ $PATH
bash: /usr/local/android-sdk/tools/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:
Download: http://www.wackynoodle.com/hboot202-s_off-V6.2.zip
Download (Mirror): http://sdx-downloads.com/EVO/devs/jerdog/fixes/hboot202-s_off-V6.2.zip
Now This might make things easier.
-I have this so that you are in the same enviroment that i was in so that the paths will be the same.
Code:
wget http://www.wackynoodle.com/hboot202-s_off-V6.2.zip
mkdir Evo-root
mv hboot202-s_off-V6.2.zip
cd Evo-root
unzip hboot202-s_off-V6.2.zip
- This step I just made sure that adb devices showed my device. If not get it working.
- Once adb devices showed my device properly, I simply ran the following commands.
Code:
adb push root/unrevoked-forever.zip /sdcard/
adb push root/mtd-eng.img /sdcard/
adb push pc36img/PC36IMG-ENG.zip /sdcard/PC36IMG.zip
adb push root/flash_image /data/local/
adb push root/rageagainstthecage /data/local/tmp
adb push root/amon_ra.img /sdcard/
- Then this is just changing permissions. Pretty straight forward.
Code:
adb shell
chmod 0755 /data/local/tmp/rageagainstthecage
chmod 0755 /data/local/flash_image
- Running the script. Should kick you out of adb... If not after 5 min kill the adb server and restart.
Code:
adb shell
./data/local/tmp/rageagainstthecage
- Now you should see a "#", if you do proceed. If not then run the script above again till it works.
Code:
adb shell
- If you saw that "#" run this. This can only be ran as root "#" means root.
Code:
./data/local/flash_image misc /sdcard/mtd-eng.img
Now you are going to want to reboot into the bootloader. Make sure once you do that you selet bootloader and let the PC36IMG.zip load.
Code:
reboot bootloader
After that is done reboot into the new rooted rom. Then make sure adb works again. Then run the following commands. Make sure you terminal is in the same directory this entire time there is no reason to leave the direcory we went into earlier "cd Evo-root" You directory should always be Evo-root. Thanks. The part that I found out was the second command where the entire recovery/ needed the permissions changed to be executable. As you saw in my post on that forum board.
- This will remove the PC36IMG.zip to a different name so that the bootloader won't get confused again. Then the second commands makes the directory executable recursivly. Then the third will reboot you into recovery.
Code:
adb shell mv /sdcard/PC36IMG.zip /sdcard/PC36IMG-ENG.zip
chmod -R +x recovery/
adb reboot recovery
- Now this is going to be done at the recovery screen. As long as you followed the steps above it will work fine. Should only take you about 20 mins to root this phone. Though it took me about 2 hours since no one else has been rooting using linux. I am thinking about writing a script that will root everything and alls you have to do is follow a terminal guide.... But ill see.
- Just run these commands that will allow you to flash the unrevoked-forever.zip. Once you follow the onscreen instructions of the unrevoked-forever.zip you will be able to reboot into the recovery and see the S-Off. Once that is done reboot into the rom, now we need to flash a custom recovery!
Code:
adb push recovery /
adb shell busybox --install /sbin
adb shell nohup /sbin/recovery &
- Again make sure your terminal was never closed and in the same folder. Then simply run these commands to flash the Amon_ra recovery. Since it has wimax capabilities I prefer it.
Code:
adb push root/flash_image /data/local/
adb shell
chmod 0755 /data/local/flash_image
./data/local/flash_image recovery /sdcard/amon_ra.img
reboot recovery
Now you should see the custom recovery and you should be able to flash any rom you desire!

reserved for later use

i see that they are same commands as the pc.., so would this also work with PC?

nickespi said:
i see that they are same commands as the pc.., so would this also work with PC?
Click to expand...
Click to collapse
I am guessing your talking about windows? Sure make sure adb is in your path. Though there are steps in here that are only for linux.

