Develop Bugs

[GUIDE] Downgrade your Desire-Z from 1.72 to 1.34 (and get root and S-OFF)

First thanks to everybody who made it possible to root our great devices.
THIS WILL WIPE YOUR DEVICE, BACKUP EVERYTHING BEFORE DOING THIS!
Polish translation by trzype
If you don't know how to use adb/fastboot don't do this. Use the search function and google and learn how to use them. If you know everything about them come back. I made a pretty nice tutorial, many people used it already with success. But I won't add anything like "go to startmenu and type..."
If your INFOCID is NOT one of these you need to make a goldcard to downgrade!
HTC__001
HTC__032
HTC__E11
HTC__203
HTC__Y13
HTC__102
HTC__405
HTC__304
HTC__A07
HTC__N34
HTC__J15
check with:
Code:
adb reboot bootloader
fastboot oem boot
Here is a great guide how to make a goldcard, follow the first part and come back here then.
Get theses 3 files:
https://github.com/tmzt/g2root-kmod/raw/scotty2/scotty2/psneuter/psneuter (right click > save as...)
https://rapidshare.com/files/1884723844/PC10IMG.zip
https://rapidshare.com/files/948281832/root.zip
Since this uses some security holes to gain root privileges on your phone some antivirus programs on your pc might warn you that this contains a virus. Thats not the case!
MikeChannon said:
It might be worth saying in the thread that android/Exploit.ragecage.A is the exploit being used to gain root and Users should not worry about the warning some software will give.
Click to expand...
Click to collapse
Extract misc_version_01.zip (only misc_version is needed)
Get the PC10IMG.zip from here or download the full RUU from here.
If you already downloaded the 1.34 RUU somewhere else you can skip this step.
Code:
adb push psneuter /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/psneuter
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/psneuter
adb shell
Check if you have the '#' sign instead of the '$'
If you see the '#' sign you got root!
Code:
/data/local/tmp/misc_version -s 1.33.405.5
exit
If you have downloaded the 1.34.405.5_PC10IMG.zip copy it to you SD-Card and rename it to PC10IMG.zip.
If you downloaded the full RUU or had it already execute the exe file (mine is called RUU_Vision_HTC_WWE_1.34.405.5_Radio_12.28b.60.140e_26.03.02.26_M_release_155556_signed.exe), start explorer and type %temp% in the adress bar.
Look in all the folders starting with a { sign and also in the sub directories if it also starts with a { sign, in one of the subdirectories there should be a rom.zip file with 298.442.206 bytes and the MD5 sum 2ff42897cd27e0db425a2cf36c8bd078.
Copy this rom.zip to your SD-Card on the phone and rename it to PC10IMG.zip
Code:
adb reboot bootloader
(or turn your phone of and on again while holding the trackbad).
Wait till the phone is in bootloader mode (white screen should look like this but with other infos http://www.brutzelstube.de/wp-content/uploads/2010/09/hboot.jpg)
Select bootloader (vol +/- buttons for navigation and power button for select).
Wait for the phone to scan the sdcard, once it's done it will ask you if you want to start the update. Confirm it and wait till it's done. Reboot with powerbutton when asked.
After the reboot check for version informations, it should show this:
Enable USB-Debugging on your phone
Extract root.zip
Code:
adb install AndroidTerm.apk
adb push busybox /data/local/tmp/
adb push gfree /data/local/tmp/
adb push rage /data/local/tmp
adb push root /data/local/tmp/
adb shell chmod 0755 /data/local/tmp/*
adb push su /sdcard/
adb push Superuser.apk /sdcard/
Start the Terminal app on your phone and type:
Code:
/data/local/tmp/rage
Wait until you see the message "Forked #### childs.", reset Terminal (menu > Reset Term). The Terminal app will close, launch it again. It will force close, launch it again.
You should see the magic '#' sign again.
Next type in the terminal
Code:
/data/local/tmp/gfree -f
, this will turn Security off (S-OFF), remove SIM Lock and set CID to 11111111.
Last step in terminal app on your phone is to execute these commands.
Code:
/data/local/tmp/root
sync
This will root your phone. It's possible that you get an error message "mkdir: /system/xbin already exists", don't worry everything should be ok.
After that restart your phone.
Now get ROM Manager and install the recovery image from there. If you are happy with the 1.34 software everything is done here, if not you can flash anything you want now.

Nice work! We allways need more people using the magic of root
Sent from my HTC Vision using XDA App

Thanks a lot for your effort!
Just bought a Desire Z and accidentally upgraded OTA.
Will try it now and report back.

I get the following Error when trying to run misc version
Code:
# /data/local/tmp/misc_version -s 1.33.405.5
/data/local/tmp/misc_version -s 1.33.405.5
--set_version set. VERSION will be changed to: 1.33.405.5
Patching and backing up partition 17...
Error opening backup file.
#
Any ideas mate?
Edit: Sorry, forgot to unmount phone from windows when i copied the img over.

VERY IMPORTANT
The OP made a small mistake in the instructions:
Code:
/data/local/tmp/misc[COLOR="Red"][B]-[/B][/COLOR]version -s 1.33.405.5
exit
the dash (-) should be an underline (_)
Code:
/data/local/tmp/misc[COLOR="Red"][B]_[/B][/COLOR]version -s 1.33.405.5
exit
Please update the first post

Darkyy said:
VERY IMPORTANT
The OP made a small mistake in the instructions:
Code:
/data/local/tmp/misc[COLOR="Red"][B]-[/B][/COLOR]version -s 1.33.405.5
exit
the dash (-) should be an underline (_)
Code:
/data/local/tmp/misc[COLOR="Red"][B]_[/B][/COLOR]version -s 1.33.405.5
exit
Please update the first post
Click to expand...
Click to collapse
Thanks, fixed it.

