Develop Bugs

SOLUTION: S-ON HTC Wildfire S Downgrade Error "Main Version is Older. Update fail."

SOLUTION: S-ON HTC Wildfire S Downgrade Error "Main Version is Older. Update fail."
Like a few people I have been trying to debrand my S-ON Wildfire S by flashing an official HTC ROM. Since my phone shipped with a later version number (1.34.110.3), the bootloader would refuse to flash the latest Official HTC ROM (1.33.401.2) even with a gold card!
Luckily I've now managed to bypass this error by hex editing and reflashing the misc partition. The following method should allow you to downgrade to any signed HTC ROM no matter what version you currently have installed, even if your phone is S-ON.
Warning: You could probably brick your phone if you flash an invalid misc partition. So follow these steps carefully (or not at all)! Also, if you flash a very recent ROM, you may not be able to use these steps to downgrade again!
Ensure you have the HTC Sync USB drivers installed then download the zip at mediafire.com/?wxf6y4yq6d6nc8d containing the tools you need, and an official HTC ROM executable. I used the ROM at filefactory.com/file/cbd7165.
Connect your phone via USB and select the HTC sync option when prompted. Also ensure that USB debugging is enabled (this is the default).
Extract the zip and open a windows command prompt and browse to the directory where you extracted the files.
Execute the following commands in the command prompt:
Code:
adb push flash_image /sdcard/flash_image
adb push GingerBreak /data/local/tmp/GingerBreak
adb shell chmod 777 /data/local/tmp/GingerBreak
Now enter the interactive shell mode with the following command:
Code:
adb shell
Gain temporary root access by executing the following command within the interactive shell:
Code:
./data/local/tmp/GingerBreak
Ensure that it has worked successfully (the shell prompt should change from $ to #).
As root now execute the following commands:
Code:
cat /dev/mtd/mtd0 > /sdcard/misc.img
cat /sdcard/flash_image > /data/flash_image
chmod 777 /data/flash_image
Now exit from root permissions. The shell prompt should change back to a $.
Code:
exit
Clean up a few files and exit from adb.
Code:
rm /data/local/tmp/sh
rm /data/local/tmp/boomsh
exit
Copy the image file from your SD card using the command:
Code:
adb pull /sdcard/misc.img misc.img
Run HxD.exe, select "OK" at the prompt then File -> Open and locate misc.img (which is in the current directory). On the 11th line you should see the version number of your current ROM, change this to a lower number. I set my version number to 1.30.401.0 since this was the version number of the previous official HTC ROM. The changes made will be highlighted in red. File -> Save As and name it misc2.img.
Copy misc2.img to your SD card using the following command:
Code:
adb push misc2.img /sdcard/misc2.img
Reboot your phone so that you can use GingerBreak again to attain temporary root privileges. (This may not be strictly necessary, but I think it's worthwhile just in case.)
Once it's back and you've connected via USB using the HTC Sync option again, issue the following commands in your command prompt:
Code:
adb shell
./data/local/tmp/GingerBreak
/data/flash_image misc /sdcard/misc2.img
Now run the official ROM installer executable as normal. Note that the installer may state your current version number but this is ignored and you should be able to downgrade successfully!
Let me know if you have any problems.
Confirmed Working on:
TMobile UK 1.34.110.3 + HBOOT 0.90.0.0
TMobile Polska 1.30.401.2 + HBOOT 0.90.0.0

You also have/had the 1.03.0000 hboot?
I get:
./data/local/tmp/GingerBreak
[**] Gingerbreak/Honeybomb -- android 2.[2,3], 3.0 softbreak
[**] (C) 2010-2011 The Android Exploid Crew. All rights reserved.
[**] Kudos to jenzi, the #brownpants-party, the Open Source folks,
[**] Zynamics for ARM skills and Onkel Budi
[**] donate to [email protected] if you like
[**] Exploit may take a while!
[+] Plain Gingerbread mode!
[+] Found PT_DYNAMIC of size 232 (29 entries)
[+] Found GOT: 0x00014360
[+] Using device /devices/platform/goldfish_mmc.0
[*] vold: 0000 GOT start: 0x00014360 GOT end: 0x000143a0
And it stays there...

The hboot version I have is 0.90.0000, but I don't see why this wouldn't work for any version.
How long are you waiting for it to complete? Like it says, it can sometimes take a while for the exploit to take effect. Sometimes it took up to a minute for me.
Every time you use GingerBreak you should make sure that you remove sh, boomsh and crashlog if they exist, reboot your phone then push and chmod GingerBreak again.
Code:
adb shell
rm /data/local/tmp/sh
rm /data/local/tmp/boomsh
rm /data/local/tmp/crashlog
exit
** restart phone **
adb push GingerBreak /data/local/tmp/GingerBreak
adb shell chmod 777 /data/local/tmp/GingerBreak
adb shell
./data/local/tmp/GingerBreak

11 row
In my misc.img 11th row look like this:
should I change 9.0.0.0 to 1.30.401.0 ?? My current rom is TMobile PL 1.30.401.2.

m3ritum said:
should I change 9.0.0.0 to 1.30.401.0 ?? My current rom is TMobile PL 1.30.401.2.
Click to expand...
Click to collapse
It seems unusual that your ROM has a 9.0.0.0 version number
But, yes, as long as 1.30.401.0 is lower than the version number of the RUU you are intending to flash, it should be fine. If it doesn't work you can use flash_image to reflash misc.img to get back the old version number.