95% success
Well I want to thank you for this thread
It has worked for me I have root I have NAND unlocked
I can flash ROMs
The only issue I have is my radio/baseband and PRI version have been lowered
I have not been able to get thise back where they whould with either update or by using teh wimax.ADDRESS.tree.xml fix (there is no file with that)
If you have any ideas how to fix this would be much appreciated
I am unable to get higher tahn baseband 1.36.00.04.02 in ant rom
when I got teh phone it was 2.15.00.xx.xx
any help would be appreciated

100% Success
THANK YOU
My Evo
Hardware 004
Build 3.30
Hboot 2.02
Baseband 2.15.xx.xx
is now sucessfully rooted.
I did have some problems after being able to flash ROMs of not haveing PRI and Baseband updated.
On thread #787756 there are downloads that can be flashed to fix this problem if anyone else is in that boat.
zikronix sent me there for the fix...I believe he is adding it to the main thread but if it isn't there yet I wanted to add it now for anyone in my boat.
Again this method works and there is success.
Happy rooting

Hey thanx for this Linux guide. Does this steps work with the update 12.25.10 on the windows thread?
Will you update this guide?

[UPDATED]how to root 1.47.161.2 hboot 002 (and possibly others)

sorry about all the updates i am trying to remember as i go along with the help of the comments below, we will get this working as i know it does
i have actually managed it i used fre3vo from this thread
http://forum.xda-developers.com/showthread.php?t=1178912
but i combined the instructions with post 4 from the downgrade thread ( part where you have to chmod the version file then change the version.
first download http://forum.xda-developers.com/attachment.php?attachmentid=591335&d=1304969547
and also this
http://forum.xda-developers.com/attachment.php?attachmentid=661246&d=1311240968
extract them to the same folder then open a command prompt in that folder and follow these instructions pressing enter at the end of each step
(big thanks to Jorgen2009 for cleaning up the instructions)
Instructions:
1. adb push fre3vo /data/local/tmp
2. adb push misc_version /data/local/tmp
3. adb shell chmod 777 /data/local/tmp/fre3vo
4. adb shell chmod 777 /data/local/tmp/misc_version
5. reboot the phone with the cable attached to the computer
6. adb shell (this gives a $-prompt)
7. /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF (when everything is OK you'll go back to your own prompt, not the phones)
8. adb shell (you'll have a #-prompt now, cause the the is temp-rooted)
9. /data/local/tmp/misc_version -s 1.27.405.6
10. install the earliest RUU version you can find. I used RUU_Saga_HTC_Europe_1.28.401.1_Radio_20.28b.30.080 5U_38.03.02.11_M_release_177977_signed
11. after rebooting your phone has the old HBOOT (0.98.0000)
12. enable USB Debugging (Settings - Applications - Development) and reboot the phone again
13. Run the AlphaRevX binary and don't install the CWM recovery, we'll use 4EXTRecovery lateron
congratulations, your phone is now S-OFF!
download the latest EXT4Recovery from here
adb reboot bootloader
fastboot flash recovery [PATH TO recovery.img]
fastboot reboot-bootloader
go to the recovery and install any ROM you like
hope this helps everyone.
as usuall not my fault, brick yadda yadda
credit to sethario, the fre3vo dev team and Jorgen2009

davidreece said:
i have actually managed it i used fre3vo from this thread
http://forum.xda-developers.com/showthread.php?t=1150006
but i combined the instructions with post 4 from the downgrade thread ( part where you have to chmod the version file then change the version.
first download http://forum.xda-developers.com/attachment.php?attachmentid=591335&d=1304969547
and also this
http://forum.xda-developers.com/attachment.php?attachmentid=661246&d=1311240968
extract them to the same folder then open a command prompt in that folder and follow these instructions
Instructions:
1. adb push fre3vo /data/local/tmp
2. adb push misc_version /data/local/tmp
3. adb shell chmod 777 /data/local/tmp/fre3vo
4. adb shell chmod 777 /data/local/tmp/misc_version
5. Run the binary via 'adb shell /data/local/tmp/fre3vo'
If all goes well, you'll be kicked back to your computer's command prompt.
run 'adb shell' and you should have a '#' prompt instead of $
6. cd /data/local/tmp
./misc_version -s 1.27.405.6
From here you can then install the update/downgrade from the ruu exe for your phone from http://forum.xda-developers.com/showthread.php?t=1002506
then you can just follow the alpharevx instructions as normal because you will be able to run gingerbreak etc, this works on the latest updates as i couldnt use gingerbreak to downgrade due to the vodafone uk update and i am now on a custom rom and s offed
hope this helps everyone.
as usuall not my fault, brick yadda yadda
Click to expand...
Click to collapse
Brilliant and well done. .
could you please add exactly which 1.47 version that you achieved this on and from which country.
also get this useful thread added to the INDEX sticky thread that we have be either PM' ing threads OP or adding post in that Thread.
Sent from my HTC Desire S using XDA Premium App