Question:
Should the psneuter -file be without a suffix?
Or should it be like psneuter.txt?

Gnurf said:
Question:
Should the psneuter -file be without a suffix?
Or should it be like psneuter.txt?
Click to expand...
Click to collapse
Without the extension... .txt is added by your browser presumably so you'll have to rename it

Another error:
When I reboot into the bootloader, the phone scans PC10IMG.ZIP and then says "CID incorrect! Update Fail! Press <POWER> to reboot."

paw3lk said:
Without the extension... .txt is added by your browser presumably so you'll have to rename it
Click to expand...
Click to collapse
Thats what I thought aswell, but seeing there has been a post about it previously... (in the other tread)
Thanks.

worked as described, big thx

waqypaqy said:
Another error:
When I reboot into the bootloader, the phone scans PC10IMG.ZIP and then says "CID incorrect! Update Fail! Press <POWER> to reboot."
Click to expand...
Click to collapse
What phone and software version do you have?
It seems like you use a wrong PC10IMG.zip for your phone. Did you download the zip from here or got it yourself from the full ruu?

Another error:
Step 15: Extract root.zip
and then do the commands:
Code:
adb chmod 0755 /data/local/tmp/*
should be
Code:
adb [B][COLOR="Red"]shell [/COLOR][/B]chmod 0755 /data/local/tmp/*

g4rb4g3 said:
What phone and software version do you have?
It seems like you use a wrong PC10IMG.zip for your phone. Did you download the zip from here or got it yourself from the full ruu?
Click to expand...
Click to collapse
I've got the Desire Z running 1.72. I first tried downloading the PC10IMG.zip from the 1st link in part 3 which didnt work. I then tried the RUU file, found the rom.zip in Temp, renamed it and copied it to SD card, which didnt work either
What am I doing wrong?
Software number: 1.72.161.1

Darkyy said:
Another error:
Step 15: Extract root.zip
and then do the commands:
Code:
adb chmod 0755 /data/local/tmp/*
should be
Code:
adb [B][COLOR="Red"]shell [/COLOR][/B]chmod 0755 /data/local/tmp/*
Click to expand...
Click to collapse
Thanks, fixed it.
Sent from my HTC Vision using XDA App

waqypaqy said:
I've got the Desire Z running 1.72. I first tried downloading the PC10IMG.zip from the 1st link in part 3 which didnt work. I then tried the RUU file, found the rom.zip in Temp, renamed it and copied it to SD card, which didnt work either
What am I doing wrong?
Software number: 1.72.161.1
Click to expand...
Click to collapse
Did you root your phone before the ota update?
Sent from my HTC Vision using XDA App

g4rb4g3 said:
Did you root your phone before the ota update?
Sent from my HTC Vision using XDA App
Click to expand...
Click to collapse
Yes I had rooted it with Visionary before I updated it. Please tell me I still have some hope for getting root back

waqypaqy said:
Yes I had rooted it with Visionary before I updated it. Please tell me I still have some hope for getting root back
Click to expand...
Click to collapse
Did you set s-off too while rooting?
Sent from my HTC Vision using XDA App

g4rb4g3 said:
Did you set s-off too while rooting?
Sent from my HTC Vision using XDA App
Click to expand...
Click to collapse
Nope Im screwed arent I?

waqypaqy said:
Nope Im screwed arent I?
Click to expand...
Click to collapse
adb reboot bootloader
fastboot oem boot
Post the result of the 2nd command (dont know if it works... but it wont harm anything)
Sent from my HTC Vision using XDA App

[Q] Temp Root and Downgrade issues 2.3.3

Hi Guys.
I have watched your Noob video and it's very funny.
However,I am going to have to risk being a "noob" due to the fact that im unable to post in the dev thread for downgrading.
I have decided to root my DHD and everyone says this is the place to go to learn how to do it.
I have read the instructions throughly and decided to take the plunge, however I'm having some problems
with the method described in the first post!
Please let me tell you what I have done so far.
1) I have read the posts at http://forum.xda-developers.com/showthread.php?t=879525 (doesn't seem to apply to me.)
2) I am running Build version 2.50.405.2 (So I need to downgrade.)
3) I have the latest version of HTC Sync installed.
4) I have created a gold card as directed in the "How to downgrade" post and also placed PD98IMG.zip in the root of the gold card
inserted in the phone.
5) My DHD is running Gingerbread 2.3.3, Software number 2.50.405.2 so I followed section b2 of the downgrade thread
http://forum.xda-developers.com/showthread.php?t=905003
However at the end of the cmd process I see a "$" symbol, not the "#" as per the screenshot.
Any ideas anyone?
Cheers.
Greg.
Update: I just tried the method here
http://forum.xda-developers.com/showthread.php?t=1152233
for "TEMP-ROOT ANY Gingerbread build and downgrade to 1.32.405.6"
I manage to temproot using the alternative method of typing the adb commands under the Temp Root heading.
I finally get the "#"
I still have the gold card with PD98IMG.zip in the DHD.
I go to Downgrade step 4 and again use the alternative method and type in the commands only for cmd to say
"adb: not found"
AAAGGGGHHHHHHH!
I have been trying this all day.
I'm going to curl up in a corner and cry now.
Any help greatly appreciated.
Greg.

