Database Users

OTA 2.2 Update With Root Made Easy

NOTE: For those of you that are looking to root thier Inc and already have the latest 2.2+ OTA released in November, these steps will not work. Changes have been made to the ROM so until a new root application has been developed by the unrEVOked team, I am afraid you are left with a stock phone. Sorry. If new updates come out, I will try to post them here.
NOTE: I have uploaded the 2.1 and 2.2 RUUs to Rapidshare and updated the links.
First, let me say that I did not come up with this nor did I create any of the tools. I am passing all this on in a single thread to let people know how update thier Droid Incredible to the OTA 2.2 and have root access if they have it in any of the following conditions:
1. Stock 2.1 without root or unrEVOked Forever
2. Stock 2.1 with root and no unrEVOked Forever
3. Stock 2.1 with root and unrEVOked Forever
4. Stock 2.2 without root and with unrEVOked Forever
5. Stock 2.2 without root and no unrEVOked Forever
6. Custom ROM with root and S-OFF
7. Getting free WiFi Tethering on 2.2
8. Removing unwanted preloaded applications.
NOTE: This may work with custom ROMs, but I have not verified it.
NOTE: SOME PEOPLE, INCLUDING ME HAVE HAD THE PROBLEM OF BEING STUCK IN HBOOT AFTER LOADING A ROM IMAGE. IF THIS HAPPENS TO YOU AFTER LOADING THE 2.1 OR 2.2 ROM, DO NOT PANIC, JUST REAPPLY THE ROM AND ALL WILL BE FINE. FOR SOME REASON THE ROM DOES NOT LOAD CORRECTLY ON THE FIRST TRY BUT DOES ON THE SECOND.
I am passing this on because I loaded the OTA 2.2 without unrEVOked forever loaded on my phone. What a mess. I tried everything (I thought) to try and downgrade it back to stock 2.1 but with no luck. If you do not know, unrEVOked3 cannot currently root a 2.2 updated Droid Incredable and if you have not used unrEVOked forever, you can not get clockworkmod recovery to reload on the phone. I tried the 2.1 RUU to downgrade, but never could get it to connect to the phone. I then tried to use the 2.1 PB31IMG.zip to load and the HBoot loader would just tell me that it was an older image and not load it. I thought I was hosed until the unrEVOked team breaks the code on the 2.2 HBoot loader until I got pointed in the right direction (sort of).
TNS201 pointed me to the following thread: http://forum.xda-developers.com/showthread.php?t=768295
I gave this a try and still could not downgrade my phone. I searched around and after much trial and error, I was able to put together the correct steps to downgrade my phone and then applied unrEVOked3, unrEVOked forever, the OTA 2.2 update, and then reroot the phone. Anyway, here is what I have come up with:
** NOTE: THIS WILL TOTALY WIPE YOUR PHONE CLEAN!!! BACKUP ANYTHING YOU WANT BACK ON THE PHONE!!! **
Condition 1
1. Go to the following link and follow the instructions: http://forum.xda-developers.com/showthread.php?t=709220 Only do the steps for getting ADB loaded on your computer!
This will get ADB loaded on your computer which you will need when doing customizations to the phone. It will also walk you through rooting your phone and doing a lot of other things. Good thread for us noobs.
2. Download unrEVOked Forever from here: http://unrevoked.com/rootwiki/doku.php/public/forever
3. Copy the file to the root of your sdcard.
4. Reboot your phone into clockworkmod recovery and load the unrEVOked Forever zip file. This will turn S to off and allow unsigned images to be loaded.
When you reboot your phone, you will have a fully rooted and S-OFF stock 2.1 Droid Incredible.
NOTE: If you are having troubles downloading the OTA 2.2 RUU, use this link to download the ROM. Just delete the "_2.2" from the file name and go straight to step 12. http://rapidshare.com/files/418523008/PB31IMG_2.2.zip
To load 2.2, do the following:
5. Download the OTA 2.2 RUU from here: http://rapidshare.com/files/418527589/RUU_Incredible_VERIZON_WWE_3.21.605.1_Radio_2.15.00.07.28_2k4k_NV_1.50_PRL58006_release_1433.exe
6. Connect your phone to your computer and ensure you have USB DEBUG turned on and CHARGE ONLY selected.
7. Run the RUU and update your phone to 2.2. If the RUU updates your phone, go on to step 15. If the RUU will not connect to your phone Go to step 8.
8. Start the RUU.
9. Go to your computers temp directory and locate the folder that contains the file rom.zip.
10. Once you locate this file, copy it to any folder (or your desktop).
11. Rename rom.zip to PB31IMG.zip
12. Copy PB31IMG.zip to the root of your phones sdcard.
13. Reboot your phone into HBoot. HBoot will load and then load PB31IMG.zip. This will take a while, so be patient.
14. Follow the instructions to have HBoot install PB31IMG.zip.
Whether you used the RUU or HBoot and PB31IMG.zip, at this point, you should have 2.2 loaded on your phone, but you will no longer have root. You will have S-OFF.
To regain root access, do the following:
15. Download clockworkmod recovery from here: http://downloads.unrevoked.com/forever/recovery/clockworkmod/PB31IMG.ZIP
16. Download the payload update from here: http://forum.xda-developers.com/attachment.php?attachmentid=388592&d=1282834695
17. Download superuser from here: http://dl.dropbox.com/u/6408470/su-releases/su-2.3.4-ef-signed.zip
18. Copy all three files to the root of the phones sdcard.
19. Reboot your phone into HBoot. HBoot will load and then load PB31IMG.zip.
20. Follow the instructions to have HBoot install PB31IMG.zip. Since the phone is still S-OFF, this will reload clockworkmod recovery on the phone.
21. Boot the phone into recovery and load the two zip files downloaded in steps 16 and 17. This will root the phone and reload superuser.
If all went well, when the phone reboots, it should now be loaded with 2.2 and have full root and S-OFF. Enjoy.
Condition 2
1. Do steps 2 through 21 under Condition 1.
Condition 3
