USE AT YOUR OWN RISK
adb push C:\Users\*\Downloads\redbend_ua /data/local
adb shell
chmod 755 /data/local/redbend_ua
/data/local/redbend_ua restore /sdcard/zImage.bin /dev/block/bml7
or
/data/local/redbend_ua restore /sdcard/recovery2.bin /dev/block/bml8
http://www.sdx-downloads.com/devs/noobnl/redbend_ua.zip
stock kernel http://www.sdx-downloads.com/devs/noobnl/zImage.bin
clockworkmod recovery: http://www.sdx-downloads.com/devs/noobnl/recovery2.bin
put it in sdcard
build 2: fixes script (made a dumb mistake)
So.. I used at my own risk.
after copying redbend over and trying to flash clockworkmod recovery I got a wierd error telling me something like the "file count is wrong" (if somebody else tries this PM me with the correct message so i can fix this)
I rebooted the phone and tried again. It worked and I can confirm clockwork recovery installed. I have not tried to do anything like format SD or install a zip yet, but I will.
After booting into recovery I was only able to find three working buttons.
1. The "Smiley" button next to left shift will allow you to navigate the menues, it functions like an up arrow would.
2. The "H" button behaves like the "enter" key
3. The "Searching Glass" (On the front, the rightmost lit button that looks like a magnifying glass) = return to the main menu within recovery.
I will test right now.
This is what I got.
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, heig
open device file: Permission den
bmldevice_get_size: bmldevice_op
dst: /dev/block/bml8 partition s
part_size: 0x0
reboot: Operation not permitted
Bump for update.
AH I just realized i still have the command prompt window up from both the attempt that work and the attempt that failed.
Code:
C:\android-sdk-windows\tools>adb push c:\redbend_ua\redbend_ua /data/local
1523 KB/s (313888 bytes in 0.201s)
C:\android-sdk-windows\tools>adb shell
$ su
su
# chmod 755 /data/local/redbend_ua
chmod 755 /data/local/redbend_ua
# /data/local/redbend_ua restore /sdcard/recovery.bin /dev/block/bml8
/data/local/redbend_ua restore /sdcard/recovery.bin /dev/block/bml8
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
page_msize: 4096, phy_unit_size: 262144
src: /sdcard/recovery.bin
dst: /dev/block/bml8 partition size: 0x780000
part_size: 0x780000
failed to read from /sdcard/recovery.bin (Bad file number)
>>>>NOTE INSERT>>>>> BETWEEN THE PREVIOUS LINE AND THE NEXT I DID A BATTERY PULL REBOOT.
C:\android-sdk-windows\tools>adb shell
$ su
# /data/local/redbend_ua restore /sdcard/recovery.bin /dev/block/bml8
/data/local/redbend_ua restore /sdcard/recovery.bin /dev/block/bml8
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
page_msize: 4096, phy_unit_size: 262144
src: /sdcard/recovery.bin
dst: /dev/block/bml8 partition size: 0x780000
part_size: 0x780000
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 20384 bytes
read finished
C:\android-sdk-windows\tools>
Thanks. I know what went wrong. SU was needed.
BTW. The first time I did it. The many read file appeared to me. But I did not have ClockWork recovery.
Badge2378 said:
AH I just realized i still have the command prompt window up from both the attempt that work and the attempt that failed.
Code:
C:\android-sdk-windows\tools>adb push c:\redbend_ua\redbend_ua /data/local
1523 KB/s (313888 bytes in 0.201s)
C:\android-sdk-windows\tools>adb shell
$ su
su
# chmod 755 /data/local/redbend_ua
chmod 755 /data/local/redbend_ua
# /data/local/redbend_ua restore /sdcard/recovery.bin /dev/block/bml8
/data/local/redbend_ua restore /sdcard/recovery.bin /dev/block/bml8
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
page_msize: 4096, phy_unit_size: 262144
src: /sdcard/recovery.bin
dst: /dev/block/bml8 partition size: 0x780000
part_size: 0x780000
failed to read from /sdcard/recovery.bin (Bad file number)
>>>>NOTE INSERT>>>>> BETWEEN THE PREVIOUS LINE AND THE NEXT I DID A BATTERY PULL REBOOT.
C:\android-sdk-windows\tools>adb shell
$ su
# /data/local/redbend_ua restore /sdcard/recovery.bin /dev/block/bml8
/data/local/redbend_ua restore /sdcard/recovery.bin /dev/block/bml8
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
page_msize: 4096, phy_unit_size: 262144
src: /sdcard/recovery.bin
dst: /dev/block/bml8 partition size: 0x780000
part_size: 0x780000
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 20384 bytes
read finished
C:\android-sdk-windows\tools>
Click to expand...
Click to collapse
nice! time to update the post!
noobnl said:
nice! time to update the post!
Click to expand...