Hi Greg, try this method, http://forum.xda-developers.com/showthread.php?t=952352

or this one : http://driphter.com/index.php?topic=3867.0
you won't get ur hands dirty with adb commands or other stuff

Hi Alex.
I have tried this method too.
Alas, no luck there either! :-(
alex6vasy said:
or this one : you won't get ur hands dirty with adb commands or other stuff
Click to expand...
Click to collapse
---------- Post added at 02:31 PM ---------- Previous post was at 02:30 PM ----------
Hi Mich.
I'll give this a go tonight.
Many thanks.
Greg.
MichDHD said:
Hi Greg, try this method, http://forum.xda-developers.com/showthread.php?t=952352
Click to expand...
Click to collapse

As Alex said try his link its easy and no telnet etc,id tried it many times through various ways and failed,the key is I found anyway...is to always format the sd card fully not a quick format,always do the 'takes longer' option I came from 2.50 also,it'll work
Sent from my HTC Desire HD A9191 using XDA App

adb push fre3vo /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF
adb shell
after this # type:
/data/local/tmp/misc_version -s 1.31.405.3
exit
adb reboot bootloader
have a good time .....................
this is the simple method to downgrade ur device.........you may los ur apps...but will be restored from google after flashing sense roms..........
believe me...this will work 100% sure...........

I'm pretty sure I have tried this method, but I'll give this a go, cheers buddy.
Greg.

hi greg
i am a noob too but i tried this and i was successful.
http://forum.xda-developers.com/showthread.php?t=1180639
I hope I could help you, best regards, gluecke63

Hey dude.
Tried this, didn't work.
I successfully manage to get temproot using the code you gave, but then on reboot the below happens.
Always, when I get to the boot loader it recognises PD98IMG.zip and looks like it's loading it. After loading it I get a "Checking PD98IMG.zip" message then the bootloader just returns to the main screen, I am never asked if I want to update!
Getting totally flumoxed with this! :-(
So I have made a youtube video of the problem.
rohithksaj said:
adb push fre3vo /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF
adb shell
after this # type:
/data/local/tmp/misc_version -s 1.31.405.3
exit
adb reboot bootloader
have a good time .....................
this is the simple method to downgrade ur device.........you may los ur apps...but will be restored from google after flashing sense roms..........
believe me...this will work 100% sure...........
Click to expand...
Click to collapse

You can't just flash PD98IMG.zip when this is an older base then your current.
When your phone is finished checking, it decide not to flash it cause it's older.

Apologies, I should have said I manage to get temproot using the code supplied. I have updated the post now.
Cheers.
MichDHD said:
You can't just flash PD98IMG.zip when this is an older base then your current.
When your phone is finished checking, it decide not to flash it cause it's older.
Click to expand...
Click to collapse

I wonder if my PD98IMG.zip file is corrupt.
I just did an MD5 check but it's tough to tell as the original PD98IMG.zip file I downloaded from here didn't have an MD5 Checksum with it

Hi guys.
Quick update. I have successfully downgraded my DHD.
The issue was a corrupt PD98IMG.zip
I downloaded MD5 Check 2.1 from here and tested the checksum of the PD98IMG.zip against the MD5 Checksup posted at the top of the page here, post 261,
Quick Ref - (C3D244A9F056E48EE3851A14FF52204C)
When MD5 Check 2.1 showed it as not matching, I downloaded a new PD98IMG.zip from here.
I used MD5 Check 2.1 to the checksum this new PD98IMG.zip. Success, it matched.
I transferred the new PD98IMG.zip to the goldcard I made using these instructions (I don't know if I actually needed a goldcard).
I put the Goldcard in my DHD, used cmd to run the below code as given by rohithksaj, thanks bud, which echoed the instructions here.
Code:
adb push fre3vo /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF
adb shell
after this # type:
/data/local/tmp/misc_version -s 1.31.405.3
exit
adb reboot bootloader
When the DHD rebooted into bootloader, I selected "bootloader", then waited about 5 seconds for the bootloader to recognise the PD98IMG.zip.
the DHD then goes through a process of loading the PD98IMG.zip then it checks the PD98IMG.zip.
Finally the screen that eluded me appeared, the "Do you wish to start update?" screen.
I chose yes, 5 mins later I had a downgraded phone.
Thank you all for your help on this issue.
Props to you all.
Greg.

My next question is how do I change the thread title to "XXXX -Solved"?

All the best mate.............
Flash carefully reading all instructions..............
welcome to the world of custom roms ~~~~~~~~~~

Cheers bud.
just done Radio S-OFF
Just about to do ENG S-OFF
What Rom do you recommend?
I have been thinking about the Sense 3.0 rom for the DHD!
Thoughts?
Cheers.
Greg.
rohithksaj said:
All the best mate.............
Flash carefully reading all instructions..............
welcome to the world of custom roms ~~~~~~~~~~
Click to expand...
Click to collapse

TeamDraven said:
Cheers bud.
just done Radio S-OFF
Just about to do ENG S-OFF
What Rom do you recommend?
I have been thinking about the Sense 3.0 rom for the DHD!
Thoughts?
Cheers.
Greg.
Click to expand...
Click to collapse
thinking about sense 3........may use ARHD 6.1.1
or
any rom with official sense 3...........
flash what u like mate..............
All have different taste ~~~~~~

[Q] Problems downgrading/rooting Desire Z Gingerbread.

Hello everyone!
Not my phone, just helping a friend
We got problems downgrading from Gingerbread to earlier version of Android.
So, wanted to root, flash custom recovery, then MIUI.
Started with this tut, then understood, that Gingerbread isn't rootable and it needs to be downgraded.
So, tried [GUIDE] Downgrade G2 (2.3.X) & DZ (2.3.X) & mT4g (2.3.4) & DHD w/ S-ON to Stock Froyo and HTC Desire Z: Firmware Downgrade (Gingerbread).
So, installed JRE, JDK, SDK (ADB), drivers.
With phone plugged to PC (USB Debuggind ON), ADB & Device manager sees it.
So, moved files to C:\android-sdk\platform-tools and ran cmd (administrator privileges). Till "adb shell it's good". But, after that, when ran chmod, it says, that permissions denied.
Question:
What we're doing wrong and how to fix it?
We've read so many guides, but unsuccessfully so far..
Device HTC Desire Z
Android 2.3.3
Kernel version 2.6.35.10-g7b95729
Baseband 12.56.60.25U_26.10.04.03_M
Build 2.42.405.2 CL84109
Thanks about helping!

