Develop Bugs

[Q] Any chance of fixing USB Brick w/o root ?

Well I USB bricked my Desire last night.
To make things worse I was only able to apply the SD Card workaround via fastboot.
After flashing the update.zip from the modaco fix I instantly went back to the stock rom using the fastboot RUU process, without actually checking if it solved all the problems...
I know I had it coming...
Before I ship the phone out for repairs - maybe someone here knows if there is a chance to unbrick without root (nor having HBOOT version that allows to use any other method of rooting other than Unrevoked)
Code:
HBOOT 0.93
European 2.10.405 OTA
Thanks in advance

a more detailed description would help:
does your phone boot?
do you have running clockworkmod recovery?
did you do a nandroid backup before touching the system?
what modaco fix? give a link.
did you use unrevoked? thats the default root tool nowadays.
can you go to hboot/fastboot when pressing vol down while pressing power on?

Use a goldcard, it will enable you to put an unrooted Rom there. It's always a good reset option.
Sent from my HTC Desire using XDA App

mad-murdock said:
a more detailed description would help:
does your phone boot?
do you have running clockworkmod recovery?
did you do a nandroid backup before touching the system?
what modaco fix? give a link.
did you use unrevoked? thats the default root tool nowadays.
can you go to hboot/fastboot when pressing vol down while pressing power on?
Click to expand...
Click to collapse
Hi,
- the phone boots ok - It has most of the symptoms from All you need to know about USB-Bricks thread, the SD card started to work after issuing:
Code:
fastboot oem enableqxdm 0
This is the output from the fastboot oem boot command
Code:
$ fastboot-mac oem boot
... INFOsetup_tag addr=0xA0000100 cmdline add=0x8E07F9F0
INFOTAG:Ramdisk OK
INFOTAG:smi ok, size = 0
INFOTAG:hwid 0x0
INFOTAG:skuid 0x21F04
INFOTAG:hero panel = 0x0
INFOTAG:engineerid = 0x0
INFOMCP dual-die
INFOMCP dual-die
INFOTAG:mono-die = 0x0
INFODevice CID is not super CID
INFOCID is HTC__032
INFOsetting->cid::HTC__032
INFOserial number: HT057PL01634
INFOcommandline from head: no_console_suspend=1
INFOcommand line length =430
INFOactive commandline: board_bravo.disable_uart3=1 board_bravo.
INFOusb_h2w_sw=1 board_bravo.disable_sdcard=0 diag.enabled=0 boa
INFOrd_bravo.debug_uart=0 smisize=0 userdata_sel=0 androidboot.e
INFOmmc=false androidboot.baseband=5.09.05.30_2 androidboot.cid
INFO=HTC__032 androidboot.carrier=HTC-EastEurope androidboot.mid
INFO=PB9920000 androidboot.keycaps=qwerty androidboot.mode=norma
INFOl androidboot.serialno=HT057PL01634 androidboot.bootloader=0
INFO.93.0001 no_console_suspend=1
INFOaARM_Partion[0].name=misc
INFOaARM_Partion[1].name=recovery
INFOaARM_Partion[2].name=boot
INFOaARM_Partion[3].name=system
INFOaARM_Partion[4].name=cache
INFOaARM_Partion[5].name=userdata
INFOpartition number=6
INFOValid partition num=6
INFOmpu_nand_acpu_rw A1E 1000
INFOjump_to_kernel: machine_id(2457), tags_addr(0x20000100), ker
INFOnel_addr(0x20008000)
INFO-------------------hboot boot time:697447 msec
ERROR: usb_read failed with status e00002ed
FAILED (status read failed (No such file or directory))
- Sadly, I made a complete reflash using
Code:
fastboot rebootRUU;
fastboot flash zip rom.zip
... so no Clockwork recovery anymore
- Yes I have a nandroid backup but no means to put it back on the phone - the nandroid backup contains exactly the same rom I have now - just rooted
- As for the modaco fix I'm a new user I can't post external links, but it's the first link in this thread
- I did use the lastest Unrevoked3 (3.21) to root the phone
- I can use hboot / fastboot without problems but it's the stock 0.93.001 S-ON version.
Thanks

geejayoh said:
Use a goldcard, it will enable you to put an unrooted Rom there. It's always a good reset option.
Sent from my HTC Desire using XDA App
Click to expand...
Click to collapse
I have an unbranded Desire so no need to use a GoldCard if I'm not mistaken.
Anyway if memory serves me right using the GoldCard / HBOOT / PB99IMG flashing, won't allow me neither to downgrade, nor to flash an unsigned rom.
An unsigned rooted rom or HBOOT downgraded do 0.80 could help me fix my problem - but with HBOOT 0.93 - dowgrading doesn't seem to be an option. I get a "Main Version Older" error when trying to downgrade, and flashing an unsigned rom is a no-no for all stock bootloaders as far as I know (I tried both HBOOT and recovery, both as expected fail at signature verification).
But thanks anyway

Whats the exact problem now? You restored rom.zip via ruu. So you got a stock firmware with stock hboot and stock recovery which can be unrevoked again?
Seams i am missing a detail ^^
Sent from my HTC Desire using Tapatalk

mad-murdock said:
Whats the exact problem now? You restored rom.zip via ruu. So you got a stock firmware with stock hboot and stock recovery which can be unrevoked again?
Seams i am missing a detail ^^
Sent from my HTC Desire using Tapatalk
Click to expand...
Click to collapse
It seems to me you're missing the main issue not a detail
The main issue being a condition called "USB Brick" (well that's only half the truth, most of the main issue is me acting without thinking )
Please read the info thread on USB Bricks here, since you have a HTC Desire - it concerns you too. Good idea to backup the MISC partition if you plan to flash the phone again
Anyyyyway - as for my case:
I screwed up, flashed the stock firmware BEFORE checking if the applied USB brick fix solved my problems. So it's true I have stock firmware, stock hboot, stock recovery - but I also have no way to connect the phone to a computer via USB - because the flashing process updates the following partitions: system, recovery, boot but not the misc partition which is now corrupt, and its corruption is the cause of the USB brick...
USB Brick = no usb connection at all while booted to the Android OS
No usb connection = no usb debug mode
no usb debug mode = no unrevoked
The usb still works from HBOOT / FASTBOOT, so If you know of a way to start Unrevoked while the phone is in HBOOT / FASTBOOT - please enlighten me, because I couldn't do It.
Unrevoked only recognized the phone while it was in USB Debug mode, which it cannot enter now because of the USB Brick. When I connect the phone while in Fastboot USB mode or HBOOT USB mode Unrevoked just states "Waiting for device".
I don't think I am able to put this in any clearer way
Thanks

Ouch. Now i see. Didnt understand you at the start. Well, i had an usb brick myself after wiping the system. At least i had a modded hboot and recovery.
Now to your problem. Wierd situation, really. But if i remember right, flashing one of the ruu.Exe files should also fix misc. Then you have stock firmware with usb working. Cant link here in tapatalk, but those ruu file are a sticky in desire dev forum... tell me, if it worked...
Sent from my HTC Desire using Tapatalk

Solved!
I was able to successfully unbrick the phone
It wouldn't be possible without rageagainstthecage, All the people writing the tutorials on USB unbricking, QuickSSHd and the Terminal Emulator app. Thanks to the authors.
I'll try to sum things up for anyone interested:
The problem
Because of acting without thinking I ended up with a stock unrooted rom and a partial USB brick. To make things worse I accepted the OTA update, installing the oh so loved HBOOT 0.93.100 S-ON.
The Solution
After some reading about rageagainstthecage, PoC code on which the Unrevoked rooting solution is based I tried to run the exploit directly on the phone.
Without having access to adb I wasn't able to find a place to put the executable, as the /data/ directory is writable only by the system user and the system group, and most tutorials suggest to place the exploit somewhere inside that directory. But all the tutorials I found mentioned using adb push to put the file on the phone, which probably operates on the phone as system:system as it is capable of writing to the /data dir. I wasn't able to write there as I had the id of the Terminal Application
Since apps storing data seem to store er... data in /data/data I had a little breakthru. Becaue I couldn't find a free telnet solution I purchased the QuickSSHd from Android Market.
This allowed me to have write access to /data/data/<package_name>/home where I created a world readable (755) directory. I scp'd the rageagaintthecage, modified misc partition image and flash_image binary to the phones filesystem, and made them executable. I could've used the Terminal Apps <data dir>/shared_prefs directory (which would be a $$$ free solution, as the ssh was not free, but not expensive either) but I'm lazy and doing stuff from a PC keyboard is easier than from a touch keyboard.
Running the exploit and flash_image from inside a ssh session seemed like a good idea but the sshd died after running the exploit, and didn't want to start untill the phone was rebooted. So next time I just started the sshd and done the rest of the stuff from a Terminal Emulator (After preparing scripts for ease of execution, and dropboxing the paths for copy paste ). After running the exploit the Terminal Emulator app stopted working correctly (as expected) but after force closing it and running it again I was greeted with a # prompt
I flashed the misc partition with an image modified with my phones CID, rebooted and voila! USB brick gone
Now I just have to beat one thing into my empty head (in the manner of "stop, drop, and roll" firedrill mantra). STOP, READ and THINK - before flashing
g'night