Click to collapse
The thing is Noob, that I had the same result with one try. And I do not have Clockwork recovery.
Here is a wierd bit.
If I reboot using "Volume Down" + "Camera" + "Power" i get into clockwork.
If I "Reboot to Recovery" using a software tool (Root Manager specifically) i end up in the stock recovery (Blue Text)
??
Badge2378 said:
Here is a wierd bit.
If I reboot using "Volume Down" + "Camera" + "Power" i get into clockwork.
If I "Reboot to Recovery" using a software tool (Root Manager specifically) i end up in the stock recovery (Blue Text)
??
Click to expand...
Click to collapse
If I boot on Recovery it boots to recovery. Hm..
C:\SDK\tools>adb shell
$ su
su
# /data/local/redbend_ua restore /sdcard/recovery.bin /dev/block/bml8
/data/local/redbend_ua restore /sdcard/recovery.bin /dev/block/bml8
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
page_msize: 4096, phy_unit_size: 262144
src: /sdcard/recovery.bin
dst: /dev/block/bml8 partition size: 0x780000
part_size: 0x780000
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 20384 bytes
read finished
I do not have Clockwork.
Fixter said:
If I boot on Recovery it boots to recovery. Hm..
Click to expand...
Click to collapse
I should have said boot, as from power off.
If I start with the power off, then Press "Volume Down" + "Camera" + "Power" and keep holding them, i end up in Clockwork Rocovery v2.5.0.4
I'll shoot a pic as soon as my wife(and her camera) get home.
Badge2378 said:
I should have said boot, as from power off.
If I start with the power off, then Press "Volume Down" + "Camera" + "Power" and keep holding them, i end up in Clockwork Rocovery v2.5.0.4
I'll shoot a pic as soon as my wife(and her camera) get home.
Click to expand...
Click to collapse
I'm gonna go check ROM Manager
Edit: Rom Manager boots me to Stock Recovery.
Fixter said:
I'm gonna go check ROM Manager
Edit: Rom Manager boots me to Stock Recovery.
Click to expand...
Click to collapse
Yeah, that's what i said before. The only way I've been able to boot into ClockworkMod is using the three button combo method.
Badge2378 said:
Yeah, that's what i said before. The only way I've been able to boot into ClockworkMod is using the three button combo method.
Click to expand...
Click to collapse
I get the same thing using both methods.
check the first post again make sure your applying the recovery.bin to bml8
shabbypenguin said:
check the first post again make sure your applying the recovery.bin to bml8
Click to expand...
Click to collapse
If you check my last post with the code, you can see we both have the exact same results. Also. I copy, pasted.
I dont understand the parrt about
/redbend_ua restore'
where do I place that file in the tools folder of sdk? and clockwork file on root of sd card?
rjmjr69 said:
I dont understand the parrt about
/redbend_ua restore'
where do I place that file in the tools folder of sdk? and clockwork file on root of sd card?
Click to expand...
Click to collapse
In the root of the SD Card.
Fixter said:
In the root of the SD Card.
Click to expand...
Click to collapse
thank you so all three files on root?
Ok so I have been trying to flash the newest oneclick flasher to my Epic all day. NOTHING is working.
The driver downloads in the thread are down but I located them else where. I know nothing is suppose to be mounted and debugging should be on. I have all of that and it still does not go through.
I went through the process of manually rooting the phone through the very first root method....I got root. No superuser app but I had root. So I figured hell the .bat file should work now....WRONG...still i get nothing.
I attached a picture of what happens every time I attempt to run the .bat file.
Maybe I'm making this over complicated since all the phones I've previously rooted were all through adb and a lot more work.
Can I please get some guidance on what I am doing wrong.
Thank you!
Open the .bat file and copy each command manually into command prompt. If you don't have paths set up, you'll have to CD to the directory with ADB (probably the 1-click-whatever folder you downloaded, which you have to do anyway, so might as well do it now). If you get a phone offline or phone disconected error. Just keep running the sam command until it goes through then move on. Copy+paste for safety. Don't worry about the ping commands.
Sent from my SPH-D700 using XDA App
This happened to me too. Use a different micro usb cable than the one the phone came with and it will fix it.
I had same issues..here is what I did:
1) unplugged phone and reset phone..
2) uninstalled the drivers..then reinstalled them.
3) Plugged in the device..
4) this is the hard part that got me...gotta wait for the device to fully install the drivers on the bottom right...I messed up the first time cause I couldn't wait..(This can take up to 5 minutes or so..there are total of 4 drivers that are installed..you need 3/4 to finish..2/4 is not enough and will cause the issues)
5) ran:
adb.exe get-state
it should give you output of "device" and not "unknown"
6) ran run.bat
7) Profit
I had the same problem the first time, but it only happed because I didn't restart my phone
After turning on debugging. When I plugged it into the usb after that it worked fine don"t even recall having to unmount anything.
