Develop Bugs

[Guide] Subsidy Unlock, SuperCID, and Radio S-OFF

Update 12-29-10: Due to problems reported with v03, we now link to v02.
Update 12-23-10: A new version of gfree, v02, has just been released by Guhl. Links have been updated to the new version, which allows you to set Sim Unlock, CID, and Radio S-ON/OFF independently. If you have previously run gfree, you will receive no additional benefit from running gfree v2, unless you want to change one of the settings.
Notice: gfree is known not to work for radio firmwares with higher versions then 26.03.02.xx -- the reason for this is that HTC patched the hole that allowed scotty2 to power cycle the emmc chip to drop its write protection. So if you installed a radio version with a higher version number, downgrade the radio firmware before using gfree.
Guhl also released gfree_verify, which allows you to verify your phone's settings (regardless of which gfree you used). See the wiki for more on that.
The wiki is usually up to date on the latest of everything, so be sure to check it frequently.
---------------
scotty2 delivers again!
His "gfree" program should do the following for your g2, dz, or dhd:
* Radio S-OFF -- the real deal. This means the g2 will permit permanent root.
* Subsidy Unlock -- AKA "Sim Unlock" AKA "Network Unlock" AKA "Use a foreign SIM Card"
* SuperCID - enables the flashing of any carrier's firmware for the phone.
If you don't know what this means or why you might want it, check the wiki.
INSTRUCTIONS:
NOTE: If you have NOT permarooted your phone previously with the HBOOT/wpthis method, doing so using the new "gfree" method should have the added effect of sim-unlocking the phone, setting superCID and turning Radio S-OFF. In fact, it's the new method for permarooting for G2/DZ and DHD. So if you haven't yet permarooted, look at those instructions.
Again, the instructions below are for people only who have already previously "permarooted" through the earlier hacked-HBOOT method. See the wiki if you are starting from scratch with a new G2/DZ/DHD and have not yet done anything "root-ish".
WARNING: Be aware that by following these instructions you are messing with your phone with potential for screwing things up. Do so at your own risk. The many authors of this guide assume no responsibility for any damage to your phone, health, general well-being, or anything else untoward with respect to these instructions or you following them.
gfree uses a dynamic in-memory patch of the kernel to remove the kernel's write protection of the radio partition.
So, for those of you who have permarooted the old HBOOT way and put on new kernels --The following kernel versions that are known NOT to work yet with gfree. If you have one of the following kernel versions on your phone install a different (stock, OTA or cyanogen) kernel before starting this procedure:
| pershoots 11/30 build
| pershoot's 2.6.32.26 – OC-UV-NEON_FP (1.516GHZ) – G2 - 12/3
| Cyanogen Kernel / release 6.1.1
| 2.6.32.26-cm-virtuous-v1.0 [email protected]#1
Other newer kernels may also not work with gfree. So if you experience problems with this procedure (either the phone reboots during the process or the procedure completes correctly but the verify still shows that the phone is locked) then you may think about downgrading the kernel to an original stock kernel or even better to this kernel.
Okay. So we're assuming you've permarooted already and usb debugging is on (Applications > Development, then enable USB debugging). You'll also need about 5MB free on your sdcard.
You might want to back up your phone with nandroid on the Clockwork recovery image first, just in case.
Note: If you hanker to do it the longer, manual, harder, and more dangerous way, or are just curious what gfree does, see the wiki history for the old instructions.
No? Then let's begin.
==== 1. Download gfree and verify sdcard is not mounted by your computer ====
You will need to download a program called gfree (v02) that will first copy partition 7 of the phone, then patch it, then reflash back to your phone. (verified to work with the g2 and desire z as well as the desire hd). (You will also need adb, which you can download as part of the Android SDK.)
Unzip gfree_02.zip to your computer.
Make sure your computer is not mounting your phone's sdcard.
==== 2. Run gfree on the phone ====
On your computer's terminal/command line, navigate to where the gfree file is, and then...
Code:
adb push gfree /data/local
adb shell
This copies gfree to your phone, then puts you in your phone's terminal. Then do this:
Code:
su
cd /data/local
chmod 777 gfree
./gfree -f
sync
Wait a few moments for the sync to "take". Then reboot your phone. That's it!
gfree created a backup of your original partition 7 at /sdcard/part7backup-<time>.bin you might consider copying this to a safe location on your computer.
Now you can try using a new SIM card to verifiy that it worked. Also, if you had to flash a different kernel before running gfree, you may now reflash the kernel you originally had.
Thanks to the gang at #g2root, including IntuitiveNipple, scotty2, tmzt, rhcp, ciwrl, and guhl... among many others.
Wiki: How to enable Radio S-OFF, SuperCID, and SIM-unlock (with some informational background)
File: gfree_02.zip
File: gfree_verify_v01.zip
Feel free to use the "Thanks" button below. Also, Scotty2's paypal email is walker.scott AT gmail.com if you want to make a contribution.
Finally, Americans might consider making a donation to the Electronic Frontier Foundation who fight to defend your legal right to root or unlock your own phone when the carriers and phone manufacturers may lobby or otherwise try to stop you. The EFF can always use your tax-deductible support.

Hey thanks for posting this!
So I guess this is like perm-perm-root.
Giving it a shot now.
Sent from my HTC Vision using XDA App

thenefield said:
Hey thanks for posting this!
So I guess this is like perm-perm-root.
Giving it a shot now.
Sent from my HTC Vision using XDA App
Click to expand...
Click to collapse
Yeah it's sim-unlock too. Which is nice.