mad-murdock said:
Ouch. Now i see. Didnt understand you at the start. Well, i had an usb brick myself after wiping the system. At least i had a modded hboot and recovery.
Now to your problem. Wierd situation, really. But if i remember right, flashing one of the ruu.Exe files should also fix misc. Then you have stock firmware with usb working. Cant link here in tapatalk, but those ruu file are a sticky in desire dev forum... tell me, if it worked...
Sent from my HTC Desire using Tapatalk
Click to expand...
Click to collapse
Hi,
Just fyi because I was able to resolve my problem in the meantime.
Because I was foolish enough to install the OTA upgrade before it occured to me that the USB is not working, installing any RRU either in the official way (by running the exe) or by extracting the rom.zip from inside of the exe didn't work. The latest RRU was older then the firmware with OTA upgrade on my phone, and it didn't seem to allow me to downgrade.
ZIP way = Main Version Older error
EXE way = You have to install the correct firmware version or some other bla bla bla
Anyway I took a look inside the rom.zip extracted from the RRU.exe - there are img files of every partition, radio and hboot but no misc.
But thanks again anyway

How did you solve your tricky situation then?
Sent from my HTC Desire using Tapatalk

quanchi said:
I was able to successfully unbrick the phone
It wouldn't be possible without rageagainstthecage, All the people writing the tutorials on USB unbricking, QuickSSHd and the Terminal Emulator app. Thanks to the authors.
I'll try to sum things up for anyone interested:
The problem
Because of acting without thinking I ended up with a stock unrooted rom and a partial USB brick. To make things worse I accepted the OTA update, installing the oh so loved HBOOT 0.93.100 S-ON.
The Solution
After some reading about rageagainstthecage, PoC code on which the Unrevoked rooting solution is based I tried to run the exploit directly on the phone.
Without having access to adb I wasn't able to find a place to put the executable, as the /data/ directory is writable only by the system user and the system group, and most tutorials suggest to place the exploit somewhere inside that directory. But all the tutorials I found mentioned using adb push to put the file on the phone, which probably operates on the phone as system:system as it is capable of writing to the /data dir. I wasn't able to write there as I had the id of the Terminal Application
Since apps storing data seem to store er... data in /data/data I had a little breakthru. Becaue I couldn't find a free telnet solution I purchased the QuickSSHd from Android Market.
This allowed me to have write access to /data/data/<package_name>/home where I created a world readable (755) directory. I scp'd the rageagaintthecage, modified misc partition image and flash_image binary to the phones filesystem, and made them executable. I could've used the Terminal Apps <data dir>/shared_prefs directory (which would be a $$$ free solution, as the ssh was not free, but not expensive either) but I'm lazy and doing stuff from a PC keyboard is easier than from a touch keyboard.
Running the exploit and flash_image from inside a ssh session seemed like a good idea but the sshd died after running the exploit, and didn't want to start untill the phone was rebooted. So next time I just started the sshd and done the rest of the stuff from a Terminal Emulator (After preparing scripts for ease of execution, and dropboxing the paths for copy paste ). After running the exploit the Terminal Emulator app stopted working correctly (as expected) but after force closing it and running it again I was greeted with a # prompt
I flashed the misc partition with an image modified with my phones CID, rebooted and voila! USB brick gone
Now I just have to beat one thing into my empty head (in the manner of "stop, drop, and roll" firedrill mantra). STOP, READ and THINK - before flashing
g'night
Click to expand...
Click to collapse
Any chance of adding some links or actual information?
I've got exactly the same problem and you seem to have the solution.
Any chance of sharing?

Usb Brick !? This is an OLD thing I have this some Months ago. Never heard of someone who got it again! YOU did something wrong ;-)

Sure, he did something wrong.I managed this, too, when playing with a partition tool not designed for my system. Misc partition damaged, so a nice usb brick...
About the requested links : just use forum search for usb brick. First hit is your sticky solution
Sent from my S-OFF'd brain using teh internetz

CyberTech71 said:
Any chance of adding some links or actual information?
I've got exactly the same problem and you seem to have the solution.
Any chance of sharing?
Click to expand...
Click to collapse
I couldn't post external links, forum limitation for new users... Now I see I can so:
This is a specific situation - usb brick and totally stock rom, recovery and hboot. It's not required for people who have a modified recovery and a rooted rom. It's easy like 1-2-3.
Before doing anything else enable the Debug Mode in the Applications / Dev menu
1. Download the rageagainstthecage exploit from the authors site:
http://c-skills.blogspot.com/2010/08/please-hold-line.html
2. Download the flash_image and misc (mtd0.img) partition image from this thread.
http://forum.xda-developers.com/showthread.php?t=691639&highlight=usb+brick
Modify the mtd0.img according to your phones CID (how to get the CID also explained in the thread)
2. Download Android Terminal Emulator from the Market
3. Copy the exploit binary (rageagainstthecage-arm5.bin), the flash_image and modifed mtd0.img to the sdcard via an external card reader
4. Start the Terminal
5. Copy the files to the Terminal app data directory (the only place on the data partition you will have write access while running the Terminal), and make the binaries executable
Code:
cat /sdcard/rageagainstthecage-arm5.bin > /data/data/jackpal.androidterm/shared_prefs/rageagainstthecage-arm5.bin
cat /sdcard/flash_image > /data/data/jackpal.androidterm/shared_prefs/flash_image
cat /sdcard/mtd0.img > /data/data/jackpal.androidterm/shared_prefs/mtd0.img
cd /data/data/jackpal.androidterm/shared_prefs/
chmod 755 rageagainstthecage-arm5.bin flash_image
6. Run the exploit
Code:
/data/data/jackpal.androidterm/shared_prefs/rageagainstthecage-arm5.bin
After the exploit exits/finishes there should be a short system freeze, followed by inablity to issue any command from the terminal (don't worry). Exit the Terminal by long pressing HOME and force close the Terminal app from the Application Manager
7. Start the terminal again, a root prompt should be visible
8. Flash the misc partition
Code:
cd /data/data/jackpal.androidterm/shared_prefs
./flash_image misc mtd0.img
9. Reboot
Done and done
Enjoy
PS. I suck at writing tutorials, but if the details are still hazy for you after reading this - better to service the phone, because you might end up bricking the device totally - cheers

quanchi said:
I was able to successfully unbrick the phone
It wouldn't be possible without rageagainstthecage, All the people writing the tutorials on USB unbricking, QuickSSHd and the Terminal Emulator app. Thanks to the authors.
I'll try to sum things up for anyone interested:
The problem
Because of acting without thinking I ended up with a stock unrooted rom and a partial USB brick. To make things worse I accepted the OTA update, installing the oh so loved HBOOT 0.93.100 S-ON.
The Solution
After some reading about rageagainstthecage, PoC code on which the Unrevoked rooting solution is based I tried to run the exploit directly on the phone.
Without having access to adb I wasn't able to find a place to put the executable, as the /data/ directory is writable only by the system user and the system group, and most tutorials suggest to place the exploit somewhere inside that directory. But all the tutorials I found mentioned using adb push to put the file on the phone, which probably operates on the phone as system:system as it is capable of writing to the /data dir. I wasn't able to write there as I had the id of the Terminal Application
Since apps storing data seem to store er... data in /data/data I had a little breakthru. Becaue I couldn't find a free telnet solution I purchased the QuickSSHd from Android Market.
This allowed me to have write access to /data/data/<package_name>/home where I created a world readable (755) directory. I scp'd the rageagaintthecage, modified misc partition image and flash_image binary to the phones filesystem, and made them executable. I could've used the Terminal Apps <data dir>/shared_prefs directory (which would be a $$$ free solution, as the ssh was not free, but not expensive either) but I'm lazy and doing stuff from a PC keyboard is easier than from a touch keyboard.
Running the exploit and flash_image from inside a ssh session seemed like a good idea but the sshd died after running the exploit, and didn't want to start untill the phone was rebooted. So next time I just started the sshd and done the rest of the stuff from a Terminal Emulator (After preparing scripts for ease of execution, and dropboxing the paths for copy paste ). After running the exploit the Terminal Emulator app stopted working correctly (as expected) but after force closing it and running it again I was greeted with a # prompt
I flashed the misc partition with an image modified with my phones CID, rebooted and voila! USB brick gone
Now I just have to beat one thing into my empty head (in the manner of "stop, drop, and roll" firedrill mantra). STOP, READ and THINK - before flashing
g'night
Click to expand...
Click to collapse
Hello
in you problem with USB bricks for unrooted HTC desire
I have the seam problem
please explain it to me
I copy the flash_image and mtd0.img to
\data\data in my device I only need to flash them to restore my device
when I try this command in terminal Eliminator
/data/data/flash_image misc /data/data/mtd0.img
It show me
error writing misc permission denied
help me please