I tried it again after remove commands and rebooting but no luck... Waited +5mins and nothing happened.
I guess the new HBOOT is the problem.

sammyke007 said:
I tried it again after remove commands and rebooting but no luck... Waited +5mins and nothing happened.
I guess the new HBOOT is the problem.
Click to expand...
Click to collapse
Maybe the GingerBreak exploit is patched on your ROM...

Beer for U mphi it works great !!!

If this has worked for you, please can you post your previous ROM version number and your HBOOT version? I'll keep a list of working version numbers updated in the first post. Thanks!

Sure, ROM was branded TMobile Polska 1.30.401.2 and Hboot is 0.90.0.0.
Now I have unbranded 1.30.401.2.

m3ritum said:
Sure, ROM was branded TMobile Polska 1.30.401.2 and Hboot is 0.90.0.0.
Now I have unbranded 1.30.401.2.
Click to expand...
Click to collapse
Hey there, I flashed my phone with
RUU_Marvel_Sasktel_Canada_WWE_1.58.669.2_Radio_47.10c.35.3030_7.47.36.19M_release_199460_signed
hoping it would be unlocked, but now it means I cannot use your method which I previously used. I think I'm stuck on this until a new ROM comes out.. D:
Just giving people a heads up so they don't hit a wall like I did, and hope you can create a work around THANKS!!
//Edit
The only way to fix this is to get S-OFF right? *Looks like I'm forking out the cash lol*

snowie72 said:
Hey there, I flashed my phone with
RUU_Marvel_Sasktel_Canada_WWE_1.58.669.2_Radio_47.10c.35.3030_7.47.36.19M_release_199460_signed
hoping it would be unlocked, but now it means I cannot use your method which I previously used. I think I'm stuck on this until a new ROM comes out.. D:
Just giving people a heads up so they don't hit a wall like I did, and hope you can create a work around THANKS!!
//Edit
The only way to fix this is to get S-OFF right? *Looks like I'm forking out the cash lol*
Click to expand...
Click to collapse
Ahh, the GingerBread exploit must have been patched in that ROM then. It's a double-edged sword really; if you were running a ROM that is unpatched a malicious app could take full control of your phone...
Having said that, it still might be possible to enter recovery mode and reflash without S-OFF, but I really haven't done much research and wouldn't know where to start

Its just a shame there is not much going on in this section compared to other phones, lol.
I'm just going to take it into to town and get it unlocked for cash on the weekend, then save for a Galaxy S2.

Does not work for me with Wildfire S HBoot 0.90 and European T-Com ROM 1.34.11.5

Hi!
I had the same 11th line as on picture - 9.0.0.0.
I put the tutorial values and a solutions works 4 me as well.
I don't remember ROM version but was branded for tmobile polska, and I'm sure that was never than 1.30.401.2. - something like 1.33.xxxx or even 1.35.xxxx
After all I tried a goldcard method - now works fine.
Many thanks for a solution!!

Chinese to european ROM
Hi
I'm trying to install the euro ROM (1.33...) using the goldcard metod in my Wildfire S but I get the downgrade error (now I'm running a 1.38... version and 0.90.0000 HBOOT).
Now I'm in China and I don't know why can't visit mediafire for download the zip with the files that I need for follow this tuto. Is there some alternative web for get this files?
Another question is if in the future will be a euro version newer than the chinese one that allow me to change the ROM without do the practice of this tuto.
I have not a lot of experience doing this, so it will be grat and easier for me
Thanks in advance!!

There's no way to tell if there will be a newer official HTC ROM > 1.38..., but if there is, you should be able to download without this tutorial.
I've re-uploaded the files to a few more filehosts, hopefully you can access at least one of them:
http://www.megaupload.com/?d=OKI8MVO1
http://depositfiles.com/en/files/fodci19ux
http://www.zshare.net/download/926497736bd36c1c/
http://uploading.com/files/9fa81218/tools.zip/
http://www.filesonic.com/file/1452304874/tools.zip
http://hotfile.com/dl/124169210/fc79b70/tools.zip.html

Thanks mphi!!
Yesterday was my first post. Im very lucky to enjoy this comunity

hi i get an error after part 11 i get access denied

Can't get root permissions
sammyke007 said:
I get:
./data/local/tmp/GingerBreak
[**] Gingerbreak/Honeybomb -- android 2.[2,3], 3.0 softbreak
[**] (C) 2010-2011 The Android Exploid Crew. All rights reserved.
[**] Kudos to jenzi, the #brownpants-party, the Open Source folks,
[**] Zynamics for ARM skills and Onkel Budi
[**] donate to [email protected] if you like
[**] Exploit may take a while!
[+] Plain Gingerbread mode!
[+] Found PT_DYNAMIC of size 232 (29 entries)
[+] Found GOT: 0x00014360
[+] Using device /devices/platform/goldfish_mmc.0
[*] vold: 0000 GOT start: 0x00014360 GOT end: 0x000143a0
And it stays there...
Click to expand...
Click to collapse
Same problem
I'm running HBOOT 0.90.0000 an my rom is 1.38.1400.5, official HTC chinese ROM

