yashsingh1/xdaforums huggingface dataset:
[HTC EVO 3D] USSENTERNCC1701E:
I don't think it would be possible to patch. I think this is something that is hard coded into the emmc chip, still firmware technically, but not in the sense that has become the norm. This mode is not something that I think it would be possible to overwrite from from the phone itself. And even if they could, I don't think they would. I'm certain this is how factory refurbishment is achieved with "hard bricks," if they patched it, I think they'd have to pull the chips off the main boards to reprogram after that.
[HTC EVO 3D] Mr nerd:
yes you can just make sure you RELOCK hboot and unroot or it will not detect it
[HTC EVO 3D] benny3:
yes you can thats what i had and what i did
[HTC EVO 3D] Unknownforce:
It would be possible to patch the method in which we are bricking, but I don't know about the emmc mode, I think that was specifically designed for exactly the purpose we're using it for (to restore a brick)
[HTC EVO 3D] motoelliot:
This is so cool I'm SO impressed. Wish I had to do it just cause I'm bored... Someone inspire me?

Sent from 3D A.W.E.S.O.M-O
[HTC EVO 3D] greeg32:
You can do mine. I have NO Linux experience whatsoever... Nor Linux equipment
[HTC EVO 3D] RussianBear:
we haven't had much luck being able to detect the phone in emmc mode in windows yet. I've only seen 2 members that were able to see it in a partition manager here:

http://xdaforums.com/showpost.php?p=23476599&postcount=110

http://xdaforums.com/showpost.php?p=23465866&postcount=92
[HTC EVO 3D] Unknownforce:
Updated the guide slightly, adjusted wording and whatnot.

Glad everyone is getting this. :)
[HTC EVO 3D] Unknownforce:
Yeah, I'm not sure that it will work well enough on Windows, the USB detection in Windows is simply too slow... Even if it does work like above, you literally only have 5 seconds where it's in EMMC Mode... then it disappears. There's currently no known way to "Lock" it in to EMMC Mode.

I am curious to see if anyone was able to try it with a VM Box or cygwin even...
[HTC EVO 3D] OfficialLocdoGg:
If using Tacoroot which file do I push? There is no tacoroot.bin.... Thanks for the hard work though!
[HTC EVO 3D] notsointeresting:
I bet you're finally happy hearing these success stories you were expecting yesterday :p

Thanks again man, and as I promised, I sent a donation about 5 minutes ago once I finally woke up, (Im sure everyone needed some sleep after witnessing the huge F-you to HTC last night :p)

I really hope people understand the trouble this guy went through to get it working for us, even after he downgraded his device successfully. :eek:
[HTC EVO 3D] rpenrod23:
For starters - THANKS AGAIN! This worked perfectly for me, with a couple of caveats that I wanted to note (I think this has been mentioned before but may be worth putting in the OP for others that run into the same issues).

1. ./emmc_recover --flash hboot1.4.nb0 --device /dev/sdb13 - should be ./emmc_recover --flash hboot_1.4.nb0 --device /dev/sdb13

2. may need to run #1 above with sudo -s if you receive "permission deined", which I did.

Beers sent and thanks a TON!!!! This is a dream come true. LOL
[HTC EVO 3D] powduh09:
Geez... Thank God I have 3 pc's... One to watch the video, and have the guide for reference, then Windows and Linux... ;-)
[HTC EVO 3D] Lanaka:
Hmph, guess i gonna have to set up a desktop pc to get a linux environment going. Ive years ago switched to laptops only. Owell, to get rid of s-on is a good enuff reason to d/l the ubuntu live cd and dig my desktop out of my closet.

Assuming i get s-off, my portion of the bounty $ is ready at hand...
[HTC EVO 3D] Unknownforce:
Yeah, I updated it to show sudo -s for all terminal windows. and I must have just named that hboot file differnetly in my zip. I adjusted the guide again, thanks.
[HTC EVO 3D] Unknownforce:
It's truly not as complicated as it might appear, Plus, the risk is fairly minimal now with what we know about emmc mode. It does make emmc based devices basically immortal.

