Database Info

[HOW-TO] downgrade HBOOT 0.93 to 0.80 again

After my new Desire updated by OTA to 2.2, my HBoot upgraded to 0.93.001
As a result, I am no longer to root it again or flashing any cooked rom.... It is such a nightmare for me. So I decided went to HTC service center and asking for a factory restore to Android 2.1, unfortunately the guy stated that due to my personal's fault - to hack the bootloader, there is no way to downgrade the software anymore. I need to pay extra money for a circuit board replacement. I am so angry with the replied, my phone actaully working fine with OTA 2.2 version (it is official release for Taiwan), all I want to do is requested for downgrade to official 2.1, why I need to replace a circuit board????
Anyway after a few hours, I figure out a solution and now working fine with Hboot 0.8 and then re-flashed to customized cooked FroYo rom
Here is the steps: (be careful, I am not responisable for any demage due to these procedures, also you need to have basic knowledge on using Android adb tools)
0.) Download this good program: http://evo4g.me/downloads/evo-root.zip (Credit goes to djR3Z)
Download this file to "PB99IMG.zip" http://shipped-roms.com/shipped/Bra...8U_4.06.00.02_2_release_126984_signed_txt.zip
1.) Make a NEW Goldcard (best using FAT32 format micro SD 4GB or 2GB)
http://www.klutsh.com/dlfiles/GoldCardTool-0.0.5.rar
2.) Find your CID ==> e.g HTC__622 (someone said all 11111111 also worked, but if you can query, why not to input your own?)
fastboot oem boot <--- run this command, will show your own CID
3.) http://ks33673.kimsufi.com/misc/
and Create your own "mtd0.img"
>adb push flash_image /data/local/
>adb push rageagainstthecage-arm5.bin /data/local/tmp/
>adb push mtd0.img /sdcard/
>adb push PB99IMG.zip /sdcard/
>adb shell
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
chmod 0755 /data/local/flash_image
cd /data/local/tmp
./rageagainstthecage-arm5.bin
If you see:
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3319, 3319}
[*] Searching for adb ...
[+] Found adb as PID 74
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] [email protected] so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$
> adb shell
# <---- you will see this good prompt
cd /data/local
./flash_image misc /sdcard/mtd0.img <---- make sure your connected to PC not in Disk drive mode
5.Shutdown your device
6.Hold volume DOWN and press power button
7.Wait until PB99IMG.ZIP was found and verfied. If that fails, check if you named the file the right way and it’s located in the root of your SD.
8.Press volume UP to start the update.
9.Wait until all steps are done. DON’T POWER OFF YOUR DEVICE!
10.After the downgrade progress has finished press volume UP to reboot.
Now you back to 2.1 with HBoot 0.80
(Please remember to delete the file PB99IMG.zip from your SDcard / folder)
If you want root again:
Navigate to http://www.unrevoked.com for rooted as usual

Interesting, a root exploit for froyo has been found? Though any downgrade of hboot is unnecessary. The rooting allows you to fix the misc partition which will let you flash any RUU you want.

My Desire show : Main Version is older! Update Fail!

setupspeed said:
My Desire show : Main Version is older! Update Fail!
Click to expand...
Click to collapse
what is the issue?
tell me what steps being failed...

hkfriends said:
what is the issue?
tell me what steps being failed...
Click to expand...
Click to collapse
read PB99IMG.ZIP finish , then checking PB99IMG.ZIP => fail

setupspeed said:
read PB99IMG.ZIP finish , then checking PB99IMG.ZIP => fail
Click to expand...
Click to collapse
Have u flashed Mtd0.img ok?

hkfriends said:
Have u flashed Mtd0.img ok?
Click to expand...
Click to collapse
Mtd0.img ok , pursuant step => still fail

better add some screenshoot bro

I have got hboot 0.93 with vodafone froyo and an amoled-display (no slcd).
Do the method of
android-tutorials.org/dev/?page_id=78
work (sorry, can't post the hole link because I an new registered, add www)?
Or do I have to use the method from post #1 in this thread?

