Database Info

[GUIDE] Telus Desire HD - Rooting and Flashing

DISCLAIMER: This guide and package are provided as-is. I do not accept any responsibility for damage caused by following the guide or using the programs. This process was used by myself for rooting, unlocking and installing ROMs on my own Telus Desire HD. Please read through the entire guide ahead of time and make sure you understand where all the files in the package are.
Introduction
I noticed there was a good deal of confusion about the forums as to what to do with the Telus Desire HD and whether it was closer to the European DHD or the Inspire 4G. Turns out its closer to the Inspire 4G. jkoljo helped figure out what needed to be done to successfully flash this phone, so don't forget to thank him!
By the way, don't order a SIM unlock code if you need to unlock the phone so you can use it on another network. This procedure allows you to SIM unlock you phone without an unlock code. (Refer to step 22 in Section B.d).
Feel free to let me know if theres anything wrong or missing or if you have any questions.
Enjoy rooting and ROMing!
-AlexDP
-------------------------
Note: All the files needed for this process are included in this package. The folders for each section are located under folders with corresponding names (i.e. the files for Preparation are in the "Preparation" folder).
Download the package here:
-Full version, includes the PD98IMG.zip stock downgrade ROM file.
-Lighter version with no PD98IMG.zip file. You can get the necessary PD98IMG.zip file from here and use it when needed as per the guide.
A. Preparation Notes:
-Install HTC Sync (from the "Step 1 - HTC Sync" folder")
-Set your phone to allow usb debugging by going to Settings->Applications->Development and checking off USB debugging.
-Make sure you have the same SIM card if you've logged into Android Market before.
-Leave your Desire HD plugged in to your PC. Choose Charging only when prompted (unless you need to copy files to your SD, in which case switch to Mount drive).
-At the end of the process, once your all done rooting, save a copy of the following files from your SD card just in case:
hboot_check.nb0
hboot_eng.nb0
part7backup-SomeNumbersHere.img
hboot_original.bin
-Create a Gold Card:
Install GoldCard Helper from the Android Market,
Run it and make note of the value listed after Card:mmc2, Reverse CID. It should be a long series of numbers and letters. (make sure to use mmc2, the default copy to clipboard copies mmc1 ..)
Visit this page (http://psas.revskills.de/?q=goldcard), enter the new copied number and create your goldcard image, which will be e-mailed to you.
Save the file attached in the email to your PC.
Install HxD Hex Editor on your computer, from the "Step 4 - Gold Card" folder.
Run HxD Hex Editor. ("Run as Administrator" under Vista and Windows 7).
Go to the Extra menu and select Open Disk. Under physical disk, select Removable Disk (your microSD card), uncheck Open as Read only and click OK. Note that you should select physical disk NOT the logical disk. This is important!
Go to the Extra menu again and select Open Disk Image. Open the goldcard image that you received by email.
Press OK when prompted for Sector Size (selecting 512 (Hard disks/Floppy disks)) and click OK.
You should now have two tabs - one is your removable disk, the other is your goldcard image.
Click on the goldcard image tab. Go to the Edit menu, choose Select All then select the Edit menu again and select Copy.
Click on the Removable Disk tab. Highlight offset (line) 00000000 to offset (line) 00000170 (including the 00000170 line), then click on the Edit menu and select Paste Write.
Click on the File menu and select Save, accepting the warning.
Your Gold Card SD card is completed.
----
B. Rooting (Do this if you just want to root, or if you want to install a custom rom, do this first):
B.a Downgrade Process
1- Copy the PD98IMG.zip file from the "Step 1 - PD98IMG" folder and put it on the root of your SD card (i.e. not in any folders). Do NOT rename this file.
2- Go to the "Common files" folder and double click Start Here.
3- Copy the files in "Step 3 - Downgrade" to the "Common files" folder.
4- In the new command window that opens, type the following commands (you shouldn't get any errors. hit enter after each):
Code:
adb push psneuter /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/psneuter
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/psneuter
adb shell
NOTE: You should have the "#" sign instead of the "$". If you do, you have temporary root, and can continue on.
Code:
/data/local/tmp/misc_version -s 1.31.405.3
exit
Note: If you get an error while running the step before exit, try using 1.31.405.6 instead of .3.
5- Type adb reboot bootloader and hit enter. Your phone will be switched into the white bootloader screen. Wait for the bootloader screen.
6- Hit the power button to select bootloader from the options. It'll automatically find the PD98IMG.zip and start examining it. You'll see a blue progress bar at the top right. Once it finishes it'll ask you to hit volume up if you want to install. Do so. Don't worry if some items are marked "Bypassed" during install.
7- Once its done, it'll ask you to hit the power button to restart. Android should boot up.
8- Set the usb debugging option again. (Refer to Preparation step 2).
B.b Temp Root
Note: As an alternative to this section, you can download and install Visionary on your phone and have it do the temproot, by tapping the Temproot Now option. If you do this, jump straight to section B.d once you're done. If you have trouble doing this, or Visionary shows "rooting" then gets stuck or get a black screen, reboot your phone and follow this section fo the guide.
9- Make sure your SIM card is in when signing in to the Android Market for the next steps, otherwise it'll give you an error saying it can't access the Google server (!?! wtf, btw...)
10- Copy the files from the "Step 10 - Temp Root" folder to the "Common files" folder.
11- Go to the "Common files" folder and double click Start Here.