Nice thanks going to try it to.
Sent from my HTC Vision using Tapatalk

shouldnt one image work for every phone

Word up scotty2. You the man.
EDIT: And you too fattire for writing up what no one else wants to

thatruth132 said:
shouldnt one image work for every phone
Click to expand...
Click to collapse
No. If it did, then this would be a lot easier, huh?

I cant wait until some juicy stuff comes out of this.

Now, what does this mean
"make everything better."

This is freaking awesome.

andrewklau said:
Now, what does this mean
"make everything better."
Click to expand...
Click to collapse
You know.... everything.

...
I just bricked my phone LMAO!!!
I did the perm root that was easy... this jeez... followed the [Guide] How to recover your semi-brick (OMFG Thank you guys over there!) BUT I'm back... I literally almost **** my pants. Well... Gonna try this again maybe after finals LOL

Question though (going to try it later tonight LOL =P) the guide says I need a "custom cyanogenmod based kernel and provides the boot image that contains it.. I am using the nightlies do they contain that same function or no? also when I did flash that boot image and ran "insmod /sdcard/wpthis-cyanogen.ko" it said error function not implemented? Anyone not run into this issue? or have any ideas?

nycjv321 said:
Question though (going to try it later tonight LOL =P) the guide says I need a "custom cyanogenmod based kernel and provides the boot image that contains it.. I am using the nightlies do they contain that same function or no?
Click to expand...
Click to collapse
Nope.
nycjv321 said:
also when I did flash that boot image and ran "insmod /sdcard/wpthis-cyanogen.ko" it said error function not implemented? Anyone not run into this issue? or have any ideas?
Click to expand...
Click to collapse
"Error function not implemented" means it worked.

well this time it didn't brick... I think I got it time to verify it

Ok I ran it all again and worked but when I was verifying it I got all the supposed feedback except at "echo -e 'AT$QCPWRDN\r' > /dev/smd0" I got AT$QCPWRDN and then +CME Error: 0.... (No OK as said in the guide? ) and then it rebooted? what didn't work?

Got it to work!
SuperCID, Radio S-OFF, Subsidy Unlock is a reality!
Thanks to scotty2.
Thanks also to guhl (guhl99).
Read my post for more details: http://forum.xda-developers.com/showpost.php?p=9495073&postcount=363
Thread: http://forum.xda-developers.com/showthread.php?p=9495073#post9495073

This may be a stupid question but doesn't 0 also equate to no error? (In my older post) (Its just not stated in the guide, I don't want to overlook something which is why I asked ) You guys are AWESOME!!!

nycjv321 said:
This may be a stupid question but doesn't 0 also equate to no error? (In my older post) (Its just not stated in the guide, I don't want to overlook something which is why I asked ) You guys are AWESOME!!!
Click to expand...
Click to collapse
After entering the following into ADB Shell command prompt:
# echo -e 'AT$QCPWRDN\r' > /dev/smd0
The reply I got was a bunch of numbers (which filled the screen and wrapped to a new line) from what I can recall and then the phone rebooted. I didn't save the command window so I don't have the full details.
When the phone re-booted, I get signal from the local Thailand carrier AIS using a pre-paid SIM card.
The first time I went through the process I made a mistake setting the following using the Hex Editor:
"...set the 4 bytes at 0x807fc to 49 53 F4 7D"
The second time around I figured out what the "c" in "0x807fc" meant in terms of location on the Hex Editor. That was it.

:O i cant believe how awesome scotty2 is...

[Q] home, menu, back icon won't work after update rom

Hi, all
i am new with android OS.
i have an htc desire Z which was semi-bricked, it keeps on htc logo. then i search this forum for unbrick the device, and i found this rom, PC10IMG_Vision_TMOUS_1.19.531.1_Radio_12.21.60.09b_26.02.01.15_M2_release_149459_signed.zip
i tried to update the file, and the device is ok after the update proses.
but, after i tried to open an application (i.e message), i can't go back to home. when i touch the home icon on the screen, the vibrate is on, but the screen is still.
is there something missing in the update proses?
sorry if i'm doing double post with this thread.
thank you all.

Well the problem is that you flashed a stock G2 ROM on the DZ... I think

omarsalmin said:
Well the problem is that you flashed a stock G2 ROM on the DZ... I think
Click to expand...
Click to collapse
+1
I agree
Sent from my HTC Vision using XDA App

Oh, I see..
Then i should look for DZ one. Could anyone here give me the link of stock DZ rom?
My hboot screen display:
Vision PVT SHIP S-OFF
HBOOT-0.82.0000
MICROP-0425
RADIO-26.02.01.15_M2
eMMC-boot
Sep 2 2010

