[Q] how can re-root the offical update? - G2 and Desire Z General

hi.. after following the instructions on how to downgrade my phone, and obtain root, i have, and after i had my foryo rooted, i downloaded RUU_Vision_Gingerbread_S_HTC_WWE_2.42.405.2 because my original intent was to have a rooted gingerbread and it didn't make much sense to have roms provided by htc itself.
but now i see i don't have root, so oops, i guess i was wrong.
so do i have to go though the whole kaka procedure again, and then find a custom rom, because my end game, is to have as close as possible a rooted gingerbread as close as possible to the original HTC rom. where can i get one?
oh, and what's the difference between the asia and wwe? does any of them handle hebrew bidi writing correctly (without applying the patch?)

I think there is a way to root gingerbread, or you have to downgrade. At either rate, you want to get to a place where you can flash your own ROM. Having clockworkmod installed would be just fine.
Then you would take the stock gingerbread, extract and unzip it, add Superuser and su, make the boot insecure, repack it for flashing, flash via CWM, and presto- rooted stock gingerbread. If you want to build in hebrew bidi writing, you can add that too.
There might be a few rooted stock gingerbread roms out there, but it seems that the trend is toward cooked up versions, rather than stock.

AFAIK i don't there's a way to root gingerbreak, it's un-rootable, that's why i downgraded in the first place. i think i can do it again, question is:
where do i find the stock gingerbread rom? is it in the RUU exe? if so, how get it out from there, without installing it
second, how on earth would i do all the things you said (add su,make boot insecure,repack,flash cwm).
is there a guide out there for all there above?

I think there is a some software for windows that will allow you to extract the rom from the RUU. I don't use windows, so I don't know anything about it. I've seen some posts about it, so I can say it seems to involve using the RUU to almost install the ROM, but at the last minute, just stop and the ROM will be extracted into one of the temp directories. You just use the RUU to extract the rom, not install it.
As far as all those other steps, I think all the information is scattered about xda.
Here's some information about the insecure boot image. It's for the transformer, but it's essentially the same thing, except for the blob parts. You'll have to use something like splitbootimg or bootunpack, and mkbootimg (search for them) instead of blobunpack.
http://forum.xda-developers.com/showthread.php?t=1193737
This might be more helpful:
http://forum.xda-developers.com/showthread.php?t=1100189
As for the other parts, you can use some of the other updates and zip files as a guide to figure out how to unpack, mod them, and repack them. I think there might be a rom kitchen script that will do this too, but I can't speak to that either.
Sorry if this sounds so complex- it's not that bad once you've done it once. I have a rooted stock GB that I made this way from the GB update, but it's the US version. Let me know when you have the WWE version extracted.

ok, let's take it one step at a time, (maybe we'll make a guide out of it
i activated the but i never continued instead i used process explorer to find out which files it's holds, so i got the temp directory and extracted rom.zip a 260 mg file (containing various img files)
now what?
btw is this relavent? http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images
yea, i've seen it is, but one issue is that where do i get the cpio and makebootfs, (if i need to compile stuff, this is where i stop, i allready downloaded the perl scripts, as well as GZIP

ok, so far so good.
That link is exactly what you need. You can use that info to unpack the boot.img and make it insecure "ro.secure=0" by editing the default.prop file in the ramdisk.
I think some of the links to the tools might not work, but these will work instead - https://github.com/AndroidRoot/BootTools
Use the guides to mod and then repack the ramdisk
put the kernel and the modded ramdisk back together with makebootimg. There might be some specific command lines and kernel addresses- the hdrboot tool will show you want they should be from the original boot.img
Also, could you upload the zip file or PM me a link? This would be a perfect project for a guide.

ok wait, which tools am i missing? i have a windows machine (ultimate 7 64 bit) and the boottools needs to be compiled, (i don't have developer studio installed just eclipse)
so far i have the following tools:
repack-bootimg.pl
unpack-bootimg.pl
split-bootimg.pl
cpio for windows
gzip
what zip file?
(i'm going to sleep now as i'm in israel,i will "boot" in 6 hrs, luckily i have a vacation tommorow, so i hope we'll have time to finish this.

I think you might need gunzip to extract the ramdisk. unzip might work, but I'm not sure with Windows.
The zip is the rom.zip which has the rom.

I seem to recall there being at least 2 rooted stock ROMs in the dev forum. I think the one I've used was posted by either suilmagic (may be siulmagic), or rmk40. Xboarder56 posted one some time ago, but he started stripping things out that I used, like QuickOffice. If nothing else, this finally drove me to use Titanium backup...
Sent from my HTC Vision using Tapatalk

Yeah, I guess a search would take some of the fun out of it....
http://forum.xda-developers.com/showthread.php?t=1169004

actually i DID google "rooted stock rom desire z"
but i could find anything for sure, that's why i posted this, is this rom appear in the developer list of roms linked in the downgrade wiki? because i couldn't find it there either, would be nice if it was added.

No worries- I didn't actually search for it- I just paged through some of the dev sections.
I think you'll have flash it using CWM recovery.

great, i'm assuming CWM is Clockwork something?

Yup- look for the 3.x version. There was a 5.x, but i think it has some issues.

ok, so now, i must re-downgrade, root,
http://forum.xda-developers.com/wiki/ClockworkMod_Recovery
get rom manager, and ah... wait, what's the update.zip? is that actual image i need to place on the sdcard?

That wiki seems kinda old- I don't think the stock recovery will flash the update.zip
This is more up to date and specific for the G2/DZ:
http://forum.xda-developers.com/wiki/HTC_Vision#Rooting_the_Vision_.28G2.2FDZ.29_and_DHD

yea i've read that one (that's how i rooted in the first place.
isn't there a way to short ciruit this somehow and instead of pc10img have the update itself installed ? or is it because it's a an OTA, i have to do the whole thing?
looking at the image, i think i'm missing someting it looks like i can somehow use the scripts inside the image when i get temp_root (meaning i won't have to update the original image. am i wrong?

ok i've gone through the motions over and over, finally rooted it, have rom manager, clicked flash recovery, copied the zip file for rom i wanted to the root of sdcard, selected it rom manager, rebooted, now i selected apply update from sdcard,
now i see the hat signal and nothing happens, (i also selected backup rom and wipe cache and data)
i also noticed that i have install zip from sdcard, but i didnt' select it, how long should it take?
ok i FINALLY managed to install (it actually i pressed power button again and immdietly returned the cwm main menu, from then on, i chose reboot, i think it's moved on.
problem is, some things looked odd, for example the phone bar on the buttom, looks distorted, when i click on the application list i can only see half the list (meaning half the screen shows the list although i can scroll up and down the buttom half remains blank..
never mind it's ok now after re-boot..
btw i tried creating a batch file like so:
adb shell cat /dev/msm_rotator
rem expected output
rem /dev/msm_rotator: invalid length
pause
rem temp_root
rem adb push fre3vo /data/local/tmp
rem adb shell chmod 777 /data/local/tmp/fre3vo
rem adb shell /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
echo wait for device to reconnect
pause
adb push misc_version /data/local/tmp/misc_version
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/misc_version -s 1.00.000.0
adb shell sync
adb shell dd if=/dev/block/mmcblk0p17 bs=1 skip=160 count=10
rem expected output is:
rem 1.00.000.010+0 records in
rem 10+0 records out
rem 10 bytes transferred in 0.001 secs (10000 bytes/sec)
pause
rem downgrade
rem wget http://www59.multiupload.com:81/fil...118187CA1236F3BA6767A7/1.34.405.5_PC10IMG.zip
adb push 1.34.405.5_PC10IMG.zip /sdcard/PC10IMG.zip
adb reboot bootloader
but it didn't workout so much, don't know why it said something about it couldn't write recovery img file

Umm if you already rooted via the xda wiki then you should've had a bootloader that was engineering s-off right? Just saying because you could've flashed a custom rooted rom through bootloader and not had to re-root, that is unless the ruu applied an updated bootloader with s-on. Maybe boot into bootloader and see if the top line says PVT ENG S-OFF, worth a look anyway, could save you some headache
Sent from my Bulletproof G2

actually i'm haveing another headache a couple actually, for some reason, during the restore, it failed to download google maps among the gailion apps i downloaded, now i can't download no matter, i tried installing it manually, and it worked, but i can't see in the market.
the market on the web site says the application is not compatible.
also when i tried using anysoft keyboard and use the hebrew fonts, even though it installed i still couldn't get the keyboard.
right not i have no idea what's the state of my phone.