12- In the new command window that opens, type the following commands (you shouldn't get any errors. hit enter after each):
Code:
adb push su /sdcard/su
adb push Superuser.apk /sdcard/Superuser.apk
adb push rage /data/local/tmp/rage
adb push busybox /data/local/tmp/busybox
adb push root /data/local/tmp/root
adb shell chmod 0755 /data/local/tmp/*
13- On the HTC Desire HD, install the Android Terminal Emulator (by Jack Palevich) app from the Android Market.
14- Launch the Terminal Emulator, and run the following command: /data/local/tmp/rage
15- After a minute or so, you will see the following message on the phone Forked #### childs. Press the Menu button & select Reset Term. The Terminal Emulator will exit out.(If you don't see this after a few minutes, something is wrong. Retrace your steps).
16- Launch Terminal Emulator. It will force close. Launch it a second time, and you'll have a root shell (i.e. you'll see a # sign instead of the $ sign in the console).
B.c Permanent Root
Note: It turns out this section (B.c) is actually unnecessary as its taken care of later in the process already. You can safely skip this section and go straight to section B.d.
17- Copy the files from the "Step 17 - Permanent Root" folder to the "Common files" folder.
18- Go to the "Common files" folder and double click Start Here.
19- In the new command window that opens, type the following commands (you shouldn't get any errors. hit enter after each):
Code:
adb push gfree /data/local
adb shell chmod 777 /data/local/gfree
20- Launch the Terminal Emulator on your phone and run the following commands:
Code:
/data/local/gfree -f
sync
/data/local/tmp/root
NOTE: You may see an error that states mkdir: /system/xbin already exists, if you do, simply ignore and continue on.
Code:
sync
21- Wait for this to finish. Once done, restart the HTC Desire HD.
B.d Unlock phone for flashing ROMs and carrier unlocking
Note: The order of these steps has been changed, but the folder names haven't been updated. Please pay good attention to the instructions here.
22- Run Easy Radio Tool (in the "Step 23 - Easy Radio Tool" folder), select the first option (especially if you want to SIM unlock, if not the Radio S-OFF option is sufficient). Follow the directions in the program. Make sure to accept the SuperUser request on the phone when it pops up (keep your phone unlocked so you see it). It may fail at one point and your phone will restart. If it does, thats ok just run it again and it'll finish successfully this time.
23- Run EasyS-OFF (in the "Step 24 - EasyS-OFF" folder) and follow the instructions.
B.e Flash ClockworksMod Recovery
24- Download and run ROM Manager from the Android Market and have it install ClockworksMod Recovery.
24.I If you're not flashing a Gingerbread-based ROM (like CM7), please choose the last option in the list "All ClockworkMod Recoveries" then choose 2.5.1.3.
24.II If your installing a CyanogenMod or any other Gingerbread-based ROM you must have ClockworkMod Recovery 3.0 and above, so just choose the first option in the list, "Flash ClockworkMod Recovery".
If this fails with a message about permissions, it means you haven't rooted correctly, retrace your steps.
----
C. Flashing a new ROM:
1- Download the ROM of your choice (I recommend Android Revolution HD, available here: http://forum.xda-developers.com/showthread.php?t=840040, but feel free to chose any). Copy the zip for the ROM to your SD card. Inside ROM Manager, click Install ROM from SD Card and select the ROM that you put on your SD card. Select wipe data and cache and optionally the backup checkbox. Let it finish installing and rebooting your device.
Note: If you are flashing to a ROM other than a stock Telus ROM (Raidroid Stockify is a stock Telus ROM), you will have to enter your APN settings manually. If you're using your phone on a different network than Telus, you will have to enter your APN settings.
Note:If you want CyanogenMod, it's available inside ROM Manager and you dont need to do this part and you can skip to the very last step. If you want to install CyanogenMod 7 or any Gingerbread-based ROM, you must first update your ClockworkMod Recovery to 3.0 and above. Please note that you can't restore from a backup or install a non-Gingerbread ROM from ClockworkMod Recovery 3.0 and above. If you need to restore from backup or downgrade, install ClockworkMod Recovery 2.5.1.3 (ROM Manager -> All ClockworkMod Recoveries -> 2.5.1.3) then proceed to flash or restore as needed.
2- Copy Telus Kernel.zip to your SD card from the "Step 2 - Telus Kernel" folder.
3- Run Kernel Update Utility (in the "Step 3 - Kernel Update Utility" folder) and click "Select a cwm zip", then click next, then click Go to fastboot, wait for the white bootloader screen on your phone, then click Flash. Once it's done, it'll reboot back into Android.
4- Once that's done click next, wait for the USB connection and USB debugging mode notification.
5- Click flash button in Kernel Update Utility and once that's done click finish.
Your done! Sound works perfectly and so does Wi-Fi!
--------------------------
Guide Credits:
This guide and package was pieced together from various other guides and packages after exploring the various posts and methods on the topic, mostly from Xda-Developers. I've listed them here:
Gold Card Guide: http://www.droid-den.com/android-guides/android-guide-how-to-create-a-gold-card
CyanogenMod Downgrade and Rooting guide: http://wiki.cyanogenmod.com/index.php?title=HTC_Desire_HD:_Full_Update_Guide#Downgrade_to_1.32.405.6
How to downgrade: http://forum.xda-developers.com/showthread.php?t=905003
One click Radio S-OFF tool: http://forum.xda-developers.com/showthread.php?t=857537
One click ENG S-OFF: http://forum.xda-developers.com/showthread.php?t=855403
Desire HD, no sound thread (thanks jkoljo): http://forum.xda-developers.com/showthread.php?t=949909&page=10
Thanks to everyone who wrote those guides and these programs and made it possible for us to flash the Telus Desire HD, specifically jkoljo, who put his own time into it.