[Q] Help Rooting and using Gold card

Hello every one,
I have been meaning to root my phone and going through the forum but a bit confusing to me with the different methods that work for different builds etc.
Bellow is my phone specifications:
Desire HD unlocked but branded to VirginMedia UK.
HBoot 0.85.0024
S-ON RL
Radio 26.09.04.11.m2
Android ver. 2.3.3
Kernel Ver 2.6.35.10-g095637
Build number 2.36.351.16
When i run the adb command this is what i get.
I have been using my phone to create the gold card now i used a card reader, same problem. shown below
I followed all procedures to the letter. Used the hexeditor while the card was in my phone. Switched to charging mode to use the CMD etc. I used both 8GB and 16GB SANDISK card. Could that be a problem?
I have andriod SDK installed
Followed the steps form jkoljo thread.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Ace>cd c:\downgrade
c:\Downgrade>adb push misc_version /data/local/tmp
adb server is out of date. killing...
* daemon started successfully *
773 KB/s (15837 bytes in 0.020s)
c:\Downgrade>adb push GingerBreak /data/local/tmp
400 KB/s (16830 bytes in 0.041s)
c:\Downgrade>adb shell chmod 777 /data/local/tmp/misc_version
c:\Downgrade>adb shell chmod 777 /data/local/tmp/GingerBreak
c:\Downgrade>adb shell
$ ./data/local/tmp/GingerBreak
./data/local/tmp/GingerBreak
[**] Gingerbreak/Honeybomb -- android 2.[2,3], 3.0 softbreak
[**] (C) 2010-2011 The Android Exploid Crew. All rights reserved.
[**] Kudos to jenzi, the #brownpants-party, the Open Source folks,
[**] Zynamics for ARM skills and Onkel Budi
[**] donate to [email protected] if you like
[**] Exploit may take a while!
[+] Plain Gingerbread mode!
[+] Found system: 0xafd17fd5 strcmp: 0xafd38065
[+] Found PT_DYNAMIC of size 232 (29 entries)
[+] Found GOT: 0x00014360
[+] Using device /devices/platform/goldfish_mmc.0
[*] vold: 1225 GOT start: 0x00014360 GOT end: 0x000143a0
What could be wrong? I have run the cmd adb like 10 times same problem as shown above.
Thanks for the help
Kind regards.

Guide, Finally Rooted, Downgraded, S-Off, and Installed Custom Rom
I followed the guide lines from this tread. I think it has a new and updated downgrade files to make use of.
The thread is by CuBz90 [Guide] TEMP-ROOT ANY Gingerbread build and downgrade to 1.32.405.6 [Updated July 30]
1. You need to do a Temp ROOT.
The instructions are there, follow them carefully. Some how the procedure for rooting by jkoljo for my phone did not some how work, but never the less a good thread to go through.
Download the DHD Downgrade folder and follow the instruction, it is now made simple with out typing much into the command line. However for me i had to enter it manually, don't know why (Alternatively (If step 3 fails))
And after the scan i typed in "adb shell" into the command prompt.
That gave me the # key i now knew i was rooted.
2. You need to create a Gold Card. The instructions are clear on how to go about it.
Instructions for creating GOLDCARD are in the both threads i listed above, by CuBz90 and by jkoljo.
Copy the downgraded Rom on to your Gold card and follow the instructions in the section Downgrade by CuBz90 [Guide] TEMP-ROOT ANY Gingerbread build and downgrade to 1.32.405.6 [Updated July 30]
I think only one method of doing it. Not hard.
I used a 16GB sandisk card.
I did all the formatting of my card while it was in my handset and the editing. you could also use a card reader.
Some say u need to clean wipe format your phone before rooting etc. I did not do that on for my Desire HD.
3. Going by CuBz90 thread, Download and install Visionary+ to your Desire HD
There a videos on you-tube on the procedure, same as the instructions.
Once you have done the perm root. you are rooted.
4. You need to do S-Off before you install a custom Rom.
I tried to instal a custom Rom with S-on, it did not work.
Follow this link:
How to Radio S-Off & SimUnlock Your Desire HD - by jkoljo
Download the Easy Radio tool v2_2.zip from the link above by jkoljo
I just use the easy radio software and did the S-Off.
Then check if you are now S-off by booting into the boot-loader of your phone (power on holding down volume down. you will see S-off)
5. Continue with the The thread is by CuBz90 [Guide] TEMP-ROOT ANY Gingerbread build and downgrade to 1.32.405.6 [Updated July 30]
With the stage :"How to Flash recovery with ClockworkMod"
Install ClockworkMod on your phone and update it and follow the remaining instructions.
ClockworkMod Provides a boot screen where i can install my downloaded custom Rom. There are so many good custom Roms for the Desire HD, I tried the LeeDrOiD HD V3.3.1 GB Rom.
I hope this helps
ps if there are any errors or mistakes kindly point them out.

Need assistance downgrading 2.36

Hello,
My DHD is running 2.3.3 Gingerbread with 2.36.771.14 Build Number.
It's a branded phone so I followed THIS guide on creating a Goldcard which I have now done.
My next step was to follow THIS precisely however I end up with a few errors in the CMD. I've moved the PD98IMG.zip file into the root of the SD Card unextracted, I've extracted the Download_v2.zip into the C:\ Drive on my computer.
This is what I input into the CMD:
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\NAME>CD/
C:\>CD Downgrade
C:\Downgrade>adb push misc_version /data/local/tmp
adb server is out of date. killing...
* daemon started successfully *
1718 KB/s (15837 bytes in 0.009s)
C:\Downgrade>adb push GingerBreak /data/local/tmp
1369 KB/s (16830 bytes in 0.012s)
C:\Downgrade>adb shell chmod 777 /data/local/tmp/misc_version
C:\Downgrade>adb shell chmod 777 /data/local/tmp/GingerBreak
C:\Downgrade>adb shell
$ ./data/local/tmp/GingerBreak
./data/local/tmp/GingerBreak
[**] Gingerbreak/Honeybomb -- android 2.[2,3], 3.0 softbreak
[**] (C) 2010-2011 The Android Exploid Crew. All rights reserved.
[**] Kudos to jenzi, the #brownpants-party, the Open Source folks,
[**] Zynamics for ARM skills and Onkel Budi
[**] donate to [email protected] if you like
[**] Exploit may take a while!
[+] Plain Gingerbread mode!
[+] Found PT_DYNAMIC of size 232 (29 entries)
[+] Found GOT: 0x00014360
[+] Using device /devices/platform/goldfish_mmc.0
[*] vold: 0000 GOT start: 0x00014360 GOT end: 0x000143a0
I've searched for a few days on how to resolve this issue, the only solutions that I've seen is to retry making a Goldcard and perform a factory reset and follow the steps again. I've done both and yet I still receive this error, can anybody point me in the right direction?