I had the same issues as well. Then I tried a different laptop and it worked like a charm
And is the best way to know this goes throught superuser application??
Ok so it looks like it is STILL not working.
I uninstalled the drivers, reinstalled them, reset both computer and the phone, plugged the phone in, waited for those to fully install, ran adb.exe get-state it said device this time but now i get this:
exploit and busybox made by joeykrim and one click installer and andromeda galax
y kernel made by noobnl
Press any key to continue . . .
copy and run the exploit (may take 2 minutes)
adb server is out of date. killing...
* daemon started successfully *
175 KB/s (5392 bytes in 0.030s)
1 KB/s (88 bytes in 0.063s)
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3712, 3712}
[*] Searching for adb ...
[+] Found adb as PID 2223
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] [email protected] so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
remove joeykrim root method
148 KB/s (14428 bytes in 0.095s)
5 KB/s (279 bytes in 0.051s)
rm failed for /system/bin/remount, No such file or directory
rm failed for /system/bin/busybox, No such file or directory
copy kernel and flasher
346 KB/s (313888 bytes in 0.885s)
488 KB/s (6889960 bytes in 13.785s)
flashing kernel
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
page_msize: 4096, phy_unit_size: 262144
src: /sdcard/zImage
dst: /dev/block/bml7 partition size: 0x780000
part_size: 0x780000
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 74216 bytes
read finished
wait 60 second
cleanup
done
Press any key to continue . . .
Click to expand...
Click to collapse
So what am I doing wrong now??
What would the physical ADB commands look like?? That's always how I have had to root on my phones in the past and I've never had issues. I have had more problems trying this "easy" one click root than with typing out everything myself.
Spectral8x said:
Ok so it looks like it is STILL not working.
I uninstalled the drivers, reinstalled them, reset both computer and the phone, plugged the phone in, waited for those to fully install, ran adb.exe get-state it said device this time but now i get this:
So what am I doing wrong now??
Click to expand...
Click to collapse
From the looks of it your using the 1.3 root with the kernal..what it failed on is to remove the other root (since you didn't have it which is fine)...seems like everything is ok..restart your phone and you should have root.
Hey Folks,
My apologies if this should be in a different forum.
Read the "efffen-manual" when using the AAHK software. The unit went through about 7 minutes of scripts on option 1 (Hack Ace), then stopped in <waiting for device>. Been like this for now 20 minutes. Screen is black, unit appears to be off, Power button does nothing. Only orange charging light is blinking. Oh, and one other thing, When it got to this point, the windows system had a balloon popup about the Motorola (or did it say qualcom) device not recognized. Suggestions?
Here is the code thus far.
Ace Advanced Hack Kit [Linux/OSX/Windows] attn1 2011/2012
___________________________
MAIN MENU | |
| Only ONE Menu Step to: |
1 - Hack Ace <----------------------------+ * S-OFF |
| * SIM Unlock |
2 - DONATE (Encouraged, but optional) | * SuperCID |
http://psas.revskills.de/?q=goldcard | * Root |
http://www.eff.org/ | * Busybox |
| |
**********************************************************************
o - Options Menu (Return to Stock, Flash radios, etc)
**********************************************************************
t - Toggle Flash Method - current method is fastbootRUU
*********************************************************************
q - Quit
[Select and press Enter]1
/sdcard/PD98IMG.zip: No such file or directory
rm failed for /sdcard/PD98IMG.zip, No such file or directory
1867 KB/s (4359771 bytes in 2.279s)
pkg: /data/local/tmp/stericson.busybox-1.apk
Success
1878 KB/s (19240 bytes in 0.010s)
2596 KB/s (4564992 bytes in 1.717s)
2790 KB/s (3737600 bytes in 1.308s)
2644 KB/s (557962 bytes in 0.206s)
683 KB/s (9796 bytes in 0.014s)
2442 KB/s (572752 bytes in 0.229s)
2678 KB/s (134401 bytes in 0.049s)
909 KB/s (13968 bytes in 0.015s)
ro.build.version.release=2.3.3
Setting up for Gingerbread restore...
2554 KB/s (2801664 bytes in 1.071s)
2717 KB/s (2830336 bytes in 1.017s)
2407 KB/s (285981 bytes in 0.116s)
2685 KB/s (285981 bytes in 0.104s)
1 file(s) copied.
Linux version 2.6.35.10-gd2564fb ([email protected]) (gcc version 4.4.0 (GCC) )
#1 PREEMPT Thu Jun 9 14:33:05 CST 2011
Kernel version is Gingerbread... Using fre3vo to temproot...
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 802160640
smem_len: 3145728
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 0
bits_per_pixel: 32
activate: 16
height: 106
width: 62
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Buffer offset: 00000000
Buffer size: 8192
Scanning region faa90000...
