[T-Mobile myTouch 4G Slide] Blue6IX:
Summary

Okay, i'm sitting here reading through this thread and am going to summarize some of the things here in an attempt to not only make it clear for me, but for anyone else who wants to contribute.

This is the first chance i've had to post in this thread with time on my hands and not being in a rush, so bear with me.

(and to make things more cumbersome, the board merged my 4 posts)

First - all the developers working on this right now have S-OFF devices. An analogy would be like doing a blind port of a ROM to a different device. A blind port is when you make a ROM for a device you don't have. Through some twilight zone weirdness it's the same device though, so we can only test so far on our own devices.

I'd like to thank Limewirelord for extensive testing back and forth with an S-ON UNLOCKED device and answering a bunch of questions I had about a device in that state. Now that we have a thread for this problem lets get a list of problems to tackle:

Basically our purpose here is to get the system to accept an update that will downgrade it to the retail launch software, which will allow the Revolutionary S-OFF method to work.

So an already S-OFF device can flash the restore to stock image referred to later in this post. This is the PG59IMG.zip file tbalden was requesting. This is the image file that gets skipped by the newer S-ON UNLOCKED devices. I would imagine S-ON LOCKED as well.

When loading hboot, the files it automatically looks for on the sdcard are:

- PG59DIAG.zip

- PG59DIAG.nbh

- PG59IMG.zip

- PG59IMG.nbh

- PG59IMG.tar

- PG59IMG.aes

- PG59IMG.enc

...and we had a working PG59IMG.zip file.

PG59IMG.zip:

PG59IMG.zip is a method of working with the doubleshot that yogi2010 and I have been exploring pretty in-depth for a while now. A series of discussions we had about it led to the generation of a variety of PG59IMG.zip installers:

Some available here:

boot, hboot This page contains some for flashing the stock boot image and most of the hboot versions we have.

Splash Images, Boot Animations and Graphics This page has one for the stock splash image.

Root, Recovery, Radio and Backup This page has PG59IMG.zip files for stock or cwm racovery.

...and more i've made that I haven't had the time to make write-ups for. A variety of people contributed to making the different parts after we started playing with what the PG59IMG.zip file is and what it can do. Etn40ff's quest for adb in recovery helped bring those boot images together, and jkilos advice got the kitchen working to make it easier to cook them. So you can use the PG59IMG.zip angle of insertion for everything we've tried.

So far these only work on S-OFF devices.

The PG59IMG.zip files linked to above are a convenience for someone wanting to restore a specific thing - like the stock recovery, for instance. You can only install an official OTA update with a stock recovery, and just renaming a small file on your sdcard to PG59IMG.zip, rebooting to hboot for an automatic install to pick up, and telling it to go for it is an easy way to surgically replace just that.

I haven't gotten the one for the most recent OTA posted yet, and i'll do that soon (not enough time in the day...) but those ready to go installers are just a byproduct of the experiment to test the viability of the PG59IMG.zip method and it's limitations.

The next series of quotes shows the asking for and resolution of finding the stock restore image and instructions for it:

And how to use it:

----

Now, the problem we have with current S-ON UNLOCKED or LOCKED users trying to use the PG59IMG.zip is that it fails the version check made by the system and won't install. They are using the 1.45.0013 hboot and 1.55.531.3 system software.

Here's what happens:

EDIT: was reviewing this after posting it - which factory recovery did you install? Was it the one from the most recent OTA, or from the original retail launch? The recovery was updated to a new version with the most recent OTA and this strikes me as something that should be checked out.

Which is why I made a test package with updated version info in an attempt to get it to work here:

post 11 from the thread: is there a way to downgrade hboot 1.45.0013??

For this kind of thing it's pass or fail, it would either install it or not, so the chance of a brick was nil. It simply skipped the installer after checking it and denying it just like for shanigami above.

The timing of the thread I linked to was while we were trying to puzzle this out and writing all of the different PG59IMG.zip files, so I whipped one up and it used to be in the post where it now says "Edit - didn't work".

It's no longer available and I don't have it anymore, so let's see about making a new one (one's maybe). I'll start that when done these postings. After searching out some things i've thought of writing all this.

What happened when people were S-ON with 1.44.0007 hboot and tried to use the PG59IMG files, were they on 1.28.531.9 or 1.28.531.10 software?

Did anyone even try?

S-OFF with rev lets you flash things without checking version numbers, and i'd imagine CID as well, but I haven't checked that. That's easy to check, though, and now that it's occurred to me i'll check that after finishing writing this too.

No, this is not sufficient to bring you back to S-ON. I will try to track down what that would take - maybe I can flip one of mine back to S-ON. If we can work out a way of doing that, I imagine that's a high brick risk so i'll gladly take it with one of mine if we can figure it out.

It's worth it to try to get the chance to play from their side. If I can get to S-ON, i'd probably have to be stock, and then it's just a matter of getting the two updates installed (that I already have) and that 'should' put me in the same boat as everyone stuck now, with a device that is S-ON and LOCKED.