Is it permission denied when u try to change the version? If permission denied during change the version, run this command:
cd /data/local/tmp/misc_version
chmod 777 misc_version
./misc_version -s 1.00.000.0
sync
Sent from my HTC Vision using XDA App

Are you sure your temp root is working?

aDeQ666, no, it wont chmod when typing chmod 777 /data/local/tmp/fre3vo, so - no temp root for us. Tried visionary, z4root, SuperOneClick - nothing works
It was updated from Froyo to Gingerbread via OTA, i think that's the issue? What else we can do? Thanks!

Could you post a copy/pastebin of your cmd when running it? It'll be much easier to spot the error if we can see exactly what you did/are doing.
-Nipqer

I have one problem when i tried to root htc desire. i already done the downgrade and now i am want to root... i folllowed the instructions on the link you gave untill this
[chmod 755 /data/local/tmp/*
/data/local/tmp/psneuter
NOTE: You will drop out of the shell after this command. Restart the shell using:
adb shell
cd /data/local/tmp
./busybox md5sum /dev/block/mmcblk0p18]
well after command:
chmod 755 /data/local/tmp/*
/data/local/tmp/psneuter
i`m not dropping out of the shell and the next instruction results with a "cd: bad substitution" msg. what should i do?
sorry for my bad english

When do u received the error? Is it when u downgrading or try to root? Are u using the wiki guide?

What I've down a few times now (and this does work) is use the fre3vo guide (the one you linked) to downgrade then continue with the guide below from step 14 or 15 to gain perm root.
http://forum.xda-developers.com/showthread.php?t=905261
Hope that helps.
Edit: You're better off flashing 1.34.405.5 as the one on the CM wiki may not be working. Its worth a shot IMO.

aDeQ666 said:
Is it permission denied when u try to change the version? If permission denied during change the version, run this command:
cd /data/local/tmp/misc_version
chmod 777 misc_version
./misc_version -s 1.00.000.0
sync
Sent from my HTC Vision using XDA App
Click to expand...
Click to collapse
Hi, i have been trying to change my misc version but it gives me permission denied and i have # (root) already. So i tried chmod after cd which didn't have a problem but now when i try harder./misc_version it says the file not found.
Please help

I used this guide. it worked fine for me =)
http://forum.xda-developers.com/showthread.php?t=905261
*faceslapps self* sorry. I was a tad too fast. I didn't see that someone allready posted that guide here.

This is the command that i use before this:
adb push misc_version /data/local/tmp/misc_version
cd /data/local/tmp/misc_version
chmod 777 misc_version
./misc_version -s 1.00.000.0
sync
Sent from my HTC Desire Z using XDA App

I used this guide when I had to go through the pain of downgrading my desire z http://forum.xda-developers.com/showthread.php?p=15851843 . It worked very easily, just follow the instructions nice and carefully, the problem is that you need ADB set up for you to use that guide though.
Once you downgrade though, I would use the guide here for rooting your phone http://forum.xda-developers.com/wiki/index.php?title=HTC_Vision#Rooting_the_G2 .
I hope that helps, that's what I used for my phone.
To be more precise in regards to the problem though, i just realised that i had the same problem as you when i was trying to run the chmod command where i had temproot but i kept getting "permission denied". As it turned out, i had accidentally written "adb push fre3vo /data/local/tmp/" instead of "adb push fre3vo /data/local/tmp" when i was following that downgrading guide. Basically what my mistake did was, it pushed fre3vo into a new folder within /tmp instead of just placing fre3vo in /tmp. So what you can do to figure out where fre3vo is, navigate to the /tmp folder using CD (in adb shell) and once you get to /tmp, type "ls". This will then display all the contents of /tmp and then you will be able to see if you accidentally created a folder like i did. Then once you check that, when you go to run the chmod command, you have to run it like "chmod 777 /data/local/tmp/**possible accidental folder name**/fre3vo", see if that works now .

Use this guide should do the job for you www.desirez.strawmetal.com

aDeQ666 said:
This is the command that i use before this:
adb push misc_version /data/local/tmp/misc_version
cd /data/local/tmp/misc_version
chmod 777 misc_version
./misc_version -s 1.00.000.0
sync
Sent from my HTC Desire Z using XDA App
Click to expand...
Click to collapse
were you able to fix this problem?

I had the same problem with my Desire Z with OTA 2.3.3.
Finally I've unlocked bootloader as show at htcdev.com.
Then I used this guide http://forum.xda-developers.com/showthread.php?t=1453066 (great thx for it), and CM 7.1 works like a charm.
All best.

allendon said:
were you able to fix this problem?
Click to expand...
Click to collapse
For my case, yes.
Sent from my HTC Vision using XDA App

