Develop Bugs

[GUIDE] Downgrade your Desire-Z from 1.72 to 1.34 (and get root and S-OFF)

First thanks to everybody who made it possible to root our great devices.
THIS WILL WIPE YOUR DEVICE, BACKUP EVERYTHING BEFORE DOING THIS!
Polish translation by trzype
If you don't know how to use adb/fastboot don't do this. Use the search function and google and learn how to use them. If you know everything about them come back. I made a pretty nice tutorial, many people used it already with success. But I won't add anything like "go to startmenu and type..."
If your INFOCID is NOT one of these you need to make a goldcard to downgrade!
HTC__001
HTC__032
HTC__E11
HTC__203
HTC__Y13
HTC__102
HTC__405
HTC__304
HTC__A07
HTC__N34
HTC__J15
check with:
Code:
adb reboot bootloader
fastboot oem boot
Here is a great guide how to make a goldcard, follow the first part and come back here then.
Get theses 3 files:
https://github.com/tmzt/g2root-kmod/raw/scotty2/scotty2/psneuter/psneuter (right click > save as...)
https://rapidshare.com/files/1884723844/PC10IMG.zip
https://rapidshare.com/files/948281832/root.zip
Since this uses some security holes to gain root privileges on your phone some antivirus programs on your pc might warn you that this contains a virus. Thats not the case!
MikeChannon said:
It might be worth saying in the thread that android/Exploit.ragecage.A is the exploit being used to gain root and Users should not worry about the warning some software will give.
Click to expand...
Click to collapse
Extract misc_version_01.zip (only misc_version is needed)
Get the PC10IMG.zip from here or download the full RUU from here.
If you already downloaded the 1.34 RUU somewhere else you can skip this step.
Code:
adb push psneuter /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/psneuter
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/psneuter
adb shell
Check if you have the '#' sign instead of the '$'
If you see the '#' sign you got root!
Code:
/data/local/tmp/misc_version -s 1.33.405.5
exit
If you have downloaded the 1.34.405.5_PC10IMG.zip copy it to you SD-Card and rename it to PC10IMG.zip.
If you downloaded the full RUU or had it already execute the exe file (mine is called RUU_Vision_HTC_WWE_1.34.405.5_Radio_12.28b.60.140e_26.03.02.26_M_release_155556_signed.exe), start explorer and type %temp% in the adress bar.
Look in all the folders starting with a { sign and also in the sub directories if it also starts with a { sign, in one of the subdirectories there should be a rom.zip file with 298.442.206 bytes and the MD5 sum 2ff42897cd27e0db425a2cf36c8bd078.
Copy this rom.zip to your SD-Card on the phone and rename it to PC10IMG.zip
Code:
adb reboot bootloader
(or turn your phone of and on again while holding the trackbad).
Wait till the phone is in bootloader mode (white screen should look like this but with other infos http://www.brutzelstube.de/wp-content/uploads/2010/09/hboot.jpg)
Select bootloader (vol +/- buttons for navigation and power button for select).
Wait for the phone to scan the sdcard, once it's done it will ask you if you want to start the update. Confirm it and wait till it's done. Reboot with powerbutton when asked.
After the reboot check for version informations, it should show this:
Enable USB-Debugging on your phone
Extract root.zip
Code:
adb install AndroidTerm.apk
adb push busybox /data/local/tmp/
adb push gfree /data/local/tmp/
adb push rage /data/local/tmp
adb push root /data/local/tmp/
adb shell chmod 0755 /data/local/tmp/*
adb push su /sdcard/
adb push Superuser.apk /sdcard/
Start the Terminal app on your phone and type:
Code:
/data/local/tmp/rage
Wait until you see the message "Forked #### childs.", reset Terminal (menu > Reset Term). The Terminal app will close, launch it again. It will force close, launch it again.
You should see the magic '#' sign again.
Next type in the terminal
Code:
/data/local/tmp/gfree -f
, this will turn Security off (S-OFF), remove SIM Lock and set CID to 11111111.
Last step in terminal app on your phone is to execute these commands.
Code:
/data/local/tmp/root
sync
This will root your phone. It's possible that you get an error message "mkdir: /system/xbin already exists", don't worry everything should be ok.
After that restart your phone.
Now get ROM Manager and install the recovery image from there. If you are happy with the 1.34 software everything is done here, if not you can flash anything you want now.

