[Q] Downgrading HBOOT 1.5 --> 1.4 - HTC EVO 3D

so I'm thinking about the 1.5 issue and had a thought. On the shift it was possible to temp root to gain access to the partition where the hboot resides, using the process in this thread (not my work)
http://forum.xda-developers.com/showthread.php?t=1255474
we're able to gain access, find the address, and then flash a new hboot. after that using the rooting method you can gain perm normal root.
any thoughts on if this would work?

ekz13 said:
so I'm thinking about the 1.5 issue and had a thought. On the shift it was possible to temp root to gain access to the partition where the hboot resides, using the process in this thread (not my work)
http://forum.xda-developers.com/showthread.php?t=1255474
we're able to gain access, find the address, and then flash a new hboot. after that using the rooting method you can gain perm normal root.
any thoughts on if this would work?
Click to expand...
Click to collapse
the shift didn't have all the partitions nand write locked like the EVO 3D does.
1st time around: shift didnt 'have nand write lock on the hboot partition, hence being able to temp root and directly flash eng hboot to the hboot partition.
2nd time around: shift didn't have the nand write lock on the misc partition, hence being able to temp root and flash a lower version to the misc partition then hboot would allow a downgraded version of software to be loaded.
esseentially it seems as if htc was doing the bare minimum to protect the shift from being unlocked/rooted as all these methods were known and some were used on the HTC EVO prior to the shift software releases.
this has been covered a few times on the forums, but i hope rehashing old ideas/attempts might spark new ones! sometimes it only takes a slight tweak to an old method for it to bypass a patch and work! hope that helps!

ah ok, gotcha, I had seen the threads on the downgrading thing, but they were a bit old and wasn't sure if the shift downgrade method was looked at as a viable option, but that makes sense as you explained it. I understand the process and methodology however, not the commands required to try it so I had the thought bouncing around and had to put it down to see if the "smart folks" might see something I missed. well, we'll see how it plays out.. it's interesting in the big picture to see how the devs always manage to find some loophole or crack in big businesses coding to develop the workaround, then they close, they find, round and round we go..

