Develop Bugs

[Q] Another unroot/s-off problem

Im hoping someone can point me in the right direction here.
Clearly I did something wrong. I could use a little direction here to get back
to factory state phone. I have a "factory phone" without root and stock apps but
S-OFF and I need to get back to S-ON
1) Rooted using Rage/Gfree method for temp root/s-off/perma root
2) Wanted to roll back(please don't ask why)
3) Tried to follow step 1a) on http://forum.xda-developers.com/showthread.php?t=835971
4) Receive following message
-- Installing: SDCARD:/stock_root.zip
E:Board does not support mtd utils.E:Failure at line 344:
write_raw_image PACKAGE:boot.img BOOT:
Installation aborted.
5) Recovered from clockwork backup
5) Went to step 1b successfully
6) Followed step 2 successfully
7) Phone patched itself OTA(step 3)
8) checked bootloader to find S -off
Steps I have taken
1) Regain temp root using rage
2) copied gfree back to phone
3) from terminal "# ./gfree -s on"
4) "#sync"
5) Reboot into bootloader to find S-OFF *sigh*
Bootloader items
VISION PVT SHIP S-OFF
HBOOT-0.82.0000
MICROP-0425
RADIO-26.03.02.26_M
eMMC-boot
**Amendment* I don't have the gfree partition backup that gets created the first time you root

brandonmcgrew said:
Steps I have taken
1) Regain temp root using rage
2) copied gfree back to phone
3) from terminal "# ./gfree -s on"
4) "#sync"
5) Reboot into bootloader to find S-OFF *sigh*
Bootloader items
VISION PVT SHIP S-OFF
HBOOT-0.82.0000
MICROP-0425
RADIO-26.03.02.26_M
eMMC-boot
**Amendment* I don't have the gfree partition backup that gets created the first time you root
Click to expand...
Click to collapse
You have the regular bootloader (not the eng one), so the fact you have S-OFF still means your "gfree -s on" didn't work. You need to try that again, and look for what error messages were produced at the time.

You have the regular bootloader (not the eng one), so the fact you have S-OFF still means your "gfree -s on" didn't work. You need to try that again, and look for what error messages were produced at the time.
Can you give me the steps for that. I got temp root with rage and ran the s-on and sync commands. do you want the output from that???

brandonmcgrew said:
Can you give me the steps for that. I got temp root with rage and ran the s-on and sync commands. do you want the output from that???
Click to expand...
Click to collapse
Yes, please post up the output from when you run "./gfree -s on", that's the bit that sounds like it's failing.

# export PATH=/data/local/bin:$PATH
# cd data
# cd local
# ./gfree -s on
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.17-g9ab3677
New .modinfo section size: 204
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c029c72c, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc029c000
Kernel memory mapped to 0x40001000
Searching for brq filter...
- Address: 0xc029c72c + 0x34c
- 0x2a000012 -> 0xea000012
Patching and backing up partition 7...
Done.
#

Well that's odd, that looks liked it worked ok.
What about if you try the stuff at http://forum.xda-developers.com/wik...ion#3._.28OPTIONAL.29_Verify_you_did_it_right to verify that S-ON has been set ?

Ok at this point I decided to get back to a spot where I felt comfortable. So I permarooted using rage/Gfree. I have also installed Clockwork and done a nandriod. So at this point here is my status. Perhaps you can help me get back to factory
1) Factory Stock w/OTA
2) Root
3) gfree verify
gfree verify_cid returned:
@CID: 11111111
OK
gfree verify_secu_flag returned:
@secu_flag: 0
OK
gfree verify_simlock returned:
@SIMLOCK= 00
OK
At this point I can't do anymore today but if you could/would give me a little help getting back to factory stock no root s-on simlock on I would REALLY appreciate it.

I'll do my best not to derail, but I cannot even install the stock ROMs anymore, and I think it is because of the version of CWR I am running. Since I wanted CM7, I had to install CWR 3.x. Is it safe to assume that any Android 2.3 ROM needs CWR 3.x, and any Android 2.2 or previous required CWR 2.x?

OK I finally got back to working on this and got a FIX!
See previous post(s) to get caught up......done ok GOOD
**THIS REQUIRED ADB TO BE WORKING**
**IF YOU TAKE THESE STEPS BELOW I TAKE NO RESPONSIBILTY IF SOMETHING GOES CRAZY AND YOU BRICK YOU PHONE. IM A NEWB TO THIS SO THIS IS JUST WHAT I DID**
Where I left off is I was Stock OTA rooted using the gfree/rage method. I had Clockwork installed and a nice nandroid backup(Such a good feeling). Copied backup to computer
1) Followed steps to a tee downgrade from OTA -->http://forum.xda-developers.com/showthread.php?t=831398
2) With a fresh preOTA phone I unmounted my sdcard
3) Formatted SDCard(no idea if this helped but made me happy)
4) Copied Visionary R14 to root of sdcard-->http://android.modaco.com/content/h...m/320722/19-nov-r14-visionary-one-click-root/
5) Enabled Unknown Sources install from Manage application
6) Installed File Manager from Market
7) Used File Manager to install Visionary
8) TempRoot using Visionary
9) Downloaded latest gFree from -->http://www.thinkthinkdo.com/trac/project1/raw-attachment/wiki/gfree/gfree_02.zip
10) unzip gfree_02.zip
11) open command prompt
12) enter following commands to confirm you have root
adb shell
$ su
**on phone should see superuser prompt...press allow**
if you see a "#" you got temp root
# exit
$ exit
13) Push gfree to phone
c:\adb push gfree_02 /data/local
c:\adb shell
$ su
# cd /data/local
# chmod 777 gfree
14) Set S-On
# ./gfree -s on
15) Set CID
# ./gfree -c TMO010
# exit
$ exit
16) Power off
17) Boot phone to bootloader (Hold Power +Vol Down) and confirm
VISION PVT SHIP S-ON
HBOOT-0.82.0000
MICROP-0425
RADIO -26.02.01.15.M2
eMMC-boot
18) Reboot Device. ALL DONE!!!
**If you want you could temproot again and remove all files copied for gfree to /data/local or you could do a factory reset from the bootloader**