Nice work! We allways need more people using the magic of root
Sent from my HTC Vision using XDA App

Thanks a lot for your effort!
Just bought a Desire Z and accidentally upgraded OTA.
Will try it now and report back.

I get the following Error when trying to run misc version
Code:
# /data/local/tmp/misc_version -s 1.33.405.5
/data/local/tmp/misc_version -s 1.33.405.5
--set_version set. VERSION will be changed to: 1.33.405.5
Patching and backing up partition 17...
Error opening backup file.
#
Any ideas mate?
Edit: Sorry, forgot to unmount phone from windows when i copied the img over.

VERY IMPORTANT
The OP made a small mistake in the instructions:
Code:
/data/local/tmp/misc[COLOR="Red"][B]-[/B][/COLOR]version -s 1.33.405.5
exit
the dash (-) should be an underline (_)
Code:
/data/local/tmp/misc[COLOR="Red"][B]_[/B][/COLOR]version -s 1.33.405.5
exit
Please update the first post

Darkyy said:
VERY IMPORTANT
The OP made a small mistake in the instructions:
Code:
/data/local/tmp/misc[COLOR="Red"][B]-[/B][/COLOR]version -s 1.33.405.5
exit
the dash (-) should be an underline (_)
Code:
/data/local/tmp/misc[COLOR="Red"][B]_[/B][/COLOR]version -s 1.33.405.5
exit
Please update the first post
Click to expand...
Click to collapse
Thanks, fixed it.

Question:
Should the psneuter -file be without a suffix?
Or should it be like psneuter.txt?

Gnurf said:
Question:
Should the psneuter -file be without a suffix?
Or should it be like psneuter.txt?
Click to expand...
Click to collapse
Without the extension... .txt is added by your browser presumably so you'll have to rename it

Another error:
When I reboot into the bootloader, the phone scans PC10IMG.ZIP and then says "CID incorrect! Update Fail! Press <POWER> to reboot."

paw3lk said:
Without the extension... .txt is added by your browser presumably so you'll have to rename it
Click to expand...
Click to collapse
Thats what I thought aswell, but seeing there has been a post about it previously... (in the other tread)
Thanks.

worked as described, big thx

waqypaqy said:
Another error:
When I reboot into the bootloader, the phone scans PC10IMG.ZIP and then says "CID incorrect! Update Fail! Press <POWER> to reboot."
Click to expand...
Click to collapse
What phone and software version do you have?
It seems like you use a wrong PC10IMG.zip for your phone. Did you download the zip from here or got it yourself from the full ruu?

Another error:
Step 15: Extract root.zip
and then do the commands:
Code:
adb chmod 0755 /data/local/tmp/*
should be
Code:
adb [B][COLOR="Red"]shell [/COLOR][/B]chmod 0755 /data/local/tmp/*

g4rb4g3 said:
What phone and software version do you have?
It seems like you use a wrong PC10IMG.zip for your phone. Did you download the zip from here or got it yourself from the full ruu?
Click to expand...
Click to collapse
I've got the Desire Z running 1.72. I first tried downloading the PC10IMG.zip from the 1st link in part 3 which didnt work. I then tried the RUU file, found the rom.zip in Temp, renamed it and copied it to SD card, which didnt work either
What am I doing wrong?
Software number: 1.72.161.1

Darkyy said:
Another error:
Step 15: Extract root.zip
and then do the commands:
Code:
adb chmod 0755 /data/local/tmp/*
should be
Code:
adb [B][COLOR="Red"]shell [/COLOR][/B]chmod 0755 /data/local/tmp/*
Click to expand...
Click to collapse
Thanks, fixed it.
Sent from my HTC Vision using XDA App

waqypaqy said:
I've got the Desire Z running 1.72. I first tried downloading the PC10IMG.zip from the 1st link in part 3 which didnt work. I then tried the RUU file, found the rom.zip in Temp, renamed it and copied it to SD card, which didnt work either
What am I doing wrong?
Software number: 1.72.161.1
Click to expand...
Click to collapse
Did you root your phone before the ota update?
Sent from my HTC Vision using XDA App

