Jump to content

  1. 0
  2. 0
  3. 0/5

Rate this Topic

- - - - -

root 2.3.4,downgrade,and regain s-off

  • Please log in to reply

OP scotty85

scotty85

Average Android

  • 85 posts

Posted 16 October 2011 - 01:40 PM #1

i cant take credit for any of this,i just took it all from different places and put it all here. unfortunately,i cant gaurantee that this will work for everyone. but several have succesfully downgraded and regained s-off.

its intended for someone who has no adb experinece,and is overwhelmed at the thot of downloading and installing the SDK. if your proficient at adb,your welcome to pull flash_image and mtd0 out,and place them in tools,platform tools,or wherever you usually push files from,rather than changing to the mini-adb_inc directory.

thots and feed back are welcome. ive had this guide up here on AF for a few days. ill try and provide support here as well,but please underdstand computer time is limited these days and i dont make it here as often. in otherwords,please help each other out :)

first and foremost,giving proper credit to all that deserve it:
*alpharev and unrevoked for all they for the root community :cool:
-efizzle for getting the ball rolling in this thread on xda by figuring out that an older version of unrevoked would get superuser access on 2.3.4
-iowabowtech for point me in the direction of this thread that i collected the misc image,and parts of the guide
-sele and the crew in the "rescue squad" on the thunderbolt forum for what i like to call the "mini-adb" concept.
-rooter28 for testing and keeping me updated as he made progress. hopefully he will stop in and help answer questions :)
-mkreiger for fearlessly jumping in to be the second official tester
-whomever origianlly came up with the images and guide linked above. if i can figure out who this was,ill add you in later.
-prolly more,im sure there will be several edits of this.

1)download these files,and save them somewhere you can easily find them:

unrevoked 3.22 unrevoked 3.22
md5: 5760fbe8ed6d44752e78433252f2d5b2

unrevokeds modified usb drivers public:windows_hboot_driver_install [RootWiki]

mini-adb_inc(contains misc image,flash image,and some basic adb tools)Multiupload.com - upload your files to multiple file hosting sites!
md5: a793cc0142e1cd18f60849894bbc47cd

PB31IMG for 2.2 PB31IMG.zip
md5: 31bb1611a0fa8197d447c0438426717e

clockwork 5.0.2.0 Multiupload.com - upload your files to multiple file hosting sites!
md5: e8ac35ddc1c37000bb0852d1f380b5bb

**make sure to check the md5 sums match those listed!**
if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: Home of the MD5summer

2)root with unrevoked 3.22
-open the recovery-clockwork-5.0.2.0-inc_PB31IMG download. extract it first if you need to. inside there is an image called "recovery-clockwork-5.0.2.0-inc". right click on this image,then click "copy". navigate to a directory you can easily find it,then right click in that directory,then "paste". alternatively,you can drag it from the extracted folder to a convienient spot(i personally like to drag files around,but its fine either way).
-use your md5 summer to verify the md5 of just the image,not the whole .zip. it should be: ea382ca5809cb872d0582aa22741d592
-install the drivers as described on unrevokeds page above.
-place your phone in charge mode,and make sure usb debugging is checked ON in settings/applications/development.
-extract the contents of the unrevoked 3.22 .zip. open the folder, right click on "reflash" and run as administrator if possible.
-click on "file" in the corner of the relfash window
-click custom recovery
-navigate to,and select your "recovery-clockwork-5.0.2.0-inc" image and select it. at the bottom of your reflash app window, it should now say "recovery:custom" and "waiting for device"
-plug in your phone,and assuming you installed the drivers correctly,unrevoked 3.22 will start. let it do its thing. it will reboot a couple of times. when its finished,it may leave you on a blank screen. if this is the case,pull the battery and reboot.
-you should now have the superuser app in your app drawer. if so,go to settings/applications/manage apps/superuser and clear data. test that superuser is working and granting permissions by downloading rom manager,and using it to flash the newest clockwork recovery. alternatively,download and run a "root checker" or any of your favorite "root only" apps and make sure they work.
-once you get "successfully flashed clockwork recovery" boot to it and make a backup,since downgrading to get s-off WILL wipe all your data. boot back into the operating system.
*special note to slcd users: this version of unrevoked is installig an old, non-compatible version of clockwork,so you will just see a black screen if you do not install newer clockwork as described above.
-if you plan to install a custom rom after downgrading,now is a good time to download titaium backup,and its pro key(WELL worth the $$) and do a batch backup of all your user apps and app data(no system data)

*at this point,you could just enjoy root access without doing anything else. if all you care about is using a couple of root only apps,and deleting some bloatware,you can remain rooted and s-on if youd like. id personally reccomend to downgrade and become s-off in case future OTAs knock out your root access.