Is this before or after you managed to downgrade using the goldcard?
If its after the downgrade to 2.36.405 or lower, use this...
http://driphter.com/index.php?topic=3867.0
You may not have to downgrade as Gingerbreak should work with your v2.36 as well (as its just the carrier modded 2.36. The .771 signifies the vendor's id#)
eg: Telus = 661, hence all telus builds are .661.x

Hi there thank you for your quick response,
I have not yet managed to downgrade at all, that is where my problem lies.
- I will try that guide out and let you know the result.

I followed that guide, however the RUU gives me an error:
"ERROR [140]: BOOTLOADER VERSION ERROR
The ROM Update Utility cannot update your Android Phone.
Please get the correct ROM Update Utility and try again."

TheRealKeyboardWarrior said:
I followed that guide, however the RUU gives me an error:
"ERROR [140]: BOOTLOADER VERSION ERROR
The ROM Update Utility cannot update your Android Phone.
Please get the correct ROM Update Utility and try again."
Click to expand...
Click to collapse
You're going to need to use the goldcard to downgrade first then, then you'll be able to root only after downgrading.
(Try this method: http://forum.xda-developers.com/showthread.php?t=1152233&page=7 to DOWNGRADE ONLY!)

That guide is for 2.37, I'm on 2.36.771.114 Build.

TheRealKeyboardWarrior said:
That guide is for 2.37, I'm on 2.36.771.114 Build.
Click to expand...
Click to collapse
it should still work. Either the bootloader will bypass the update to 2.37, or it will take. If it takes, then you can downgrade to 1.32 and root your device. If it doesnt, then it doesnt and you're still on 2.36.771.
So its either a win situation, or a loss of 10 minutes. lol

JSLEnterprises said:
it should still work. Either the bootloader will bypass the update to 2.37, or it will take. If it takes, then you can downgrade to 1.32 and root your device. If it doesnt, then it doesnt and you're still on 2.36.771.
Click to expand...
Click to collapse
Great, I'm halfway through the process as we speak. Thank you for your consistent help so far.

JSLEnterprises said:
it should still work. Either the bootloader will bypass the update to 2.37, or it will take. If it takes, then you can downgrade to 1.32 and root your device. If it doesnt, then it doesnt and you're still on 2.36.771.
So its either a win situation, or a loss of 10 minutes. lol
Click to expand...
Click to collapse
I am now rooted and have Radio-off. I will be flashing LeeRoid later today, thank you very much for all your help

N.P.
Recommendation: use the 2.36.405.8 ruu to update to that version and root it (unless you want to update your raidio using fastboot and shell commands)

[S-ON][TUTORIAL] Downgrade from a ROM Hboot 1.03 to a ROM Hboot 0.9

Firts before all, I WILL NOT BE RESPONSABLE IF YOU'VE GOT ANY PROBLEM FOLLOWING THESE STEPS.
What to learn in this tut ?
- GAIN FULL ROOT ACCESS IN ADB SHELL easily, thanks to zergRush
- DOWNGRADE from a ROM compatible HBOOT 1.03 to a ROM compatible HBOOT 0.9 (and consequently avoid RUU Output Errors)
Thanks to mphi tuto, aparici help and zergRush I managed to do it whereas with other techniques it doesn't work.
Techniques not working to downgrade :
Installing a modified PG76IMG.ZIP (version has been modified to be after my current ROM version, modifying android-info.txt) with GoldCard and Bootloader Install
--> Bootloader loads and checks the zip on your goldcard, but after finishing to check it goes back to bootloader menu
Installing with the RUU by replacing the rom.zip in temp folder. I extracted rom.zip content then change version in android-info.txt, then recompress a new zip and replace the other by the new one.
--> Signature Version Error even if the ROM version is changed…
I guess it doesn't work because the phone is not rooted and S-OFF.
Working downgrade steps :
Download HTC Sync USB Drivers and the tools you will need here, including zergRush (found here) : http://www.mediafire.com/?z2l7n2gxznz6276
Download the HTC Official ROM which is hboot 0.9 here : http://www.filefactory.com/file/cbb...35.3029H_7.46.35.08_release_183799_signed.exe
Back up your phone data on a SD card or something else
Shut down your phone then insert GoldCard in it and power on (Creating a goldcard http://forum.xda-developers.com/showthread.php?t=954723)
Connect your phone to your computer via USB and select HTC Sync mode (also verify USB debugging is enabled).
Extract the tools at the root of your computer (example c:\tools)
Run Windows CMD and move to the tools folder, then execute these commands
Put the tool on your sd_card
Code:
adb push flash_image /sdcard/flash_image
Add zergRush to your phone
Code:
adb push zergRush /data/local/zergRush
Enter interactive shell mode
Code:
adb shell
Launch zergRush
Code:
chmod 755 /data/local/zergRush
/data/local/zergRush
The resulting output should be like this :
Code:
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00017118
Sending 149 zerglings ...[ * ] Trying a new path ...[ * ] Sending 149 zerglings ...[ * ] Trying a new path ...[ * ] Sending 149 zerglings ...[ * ] Trying a new path ...[ * ] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219c4 0x0054[ * ] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd260a9 0xafd39f9f[ *] Poping 24 more zerglings[ * ] Sending 173 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root..enjoy!
Kudos you're root !! you can even exit adb, you still will be root as long as your phone is connected via usb
.
Now execute those commands :
Code:
cat /dev/mtd/mtd0 > /sdcard/misc.img
cat /sdcard/flash_image > /data/flash_image
chmod 777 /data/flash_image
exit
Once you've exit from adb shell type this :
Code:
adb pull /sdcard/misc.img misc.img
Now the misc.img is in your tools folder. Run HxD.exe and select OK when prompted.
Open misc.img in the current directory, and change line 11 which contains the version number of your current ROM. Change it by number of the future ROM you want to install.
Changes will appear in red. Save the file to misc2.img.
Copy the img t the SDCard using this command :
Code:
adb push misc2.img /sdcard/misc2.img