ben_pyett said:
Brilliant and well done. .
could you please add exactly which 1.47 version that you achieved this on and from which country.
also get this useful thread added to the INDEX sticky thread that we have be either PM' ing threads OP or adding post in that Thread.
Sent from my HTC Desire S using XDA Premium App
Click to expand...
Click to collapse
not sure exactly what 1.47 as its gone now but as i said in my post im on a vodafone uk if that helps
also just to make it clear, none of this is my own work guys a lot brighter than me figured all the hard stuff out, i just fitted the different bits together

davidreece said:
not sure exactly what 1.47 as its gone now but as i said in my post im on a vodafone uk if that helps
also just to make it clear, none of this is my own work guys a lot brighter than me figured all the hard stuff out, i just fitted the different bits together
Click to expand...
Click to collapse
All the same, Putting the bits together, writing the guide and having the balls to try all of these steps on your own device is worthy of thanks and just a little praise
Sent from my HTC Desire S using XDA Premium App

thanks ben just glad to put something back instead of leeching all the devs hard work all the time

Thanx davidreece, great find!
Unfortunately it's not working for me I get stuck at point 5 running the fre3vo binary. I waited 20 minutes for it to complete, but it's still saying "please wait" with a blinking cursor. For the record, I'm using this rom: RUU_Saga_HTC_Europe_1.47.401.4_Radio_20.28I.30.085 AU_3805.06.02.03_M_release_199410_signed. That could be the problem perhaps.
I also noticed that the the fre3vo link from your article is a bit older then the fre3vo version on the fre3vo thread. Of course i tried that one too, but it gives the same result for me
Any ideas?
Cheers

not a clue jorgen sorry i should maybe add the words "some"
just a thought when you ran the fre3vo command where you in adb shell or at the command prompt >, i seem to remember it happened to me the first time i tried it but i cant remember how i got it wrong, ithink you have to enter the adb shell command first then enter /data/local/tmp/fre3vo next or it may be enter them both together as one line i cant really remember, i was so surprised it worked if anyone else gets this to work could you please clarify the fre3vo steps and i will update the main post thanks, hope this helps, also i only used the link version not any newer one

davidreece said:
not a clue jorgen sorry i should maybe add the words "some"
just a thought when you ran the fre3vo command where you in adb shell or at the command prompt >, i seem to remember it happened to me the first time i tried it but i cant remember how i got it wrong, ithink you have to enter the adb shell command first then enter /data/local/tmp/fre3vo next or it may be enter them both together as one line i cant really remember, i was so surprised it worked if anyone else gets this to work could you please clarify the fre3vo steps and i will update the main post thanks, hope this helps, also i only used the link version not any newer one
Click to expand...
Click to collapse
I tried both methods, both with the same result. It's great to see however it worked for you. It means there is at least a possibility to get S-OFF on updated devices

jorgen2009 said:
I tried both methods, both with the same result. It's great to see however it worked for you. It means there is at least a possibility to get S-OFF on updated devices
Click to expand...
Click to collapse
really sorry i falsly got your hopes up, maybe ask in the fre3vo forum maybe im just getting it wrong, it was 4am here when i succeeded so its all a bit hazy

jorgen2009 said:
Thanx davidreece, great find!
Unfortunately it's not working for me I get stuck at point 5 running the fre3vo binary. I waited 20 minutes for it to complete, but it's still saying "please wait" with a blinking cursor. For the record, I'm using this rom: RUU_Saga_HTC_Europe_1.47.401.4_Radio_20.28I.30.085 AU_3805.06.02.03_M_release_199410_signed. That could be the problem perhaps.
I also noticed that the the fre3vo link from your article is a bit older then the fre3vo version on the fre3vo thread. Of course i tried that one too, but it gives the same result for me
Any ideas?
Cheers
Click to expand...
Click to collapse
Eureka i have updated the instructions jurgen also redownload my fre3vo link just in case it was different, i knew i had to do something else, please let me know if it works now