Here's what you're going to need to do. You need to download Terminal Emulator from the Android Market (the one by Palevich I think) and follow these steps:
Download the G2TempRoot.rar file I have attached. It also includes a DesireZ bootloader.
Extract the files to your desktop.
Now, you're going to ROOT your poor device. Follow these steps.
1. Make sure you have your USB debugging enabled and plug-er-in.
2. Open a command shell. Type in "cd Desktop\G2TempRoot" without the quotes of course...
3. Type in the following commands followed by enter after each one.
Code:
adb push su /sdcard/su
adb push Superuser.apk /sdcard/Superuser.apk
adb push busybox /data/local/tmp/busybox
adb push root /data/local/tmp/root
adb push rage /data/local/tmp/rage
adb shell chmod 0755 /data/local/tmp/*
adb push wpthis\wpthis-pre-OTA.ko /sdcard/wpthis-pre-OTA.ko
adb push wpthis\wpthis-OTA.ko /sdcard/wpthis-OTA.ko
adb push desirezboot\hboot-dzship.img /sdcard/hboot-dzship.img
--- All commands from here out are typed into the phone using Terminal Emulator, not ADB ---
4. Open up the Terminal Emulator you just installed on your phone and type the following:
Code:
/data/local/tmp/rage
Let it finish. After you see "Forked #### childs" press the Menu button on your keyboard and then tap "Reset terminal" on the screen.
5. Open the Terminal Emulator again. This time it will force close. Close it. Now, open the Terminal Emulator again, this time you should have a root shell.
6. If you did not apply the OTA update, type this into your terminal screen:
Code:
insmod /sdcard/wpthis-pre-OTA.ko
and press enter. It should say something about "function not implemented". This is normal. If it says anything else, you probably applied the OTA, and you need to reboot and start this process from step 4, replacing wpthis-pre-OTA.ko in step 6 with wpthis-OTA.ko.
7. Now, you're going to type the following commands into your shell. Make sure you double check EACH and EVERY command before you hit enter. Screwing up the first one, specifically has a nasty habit of producing bricks.
Code:
dd if=/sdcard/hboot-dzship.img of=/dev/block/mmcblk0p18
/data/local/tmp/root
sync
8. Now you should be able to reboot your phone into fastboot (trackpad button+power) and reflash using a HTC DesireZ RUU. Sorry, I have none of these in my files. Look in the wiki here, I think there are a few posted up.
9. If the RUU can't detect your phone, don't close the utility, YET. Search for rom.zip on your computer, and it'll be the one located in your temp folder. It should be ~ 260MB. Copy it to a place on your desktop, rename it PC10IMG.zip, and copy it to the root of your SD card using either an adapter and a SD reader, or a working phone that has SD storage. Then it's just a matter of booting into the bootloader with the Vol down + Power combination. It should go through the checks, and ask you to update if all worked correctly.
-- My guess is you didn't apply SuperCID to your phone before flashing G2 ROM? --

Wow, thanks for the reply. Quite confused though.
Yes, maybe i didn't apply SuperCID before flashing.
How can i make sure that USB debugging has been enabled?

Wow, well I guess this confirms it's fine to flash a stock G2 ROM to a Desire Z !
Those buttons won't be working because of the key mapping. The G2 and DZ have different hardware keyboard, so different keyboard mappings. Those capacitive buttons on the phone are effectively linked to the hardware keyboard, so just need mapping differently. It's possible to change the mapping, but probably makes more sense (no pun intended lol) just to flash a DZ ROM.
You can find the original 1.34 European RUU at http://forum.xda-developers.com/showthread.php?t=822908
There is also a newe 1.72 version, but be careful, because right now the current rooting methods don't work on that one.
To enable USB debugging you need to go into Menu->Settings->Applications->Development

Actually, the bootloader may have detected an incorrect digitizer controller. There is a difference in both the version of the bootloader and the order in which the firmwares partitions are flashed. You may want to reflash the G2 firmware again without switching out the bootloader to see if this fixes your issue. If not, the problem may actually lie in the partition 7 which was modified to unlock your phone. Try a reflash of the G2 PC10IMG.zip without switching your bootloader back if you have your heart set on stock Android. Watch the screen while it is flashing to make sure everything flashes ok. One of the TP entries should get skipped. TP stands for touch panel in this case. An incorrect driver could well explain why your icons aren't working.
For anyone interested, I flashed my G2 to DZ and back with great success, but to load the DZ rom I had to switch bootloaders and flashing it back to G2 flashed twice due to the difference in partition order to make sure everything went through OK. You may also have a corrupt .zip file. Open up your PC10IMG.zip file up in an archiver and run a test to make sure nothing fails. If the zip is corrupt its gonna load a bad digitizer driver everytime and possibly screw up the ROM.

Okay, i'll try again.
@steviewevie, Thanks for sharing.
If i use RUU_Vision_HTC_WWE....exe with a DZ that has a G2 rom inside, there will be no problem with the device?
@deliberate187, I guess there is nothing wrong with the zip file i have, coz i got it from this forum, and when i extract it with winrar, it extracts all files completely withouit fails.

deliberate187 said:
Actually, the bootloader may have detected an incorrect digitizer controller. There is a difference in both the version of the bootloader and the order in which the firmwares partitions are flashed. You may want to reflash the G2 firmware again without switching out the bootloader to see if this fixes your issue. If not, the problem may actually lie in the partition 7 which was modified to unlock your phone. Try a reflash of the G2 PC10IMG.zip without switching your bootloader back if you have your heart set on stock Android. Watch the screen while it is flashing to make sure everything flashes ok. One of the TP entries should get skipped. TP stands for touch panel in this case. An incorrect driver could well explain why your icons aren't working.
For anyone interested, I flashed my G2 to DZ and back with great success, but to load the DZ rom I had to switch bootloaders and flashing it back to G2 flashed twice due to the difference in partition order to make sure everything went through OK. You may also have a corrupt .zip file. Open up your PC10IMG.zip file up in an archiver and run a test to make sure nothing fails. If the zip is corrupt its gonna load a bad digitizer driver everytime and possibly screw up the ROM.
Click to expand...
Click to collapse
Interesting info. So those TP things in the ROM are something to do with the touch panel ?