1. Do steps 5 through 21 under Condition 1.
Condition 4
** NOTE: THIS ONE DOES NOT WIPE YOUR PHONE!! **
1. Do steps 15 through 21 under Condition 1.
Condition 5
This is a tuffer one and requires the phone to be downgraded to 2.1 before upgrading it back to 2.2. Anyway, here are the steps:
NOTE: YOU MUST USE THE 2.1 RUU I HAVE LINKED AND THE MTD0.IMG FILE I HAVE ATTACHED OR THIS MAY NOT WORK!!!
NOTE: If you are having troubles downloading the 2.1 RUU, use this link to download the ROM. Just delete the "_2.1" from the file name and go straight to step 5 after completing step 1 and 2 (skip step 3 and 4). http://rapidshare.com/files/418141003/PB31IMG_2.1.zip.html
1. Do steps 1 and 2 under Condition 1.
2. Download the attached zip file. It contains the files I had a hard time finding.
3. Download the 2.1 RUU file from here: http://rapidshare.com/files/418525132/RUU_Incredible_Verizon_WWE_1.22.605.2_Radio_1.00.03.04.06_hboot_0.79_.exe
4. Follow steps 8 through 11 under condition 1 to get a good copy of the 2.1 ROM.
5. Copy the 2.1 ROM to the c:\android-sdk-windows\tools folder.
6. Unzip the files downloaded in step 2 to the c:\android-sdk-windows\tools folder.
7. Copy the unrevoked-forever.zip to the c:\android-sdk-windows\tools folder.
Note: At this point, you should have the following files copied to your c:\android-sdk-windows\tools folder:
PB31IMG.zip (this is the 2.1 ROM)
unrevoked-forever.zip (will set S-OFF)
rageagainstthecage-arm5.bin (this is a root exploit - gives you temperary root)
mtd0.img (need to research this one)
flash_image (this flashes images)
7. Connect your phone to your computer and ensure you have USB DEBUG turned on and CHARGE ONLY selected.
8. Open a command promt window and change to the c:\android-sdk-windows\tools folder.
9. Enter adb push unrevoked-forever.zip /sdcard/ and then press enter.
10. Enter adb push flash_image /data/local/ and then press enter.
11. Enter adb push rageagainstthecage-arm5.bin /data/local/tmp/ and then press enter.
12. Enter adb push mtd0.img /sdcard/ and then press enter.
13. Enter adb push PB31IMG.zip /sdcard/ and then press enter.
14. Enter adb shell and then press enter.
15. Enter cd /data/local/tmp/ and then press enter.
16. Enter chmod 777 /data/local/tmp/rageagainstthecage-arm5.bin and then press enter.
17. Enter cd /data/local/ and then press enter.
18. Enter chmod 777 /data/local/flash_image and then press enter.
19. Enter cd /data/local/tmp/ and then press enter.
20. Enter ./rageagainstthecage-arm5.bin and then press enter. You will now see some text on your cmd prompt screen explaining the exploit. Wait for the adb shell to go away, and it will dump you into your windows command prompt again (no shell) should look something like this:
C:\android-sdk-windows\tools>
21. Enter adb shell and then press enter. You will see you now have a # instead of a $ prompt.
22. Enter cd /data/local and then press enter.
23. Enter ./flash_image misc /sdcard/mtd0.img and then press enter. This will flash your misc partition with Toast's mtd-eng.img and should return you to a # prompt.
24. Enter reboot bootloader and press enter.
25. HBoot will load. Select bootloader and HBoot will then load PB31IMG.zip.
26. Follow the instructions to have HBoot install PB31IMG.zip.
Once it is finished, select restart. You now are on the stock 2.1 build of Android. Now you can follow steps 3 through 21 under condition 1 and get your phone loaded back with 2.2 and have root and S-OFF.
Condition 6
1. Do steps 5 through 21 under Condition 1.
Condition 7
The following steps will allow you to use the 3G Mobile Hotspot that comes with the OTA 2.2 update and not have Verizon charge you for using it:
1. On your phone, bring up the dialer and dial ##778. This will load EPST.
2. Select EDIT.
3. Enter 000000 for the password.
4. Select SECURITY.
5. Select the username that has [email protected].
6. Edit the username to read [email protected] (delete "dun.").
7. Click the back button to return to the list.
8. Select M.IP DEFAULT PROFILE.
9. Repeat steps 5 and 6.
10. Click on MENU and select COMMIT.
At this point, your phone will reboot and you will be able to use the 3G Mobile Hotspot application to get free WiFi tethering. Enjoy.
Condition 8
I have so far found three options for removing the preloaded apps. They all require the phone to be rooted. Here they are:
1. The first way is to get Titanium Backup. You will also need to donate (as little as $3.99) to get full functionality of Titanium Backup, but it is well worth it. If you do not want to physically remove the application, you can use the FREEZE function and the application will be removed from the app list, but physically will still be on the phone. If you really want to get it off, you can uninstall and then deleted from the phone. All of this through a user interface that is pretty easy to use. By the way, it also does backups of apps and data.
2. Another option is to get Root Explorer. You have to pay for this one. It will let you mount the system folders on the phone as read/write and allow you to move and/or delete apps from the apps folder on the phone. This is a good app and worth having even if you do not use it to remove apps.
3. The final way is to use ADB and the command prompt to remove or move any application you do not want. This is tried and true, but combersome. You do not have to buy it, but there is no GUI to help you out.
My thanks to all the folks here on XDA that made it possible for us to release the possibilities of the Droid Incredable. As I stated above, I did not create the apps or the steps, I just put them together for others to use. I wish I could thank all the individuals that made this possible, but I did not get thier IDs, so in lew of an individual thank you, I am posting this group THANK YOU. Keep up the good work!