cordezz said:
I have got hboot 0.93 with vodafone froyo and an amoled-display (no slcd).
Do the method of
android-tutorials.org/dev/?page_id=78
work (sorry, can't post the hole link because I an new registered, add www)?
Or do I have to use the method from post #1 in this thread?
Click to expand...
Click to collapse
Try teppic74's tool, i think it will be more easy and the same as mine too!
http://forum.xda-developers.com/showthread.php?t=768256

C:\adb>adb push flash_image /data/local/
adb server is out of date. killing...
* daemon started successfully *
774 KB/s (26172 bytes in 0.033s)
C:\adb>adb push rageagainstthecage-arm5.bin /data/local/tmp/
478 KB/s (5392 bytes in 0.011s)
C:\adb>adb push mtd0.img /sdcard/
1807 KB/s (655360 bytes in 0.354s)
C:\adb>adb push PB99IMG.zip /sdcard/
1550 KB/s (144169877 bytes in 90.807s)
C:\adb>adb shell
$ chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
$ chmod 0755 /data/local/flash_image
chmod 0755 /data/local/flash_image
$ cd /data/local/tmp
cd /data/local/tmp
$ ./rageagainstthecage-arm5.bin
./rageagainstthecage-arm5.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3319, 3319}
[*] Searching for adb ...
[+] Found adb as PID 671
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] [email protected] so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$
C:\adb>adb shell
adb server is out of date. killing...
* daemon started successfully *
# cd /data/local
cd /data/local
# ./flash_image misc /sdcard/mtd0.img
./flash_image misc /sdcard/mtd0.img
# exit
exit
C:\adb>
-------------------------------------------------------------
my step , correct?

Yes, seems corrected..
have you made gold card?
what is your phone? OEM or branded?
what is the original Hboot version?
setupspeed said:
C:\adb>adb push flash_image /data/local/
adb server is out of date. killing...
* daemon started successfully *
774 KB/s (26172 bytes in 0.033s)
C:\adb>adb push rageagainstthecage-arm5.bin /data/local/tmp/
478 KB/s (5392 bytes in 0.011s)
C:\adb>adb push mtd0.img /sdcard/
1807 KB/s (655360 bytes in 0.354s)
C:\adb>adb push PB99IMG.zip /sdcard/
1550 KB/s (144169877 bytes in 90.807s)
C:\adb>adb shell
$ chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
$ chmod 0755 /data/local/flash_image
chmod 0755 /data/local/flash_image
$ cd /data/local/tmp
cd /data/local/tmp
$ ./rageagainstthecage-arm5.bin
./rageagainstthecage-arm5.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3319, 3319}
[*] Searching for adb ...
[+] Found adb as PID 671
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] [email protected] so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$
C:\adb>adb shell
adb server is out of date. killing...
* daemon started successfully *
# cd /data/local
cd /data/local
# ./flash_image misc /sdcard/mtd0.img
./flash_image misc /sdcard/mtd0.img
# exit
exit
C:\adb>
-------------------------------------------------------------
my step , correct?
Click to expand...
Click to collapse

hkfriends said:
Yes, seems corrected..
have you made gold card?
what is your phone? OEM or branded?
what is the original Hboot version?
Click to expand...
Click to collapse
gold card => yes
My phone => HTC Desire
Hboot version => 0.93.0001

i have this error "error writing misc: Permission denied"
in this step: "./flash_image misc /sdcard/mtd0.img"

Noob question
Using your method wont brick my phone right? My phone details are below:
Unit: HTC Desire
ROM: FroYo OTA (Unbranded)
BOOTLoader: 0.93
Software:2.13.707.1
Kernel:2.6.32.15

Just use my tool instead, it's much easier.

Doesn't Unrevoked3, the tool that is used to root phones, support hboot 0.93 on unbranded / unlocked phones? So this step is un-necessary on unbranded / unlocked phones?

Did it work at all?
Hi,
I too want to downgrade my HTC Desire from 2.2 to 2.1 because after the upgrade to 2.2 with hboot 0.93 my desire has stopped connecting to the H or 3g network.
Did this guide work for anyone at all?