I could be wrong, but the TP files are Atmel firmwares. If I'm not mistaken Atmel is the manufacturer of the controller chips used in the touch panels on Android phones.
Sent from my T-Mobile G2 using XDA App

Sirs,
I believe I did the same, that is flashing a G2 ROM to a Desire Z phone.
Now I followed the instructions till I reached 8 and 9, I downloaded: RUU_Vision_HTC_WWE_1.34.405.5_Radio_12.28b.60.140e_26.03.02.26_M_release_155556_signed.exe, tried it, it gave me this error on the PC:
"Error [156]: image error
The rom update utility cannot update your android phone.
Please get the correct rom update utility and try again."
Searched for rom.zip, changed its name to PC10IMG.zip, took the sd card out, copied the file, rebooted the phone, the bootloader didn't recognize the ROM.
This what flashed so fast on the screen:
"SD Checking ...
Loading ... [PC10DIAG.zip]
No image!
Loading ... [PC10DIAG.ngh]
No image or wrong image!
Loading ... [PC10IMG.zip]
Lack of heap!
Loading ... [PC10IMG.nbh]
No image or wrong image!"
I hope these info will help:
VISION PVT SHIP S-ON
HBOOT-0.82.0000
MICROP-0425
RADIO-26.02.01.15_M2
eMMC-boot
Sep 2 2010, 17:59:38
The mobile works, but none of the bottom icons do: Home, Menu, Back, and Search.
The keyboard isn't matching 100% specially with the special characters.
At boot, HTC signs appear, then "T mobile G2 with Google" appears short after, then the home screen.
Settings/About phone:
Model number: T-mobile G2
Android Version
2.2
Baseband Version
12.22.60.09.bU_26.02.01.15_M2
Kernel version
2.6.32.17-g814e0a1
[email protected]#1
Build number
1.19.531.1 CL255798 release-keys
I m lost as you may see!
I don't know what else I made wrong in addition to flashing the wrong ROM.

[GUIDE] Permanent Root with Visionary/gfree (No ADB Required)

After seeing lots of users struggle to root their phone with the existing guides (or worse, brick their phones), often times because of an inability to install/use ADB correctly (so they hobble together steps from multiple guides), I decided to write up a guide for rooting without the need for ADB. This guide uses the Visionary program to achieve temporary root and then gfree to achieve permanent root. Visionary is used only for the temporary root and nothing else (since many on these forums are wary of the app for permanent rooting). All of the gfree steps were scripted together to make things more convenient (and allow less room for user error in typing things in). This has been tested to work with multiple G2s and theoretically should work with the Desire Z as well (if you have the 1.72 OTA though, you will need to downgrade first in order to root as per the instructions in the wiki). All credit goes to the original developers of these programs and those others who aided in achieving root originally (I didn't add anything new content-wise, just bundled it up nicely).
WARNING: A few Desire Z users have reported being stuck on the HTC logo after following this guide. Without having a Desire Z myself, it is difficult to figure out why (since this simple automates known working methods). For the time being, I recommend Desire Z users obtain permanent root using one of the other guides out there.
Instructions
1. Install Terminal Emulator and a file manager (such as Astro File Manager) from the Market.
2. Extract the contents of the zip file to the SD card (this will create a directory called root_files on the card). When done, make sure you unmount your SD card from your computer if you had mounted it as a storage device to transfer the files.
3. Enable Unknown Sources (under Settings->Applications) and USB Debugging (under Settings->Applications->Development).
4. Using your file manager, navigate to the root_files directory on your SD card and select "com.modaco.visionaryplus.r14.apk" to install the Visionary app.
5. Start the Visionary app.
6. Click on "Temproot now." Leave all other settings unchecked.
7. Start the Terminal app.
8. Type the following commands (the $ and # symbols represent the command prompt and should not be typed):
Code:
$ su
# cp /sdcard/root_files/perm_root /data/local/perm_root
# chmod 777 /data/local/*
# /data/local/perm_root
You will see multiple messages scroll by as the programs run. Once you are returned to the prompt in terminal, you will have permanent root (S-OFF), as well as subsidy unlock and SuperCID. At this point, you can also choose to flash the engineering hboot as explained in the wiki. Flashing this hboot allows you to use the flashboot program to flash images from your computer to your phone (which can be very helpful when stuck in a bootloop for example). Note, this is often times the step that bricks people's phones when following other guides. To help mitigate the danger involved, I created a script that first checks the md5 of the hboot file to ensure it didn't get corrupted and then actually performs the flash (many times the bricking occurs because of a typo in this command). If you wish to flash the engineering hboot, type the following command in terminal if you have a G2:
Code:
# /data/local/tmp/flash_hboot
Or this command if you have a Desire Z
Code:
# /data/local/tmp/flash_hboot_z
If you get a verification failed message, you should re-download the files, re-extract them to your SD card, and run the flash_hboot script again.
If you don't want the engineering hboot, just reboot your phone. You can verify you have permanent root by holding volume down while powering on (you'll see S-OFF in the first line of the bootloader). You are now free to install a new recovery and start flashing custom ROMs. If you don't want to flash a new ROM, it's safe to uninstall the Visionary app at this point.
And if you are curious, you can open the perm_root and flash_hboot files in a text editor to see what they are actually doing...

thnak you bro man this was way better !!!

does this apply to someone who just bought the G2.currently on stock 2.2?

GHOST99K said:
does this apply to someone who just bought the G2.currently on stock 2.2?
Click to expand...
Click to collapse
YES!!!! Especially you! This is much easier than the previous ways!
NICE!

I wish I had seen this last night before I spent 4 hour trying to get ADB to see my wife's new phone. Oh well got it working the hard way

Copy flash_hboot
Do you need to copy the flash_hboot like the perm_root file?

Crey23 said:
YES!!!! Especially you! This is much easier than the previous ways!
NICE!
Click to expand...
Click to collapse
cool i guess 2 of my friends will be pleased to hear this cuz i'll be helping them to root their phones.

worked like a charm! sweet man, saved me a lot of time by making this thread and guide, definitely should be added to wiki or sticky thread.