g4rb4g3 said:
Did you root your phone before the ota update?
Sent from my HTC Vision using XDA App
Click to expand...
Click to collapse
Yes I had rooted it with Visionary before I updated it. Please tell me I still have some hope for getting root back

waqypaqy said:
Yes I had rooted it with Visionary before I updated it. Please tell me I still have some hope for getting root back
Click to expand...
Click to collapse
Did you set s-off too while rooting?
Sent from my HTC Vision using XDA App

g4rb4g3 said:
Did you set s-off too while rooting?
Sent from my HTC Vision using XDA App
Click to expand...
Click to collapse
Nope Im screwed arent I?

waqypaqy said:
Nope Im screwed arent I?
Click to expand...
Click to collapse
adb reboot bootloader
fastboot oem boot
Post the result of the 2nd command (dont know if it works... but it wont harm anything)
Sent from my HTC Vision using XDA App

[Q] Unrooting for warranty return

I rooted my phone using the gfree method outlined in the wiki, but made a Nandroid backup of stock before I started anything. I restored the backup; is there anything else I need to do before sending it back?
I noticed that still have the Superuser app in my app drawer, and I wasn't able to follow the instructions for S-OFF here (http://forum.xda-developers.com/wiki/index.php?title=HTC_Vision#Turning_S-On) as it said "Permission denied" when I type cd /data/local (I also noticed that I don't have the /data/local folder anymore on my sd card).

Gfree gives you an option to turn S-off or S-on, go back to the wiki and re-read it, the code below is copied from the Wiki and I highlighted the options in red for you, just run gfree again with the -s option
Code:
gfree usage:
gfree [-h|-?|--help] [-v|--version] [-s|--secu_flag on|off]
-h | -? | --help: display this message
-v | --version: display program version
-s | --secu_flag[COLOR="red"] on|off[/COLOR]: turn secu_flag [COLOR="Red"]on[/COLOR] or [COLOR="red"]off[/COLOR]
-c | --cid <CID>: set the CID to the 8-char long CID
-S | --sim_unlock: remove the SIMLOCK
-f | --free_all: same as --secu_flag off --sim_unlock --cid 11111111
As far as superusers app, just go into the app manager and remove it.

Sorry, I should've clarified that I don't have gfree anymore. I tried again and this is the prompt I get:
$ su
su
# cd data/local
cd data/local
# chmod 777 gfree
chmod 777 gfree
Unable to chmod gfree: No such file or directory
# ./gfree
./gfree
./gfree: not found
#

Push the gfree file back to data/local and rerun the commands except with -s option read the wiki again and use the right commands.
Sent from my HTC Vision using XDA App

All right, got my phone back to stock unrooted and with S-ON. Here's what I did (note that my circumstances my be different than yours so try this at your own risk):
I rooted and S-OFFed using the rage (v 0.03-this will come into play later) method on the wiki (http://forum.xda-developers.com/wik...sion#Rooting_the_Vision_.28G2.2FDZ.29_and_DHD). I did this right when I got the phone, so no OTA update (I had 1.19). Downloaded ROM Manager and did a Nandroid backup at this point (in my above post I said I made a backup right at the beginning which I was mistaken on). Then I went ahead and flashed CyanMod.
Phone earpiece broke, so I had to get the phone back to stock. First I restored my backup ROM (so back to 1.19 again). Used the unroot guide (http://forum.xda-developers.com/showthread.php?t=835971), and during step one, I got the following error:
E:Board does not support mtd utils.E:Failure at line 344:
write_raw_image PACKAGE:boot.img BOOT:
Installation aborted.
Failure at line 6:
install_zip SDCARD:/stock_root.zip​Some others seemed to get this error as well and it looked benign. Continued and rebooted the phone. Figured this would be a failure, so I followed the HexEditor steps. Turns out the misc.img file was already the right version, but I renamed it and ran dd if=/sdcard/miscnew.img of=/dev/block/mmcblk0p17 just in case.
Step 2 ran without any problems, so now I had a stock phone with S-OFF. To turn it back on, I temp rooted the phone (just follow the TEMP Root steps in the wiki). I then tried to follow the S-ON directions on the wiki (http://forum.xda-developers.com/wiki/index.php?title=HTC_Vision#Turning_S-On), but the phone would automatically reboot after the dd line while not changing S-OFF.
Then I realized that I could use ./gfree -s on to turn S-ON since I was using 0.03, which worked perfectly. Rebooted to remove the temp root, and did a factory restore for good measure, and I believe I have a fairly pristine G2 ready for replacement.
Thanks to all the wikis and threads for their help!