Return to the shell where you're root
Code:
adb shell
/data/flash_image misc /sdcard/misc2.img
After this, run the RUU installer and let it do its work !
You should have succeed
Please send me your hboot version and your before and after configuration of roms before and after the downgrade or upgrade following this tutorial if you succeed in it !
Experimentations :
Being root in adb allows you to do things like those who are S-OFF. If you tried something, inform me by PM for me to add informations to this part of the tuto.
Before and after configs Working:
- ROM 1.48.118.0 T-mobile Poland TO ROM 1.33.401.2 StockWWE, HBOOT 1.03, S-ON, CID: T-MOB009
- ROM 1.64.192.1 Vodafone FR TO ROM 1.30.401 Official HTC Rom, HBOOT 1.03 S-ON
- ROM T-Mobile NL rom TO ROM 1.30.401 Official HTC Rom
It seems to be not working on T-Mob USA phones, take care following steps
Special Thanks :
mphi for his tuto, aparici for his help, revolutionary for their local root
----------
Hope it will help ! Let me know how it's going for you !
Please click Thanks if you find the post useful

Great tut you should put [S-ON] in the topic title.
emveefr said:
Experimentations :
Being root in adb allows you to do things like those who are S-OFF. If you tried something, inform me by PM for me to add informations to this part of the tuto.
Click to expand...
Click to collapse
What are the differences between adb root and permanent root? Any disadvantages?
(also, think this topic should be pinned)

Doesn't work for me.
Root is fine, flash edited misc is fine.
When try to flash 1.30.401.0 via RUU I get ERROR [131]: CUSTOMER ID ERROR
my phone: hboot 1.03, S-ON, cid: T-MOB009

*se-nsei. said:
Great tut you should put [S-ON] in the topic title.
What are the differences between adb root and permanent root? Any disadvantages?
(also, think this topic should be pinned)
Click to expand...
Click to collapse
That's done . I don't know how it could be pinned ?
I think there are no differences between them except permanent or temporary effect on the phone lol.
BTW thanks for your reply, happy that it helps !
slavislavi said:
Doesn't work for me.
Root is fine, flash edited misc is fine.
When try to flash 1.30.401.0 via RUU I get ERROR [131]: CUSTOMER ID ERROR
my phone: hboot 1.03, S-ON, cid: T-MOB009
Click to expand...
Click to collapse
I've never met this error, but be sure to do all the steps carefully. I do them 2 times before it works (so first time, there was an error !).
I think the operation I missed was this one : adb push flash_image /sdcard/flash_image. Which is really important !
Repeat operations, be sure of what you do and if it doesn't work I hope we could find the fix for you !
Edit : check your Goldcard, there are lot of possibilites that error is caused by this one :
- GoldCard not in the device (you're not noob like this I guess xD)
- Bad manipulation while creating Goldcard
- Change the brand of your SD Card, try Kingston one which is perfect for it

emveefr said:
but be sure to do all the steps carefully. I do them 2 times before it works (so first time, there was an error !).
Click to expand...
Click to collapse
I tried several times, each time without error.
I also tried to change the CID in misc.img but also no effect yet.

The tutorial is nothing short of genius my friend. I am sure this will help all S-ON users to gain a temporary root and flash their ROM of choice. Cheers mate!

slavislavi said:
I tried several times, each time without error.
I also tried to change the CID in misc.img but also no effect for now.
Click to expand...
Click to collapse
Check your goldcard like I said in the edit.
hardikrajgor123 said:
The tutorial is nothing short of genius my friend. I am sure this will help all S-ON users to gain a temporary root and flash their ROM of choice. Cheers mate!
Click to expand...
Click to collapse
Thanks dude ! Yes that's why I thought it would be helpful for other people who are beginners like me and who wants to flash the ROM !
The key to succeed for noobs : Read, read, read, and re-read HTC dev forums

emveefr said:
Check your goldcard like I said in the edit.
Click to expand...
Click to collapse
Success!!
The problem was in s...ty Goodram memory card (in trash now).
Thank you!
now StockWWE 1.33.401.2, S-ON, HBOOT 1.03

slavislavi said:
Success!!
The problem was in s...ty Goodram memory card (in trash now).
Thank you!
now StockWWE 1.33.401.2, S-ON, HBOOT 1.03
Click to expand...
Click to collapse
did you have a tmobile usa wildfire s ?