I just bought a T-mobile G2 as well, and I love the phone as is, but I just want to root it, so I can over-clock the cpu just a little bit (maybe about 1Ghz is fine). Can I use this method and keep the phone as is? Or does this method delete everything and I need to use custom rom? I'm coming from original MyTouch 3G (without 3.5 jack) rooted with CM, but I am still a newb.

misterykid89 said:
I just bought a T-mobile G2 as well, and I love the phone as is, but I just want to root it, so I can over-clock the cpu just a little bit (maybe about 1Ghz is fine). Can I use this method and keep the phone as is? Or does this method delete everything and I need to use custom rom? I'm coming from original MyTouch 3G (without 3.5 jack) rooted with CM, but I am still a newb.
Click to expand...
Click to collapse
Once you root the phone, everything will stay as is. Here's a link to overclock to at least 1 GHz on stock ROM: http://theunlockr.com/2010/10/20/t-mobile-g2-overclocked-to-1-42ghz-how-to-overclock-your-t-mobile-g2/
However, it's required you first set up ADB.

I can't just download setCPU and over-clock? I thought as long as the phone is rooted, I can do that...

misterykid89 said:
I can't just download setCPU and over-clock? I thought as long as the phone is rooted, I can do that...
Click to expand...
Click to collapse
You can still download SetCPU, but just having the app itself won't let you overclock the phone. You can try flashing a different ROM and you'll be overclocked once you run that ROM.

Wait, but the recommended and safest way is still with Rage and GFree, right? VISIONary was found to do something with the phones file system that messes up some phones I thought, right? I thought that is why scotty2 made Rage, or am I wrong?

KoolKidsKlub said:
Wait, but the recommended and safest way is still with Rage and GFree, right? VISIONary was found to do something with the phones file system that messes up some phones I thought, right? I thought that is why scotty2 made Rage, or am I wrong?
Click to expand...
Click to collapse
Rage/G-Free is still the safest but they both require ADB, which can be quite a hassle to install for many. True that Visionary has been found to mess one's phone up, but this method only implements the temp root procedure from Visionary (which doesn't require ADB) and the perm root procedures from Rage/G-Free for a more simple way to root one's G2.

so its more like the best of both methods then... i gave up cus i couldnt figure out the ADB but this way looks way easier so ima give this a try thanks for this

Worked perfectly first try. Thanks!

What exactly is kernel? I've seen some people saying they are running over-clock on their G2 with a modded kernel on stock ROM.

misterykid89 said:
What exactly is kernel? I've seen some people saying they are running over-clock on their G2 with a modded kernel on stock ROM.
Click to expand...
Click to collapse
Search google for "Kernel Operating System"

What I meant was is it okay to just change the kernel and run stock ROM that came with my T-mobile G2? Would it not change anything except for the clock speed?

misterykid89 said:
What I meant was is it okay to just change the kernel and run stock ROM that came with my T-mobile G2? Would it not change anything except for the clock speed?
Click to expand...
Click to collapse
Different kernels can be compatible only with certain ROM's. Check on on the kernel before you flash to stock ROM

[Q] Obscure problem with rooting

Hi everyone
The following summarises my quest to root my recently acquired HTC Desire/Bravo:
Key info:
Android 2.2
HBOOT 0.93
Build 2.12.110.4 CL274424 release-keys
Radio 32.49.00.32U_5.11.05.27
Kernel 2.6.32.15-gd96f2c0 - [email protected] #1
SIM Unlocked
T-Mobile branded
UK
I first try using Unrevoked. After a promising start, I get the 'Validation error: backup CID missing' message, for which I can find no solution for on the internet. I tried using a different computer booting a clean Slax image, wiping the phone, and using four different versions (3.32, 3.31, 3.21, 3.14) to no avail.
Next I try using the GoldCard method. I find a suitable memory card, and get cracking using this method: http://theunlockr.com/2010/03/10/how-to-create-a-goldcard/
I manage to get my CID: 0353445355303147804029a554007c08
However, it turns out that the website used to generate the goldcard boot sector is not working ('Page not found'). It appears to have been working until only recently.
No matter, I found a standalone solution here: http://www.mygsmforum.com/f15/all-htc-goldcard-generator-perl-script-free-standalone-unlimited-7255/
I grabbed the file, and I managed to get it working by compiling both of the perl modules it needs. I typed in the command:
perl ./goldcardgenerator.pl -d sd80.img -p magic=xxx -p cardid=0080c700455a9204087413035535443530
You might notice I haven't specified the security level or the key set, but I can assure you that not a byte of the output file changes when I use the defaults specified in the readme.
So I have a convincing looking header. I do as the instructions say and copy the first 0x170 bytes to the beginning of the card. It reads and writes to the FAT32 partition fine, so I assume the card's good. So I copy over a rom I got here: http://forum.xda-developers.com/showthread.php?t=741775
Rename it update.zip and boot into recovery. I try to flash, and I get the 'E:Signature verification failed' error, so obviously the goldcard's not working.
My contention is that when I made the image, I missed one or more vital parameters, keys, seclevel, cid etc. However I really have no idea where to start looking for them, since they're so obscure.
Help with anything to do with this (Including getting Unrevoked to work) would be much appreciated! Honestly, I've spent the entire day trying to get this to work.
Thanks,
Hamish Milne

screw unrevoked.
Go to www.revolutionary.io and follow the instructions
Go to my guide and flash recovery
Backup your ROM, and then push superuser with adb.
Done. Rooted.
All resources you need are there. Tutorials, links etc.