Related

[A] What S-OFF does, what root does

OK, about sixteen million posts have been flying back and forth about what you can do with root, can't do, what S-OFF is, is not... So I'm going to try to clear it all up for you, OK?
ROOT means you have full control over the OS. From the OS, you can write to the recovery partition. Without root, the only way to write recovery is through hboot, which will only let you flash a custom recovery if you have S-OFF. But even with S-ON, you can write recovery from the OS if you have root. Then, with a custom recovery, you can write the hboot with an engineering bootloader, which has S-OFF. This way, you get S-OFF without a warranty-voiding watermark.
S-OFF means you can flash a custom recovery or ROM from hboot. Things you could already do with root, except that it's hard to get root while S-ON. But if you get it, you're set.
HTC says they'll ship an update which sets S-OFF, and then we're set, except their update will almost assuredly drop a watermark and void the warranty.
ANALOGY: Say the phone is a fortress, and you're trying to get in. S-ON means the gate is shut. If you root it with S-ON, you do it with an exploit, so you find a weak spot in the wall and pack it full of C4 and BOOM, you're in. S-OFF means they opened the gate from the inside, and you just walked in. Either way (S-OFF or root) you're in.
SUMMARY: With S-OFF, you get everything. With root, you get everything. End of story.
Final comment: rooting with S-ON means you used an exploit. Exploits are bad!! But HTC is forcing us to resort to such brutish, nasty means (blowing up walls to the fortress) because they locked the gate before selling us the place. We have a right to get inside, but they aren't opening the gate, so we have to get in some other way. Remember, if you can blow up the wall and walk in, a malicious program can do so too. Exploits are bad, and HTC should patch them. But let's get some legitimate use out of them first, ehhh?
Tell that to the droidx users, they love their custom kernels ;p
Overall good info, thank you for taking the time to type it up
DigitalPioneer said:
OK, about sixteen million posts have been flying back and forth about what you can do with root, can't do, what S-OFF is, is not... So I'm going to try to clear it all up for you, OK?
ROOT means you have full control over the OS. From the OS, you can write to the recovery partition. Without root, the only way to write recovery is through hboot, which will only let you flash a custom recovery if you have S-OFF. But even with S-ON, you can write recovery from the OS if you have root. Then, with a custom recovery, you can write the hboot with an engineering bootloader, which has S-OFF. This way, you get S-OFF without a warranty-voiding watermark.
S-OFF means you can flash a custom recovery or ROM from hboot. Things you could already do with root, except that it's hard to get root while S-ON. But if you get it, you're set.
HTC says they'll ship an update which sets S-OFF, and then we're set, except their update will almost assuredly drop a watermark and void the warranty.
ANALOGY: Say the phone is a fortress, and you're trying to get in. S-ON means the gate is shut. If you root it with S-ON, you do it with an exploit, so you find a weak spot in the wall and pack it full of C4 and BOOM, you're in. S-OFF means they opened the gate from the inside, and you just walked in. Either way (S-OFF or root) you're in.
SUMMARY: With S-OFF, you get everything. With root, you get everything. End of story.
Final comment: rooting with S-ON means you used an exploit. Exploits are bad!! But HTC is forcing us to resort to such brutish, nasty means (blowing up walls to the fortress) because they locked the gate before selling us the place. We have a right to get inside, but they aren't opening the gate, so we have to get in some other way. Remember, if you can blow up the wall and walk in, a malicious program can do so too. Exploits are bad, and HTC should patch them. But let's get some legitimate use out of them first, ehhh?
Click to expand...
Click to collapse
Well stated. I'm looking for a picture to illustrate said procedures and chuck that up here. (Only half-joking)
Can you detail a bit more about watermarks? If you have root, can't you clean up the watermarks? Idk obviously, but I'm really interested in learning about this stuff.
Thanks!!
...adjusting to life without the trackball
guyandhisdog said:
Well stated. I'm looking for a picture to illustrate said procedures and chuck that up here. (Only half-joking)
Can you detail a bit more about watermarks? If you have root, can't you clean up the watermarks? Idk obviously, but I'm really interested in learning about this stuff.
Thanks!!
...adjusting to life without the trackball
Click to expand...
Click to collapse
AFAIK (read: I don't know for sure) there is no way to remove a watermark once it's on (without modding hardware). I believe a watermark is put on by physically modifying the hardware (like blowing a fuse) so that it can't be reverted. But that's a vague memory of something I heard once, so I could be completely wrong.
Much better to not get one in the first place.
DigitalPioneer said:
AFAIK (read: I don't know for sure) there is no way to remove a watermark once it's on (without modding hardware). I believe a watermark is put on by physically modifying the hardware (like blowing a fuse) so that it can't be reverted. But that's a vague memory of something I heard once, so I could be completely wrong.
Much better to not get one in the first place.
Click to expand...
Click to collapse
That clears things up a bit. I 2 was wondering about the watermark. I assumed that is was software related but was just encrypted with hash so it was unable to be edited. It would truly suck if it was hardware related : (
LOL that is a win analogy indeed, I am still ROFL'ing. Thank you.
thank you for the infor it help me
Can't write to the recovery yet until we have s-off. If you can get root while booted in to the recovery on the other hand, the hboot unlocks everything for it so the phone would be wide open. At least, that's how it used to be; they may have changed it.
Sent from my PG86100 using XDA Premium App