3)prepare to downgrade
-extract the mini-adb_inc .zip. place the extracted folder on the root of your c\ drive. it comtains mtd0,flash_image,and some adb tools.
-place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG. now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting WILL wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.

4)downgrade with adb. make sure your phone is charged to 100% before starting.
-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.

at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.

-make sure phone is plugged in and usb debugging checked on,in charge only mode

-at the promt in your command window:

cd c:\mini-adb_inc this should change your command promt to "mini-adb_inc",indicating youre using that directory.
adb devices this should output your phones serial number,indicating its recognized

md5sums mtd0.img it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839

md5sums flash_image again,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a

*both those numbers must match exactly. if they do then you can procede.


adb push flash_image /data/local/
adb push mtd0.img /sdcard/

adb shell your prompt should change to a #. if it changes to a $,then type su note your phone may pop up a message asking you to allow permissions the first time you do this. if it does check "always" and touch "allow" on the superuser request on the phone screen.

cd /data/local
chmod 0755 /data/local/flash_image

cd /data/local
./flash_image misc /sdcard/mtd0.img

you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off

exit to get out of your adb shell,and back to the "mini-adb_inc" prompt

adb reboot bootloader this will boot your phone to "fastboot" select "bootloader" with the power button.

hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.

let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.

download unrevoked forever from here: unrevoked3 recovery reflash tool, v3.32

run it as you did the previous version. this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.

if you wish to return to where you were,sign into google,download rom manger,flash the latest clockwork recovery. boot to recovery,then restore the back you made before we started.

optionally,you can now install the custom rom of your choice,along with a new recovery and radio if you desire. :)

and heres what you will see when entering the commands(the red are my copy/paste's):

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Scott>[COLOR="Red"]cd c:\mini-adb_inc[/COLOR]

c:\mini-adb_inc>[COLOR="red"]adb devices[/COLOR]
List of devices attached
HT07DHJ02777    device


c:\mini-adb_inc>[COLOR="red"]md5sums mtd0.img[/COLOR]

MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help

[Path] / filename                              MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
mtd0.img                                       34307be744275f1db1dd16af04c37839

c:\mini-adb_inc>[COLOR="red"]md5sums flash_image[/COLOR]

MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help

[Path] / filename                              MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
flash_image                                    0098a7dd6600b55fac34fc6645be5d7a

c:\mini-adb_inc>[COLOR="red"]adb push flash_image /data/local/[/COLOR]
1547 KB/s (76044 bytes in 0.048s)

c:\mini-adb_inc>[COLOR="red"]adb push mtd0.img /sdcard/[/COLOR]
1662 KB/s (655360 bytes in 0.385s)

c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
$ [COLOR="red"]su[/COLOR]
su
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]chmod 0755 /data/local/flash_image[/COLOR]
chmod 0755 /data/local/flash_image
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]./flash_image misc /sdcard/mtd0.img[/COLOR]
./flash_image misc /sdcard/mtd0.img
# [COLOR="red"]exit[/COLOR]
exit
$ [COLOR="red"]exit[/COLOR]
exit

c:\mini-adb_inc>[COLOR="red"]adb reboot bootloader[/COLOR]

c:\mini-adb_inc>

Edited by scotty85, 16 October 2011 - 02:12 PM.

  • 1 Likes

OP scotty85

scotty85

Average Android

  • 85 posts

Posted 16 October 2011 - 01:41 PM #2

this is for folks who for whatever reason,unrevoked 3.22 does not work to get them root access.

this could also be used if youve got a replacement device thats not setup,and you could care less about installing a recovery. this still requires unrevokeds drivers to be set up,so you can root with unrevoked 3.32 after downgrading,but otherwise,it prolly is a lil quicker since you dont need to download and run unrevoked 3.22.

alternately,use this if you just like ADB :D if your proficient in adb,feel free to remove the images from mini-adb_inc,and place them and the zergRush tool into whatever folder you typically push files from.

like above,this is intended for someone whose never installed ADB or entered command lines before.

