Here is a quick guide on how to unroot the latest RUU 5.07. It seems that quite a few people are having trouble unrooting their device or running an official RUU while being on the latest update, or a ROM based on the latest update.
The problem is that HTC has fixed the bootloader (in particular Hboot 2.18) so that it will reject any PC36IMG.zip official software or RUU files that update previous operating systems on the phone (a S-ON phone). You would usually need a RUU (I'm calling both the PC3IMG.zip file and the RUU file an RUU) that is for your current operating system. If your phone is on the latest 5.07 update or a ROM that is based on the 5.07 update, then latest RUU that exist is for the Evo with RUU Supersonic 4.67. 5.07 never came out, done intentionally by HTC I believe. So none of the RUUs which exist today will work with the 5.07 update. The problem exist because the phone's misc partition is updated whenever you accept an update or run a RUU from HTC, or even flash a ROM. There are other cases as well. The only way to run an official RUU on a phone that is not currently S-OFF is either to downgrade the phone's misc partition, or to turn the phone S-OFF (which you will still have to flash the phone's misc partition to do).
What I've done is put together a quick guide for those who need (or just insist) on unrooting their Evo. It is brief and only for a PC (not a Mac). Hopefully, someone in the future can provide further details or make it Mac friendly or even more user friendly because I don't have a Mac, nor the time to spend to make this guide perfect. I have another phone too to deal with. Remember too, that everything is done at your own risk. So if something goes wrong, well you knew the risks.
For this guide I'm going to assume that you are on Hboot 2.18, the phone is S-ON, the bootloader is unlocked (UNLOCKED), and that the phone's ROM is currently rooted. If not, then this is not the right guide for you.
1. Download this zip file. It contains the necessary files that you will need.
https://dl.dropbox.com/u/38127313/sdk.zip
2. Plug your phone into your computer. Then go to Settings/Applications and uncheck Fastboot. Then goto Development and make sure that USB debugging is now checked. If you have a custom ROM, then the locations of these settings may be slightly different.
If you need the HTC drivers, then I have also included the drivers.exe file that you must run from your computer to install the "MyHtc" drivers that you must have under the computer's device manager when the phone is plug in.
3. Next, unzip the file to a folder, preferably sdk. Rename the "PC36IMG_SuperSonic_GB_Sprint_WWE_4.54.651.1_Radio_2.15.00.0808_NV_2.15_release_220182_signed" file to PC36IMG.zip (not PC36IMG.zip.zip). Place the phone into "Disk drive, then copy the PC36IMG.zip file to your sdcard. Afterwards, don't forget to change the phone back to "Charge only".
4. Next you will need to open a command prompt at the folder where you extracted the files. If you are not familiar or uncomfortable with adb commands, then I cannot help you here.
5. Type or copy the below commands exactly as they appear.
adb push flash_image /data/local <ENTER>
(This places the file on your phone in the /data/local directory).
adb push mtd-eng.img /data/local <ENTER>
(This places the file on your phone in the /data/local directory).
adb shell <ENTER>
(You should see either a dollar sign ($) or a pound sign (#) at your prompt, depending on your ROM. If you do not then something went wrong. And, No the phone will not brick if you should stop at this point).
su <ENTER>
(You might not need this command depending on your ROM, and also you should check to see if your phone is asking for superuser permissions. If everything went Ok, you should now see a pound (#) sign at your prompt. If you do not then something went wrong. And, No the phone will not brick if you should stop at this point).
cd /data/local <ENTER>
(You need to be in the directory where you put the flash_image and mtd-eng.img files).
chmod 755 flash_image <ENTER>
(flash_image needs to be assigned permissions).
./flash_image misc mtd-eng.img <ENTER>
(This is the most critical step here).
reboot bootloader <ENTER>
(I prefer this step, as it is much faster than pulling the battery and all that other stuff that people suggest).
The phone should now reboot directly into the bootloader. Also the phone will now be locked again (LOCKED OWW) regardless of its previous state. Next hit the power button. It will then take some time to read the PC36IMG.zip file. If everything went Ok, then it should ask you whether or not you want to accept the update, which means that your misc partition was successfully downgraded, and now you can successfully run the RUU.
EDIT: I have to re-upload the sdk.zip file, because the original one had a problem with the PC36IMG.zip file. It should be available shortly. The one I added does work this time; however, the phone may have to be updated in order to bring it back to the latest bootloader and update. It's not the latest RUU 4.67, but the second latest 4.54. I cannot believe that something was wrong with that file. Also, instead of the PC36IMG.zip file that I added, you could also use any other PC36IMG.zip file or a RUU.exe file from HTC. They should work as well. I would not recommend a RUU below Supersonic 3.70. I'm going to upload some of these as well when I get a chance. I have like all of them.
