This thread is copied and modified from the G2 thread by trigeek for the Desire Z:
http://forum.xda-developers.com/showthread.php?t=834228
Apart from the changed hboot and wpthis-Z kernel module for the Desire Z instead of the G2, I have also updated the su-binary and SuperUser.apk to the latest version by ChainsDD
In no way I can be held responsible for any bricks to your phone. You are using this guide at your own risk!! I did test this guide on my own, and also on a friend's Desire Z.
As there was no manual rooting guide for the Desire Z, I posted it myself in order to help others that do not like visionary and like to do it 'the clean way'.
[GUIDE] Temp to permanent root on Desire Z, using rage instead of visionary
=================================================
There's already a guide here for obtaining permanent root using VISIONary, but some folks in #G2ROOT are having issues with the way that VISIONary modifies parititons. Using rage directly is a bit cleaner, since you know exactly what it's going to touch at each step of the way. I did NOT come up with any of this on my own, I'm building completely off of work that others have done. Speaking of which-
None of this would be possible without the tireless work that scotty2 put in. He stayed with the project for well over a month, through lots of smashed hopes and dead ends, until the solution was finally found. Were it not for his work, as well as the help of a few other key folks- we wouldn't be here. He deserves our thanks and some donations! We're talking hundreds of hours of work here, a couple bucks is not too much for that. His paypal is:
[email protected]
Send him some love! I'm not asking for anything myself, because I spent a half hour putting this together, and that doesn't deserve any donations!
DESIRE Z ROOT INSTRUCTIONS
=================================================
These are modified instructions based on the ones posted at http://bit.ly/g2root that use Visionary. A number of people have run into issues with the way that Visionary juggles around temporary partitions, and using the original root exploit is a much easier, and cleaner method for achieving permanent root. This tutorial will walk you through the rooting process by first achieving temporary root, and moving on to permanent root.
REQUIREMENTS
=================================================
•Visionary disabled at boot or uninstalled completely
•Android Terminal Emulator app
•ADB
•desirez-combined-root.zip (Attached to this post)
In the commands to run below, $ or # represent the prompt and should NOT be entered as part of the commands.
VERY IMPORTANT!
Visionary has caused filesystem corruption for some users during the rooting process. Before attempting the instructions below, make sure that you have "auto run on boot" turned OFF, and reboot your system. Since you will not need visionary anyway after this, you might as well just uninstall visionary and reboot NOW before doing anything.
TEMP ROOT
=================================================
ON YOUR PC:
Unzip the z-temp-root files to a folder. From a cmd window or terminal, navigate to that folder and execute these commands:
Code:
$ adb push su /sdcard/su
$ adb push Superuser.apk /sdcard/Superuser.apk
$ adb push rage /data/local/tmp/rage
$ adb push busybox /data/local/tmp/busybox
$ adb push root /data/local/tmp/root
$ adb shell chmod 0755 /data/local/tmp/*
ON YOUR PHONE:
1.Launch Terminal Emulator
2.
Code:
/data/local/tmp/rage
3.Wait for the message: "Forked #### childs."
4.Menu > Reset Term - Terminal Emulator will exit.
5.Launch Terminal Emulator, it Force Closes. Launch a second time, and you'll have a root shell
6.**NOTE**: in the original directions from the XDA thread, you are instructed to run the /data/local/tmp/root script here. DON'T do this just yet. Leave the terminal window open.
PERM ROOT
=================================================
ON YOUR PC:
unzip z-perm-root and navigate to that folder. There will be four files. You will need to push two of these to your phone: hboot_7230_0.84.2000_100908.nb0 and wpthis-Z.ko. The other two files are optional for checksum verification.
Code:
$ adb push hboot_7230_0.84.2000_100908.nb0 /data/local
$ adb push wpthis-Z.ko /data/local
Optional but might came in handy:
Code:
$ adb push md5checksum /sdcard/md5checksum
ON YOUR PHONE:
You should still have terminal emulator up, at a root prompt. Now run:
Optional but recommended:
Code:
# /data/local/tmp/busybox md5sum /data/local/*
You should see:
hboot_7230_0.84.2000_100908.nb0 2ce1bdd5e4c1119ccfcecb938710d742
wpthis-Z.ko c73c5e77c91d306c418983c002b60b93
In case your hboot or wpthis-Z.ko file do not have the same md5hash as shown above, DO NOT CONTINUE. This means your file is corrupt or you are using a different file, for example the one for the G2 instead of Desire Z.