1)download these files,and save them somewhere you can easily find them:

unrevokeds modified usb drivers public:windows_hboot_driver_install [RootWiki]

mini-adb_inc(contains misc image,flash image,and some basic adb tools)Multiupload.com - upload your files to multiple file hosting sites!
md5: a793cc0142e1cd18f60849894bbc47cd

PB31IMG for 2.2 PB31IMG.zip
md5: 31bb1611a0fa8197d447c0438426717e

zergRush tool from xda: Revolutionary - zergRush local root 2.2/2.3 - xda-developers
md5: 12c52b97e75e73595b325c03610b3380

**make sure to check the md5 sums match those listed!**
if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: Home of the MD5summer

3)prepare to downgrade
-extract the mini-adb_inc .zip. place the extracted folder on the root of your c\ drive. it comtains mtd0,flash_image,and some adb tools.
-extract zergRush.zip. take the image inside,and either copy/paste or drag it into your mini-adb_inc folder
-place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG. now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting WILL wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.

4)downgrade with adb. make sure your phone is charged to 100% before starting.
-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.

at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.

-make sure phone is plugged in and usb debugging checked on in charge only mode

-at the promt in your command window:

cd c:\mini-adb_inc this should change your command promt to "mini-adb_inc",indicating youre using that directory.
adb devices this should output your phones serial number,indicating its recognized

md5sums mtd0.img it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839

md5sums flash_image again,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a

md5sums zergRush again,output stuff, then this number: 3cf8a3fbceb667121d91f4ef1a66684c

*all those numbers must match exactly. if they do then you can procede.


adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush

this will cause zergRush to start,and it shoudl say "found a gingerbread!" followed by a bunch of other funny stuff.

last thing it says will be: Killing ADB and restarting as root... enjoy!

you should then be returned to your "mini-adb_inc>" prompt


adb push flash_image /data/local/
adb push mtd0.img /sdcard/

adb shell your prompt should change to a #

cd /data/local
chmod 0755 /data/local/flash_image

cd /data/local
./flash_image misc /sdcard/mtd0.img

you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off

exit to get out of your adb shell,and back to the "mini-adb_inc" prompt

adb reboot bootloader this will boot your phone to "fastboot" select "bootloader" with the power button.

hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.

let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.

download unrevoked forever from here: unrevoked3 recovery reflash tool, v3.32

run unrevoked(extract the contents,right click on "reflash",run as adminstrator if possible). this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.

and heres what you should see when entering the commands(my copy/pastes are in red):

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Scott>[COLOR="Red"]cd c:\mini-adb_inc[/COLOR]

c:\mini-adb_inc>[COLOR="red"]adb devices[/COLOR]
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
HT117HJ00242    device


c:\mini-adb_inc>[COLOR="red"]md5sums mtd0.img[/COLOR]

MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help

[Path] / filename                              MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
mtd0.img                                       34307be744275f1db1dd16af04c37839

c:\mini-adb_inc>[COLOR="red"]md5sums flash_image[/COLOR]

MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help

[Path] / filename                              MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
flash_image                                    0098a7dd6600b55fac34fc6645be5d7a

c:\mini-adb_inc>[COLOR="red"]md5sums zergRush[/COLOR]

MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help

[Path] / filename                              MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
zergRush                                      3cf8a3fbceb667121d91f4ef1a66684c

c:\mini-adb_inc>[COLOR="red"]adb push zergRush /data/local/[/COLOR]
1150 KB/s (21215 bytes in 0.018s)

c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
$ [COLOR="red"]chmod 755 /data/local/zergRush[/COLOR]
chmod 755 /data/local/zergRush
$ [COLOR="red"]/data/local/zergRush[/COLOR]
/data/local/zergRush

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x00015108
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219e4 0x006c
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd158bf 0xafd1ace3
[*] Sending 149 zerglings ...