I have a question about restoring to factory settings. Cant you just use the RUU from HTC (if you have a Desire Z that is) and just run that? Wont that just put it back to factory settings?

[Q] about to flash eng hboot

here are my phone specs
pvt ship s-off
hboot 0.82.0000
microp-0425
radio 26.03.02.26m
emmc-boot
sep 2 2010, 17:59:38
is there anything i should change?
only reason i ask is cause i have bricked a phone before and i think it was due to wrong hboot/radio combo (mt3g 1.0)
btw i rooted via rage root temp and gfree method
all help/tips is appreciated!

8. Install the engineering hboot (if you really want to)
8.1. download engineering hboot
Download the appropriate HBOOT for your phone:
T-Mobile G2: vision.hboot-0.76.2000.zip (md5sum 7669AE12DC2FAA10AE555A164980EFD0)
HTC Desire Z: vision.hboot-0.84.2000.zip (md5sum 2CE1BDD5E4C1119CCFCECB938710D742)
HTC Desire HD: ace_glacier.hboot-0.85.2007.zip (md5sum df4fd77f44993eb05a4732210d2eddc6)
Note that the md5sums are for the actual hboot img contained within the zip file, not the for the zip file itself. Note also that the dz, g2, and dhd each use their own version of the engineering boot, as the phones are partitioned differently. (If you have previously installed the wrong HBOOT for your phone, you may need to reflash everything after partition 18)
8.2. Copy the files to the phone
Connect the phone to the USB of your PC. The phone will stay connected during the complete procedure.
Make sure that you do NOT turn on USB storage. There has to be a sdcard in the phone and it has to be mounted to the phone!
Unpack the engineering hboot zip files to a directory on your PC.
Open a terminal (or command window) on your PC and change the current directory to where the file is on your PC and execute these commands:
$ adb push hboot-eng.img /data/local/tmp/
8.3. Install the engineering hboot
Please make sure that you type or better copy/paste the following commands exactly, and in exactly this order. Especially the dd-command is very critical!
In the terminal (or command window) on your PC execute these commands:
$ adb shell
$ su
# dd if=/data/local/tmp/hboot-eng.img of=/dev/block/mmcblk0p18
# sync
8.3.1. Check the md5sums of the installed hboot
As it is very important that the hboot was installed correctly we recommend to check the md5sums of the partition. In the root shell (indicated by the #) that you got in the Temporary root section execute the following commands:
# /system/xbin/busybox md5sum /data/local/tmp/hboot-eng.img
# /system/xbin/busybox md5sum /dev/block/mmcblk0p18
We call these two md5_1 and md5_2 in the next section
If md5_2 does not match md5_1: First DON'T REBOOT and second run for help at the #G2ROOT IRC channel on freenode.
If md5_2 matches md5_1: You are fine, Reboot your phone by executing the following command in the root shell (indicated by the #):
# reboot

thats relavent section of wiki for you follow it .... although putting eng hboot puts you at risk of bricking your phone while flashing radio . stock hboot atleast doesnt let you to flash wrong radio

You don't need eng hboot to change the radio. Read this http://forum.xda-developers.com/showthread.php?t=970809

Is this method safe, or are there many problems with md5?