Thanks, I have a question on condition 4
4. Stock 2.2 without root and with unrEVOked Forever
If I do the steps and since I am not loading RUU (I manually updated the offical OTA and have S-off) will this still wipe my phone clean? Looks like all I am doing is loading clockwork back on and load superuser..etc, that shouldn't wipe all the data right?

Scblacksunshine said:
Thanks, I have a question on condition 4
4. Stock 2.2 without root and with unrEVOked Forever
If I do the steps and since I am not loading RUU (I manually updated the offical OTA and have S-off) will this still wipe my phone clean? Looks like all I am doing is loading clockwork back on and load superuser..etc, that shouldn't wipe all the data right?
Click to expand...
Click to collapse
No, in the case of having 2.2 already loaded and S-OFF, you are correct, the phone will not get wiped. The steps will root the phone and load superuser back on.

confirmation
Can anyone confirm option 4 working??

RBurn said:
Can anyone confirm option 4 working??
Click to expand...
Click to collapse
Those are steps I used to get root back on my phone after I update to 2.2. As I stated, I messed up the first time and did not load unrEVOked forever and could not root the phone, so I had to downgrade to 2.1 first and then go through the rooting process. That time I made sure to load unrEVOKED forever. After that, all went well.
Sent from my HTC Incredible.

RBurn said:
Can anyone confirm option 4 working??
Click to expand...
Click to collapse
I did option 4 early this morning. Worked perfectly.
Thank-you to all involved.

Thanks for the write up =)
I am trying condition five and on step 18 and after running ./rageagainstthecage-arm5.bin it exectues so I move to step 18 and type adb shell but it remains, $ not root(#). Does anyone know if This has worked yet?

also Im running Ubuntu 10.04 if that makes a difference

adb shell
cd /data/local/tmp
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
cd /data/local
chmod 0755 /data/local/flash_image
cd /data/local/tmp
./rageagainstthecage-arm5.bin
This worked

PimpShit420 said:
adb shell
cd /data/local/tmp
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
cd /data/local
chmod 0755 /data/local/flash_image
cd /data/local/tmp
./rageagainstthecage-arm5.bin
This worked
Click to expand...
Click to collapse
I tried this and it did not work for me. It looked as if it did. It gave me the proper prompt, but on reboot, no root access. I had to use chmod 777 instead of chmod 0755.

PimpShit420 said:
Thanks for the write up =)
I am trying condition five and on step 18 and after running ./rageagainstthecage-arm5.bin it exectues so I move to step 18 and type adb shell but it remains, $ not root(#). Does anyone know if This has worked yet?
Click to expand...
Click to collapse
I made a mistake, the line should have had 777 after chmod, not 0755. I have updated the instructions. If other individuals that use 0755 instead of 777 get the above to work, let me know. I do not know what the difference is. All I know is 0755 did not work for me. I had to use 777. I think I will do some research on chmod.
Hope other individuals find this helpful.

well I got to root in the shell and everyting seemed to work up until I tried to flash the PB31IMG, is says the main version is older and just reboots

I dont know what the difference is but it could be we are running different OS, windows vs linux but I have no clue

PimpShit420 said:
well I got to root in the shell and everyting seemed to work up until I tried to flash the PB31IMG, is says the main version is older and just reboots
Click to expand...
Click to collapse
This is the problem I had. Try 777 instead of 0755 after each of the chmod commands. That is what worked for me.

you were right, the first time 0755 gave me root but did not let me flash the PB file, the second time 0755 didnt work, and 777 did but it still says update fail

chmod 0755 vs chmod 777
PimpShit420 said:
I dont know what the difference is but it could be we are running different OS, windows vs linux but I have no clue
Click to expand...
Click to collapse
Well, I looked the chmod 777 and chmod 0755 commands up. Both commands change the read/write state for a file. 0755 changes the permissions for a specific group and user. 777 changes the permissions for everyone. You can find an explanation here: http://ss64.com/bash/chmod.html
0755 did not work for me, but 777 did. I am going to keep the instructions as they are unless I get feedback that 0755 is working for other people. If I do, I will add them as an alternative.

PimpShit420 said:
you were right, the first time 0755 gave me root but did not let me flash the PB file, the second time 0755 didnt work, and 777 did but it still says update fail
Click to expand...
Click to collapse
Are you using 777 for each chmod command?
Also, I was reading through the steps and found an error with step 16. It said the following:
16. Enter chmod 777 /data/local/tmp/rageagainstthecage-arm5.bin and then press enter.
It should have said this:
16. Enter chmod 777 /data/local/rageagainstthecage-arm5.bin and then press enter.
I have updated the steps on post 1.

Thanks very much for this thread!
My phone was in Condition 3. Instructions worked for me!

BNG303 said:
Thanks very much for this thread!
My phone was in Condition 3. Instructions worked for me!
Click to expand...
Click to collapse
Your welcome. I am glad it helped.

bagery77 said:
I did option 4 early this morning. Worked perfectly.
Thank-you to all involved.
Click to expand...
Click to collapse
Glad this helped. I wanted to give everyone a one stop shop for updating and root for 2.2. Also hoped everyone would not have to go though all that I did.