Related

Flash recovery image Droid Eris How To

First of all thanks to Amon_RA for this. I had no part in creating this. I am just providing a how to flash it. There may be an eaiser way but this is what worked for me.
First let me say I am on a Mac. If you are on windows the adb commands should work fine but I can't say how to get adb working for you.
1. download flash_image Here Link updated 3/17/10
2. Open the terminal and copy and paste the following commands.
adb shell [hit enter]
su [hit enter]
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system [hit enter]
3. In a new terminal window (don't close the original one).
adb push flash_image /system/bin [hit enter]
exit [hit enter]
4. Now in the original terminal window
chmod 755 /system/bin/flash_image [hit enter]
5. Now exit all termainl windows and reboot your phone.
6. Download Amon_AR's recovery Here.
7. Mount your phones sd card and drop recovery-RA-eris-v1.6.2.img on to it and eject your phone.
8. Open the Terminal and copy and paste the following commands with the phone connected to your computer.
8. adb shell [hit enter]
9. su [hit enter]
10. flash_image recovery /sdcard/recovery-RA-eris-v1.6.2.img
11. To get into recovery turn off you phone and hold the Volume Up + Power until it boots into recovery.
That's it.
I made an automator script the help all of you having problems getting adb working. Make sure you have the android sdk downloaded and named android-sdk Put it in your home folder and then run this script. Let me know how it works for you.
Disclaimer: I am not responsible for any damage you may do to your phone. I am only providing instructions on what worked for me. This is very beta. Good luck. Enjoy the nandroid goodness.
First link is Dead...........
ooopps Srry my bad, Its up.
You should mention that the chmod command is in the original terminal window. Also, you could do it in one window if you put:
adb remount
adb push bla /bla/bla
at the begining of everything.
adb push flash_image to /system/bin
Click to expand...
Click to collapse
I don't think there's a "to" in that command either. lol
testing567 said:
You should mention that the chmod command is in the original terminal window. Also, you could do it in one window if you put:
adb remount
adb push bla /bla/bla
at the begining of everything.
I don't think there's a "to" in that command either. lol
Click to expand...
Click to collapse
Thanks. I don't think the "to" is going to work either. I made the corrections.
Just a quick question. What does this boot too. Im new to all this phone stuff. I did the upgrade to 2.1 leaked so just been searching the forum here each day to see if a solution has come about. i just noticed v.1.6.2 in there so was curious as to what this will do.
Will this put the regular android on it or keep it the same, sorry just kinda getting started with android
coupla questions -
For northmendo:
Is the reboot in the middle of this even necessary? ( flash_image won't work right if /system is still mounted rw ?)
For testing567:
Do all the adb shell commands run as root against the 2.1_root install ... or maybe the above could be simplified even more by just running "adb root" first?
For Austinjs0102 (not a question)
This process only applies (at the moment) to phones with "2.1_root" - there isn't a path at present to go from "2.1_leak" to a rooted phone. Assuming that a way to roll back (or get root) for "2.1_leak" eventually is found, then the answer to your question is this: it is a process to apply a custom recovery partition to the phone that include tools that will allow you to perform complete phone backups and restore operations. This can be critical for devs who are experimenting with writing boot or system partitions to their phones - if something goes wrong with their experiments, they can "boot" their phone into recovery mode and restore back to a working configuration. To reiterate, though: this only applies to phones that are already rooted.
bftb0
Thanks a bunch that helps clear up info.
hopefully the hard working dev's here find a 2.1 leaked fix for us early people, if not then i may need to lose the phone lol.
Austinjs0102 said:
Just a quick question. What does this boot too. Im new to all this phone stuff. I did the upgrade to 2.1 leaked so just been searching the forum here each day to see if a solution has come about. i just noticed v.1.6.2 in there so was curious as to what this will do.
Click to expand...
Click to collapse
I am in same boat as you...
Let me start off by saying that I'm not a phone dev. I've done software development for many years, but never messed with the phone.
Can someone explain why we can't just load the 1.5 rooted PB001IMG.ZIP file over our 2.1 leaked handset? Is it a matter of the version number being lower? If so, since the 1.5 is rooted, couldn't someone just up the version number to whatever the 2.1 leak is plus one? Then, once it's loaded, write a little app to drop the number back where it should be?
TIA for the education.
Doc
DocTauri said:
Let me start off by saying that I'm not a phone dev. I've done software development for many years, but never messed with the phone.
Can someone explain why we can't just load the 1.5 rooted PB001IMG.ZIP file over our 2.1 leaked handset? Is it a matter of the version number being lower? If so, since the 1.5 is rooted, couldn't someone just up the version number to whatever the 2.1 leak is plus one? Then, once it's loaded, write a little app to drop the number back where it should be?
TIA for the education.
Doc
Click to expand...
Click to collapse
(I suppose I shouldn't respond, 'cuz DocTauri is jacking northmendo's thread. Sorry north!)
Doc,
I understand exactly what you are getting at... and also think I can explain why it's not easy.
First - what has been discovered so far was not a "root break-in", but rather an engineering ROM with root "built in". It is cryptographically signed so that a production phone will recognize the .zip file as a valid ROM. That first validation step has nothing to do with version numbers.
If the "SPL" on an unrooted phone was doing something as simple as looking at a couple of bytes in the initial file downloaded to the phone, then yes - doing what you suggest would work... just patch a few bytes using a hex editor. Unfortunately, the phone SPL is quite sophisiticated: it verifies the crypto signature on the entire zip file first, unpacks that zip, and then examines the contents of an individual file within the zip archive (and possibly even unpacks one of the YAFFS image files and then looks in a file within the YAFFS image) to read version numbers.
That means that the fundamental issue is the cryptographic signature on the .zip file. If you do anything which breaks step #1, step #2 (version # checks) are never reached. Certainly an individual file could be byte-patched, and then images and zip files could be re-assembled... but you would have no way to sign the zip with HTC's private key. Or you could even attempt to byte-patch the zip file - but then that would break the crypto signature. Either way, the crypto signature on the zip file is no longer valid.
If you have HTC's private RSA key, let us know!
bftb0
bftb0 said:
coupla questions -
For northmendo:
Is the reboot in the middle of this even necessary? ( flash_image won't work right if /system is still mounted rw ?)
Click to expand...
Click to collapse
I added the reboot because. All I would get is out of memory errors. The reboot fixed that.
e.g.
mtd: read error at 0x001e0000 (Out of memory)
mtd: read error at 0x00200000 (Out of memory)
mtd: read error at 0x00220000 (Out of memory)
mtd: read error at 0x00240000 (Out of memory)
northmendo -
That first link (that you corrected) now points to the recovery image, not "flash_image".
Note that the "flash_image" executable which Amon_RA originally included with his first recovery (.zip) is identical to the /system/bin/flash_image binary which ships on the Eris with 1.5 (1.17.605.1); the md5sum signature (of both of those files) is:
16559f2c27d08ff1ddfcaca05fbf10fb flash_image
That's also the same md5 signature as the "flash_image" file which was posted to dl.dropbox.
I don't have 2.1_root installed on my phone, but if the same binary is already on the phone after installing the 2.1_root ROM, there's no need to include those steps in your instructions. It is also possible that even if the "2.1_root" version of /system/bin/flash_image is different, it would also work.
Note that the only reason I bring it up is that your instructions might be (a) unnecessary, and (b) are encouraging folks to overwrite a binary that is already on the phone. No harm (but unneeded) if it is the same, and unknown harm if it is different.
Also (while I'm at it)
901167f6b5541b488c8e0404bceb0631 recovery-RA-eris-v1.6.2.img ***
It appears to me ( reading between the lines here ) that Amon_RA is trying to improve his v1.6.2 recovery - folks might want to keep an eye on that thread.
An alternative and quicker method than all of this is what zifnab06 suggested here. It's only two lines long, after all.
bftb0
[Edit]***Wow, my post was obsolete the moment I posted it - don't know how I missed Amon_RA's announcement post. Note that there appears to be several versions of "v1.6.2" floating around now - make sure to check his post if you want the most recent.
bftb0 said:
It appears to me ( reading between the lines here ) that Amon_RA is trying to improve his v1.6.2 recovery - folks might want to keep an eye on that thread.
An alternative and quicker method than all of this is what zifnab06 suggested here. It's only two lines long, after all.
bftb0
Click to expand...
Click to collapse
I will keep the link updated to the newest version here. Also I tried the quicker method without success. I will try it again when I get home from work.
Thanks
bftb0 said:
(I suppose I shouldn't respond, 'cuz DocTauri is jacking northmendo's thread. Sorry north!)
Click to expand...
Click to collapse
Sorry, didn't mean to. Understood on the explaination. I didn't realize it was a different rom image, I thought the key had been broken, allowing someone to resign a modified image.
Thanks!
Doc
I used this method and it was all really easy until I got to the end. It just says usage and then sits their and does nothing. I unplugged it and went into recovery and see the android dude and a yellow traiangle and exclamation point. Did I forget something? Is their an alternative way to flashing this?
sdk issues for flashing recovery...
Hey guys,
Im a noob but here's whats going on, Ive downloaded sdk extracted it to my c drive, ive downloaded all the required packages reccomended in the forum, Ive up dated my driver and still my machine doesnt recognize my phone...
Ive also extracted the recovery image to my tools directory and added the the path in enviromentals...
So at this point Im stuck as to how to get my pc (xp) phone and sdk in sync in order to get this recovery image working...So any advice would be highly appreciated. Thanks in advance.
Chris
Spencer_Moore said:
I used this method and it was all really easy until I got to the end. It just says usage and then sits their and does nothing. I unplugged it and went into recovery and see the android dude and a yellow traiangle and exclamation point. Did I forget something? Is their an alternative way to flashing this?
Click to expand...
Click to collapse
You could try this.
If you have your phone pluged in and type in to the terminal
adb reboot recovery [hit enter]
After you phone reboots it should come up with text options to do back-ups and restores. Do you get any of that?
Anyone know the key combo to get into recovery without adb?
having issues getting adb
got the command prompts working in xp, however while trying the methods here in the forum i am getting adb not foud errors. Any suggestions?

Troubleshooting for Newbies (having a "wtf!?" moment?)

Most of this information has been repeated so many times. But I wanted to make a short list of all the silly mistakes and simple oversights I’ve made over time.
(I make mistakes constantly - there are probably some mistakes in this very post - and I usually search around and try to find my way out of them. I will edit this post whenever I run into a problem. If anyone has any input, I will gladly add it to this post.)
YOU CAN NOT COME BACK FROM UNLOCKING YOUR BOOTLOADER:
If you ever think you’ll need to or want to “relock” your bootloader, you can’t.
Alternative root method:
VISIONary
(when you launch the application, you can leave everything unchecked)
Alternative recovery option:
ROM Manager (in the market)
ALWAYS DO A NANDROID/CLOCKWORKMOD BACKUP!
It will restore everything the way you had it if you F something up.
Want to go back to original shipping, but followed this guide, downloaded the linked file and can’t find the image files?
They’re not in that file. I don’t know why. Go here and download FRG33, decompress it and use the contents to follow the tutorial
Are you getting a “verification failed” error when you try to apply an update.zip in recovery?
Mount your SD card to your computer, download whatever file you were trying to apply directly to it (don’t download it and then drag it), and rename it to “update.zip”.
If you’re using Windows, make sure “hide extensions for known file types” is unchecked in your folder options within the Control Panel. You’ll keep having problems if it’s named “update.zip.zip” and you didn’t realize it
If you're still having problems, try this download of the stock FRG83 update.
<Added 11/18> I had another facepalm moment. If you downgraded back to FRG33 and you get an "assert failed" error, flash the recovery.img from that FRG33 package you extracted. (found this solution here)
Did you flash a ROM or go back to stock, start up your phone and noticed that you’re stuck on Edge?
Go to Menu>Settings>Wireless and Networks>Mobile Networks>Network Operators>(choose your carrier), wait.
Trying to copy something from your SD Card to /system/app (for instance)?
If you use the “cat” command, DON’T FORGET THE “>” SYMBOL. Nothing awful happens as far as I know, but it’s unnerving to watch the terminal puke all over itself.
Code:
cat /sdcard/thing.apk > /system/app/thing.apk
If you’re new to Linux and/or Android and are removing apps:
BE CAREFUL with the “rm” command. Once it’s gone, it’s gone.
You can always rename (technically, "move") the files instead:
Code:
mv /system/app/thing.apk /system/app/thing.apk.bak
Switch the commands to get it back
Code:
mv /system/app/thing.apk.bak /system/app/thing.apk
And don't forget to mount /system as read and write. To do that:
Windows: (must have drivers installed, Nexus One drivers are in the SDK)
Code:
adb shell
su
Linux: (no drivers necessary)
Code:
./adb shell
su
Code:
mount -o remount,rw -t yaffs2 /dev/mtdblock3/system /system
Don't forget to mount /system as read-only when you're finished. To do that, use the same code but replace "rw" with "ro" (without quotations of course)
Having trouble connecting with adb?
In Linux, you need to be in the SDK directoy (mine is in ~/AndroidSDK/tools). In Windows, you need to have ;C:\AndroidSDK\tools in the system path, within Environmental Variables (right-click on Computer>Properties>Advanced>Environmental Variables)
Unplug the device
In Linux, cd to ~/AndroidSDK/tools (or whatever you called it) enter:
Code:
sudo ./adb kill-server
sudo ./adb start-server
Plug in the device
Code:
sudo ./adb devices
In Windows:
Code:
adb kill-server
adb start-server
Plug in the device
Code:
adb devices
Device not found?
Did you enable USB Debugging in Menu>Settings>Applications>Development?
Trying to install an .apk but it just won’t work?
Try the “adb install” method, or push the apk to /system/app. If the app force closes or doesn’t work, just remove it
Code:
rm /system/app/thing.apk
Using Ubuntu (or another Linux distro), trying to mount your SD through Amon-Ra's recovery, but it won't mount?
Disable USB-MS toggle, unplug the phone, reboot your computer, try again.
Can I kiss you?
Seriously though I really appreciate it when the guys on here take time out of their day to post helpful guides like this since it prolly took 30 min at least. Thank you very much for doing this it might have been just what I'm looking for
ap3604 said:
Can I kiss you?
Click to expand...
Click to collapse
Nope.
ap3604 said:
Seriously though I really appreciate it when the guys on here take time out of their day to post helpful guides like this since it prolly took 30 min at least. Thank you very much for doing this it might have been just what I'm looking for
Click to expand...
Click to collapse
I'm glad you appreciate it. I'm not technically one of the guys on here. I've been on XDA in different device forums for a little while but have always been absorbing the information and never giving anything back. This is my first try. I can only dream of being a developer when I grow up, and solving more serious problems.
ahorriblemess said:
Want to go back to original shipping, but followed this guide, downloaded the linked file and can’t find the image files?
They’re not in that file. I don’t know why. Go here and download FRG33, decompress it and use the contents to follow the tutorial
Click to expand...
Click to collapse
Just wondering ahorriblemess, I looked over the guide and it says:
"This will do the followings to your Nexus One:
1. Reset your system files to the original system files.
2. Reset your kernel/boot image to the original shipping boot image.
3. Reset your recovery to original recovery (if you wish)."
Since I'm a real idiot... does this guide get your baseband / radio back to original (january) shipping image as well?
I didn't see it in those 3 things and have the 5.12.00.08 version so I wanted to make sure following that guide would reset the radio baseband back to the original (january) version as well before I did it.
Now all I need to do is figure out how fastboot works and I'm gold!
ap3604 said:
Just wondering ahorriblemess, I looked over the guide and it says:
"This will do the followings to your Nexus One:
1. Reset your system files to the original system files.
2. Reset your kernel/boot image to the original shipping boot image.
3. Reset your recovery to original recovery (if you wish)."
Since I'm a real idiot... does this guide get your baseband / radio back to original shipping image as well?
I didn't see it in those 3 things and have the 5.12.00.08 version so I wanted to make sure following that guide would reset the radio baseband back to the original (january) version as well before I did it.
Now all I need to do is figure out how fastboot works and I'm gold!
Click to expand...
Click to collapse
I don't know. I'm in no way an expert at any of this. My intent with this thread was to compile all of the sort of simple things that I've overlooked in the past. Usually I've found solutions to those problems scattered all over the place, so I just thought it would be helpful to put them all in one place in case anyone ever has the same problems I've had.
I have a pretty good feeling about the answer, but I don't want to share it in case you decide to act on it and it's wrong.
Thanks a ton!