[Q] Desire Z - Upgrade to Android 4

Hi Everybody,
I know, that there are a lot of threats about this fact in the forum. But nothing will work for me, aspessially important links will not work anymore. Could anybody help me?
If I go to the bootloader (noise - and Power-On) there are the following informations written:
VISION PVT SHIP S-ON
HBOOT-0.85.0013
MICROP-0425
RADIO-26.10.04.03_MeMMC-boot
Apr 11 2ß11,23:36:27
HBOOT
OK, on my cell is working a Android 2.3.3, so I have to root my cell and downgrade.
I tryed to do this with the following threat: http://forum.xda-developers.com/showthread.php?t=905261
1. I Tryed to create a GOLDCARD. I read this threat, got the CID of my cell with the the code
Code:
adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
. Now I should type this CID in a webformular at this link to reverse it. This formular is still working, but there is also a Excel-Tool on this page for downloading, which should do the same. So my CID like "035344534d49202010000073b900d494" was reversed to "00d400b9730000102020494d53445303".
This code I should input to this formular for creating a GOLDCARD, but it doesn't work anymore.
So I looked around and found this threat, where a goldcardcreator is downloadable.
In this zip-file is included a program named "SimpleGoldCard", which read a reversed CID from the cell. On a command-Line I typed in
Code:
gcard -c 00d400b9730000102020494d53445303 -r -o "GoldCard.img"
Than I putted in the sd-Card into the Card-Reader of my Desktop, formatted it, used the tool "HeX Editor", copyed (line) 00000000 to offset (line) 00000170 (including the 00000170 line) and pasted it to the SD-Card.
After that I hope to created a correct GoldCard.
2. After that I downloaded the files psneuter, PC10IMG.zip and root. But in this threat is written, that I have to extract "misc_version_01.zip". Where is this file? I searched in this forum and downloaded a file named like this. Are there Differences or is a special version needed? I copyed the PC10IMG.zip to the SD-Card and put this to the cell.
3. then I booted the cell again, connected it to the desktop and used the following commands to put the downloaded files to the cell
Code:
adb push psneuter /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/psneuter
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/psneuter
adb shell
After that I should get the # - symbol instead of the $ - symbol which means, that I rooted the phone. But here is my first problem, I didn't get the # - symbol, so I don't have the permission to start the next programms.
4. Normally I would do next the following commands and then to reboot and flash the older Firmware.
Code:
/data/local/tmp/misc_version -s 1.33.405.5
exit
adb reboot bootloader
But when I reboot, the bootloader is looking for the PC10IMG.zip, is loading and checking this ... and gives me the information
CID incorrect!
Update Fail!
Press <POWER> to reboot.
Well, this is the next big problem.
Cold anybody tell me, where my mistakes are? I read 2 days in the forum, tryed a lot to get the final result, but now I don't have the time anymore to continue in this way.
THanks a lot. with best regards, Speedy8

Mods please move to q&a
Always check the stickies
http://forum.xda-developers.com/showthread.php?p=43195539
Follow the threads linked here, don't use any other to root your phone, they will either be outdated or cause you trouble.
After following these threads if you still have issues post back and I'll try to help ya
Best of luck!
Sent from my Nexus 4 using xda premium

well ... I searched again today ... and found the following threat, which was working on my cell-phone.
And also at the cyanogenmod-page you can find the relevant things to root the Desire Z. You can find it here.
Now I will first install the latest cyanogenmod, which is for the Desire Z not the Android 4, but at the moment newer than 2.3.3.
Thanks for answering, my Questions are answered.
With best regards.