Ubuntu is easy enough to use too. It was a bit frightening at first to brick my device without knowing for sure it was going to work, but this emmc mode lets you flash to any partition. So I expect that bricks that were caused by bad partitioning or power loss or something similar can be recovered like this.
[HTC EVO 3D] il Duce:
as promised, I'm broke too, but still :)

Confirmation number: 9X835260TK710963G
[HTC EVO 3D] notsointeresting:
Hmm, I didn't think to post my confirmation number, but I hardly use PayPal haha.

Confirmation #: 8HR91846CF7495028
[HTC EVO 3D] joeykrim:
First, want to thank all those involved taking these extra ordinary risks with their devices to provide these methods of bypassing HTC's security! Without those taking these risks, many of these things we would never have any proof of!

Was talking with thecubed early this morning regarding the steps and process in this method.

There might be some extra steps or steps that could be improved to save a bit more time and help simply the process for all those involved.

Here are my thoughts blended with thecubed's.

Main goal: The trick is corrupting the bootloader. Once the bootloader is corrupt, there is no security check (signature, hash, etc) on anything flashed in the emmc recovery mode (as far as we've seen to this point)

1) Short answer: Step 1 is probably not needed.

Longer answer: Do not need to reset the main version. Resetting the main version is ONLY necessary if an RUU PG86IMG.zip file is being used with a prior version. That isn't required since a 2nd PG86IMG.zip was never really being flashed and is now removed from the directions.

Generically, the directions can always provide the 2.17 RUU, as of right now, no user will have a more recent main version and will not run into a main version error. As long as the user always loads the 2.17 RUU PG86IMG.zip file, the main version error will be avoided and they'll still be able to disrupt power during the bootloader flash in order to trigger the corrupt bootloader scenario.

This #2 is more of a proposed idea and discussion point...I'm not 100% aware of how revolutionary exploits and what/where it patches at (either radio, bootloader, both, neither, more, etc...)

2) Short answer: Step 3 might be shorter/simpler.

Longer answer: Since there is no security in the emmc mode, why flash hboot 1.4, which then has to be exploited by revolutionary? Couldn't the eng hboot be flashed directly onto the device eliminating the need to load hboot 1.4 and run revolutionary (sometimes multiple times). Maybe the method revolutionary uses to exploit requires hboot 1.4 and won't work with the eng hboot? Maybe revolutionary sets s-off at a level lower than the eng hboot, as they did with the EVO 4G?

Once again, appreciate all the work for all those involved, especially those corrupting essential portions of their device in order to test and develop these methods!

Hope those ideas might contribute to the community and help refine/improve the process for all involved! Thanks again to the OP and those with the Sensation exploring these methods and coding up these tools!
[HTC EVO 3D] rpenrod23:
With the success that I had using Unknown's method and knowing how to do it the CORRECT way now :) I would be more than happy to try any of the above mentioned ideas.

Anything to shorten/simplify this process would only help others who are suffering from the same HTC pains as I was until I was able to use this method to downgrade.
[HTC EVO 3D] Unknownforce:
This is actually necessary, because the last step is to flash 1.13, and if it's at a higher version (2.17 or 2.08) you won't be able to run the 1.13 RUU at that point because it will return main version is older. On top of that, I want to say it would not boot, or it boot looped when I tried to boot right after flashing the lower hboot, so you'd be stuck not able to change the version at that point and have to ultimately go back to 1.5 and start all over.

Perhaps, but because the radio is still S-ON at this point and The ENG Hboot is not signed by HTC from my understanding, the radio still won't allow it to boot, and thus it would still be bricked.

However, we could find the correct partition where S-OFF is at and simply flash that partition at the same time.

I'll check this out.