Need Help researching Hboot Downgrade from 1.5

Ok, so over on the Shift forums, they stumbled upon a way to downgrade your device to allow nand unlocking. *All credit goes to ScaryGhoul, and Otaking71*
Basically by using a temproot method (which the 3D has), and using a misc.img partition from another phone (The Tbolt for this instance), they were able to trick the Hboot security check into allowing older RUU's to be run against the device.
According to Scary, and Otaking the dev work behind this should work for other devices, as long as you are able to identify which BLK houses the hidden partition that Hboot uses to check everything it flashes. As they outlined it is usually "misc", or hboot -1, in the case of the Evo shift, their Hboot partition is mmcblk0p18, so since the hidden partition is hboot -1, it would be mmcblk0p17.
Following their theory, If someone is willing to try this we would need to know which partition the Evo 3D uses for Hboot, we would also need to know if the 3D uses emmc or mtd blocks. If it is emmc the same commands with the proper mmc blocks will work, if it is mtd, we would need to reference the original EVO 4G root method to figure out how to force the hboot to bypass the security checks.
Here is the full post laying out the ground work necessary, including reference to the original Evo 4G root method. http://forum.xda-developers.com/showthread.php?t=1255474
If this works, then it will allow us to run the original RUU for the Evo 3D, essentially downgrading the device from Hboot 1.5 to Hboot 1.30, which then allows the device to be rooted with Revolutionary instead of being forced to use HTC's Unlock method.
Is there anyone out there willing to help dig into this, to see if we can roll back the Hboot of the Evo 3D to allow revolutionary to root it?
---------- Post added at 05:46 PM ---------- Previous post was at 05:29 PM ----------
The direction I am going with this is, If we can force the Hboot to allow downgrades, then that should mean that we should technically be able to force the hboot to downgrade itself, theoretically taking the hboot from 1.50 to 1.30 or 1.40 depending on whichever one you can get your hands on. Also here is some more info added to the whole wrack your brain process this is becoming. Also please ignore my odd way of thinking, I'm trying to think whether or not this is possible, while at the same time gathering data and trying to formulate a process to make it work. I could be entirely wrong about the whole thing, but you never know until you have it looked into and reviewed.
So first step to digging, It looks like the Evo 3D does indeed have emmc partitions http://forum.xda-developers.com/showthread.php?t=1197315
Which makes using their method easier to accomplish.
otaking71 said:
I accidentally figured this out.
You'll need temp root on the phone. Use any temp rooting method.
Push the extracted misc.img file to the sdcard.
Once you have root, dd the misc.img to the partition just above hboot.
In the case of the shift and the thunderbolt this is /dev/block/mmcblk0p17
Once this is done..you can proceed to use any ruu (the full executable) or any properly signed AND named zip from hboot.
This has only been tested on the shift...but the theory is sound. If you are doing this on anything other than a shift/tb....please check the size of the partition just above hboot.
Click to expand...
Click to collapse
We should also be able to use the misc.img file from the Tbolt that they used, as long as the size doesnt conflict with the 3D, the version is lower than that of the 3D, so it is still staying true to their groundwork.
So now knowing all of this, we just need someone willing to perform this to try and see if the HBoot can be downgraded accordingly since sofar everything is appearing to line up nicely.
The other question I would then propose is, If this is possible, could it work for 3D's that were unlocked using HTC's method. ie. Unlock with HTC's method, flash a rooted ROM, perform the hboot security bypass using the misc.img file. Then run an RUU that is from the 1.30 or 1.40 HBoot to return the device back to stock, after re-root using revolutionary.
One final thing, The only reason I am bringing this straight to the community without diving into it myself, is that I presently don't have a 3D to work with, but at the same time was tasked by several people that Have 3D's that took the OTA to HBoot 1.50, to see if there was a way to revert the process. That and I have no idea which mmcblk is the hboot partition for the 3D.
Sorry but this was one of the first things that was tried and multiple people have confirmed it's a no go. A little searching should be able to pull up some of the older threads that have more info about it in them.
Sent from my PG86100 using xda premium
xHausx said:
Sorry but this was one of the first things that was tried and multiple people have confirmed it's a no go. A little searching should be able to pull up some of the older threads that have more info about it in them.