Complete Guide to Root, Downgrade and Upgrade HTC Desire Z

A link for all the necessary files in a platform-tools folder.zip:
Sorry, this forum doesn’t allow me to submit direct links.
h.t.t.p.w.w.w. dropbox.com/s/tk0v3aogwqhp5qn/platform-tools.zip?dl=0
Unzip and put the platform-tools folder on your C drive.
A part of this guide was made by steven-liesenborgs I have used that to make an all in one guide.
1. Create Temproot:
Go to start – windows accessories – open the command prompt. Connect the USB cable to your phone and connect to your pc (!! Make sure USB debugging is turned on your HTC and if asked for only charging or mass storage choose only charging!!) Now go back to the command prompt and type: (press enter after each line,)
cd c:\platform-tools
adb devices
Normally you will now see numbers and letters meaning your device is connected and recognized.
Type: (in windows 10 you can select and use ctrl-c ctrl-v)
adb push fre3vo /data/local/tmp
adb shell
chmod 777 /data/local/tmp/fre3vo
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
Now you get normally something like the following lines (this may take 2 min)
Buffer offset: 00000000
Buffer size: 8192
Scanning region fb7b0000…
Scanning region fb8a0000…
Scanning region fb990000…
Scanning region fba90000…
Potential exploit area found at address fbb4d600:a00.
Exploiting device…
I f it Works you will see that $ has dissapeared, otherwise try one of the next lines below (!!restart your mobile for each attempt!!)
/data/local/tmp/fre3vo -debug -start 10000000 -end 1FFFFFFFF
/data/local/tmp/fre3vo -debug -start 20000000 -end 2FFFFFFF
/data/local/tmp/fre3vo -debug -start 30000000 -end 3FFFFFFF
/data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF
/data/local/tmp/fre3vo -debug -start E0000000 -end EFFFFFFF
When $ has dissapeared type:
adb shell
Now you will see # instead off $ which means succes. Now type:
exit
2. Change version to downgrade and get superCID and Goldcard
Type:
adb push misc_version /data/local/tmp/misc_version
adb push flashgc /data/local/tmp/flashgc
adb shell chmod 777 /data/local/tmp/*
adb shell
cd /data/local/tmp
./misc_version -s 1.00.000.0
Now you get:
–set_version set. VERSION will be changed to:1.00.000.0
Patching and backing up partition 17…
Then type:
./flashgc
(!! In case of an error message like below, check if you did select charge only in settings menu !!)
Error opening backup file.
If everything worked type:
sync
You can check if everything is fine, type:
dd if=/dev/block/mmcblk0p17 bs=1 skip=160count=10
1.00.000.010+0 records in
10+0 records out
10 bytes transferred in 0.001 secs (10000 bytes/sec)
BACK-UP everything now
3. Temp root and backup
Type:
Exit
adb push su /data/local/tmp/
adb push busybox /data/local/tmp/
adb push fixsu.sh /data/local/tmp/
adb install SuperUser.apk
adb shell chmod 755 /data/local/tmp/fixsu.sh
adb shell/data/local/tmp/fixsu.sh
Backup your data with a backup program on your phone, Rom Manager, Titanium Backup of My backup root for instance.
4. Downgrade to Froyo:
You will need a Rom which you can find following link below :
(There is a rom included the platform-tools.zip from Dropbox, renamed to PC10IMG.zip ready to use, continue to 4a at once) Remember, this is a shipped EU rom, if you need another you can download and find it at same domain from link below or h.t.t..p androidruu.com
h.t.t.p shipped-roms.com/index.php?catcegory=android&model;=Vision
RUU_Vision_HTC_WWE_1.34.405.5_Radio_12.28b.60.140e_26.03.02.26_M_release_155556_signed.exe
Download this .exe and activate it as administrator wait till you the first screen, don’t do anything just leave it there.
Click on Start>Run and type %temp%. Then click OK. Look for the newest folder in the temp folder. Double-click on it. (Appdata/local files/temp from user administrator) Open the last folder made (organize!) it will have a name like {4AD69632-45A1-41DE-} Search in that directory for a rom which the update utility did create there. Copy the rom to the platform-tools folder. Close the HTC Android Rom Update Utility, you don’t need it anymore. Change the name of the rom in PC10IMG.zip. Be aware if you can see extensions or not and you didn’t create a .zip.zip file. Check it with right click on it and see properties.
4a
Now copy the PC10IMG.zip to the root of SD card. Take off the USB cable and check in phone your settings, charge only, USB and accept software 3thparty. Restart the Desire. For some reason this goes smoother as turning power off. When the screen goes dark push volume down and power button at same time till you get in the boot menu. Click power button one time and the HTC will search for a file, and start to check the PC10IMG.zip. This will take 1 or two minutes . Now you get a choice to upgrade yes or no select yes with the Volume up or down button and activate the choice with the power button. You HTC will now downgrade to Froyo Android 2.2 firmware 1.34.405.5.