Scanning region fab80000...
Scanning region fac70000...
Scanning region fad60000...
Scanning region fae50000...
Scanning region faf40000...
Scanning region fb030000...
Scanning region fb120000...
Scanning region fb210000...
Scanning region fb300000...
Scanning region fb3f0000...
Scanning region fb4e0000...
Scanning region fb5d0000...
Scanning region fb6c0000...
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba80000...
Scanning region fbb70000...
Potential exploit area found at address fbb80e00:200.
Exploiting device...
/dev/block/vold/179:65 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,
uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharse
t=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
http://psas.revskills.de/
0+1 records in
0+1 records out
384 bytes transferred in 0.004 secs (96000 bytes/sec)
--set_version set. VERSION will be changed to: 1.31.405.6
Misc partition is "/dev/block/mmcblk0p17"
Patching and backing up misc partition...
Starting update process....
< waiting for device >
erasing 'cache'... OKAY [ 0.163s]
finished. total time: 0.164s
Be patient - sending update ...
sending 'zip' (18223 KB)... OKAY [ 3.071s]
writing 'zip'... INFOadopting the signature contained in this i
mage...
INFOsignature checking...
INFOzip header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
INFOchecking main version...
INFOstart image[boot] unzipping & flushing...
INFO[RUU]UZ,boot,0
INFO[RUU]UZ,boot,31
INFO[RUU]UZ,boot,68
INFO[RUU]UZ,boot,99
INFO[RUU]UZ,boot,100
INFO[RUU]WP,boot,0
INFO[RUU]WP,boot,100
INFOstart image[recovery] unzipping & flushing...
INFO[RUU]UZ,recovery,0
INFO[RUU]UZ,recovery,20
INFO[RUU]UZ,recovery,44
INFO[RUU]UZ,recovery,66
INFO[RUU]UZ,recovery,89
INFO[RUU]UZ,recovery,100
INFO[RUU]WP,recovery,0
INFO[RUU]WP,recovery,100
INFOstart image[radio] unzipping & flushing...
INFO[RUU]UZ,radio,0
INFO[RUU]UZ,radio,8
INFO[RUU]UZ,radio,13
INFO[RUU]UZ,radio,20
INFO[RUU]UZ,radio,25
INFO[RUU]UZ,radio,33
INFO[RUU]UZ,radio,41
INFO[RUU]UZ,radio,49
INFO[RUU]UZ,radio,57
INFO[RUU]UZ,radio,62
INFO[RUU]UZ,radio,70
INFO[RUU]UZ,radio,79
INFO[RUU]UZ,radio,86
INFO[RUU]UZ,radio,94
INFO[RUU]UZ,radio,99
INFO[RUU]UZ,radio,100
INFO[RUU]WP,radio,0
INFO[RUU]WP,radio,6
INFO[RUU]WP,radio,14
INFO[RUU]WP,radio,19
INFO[RUU]WP,radio,27
INFO[RUU]WP,radio,36
INFO[RUU]WP,radio,44
INFO[RUU]WP,radio,51
INFO[RUU]WP,radio,59
INFO[RUU]WP,radio,68
INFO[RUU]WP,radio,76
INFO[RUU]WP,radio,85
INFO[RUU]WP,radio,95
INFO[RUU]WP,radio,100
OKAY [108.400s]
finished. total time: 111.472s
rebooting...
finished. total time: 0.172s
Radio downgrade complete - starting next process - please be patient...
Linux version 2.6.32.21-gf3f553d ([email protected]) (gcc version 4.4.0 (GCC) )
#1 PREEMPT Thu Oct 28 13:24:11 CST 2010
major abra-cadabra going on, please be patient.....
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.21-gf3f553d
New .modinfo section size: 204
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02a9e00, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02a9000
Kernel memory mapped to 0x40000000
Searching for brq filter...
- Address: 0xc02a9e00 + 0x34c
- 0x2a000012 -> 0xea000012
Patching and backing up partition 7...
Error opening copy file.
Error opening copy file.
^^^^^^^^^^^^
I- NORMAL ERROR HERE -I
patience - rebooting
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.21
New .modinfo section size: 196
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02db21c, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02db000
Kernel memory mapped to 0x40009000
Searching for brq filter...
- Address: 0xc02db21c + 0x34c
- 0x2a000012 -> 0xea000012
Patching and backing up partition 7...
patching secu_flag: 0
Done.
board_spade.disable_uart2=0 board_spade.usb_h2w_sw=0 board_spade.disable_sdcard=
0 diag.enabled=0 board_spade.debug_uart=0 smisize=0 userdata_sel=0 androidboot.e
mmc=true androidboot.baseband=26.03.02.26_M androidboot.cid=CWS__001 androidboo
t.batt_poweron=good_battery androidboot.carrier=ATT androidboot.mid=PD9812000 en
able_zcharge=1 androidboot.keycaps=qwerty androidboot.mode=recovery androidboot.
serialno=HT14JT200132 androidboot.bootloader=0.85.0024 zygote_oneshot=off kmemle
ak=off no_console_suspend=1
push: tools/afr/system/app/Superuser.apk -> /system/app/Superuser.apk
push: tools/afr/system/bin/su -> /system/bin/su
2 files pushed. 0 files skipped.