root 2.3.4,downgrade,and s-off

ATTENTION! this thread is OUTDATED
unrevoked has always been a finicky program,3.22 working fine for some,not so much for others.recent updates seemd to have made it even worse, i see alot of issue and fustration with it lately. as such, i do not recomend this method any longer.
IMO,at this time htcdev is the best way to root,downgrade,and achieve s-off. while it technically does void your warranty,and wipe your data,it has thus far at least proven to be reliable. i doubt may original droid incredibles have factory warranty left anyway it does not use unrevoked,or any otehr root tools or programs,just htcs own unlock(you can giggle loudly,or silently,as you use their unlock to achieve s-off
the original home of the hctdev method is here, on android forums.
it is also here: http://forum.xda-developers.com/showthread.php?t=1600904 but not as well supported since im not here as much.
_______________________________________________________________________________________________________________________
*outdated guide:
i wasnt sure if this should be here,or in development,so feel free to move it if you feel its in the weong spot. i cant take credit for any of this,i just took it all from different places and put it all here. unfortunately,i cant gaurantee that this will work for everyone. but several have succesfully downgraded and regained s-off.
its intended for someone who has no adb experinece,and is overwhelmed at the thot of downloading and installing the SDK. if your proficient at adb,your welcome to pull flash_image and mtd0 out,and place them in tools,platform tools,or wherever you usually push files from,rather than changing to the mini-adb_inc directory.
thots and feed back are welcome. ive had this guide up here on AF for a few days. ill try and provide support here as well,but please underdstand computer time is limited these days and i dont make it here as often. in otherwords,please help each other out
_______________________________________________________________________________________
PLEASE NOTE: this thread is for the original droid incredible. NOT the incredible 2(vivow) or incredible S(vivo)
for info on downgrading the inc 2 to .97 hboot so you can root with revolutionary,see this thread here in the inc 2 all things root subforum
if you DO have an original droid incredible,aka Inc 1,then procede
_________________________________________________________________
**********************************************************
_________________________________________________________________
READ THIS: i dont mean to sound like i dont want to be bothered with questions. however,folks are having basically the same issues thru-out the 600+ posts,so i can almost gauarntee if you have a prollem,it has been covered. please try and search for some answers before jumping to the end and posting. answering the same things over and over is just making the thread even longer and harder to search.
if you do have trouble and need to post questions about ADB commands,please provide a copy of your entire session in the command window along with the question. its usually pretty easy to see what went wrong when we can see the whole thing.
copy everything in the command window,and paste it into a code box by:
-right click in the command window,click mark.
-highlight everything in white. hit enter.
-then,in your "reply to thread" box here,click the "#" up top
-right click and "paste" everything between the
Code:
tags.
_________________________________________________________________
i cant take credit for any of this,i just took it all from different places and put it all here. unfortunately,i cant gaurantee that this will work for everyone. but several now have rooted 2.3.4,and 1 has succesfully downgraded and gained s-off.
its intended for someone who has no adb experinece,and is overwhelmed at the thot of downloading and installing the SDK. if your proficient at adb,your welcome to pull flash_image and mtd0 out,and place them in tools,platform tools,or wherever you usually push files from,rather than changing to the mini-adb_inc directory.
thots and feed back are welcome. there will prolly be several edits of this as i try to clarify it,and make it a lil better. but for now im tired and 5am comes early ;)
[B]first and foremost,giving proper credit to all that deserve it:[/B]
*alpharev and unrevoked for all they for the root community :cool:
-efizzle for getting the ball rolling in [URL="http://forum.xda-developers.com/showthread.php?t=1286223"]this thread[/URL] on xda by figuring out that an older version of unrevoked would get superuser access on 2.3.4
-iowabowtech for point me in the direction of [URL="http://forum.xda-developers.com/showthread.php?t=768295&highlight=ota"]this thread[/URL] that i collected the misc image,and parts of the guide. also for his support answering questions.
-sele and the crew in the "rescue squad" on [URL="http://api.viglink.com/api/click?format=go&drKey=1153&loc=http%3A%2F%2Fandroidforums.com%2Fthunderbolt-all-things-root%2F418539-thunderbolt-root-unroot-thread.html&v=1&libid=1318297929451&out=http%3A%2F%2Fwww.thunderboltforums.com%2F&ref=http%3A%2F%2Fandroidforums.com%2Fthunderbolt-all-things-root%2F&title=Thunderbolt%20Root%2FUnroot%20Thread%20-%20Android%20Forums&txt=HTC%20Thunderbolt%20Forum&jsonp=vglnk_jsonp_13182980284911"]the thunderbolt forum[/URL] for what i like to call the "mini-adb" concept.
-rooter28 for testing and keeping me updated as he made progress. hopefully he will stop in and help answer questions :)
-mkreiger for fearlessly jumping in to be the second official tester
-lovejess for finding a mac download for unrevoked 3.22
-gkinsella2 for contributing the mac specific instructions
-whomever origianlly came up with the images and guide linked above. if i can figure out who this was,ill add you in later.
*special thanks to sdrawcab for his invaluable support in helping answer questions and prollems
-prolly more,im sure there will be several edits of this.
1)[B][I]download these files[/I][/B],and save them somewhere you can easily find them:
[U]unrevoked 3.22[/U] [url=http://www.multiupload.com/WMGYYGL97Z]unrevoked 3.22[/url]
[U]mirror:[/U] [URL="https://www.box.net/shared/8e3nb5l5lnjjuh6vbqt7"]unrevoked 3.22 mirror[/URL]
md5: [COLOR="red"]5760fbe8ed6d44752e78433252f2d5b2[/COLOR]
[U]unrevokeds modified usb drivers[/U] [url=http://unrevoked.com/rootwiki/doku.php/public/windows_hboot_driver_install]public:windows_hboot_driver_install [RootWiki][/url]
[U]mini-adb_inc[/U](contains misc image,flash image,and some basic adb tools)[url=http://www.multiupload.com/0G635MCZS2]Multiupload.com - upload your files to multiple file hosting sites![/url]
md5: [COLOR="red"]a793cc0142e1cd18f60849894bbc47cd[/COLOR]
[U]mirror:[/U][url]http://www.mediafire.com/?o6c4kq4wyccuom5[/url]
mirror md5: [COLOR="Red"]7c5211686a20b558ccd660c782f82e2b[/COLOR]
[I]*clockwork and zergrush included in mirror[/I]
[U]PB31IMG for 2.2[/U] (2.2 downgrade) [url=http://www.mediafire.com/?uvha2u2pv3xp8d5]PB31IMG.zip[/url]
[U]mirror:[/U] [url]http://pvillecomp.com/?page_id=22[/url]
md5: [COLOR="red"]31bb1611a0fa8197d447c0438426717e[/COLOR]
[U]clockwork 5.0.2.0[/U] [url=http://www.multiupload.com/FGEU9VPGKF]Multiupload.com - upload your files to multiple file hosting sites![/url]
[U]mirror:[/U][url]http://pvillecomp.com/?page_id=28[/url]
md5: [COLOR="Red"]e8ac35ddc1c37000bb0852d1f380b5bb[/COLOR]
**make sure to check the md5 sums match those listed!**
if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: [url=http://www.md5summer.org/]Home of the MD5summer[/url]
2)[B][I]root with unrevoked 3.22[/I][/B]
-go to settings/applications and [U]uncheck[/U] "fastboot". having this checked will prevent you from getting to hboot via power/vol down.
-open the recovery-clockwork-5.0.2.0-inc_PB31IMG download. extract it first if you need to. inside there is an image called "recovery-clockwork-5.0.2.0-inc". right click on this image,then click "copy". navigate to a directory you can easily find it,then right click in that directory,then "paste". alternatively,you can drag it from the extracted folder to a convienient spot(i personally like to drag files around,but its fine either way).
-use your md5 summer to verify the md5 of just the image,not the whole .zip. it should be: [COLOR="Red"]ea382ca5809cb872d0582aa22741d592[/COLOR]
-install the drivers as described on unrevokeds page above.
-unplug your phone.
-extract the contents of the unrevoked 3.22 .zip. open the folder, right click on "reflash" and run as administrator if possible.
-click on "file" in the corner of the relfash window
-click custom recovery
-navigate to,and select your "recovery-clockwork-5.0.2.0-inc" image and select it. at the bottom of your reflash app window, it should now say "recovery:custom" and "waiting for device"
-make sure usb debugging is checked ON in settings/applications/development.
-plug in your phone and place it in charge only mode. assuming you installed the drivers correctly,unrevoked 3.22 will start. let it do its thing. it will reboot a couple of times. when its finished,it may leave you on a blank screen. if this is the case,pull the battery and reboot.
-you [I]should[/I] now have the superuser app in your app drawer. if so,go to settings/applications/manage apps/superuser and clear data. test that superuser is working and granting permissions by downloading rom manager,and using it to flash the newest clockwork recovery. alternatively,download and run a "root checker" or any of your favorite "root only" apps and make sure they work.
-once you get "successfully flashed clockwork recovery" boot to it and make a backup,since downgrading to get s-off [U]WILL[/U] wipe all your data. boot back into the operating system.
*[I]special note to slcd users[/I]: this version of unrevoked is installig an old, non-compatible version of clockwork,so you will just see a black screen if you do not install newer clockwork as described above.
-if you plan to install a custom rom after downgrading,now is a good time to download titaium backup,and its pro key(WELL worth the $$) and do a batch backup of all your user apps and app data(no system data)
*at this point,you could just enjoy root access without doing anything else. if all you care about is using a couple of root only apps,and deleting some bloatware,you can remain rooted and s-on if youd like. id personally reccomend to downgrade and become s-off in case future OTAs knock out your root access.
3)[B][I]prepare to downgrad[/I]e[/B]
-extract the mini-adb_inc .zip. place the extracted folder on the root of your c drive. it comtains mtd0,flash_image,and some adb tools.
-place the 2.2 downgrade on the root of your sd card,and verify it is named "PB31IMG". now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting [U]WILL[/U] wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.
[U]special notes on hboot flashing PB31IMG files[/U] a common issue folks are having is the PB31IMG is not being found by hboot.
*there are only 2 reasons a PB31IMG is not found on the root of the sd card:
a)not named correctly. the phone muse see exactly "PB31IMG.zip". due to the way windows automatically adds and hides file extensions,it is usually correct to name the file "PB31IMG" with windows. common errors are for the file to be named "PB31IMG.zip.zip" after manually tying in the ".zip". on rarer occasions,it may not be adding/hiding the file extension,resulting in the file actually beening seen by the phone as "PB31IMG" :eek: [I]check your file with a file manager on your phone[/I] and see how its seeing it.