I can't believe it, mate, finally this tutorial solved my usb (and bluetooth, and fm radio, and...) problem!!!!!
My Desire is unrooted, I've tried so many solution in the last 3 months but they all were useless.
I was starting to pack my phone for sending it to HTC Service when... tataaaa, I found your topic. Is on your if my wonderful Android powered phone got back fully functional.
Really, thank you for sharing your solution with us.
===========;-D
Francalberto

francalberto said:
I can't believe it, mate, finally this tutorial solved my usb (and bluetooth, and fm radio, and...) problem!!!!!
My Desire is unrooted, I've tried so many solution in the last 3 months but they all were useless.
I was starting to pack my phone for sending it to HTC Service when... tataaaa, I found your topic. Is on your if my wonderful Android powered phone got back fully functional.
Really, thank you for sharing your solution with us.
===========;-D
Francalberto
Click to expand...
Click to collapse
Good for you
All the credit goes to the people responsible for the tools used, I just put some things together.
Cheers

thank you very much
I really appreciate you effort you helped me so much
you are a brilliant man
thank you

Flashb, is your problem solved now?
Swyped with my S-OFF'd brain using teh internetz

[Guide] Subsidy Unlock, SuperCID, and Radio S-OFF

Update 12-29-10: Due to problems reported with v03, we now link to v02.
Update 12-23-10: A new version of gfree, v02, has just been released by Guhl. Links have been updated to the new version, which allows you to set Sim Unlock, CID, and Radio S-ON/OFF independently. If you have previously run gfree, you will receive no additional benefit from running gfree v2, unless you want to change one of the settings.
Notice: gfree is known not to work for radio firmwares with higher versions then 26.03.02.xx -- the reason for this is that HTC patched the hole that allowed scotty2 to power cycle the emmc chip to drop its write protection. So if you installed a radio version with a higher version number, downgrade the radio firmware before using gfree.
Guhl also released gfree_verify, which allows you to verify your phone's settings (regardless of which gfree you used). See the wiki for more on that.
The wiki is usually up to date on the latest of everything, so be sure to check it frequently.
---------------
scotty2 delivers again!
His "gfree" program should do the following for your g2, dz, or dhd:
* Radio S-OFF -- the real deal. This means the g2 will permit permanent root.
* Subsidy Unlock -- AKA "Sim Unlock" AKA "Network Unlock" AKA "Use a foreign SIM Card"
* SuperCID - enables the flashing of any carrier's firmware for the phone.
If you don't know what this means or why you might want it, check the wiki.
INSTRUCTIONS:
NOTE: If you have NOT permarooted your phone previously with the HBOOT/wpthis method, doing so using the new "gfree" method should have the added effect of sim-unlocking the phone, setting superCID and turning Radio S-OFF. In fact, it's the new method for permarooting for G2/DZ and DHD. So if you haven't yet permarooted, look at those instructions.
Again, the instructions below are for people only who have already previously "permarooted" through the earlier hacked-HBOOT method. See the wiki if you are starting from scratch with a new G2/DZ/DHD and have not yet done anything "root-ish".
WARNING: Be aware that by following these instructions you are messing with your phone with potential for screwing things up. Do so at your own risk. The many authors of this guide assume no responsibility for any damage to your phone, health, general well-being, or anything else untoward with respect to these instructions or you following them.
gfree uses a dynamic in-memory patch of the kernel to remove the kernel's write protection of the radio partition.
So, for those of you who have permarooted the old HBOOT way and put on new kernels --The following kernel versions that are known NOT to work yet with gfree. If you have one of the following kernel versions on your phone install a different (stock, OTA or cyanogen) kernel before starting this procedure:
| pershoots 11/30 build
| pershoot's 2.6.32.26 – OC-UV-NEON_FP (1.516GHZ) – G2 - 12/3
| Cyanogen Kernel / release 6.1.1
| 2.6.32.26-cm-virtuous-v1.0 [email protected]#1
Other newer kernels may also not work with gfree. So if you experience problems with this procedure (either the phone reboots during the process or the procedure completes correctly but the verify still shows that the phone is locked) then you may think about downgrading the kernel to an original stock kernel or even better to this kernel.
Okay. So we're assuming you've permarooted already and usb debugging is on (Applications > Development, then enable USB debugging). You'll also need about 5MB free on your sdcard.
You might want to back up your phone with nandroid on the Clockwork recovery image first, just in case.
Note: If you hanker to do it the longer, manual, harder, and more dangerous way, or are just curious what gfree does, see the wiki history for the old instructions.
No? Then let's begin.
==== 1. Download gfree and verify sdcard is not mounted by your computer ====
You will need to download a program called gfree (v02) that will first copy partition 7 of the phone, then patch it, then reflash back to your phone. (verified to work with the g2 and desire z as well as the desire hd). (You will also need adb, which you can download as part of the Android SDK.)
Unzip gfree_02.zip to your computer.
Make sure your computer is not mounting your phone's sdcard.
==== 2. Run gfree on the phone ====
On your computer's terminal/command line, navigate to where the gfree file is, and then...
Code:
adb push gfree /data/local
adb shell
This copies gfree to your phone, then puts you in your phone's terminal. Then do this:
Code:
su
cd /data/local
chmod 777 gfree
./gfree -f
sync
Wait a few moments for the sync to "take". Then reboot your phone. That's it!
gfree created a backup of your original partition 7 at /sdcard/part7backup-<time>.bin you might consider copying this to a safe location on your computer.
Now you can try using a new SIM card to verifiy that it worked. Also, if you had to flash a different kernel before running gfree, you may now reflash the kernel you originally had.
Thanks to the gang at #g2root, including IntuitiveNipple, scotty2, tmzt, rhcp, ciwrl, and guhl... among many others.
Wiki: How to enable Radio S-OFF, SuperCID, and SIM-unlock (with some informational background)
File: gfree_02.zip
File: gfree_verify_v01.zip
Feel free to use the "Thanks" button below. Also, Scotty2's paypal email is walker.scott AT gmail.com if you want to make a contribution.
Finally, Americans might consider making a donation to the Electronic Frontier Foundation who fight to defend your legal right to root or unlock your own phone when the carriers and phone manufacturers may lobby or otherwise try to stop you. The EFF can always use your tax-deductible support.

Hey thanks for posting this!
So I guess this is like perm-perm-root.
Giving it a shot now.
Sent from my HTC Vision using XDA App

thenefield said:
Hey thanks for posting this!
So I guess this is like perm-perm-root.
Giving it a shot now.
Sent from my HTC Vision using XDA App
Click to expand...
Click to collapse
Yeah it's sim-unlock too. Which is nice.

Nice thanks going to try it to.
Sent from my HTC Vision using Tapatalk

shouldnt one image work for every phone

Word up scotty2. You the man.
EDIT: And you too fattire for writing up what no one else wants to

thatruth132 said:
shouldnt one image work for every phone
Click to expand...
Click to collapse
No. If it did, then this would be a lot easier, huh?

I cant wait until some juicy stuff comes out of this.

Now, what does this mean
"make everything better."

This is freaking awesome.

andrewklau said:
Now, what does this mean
"make everything better."
Click to expand...
Click to collapse
You know.... everything.