[ROOT] MR1/OTA PermRoot + Unlock Bootloader - Safer/Easier 5/12/2011

OUTDATED
Augest 14 2011
Unrevoked and AlpharevX released a new version of their http://revolutionary.io/ tool, use it, and preserve your data.
Do not use the root method below.
Original root left for a good read.
Advanced users wanting a different hboot please see http://forum.xda-developers.com/showthread.php?t=1186022, others continue as is.
Updated May 12th 2011
This guide has been updated to MR1/OTA Firmware 1.13.605.7
This guide has been updated on April 21 2011 to make it more reliable, and faster.
On request I am reposting this in full, but please check out the original here first.
HTC tried to stop us. They made signed images, a signed kernel, and a signed recovery. They locked the memory. In short, the ThunderBolt is their most locked-down phone to date.
We fixed it for you. Unlike the root method we described yesterday, following the instructions below will provide S-OFF, remove signature checks, and unlock eMMC. Enjoy!
Rooting The ThunderBolt – Version 3
Pros
Root with read/write access to /system
Ability to downgrade and flash any RUU (i.e. signed firmware)
S-OFF
Fully unlocked bootloader
All ThunderBolts survived testing
Cons
Voids warranty
Could brick your phone if you aren’t careful
The method of rooting your Android device as described in the article herein is solely for enthusiasts and not for the faint of heart.
IT WILL WIPE YOUR DATA. IT WILL WIPE YOUR DATA. IT WILL WIPE YOUR DATA.
Android Police and Team AndIRC disclaim all liability for any harm that may befall your device, including, but not limited to: bricked phones, voided manufacturer warranties, exploding batteries, etc.
The instructions below assume you already have a strong familiarity with adb command lines – this is not for beginners.
Credits
Scotty2, jamezelle, jcase, and all of Team AndIRC
dsb9938 for the tutorial cleanup
Testers, especially ProTekk and Trident
Thanks to scotty2 for WPThis
Busybox was pulled from a CyanogenMod ROM, source should be available here
psneuter was pulled from somewhere, credit to scotty2, source here
All firmware credit goes to 911sniper
Jaroslav from Android Police for editorial help
If I missed anyone in the credits, it was unintentional and I will fix it soon. Lots of people had their hands in on this project.
*** Please read the instructions in full before you attempt the process or head to IRC to ask questions. Also, make sure your battery is fully charged before taking the plunge. ***
Step 1
First, download these files:
Downgrade RUU PG05IMG_downgrade.zip ( (md5sum : aae974054fc3aed275ba3596480ccd5b) THIS IS THE DOWNGRADE RUU USED IN STEP 4:
Multiupload mirror
Mirrors for the package (contains busybox, wpthis, psneuter, su, readme.txt, misc.img, and hbooteng.nb0) (md5sum : 3b359efd76aac456ba7fb0d6972de3af) THIS IS THE EXPLOITS FILE:
Multiupload mirror
DroidSite mirror
Custom upgrade PG05IMG_MR1_upgrade.zip (md5sum : 7960c7977c25b2c8759605be264843ea) THIS IS THE CUSTOM RUU USED IN STEP 7:
http://www.multiupload.com/NEANZBS5S4
Step 2
Note that adb is required.
Push misc.img, busybox, and psnueter using the following commands:
Code:
adb push psneuter /data/local/
adb push busybox /data/local/
adb push misc.img /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox
Step 3
This step will gain temp root and flash the custom misc.img. Run:
Code:
adb shell
Now the shell should display "$".
Run:
Code:
/data/local/psneuter
You will now be kicked out of adb, and adb will restart as root.
Let’s confirm the md5 of misc.img:
Code:
adb shell
At this point, the shell should display "#".
Now run:
Code:
/data/local/busybox md5sum /data/local/misc.img
Output should be "c88dd947eb3b36eec90503a3525ae0de." If it’s anything else, re-download the file and try again.
Now let’s write misc.img:
Code:
dd if=/data/local/misc.img of=/dev/block/mmcblk0p17
exit
Step 4
Here you will rename the downgrade RUU (PG05IMG_downgrade.zip) as PG05IMG.zip and place it on your SD card (put the phone in drive mode and just copy it with your OS). Then, run the following command:
Code:
adb reboot bootloader
Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.
Step 5
Set up the two part exploit, to gain root and unlock MMC.
Push wpthis, busybox, and psnueter:
Code:
adb push psneuter /data/local/
adb push busybox /data/local/
adb push wpthis /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox
adb shell chmod 777 /data/local/wpthis
Gain root (this will once again throw you out of adb):
Code:
adb shell
/data/local/psneuter
Unlock MMC:
Code:
adb shell
/data/local/wpthis
exit
Step 6
Please pay attention – this is very important. This step involves a small chance of bricking if you mess up.
To push the eng bootloader:
Code:
adb push hbooteng.nb0 /data/local/
adb shell
/data/local/busybox md5sum /data/local/hbooteng.nb0
If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb" exactly, stop, delete it, and re-download it. Otherwise, continue.
Now we will write the new bootloader.
Code:
dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18
Confirm proper write:
Code:
/data/local/busybox md5sum /dev/block/mmcblk0p18
If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb," try again; if it still doesn’t work, seek help from chat.andirc.net in channel #root or go here AndIRC Thunderbolt Web Chat DO NOT REBOOT.
Reboot.
Step 7
Now, put the custom MR1 RUU (PG05IMG_MR1_upgrade.zip) on your SD card by putting the phone in drive mode and copying it with your OS. Then rename it to PG05IMG.zip
Then using an md5sum type program, check the md5sum and make sure it matches 7960c7977c25b2c8759605be264843ea, if it does not, redownload it. (Here is a free windows md5summer).
Next, run this command:
Code:
adb reboot bootloader
Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.
After it flashes, you will be running release firmware with S-OFF.
Reboot your phone. You should now have full root permissions, an engineering kernel and recovery.
I recommend you get rom manger from market.
If you still have problems, come to the chat: irc.andirc.net #thunderbolt or use http://chat.andirc.net:9090/?channels=#thunderbolt.
.

Good luck to you guys and thank you for the work you're putting into this. Definitely going to do a lot of projects once I get the TB and we get confirmed permanent root.

Cool, can't wait to hear about it!

Its against the nature of my being to have an unrooted Android phone for more than 72 hours. Good luck guys!

HAHAAAaaaaa
rulevoid said:
Its against the nature of my being to have an unrooted Android phone for more than 72 hours. Good luck guys!
Click to expand...
Click to collapse
Same here brother....

waiting for my instructions so i can root this

Waiting on this!

Ah...the cutting edge. Can't wait to see the development for this phone.

<- is very excited, I made it first in line for vzw opening at my store.

destroyerbmx said:
<- is very excited, I made it first in line for vzw opening at my store.
Click to expand...
Click to collapse
Me too! Now bring on the root! I need to restore data to some of my apps from my incredible.

Gimme Gimme
So pumped. TB is great, but like you guys, after five minutes, now on to rooting. Can't wait, and thanks for all the hard work on this. TB is going to be monster.

ahahaha
/10char

Awe yea!!!!!! Can't wait.

Got VZW to give me an early-up early-up! TB arriving in 12 hrs! Rooting in 12.5...

just copped my thunderbolt today so be on the lookout for the HOTNESS

XxXViRuSXxX said:
just copped my thunderbolt today so be on the lookout for the HOTNESS
Click to expand...
Click to collapse
Sweet, mine should be in hand tomorrow. Lookin' forward to it.

Picked up mine this am at local verizon looks sweet..., bring on the rooting

Ok guys I just picked up TB and itching to root and run cm7 ,It's not as fast as inc on gbread.
Sent from my ADR6400L using XDA App

I came from the fascinate and it feels a lot better to me. I don't use my phone for games but browsing feels like the xoom to me, minus the chrome browser. Hope we can port it.

santod040 said:
Sweet, mine should be in hand tomorrow. Lookin' forward to it.
Click to expand...
Click to collapse
WOW whats up man haven't talked to you in a WHILE man add me on gtalk [email protected]

[Root+ROM+RUU] This will root your TB and install BAMF 1.5nte and the leaked RUU.

