Develop Bugs

[GUIDE] Temp to permanent root, using rage instead of visionary

There's already a guide here for obtaining permanent root using VISIONary, but some folks in #G2ROOT are having issues with the way that VISIONary modifies parititons. Using rage directly is a bit cleaner, since you know exactly what it's going to touch at each step of the way. I did NOT come up with any of this on my own, I'm building completely off of work that others have done. Speaking of which-
None of this would be possible without the tireless work that scotty2 put in. He stayed with the project for well over a month, through lots of smashed hopes and dead ends, until the solution was finally found. Were it not for his work, as well as the help of a few other key folks- we wouldn't be here. He deserves our thanks and some donations! We're talking hundreds of hours of work here, a couple bucks is not too much for that. His paypal is:
[email protected]​Send him some love! I'm not asking for anything myself, because I spent a half hour putting this together, and that doesn't deserve any donations!
[size=+2]G2 ROOT INSTRUCTIONS[/size]
=================================================
These are modified instructions based on the ones posted at http://bit.ly/g2root that use Visionary. A number of people have run into issues with the way that Visionary juggles around temporary partitions, and using the original root exploit is a much easier, and cleaner method for achieving permanent root. This tutorial will walk you through the rooting process by first achieving temporary root, and moving on to permanent root.
[size=+1]REQUIREMENTS[/size]
=================================================
Visionary disabled at boot or uninstalled completely
Android Terminal Emulator app
ADB
vision-combined-root.zip (Attached to this post, OR these two files: )
G2TempRoot.zip (http://forum.xda-developers.com/showthread.php?t=797042) NOTE: only download the files! Don't follow these instructions yet
vision-perm-root.zip (http://forum.xda-developers.com/showthread.php?t=833965) NOTE: again, just download the files from the thread.
In the commands to run below, $ or # represent the prompt and should NOT be entered as part of the commands.
[size=+2]VERY IMPORTANT![/size]​Visionary has caused filesystem corruption for some users during the rooting process. Before attempting the instructions below, make sure that you have "auto run on boot" turned OFF, and reboot your system. Since you will not need visionary anyway after this, you might as well just uninstall visionary and reboot NOW before doing anything.
[size=+1]TEMP ROOT[/size]
=================================================
ON YOUR PC:
Unzip the G2TempRoot files to a folder. From a cmd window or terminal, navigate to that folder and execute these commands:
Code:
$ adb push su /sdcard/su
$ adb push Superuser.apk /sdcard/Superuser.apk
$ adb push rage /data/local/tmp/rage
$ adb push busybox /data/local/tmp/busybox
$ adb push root /data/local/tmp/root
$ adb shell chmod 0755 /data/local/tmp/*
ON YOUR PHONE:
Launch Terminal Emulator
/data/local/tmp/rage
Wait for the message: "Forked #### childs."
Menu > Reset Term - Terminal Emulator will exit.
Launch Terminal Emulator, it Force Closes. Launch a second time, and you'll have a root shell
**NOTE**: in the original directions from the XDA thread, you are instructed to run the /data/local/tmp/root script here. DON'T do this
just yet. Leave the terminal window open.
[size=+1]PERM ROOT[/size]
=================================================
ON YOUR PC:
unzip the vision-perm-root.zip and navigate to that folder. There will be four files. You will need to push two of these to your phone- hboot-eng.img, and one of the wpthis-[..].ko files.
If you HAVE applied the OTA update, push wpthis-OTA.ko.
If you HAVE NOT applied the OTA update, push wpthis-pre-OTA.ko.
Code:
$ adb push hboot-eng.img /data/local
$ adb push wpthis-OTA.ko /data/local
ON YOUR PHONE:
You should still have terminal emulator up, at a root prompt. Now run:
Code:
# insmod /data/local/wpthis-OTA.ko
You should see:
Code:
init_module 'wpthis-OTA.ko' failed (Function not implemented)
That means it worked. This next step is CRUCIAL. You must make sure that you are writing to the proper partition here or you could brick your phone. To be absolutely clear- the partition is mmcblk(zero)p(one)(eight)
Code:
dd if=/data/local/hboot-eng.img of=/dev/block/mmcblk0p18
You should see some messages indicating that it was written. Next, run:
Code:
# /data/local/tmp/root
This will lock in root, and give you 'su' access in the future. Next, run:
Code:
# sync
Now wait at least a minute, just to be safe. After waiting, reboot your phone using the power button. After it finishes starting up, launch the terminal emulator, and type 'su'. You should get the prompt asking you to grant permissions. If you got the prompt, congratulations! You have permanent root!

I used these instructions and they worked brilliantly.
Sounds like it's a little safer than using VISIONary, which some people in the thread are reporting can get confused and not let you root because it thinks you already have root, etc.

I love it when a plan comes together. Perma-root. thanks man, i never had much luck getting visonary to work so this was spot on. worked like a charm

*not smart enough*
*leaves thread*
I really try to leave ADB out of the equation since I'm not comfortable navigating it.... I suppose I could dedicate my time to learning it, but it's not worth it since I would only use it once every two years to root my phone. In 16 hours I'm sure there will probably be a one click perm root method out anyway.

