Develop Bugs

Maybe this can help for rooting the new sbf

1. How can I root my phone?
1.1 General information/Basic adb-commands
Rooting a phone enables you to do things, which normally aren't possible for the average user like:
- Removing apps which were preinstalled by the provider (like Orange, Vodafone, etc.). My Tattoo had Vodafone apps for buying music and other sh*t, which was installed on the system partition (to which a "normal" user has no rights to write to, including deleting).
The Tattoo was successfully rooted by a bunch of guys here, namely -bm-, mainfram3 and Coburn64 (maybe, I don't remember quite correctly ). Also the Tattoo was the first phone having a security mechanism hindering a user to mount the filesystems as read/write, which had to be overridden by remapping the read only memory region to a read/write one. This is done by the module Tattoo-hack.ko, also made by mainfram3. He also created the first boot.img, which enabled su directly from adb and loading Tattoo-hack directly from boot on.
A few words about adb:
ADB is a tool for communicating from the PC with the mobile phone. For this a service is running on the phone enabling the communication via Terminal Emulator. Here are the most useful adb-commands:
Code:
adb push localFileFromPC /path/on/mobilephone
-> pushes a file "localFileFromPC" to a specified location on the phone
adb pull /path/to/file pathFromPC
-> receives a file from the phone and stores it to "pathFromPC"
adb remount
-> This is only possible in custom ROMs, remounts the file system to r/w automatically
adb shell "command"
-> executes "command" and returns to the computer shell
adb shell
-> opens a shell session on the phone (from here on you have to be very careful! Also you can execute now normal linux commands like rm, mv, ls, chmod and so on, but not cp (this can done through busybox)). You will have to use this more often, so get used to it
1.2 Do I have to create a goldcard?
I read this question quite often. For rooting, you don't need it, but for SIM-locked phones you can't flash custom unbranded ROMs (I think).
A guide to create a goldcard follow this link: http://forum.xda-developers.com/show...88&postcount=1 (thanks to MiSSigNNo to this point)
1.3 Tools you need
A complete set of tools can be found here Feel free to mirror it:
http://rapidshare.com/files/403766494/Tattoo.rar.html
Mirror(s):
http://www.bild-ton.net/Tattoo.rar
http://www.megaupload.com/?d=CI9AW83F
This package contains:
- adb binaries for Windows (sorry Linux users )
- su (Please note: use the su-binary attached in this post, not the one in the archive!!!!!)
- m7 exploit
- Amon_RA recovery.img
- mainfram3 boot.img
- flash_image binary
- tattoo-hack.ko
1.4 The automated way
This method was created by maverixx and can be found here. This basically consists of a package doing everything you need by itself. It roots the phone and flashes maverixx recovery.img, which (no offense) I don't like as much as I like Amon_RA's one!). Just click the batchfile and it does the rest (you have to connect your phone via USB to your PC though ).
If you want to use the automated way, but flashing Amon_RA's recovery, just replace the recovery.img from maverixx' package with the recovery.img provided in my archive file (see 1.3 for the link).
In my time here I noticed quite a few users experiencing problems either with a fully functional su or with the recovery image not flashing certain update.zip packages. It seems to be a matter of luck.
1.5 The manual way (recommended by the author)
I personally like what is done when and how, that's why I recommend the manual way. So let's get down to business Let's see if you know all the adb-commands I wrote here:
1. Let's say you have everything unpacked into C:\Tattoo
2. In your terminal (on your PC) type:
- adb shell "mkdir /data/local/bin" (if it returns an error it means that the directory already exists, just proceed)
- adb push m7 /data/local/bin/
- adb push su /data/local/bin/
- adb push flash_image /data/local/bin/
- adb push tattoo-hack.ko /data/local/bin/
- adb push recovery.img /sdcard
- adb push boot.img /sdcard
3. We have every needed file on the phone now. Type now (we are still in your terminal):
- adb shell
$ cd /data/local/bin
$ chmod 766 m7 (I don't retain this step as mandatory, so if this process fails, just proceed)
$ while ./m7 ; do : ; done
lots of text until you see something like "wrote shell code", press enter 2 or 3 times enter to see:
#
4. Then perform this:
- # export LD_LIBRARY_PATH=/system/lib
- # export PATH=/system/bin
- # insmod ./tattoo-hack.ko
- # mount -o rw,remount /dev/block/mtdblock5 /data
- # mount -o rw,remount /dev/block/mtdblock3 /system
- # cat ./su > /system/bin/su
- # chmod 4755 /system/bin/su
- # chmod 755 ./flash_image
Questions?
1.6 Problems and (hopefully good) solutions
Q: How do I execute my command line tool?
A: On your Windows host, go to Start->Run...->type "cmd"
Q: Where is my adb? When I type it in my shell it says that it was not found!
A: The adb binary is found in the archive I supplied above or in the Google SDK. As my archive-file is quite smaller than the Google SDK you should take mine. Let's suppose your adb binary is unpacked in C:\Tattoo, then type:
Code:
Your\Current\Location> cd C:\Tattoo
C:\Tattoo> adb <command>Q: adb says "error: device not found" when I try to launch the shell on the phone!
A: Connect the phone with the usb cable and make sure the sd card is not mounted as drive on your PC!!!
Q: When I want to copy something the phone returns that "cp" is not found! Also when I try to move a file, it says "cross-link device".
A: Well, copying from one partition to another is only possible either via busybox or via
Code:
cat file > /location/filename
Example:
cp /data/su /system/bin
is realized by typing
cat /data/su > /system/bin/suAlso make sure that system is r/w!!!
Q: flash_image returns write errors when flashing recovery/boot image!
A:
For boot: Try to redo the flash procedure
For recovery: Note that you can't flash the same recovery.img as the one already installed, so install another recovery.img first (like maverixx) and then Amon_RA's again. If it still doesn't work reboot, remount the partitions r/w, insmod tattoo-hack.ko and retry flashing.
Q: How can I unroot my device?
A: Just delete su from /system/xbin and restore the old boot.img. Alternatively see here for retrieving a stock ROM to flash it on your phone.
i hope someone try this i don't have time