All root credit still goes to AndIRC and crew. ​
Rooting The ThunderBolt – Updating The Radio – And Installing BAMF 1.5
From Adrynalyne: This totally awesome wtfomgroflbbq ungodly large PG05IMG.zip contains the latest of everything 1.13.605.7 has to offer plus engineering hboot for s-off, BAMF 1.5, BAMF 4.4.2 kernel, clockwork, and custom boot splash by gadget!
Pros
Root with read/write access to /system
Ability to downgrade and flash any RUU (i.e. signed firmware)
S-OFF
Fully unlocked bootloader
Latest RUU installed
BAMF 1.5nte installed
Cons
Voids warranty
Could brick your phone if you aren’t careful
Its an RUU, IT CAN BREAK YOSELF.....FOO!!!
Its an RUU, IT CAN BREAK YOSELF.....FOO!!!
Its an RUU, IT CAN BREAK YOSELF.....FOO!!!
The method of rooting your Android device as described in the article herein is solely for enthusiasts and not for the faint of heart.
IT WILL WIPE YOUR DATA. IT WILL WIPE YOUR DATA. IT WILL WIPE YOUR DATA.
Android Police and Team AndIRC and Adrynalyne disclaim all liability for any harm that may befall your device, including, but not limited to: bricked phones, voided manufacturer warranties, exploding batteries, etc.
The instructions below assume you already have a strong familiarity with adb command lines – this is not for beginners.
Credits
Adrynalyne for the Custom RUU, BAMF, and Kernel
Scotty2, jamezelle, jcase, and all of Team AndIRC
dsb9938 for writing this, testing, boot ani, and just being an overall great guy
Testers, especially ProTekk and Trident
Gadget for boot splash and ani
Thanks to scotty2 for WPThis
Busybox was pulled from a CyanogenMod ROM, source should be available here
psneuter was pulled from somewhere, credit to scotty2, source here
All firmware credit goes to 911sniper
If I missed anyone in the credits, it was unintentional and I will fix it soon. Lots of people had their hands in on this project.
Please read the instructions in full before you start. Also, make sure your battery is fully charged before taking the plunge.
Step 1
First, download these files:
RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.01 03_2r_NV_8k_1.37_9k_1.52_release_165253 (md5sum : aae974054fc3aed275ba3596480ccd5b) THIS IS THE DOWNGRADE RUU USED IN STEP 4:
Multiupload mirror
GalaxySense mirror
DroidSite mirror
Mirrors for the package (contains busybox, wpthis, psneuter, su, readme.txt, misc.img, and hbooteng.nb0) (md5sum : 3b359efd76aac456ba7fb0d6972de3af) THIS IS THE EXPLOITS FILE:
Multiupload mirror
GalaxySense mirror
DroidSite mirror
BAMF/Leaked RUU mirrors (md5sum : ede0dc842ab676080befe2ae01c74cd3) THIS IS THE CUSTOM RUU USED IN STEP 7:
Single Source
Step 2
Note that adb is required.
Push misc.img, busybox, and psnueter using the following commands:
Code:
adb push psneuter /data/local/
adb push busybox /data/local/
adb push misc.img /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox
Step 3
This step will gain temp root and flash the custom misc.img. Run:
Code:
adb shell
Now the shell should display "$".
Run:
Code:
/data/local/psneuter
You will now be kicked out of adb, and adb will restart as root.
Let’s confirm the md5 of misc.img:
Code:
adb shell
At this point, the shell should display "#".
Now run:
Code:
/data/local/busybox md5sum /data/local/misc.img
Output should be "c88dd947eb3b36eec90503a3525ae0de." If it’s anything else, re-download the file and try again.
Now let’s write misc.img:
Code:
dd if=/data/local/misc.img of=/dev/block/mmcblk0p17
exit
Step 4
Here you will rename the downgrade RUU (RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.01 03_2r_NV_8k_1.37_9k_1.52_release_165253) as PG05IMG.zip and place it on your SD card (put the phone in drive mode and just copy it with your OS). Then, run the following command:
Code:
adb reboot bootloader
Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.
Step 5
Set up the two part exploit, to gain root and unlock MMC.
Push wpthis, busybox, and psnueter:
Code:
adb push psneuter /data/local/
adb push busybox /data/local/
adb push wpthis /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox
adb shell chmod 777 /data/local/wpthis
Gain root (this will once again throw you out of adb):
Code:
adb shell
/data/local/psneuter
Unlock MMC:
Code:
adb shell
/data/local/wpthis
exit
Step 6
Please pay attention – this is very important. This step involves a small chance of bricking if you mess up.
To push the eng bootloader:
Code:
adb push hbooteng.nb0 /data/local/
adb shell
/data/local/busybox md5sum /data/local/hbooteng.nb0
If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb" exactly, stop, delete it, and re-download it. Otherwise, continue.
Now we will write the new bootloader.
Code:
dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18
Confirm proper write:
Code:
/data/local/busybox md5sum /dev/block/mmcblk0p18
If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb," try again; if it still doesn’t work, seek help from http://chat.andirc.net:9090/?channels=#root. DO NOT REBOOT.
Reboot.
Step 7
Now, put the custom leaked RUU (Adrynalyne.1.5.PG05IMG.zip) on your SD card by putting the phone in drive mode and copying it with your OS. Now rename it to PG05IMG.zip.
Then using an md5sum type program, check the md5sum and make sure it matches ede0dc842ab676080befe2ae01c74cd3, if it does not, redownload it. (Here is a free windows md5summer).
Next, run this command:
Code:
adb reboot bootloader
Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.
After it flashes, you will be running BAMF 1.5nte with S-OFF on the latest leaked RUU.
Please Note: One of the TP images will be bypassed while flashing, this is normal. Also, on first boot, there will be no boot sound, this is normal.
Please make a nand backup in Rom Manager after you go thorugh phone set up.
Rom Manager, SuperUser, and Titanium Backup are already installed.
ClockWork Recovery 3.0.2.5 is already installed.
If you have problems, come to the chat: irc.andirc.net #root or use http://chat.andirc.net:9090/?channels=#root.
.

"omg, no one-click method!?"
jk, this will be a nice time-saver for those just getting their Thunderbolts. Great job compiling this all into one package!

Sweet!

Nice job! Gotta love how the Android community is always trying to help the non-tech savvy be awesome too.
Sent from a bit of awesomeness...

