[myTouch 4G Q&A, Help & Troubleshooting] ihackback:
Let me first say sorry if I am posting where I should not. I'm a noob and completely frustrated. I successfully rooted and unrooted a MT4g on 2.2.1 which I shipped back to Tmobile for a replacement. I now have a new shiny MT4g on 2.3.4. I originally mistakenly tried to root using visionary. I was then stuck on splash screen. I found the 2.3.4 PD15IMG that I booted from SDcard from bootloader. I then ran the downgrade successfully or at least I believe successfully. I am again now stuck on the splash screen and really need a hand. When I run the 2.2.1 stock it changes the hboot to what ever it should 0.86.0000 or something like that but the rom never boots. I can intermittently get into the 2.3.4 rom after flashing and hboot changes to 0.89.0005 but the moment the phone is turned off BAM splash screen again. Any help is greatly appreciated.

yres: 800

xres_virtual: 480

yres_virtual: 1600

xoffset: 0

yoffset: 800

bits_per_pixel: 32

activate: 16

height: 80

width: 48

rotate: 0

grayscale: 0

nonstd: 0

accel_flags: 0

pixclock: 0

left_margin: 0

right_margin: 0

upper_margin: 0

lower_margin: 0

hsync_len: 0

vsync_len: 0

sync: 0

vmode: 0

Buffer offset: 00000000

Buffer size: 8192

Scanning region faa90000...

Scanning region fab80000...

Scanning region fac70000...

Scanning region fad60000...

Scanning region fae50000...

Scanning region faf40000...

Scanning region fb030000...

Scanning region fb120000...

Scanning region fb210000...

Scanning region fb300000...

Scanning region fb3f0000...

Scanning region fb4e0000...

Scanning region fb5d0000...

Scanning region fb6c0000...

Scanning region fb7b0000...

Scanning region fb8a0000...

Scanning region fb990000...

Scanning region fba80000...

Potential exploit area found at address fbb55c00:400.

Exploiting device...

C:\android-sdk\platform-tools>adb shell

# exit

exit

C:\android-sdk\platform-tools>adb push misc_version /data/local/tmp/misc_version

198 KB/s (15837 bytes in 0.078s)

C:\android-sdk\platform-tools>adb push flashgc /data/local/tmp/flashgc

1362 KB/s (712688 bytes in 0.511s)

C:\android-sdk\platform-tools>adb shell

# cd /data/local/tmp

cd /data/local/tmp

# ./misc_version -s 1.00.000.0

./misc_version -s 1.00.000.0

./misc_version: permission denied

#

C:\android-sdk\platform-tools>adb push misc_version /data/local/tmp/misc_version

1189 KB/s (15837 bytes in 0.013s)

C:\android-sdk\platform-tools>adb push flashgc /data/local/tmp/flashgc

1599 KB/s (712688 bytes in 0.435s)

C:\android-sdk\platform-tools>adb shell

# cd /data/local/tmp

cd /data/local/tmp

# ./misc_version -s 1.00.000.0

./misc_version -s 1.00.000.0

./misc_version: permission denied

# dd if=/dev/block/mcblk0p17 bs=1 skip=160 count=10

dd if=/dev/block/mcblk0p17 bs=1 skip=160 count=10

/dev/block/mcblk0p17: cannot open for read: No such file or directory

# exit

exit

C:\android-sdk\platform-tools>adb push fre3vo /data/local/tmp

797 KB/s (9796 bytes in 0.012s)

C:\android-sdk\platform-tools>adb shell

# chmod 777 /data/local/tmp/fre3vo

chmod 777 /data/local/tmp/fre3vo

# /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF

/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF

fre3vo by #teamwin

Please wait...

Attempting to modify ro.secure property...

fb_fix_screeninfo:

id: msmfb

smem_start: 802160640

smem_len: 3145728

type: 0

type_aux: 0

visual: 2

xpanstep: 0

ypanstep: 1

line_length: 1920

mmio_start: 0

accel: 0

fb_var_screeninfo:

xres: 480

yres: 800

xres_virtual: 480

yres_virtual: 1600

xoffset: 0

yoffset: 0

bits_per_pixel: 32

activate: 16

height: 80

width: 48

rotate: 0

grayscale: 0

nonstd: 0

accel_flags: 0

pixclock: 0

left_margin: 0

right_margin: 0

upper_margin: 0

lower_margin: 0

hsync_len: 0

vsync_len: 0

sync: 0

vmode: 0

Buffer offset: 00000000

Buffer size: 8192

Scanning region faa90000...

Scanning region fab80000...

Scanning region fac70000...

Scanning region fad60000...

Scanning region fae50000...

Scanning region faf40000...

Scanning region fb030000...

Scanning region fb120000...

Scanning region fb210000...

Scanning region fb300000...

Scanning region fb3f0000...

Scanning region fb4e0000...