[Q] HTC EVO unable to mount /sdcard :: What else can I do and how?

So, being in IT, let me tell you what I've done so far and maybe you guys can give me some hints on what to do next, bc I'm stumped.
First, the phone is rooted and NAND unlocked. I have the S-OFF in the Bootloader.
So far...
I've "turned it off and on again"
Reseated battery,
Let phones capacitors drain
Reseated SDCard
Still nothing
Opened up terminal
Code:
fastboot oem rebootRUU
fastboot oem enabledqxdm 0
fastboot oem clearcache
That didn't work. Here's my commandline output:
Code:
active commandline:
board_supersonic.disable_uart3=0
board_supersonic.usb_h2w_sw=0
board_supersonic.disable_sdcard=0
diag.enabled=0
board_supersonic.debug_uart=0
smisize=0
userdata_sel=0
androidboot.emmc=false
androidboot.baseband=2.15.00.11.19
androidboot.cid=SPCS_001
androidboot.batt_poweron=die_
battery androidboot.carrier=COMMON
androidboot.mid=PC3610000
androidboot.keycaps=qwerty
androidboot.mode=normal
androidboot.serialno=************
androidboot.bootloader=0.76.2000
no_console_suspend=1
So we know the system is setup to enable the sdcard
board_supersonic.disable_sdcard=0
Here's what stumps me...
Here's the listing in my /dev/block folder
Code:
# ls -a
. loop1 loop4 loop7 mtdblock2 mtdblock5
.. loop2 loop5 mtdblock0 mtdblock3 mtdblock6
loop0 loop3 loop6 mtdblock1 mtdblock4 vold
Here's also a given.
The phone is detected by my computer, I can fastboot and adb. I just can't get the damn sdcard to mount.
When I've tried to mount it, I get this error
Code:
Can't mount /dev/block/mccblk0p1
Which is obvious why because it isn't in the folder!
Now, I can't mount the card in my PC bc I don't have a reader.
What advice/tips do you guys have?

sublimegeek said:
So, being in IT, let me tell you what I've done so far and maybe you guys can give me some hints on what to do next, bc I'm stumped.
First, the phone is rooted and NAND unlocked. I have the S-OFF in the Bootloader.
So far...
I've "turned it off and on again"
Reseated battery,
Let phones capacitors drain
Reseated SDCard
Still nothing
Opened up terminal
Code:
fastboot oem rebootRUU
fastboot oem enabledqxdm 0
fastboot oem clearcache
That didn't work. Here's my commandline output:
Code:
active commandline:
board_supersonic.disable_uart3=0
board_supersonic.usb_h2w_sw=0
board_supersonic.disable_sdcard=0
diag.enabled=0
board_supersonic.debug_uart=0
smisize=0
userdata_sel=0
androidboot.emmc=false
androidboot.baseband=2.15.00.11.19
androidboot.cid=SPCS_001
androidboot.batt_poweron=die_
battery androidboot.carrier=COMMON
androidboot.mid=PC3610000
androidboot.keycaps=qwerty
androidboot.mode=normal
androidboot.serialno=************
androidboot.bootloader=0.76.2000
no_console_suspend=1
So we know the system is setup to enable the sdcard
board_supersonic.disable_sdcard=0
Here's what stumps me...
Here's the listing in my /dev/block folder
Code:
# ls -a
. loop1 loop4 loop7 mtdblock2 mtdblock5
.. loop2 loop5 mtdblock0 mtdblock3 mtdblock6
loop0 loop3 loop6 mtdblock1 mtdblock4 vold
Here's also a given.
The phone is detected by my computer, I can fastboot and adb. I just can't get the damn sdcard to mount.
When I've tried to mount it, I get this error
Code:
Can't mount /dev/block/mccblk0p1
Which is obvious why because it isn't in the folder!
Now, I can't mount the card in my PC bc I don't have a reader.
What advice/tips do you guys have?
Click to expand...
Click to collapse
So when did this start? What recovery do you have on it? Can you still get into recovery? You could try that and remount sd card in there. My guess is you already tried that. I am using amon 2.3 .

I had that happen to me a few weeks back. I ended up needing to format my SD card, for whatever reason. I used my windows machine to format it to FAT32, then thankfully it worked after that. Hopefully it's that easy for you!

reaper24 said:
So when did this start? What recovery do you have on it? Can you still get into recovery? You could try that and remount sd card in there. My guess is you already tried that. I am using amon 2.3 .
Click to expand...
Click to collapse
It all started when I was restoring some stuff with Titanium. Then poof, gone. I have Amon like you do. I can get into recovery, I can access both adb and fastboot, but it still won't manually mount the sdcard.
And yeah, I did, but no luck. It keeps giving me that "Can't mount /dev/block/mccblk0p1" error saying that it doesn't exist...which it doesn't, but that doesn't tell me WHY.