I'm also going to speak with Fuses about getting the source code of the tool so that I can re-write it so that you don't have to have multiple windows of terminal open running the same slightly altered command. Basically, just put in some better device detection, it's possible he's already done this, but I'll check that out as well.
[HTC EVO 3D] USSENTERNCC1701E:
Whoops, thought i responded already.

Just run tacoroot.bat, I posted a guide about it in the dev section. I'd link to it but I'm on my phone
[HTC EVO 3D] Unknownforce:
Yep, there's a batch file to run for that tool.

Also, if anyone is still having issues, please feel free to PM me. I can guide you through it.
[HTC EVO 3D] powduh09:
Add powduh09@Gmail.com to your gtalk... I'll probably need a little help tonight when I'm doing this
[HTC EVO 3D] dased14:
got a 1.5 hboot on the way cant wait to try this
[HTC EVO 3D] Unknownforce:
Just added you. Just make sure you've got all the stuff you need, I am at work for the next 7 hours though, just an FYI.
[HTC EVO 3D] sgt. slaughter:
Yup everything is patchable just like everything has a possible exploit pretty much...let's hope the exploit stays around for long time, though Will be interested to see if this method would work on the One series once they get released...newer S4 chips and hardware I dunno how much of a diff that would make itself here...

Still days later I'm impressed with all you guys work!
[HTC EVO 3D] zone23:
Very interesting read.
[HTC EVO 3D] Cuppeerr:
Could something like this be done for the og evo and it's locked bootloader? I went to root my moms og evo and booted it up into hboot and it said locked:confused:
[HTC EVO 3D] powduh09:
I've still got 3 hours of work, and i have all the tools and ruu roms, just need to set up ubuntu and get this bad boy s-off

One question... If I am htc unlocked, can i do the misc_version changes before relock? Or should I start from 100% stock?
[HTC EVO 3D] Genesis Nova:
I did the misc_version while Htc rooted, should be fine

just remember to fastboot oem lock for the PG86IMG to work
[HTC EVO 3D] Unknownforce:
What HBOOT are you on?
[HTC EVO 3D] Kfunk:
Here is a new splash screen I made inspired by last nights events. For those of you "new" to hboot 1.40...

Click 2 Download

Installation instructions
[HTC EVO 3D] Unknownforce:
Lol, nice.
[HTC EVO 3D] dburg84:
OG evo can be downgraded without bricking (including 2.18 hboot).

http://tinyw.in/evo4gdown
[HTC EVO 3D] Cuppeerr:
She's on EVO_HBoot_2.18.0001 this is the og evo 4g btw. I just figured that since you did this for the 3D it might be possible to one day do it for the og evo!
[HTC EVO 3D] Unknownforce:
Oh, good deal, Thanks for that info, I was gonna look into it, but now I don't have to :)
[HTC EVO 3D] Cuppeerr:
Why couldn't I find this ):<
[HTC EVO 3D] notsointeresting:
Haha, Nice, I knew someone would make one :D. The first thing I did after getting hboot 1.40 was flash your "Haters Gonna Hate- Themers guide 101" splash.

Definitely going to use this one :p
[HTC EVO 3D] timezone12:
here is a idea just to throw out there on page 48 russianbear posted 2 links to people that were able to read the partitions off the phone. now in this linkhttp://xdaforums.com/showpost.php?p=23465866&postcount=92

it seems like the person maybe in the the partition that needs to be written to and it at this point looks courpted, at that point can't the hboot img be pushed to the phone? or using minitool partition tool to try and delete that folder? i have no idea about coding i'm just throwing stuff out there to try and make a more simple way of doing this. thanks for all you great work unknownforce
[HTC EVO 3D] Unknownforce:
I'm not entirely sure what you're getting at here... It does mount those devices, but only for approximately 5 seconds... emmc mode then turns off and the only way to get it back is to un-plug and re-plug and get another 5 seconds out of it...
[HTC EVO 3D] timezone12:
just thought you would be able to write to the folder using minitool partition just a thought
[HTC EVO 3D] mnomaanw:
When i do "adb shell /data/local/misc_version -s 1.10.651.2" i get

--set_version set. VERSION will be changed to: 1.10.651.2

Patching and backing up misc partition...