HI
CAN SOME HELP ME TO GET THE ROM IMAGE VERSION 2.13.707.1 I NEED THE EXE. FILE THATS THE ONLY WAY I KNOW TO INSTALL THE ROM!!!!
MY PHONE TRIED TO UPGRADE FROM THE PHONE SOMETHING WENT WRONG AND IT SWITCH ON AND GET STUCK IN WHITE SCREEN WITH htc GREEN LOGO . . . I TRIED TO INSTALL THE ROM FROM MY COMPUTER THE LATEST BUT THE IMAGE ON THAT IS 2.10.405.2 . I REALLY APPRECIATE IF SOMEONE CAN HELP ME

black screen
I got a black screen after downgrade. Also after restart the phone
Desire

[Q] Downgrade problem, please help

Can you tell me what is the problem:
(I think my goldcard is good)
\Common files>adb push psneuter /data/local/tmp
1660 KB/s (0 bytes in 557962.000s)
\Common files>adb push misc_version /data/local/tmp
989 KB/s (0 bytes in 15837.000s)
\Common files>adb shell chmod 777 /data/local/tmp/psneuter
\Common files>adb shell chmod 777 /data/local/tmp/misc_version
C\Common files>adb shell /data/local/tmp/psneuter
Failed to set prot mask (Inappropriate ioctl for device)
\Common files>adb shell

[Q] Rooting the HTC Amaze 4g

I recently watched a video on YouTube on how to root the HTC Amaze. I followed the directions and unlocked the bootloader successfully but when I ran the ZergRushTempRoot.bat to root it, I got the following:
C:\Zerg rush root>adb wait-for-device
C:\Zerg rush root>adb push zergRush /data/local/
1328 KB/s (21215 bytes in 0.015s)
C:\Zerg rush root>adb shell chmod 777 /data/local/zergRush
C:\Zerg rush root>adb shell rm /data/local/tmp/*sh
C:\Zerg rush root>adb shell /data/local/zergRush
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00017118
[*] Scooting ...
[*] Sending 149 zerglings ...
[*] Sending 189 zerglings ...
[-] Hellions with BLUE flames !
C:\Zerg rush root>adb wait-for-device
C:\Zerg rush root>adb shell sleep 1
C:\Zerg rush root>adb remount
remount failed: Operation not permitted
C:\Zerg rush root>adb shell mount -o rw,remount rootfs /
mount: Operation not permitted
C:\Zerg rush root>adb shell mount -o remount,suid /dev/block/mmcblk0p29 /system
mount: Operation not permitted
C:\Zerg rush root>adb shell chmod 4755 /system/bin/sh
Unable to chmod /system/bin/sh: Read-only file system
C:\Zerg rush root>adb push ./su /system/bin
failed to copy './su' to '/system/bin/su': Read-only file system
C:\Zerg rush root>adb push ./su /system/bin
failed to copy './su' to '/system/bin/su': Read-only file system
C:\Zerg rush root>adb push ./busybox /system/bin
failed to copy './busybox' to '/system/bin/busybox': Read-only file system
C:\Zerg rush root>adb shell chmod 4755 /system/bin
Unable to chmod /system/bin: Read-only file system
C:\Zerg rush root>adb shell chmod 4755 /system/bin/su
Unable to chmod /system/bin/su: No such file or directory
C:\Zerg rush root>adb shell chmod 4755 /system/bin/su
Unable to chmod /system/bin/su: No such file or directory
C:\Zerg rush root>adb push ./Superuser.apk /system/app
failed to copy './Superuser.apk' to '/system/app/Superuser.apk': Read-only file
system
C:\Zerg rush root>adb install ./androidterm.apk
2904 KB/s (92780 bytes in 0.031s)
pkg: /data/local/tmp/androidterm.apk
Failure [INSTALL_FAILED_ALREADY_EXISTS]
C:\Zerg rush root>adb wait-for-device
C:\Zerg rush root>adb shell sync
C:\Zerg rush root>pause
Press any key to continue . . .
If anyone can help me get this phone rooted, I would appreciate it.
Thanks,
George
[email protected]

root htc amaze 4g
i am in canada. useing mobilicity on this phone. i am also facing same problem. i am also waiting for root. after i readable my indian language. thanks
anybody plz help me.