Now, let's turn off security for permanent flashing:
Code:
# insmod /data/local/wpthis-Z.ko
init_module 'wpthis-Z.ko' failed (Function not implemented)
That means it worked. This next step is CRUCIAL. You must make sure that you are writing to the proper partition here or you could brick your phone. To be absolutely clear- the partition is mmcblk(zero)p(one)(eight)
# dd if=/data/local/hboot_7230_0.84.2000_100908.nb0 of=/dev/block/mmcblk0p18
Click to expand...
Click to collapse
You should see some messages indicating that it was written.
Code:
# /data/local/tmp/root
This will lock in root, and give you 'su' access in the future. Next, run:
Code:
# sync
Now wait at least a minute, just to be safe. After waiting, reboot your phone using the power button. After it finishes starting up, launch the terminal emulator, and type 'su'. You should get the prompt asking you to grant permissions. If you got the prompt, congratulations! You have permanent root!
Nice guide, thanks
Thank you Mr Q. works like a charm!
first of all.. thanks for this great guide. Everything went perfect until I came to the step to lock in root. After the command "/data/local/tmp/root" I get this error:
mkdir failed for /system/xbin, File exists
when I just ignore it and type sync after that I have no root acces after a reboot.
Does anybody have a solution for it? I have already done a hardreset with the same results.
thanks in advance...
So this only roots your phone? Or does it s-off as well? From what I understand this s-offs as well because you're pushing the hboot as well.
EDIT: Nevermind. I read the thread again and it does indeed s-off as well.
MarDor said:
first of all.. thanks for this great guide. Everything went perfect until I came to the step to lock in root. After the command "/data/local/tmp/root" I get this error:
mkdir failed for /system/xbin, File exists
when I just ignore it and type sync after that I have no root acces after a reboot.
Does anybody have a solution for it? I have already done a hardreset with the same results.
thanks in advance...
Click to expand...
Click to collapse
Everything was fine up until this point. So i restarted the phone and phone is stuck on the "quietly brilliant" screen
ssyed said:
Everything was fine up until this point. So i restarted the phone and phone is stuck on the "quietly brilliant" screen
Click to expand...
Click to collapse
having the same issue here
So I'm looking into these S-OFF and rooting threads and here is two bricks too. Does anyone have an answer for these two or should I skip this? Did the hboot do this or was it due to some problem in inserted kernel module? (I.E. the reboot of the emmc controller resulted in a ****ed up file system?)
yelti said:
having the same issue here
Click to expand...
Click to collapse
AnyDone said:
So I'm looking into these S-OFF and rooting threads and here is two bricks too. Does anyone have an answer for these two or should I skip this? Did the hboot do this or was it due to some problem in inserted kernel module? (I.E. the reboot of the emmc controller resulted in a ****ed up file system?)
Click to expand...
Click to collapse
Ok, so I have figured out how to get out of this "quietly brilliant" loop.
First of all, this isn't a brick and all that is needed to fix this is a quick factory reset from the bootloader.
ssyed said:
First of all, this isn't a brick and all that is needed to fix this is a quick factory reset from the bootloader.
Click to expand...
Click to collapse
Ok, so does any one have an explanation why this happened?
1. It wasn't wrong or screwed hboot, otherwise we would be facing a real brick?
Was it the root method? Was it the wpthis-Z.ko?
It might have been the kernel module, but I can't be sure about that with so little knowledge I have. (sure not the module itself but the kick to the emmc?) Just that it seems to be more likely option than a rooting attempt on a cached r-o file system?
I'm not complaining about the guide, it is specific and easy to follow but I would really love to have these semi bricks etc inspected more closely. It is not really helping to encourage ppl to root and try safe-off when we have unexplained bricks and semi-bricks around
MarDor said:
first of all.. thanks for this great guide. Everything went perfect until I came to the step to lock in root. After the command "/data/local/tmp/root" I get this error:
mkdir failed for /system/xbin, File exists
Click to expand...
Click to collapse
ssyed said:
Everything was fine up until this point. So i restarted the phone and phone is stuck on the "quietly brilliant" screen
Click to expand...
Click to collapse
yelti said:
having the same issue here
Click to expand...
Click to collapse
Did you guys run Visionary before trying this "rage" method of rooting ?
steviewevie said:
Did you guys run Visionary before trying this "rage" method of rooting ?