Error opening input file.

I m permanent rooted....and someone confirmed that it works even if you are unlocked and rooted
[HTC EVO 3D] Sim-X:
lol that's awesome. Make sure to tweet that to HTC & post it on there facebook.
[HTC EVO 3D] dased14:
thats awesome
[HTC EVO 3D] WatermelonSlim:
Where is everyone getting the 1.13 RUU from? I am trying to download it from the dev-host site (linked to in the first post, via ppcgeeks) but it keeps telling me download interrupted (and stopping the download) after a while.
[HTC EVO 3D] bigwillyg:
Question: I apologize in advance: is it necessary to have the v1.13 ruu exe file our is it ok with just the .zip file?
[HTC EVO 3D] Holyrolla:
You want the .zip file out of the RUU as indicated in the instructions. That ZIP file gets renamed to PG86IMG.zip and is flashed to the phone.
[HTC EVO 3D] bigwillyg:
Wanted to make sure thanks.
[HTC EVO 3D] rpenrod23:
You can get the ZIPs and RUUs from here or here as well.
[HTC EVO 3D] mnomaanw:
Anyone? please

I cannot even get the 1st step done
[HTC EVO 3D] Unknownforce:
do an adb shell, do you see a # or a $?
[HTC EVO 3D] mnomaanw:
$ 10 chaaaarrss
[HTC EVO 3D] Unknownforce:
$ means you're not rooted. and that's why the command is failing. What software version are you on right now?
[HTC EVO 3D] bigwillyg:
Try typing su at the adb shell first.
[HTC EVO 3D] .Elite_The_King.:
Well said Sir.

Sent from my powered Shooter E3D with Infection of AnthraX Jamz by wolf.
[HTC EVO 3D] mnomaanw:
LOL, i dont know what happened but i use every root app like titanium backup, boot manager successfully....

I just relocked then re-unlocked so it might be showing "$"

but it wasnt working before either.

I m on 2.17 htc unlocked once again with superuser.....
[HTC EVO 3D] Unknownforce:
Run the tacoroot batch file, which will reboot the device and have you do vol down+up+power a couple times and reboot the device, and then when it says you have root in that screen, (even though your phone will probably be bootlooping) just start step one over from there.
[HTC EVO 3D] byg.nick:
As I am linux-noob and still trying to learn....

Question: Since others have had success using live CD, would it be safe to assume that we should have same success using a bootable USB running Ubuntu?
[HTC EVO 3D] rpenrod23:
this is awesome!! Lol!
[HTC EVO 3D] Unknownforce:
Someone had contacted me on skype doing this and got all the way till when they were getting the "Permission Denied" part (which was fixed shortly after by using sudo -s to start terminal windows)

So I do believe it should work just fine. just keep in mind how many usb devices you have and be sure to increase the letter of /dev/sd*13 you have it look for.
[HTC EVO 3D] zedomax:
THANKS!

Just got mine downgraded, the hardest part was bricking, after that it was easy.

Back on hboot 1.40 Synergy ROM!!!

THANKS TO OP!