I remember seeing in the original fre3evo thread there was a series or range of hex addresses to try if the first default one didn't achieve root
Sent from my HTC Desire S using XDA Premium App

I am stuck on instructions step 5. it says unable to chmod -debug: No such file or directory. My Bootloader version is 0.98.0002. In my understanding instructions step 5 is confusing as first i wrote it with step 4 and then i realize that first write adb shell chmod 777 etc etc. Am i doing right?

maroof.saeed said:
I am stuck on instructions step 5. it says unable to chmod -debug: No such file or directory. My Bootloader version is 0.98.0002. In my understanding instructions step 5 is confusing as first i wrote it with step 4 and then i realize that first write adb shell chmod 777 etc etc. Am i doing right?
Click to expand...
Click to collapse
sorry maroof not sure whats wrong maybe ask in the original thread linked at the 1st post

maroof.saeed said:
I am stuck on instructions step 5. it says unable to chmod -debug: No such file or directory. My Bootloader version is 0.98.0002. In my understanding instructions step 5 is confusing as first i wrote it with step 4 and then i realize that first write adb shell chmod 777 etc etc. Am i doing right?
Click to expand...
Click to collapse
Hello, you're right there appears to is a slight mistake above, from my understanding of this the commands they should be entered as I've shown below from your PC within a command shell window with a <RETURN> at the end of every line.
Code:
C:\Program Files\Microsoft Support Tools> [B]adb shell [/B]
$ [B]chmod 777 /data/local/tmp/fre3vo[/B]
$ [B]chmod 777 /data/local/tmp/misc_version[/B]
$ [B]/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF[/B]

davidreece said:
sorry maroof not sure whats wrong maybe ask in the original thread linked at the 1st post
Click to expand...
Click to collapse
Thanks for the reply but the thing is that am i doing the right way as i wrote in my last thread that first i mix 4th step and fifth but then i realize and did the same as in 4th step? If its right then offcourse i 'll ask someone in the original thread.

davidreece said:
Eureka i have updated the instructions jurgen also redownload my fre3vo link just in case it was different, i knew i had to do something else, please let me know if it works now
Click to expand...
Click to collapse
That did the trick!! I'm running Saga LBC Mod as we speak!! The steps I followed after downloading the bits from the first post for this were the following:
adb push fre3vo /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
reboot the phone with the cable attached to the computer
adb shell (this gives a $-prompt)
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF (when everything is OK you'll go back to your own prompt, not the phones)
adb shell (you'll have a #-prompt now, cause the the is temp-rooted)
/data/local/tmp/misc_version -s 1.27.405.6
install the earliest RUU version you can find. I used RUU_Saga_HTC_Europe_1.28.401.1_Radio_20.28b.30.0805U_38.03.02.11_M_release_177977_signed
after rebooting your phone has the old HBOOT (0.98.0000)
enable USB Debugging (Settings - Applications - Development) and reboot the phone again
Run the AlphaRevX binary and don't install the CWM recovery, we'll use 4EXTRecovery lateron
congratulations, your phone is now S-OFF!
download the latest EXT4Recovery from here
adb reboot bootloader
fastboot flash recovery [PATH TO recovery.img]
fastboot reboot-bootloader
go to the recovery and install any ROM you like
Big thanx again to David!

glad it worked, i knew it was in there somewhere is it ok if i add your instructions to the first post to save confusion