It worked flawlessly!
I always get so stressed when I root my phones, especially without tutorial vids.
I first did my G1 and that worked perfectly fine.
My second attempt at rooting was with my MT3G and that resulted in a bricked device because one of the lines of code was incorrect in the thread.
This, however, was clearly and plainly spelled out exactly to what happened to my phone.
I give you my thanks.

Awesome- glad to hear it's working well for people. If anybody sees areas that I could improve in the description just let me know.
sinistersai4d4d said:
I really try to leave ADB out of the equation since I'm not comfortable navigating it....
Click to expand...
Click to collapse
ADB is worth it IMHO because it makes moving files around easy, whether you're rooted or not. You don't have to turn on SD card storage, you can just do adb pull/push etc to grab or put files when you need them. Worth the effort. The one click root should be out within the next couple days though, you are right about that one.

trigeek,
I already perm rooted earlier, but just wanted to say you gave a very nicely detailed explanation that anyone should be able to follow. Well done!

Great guide. I liked it a lot more than Unforgivens just because it doesn't rely on VisionARY which might mess things up.

Guide worked absolutely great, no problems. I did not try the visionary method first, but for some reason I just felt safer doing it in adb.
Thank you!

Sorry for the noob question...? but does this mean we have fully rooted to G2 and now we can load ROMS on it when they come out ????
Edit: Nevermind I didnt see the sticky

RaffieKol said:
Sorry for the noob question...? but does this mean we have fully rooted to G2 and now we can load ROMS on it when they come out ????
Click to expand...
Click to collapse
You got it!

RaffieKol said:
Sorry for the noob question...? but does this mean we have fully rooted to G2 and now we can load ROMS on it when they come out ????
Edit: Nevermind I didnt see the sticky
Click to expand...
Click to collapse
Custome ROMs, custom Recovery...the whole 9 yards

Thanks for posting this, it was so easy!

Thank you so very much it was a success

this is my first rooting on an android device... im freaking out... but here i go.... if something happens i will just report my phone lost and get a new one i guess ahahah still... im scared.

Issues
I was temp rooted before using rage and then thru Visionary. But I decided to go back to stock till we have permanent root. I perm rooted today using this method. But I'm having the following issues:
1) adb remount
- remount failed: Operation not permitted
2) when using Root Explorer in /system, toggling Mount R/W does not work
- the only way to mount it R/O is thru terminal/adb shell. Once mounted R/O, the only way to mount R/W again is thru a reboot. Issuing mount -o remount ro /system either in terminal or adb shell does not work.

i actually changed my mind... im going to wait for a one click untended root i guess.... to scary...

joackie27 said:
I was temp rooted before using rage and then thru Visionary. But I decided to go back to stock till we have permanent root. I perm rooted today using this method. But I'm having the following issues:
1) adb remount
- remount failed: Operation not permitted
2) when using Root Explorer in /system, toggling Mount R/W does not work
- the only way to mount it R/O is thru terminal/adb shell. Once mounted R/O, the only way to mount R/W again is thru a reboot. Issuing mount -o remount ro /system either in terminal or adb shell does not work.
Click to expand...
Click to collapse
make sure you have debugging enabled.

juanshop said:
i actually changed my mind... im going to wait for a one click untended root i guess.... to scary...
Click to expand...
Click to collapse
Not gonna happen.

then i guess.... im going to jump in it.... wish me luck...

TRUE PermaRoot and the ULTIMATE S=Off!!! Check this out even if you're rooted!!!