b)sd card not formatted FAT32. if it is plain FAT or anything else,PB31IMG is invisible. on rare occasion,i have seen claims that a bad sd card,or card that needs reformatted(even tho it may be FAT32) will have the same affect.
*this has been addressed [U]several[/U] times in the thread,skim thru it for more information.
4)[B][I]downgrade with adb[/I][/B]. make sure your phone is charged to 100% before starting.
-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in [B]bold[/B] so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.
at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.
-make sure phone is plugged in and usb debugging checked on,in charge only mode
-at the promt in your command window:
[B]cd c:mini-adb_inc [/B] [COLOR="Blue"]this should change your command promt to "mini-adb_inc",indicating youre using that directory.[/COLOR]
[B]adb devices[/B] [COLOR="blue"]this should output your phones serial number,indicating its recognized[/COLOR]
[B]md5sums mtd0.img [/B] [COLOR="blue"]it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839
[/COLOR]
[B]md5sums flash_image[/B] [COLOR="blue"]again,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a[/COLOR]
[COLOR="Red"]*both those numbers must match exactly. if they do then you can procede.
[/COLOR]
[B]adb push flash_image /data/local/[/B]
[B]adb push mtd0.img /sdcard/[/B]
[B]adb shell[/B] [COLOR="Blue"]your prompt should change to a #. if it changes to a $,then type[/COLOR] [B]su[/B] [COLOR="blue"]note your phone may pop up a message asking you to allow permissions the first time you do this. if it does check "always" and touch "allow" on the superuser request on the phone screen.[/COLOR]
[B]cd /data/local[/B]
[B]chmod 0755 /data/local/flash_image[/B]
[B]cd /data/local[/B]
[B]./flash_image misc /sdcard/mtd0.img[/B]
[COLOR="blue"]you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off[/COLOR]
[B]exit[/B] [COLOR="Blue"]to get out of your adb shell,and back to the "mini-adb_inc" prompt[/COLOR]
[B]adb reboot bootloader[/B] [COLOR="blue"]this will boot your phone to "fastboot" select "bootloader" with the power button.[/COLOR]
hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.
let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.
*[I][U]special note:[/U][/I] if your phone does not fully boot after running PB31IMG,dont panic. its happened to quite a few users,for some reason. simply pull your battery,boot to hboot via power/volume down and run PB31IMG again.
download unrevoked forever from here: [url=http://www.unrevoked.com/recovery/]unrevoked3 recovery reflash tool, v3.32[/url]
run it as you did the previous version. before plugging in your phone,make sure "disable phone security is checked" in the file menu. this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.
[I][U]*unrevoked 3.32 note:[/U][/I] if you check the "disable phone security" box as described above,and unrevoked still fails to turn s-off,you are not lost.[U]simply flash the s-off tool in recovery[/U]. you can find it here: [url=http://unrevoked.com/rootwiki/doku.php/public/forever]public:forever [RootWiki][/url]
if you wish to return to where you were,sign into google,download rom manger,flash the latest clockwork recovery. boot to recovery,then restore the back you made before we started.
optionally,you can now install the custom rom of your choice,along with a new recovery and radio if you desire. :)
and heres what you will see when entering the commands(the red are my copy/paste's):
[CODE]Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:UsersScott>[COLOR="Red"]cd c:mini-adb_inc[/COLOR]
c:mini-adb_inc>[COLOR="red"]adb devices[/COLOR]
List of devices attached
HT07DHJ02777 device
c:mini-adb_inc>[COLOR="red"]md5sums mtd0.img[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:mini-adb_inc]
mtd0.img 34307be744275f1db1dd16af04c37839
c:mini-adb_inc>[COLOR="red"]md5sums flash_image[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:mini-adb_inc]
flash_image 0098a7dd6600b55fac34fc6645be5d7a
c:mini-adb_inc>[COLOR="red"]adb push flash_image /data/local/[/COLOR]
1547 KB/s (76044 bytes in 0.048s)
c:mini-adb_inc>[COLOR="red"]adb push mtd0.img /sdcard/[/COLOR]
1662 KB/s (655360 bytes in 0.385s)
c:mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
$ [COLOR="red"]su[/COLOR]
su
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]chmod 0755 /data/local/flash_image[/COLOR]
chmod 0755 /data/local/flash_image
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]./flash_image misc /sdcard/mtd0.img[/COLOR]
./flash_image misc /sdcard/mtd0.img
# [COLOR="red"]exit[/COLOR]
exit
$ [COLOR="red"]exit[/COLOR]
exit
c:mini-adb_inc>[COLOR="red"]adb reboot bootloader[/COLOR]
c:mini-adb_inc>
other info:
-unrevoked 3.22 for mac can be found here: http://downloads.unrevoked.com/recovery/3.22/Reflash.dmg at this point youre on your own converting the adb commands. if someone wants to translate,or make a mac adb guide,ill gladly add it in
-until we put together a mac specific guide,directions for modifying the rest of it to work on a mac are found in post #629,here: http://androidforums.com/incredible...-3-4-root-downgrade-s-off-13.html#post3623666 courtesy of gkinsella2. mac users(and everyone else ) make sure to click the thanks button on his post!
______________________________________________________________________________________
*last and not least,this is a direct copy/paste of the AF thread,so any references to pages numbers are references to THAT thread on AF
the zergRoot method
this is for folks who for whatever reason,unrevoked 3.22 does not work to get them root access.
this could also be used if youve got a replacement device thats not setup,and you could care less about installing a recovery. this still requires unrevokeds drivers to be set up,so you can root with unrevoked 3.32 after downgrading,but otherwise,it prolly is a lil quicker since you dont need to download and run unrevoked 3.22.
alternately,use this if you just like ADB if your proficient in adb,feel free to remove the images from mini-adb_inc,and place them and the zergRush tool into whatever folder you typically push files from.
like above,this is intended for someone whose never installed ADB or entered command lines before.
1)download these files,and save them somewhere you can easily find them:
unrevokeds modified usb drivers public:windows_hboot_driver_install [RootWiki]
mini-adb_inc(contains misc image,flash image,and some basic adb tools)Multiupload.com - upload your files to multiple file hosting sites!
md5: a793cc0142e1cd18f60849894bbc47cd
PB31IMG for 2.2 PB31IMG.zip
md5: 31bb1611a0fa8197d447c0438426717e
zergRush tool from xda: Revolutionary - zergRush local root 2.2/2.3 - xda-developers
md5: 12c52b97e75e73595b325c03610b3380
**make sure to check the md5 sums match those listed!**
if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: Home of the MD5summer
3)prepare to downgrade
-extract the mini-adb_inc .zip. place the extracted folder on the root of your c\ drive. it comtains mtd0,flash_image,and some adb tools.
-extract zergRush.zip. take the image inside,and either copy/paste or drag it into your mini-adb_inc folder
-place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG. now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting WILL wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.
4)downgrade with adb. make sure your phone is charged to 100% before starting.
-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.
at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.
-make sure phone is plugged in and usb debugging checked on in charge only mode
-at the promt in your command window:
cd c:\mini-adb_inc this should change your command promt to "mini-adb_inc",indicating youre using that directory.
adb devices this should output your phones serial number,indicating its recognized
md5sums mtd0.img it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839
md5sums flash_image again,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a
md5sums zergRush again,output stuff, then this number: 3cf8a3fbceb667121d91f4ef1a66684c
*all those numbers must match exactly. if they do then you can procede.
adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush
this will cause zergRush to start,and it shoudl say "found a gingerbread!" followed by a bunch of other funny stuff.
last thing it says will be: Killing ADB and restarting as root... enjoy!
you should then be returned to your "mini-adb_inc>" prompt
adb push flash_image /data/local/
adb push mtd0.img /sdcard/
adb shell your prompt should change to a #
cd /data/local
chmod 0755 /data/local/flash_image
cd /data/local
./flash_image misc /sdcard/mtd0.img
you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off
exit to get out of your adb shell,and back to the "mini-adb_inc" prompt
adb reboot bootloader this will boot your phone to "fastboot" select "bootloader" with the power button.
hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.
let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.
download unrevoked forever from here: unrevoked3 recovery reflash tool, v3.32
run unrevoked(extract the contents,right click on "reflash",run as adminstrator if possible). this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.
and heres what you should see when entering the commands(my copy/pastes are in red):
Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Scott>[COLOR="Red"]cd c:\mini-adb_inc[/COLOR]
c:\mini-adb_inc>[COLOR="red"]adb devices[/COLOR]
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
HT117HJ00242 device
c:\mini-adb_inc>[COLOR="red"]md5sums mtd0.img[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
mtd0.img 34307be744275f1db1dd16af04c37839
c:\mini-adb_inc>[COLOR="red"]md5sums flash_image[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
flash_image 0098a7dd6600b55fac34fc6645be5d7a
c:\mini-adb_inc>[COLOR="red"]md5sums zergRush[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
zergRush 3cf8a3fbceb667121d91f4ef1a66684c
c:\mini-adb_inc>[COLOR="red"]adb push zergRush /data/local/[/COLOR]
1150 KB/s (21215 bytes in 0.018s)
c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
$ [COLOR="red"]chmod 755 /data/local/zergRush[/COLOR]
chmod 755 /data/local/zergRush
$ [COLOR="red"]/data/local/zergRush[/COLOR]
/data/local/zergRush
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00015108
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219e4 0x006c
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd158bf 0xafd1ace3
[*] Sending 149 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!
c:\mini-adb_inc>[COLOR="red"]adb push flash_image /data/local/[/COLOR]
1547 KB/s (76044 bytes in 0.048s)
c:\mini-adb_inc>[COLOR="red"]adb push mtd0.img /sdcard/[/COLOR]
1017 KB/s (655360 bytes in 0.629s)
c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]chmod 0755 /data/local/flash_image[/COLOR]
chmod 0755 /data/local/flash_image
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]./flash_image misc /sdcard/mtd0.img[/COLOR]
./flash_image misc /sdcard/mtd0.img
#[COLOR="red"] exit[/COLOR]
exit
c:\mini-adb_inc>[COLOR="red"]adb reboot bootloader[/COLOR]
c:\mini-adb_inc>
edit:apparently the zergRush tool has changed. ive included the new md5s,so hopefully there wont be any more confusion like the old md5s caused earlier. be aware of this,however, in case they do change again. you are right to be cautious if it doesnt match,so ill do my best to keep up with it.