(Q) How to transfer rom.zip to sd?

Hi,
I needed to remove some stuff from my stock rom, i flashed some zips from recovery:
ONE-X-1.29-NRGZ-TR-TOP-BAR.zip
ONE-X-1.29-NRGZ-6X7-9X4-ROSIE.zip
Battery_circle_OneX_1.29.zip
After that my rom booted but process android.phone.xxx and sense launcher app crashed, so i had black screen, tried hard reset, brom bootloader, also reset and wipe from cwm, nothing helped, i had to erase /system/ /sdcard/ /cache.
After that i reflashed cwm recovery 5.8.2.7 touch, but i cant mount sd storage or juyst mount /sdcard to transfer new rom to flash it, please help!

Forgot to say, first i tried to find stock rom 1.29, and all links were broken, I downloaded everything needed for 2 roms which i might use if i'll be able to flash them:
1. Android Revolution HD 5.2.0 ICS High Quality & Performance 1.29.401.8
2. LeeDroid One Extreme v.6.0.0 - 13.May
Now found stock rom and downloading, it's .exe file, can this be flash from win over fastboot-usb mode on bootloader?

Anyone please??????

Just tried to flash stock rom from my pc, run this:
RUU_ENDEAVOR_U_ICS_40_HTC_Europe_1.29.401.7_Radio_1.1204.104.14_release_259281_signed.exe
It goes thrue process, then says ERROR (155): unknown error:
The ROM Update Utility cannot update your Android phone.
Please get correct ROM Update Utility and try again.

Hi Stegy
I guess you have latest cwm recovery, so copy a rom to your adb-directory on your computer (obviously it will have to be arhd ) and then switch off the phone and connect it to the pc and wait until you hear the usb connection sound and then open a cmd and navigate it to the adb-directory where your rom is located and use the command "adb push romfile.zip /sdcard/" obviously you will change the romfile.zip for the file name for your rom. Now just wait for the message which tells you the file was transferred correctly and then proceed to flash the rom as you would do normally.
I hope this helps

adamgaltress said:
Hi Stegy
I guess you have latest cwm recovery, so copy a rom to your adb-directory on your computer (obviously it will have to be arhd ) and then switch off the phone and connect it to the pc and wait until you hear the usb connection sound and then open a cmd and navigate it to the adb-directory where your rom is located and use the command "adb push romfile.zip /sdcard/" obviously you will change the romfile.zip for the file name for your rom. Now just wait for the message which tells you the file was transferred correctly and then proceed to flash the rom as you would do normally.
I hope this helps
Click to expand...
Click to collapse
Yea, I flashed latest CWM recovery
recovery-clockwork-touch-5.8.3.1-endeavoru.img
Now i put my phone off, started cmd, get to directory where is my adb.exe (android sdk from htc dev files)
Now waiting for good news on mcd window...
I do hope this will be it, so i can flash the rom thrue cwm and finish this disaster...

It seems finished, but no confirm message, except this:
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb push update.zip /
sdcard/
1677 KB/s (621988319 bytes in 362.021s)
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>

Also, as you suggested, i entered "adb devices" and this is what i got:
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb devices
List of devices attached
HT243W100060 recovery

Nice... went to CWM recovery , choose zip from sdcard, and it ways:
No files found...

Stegy said:
It seems finished, but no confirm message, except this:
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb push update.zip /
sdcard/
1677 KB/s (621988319 bytes in 362.021s)
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>
Click to expand...
Click to collapse
Okay this confirms how much data was transferred and the time it took
Stegy said:
Also, as you suggested, i entered "adb devices" and this is what i got:
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb devices
List of devices attached
HT243W100060 recovery
Click to expand...
Click to collapse
And this just confirms that a device is detected and confirms what device it is with the serial number.
good luck!

Also, this info might mean something, on bootloader:
xxx UNLOCKED xxx
ENDEAVORU PVT SHIP S-ON RL
HBOOT-0.94.0000
CPLD-None
MICROP-None
Radio: 1.1201.104.14
eMMC-bootmode: disabled
CPU-bootmode: disabled
HW Secure boot: enabled
MODEM PATH: OFF
Apr 11, 2012, 02:27:11

Stegy said:
Nice... went to CWM recovery , choose zip from sdcard, and it ways:
No files found...
Click to expand...
Click to collapse
Try unplugging and then rebooting the device, adb may be stopping the phone from accessing the sdcard

SD checking....
Failed to upen USB master mode
Maybe this is the problem with my internal SD?

See this http://forum.xda-developers.com/showpost.php?p=25863603&postcount=11
You need to mount sdcard before you push the zip file.

ckpv5 said:
See this http://forum.xda-developers.com/showpost.php?p=25863603&postcount=11
You need to mount sdcard before you push the zip file.
Click to expand...
Click to collapse
So, if I understood correctly, boot onto fastboot-usb,
start cmd, go to directory where adb.exe is, just made:
fastboot boot recovery-clockwork-touch-5.8.3.1-endeavoru.img
Went ok, message:
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>fastboot boot recover
y-clockwork-touch-5.8.3.1-endeavoru.img
downloading 'boot.img'...
OKAY [ 0.829s]
booting...
OKAY [ 0.008s]
finished. total time: 0.837s
Phone restarted, now going back to fastboot usb mode on bootloader.
Next 3 steps:
adb devices
adb shell
mount sdcard
Just need to run these 3 commands one after another in current cmd?
With my phone on fastboot usb? Or i must shut down the phone, like for that adb push rom.zip?
And last step,
pen another cmd prompt
adb push xxx.zip /sdcard
with phone off, have to wait for usb connect sound on pc
??