Instead of gfree and rage, you can just use Visionary and Radio S-OFF Tool, saves a lot of time
Sent from my Desire HD using Tapatalk

True. I was personally having some trouble with Visionary though... after hitting temproot now or temproot on boot it'd show the rooting screen, then hang there and turn black. The whole phone would get slow too.
I'll probably add that as alternative steps tomorrow morning when I wake though. Thanks for the feedback!
Sent from my Desire HD using XDA App

Alex, thanks so much. I don't yet have the device, but was looking for a fool-proof rooting/sound-maintaining guide before purchasing. I knew it would come in good time
I also had tons of trouble using Visionary to temp/perm root my Desire Z. I would definitely shy away from that method, especially if you're comfortable with ADB. Your method, while it may take longer, works great.
Does this also provide a SIM Unlock like it does the G2?

Does flashing the Telus Kernel from the Kernel Update Utility yield a different result than flashing it from Clockwork?

Thanks Guys. Guide worked Perfect!

You should remove the gfree part of your guide, Easy Radio Tool does exactly the same, but in one click. In the current form, you are Radio S-OFFing two times.
Gfree does not give you permanent root.

jkoljo said:
You should remove the gfree part of your guide, Easy Radio Tool does exactly the same, but in one click. In the current form, you are Radio S-OFFing two times.
Gfree does not give you permanent root.
Click to expand...
Click to collapse
So you mean the entire part B.c, right? Thanks again for your feedback!

Yes, entire B.c section, and flashing ClockworkMod should be the last step of all.

jkoljo said:
Yes, entire B.c section, and flashing ClockworkMod should be the last step of all.
Click to expand...
Click to collapse
Thanks, updated as such.

I'm getting this error:
mmap<> failed. Operation not permitted
On section B a -4 on the command
adb shell /data/local/tmp/psneuter adb shell
Anyone know what's causing it?

Hey guys, has anyone been successful in getting sound on the cm7 nightly ROM?

omegacell said:
I'm getting this error:
mmap<> failed. Operation not permitted
On section B a -4 on the command
adb shell /data/local/tmp/psneuter adb shell
Anyone know what's causing it?
Click to expand...
Click to collapse
I'm sorry, there was a mistake. It should be:
adb shell /data/local/tmp/psneuter
<hit enter>
adb shell
<hit enter>
Instead of:
adb shell /data/local/tmp/psneuter adb shell
I've updated the guide to reflect that.

sound and other stuff
plasticdarlow said:
Hey guys, has anyone been successful in getting sound on the cm7 nightly ROM?
Click to expand...
Click to collapse
Nope I cant get any sound and if youflash the telus zip I just get stuck at htc logo, funny thing is I can get sound through fm radio only, i get sound oon fm radio through headset and through speaker but not on anything else.

I'm getting stuck during root process....any ideas???
C:\Documents and Settings\waycoy\Desktop\Telus Desire HD\Common files>adb push psneuter /data/local/tmp
2490 KB/s (0 bytes in 557962.000s)
C:\Documents and Settings\waycoy\Desktop\Telus Desire HD\Common files>adb push misc_version /data/local/tmp
15 KB/s (0 bytes in 15837.001s)
C:\Documents and Settings\waycoy\Desktop\Telus Desire HD\Common files>adb shell chmod 777 /data/local/tmp/psneuter
C:\Documents and Settings\waycoy\Desktop\Telus Desire HD\Common files>adb shell chmod 777 /data/local/tmp/misc_version
C:\Documents and Settings\waycoy\Desktop\Telus Desire HD\Common files>adb shell /data/local/tmp/psneuter
mmap() failed. Operation not permitted
C:\Documents and Settings\waycoy\Desktop\Telus Desire HD\Common files>

I loaded cm 6 and got no sound at all either. Which roms are people having good luck with?
Sent from my Nexus One using XDA App

Step Ba6 when applying PD98IMG.zip I recieve a "Model ID incorrect!" and "Update Fail!". Any suggestions? There were no errors up to that point. My scree is currently sitting at Press POWER to reboot. Not wanting to brick - am I ok to POWER. Model on the packing box shows A9192 if that means anything.

dr_pepper said:
Step Ba6 when applying PD98IMG.zip I recieve a "Model ID incorrect!" and "Update Fail!". Any suggestions? There were no errors up to that point. My scree is currently sitting at Press POWER to reboot. Not wanting to brick - am I ok to POWER. Model on the packing box shows A9192 if that means anything.
Click to expand...
Click to collapse
you can reboot my phone had the same problem i was unable to downgrade i was stuck at that point for a while. i dont know if there is a fix for this yet.

Bummer. Thanks for the reply

gold card
Did you guys use a gold card. Did you follow everything from the start down. I did it last night and had no problems. The only problem you will have if you get it done is with roms. At this point it is probably best just to get root and wait for some roms that use the right kernel, some roms sound tinny, some just don't work. CM7 doesn't work with sound at all and if you apply the TELUS kernel it locks up at HTC boot screen.