5. Root and Superuser to upgrade
Every file you need is already included in the platform-tools.zip from Dropbox
Source: .h.t.t.p.w.w.w. desire.tode.cz/how-to-root-htc-desire-z-g2-vision
Connect the HTC Desire Z to the computer via USB.
Make sure USB debugging is enabled on the HTC Desire Z by checking Settings » Applications » Development » USB debugging.
On the computer, go back to command prompt an type:
adb push busybox /data/local/tmp/
adb push gfree /data/local/tmp/
adb push hboot-eng.img /data/local/tmp/
adb push psneuter /data/local/tmp/
adb push recovery-clockwork-3.0.2.4-vision.img /data/local/tmp/recovery.img
adb push root_psn /data/local/tmp/
adb push su /sdcard/
adb push Superuser.apk /sdcard/
adb shell
chmod 755 /data/local/tmp/*
/data/local/tmp/psneuter
NOTE: You will drop out of the shell after this command to platform-tools folder, type:
adb shell
cd /data/local/tmp
./gfree -f -b hboot-eng.img -y recovery.img
As it is very important that the hboot was installed correctly gfree calculates md5sums of the partition. It will calculate the following 3 checksums
md5sum #1 - checksum of partition 18 before the installation
md5sum #2 - checksum of the hboot image that should be installed
md5sum #3 - checksum of partition 18 after the installation
The messages that you what to see are either/or
md5sum #1 == md5sum #2 – the hboot image is already installed -> skipping installation
md5sum #3 == md5sum #2 – the hboot image was successfully installed -> OK!
If you get a different error message then DO NOT REBOOT. Check everything again and try again
If gfree worked correctly continue with, type:
./root_psn
sync
reboot
The HTC Desire Z is now rooted with S-OFF, the Engineering HBoot & the ClockworkMod Recovery.
6. Install a new Rom
This is a tricky part since most roms will just fail to install, at least on shipped models, the roms from Guhl99 (XDA Forums)do the job. There is an interesting part to these roms also, which I Like. You really should check his work out.
In case you prefer a Cyanogenmod version 10.1 Guhl99 made one also you can find it via XDA forums, in the platform-tools folder there is a working Cyanogenmod 10.1 cm-10.1-20140309-UNOFFICIAL-vision.zip in case you don’t like spoofing. If you do like it, check out Guhl99 his work which you should do anyway in case of HTC Desire 7.
In your platform-tools folder select AndromadusAOSP4.2-vision-pff-16062013.zip an AOS Android4.2.2 and gapps-jb-20130301-signed.zip (they are already present in the platform-tools.zip from Dropbox)
Copy them to the root of your SD card, download Rom Manager from link below and install it:
If you can’t download it because your SD is occupied release the USB cable from your phone.
h.t.t.p.w.w.w. apk4fun.com/apk/2119/
Open Rom Manager, select Recovery Setup and activate the 2th ClockworkMod option, select as option the 3x version. Go back and select now the 1th ClockworkMod option and activate it to flash, it will ask for permission which you grant. Now Clockworkmod has root acces as Superuser. Go back to main menu from Rom Manager and select Fix Permissions. Now, check if everything in your Phone settings is still correct. Charge only, USB debugging, allow unknow installs etc. Take the USB cable out of your Phone. In Rom Manager menu select Reboot to Recovery and activate it, no need to push buttons this time the HTC wil go to Rom Manager bootmenu automatic by restart after showing the HTC start screen first.
7. Rom Manager Bootmenu
Another part which need some attention to proceed. In this menu the Volume up and down button are used to scroll. The power button is used to get to out of a submenu. The Photo button, on right lower side is used to activate the selection. With this knowledge in mind it is easy to navigate and delete Factory Settings, then Cache and under advanced menu the Dalvik Cache. Return to main menu pressing the Power button and select install zip from SD. Select ROMAndromadusAOSP4.2-vision-pff-16062013.zip and activate it with Photo button. The Desire will now install AOS Android 4.2.2. When it is finished select Install a zip from SD again and this time select gapps-jb-20130301-signed.zip and install it. When ready select reboot in Rom Manager and the HTC will restart, which will take some minutes, and it will run now on Android 4.2.2. Connect the HTC to USB Cable and copy the 3 files from platform-tools/PFF folder to your SD. Use a file manager on your HTC to search and install them to play with spoofing.
Now you are ready: This rare quality phone with qwerty keyboard will be at your service for some years more.

Still works! Thanks!