Great job this will come in handy if I decide to root the wifes phone. Mine has been rooted for a while now.

this isnt working so well for me... flashing the last part and boot failed and its stuck on mdm9k

lllboredlll said:
this isnt working so well for me... flashing the last part and boot failed and its stuck on mdm9k
Click to expand...
Click to collapse
Please post back and let us know how things work out after you get the new phone. Sorry you had to have what I think is a bad nand chip that wouldn't take a flash.
D

dsb9938 said:
Please post back and let us know how things work out after you get the new phone. Sorry you had to have what I think is a bad nand chip that wouldn't take a flash.
D
Click to expand...
Click to collapse
well just for the record ... i hold no one accountable but myself or vzw on this one.... what a weird experience.... all the flashing and modding i've done over the last 5 years or so and I kill this phone right out of the gate... it literally made it 2hrs 45 minutes before i had a funeral for it lol

lllboredlll said:
well just for the record ... i hold no one accountable but myself or vzw on this one.... what a weird experience.... all the flashing and modding i've done over the last 5 years or so and I kill this phone right out of the gate... it literally made it 2hrs 45 minutes before i had a funeral for it lol
Click to expand...
Click to collapse
Thanks. I think we did all we could. Happy to help with the new one.
Sent from my ThunderBAMF using the XDA app.

Thank you for this.. Made ROOTING my wife's phone a breeze!

[GUIDE] Desire Z/G2 Rooting and Flashing Firmware for Noobs

Hey guys, i rooted my Desire Z with these Tutorials out there and i recognized not everything is that clear and easy to understand if you are a noob like me with this stuff. First i want to say that im from austria and so please ignore when my english is not that good.
Now just start here. When you are done with that all you can have any rom running on youre phone, but i recommend the ones designed for the desire z.
>>> Click here to read the full tutorial on my website with fast download links. ;D
!!! BEFORE YOU START YOU MUST CREATE A BACKUP OF ALL YOR DATA YOU HAVE ON YOUR PHONE !!!
Don't worry, youre friut ninja scores are still on feint.
1. First you will have to install ADB. If you have it skip that part.
Just head over here: http://developer.android.com/sdk/index.html
Download the .zip archive and extract "android-sdk-windows" to C:\
Now run SDK Manager.exe and let it install everything. This could take looooong hours...
2. Now you have to check the infocid of your Desire Z. Make sure the developement mode is turned on (USB-Debugging).
Open up a cmd window on your PC (Windows Key + R and type "cmd") and type:
Code:
cd C:\android-sdk-windows\platform-tools
adb reboot bootloader
fastboot oem boot
If your INFOCID doesnt match the following you'll need a goldcard to continue (Get it here: http://forum.xda-developers.com/showthread.php?t=832503 ).
Code:
HTC__001
HTC__032
HTC__E11
HTC__203
HTC__Y13
HTC__102
HTC__405
HTC__304
HTC__A07
HTC__N34
HTC__J15
3. So now you have to download 3 Files:
>>> http://wede.devftw.com/downloads/psneuter
>>> http://www.multiupload.com/A9PNGVBWBE
>>> http://www.multiupload.com/9L618DJVR6
Broken link? Click here: W3D3 @ devFTW
IMPORTANT! When you save psneuter remove the txt file extention, it should hav none!
4. Extract the file misc_version from misc_version_01.zip (just downloaded in step 3). Just ignore the rest. Put that file to C:\android-sdk-windows\platform-tools.
5. Get the PC10IMG.zip from here: http://www.multiupload.com/GH26HXLLES
6. Now you open the cmd again and type following commands: (type cd C:\android-sdk-windows\platform-tools first if youve closed the window)
Code:
adb push psneuter /data/local/tmp
adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/psneuter
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/psneuter
adb shell
7. Congrats if you now see a #! You now have root access.
If you see a $ something went wrong here. Just go back to step 1 and check youve done everything right.
8. Beside the # type:
Code:
/data/local/tmp/misc_version -s 1.33.405.5
exit
9. Now copy the 1.34.405.5_PC10IMG.zip to youre phone's SD card (Download in step 5) and rename it PC10IMG.zip
10. Now boot youre phone's bootloader with following commands:
Code:
adb reboot bootloader
Or you can just switch youre phone off. Switch it on again while you press the power button and the trackpad together.
You now see the bootloader screen with the 3 android skaters on the bottom.
11. Select BOOTLOADER.
Wait a few seconds.
Then the Bootloader will load our PC10IMG.zip
When asked for update press VOL UP to confirm.
Now wait and restart your phone when prompted.
12. When you check your version at your phone now it should say "1.34". Youre desire z is now downgroaded.
13. Enable USB-Debugging again.
14. Extract the contents in root.zip to the platform-tools folder.
15. Now type that in cmd:
Code:
adb install AndroidTerm.apk
adb push busybox /data/local/tmp/
adb push gfree /data/local/tmp/
adb push rage /data/local/tmp
adb push root /data/local/tmp/
adb shell chmod 0755 /data/local/tmp/*
adb push su /sdcard/
adb push Superuser.apk /sdcard/
16. Start the new app "Terminal Emulator" on your phone and type:
Code:
/data/local/tmp/rage
After a while you'll see the message: "Forked [number] childs"
Press MENU > reset terminal
The terminal will close.
Start it again. It will force close.
Start it again. You should see the # sign again.
Beside it write following:
Code:
/data/local/tmp/gfree -f
After that type:
Code:
/data/local/tmp/root
sync
This will root your phone. When you get that message "mkdir: /system/xbin already exists", don't worry everything is ok.
After that restart your phone.
17. Install ROM Manager from market. Install The ClockworkMod Recovery.
After that you should go to "restart to recovery-system"(or similar) and from there you chose Backup/Restore and create a backup from your current rom.
(Note that you chose with the trackpad in Clockwork and not with the power button like in the bootloader)
When that's done you can come back to that status everytime you want.
(How to Restore when something isnt working:
- Start the device with trackpad holded.
- Chose Fastboot in Bootmanager. (if he asks for update again you forgot to remove the PC10IMG.zip from your SD)
- Chose Recovery
- ClockworkMod Recovery will show up
- Go to Backup/Restore and chose your Backup to restore
- Done. )
18. In RomManager chose Download ROM or install from SD card when you've found a ROM you like.
19. When it's done loading and there is a small window with 3 points make sure the 3rd AND the 2nd is chosen! if you forget to chose the 2nd point youre phone will make bootloops!
ENJOY your rooted DESIRE Z!
(Credits go to g4rb4g3 for the great solution of downgroading)
Please hit Thanks if you liked the Tut.

i recommend visionary/gfree no adb but to each his own
pimped out g2

The visionary-gfree no-adb method is awesome.. used it myself. But doesn't really apply to the Desire-Z, which is what the OP has.

killswitch11 said:
The visionary-gfree no-adb method is awesome.. used it myself. But doesn't really apply to the Desire-Z, which is what the OP has.
Click to expand...
Click to collapse
Yes it does, i have one, and it worked perfect for me

oh snap!! my bad..all i saw was g2 root...score 1 for killswitch
pimped out g2

I heard that there is a high brick risk using visonary?
Sent from my HTC Vision using XDA Premium App

only for permroot
pimped out g2

I permrooted my desire z with the tutorial above and everything is working fine - i tried visionary before but didn't worked for me.
Sent from my HTC Vision using XDA Premium App

Thanks, rooted my bell desire z with this guide.

pretty exhausting explanation. A big thank you....

