[Upgrading, Modifying and Unlocking] drellisdee:
Well, ask and you shall receive!!!

I got s-off on vzw merge. However, altell or USC ones it will require supercid or a goldcard to flash ruu from another carrier.

Tested and working CWM recovery I made for merge and latest radio hboot zips after s-off.

You must verify all Md5sums after downloading to computer (don't even think about downloading on phone) before flashing or risk a brick!!!!! Windows users can get one here & linux users can just type md5sum (name of file) into terminal.

Md5's

8cd1ca796e755b6b72f35e5686dc973a PD42IMG_cw_recovery_gnm.zip

97e35ecc802081b67e27d6cc8323cf81 PD42IMG_radio_1.08.00.320.zip

cc2e7c077fddd017d7b0db614661c535 PD42IMG_1.49.605.1_no_system.zip

4fe37c64b21d1d4542a801779fad5c57 misc-downgrade.img

6d37a0f3526295ebb779f4465a328c96 rom.zip (leaked 1.23.605.1)

http://www.mediafire.com/file/6b2jatt0445h41g/PD42IMG_cw_recovery_gnm.zip

http://www.mediafire.com/file/gbayon7dkmaq98i/PD42IMG_radio_1.08.00.320.zip

I am exploring a goldcard method that will allow flashing of the vzw ruu 1.23.605.1 that can be s-off'ed to allow other carriers merge's to be able to downgrade to s-off.

How to on s-off will be coming soon .... stay posted :)

Ok how to guide for s-off.

Files needed:

MISCIMG Downgrade http://www.mediafire.com/file/f7c3boee7ixa3i9/misc-downgrade.img

VZW leak 1.23.605.1 ruu.zip http://xdaforums.com/showpost.php?p=8237592&postcount=2

Exploits http://www.mediafire.com/file/e9w92clv6l71el3/exp.zip

VZW ONLY http://www.mediafire.com/file/rvxec54dgg1ad6q/PD42IMG_1.49.605.1_no_system.zip

USSC or Altell get your RUU from here: http://shipped-roms.com/index.php?category=android&model=Lexikon

2fast4u88 has reported that this is the most current RUU for USSC here

HEADS UP: This guide will reflash your phone and cause loss of all non-backed up data

Goldcard is required for ALL NON-VZW phones

Read how to make one here : http://www.mikesouthby.co.uk/2010/0...yo-official-ota-for-network-branded-handsets/

I used the app goldcard helper from market and if you use it skip right to the step of "Go to this page and enter this new number into the SD Card Serial (CID) field" and enter the output of the sdcard cid for mmc2 into the goldcard generator site.

After goldcard is made via directions in link above or if on vzw branded device you can skip the goldcard part. Next rename the vzw leak ruu.zip to PD42IMG.zip and place it on root of sdcard.

Next from dir you downloaded stuff to unzip the exp.zip and copy the exp folder to your android sdk platform-tools dir (if using windows) linux users should have adb in path so this shouldn't be needed just open terminal from download dir. Make sure the phone is in usb mode charge-only from this point on with usb-debugging turned on (settings/applications/development).

adb push exp /data/local
adb shell chmod 0755 /data/local/psneuter
adb shell chmod 0755 /data/local/busybox
adb shell /data/local/psneuter
adb shell

At this point you should have a # indicating temporary root.

If on vzw you will need to backup system.img from 1.49.605.1 FW as no ruu exists for it and I couldn't upload in mediafire as it was bigger than 200mb. This will take 5-10 minutes.

adb shell
dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096

Next we backup our existing misc partition.

adb shell
dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
/data/local/busybox md5sum /sdcard/misc-stock.img
/data/local/busybox md5sum /dev/block/mmcblk0p17

Make sure the md5sum of the misc-stock.img matches the one from /dev/block/mmcblk0p17

Next we use temp root to flash a misc.img that I hex edited to allow downgrading FW. misc-downgrade.img needs to be in platform-tools dir for windows users.

adb push misc-downgrade.img /sdcard/
adb shell
dd if=/sdcard/misc-downgrade.img of=/dev/block/mmcblk0p17
sync

Next power off your phone and boot it holding vol_dn + power.

Let the PD42IMG.zip complete ( will do hboot + radio then self reboot and restart to finish the rest)

Once rebooted into the 1.23.605.1 firmware

adb push exp /data/local
adb shell
chmod 0755 /data/local/psneuter
chmod 0755 /data/local/wpthis
chmod 0755 /data/local/gfree
/data/local/psneuter (to get temp root again)

adb shell

/data/local/wpthis (to disable emmc write protect)
/data/local/gfree -f (this will supercid, simunlock, and s-off phone)
rm /sdcard/PD42IMG.zip (remove/delete the leaked FW so hboot wont load it again)

Reboot into bootloader and verify you have s-off :)

If so reboot into android and use your carrier's RUU to replace your FW. You will not lose s-off. If on vzw unzip the PD42IMG_1.49.605.1_no_system.zip and add your system.img from your memory card we dumped earlier to the zip. Rezip and rename to PD42IMG.zip and place on root of sdcard and reboot into hboot to flash it just like we did earlier. This will restore the shipped 1.49.605.1 hboot, radio, boot.img, stock recovery.img, and system.img.

After you have upgraded backup you can use the clockwork recovery.img I made and rename it to PD42IMG.zip (make sure to delete the old PD42IMG.zip on your sdcard) and place it on root of sdcard and flash via hboot just like the other PD42IMG.zip's. Then you will have s-off and a custom recovery. Remember to remove/rename/move the PD42IMG.zips when done as they will flash if you enter hboot. Recovery can be entered via bootloader by picking recovery or via "adb reboot recovery".

Flashing this zip via clockwork recovery will install root (su & superuser.apk), busybox & symlink applets, flash & dump image. signed_merge_su_eng_toolkit.zip

After you have root on your release firmware:

The following commands will restore your stock misc.img

from a root # shell: (will need to type su after adb shell and accept superuser pop-up)

adb shell
dd if=/sdcard/misc-stock.img of=/dev/block/mmcblk0p17
sync

Special thanks to Scotty2 & Tmzt who wrote and developed the wpthis & gfree exploits for the G2 without these s-off for lexikon wouldn't have been possible for me.

My donation link is below if anyone wants to toss me a donation. Took me about a week to port RA recovery to merge only to fail as it had issues then to setup the board files for lexikon for cm7 to do a clockwork recovery and not to mention dumping partitons and working on the s-off stuff and goldcard.