SO, next steps, fastboot boot xx-recovery.img done,
restart of phone to bootloader, choosen shut down option, waited for usb connect sound,
wrote command adb devices, got this:
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb devices
List of devices attached
HT243W100060 recovery
Then wrote next command: adb shell, and it's still like these for few mins...
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb shell
~ #

1. fastboot boot recovery-clockwork-touch-5.8.3.1-endeavoru.img
Went ok, message:
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>fastboot boot recover
y-clockwork-touch-5.8.3.1-endeavoru.img
downloading 'boot.img'...
OKAY [ 0.829s]
booting...
OKAY [ 0.008s]
finished. total time: 0.837s
don't reboot your device, leave it in recovery
2. D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb devices
enter
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb shell
enter then type after ~ # mount sdcard
3. don't close anything, open another cmd prompt
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb push xxx.zip /sdcard
then enter
once completed, choose install from sdcard - choose zip from sdcard, the xxx.zip should be there

ckpv5 said:
1. fastboot boot recovery-clockwork-touch-5.8.3.1-endeavoru.img
Went ok, message:
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>fastboot boot recover
y-clockwork-touch-5.8.3.1-endeavoru.img
downloading 'boot.img'...
OKAY [ 0.829s]
booting...
OKAY [ 0.008s]
finished. total time: 0.837s
don't reboot your device, leave it in recovery
2. D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb devices
enter
then type after ~ # adb shell
enter then type after ~ # mount sdcard
3. don't close anything, open another cmd prompt
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>push adb xxx.zip /sdcard
then enter
once completed, choose install from sdcard - choose zip from sdcard, the xxx.zip should be there
Click to expand...
Click to collapse
I'm cursed...
1. step DONE
2. step:
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>adb shell
~ # mount sdcard
mount sdcard
~ #
3. opened new cmd, wrote the command and here are results....
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>push adb update.zip /
sdcard
'push' is not recognized as an internal or external command,
operable program or batch file.
D:\HTC\One X\HTC Dev.com unlock\android-sdk\platform-tools>push adb update.zip /
sdcard
'push' is not recognized as an internal or external command,
operable program or batch file.

Sorry... adb push.... not push adb, see my edited post above

Figured that... now waiting for transfer to finish, still have both cmd windows opened, just in case...

[TUTORIAL]Update to Android 5.0.2

If you are S-Off Unlocked:
1. change CID into HTC__621 or 11111111:
>fastboot oem writecid HTC__621
2. change MID with hex editor in mmcblk0p5:
(root is required)
>adb shell
>su
>dd if=/dev/block/mmcblk0p5 of=/sdcard/mmcblk0p5.bin
(copy mmcblk0p5.bin into computer then open hex editor(eg. hxd), find address "00004000" and change it into "0PFH20000", then copy it back to /sdcard/)
>adb shell
>su
>dd of=/dev/block/mmcblk0p5 if=/sdcard/mmcblk0p5.bin
3. reboot into TWRP recovery and restore the backup files from : http://forum.xda-developers.com/desire-eye/general/twrp-htc-desire-eye-tw-1-19-709-2-stock-t3020177
4. install Stock_kernel Patch : https://drive.google.com/file/d/0ByBfWX359WjHYkZweXZ4YlBad1E/view?usp=sharing
!!!!!You should boot once and finish set up once after this step, or some problem may occur
5. download OTA file and copy it into internal Storage
6. flash Stock recovery which can be found in firmware.zip in ota zip
7. reboot into recovery, select ota zip and wait
well done!
If you are S-On Unlocked or you are S-off but don't want to enjoy the OTA progress:
1.Restore form TWRP with following file: https://drive.google.com/file/d/0ByBfWX359WjHenYzTGJfNUJwOTA/view?usp=sharing
2. flash boot.img : https://drive.google.com/file/d/0ByBfWX359WjHMURkTENQb3JOSzg/view?usp=sharing
> fastboot flash boot boot.img
Resources:
1. TWRP :
->http://forum.xda-developers.com/desire-eye/development/recovery-twrp-2-8-4-0-htc-desire-eye-t3008442
2. TWRP+(4.4.4)stock boot.img and stock recovery.img
->http://forum.xda-developers.com/desire-eye/development/doe-dev-desire-boot-recovery-signed-t2932148
3. Hboot without "entering recovery...."
->for 4.4.4 : https://drive.google.com/file/d/0ByBfWX359WjHb1NsYklrakRoSzg/view?usp=sharing
->for 5.0.2 : https://drive.google.com/file/d/0ByBfWX359WjHcjd2bkJ4bU5wUEE/view?usp=sharing
4. Software status: Official(Soff required)
>adb shell
>su
>dd if=/dev/block/mmcblk0p6 of=/sdcard/mmcblk0p6.bin
(copy mmcblk0p6.bin into computer then open hex editor(eg. hxd), find and address 00511802 into 00, thencopy it back to /sdcard/)
>adb shell
>su
>dd of=/dev/block/mmcblk0p6 if=/sdcard/mmcblk0p6.bin

Thanks a lot!! It works!!!
I have a tw phone, I can pass changing CID and MID. I didn't root this device, just did s-off before unroot.
In my case, the kernel was the problem that failed OTA upgrade.
When my phone was bricked, I just installed SD rom, restored form twrp backup. these things made my kernel messed up.
Anyway, I finally make it and thanks a lot!!♥♥

Everything is working . Only issue I've got , was that I've needed to change the name of folder with the backup . Becouse TWRP did not see it .

