[myTouch 4G General] vizionforever:
RE:[GUIDE] Downgrade G2 (2.3.X) & DZ (2.3.X) & mT4g (2.3.4) & DHD w/ S-ON to Froyo

Wanted to document my musings... All the following how to's are other peoples with some of my(VERY LITTLE) comments mixed in.. Thanks to all those peeps!!! hope it helps someone to downgrade and root!

Introduction

This guide is written with the assumption that the user has previously used "adb". If you are unfamiliar with "adb" or do not even know what "adb" is, download the Android SDK (found at http://developer.android.com/sdk/index.html). There are a couple guides to help you get started setting up the Android SDK and understanding ADB. If you have not installed the Android SDK or you are unfamiliar with ADB, please take some time and read a couple guides to get a basic understanding of it.

* [GUIDE] ADB Workshop and Guide for everyone

* [HOW-TO] ADB for Dummies(How-To Learner's Guide)

* How To Set Up ADB/USB Drivers for Android Devices

Gaining Temp Root

1. Download the attached files, unzip them, and place the files in your platform-tools folder. To elaborate, place the fre3vo file inside of the fre3vo.zip file and the misc_version file inside the misc_version_01.zip file in your platform-tools directory.).

2. Make sure you have your sdcard inserted in your phone, and you are NOT in USB Storage Mode, and your sdcard is NOT FULL.

3. Run the following command to verify the exploit has access to what it needs. (Only the first line is the command. The second line should be the result returned if all goes well.)

Code:

> adb shell cat /dev/msm_rotator

/dev/msm_rotator: invalid length

4. If you received the same message, you're good to continue on. If not... I'd recommend going back to #g2root and asking them. (I am just passing along the information after all).

5. Run the following commands from your platform-tools directory.

Code:

> adb push fre3vo /data/local/tmp

> adb shell

$ chmod 777 /data/local/tmp/fre3vo

$ /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF

6. After you enter that command, with luck you should see something similar to the last few lines in the following displayed. (It may take a minute or two. From what I can tell, this appears to be the quickest method as the exploit seems to be found in the latter regions.)

Code:

Buffer offset: 00000000

Buffer size: 8192

Scanning region fb7b0000...

Scanning region fb8a0000...

Scanning region fb990000...

Scanning region fba90000...

Potential exploit area found at address fbb4d600:a00.

Exploiting device...

7.

1. If the exploit works, you will be kicked out of ADB shell, proceed to Step #8.

2. If the above does not work, and fails, you can try the following, and hopefully one will work, try the following (you must reboot your phone before you try another set):

Code:

$ /data/local/tmp/fre3vo -debug -start 10000000 -end 1FFFFFFF

$ /data/local/tmp/fre3vo -debug -start 20000000 -end 2FFFFFFF

$ /data/local/tmp/fre3vo -debug -start 30000000 -end 3FFFFFFF

$ /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF

$ /data/local/tmp/fre3vo -debug -start E0000000 -end EFFFFFFF

8. If you did get kicked out of adb shell, open it again. You should now see the lovely # instead of $, thus granting you temp root. Go ahead and exit out of shell to proceed to the next stage.

Code:

> adb shell

# exit

Changing Version Number to Allow Downgrade

1. If you followed the first portion of this, you should of unzipped misc_version_01.zip in the platform-tools directory.

If you haven't done that yet, do that now and then run the following commands from your platform-tools directory.

2.

Code:

> adb push misc_version /data/local/tmp/misc_version

> adb shell chmod 777 /data/local/tmp/misc_version

> adb shell

# /data/local/tmp/misc_version -s 1.00.000.0

--set_version set. VERSION will be changed to: 1.00.000.0

Patching and backing up partition 17...(MIXING THIS IN (specially the folderand file ref) COMPAIRE THE METHOD BELOW WITH THIS ABOVE IF ONE DOES NOT WORK TRY THE DIFFRENT PATHS MISC_VERSION/MISC_VERSION...DID THE TRICK FOR ME:

1.

# /data/local/tmp/misc_version -s 1.00.000.0

2.

/data/local/tmp/misc_version -s 1.00.000.0

3.

/data/local/tmp/misc_version: permission denied

4.

5.

# chmod 777 /data/local/tmp/misc_version/misc_version

6.

chmod 777 /data/local/tmp/misc_version/misc_version

7.

# /data/local/tmp/misc_version/misc_version -s 1.00.000.0

8.

/data/local/tmp/misc_version/misc_version -s 1.00.000.0

9.

--set_version set. VERSION will be changed to: 1.00.000.0

10.

Patching and backing up partition 17...

3.

*Note: If you get the following error, please make sure your sdcard is inserted in your phone and is NOT mounted to your computer (ie: make sure you are NOT in USB Storage Mode).

Code:

Error opening backup file.