I took a video while I did it so will have a video up in couple hours for those of you still trying. Took me like 10 hours to get it right. almost gave up thought was bogus but it's NOT THANKS OP!!!
[HTC EVO 3D] DomSim:
OMG finally got it! I did do it with a ubuntu usb. I think my problem why I couldn't get it to brick right was because I was putting the battery back in as well before plugging into the usb for emmc_recover. After I realized this mistake I got it withing 3 tries. 1.13 RUU just finished flashing and getting ready to revolutionary. This was frigging exciting to say the least. FWIW I wouldn't call what we are doing Bricking as I was able to boot back into hboot each time I failed. Unless you can't when it "bricks" right.
[HTC EVO 3D] jamexman:
Sorry my linux noobness. I'm getting stuck on the part where you replace chmod 0755 /path/to/emmc_recover "path/to" with where my files are. I put them in my "home folder" and i do this then: chmod 0755 /home/emmc_recover but gives me an error?? cant find it
[HTC EVO 3D] Unknownforce:
Haha, how do you think I felt when I got it to work the very FIRST time... I was nervous as heck, cause I couldn't get it to work right away and I had figured I was stuck with a brick, but stuck with it for a bit and sure enough my phone turned on to 1.40. I swear my roof opened up and the light was shining down on my device, and I could hear the "ahhhhhh" sounds. LOL
[HTC EVO 3D] Unknownforce:
If you just open a terminal and do your sudo -s to start, you'll already be in your home folder, so just do chmod 0755 ./emmc_recover
[HTC EVO 3D] USSENTERNCC1701E:
disregard.
[HTC EVO 3D] jamexman:
Thanks! Got it!
[HTC EVO 3D] Captain_Throwback:
I don't know, but there's a link in my sig with a guide on how to do it too . . . been there for a couple of months, in fact . . .

So this post is exciting! If I ever end up with a 3D as an insurance replacement for my wife's OG EVO, I'll make sure I continue following this thread to make sure I can do this right. Great work and great job. Kudos to everyone involved!! :)

I do wonder if something like this is possible on the OG, but it's an mtd device rather than emmc, so the partitions are set up a little differently. It's actually pretty easy to get root and change the main version on the OG, and changing the HBOOT is just a matter of flashing an older version PC36IMG. It seems they've done a better job patching those vulnerabilities on the new emmc devices.

My mother has a Rezound though . . . so hopefully this procedures will lead to some breakthroughs on that front as well ;). I'd imagine the emmc recovery mode should exist on all devices with that type of partition/setup, right?
[HTC EVO 3D] tommytomatoe:
I know you got it and that is really good. But for future reference, the "home folder" is actually the /home/$USER directory. Which is /home/YOURNAME

/home/tommytomatoe is mine, for example.

As unknown mentioned, the default start path for a terminal session is $HOME, which is /home/$USER by default.

In the future it is easier to work from the desktop. Put your files in a folder on the desktop that way you "isolate" all your working files, being that they are really only temporary.
[HTC EVO 3D] byg.nick:
Awesome! Thanks!

..... And confirmed!! Thanks guys!
[HTC EVO 3D] phantommadman:
Do we have be on a stock Rom or can we be on custom Rom for this to work.
[HTC EVO 3D] EindhovenOne:
Ok, this is sad...I have everything all set and ready to go and am familiar with ADB and Ubuntu, got through step 1 without any issue but on step 2 I reboot to bootloader and it detects and reads the ZIP file (blue bar then yellow bar in upper right corner) but when it is done when it should say vol-up to update, it just goes back to the regular bootloader screen with no option to update...any suggestions? I am using the 2.17 image file. Thanks for your time.

-E
[HTC EVO 3D] Unknownforce:
As long as you can gain temp/perm root (# in adb shell) it doesn't matter what you're on.

If you're on a custom rom, I'm assuming you've HTC Unlocked, so You WILL, need to be RELOCKED in order for the hboot to accept the PG86IMG.zip in the HBOOT.

Make sure you backup too :)

Same as above, if you're Unlocked, you must relock... either that Or you have a bad zip file and try downloading a new one.
[HTC EVO 3D] zagman:
@Unknownforce....

Again, let me say a BIG

Thank You

, for what you have worked so hard to achieve. I did say in my post right after you cracked this that my post in the [BOUNTY] thread shall stand ($20 in MC gift cards). Although the count of my posts may be small...Im not a complete noob as far as root/unroot abilities etc. etc. etc., but then I feel Im not in the category of most of the fine DEVs here on XDA. I have to admit I havnt kept up with all the posts as far as if a Windows/automated tool had been created for this, which leaves me semi-apprehensive in attempting your guide until such a method is harnessed.