[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!

c:\mini-adb_inc>[COLOR="red"]adb push flash_image /data/local/[/COLOR]
1547 KB/s (76044 bytes in 0.048s)

c:\mini-adb_inc>[COLOR="red"]adb push mtd0.img /sdcard/[/COLOR]
1017 KB/s (655360 bytes in 0.629s)

c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]chmod 0755 /data/local/flash_image[/COLOR]
chmod 0755 /data/local/flash_image
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]./flash_image misc /sdcard/mtd0.img[/COLOR]
./flash_image misc /sdcard/mtd0.img
#[COLOR="red"] exit[/COLOR]
exit

c:\mini-adb_inc>[COLOR="red"]adb reboot bootloader[/COLOR]

c:\mini-adb_inc>

edit:apparently the zergRush tool has changed. ive included the new md5s,so hopefully there wont be any more confusion like the old md5s caused earlier. be aware of this,however, in case they do change again. you are right to be cautious if it doesnt match,so ill do my best to keep up with it.

Edited by scotty85, 21 October 2011 - 02:20 PM.

  • 0 Likes

gu1dry

gu1dry

Supporting Member

Posted 17 October 2011 - 06:24 PM #3

Why not link to the official source for the ClockworkMod Recovery, link (md5: ea382ca5809cb872d0582aa22741d592) & the official source for unrevoked, link or link....
  • 0 Likes

Ink'd_rooter

Ink'd_rooter

Android Beginner

  • 11 posts

Posted 17 October 2011 - 07:48 PM #4

Why not link to the official source for the ClockworkMod Recovery, link (md5: ea382ca5809cb872d0582aa22741d592) & the official source for unrevoked, link or link....


Because the version of unrevoked needed to gain root on 2.3.4 is an older version 3.22 and is not available from source. After root is obtained and a successful downgrade then the current unrevoked. Will work to obtain s off.
  • 1 Likes

JonElCanche

JonElCanche

Android Beginner

  • 39 posts

Posted 18 October 2011 - 07:43 PM #5

I had the incredible connected when I started unrevoked and it instantly started running and rebooting the incredible. Now I am stuck in a bootloop. Any ideas?
  • 0 Likes

OP scotty85

scotty85

Average Android

  • 85 posts

Posted 19 October 2011 - 03:39 AM #6

if you are unable to boot normally after removing the battery for a couple minutes,youll have to run a gingerbread RUU or PB31IMG file.

did you unplug your phone in the middle of unrevoked doing something? i cant imagine what simply running it could have done to cause a bootloop,unless it was altering files in /system and you interupted it.

i cant look for and link a GB RUU for you at the moment,hopefully one of the guys can link it if you cant find it...
  • 0 Likes

Gootz66

Gootz66

Android Addict

Posted 19 October 2011 - 08:56 AM #7

Curious as to why Unrevoked 3.22 was chosen over current 3.23? Did I miss something?
  • 0 Likes

BB Curve 8330>BB Storm 9530>BB Storm 9550>HTC Incredible>Galaxy Nexus>iPhone4s


Ink'd_rooter

Ink'd_rooter

Android Beginner

  • 11 posts

Posted 19 October 2011 - 05:17 PM #8

The 3.22 for some reason have root access on 2.3.4. That allows the downgrade then the newest unrevoked will work after the downgrade since a compatible radio is now installed. There is no known direct method on 2.3.4 as of now.
  • 2 Likes

Ink'd_rooter

Ink'd_rooter

Android Beginner

  • 11 posts

Posted 19 October 2011 - 05:19 PM #9

Also 3.22 will only give root not s off on 2.3.4.
  • 1 Likes

OP scotty85

scotty85

Average Android

  • 85 posts

Posted 20 October 2011 - 04:06 PM #10

Curious as to why Unrevoked 3.22 was chosen over current 3.23? Did I miss something?



it was picked,as ink'd said,because its the one that happens to work ;)

again,i cant take any credit. efizzle on xda spent several hours trying old versions until 3.22 happened to work. i have no idea why this particular one works,and ones before and after dont. an old saying about looking a gift horse in the mouth comes to mind ;)

unfortunately,this version is still not compatible with the gingerbread radio,so it will not install s-off,and nor will flashing the forever patch. the downgrade is needed to regain s-off with 3.32,at least until unrevoked can support the new baseband.

Edited by scotty85, 21 October 2011 - 03:15 AM.

  • 0 Likes