This does work, but god I wish it was all ADB it was all so easy before unrevoked it didn't work the first time it gave me SU and root but no s-off then unrevoked would not run again due to new firmware. I did full downgrade to 2.2 and followed all directions ADB is so simple but unrevoked took 2 hours of just missing around to get s-off which included flashing 2.2 in hboot again starting over, running what I could run again in ADB without the gingerbreak since I was now on froyo, it was mostly just repushing the files and binary. But after all that unrevoked ran and gained root and s-off. Worst root I have ever done but people its all about making smart decisions before you do it if you make a mistake and get stuck, get help or trouble shoot but use you head before you battery pull and make sure you read before you hit anything.
If I helped you in any way please use the thank you button
sorry you had such issue with unrevoked. usually thats the easy part most folks are confused by adb and running commnads and wish it was all automated!
just a couple things that may help folks in the future:
-if you dont want to fool with unrevoked 3.22 in 3.2.4 use the "zergRoot"method in post 2. its all adb up to the downgrade. once you get to this point,you could easily roll yourself all the way back to the shipping firmware(assuming amoled screen) if you wanted,and then use an adb method(if one exists,im not that flamiliar with the inc). you dont have to go back to 2.2. i just picked that cause most folks are familiar with it,and with using unrevoked 3.32 to root/s-off it
-there have been a few complaints of unrevoked not giving s-off on 2.2. before you start,make sure "disable phone security" is checked in the file menu. if s-off still fails,but gives you root and a recovery,its worked for everyone thus far to just run the "forever" .zip in recovery,no real need to reflash the 2.2 ruu and run unrevoked multiple times.
-last and not least unrevoked is not ever going to give s-off in the 2.3.4(unless they release a new version for 2.3.4),as is uses an unsupported baseband,thats why the 2.2 downgrade is needed. folks that have no intention of backing up or returning to 2.3.4 and are fairly savy like the poster above,id strongy encourage to just use directions in post 2,its a lil quicker to not have to mess with unrevoked 3.22. its mainly included for the folks that want to make a nandroid or run tibu prior to the downgrade(plus zergRoot hadnt come out yet,when i originally put this together )
once your back on 2.2 you could even just use z4root to get get root access,install rom manager and clockwork,then flash the forever patch. once you can downgrade,there are alot of ways to skin the cat
Worked after a few tries!
Thanks Scotty for this writeup. I thought for a minute that things wouldn't work, but a third try proved fruitful.
Here's a few tips that I can add to things.
Things failed for me at the restore 2.2 part - HBOOT would not recognize the zip file as correct.
I am on a Win XP machine... Format the sd card to fat 32 using something other than Windows - I used a little program called "fat32format.exe". Windows seems to have a problem formatting sd cards correctly, so that could have been it.
Once I made sure the sd card was formatted, I put the 2.2 zip (PB31IMG) back on the sd card and started over using the zergRush method.
If you have tried this before, you will have to remove two directories from the /data/local/tmp directory. These are sh and boomsh. Thanks to ieftm in this forum for this tidbit of info.
If your zergRush is giving you problems stating:
[-] Cannot copy boomsh.: Permission denied
Then use this method to fix as I stated in paragraph above: remove sh and boomsh
Once these directories were removed and the zergRush was completed, the downgrade commenced just as described.
Side note - Unrevoked 3.32 installed Unrevoked forever automatically onto my DInc, so there was no reason to do the additional forever installation. You may have the same results.
For anyone else that can't seem to get things working, the search is your friend. It took me a while of hacking away at things, but eventually they all turned up roses...
Good Luck!
problems install roms
I have a problen,I can't install a Rom error e: can't open/sdcard/primexl3d.zip, why?
saosinalm:
First off, that's the wrong name for the downgrade zip according to the instructions that scotty posted above. Make sure the file is titled correctly and follow his instructions from beginning to end. I believe when mine succeeded my file title was "PB31IMG.zip" but in his instructions he leaves off the ".zip" at the end.
If there is an error in the process, you will have to start over from about step 3. You can't just start back from where you left off if you reboot the phone. Make sure you check your MD5's once you download, then you won't have to go back over that step.
I found the zergRush method easier, but I am more comfortable with adb...
I would suggest re-reading the instructions and following closely - he walks you through things really well.
I have one question....
Why root a phone? I had my phone rooted and honestly it was a complete waste of time. NONE of the Roms I downloaded ever worked properly, the apps never worked, and it was nothing but trouble for me. My phone always "force close" my apps too. No offense to the developers I just didn't see a benefit.
Am I wrong?
epescina:
That's really best answered differently depending on the type of person you are. If you like to play around and experiment with things or like learning how things work, maybe this works for you. Some people do it to get a custom look that no one else has, some do it to try and get better performance out of their phone that may have been bloated with apps out of the factory, and others are learning about developing apps and programming with it. Every person is different. Maybe it's just not for you, but others on this board can't live without it. To each his (her) own...
saosinalm said:
I have a problen,I can't install a Rom error e: can't open/sdcard/primexl3d.zip, why?
Click to expand...
Click to collapse
what are you trying to do exactly? no part of this guide requires you to flash a rom. so if youre tryingto root,be more specific what youre having trouble with, and if this is just a general question about flashing roms,you might do some research and/or post a new thread where more people will see it
epescina said:
I have one question....
Why root a phone? I had my phone rooted and honestly it was a complete waste of time. NONE of the Roms I downloaded ever worked properly, the apps never worked, and it was nothing but trouble for me. My phone always "force close" my apps too. No offense to the developers I just didn't see a benefit.
Am I wrong?
Click to expand...
Click to collapse
i personally have the opposite experience. while there are a couple minor issues with the rom that i run,i feel my phone is faster and more pleasureable after root. i love htc phones,but hate htc sense,so i root mainly root so i can run AOSP based firmware.
but as was said,to each his(her) own
scotty1223 said:
i personally have the opposite experience. while there are a couple minor issues with the rom that i run,i feel my phone is faster and more pleasureable after root. i love htc phones,but hate htc sense,so i root mainly root so i can run AOSP based firmware.
but as was said,to each his(her) own
Click to expand...
Click to collapse
I too hate the HTC Sense and wish I could change the overall layout of my phone. When I did load a new ROM that changed the layout it always seemed to be screwed up for one reason or another.
For example the lastest rom (Cyanogen) I absolutely loved but it didn't have market and I never could find out how to load it!
scotty1223 said:
i personally have the opposite experience. while there are a couple minor issues with the rom that i run,i feel my phone is faster and more pleasureable after root. i love htc phones,but hate htc sense,so i root mainly root so i can run AOSP based firmware.
but as was said,to each his(her) own
Click to expand...
Click to collapse
Couple of quick questions (which might appear silly):
"place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG"
#1) What do we rename "PB31IMG.zip" to? The directions simply state to rename it.
#2) Move it to the root of the external sdcard or internal sdcard?
tia, and I hope these questions weren't too ridiculous.
kjy2010 said:
Couple of quick questions (which might appear silly):
"place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG"
#1) What do we rename "PB31IMG.zip" to? The directions simply state to rename it.
#2) Move it to the root of the external sdcard or internal sdcard?
tia, and I hope these questions weren't too ridiculous.
Click to expand...
Click to collapse
It should be named PB31IMG.zip
It all depends how you rename it, if you use your pc it may not show the.zip extension if you have "show extensions" turned off. So on your pc it may just say PB31IMG even though it is really a zip. Sometimes when extensions are off people end up naming it PB31IMG.zip.zip wich will not work. It is best to have your pc show extensions you can do that by going to controll pannel / folder options / view tab uncheck hide extensions for known file types.
cmlusco said:
It should be named PB31IMG.zip
It all depends how you rename it, if you use your pc it may not show the.zip extension if you have "show extensions" turned off. So on your pc it may just say PB31IMG even though it is really a zip. Sometimes when extensions are off people end up naming it PB31IMG.zip.zip wich will not work.
Click to expand...
Click to collapse
wow lol ok, that just seems common sense, but I guess you never know who your audience is
Which sdcard should the file be on?
kjy2010 said:
wow lol ok, that just seems common sense, but I guess you never know who your audience is
Which sdcard should the file be on?
Click to expand...
Click to collapse
It should be on the removable sd not the internal storage if thats what you were asking.
cmlusco said:
It should be on the removable sd not the internal storage if thats what you were asking.
Click to expand...
Click to collapse
thanks again, just making certain. going for my third try now!
---------- Post added at 01:20 PM ---------- Previous post was at 01:14 PM ----------
I'm getting an unmatched number on zergRush
"md5sums zergRush again,output stuff, then this number: 795275fb9c41ebd5b9fe7ab19108c52b"
I get "4bf71b766a9603fa7db98e71e3f3b470"
??
It states:
"*all those numbers must match exactly. if they do then you can procede."
What do you do if they don't match?
Sorry for the n00b questions, been dealing with nothing but HC since June.
I would try redownloading and then check it again. If its still wrong i would contact the op scotty and ask him, as he is the one who provided the original md5.
cmlusco said:
I would try redownloading and then check it again. If its still wrong i would contact the op scotty and ask him, as he is the one who provided the original md5.
Click to expand...
Click to collapse
thanks, d/l it three times already what a PITA
I get a md5 of
3cf8a3fbceb667121d91f4ef1a66684c
for the zergrush file in the zip and.
12c52b97e75e73595b325c03610b3380
for the zip it self, different than both of your guys.
Edit. I believe that the zergrush file has been updated since this post to include more phones so that is probably why the md5 is different.