Re: How to unroot the latest RUU (5.07)
You should put "[GUIDE]" in the title, right now it seems like a question
Just a thought anyway.
Sent from my PG06100 using xda premium
CNexus said:
You should put "[GUIDE]" in the title, right now it seems like a question
Just a thought anyway.
Sent from my PG06100 using xda premium
Click to expand...
Click to collapse
Thanks for the advice. I'm currently re-uploading the sdk.zip file. Something went wrong with the PC36IMG file. It should be available again in a little while.
I wonder if you can help me?
I have a problem with an Evo I got from someone, it mostly gets stuck in a bootloop but sometimes it actually boots all the way up. As your guide mentioned, I'm not able to RUU because its on the 5.0.7. I think the phone was rooted because it had a few .apk's that require root including su.apk. I did a factory reset while the phone was on a sprint account but it didn't fix the issue........ long story short, I noticed the bootlooping stopped when she got off the phone, so I figured the bootloop was caused by the data running through it or something. Today I turned the phone on and fooled around with it for about an hour before I decided to put it on my pageplus account because my verizon droid razr was stolen yesterday, as soon as I did the esn swap with the pageplus rep the phone started the bootlooping again. So I came across your post and luckily got the phone to boot up and began following your guide...... when i got to the "su" I didn't get "#" sign and permission was denied. I noticed the su.apk was not in the app draw so I downloaded it, I also installed root explorer to see if I get root access, no luck. Since then I can't get the Evo to boot up..... So finally my question, is it possible to execute your guide in fastboot or is there a way to push su through fastboot via adb?
---------- Post added at 09:12 PM ---------- Previous post was at 09:05 PM ----------
6foot5nbad said:
I have a problem with an Evo I got from someone, it mostly gets stuck in a bootloop but sometimes it actually boots all the way up. As your guide mentioned, I'm not able to RUU because its on the 5.0.7. I think the phone was rooted because it had a few .apk's that require root including su.apk. I did a factory reset while the phone was on a sprint account but it didn't fix the issue........ long story short, I noticed the bootlooping stopped when she got off the phone, so I figured the bootloop was caused by the data running through it or something. Today I turned the phone on and fooled around with it for about an hour before I decided to put it on my pageplus account because my verizon droid razr was stolen yesterday, as soon as I did the esn swap with the pageplus rep the phone started the bootlooping again. So I came across your post and luckily got the phone to boot up and began following your guide...... when i got to the "su" I didn't get "#" sign and permission was denied. I noticed the su.apk was not in the app draw so I downloaded it, I also installed root explorer to see if I get root access, no luck. Since then I can't get the Evo to boot up..... So finally my question, is it possible to execute your guide in fastboot or is there a way to push su through fastboot via adb?
Click to expand...
Click to collapse
BTW, Bootloader is still unlocked
If bootloader is unlocked, flash a recovery through fastboot
Code:
fastboot flash recovery path/to/RECOVERY_NAME_HERE
Most likely RECOVERY_NAME will end with ".img" so the command would be like this:
Code:
fastboot flash recovery /path/to/recovery-evo.img
After that, search google for a "zip" file named "su-signed-efghi.zip", look for a hit on goo.im (search "evo 4g su-signed-efghi.zip") and download and place it on your sdcard
Boot into recovery (VolDown + Power, then user volume keys to navigate and power key to select recovery)
Then choose "flash zip" and locate the "su-signed-efghi.zip" file and flash it
You should now have the su binary installed in the correct place
Sent from my PG06100
CNexus said:
If bootloader is unlocked, flash a recovery through fastboot
Code:
fastboot flash recovery path/to/RECOVERY_NAME_HERE
Most likely RECOVERY_NAME will end with ".img" so the command would be like this:
Code:
fastboot flash recovery / path/to/recovery-evo.img
After that, search google for a "zip" file named "su-signed-efghi.zip", look for a hit on goo.im (search "evo 4g su-signed-efghi.zip") and download and place it on your sdcard
Boot into recovery (VolDown + Power, then user volume keys to navigate and power key to select recovery)
Then choose "flash zip" and locate the "su-signed-efghi.zip" file and flash it
You should now have the su binary installed in the correct place
Sent from my PG06100
Click to expand...