[GUIDE][S-ON] How to downgrade chacha to lower firmware version

This guide will explain how to downgrade chacha from higher RUU version to lower RUU version. Even HBoot downgrade is possible. Mine, I successfully downgraded from HBoot 1.05 to 1.04.
Usually this error msg appears if you try to downgrade your firmware ‘Main Version is Older’, the guide will help solve this.
The guide is based on thread http://forum.xda-developers.com/showthread.php?p=10757949#post10757949
This is not my actual work, I searched thru the forums when I wanted to downgrade my chacha from RUU_Chacha_HTC_Europe_1.33.401.1_Radio_47.17.35.3033H_7.48.35.14_2_release_204385_signed to RUU_Chacha_hTC_Asia_WWE_1.21.707.2_Radio_47.14.35.3030H_7.47.35.17_release_197518_signed and created this guide.
My device is carrier unlocked, S-ON and this method will work on S-ON devices.
Note: Before you proceed, I accept no responsibility if you brick your phone. Do it on your own risk!!!
Things you need
I assume you already have android SDK and HTC sync installed in your system
1) Flash_Image – http://www.android-hilfe.de/attachments/root-hacking-modding-fuer-htc-desire/8835d1275662657-how-rebrand-o2-desire-fertig-flash_image.zip
2) HEX Editor - http://mh-nexus.de/en/downloads.php?product=HxD
3) A gold card – search thru the forums if you need to create one.
Step 1: Achieve temp adb shell root
You can achieve temp adb shell root using zergRush method, if you don’t know how, your can see this thread http://forum.xda-developers.com/showthread.php?t=1296916 or simplest way is to use the batch file created by qzfive http://forum.xda-developers.com/showthread.php?t=1319386
Step 2: copy the mtd0 file to sdcard.
Open command prompt, change your directory to ADB directory (usually the folder where ADB.exe resides).
In the command prompt type, adb shell
You should see ‘#’ at the prompt, if you see ‘$’ then you didn’t achieved temp root, redo step-1.
In the command prompt type
cat /dev/mtd/mtd0 > /sdcard/misc.img
Step 3: now change the USB connection type to ‘disk drive’ and copy the ‘misc.img’ to your pc or laptop. Use HxD as administrator and open ‘misc.img’
Step 4: The current version number can be located at 11th line, change it to the version number of RUU you want to downgrade to. I have changed mine from 1.33.401.1 to 1.25.709.1 and save. Be sure to back up the file before any updates.
Step 5:
copy the flash_image (which you downloaded at the start) and misc.img back to your root of sdcard
Step 6: change the USB connection type to ‘charge only’ and execute the below commands in the adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/misc.img
Step 7:
Copy the rom.zip from RUU which you wanted to flash to the root of the goldcard and rename to PH06IMG.zip. Power off the phone, insert goldcard to the phone – press volume down + power on, the phone will flash the rom.

I'm quite happy to see that this ChaCha section is getting more and more used. This goes straight to the ChaCha guide that I made. Congratulations!

Thank you, i was trying my luck for s-off as in this forum http://forum.xda-developers.com/showthread.php?t=1317960 so downgraded my phone. and unfortunately no s-off!

Ok, this could be modified with a s-off hboot in the zip to achieve s-off, I'm sure of it. Anyone have an engineering s-off Hboot around?

It wouldn't work - if you modify a signed HTC .zip, the bootloader won't take it if it's S-ON

@#$%. I do feel this is is the start of an exploitable loophole. Now how to use it is the key.

as qzfive said, if the rom.zip in RUU is modified it cannot be flashed, i tried to modify the rom.zip using zip utility to change the CID information once, but the flashing was not successful. Believe HTC uses some special technique to build the zip
if any one can direct to information on building RUU may be we can give it a try

ajeevlal said:
as qzfive said, if the rom.zip in RUU is modified it cannot be flashed, i tried to modify the rom.zip using zip utility to change the CID information once, but the flashing was not successful. Believe HTC uses some special technique to build the zip
if any one can direct to information on building RUU may be we can give it a try
Click to expand...
Click to collapse
It has a digiotal signature that you are modifying by packing it with a normal zip program. Instead, use 7zip this way:
- extract the files you want to edit
- edit them (for text editor use notepad++ as others like normal notepad\word\wordpad are creating unneeded newline chars)
- open the zip with 7zip again and drag and drop the files you want to replace into 7zip.

Alex C. said:
It has a digiotal signature that you are modifying by packing it with a normal zip program. Instead, use 7zip this way:
- extract the files you want to edit
- edit them (for text editor use notepad++ as others like normal notepad\word\wordpad are creating unneeded newline chars)
- open the zip with 7zip again and drag and drop the files you want to replace into 7zip.
Click to expand...
Click to collapse
I'm guessing it's only possible to modify the CID of the .zip this way? I got an idea of replacing recovery.img in the zip to a CWM.img, guessing it wouldn't work?
EDIT: I pulled the rom.zip from the 1.33.401.1 RUU and it wouldn't let me put my modified android-info.txt back into the .zip, 7zip gave me a "Not implemented/Operation not supported" error :/

qzfive said:
I'm guessing it's only possible to modify the CID of the .zip this way? I got an idea of replacing recovery.img in the zip to a CWM.img, guessing it wouldn't work?
EDIT: I pulled the rom.zip from the 1.33.401.1 RUU and it wouldn't let me put my modified android-info.txt back into the .zip, 7zip gave me a "Not implemented/Operation not supported" error :/
Click to expand...
Click to collapse
7zip said "Not implemented"? Weird.. So you are simply using drag and drop, eh?

As a side note, remove the first 256 bytes of the file, which is the RSA signature (for example using HxD) to get a "proper" zip file. All modifications of the file will invalidate the signature anyway, you won't be able to flash it unless you're S-OFF or through an exploit.

Yup, Drag and Drop gives the error "Not Implemented", and clicking the Add icon gives the error "Operation is not supported"
Funnily enough, WinRAR says "C:\Users\James\Desktop\PH06IMG.zip: The archive is corrupt" when trying to add files to it
I'm guessing HTC made their .zips pretty secure then :/

xdbg said:
As a side note, remove the first 256 bytes of the file, which is the RSA signature (for example using HxD) to get a "proper" zip file. All modifications of the file will invalidate the signature anyway, you won't be able to flash it unless you're S-OFF or through an exploit.
Click to expand...
Click to collapse
I've edited with 7zip and the signature was not invalidated. The files were then flashed.

do i have to buy xtc clip to get gold card or what ?
cause i cant find any other way to do it

Search on Google: gold card creator. You can also search "gold card" on XDA.

It worked Thanks....

what to do if i cant get adb shell root?
zergRush doesnt work saying Hellions with blue flames
the 2nd link is dead, and i guess its based on the same exploit
all i need is to flash europe 1.33.401.1 on top of 1.57.707.2
s-on

aZzz.bZzz said:
what to do if i cant get adb shell root?
zergRush doesnt work saying Hellions with blue flames
the 2nd link is dead, and i guess its based on the same exploit
all i need is to flash europe 1.33.401.1 on top of 1.57.707.2
s-on
Click to expand...
Click to collapse
facing similar issue... ok got adb shell working (already rooted) but failed at last command and says not enough memory ... card empty and phone got abt 80mb free.
my phone is s-on, and factory unlocked. Do i still need goldcard? read reviews long time ago that unlocked phone dont need that, only branded one need goldcard.
wish the xtc clip were cheaper ...

thank you , you were right it just wants a post on my wall.
I am sorry for the off topic but is there any easy tutorial how to Sim Carrier unlock MY HTC chacha S-ON, if there is one ?