{ROOT} {100% Working} Vzw Desire 526 Perm Root {Unlocked Boot-Loader Required}

How To Get Permanent Root
This is a workaround until I can compile a Bootable Kernel
First of all say thanks to @Captain_Throwback !!
He was the original creator of the TWRP Recovery for the Desire 626s.
I have taken his TWRP recovery for the 626s, unpacked it and ported in some of the Desire 526 recovery image.
Kinda a cracked up way of doing this but hey ( It Works)
Step #1
Unlock Your Boot-Loader !!! (currently accomplished with a Java Card / HTC Service Tool)
Even with the card you could run into trouble with unlocking the boot-loader.
There is no switch to Enable OEM Unlock available in the Developer Options.
Here is a work-around for that.
Step #1-A
Open up terminal shell on a computer and pull the frp image from the device. (Temp Root Required)
Code:
dd if=/dev/block/bootdevice/by-name/frp of=/sdcard/frp.img
Terminal Output
[email protected]_a13wlpp:/ #dd if=/dev/block/bootdevice/by-name/frp of=/sdcard/frp.img <
1024+0 records in
1024+0 records out
524288 bytes transferred in 0.364 secs (1440351 bytes/sec)
[email protected]_a13wlpp:/ #
Pull the frp.img to the computer.
If you are still in adb shell.
Code:
exit
exit
Then from the normal command line
Code:
adb pull /sdcard/frp.img
Terminal Output
f=/dev/block/bootdevice/by-name/frp of=/sdcard/frp.img <
1024+0 records in
1024+0 records out
524288 bytes transferred in 0.364 secs (1440351 bytes/sec)
[email protected]_a13wlpp:/ # exit
[email protected]_a13wlpp:/ $ exit
[email protected]:~$ adb pull /sdcard/frp.img
2758 KB/s (524288 bytes in 0.185s)
[email protected]:~$
Now open the frp.img file in a hex editor. Like HXD in windows.
Go to the last line of the file.
Change the very last 00 to 01 and save the file.
Reference the screen shots below.
Factory FRP
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Patched FRP
Flash the patched frp.img to the device.
Back to the terminal.
Code:
adb push frp.img /sdcard/frp.img
Code:
adb shell
su
dd if=/sdcard/frp.img of=/dev/block/bootdevice/by-name/frp
If you have completed this now your clip can unlock the boot-loader
In case your wondering this will also work on a boot loader locked device. It will get you as far as being able to get a unlock token from fastboot using Fastboot oem get_identifier_token WITH THE DEVICE IN DOWNLOAD MODE
Unfortunatly HTC-DEV still will not give you the UNLOCK TOKEN yet. The pg2fs partition needs an edit then htc dev will generate a good code. Problem is without clip you cannot modify the pg2fs image. Allthough I am working on it.
STEP #2 ( Get Perm Root !! )
Download the Patched TWRP and SuperSu
The 2 files are attached to the thread. Unzip the TWRP-No-Touch.img.zip Do not unzip the Super.zip.
Copy the super.zip to the device sdcard. Use file explorer or terminal.
Code:
adb push super.zip /sdcard/super.zip
Flash the TWRP Recovery to the device.
reboot to download mode
Code:
adb reboot download
Flash the recovery
Code:
fastboot flash recovery Twrp-526-NO-TOUCH.img
Boot into TWRP Recovery
Code:
fastboot boot recovery
DON'T PANIC !! Yes your right......The touch screen is not working!!!
I need to compile a custom kernel to get TWRP working Right.
I have compiled the kernel but it isn't booting right yet. That's why I figured out this work around for now.
So Now What ???
No worries....Even though we can't access the TWRP commands from the touch screen LETS NOT FORGET.........
We can use the command line :highfive:
Open up terminal on your computer.
If it's not already open.
Go into the shell.
Code:
adb shell
No need to type su cause in case you didn't notice we are already ROOT. "#"
So to install SuperSu (or any other zip package) we do this.
#1 Mount the system partition.
Code:
mount -o rw -t ext4 /dev/block/mmcblk0p62 /system
#2 Tell TWRP what we want it to do one stap at a time
Set device to boot into recovery upon reboot.
Code:
echo 'boot-recovery ' > /cache/recovery/command
Tell TWRP to install SuperSu when it boots.
Code:
echo '--update_package=/sdcard/super.zip' >> /cache/recovery/command
Reboot the recovery to install the SuperSu.
Code:
reboot recovery
Now you will see TWRP boot back up and when it boots up it will install the zip package.
Congratulations you are now one of the first peoples to have a fully rooted Verizon Desire 526. :laugh::silly:
Lets get busy boys !!!! We need to get this boot loader unlocked for the rest of the community.
It's all about the pg2fs partition. If we can find a way to write to it with s-on and boot loader locked then we can unlock all boot-loaders

Glad to see sum positive progress in the right direction....