[UPDATED] Get s-off and root for 6.01.605.05 software

Update: Found better instructions here and updated this post with them: http://rootzwiki.com/topic/27003-root-dinc2-on-any-firmware-may-want-to-sticky-later/
Be warned that this has been reported to cause bootloops on Sense ROMs, proceed at your own risk.
A few disclaimers before I begin:
1) I AM NOT RESPONSIBLE FOR ANYTHING YOU DO TO YOUR PHONE. ANYTHING YOU ATTEMPT TO DO YOU DO AT YOUR OWN RISK
2) This method requires use of adb and is not for thr faint of heart. your phone WILL be bootlooping along the way; this is exactly what we want (at a specific point)
Now to begin in earnest
First find what we need!
We need the patched misc version, tacoroot, and the earlier GB RUU
Modified htc drivers or linux, both with working adb installation
disable fastboot on your device
A few disclaimers before I begin:
1) I AM NOT RESPONSIBLE FOR ANYTHING YOU DO TO YOUR PHONE. ANYTHING YOU ATTEMPT TO DO YOU DO AT YOUR OWN RISK
2) This method requires use of adb and is not for thr faint of heart. your phone WILL be bootlooping along the way; this is exactly what we want (at a specific point)
Now to begin in earnest
First find what we need!
We need the patched misc version, tacoroot, and the earlier GB RUU
Modified htc drivers or linux, both with working adb installation
disable fastboot on your device
Now we push, make executable, and execute the tacoroot method
adb push tacoroot.sh /data/local/
adb shell chmod 755 /data/local/tacoroot.sh
adb shell /data/local/tacoroot.sh
At this point we will run tacoroot with the --recovery, (push volume up and power at the triangle) (reboot after this) --setup and --root (run one, wait for the device to settle then run the next)
AT THIS POINT YOUR DEVICEWILL BE BOOTLOOPING; THAT IS PERFECTLY NORMAL
Now we downgrade the misc_version
adb push misc_version /data/local
adb shell chmod 777 /data/local/misc_version
adb shell /data/local/sh -c '/data/local/tmp/misc_version -s 2.18.605.3'
If everything so far has succeeded, youre almost there!
adb reboot bootloader
fastboot oem rebootRUU
fastboot erase cache
fastboot flash zip <your RUU>
fastboot reboot
If everything so far has succeeded, youre almost there!
adb reboot bootloader
fastboot oem rebootRUU
fastboot erase cache
fastboot flash zip <your RUU>
fastboot reboot
Click to expand...
Click to collapse
Tacoroot: https://github.com/CunningLogic/TacoRoot
misc_version: https://github.com/downloads/hyuh/misc_version_universal/misc_version_universal.zip
2.3.3 RUU: http://jellybellys.minus.com/mvivow/2

prototype7 said:
All credit goes to jcase on the RootzWiki forums, I can't try this out myself but I thought I'd share it for those who could use it:
Here are my instructions to preform this. If you do pack this in a script/program , please follow the license that comes with Tacoroot and misc_version
Download https://github.com/d...n_universal.zip
and unzip it
Preform manual tacoroot exploit
adb reboot recovery
(Reboot normally once in recovery, this creates the directory for the log. Continue once booted)
adb shell
rm /data/data/recovery/*
ln -s /data/local.prop /data/data/recovery/log
exit
adb reboot
adb shell
echo 'ro.kernel.qemu=1' > /data/local.prop
exit
adb reboot
(Device will appear to bootloop, but ADB will work, continue once adb is working)
adb push misc_version /data/local/
adb shell
chmod 755 /data/local/misc_version
/data/local/misc_version --set_version 1.11.605.11
rm /data/data/recovery/log
echo 'ro.kernel.qemu=0' > /data/local.prop
adb reboot
Now you can flash the proper ruu to s-off with
Sent from my Incredible 2 using Tapatalk 2 Beta-5
Click to expand...
Click to collapse
I'm going to try this when I get home hopefully I can FINALLY get downgraded...
Sent from my ADR6350 using XDA

Jayydude_SGP said:
I'm going to try this when I get home hopefully I can FINALLY get downgraded...
Sent from my ADR6350 using XDA
Click to expand...
Click to collapse
Let me know how it works .
Sent from my Incredible 2 using Tapatalk 2 Beta-5

I'm just a little unclear about what comes before and after this...
Can we get a post that has ALL the code/instructions spelled out? For instance, the "Preform manual tacoroot exploit"... is that the tacoroot code from before in its entirety, or just a certain part of it?
And then when the instructions in this post are done, are we to then follow the downgrade instructions from beginning to end?
Sorry to be pesty, but really want this to work and I'm just unsure of what all to do. Many many super thanks.

tcwota said:
I'm just a little unclear about what comes before and after this...
Can we get a post that has ALL the code/instructions spelled out? For instance, the "Preform manual tacoroot exploit"... is that the tacoroot code from before in its entirety, or just a certain part of it?
And then when the instructions in this post are done, are we to then follow the downgrade instructions from beginning to end?
Sorry to be pesty, but really want this to work and I'm just unsure of what all to do. Many many super thanks.
Click to expand...
Click to collapse
After you do this, use an RUU to downgrade and then use revolutionary to obtain s-off. I'll look into the tacoroot in a minute, like I said these aren't my instructions.
Edit: Nothing like a quick google search to make you feel like an idiot lol. The adb commands are the manual tacoroot exploit. I'll update the OP to make it more clear.
Sent from my Incredible 2 using Tapatalk 2 Beta-5

OP updated. Make sure to post and tell me if this works.

Thanks, but still unclear about one thing. To flash the RUU, do we follow all the instructions in the downgrade vivow .98 thread?

You have to combine all the instructions.
If you go to the rootzwiki page I spelled it out. Just can't link to external sites because I'm new to xda.