Nonetheless, what I am is a man of my words. If you would kindly PM me, we can discuss on how I intend to follow thru. Again, Thank you and Congrats on a job well done! :D

Zagman
[HTC EVO 3D] phantommadman:
Do you relock the phone after you have confirmed the mainver.
[HTC EVO 3D] Unknownforce:
I appreciate it. I will be looking at simplifying this process and exploring the possibility of a Windows only approach (chances are very slim on this by the way) But I am taking a break for a bit, as I'm simply burnt out right now on this, Plus I'm still just kind of trying to help everyone along as it can be a bumpy road.

Just shoot me a PM whenever, I've been doing nothing but answering everyones PMs about little issues they've had or thanks or whatnot, so I'll get it :)
[HTC EVO 3D] Unknownforce:
This I don't know for certain, but I am pretty sure it should not matter, but to double check, just put it back into fastboot USB and run the fastboot getvar mainver another time, it shouldn't change though.
[HTC EVO 3D] WatermelonSlim:
So the PG86IMG file in this is the one from the 1.13 then? Or do we still need to download the 1.13 ruu?
[HTC EVO 3D] Unknownforce:
Looks like the 1.13 exe is not in there.
[HTC EVO 3D] EindhovenOne:
Does it matter what ROM I was running previously because I definitely relocked before running the bootloader and trying for it to read the PG86IMG. I am downloading a different 2.17 IMG zip right now and I just unlocked and relocked and am going to try again.

Also, and I'm sorry if this sounds ridiculous, in the last step it says just delete the PG186IMG and run the 1.13 RUU...how exactly am I going to run the executable file so it installs onto the phone? Am I missing something blatantly obvious?
[HTC EVO 3D] jamexman:
I take it you're HTC unlocked. I was too. First, change the main version while you are HTC unlocked on you regular rooted ROM. Reboot to fastboot and do the fastboot oem lock. Your main version will stay changed (you can reboot to fastboot again and do the get main ver thingy and you'll see it stays).

In short, it will stay with the lower version, and yes you need to relock in order for it to take the 2.17 zip or whatever to brick it.
[HTC EVO 3D] Unknownforce:
Rom does not matter, although I did have one where someone couldn't get root on a phone he had root on... so, just make sure your adb shell shows a # and not a $.

For the last step, you put the phone into FASTBOOT and connect it to the PC and then run the RUU exe, it will find the phone and flash it properly.
[HTC EVO 3D] benny3:
dont't wanna spam the thread but aaahhhhhhh!!!!! 1.4 s-off feels so frigging good

thanks again Unknown, Donation sent last night
[HTC EVO 3D] Unknownforce:
Glad it worked, and I got it, thanks bud.
[HTC EVO 3D] xadidas4lifex:
so i could do this while having miui on at first?
[HTC EVO 3D] jasKaos:
My phone doesn't want to stay on when I pull the battery.. Tried from different plugs and still the same outcome. Using the USB Plug that came with the phone too. Anyone know what I can do?

...sent from my super mean 3vo. RAWR!
[HTC EVO 3D] benny3:
put it in fastboot first before pulling the battery
[HTC EVO 3D] Unknownforce:
Do it in the exact order specified. and make sure it's AC (Wall Outlet) POWER, NOT PC USB. the PC usb will NOT provide enough power to the device.
[HTC EVO 3D] Unknownforce:
As long as when you do adb shell, you get a # and not a $, then yes, do step one. Then re-lock the bootloader.
[HTC EVO 3D] EindhovenOne:
Successsssssss!!!!!!!!!! :d
[HTC EVO 3D] Unknownforce:
Grats!

10chars
[HTC EVO 3D] sgt. slaughter:
Very well done bud. Very professional!
[HTC EVO 3D] adamantypants:
I've never been this excited about a hack since devs got the haret Android launcher working on my Touch Pro 2.

Everything about this hack reminds me of why I'm going into computer science. Thank you so much for this unknown, hopefully I can post another success story tonight after I get off work.