Howto apply manually update to 4.0.4 with encrypted flash and minor changes

OK i'm posting this since it was a bit complex and i think others could benefit.
I was on 4.0.2 stock HSPA (yakju-icl53f). But i had made some minor changes, and worse, had encrypted the flash. How to update to 4.0.4 without a wipe? Turns out it is possible.
First, get CWM and 4.0.4 image.
Clockworkmod from here.
OTA image from 4.0.2 to 4.0.4 from here.
Steps needed:
1. adb reboot bootloader
2. fastboot cwm.img
3. adb shell
4. mount -t tmpfs -o size=330M,mode=0777 tmpfs /sdcard
5. adb push 7f97fbc19417.signed-yakju-IMM76D-from-ICL53F.7f97fbc1.zip /sdcard/update.zip
6. unzip 7f97fbc19417.signed-yakju-IMM76D-from-ICL53F.7f97fbc1.zip META-INF/com/google/android/updater-script
7. unzip 7f97fbc19417.signed-yakju-IMM76D-from-ICL53F.7f97fbc1.zip META-INF/com/google/android/update-binary
8. adb push META-INF/com/google/android/updater-script /sdcard/
9. adb push META-INF/com/google/android/update-binary /sdcard/
10. Fix all the changes you made in the past <more below>. You can try the below steps and just see which assert fail, and then fix them one by one
11. adb shell
12. cd /sdcard/
13. chmod a+rx *
14. ./update-binary 2 stdout update.zip
15. reboot and enjoy.
The changes i had made were to build.prop (adding ro.config.vc_call_vol_steps=10 from volume+) and to remove GenieWidget.apk via TitaniumBackup.
To fix these, i got the 4.0.2 stock image from here.
1. tar zxvf yakju-icl53f-factory-89fccaac.tgz
2. cd yakju-icl53f
3. unzip image-yakju-icl53f.zip
4. Get the ext4_utils file from here. Build it.
5. run simg2img system.img x.img
6. mkdir ./x; sudo mount -o loop -t ext4 ./x.img x
7. adb push x/app/GenieWidget.apk /system/app/
8. adb push x/app/GenieWidget.odex /system/app/
9. adb push x/build.prop /system/
[i just kept running the update-binary 2 stdout update.zip and watching the assert until i knew what all i had changed].
After all this, i rebooted, and it worked. Despite my being encrypted. Despite my changes. Despite my not being eligible for OTA yet. Once i rebooted, i entered my decryption key, it chewed on the upgrade for a bit, and i'm on 4.0.4
Enjoy. The above instructions are for Linux obviously, and may have some minor typos as i did them afterwards.

