[Droid Incredible General] scotty1223:
the zergRoot method

this is for folks who for whatever reason,unrevoked 3.22 does not work to get them root access.

this could also be used if youve got a replacement device thats not setup,and you could care less about installing a recovery. this still requires unrevokeds drivers to be set up,so you can root with unrevoked 3.32 after downgrading,but otherwise,it prolly is a lil quicker since you dont need to download and run unrevoked 3.22.

alternately,use this if you just like ADB :D if your proficient in adb,feel free to remove the images from mini-adb_inc,and place them and the zergRush tool into whatever folder you typically push files from.

like above,this is intended for someone whose never installed ADB or entered command lines before.

1)download these files,and save them somewhere you can easily find them:

unrevokeds modified usb drivers

public:windows_hboot_driver_install [RootWiki]

mini-adb_inc

(contains misc image,flash image,and some basic adb tools)Multiupload.com - upload your files to multiple file hosting sites!

md5: a793cc0142e1cd18f60849894bbc47cd

PB31IMG for 2.2

PB31IMG.zip

md5: 31bb1611a0fa8197d447c0438426717e

zergRush tool from xda: Revolutionary - zergRush local root 2.2/2.3 - xda-developers

md5: 12c52b97e75e73595b325c03610b3380

**make sure to check the md5 sums match those listed!**

if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: Home of the MD5summer

3)prepare to downgrade

-extract the mini-adb_inc .zip. place the extracted folder on the root of your c\ drive. it comtains mtd0,flash_image,and some adb tools.

-extract zergRush.zip. take the image inside,and either copy/paste or drag it into your mini-adb_inc folder

-place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG. now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting

WILL

wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.

4)downgrade with adb. make sure your phone is charged to 100% before starting.

-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.

at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.

-make sure phone is plugged in and usb debugging checked on in charge only mode

-at the promt in your command window:

cd c:\mini-adb_inc this should change your command promt to "mini-adb_inc",indicating youre using that directory.

adb devices this should output your phones serial number,indicating its recognized

md5sums mtd0.img it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839

md5sums flash_image again,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a

md5sums zergRush again,output stuff, then this number: 3cf8a3fbceb667121d91f4ef1a66684c

*all those numbers must match exactly. if they do then you can procede.

adb push zergRush /data/local/

adb shell this will change your promt to a $

chmod 755 /data/local/zergRush

/data/local/zergRush

this will cause zergRush to start,and it shoudl say "found a gingerbread!" followed by a bunch of other funny stuff.

last thing it says will be: Killing ADB and restarting as root... enjoy!

you should then be returned to your "mini-adb_inc>" prompt

adb push flash_image /data/local/

adb push mtd0.img /sdcard/

adb shell your prompt should change to a #

cd /data/local

chmod 0755 /data/local/flash_image

cd /data/local

./flash_image misc /sdcard/mtd0.img

you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off

exit to get out of your adb shell,and back to the "mini-adb_inc" prompt

adb reboot bootloader this will boot your phone to "fastboot" select "bootloader" with the power button.

hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.

let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.

download unrevoked forever from here: unrevoked3 recovery reflash tool, v3.32

run unrevoked(extract the contents,right click on "reflash",run as adminstrator if possible). this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.

and heres what you should see when entering the commands(my copy/pastes are in red):

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\Scott>[COLOR="Red"]cd c:\mini-adb_inc[/COLOR]

c:\mini-adb_inc>[COLOR="red"]adb devices[/COLOR]
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
HT117HJ00242 device

c:\mini-adb_inc>[COLOR="red"]md5sums mtd0.img[/COLOR]

MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help

[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
mtd0.img 34307be744275f1db1dd16af04c37839

c:\mini-adb_inc>[COLOR="red"]md5sums flash_image[/COLOR]

MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help

[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
flash_image 0098a7dd6600b55fac34fc6645be5d7a

c:\mini-adb_inc>[COLOR="red"]md5sums zergRush[/COLOR]

MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help

[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
zergRush 3cf8a3fbceb667121d91f4ef1a66684c

c:\mini-adb_inc>[COLOR="red"]adb push zergRush /data/local/[/COLOR]
1150 KB/s (21215 bytes in 0.018s)

c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
$ [COLOR="red"]chmod 755 /data/local/zergRush[/COLOR]
chmod 755 /data/local/zergRush
$ [COLOR="red"]/data/local/zergRush[/COLOR]
/data/local/zergRush

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x00015108
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219e4 0x006c
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd158bf 0xafd1ace3
[*] Sending 149 zerglings ...

[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!

c:\mini-adb_inc>[COLOR="red"]adb push flash_image /data/local/[/COLOR]
1547 KB/s (76044 bytes in 0.048s)

c:\mini-adb_inc>[COLOR="red"]adb push mtd0.img /sdcard/[/COLOR]
1017 KB/s (655360 bytes in 0.629s)

c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]chmod 0755 /data/local/flash_image[/COLOR]
chmod 0755 /data/local/flash_image
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]./flash_image misc /sdcard/mtd0.img[/COLOR]
./flash_image misc /sdcard/mtd0.img
#[COLOR="red"] exit[/COLOR]
exit

c:\mini-adb_inc>[COLOR="red"]adb reboot bootloader[/COLOR]

c:\mini-adb_inc>

edit:apparently the zergRush tool has changed. ive included the new md5s,so hopefully there wont be any more confusion like the old md5s caused earlier. be aware of this,however, in case they do change again. you are right to be cautious if it doesnt match,so ill do my best to keep up with it.