Perfect. Thanks and can't wait to give this a try in the morning.
Do you (or anyone) think it will matter that I have already (successfully) used the HTCDev boot unlocker?
aaronc222 said:
You have to combine all the instructions.
If you go to the rootzwiki page I spelled it out. Just can't link to external sites because I'm new to xda.
Click to expand...
Click to collapse

It took some tinkering (and a bit of sweating), but I was able to get this to work successfully.
I had previously used the HTCdev tool to unlock and was running clockwork recovery. I had to flash the stock recovery and do a factory restore, but still got a "99 unknown fail" when trying to flash the RUU at the end of this process.
A quick google search told me to relock the bootloader with "fastboot oem lock." After the relock, I had to do ANOTHER factory restore and then everything worked fine.
One difference for me: the bootloop started earlier, ie after "adb shell /data/local/tacoroot.sh --root". But I just continued to use adb when I could and got through it.
About to run Revolutionary. Thanks to everyone up to this point! Such a fantastic community!

not to rain on your parade but this makes no sense. after the adb reboot recovery..... i do the adb shell and then it cant find the file/directory

dets34 said:
not to rain on your parade but this makes no sense. after the adb reboot recovery..... i do the adb shell and then it cant find the file/directory
Click to expand...
Click to collapse
Are you rebooting out of the recovery? You do "adb reboot recovery," and then when you get to the red triangle, hold down volume up AND volume down and then the power button, reboot, let the phone reboot back into normal, and then continue the instructions.

unstuck! ... then stuck again
Trying this on a warranty replacement Dinc2 that's got Android 2.3.4, Software number 6.01.605.05 710RD ... the above post got me past the red triangle "!" thing, so I proceeded to:
Code:
adb shell
rm /data/data/recovery/*
ln -s /data/local.prop /data/data/recovery/log
exit
adb reboot
adb shell
echo 'ro.kernel.qemu=1' > /data/local.prop
and got:
Code:
$ echo 'ro.kernel.qemu=1' > /data/local.prop
cannot create /data/local.prop: permission denied
Is it significant that I'm seeing a "$" prompt instead of a "#"? or is that later in the process? Is it significant that, after the sym-linking of /data/local.prop to the log file and then rebooting, my phone had no signal and seemed pretty inoperable, but then after the write to /data/local.prop failed (and I sat googling around for a bit) the phone rebooted itself (no adb commands, and I didn't even breath in its direction) and came back to having signal and my settings, etc. and full operability?
Any help appreciated - I'll come back to this tomorrow ...

jehosephat said:
Trying this on a warranty replacement Dinc2 that's got Android 2.3.4, Software number 6.01.605.05 710RD ... the above post got me past the red triangle "!" thing, so I proceeded to:
Code:
adb shell
rm /data/data/recovery/*
ln -s /data/local.prop /data/data/recovery/log
exit
adb reboot
adb shell
echo 'ro.kernel.qemu=1' > /data/local.prop
and got:
Code:
$ echo 'ro.kernel.qemu=1' > /data/local.prop
cannot create /data/local.prop: permission denied
Is it significant that I'm seeing a "$" prompt instead of a "#"? or is that later in the process? Is it significant that, after the sym-linking of /data/local.prop to the log file and then rebooting, my phone had no signal and seemed pretty inoperable, but then after the write to /data/local.prop failed (and I sat googling around for a bit) the phone rebooted itself (no adb commands, and I didn't even breath in its direction) and came back to having signal and my settings, etc. and full operability?
Any help appreciated - I'll come back to this tomorrow ...
Click to expand...
Click to collapse
I'm in the same situation, any idea's yet? I wonder if I should htcdev unlock just to have root privilages

Here's a better guide for it, I'll update the OP in a minute: http://rootzwiki.com/topic/27003-root-dinc2-on-any-firmware-may-want-to-sticky-later/
Edit: OP updated.

prototype7 said:
Here's a better guide for it, I'll update the OP in a minute: http://rootzwiki.com/topic/27003-root-dinc2-on-any-firmware-may-want-to-sticky-later/
Edit: OP updated.
Click to expand...
Click to collapse
Thanks a lot, quick question though, will this send my phone into a continuous bootloop if I don't run aosp?
Sent from my ADR6425LVW using Tapatalk 2

prototype7 said:
Here's a better guide for it, I'll update the OP in a minute: http://rootzwiki.com/topic/27003-root-dinc2-on-any-firmware-may-want-to-sticky-later/
Edit: OP updated.
Click to expand...
Click to collapse
Trying this now. Hopefully it fixes the
Code:
cannot create /data/local.prop: permission denied
errors other people and myself are seeing.
---------- Post added at 02:46 PM ---------- Previous post was at 02:03 PM ----------
worked until i ran the tacoroot.sh --root command. Didn't root my phone and left me hanging at
Code:
adb shell chmod 777 /data/local/misc_version
adb shell /data/local/sh -c '/data/local/tmp/misc_version -s 2.18.605.3'
after --root this is what i received.
Code:
Usage:
--recovery : For this exploit to work, you must have booted recovery at least on
ce after your last factory reset.
--setup : Setup the phone for root, must be done before --root.
--root : Root the phone.
--undo : Remove TacoRoot.
----------
Rebooting into root.
C:\Program Files (x86)\Android\android-sdk\platforms>abd shell chmod 777 /data/l
ocal/misc_version
'abd' is not recognized as an internal or external command,
operable program or batch file.
C:\Program Files (x86)\Android\android-sdk\platforms>adb shell chmod 777 /data/l
ocal/misc_version
Unable to chmod /data/local/misc_version: No such file or directory
C:\Program Files (x86)\Android\android-sdk\platforms>adb shell /data/local/sh -c
'/data/local/tmp/misc_version -s 2.18.605.3'
/data/local/sh: not found
C:\Program Files (x86)\Android\android-sdk\platforms>