...
I just bricked my phone LMAO!!!
I did the perm root that was easy... this jeez... followed the [Guide] How to recover your semi-brick (OMFG Thank you guys over there!) BUT I'm back... I literally almost **** my pants. Well... Gonna try this again maybe after finals LOL

Question though (going to try it later tonight LOL =P) the guide says I need a "custom cyanogenmod based kernel and provides the boot image that contains it.. I am using the nightlies do they contain that same function or no? also when I did flash that boot image and ran "insmod /sdcard/wpthis-cyanogen.ko" it said error function not implemented? Anyone not run into this issue? or have any ideas?

nycjv321 said:
Question though (going to try it later tonight LOL =P) the guide says I need a "custom cyanogenmod based kernel and provides the boot image that contains it.. I am using the nightlies do they contain that same function or no?
Click to expand...
Click to collapse
Nope.
nycjv321 said:
also when I did flash that boot image and ran "insmod /sdcard/wpthis-cyanogen.ko" it said error function not implemented? Anyone not run into this issue? or have any ideas?
Click to expand...
Click to collapse
"Error function not implemented" means it worked.

well this time it didn't brick... I think I got it time to verify it

Ok I ran it all again and worked but when I was verifying it I got all the supposed feedback except at "echo -e 'AT$QCPWRDN\r' > /dev/smd0" I got AT$QCPWRDN and then +CME Error: 0.... (No OK as said in the guide? ) and then it rebooted? what didn't work?

Got it to work!
SuperCID, Radio S-OFF, Subsidy Unlock is a reality!
Thanks to scotty2.
Thanks also to guhl (guhl99).
Read my post for more details: http://forum.xda-developers.com/showpost.php?p=9495073&postcount=363
Thread: http://forum.xda-developers.com/showthread.php?p=9495073#post9495073

This may be a stupid question but doesn't 0 also equate to no error? (In my older post) (Its just not stated in the guide, I don't want to overlook something which is why I asked ) You guys are AWESOME!!!

nycjv321 said:
This may be a stupid question but doesn't 0 also equate to no error? (In my older post) (Its just not stated in the guide, I don't want to overlook something which is why I asked ) You guys are AWESOME!!!
Click to expand...
Click to collapse
After entering the following into ADB Shell command prompt:
# echo -e 'AT$QCPWRDN\r' > /dev/smd0
The reply I got was a bunch of numbers (which filled the screen and wrapped to a new line) from what I can recall and then the phone rebooted. I didn't save the command window so I don't have the full details.
When the phone re-booted, I get signal from the local Thailand carrier AIS using a pre-paid SIM card.
The first time I went through the process I made a mistake setting the following using the Hex Editor:
"...set the 4 bytes at 0x807fc to 49 53 F4 7D"
The second time around I figured out what the "c" in "0x807fc" meant in terms of location on the Hex Editor. That was it.

:O i cant believe how awesome scotty2 is...

[Q] how to root my HTC desire HD version Android 2.3.5 with HTC sense 3.0

Hi Everybody!!
I would like to root my HTC desire HD with android version 2.3.5 & HTC sense 3.0.
As per the xda forums I have tried both the options
1. Using the unlock root tool.
2. using the Advance Ace hack kit tool.
Using the first option it gives me an error saying that "Failed to get the shell root"
Using the 2nd option Advance ace kit tool. I had run the hack-ace.cmd file using run as administrator.
Then after entering the key it asked me to downgrade it as the version it latest.
I downloaded saying "yes" then it asked for Flash to downgrade option.
After that during the time of rebooting under the flash downgrade option, it got stuck under the HBOOT menu.
I am attaching the text file of advance ace kit tool run by me for any evaluation purpose.

I would click on the irc link in the ace hack kit and get help there...
Sent from my Inspire 4G using xda premium

maddiedad2009 said:
I would click on the irc link in the ace hack kit and get help there...
Sent from my Inspire 4G using xda premium
Click to expand...
Click to collapse
Might have to do a manual downgrade with PD98.img file and a goldcard, that's what I had to do first at least, (Telus DHD).

Prashanti said:
Hi Everybody!!
I would like to root my HTC desire HD with android version 2.3.5 & HTC sense 3.0.
As per the xda forums I have tried both the options
1. Using the unlock root tool.
2. using the Advance Ace hack kit tool.
Using the first option it gives me an error saying that "Failed to get the shell root"
Using the 2nd option Advance ace kit tool. I had run the hack-ace.cmd file using run as administrator.
Then after entering the key it asked me to downgrade it as the version it latest.
I downloaded saying "yes" then it asked for Flash to downgrade option.
After that during the time of rebooting under the flash downgrade option, it got stuck under the HBOOT menu.
I am attaching the text file of advance ace kit tool run by me for any evaluation purpose.
Click to expand...
Click to collapse
Hi Prashanti,
I was stuck in HBOOT or green HTC Logo (bootloop) the other day
Thanks to one the members from xda I have managed to to put the stock rom back in.
Heres the link:
http://forum.xda-developers.com/showthread.php?t=1275632&page=38
Hope it helps my friend!
Kind regards,
Luke

The AAHK usually will complete the process itself quite easily, but you have to prepare the correct drivers etc....I tried it on Windoze first and it didn't work, then got home ran it n Mac and it went smoothly as anything.

Please help me rooting my htc desire HD phone
Prashanti said:
Hi Everybody!!
I would like to root my HTC desire HD with android version 2.3.5 & HTC sense 3.0.
As per the xda forums I have tried both the options
1. Using the unlock root tool.
2. using the Advance Ace hack kit tool.
Using the first option it gives me an error saying that "Failed to get the shell root"
Using the 2nd option Advance ace kit tool. I had run the hack-ace.cmd file using run as administrator.
Then after entering the key it asked me to downgrade it as the version it latest.
I downloaded saying "yes" then it asked for Flash to downgrade option.
After that during the time of rebooting under the flash downgrade option, it got stuck under the HBOOT menu.
I am attaching the text file of advance ace kit tool run by me for any evaluation purpose.
Click to expand...
Click to collapse
Hi after the AAKT dint help me. I have read the Effen manual ...during the time of flash downgrade it says that phone will boot in hboot and v will prompt with "vol-up" button then reboot with flashing twice..
But this dint happen only i got hboot but no instruction.
Then as per my previous post reply i tried the manual downgrade. still it dint worked after creating the gold card too.
It gives me an error saying "device not found in the command prompt as per section 2b in one of the xda forum Gingerbread method.
Please help!!

Have you tried my method? Go into recovery, plug your phone in to your pc, go to shipped Rom and download your stock rom.
Run it from your pc and you will be fine. The manual method did not worked for me but this did. Just look at my link in my previous post.
Sent from my HTC Desire HD A9191 using XDA App

lukass1984 said:
Have you tried my method? Go into recovery, plug your phone in to your pc, go to shipped Rom and download your stock rom.
Run it from your pc and you will be fine. The manual method did not worked for me but this did. Just look at my link in my previous post.
Sent from my HTC Desire HD A9191 using XDA App
Click to expand...
Click to collapse
My hboot menu not working. When i try to boot it using vol-up & power key .... nothing is happening. What to do?

Just in case it helps. Check out a couple of links in my sig. The Desire HD page includes a couple of Desire HD rooting videos. They might help you.

Prashanti said:
My hboot menu not working. When i try to boot it using vol-up & power key .... nothing is happening. What to do?
Click to expand...
Click to collapse
Exactly the same problem here... Using the AAHK failed and I'm stuck on the HBOOT screen with volume and power keys unresponsive.
My AAHK run looks exactly like mine (except that I used the linux version).
Btw, I also had DHD with OTA Gingerbread 2.3.5 and Sense 3.0.
Help will be greately appreciated...!!

Wait for ics rom which is on way by may, Its official htc rom.

harisharun said:
Wait for ics rom which is on way by may, Its official htc rom.
Click to expand...
Click to collapse
Yes, I would be glad to go back to the stock ROM. If I just could wake my phone up...
Being stucked in the HBOOT screen, rooting it is not my main concern now. Having a usable device is!

Prashanti said:
My hboot menu not working. When i try to boot it using vol-up & power key .... nothing is happening. What to do?
Click to expand...
Click to collapse
Sorry, didn't realised that your buttons don't work also.
I am not experienced enough to help you I'm afraid. I'm sure someone will be able to guide you in the right direction.
Good luck!

Good news (partially):
I've talked to people at the AAHK IRC channel. They told me this problem was due to a corrupted sd card.
Following their advise, I've changed to another sd card. As a result, my HBOOT is now responding!
However, if I try to boot normaly, my phone does not boot. They said this is weird, and that I would have to flash an RUU. I've not done this before, but I think there are good tutorials around, so I'll give it a try...

Partial good news are better than no news my friend! Please keep us posted on your progress.
By the way, are you S-off ?
Sent from my HTC Desire HD A9191 using XDA App

Problem solved!
As proposed by the AAHK team (on their irc channel):
- Removed the sd card.
- Flashed an original (vodafone) RUU.
- Placed another sd card.
- Ran the AAHK again.
This time the AAHK ran smoothly and I ended up with an S-OFF terminal.
Now let those ROMs come...