BigCountry907 ,
Since the MarshaMallow update gives us the developer options OEM unlock switch, shouldn't we just update to it first, to get the bootloader unlock?

OEM Update
You won't find the option to turn on OEM in the device.
You can enable it! Here's how:
Go to the Google Play Store.
Search secret codes revealer.
Search codes
Look for 759
Click launch code
Confirm launch
Under oem click on.
Congrats. You've just enabled oem on your desire 526!
Happy hunting.
BigCountry907 said:
How To Get Permanent Root
This is a workaround until I can compile a Bootable Kernel
First of all say thanks to @Captain_Throwback !!
He was the original creator of the TWRP Recovery for the Desire 626s.
I have taken his TWRP recovery for the 626s, unpacked it and ported in some of the Desire 526 recovery image.
Kinda a cracked up way of doing this but hey ( It Works)
Step #1
Unlock Your Boot-Loader !!! (currently accomplished with a Java Card / HTC Service Tool)
Even with the card you could run into trouble with unlocking the boot-loader.
There is no switch to Enable OEM Unlock available in the Developer Options.
Here is a work-around for that.
Step #1-A
Open up terminal shell on a computer and pull the frp image from the device. (Temp Root Required)
Code:
dd if=/dev/block/bootdevice/by-name/frp of=/sdcard/frp.img
Terminal Output
[email protected]_a13wlpp:/ #dd if=/dev/block/bootdevice/by-name/frp of=/sdcard/frp.img <
1024+0 records in
1024+0 records out
524288 bytes transferred in 0.364 secs (1440351 bytes/sec)
[email protected]_a13wlpp:/ #
Pull the frp.img to the computer.
If you are still in adb shell.
Code:
exit
exit
Then from the normal command line
Code:
adb pull /sdcard/frp.img
Terminal Output
f=/dev/block/bootdevice/by-name/frp of=/sdcard/frp.img <
1024+0 records in
1024+0 records out
524288 bytes transferred in 0.364 secs (1440351 bytes/sec)
[email protected]_a13wlpp:/ # exit
[email protected]_a13wlpp:/ $ exit
[email protected]:~$ adb pull /sdcard/frp.img
2758 KB/s (524288 bytes in 0.185s)
[email protected]:~$
Now open the frp.img file in a hex editor. Like HXD in windows.
Go to the last line of the file.
Change the very last 00 to 01 and save the file.
Reference the screen shots below.
Factory FRP
Patched FRP
Flash the patched frp.img to the device.
Back to the terminal.
Code:
adb push frp.img /sdcard/frp.img
Code:
adb shell
su
dd if=/sdcard/frp.img of=/dev/block/bootdevice/by-name/frp
If you have completed this now your clip can unlock the boot-loader
In case your wondering this will also work on a boot loader locked device. It will get you as far as being able to get a unlock token from fastboot using Fastboot oem get_identifier_token WITH THE DEVICE IN DOWNLOAD MODE
Unfortunatly HTC-DEV still will not give you the UNLOCK TOKEN yet. The pg2fs partition needs an edit then htc dev will generate a good code. Problem is without clip you cannot modify the pg2fs image. Allthough I am working on it.
STEP #2 ( Get Perm Root !! )
Download the Patched TWRP and SuperSu
The 2 files are attached to the thread. Unzip the TWRP-No-Touch.img.zip Do not unzip the Super.zip.
Copy the super.zip to the device sdcard. Use file explorer or terminal.
Code:
adb push super.zip /sdcard/super.zip
Flash the TWRP Recovery to the device.
reboot to download mode
Code:
adb reboot download
Flash the recovery
Code:
fastboot flash recovery Twrp-526-NO-TOUCH.img
Boot into TWRP Recovery
Code:
fastboot boot recovery
DON'T PANIC !! Yes your right......The touch screen is not working!!!
I need to compile a custom kernel to get TWRP working Right.
I have compiled the kernel but it isn't booting right yet. That's why I figured out this work around for now.
So Now What ???
No worries....Even though we can't access the TWRP commands from the touch screen LETS NOT FORGET.........
We can use the command line :highfive:
Open up terminal on your computer.
If it's not already open.
Go into the shell.
Code:
adb shell
No need to type su cause in case you didn't notice we are already ROOT. "#"
So to install SuperSu (or any other zip package) we do this.
#1 Mount the system partition.
Code:
mount -o rw -t ext4 /dev/block/mmcblk0p62 /system
#2 Tell TWRP what we want it to do one stap at a time
Set device to boot into recovery upon reboot.
Code:
echo 'boot-recovery ' > /cache/recovery/command
Tell TWRP to install SuperSu when it boots.
Code:
echo '--update_package=/sdcard/super.zip' >> /cache/recovery/command
Reboot the recovery to install the SuperSu.
Code:
reboot recovery
Now you will see TWRP boot back up and when it boots up it will install the zip package.
Congratulations you are now one of the first peoples to have a fully rooted Verizon Desire 526. :laugh::silly:
Lets get busy boys !!!! We need to get this boot loader unlocked for the rest of the community.
It's all about the pg2fs partition. If we can find a way to write to it with s-on and boot loader locked then we can unlock all boot-loaders
Click to expand...
Click to collapse

Good to know about the 759 code webag.youtag.
But without buying the clip device we are still stuck.
So hopefully BigCountry907 can find a way to unlock the bootloader and root without the clip.
Sidenote: I tried changing my PRL but couldn't get the changes to stick. I tried DFS and QPST. Am I missing something?