Hello,
Thank you for this post. I also have the exact same issue.
Similar to kapil1878, I am also on Mobilicity in Canada.

Same issue here! Amaze t-mobile.

rooting
having the same problem about rooting. t-mobile usa

remount fails
So, one thing at a time.
First off remount fails. Why? Lets look at the script. I've numbered the lines for reference:
1 :cd %:h
2 adb wait-for-device
3 adb push zergRush /data/local/
4 adb shell chmod 777 /data/local/zergRush
5 adb shell /data/local/zergRush
6 adb wait-for-device
7 adb shell sleep 1
8 adb remount
9 adb shell mount -r -w -o remount rootfs /
10 adb shell mount -o remount,suid /dev/block/mmcblk0p29 /system
11 adb shell chmod 4755 /system/bin/sh
12 adb push ./su /system/bin
13 adb push ./su /system/bin
14 adb push ./busybox /system/bin
15 adb shell chmod 4755 /system/bin
16 adb shell chmod 4755 /system/bin/su
17 adb shell chmod 4755 /system/bin/su
18 adb push ./Superuser.apk /system/app
19 adb install ./androidterm.apk
20 adb wait-for-device
21 adb shell sync
22 pause
Line 8 is what fails first, probably causing a chain reaction of failures. This is because there's a critical spot on the device we need to write to that we can't write to for some reason.
I executed:
adb devices
The above command provides the serial numbers of all connected Android devices. I needed this for the next command which was:
adb -s [put serial number here] shell
This gave me access to the command line on the device. Then I executed:
mount
The above command tells you what file systems are active and usable, i.e. file systems that are mounted and ready for action. I think "file system" in this case may be synonymous with partition.
Now... looking up the remount command in the reference material shows that it is supposed to (and this is cut from the manual) :
adb remount - remounts the /system partition on the device read-write
However the result from our mount command a minute ago shows this for the /system mount. Note that there's a bunch of crap I've cut out but we are only interested in /system for now, anyway:
rootfs / rootfs ro,relatime 0 0
.
.
.
/dev/block/mmcblk0p29 /system ext4 ro,relatime,barrier=1,data=ordered 0 0
.
.
.
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
So... guessing based on my previous Unix experience, ro probably means that this partition is mounted read only. That means we have to find a way to remount it "rw". Problem is that I can't figure out what the command is. We already know remount doesn't work.
Here are some of my attempts:
$ mount -t ext4 -o rw,relatime,barrier=1,data=ordered /dev/block/mmcblk0p29 /system
mount -t ext4 -o rw,relatime,barrier=1,data=ordered /dev/block/mmcblk0p29 /system
mount: Operation not permitted
$ mount -t ext4 -o remount,rw,relatime,barrier=1,data=ordered /dev/block/mmcblk0p29 /system
mount -t ext4 -o remount,rw,relatime,barrier=1,data=ordered /dev/block/mmcblk0p29 /system
mount: Operation not permitted
Now, then. We don't have permissions require to execute remount and for mount we get the above. The only thing I can think of at this point is that I need to elevate the permissions of the user I am logged in as. Anybody know how to do that on Android? How do I know who I am logged in as? Is there more than one user even?

everyone should check out the thread below, Binary100100 does an excellent job in explaining how to root...
http://forum.xda-developers.com/showthread.php?t=1426179?referrerid=922386

[Q] Error when try downgrade htc legend

Hello,
I try to downgrade my htc legend with this tutor : http://forum.xda-developers.com/showthread.php?t=725430
But i get the next line :
cr--rw---- 1 1001 2002 90, 0 Jan 13 21:11 /dev/mtd/mtd0
how can i fix this?