Yep, unrEVOked is obsolete. This should be mentioned in sticky thread.

Truly excellent! Thank you!
Flashed the Clockwork mod, and replaced the bootloader without breaking the OS.
However, I still don't have root. I know I could flash the ROM, but I'd rather not wipe my data again. How exactly would I go about 'flashing superuser with adb'? (I have the adb installed btw)
EDIT: Wait, found it

actually, i had hboot 1.06 on my stock cdma desire, and i had to use revolutionary's tool before running unrevoked. i tried 3 different desires with unrevoked before i discovered revolutionary, and after it unrevoked did its job just fine.

Root Telstra T-Hub 2 (Technicolor)

Wanting to root my new Telstra T-Hub 2, made by Technicolor.
There appears to be no USB drivers available (nothing via Google)
There also appears to be no way to get into the Download Mode for connection to Odin. (again nothing on Google)
So these two points have left me a bit lost.
It is running Android (GB) 2.3.7
Any one have any ideas????

Rabs_1976 said:
Wanting to root my new Telstra T-Hub 2, made by Technicolor.
There appears to be no USB drivers available (nothing via Google)
There also appears to be no way to get into the Download Mode for connection to Odin. (again nothing on Google)
So these two points have left me a bit lost.
It is running Android (GB) 2.3.7
Any one have any ideas????
Click to expand...
Click to collapse
I got ADB working on my T-Hub 2 by using the generic Google drivers, and edited the adb_usb.ini to just say 0x069B
So far I have problems rooting it.

wocko1 said:
I got ADB working on my T-Hub 2 by using the generic Google drivers, and edited the adb_usb.ini to just say 0x069B
So far I have problems rooting it.
Click to expand...
Click to collapse
BUMP

I have this Tablet as-well and having the same problem.
any ideas on the best way to root this thing?
wocko1 do you have any more details on how to got that far?
Thanks guys.
Rabs_1976 said:
Wanting to root my new Telstra T-Hub 2, made by Technicolor.
There appears to be no USB drivers available (nothing via Google)
There also appears to be no way to get into the Download Mode for connection to Odin. (again nothing on Google)
So these two points have left me a bit lost.
It is running Android (GB) 2.3.7
Any one have any ideas????
Click to expand...
Click to collapse

was it released in any other countries as another device?
even if we got root on it what can we do for a custom ROM if noone can dev for it

Madaz2 said:
was it released in any other countries as another device?
even if we got root on it what can we do for a custom ROM if noone can dev for it
Click to expand...
Click to collapse
We as owners/users of T-Hub 2 devices require sensible answers to important questions.
We need usb drivers for the T-Hub 2, either from Telstra or from Technicolor the manufacturer of the device so that we can attain " ROOT ACCESS" via a usb cable connection to a computer.
Unless we can get "ROOT ACCESS" we cannot move applications to an external SD card (32 GB in my case) or use Titanium Backup or certain Antivirus programs that require "ROOT ACCESS".
Please accept the undeniable fact that 1 Gigabyte of storage on the internal SD card is totally insufficient and pathetic, almost as pathetic as the fact that we are still stuck with "Gingerbread" which puts us three versions behind on Android which is now up to "JellyBean" v2.
The fact is, I believe the Android operating system running on the T-Hub 2 is, like all other versions of Android, based on the Linux kernel which is software using the GNU General Public License, which allows people to see, copy, use, and modify for their own needs.
If indeed I am correct in my assumption then Telstra/Technicolor could be in breach of a world standard which would mean that the proprietary blocks and gates that they have built to prevent access to the kernel on the T-Hub 2 are illegal.

Download Mode discovered...and more...
I thought this:
Hold "Volume-" and "Volume+" and "Power Button" boots into download mode. This is incorrect.
This gets you to recovery mode (which shows the Android robot fallen over).

Help!
wocko1 said:
I got ADB working on my T-Hub 2 by using the generic Google drivers, and edited the adb_usb.ini to just say 0x069B
So far I have problems rooting it.
Click to expand...
Click to collapse
Have been looking for the drivers everywhere, and so far none of them have worked. Even tried wireless adb to no avail. Also tried gingerbreak but still nothing. Sick of looking at the bloatware. Someone please help!