Ok guys, first of all Scotty2 gets all the credit for the program R&D. I used my device as a test bed and have tried a couple different kernels (Gr8Gorilla's O/C Kernel and the stock kernel).
Now for the boring stuff ...
This is a very invasive way of rooting your device but the benefit is TRUE S=Off and root privileges throughout the system. As such, you do this at your own risk and if you brick your device neither Scotty2 nor myself are responsible, YOU ARE!!! Do this at your own risk!!!
This is not for the faint of heart and if you have any reservations about doing things like this do not do it.
This process will do three things for your device. I will explain them here:
1. It will set up Super CID on your device allowing you to flash any carriers rom (not just tmobile). Giving you more freedom with your choice of software. The software still needs to be device specific to the glacier for compatability reasons though. Like vodafone glacier roms etc.
2. It will subsidy unlock your device. In other words, it will SIMUNLOCK your phone allowing you to use an AT&T sim card and so on in your device without needing the unlock code from HTC.
3. Most important of all it will turn the RADIO S=Off. This is the ultimate S=Off because the radio is what controls the security flag in the first place. Once you turn it off here it is off everywhere and will allow you pure unadulterated access to your device.
This process will not change your bootloader (unless your on 0.86.0000 and you follow the optional steps).
Now, you may be asking "Why do this? I already have root from your other guide and it has given me r/w access to system and recovery. I thought this meant we had permanent S=Off." This is only partially true. We have had an engineering bootloader and "Label" s=off not radio s=off. When you turn the security off in radio it is off permanently no matter what hboot you have installed engineering or otherwise. However, it is optional but you can still copy the engineering hboot over and it will allow you to flash whatever you like without (as much) fear of bricking your device.
This guide assumes you know how to use ADB. If you do not there are guides all over XDA to show you how. There is even a really good one in this forum. Also here is a video on how to setup adb discovered by topgun303: http://www.youtube.com/watch?v=1UF5w1dKe2U
*NOTE*
For some reason this process can bork your recovery. If you notice after following the steps below that in order to reboot from recovery you have to uninstall/reinstall the battery and hit the power button, just install/reinstall clockwork recovery through Rom Manager in the android market and it will fix your problem.
CONFIRMED: Guide does work for pre-OTA devices!!! Thanks xanz!
Here we go:
If you are already permarooted per the other guide just follow the first 11 steps.
Make sure you have visionary installed on your device. (If you were already permarooted w/s=off ignore this step.)
Download this file:
http://www.mediafire.com/?s7afymwe2wb3x60 New version of gfree with more options! See below.
md5sum: b73c56ca0e21664c5756d4ad295063c5
1. Now unzip the file into your SDK tools directory.
2. Plug your device into your computer.
3. Now open explorer and hold down shift at same time you right mouse click on your SDK tools directory (platform-tools if you have the R8 version of the SDK). Select open command window here. If you are in linux (ubuntu) right mouse click on your SDK tools folder, choose actions, and choose open command window(or whatever it's called). Otherwise, open a command prompt and cd your way to your SDK tools directory.
4. Type "adb push gfree /data/local" and hit enter.
Optionally, you could dl the file to your phone use androzip or something like it to unzip the file and then use root explorer to move the file named gfree to /data/local. Not the gfree.h file. All the other files are source code inlcuded for the gnu license. This would skip the first 4 steps.
5. Now unplug your device from the computer.
6. Run visionary to gain temp root. (If you were already permarooted w/s=off ignore this step.)
7. Open terminal emulator on your device, type "su", and hit enter to gain root privileges.
8. Type "cd /data/local" and hit enter.
9. Now type "chmod 777 gfree" and hit enter to make the program executable.
10. Type "./gfree -f" and hit enter.
New features in gfree.
gfree usage:
gfree [-h|-?|--help] [-v|--version] [-s|--secu_flag on|off]
-h | -? | --help: display this message
-v | --version: display program version
-s | --secu_flag on|off: turn secu_flag on or off
-c | --cid <CID>: set the CID to the 8-char long CID
-S | --sim_unlock: remove the SIMLOCK
With the new features you can turn off one thing at a time. You can also turn security back on and set the CID back to stock if you wish. To turn simlock back on you still have to follow the revert procedures on this page as the information that is patched to turn the lock off is encrypted and we can't write back to it other than restoring the entire image.
So, if you wanted to leave simlock on but turn security off and set super CID the command would be "./gfree --secu_flag off --cid 11111111" + enter. The -f switch after ./gfree that is now in the above step (./gfree -f) just tells gfree to patch everything.
11. Wait for the program to finish and then reboot into HBoot to see if S=Off. Also, check your bootloader version. If it says s=off and has bootloader version 0.86.0000 it worked.
If you already had hboot 0.85.2007 you can check it through the hboot menu. It gives you an option for "system info" in the hboot menu. Highlight it and hit power. It should say CID = 11111111 or something like that. If it does your golden.
Congratulations!
12. If this is the first time you have rooted your device you will need to run visionary again (temproot w/set system r/w after root checked and then attempt permroot) to make root privileges permanent and then reboot again. Now "su" should work properly for you.
Gfree writes a backup of the file that it patches named Part7backup-numbers.bin on your sdcard. I suggest putting this file in a safe place as it is the only way to revert if you need to.
[Optional] Steps to flash engineering bootloader.
1. Restart your phone and plug it back into your computer.
2. Download this file: http://www.megaupload.com/?d=NN5726Z8
md5sum: df4fd77f44993eb05a4732210d2eddc6
3. Copy the file to your SDK tools directory.
4. Open a command prompt again and cd into your SDK tools directoty (platform-tools if your on the new R8 SDK).
5. Type "adb push hboot_dhd.nb0 /data/local" and hit enter.
6. Now open terminal on your device and type "su" and enter to gain root priviliges.
7. Type "cd /data/local" and enter.
8. Now type "dd if=hboot_dhd.nb0 of=/dev/block/mmcblk0p18" and hit enter.
9. You should see something like: 2048 bytes in 2048 bytes out 1048576 bytes copied blah blah blah.
10. Now restart the device into hboot and check if your bootloader version is 0.85.2007. That is what you want to see.
Congratulations, you now have a TRUE root and engineering bootloader on your shiny MT4G!!!
Procedure to revert
1. Rename the part7backup file that you already have to something just so you know that it is the original backup.
2. Open up terminal emulator or adb shell and type "su" + enter to get root privileges.
3. Type "cd /data/local" and hit enter.
4. Now type "./gfree -f" + enter to run gfree again. It will disable wp on the emmc and remove the brq filter in the kernel. (as well as make another backup, which you can delete if you wish)
5. Now run the "dd if=/where/your/part7backup-numbers.bin of=/dev/block/mmcblk0p7" and it should show the output:
xxxx bytes in
xxxxbytes out
xxxxxxxxxx copied in blah blah blah
6. Run "sync" and then reboot. (I didn't do this and it worked fine but it won't hurt either. )
If you have the engineering hboot 0.85.2007 installed you will still be showing s=off when you do the above revert steps. Follow these steps to reflash the stock hboot and turn s=on:
Download this file and unzip it to /sdcard on your device.
unroot.rar
http://www.mediafire.com/?12oi5elu7v2y8og
md5sum: aad4e64126cf8d92d7e8b5abb48fdadd
Terminal Emulator Method
1. Open up terminal editor on your device.(I prefer this method b/c you can see the output.)
a. Type "su" + enter to gain root privileges.
b. Type "cd /sdcard/unroot" + enter.
c. Type "sh unroot.sh" + enter.
d. Follow the onscreen prompts.
File Explorer Method
2. Open root explorer, sufbs, or some other file browser with root access.
a. Navigate to /sdcard/unroot.
b. Click on unroot.sh and allow it to run. Some file browsers ask permission before they execute scripts.
c. Wait 18 to 20 seconds and reboot your phone into the bootloader to check if S=on.
You now have S=ON again.
Here is a pic of the stock HBoot 0.86.0000 with S=Off to prove it.