I have USA Version CHACHA , with firmware 1.60.xxx
Really downgrade firmware? And do S-OFF?
With gold card not have downgrade

Phone doesn't load image

Hello,
I'm aware, that this problem might have been reported in that or a similar case, but to be honest with you, there are so many different guides now, that i don't know which to follow. Some guides did nothing while for others files were required that are not specified correctly or not available anymore.
I try to describe as best as I can to tell you what I did, so maybe someone can see what my error was and how I might be able to fix it, or at least point me in a direction.
1st: I followed this guide to get root rights: http://forum.xda-developers.com/showthread.php?t=1390496
2nd: This guide, in order to install the ClockworkMod Recovery: http://www.androidauthority.com/desire-s-root-s-off-hboot-2-00-0002-superoneclick-74470/
3rd: I tried to install the Cyanogen mod: cm-7.2.0-saga.zip through the ClockworkMod Recovery console. (No I didn't backup...[Please don't tell me how stupid that was, I know it already])
The effect of these actions is, that I can see the HTC logo on a white background, but nothing happens afterwards.
4.th tried to install update-cm-7.1.0-DesireS-signed.zip, but didn't work either
5th: Nothing worked, so I tried to go back to the stock version using this RUU:
RUU_Saga_O2_UK_1.31.206.2_R_Radio_20.28b.30.0805U_38.03.02.14_M_release_180220_signed.exe long story short, it didn't work. It did find my phone but it didn't work: found version "2.13.206.1" going to version "1.31.206.2".
RUU
Security Fail!
Update Fail!
I feel like I'm only 5-10 minutes away from achieving what I wanted in the first place, but due to 100 of guides I can't find the right one for my device to 1. s-off or 2. Go back to the original version.
Can someone help me please?
Some facts about my phone:
HBOOT-2.00.000.2
RADIO-3822.10.08.04_M
eMMC-boot AUG 22 2011,15:22:13
Provider: O2 Ireland
I tried to use this guide to change the version of the phone butu it didn't work "http://forum.xda-developers.com/showthread.php?t=1318919"
a. Connect the phone using USB cable using "Charge ONLY" and USB Debugging is ON.
b. Open command prompt and input these codes:
Code:
adb push C:\downsaga\misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
su
cd /data/local/tmp
./misc_version -s 1.27.405.6
exit
exit
c. Your phone should now read as the version you've placed there (but not visible to settings)
Click to expand...
Click to collapse
Error message on the first command i enter
f:\Desire S\Fastboot\adb-fastboot-win>adb push C:\downsaga\misc_version /data/local/tmp
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
error: device not found​
Click to expand...
Click to collapse
Kind regards,
Matthias

Since you have used htcdev you should flash the kernel (boot.img) that you can find in the custom Rom zip archive. There are instructions about this in almost each custom ROM thread.
So flash CyanogenMod again from recovery then reboot to bootloader and flash the kernel. It will work after that
Sent from my HTC Desire S

amidabuddha said:
Since you have used htcdev you should flash the kernel (boot.img) that you can find in the custom Rom zip archive. There are instructions about this in almost each custom ROM thread.
So flash CyanogenMod again from recovery then reboot to bootloader and flash the kernel. It will work after that
Sent from my HTC Desire S
Click to expand...
Click to collapse
That was indeed the "droid" Help I was Looking for
close your phone (or simply remove battery),
connect usb cable to pc,
press volume down and power at the same time,
select fastboot,
than exract boot.img file from zip file that you put sd card ( in kernel/saga/boot.img )
copy img file to same directory with fastboot file
start -> cmd
go to directory with cd command
fastboot flash boot boot.img
than reboot
Click to expand...
Click to collapse
And I was right, took me only 10 minutes to solve an issue I was on for 4 hours now...
Damn these captchas are annoying...

New downgrade for J Butterfly 1.36.970.1 > 1.15.970.1

There is a new downgrade option released for firmware 1.36.970.1 to 1.15.970.1.
However my Japanese is not perfect and my understanding of hacking is very weak.
If there is someone more in the know could understand what the steps to take are that would be great.
Good luck all. I hope someone can make a guide as well to help other out.
I'll try my best as well.
Here is the link.
http://htcsoku.info/htcsokudev-news/au-deluxe-136to115-downgrade/