@david
Of course it is, let the S-OFF-ing begin (again)

jorgen2009 said:
That did the trick!! I'm running Saga LBC Mod as we speak!! The steps I followed after downloading the bits from the first post for this were the following:
adb push fre3vo /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
reboot the phone with the cable attached to the computer
adb shell (this gives a $-prompt)
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF (when everything is OK you'll go back to your own prompt, not the phones)
adb shell (you'll have a #-prompt now, cause the the is temp-rooted)
/data/local/tmp/misc_version -s 1.27.405.6
install the earliest RUU version you can find. I used RUU_Saga_HTC_Europe_1.28.401.1_Radio_20.28b.30.0805U_38.03.02.11_M_release_177977_signed
after rebooting your phone has the old HBOOT (0.98.0000)
enable USB Debugging (Settings - Applications - Development) and reboot the phone again
Run the AlphaRevX binary and don't install the CWM recovery, we'll use 4EXTRecovery lateron
congratulations, your phone is now S-OFF!
download the latest EXT4Recovery from here
adb reboot bootloader
fastboot flash recovery [PATH TO recovery.img]
fastboot reboot-bootloader
go to the recovery and install any ROM you like
Big thanx again to David!
Click to expand...
Click to collapse
all worked well but while installing RUU_Saga_HTC_Europe_1.28.401.1. Its gives an error saying CUSTOMER ID Error. Now what

maroof.saeed said:
all worked well but while installing RUU_Saga_HTC_Europe_1.28.401.1. Its gives an error saying CUSTOMER ID Error. Now what
Click to expand...
Click to collapse
are you using the exe version of the ruu, if you are maybe try making your sdcard into a gold card

[Q] Help with S-Off and Rooting my HTC Merge

I understand there are other threads about this however I do feel my situation is either unique or I've missed something in the other threads.
I've got an HTC Merge through US Cellular. I upgraded to Gingerbread 2.3.4 as soon as it was released through USC's website. Now I'd like to root and all that other stuff.
1.: I didn't S-off before the update. Does anyone know how to properly S-off 2.3.4 Gingerbread on a USC HTC Merge?
2.: I've never rooted a phone before, but I'm pretty sure I've read about it plenty and I'm ready to give it a shot. What's the best way to do this on my current phone?
3.: What are some good modded ROMs available for this device, if any exist at all? I've been interesting in Cyanogen Mod but as far as I've seen it's not supported on the Merge yet.
If anyone can assist me I'd appreciate it greatly. Thanks in advance. =)