If already on ENG bootloader, S-OFF, and perm rooted via your other guide would we be able to just run gfree for the "radio/sim" unlock?

Genocaust said:
If already on ENG bootloader, S-OFF, and perm rooted via your other guide would we be able to just run gfree for the "radio/sim" unlock?
Click to expand...
Click to collapse
Yes, that's what I did. Good call btw! I wrote the guide in a hurry just before heading to work and knew I would miss something.
My MyGlacier 4G MINE!!!

u could use root explorer to place the gfree file in data local couldn't u?

Yes you could use root explorer. I am going to revise this as soon as I get time. I'm at work right now.
As for the optional steps, you wouldn't need to do them if you already followed the other permroot guides successfully b/c you should alread have hboot 0.85.2007 installed.
My MyGlacier 4G MINE!!!

so is the 0.85.2007 is the one we want to be on?

mrpanic7 said:
my bootloader is 0.85.2007 is this the sweet one i want or the stock one?
Click to expand...
Click to collapse
Good to go. You have the engineering hboot.
Should work from either one as long as you have some kind of root access.
But ... Keep that one.
My MyGlacier 4G MINE!!!

sweet thanks, and the whole talk about subsidy unlock and flashing other device roms, is that part of the hboot im running, or the gfree file ?

Hey grankin01 this is what i have on my screen. Bec i just got this phone from warranty claim.
GLACIER PVT ENG S -OFF
HBOOT-0.85.2007 (PD1510000)
MICROP-0429
RADIO-26.03.02.26_M
eMMC-boot
oct 11 2010, 12:44:14

@mrpanic7, no its part of the gfree patch.
@topgun303, what kernel version are you running? Stock?
My MyGlacier 4G MINE!!!

sweet thanks will test tonight and comment when everything is done! how do we know if hte gfile goes thru successfully? since im already permarooted

grankin01 said:
@mrpanic7, no its part of the gfree patch.
@topgun303, what kernel version are you running? Stock?
My MyGlacier 4G MINE!!!
Click to expand...
Click to collapse
Kernal version: I have not flashed anything other kernal yet. This is what came with my phone.
2.6.32.21-g899d047
[email protected] #1
tue oct 26 16:10:01 CST 2010
Hey grankin01 I dont have adb steup, can you provide workaround for that. Meaning without adb.

Awesome man. Great job. Just to be clear. After unzipping the file, all of them need to go in the data/local folder yes?

So we can use root explorer to oaste the file, then the termunal steps?
Sent from my rooted w/s=off HTC Glacier on Iced Glacier Dark Froyo Themed 1.1.1 using XDA App

You should be able to use root explorer and yes put all files in /data/local including the hboot_dhd.nb0 file if you are going to do the optional steps.
Edit: Added mention of root explorer method between steps 4 and 5.
My MyGlacier 4G MINE!!!

hey grankin01 my phone is on engineer bootloader right now. what are the advantages of engineer bootloader vs bootloader version 0.86.0000?
Also if i flash bootloader version 0.86.0000, can i go back to engineer bootloader.