Well done mate!
Enjoy and thanks for posting the result. May come in handy for the future

I am still getting stuck both in windows & Linux Ubuntu....
Here is the log from Ace Hack CMD:
Ace Advanced Hack Kit [Linux/OSX/Windows] attn1 2011/2012
___________________________
MAIN MENU | |
| Only ONE Menu Step to: |
1 - Hack Ace <----------------------------+ * S-OFF |
| * SIM Unlock |
2 - DONATE (Encouraged, but optional) | * SuperCID |
Free HTC goldcard generator | RevSkills | * Root |
http://www.eff.org/ | * Busybox |
| |
************************************************** ********************
o - Options Menu (Return to Stock, Flash radios, etc)
************************************************** ********************
t - Toggle Flash Method - current method is fastbootRUU
************************************************** *******************
q - Quit
[Select and press Enter]1
ro.product.version=3.13.832.4
This version of Android cannot use the hack kit at this time.
You can downgrade if you like, then rerun the hack step.
WARNING: THIS WILL WIPE DATA
[Would you like to downgrade? y/n]y
Download this RUU? [y,n]y
--2012-01-28 04:42:21-- http://tau.shadowchild.nl/files/PD98IMG-GB2.zip
Resolving tau.shadowchild.nl... 176.9.40.154
Connecting to tau.shadowchild.nl|176.9.40.154|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 259503624 (247M) [application/zip]
Saving to: `PD98IMG/PD98IMG-GB2.zip'
100%[======================================>] 259,503,624 253K/s in 16m 51s
2012-01-28 04:59:13 (251 KB/s) - `PD98IMG/PD98IMG-GB2.zip' saved [259503624/2595
03624]
a67daa6baa7ef085307593fef6329d14 *PD98IMG/PD98IMG-GB2.zip
Flash the downgrade RUU? [y,n]y
pushing rom to sdcard - this takes time please be patient.
2273 KB/s (259503624 bytes in 111.483s)
2400 KB/s (572752 bytes in 0.233s)
552 KB/s (19240 bytes in 0.034s)
673 KB/s (14475 bytes in 0.021s)
Starting stock recovery the first time to init....
Steps:
1. When you see the ugly red triangle, push/hold vol-UP and then push power to
start stock recovery.
2. When you get to the blue stock recovery menu, choose reboot and push power.
TacoRoot: HTC Edition v1
By Justin Case (jcase)
Presented by TeamAndIRC, RootzWiki and AndroidPolice
With great assistance from Reid Holland (Erishasnobattery)
----------
TacoRoot: HTC Edition v1 is based on a vulnerability independently discovered by
both Justin Case and Dan Rosenberg (Rosenberg fist). I believe unrevoked and
AlpahRev were also aware of it.
----------
Usage:
--recovery : For this exploit to work, you must have booted recovery at least on
ce after your last factory reset.
--setup : Setup the phone for root, must be done before --root.
--root : Root the phone.
--undo : Remove TacoRoot.
----------
Rebooting into recovery, please press Volume+, Volume- and Power at the same tim
e, and reboot the system.
Starting stock recovery for the last time....
Steps:
1. When you see the ugly red triangle, push/hold vol-UP and then push power to
start stock recovery.
2. When you get to the blue stock recovery menu, choose reboot and push power.
TacoRoot: HTC Edition v1
By Justin Case (jcase)
Presented by TeamAndIRC, RootzWiki and AndroidPolice
With great assistance from Reid Holland (Erishasnobattery)
----------
TacoRoot: HTC Edition v1 is based on a vulnerability independently discovered by
both Justin Case and Dan Rosenberg (Rosenberg fist). I believe unrevoked and
AlpahRev were also aware of it.
----------
Usage:
--recovery : For this exploit to work, you must have booted recovery at least on
ce after your last factory reset.
--setup : Setup the phone for root, must be done before --root.
--root : Root the phone.
--undo : Remove TacoRoot.
----------
Rebooting into root.
allowing time for the rom to settle.....
Creating goldcard....
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
RevSkills | We deliver mobile forensic and analysis software solutions worldwide
0+1 records in
0+1 records out
384 bytes transferred in 0.009 secs (42666 bytes/sec)
setting mainver lower for downgrade...
--set_version set. VERSION will be changed to: 1.31.405.6
Misc partition is "/dev/block/mmcblk0p17"
Patching and backing up misc partition...
starting downgrade...
** The phone will now reboot into HBOOT.
** It will then check the file just sent.
** If everything is okay, the phone will
** prompt you to continue by pressing
** VOLUME UP. It will reboot, flashing twice.
**** PUSH POWER WHEN THIS STEP COMPLETES ****
If downgrade is successful, you may set up the phone and try to hack it again.
Once the downgrade is successful, press a key to return to the menu......
Otherwise, cut and paste the output to the screen into a text file for evaluatio
n.... then press a key.
Press any key to continue . . .

Are you sure you installed all the drivers correctly? Maybe you fotgot to do something.
Sent from my HTC Desire HD using XDA App

Prashanti, have you changed your sd card?

Wildfire S T-Mobile...can't seem to root...help?

Got the device today, and already came with the bootloader unlocked and S-On...but every method I've tried just doesn't work - even temporary root.
Here's the info on the phone:
-T-Mobile Wildfire S (Marvel PVT) running 2.3.5
-Firmware - 2.17.531.1
-HBOOT - 1.08.0099
Any driver files I've seen are either dead links or "not available in my country" (I'm in the USA), but I'm almost positive I have the appropriate drivers on my Win7 64-bit install, since anything I've had to do on my G2 was problem-free.
Here's what I've tried, all in both "charge only" and "HTC sync" mode, with HTC sync disabled/not running on the PC:
-SuperOneClick - freezes at step #7
-Gingerbreak - endlessly "works" and never accomplishes anything
-Flashing anything via the bootloader fails, either due to not being the "right" image (picks up and starts loading/installing, but then it seems like the file is corrupt and it's aborted - and I've tried multiple files/versions) or failing due to some Model ID mismatch or something
-Flashing a recovery through fastboot (from this thread: http://forum.xda-developers.com/showthread.php?t=1503393) seems to have bricked my recovery
-Anything else in that guide (basically anything zergRush) fails to copy anything over to /system or /sbin or whatever even though it says it successfully rooted at the end
-The temporary root procedure gives me some random error about drivers in the middle of the process and fails
I'm at my wits end here - I just don't know what I'm doing wrong, if anything. If I had known the Wildfire S would be such a PITA just to root, I probably wouldn't have gotten it and saved up for something else...at least I still have my G2 =/

Check that only one instance of ADB is running (in task manager).

try installing Busybox and Superuser from the market first then trying one of the other methods again

inconn said:
Check that only one instance of ADB is running (in task manager).
Click to expand...
Click to collapse
I went and killed it after each time in order to be able to delete the files, that wasn't it.
Nicknoxx said:
try installing Busybox and Superuser from the market first then trying one of the other methods again
Click to expand...
Click to collapse
Tried that too, didn't work.
Ended up doing a full reset because it refused to mount the SD card on my PC at some point, and tried this method:
http://forum.xda-developers.com/showpost.php?p=22178267&postcount=128
And managed to get it rooted that way. Much more inclined to keep my new WFS now

I have tmobile us and all I did was install cwm recovery and flashed a root.zip file. You can pm me if you need the file.
Sent from my HTC Wildfire S using xda premium

I know this thread's been dead for a couple months, but I didn't see that it was resolved...did you turn usb debugging on?
You need that on to root these phones...
Edit : NVM, I should have read a little bit more. Please disregard.