Hello,
I just whiped my phone but still :
Microsoft Windows [versie 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. Alle rechten voorbehouden.
C:\Users\Administrator\Desktop\android-sdk-windows\platform-tools>crackin.bat
"Copying tools"
adb server is out of date. killing...
* daemon started successfully *
1619 KB/s (698452 bytes in 0.421s)
1190 KB/s (76044 bytes in 0.062s)
1641 KB/s (655360 bytes in 0.390s)
"Freeing primary PERM linker"
rm failed for /data/DxDrm/fuse/*, No such file or directory
rm failed for /data/DxDrm/fuse, No such file or directory
rmdir failed for /data/DxDrm/fuse/, No such file or directory
cannot create /data/DxDrm/fuse: directory nonexistent
Unable to chmod /data/DxDrm/fuse: No such file or directory
"Freeing secondary PERM linker"
rmdir failed for /data/DxDrm/fuse/, No such file or directory
rmdir failed for /data/DxDrm, No such file or directory
link failed Permission denied
"Rebooting to normal mode to unlock CHMOD links"
rmdir failed for /data/dontpanic, Permission denied
rm failed for /data/DxDrm, No such file or directory
link failed File exists
link failed Permission denied
"Rebooting to normal mode to downgrade ROM"
/dev/mtd/mtd0: Permission denied
cr--rw---- 1 1001 2002 90, 0 Jan 14 00:51 /dev/mtd/mtd0
error writing misc: Permission denied
"Freeing links"
rm failed for /data/DxDrm, No such file or directory
rm failed for /data/dontpanic, Permission denied
What to do ?
mij boot loader is 1.01

You missed a step or something that's why it says no file or directory,make sure files where pushed into the Data folder
adb shell
cd data
ls
and you should see the dxdrm

Hello,
If i do that i get this :
C:\androidSDK\tools>adb shell
$ cd data
cd data
$ ls
ls
opendir failed, Permission denied

edit :
I finaly managed to roll back to 2.1 what to do now ?
Code:
C:\androidSDK\tools>crackin.bat
"Copying tools"
1256 KB/s (698452 bytes in 0.543s)
589 KB/s (76044 bytes in 0.126s)
1155 KB/s (655360 bytes in 0.554s)
"Freeing primary PERM linker"
rm failed for /data/DxDrm/fuse/*, No such file or directory
rm failed for /data/DxDrm/fuse, Is a directory
"Freeing secondary PERM linker"
rmdir failed for /data/DxDrm/fuse/, Not a directory
rmdir failed for /data/DxDrm, Directory not empty
link failed File exists
"Rebooting to normal mode to unlock CHMOD links"
rmdir failed for /data/dontpanic, Permission denied
rm failed for /data/DxDrm, Permission denied
link failed File exists
link failed File exists
"Rebooting to normal mode to downgrade ROM"
crwxrwxrwx 1 1001 2002 90, 0 Jan 14 19:25 /dev/mtd/mtd0
"Freeing links"
rm failed for /data/DxDrm, Permission denied
rm failed for /data/dontpanic, Permission denied
I Did this whit RUU Legend
but can i root now?

RUU say's i have : image version : 1.31.405.5
edit : r4-lagend-root keeps on : writing "zip"

question to ericosman
ericosman how did you managed to fix the cr--rw---- 1 1001 2002 90, 0 Jan 13 21:11 /dev/mtd/mtd0 part and get it right? iv been working on it for so long i have no idea how to fix it and cant downgrade

[Q] help me to use ./dexopt-wrapper

Hi,
I want to make odex file.
How to solve this problem.
what is the checkpoint for this problem?
Can anyone help me with this please!!
*log
C:\ADB>adb push dexopt-wrapper /system/
5930 KB/s .....
C:\ADB>adb push services.jar /system/
358 KB/S ...
C:\ADB>adb shell
~ # cd /system
cd /system
/system # chmod 777 dexopt-wrapper
chmod 777 dexopt-wrapper
/system # ./dexopt-wrapper service.jar a.odex $BOOTCLASSPATH
--- BEGIN 'services.jar' <bootstrap=0> ---
--- would reduce privs here
--- waiting for verify+opt, pid=1541
--- END 'services.jar' --- status=0xff00, process failed
/system #