Sent from my PG86100 using xda premium
Click to expand...
Click to collapse
Thanks, yeah I searched but didn't will admit didn't look as hard as I should have.
Sent from my PC36100 using Tapatalk
xHausx said:
Sorry but this was one of the first things that was tried and multiple people have confirmed it's a no go. A little searching should be able to pull up some of the older threads that have more info about it in them.
Sent from my PG86100 using xda premium
Click to expand...
Click to collapse
I just looked into what you posted xHausx, and I can only find threads where people tried to just flash a new Hboot ontop of the 1.50 HBoot, however this is known not to work because HTC does not fully unlock the HBoot, What I am proposing is forcing the HBoot to act like it is 100% unlocked to allow downgrading by using the misc.img file from the TBolt, like they did with the Evo Shift, I searched and searched, and cannot find anyone even attempting to modify the security of the HBoot -1 partition by using an unlocked bootloader from another device. So I am bringing this theory back up for testing, and for someone to show me where this method was tried and failed. Since as mentioned, I can only locate attempts to flash a bootloader ontop of a still locked bootloader.
If this is viable then it should also be useful for GSM E3D right?
Actually there is no temp root for updated Evo 3D's with 1.50 HBOOT and 2.3.4...HTC patched the exploit that was used to gain temp root. The only way this will work is if you already used HTC's unlocking method and use a rooted ROM. I am still on 1.40 and can't help(I probably wouldn't be much use anyway), but I would get into contact with Treve from the Synergy Rom. He has done all kinds of stuff with download mode and messing with the partitions before full root was available. He may not know of this hidden partition and may be able to help you out.
housry23 said:
Actually there is no temp root for updated Evo 3D's with 1.50 HBOOT and 2.3.4...HTC patched the exploit that was used to gain temp root. The only way this will work is if you already used HTC's unlocking method and use a rooted ROM. I am still on 1.40 and can't help(I probably wouldn't be much use anyway), but I would get into contact with Treve from the Synergy Rom. He has done all kinds of stuff with download mode and messing with the partitions before full root was available. He may not know of this hidden partition and may be able to help you out.
Click to expand...
Click to collapse
As suggested I contacted TrevE regarding this, and he didn't outright say that it wasn't possible, but without a temproot for the latest version, it basically came down to this. Obtain root via HTC's unlock, then attempt the patch, and then attempt the downgrade.
Any luck with this Khilbron?
Evo3Duzer said:
Any luck with this Khilbron?
Click to expand...
Click to collapse
its been 3 months...... not trolling but god damn way to rise a dead thread
nate420 said:
its been 3 months...... not trolling but god damn way to rise a dead thread
Click to expand...
Click to collapse
I am relatively new to this forum. Is there a time limit on threads? Is there a point where a user is no longer permitted to post a question in a thread?
Maybe an Admin can let me know if I have done something wrong?
I guess I could have IMd him.
Thanks for your useful input nate420
Evo3Duzer said:
I am relatively new to this forum. Is there a time limit on threads? Is there a point where a user is no longer permitted to post a question in a thread?
Maybe an Admin can let me know if I have done something wrong?
I guess I could have IMd him.
Thanks for your useful input nate420
Click to expand...
Click to collapse
Nope dude there is no problem with asking questions and raising "dead" threads. It shows that you are searching. If you had not searched then you would have been flamed for not searching. Unfortunately, on this forum, you are damned if you do and damned if you don't. Some people get their panties in a bunch for no reason at all.
animal7296 said:
Nope dude there is no problem with asking questions and raising "dead" threads. It shows that you are searching. If you had not searched then you would have been flamed for not searching. Unfortunately, on this forum, you are damned if you do and damned if you don't. Some people get their panties in a bunch for no reason at all.
Click to expand...
Click to collapse
chill dude i said i wasnt trolling
but if you see that their hasnt been an update in 3 months... by OP or ANYONE is there a point to ask for a update on the status?
sorry if my logic seems back asswards
but yes good job for searching before cheating a new thread ill give you both a thanks since im gonna be out of this forum soon
Searching this out is kind of depressing. no S Off on 1.5 and no downgrading off 1.5.... man atleast i have Flash GUI