u r the maaan
after trying everything i got s=off thanx to you...but 1 lil isue the root did not stick for me after checking hboot to see if i got s=off

topgun303 said:
hey grankin01 my phone is on engineer bootloader right now. what are the advantages of engineer bootloader vs bootloader version 0.86.0000?
Also if i flash bootloader version 0.86.0000, can i go back to engineer bootloader.
Click to expand...
Click to collapse
Eng hboot will let you flash anything you want. Stock hboot will still limit your choices.
Yes you can just do the optional steps from the OP to go back to eng hboot. Actually having stock hboot will let you see if it worked without having to do anything special.
My MyGlacier 4G MINE!!!

wadie said:
after trying everything i got s=off thanx to you...but 1 lil isue the root did not stick for me after checking hboot to see if i got s=off
Click to expand...
Click to collapse
So this did work w/stock device and kernel?
Try running visionary r14 and doing permroot option. Being a stock rom you may still have to fiddle with it a little. Not quite an exact science.
My MyGlacier 4G MINE!!!

So the bootloader version 0.86.0000 provides simunlock correct? If i read correct from the first page of op. For now i think i will stay on engineer hbootloader.
Also one more thing op, I found a great video on how to setup adb. I have already got my adb setup using this. If u like you can post it in the op section. http://www.youtube.com/watch?v=1UF5w1dKe2U

Restore gfree backup

Hello all,
I've had a DZ for nearly 2 weeks now, and have been holding off on installing roms, overclocking etc until there were clear, reversible guidlines available.
A few days ago I was being curious and ended up doing this the UBERROOT guide.
Essentially I temprooted using Visionary then executed the gfree script on my PC:
adb push gfree /data/local
adb shell
su
cd /data/local
chmod 777 gfree
./gfree
sync
This went well, and when I got to the bootloader I could see indeed that my S was OFF.
However, before I go any further I want to know how to reverse what I've done. This is mentioned at the bottom of the UBERROOT guide:
'run gfree, which will create a new backup of partition 7 in its unlocked state.
this will disable wp on the emmc, as well as remove the brq filter from the kernel.
at this point, you can dd if=/wherever/your/partition7-relock.img of=/dev/block/mmcblk0p7
sync; reboot'
I found the backup, although it was a .bin file not .img
I entered in the command above, but my phone rebooted before I could enter the 'sync' command. My S is still off, it would seem.
So my question to you fine people, having typed all this is:
How can I use the gfree backup to return my phone back to stock?

nofixio said:
How can I use the gfree backup to return my phone back to stock?
Click to expand...
Click to collapse
You can use the "dd" command to copy back the image of that original partition, as you mention.
However, the latest version of gfree now includes some new options to un-do that stuff, e.g. you can switch S-ON back on and change your SID via options. See the Wiki on this - http://forum.xda-developers.com/wik...Phone.2C_Set_SuperCID.2C_and_Turn_Radio_S-OFF

nofixio said:
Hello all,
I've had a DZ for nearly 2 weeks now, and have been holding off on installing roms, overclocking etc until there were clear, reversible guidlines available.
A few days ago I was being curious and ended up doing this the UBERROOT guide.
Essentially I temprooted using Visionary then executed the gfree script on my PC:
adb push gfree /data/local
adb shell
su
cd /data/local
chmod 777 gfree
./gfree
sync
This went well, and when I got to the bootloader I could see indeed that my S was OFF.
However, before I go any further I want to know how to reverse what I've done. This is mentioned at the bottom of the UBERROOT guide:
'run gfree, which will create a new backup of partition 7 in its unlocked state.
this will disable wp on the emmc, as well as remove the brq filter from the kernel.
at this point, you can dd if=/wherever/your/partition7-relock.img of=/dev/block/mmcblk0p7
sync; reboot'
I found the backup, although it was a .bin file not .img
I entered in the command above, but my phone rebooted before I could enter the 'sync' command. My S is still off, it would seem.
So my question to you fine people, having typed all this is:
How can I use the gfree backup to return my phone back to stock?
Click to expand...
Click to collapse
When you run gfree, it creates a bin file in your sd card. That bin file you shall rename it to "whatever".img, to be more specific rename it to partiiton7-relock.img.
Now once you did this, just run gfree again:
adb push gfree /data/local
adb shell
su
cd /data/local
chmod 777 gfree
./gfree
sync
Once done the above, just download terminal emulator and from there run:
su
dd if=/sdcard/partition7-relock.img of=/dev/block/mmcblk0p7
sync
exit
And reebot the phone, Now you can go and see you are S-ON.
This method above works without a problem as myself have tried several times, however as steviewevie mentioned, the new version of gfree does this easier.

buzmay said:
When you run gfree, it creates a bin file in your sd card. That bin file you shall rename it to "whatever".img, to be more specific rename it to partiiton7-relock.img.
Now once you did this, just run gfree again:
adb push gfree /data/local
adb shell
su
cd /data/local
chmod 777 gfree
./gfree
sync
Once done the above, just download terminal emulator and from there run:
su
dd if=/sdcard/partition7-relock.img of=/dev/block/mmcblk0p7
sync
exit
And reebot the phone, Now you can go and see you are S-ON.
This method above works without a problem as myself have tried several times, however as steviewevie mentioned, the new version of gfree does this easier.
Click to expand...
Click to collapse
How to get that file (partition7-relock.img)? Because I formated the card after g-free method and I runned the official Ruu, so now I have that stupid S-Off, I need it S-On...