link to RUU 1.15.970.1 is dead

I have successfully downgraded my J Butterfly based on those instructions. I have simplified it because the original instructions seems to be overly complicated. It involved tricking a system app with root privileges to run an custom command, only to use run_root_shell later anyway.
I also did not use the run_root_shell supplied by the guide, instead I compiled a newer version direct from the source: https://github.com/android-rooting-tools/android_run_root_shell
You'll need
1. revone.dna-0.2.1
http://forum.xda-developers.com/showthread.php?t=2314582
2. A newer build of run_root_shell (attached)
3. 1.15 ROM: PL99IMG_DLX_WLJ_JB_45_KDDI_JP_1.15.970.1_R_Radio_1.00.10.1127_3_NV_2.28_01C_release_signed.zip
(renamed to rom.zip in this tutorial)
https://mega.co.nz/#!jQtQ0BLS!279lf8k4sbKPTmWHTsPg6hbaGDatpq3xGGv4aE8N1h4
4. firmware.zip extracted from OTA_DLX_WLJ_JB_45_KDDI_JP_1.36.970.1-1.29.970.1_release_330380g3nfgypcfojku8a9.zip:
http://kie.nu/1urK
5. adb and fastboot
6. An HEX editor such as XVI32
THIS WILL WIPE YOUR USER DATA, BACKUP ALL YOUR STUFF FIRST
Steps:
1. Run the following commands in command prompt to push files required by run_root_shell to device:
adb push run_root_shell /data/local/tmp/
adb push device.db /data/local/tmp/
2. Run in command prompt:
adb shell
to access the shell on your device. Run the following commands to run run_root_shell, disregard messages about HTL21 not supported. You will be returned to the command line but with a hash (#) instead of a dollar sign, that means you have temprooted.
cd /data/local/tmp/
chmod 755 *
./run_root_shell
3. Run these commands on device shell:
chmod 666 /dev/msm_acdb
dd if=/dev/block/mmcblk0p21 of=/sdcard/p21
4. Run in another command prompt:
adb pull /sdcard/p21
to pull the file p21 from device, then open it with an HEX editor. Refer to the images on the original Japanese tutorial, change the version number near "ClearAutoImage" to 1.00.000.0 and save the file as p21mod.
5. Push the modified file back to the device by running in command prompt:
adb push p21mod /sdcard/p21mod
6. Back to the device shell, run these commands to write the modifications to the device and reboot into bootloader.
dd if=/sdcard/p21mod of=/dev/block/mmcblk0p21
reboot bootloader
7. Run in command prompt:
fastboot oem rebootRUU
to boot to RUU.
8. Run in command prompt:
fastboot flash zip firmware.zip
and it willl fail with this error: "FAILED (remote: 90 hboot pre-update! please flush image again immediately)"
9. Run in command prompt:
fastboot flash zip rom.zip
to flash 1.15 ROM. It should take around 6 minutes. This wipes your user data.
10. In command prompt, push run_root_shell to device again. Also push revone.dna-0.2.1 to device.
adb push run_root_shell /data/local/tmp/
adb push device.db /data/local/tmp/
adb push revone.dna-0.2.1 /data/local/tmp/revone.dna
11. Refer to step 2 to temproot again.
12. Run revone.dna on device shell:
./revone.dna -P
and you should see "revone successful - please reboot to continue".
13. Reboot and repeat step 12 again, this time you should see "revone successful - no need to reboot".
14. Run on device shell:
./revone.dna -s 0 -u
and you should see "revone successful".
15. ???
16. PROFIT!
You have now successfully S-OFFed and may proceed to unlocking and SuperCIDing your device as usual.

Corrupted
Phil_123 said:
3. 1.15 ROM: PL99IMG_DLX_WLJ_JB_45_KDDI_JP_1.15.970.1_R_Radio_1.00.10.1127_3_NV_2.28_01C_release_signed.zip
(renamed to rom.zip in this tutorial)
.
Click to expand...
Click to collapse
I have downloaded this file twice and found it corrupted. Can't open it so i can't uncompress and reach firmware.zip either.
:crying:
Could you reupload it?

corrupted
darky4e said:
I have downloaded this file twice and found it corrupted. Can't open it so i can't uncompress and reach firmware.zip either.
:crying:
Could you reupload it?
Click to expand...
Click to collapse
I have "fixed" it by Zip2Fix and made a zip file what can be extracted. But the two zip file size isn't match so i guess its isn't the same and there isn't any firmware.zip in the nem zip file so i guess the program extracted everything.
I have read that some people succesfully used corrupted ruu, and it's made corrupted by reason. I will read more about it and try to find a correct firmware.zip for the method. If you could help me in any means it would be great.

darky4e said:
I have "fixed" it by Zip2Fix and made a zip file what can be extracted. But the two zip file size isn't match so i guess its isn't the same and there isn't any firmware.zip in the nem zip file so i guess the program extracted everything.
I have read that some people succesfully used corrupted ruu, and it's made corrupted by reason. I will read more about it and try to find a correct firmware.zip for the method. If you could help me in any means it would be great.
Click to expand...
Click to collapse
My bad, my instructions were wrong. I wrote them only after successfully doing it myself, I must have mixed some things up while writing.
I looked at the original Japanese guide again, the firmware.zip is in OTA_DLX_WLJ_JB_45_KDDI_JP_1.36.970.1-1.29.970.1_release_330380g3nfgypcfojku8a9.zip and can be downloaded here:
http://kie.nu/1urK

Phil_123 said:
My bad, my instructions were wrong. I wrote them only after successfully doing it myself, I must have mixed some things up while writing.
I looked at the original Japanese guide again, the firmware.zip is in OTA_DLX_WLJ_JB_45_KDDI_JP_1.36.970.1-1.29.970.1_release_330380g3nfgypcfojku8a9.zip and can be downloaded here:
http://kie.nu/1urK
Click to expand...
Click to collapse
Thank you very much! I have succesfully downgraded the phone! Thx for the instructions again!!

run_root_shell and revone.dna-0.2.1 work with HTC Butterfly kddi HTL21 with HBOOT 1.41 ? I'am stuck on run_root_shell and it say's "Error No such file or directory" when I use the command in adb "$ ./run_root_shell"
what can I do ?

dfani511 said:
run_root_shell and revone.dna-0.2.1 work with HTC Butterfly kddi HTL21 with HBOOT 1.41 ? I'am stuck on run_root_shell and it say's "Error No such file or directory" when I use the command in adb "$ ./run_root_shell"
what can I do ?
Click to expand...
Click to collapse
This method can only be used for the software version of the 1.36.970.1, I think your software version 1.39.970.1 is not SOFF

i have 1.39.970.3 ?????????????
OTA ??????????

Nice share, im succesfully unlock soff with this way
Sent from my MITO_A10 using XDA Free mobile app

"htl21 1399703 firmware" I want up because it cannot find the file.