Click to expand...
Click to collapse
I don't know about others, but I didn't on mine. I was rooting it for the first time. Also, I don't know if this has anything to do with it, but I have the Bell version from Canada.
The root script threw an error for me too, so just to be safe I opened the script and typed in the commands manually. If you have problems with the script, just run these commands from the root terminal on your phone:
Code:
/data/local/tmp/busybox killall rage
mount -o rw,remount -t ext3 /dev/block/mmcblk0p25 /system
mkdir /system/xbin
/data/local/tmp/busybox cp /data/local/tmp/busybox /system/xbin/busybox
chmod 4755 /system/xbin/busybox
/system/xbin/busybox --install -s /system/bin
cp /sdcard/Superuser.apk /system/app/Superuser.apk
cp /sdcard/su /system/bin/su
chmod 4755 /system/bin/su
mount -o ro,remount -t ext3 /dev/block/mmcblk0p25 /system
sync
"mkdir /system/xbin" just creates a directory, if it already exists you can ignore this command and proceed.
Hope this helps someone.. Thanks to the OP for the scripts.
Have a quick look, /system/xbin already seems to exist on my phone too.
So is there an error in the script ? e.g. needs to ignore if the directory already exists ? Or am I (we ?) missing something ?
goldenarmZ said:
"mkdir /system/xbin" just creates a directory, if it already exists you can ignore this command and proceed.
Click to expand...
Click to collapse
Good info, thanks. Perhaps just comment out that line of the script, to save running it all by hand (and therefore be prone to more error ?) ?
steviewevie said:
Good info, thanks. Perhaps just comment out that line of the script, to save running it all by hand (and therefore be prone to more error ?) ?
Click to expand...
Click to collapse
I did that first.. it threw more errors with the mount commands because I'd already run the script once, so some of the commands were repated. If it's your first run through, commenting it out would be fine.
I only did it line by line so I could see any more errors for myself and decide if they were important. As it turns out the script is very simple and only involves moving files around and changing their permissions.. anything that goes wrong should be immediately apparent even if you have no experience with shell commands.
goldenarmZ said:
I only did it line by line so I could see any more errors for myself and decide if they were important. As it turns out the script is very simple and only involves moving files around and changing their permissions.. anything that goes wrong should be immediately apparent even if you have no experience with shell commands.
Click to expand...
Click to collapse
Thanks, I was starting to worry about the bad experiences outlined above, given that this method appeared to be a more reliable one than VISIONary, and a route I was going to go down. But I'm pretty comfortable with shell scripts, so your input makes me feel a whole lot better !
goldenarmZ said:
The root script threw an error for me too, so just to be safe I opened the script and typed in the commands manually. If you have problems with the script, just run these commands from the root terminal on your phone:
-code-
"mkdir /system/xbin" just creates a directory, if it already exists you can ignore this command and proceed.
Hope this helps someone.. Thanks to the OP for the scripts.
Click to expand...
Click to collapse
thanks for this... I will give it a try
Yay, I just perma-rooted my phone using this method, many thanks to those who came up with the method in the first place, plus this handy guide too.
I got the message about /system/xbin already existing, but you can just ignore that message, it runs the rest of the script anyway.
ssyed said:
Ok, so I have figured out how to get out of this "quietly brilliant" loop.
First of all, this isn't a brick and all that is needed to fix this is a quick factory reset from the bootloader.
Click to expand...
Click to collapse
So after doing the guide you simply reeboot your phone into bootloader and select factory reset?
And then will the device be perm root and s-off???
Hello All,
So I decided to try rooting after doing all this research. I chose to use the "rage" method shown here: http://forum.xda-developers.com/showthread.php?t=834228
I download all the files and everything needed, I get adb to work, and I type in the displayed commands. My problem comes in when I move over to the phone and use Terminal Emulator. I type in /data/local/tmp/rage just as the directions specified but emulator then spits back: /data/local/tmp/rage:not found.