anyone had more success now that it has ICS 4.0.4

Yes, it can be rooted, but...
Hi,
Yes, much more progress. I've gained ADB root access using the restore method (i.e., restoring a backup which has been modified to install a file to a strange path, e.g,: ../../../system/bin/su), I recommend creating your own restore file rather than using one of the many out there and using it to install the necessary SU software to the appropriate locations.
If your device isn't detected by ADB, check that the device ID has been added to the ADB config file. The Thub2 ID is not recognised automatically. Also, when using fastboot remember to specify this ID or it won't find your THub.
The biggest issue with the THub2 is that Telstra have (in an oddly intelligent move) adopted SquashFS for the root file system; this is the FS used on things like linux liveCD's, and it's 100% RO (well, 99% RO . I have gotten around this in a number of ways. 1: I copied the SquashFS partition using DD to an Ext4 partition, then forced a dirty unmount of the SquashFS partiition chained to a mount of the new Ext4 partition to /system. RW access no problems, SU installs OK, but no persistence without forcing the dirty unmount each boot. 2: I copied the SquashFS partition to my ~ using DD, mounted and edited the partition, then re-flashed to the thub. worked much better, persistence across reboots, but dangerous and dodgy method that could risk many NANDs. 3: I cross-compiled a busybox containing UnionFS to Android.
Option 3 is by far the best option. UnionFS provides a transperent RW layer for SquashFS filesystems, writing the updates that couldn't be written to a RO system like squash to another partition (e.g., Ext4 on SD card). Mount a UnionFS system over /system to enable write access to the system. Maybe a better idea to mount it at /, but that raises other problems I couldn't be bothered dealing with.
I mentioned above that SquashFS is on 99% RO (in all my other experiences, it has been well and truly 100% RO, so this indicates something else a-going on that we should be able to use; I haven't looked into it yet.). For some reason, files installed to the Thub2 using the Restore method are persistent. Very useful, and should lead to a cleaner method.
So rooting so far:
Root with Restore method to install (1 & 2., SU bins, or 3., UnionFS Busybox)
Remount / as RW
-->Path 1 & 2
Dirty unmount /system && dirty unmount /system2 && mount /dev/block/etc.. NOTE: Once you dirty unmount /system, you will need to reference the location of the Ext4 partiition using the absolute (real) name of the device. You will also need to invoke busybox from a fully qualified path, eg. /data/local/tmp/busybox, as the internal /bin applications are no longer available (eg., mount).​
-->Path 3
No need to umount /system, just mount the UnionFS system over the top.​
Finally, for Paths 1 & 3...
Install Superuser application and be free!​
So to sum up; I have easily rooted the Thub2 to root over ADB using a number of methods, however the Restore method works 100% of the time. I have mounted an Ext4 system to /system in order to have RW, but this isn't persistent. I have re-flashed the SquashFS with modified content, and this works a treat, but is RO and dangerous to NAND. I have mounted a UnionFS system over the SquashFS system, and this seems to provide the best all round performance.
I also wrote a short and nasty .apk to mount the UFS system without terminal, so that's a go as well.
Have fun pulling it all apart; I don't read these message boards, so I probably won't se any questions. More than enough to get rooted though.

THub Drivers and ADB Access
THUB 2 DRIVER INSTALLATION AND ADB ACCESS
This method sets out how to install drivers for the THub 2 and access ADB (Android Debug Bridge).
Access to ADB is the usual way that you use to Root an Android device.
Please note that not all ADB versions work. If you download and try a root method, you may have to copy the ADB.exe and support files across so that the root method can at least have a chance of working.
INSTALLING GOOGLE UNIVERSAL ANDROID DRIVERS
1. Ensure that Debugging has been enabled – Settings  Developer options  USB debugging and make sure the box is checked
2. The following is for Windows 7, other versions will be similar
3. Unzip the file and copy contents to a folder on the C: drive. I copied it to a folder I named THub
4. Plug the THub into your PC and it will try to find suitable drivers – some drivers may load and install but at least one will come up with “No driver found”
5. Open “Computer”
6. Click on “System properties”
7. Click on “Device Manager”
8. Under “Other devices” you will see T-Hub2 with an icon with a yellow exclamation mark.
9. Right-click the device and select "Update Driver"
10. Select "Browse my computer for driver software"
11. Select "Let me pick from a list of device drivers"
12. Click “Show All Devices”
13. Click “Have disk …”
14. Browse to where you put the extracted files
15. Select and open “Android_winusb.inf”
16. Select “Android Composite ADB Interface”
17. Click “Next” and then Click “Yes” (Ignore warning)
18. Wait until the software installs
19. You should now have Android Composite Interface” under the “Android Phone” listing
If you have problems, ensure Debugging is selected and try unplugging the THub and reconnecting it
ACCESSING ADB
1. Ensure that Debugging has been enabled – Settings  Developer options  USB debugging and make sure the box is checked
2. The following is for Windows 7, other versions will be similar, It also assumes that the file has been down loaded, unzipped and installed in a folder called THub on you C: drive
3. Connect the THub to your PC
4. Click in the “Start” icon, lower left icon on your PC Desktop
5. In the entry box type in “CMD” and push “Enter”
6. You will be at the “Command Prompt”
7. You need to navigate to the “THub” folder, the following are my entries, and yours should be similar.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Terry>cd .. and “Enter”
C:\Users>cd .. and “Enter”
C:\>
C:\>cd THub and “Enter”
C:\THub>
8. At the THub folder type in “ADB devices” and “Enter”
9. You should get an output similar to this:
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
01545CAB0B015004 device
C:\THub>
10. You now have ADB access
11. Try “adb shell” and “Enter” to enter ADB and then “ls” and “Enter” to get the THub Root folder listing
What next, I don’t know but at least we have ADB access?
I have been trying to copy system files to my SD card to have a look at them but have no success.
Does anyone know how?
Here is the site I uploaded the files to:
"You can fill in the missing bits"
xxx.mediafire.com/download/voku3wnuff5s2ef/THub.zip
NOTE: There is also a file called “UniversalAdbDriverSetup6.msi”.
I don’t know what it is for, but I installed it anyway. It MAY be necessary for the above method.