Thank you for this howto!
Since you are "just updating" I assume you lost root?
Did the boot duration change? With crypted SGN 4.0.2 it takes an eternity and a half to boot.

yes, lost root, had to re-apply (you can use the above instructions but put the super-user zip in for cwm).
no change in boot time

Mmm, you can also do a 'mount -a; chmod 4755 /system/bin/su' if you previously had root, @ step 3 (after rebooting w/ all the changes, redo 1/2/3).

For interest (to open an old thread), this worked to move to Jelly Bean as well. I took the clockworkmod version of the JB from here.
I used the same basic steps as above, but w/ the change of:
1. make ram disk (using 390M instead of 330M)
2. unzip jb-takju.zip (on pc)
3. adb push boot.img /sdcard/
4. adb shell; cat /sdcard/boot.img > /dev/block/platform/omap/omap_hsmmc.0/by-name/boot
5. adb push system.tar /sdcard
6. adb shell; mount /system; cd /system; rm -rf *; cd /; tar xvf /sdcard/system
7. reboot. enjoy.
This kept all my settings, apps, everything... its seamless.

Unlocking DZ ONLY by power button? :)

Hello!
I bought already DZ and everything is fine, but the system of keyboard is pissed off So, I was thinking if is any way to change that when Im opening a phone automatically screen is turned on. I would like to change that, because sometimes when im taking him the phone is trying to open, because of best opening system Screen should turn on only if I will press the power button. Any idea how to resolve that? I'd really appreciate that.

root DZ
IM NOT RESPONSIBLE TO BRICKED DEVICE(S), APOCALYPSE, GLOBAL WARMING AND NUCLEAR WAR
IT WORKED 4ME BUT MAY NOT WORK 4YOU
Download: Attachments (unzip Root.zip to C:/htc/ directory, then copy PC10IMG.zip and .apk files to C:/htc/) PC10IMG.zip link has been dended to your XDA mailbox
Then:
unpack attachment to C:/htc (example)
copy System32.zip files to C:/Windows/System32/
TempRoot:
Run cmd and type:
Code:
adb push C:\htc\fre3vo /data/local/tmp
adb shell
chmod 777 /data/local/tmp/fre3vo/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
This will kick you srom the device shell , but dont worry and DO NOT reboot your device
Change Misc Version:
Code:
adb push C:\htc\misc_version /data/local/tmp/misc_version
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
/data/local/tmp/misc_version -s 1.33.405.5
To get:
Code:
--set_version set. VERSION will be changed to: 1.33.405.5
Patching and backing up partition 17...
Then type:
Code:
sync
Now you must type this GOOD (fail=brick) (still in shell!!!):
Code:
dd if=/dev/block/mmcblk0p17 bs=1 skip=160 count=10
Then type:
Code:
exit
Then copy PC10IMG.zip package:
Code:
adb push C:/htc/PC10IMG.zip /sdcard/PC10IMG.zip
CMDline wont response for 6-10 minutes, its fine, its good
When finish type:
Code:
adb reboot bootloader
Wait until bootloader parse package and press VOL-UP
DO NOT POWER-OFF YOUR DEVICE (PLUG IT TO CHARGER)
When it finish, press POWER button to reboot
You dont must set up android
Switch on usb-debugging (settings/apps/develop)
then plug it to pc and type in cmd:
Code:
adb install C:\htc\AndroidTerm.apk
adb install C:\htc\TotalCommander.apk
adb push C:\htc\busybox /data/local/tmp/
adb push C:\htc\gfree /data/local/tmp/
adb push C:\htc\rage /data/local/tmp
adb push C:\htc\root /data/local/tmp/
adb shell chmod 0755 /data/local/tmp/*
adb push C:\htc\su /sdcard/
adb push C:\htc\Superuser.apk /sdcard/
Then launch Terminal emulator and type:
Code:
/data/local/tmp/rage
to get
"forked xxxxxx childs"
Tap "menu" and select "reset term"
It will kill the terminal
Launch Terminal emulator again, but you will get error wit "force close" (force close it)
Launch Terminal Emulator again and type:
Code:
/data/local/tmp/gfree -f
/data/local/tmp/root
sync
close terminal emulator and launch Total Commander
Go to "system directory" and try to open /data
If succeed (Superuser request): TOU DID (S-OFF, Super-CID (no simlock), root)
You can use RootKeeper.apk to "survive" su binary when installing OTA update (you can root android 2.2 but no android 2.3.3)
Disable root keeper when making nandroid
When you have root you can modify it with flashing another rom
Please hit thanks button