I run the risk of permanently locking it S-ON and LOCKED, (barring download mode) because we are unsure of all the changes Revolutionary made and the possibility exists of just getting screwed because of the changes the device has been through. I'm willing to take the risk if we come up with something solid.

Getting back to an S-ON state so I can test things in front of me to get back to S-OFF would be worth the risk that I can't and the device becomes mostly useless until we figure out how to use download mode. ( and hell, give me a reason to spend time on it - so no matter what happens we win even if I brick with the right attitude - we just don't win as much but the potential to learn something else. )

I can probably restore to stock and then try S-ON with the 1.44.0007 hboot?

Beyond the stock restore PG59IMG.zip we also have this to work with:

Here is a list of radio packages we have:

Then came HTC update to version 1.28.531.10

Then came OTA update to version 1.55.531.3

Find them here

...and we can thank Etn40ff for pulling the new radio from the OTA 1.55.531.3 here:

Radio-11.16.3504.20_2 - this is in a flashable zip form and not a PG59IMG.zip like the other packages.

Now, do we have a proper RUU like other phones seem to have? I don't think so but this is my first android phone and from what I gather a RUU would be in the form of an .exe file so some of you with more experience please chime in here.

Shouldn't it be something we can capture a rom.zip file from? This area and the distinction between RUU and the PG59IMG.zip files (if any) is lost on me.
​

What we have to do is get the system to accept the update - either by changing what the update tells the system it is, or by changing what the system will accept. (or both)

tbalden has been relentlessly at work on the misc.version piece since him and I had a brief chat about how to solve this S-ON issue. Much thanks for starting the thread and getting that underway!

Older, but maybe relevant:

Changing phone image version - to solve 140 bootloader version error for hTC RUU

From the desire z forums:

downgrade HBOOT 2.00.0002 to 0.98.00000 without using HTCDEV unlock

This is basically what we want to do. Zergrush is the rev method.

...and here was an attempt at the misc.version try for downflash here with the doubleshot - this post needs to be in this thread:

thrice43 has also gravitated towards this:

...and that also brings us to supercid.

Our hboot files have the writecid/readcid commands.

If you are in fastboot and run the command:

fastboot getvar cid

The ouput is cid: T-MOB010

I'm sure we could make supercid happen but does that gain us anything right now?

In case anyone wants it anyway just do this fastboot command:

fastboot oem writecid 11111111

To find out what fastboot commands you have, in fastboot run:

fastboot oem ?

Find the output of that command under hboot here:

boot,hboot

---------- Post added at 06:31 AM ---------- Previous post was at 06:30 AM ----------

So I grouped boot and hboot together in the dev reference, and am concentrating all of our info about them to there. I have some questions about them here:

So what's the deal with flashing a boot image?

I'm not clear on if people are able to replace the boot image, because people have replaced with the insecure boot image in the boot section of the reference, but that uses the stock kernel from 1.55.531.3

Some people with ICS ROMs can't get them to work right? I'm unclear on this. I was under the impression that people couldn't flash new kernels...

I definitely told you that you were wrong based on what I knew - but I don't have an S-ON device and so my understanding is secondhand. As it's now been made more clear... you were definitely right about it. I think reading a bit further down should highlight my confusion:

...and I should have already known this from the whole boot.img project and the fact that nlarge did it in this thread:

edit boot.img and I had him flash the partition in a terminal window on it with a dd command.

We know with S-ON UNLOCKED status and root you can us dd to replace the boot image manually.

We know you can fastboot flash a boot image.

So i'd say the boot partition, mmcblk0p20, is something we can write to.

However, I think the hboot or some other part of the system is preventing it from being able to be changed from recovery. So fastboot works, dd works with root, but as part of a ROM zip file it won't install from recovery. Why?

Is this a valid observation? Can someone confirm this - i'm confused about this part.

First:

I would caution anyone S-ON regardless of lock status away from installing just an hboot by itself. If you manage to do that, and only that you will almost assuredly brick your device.

Can you be more specific on how you tried to flash hboot, and what version you tried to replace it with?

Where did you get the file you were trying to use to replace your hboot with, can you give a link?

This is for your protection, because replacing hboot alone is not enough, and should result in a brick for an S-ON device. You would need to include a new radio too at the very least...we're not sure what else yet.

Can we say hboot partition, mmcblk0p12, is something we can't write to?

Moreover, is this really what's preventing us from writing to boot from within recovery?

What if someone S-ON UNLOCKED were to use dd or fastboot to install the insecure boot partition from here:

dd instructions and download insecure 1.55.531.3 boot partition

...and then try to install a ROM with a custom kernel?

The insecure boot image will allow you to have adb remount access in recovery, is that enough to let you replace the boot image through the ROM flashable zip?

If yes then we found the limiting factor - if not we need to keep looking.