Click to collapse
Thanks for your quick response. Been trying that but its been going into a bootloop after I select recovery from hboot. Can't boot into recovery at all I was thinking about using adb to flash a stock recovery but all the recovery.img's i come across.... seem to be for an older hboot and/or system. Also I don't want to attempt anything that will make things worse. I've rooted dozens of Evo's on hboot 2.18 and I have a good Idea of how adb works. I'm wondering if that if I can manage to get S-Off will the phone be able to take an RUU then? or is there anyway to push a older flash_image to trick RUU into updating? I guess the question I should ask is what would you do if your evo would barely boot normally and couldn't get into recovery? the only thing that does work consistently is Hboot and I can't launch recovery through adb nor hboot.
update
6foot5nbad said:
Thanks for your quick response. Been trying that but its been going into a bootloop after I select recovery from hboot. Can't boot into recovery at all I was thinking about using adb to flash a stock recovery but all the recovery.img's i come across.... seem to be for an older hboot and/or system. Also I don't want to attempt anything that will make things worse. I've rooted dozens of Evo's on hboot 2.18 and I have a good Idea of how adb works. I'm wondering if that if I can manage to get S-Off will the phone be able to take an RUU then? or is there anyway to push a older flash_image to trick RUU into updating? I guess the question I should ask is what would you do if your evo would barely boot normally and couldn't get into recovery? the only thing that does work consistently is Hboot and I can't launch recovery through adb nor hboot.
Click to expand...
Click to collapse
I found and exploit on TacoRoot that will get me temp root access without booting into recovery as long as I had an recovery log in /data/data/recovery/log (stock preferably). So I would greatly appreciate if someone can post the file here. I want to attempt to use the exploit to get temp root access then use this guide to get to the point where i can use an RUU.
---------- Post added at 01:22 AM ---------- Previous post was at 01:11 AM ----------
6foot5nbad said:
I found and exploit on TacoRoot that will get me temp root access without booting into recovery as long as I had an recovery log in /data/data/recovery/log (stock preferably). So I would greatly appreciate if someone can post the file here. I want to attempt to use the exploit to get temp root access then use this guide to get to the point where i can use an RUU.
Click to expand...
Click to collapse
Also, I would need help on how to push the recovery log file to /data/data/recovery/log if possible or would it simply be adb push log /data/data/recovery/ ?
An RUU would only work if you had a lower or equal version on your phone than the RUU
As for your actual issue....you cant use adb while its in the bootloader, phone has to be fully booted if you want to do anything with adb
The only thing you can do while in hboot is to use fastboot
Try running:
Code:
fastboot reboot recovery
And see if that gets you into recovery
Sent from my PG06100
CNexus said:
An RUU would only work if you had a lower or equal version on your phone than the RUU
As for your actual issue....you cant use adb while its in the bootloader, phone has to be fully booted if you want to do anything with adb
The only thing you can do while in hboot is to use fastboot
Try running:
Code:
fastboot reboot recovery
And see if that gets you into recovery
Sent from my PG06100
Click to expand...
Click to collapse
Yes, I've tried -fastboot reboot recovery- in fastboot, just goes into a boot loop....... I did get the phone to stay booted overnight, I think as long as the battery is fully charged it stays on, and I can use adb now. The main issue now is that I can't boot into recovery therefore, like I mentioned it just goes into a bootloop and the battery discharges if I let the phone bootloop while trying to boot into recovery. Also, I noticed that the phone won't boot normally unless I have a full charge (Green Light). I think I just need the recovery log file, my thinking is if I can put the log file in the the correct location I can trick the phone into thinking it booted into recovery. If I can get temp root access then I use this guide to relock the bootloader and be able to use an RUU. Do you think that's possible?
---------- Post added at 12:24 PM ---------- Previous post was at 11:59 AM ----------
6foot5nbad said:
Yes, I've tried -fastboot reboot recovery- in fastboot, just goes into a boot loop....... I did get the phone to stay booted overnight, I think as long as the battery is fully charged it stays on, and I can use adb now. The main issue now is that I can't boot into recovery therefore, like I mentioned it just goes into a bootloop and the battery discharges if I let the phone bootloop while trying to boot into recovery. Also, I noticed that the phone won't boot normally unless I have a full charge (Green Light). I think I just need the recovery log file, my thinking is if I can put the log file in the the correct location I can trick the phone into thinking it booted into recovery. If I can get temp root access then I use this guide to relock the bootloader and be able to use an RUU. Do you think that's possible?
Click to expand...