@webag.youtag
I installed the mentioned app and used the code.
It shows in the app that the oem is turned on.
But It isn't setting the last byte of the FRP to 01 so ultimatly it will not work.
I tested and still get.
[email protected]:~$ fastboot oem get_identifier_token
...
(bootloader) [KillSwitch] : /dev/block/bootdevice/by-name/frp
(bootloader) [KillSwitch] Last Byte is 0X00, disable unlock
(bootloader) [KillSwitch] oem unlock Turn Off!
OKAY [ 0.082s]
finished. total time: 0.082s
[email protected]:~$
The app lacks permissions to write to the frp partition.
Anyone working on unlocking the boot-loader needs to use the method I posted previously.
And also note: If you reboot the phone then you need to flash the frp partition again.
During re-boot the bit gets set back to 00.
So in a nutshell.
Edit your frp. Make 00 = 01.
Then dd flash the frp.
Then adb reboot download.
Then fastboot oem get_identifier_token.
Problem is there still is a change required in the pg2fs partition / TO Avoid the CID Not Allowed Error
@supermaxkato
Not sure about the prl.
But I have noticed that the security system is tricky.
It will show you in adb shell that you have written the changes to the partition successfully.
But due to the read only protection the partition never really gets written.
Basically instead of giving an error it is writing to a NULL device successfully.

I was looking around and saw a post! (Rare I know)
Have you tried hboot instead of fastboot?also, I have no computer (sad). I am able to get temp root with "kingroot-4.8.2" I am able to use hex edit to change frp from 00 to 01. Is there a way to get identifier token without a PC? Maybe in configuration files or prop files?
BigCountry907 said:
@webag.youtag
I installed the mentioned app and used the code.
It shows in the app that the oem is turned on.
But It isn't setting the last byte of the FRP to 01 so ultimatly it will not work.
I tested and still get.
[email protected]:~$ fastboot oem get_identifier_token
...
(bootloader) [KillSwitch] : /dev/block/bootdevice/by-name/frp
(bootloader) [KillSwitch] Last Byte is 0X00, disable unlock
(bootloader) [KillSwitch] oem unlock Turn Off!
OKAY [ 0.082s]
finished. total time: 0.082s
[email protected]:~$
The app lacks permissions to write to the frp partition.
Anyone working on unlocking the boot-loader needs to use the method I posted previously.
And also note: If you reboot the phone then you need to flash the frp partition again.
During re-boot the bit gets set back to 00.
So in a nutshell.
Edit your frp. Make 00 = 01.
Then dd flash the frp.
Then adb reboot download.
Then fastboot oem get_identifier_token.
Problem is there still is a change required in the pg2fs partition / TO Avoid the CID Not Allowed Error
@supermaxkato
Not sure about the prl.
But I have noticed that the security system is tricky.
It will show you in adb shell that you have written the changes to the partition successfully.
But due to the read only protection the partition never really gets written.
Basically instead of giving an error it is writing to a NULL device successfully.
Click to expand...
Click to collapse

Can you please upload your unlocked boot loader bigcountry907?

Any more progress on this, gentlemen?

When I follow the OP and get to the step:
"fastboot flash recovery Twrp-526-NO-TOUCH.img"
I receive the following error:
FAILED (remote: 9: SD_SECURITY_FAIL recovery and bootloader isn't BL_UNLOCK)
finished. total time: 2.762s
Steps taken:
-frp.img (Pulled from the device, edited & reflashed back with dd command, adb shell reports successful)
-pushed super.zip to device
-rebooted using fastboot to download mode
-attempted to flash TWRP & get the fail with the same error multiple times
Any suggestions or clues? I've attempted this several times, following the OP step by step.
Thanks for the help

@rfunderburk39
You have to unlock the BOOTLOADER first.
Currently I can only unlock it with the xtc-2 clip.
But I'm working on it.
Surprisingly my desire 530 was able to be s-off using TWRP recovery.
If i can somehow capture the commands passed from the xtc-2 clip to the twrp recovery we can replicate it.
Other than that were looking at cooking a qfil / qpst flashable rom.
Not easy.
does anyone know how to log all commands sent to TWRP?

BigCountry907, is the desire 530 you were able to root with twrp the verizon version? If so, did you have to unlock the bootloader first? Because I don't see it on htcdev.

@BigCountry907 I misunderstood the OP, I thought the frp.img edit was a work around of the Java Card.
I will look into the logging of the the TWRP commands. Let me know if I can help out in other ways.

@rfunderburk39
It gets you one step closer but still at the end it fails.
Verizon implements some major security.
I could really use some help.
I got alot together. The entire qcom msm8909 source + manuals you name it.
I was amazed today when i unlocked a desire 530 with the xtc-2 clip and it used @Captain_Throwback twrp to s-off the device.
The beauty of this is it proves S-Off is possible through twrp recovery.
It was my belief that the recovery did not have high enough permissions to write to the radio and get s-off.
Apparently if you know the right commands in the TWRP #shell it's possible.
So how deep into linux / android do you go?
My next best attempt is to generate a service rom using QPST to flash in EDL mode.
Ever make a partition.xml file???
Thats aboot where im at.
oh yea and JTAG TOO.