2045 KB/s (609587 bytes in 0.291s)
dmagent mmcamera_test su
dmesg monkey surfaceflinger
ifconfig printenv wpa_supplicant
S-OFF, ROOT and Clockworkmod recovery complete
Be patient - installing updated radio and AAHK ENG Hboot...
Starting update process....
< waiting for device >
Greech said:
Hey Folks,
My apologies if this should be in a different forum.
Read the "efffen-manual" when using the AAHK software. The unit went through about 7 minutes of scripts on option 1 (Hack Ace), then stopped in <waiting for device>. Been like this for now 20 minutes. Screen is black, unit appears to be off, Power button does nothing. Only orange charging light is blinking. Oh, and one other thing, When it got to this point, the windows system had a balloon popup about the Motorola (or did it say qualcom) device not recognized. Suggestions?
Here is the code thus far.
Ace Advanced Hack Kit [Linux/OSX/Windows] attn1 2011/2012
___________________________
MAIN MENU | |
| Only ONE Menu Step to: |
1 - Hack Ace <----------------------------+ * S-OFF |
| * SIM Unlock |
2 - DONATE (Encouraged, but optional) | * SuperCID |
http://psas.revskills.de/?q=goldcard | * Root |
http://www.eff.org/ | * Busybox |
| |
**********************************************************************
o - Options Menu (Return to Stock, Flash radios, etc)
**********************************************************************
t - Toggle Flash Method - current method is fastbootRUU
*********************************************************************
q - Quit
[Select and press Enter]1
/sdcard/PD98IMG.zip: No such file or directory
rm failed for /sdcard/PD98IMG.zip, No such file or directory
1867 KB/s (4359771 bytes in 2.279s)
pkg: /data/local/tmp/stericson.busybox-1.apk
Success
1878 KB/s (19240 bytes in 0.010s)
2596 KB/s (4564992 bytes in 1.717s)
2790 KB/s (3737600 bytes in 1.308s)
2644 KB/s (557962 bytes in 0.206s)
683 KB/s (9796 bytes in 0.014s)
2442 KB/s (572752 bytes in 0.229s)
2678 KB/s (134401 bytes in 0.049s)
909 KB/s (13968 bytes in 0.015s)
ro.build.version.release=2.3.3
Setting up for Gingerbread restore...
2554 KB/s (2801664 bytes in 1.071s)
2717 KB/s (2830336 bytes in 1.017s)
2407 KB/s (285981 bytes in 0.116s)
2685 KB/s (285981 bytes in 0.104s)
1 file(s) copied.
Linux version 2.6.35.10-gd2564fb ([email protected]) (gcc version 4.4.0 (GCC) )
#1 PREEMPT Thu Jun 9 14:33:05 CST 2011
Kernel version is Gingerbread... Using fre3vo to temproot...
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 802160640
smem_len: 3145728
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 0
bits_per_pixel: 32
activate: 16
height: 106
width: 62
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Buffer offset: 00000000
Buffer size: 8192
Scanning region faa90000...
Scanning region fab80000...
Scanning region fac70000...
Scanning region fad60000...
Scanning region fae50000...
Scanning region faf40000...
Scanning region fb030000...
Scanning region fb120000...
Scanning region fb210000...
Scanning region fb300000...
Scanning region fb3f0000...
Scanning region fb4e0000...
Scanning region fb5d0000...
Scanning region fb6c0000...
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba80000...
Scanning region fbb70000...
Potential exploit area found at address fbb80e00:200.
Exploiting device...
/dev/block/vold/179:65 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,
uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharse
t=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
http://psas.revskills.de/
0+1 records in
0+1 records out
384 bytes transferred in 0.004 secs (96000 bytes/sec)
--set_version set. VERSION will be changed to: 1.31.405.6
Misc partition is "/dev/block/mmcblk0p17"
Patching and backing up misc partition...
Starting update process....
< waiting for device >
erasing 'cache'... OKAY [ 0.163s]
finished. total time: 0.164s
Be patient - sending update ...
sending 'zip' (18223 KB)... OKAY [ 3.071s]
writing 'zip'... INFOadopting the signature contained in this i
mage...
INFOsignature checking...
INFOzip header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
INFOchecking main version...
INFOstart image[boot] unzipping & flushing...