Scanning region fb5d0000...

Scanning region fb6c0000...

Scanning region fb7b0000...

Scanning region fb8a0000...

Scanning region fb990000...

Scanning region fba80000...

Potential exploit area found at address fbb55c00:400.

Payload verification failed.

Scanning region fbb70000...

Scanning region fbc60000...

Scanning region fbd50000...

Scanning region fbe40000...

Scanning region fbf30000...

Scanning region fc020000...

Scanning region fc110000...

Scanning region fc200000...

Scanning region fc2f0000...

Scanning region fc3e0000...

Scanning region fc4d0000...

Scanning region fc5c0000...

Scanning region fc6b0000...

Scanning region fc7a0000...

Scanning region fc890000...

Scanning region fc980000...

Scanning region fca70000...

Scanning region fcb60000...

Scanning region fcc50000...

Scanning region fcd40000...

Scanning region fce30000...

Scanning region fcf20000...

Scanning region fd010000...

Scanning region fd100000...

Scanning region fd1f0000...

Scanning region fd2e0000...

Scanning region fd3d0000...

Scanning region fd4c0000...

Scanning region fd5b0000...

Scanning region fd6a0000...

Scanning region fd790000...

Scanning region fd880000...

Scanning region fd970000...

Scanning region fda60000...

Scanning region fdb50000...

Scanning region fdc40000...

Scanning region fdd30000...

Scanning region fde20000...

Scanning region fdf10000...

Scanning region fe000000...

Scanning region fe0f0000...

Scanning region fe1e0000...

Scanning region fe2d0000...

Scanning region fe3c0000...

Scanning region fe4b0000...

Scanning region fe5a0000...

Scanning region fe690000...

Scanning region fe780000...

Scanning region fe870000...

Scanning region fe960000...

Scanning region fea50000...

Scanning region feb40000...

Scanning region fec30000...

Scanning region fed20000...

Scanning region fee10000...

Scanning region fef00000...

Scanning region feff0000...

Scanning region ff0e0000...

Scanning region ff1d0000...

Scanning region ff2c0000...

Scanning region ff3b0000...

Scanning region ff4a0000...

Scanning region ff590000...

Scanning region ff680000...

Scanning region ff770000...

Scanning region ff860000...

Scanning region ff950000...

Scanning region ffa40000...

Scanning region ffb30000...

Scanning region ffc20000...

Scanning region ffd10000...

Scanning region ffe00000...

Scanning region ffef0000...

Scanning region fffe0000...

# adb shell

adb shell

adb: not found

# exit

exit

C:\android-sdk\platform-tools>adb push misc_version /data/local/tmp/misc_version

1189 KB/s (15837 bytes in 0.013s)

C:\android-sdk\platform-tools>adb push flashgc /data/local/tmp/flashgc

1661 KB/s (712688 bytes in 0.419s)

C:\android-sdk\platform-tools>adb shell

# cd /data/local/tmp

cd /data/local/tmp

# ./misc_version -s 1.00.000.0

./misc_version -s 1.00.000.0

./misc_version: permission denied

# exit

exit

C:\android-sdk\platform-tools>adb push misc_version /data/local/tmp/misc_version

1405 KB/s (15837 bytes in 0.011s)

C:\android-sdk\platform-tools>adb push flashgc /data/local/tmp/flashgc

1611 KB/s (712688 bytes in 0.432s)

C:\android-sdk\platform-tools>adb shell chmod 777 /data/local/tmp/*

C:\android-sdk\platform-tools>adb shell

# cd /data/local/tmp

cd /data/local/tmp

# ./misc_version -s 1.00.000.0

./misc_version -s 1.00.000.0

--set_version set. VERSION will be changed to: 1.00.000.0

Patching and backing up partition 17...

# ./flashgc

./flashgc

Backing up sd-card MBR to file "./sdcardMbr-backup.img".

Making sd-card golden.

Writing gold-card to sd-card (/dev/block/mmcblk1) ...

SUCCESS: SD-card is golden.

# dd if=/dev/block/mmcblk0p17 bs=1 skip=160 count=10

dd if=/dev/block/mmcblk0p17 bs=1 skip=160 count=10

1.00.000.010+0 records in

10+0 records out

10 bytes transferred in 0.003 secs (3333 bytes/sec)

# exit

exit

C:\android-sdk\platform-tools>adb push su /data/local/tmp/

278 KB/s (22228 bytes in 0.078s)

C:\android-sdk\platform-tools>adb push busybox /data/local/tmp/

1616 KB/s (1372660 bytes in 0.829s)

C:\android-sdk\platform-tools>adb push fixsu.sh /data/local/tmp/

13 KB/s (594 bytes in 0.042s)

C:\android-sdk\platform-tools>adb install SuperUser.apk

1004 KB/s (196521 bytes in 0.191s)

pkg: /data/local/tmp/SuperUser.apk

Success