Firstly, I understand this is an old thread but quite a lot of us Australians have this THub 2 now because Telstra seem to basically be handing them out like shots at a party.
As far as I know this thing still has no root access. You can get into ADB with it without too much trouble.
But what I really want to know is how I can get root access with SuperSU so I can install something like AdAway to remove the seemingly ridiculous amount of advertisements that apps and etc. come with.
In addition to that, after installing just TWO small apps. It seems the device's internal memory is already full and it cannot install any more apps.. I need root access in order to run Apps2SD so I can move some apps to the SD card that I have purchased for it.
Does anyone, and I mean anyone have any ideas about how to root this thing? There has to be some Australian who has a rooted version with SuperSU running.
I tried 'towelroot' but the device just rebooted (meaning it failed) and then when I ran the .apk again it said that the device was unsupported.
It's one thing to be able to get access to the root partition (which is possible over ADB) but it's another to be able to run apps with root privileges.
For any information.
The specs are:
Manufacturer - Technicolor
Operating System - Ice Cream Sandwich 4.0.4
Processor - 1 GHz dual core
Screen - 7″ (1024 x 600 pixels)
Camera - 1.9 MP rear camera, 1.2 MP HD front camera
RAM - 1GB
Storage - 2 GB Internal with an expandable Micro SD card slot (1GB internal usable)
Battery - 6000 mAh (non-removable)
I know it's nothing amazing, but if I could root the device and change the DPI, remove advertisements and install a few hacks. I'd get so much more out of the device.
I picked it up in almost perfect condition second-hand off eBay for only $15. They're worth $360 AU brand-new.
If anyone has any information at all, please do post something. My apologies again for bumping a super old thread but otherwise I was going to just start my own.

Possible to restore system partition
Hi Guys,
I done goofed.
I killed my T-Hub by flashing a corrupted system partition and now the device wont boot and only displays the Telstra logo at the boot loader. I do have a backup of my system partition however I cant work out how I would perform the restore. The boot loader will not allow an ADB connection so no luck there.
Im thinking JTAG may be my only option. I have experience with this on other devices but i cant find the JTAG terminals on this thing? I must have tapped about 60 different combinations of testpoints now and have only been able to get console out of the radio module which is obviously no good for talking to the kernel.
Any help would be greatly appreciated.
Cheers,
Swamp

SwampCrack1210 said:
Hi Guys,
I done goofed.
I killed my T-Hub by flashing a corrupted system partition and now the device wont boot and only displays the Telstra logo at the boot loader. I do have a backup of my system partition however I cant work out how I would perform the restore. The boot loader will not allow an ADB connection so no luck there.
Im thinking JTAG may be my only option. I have experience with this on other devices but i cant find the JTAG terminals on this thing? I must have tapped about 60 different combinations of testpoints now and have only been able to get console out of the radio module which is obviously no good for talking to the kernel.
Any help would be greatly appreciated.
Cheers,
Swamp
Click to expand...
Click to collapse
I'm completely new to this. What ROM would i look for to install on the THUB if any? And if i could install it?

clearburn said:
I'm completely new to this. What ROM would i look for to install on the THUB if any? And if i could install it?
Click to expand...
Click to collapse
sorry but no one has developed a ROM for this device, there is no demand

Madaz2 said:
sorry but no one has developed a ROM for this device, there is no demand
Click to expand...
Click to collapse
Thanks. I thought there might have been a rom from the basic device that didn't have all of the Telstra stuff on it.
It is currently a brick

if you can root it then you could install Titanium backup and uninstall the bloatware off of it

Some moderate success
I have had some moderate advancements of late.
I can get temporary ADB root using the directory traversal exploit
.
While the above method gets you a root terminal session, as it screws with some settings the device is nearly unusable due to screen flicker and general lag. I guess the exploit breaks some settings. Does anyone know how to leave the exploit in place and restore the settings file to eliminate the flickering and lag?
I have been able to export the system partition, edit it (add su.bin and SuperUser.apk) then swap the system mount so the device uses my edited system partition as described by malleus. When I try to flash my partition the device reboots and is in a semi brick state (reboot loop, stuck on boot loader Telstra logo).
I was able to obtain the OTA update files by getting an old 2.3.7 device, rooting it then grabbing the OTA files using ADB once it had downloaded them. These OTA's can be flashed from an SD card (ext4 format) in 3e recovery. This was a good bit of progress as it means I can restore from a bricked state. If anyone needs them, the files I have are:
Product_4.0.4_3.38-FOTA
Product_4.0.4_3.48-FOTA
This is all new territory for me but i think I am getting close to achieving full, persistent root in 4.0.4.
Any help would be appreciated.

I would be very interested in your progress as I have one of these but in default state it is only usable as a phone on the DECT base.....
Having some useful apps running off an SD card would help no end (like multimedia remote for my home theatre system)
Cheers,
Alex B
SwampCrack1210 said:
I have had some moderate advancements of late.
I can get temporary ADB root using the directory traversal exploit
.
While the above method gets you a root terminal session, as it screws with some settings the device is nearly unusable due to screen flicker and general lag. I guess the exploit breaks some settings. Does anyone know how to leave the exploit in place and restore the settings file to eliminate the flickering and lag?
I have been able to export the system partition, edit it (add su.bin and SuperUser.apk) then swap the system mount so the device uses my edited system partition as described by malleus. When I try to flash my partition the device reboots and is in a semi brick state (reboot loop, stuck on boot loader Telstra logo).
I was able to obtain the OTA update files by getting an old 2.3.7 device, rooting it then grabbing the OTA files using ADB once it had downloaded them. These OTA's can be flashed from an SD card (ext4 format) in 3e recovery. This was a good bit of progress as it means I can restore from a bricked state. If anyone needs them, the files I have are:
Product_4.0.4_3.38-FOTA
Product_4.0.4_3.48-FOTA
This is all new territory for me but i think I am getting close to achieving full, persistent root in 4.0.4.
Any help would be appreciated.
Click to expand...
Click to collapse

Has anyone made any progress on this?
I have two of these tablets that have sat unused since I got them from Telstra. I really just want to update it to at least 4.1, but there's no official release from Telstra for the T-Hub, and I don't think there will be. Are ports entirely unfeasible?
Do you think I could contact Technicolor? What should I say?
P.S. there is a recovery mode, because I've booted into it.
hxxp://imgur.com/O0uq4Uk