How different is this from the guide in the wiki?

slapshot30 said:
How different is this from the guide in the wiki?
Click to expand...
Click to collapse
Hi!
It's similar to the wiki method but uses older versions of the tools and some tools and procedures are redundant (i.e. using psneuter for temp-root to downgrade but rage for temp-root during the gfree procedure).
If you know how to use adb, follow the wiki, if not follow the visionary temp-root plus gfree guide that is somewhere around here.
Have fun - Guhl

backarelli said:
pretty exhausting explanation. A big thank you....
Click to expand...
Click to collapse
Infact, it is a concise tutorial
You dont need to open many links just to know how to root.. unlike the time before this thread exist
Thanks to the OP

Glad you all like it
Sent from my HTC Vision using XDA Premium App

Hi,
I got a question before I jump off the bridge and root/flash/stress.
My phone is still on the branded bellmobility firmware, but it is unlocked. Since I only want to get rid of bell stuff and install an official HTC WWE ROM, do I have to follow your guide and root the phone to flash it ? Or can I follow only the flash part and flash an official ROM without rooting ?
Thx

I was able to root my girlfriend's G2 that was still on 2.2 by using this method:
http://archive.rootzwiki.com/index.php/Smartphones/HTC-Corporation/HTC-Desire-Z/G2.html
My coworker recently got a replacement G2 and it shipped back to her with 2.3 on it. We're just wondering if we're able to use the same perm root process that we used for my girlfriend's G2 (2.2)

If u dont want to permroot but u want roms I suggest u at least temp root using visionary, z4root, or one of the othrr one click methodz. If u browse the forums people have gottin into trouble not bein rooted. Then if u dont like it u can reboot and itll go back

ElNiNi0 said:
Hi,
I got a question before I jump off the bridge and root/flash/stress.
My phone is still on the branded bellmobility firmware, but it is unlocked. Since I only want to get rid of bell stuff and install an official HTC WWE ROM, do I have to follow your guide and root the phone to flash it ? Or can I follow only the flash part and flash an official ROM without rooting ?
Thx
Click to expand...
Click to collapse
You can also use temproot which means that you can use all the root functions (flashing included) till you reboot.
I thought of that method before but when you wanna play around with the different roms to find out which is the best permroot would be great. (Look @ the guide)
I dont know much about temproot so just head over to another thread in xda to find out more about that method.
Its your choise.
Sent from my HTC Vision using XDA Premium App

letsgophillyingeneral said:
...
My coworker recently got a replacement G2 and it shipped back to her with 2.3 on it. We're just wondering if we're able to use the same perm root process that we used for my girlfriend's G2 (2.2)
Click to expand...
Click to collapse
Hi!
No, the 2.3.3 version that T-Mobile/HTC are shipping as replacement (by accident) are not rootable at all (at the moment).
There is currently no published temp-root method for this release and therefor it can also not be S-OFFed or perm-rooted.
Have fun - Guhl
Sent from my HTC Vision using XDA App

I have been thinking about rooting my desire z for a while now, just made a backup.
got the android sdk, and adb working, but i cant get the infocid, "fastboot oem boot" doesn't work? why? what to do?
well just skipped the part, worked just fine whit out goldcard. i'm rooted now

1st time attempt to root, stuck at visionary+

Hi all,
I appreciate this forum is cram packed with info, but for me as a newb...I can't see the woods for the trees :-(
I have a stock Orange D-HD ( A2.3.3 with sense 2.1 ) and basically just want to unlock it to use an O2 sim.
I have previously flashed WM6 cooked roms onto Kaisers / Hermes & Himyies so do understand the basic principle. And I grasp the basic point about rooting as I have flashed a Superpad device too.
http://forum.xda-developers.com/showthread.php?t=964996
So I started to follow the above tutorial thread and downloaded Visionary+ and S-OFF etc.
But even though I set USB root debugging, when I run Visionary+ to temp-root, my DHD just runs the triange message a few seconds and then just goes blank.
Is there an alternative way to root instead of visionary+ ???
Someone pls help me get past the first hurdle and root my device
Thanks

I got stuck too but...
Did u try ticking the 'root on startup or reboot' option? then restart. it may take a few goes, u'll probably notice Superuser has been installed then Temproot should happen next reboot. Permroot's the same, may take a few times to stick. To test if ur root has worked try installing Titanium Backup from market, u'll need it once ur rooted.

If you have a Stock HTC with Android 2.3.3 you need to downgrade the software version first before you can use visionary.
[GUIDE] How to downgrade 1.7x/1.8x/2.x to 1.32.405.6

ahh ok, will do.
None of this was mentioned in the guide link I mentioned in the original post. It would be worthwhile for that guide to be modded to reflect the fact a downgrade is needed.
"Open up a cmd and go to Downgrade folder"...is this done on the PC or the phone??? don't understand...

hey, have you created a goldcard mentioned in section 1 of the tutorial?

ermm,, nope
I wasn't sure I needed to as it seemed to be related to branded phones. Mine is locked to orange at present....but it doesn't have an orange splash screen or any orange logo on the phone casing. Thought if my 'build' number had '405' in the middle...that this meant I didn't need a goldcard creating...
wrong or right peeps??

ebod said:
None of this was mentioned in the guide link I mentioned in the original post.
Click to expand...
Click to collapse
Ehem......
wid0w said:
If your Desire HD is running stock firmware 1.7x, please check this guide in order to downgrade:
http://forum.xda-developers.com/showthread.php?t=905003
Click to expand...
Click to collapse
and
wid0w said:
Basic Setup
...
- Desire HD with lower than 1.7x stock ROM
...
Click to expand...
Click to collapse
I think the guide captures every detail.