Niiceg said:
How to get that file (partition7-relock.img)? Because I formated the card after g-free method and I runned the official Ruu, so now I have that stupid S-Off, I need it S-On...
Click to expand...
Click to collapse
You don't need the backup for that. Just check the Wiki to find the options for gfree that will set it back to S-ON
Sent from my HTC Desire Z

steviewevie said:
You don't need the backup for that. Just check the Wiki to find the options for gfree that will set it back to S-ON
Sent from my HTC Desire Z
Click to expand...
Click to collapse
I don't find anything more than this guide:
Turning S-On
If you are returning your Vision to stock, you will want to flash your stock ROM and Recovery image before starting this, as root permissions and S-Off are required for both of those processes.
Remove Gfree (turn back S-On):
When you first ran Gfree, it automatically backed up your stock partition 7 (with S-On) and placed it on your microSD card as a file named part7-(something).bin and you will need to rename this file to: partition7-relock.img
Open up your ADB command prompt on your computer (with your phone plugged in) and type the following exactly as shown:
Code:
adb shell
su
cd /data/local
chmod 777 gfree
./gfree
dd if=/sdcard/partition7-relock.img of=/dev/block/mmcblk0p7
sync
reboot bootloader
Your phone will reboot into bootloader. Look at the first line. The end should now say "S-On".

steviewevie said:
You don't need the backup for that. Just check the Wiki to find the options for gfree that will set it back to S-ON
Sent from my HTC Desire Z
Click to expand...
Click to collapse
I think they removed the automatic option for some reason, I beleive it was in version v.3 and now v.2 is back up. I was looking for that option for someone else early yesterday and noticed its not on the Wiki anymore, unless I missed it, but Im prettty sure I didn't. So I think were back to using the "dd if=/sdcard/partition7-relock.img of=/dev/block/mmcblk0p7" command.
Update: On fattire's thread they said they took down v3 because people were having problems with it and are now advising using v2 and the old restore method.

joemm said:
I think they removed the automatic option for some reason, I beleive it was in version v.3 and now v.2 is back up. I was looking for that option for someone else early yesterday and noticed its not on the Wiki anymore, unless I missed it, but Im prettty sure I didn't. So I think were back to using the "dd if=/sdcard/partition7-relock.img of=/dev/block/mmcblk0p7" command.
Click to expand...
Click to collapse
Where to get that file if i already formated the card?!

Niiceg said:
Where to get that file if i already formated the card?!
Click to expand...
Click to collapse
There is no where to get the file if you erased/formatted your sdcard without saving it somewhere else, the instructons on gfree tell you to do this:
"gfree created a backup of your original partition 7 at /sdcard/part7backup-<time>.bin you might consider copying this to a safe location on your computer."
So if you didnt do this I really dont know what you can do. I have my part7backup but I dont know if its specific to my device or if anyone can use it.

joemm said:
There is no where to get the file if you erased/formatted your sdcard without saving it somewhere else, the instructons on gfree tell you to do this:
"gfree created a backup of your original partition 7 at /sdcard/part7backup-<time>.bin you might consider copying this to a safe location on your computer."
So if you didnt do this I really dont know what you can do. I have my part7backup but I dont know if its specific to my device or if anyone can use it.
Click to expand...
Click to collapse
Well, What device you have? Z or G2? I think that it's not specific, because all phones are the same ;D

Niiceg said:
I don't find anything more than this guide:
Turning S-On
Click to expand...
Click to collapse
Look at http://forum.xda-developers.com/wik...Phone.2C_Set_SuperCID.2C_and_Turn_Radio_S-OFF
Scroll down to the bit that shows you the usage message for gfree and check out the "-s" option

joemm said:
I think they removed the automatic option for some reason, I beleive it was in version v.3 and now v.2 is back up. I was looking for that option for someone else early yesterday and noticed its not on the Wiki anymore, unless I missed it, but Im prettty sure I didn't. So I think were back to using the "dd if=/sdcard/partition7-relock.img of=/dev/block/mmcblk0p7" command.
Update: On fattire's thread they said they took down v3 because people were having problems with it and are now advising using v2 and the old restore method.
Click to expand...
Click to collapse
The latest gfree 0.03 had problems, yes, so they went back to 0.02 in the Wiki. But as my previous post shows, you can still un-do things with gfree 0.02.
The only reason to use the backup of partition 7 that I can think of is if you don't know what your original CID was to reset to, or if you want to SIM Lock your phone again (there doesn't seem to be an undo option for the SIM Unlock).