Click to collapse
I forgot to mention, the TacoRoot Exploit requires the recovery log file (http://rootzwiki.com/topic/13713-tacoroot-htc-universal-root-exploit-12-30-2011/) to be in /data/data/recovery/ directory, so it requires a user to boot into recovery to create the log file, and I can't boot into recovery.... so my idea is to push the recovery log file to /data/data/recovery/log cause thats where the exploit is looking for the log file. I'm hoping that will prevent me from having to boot into recovery which is where I'm getting stuck on the tacoroot exploit. With shortydoggs guide, I'm getting stuck at the "su" command cause the evo (for some reason) isn't rooted anymore. So my plan is to get me temp root with TacoRoot so I can get "#" and continue with shortydoggs guide. Not sure if that's possible but at this point its my only option since I can't get into recovery to flash su.zip nor can I RUU cause I'm on 5.0.7 which has no RUU.
I can give you the file, but it's hard to get it to work without that recovery. You have to extract out of the zip file and then push it to the /data/data/recovery directory. I tried it myself and I can adb push it, but when doing the tacoroot --root, I get an error "/data/local/tacoroot.sh: cannot create /data/local.prop: permission denied".
EDIT: I uploaded the two files that you need. You need to unzip the two files. Then push the log file to the /data/data/recovery directory, and the local.prop file to the /data/ directory. Getting them there will be up to you, as I'm not the most Linux educated person out there. I'm only able to push the files because my phone is already rooted. Hopefully you figure it out or someone more familiar with Linux (adb) commands can help you. Then, the "adb shell /data/local/tacoroot.sh --root" command is a breeze.
Code:
adb push tacoroot.sh /data/local/tacoroot.sh
adb shell chmod /data/local/tacoroot.sh
adb shell sh /data/local/tacoroot.sh --setup
#should give an error after line above, its fine because you're pushing the local.prop yourself
adb push local.prop /data/local.prop
adb shell sh /data/local/tacoroot.sh --root
If anything goes wrong or it doesnt work, run this to revert
Code:
adb shell sh /data/local/tacoroot.sh --undo
I would've posted the tacoroot.sh for you since I use it in my shift utility to root your phone, but I wasn't sure if it was universal for all HTC devices or just for the evo shift. Sorry about that.
Sent from my PG06100
Thanks!!!
shortydoggg said:
I can give you the file, but it's hard to get it to work without that recovery. You have to extract out of the zip file and then push it to the /data/data/recovery directory. I tried it myself and I can adb push it, but when doing the tacoroot --root, I get an error "/data/local/tacoroot.sh: cannot create /data/local.prop: permission denied".
EDIT: I uploaded the two files that you need. You need to unzip the two files. Then push the log file to the /data/data/recovery directory, and the local.prop file to the /data/ directory. Getting them there will be up to you, as I'm not the most Linux educated person out there. I'm only able to push the files because my phone is already rooted. Hopefully you figure it out or someone more familiar with Linux (adb) commands can help you. Then, the "adb shell /data/local/tacoroot.sh --root" command is a breeze.
Click to expand...
Click to collapse
Thank you and CNexus. I'll try it and let you know how it went. I probably will fool around with it tomorrow sometime so I'll get back to you then. Going back a little, after I pushed flash_image and mtd-eng.img to data/local/, I noticed a blue status bar while in hboot, I'm assumming its searching for the pg36img.img update...... that said, is it necessary to push those files again?? BTW, great guide and write up. Thanks for everything. http://forum.xda-developers.com/images/smilies/good.gif
---------- Post added at 10:51 PM ---------- Previous post was at 10:46 PM ----------
Thanks for your help, I'll let you know how it goes tomorrow.
CNexus said:
Code:
adb push tacoroot.sh /data/local/tacoroot.sh
adb shell chmod /data/local/tacoroot.sh
adb shell sh /data/local/tacoroot.sh --setup
#should give an error after line above, its fine because you're pushing the local.prop yourself
adb push local.prop /data/local.prop
adb shell sh /data/local/tacoroot.sh --root
If anything goes wrong or it doesnt work, run this to revert
Code:
adb shell sh /data/local/tacoroot.sh --undo
I would've posted the tacoroot.sh for you since I use it in my shift utility to root your phone, but I wasn't sure if it was universal for all HTC devices or just for the evo shift. Sorry about that.
Thanks for your help, I'll let you know how it goes tomorrow.
Sent from my PG06100
Click to expand...