INFO[RUU]UZ,boot,0
INFO[RUU]UZ,boot,31
INFO[RUU]UZ,boot,68
INFO[RUU]UZ,boot,99
INFO[RUU]UZ,boot,100
INFO[RUU]WP,boot,0
INFO[RUU]WP,boot,100
INFOstart image[recovery] unzipping & flushing...
INFO[RUU]UZ,recovery,0
INFO[RUU]UZ,recovery,20
INFO[RUU]UZ,recovery,44
INFO[RUU]UZ,recovery,66
INFO[RUU]UZ,recovery,89
INFO[RUU]UZ,recovery,100
INFO[RUU]WP,recovery,0
INFO[RUU]WP,recovery,100
INFOstart image[radio] unzipping & flushing...
INFO[RUU]UZ,radio,0
INFO[RUU]UZ,radio,8
INFO[RUU]UZ,radio,13
INFO[RUU]UZ,radio,20
INFO[RUU]UZ,radio,25
INFO[RUU]UZ,radio,33
INFO[RUU]UZ,radio,41
INFO[RUU]UZ,radio,49
INFO[RUU]UZ,radio,57
INFO[RUU]UZ,radio,62
INFO[RUU]UZ,radio,70
INFO[RUU]UZ,radio,79
INFO[RUU]UZ,radio,86
INFO[RUU]UZ,radio,94
INFO[RUU]UZ,radio,99
INFO[RUU]UZ,radio,100
INFO[RUU]WP,radio,0
INFO[RUU]WP,radio,6
INFO[RUU]WP,radio,14
INFO[RUU]WP,radio,19
INFO[RUU]WP,radio,27
INFO[RUU]WP,radio,36
INFO[RUU]WP,radio,44
INFO[RUU]WP,radio,51
INFO[RUU]WP,radio,59
INFO[RUU]WP,radio,68
INFO[RUU]WP,radio,76
INFO[RUU]WP,radio,85
INFO[RUU]WP,radio,95
INFO[RUU]WP,radio,100
OKAY [108.400s]
finished. total time: 111.472s
rebooting...
finished. total time: 0.172s
Radio downgrade complete - starting next process - please be patient...
Linux version 2.6.32.21-gf3f553d ([email protected]) (gcc version 4.4.0 (GCC) )
#1 PREEMPT Thu Oct 28 13:24:11 CST 2010
major abra-cadabra going on, please be patient.....
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.21-gf3f553d
New .modinfo section size: 204
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02a9e00, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02a9000
Kernel memory mapped to 0x40000000
Searching for brq filter...
- Address: 0xc02a9e00 + 0x34c
- 0x2a000012 -> 0xea000012
Patching and backing up partition 7...
Error opening copy file.
Error opening copy file.
^^^^^^^^^^^^
I- NORMAL ERROR HERE -I
patience - rebooting
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.21
New .modinfo section size: 196
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02db21c, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02db000
Kernel memory mapped to 0x40009000
Searching for brq filter...
- Address: 0xc02db21c + 0x34c
- 0x2a000012 -> 0xea000012
Patching and backing up partition 7...
patching secu_flag: 0
Done.
board_spade.disable_uart2=0 board_spade.usb_h2w_sw=0 board_spade.disable_sdcard=
0 diag.enabled=0 board_spade.debug_uart=0 smisize=0 userdata_sel=0 androidboot.e
mmc=true androidboot.baseband=26.03.02.26_M androidboot.cid=CWS__001 androidboo
t.batt_poweron=good_battery androidboot.carrier=ATT androidboot.mid=PD9812000 en
able_zcharge=1 androidboot.keycaps=qwerty androidboot.mode=recovery androidboot.
serialno=HT14JT200132 androidboot.bootloader=0.85.0024 zygote_oneshot=off kmemle
ak=off no_console_suspend=1
push: tools/afr/system/app/Superuser.apk -> /system/app/Superuser.apk
push: tools/afr/system/bin/su -> /system/bin/su
2 files pushed. 0 files skipped.
2045 KB/s (609587 bytes in 0.291s)
dmagent mmcamera_test su
dmesg monkey surfaceflinger
ifconfig printenv wpa_supplicant
S-OFF, ROOT and Clockworkmod recovery complete
Be patient - installing updated radio and AAHK ENG Hboot...
Starting update process....
< waiting for device >
Click to expand...
Click to collapse
Please come to the IRC channel in my signature. That is Hack Kit support channel
Bricked n suckss
i need help my htc inspire was in process of rooting w/t ace hackn power went out on installing radio100 and its stayed on black backround w/t rooted HTC logo and dats all it does witch 4 logos in evry corner
please help
Trying to get XZDR to work on my D6603 with version 23.4.A.0.56 of my firmware. Following [NUT]'s instructions on http://nut.xperia-files.com/
This is what happens on my screen in cmd:
==============================================
= =
= PhilZ Touch, CWM and TWRP Dual Recovery =
= Maintained by [NUT] =
= =
= For Many Sony Xperia Devices! =
= =
==============================================
1. Installation on ROM rooted with SuperSU
2. Installation on ROM rooted with SuperUser
3. Installation on unrooted ROM using the TowelRoot method
4. Install ADB drivers to windows
5. Exit
Please choose install action.