Hello,
I tried to do everything as you said in tutorial but I'm so unexperienced in rooting etc. so I failed.
I think I made a goldcard, and I moved to correct folder while being in CMD but after writing "adb push flash_image /sdcard/flash_image" I saw that:1584 KB/s (0 bytes in 76044.000s)> I think it's not good. After typing the second comment "adb push zergRush /data/local/zergRush" I saw "cannot stat 'zergRush': No such file or directory".
What am I doing wrong?
I'm sorry for my bad english.

tyrone1 said:
did you have a tmobile usa wildfire s ?
Click to expand...
Click to collapse
T-Mobile Poland. CID is still T-MOB009

So let me get this right.
We now have a method of rooting the WFS and having the ability to flash a new rom on to it?

imlgl said:
So let me get this right.
We now have a method of rooting the WFS and having the ability to flash a new rom on to it?
Click to expand...
Click to collapse
Yes and no. We can install custom roms yes, but it's not permanent root it's only through adb shell and it's only tested working so far from actual operator roms first (t-mobile, vodafone) not sure if it works from generic stock down.

*se-nsei. said:
Yes and no. We can install custom roms yes, but it's not permanent root it's only through adb shell and it's only tested working so far from actual operator roms first (t-mobile, vodafone) not sure if it works from generic stock down.
Click to expand...
Click to collapse
Well at least it's something. It can only progress from here. Feels lonely being in the S-off club

emveefr said:
Firts before all, I WILL NOT BE RESPONSABLE IF YOU'VE GOT ANY PROBLEM FOLLOWING THESE STEPS.
What to learn in this tut ?
- GAIN FULL ROOT ACCESS IN ADB SHELL easily, thanks to zergRush
- DOWNGRADE from a ROM compatible HBOOT 1.03 to a ROM compatible HBOOT 0.9 (and consequently avoid RUU Output Errors)
Thanks to mphi tuto, aparici help and zergRush I managed to do it whereas with other techniques it doesn't work.
Techniques not working to downgrade :
Installing a modified PG76IMG.ZIP (version has been modified to be after my current ROM version, modifying android-info.txt) with GoldCard and Bootloader Install
--> Bootloader loads and checks the zip on your goldcard, but after finishing to check it goes back to bootloader menu
Installing with the RUU by replacing the rom.zip in temp folder. I extracted rom.zip content then change version in android-info.txt, then recompress a new zip and replace the other by the new one.
--> Signature Version Error even if the ROM version is changed…
I guess it doesn't work because the phone is not rooted and S-OFF.
Working downgrade steps :
Download HTC Sync USB Drivers and the tools you will need here : http://mediafire.com/?wxf6y4yq6d6nc8d
Download the HTC Official ROM which is hboot 0.9 here : http://www.filefactory.com/file/cbb...35.3029H_7.46.35.08_release_183799_signed.exe
Back up your phone data on a SD card or something else
Shut down your phone then insert GoldCard in it and power on (Creating a goldcard http://forum.xda-developers.com/showthread.php?t=954723)
Connect your phone to your computer via USB and select HTC Sync mode (also verify USB debugging is enabled).
Extract the tools at the root of your computer (example c:\tools)
Run Windows CMD and move to the tools folder, then execute these commands
Put the tool on your sd_card
Code:
adb push flash_image /sdcard/flash_image
Add zergRush to your phone
Code:
adb push zergRush /data/local/zergRush
Enter interactive shell mode
Code:
adb shell
Launch zergRush
Code:
chmod 755 /data/local/zergRush
/data/local/zergRush
The resulting output should be like this :
Code:
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00017118
Sending 149 zerglings ...[ * ] Trying a new path ...[ * ] Sending 149 zerglings ...[ * ] Trying a new path ...[ * ] Sending 149 zerglings ...[ * ] Trying a new path ...[ * ] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219c4 0x0054[ * ] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd260a9 0xafd39f9f[ *] Poping 24 more zerglings[ * ] Sending 173 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root..enjoy!
Kudos you're root !! you can even exit adb, you still will be root as long as your phone is connected via usb
.
Now execute those commands :
Code:
cat /dev/mtd/mtd0 > /sdcard/misc.img
cat /sdcard/flash_image > /data/flash_image
chmod 777 /data/flash_image
exit
Once you've exit from adb shell type this :
Code:
adb pull /sdcard/misc.img misc.img
Now the misc.img is in your tools folder. Run HxD.exe and select OK when prompted.
Open misc.img in the current directory, and change line 11 which contains the version number of your current ROM. Change it by number of the future ROM you want to install.
Changes will appear in red. Save the file to misc2.img.
Copy the img t the SDCard using this command :
Code:
adb push misc2.img /sdcard/misc2.img

Return to the shell where you're root
Code:
adb shell
/data/flash_image misc /sdcard/misc2.img
After this, run the RUU installer and let it do its work !
You should have succeed
Experimentations :
Being root in adb allows you to do things like those who are S-OFF. If you tried something, inform me by PM for me to add informations to this part of the tuto.
Working on :
- RUU_Marvel_Vodafone_FR_LPM_1.64.192.1_Radio_47.10c .35.3030_7.47.36.19M_release_203694_signed + Hboot 1.03
Special Thanks :
mphi for his tuto, aparici for his help, revolutionary for their local root
----------
Hope it will help ! Let me know how it's going for you !
Please click Thanks if you find the post useful
Click to expand...
Click to collapse
Good job on the tutorial emveefr, I am almost certain my problem is gonna be goldcard related, I'll get a new microsd in the morning thanks alot.