[Change CID and MID][S-ON]An interesting way to modify cid and mid on s-on devices

WARINING!!!!
Flashing TWRP before doing anything, or you may lose your phone!
And NEVER flash ENTIRE SDE and SDF parititions from OTHER phone!
------------------------------------
In sdf1, there are some information after the IMEI2
After I bricked my phone, I think these information is unlock code
------------------------------------
Hello guys!
After the last time I successfully downgraded by modifying /dev/sde1, I tried to modify cid and mid in the same way. I successfully done this today, but I encountered some problems while flashing the RUU pack.
FAILED 14 android_info.txt missing or malformed
Click to expand...
Click to collapse
It seems that HTC has some cryptographic verifications for this, so I cannot modify everything.
The following is the method of modification. I hope people who are familiar with these can find things that I didn’t notice.
-------------------------------------
Changing mid:
1.Get image of sdf2 partition by
dd if=/dev/block/sdf2 of=/sdcard/sdf2.img
Click to expand...
Click to collapse
and then pull it to your computer by
adb pull /sdcard/sdf2.img
Click to expand...
Click to collapse
2.Open the image file by hex editor, find the mid of your phone. For me, it is
2.Q.4.D.2.0.0.0.0
Click to expand...
Click to collapse
change it to the mid you want.
3.Push the image back to your phone by
adb push ./sdf2.img /sdcard/sdf2.img
Click to expand...
Click to collapse
the flash it back to the sdf2 partition by
dd if=/sdcard/sdf2.img of=/dev/block/sdf2
Click to expand...
Click to collapse
4.Done. You can check it by
fastboot getvar mid
Click to expand...
Click to collapse
-------------------------------------
Changing cid:
1.Get image of sdf1 partition by
dd if=/dev/block/sdf1 of=/sdcard/sdf1.img
Click to expand...
Click to collapse
and then pull it to your computer by
adb pull /sdcard/sdf1.img
Click to expand...
Click to collapse
2.Open the image file by text editor, find the cid of your phone. For me, it is
HTCCN701
Click to expand...
Click to collapse
change it to the cid you want.
3.Push the image back to your phone by
adb push ./sdf1.img /sdcard/sdf1.img
Click to expand...
Click to collapse
the flash it back to the sdf1 partition by
dd if=/sdcard/sdf1.img of=/dev/block/sdf1
Click to expand...
Click to collapse
4.Done. You can check it by
fastboot getvar cid
Click to expand...
Click to collapse
(Yes, I copied the above )
-------------------------------------
For changing version number to downgrade, here is the link:
https://forum.xda-developers.com/htc-u11/how-to/downgrade-downgrade-flashing-version-t3762172
I noticed that there is also a cid in sde1, but modifying it does not make me to pass the checking of HTC.
-------------------------------------
After I failed on flashing the other RUU pack, I restore cid, mid and version number, and I pass the checking this time, so I don't think modifying them will cause trouble.
There are many things in the extracted image, maybe some encrypted data is hidden inside.
Hope this can help you.

Those are images of my sde and sdf (entire partition). The IMEI and MEID after CID in sdf.img have been deleted. You should fill in your ID. If you want to test the entire partition flashing from other phones, you can try it. Backup your data and original partitions before flashing!!!
https://drive.google.com/open?id=1P1hxH4hI9BC8qNRzodMC298I3dZhpTs1
China mainland version.
CID:HTCCN701
MID:2Q4D20000
version number:1.24.1405.7
Hopefully you can share your partition images too.

you can recomend app for editor img .
Thank you for share.

newyesor said:
you can recomend app for editor img .
Thank you for share.
Click to expand...
Click to collapse
You can try this:
https://play.google.com/store/apps/details?id=tuba.tools
on Android or
https://mh-nexus.de/en/hxd/
on Windows.
I used vim and xxd for editing hex file,
:%!xdd to get hex format and :%!xxd -r to return text format.
Vim for Android:
https://play.google.com/store/apps/details?id=com.droidvim
For editing CID, just edit the image by any text editor such as notepad.

I was pull file sdf1.img,sdf2,img from my devices but it's smaller than your file.
adb shell "dd if=/dev/block/sdf1 of=/sdcard/sdf1.img"
adb pull /sdcard/sdf1.img
adb shell "dd if=/dev/block/sdf2 of=/sdcard/sdf2.img"
adb pull /sdcard/sdf2.img
sdf1.img size=16 kb
sdf2.img size=256 kb

newyesor said:
I was pull file sdf1.img,sdf2,img from my devices but it's smaller than your file.
adb shell "dd if=/dev/block/sdf1 of=/sdcard/sdf1.img"
adb pull /sdcard/sdf1.img
adb shell "dd if=/dev/block/sdf2 of=/sdcard/sdf2.img"
adb pull /sdcard/sdf2.img
sdf1.img size=16 kb
sdf2.img size=256 kb
Click to expand...
Click to collapse
Of course, I extract the entire sdf and sde partitions by
dd if=/dev/block/sdf of=/sdcard/sdf.img
and
dd if=/dev/block/sde of=/sdcard/sde.img
Because I think the data may not only exist in sdf1 and sdf2.
If you want to test my image, you should type
dd if=/sdcard/sdf.img of=/dev/block/sdf
and
dd if=/sdcard/sde.img of=/dev/block/sde
Remember to backup your data.