[Q] HTC Desire HD

I have been true some web sites and have not found a solution for this problem. I have a HTC Desire HD, sow called HTC ACE, I got it from Orange UK, Android Version 2.3.5, HTC Sence Version 3.0 With Software 3.13.61.5, and I would be pleased to debrand this machine, but always come to the same decision I cannot duet yet, I would like to receive some suggestions on how to debrand it, I will try everything and after that right everything I have done until be successful, thank's

PauloMHAlmeida said:
I have been true some web sites and have not found a solution for this problem. I have a HTC Desire HD, sow called HTC ACE, I got it from Orange UK, Android Version 2.3.5, HTC Sence Version 3.0 With Software 3.13.61.5, and I would be pleased to debrand this machine, but always come to the same decision I cannot duet yet, I would like to receive some suggestions on how to debrand it, I will try everything and after that right everything I have done until be successful, thank's
Click to expand...
Click to collapse
Before you do anything — Make a backup
Don't forget to back up your data. If you have synced the device with a Google account, then the contacts, calendar, Gmail, & select other Google-related data will not be lost and will come back after the next sync. However, you should backup anything you want to keep that is not stored on the SD card:
SMS/MMS messages,
Call Log,
Bookmarks,
Applications; use Titanium Backup or the Astro File Manager, for example,
Any application data not on the SD card.
It would also be a good idea to backup everything stored on the SD card in the rare case the SD card must be formatted to resolve any major problems.
MyBackup Root, SMS Backup & Restore, and Call Backup & Restore are all free applications that can assist with backing up your data.
Downgrade to an exploitable Firmware
AT&T Inspire 4G: Firmware Downgrade: Froyo, Gingerbread
HTC Desire HD: Firmware Downgrade: Froyo, Gingerbread
Rooting the HTC Ace
WARNING: ROOTING THE HTC ACE WILL VOID THE WARRANTY.
Before you begin, if VISIONary is installed on the HTC Ace, uninstall it before continuing.
You will need ADB on the computer to root the HTC Ace and to flash the necessary files for radio S-OFF. Follow the Android SDK guide, to get the ADB shell on the computer.
Download busybox, the ClockworkMod Recovery, the Engineering HBoot, gfree 0.7, psneuter, root_psn, Superuser package:
busybox: Download
md5: 25c5db694c987995909cc3166d4f01b0
ClockworkMod Recovery: Download
md5: 072a643b0aba983a4b9994db0e113c5e
Engineering HBoot: Download
md5: b2c8834905bfa2349f5223077493140a
gfree 0.9: Download
md5: 2dd45594b1ecb084401d428432f87010
psneuter: Download
md5: 89c2dec8d72d87b4c669f44dd31c8d17
root_psn: Download
md5: c8fe38ef55eb8951def9ff17b2eb99c1
Superuser package: Download
md5: 43d9a40b63e916635d5ad7ca32433fab
Unzip the zip files and copy the contents to the same folder as adb (the /platform-tools folder within the Android SDK folder).
Connect the HTC Ace to the computer via USB.
Make sure USB debugging is enabled on the HTC Ace by checking Settings » Applications » Development » USB debugging.
On the computer, open terminal and run the following commands:
adb push busybox /data/local/tmp/
adb push gfree /data/local/tmp/
adb push hboot-eng.img /data/local/tmp/
adb push psneuter /data/local/tmp/
adb push recovery-clockwork-5.0.2.3-ace.img /data/local/tmp/recovery.img
adb push root_psn /data/local/tmp/
adb push su /sdcard/
adb push Superuser.apk /sdcard/
adb shell
chmod 755 /data/local/tmp/*
/data/local/tmp/psneuter
NOTE: You will drop out of the shell after this command. Restart the shell using:
adb shell
cd /data/local/tmp
./gfree -f -b hboot-eng.img -y recovery.img
As it is very important that the hboot was installed correctly gfree calculates md5sums of the partition. It will calculate the following 3 checksums
md5sum #1 - checksum of partition 18 before the installation
md5sum #2 - checksum of the hboot image that should be installed
md5sum #3 - checksum of partition 18 after the installation
The messages that you what to see are either/or
md5sum #1 == md5sum #2 - the hboot image is already installed -> skipping installation
md5sum #3 == md5sum #2 - the hboot image was successfully installed -> OK!
If you get a different error message you should run for help at then DO NOT REBOOT and join #G2Root on Freenode for further help.
If gfree worked correctly continue with:
./root_psn
sync
reboot
The HTC Ace is now rooted with S-OFF, the Engineering HBoot & the ClockworkMod Recovery. Continue to the next section.
Flashing CyanogenMod
If the {{{device}}} has been rooted, unlocked, etc. through steps other than the method described above or running a custom ROM other than CyanogenMod and you are having issues flashing or booting CyanogenMod, it is recommended the {{{device}}} be returned to stock & start over with the full instructions provided above.
Method via Recovery
Download the [[Devices Overview#{{{device}}}|latest version]] of CyanogenMod.
Optional: Download the Google Apps for the device.
Place the CyanogenMod update.zip file on the root of the SD card.
Optional: Place the Google Apps .zip on the root of the SD card also.
Boot into the ClockworkMod Recovery.
Once the device boots into the ClockworkMod Recovery, use the side volume buttons to move around, and either the power button or the trackball to select.
Optional: Select backup and restore to create a backup of current installation on the {{{device}}}.
Select the option to Wipe data/factory reset.
Then select the option to Wipe cache partition.
Select Install zip from sdcard.
Select Choose zip from sdcard.
Select the CyanogenMod update.zip.
Optional: Install the Google Apps by performing steps 7 - 9 again and choosing the Google Apps update.zip.
Once the installation has finished, select +++++Go Back+++++ to get back to the main menu, and select the Reboot system now option. The {{{device}}} should now boot into CyanogenMod.
Method via ROM Manager
Launch RomManager.
Optional: Choose the first option in the app, Flash ClockworkMod Recovery to update to the latest version.
Select the Download ROM option from the main menu in the ROM Manager.
Select the CyanogenMod option, and then choose the latest version of CyanogenMod from the menu.
Optional: When you select the latest version of CyanogenMod, check the Google Apps option.
Once the ROM is finished downloading, it asks if you would like to Backup Existing ROM and Wipe Data and Cache.
If Superuser prompts for root permissions check to Remember and then Allow.
The {{{device}}} will now reboot into the recovery, wipe data and cache, and then install CyanogenMod. When it's finished installing it will reboot into CyanogenMod.
:crying:
I have try that was another fail lol...

PauloMHAlmeida said:
I have been true some web sites and have not found a solution for this problem. I have a HTC Desire HD, sow called HTC ACE, I got it from Orange UK, Android Version 2.3.5, HTC Sence Version 3.0 With Software 3.13.61.5, and I would be pleased to debrand this machine, but always come to the same decision I cannot duet yet, I would like to receive some suggestions on how to debrand it, I will try everything and after that right everything I have done until be successful, thank's
Click to expand...
Click to collapse
GUIDE] Downgrade from 3.13 (Sense 3.0) roms
This guide is for phones shipped with froyo and updated to the 3.x firmware! For phones shipped with gingerbread (even the lower versions) please read attn1's posts in this thread!
With the Sense 3.0 upgrade HTC patched against fre3vo, so we can no longer temproot to use misc_version on that firmware. Lucky us, a new exploit was issued @rootzwiki. This exploit was tested at #g2root (freenode) and was able to temproot a 3.13.161.3 firmware version.
The usual disclaimer applies: Everything you do is your responsibility, no one can be held accountable for the state you put yourself and/or your phone into.
If you meet troubles search for help at IRC: freenode, #g2root
make sure your phone is in 'charge only' mode and the 'fast boot' feature is turned off.
What you need:
tacoroot
misc_version NOTE: you need THAT version of misc_version. Earlier versions would not work.
flashgc for a goldcard
1.32 PD98IMG.zip
put all files in your platform-tools directory (unzip misc_version and tacoroot.sh)
Code:
adb push tacoroot.sh /data/local/tmp/tacoroot
adb push misc_version /data/local/tmp/
adb push flashgc /data/local/tmp/
adb push PD98IMG.zip /sdcard/
NOTE: the last command will take a long time
After all files are pushed you have to run tacoroot:
Code:
adb shell
chmod 755 /data/local/tmp/*
/data/local/tmp/tacoroot --setup
This command will reboot the phone to recovery. Once it is done, use vol up/power then choose 'reboot' to reboot the phone. After it boots (it will bootloop, that's expected):
Code:
adb shell
/data/local/tmp/tacoroot --root
this command will kick you out of adb shell, so we need to return there and see the # sign of root access, after which we can change the main version and create a goldcard:
Code:
adb shell
cd /data/local/tmp
./misc_version -s 1.00.000.0
./flashgc
./tacoroot --undo
After these commands are done, the phone should get rebooted by tacoroot. After it boots, boot to bootloader to flash the 1.32 firmware:
Code:
adb reboot bootloader
Once in bootloader, use the vol buttons to go to 'bootloader' and the power button to execute. The rom will flash. Enjoy!
Credits:
the tacoroot team
skorgon for flashgc
Donate to RevSkills and EFF!
fail againnnnnn:crying:

PauloMHAlmeida said:
I have been true some web sites and have not found a solution for this problem. I have a HTC Desire HD, sow called HTC ACE, I got it from Orange UK, Android Version 2.3.5, HTC Sence Version 3.0 With Software 3.13.61.5, and I would be pleased to debrand this machine, but always come to the same decision I cannot duet yet, I would like to receive some suggestions on how to debrand it, I will try everything and after that right everything I have done until be successful, thank's
Click to expand...
Click to collapse
use this
http://forum.xda-developers.com/showthread.php?t=1377119

For the last few days I have try new software
Z4root No chance another fail...