4.

Code:

# sync

5. Double check and make sure everything looks good so far by running the following command (still in adb shell).

Code:

# dd if=/dev/block/mmcblk0p17 bs=1 skip=160 count=10 {did not return this 4 me but ok!!!}

1.00.000.010+0 records in

10+0 records out

10 bytes transferred in 0.001 secs (10000 bytes/sec)

6. BE SURE TO BACKUP ANY DATA!!!***

Temp-Rooting to Backup

If you have nothing to back up or don't care to back anything up, proceed to the next section.

Credit goes to Nipqer from #g2root for providing me with this method.

1. Download the attached file, "Vision-fre3vo-temp-root.zip".

2. Extract the contents to your platform-tools directory.

3. Run the following commands in command prompt while in platform-tools directory: notice the / at the end of the commands here DIFFRENT!

4. adb devices is good to check u have proper driver connection, u can enable and then disabe usb debug to glitch usbport into connecting to phone as well as finding another usb port uninstalling reinstalling HTCdrivers of course while untethered

Code: > adb devices (make sure u have a connection)

> adb push su /data/local/tmp/

> adb push busybox /data/local/tmp/

> adb push fixsu.sh /data/local/tmp/

> adb install SuperUser.apk

> adb shell chmod 755 /data/local/tmp/fixsu.sh

> adb shell /data/local/tmp/fixsu.sh

5. Download a backing up application such as...

1. Titanium Backup

2. MyBackup Root

6. Make a backup!

Downgrading

* Download the Stock Rom for your device:

o G2: PC10IMG_Vision_TMOUS_1.19.531.1_Radio_12.21.60.09b _26.02.01.15_M2_release_149459_signed.zip

+ MD5: 531c08dc402e15577b947bf4cd22aec2

o Desire Z: 1.34.405.5_PC10IMG.zip

+ MD5: 2ff42897cd27e0db425a2cf36c8bd078

o myTouch 4G: PD15IMG.zip

+ MD5: 49d07f0ee7de1765a6a84cb12fa53110

o Desire HD: RUU_Ace_HTC_WWE_1.24.405.1_Radio_12.27.60.14b_26.0 2.00.29_M4_release_151852_signed.zip

+ MD5: a107b30a4b397c9238ddc7f4571c2ee8

* Please follow either Manual Downgrade OR Fastboot Downgrade

Manual Downgrade

1. Rename the downloaded rom to it's proper update name:

(Please note, the filenames MUST be all uppercase except for the extension, and if file extensions are hidden, do not include ".zip"):

* G2: "PC10IMG.zip"

* Desire Z: "PC10IMG.zip"

* myTouch 4G: "PD15IMG.zip"

* Desire HD: "PD98IMG.zip"

2. Place the zip file in the root of your sdcard.

3. Reboot your phone into bootloader by typing the following command:

Code:

> adb reboot bootloader

u should have PD15IMG.zip on your newly formatted sd card

4.

Your phone will reboot once or twice - this is completely normal.

This process will take roughly 5-10 minutes so make sure your phone is plugged in, either to an outlet or your computer.

5. THEN I DID THIS

6. EASY PERM/S-OFF FOR MYTOUCH 4G: G2/Desire Z PermRoot/S-OFF I've rooted over 50 Mytouch 4G's and i always have issues lol.

BUT I ALWAYS ROOT THEM IN THE END, and might I add with a headache

lol.

I tried this method, and IT WORKED, tried on over 5 phones now.

**NOTE! R E A D!NOTE!**

UNINSTALL ALL ANTI-VIRUS, LOOKOUT, OR ALL THAT CRAP BEFORE INSTALL.

[]ROOT WAS ACHIEVED FROM:

http://xdaforums.com/showthread.php?t=928160

by: ianmcquinn

*REFORMAT SD CARD TO FAT+32

*TEMPROOT ROOT YOUR PHONE WITH VISIONARY+ (LEAVE EVERYTHING UNCHECKED)now redo the phone connect to market get astro file mgr and install clockwork after installing temp root with visionary 14 nothing checked and temp root then run : set to charge or usb tether usb debuging install non market apps.

-DOWNLOAD ANDROID TERMINAL EMULATOR FROM MARKET.

Step one:

-you need root_files.rar

http://xdaforums.com/atta...6&d=1296452641

-then create a new folder on the root of the SD CARD named root_files and extract everything

in the rar there.

Step Two:

Open term. emu. and type.

(DO NOT TYPE */# just commands.)

$) su

#) cp /sdcard/root_files/perm_root /data/local/perm_root

#) chmod 777 /data/local/*

#) /data/local/perm_root

Now turn off phone, take battery out, vol+down, S-OFF PERM ROOT...

Install Rom Manager, flash CWM, and flash your fav. rom (RoyalGinger)

The most painless way I rooted mytouch!

hope it saves you a headache.