I read that few times to be sure what ive got to do, so tommorow im gonna do the operation Man, you are awsome. In one time I will get root (im doing that from time, when i wrote that thread) and resolve of my unlocking problem Hope, that i will not get lost on that. Cant wait for tommorow..

unlocking DZ
I forgot about one thing: after /data/local/tmp/root you can get error, but it's fine too
If you dont want to check root with Tcmd type "su" in terminal

HELP!!!! Cannot update FTV manually

Tried these steps
Connect to your Fire TV using ADB
(If you don’t know how, follow up to Step 4 Part 2 in our Windows or Mac guide)
Run the command: adb shell
Run the command: su
(If this is the first time you’ve ever run su, a pop-up will appear on the Fire TV, select Grant)
Run the command: chmod 777 /cache
Run the command: chmod 777 /cache/recovery
Run the command: cd /cache/recovery
Run the command: echo “--update_package=/cache/update.zip” > command
Run the command: exit
Run the command (yes, again): exit
Run the command: adb push update.zip /cache
(This assumes the update.zip file you renamed in step 2 is in the same directory as adb, otherwise enter the full path to the file like adb push C:\full\path\to\update.zip /cache)
Once the update.zip file has finished transferring to the Fire TV, run the command: adb reboot recovery
The update.zip file is on the same folder where the adb platform-tools is located, but when I enter the full path it says no such file or directory.
Mine looks like this C:\Users\XXX\platform-tools>adb push update.zip /cache
What am I doing wrong, please help

CD to the directory first . then enter adb push update.zip /cache

mastafunk said:
CD to the directory first . then enter adb push update.zip /cache
Click to expand...
Click to collapse
I did everything in the same folder.
Do you suggests I go back to root of c folder then go back to the folder again

Copy and paste what you entered and the error..

[url]https://www.dropbox.com/s/rdr3buikslvw1qm/adb.png[/URL]
https://www.dropbox.com/s/rdr3buikslvw1qm/adb.png

Stevie G said:
[url]https://www.dropbox.com/s/rdr3buikslvw1qm/adb.png[/URL]
https://www.dropbox.com/s/rdr3buikslvw1qm/adb.png
Click to expand...
Click to collapse
when you push a file with adb, the file must be in the same folder/path you're running the adb command from. From your example, you need update.zip on your PC at C:\users\Stevie G\platform-tools\
The error is saying the file isn't at that path.

Luxferro said:
when you push a file with adb, the file must be in the same folder/path you're running the adb command from. From your example, you need update.zip on your PC at C:\users\Stevie G\platform-tools\
The error is saying the file isn't at that path.
Click to expand...
Click to collapse
might have issues with the space in Stevie G, try a folder without spaces.