Is this problem even clearly defined, can we get people to confirm or deny this is how it works with the boot and hboot partitions?

---------- Post added at 06:31 AM ---------- Previous post was at 06:31 AM ----------

Okay, volunteers:

Still game revo420?

...and others who want to help, please make a post like this:

I want to volunteer the possibility of using my device for testing:

S-ON

Locked (or) Unlocked
​

Because we need to figure out what we have access to for people to check things or pull software from.

So far we have:

Sinfamy (S-ON UNLOCKED)

shanigami (S-ON UNLOCKED)

By volunteer your device, you should never feel obligated to do anything to it you are not comfortable with doing. You are more then welcome to say so at any time on any request.

Please, please

do not

go ahead and do something to your device because you feel pressured into it by participating in this project.

You will never hear anyone get on your case because you were worried about bricking your device - and if anyone does try to pressure someone into flashing something they don't want to they do not belong here at XDA. The developers working on this project are appreciative of any participation at any level with no strings attached.

This is all volunteer time given by people when they have it across the board - from the developers down to the users. At this point in time all of our developers have S-OFF devices, which makes this harder to do for us.

The limits of what i'm comfortable with are considerably higher then what i'm comfortable with offering to someone else's device. I'd be willing to try more things that could result in a brick on my own device, but much more careful in distributing such files to others.

That being said, we don't actually have an S-ON device to play with that hasn't been S-OFF'd by the rev method, so as careful as we are we can only test so far.

Remember:

As has been stated several times - what we are dealing with could very well end up bricking a device if done wrong.

This is why you need to enter device information to use the software for the Revolutionary method - so if it ever starts bricking devices they can stop people from doing it until they work out a fix. Note that it is still pre-release status software, and it works for all of us without a problem.

...as this is being developed here everyone needs to remember this before using any software or methods described in this thread.​

So lastly, don't flash anything tossed around here unless we say to go for it. Definitely don't flash anything without understanding what it is - if it's not clear then ask. Please.

---------- Post added at 06:32 AM ---------- Previous post was at 06:31 AM ----------

Okay, I had more to say but i'm getting scattered because i've been sitting here for hours typing this up. Let me wrap it up here and come back to it in a bit, it'll also make it easier for others to digest I suppose.

I'll finish with this request:

----

Can I get people to run this fastboot command and paste their result, deleting the serial number and imei number?

fastboot getvar all

So after running that fastboot command, paste your reply and tell if you were:

-S-ON LOCKED or UNLOCKED

-hboot version? 1.44.0013

-what ROM or software version you are using?

* Don't forget to blank our your serial number and imei number!!!!!!!!

** Also blank out the line on commitno-bootloader: - I don't know what it is and don't want to accidentally ask you to publicly submit privately identifiable data.

Anyone know what commitno-bootloader is? If we need it later you can run the command again.

Here are my two devices:

Output device 1

S-OFF

hboot 1.44.0007

Bulletproof 1.1

fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 1.44.0007
(bootloader) version-baseband: N/A
(bootloader) version-cpld: None
(bootloader) version-microp: 0353
(bootloader) version-main: 1.28.531.9
(bootloader) serialno: [B]BLANK THIS NUMBER OUT[/B]
(bootloader) imei: [B]BLANK THIS NUMBER OUT[/B]
(bootloader) product: doubleshot
(bootloader) platform: HBOOT-8260
(bootloader) modelid: PG5910000
(bootloader) cidnum: T-MOB010
(bootloader) battery-status: good
(bootloader) battery-voltage: 4202mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: [B]BLANK THIS NUMBER OUT[/B]
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
all: Done!
finished. total time: 0.484s

Output device 2:

S-OFF LOCKED

hboot 1.45.0013

Stock, 1.55.531.3

(bootloader) version: 0.5
(bootloader) version-bootloader: 1.45.0013
(bootloader) version-baseband: N/A
(bootloader) version-cpld: None
(bootloader) version-microp: 0353
(bootloader) version-main: 1.28.531.9
(bootloader) serialno: [B]BLANK THIS NUMBER OUT[/B]
(bootloader) imei: [B]BLANK THIS NUMBER OUT[/B]
(bootloader) product: doubleshot
(bootloader) platform: HBOOT-8260
(bootloader) modelid: PG5910000
(bootloader) cidnum: T-MOB010
(bootloader) battery-status: good
(bootloader) battery-voltage: 4142mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: [B]BLANK THIS NUMBER OUT[/B]
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
all: Done!
finished. total time: 0.500s

For the second device:

Notice how it says 1.28.531.9 on the fastboot command? If I boot to the system normally and go to settings -> about phone -> software number it says: 1.55.531.3

Is this discrepancy important? What does it mean?

We should only need a few of these from each status, and can I get at least one person on S-ON 1.45.0013 hboot to post the output of the fastboot command:

fastboot oem ?

Thanks!