1.

Code:

> adb reboot bootloader

Sources:

1. #g2root: http://fishporn.ca/vision.gingerbread.root.html

2. Using fre3vo: http://therootofallevo.com/forums/vi....php?f=6&t=120

3. [GUIDE] ADB Workshop and Guide for everyone

4. [HOW-TO] ADB for Dummies(How-To Learner's Guide)

5. How To Set Up ADB/USB Drivers for Android Devices

6. [ROM]Ace Test & Stock ROMS [RE-UPLOADED]

7. Instructions for flashgc

8. Temp-Root Backup Post by Nipqer

9. Various Chats I've had with individuals.

If anyone needs further help and would prefer messaging me, feel free.

* AIM: IgnorantNihilist

* G-Talk: leon.yandel@gmail.com

* MSN: leon.yandel@gmail.com

Troubleshooting

Originally Posted by Cimer View Post

[...] If [the downgrade] does not work, Right click your Command prompt, Select All, Right click again. Then go to pastebin.com, paste there, Scroll down, name it and hit submit. After that post the link here and we'll take a look at it.

EVERYONE: If you want a faster diagnostic please do this in advance and other people can see your mistakes.

I wanted to give credit to specific individuals whom have helped write this guide, provided important feedback to further improve this guide, and/or in any other way further improved this guide. I think these invidiuals should be recognized, as if it were not for them, this would wouldn't be as elaborate, dynamic, and informative as it is. So a special thanks to, Cimer, petarpLab, iDylan1357, asharma5290, Nipqer, guhl, pierre_ja, and skorgon from #g2root

Change Log

* 2011/10/27

o Changed the download link for the Desire HD.

o Added MD5 checksums next to the rooms.

* 2011/10/26

o Re-added the manual downgrade method due to people having issues with the fastboot method.

* 2011/10/23

o Fixed a slightly error in code during the temp-root backup section. Had "adb install install Superuser.apk", replaced it with "adb install Superuser.apk"

* 2011/10/22

o Added a method to be able to backup data prior to downgrading! (thanks to Nipqer from #g2root)

* 2011/10/20

o Added Desire HD.

o Changed the downgrading method to use fastboot rather than manually downgrading.

o Added "Creating A Goldcard" method from http://www.thinkthinkdo.com/trac/pro...c_instructions

* 2011/08/26

o Changed modified version number for each device to 1.00.000 as it is more universal and works for each one.

o Made it more clear to extract the attached files and place them in the platform-tools directory for use.

* 2011/08/06

o Added a couple links to ADB guide.

* 2011/08/05

o Added myTouch 4G

o Added link to an "adb" guide.

o Changed title from "[GUIDE] Downgrade G2 2.13.531.8 (2.3.3 T-Mobile Rom w/ S-ON) & DZ 2.3.3 w/ S-ON" to "[GUIDE] Downgrade G2 (2.3.3) & DZ (2.3.3) & mT4g (2.3.4) w/ S-ON to Stock Froyo"

Attached Files

File Type: zip	misc_version_01.zip - [Click for QR Code] (10.0 KB, 10460 views)

File Type: zip	fre3vo.zip - [Click for QR Code] (5.5 KB, 15754 views)

File Type: zip	fastboot.zip - [Click for QR Code] (398.7 KB, 3353 views)

File Type: zip	Vision-fre3vo-temp-root.zip - [Click for QR Code] (1.01 MB, 3398 views)

Last edited by Setherio; 27th October 2011 at 10:10 PM. Reason: Added a "Change Log" to keep track of past and future updates. --- Revised the intro to adb portion and added a couple links for further reference --- Added myTouch 4G to the guide.

Just some suggestions to avoid confusion when you run the command

Code:

adb shell cat /dev/msm_rotator

you should get the return of

Code:

/dev/msm_rotator: invalid length

you do not need to enter in this line.

Also after entering

Code:

/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF

or one like it and it fails (It should not) you need to reboot the phone between these attempts.

Thanks for writing the guide! We just posted the log lol

Thanks for the tips Cimer, I edited the post, hopefully that clarifies it a bit more.

I've been a quiet browser here on XDA for quite a while but I believe that was actually the first post I made =3 It took me a while to try to get it formatted... fluently / tried to make it easy to read and follow.

And hey, if it wasn't for you all posting the logs from #g2root, I would of never gotten my G2 back to being rooted. I think I had like 8 different pages open when I was doing it, reading the chat log, reviewing the pastebin data, et cetera. But it worked, after searching every day, the trick has been found.

On a side note, I picked the range "-start FAA90000 -end FFFFFFFF" because it appears that the exploit is most likely within that range. It was for yours "FBB47C00:1400", mine was "FBB4D600:A00", and a friend of mine was also an FBB*.