steviewevie said:
The latest gfree 0.03 had problems, yes, so they went back to 0.02 in the Wiki. But as my previous post shows, you can still un-do things with gfree 0.02.
The only reason to use the backup of partition 7 that I can think of is if you don't know what your original CID was to reset to, or if you want to SIM Lock your phone again (there doesn't seem to be an undo option for the SIM Unlock).
Click to expand...
Click to collapse
Ok, I see the option for sec-flag on/off but does that also restore the sim lock?
Sent from my T-Mobile G2 using XDA App

joemm said:
Ok, I see the option for sec-flag on/off but does that also restore the sim lock?
Click to expand...
Click to collapse
No it doesn't as far as I know, but that's why I said restoring SIM lock was the only real use for that part7 backup that I could think of.

steviewevie said:
No it doesn't as far as I know, but that's why I said restoring SIM lock was the only real use for that part7 backup that I could think of.
Click to expand...
Click to collapse
I wasn't sure myself, thanks.
Sent from my T-Mobile G2 using XDA App

steviewevie said:
No it doesn't as far as I know, but that's why I said restoring SIM lock was the only real use for that part7 backup that I could think of.
Click to expand...
Click to collapse
Okey, can you tell how to do everything? Because I don't know anything with that gfree... And there is no instruction... Please, help me get the S-On

I have PM'd the author of gfree about an option for SIM re-lock, because that would be useful. I guess you will still need some sort of carrier string which it needs re-locking to though ? Would be handy if perhaps gfree told you what that was before you unlocked it.

Im in the same boat as niiceg, I cannot find my backup and have had no luck in my searchs. Any Idea's what I can do from here?
Thanks in advance..
ps I'm guess my next step is to re root and do
su
cd /data/local
chmod 777 gfree
./gfree -s on
sync
???

bildo said:
Im in the same boat as niiceg, I cannot find my backup and have had no luck in my searchs. Any Idea's what I can do from here?
Thanks in advance..
ps I'm guess my next step is to re root and do
su
cd /data/local
chmod 777 gfree
./gfree -s on
sync
Click to expand...
Click to collapse
Yes, you just need to run "gfree -s on" as root to go from radio S-OFF to S-ON, no need to find/restore that backup.

have S-OFF but no root access

I have S-OFF but now temp root visionary won't work for me and I can't get root access. Can only $ using adb so I can't push files. Any help would be apperciated

Try the method in the Wiki - http://forum.xda-developers.com/wik...sion#Rooting_the_Vision_.28G2.2FDZ.29_and_DHD
You should still be able to push files via adb though, I don't understand your comment about getting $ with adb (don't do an "adb shell" before you run "adb push", adb is a command for running on your PC, not your phone).

Same here. I did the wiki instructions. but /data/local/root gave me the cp:not found
and /su no a directory. visionary doesnt work. and rage never works right. my "root shell" doesnt let me do su. i think i might have no su. i'm really confused why this wont work. I've done four factory resets trying the rage method and the visionary method. I have S-OFF but nothing else as far as I can tell.
EDIT: I've read a bunch of threads on this and still can't find a solution

I've read in the Rage thread that there were issues with Visionary seeing root access. I would honestly give rage another shot. It worked brilliantly for me, you just have to have ADB configured first.

I did. i get temp root but gfree wont work. i have cid and sim unlock and s off but not system r/w. and when i run /data/local/tmp/root. also my phone will randomly restart now.

steviewevie said:
Try the method in the Wiki - http://forum.xda-developers.com/wik...sion#Rooting_the_Vision_.28G2.2FDZ.29_and_DHD
You should still be able to push files via adb though, I don't understand your comment about getting $ with adb (don't do an "adb shell" before you run "adb push", adb is a command for running on your PC, not your phone).
Click to expand...
Click to collapse
I tried this and it didn't work for me.

Can I reflash somehow to the stock rom? I think visionary somehow messed up my phone.

I reflashed to 1.12 and rage worked!
So if visionary has messed up your /su you need to reflash to stock because your /system is messed up.

http://forum.xda-developers.com/showpost.php?p=10966727&postcount=63
had the same problem. had s-off and all that fun stuff. had to do this.

[Q] How to unlock Desire HD 4G?

Well, as the title says, how do I unlock the Desire HD 4G, now that the aahk tool is not being used? I've searched and searched but I don't find anything.
Thanks in advance.

ghosts3v3n said:
Well, as the title says, how do I unlock the Desire HD 4G, now that the aahk tool is not being used? I've searched and searched but I don't find anything.
Thanks in advance.
Click to expand...
Click to collapse
Did you search the Development forums? Easy Ace Root Tool.

bananagranola said:
Did you search the Development forums? Easy Ace Root Tool.
Click to expand...
Click to collapse
I've read about it, but I see it only works for root. I've already rooted my phone and booted up a custom rom, I just don't find a way to unlock it and make it work with Simple Mobile.

ghosts3v3n said:
I've read about it, but I see it only works for root. I've already rooted my phone and booted up a custom rom, I just don't find a way to unlock it and make it work with Simple Mobile.
Click to expand...
Click to collapse
So you're asking about SIM unlock, not bootloader unlock? AAHK's old website has a high-level manual guide for how to do everything AAHK used to do.