How to root stock 3.2

Ok, after messing around with 3.2 I decided to fix the rooting issues without downgrading. The problem with downgrading is it requires a SDCard and requires you to install a couple of programs and then to install an update.zip from the sdcard. I could not get half my ACER's to read and mount a sdcard, and some ACER's I have located in a remote office and trying to walk someone through the process was too painful. I tweaked the the downgrade tool's images to install 3.2 with root instead of downgrading it and jumping through hoops. All I did to the stock image is to copy the ash shell over to /system/xbin/su and set the sticky bit. Everything else is stock.
Update posted here, read thead http://forum.xda-developers.com/showpost.php?p=20654298&postcount=129
New version V4
-- The instructions are in a PDF document inside the download --
== Version V4 ==
-- Added /system/subin/su which is a backup (backdoor) root in case an OTA deletes the /system/xbin/su
-- Set permissons on the su root(#) tool so OTA's shouldn't be able to break it.
-- Added drivers for XP
Summary:
Version V4 is the same as V3 with the only difference being that there is a NEW backdoor script which has some additional features to protect root(#) from getting broken when you do an OTA. I also applied these to this flash image so you wouldn't have to add the additional protection yourself. V4 also has the drivers for XP included. However, when taking an OTA you should also install the backdoor for additional protection. However, you cannot leave the backdoor installed as it turns off sound. So having a little more protection just might save your root in case you take an OTA and forget to install the backdoor.
Download it here: http://www.multiupload.com/NS0X5TK4D1
Alternative download location:
http://depositfiles.com/files/c6pr69ri6
http://www.fileserve.com/file/s2wCQpN/root-3.2.1-V4.7z
http://www.filesonic.com/file/jTA7AMN
http://www.filejungle.com/f/vRnfK5/root-3.2.1-V4.7z
Which 3.2 update is it ? Fully working, no issues ? Good job. Is it power + volume down or volume up to go into recovery ? And is it possible to flash a custom kernel like Honeyvillain on this stock ROM ?
Thx
Has anybody ( including OP) tried this method?
It is the 3.2 OTA for WiFi that my Tablet picked up. It is total stock other than making a SU from the ash shell and putting it into /system/xbin.
Fully works, no issues, have used it on 8 ACER 500's with no issues.
To enter recover it is the left side of the volume button which is volume (-) oopps NOT (+) as I indicated.
Hah, saying Vol +/- is not intuitive on this device since when in landscape, Vol + is the "right" side, but in portrait mode Vol + is the "top" side.
no go
Hi, i can see my iconia uid from adb ( already installed in my pc) but
not from test.cmd, in the extracted package. Any ideas?
REPEATED STEPS 1-4 ( PER INSTRUCTIONS) ON 2 PC'S RUNNING W XP. SO FAR "NO GO" TEST.CMD CANNOT FIND PATH.... AND DOTNETDETECTER, THEREFORE, DOES NOT WORK.
will this wipe all the data on the tablet?
---------- Post added at 04:19 PM ---------- Previous post was at 03:40 PM ----------
JUGOMAN said:
Hi, i can see my iconia uid from adb ( already installed in my pc) but
not from test.cmd, in the extracted package. Any ideas?
Click to expand...
Click to collapse
same here i run the setup file and it installs but after i run test.cmd and it cant find it
Sorry about the test.cmd not working. The script just calls adb.exe to make sure it is working and I have it installed in another directory that I did not include. I posted, to the original message an attachment, it is called fix-Test.7z that fixes the test.cmd. You should be able to just unzip it into the directory you created and run the test. The archive includes the adb.exe and dll's so the test.cmd should work. If you have adb.exe working you really don't the test.cmd, but I found out when talking someone through it (over the phone) this made sure that adb.exe was installed and they had the tablet USB Debugging turned on.
And it is a quick and easy way to get the serial number which you need to flash it.
Thanks,
Let me know if you have any more issues.
does anyone know if flashing it this way will delete all your data on the tablet?
NO GO2
The attchment does fix the test.cmd "problem" but the next step, Dotnetdetecter, does not work. It re-installs the driver (?) then error "adb is old" or something like that. All packages in my computer's ADB are up to date. I think that the "target" directory in the DONETDETECTER IS NOT CORRECT. ANY IDEAS? btw GOOD WORK!!!!!
Many thanks for this. It is really easy like this. Keep up the great work.
UPDATE
Installed, booted, but no root. Previous rom( acer update) was3.2 Gen 2, now 3.2 Gen 1. was worth a try.. Thank you... tablet is working just fine, just no root
jimmkd84 said:
does anyone know if flashing it this way will delete all your data on the tablet?
Click to expand...
Click to collapse
Yea. I've never done this before so I'm wondering the same thing.
Also
Idk about this test thing but if u type 'adb devices' it'll show you which devices (if any) are connected. I always use that as a test when i use the adb to install apks.
bad adb
NO GO2 WROTE
The attchment does fix the test.cmd "problem" but the next step, Dotnetdetecter, does not work. It re-installs the driver (?) then error "adb is old" or something like that. All packages in my computer's ADB are up to date. I think that the "target" directory in the DONETDETECTER IS NOT CORRECT. ANY IDEAS? btw GOOD WORK!!!!!
Not sure what that would be. I just use the adb.exe and dlls that are in the fix.zip. Maybe you have a different version loaded?
ROOT IS NOT in the apps. It is in the adb shell.
What this does is allows you to connect to the device using adb.exe shell and you will get the $ prompt.
at the $ prompt type su and press enter. You will get # and be in su mode.
Now you can do whatever you would like. What would that be, you might ask? Well you could do the following:
1. mount system as rw
2. Push your favorite su tools to the device so they are listed in the apps (busybox etc).
Again this gets you to 3.2 with the ability to have a SU when connected via the adb shell. I left the building of the tools and custom CW to you guys to do as you wish. Here's something else you could do.
1. Shell to it, and issue the SU
2. Mount system as rw
3. Push your favorite tools to where you want (busybox etc)
4. Take the recovery.img (in the zip) and dd dump it to the recovery partition. This will put clockwork on the device (1.5).
a. You should probably run itsmagic too.
5. Get everything the way you want it.
6. Reboot to recovery and CW will load.
7. Now with CW 1.5 loaded, you can build and make copies of your ACER and make them available to anyone you like. CW 1.5 does NOT require an external SDCARD.
Sorry, if I did not make it clear that this is just a SU that you have to use from the command line. If someone wants to give me the links to a SU apk, busybox, etc they'd like included I'd do it. It would only take a few minutes as I got hundreds of these ACER's to flash for our company. I just wanted to get SU, but what the heck, I could build it out if someone would like it that way. ACER really pee'd me off with this, and guess what? They left the ability to gain root in the 3.2 100. Why the 'Sam Heck' did they change the 500 3.2 so you cannot get root?
So, anything I can do to help let me know. Also, If you never want ACER to send you another update I can tell you how to fix that too. All you have to do is the following:
1. Get to the adb shell $
2. type su to get the # prompt
3. Now mount system as rw by doing the following:
a. mount -t rfs -o remount,rw system /system
4. Now rename the update tool by doing the following:
a. mv /system/app/FDUpdater.apk /system/app/FDUpdater.apk.old
mv /system/app/FWupdateService.apk /system/app/FWupdateService.apk.old
5. To get OTA then just reverse the process if you ever want ACER and their OTA to break your fleet of ACER Tablets by pushing silly updates that they think you want then you can undo it. The last I knew, I owned these ACER Tablets and I don't take kindly to them changing something that I do NOT WANT CHANGED. They should be sued, matter of fact, I think they are violating federal laws by destroying data on MY tablets. Anyway, off my soapbox.
i have re run the new test.cmd and is working now, and have successfully run dotnetdetector but i dont want to proceed until someone can confirm if doing this will wipe all data on the tablet
appreciate it, great work btw dev!
---------- Post added at 05:05 PM ---------- Previous post was at 04:39 PM ----------
did this wipe the data on it?
Hello, may i use this procedure on my A501?
Thanks
I did NOT test on the 501 so I do not know. If it was me, I would take the 501 stock images and put them in the kitchen and root them and then replace the ones in my zip with those or better yet, use CW to flash it in.
I think the ACER 501 has cell phone data connection doesn't it? I don't think the stock for WiFi only would be a good idea.
What ACER did on the 3.2 update (my opinion) was removed the Gingerbreak exploit and they removed the adb root exploit (they left the adb root exploit in on the 100). This is what many OEM's did, however many allow you to flash your own easier than ACER seems to want to let us. So if you got 3.2 NON-ROOTED loaded then there is no way to 'hack' out a root (just yet).
So how do you root it? You have to make a custom ROM and flash it. Now ASUS/Motorola/Samsung/Toshiba all allow you to flash your own ROM if you know what you are doing.
ACER seems to hide how to put the tablet into flash mode (if someone knows please let me know). Even if you did flash it they do want those ROMS running so they take each partition and calculate the MD5Sum and write it to, I think, partition #7. Therefore, if you do figure out how to flash in a new boot image or system image the tablet will not boot because the MD5Sums will not match (if you brick your tablet this way you are fubar). Fortunately, someone wrote a tool called itsmagic which you can run to tell the tablet to rebuild these. But if you fubar brick it before you get itsmagic run, I don't know how you get into flash mode using the keys so you'd be up a creek.
So, the 411 skinny on rooting an ACER with 3.2 is to get 3.2 off the device. Fortunately, they made an earlier flashing tool to flash in 3.0. I would guess this leaked out as a way for people to reflash to stock when they have issues.
Once you are on 3.0, you now can use Gingerbreak or the adb root exploit to root it. Once rooted, you can get CW loaded. CW allows you to install your own ROM's. Without CW you can only install ROM's signed by ACER and without ROOT you cannot install CW.
So, if you flash to the 3.0 now you are 'back to the future' in 3.0, you can root and install CW so you can now install a custom ROM from your SDCard.
What I would do is go get the STOCK ROM from ACER for your 501 device.
Once you have the stock ROM, you can use the kitchen tools to unzip the ACER ROM and root it to your liking. Now, re-zip it, but you cannot sign it with an ACER certificate so it will only install using CW. No, big deal because you got 3.0 loaded with CW. You boot to recovery CW and then run the update from your SDCard that you built in your kitchen.
This isn't really that hard to do if you're willing to read some documentation.
I have no idea if it wipes it clean totally. It does walk you through the setup again (like it was new out of the box) so I would assume most things would be wiped. I would back it up and not take the chance because it is best to be backed up.
Just a note here. It says fully stock execpt root? i don't think that's entirely accurate. I believe that it's still downgrading the bootloader, otherwise you'd never be able to get CWM to run, as itsmagic doesn't work with the new bootloader. So your left with stock 3.2 ROM with adb/su abilities and pre 3.2 bootloader.
On another note, I believe step 17 is not needed. CWM run's itsmagic automatically on every boot. So just booting CWM and then rebooting to android should suffice.