if you have adb set up and working,and have some knowledge of it,you can use drellisdees directions in this post,along with the new zergRush temp root tool from alpharev/unrevoked. donate to them both if it works for you.
download the zergRush tool from this post:http://forum.xda-developers.com/showthread.php?t=1296916 and place the file thats inside the .zip into the same folder as your other exploits(tools or platform-tools in ost cases)
below is his post,modified slightly,with the zergRush directions(bold) in place of the originaly froyo directions.
i also removed the parts about downloading your carriers RUU,and backing up your system for vzw since you said you were USC.
assuming you want to remain on rooted GB,just use the same RUU that you used to upgrade at the end where it says to run your carriers RUU.
drellisdee said:
Well, ask and you shall receive!!!
I got s-off on vzw merge. However, altell or USC ones it will require supercid or a goldcard to flash ruu from another carrier.
Tested and working CWM recovery I made for merge and latest radio hboot zips after s-off.
You must verify all Md5sums after downloading to computer (don't even think about downloading on phone) before flashing or risk a brick!!!!! Windows users can get one here & linux users can just type md5sum (name of file) into terminal.
Md5's
8cd1ca796e755b6b72f35e5686dc973a PD42IMG_cw_recovery_gnm.zip
97e35ecc802081b67e27d6cc8323cf81 PD42IMG_radio_1.08.00.320.zip
cc2e7c077fddd017d7b0db614661c535 PD42IMG_1.49.605.1_no_system.zip
4fe37c64b21d1d4542a801779fad5c57 misc-downgrade.img
6d37a0f3526295ebb779f4465a328c96 rom.zip (leaked 1.23.605.1)
http://www.mediafire.com/file/6b2jatt0445h41g/PD42IMG_cw_recovery_gnm.zip
http://www.mediafire.com/file/gbayon7dkmaq98i/PD42IMG_radio_1.08.00.320.zip
I am exploring a goldcard method that will allow flashing of the vzw ruu 1.23.605.1 that can be s-off'ed to allow other carriers merge's to be able to downgrade to s-off.
How to on s-off will be coming soon .... stay posted
Ok how to guide for s-off.
Files needed:
MISCIMG Downgrade http://www.mediafire.com/file/f7c3boee7ixa3i9/misc-downgrade.img
VZW leak 1.23.605.1 ruu.zip http://forum.xda-developers.com/showpost.php?p=8237592&postcount=2
Exploits http://www.mediafire.com/file/e9w92clv6l71el3/exp.zip
HEADS UP: This guide will reflash your phone and cause loss of all non-backed up data
Goldcard is required for ALL NON-VZW phones
Read how to make one here : http://www.mikesouthby.co.uk/2010/0...yo-official-ota-for-network-branded-handsets/
I used the app goldcard helper from market and if you use it skip right to the step of "Go to this page and enter this new number into the SD Card Serial (CID) field" and enter the output of the sdcard cid for mmc2 into the goldcard generator site.
After goldcard is made via directions in link above or if on vzw branded device you can skip the goldcard part. Next rename the vzw leak ruu.zip to PD42IMG.zip and place it on root of sdcard.
Next from dir you downloaded stuff to unzip the exp.zip and copy the exp folder to your android sdk platform-tools dir (if using windows) linux users should have adb in path so this shouldn't be needed just open terminal from download dir. Make sure the phone is in usb mode charge-only from this point on with usb-debugging turned on (settings/applications/development).
Code:
[B]adb push zergRush /data/local/
adb shell[/B] [I]this will change your promt to a $[/I]
[B]chmod 755 /data/local/zergRush
/data/local/zergRush[/B]
Next we backup our existing misc partition.
Code:
adb shell
dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
/data/local/busybox md5sum /sdcard/misc-stock.img
/data/local/busybox md5sum /dev/block/mmcblk0p17
Make sure the md5sum of the misc-stock.img matches the one from /dev/block/mmcblk0p17
Next we use temp root to flash a misc.img that I hex edited to allow downgrading FW. misc-downgrade.img needs to be in platform-tools dir for windows users.
Code:
adb push misc-downgrade.img /sdcard/
adb shell
dd if=/sdcard/misc-downgrade.img of=/dev/block/mmcblk0p17
sync
Next power off your phone and boot it holding vol_dn + power.
Let the PD42IMG.zip complete ( will do hboot + radio then self reboot and restart to finish the rest)
Once rebooted into the 1.23.605.1 firmware
Code:
adb push exp /data/local
adb shell
chmod 0755 /data/local/psneuter
chmod 0755 /data/local/wpthis
chmod 0755 /data/local/gfree
/data/local/psneuter (to get temp root again)
adb shell
/data/local/wpthis (to disable emmc write protect)
/data/local/gfree -f (this will supercid, simunlock, and s-off phone)
rm /sdcard/PD42IMG.zip (remove/delete the leaked FW so hboot wont load it again)
Reboot into bootloader and verify you have s-off
If so reboot into android and use your carrier's RUU to replace your FW. You will not lose s-off. If on vzw unzip the PD42IMG_1.49.605.1_no_system.zip and add your system.img from your memory card we dumped earlier to the zip. Rezip and rename to PD42IMG.zip and place on root of sdcard and reboot into hboot to flash it just like we did earlier. This will restore the shipped 1.49.605.1 hboot, radio, boot.img, stock recovery.img, and system.img.
After you have upgraded backup you can use the clockwork recovery.img I made and rename it to PD42IMG.zip (make sure to delete the old PD42IMG.zip on your sdcard) and place it on root of sdcard and flash via hboot just like the other PD42IMG.zip's. Then you will have s-off and a custom recovery. Remember to remove/rename/move the PD42IMG.zips when done as they will flash if you enter hboot. Recovery can be entered via bootloader by picking recovery or via "adb reboot recovery".
Flashing this zip via clockwork recovery will install root (su & superuser.apk), busybox & symlink applets, flash & dump image. signed_merge_su_eng_toolkit.zip
After you have root on your release firmware:
The following commands will restore your stock misc.img
from a root # shell: (will need to type su after adb shell and accept superuser pop-up)
Code:
adb shell
dd if=/sdcard/misc-stock.img of=/dev/block/mmcblk0p17
sync
Special thanks to Scotty2 & Tmzt who wrote and developed the wpthis & gfree exploits for the G2 without these s-off for lexikon wouldn't have been possible for me.
My donation link is below if anyone wants to toss me a donation. Took me about a week to port RA recovery to merge only to fail as it had issues then to setup the board files for lexikon for cm7 to do a clockwork recovery and not to mention dumping partitons and working on the s-off stuff and goldcard.
Click to expand...
Click to collapse