I have scoured the internet to find a solution to this problem and I can't seem to find any postings of someone else having the same problem. How do I get past this. Is there something I am missing? Please help!
in terminal or in adb shell... go to that directory to tmp
then do ls to check if rage is in there
so you would go
cd /data
cd /local
cd tmp
then
ls
and hopefully you should see rage in there if you do then try it again if you dont push it back in there
I tried your suggestion using terminal on my phone and it keeps telling me Is: permission denied. So I tried cd /data\local\tmp and it let me get to that point. then i tried the dir command and I get dir: permission denied.
hey, i recently rooted my desire z and i had that problem too
i found that if you don't do run this
Code:
$ adb shell chmod 0755 /data/local/tmp/*
make sure you run that before you type /data/local/tmp/rage in your terminal
I got it to work!! I am rooted. I finally realized that I had missed a space. I am about to flash my first rom!! YAAAAYYY. Thanks to all the hard work of others and their wonderful directions lol
Hi there im a beginner user so pls bare with me,
In Feb i became the proud owner of a Desire HD running Froyo 2.2 which was working perfectly, then i applied the OTA firmware update which screwed up my GPS's ability to get a lock. To fix this i read numerous forums and what i did was downgraded back to the original firmware my phone came with 1.32.405.3 and also used ADB to change the /system/etc/gps.conf file from reading:
NTP_SERVER=north-america.pool.ntp.org
to
NTP_SERVER=nz.pool.ntp.org
.....as i live in New Zealand..........I did this by copy the file /system/etc/gps.conf from my phone to my computer changed the code and used the following adb code in command prompt to push my updated gps.conf file back into the /system/etc/ folder in my phone:
adb devices
adb push psneuter /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/psneuter
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/psneuter
adb shell mount -o remount,rw /dev/block/mmcblk0p25 /system
adb push gps.conf /system/etc/gps.conf
adb shell mount -o remount,ro /dev/block/mmcblk0p25 /system
exit
After that i was delighted to see that my GPS started working again but what i had discovered was that when i restarted my phone the first line of code in the gps.conf file reverts back to NTP_SERVER=north-america.pool.ntp.org which means my GPS doesn't get a lock again so i then manually do the process i mentioned above to change North.America to NZ, this process isnt a big hassle but more an inconvenience and was thinking there has got to be a way to change the loading script or something like that so that every time my phone restarts the code reads NZ.
So in essence i am trying to find out if anyone knows a way to make the first line of code in the gps.conf file read NZ i/o North.America everytime i restart my phone WITHOUT ROOTING IT (personal preference)......there must be a way to temp root using adb then change the code within the boot image or script however it works im not sure.....?
Your help is much appreciated
Hi HakaWaka
You have to root it if you wanna make it easier. (That's one of the advantages of rooting)
You can use Visionary+ to temproot and permroot your Desire HD. However, even if you wish to just temproot it, after you change your ntp server, no matter what if you reboot your phone it will be back to normal. (i.e. it will be back to north-america) I tried it before, thats why i know.
If you permroot it, it will be easier. Once you permroot it, just install FasterFix. Downloadable from Market. And from there, change your ntp server, it is just that simple though. Changes will remain no matter how many times you reboot your phone.
Cheers mate.
Thanks superstick1!
I've tried using Visionary+ to temproot but it starts to load then shows a white screen indicating that it's jammed so im worried to do a permaroot and screw the phone up :S.
Anyone know a safe and sure way to root the DHD?
HakaWaka said:
Anyone know a safe and sure way to root the DHD?
Click to expand...
Click to collapse
There are lots of guides linked in the sticky at the top of the Development forum that go into step by step details. But if you're on 1.32.405.6 then Visionary should work. I noticed you said 1.32.405.3 in your first post, was that a typo or are you on the Vodafone RUU? If you are I would switch to 1.32.405.6 and try again.
I just double checked and nope it was no typo firmware = 1.32.405.3. I might try switching to .6 and try Visionary again...
Cher cher
Hi to all,
lets say I never expect to create this thread, Im not begginer, but all my current or previous phone was much more user friendly than this one. Samsung is soo easy to root, older mobiles with WM are just made to play with.
All I want is to install CWM recovery...
Ive red all threads regarding root,but I never make it work on my Desire Z, can be someone so kind and help me or just let me know what Im doing wrong?
My soft. version is 2.42, 2.3.3 android
1. Unrevoken method
When is installer downloaded and installed Unrevoken screen appears, I connect my phone but nothing happened,I tryed all modes when USB connected but it was never connected. What Im doing wrong?
2. Visionary method
When installed all works fine. I tryed temporary root but phone was freezing and got slower,simply it doesnt work on my phone.
3.SDK tools
I understand that phone needs to be downgraded.
Installer installed, newest version, just dont understand how I have to connect my phone with computer, how to enter orders in cmd, because always is just error message.