for debrand use latest RUU, WWE version.. no branded
for rooting use advanced ace hack kit

The Advanced Ace Hack Kit – for HTC Desire HD and HTC Inspire
failed..........

new Advanced Ace Hack Kit system
I just found a new chance and I'm trying it
with new Advanced Ace Hack Kit system, I found it at http://tau.shadowchild.nl/attn1/?p=74
was Posted on July 26, 2012
The Advanced Ace Hack Kit – for HTC Desire HD and HTC Inspire
AAHK will work on Inspires on AT&T’s latest ROM, 3.20.502.52 only after following the steps outlined here: http://tau.shadowchild.nl/attn1/?p=88 .
Warnings:
If your PC environment is not ready to run this kit, there is a good chance your device will not boot properly until you fix your PC or switch to another and re-run the hack kit from the partial boot. READ THIS ENTIRE POST and READ THE EFFEN MANUAL! There is no substitute for READING for COMPREHENSION
Do NOT use earlier versions Ace Hack Kit (12.x and lower) on Inspire or DHD devices shipped with Gingerbread.
Do NOT attempt to downgrade a Inspire or DHD shipped with Gingerbread with a Froyo RUU.
Do NOT attempt to install earlier ENG HBOOTs on these models. AAHK now has Hboots that safely support fastboot image flashing.
Doing this WILL severely degrade bootloader performance on Inspires and DHDs and causes issues trying to install RUUs. In other words, it WILL jam you up. (Note: Issue confirmed on later DHDs – ignore at your own risk).
Sense 3, including those with RELOCKED HTC BOOTLOADERS (NOTE: NOT UNLOCKED – MUST BE LOCKED OR RELOCKED) is auto-detected in hack step. Option is given to download a GB RUU and downgrade or abort. This WILL wipe data.
#include <std_disclaimer.h>
/*
Your warranty is now void.
I am not responsible for bricked devices, dead SD cards,
thermonuclear war, or you getting fired because you can’t tether. Please
do some research if you have any concerns about features included in this
TOOL before running it! YOU are choosing to make these modifications, and if
you point the finger at me for messing up your device, I will laugh at you.
*/
(Disclaimer borrowed heavily from cyanogenmod)
Features:
COMPLETELY INTEGRATED/INVISIBLE GOLD CARD PROCESS
Custom AAHK Bootloaders support popular ENG S-OFF functions for both Sense 2 and Sense 3 partition layouts
Only ONE menu step – HACK ACE
No ROM downgrade required (only radio/kernel) for devices not running sense 3
The original ROM is retained (except when downgrade from Sense3-GB is required)
No wiping data for devices not running sense 3
Rom is fully functional (yes, inc wifi)
Fully rooted with insecure boot image (supports adb remount for rw system)
Busybox manager app installed
Radio S-Off, superCid & carrier sim unlock
Correct Radio is automagically restored for HSPA+ operation
Clockworkmod Recovery included
All known Inspire/DHD builds supported
Easy return to stock for SOME builds (See the Effen Manual – not all carrier RUUs are available)
Notes:
Please do NOT run the hack step if you are already S-OFF AND are running a custom ROM. It’s pointless, and while it won’t brick you, you can get jammed up a bit. This is for stock devices only.
You MUST read the ENTIRE EFFEN MANUAL in order to run the hack kit.
Do NOT try to run this from a VM – particularly VirtualBox. You WILL get jammed up and may wind up flashing an RUU to recover, losing data in the process.
After kernel downgrade – video is lost on boot – this is okay as adb is working and can be used to finish the process. If the process fails, it can be restarted once the PC environment is corrected. When the process completes successfully, everything is restored and fully working.
Youtube videos are neat demos, but they make poor guides. READ THE EFFEN MANUAL. “There is no substitute for reading for comprehension.” – GenePoole
Make sure you extract the hack kit to your pc maintaining the directory structure in the archive you downloaded. The docs will be in the root directory of the unarchived kit, as will the scripts. READ THE EFFEN MANUAL.
I can’t believe that so many people are asking where the effen manual is. THE EFFEN MANUAL IS IN THE EFFEN HACK KIT.
This kit should work fine on HTC Inspire and HTC Desire HD Software versions below 3.06.405.1 which require the radio/kernel downgrade before a root exploit is available.
Windows Prep:
IMPORTANT – disable all malware (Antivirus detection etc) detection before unarchiving the hack kit. Keep it off thoughout the hack kit processes. Many Windows malware detection programs report false positives, deleting or binding critical files required by the process.
IMPORTANT – Remove or disable all services and daemons you can, particulary anything Apple, blackberry, PDAnet, Microsoft Mobile, anything USB not required for this task, any resource hogs. Also disconnect all un-needed USB devices and USB HUBs.
Remove HTC Sync and drivers.
Only after completing the above steps, install the drivers contained in the Hack Kit (see the Effen Manual) BEFORE plugging in the phone.
Connect the phone to the computer via a USB port connected to the system board – not a front panel port or a hub or extention port.
Verify successful android device driver installation in device manager.
Issues during downgrade:
IMPORTANT: BEFORE SWITCHING FROM DISK DRIVE TO CHARGE ONLY MODE, ALWAYS EJECT THE SDCARD WITH PC SOFTWARE TO FLUSH WRITE BUFFERS AND AVOID CORRUPTING THE SDCARD.
model ID incorrect update fail – this is because your goldcard is not working.
READ THE EFFEN MANUAL. Reading is fundamental.
Download:
Note: AAHK filename uses ddmmyyyy naming convention.
aahk-11092012.zip
md5: 5727960aa167b305b8f3561ffbbb1360
viperbjk is with Revskills, and his contribution is key to finally allowing one step processing where a goldcard is required. The entire process is now one menu step. A second step will be required to clear your conscience –
DONATE to:
Revskills.
and/or
Electronic Frontier Foundation
Note: No money has been accepted for the AAHK or support of the AAHK by myself or anyone working with me on it.
If you have read this post and the effen-manual and get stuck during processing,
help is available in IRC at http://webchat.freenode.net/?channels= – aahkSupport
Yes, there are stupid questions.
Questions that will get you immediately kickbanned from the IRC channel with no further explanation:
Q: Do I need to flash a ROM after the hack kit is finished?
A: Kickban. The hack kit is a complete, one step process. If it finishes correctly, you are finished. What part of “fully functional” is vague?
Q: Do I need to flash a radio after the hack kit is finished?
A: Kickban. The hack kit is a complete, one step process. If it finishes correctly, you are finished. What part of “fully functional” is vague?
Q: The options menu has options to flash radios. Do I need to flash a radio?
A: Kickban. What part of “optional” is vague? This option is to make it easy for people who may have flashed another radio and want to flash back to these particular radios.
Q: Do I need to plug in the phone?
A: Kickban. If you know how to enable usb debugging without a USB connection, then I’ll change this policy. In the meantime, asking such a question just makes me think you have not read anything and/or have dedicated yourself to being an idiot.
Q: What’s the best ROM?
A: Kickban. The whole point of this is to give YOU control and allow YOU to decide. Yes, we prefer CM7 and I think it’s the only real Android choice available, but don’t ask us to think for you. If you don’t see that pretty much everything else is either ripped off or HTC Non-Sense, then you haven’t done your homework and that’s okay. Just don’t ask, because in the end, it’s YOUR choice.
Q: Facebook doesn’t work.
A: Kickban. This has nothing to do with anything but Facebook. Go ask Facebook, not us.
Q: I can’t find the pass key.
A: Kickban. Really? Then you did not really read the Effen Manual. If you really did, then you would not ask. Really.
Q: My phone won’t boot – how do I fix my HBOOT?
A: Kickban. We’ve been warning people not to flash Froyo Hboots (Including HTC ENG ones) on devices shipped with GB for going on a year now. If you do this and screw up, it’s not our fault and you’re on your own.
This IRC channel is for people who read, attempt and get stuck because of PC issues or an occasional bug introduced with a new feature. It’s not for people to troll those who dedicate their time for support without any compensation by asking a series of mindless, inane questions and observations for attention. We’re too busy for that – even if we have nothing to do. It’s beyond annoying and you will be kickbanned without warning. Read, search, think, try, then ask.
The people in #aahkSupport have been helping noobs without compensation for over a year now, with generally very good results and a generally good nature, despite being abused by some on almost a daily basis.
Thanks to:
Revskills for their fantastic gold card algorithym
GenePoole for the kickass android goldcard binary based on above
agrabren for fre3vo, the Gingerbread temproot used
scotty2 for finding the vold exploit and the author of psneuter
Guhl for misc_version and gfree
hyuh for misc_version revisions and Hboots with ENG features
jcase for taco root
shad0wf0x for his windows scripting contributions
ktilcu for DOC contributions
anthony1s for his review and unique perpective
neolobster for his generous file hosting
The > 150,000 downloaders of the hack kit, most of whom seem to get though it without issue.
and they have amazing feedback's, lets try it now....

sow far as I see he dues everything you just need to site back and wait, look's amazing.........
new Advanced Ace Hack Kit system
thanks for the new development!
let's see in a hour time how he dues lol

PauloMHAlmeida said:
sow far as I see he dues everything you just need to site back and wait, look's amazing.........
new Advanced Ace Hack Kit system
thanks for the new development!
let's see in a hour time how he dues lol
Click to expand...
Click to collapse
Well, don't forget that you also need to read the "effen manual!"