Kobo Arc Development

So I was randomly flying around on Google today, and I noticed that someone had claimed to root the Kobo Arc, and gave written instructions here -- http : // www . mobileread . com / forums / showthread.php?p=2584491 (Remove the spaces, XDA won't let me post an actual link, since I don't have 10 posts yet). After running through this myself, I went on the Google Play store and used root checker. Much to my surprise, it worked, and my device now has root access. I even tested with Root Explorer, and mounted the system partition as R/W, and I can move things in and out of it. I'm currently working on trying to get a custom ROM working, but I'm worried that I will cause a brick, since Cyanogen doesn't support the Arc. (yet...)
ThunderBird2678 said:
So I was randomly flying around on Google today, and I noticed that someone had claimed to root the Kobo Arc, and gave written instructions here -- http : // www . mobileread . com / forums / showthread.php?p=2584491 (Remove the spaces, XDA won't let me post an actual link, since I don't have 10 posts yet). After running through this myself, I went on the Google Play store and used root checker. Much to my surprise, it worked, and my device now has root access. I even tested with Root Explorer, and mounted the system partition as R/W, and I can move things in and out of it. I'm currently working on trying to get a custom ROM working, but I'm worried that I will cause a brick, since Cyanogen doesn't support the Arc. (yet...)
Click to expand...
Click to collapse
confirmed, was just going to post this but was beaten to it.
http://www.mobileread.com/forums/showthread.php?t=218928
ive attached the file but please go to that website and pay homage to whoever did this work...now to the next stop, a ROM
Device now has a working custom recovery see post 15
Sent from my Arc using xda app-developers app
dazza9075 said:
confirmed, was just going to post this but was beaten to it.
http://www.mobileread.com/forums/showthread.php?t=218928
In terms of a ROM do we not need a compatible boot loader that will allow unsigned ROMs?
ive attached the file but please go to that website and pay homage to whoever did this work...now to find a man about a ROM
Sent from my Arc using xda app-developers app
Click to expand...
Click to collapse
i have absolutely no idea what im doing but I think I have dumped 12 partitions using
dd if=/dev/block/mmcblk0p10 of=/sdcard/p10.img
is there anyone around that fancies a challenge? im in a position where bricking this thing isn't really much of a problem so if someones up for a challenge and wants to help im willing to lend myself and the device to this
Warning : Block of Text Ahead.
dazza9075 said:
confirmed, was just going to post this but was beaten to it.
In terms of a ROM do we not need a compatible boot loader that will allow unsigned ROMs?
ive attached the file but please go to that website and pay homage to whoever did this work...now to find a man about a ROM
Sent from my Arc using xda app-developers app
Click to expand...
Click to collapse
Haha. As soon as I found a thread called "root the Kobo Arc" on Google, I posted it here right away. Sorry if I deprived you of the satisfaction! *troll*
Joking aside, I'm not too sure about the bootloader. I think it's pretty locked down (since I put a nexus 7's cyanogenmod onto the data partition and rebooted. It tried to updated, but said validation failed, or something of that sort). I can't install any custom recoveries either, since I have no idea how to do it in the first place, and there's none made for the Arc.
Also, I analyzed the Arc with the "Droid Examiner" App from the play store (That is a really great app, just so you know), and found that it uses a board called "zeus". The funny thing, though, is that one of Sony's Xperia phones, also has a board called "Zeus", and there's Cyanogenmod for that (albiet not the latest version). However, these two devices have nothing in common. The closest thing to an Arc that has Cyanogenmod is the Nook HD/HD+, which uses the exact same chip (OMAP TI 4470).
If someone is smart enough (not me) to analyze the Cyanogenmod files for the Nook, and see how they work, that may lead into flashing the Arc.
Anyway, I'm resetting the Arc, since I'm having weird cases where the Arc would freeze after booting it from sleep mode, and I'd have to turn it off and on again. I think that was something else I did, since it happened before the root, but neh, I might as well try this all from factory default settings.
Sorry for the block of text, guys!
P.S. Using the stock Jelly Bean boot animation on the Arc looks amazing!:laugh:
Haha, its cool, like yourself I just happened to Google kobo arc root and for once my googe fu was up to the task and the root appeared
I've been looking at starting my own recovery mod branch but its no simple task by the looks of it, if their are similar devices we can use all their data and tweak it to ours which would help a lot!
Oh I think we have fast boot, I held vol down and pushed power on, it just sat at the kobo arc screen, I used the nexus 7 driver from the universal adb/fastboot driver I found on here and it connected up http://forum.xda-developers.com/showthread.php?t=2263822
I stumbled on some to good to be true program on Xda dev that apparently can root anything and unlock any bootloader once your in fastboot mode. I have tried that part and it said it was successful but i have no idea how to test this out yet, the program does a bunch of other stuff too, the adb stuff worked as did apk sending, and the rooting options knew i was rooted, it also has flashing functions, I'll be damed if I can find it now I'm at home though , I'll have another look.
I don't mind doing leg work but if someone can read the map it would be very helpful!
Edit, found it
http://forum.xda-developers.com/showthread.php?t=2399385
http://www.mediafire.com/?vwxpq62pa927s9c
Sent from my Arc using xda app-developers app
dazza9075 said:
Haha, its cool, like yourself I just happened to Google kobo arc root and for once my googe fu was up to the task and the root appeared
I've been looking at starting my own recovery mod branch but its no simple task by the looks of it, if their are similar devices we can use all their data and tweak it to ours which would help a lot!
Oh I think we have fast boot, I held vol down and pushed power on, it just sat at the kobo arc screen, I used the nexus 7 driver from the universal adb/fastboot driver I found on here and it connected up http://forum.xda-developers.com/showthread.php?t=2263822
I stumbled on some to good to be true program on Xda dev that apparently can root anything and unlock any bootloader once your in fastboot mode. I have tried that part and it said it was successful but i have no idea how to test this out yet, the program does a bunch of other stuff too, the adb stuff worked as did apk sending, and the rooting options knew i was rooted, it also has flashing functions, I'll be damed if I can find it now I'm at home though , I'll have another look.
I don't mind doing leg work but if someone can read the map it would be very helpful!
Edit, found it
http://forum.xda-developers.com/showthread.php?t=2399385
http://www.mediafire.com/?vwxpq62pa927s9c
Sent from my Arc using xda app-developers app
Click to expand...
Click to collapse
Um... Okay. I've installed the drivers (I think I installed them correctly), and I booted my device using "volume down + power". I have it connected to my System, but whenever I try to use one of the options in the Android Root Toolkit, it tells me it's waiting for the device. I don't know what I did wrong, but something's clearly not working.
As far as the recovery goes, I think that looking at the Nook Tablet from TWRP would work quite nicely. It runs on a similar processor ( I believe it's a OMAP TI 4430 ), and it seems to be quite similar in specs to the Arc. If only I was a bit better at programming...
ThunderBird2678 said:
Um... Okay. I've installed the drivers (I think I installed them correctly), and I booted my device using "volume down + power". I have it connected to my System, but whenever I try to use one of the options in the Android Root Toolkit, it tells me it's waiting for the device. I don't know what I did wrong, but something's clearly not working.
As far as the recovery goes, I think that looking at the Nook Tablet from TWRP would work quite nicely. It runs on a similar processor ( I believe it's a OMAP TI 4430 ), and it seems to be quite similar in specs to the Arc. If only I was a bit better at programming...
Click to expand...
Click to collapse
im usig the generic android adb driver and the bootloader driver for fast boot
im dumped all partitions and mapped them all out, see below for file system details
But again I'm blindly stabbing in the dark and most tutorials are a bit lacking in depth or not relevant to the kobo :/
Sent from my Arc using xda app-developers app
127|[email protected]:/ # blkid
/dev/block/dm-2: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/dm-1: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/dm-0: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p12: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p11: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p10: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p4: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
[email protected]:/ #
Okay, so I can't even push apps to the Arc using ADB. I think you have to boot into recovery (power + volume up). I don't know how to use the terminal at all (I'm lost, I know D: ), so I don't have that installed on the Arc. I remember being able to do ADB even with my Sony Reader (First gen, PRST1), so I'm not sure why the Arc isn't quite working. I have both drivers installed, BTW.
As for the recovery, I can't even find a method to flash it. I'm still trying everything I can, though. :\
Sent from my Arc using xda app-developers app
ive mapped out the following partitions and any info ive found about each of them, im not in a position to help at the moment, got a big day at work tomorrow, as mentioned above ive used several tools,
SuperSU,
ROM toolbox pro
busybox
remount
Below is a list of all the available partition names and numbers
/dev/block/mmcblk0p1 xloader
/dev/block/platform/omap/omap_hsmmc.1/by-name/xloader
348KB
/dev/block/mmcblk0p2 bootloader
/dev/block/platform/omap/omap_hsmmc.1/by-name/bootloader
1.50MB
/dev/block/mmcblk0p3 cypto
/dev/block/platform/omap/omap_hsmmc.1/by-name/crypto
Completely empty
64KB partition size
/dev/block/mmcblk0p4 EFS
Mounted as /FACTORY
/dev/block/mmcblk0p4:UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/platform/omap/omap_hsmmc.1/by-name/efs /factory ext4 ro,relatime,barrier=1,data=ordered 0 0
20MB
/dev/block/mmcblk0p5 misc
/dev/block/platform/omap/omap_hsmmc.1/by-name/misc
Completely empty
128KB partition size
/dev/block/mmcblk0p6 Bootlogo
/dev/block/platform/omap/omap_hsmmc.1/by-name/bootlogo
Contains kobo arc picture
4MB partition size
/dev/block/mmcblk0p7 Logos
/dev/block/platform/omap/omap_hsmmc.1/by-name/logos
contains the battery charge logo
28MB partition size
/dev/block/mmcblk0p8 recovery
/dev/block/platform/omap/omap_hsmmc.1/by-name/recovery
data contains a GZ file, when decompressed we get a 8.5MB file of unknown type, exact same as in boot
5MB of data
16MB partition size
/dev/block/mmcblk0p9 boot
/dev/block/platform/omap/omap_hsmmc.1/by-name/boot
data contains a GZ file, when decompressed we get a 8.5MB file of unknown type, exact same as n recovery
4.5MB of data
8MB partition size
/dev/block/mmcblk0p10 CACHE
Mounted as /CACHE
/dev/block/mmcblk0p10: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/platform/omap/omap_hsmmc.1/by-name/cache /cache ext4
rw,nosuid,nodev,noatime,errors=panic,barrier=1,nom blk_io_submit,data=ordered 0
0
768MB partition size
/dev/block/mmcblk0p11 SYSTEM
Mounted as /SYSTEM
/dev/block/mmcblk0p11: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/platform/omap/omap_hsmmc.1/by-name/system /system ext4
rw,relatime,barrier=1,data=ordered 0 0
910MB partition size
/dev/block/mmcblk0p12 USERDATA
Mounted as /DATA
/dev/block/mmcblk0p12: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/platform/omap/omap_hsmmc.1/by-name/userdata /data ext4