Galaxy S2 rooted in 10 minutes, Galaxy R with one crash when phone was bricked, 60 minutes...older WMs phones...many...but Desire Z...
Check this guide strawmetal compiled, http://minus.com/mu9vZ3P38/2
its prety user friendly
-Nipqer
Thank you...everything looks fine. But stucked on something called fre3vo. This sentence is probably wrong...
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
cant get thru
Are you getting some sort of error message?
-Nipqer
I guess there is problem with spaces....in guide is few spaces in between orders.
For example:
adb push fre3vo /data/local/tmp
adb shell
chmod 777 /data/local/tmp/fre3vo
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
This is text copied from guide...but if you copy-paste orders in cmd, they just doesnt work and for example by the first one have to be deleted betweek fre3vo AND /.Otherwise it doesnt work.It have to look like this:
adb push fre3vo/data/local/tmp
adb shell
chmod 777/data/local/tmp/fre3vo
But with last one I dont know what to do.
When I enter sentence it just show up:
/data/local/tmp/fre3vo: not found
See attached file with cmd.
that massive amount of txt when you run
'adb push fre3vo/data/local/tmp '
Is adb telling you how to use it.
if it pushed properly, you should get just 1 (or maybe 2?) lines of output telling you how fast it pushed.
All the spaces that are there are meant to be there, if you look at the chmod line you can see its showing you how to use it, with a space clearly defined.
-Nipqer
Hi,
I had an issue with my phone and the motherboard had to be replaced with my permaroot fading. So I decided to root it again, as I have done that earlier, however, I got stuck as I (obviously) made a mistake on the way.
I tried to follow multiple guides, so there might be a combination of all (links below).
Current state:
Phone is Desire Z, however, it has a ROM for T-Mobile G2 (I have probably followed bad guide or downloaded bad file - that seems to be the clutch problem).
According to bootloader:
VISION PVT SHIP S-ON
HBOOT - 0.82.0000
MICROP - 0425
RADIO - 26.02.01.15_M2
eMMC - boot
Now my target is to flash it with Audacity b5 as I had that before. Not sure however what I need to do now.. When bootloading (I guess I have a correct stock ROM this time) it says "Lack of heap!", which (as I found out) probably is the result of having G2 ROM on my Desire Z.
My question is therefore how to get a stock DZ ROM instead of this G2 thing back on my phone?
Tried to follow these guides (and maybe found some more information here and there, but those are the main)
http://forum.xda-developers.com/showthread.php?t=1178912 - cant get past temp root step 7 - none of those intervals doesnt work
http://forum.xda-developers.com/wik...sion#Rooting_the_Vision_.28G2.2FDZ.29_and_DHD - Command in part 2 adb shell chmod 755 /data/local/tmp/* throws an error "Unable to chmod /data/local/tmp/sh: Operation not permitted"
http://forum.xda-developers.com/showthread.php?t=905261 with these exceptions http://forum.xda-developers.com/showpost.php?p=15825944&postcount=27
http://forum.xda-developers.com/showthread.php?t=1453066 - fr3evo problem above
Thanks, any help appreciated - I know this problem is caused by my own failure, but I hope you can help a newbie out.
EDIT: found out I am able to get a temporary root with this:
adb push psneuter /data/local/tmp
adb push misc_version /data/local/tmp
adb shell
chmod 777 /data/local/tmp/psneuter
chmod 777 /data/local/tmp/misc_version
/data/local/tmp/psneuter
but I am unable to flash a stock rom as the bootloader still says "Lack of heap!"
2nd EDIT: I finally rooted and installed the requested ROM. All I needed was few more hours and a little use of my obviously tiny brain.
For possible future use, here is how I managed to solve the problem.
I followed this guide http://wiki.cyanogenmod.com/wiki/HTC_Desire_Z:_Firmware_Downgrade_(Froyo) and after step 6 combined with this guide http://wiki.cyanogenmod.com/wiki/TMobile_G2:_Rooting allowing me to first get there relevant hboot version for Desire Z (should be 84.2000). Then I permrooted and installed stock Desire Z ROM. It somehow did not run, but allowed me to enter Clockwork mod recovery through bootloader / fastboot / factory reset and installing my current custom ROM directly through here.
Sorry for spamming, I hope this helps someone else save some time solving the issue.
Thank you so much
I can't put into words how useful this was. I was in the exact same position, and I never thought that my hboot could be the issue.