So if can get adb root can't you just go into current rom with adb and delete certain apps out of the /system/app folder????
i'm sorta a newbie at all this kinda stuff...
i got zergRush to go... then it restarted adb root which is indicated by # instead of $ correct?
But once in there i couldnt rm any of the .apk in /system/app
or any ideas which rom would be compatible with Tmobile USA wildfire s ???
build 1.62.531.3
thanks in advanced..

slavislavi said:
Success!!
The problem was in s...ty Goodram memory card (in trash now).
Thank you!
now StockWWE 1.33.401.2, S-ON, HBOOT 1.03
Click to expand...
Click to collapse
No problem man, I told you there was a mistake somewhere ^^
Could you tell us your before and after configurations please ?

filip88888888 said:
Hello,
I tried to do everything as you said in tutorial but I'm so unexperienced in rooting etc. so I failed.
I think I made a goldcard, and I moved to correct folder while being in CMD but after writing "adb push flash_image /sdcard/flash_image" I saw that:1584 KB/s (0 bytes in 76044.000s)> I think it's not good. After typing the second comment "adb push zergRush /data/local/zergRush" I saw "cannot stat 'zergRush': No such file or directory".
What am I doing wrong?
I'm sorry for my bad english.
Click to expand...
Click to collapse
You know I was so inexperienced like you a few days ago. Like I said previously, read, read and read on forums to understand what you are doing.
How do you want to succeed if you don't understand the whole part ? It's not about copying the lines I put here, understand them and you will know what to do .
BTW about your errors, transfert is not good and it cannot find zergRush because something is going wrong somewhere in your files and folders I guess.
If other users can do it themselves and succeed, just give it a try later and be patient while learning !
PS : You know I'm french and I will not criticize you on your english speaking ^^

meanmug said:
Good job on the tutorial emveefr, I am almost certain my problem is gonna be goldcard related, I'll get a new microsd in the morning thanks alot.
Click to expand...
Click to collapse
Thanks dude . Tell us if you succeed and post your config !
tyrone1 said:
So if can get adb root can't you just go into current rom with adb and delete certain apps out of the /system/app folder????
i'm sorta a newbie at all this kinda stuff...
i got zergRush to go... then it restarted adb root which is indicated by # instead of $ correct?
But once in there i couldnt rm any of the .apk in /system/app
or any ideas which rom would be compatible with Tmobile USA wildfire s ???
build 1.62.531.3
thanks in advanced..
Click to expand...
Click to collapse
Yes root is indicated by # in the shell. What does it say when you want to remove apk ?
About your rom sorry I don't know.

I'm sure I was doing something wrong but like I would go into /system/app/ and type rm Stock.apk
It would say directory not empty.
Can you help me how to do it step by step. I believe needs to me mounted rw.. I not familiar with the exact commands.
Thanks.
Sent from my HTC Wildfire S using Tapatalk

[TUTORIAL] Downgrade Desire Hboot 1.03

Hi,
If You want to downgrade Desire Hboot 1.03, then using revolutionary to s-off, please follow the instructions .
Steps:
1. Download tools package (attached files)
2. Download this HTC Official ROM (RUU)
3. For branded phones create GoldCard.
4. Extract the tools any where at your computer.
5. Run RUU and wait to appear Android rom update utility screen.
6. Go to Temp directory on C drive on your computer and find folder that RUU extracted in it.
7. Copy the rom.zip and paste it to sdcard and rename it to PB99IMG.zip
8. Connect your phone to computer via USB as charge only and enable USB debugging and Unknown Sources.
9. Run cmd.exe on tools folder that you download and extracted it and Execute these commands:
7.
Code:
adb push flash_image /sdcard/flash_image
8.
Code:
adb push zergRush /data/local/zergRush
9.
Code:
adb shell
10.
Code:
chmod 755 /data/local/zergRush
/data/local/zergRush
Output on cmd should be like :
Code:
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00017118
Sending 149 zerglings ...[ * ] Trying a new path ...[ * ] Sending 149 zerglings ...[ * ] Trying a new path ...[ * ] Sending 149 zerglings ...[ * ] Trying a new path ...[ * ] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219c4 0x0054[ * ] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd260a9 0xafd39f9f[ *] Poping 24 more zerglings[ * ] Sending 173 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root..enjoy!
11.
Code:
cat /dev/mtd/mtd0 > /sdcard/misc.img
12.
Code:
cat /sdcard/flash_image > /data/flash_image
13.
Code:
chmod 777 /data/flash_image
14.
Code:
exit
15.
Code:
adb pull /sdcard/misc.img misc.img
16. Now the misc.img is in your tools folder. Run HxD.exe and select OK when prompted.
17. Open misc.img in the current directory, and change line 11 which contains the version number of your current ROM. Change it by number of the future ROM you want to install(Find at Android rom update utility screen after run RUU)
Changes will appear in red. Save the file to misc0.img.
16.
Code:
adb push misc0.img /sdcard/misc0.img

17.
Code:
adb shell
/data/flash_image misc /sdcard/misc0.img
18. Reset phone and press vol-down to go to Bootloader.
19. Wait for detect and check the Update Package.
20. After checking package, press vol-up to begin update process, IN FIRST TIME AFTER PRESSING VOL-UP YOUR PHONE WILL RESET AND DO NOTHING, YOU SHOULD DO AGAIN FOR STEPS 18,19,20.
Notes
The process will flash your recovery partition back to stock
This process will wipe all the data from your phone
The downgrade installs an official stock HTC ROM with Hboot1.02 (You can s-off with revolutionary and after it You can flash any version of Hboot)
Your sdcard should be fat32 formatted
Creating a goldcard
Thanks
emveefr
IF YOU CAN NOT DOWNGRADE HBOOT,WITH THIS TUTORIAL, PLEASE READE THIS POST

Neat, I'll link this on my guide. I'm sure it'll be very useful to some.