Click to collapse
Hi, Just wondering if you would mind re-uploading the original files? The link is broken, and I'd really like to unroot my phone, so it would be really appreciated. Thanks heaps!
Ok guys I am having a brain fart or something. I have everything in the same directory and have my phone in the correct screen. When I do the command prompt and type adb sideload update.zip, it says the command is not recognized. Also using the adb devices check, there are no devices listed as being connected. I have debugging turned on also. Now from messing around with the framework ota trick which obviously didn't work like 4.2.2, my play store will not connect to the server for updates. Hope this is an easy fix, thanks!
PS: I am 100% stock never rooted or anything else
I am thinking the problem is my phone is not being recognized by my pc, but when it's turned on and connected it shows up just fine...
The command prompt has to be looking in the same folder as adb unless you have adb/fastboot in your system path
EddyOS said:
The command prompt has to be looking in the same folder as adb unless you have adb/fastboot in your system path
Click to expand...
Click to collapse
I have everything in the same folder including the renamed update.zip folder. I open the prompt when the folder is open and the path matches on the prompt screen as well.
And you have the latest version of adb (v1.0.31)? And the PC can see the device when using 'adb devices'?
Will adb sideloading cause future problems ??
I'm an impatient noob waiting endlessly for 4.3 ota to arrive.. downloaded 4.3 ota and planning to adb sideload it.
will doing so erase my data/ make my fone incapable of receiving future ota updates like 4.3.x or even 5.0 ??
pl help me..
Sideload question..
I used ADB to manually push each firmware from 4.1.2 to 4.3 without unlocking or SU,
I like being able to reinstall older firmwares.. but recently found out I have to unlock to downgrade so I can,
whats is sideloading used for? is it the same as ADB? adb talks to ur pc.. sideloading seems different idk
Hello, I downgraded to MK3 to root my device and succeeded. However, I no longer have any networking that works. The guide here says to put in this cmd code to fix it, but doesnt tell you where to do it. I tried with my device connected on CMD but it won't work at all. He gives no instructions on how to do it. http://forum.xda-developers.com/showthread.php?t=2663545
Could someone please help me with this?
Laemon said:
Hello, I downgraded to MK3 to root my device and succeeded. However, I no longer have any networking that works. The guide here says to put in this cmd code to fix it, but doesnt tell you where to do it. I tried with my device connected on CMD but it won't work at all. He gives no instructions on how to do it. http://forum.xda-developers.com/showthread.php?t=2663545
Could someone please help me with this?
Click to expand...
Click to collapse
There are 3 methods posted there? Didnt you try at least method 2?
Ensure that "adb devices" in CMD detects your phone being connected.
Code:
adb push bypasslkm /data/local/tmp
adb shell
cd /data/local/tmp
chmod 755 bypasslkm
./bypasslkm
jmjoyas said:
There are 3 methods posted there? Didnt you try at least method 2?
Ensure that "adb devices" in CMD detects your phone being connected.
Code:
adb push bypasslkm /data/local/tmp
adb shell
cd /data/local/tmp
chmod 755 bypasslkm
./bypasslkm
Click to expand...
Click to collapse
I used the second method and got it working, didnt realize they were talking about different methods. However, now my sim card isn't working. No networks besides wifi.
Laemon said:
Hello, I downgraded to MK3 to root my device and succeeded. However, I no longer have any networking that works. The guide here says to put in this cmd code to fix it, but doesnt tell you where to do it. I tried with my device connected on CMD but it won't work at all. He gives no instructions on how to do it. http://forum.xda-developers.com/showthread.php?t=2663545
Could someone please help me with this?
Click to expand...
Click to collapse
You phone must be previously NB1 and you need to root so you downgrade to MK2, root, and instal safestrap.
Your post appears that you finished steps 1 through 7..
Your bootloader is in NB1 but your modem and kernel is in MK2 so your wifi would not work.
To fix it , either you go back to NB1 or use the bypass exploit.
if you had made a NB1 backup before you odin you can restore that back up. That is for the step 8.
If you want to go back to NB1 use the file in the post #2 and follow the instruction on post #3.
if you want to stay in MK2 you can use adb (android debug bridge) to fix the wifi problem . That is for the step 9.
Search adb on the net and get the adb files. go to command mode with admin, start the adb connect your phone and check your device is listed in the adb.
Then enter the codes that mentioned on the page step by step.
If you had never use the adb before I would go back to NB1.
I've decided to give up, having too many problems and been at it for 5 hours to 6 hours. Updated back to 4.4.2 and will simply look to root before installing updates on the next device I buy.