[1,2,3,4,5]?3
* server not running *
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
=============================================
Waiting for Device, connect USB cable now...
=============================================
Device found!
=============================================
Getting ro.build.product
=============================================
Device model is D6603
Firmware is 23.4.A.0.546
=============================================
Step2 : Sending the recovery files.
=============================================
5 KB/s (31 bytes in 0.006s)
1492 KB/s (18340 bytes in 0.012s)
97 KB/s (501 bytes in 0.005s)
1323 KB/s (12198 bytes in 0.009s)
3067 KB/s (65965 bytes in 0.021s)
501 KB/s (3082 bytes in 0.006s)
2193 KB/s (29204 bytes in 0.013s)
220 KB/s (1357 bytes in 0.006s)
1683 KB/s (34473 bytes in 0.020s)
234 KB/s (1202 bytes in 0.005s)
1029 KB/s (96956 bytes in 0.092s)
2482 KB/s (1410852 bytes in 0.555s)
2177 KB/s (3415978 bytes in 1.532s)
2441 KB/s (2420032 bytes in 0.968s)
2286 KB/s (1936117 bytes in 0.827s)
1276 KB/s (11760 bytes in 0.009s)
=============================================
Step3 : Setup of dual recovery.
=============================================
=============================================
Attempting to get root access for installation using TowelRoot now.
NOTE: this only works on certain ROM/Kernel versions!
If it fails, please check the development thread (Post #2) on XDA for more detai
ls.
REMEMBER THIS:
XZDualRecovery does NOT install any superuser app!!
You can use one of the recoveries to root your device.
=============================================
=============================================
Sending files
=============================================
33 KB/s (1776 bytes in 0.052s)
632 KB/s (13592 bytes in 0.021s)
2293 KB/s (197320 bytes in 0.084s)
618 KB/s (9496 bytes in 0.015s)
1112 KB/s (13672 bytes in 0.012s)
Copying kernel module...
1346 KB/s (34473 bytes in 0.025s)
32 KB/s (765 bytes in 0.023s)
1721 KB/s (96956 bytes in 0.055s)
Kernel version is 3.4.0-perf-gc42d8a9-01971-gef29327
Version does not match 3.4.0-perf-ge4322cd, needs patching...
dd: conv option disabled
Kernel module patched.
modulecrcpatch (by zxz0O0)
module_layout: patched to 0xCE969278
__aeabi_unwind_cpp_pr1: match
kallsyms_lookup_name: not found
printk: not found
mem_text_write_kernel_word: not found
__aeabi_unwind_cpp_pr0: match
=============================================
Installing using zxz0O0's towelzxperia
(using geohot's towelroot library)
=============================================
error: only position independent executables (PIE) are supported.
=============================================
Installation finished. Enjoy the recoveries!
=============================================
* server not running *
Press any key to continue . . .
What am I doing wrong? I thought that you didnt need to unlock any bootloader to get dual recovery to work. Pretty new with Sony's products so I might have something.
/Dave
daspunner said:
Trying to get XZDR to work on my D6603 with version 23.4.A.0.56 of my firmware.
What am I doing wrong? I thought that you didnt need to unlock any bootloader to get dual recovery to work. Pretty new with Sony's products so I might have something.
/Dave
Click to expand...
Click to collapse
The problem is 5.1.1 is not directly rootable useing towelroot method. (option 3).
You need to find a method to root the firmware with supersu and select option 1.
Flash a prerooted v.77 4.4.4 ftf first, then you can flash a prerooted v.56 5.11 zip using xzdr.
Googled around a bit and I couldnt figure out how to do. Where do I find the V.77 u are mentioning?
tweker said:
Flash a prerooted v.77 4.4.4 ftf first, then you can flash a prerooted v.56 5.11 zip using xzdr.
Click to expand...
Click to collapse
Never mind, found it!
The best thing about xzdr is it's full backup/restore capabilities. You can save or restore from anywhere, but saving to sd card takes twice as long. I only wish it worked with Sony's built-in full phone encryption. Once phone is encrypted you can kiss xzdr goodbye.
I'm gettin ready to use it as I want to see what existenz y looks and feels like. I like running 5.1.1 but moonwalkers 4.0 changed my LTE to 4G and apparently there is no option but to flash a different radio which I'd rather not mess with atm.
Check MultiRom Mgr off playstore. Requires unlocked bootloader which I haven't done yet.
While connecting usb-cable I am holding volume down. This is recognized by flashtool as entering in flashmode. So far so good! Selecting the correct firmware and flashtool is starting its business. About 30-45 seconds later my phone reboots in to system and the downgrade cant continue. WTF?!