dets34 said:
Trying this now. Hopefully it fixes the
Code:
cannot create /data/local.prop: permission denied
errors other people and myself are seeing.
---------- Post added at 02:46 PM ---------- Previous post was at 02:03 PM ----------
worked until i ran the tacoroot.sh --root command. Didn't root my phone and left me hanging at
Code:
adb shell chmod 777 /data/local/misc_version
adb shell /data/local/sh -c '/data/local/tmp/misc_version -s 2.18.605.3'
after --root this is what i received.
Code:
Usage:
--recovery : For this exploit to work, you must have booted recovery at least on
ce after your last factory reset.
--setup : Setup the phone for root, must be done before --root.
--root : Root the phone.
--undo : Remove TacoRoot.
----------
Rebooting into root.
C:\Program Files (x86)\Android\android-sdk\platforms>abd shell chmod 777 /data/l
ocal/misc_version
'abd' is not recognized as an internal or external command,
operable program or batch file.
C:\Program Files (x86)\Android\android-sdk\platforms>adb shell chmod 777 /data/l
ocal/misc_version
Unable to chmod /data/local/misc_version: No such file or directory
C:\Program Files (x86)\Android\android-sdk\platforms>adb shell /data/local/sh -c
'/data/local/tmp/misc_version -s 2.18.605.3'
/data/local/sh: not found
C:\Program Files (x86)\Android\android-sdk\platforms>
Click to expand...
Click to collapse
Interesting. Looking over the code and tacoroot.sh, nothing actually puts the misc_version where it needs to be lol. Updated the instructions and added "adb push misc_version /data/local" before "adb shell chmod...", try that.

yeah i was just going to say looks like a the push misc_version was missing which solved everything for me.
as for others with this problem if the push misc_version doesn't seem to help i'd take a loot at this post here http://forum.xda-developers.com/showthread.php?t=1526316 for manually changing the version.
s-offffffed

dets34 said:
yeah i was just going to say looks like a the push misc_version was missing which solved everything for me.
as for others with this problem if the push misc_version doesn't seem to help i'd take a loot at this post here http://forum.xda-developers.com/showthread.php?t=1526316 for manually changing the version.
s-offffffed
Click to expand...
Click to collapse
So it worked?

[Q] How to root Desire Z without USB debugging

Hi. I did a factory reset and now I cannot get past the white HTC welcome screen. I don't have the phone rooted, hboot says S-ON. I had USB debugging disabled when doing the reset, so now I can't turn it on (since I won't get anywhere near the actual system).
Also, I don't know if this is the cause of not having USB debugging on - adb can't seem to find my device. When connected, it shows HBOOT USB PLUG, but adb devices returns an empty list..
Is there a way I can root/unlock the phone, without having debugging on, so that I can flash a recovery and a new system?
Thanks

Not too likely, adb will never work in bootloader mode but fastboot should. adb only works in os and recovery.
What you'll need to do is flash an RUU through bootloader or fastboot to get things working again. Check the development section here for a list of the latest RUUs for the vision
Sent from my Nexus 4 using XDA Premium 4 mobile app

I was swamped and got back to it by now. Thank you for your suggestion. It doesn't work though.
I downloaded the newest RUU from htcdev.com, the phone did get recognized by fastboot and the RUU installer seemed happy. However, when the actual update started, it got stuck on "Rebooting bootloader" or similar for over half an hour. That's when I decided to cancel it.
Next on, I tried steps shown here: androidforums .c o m/htc-desire-s/678126-desire-s-stuck-bootloader.html
fastboot erase cache - this got stuck on 'erasing cache', nothing happened afterwards
fastboot oem rebootRUU - this wrote "..." and nothing else happened
Is there anything else I can try?