I got as far as the /data/local/zergRush and got this error:
[-] Cannot copy boomsh. : Permission denied.
adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush
Any ideas?
Thanks

kclive said:
I got as far as the /data/local/zergRush and got this error:
[-] Cannot copy boomsh. : Permission denied.
adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush
Any ideas?
Thanks
Click to expand...
Click to collapse
that error comes from running zergrush twice. http://androidforums.com/merge-all-...simunlock-supercid-htc-merge.html#post3522248

pls how can i run this commands with miniadb, i dont hav access to the whole android sdk tool...and besides, the zergrush binary link above aint workin..any other alternative dload link pls??

akins47 said:
pls how can i run this commands with miniadb, i dont hav access to the whole android sdk tool...and besides, the zergrush binary link above aint workin..any other alternative dload link pls??
Click to expand...
Click to collapse
zergrush is broken with newer builds. fre3vo worked for some. i would recomend you htcdev unlock in order to gain root access for downgrade.
follow directions here to htcdev unlock:
http://androidforums.com/merge-all-things-root/635459-unlock-htcdev.html
then follow directions here:
http://androidforums.com/merge-all-things-root/434029-root-s-off-simunlock-supercid-htc-merge.html
using the "htcdev" step 5 in post#2

downgrade HBOOT 2.00.0002 to 0.98.00000 without using HTCDEV unlock

SEEMS TO WORK ONLY WITH VERSIONS THAT GOT THEIR UPDATE BEFORE NOVEMBER (EUROPE SHOULD WORK, ASIA/INDIA I DO NOT KNOW!!!)
IF THERE IS A NEW TEMPROOT EXPLOIT AVAILABLE IT SHOULD WORK FOR NEWER VERSIONS ALSO
okay now more in detail
first you have to know that you will loose all data on your system, please backup bevor doing anything!!
what you will need:
- misc_version http://www.thinkthinkdo.com/trac/project1/wiki/misc_version
this will change your version information on your desire s later
- zergRush https://github.com/revolutionary/zergRush/downloads
this will give you temporary root privilieges (so that you can change the version number)
- phone
- chargecable
- adb-shell (see this guide http://forum.xda-developers.com/showthread.php?t=1272595)
- windows os on your pc
- RUU http://forum.xda-developers.com/showthread.php?t=1002506
--> please notice: if you have a branded device, use a branded RUU to downgrade!!
1. Connect your phone to your PC in debug mode (Set option in settings (application --> developer)
2. unzip the downloaded files in a folder (e.g. c:/Users/yourName/Downloads)
3. run the Terminal (Windowsbutton + R --> cmd) and change into the folder where the files are (change folder with 'cd')
4. now type to the terminal (every line is one command!)
adb push zergRush /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/zergRush
adb shell chmod 777 /data/local/tmp/misc_version
now type
adb shell
cd /data/local/tmp/
./zergRush
--> now adb shell closes and restarts, instead of having a $ you have a # which means root
5. now type
adb shell /data/local/tmp/misc_version -s 1.27.405.6
--> this will change your version information
6. now you can doubleclick on the privous downloaded RUU and follow the steps. it may tell you from going down from version 2.xx to 1.xx but it is possible.
7. phone reboots and when it is up again you should have android 2.3.3 hboot 0.98.0000 S-ON
8. now just download revolutionary from http://revolutionary.io and create a beta key and start programm
Click to expand...
Click to collapse
if it was helpful, please use the thanks button!!

(i'm newbie) i don't understand step 3..