I have not forget to read it but is a fail....
thanks for telling me that but I found the solution for all S-ON HTC...
and for the Hboot lol
is a big journey I made on the last months, and I have put some staff all together and got it made lol
just wait for my next post how to duet....

look for my next post
There's no need to make the phone S-OFF (like some people say).

PauloMHAlmeida said:
look for my next post
There's no need to make the phone S-OFF (like some people say).
Click to expand...
Click to collapse
With S-ON your bootloader is locked.
And without ENG S-OFF you can't change the radio.
S-OFF is necessary for me
And btw... i don't know what you do..
But with the Hack Kit i've rooted about 15 DHDs in my circle of friends.
Some devices with problems. But after manually downgrade with RUU no problems at all.

I'm finish here Just look for my next publication Thanks

fr34kde said:
With S-ON your bootloader is locked.
And without ENG S-OFF you can't change the radio.
S-OFF is necessary for me
And btw... i don't know what you do..
But with the Hack Kit i've rooted about 15 DHDs in my circle of friends.
Some devices with problems. But after manually downgrade with RUU no problems at all.
Click to expand...
Click to collapse
There's no need to make the phone S-OFF (like some people say).
Disable fast/quick reboot (Settings » Power » Fastboot)
Download all
Fastboot commander.zip http://www.mediafire.com/download.php?xsu7c3m981o9gb8
Google.zip http://www.mediafire.com/download.php?cm9pdoh2g9mkgvb
Superuser-3.1.3-arm-signed http://www.mediafire.com/download.php?kzpbhq13jb085s8
Android ultimate toolbox pro http://www.mediafire.com/download.php?6m5w39zmb6ph8gq
Recovery.img http://www.mediafire.com/download.php?grl8wsjzxihhfwf
Update http://www.mediafire.com/download.php?dzkww8zaq7sxhae
Fastboot.bin http://www.mediafire.com/download.php?bhzth13p4kvow4v
Copy in to the root of your sd card after been formatted
Google.zip + Update.zip + Superuser-3.1.3-arm-signed.zip
On your pc create a new folder on C: and name it HTC for easy access and copy in to the folder
Recovery.img + fastboot binary
Install on your PC
Fastboot commander.zip + Android ultimate toolbox pro
Start rooting
Unlock bootloader: http://htcdev.com/bootloader/
Put the phone in Fastboot USB mode (Turn off, hold Volume Down + Power)
fastboot oem get_identifier_token
fastboot flash unlocktoken Unlock_code.bin (file from email)
Install ClockWorkMod recovery the recovery.img from my link our use android ultimate box to flash recovery
fastboot flash recovery recovery.img
Make a backup
Start clockworkmod recovery (Fastboot mode, Recovery)
Select backup and restore
Select backup
Go to your mobile start it as Fastboot and go to recovery
You go in to Clockworkmod Recovery V5.0.2.7 from the Ace Hack Kit
On the top is the menu with + and – buttons just scrool in to advanced and press power
Select “Wipe Dalvik Cache”
Then select “Wipe Battery Stats”
Then select “And go back”
Then select “Wipe data/Factory reset”
Then select “Wipe cache Partition” (Now you have cleaned all the old staf from your mobile)
Now let’s start rebuild the HTC
Select "apply update from sdcard"
Then select "Yes - install update.zip" to confirm
Then select "install zip from sdcard"
Then select “google.zip”
Then select "Yes - install google.zip" to confirm
Then select "install zip from sdcard"
Then select "su-3.0-efgh-signed.zip"
Then select "Yes - install su-3.0-efgh-signed.zip" to confirm
Then go back to your pc for the files you have download and unzip update and copy Boot.bin to the file you created C:\HTC
o Flash boot.img trough fastboot:
o fastboot flash boot boot.img
o Reboot
• Done
• You should have now a white screan from HTC for at least 5 minutes and after will sart the new room, just let it on for a couple minutes and you will see the sucess….
All my files are at http://www.mediafire.com/?al6dsdcd6c02f
Enjoy it, next I will say how to sort google play problem I found it easy lol…

PauloMHAlmeida said:
[....]
Unlock bootloader: http://htcdev.com/bootloader/
[....]
Click to expand...
Click to collapse
And thats the point.
You do what S-OFF does through HTC-Tool.
Now u unlocked the bootloader and your warranty is gone because your device is registered now.
Why should anyone go the complicated way if there is an easy way?

Firts have 2 types of waranty, 1st the manufactors warranty. That runs off 3 years after your purchase, 2nd the software warranty... And HTC have take off that point on the warranty, now you can unlock our relock the bootloader from your HTC with out lost of your warranty... By the way that's the reason HTC created HTC devoluppers web page...
And if you want to understand that just read all my post's. Changing our due hboot s-off make you lost warranty lol....
Sent from my HTC Desire HD A9191 using xda app-developers app

Unlocking Your Bootloader
HTC is committed to listening to users and delivering customer satisfaction. We have heard your voice and starting now, we will allow our bootloader to be unlocked for 2011 models going forward. We plan on releasing the updates that will allow you to unlock your bootloader in the coming months, please keep an eye on this website for more details on which devices will be adding this feature. We are extremely pleased to see the energy and enthusiasm from our fans and loyal customers, and we are excited to see what you are capable of. HTC eagerly anticipates your innovations.
It is our responsibility to caution you that not all claims resulting or caused by or from the unlocking of the bootloader may be covered under warranty. Please note that unlocking your bootloader does not mean that you will be able to unlock the SIM lock. Unlocking your SIM lock is at the discretion of your operator/carrier and is not part of the bootloader unlocking scope.
Our devices have been designed with our hardware and software specifications in mind and unlocking the bootloader will change the software and may cause unexpected side effects. It is impossible for HTC to ensure the proper functioning of your device after this. In the worst case scenario, it is possible that your device may be physically damaged due to overheating or the behavior of your device might be altered including, but not limited to, hearing aid compatibility (HAC) and specific absorption rate (SAR) values.
Some content on your device may also be invalidated and cannot be accessed any more because of invalid DRM security keys. This includes content that you may have purchased through a 3rd party vendor and through HTC. Furthermore, although you will still be able to receive updates to your device via FOTA (“firmware over the air”), we do not guarantee that updating your device via FOTA will not render your device unusable. Please understand that you will not be able to return your device to the original state and going forward your device may not be held covered under the warranty for all claims resulting from the unlocking of the bootloader. HTC bears no responsibility if your device is no longer usable afterwards.
HTC is committed to assisting customers in unlocking bootloaders for HTC devices. However, due to some of our carrier customers concerns, certain models with specific restrictions may not be able to be unlocked. Please refer to our list of supported devices to see if your device is eligible for unlocking the bootloader.
We strongly suggest that you do not unlock the bootloader unless you are confident that you understand the risks involved. This is a technical procedure and the side effects could possibly necessitate repairs to your device not covered under warranty. If you are still interested in unlocking the bootloader, and you understand the consequences both to your device and to your warranty, then you may refer to the following pages where we have provided the unlocking instructions.
Un lo c k Bo o tlo ad er
Unl oc k th e pos s ib ilit i es wit h to ta l cu s t omi zat io n
Unlock Bootloader
Frequently Asked Questions Preview Unlock Process
Supported Devices
Select “All other supported models” if you cannot find your phone in this list. Devices launched after 9/2011 will be shipped with the unlock capability. Please check back often for updates on the unlock status of additional devices.
------- Select Your Device ------
Beg i n Unl o ck Bo ot l o ad er
* Indicates HBOOT update required.
HTC is committed to assisting customers in unlocking bootloaders for HTC devices. However, certain models may not be unlockable due to operator restrictions. We continue to work with our partners on this, check back often for ongoing updates about unlockable devices.
Copyright © 2012 HTC Corporation. All rights reserved. Terms of Use Privacy Policy About HTCdev HTCDev Affiliates Follow Us Comments - Tell HTCdev what YOU want.