Please help!
-edit-
Worked it out. Let flashtool create its magic and connected phone in flash mode when it asked me.
/Dave
Next problem... *sighs*
(Managed to get .77 firmware on my phone.)
Running the included installer in XZDR and it gets stuck at a certain point, which is when it says libdvm opened (loljavasucks). Not before entering CTRL+C and pressing N when asked if I want to "Terminate batch job (Y/N)?" it continues and says:
=============================================
Installation finished. Enjoy the recoveries!
=============================================
Press any key to continue . . .
Still no dual recovery...
Here is everything that is going on on my screen during installation:
==============================================
= =
= PhilZ Touch, CWM and TWRP Dual Recovery =
= Maintained by [NUT] =
= =
= For Many Sony Xperia Devices! =
= =
==============================================
1. Installation on ROM rooted with SuperSU
2. Installation on ROM rooted with SuperUser
3. Installation on unrooted ROM using the TowelRoot method
4. Install ADB drivers to windows
5. Exit
Please choose install action.
[1,2,3,4,5]?3
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
=============================================
Waiting for Device, connect USB cable now...
=============================================
Device found!
=============================================
Getting ro.build.product
=============================================
Device model is D6603
Firmware is 23.0.1.A.5.77
=============================================
Step2 : Sending the recovery files.
=============================================
7 KB/s (31 bytes in 0.004s)
1989 KB/s (18340 bytes in 0.009s)
122 KB/s (501 bytes in 0.004s)
1701 KB/s (12198 bytes in 0.007s)
2477 KB/s (65965 bytes in 0.026s)
752 KB/s (3082 bytes in 0.004s)
2193 KB/s (29204 bytes in 0.013s)
331 KB/s (1357 bytes in 0.004s)
2244 KB/s (34473 bytes in 0.015s)
293 KB/s (1202 bytes in 0.004s)
2705 KB/s (96956 bytes in 0.035s)
2367 KB/s (1410852 bytes in 0.582s)
2349 KB/s (3415978 bytes in 1.420s)
2168 KB/s (2420032 bytes in 1.090s)
2248 KB/s (1936117 bytes in 0.841s)
1640 KB/s (11760 bytes in 0.007s)
=============================================
Step3 : Setup of dual recovery.
=============================================
=============================================
Attempting to get root access for installation using TowelRoot now.
NOTE: this only works on certain ROM/Kernel versions!
If it fails, please check the development thread (Post #2) on XDA for more detai
ls.
REMEMBER THIS:
XZDualRecovery does NOT install any superuser app!!
You can use one of the recoveries to root your device.
=============================================
=============================================
Sending files
=============================================
867 KB/s (1776 bytes in 0.002s)
3318 KB/s (13592 bytes in 0.004s)
3853 KB/s (197320 bytes in 0.050s)
1854 KB/s (9496 bytes in 0.005s)
1668 KB/s (13672 bytes in 0.008s)
Copying kernel module...
2404 KB/s (34473 bytes in 0.014s)
186 KB/s (765 bytes in 0.004s)
2705 KB/s (96956 bytes in 0.035s)
Kernel version is 3.4.0-perf-g1b1963a-02930-g23f7791
Version does not match 3.4.0-perf-ge4322cd, needs patching...
1+0 records in
0+1 records out
34 bytes transferred in 0.001 secs (34000 bytes/sec)
Kernel module patched.
modulecrcpatch (by zxz0O0)
module_layout: patched to 0xFF791C4F
__aeabi_unwind_cpp_pr1: match
kallsyms_lookup_name: not found
printk: not found
mem_text_write_kernel_word: not found
__aeabi_unwind_cpp_pr0: match
=============================================
Installing using zxz0O0's towelzxperia
(using geohot's towelroot library)
=============================================
towelzxperia (by zxz0O0)
thanks to geohot for libexploit
doing the magic
creating vm (loljavasucks)
libdvm opened (loljavasucks)
^CTerminate batch job (Y/N)? N
=============================================
Installation finished. Enjoy the recoveries!
=============================================
Press any key to continue . . .
Feeling like total noob... Pls help!
/Dave
So I solved this one too... After downgrading even futher to 23.0.A.2.93 I used the giefroot root method and succeded to get the phone rooted. Option 3 in XZDR doesnt work on D6603 i read somewhere in my search for knowledge...
Thx a bunch everybody for the help and I hope my struggles will help others with same issues. I will try to apply this same method once more tomorrow on a D5803. Will get back with info wheter it worked.
/Dave
Yeah first steps first is root. Glad you perservered.
One quick question btw... Are my drm-keys intact? Only used prerooted stock firmware the whole way...
Any way to check that?
Found out how to check the Drm:s. Entered the servicemenu by dialling *#*#7378423#*#*