newyesor said:
I was pull file sdf1.img,sdf2,img from my devices but it's smaller than your file.
adb shell "dd if=/dev/block/sdf1 of=/sdcard/sdf1.img"
adb pull /sdcard/sdf1.img
adb shell "dd if=/dev/block/sdf2 of=/sdcard/sdf2.img"
adb pull /sdcard/sdf2.img
sdf1.img size=16 kb
sdf2.img size=256 kb
Click to expand...
Click to collapse
I want to find out what is the difference between our partitions. Perhaps comparing your files will reveal some interesting things to help us to change CID and MID. So if you agree, I want your partition images.
Thanks

handsome_hell said:
Hello guys!
After the last time I successfully downgraded by modifying /dev/sde1, I tried to modify cid and mid in the same way. I successfully done this today, but I encountered some problems while flashing the RUU pack.
It seems that HTC has some cryptographic verifications for this, so I cannot modify everything.
The following is the method of modification. I hope people who are familiar with these can find things that I didn’t notice.
-------------------------------------
Changing mid:
1.Get image of sdf2 partition by
and then pull it to your computer by
2.Open the image file by hex editor, find the mid of your phone. For me, it is
change it to the mid you want.
3.Push the image back to your phone by
the flash it back to the sdf2 partition by
4.Done. You can check it by
-------------------------------------
Changing cid:
1.Get image of sdf1 partition by
and then pull it to your computer by
2.Open the image file by text editor, find the cid of your phone. For me, it is
change it to the cid you want.
3.Push the image back to your phone by
the flash it back to the sdf1 partition by
4.Done. You can check it by
(Yes, I copied the above )
-------------------------------------
For changing version number to downgrade, here is the link:
I noticed that there is also a cid in sde1, but modifying it does not make me to pass the checking of HTC.
-------------------------------------
After I failed on flashing the other RUU pack, I restore cid, mid and version number, and I pass the checking this time, so I don't think modifying them will cause trouble.
There are many things in the extracted image, maybe some encrypted data is hidden inside.
Hope this can help you.
Click to expand...
Click to collapse
Hello
I try get file sde1 but error
Code:
remote object '/dev/block/sde1' not a file or directory
What should I do?
and how do you modify the sde1 file? "what is software?"

Ba Duc said:
Hello
I try get file sde1 but error
What should I do?
and how do you modify the sde1 file? "what is software?"
Click to expand...
Click to collapse
Try it in recovery mode, or try
dd if=/dev/block/sde1 of=/sdcard/sde1.img
then
adb pull /sdcard/sde1.img
Just modify it by any text editor.

handsome_hell said:
Try it in recovery mode, or try
dd if=/dev/block/sde1 of=/sdcard/sde1.img
then
adb pull /sdcard/sde1.img
Click to expand...
Click to collapse
yep !
I have "sde1" by way copy "sde1" to forder "system" and "pull" it.
but I edit "sed1" by "notepad" and save
Then I "push" it to the forder "system" and copy it to "/dev/block"
and "reboot dowload" with 2Q4DIMG.zip (not 2Q4DIMG.zip.zip) but it reboot to operating system, not install firmwave

This is images of my sde and sdf (entire partition).
https://drive.google.com/open?id=1S9XeQ5muOkqeyMGE1fQJR1Tp1M1O4Wda
Hongkong version.
CID:HTC__622
MID:2Q4D10000
version number:1.24.400.3

Ba Duc said:
yep !
I have "sde1" by way copy "sde1" to forder "system" and "pull" it.
but I edit "sed1" by "notepad" and save
Then I "push" it to the forder "system" and copy it to "/dev/block"
and "reboot dowload" with 2Q4DIMG.zip (not 2Q4DIMG.zip.zip) but it reboot to operating system, not install firmwave
Click to expand...
Click to collapse
It's not a problem of sde1, did you use
adb reboot dowload ?
If yes, you should type
adb reboot download
instead of it
dowload -> download
If you type the right command, you can try pressing and holding the volume up button during startup, which can also let you enter the download mode.
BTW, what do you mean by "copy"? Did you mean the command "dd"?

handsome_hell said:
It's not a problem of sde1, did you use
adb reboot dowload ?
If yes, you should type
adb reboot download
instead of it
dowload -> download
If you type the right command, you can try pressing and holding the volume up button during startup, which can also let you enter the download mode.
BTW, what do you mean by "copy"? Did you mean the command "dd"?
Click to expand...
Click to collapse
hi Handsome_hell, Thanks for your enthusiasm
I used "HTC_Version_Tool" and changed it.

Ba Duc said:
hi Handsome_hell, Thanks for your enthusiasm
I used "HTC_Version_Tool" and changed it.
Click to expand...
Click to collapse
Okay
Does this tool provide the ability to change CID or MID?

handsome_hell said:
Okay
Does this tool provide the ability to change CID or MID?
Click to expand...
Click to collapse
no it only change version

newyesor said:
This is images of my sde and sdf (entire partition).
https://drive.google.com/open?id=1S9XeQ5muOkqeyMGE1fQJR1Tp1M1O4Wda
Hongkong version.
CID:HTC__622
MID:2Q4D10000
version number:1.24.400.3
Click to expand...
Click to collapse
I will try to modify CID and MID on this Thursday or Friday. Thank you for your help.

newyesor said:
This is images of my sde and sdf (entire partition).
https://drive.google.com/open?id=1S9XeQ5muOkqeyMGE1fQJR1Tp1M1O4Wda
Hongkong version.
CID:HTC__622
MID:2Q4D10000
version number:1.24.400.3
Click to expand...
Click to collapse
How many Sim cards can your phone use at the same time? Why do I only find one IMEI number in your file?

My devices is dual sims but i use single sim with SD card.
I am insert image partition sdf of my devices.
sdf1&sdf2
https://drive.google.com/open?id=1FgDOlpIx-FHSOzdEirIMMYXW3yjrVWtT

Hi mate, I have a question about edit cid and mid.
I want to change cid and mid on my devices ,i must to edit file sdf.img and sde.img.
I must to edit sdf1.img and sdf2.img ?

newyesor said:
Hi mate, I have a question about edit cid and mid.
I want to change cid and mid on my devices ,i must to edit file sdf.img and sde.img.
I must to edit sdf1.img and sdf2.img ?
Click to expand...
Click to collapse
I don't understand...
You can edit sdf1 for CID and sdf2 for MID, sde1 for version number.