After step 10 pc can't find phone and screen never turn off... Current rom is Stock pre-rooted Gingerbread, non-branded

mikele020794 said:
After step 10 pc can't find phone and screen never turn off... Current rom is Stock pre-rooted Gingerbread, non-branded
Click to expand...
Click to collapse
Hi, please read and do the end of post #1

netmsm said:
Hi, please read and do the end of post #1
Click to expand...
Click to collapse
Hi, after official unlocking I cant flash any stock rom =( I tried to use teppic's downgrader before...

mikele020794 said:
Hi, after official unlocking I cant flash any stock rom =( I tried to use teppic's downgrader before...
Click to expand...
Click to collapse
Hi, dont worry
Please :
1. Do full wipe
2. Do instructions in second way (bottom of the post #1, in red color)

5. Run RUU and wait to appear Android rom update utility screen.
6. Go to Temp directory on C drive on your computer and find folder that RUU extracted in it.
Can't find the file in step 6?

Kurt45 said:
5. Run RUU and wait to appear Android rom update utility screen.
6. Go to Temp directory on C drive on your computer and find folder that RUU extracted in it.
Can't find the file in step 6?
Click to expand...
Click to collapse
Hi,
On temp directory at C drive, please search "adb.exe" or "rom.zip"

bortak said:
Neat, I'll link this on my guide. I'm sure it'll be very useful to some.
Click to expand...
Click to collapse
offer, for you My friend

I have tried it on a phone with the HTC official unlock but it stop working on step 11.

Kurt45 said:
I have tried it on a phone with the HTC official unlock but it stop working on step 11.
Click to expand...
Click to collapse
Hi, Yes It might be occur for some roms and V2 post For resolving this problem.
You should do full wipe and follow steps on V2.

I tried also this, since the V2 report a virus in the zip.
But when I execute the first command I receive back this:
Code:
adb push flash_image /sdcard/flash_image
1584 KB/s (0 bytes in 76044.000s)
Is normal? why do this?

corno77 said:
I tried also this, since the V2 report a virus in the zip.
But when I execute the first command I receive back this:
Code:
adb push flash_image /sdcard/flash_image
1584 KB/s (0 bytes in 76044.000s)
Is normal? why do this?
Click to expand...
Click to collapse
Sorry.... now everything is working! using V2 solution!

corno77 said:
Sorry.... now everything is working! using V2 solution!
Click to expand...
Click to collapse
Hi my friend
Is Your problem solved ?

Issue with DOWNGRADER
" You must wait about one minute before continuing.
Press any key to continue...
* daemon not running. starting it now *
* daemon started successfully *
Testing access: FAILED - please exit and try again. "
What should I do now, should I try with the alternative tutorial ?
---------- Post added at 07:00 PM ---------- Previous post was at 06:14 PM ----------
After entering the code at step 11 it shows up:
" The system cannot find message text for message number 0x3 in the message file for System. "
Also, can't continue with the other steps without makin this one. HELP!

Hi all
after flash hboot jellybean but now can't flash stock hboot
when I want flash stock hboot error you can't back hboot
please help me

I'm trying to run this tutorial so I can downgrade hboot and then run revolutionary for root/s-off. I get stuck at step 11. Says "The system cannot find the path specified." Anyone got any idea how I could get past this?

Same here! Pls help!

Many thanks for such detailed tutorial, but I am having problems.
First of all when I click on the RUU link I am presented with a download that doesn't work and just cycles through a bunch of adverts. Fair enough, I managed to get to the real link anyway, but the file is not an RUU.EXE but it is HTC_Desire_Android_2.3_Upgrade.zip. Using this file I cannot find which rom version it is and cannot therefore patch it with the correct version in step 17, but I never got to that point.
I created apparently successfully a goldcard and used it for the rest of the procedure, hope this is ok. Steps 7 to 10 seemed to be successful also although the output was not quite like on your tutorial. I got
$ chmod 755 /data/local/zergRush
chmod 755 /data/local/zergRush
$ /data/local/zergRush
/data/local/zergRush
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a Froyo ! 0x00000108
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[+] Overseer found a path ! 0x000150e8
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219e4 0x006c
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd158bf 0xafd1ace3
[*] Sending 149 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!
The trouble started with step 11. The phone did not restart as root by itself. So I switched it off and pressed volume down and power to force it into root. Then I typed the command. This didn't work as cat is not a DOS command nor was it in the unzipped directory.
What is this cat command? How am I supposed to use it? I AM STUCK, HELP PLEASE.

marco_bruzzone said:
Many thanks for such detailed tutorial, but I am having problems.
First of all when I click on the RUU link I am presented with a download that doesn't work and just cycles through a bunch of adverts. Fair enough, I managed to get to the real link anyway, but the file is not an RUU.EXE but it is HTC_Desire_Android_2.3_Upgrade.zip. Using this file I cannot find which rom version it is and cannot therefore patch it with the correct version in step 17, but I never got to that point.
I created apparently successfully a goldcard and used it for the rest of the procedure, hope this is ok. Steps 7 to 10 seemed to be successful also although the output was not quite like on your tutorial. I got
$ chmod 755 /data/local/zergRush
chmod 755 /data/local/zergRush
$ /data/local/zergRush
/data/local/zergRush
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a Froyo ! 0x00000108
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[+] Overseer found a path ! 0x000150e8
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219e4 0x006c
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd158bf 0xafd1ace3
[*] Sending 149 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!
The trouble started with step 11. The phone did not restart as root by itself. So I switched it off and pressed volume down and power to force it into root. Then I typed the command. This didn't work as cat is not a DOS command nor was it in the unzipped directory.
What is this cat command? How am I supposed to use it? I AM STUCK, HELP PLEASE.
Click to expand...
Click to collapse
Why don't you extract the zip and check if there is an ruu inside it then run it to update to gb and it should change hboot?
Sent from my HTC Desire S using XDA Free mobile app