BigCountry907 said:
@rfunderburk39
It gets you one step closer but still at the end it fails.
Verizon implements some major security.
I could really use some help.
I got alot together. The entire qcom msm8909 source + manuals you name it.
I was amazed today when i unlocked a desire 530 with the xtc-2 clip and it used @Captain_Throwback twrp to s-off the device.
The beauty of this is it proves S-Off is possible through twrp recovery.
It was my belief that the recovery did not have high enough permissions to write to the radio and get s-off.
Apparently if you know the right commands in the TWRP #shell it's possible.
So how deep into linux / android do you go?
My next best attempt is to generate a service rom using QPST to flash in EDL mode.
Ever make a partition.xml file???
Thats aboot where im at.
oh yea and JTAG TOO.
Click to expand...
Click to collapse
Tommorrow my time will be limited during the day, but I can look into "qcom msm8909 source + manuals" & the ability to log TWRP commands and see what I can find.
Interesting about the 530, I was not aware that was possible.
I've used linux for about 20 years, and would consider my knowledge to be good, with the ability to usually get to source of a problem and/or find a solution slash work around.
I've never created a partition.xml, but would be happy to look into it.
I do have quite a bit of past JTAG experience but that was using a serial port not USB, which I assume you are referencing.

@supermaxkato
No my Desire 530 is Metro-Pcs.
I took one of the verizon 526 and activated it then used the phone number to port to Metro Pcs.
With the port it cost $70 for the Desire 530 + 1 month of unlimited service. Essentially the Desire 530 was free.
Any Verizon HTC most likely will have the same security scheme.
@rfunderburk39
This is good news. I would be grateful to have help on this.
It is difficult to know what kind of experience people have some don't even know how to use adb.
I will start another thread with all the information I know so far.
And I have the MSM8909 source code. Not just the kernel but the "Qualcomm Chipcode" Board Support Package.
And many qcom manuals.
This should be very helpful to us.
I will name the new thread "{WIP} {ROM} MSM8909 Service Rom From Source / QPST Root + Unlock + Unbrick"
I will post all current information there.

Something potentially worth trying:
-Grab the Settings.apk (and .odex) from the 526+ or 626, just make sure its the same version of android.
-Push those to device
-adb shell
-su
-mount -o rw,remount,rw /system
-exit
-exit
-adb push Settings.apk /system/priv-app/Settings/
-adb push Settings.odex /system/priv-app/Settings/arm/
-Open >settings>developer options on the device
-check and see if the option “OEM Unlock” appears
-reboot into "download mode" and see if the settings stick.
-run fastboot oem get_identifier_token
Granted this holds the possibility of bricking the phone, but more than likely will not stick on a reboot & the Settings.apk will be replaced with the device original.

I will test on mine.
Give me an hour

Well I replaced the settings files with the settings files from the unlocked ruu for the 526.
It's a no-go the settings app crashes on boot.
This would only add the oem_unlocking option.
We can get the same result by changing the last byte 00 of the FRP.img to 01 and then in a root shell
to pull
dd if=dev/block/bootdevice/by-name/frp of=/sdcard/frp.img
to push
dd if=/sdcard/frp.img of=dev/block/bootdevice/by-name/frp
This will work to get a Unlock Token but the HTC-DEV site will reject it.
ERROR = CID Not Allowed.
If you can find a way to write the pg2fs partition I can make this work.

BigCountry907 said:
@rfunderburk39
It gets you one step closer but still at the end it fails.
Verizon implements some major security.
I could really use some help.
I got alot together. The entire qcom msm8909 source + manuals you name it.
I was amazed today when i unlocked a desire 530 with the xtc-2 clip and it used @Captain_Throwback twrp to s-off the device.
The beauty of this is it proves S-Off is possible through twrp recovery.
It was my belief that the recovery did not have high enough permissions to write to the radio and get s-off.
Apparently if you know the right commands in the TWRP #shell it's possible.
So how deep into linux / android do you go?
My next best attempt is to generate a service rom using QPST to flash in EDL mode.
Ever make a partition.xml file???
Thats aboot where im at.
oh yea and JTAG TOO.
Click to expand...
Click to collapse
BigCountry907 said:
Well I replaced the settings files with the settings files from the unlocked ruu for the 526.
It's a no-go the settings app crashes on boot.
This would only add the oem_unlocking option.
We can get the same result by changing the last byte 00 of the FRP.img to 01 and then in a root shell
to pull
dd if=dev/block/bootdevice/by-name/frp of=/sdcard/frp.img
to push
dd if=/sdcard/frp.img of=dev/block/bootdevice/by-name/frp
This will work to get a Unlock Token but the HTC-DEV site will reject it.
ERROR = CID Not Allowed.
If you can find a way to write the pg2fs partition I can make this work.
Click to expand...
Click to collapse
I didn't think it would work, just an outside chance. Hoped it may give a different token, that in turn would pass over at HTC-DEV.
Back when I had other HTC devices, I used a tool here on XDA [TOOL] HTC Easy Unlock Bootloader Tool. It doesn't appear to be maintained any longer, its based around Windows *.bat files (easy enough to edit)
https://forum.xda-developers.com/showthread.php?t=2133336
and SimpleGoldCard
https://forum.xda-developers.com/showthread.php?t=970157
SimpleGoldCard would access a site, after downloading that, you select it in the SimpleGoldCard application & it would create the image.
https://huygens.hoxnet.com/goldcard.html
I haven't had time to read through these post just yet, the method may no longer be valid. But worth a look, and I will be reading through these today to see.
Also I will see what I can find about a work-a-round of the the writing to pg2fs partition