Complete Guide to Root, Downgrade and Upgrade HTC Desire Z

A link for all the necessary files in a platform-tools folder.zip:
Sorry, this forum doesn’t allow me to submit direct links.
h.t.t.p.w.w.w. dropbox.com/s/tk0v3aogwqhp5qn/platform-tools.zip?dl=0
Unzip and put the platform-tools folder on your C drive.
A part of this guide was made by steven-liesenborgs I have used that to make an all in one guide.
1. Create Temproot:
Go to start – windows accessories – open the command prompt. Connect the USB cable to your phone and connect to your pc (!! Make sure USB debugging is turned on your HTC and if asked for only charging or mass storage choose only charging!!) Now go back to the command prompt and type: (press enter after each line,)
cd c:\platform-tools
adb devices
Normally you will now see numbers and letters meaning your device is connected and recognized.
Type: (in windows 10 you can select and use ctrl-c ctrl-v)
adb push fre3vo /data/local/tmp
adb shell
chmod 777 /data/local/tmp/fre3vo
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
Now you get normally something like the following lines (this may take 2 min)
Buffer offset: 00000000
Buffer size: 8192
Scanning region fb7b0000…
Scanning region fb8a0000…
Scanning region fb990000…
Scanning region fba90000…
Potential exploit area found at address fbb4d600:a00.
Exploiting device…
I f it Works you will see that $ has dissapeared, otherwise try one of the next lines below (!!restart your mobile for each attempt!!)
/data/local/tmp/fre3vo -debug -start 10000000 -end 1FFFFFFFF
/data/local/tmp/fre3vo -debug -start 20000000 -end 2FFFFFFF
/data/local/tmp/fre3vo -debug -start 30000000 -end 3FFFFFFF
/data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF
/data/local/tmp/fre3vo -debug -start E0000000 -end EFFFFFFF
When $ has dissapeared type:
adb shell
Now you will see # instead off $ which means succes. Now type:
exit
2. Change version to downgrade and get superCID and Goldcard
Type:
adb push misc_version /data/local/tmp/misc_version
adb push flashgc /data/local/tmp/flashgc
adb shell chmod 777 /data/local/tmp/*
adb shell
cd /data/local/tmp
./misc_version -s 1.00.000.0
Now you get:
–set_version set. VERSION will be changed to:1.00.000.0
Patching and backing up partition 17…
Then type:
./flashgc
(!! In case of an error message like below, check if you did select charge only in settings menu !!)
Error opening backup file.
If everything worked type:
sync
You can check if everything is fine, type:
dd if=/dev/block/mmcblk0p17 bs=1 skip=160count=10
1.00.000.010+0 records in
10+0 records out
10 bytes transferred in 0.001 secs (10000 bytes/sec)
BACK-UP everything now
3. Temp root and backup
Type:
Exit
adb push su /data/local/tmp/
adb push busybox /data/local/tmp/
adb push fixsu.sh /data/local/tmp/
adb install SuperUser.apk
adb shell chmod 755 /data/local/tmp/fixsu.sh
adb shell/data/local/tmp/fixsu.sh
Backup your data with a backup program on your phone, Rom Manager, Titanium Backup of My backup root for instance.
4. Downgrade to Froyo:
You will need a Rom which you can find following link below :
(There is a rom included the platform-tools.zip from Dropbox, renamed to PC10IMG.zip ready to use, continue to 4a at once) Remember, this is a shipped EU rom, if you need another you can download and find it at same domain from link below or h.t.t..p androidruu.com
h.t.t.p shipped-roms.com/index.php?catcegory=android&model;=Vision
RUU_Vision_HTC_WWE_1.34.405.5_Radio_12.28b.60.140e_26.03.02.26_M_release_155556_signed.exe
Download this .exe and activate it as administrator wait till you the first screen, don’t do anything just leave it there.
Click on Start>Run and type %temp%. Then click OK. Look for the newest folder in the temp folder. Double-click on it. (Appdata/local files/temp from user administrator) Open the last folder made (organize!) it will have a name like {4AD69632-45A1-41DE-} Search in that directory for a rom which the update utility did create there. Copy the rom to the platform-tools folder. Close the HTC Android Rom Update Utility, you don’t need it anymore. Change the name of the rom in PC10IMG.zip. Be aware if you can see extensions or not and you didn’t create a .zip.zip file. Check it with right click on it and see properties.
4a
Now copy the PC10IMG.zip to the root of SD card. Take off the USB cable and check in phone your settings, charge only, USB and accept software 3thparty. Restart the Desire. For some reason this goes smoother as turning power off. When the screen goes dark push volume down and power button at same time till you get in the boot menu. Click power button one time and the HTC will search for a file, and start to check the PC10IMG.zip. This will take 1 or two minutes . Now you get a choice to upgrade yes or no select yes with the Volume up or down button and activate the choice with the power button. You HTC will now downgrade to Froyo Android 2.2 firmware 1.34.405.5.