[Q] temp root questions

So instead of waiting for revolutionary, im going to temp root because I don't want to use HTC's method. So, by doing so:
1)if I temp root and then I reboot the device, will any problems occur or will I just lose my root but it'll be the same as stock?
2) Can I remove a bloatware that I can't remove completely (Qik Video for example) with temp root?
3) Can I install the Google Talk with Voice/Video Chat (Link:http://forum.xda-developers.com/showthread.php?t=1230795) and will it work?
THANK YOU ALL SO MUCH
TechnoHacker said:
So instead of waiting for revolutionary, im going to temp root because I don't want to use HTC's method. So, by doing so:
1)if I temp root and then I reboot the device, will any problems occur or will I just lose my root but it'll be the same as stock?
2) Can I remove a bloatware that I can't remove completely (Qik Video for example) with temp root?
3) Can I install the Google Talk with Voice/Video Chat (Link:http://forum.xda-developers.com/showthread.php?t=1230795) and will it work?
THANK YOU ALL SO MUCH
Click to expand...
Click to collapse
How do you plan on temp rooting? I am pretty sure that the fre3vo temp root method no longer works if you're on 1.5hboot. Also, if you were to somehow accomplish temp root, anything you remove from /system/ will be back after a reboot. I would just use HTC`s method. You can flash whatever your want, minus radios.
Sent from my PG86100 using Tapatalk
k2buckley said:
How do you plan on temp rooting? I am pretty sure that the fre3vo temp root method no longer works if you're on 1.5hboot. Also, if you were to somehow accomplish temp root, anything you remove from /system/ will be back after a reboot. I would just use HTC`s method. You can flash whatever your want, minus radios.
Sent from my PG86100 using Tapatalk
Click to expand...
Click to collapse
I want to use fre3vo.
Well I just switched from an intercept to my EVO3D (3VO haha). What's the point of flashing radios?
I want to perma root, but wont that destroy my battery life?
TechnoHacker said:
I want to use fre3vo.
Well I just switched from an intercept to my EVO3D (3VO haha). What's the point of flashing radios?
I want to perma root, but wont that destroy my battery life?
Click to expand...
Click to collapse
If you want to have any root at all, as of right now the only thing you can do is use the HTC unlock method. It should definitely not destroy your battery life, not sure what prompted you to think it will destroy your battery life, but it won't.
Also, the point of flashing a radio is just to stay up to date with whatever radios HTC releases. Sometimes it will give you better signal, but usually you will be just fine staying on whatever radio you're already on.
Sent from my PG86100 using Tapatalk
k2buckley said:
If you want to have any root at all, as of right now the only thing you can do is use the HTC unlock method. It should definitely not destroy your battery life, not sure what prompted you to think it will destroy your battery life, but it won't.
Also, the point of flashing a radio is just to stay up to date with whatever radios HTC releases. Sometimes it will give you better signal, but usually you will be just fine staying on whatever radio you're already on.
Sent from my PG86100 using Tapatalk
Click to expand...
Click to collapse
So HBOOT 1.50 has no temp root (fre3vo does not work?)
Well I could use a signal boost for the radio as I don't get to much coverage indoors. :/ I'm not sure what to do, can I un-root and turn s-on ( *** Locked***) again?
-Sent from my HTC EVO 3D using the XDA App.
TechnoHacker said:
So HBOOT 1.50 has no temp root (fre3vo does not work?)
Well I could use a signal boost for the radio as I don't get to much coverage indoors. :/ I'm not sure what to do, can I un-root and turn s-on ( *** Locked***) again?
-Sent from my HTC EVO 3D using the XDA App.
Click to expand...
Click to collapse
The temp-root exploit that fr3vo used has been patched. Since you are on HBOOT 1.5 you have the latest radio. You can't turn S-ON because you never get S-OFF with the HTC method.
私のEVO 3Dから送信される。
No I'm saying if i turn s-off, can i go completely stock and turn s-on?
Also, If i root using HTC's method, will I lose all my apps and data :O
-Sent from my HTC EVO 3D using the XDA App.
Also, how am I supposed to backup my apps without root?
As far as backing up your app's without root, try linda file manger. And what flash is saying is the htc method is not a true unlock. Therefore you can't get your Evo3d to be s-off because your on hboot 1.5 so the only way you can unlock your phone is threw htc's method. The methods of truly unlocking your Evo3d are not an option for Evo3d's with the 1.5 boot loader. So in short you don't have to worry about getting your phone s-off and going back to stock because you can't get s-off. You can still however flash roms,mods,kernels,etc. You do however have to flash kernels threw fast boot or threw Joey k's app. Hope this helps. If you need more info send me a pm.
Locked & Loaded
""shooter on Deck""
laie1472 said:
As far as backing up your app's without root, try linda file manger. And what flash is saying is the htc method is not a true unlock. Therefore you can't get your Evo3d to be s-off because your on hboot 1.5 so the only way you can unlock your phone is threw htc's method. The methods of truly unlocking your Evo3d are not an option for Evo3d's with the 1.5 boot loader. So in short you don't have to worry about getting your phone s-off and going back to stock because you can't get s-off. You can still however flash roms,mods,kernels,etc. You do however have to flash kernels threw fast boot or threw Joey k's app. Hope this helps. If you need more info send me a pm.
Locked & Loaded
""shooter on Deck""
Click to expand...
Click to collapse
Okay, I just want temp-root. How can I get it?
TechnoHacker said:
Okay, I just want temp-root. How can I get it?
Click to expand...
Click to collapse
I think the only publicly released exploit for root on EVO 3D works with software versions 1.11 and 1.13 but was patched by HTC in software version 2.08 and is called fre3vo developed and released by agrabren. This exploit was also integrated and used in the AlphaRevX revolutionary tool to gain temp root access before modifying the bootloader.
Original thread and guide by agrabren, I located by typing fre3vo into google.com: http://forum.xda-developers.com/showthread.php?t=1150006
Hope that helps!
You can not get temp root. Temp root methods for hboot 1.4 were patched with the release of hboot 1.5...
You have been told this already in this thread several times. You have two option. Hurry up and wait for revolutionary to do there thing or you can unlock VIA htcs onlick method.
HTC method will void your warranty. It registers your serial number with them and there's no way around that. Also it is not a true s-off root. It will allow you to write to system to root but will leave the s-on still. This is easily fixed by GUI flash image developed by joeykrim, or by learning to use fastboot commands. Which BTW are easy and fast. I can use fastboot to flash a system.img data.img and boot.img as well as a recovery image in about 4 seconds of typing. Your best bet is to get the sdk set up and get fastboot working. Use fastboot to flash a recovery. You do this by putting the recovery image of your choose into the platform-tools folder of the sdk & rename it to recovery.img . Navigate with windows explorer to the platform tools folder. Assuming you have win7 hold shift and right click an empty spot in the folder and choose open cmd window here. In your cmd window type the following with no quotes..
"Fastboot flash recovery recovery.img" and hit enter.
That flashes your recovery, now to use it you need to boot recovery with fastboot
" fastboot boot recovery recovery.img" then enter.
Something about fastboot booting the recovery completly negates the s-on flag allowing full access to all partions on the device.
Again no temp root at all. It's possible but your gonna have to develop your own exploit. Good luck.
Sent from my PG86100 using Tapatalk
Okay, I understand now.
So there is no temp root or perma-temp root for HBOOT 1.5 correct?
(I also don't think there is a way to downgrade your hboot).
I want to use HTC's method but it erases all of the phones data(factory reset).
-Sent from my HTC EVO 3D using the XDA App.
joeykrim said:
I think the only publicly released exploit for root on EVO 3D works with software versions 1.11 and 1.13 but was patched by HTC in software version 2.08 and is called fre3vo developed and released by agrabren. This exploit was also integrated and used in the AlphaRevX revolutionary tool to gain temp root access before modifying the bootloader.
Original thread and guide by agrabren, I located by typing fre3vo into google.com: http://forum.xda-developers.com/showthread.php?t=1150006
Hope that helps!
Click to expand...
Click to collapse
mikedavis120 said:
You can not get temp root. Temp root methods for hboot 1.4 were patched with the release of hboot 1.5...
This is easily fixed by GUI flash image developed by joeykrim...
Click to expand...
Click to collapse
To clarify on the technical details, in case anybody comes across this later, the fre3vo temp root exploir, I quoted here and linked to in my previous post in this thread, exploited an area inside the kernel.
The kernel was patched in software release 2.08*. the fre3vo exploit is not related to hboot or hboot version. The hboot version number 1.5 coincided with software release 2.08* but did not patch the temp root exploit itself.
The kernel update in software version 2.08* and assuming all future versions has/will be patched against the fre3vo exploit.
Also link for Flash Image GUI mentioned above, http://goo.gl/sNi7V . Thanks for the support! Works well when away from a computer but wanting to change kernels/ROMs!
Also, will echo the above post, should always use and become familar with custom recovery for backup proposes. There is not a very good way around this therefore it is strongly encouraged!
Hope the additional technical details help currently or in the future!