ROOT
http://forum.xda-developers.com/showthread.php?t=2348266
http://forum.xda-developers.com/showthread.php?t=1178912
http://forum.xda-developers.com/wiki/HTC_Vision
How To Get R/W Access (Permanent Root / "Permaroot") using gfree v1.0[edit]
Prerequisites
Having the proper USB drivers installed - HTC Sync including Windows USB Drivers for the Vision
Disable auto-run or uninstall Visionary if you have it (It's important!)
adb (installed as part of the Android SDK.) See this guide on how to install/setup adb on your PC.
The HTC Desire Z with a firmware version higher than 1.34, T-Mobile G2 with a firmware version higher than 1.22 and the Desire HD with a firmware version higher then 1.32 have to be downgraded before proceeding.
Downgrading HTC Desire Z, T-Mobile G2 and Desire HD
For the 1.XX firmware HTC Desire Z follow this guide Downgrade DZ till step 12 and then come back.
For the 1.XX firmware HTC Desire HD follow this guide Downgrade HD and then come back.
For the 2.XX firmware HTC Desire Z/Desire HD and T-Mobile G2 follow this guide GUIDE Downgrade G2 2.13.531.8 (2.3.3 T-Mobile Rom w/ S-ON) & DZ 2.3.3 w/ S-ON" and come back. The history can be found in this thread New exploit works with Gingerbread! and Desire Z users see this posting of the thread Desire Z explanation.
Please use your brain when following these postings / guides. Especially make sure that you use a PC10IMG.zip for your device!
1. Necessary files
psneuter psneuter.zip (md5sum 89c2dec8d72d87b4c669f44dd31c8d17)
gfree v1.0 gfree_10.zip (md5sum 0bc9fc22bda897c765b02066f8a3c83b)
root_psn root_psn.zip (md5sum c8fe38ef55eb8951def9ff17b2eb99c1)
Superuser package su-2.3.6.2-efgh.zip (md5sum 43d9a40b63e916635d5ad7ca32433fab)
1.1. engineering hboot
Download the appropriate HBOOT for your phone:
T-Mobile G2: vision.hboot-0.76.2000.zip / Mirror (md5sum 7669AE12DC2FAA10AE555A164980EFD0)
HTC Desire Z: vision.hboot-0.84.2000.zip / Mirrors in this thread (md5sum 2CE1BDD5E4C1119CCFCECB938710D742)
HTC Desire HD: ace_glacier.hboot-0.85.2007.zip (md5sum df4fd77f44993eb05a4732210d2eddc6)
Note that the md5sums are for the actual hboot img contained within the zip file, not the for the zip file itself. Note also that the dz, g2, and dhd each use their own version of the engineering boot, as the phones are partitioned differently. (If you have previously installed the wrong HBOOT for your phone, you may need to reflash everything after partition 18)
1.2. clockwork recovery
Download the appropriate clockwork recovery for your phone:
ClockworkMod Recovery 5.0:
T-Mobile G2 and HTC Desire Z: recovery-clockwork-5.0.2.7-vision.img (md5sum 87a428549440894dbe2f96dd5efc4fb5)
HTC Desire HD: recovery-clockwork-5.0.2.0-ace.img (md5sum b8d77b9352dcbb41839e45342ea35658)
ClockworkMod Recovery 5.8 (touch):
T-Mobile G2 and HTC Desire Z: recovery-clockwork-touch-5.8.1.0-vision.img (md5sum b21aa5a0d593b6ebce880be3316ff64a)
HTC Desire HD: recovery-clockwork-touch-5.8.1.5-ace.img (md5sum fd6abfbc459663455a25b88ca7d77442)
Rename the file to 'recovery-clockwork.img'.
2. Copy the files to the phone
Before you can adb as described below you need to enable debugging in the settings on the phone. In Settings go to "Applications -> Development" and check the "USB debugging" option.
Connect the phone to the USB of your PC. The phone will stay connected during the complete procedure.
Make sure that you do NOT turn on USB storage. There has to be a sdcard in the phone and it has to be mounted to the phone!
In the commands to run below, $ or # represent the prompt and should NOT be entered as part of the commands (in Windows this will be something like C:\> instead).
Unpack all the zip files to a directory on your PC. Open a terminal (or command window) on your PC and change the current directory to where the files are on your PC and execute these commands:
$ adb push psneuter /data/local/tmp/
$ adb push gfree /data/local/tmp/
$ adb push busybox /data/local/tmp/
$ adb push hboot-eng.img /data/local/tmp/
$ adb push root_psn /data/local/tmp/
$ adb push su /sdcard/
$ adb push Superuser.apk /sdcard/
$ adb shell chmod 755 /data/local/tmp/*
2. clockwork recovery for T-Mobile G2 and HTC Desire Z
To copy your clockwork recovery execute the following command in the terminal or command window
$ adb push recovery-clockwork.img /data/local/tmp/recovery.img
3. Temporary root
In the terminal (or command window) execute these commands:
$ adb shell /data/local/tmp/psneuter
$ adb shell
after the last command you should have a root shell in adb (this is indicated by a # prompt). Leave this terminal (or command window) that contains the root shell open.
4 S-OFF, root and its friends Super-CID, SIM-unlock, engineering hboot, clockwork recovery and root
In the following section we are trying to gain write access to the emmc by power cycling it.
We recommend to install the engineering hboot as part of the gfree procedure.
In the root shell (indicated by the #) that you got in the Temporary root section execute the following commands:
# cd /data/local/tmp
# ./gfree -f -b hboot-eng.img -y recovery.img
# ./root_psn
# sync
Wait a few seconds for the changes to "take".
4.1. Automatic gfree hboot verification
As it is very important that the hboot was installed correctly gfree calculates md5sums of the partition. It will calculate the following 3 checksums
md5sum #1 - checksum of partition 18 before the installation
md5sum #2 - checksum of the hboot image that should be installed
md5sum #3 - checksum of partition 18 after the installation
gfree will check the md5sums and give you a proper success or error message. The messages are explained in detail at gfree-wiki
The messages that you want to see are either:
md5sum #1 == md5sum #2 - the hboot image is already installed -> skipping installation
or
md5sum #3 == md5sum #2 - the hboot image was successfully installed -> OK!
If you get a different error message you should run for help at #G2ROOT on Freenode.
If you got one of the two success messages described above -> You are fine, Reboot your phone by executing the following command in the root shell (indicated by the #):
# reboot
5. Verify the success of gfree
You can verify the success of gfree by using gfree_verify.
Download gfree_verify.zip from gfree_verify_v01.zip (md5sum 8e3535fd720d19fa0aec4eb711b897c4)
Unzip gfree_verify_v01.zip to a place on your PC.
Open a terminal (or command window) on your PC and change the current directory to where the files are on your PC and execute these commands:
$ adb push gfree_verify /data/local/tmp
$ adb shell chmod 755 /data/local/tmp/gfree_verify
$ adb shell
In this shell:
Remark: When you run su for the first time in the adb shell make sure the the screen of the phone is unlocked. Because when you enter the command the Superuser app will show up and ask you if you want to grant superuser access to app Unknown (2000).
Check the Remember check box and click allow.
$ su
# cd /data/local/tmp
# stop ril-daemon
# ./gfree_verify
You should see the following output:
gfree verify_cid returned:
@cid: 11111111
OK
gfree verify_secu_flag returned:
@secu_flag: 0
OK
gfree verify_simlock returned:
@simlock= 00
OK
Start the interface layer again (IN THE ADB SHELL ON YOUR PC):
# start ril-daemon
Did it work? Here's what you're looking for:
@cid: 11111111 <--- this response means you have superCID!
@simlock= 00 <--- this means your simlock is off.
@secu_flag: 0 <--- this means your radio is S-OFF.
6. Backup and cleanup
During the process gfree created backups of the partitions that it changed on your sdcard in /sdcard/
The files are called /sdcard/part7backup-.bin, part18backup-<time>.bin (if you installed hboot) and part21backup-<time>.bin. It is highly recommended that you copy these files to a save location on your PC and keep them!
You can delete the files in /data/local/tmp they are not needed anymore.
7. Next steps
Find a custom rom that you would like to install and install it using the clockwork recovery.
Enjoy the freedom of your phone.
If you like free phones and our work we would like to ask you to support the EFF.
Support the EFF[edit]
or
http://forum.xda-developers.com/showthread.php?t=1097977