for3st said:
Ehem......
and
I think the guide captures every detail.
Click to expand...
Click to collapse
All very well if you understand what a rom is. My software page is full of 2.50 , 2.6 type numbers and nothing below 1.7....hence my comment.
Also, I've made a goldcard out of a spare 1gb sd, and copied PD98img.zip to it. So for the next bit....do I now put that goldcard in my HTC and connect to the PC whilst set in USB debugging enabled mode.
Then do I put this lot below into the win-xp pc 'run' box line by line or one whole lump?:-
adb push misc_version /data/local/tmp
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF

ebod said:
All very well if you understand what a rom is. My software page is full of 2.50 , 2.6 type numbers and nothing below 1.7....hence my comment.
Also, I've made a goldcard out of a spare 1gb sd, and copied PD98img.zip to it. So for the next bit....do I now put that goldcard in my HTC and connect to the PC whilst set in USB debugging enabled mode.
Then do I put this lot below into the win-xp pc 'run' box line by line or one whole lump?:-
adb push misc_version /data/local/tmp
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
Click to expand...
Click to collapse
one by one......

I dont use Visionary+ , it just dont work in my phone,end me up using manual method. Plus S-off and Engineering S-off.
First of all, DOWNGRADE UR PHONE TO 1.32
Gaining Radio S-OFF:
This method will get you the Radio S-OFF flag while SIM-unlocking it and setting up SuperCID, which means
1. This method will root your phone for the process if it isn’t already rooted. If you just want to permanently root your phone
2. Make sure you have ADB installed on your computer. Also, if you have previously installed VISIONary on your phone in order to root it, uninstall it first before proceeding.
3. Download Desire HD S-OFF Toolkit and unzip its contents to your computer. Put it in your adb folder
4. Enable USB Debugging on your phone from Settings > Applications > Development.
5. Connect your phone to your computer via USB.
6. Launch a Command Prompt/Terminal window on your computer, navigate to the folder where you extracted the files in Step 3 and enter the following commandsne by one , press enter after each line
adb push su /sdcard/su
adb push Superuser.apk /sdcard/Superuser.apk
adb push rage /data/local/tmp/rage
adb push busybox /data/local/tmp/busybox
adb push root /data/local/tmp/root
adb push gfree /data/local
adb shell chmod 0755 /data/local/tmp/*
adb shell chmod 777 /data/local/gfree
7. Install Terminal Emulator app on your phone from the Android Market and launch it.
8. Enter the following command in Terminal Emulator on your phone:
/data/local/tmp/rage
9. In a while, you will see the output “Forked #### childs”. Now press ‘Menu’ and tap ‘Reset Term’ to exit Terminal Emulator.
10. Launch Terminal Emulator again. You will notice that it force-closes. Don’t worry and just launch it again, and you should have a root shell indicated by the # prompt instead of $.
11. Now enter the following commands in Terminal Emulator:
/data/local/gfree -f
sync
/data/local/tmp/root
sync
If you get a ‘mkdir: /system/xbin already exists’ error during the process, ignore it and proceed.
12. Wait patiently while the process finishes. Once it is complete, reboot your phone.
You should now have Radio S-OFF, SIM-unlock and SuperCID all set on your phone. If you just want to install ClockworkMod recovery and custom ROMs etc., you are all good to go and do not need to gain Engineering S-OFF. You may simply install ClockworkMod Recovery, find a custom ROM of your choice and flash it to your phone from recovery.
Gaining Engineering S-OFF:
You should attempt to gain Engineering S-OFF if and only if you want to gain absolute access to your Desire HD including the ability to flash a radio or edit all your phone’s partitions the way you want. If you are not absolutely sure what you are about to do, we recommend that you do NOT proceed.
1. Make sure you have already gained radio S-OFF by following the above-mentioned steps.
2. Download the Engineering HBoot for HTC Desire HD and extract the contents of the zip files.put in adb folder
3. Enable USB debugging (if not already enabled) and connect your phone to the computer.
4. On your computer, launch Command Prompt/Terminal, navigate to the folder where you extracted the files in Step 2 and enter these commands:
adb push hboot-eng.img /data/local
5. Finally, launch Terminal Emulator on your phone and enter these commands, being EXTREMELY careful not to make any mistake here:
su
dd if=/data/local/hboot-eng.img of=/dev/block/mmcblk0p18
Make sure to allow when Super User access is requested. Wait till the process is finished and you’re done!
You now have the Engineering S-OFF HBoot installed and with this, you have absolute control over your HTC Desire HD. You can now flash radios of your choice to your phone and have access to modify all its partitions as well as unbrick it in certain circumstances where no other method would revive your device.
Click to expand...
Click to collapse

rohithksaj said:
one by one......
Click to expand...
Click to collapse
...but I get lost here : "•Open up a cmd and go to Downgrade folder, execute commands:"i.e. I don't understand a 'cmd' is an where I open it from..
EDIT : okay finally at 1.32 & rooted ( yey!)
wanting to check whether the S-OFF info is right but having a mare trying to get bootloader screen to stop from tripping to HBOOT and running the PD98IMG ( even though I took out the goldcard ).
Is there some specific combination to hold vol-down and power for a set number of seconds? I've tried 10+ times and can't stop it going onto the HBOOT update thingy :-(

Ok folks...back to my painful rooting excercise
I'm still in this thread
http://forum.xda-developers.com/showthread.php?t=964996
..trying to eastablish whether or not my S-OFF info is correct before proceeding further. The thread says :-
"Testing Eng S-off and Radio S-OFF
1. Power Down Your Device
2. Go to Bootloader
3. If it says Ace PVT ENG S-OFF your phone is ENG S-OFF.
4. use Volume down to get to system info and tap power button to select
5. check CID for CID-11111111 (if you have this all is done 100%)
6. Reboot
"
how can I check my "CID-11111111" info ? where is it displayed?

DOH STUPID STUPID STUPID!!!!!
Before I made my goldcard I put a copy of pd98img.zip on my SD card....and although I took out the goldcard...when I put the normal SD back in, I neglected to recall it had a copy of pd98img.zip still sat on it.
Thats why I couldn't access bootloader.
Anyways, I have the right S-OFF info so its now onwards the next step