rw,nosuid,nodev,noatime,errors=panic,barrier=1,nom blk_io_submit,data=ordered 0
0
12GB partition size
Watching with interest. The root works. No frills CPU installed and working. There may be hope for this thing yet:good:
Moved to new thread and more appropriate forum - keep up the good work guys
im not sure that's going to work you know, ive had some permission errors with adb which suggests the root isn't full, terminal on the device works fine, but adb just has some problems, adb shell and the su seems to fix them.
http://www.gadgetsdna.com/android-terminal-adb-shell-command-list/1168/
http://www.addictivetips.com/android/make-nandroid-backups-on-android-without-booting-into-recovery/
im busy today but ive found these useful
i think Clockwork Recovery should be our focus at this point or if you have dumped your partitions(?) attempt to construct a rom for later use
or this should work too
Install any Custom Recovery with flash_image:
Just like the previous method, this method also requires following advanced steps and is not recommended if the first method is working for you. flash_image is a tool for Android devices that lets you rewrite your phone’s system partitions with partition image files and installing it to your device requires ADB. If you don’t already have ADB installed, check out our guide on installing ADB. Once you have ADB installed, flash the custom recovery image as follows:
WARNING: It is very important that the recovery image that you use in this method is compatible with your device. Else it will not work and flashing it could possibly brick your device.​
Download flash_image and extract it from the zip file to a location on your computer. We extracted it to the main C drive (not in any folder) and will use that in the next steps.
Copy the recovery image for your phone to a convenient location on your computer, preferably with a short path. We will be placing it on the C Drive directly (not in any folder) and using that in the next steps.
Note: The recovery image should have .img extension. If it is in a zip file, extract the .img file from it.
Enable USB debugging mode on your device from Menu > Settings > Applications > Development.
Connect your device to your computer via USB.
Open a Command Prompt window on your computer and enter the following commands: adb push c:\flash_image /sdcard/adb push c:\recovery.img /sdcard/adb shellsumount -o remount, rw /systemcp /sdcard/flash_image /system/bincd /system/binchmod 777 flash_imageflash_image recovery /sdcard/recovery.imgThis will first transfer flash_image and recovery.img to your phone. Then it will copy flash_image to the /system/bin folder of your Android device and make it executable. Finally, it will flash the custom recovery image to your device using flash_image.
Note that we used c:\flash_image and c:\recovery.img in the first two lines as we had these files extracted at the root of our C drive. If you extracted the files elsewhere, use the appropriate paths and if your recovery image has a different name, use the appropriate name.
Reboot your device once the process is finished and you’re done. You may exit adb and the Command Prompt window on your computer by entering ‘exit’ thrice.
dazza9075 said:
im not sure that's going to work you know, ive had some permission errors with adb which suggests the root isn't full, terminal on the device works fine, but adb just has some problems, adb shell and the su seems to fix them.
http://www.gadgetsdna.com/android-terminal-adb-shell-command-list/1168/
http://www.addictivetips.com/android/make-nandroid-backups-on-android-without-booting-into-recovery/
im busy today but ive found these useful
i think Clockwork Recovery should be our focus at this point or if you have dumped your partitions(?) attempt to construct a rom for later use
or this should work too
Install any Custom Recovery with flash_image:
Just like the previous method, this method also requires following advanced steps and is not recommended if the first method is working for you. flash_image is a tool for Android devices that lets you rewrite your phone’s system partitions with partition image files and installing it to your device requires ADB. If you don’t already have ADB installed, check out our guide on installing ADB. Once you have ADB installed, flash the custom recovery image as follows:
WARNING: It is very important that the recovery image that you use in this method is compatible with your device. Else it will not work and flashing it could possibly brick your device.​
Download flash_image and extract it from the zip file to a location on your computer. We extracted it to the main C drive (not in any folder) and will use that in the next steps.
Copy the recovery image for your phone to a convenient location on your computer, preferably with a short path. We will be placing it on the C Drive directly (not in any folder) and using that in the next steps.
Note: The recovery image should have .img extension. If it is in a zip file, extract the .img file from it.
Enable USB debugging mode on your device from Menu > Settings > Applications > Development.
Connect your device to your computer via USB.
Open a Command Prompt window on your computer and enter the following commands: adb push c:\flash_image /sdcard/adb push c:\recovery.img /sdcard/adb shellsumount -o remount, rw /systemcp /sdcard/flash_image /system/bincd /system/binchmod 777 flash_imageflash_image recovery /sdcard/recovery.imgThis will first transfer flash_image and recovery.img to your phone. Then it will copy flash_image to the /system/bin folder of your Android device and make it executable. Finally, it will flash the custom recovery image to your device using flash_image.
Note that we used c:\flash_image and c:\recovery.img in the first two lines as we had these files extracted at the root of our C drive. If you extracted the files elsewhere, use the appropriate paths and if your recovery image has a different name, use the appropriate name.
Reboot your device once the process is finished and you’re done. You may exit adb and the Command Prompt window on your computer by entering ‘exit’ thrice.
Click to expand...
Click to collapse
I've already tried that recovery method (I spent about two hours just googling), and it doesn't work with the Arc. The ADB won't let me push the image over.
As for Cyanogenmod, I tried something yesterday. A person on the Mobileread forums (apparently a Kobo employee) put out an update.zip file for the Kobo Arc. The file was quite old, and it's really just the 4.1.1 update that (I hope) we're all running. He said that as long as you put it on the root of the data partition, the Arc will flash it immediately. When I tried taking a Nexus 7's Cyanogenmod file and sticking it in the same place, the Arc started flashing it, but then just said there was an error with the update. So I personally think that you do require a properly signed ROM.
However, if you open up Kobo's update.zip using Winrar, a sidebar pops up that says "signed by SignApk". I don't know too much about this, but couldn't we use this "signapk" to sign our own ROMS and flash them?
Just a thought.
​
ThunderBird2678 said:
As for Cyanogenmod, I tried something yesterday. A person on the Mobileread forums (apparently a Kobo employee) put out an update.zip file for the Kobo Arc. The file was quite old, and it's really just the 4.1.1 update that (I hope) we're all running. He said that as long as you put it on the root of the data partition, the Arc will flash it immediately. When I tried taking a Nexus 7's Cyanogenmod file and sticking it in the same place, the Arc started flashing it, but then just said there was an error with the update. So I personally think that you do require a properly signed ROM.
However, if you open up Kobo's update.zip using Winrar, a sidebar pops up that says "signed by SignApk". I don't know too much about this, but couldn't we use this "signapk" to sign our own ROMS and flash them?
Just a thought.
Click to expand...
Click to collapse
I think there is a problem with the setup, I just flashed a CW recovery image and it worked, or didn't rather! but the concept did, transferred, flashed using adb, I had to replace it though as it was totally borked and kept restarting, apparently the touch based recovery methods can be like that, ill have some good time tomorrow night (UK time) if your about, and ill keep at it tonight if I get a chance!
copy recovery to adb location
adb push recovery.img /sdcard/
adb shell
su
cat /sdcard/recovery.img > /dev/block/platform/omap/omap_hsmmc.1/by-name/recovery
exit adb shell and type
adb reboot recovery
fixed it by holding power button and vol down to boot to fastboot recovery
then ran
fastboot flash recovery inputrecovery.img
inputrecovery being my original recovery file taken from partition 8!
ive updated the partition map on the post above with my progress, but it looks like we can flash to them my name so its probably less relevant now
oh ive ditched the drivers I was using and reinstalled the drivers from the official SDK, generic android adb for within android and android bootloader for fastboot
EDIT
Yaaas!! recovery replaced
ok, deleting or renaming /etc/install-recover.sh appears to have stopped custom recovery being changed back to stock after reboot, I used the recovery builder to make a build from partition 8, which it did without error, flashed using the above commands.​
Still don't know what im doing though, but progress is progress ​
ill post a link to the custom recovery ive made soon, we need to make up some fstab file listing all the mounts etc, i tried one but it must be borked as recovery couldnt see anything​
​
ok i have a working recovery http://jenkins.cyanogenmod.com/job/recovery/35325/artifact/
its not quite done, i need to mount the sdcard, its physical location is mounted, ie /data, but its virtual mount isn't /storage/sdcard
I have asked for some help so hopefully someone can help be on this, I think it needs to be symlinked
im going to need some help soon, so if your reading this with a kobo arc, I need you! im needing a hand folks! if your stuck getting this far let me know and we can PM to get it working
oh and recovery is also now persistant by deleting or renaming /etc/install-recover.sh"
Sorted folks!
I have made a stable and thus far, a working custom recovery.
its mounting everything and backing up / restoring works as it should, unless anyone can find any issues I consider this step in building a complete ROM completed,
you must have root, download arctic.apk and install on your tablet, you will need to enable unknown sources In dev options first
you must have android and java sdk also installed, you will need to add the google usb drivers in the android sdk, you will find them in the "extras"
Enable usb debug on the arc and install the generic google adb usb drivers
Delete or rename /etc/install-recover.sh this will make the custom recovery persistent
Copy the recovery.img to the SDCard, either by using drag and drop in windows ( to root of "internal storage") or by adb push, if you use adb push then remember to copy recovery.img to the same folder as adb
adb push recovery.img /sdcard/
The next job is to open up a command window and navigate to adb folder, type the following exactly, even better copy and paste them!
adb shell
su
cat /sdcard/recovery.img > /dev/block/platform/omap/omap_hsmmc.1/by-name/recovery
exit adb shell (ctrl+C) and type
adb reboot recovery
and bobs your uncle, one happy new recovery
Thanks for your hard work. Everything works quite well.
Sent from my Arc using Tapatalk 4
cancuck said:
Thanks for your hard work. Everything works quite well.
Sent from my Arc using Tapatalk 4
Click to expand...
Click to collapse
that's the easy bit, I have a feeling I need to make a couple of changes to the recovery.img but noting major, just a couple of other mounts I may have missed
I probably would like some help with the next bit however.
im just trying to build a development platform, I have a loathing for Linux as a desktop so will need to re educate myself without throwing my laptop out of the window, after that "challenge" the ROM should be easy
Well, I've just done it, and it works. Everything seems to be in order for the time being. I'm going to muck around with the new capabilities, and see what I can do.

Categories

Resources