bananagranola said:
So you're asking about SIM unlock, not bootloader unlock? AAHK's old website has a high-level manual guide for how to do everything AAHK used to do.
Click to expand...
Click to collapse
Well, I can't say i'm a pro at Android, but I ain't bad either. I took a read at that. I believe that manual is to SIM Unlock? Again, I read it but tbh, not everything is explained easily. It would help if someone would explain what is going on. (not what do I have to do.)

ghosts3v3n said:
Well, I can't say i'm a pro at Android, but I ain't bad either. I took a read at that. I believe that manual is to SIM Unlock? Again, I read it but tbh, not everything is explained easily. It would help if someone would explain what is going on. (not what do I have to do.)
Click to expand...
Click to collapse
The manual is, top to bottom, what AAHK used to do. That includes SIM unlock. That also includes S-Off, recovery, and root. He gives a high-level explanation of each step. What kind of explanation are you looking for?

bananagranola said:
The manual is, top to bottom, what AAHK used to do. That includes SIM unlock. That also includes S-Off, recovery, and root. He gives a high-level explanation of each step. What kind of explanation are you looking for?
Click to expand...
Click to collapse
Well, first of all, I assume these are the steps to Sim Unlock my phone?
High Level Steps (some detail deliberately NOT included)
htc dev unlock, install cwm recovery and root ONLY
dd the stock boot image to /data/local/tmp and pull it to your pc HD (/dev/block/mmcblk0p22 is boot)
adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
adb pull /data/local/tmp/boot.img
make a goldcard (for all CIDS not in android-info.txt in the firmware.zip to be flashed)
adb push goldcard /data/local/tmp
adb shell chmod 775 /data/local/tmp/goldcard
adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid (returns sdcard cid)
adb shell /data/local/tmp/goldcard -c <sd card cid above> -o /data/local /tmp/goldcard.img
adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1 (this writes the goldcard.img to the sdcard. Mileage on used sdcards may vary)
push misc_version to the phone and use to lower the mainversion (need to lower the mainversion in order to flash the firmware downgrade)
adb push misc_version /data/local/tmp
adb shell chmod 775 /data/local/tmp/misc_version
adb shell /data/local/tmp/misc_version -s 1.11.111.1
relock the bootloader
flash firmware.zip with from the zip below (this firmware contains the original radio exploit used by gfree)
fastboot oem rebootRUU
fastboot flash zip firmware.zip
fastboot reboot-bootloader
unlock the bootloader again (use the same unlocktoken bin)
flash your stock boot.img to boot (this will get the current rom working again)
fastboot flash boot boot.img
flash recovery.img to recovery (from the zip below – this recovery has a kernel that works with the radio exploit)
fastboot flash recovery recovery.img
boot to recovery (yes, the screen may well be blank, but adb should work fine)
adb push gfree /tmp/
adb shell chmod 775 /tmp/gfree
adb shell /tmp/gfree -f >> yeilds – s-off, supercid, sim-unlock
reboot to bootloader and check success.
Click to expand...
Click to collapse

No, like I said, those are all the steps to do what AAHK used to do. That includes SIM unlock, as well as all those other things I mentioned previously.

bananagranola said:
No, like I said, those are all the steps to do what AAHK used to do. That includes SIM unlock, as well as all those other things I mentioned previously.
Click to expand...
Click to collapse
Well okay, so, which of those are the steps to SIM Unlock the phone?

ghosts3v3n said:
Well okay, so, which of those are the steps to SIM Unlock the phone?
Click to expand...
Click to collapse
Wait okay, I think I'm not being clear. I'm pretty sure that those instructions get your phone in a state where it can run the gfree exploit. It does this by unlocking, making a goldcard, and flashing an exploitable firmware. The gfree exploit does S-Off, SIM unlock, and superCID. I don't know what state your phone is in now, so you need to look at that to figure put what your next steps are.

hmm, gfree exploit? I haven't read about that. Care to send a link?
Sent from my HTC Desire HD using Tapatalk 4 Beta

ghosts3v3n said:
hmm, gfree exploit? I haven't read about that. Care to send a link?
Click to expand...
Click to collapse
It's included in the instructions you quoted above.

oh, I think I get it. Ignoring the first steps (I already have CWM, and root), I should follow everything else and I should end up with S-OFF, Supercid (what's this?), and sim unlock?
Sent from my HTC Desire HD using Tapatalk 4 Beta

ghosts3v3n said:
oh, I think I get it. Ignoring the first steps (I already have CWM, and root), I should follow everything else and I should end up with S-OFF, Supercid (what's this?), and sim unlock?
Sent from my HTC Desire HD using Tapatalk 4 Beta
Click to expand...
Click to collapse
SuperCID: All RUUs will be compatible with your phone, every region. This is because the cid is what determines what country and carrier you phone is from, it also helps unbranding.
Sent from my Desire HD using Tapatalk 4