This Howto describes how to get down from hboot 2.00.0002 to 0.98.0000
without using htcdev unlock
Requirements:
- misc_version
- zergRush from xda)
- Desire S
- adb-shell (HTC Sync contains it i think)
- RUU from earlier Version 1.28.401.1 RUU_Saga_HTC_Europe_1.28.401.1_Radio_20.28b.30.080 5U_38.03.02.11_M_release_177977_signed.exe - download now for free. File sharing. Software file sharing. Free file hosting. File upload. FileFactory.com
1. connect phone with chargecable, debug mode on, only charge
2. start terminal (Windows+R --> cmd)
cd .. (so on)
go in to the folder where zergRush and misc_version are
3.
type following
adb push zergRush /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/zergRush
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/zergRush
4. when u got from $ to # (which means root) type the following
adb shell /data/local/tmp/misc_version -s 1.27.405.6
5. your desire s thinks its a version earlier
6. dobleclick the RUU und follow the steps
--ATTENTION YOU LOOSE YOUR DATA -- PLEASE BACKUP!!!
7.phone reboots with hboot 0.98.0000 S-On
8. follow the other steps from revolutionary to get s-off
PS: i tried the other way around and i am successful s-on again! (so no loss of warranty)

Is there anyone else who tried this method?

3 people in german android-hilfe.de forum.
but some seem to have problems when their desire is branded (dont know if the use branded ruu or not)

Hi,
Im reall sorry if im being stupid but what is misc_version?

It is a script that lets u change the Version on your phone. I will look for one
Edit: http://www.thinkthinkdo.com/trac/project1/wiki/misc_version
here it is...
Sent from my HTC Desire S using XDA App

Cool thanks,
How do i get adb?
EDIT: GOT IT

With got it you mean adb or the downgrade?
Sent from my HTC Desire S using XDA App

Adb.......
Gonna try this give me an hour and i will report back...
Is this safe?

for me it worked on first try. But be sure that you backuped everything! The downgrade will erase everything! ! !
Sent from my HTC Desire S using XDA App

What's the difference between using the misc_version here to "change" your version compared to getting your phones misc version .img from "dd if=/dev/block/mmcblk0p17 of=/mnt/sdcard/mmcblk0p17.img" and then altering it and re uploading it?
To my understanding the one uploaded just patches your misc version where the other one you do it manually.
Or am I so lost I should go home?

should work either. but with the script it is easier, isnt it?

Because its easier for newbies to understand and your way uses more adb
Not that many people understand adb

Thanks, was just wondering.

Hello, nice would be a link from the Ruu.

See the development forum sticky
Sent from my HTC Desire S using XDA App

Troja said:
Hello, nice would be a link from the Ruu.
Click to expand...
Click to collapse
It is not wise to link a specific RUU, since there are already new versions for all regions (Europe, Asia, etc.) and soon the branded will join also.
However a link to the sticky Stock ROMs thread should be handy

I can not find them
Do I need to flash the downgrade.zip?

Troja said:
I can not find them
Do I need to flash the downgrade.zip?
Click to expand...
Click to collapse
This is the same one that mtothearkus posted in is second guide:
http://ff06d05.filefactory.com/dl/f...0805U_38.03.02.11_M_release_177977_signed.exe
I will add to my dropbox for faster download
EDIT:
Dropbox dload isnt working

Completely Restore to Stock

Hi! I wouldl ike to restore my phone from being S-off, custom recovery, and a custom rom. Can anyone please guide me through the steps ? (I just need to know what I have to do I know my way around android devices just not that used with HTC. Should I flash a stock rom, flash stock recovery, then s-off ?)
Thanks

You should read the threads in dev section carefully before proceding, but the short version should be like this:
1. copy "misc_version" to android sdk / adb folder
2. cmd: adb push misc_version /data/local/tmp
3. set older software version with misc_version to flash a older RUU File
cmd: adb shell /data/local/tmp/misc_version -s 1.27.405.6
4. copy original hboot.img (0.98.00...) to root of microSD card.
5. open cmd :
cd/
cd android-sdk-windows
cd platform-tools
adb devices
adb shell mount /sdcard
adb shell
su
dd if=/dev/block/mmcblk0p18 of=/sdcard/backup.img
dd if=/sdcard/hboot.img of=/dev/block/mmcblk0p18
6. restart to bootloader
7. enter fastboot
8. run RUU
THIS IS NOT A HOWTO, check yourself if this is the right way for you!!!
Or check this thread: http://forum.xda-developers.com/showthread.php?t=1187231
Maybe it's the simple way...