5. Root and Superuser to upgrade
Every file you need is already included in the platform-tools.zip from Dropbox
Source: .h.t.t.p.w.w.w. desire.tode.cz/how-to-root-htc-desire-z-g2-vision
Connect the HTC Desire Z to the computer via USB.
Make sure USB debugging is enabled on the HTC Desire Z by checking Settings » Applications » Development » USB debugging.
On the computer, go back to command prompt an type:
adb push busybox /data/local/tmp/
adb push gfree /data/local/tmp/
adb push hboot-eng.img /data/local/tmp/
adb push psneuter /data/local/tmp/
adb push recovery-clockwork-3.0.2.4-vision.img /data/local/tmp/recovery.img
adb push root_psn /data/local/tmp/
adb push su /sdcard/
adb push Superuser.apk /sdcard/
adb shell
chmod 755 /data/local/tmp/*
/data/local/tmp/psneuter
NOTE: You will drop out of the shell after this command to platform-tools folder, type:
adb shell
cd /data/local/tmp
./gfree -f -b hboot-eng.img -y recovery.img
As it is very important that the hboot was installed correctly gfree calculates md5sums of the partition. It will calculate the following 3 checksums
md5sum #1 - checksum of partition 18 before the installation
md5sum #2 - checksum of the hboot image that should be installed
md5sum #3 - checksum of partition 18 after the installation
The messages that you what to see are either/or
md5sum #1 == md5sum #2 – the hboot image is already installed -> skipping installation
md5sum #3 == md5sum #2 – the hboot image was successfully installed -> OK!
If you get a different error message then DO NOT REBOOT. Check everything again and try again
If gfree worked correctly continue with, type:
./root_psn
sync
reboot
The HTC Desire Z is now rooted with S-OFF, the Engineering HBoot & the ClockworkMod Recovery.
6. Install a new Rom
This is a tricky part since most roms will just fail to install, at least on shipped models, the roms from Guhl99 (XDA Forums)do the job. There is an interesting part to these roms also, which I Like. You really should check his work out.
In case you prefer a Cyanogenmod version 10.1 Guhl99 made one also you can find it via XDA forums, in the platform-tools folder there is a working Cyanogenmod 10.1 cm-10.1-20140309-UNOFFICIAL-vision.zip in case you don’t like spoofing. If you do like it, check out Guhl99 his work which you should do anyway in case of HTC Desire 7.
In your platform-tools folder select AndromadusAOSP4.2-vision-pff-16062013.zip an AOS Android4.2.2 and gapps-jb-20130301-signed.zip (they are already present in the platform-tools.zip from Dropbox)
Copy them to the root of your SD card, download Rom Manager from link below and install it:
If you can’t download it because your SD is occupied release the USB cable from your phone.
h.t.t.p.w.w.w. apk4fun.com/apk/2119/
Open Rom Manager, select Recovery Setup and activate the 2th ClockworkMod option, select as option the 3x version. Go back and select now the 1th ClockworkMod option and activate it to flash, it will ask for permission which you grant. Now Clockworkmod has root acces as Superuser. Go back to main menu from Rom Manager and select Fix Permissions. Now, check if everything in your Phone settings is still correct. Charge only, USB debugging, allow unknow installs etc. Take the USB cable out of your Phone. In Rom Manager menu select Reboot to Recovery and activate it, no need to push buttons this time the HTC wil go to Rom Manager bootmenu automatic by restart after showing the HTC start screen first.
7. Rom Manager Bootmenu
Another part which need some attention to proceed. In this menu the Volume up and down button are used to scroll. The power button is used to get to out of a submenu. The Photo button, on right lower side is used to activate the selection. With this knowledge in mind it is easy to navigate and delete Factory Settings, then Cache and under advanced menu the Dalvik Cache. Return to main menu pressing the Power button and select install zip from SD. Select ROMAndromadusAOSP4.2-vision-pff-16062013.zip and activate it with Photo button. The Desire will now install AOS Android 4.2.2. When it is finished select Install a zip from SD again and this time select gapps-jb-20130301-signed.zip and install it. When ready select reboot in Rom Manager and the HTC will restart, which will take some minutes, and it will run now on Android 4.2.2. Connect the HTC to USB Cable and copy the 3 files from platform-tools/PFF folder to your SD. Use a file manager on your HTC to search and install them to play with spoofing.
Now you are ready: This rare quality phone with qwerty keyboard will be at your service for some years more.

Still works! Thanks!