Downgrade hboot

My wife updated her phone and is now on the newest hboot. Is it possible to downgrade it so I can root it?
You'll shoot your eye out (in 3D)
Na man sry. What hboot r u on now?
babyschmoof said:
My wife updated her phone and is now on the newest hboot. Is it possible to downgrade it so I can root it?
You'll shoot your eye out (in 3D)
Click to expand...
Click to collapse
The only way you can root the phone is with htcdev
She's on 1.5 now. Waited too long I guess.
You'll shoot your eye out (in 3D)
That's what I thought. She saw the news clip on iq logging and freaked out. Thought this would remove it. Sucks for her.
You'll shoot your eye out (in 3D)
You use HTC method or wait I've seen evil_devnul testing out bethas for his 1.5 root method on Twitter.
Sent from my PG86100 using xda premium
I'm going to wait it out. If I do htc method and they don't cover something, I'm going to be in the doghouse.
Has there been any real proof about the possible 1.5 root? I hear a lot of talk but don't see any action.
I'm waiting for htc to say if you want ice cream you need to be on 1.5. Just seems to be the path they are headed down.
You'll shoot your eye out (in 3D)
Not sure if this helps, but I am able to get temp root with hboot 1.50. Just trying to research a way to downgrade at the moment.
Good start
You'll shoot your eye out (in 3D)
Crackanug said:
Not sure if this helps, but I am able to get temp root with hboot 1.50. Just trying to research a way to downgrade at the moment.
Click to expand...
Click to collapse
you're on kernel version 2.6.35.13-g84f8edd ? what exploit are you using for temp root?
babyschmoof said:
My wife updated her phone and is now on the newest hboot. Is it possible to downgrade it so I can root it?
You'll shoot your eye out (in 3D)
Click to expand...
Click to collapse
Here are a few reasons why we aren't able to downgrade the Hboot, like was done on the EVO Shift twice:
[Q] Downgrading HBOOT 1.5 --> 1.4
joeykrim said:
the shift didn't have all the partitions nand write locked like the EVO 3D does.
1st time around: shift didnt 'have nand write lock on the hboot partition, hence being able to temp root and directly flash eng hboot to the hboot partition.
2nd time around: shift didn't have the nand write lock on the misc partition, hence being able to temp root and flash a lower version to the misc partition then hboot would allow a downgraded version of software to be loaded.
esseentially it seems as if htc was doing the bare minimum to protect the shift from being unlocked/rooted as all these methods were known and some were used on the HTC EVO prior to the shift software releases.
this has been covered a few times on the forums, but i hope rehashing old ideas/attempts might spark new ones! sometimes it only takes a slight tweak to an old method for it to bypass a patch and work! hope that helps!
Click to expand...
Click to collapse

[Q] S-Off Without HTC Dev Unlock?

Bypassing HTC Dev Unlock would be one less step for new phones to get ready for customization. And it would eliminate warranty worries about HTC's ominous warnings when unlocking the bootloader.
The Sensation now has a method to achieve S-off via temp root:
http://forum.xda-developers.com/showthread.php?p=26280760
Unfortunately, I don't have the ability at this time to ask the JuopunutBear team in IRC myself about the possibility of porting this method to the Rezound.
What input does the Rezound community have on the technical aspect of this? I know there are temp root methods such as this buried in the Development section:
http://forum.xda-developers.com/showthread.php?p=19924490
I think if you use the current HTC roots (ie for one x, evo 4g LTE) then flash their boot image (assuming it disables emmc write lock) then reboot to that then run their tool it will work.
con247 said:
I think if you use the current HTC roots (ie for one x, evo 4g LTE) then flash their boot image (assuming it disables emmc write lock) then reboot to that then run their tool it will work.
Click to expand...
Click to collapse
Good deal, will look into those methods. Had my phone S-on and on 1.02.605.6 this past weekend for a bit, got curious.
Really wish I wasn't out of town when I got an itch to test something out. lol.
I could be wrong an it could brick lol. But it is worth maybe trying or looking into.
I haven't looked into this in a while, but now that the OTA is available, I researched this a bit more last night.
Traced the method used by the Senastion back through the One X files. These are derivatives of the SparkyRoot method used first on the Transformer Prime:
http://forum.xda-developers.com/showthread.php?t=1439429
This method and the NachoRoot method use an exploit that may have been patched if I'm interpreting this data correctly. I tried a modded script for the Rezound on the 3.14.605.10 stock RUU, but no dice. The ICS OTA is still Android 4.0.3 which may mean the vulnerability is still there given the timeline of that patch.
Now the title may as well read "New Temp/Perm Root Method?" as that is what is required to bypass HTCDev Unlock altogether. But if and when such a method arises, that will get its own thread. It would be a useful tool for not only S-off, but a new round of bloatware removers.
Still looking around at other devices and vulnerabilities that could be used on the Rezound. Any input is welcome, I'm no coder but curious enough to find a way.

Categories

Resources