[Desire HD General] mochapenguin:
Hack Ace - stuck at reboot

Hi,

I am looking to root my HTC Desire HD and subsequently install a Cyanogenmod ROM. I have been working through the steps but now have my phone stuck at the HTC boot screen after an Ace hack attempt. Please help me with some tips on what to do here.

Many thanks to Phiber2000 and everyone else who has been contributing to this. Am new to rooting and installing ROMs, so please go easy on me.

So, here's the story so far:

Phone is an HTC Desire HD purchased in the UK in early 2011. No carrier locks.

fastboot getvar all output - after unlocking bootloader through HTCDEV

Pastebin - pastebin.com/Nf2Kmd4H

C:\>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 2.00.0029
(bootloader) version-baseband: 26.14.04.28_M
(bootloader) version-cpld: None
(bootloader) version-microp: 0438
(bootloader) version-main: 1.31.405.6
(bootloader) serialno: HT--hidden--
(bootloader) imei: hidden
(bootloader) product: ace
(bootloader) platform: HBOOT-7230
(bootloader) modelid: PD9810000
(bootloader) cidnum: HTC__001
(bootloader) battery-status: good
(bootloader) battery-voltage: 4047mV
(bootloader) partition-layout: Generic
(bootloader) security: on
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: fcef1579
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) region-id: 0
all: Done!
finished. total time: 0.047s

From reading various posts, it seemed the most appropriate thing would be to get the bootloader unlocked through HTCDEV, so

HTC Desire HD (UK) - HBOOT screen before HTCDEV Unlock

HTC Desire HD (UK) - HTC Dev Unlock

HTC Desire HD (UK) - HBOOT screen after HTCDEV Unlock

Since my phone shows cidnum: HTC__001 (Line 13, ) I downloaded PD98IMG-GB2.zip and copied it to the PD98IMG folder. Then executed the AAHK2 script.

First the Prepare HTC unlocked device option.

AAHK2 - HTCDHD - Prepare HTC unlocked device

Pastebin - pastebin.com/xw7LDqbr

Had some concerns about the message at Line 101, but from the final output (Lines 104-109) inferred things worked.

Ace Advanced Hack Kit 2

___________________________
MAIN MENU	|	|
1 - Hack Ace <----------------------------+	* S-OFF	|
|	* SIM Unlock	|
h - Prepare HTCdev unlocked device	|	* SuperCID	|
|	* Root	|
|	* Touch Recovery |
|	|
**********************************************************************
t - Toggle Flash Method - current method is fastbootRUU
**********************************************************************

q - Quit

[Select and press Enter]h

WARNING: THIS WILL WIPE DATA
Would you like to proceed? [y/n]y

7-Zip (A) 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18

Processing archive: PD98IMG\PD98IMG-GB2.zip

Extracting radio.img
Extracting boot.img
Extracting recovery.img
Extracting system.img
Extracting splash1.nb0

Everything is Ok

Files: 5
Size:	618070016
Compressed: 259503624

Starting flash process...
erasing 'cache'...
OKAY [ 1.047s]
finished. total time: 1.047s
sending 'boot' (2764 KB)...
OKAY [ 0.469s]
writing 'boot'...
OKAY [ 1.109s]
finished. total time: 1.578s
sending 'radio' (24960 KB)...
OKAY [ 4.422s]
writing 'radio'...
(bootloader) signature checking...
FAILED (remote: signature verify fail)
finished. total time: 7.547s
sending 'recovery' (3704 KB)...
OKAY [ 0.641s]
writing 'recovery'...
OKAY [ 1.141s]
finished. total time: 1.797s
sending 'splash1' (768 KB)...
OKAY [ 0.141s]
writing 'splash1'...
(bootloader) signature checking...
FAILED (remote: signature verify fail)
finished. total time: 0.250s
??
Starting flash process...
erasing 'cache'...
OKAY [ 1.047s]
finished. total time: 1.047s
sending 'boot' (2764 KB)...
OKAY [ 0.469s]
writing 'boot'...
OKAY [ 1.109s]
finished. total time: 1.578s
sending 'radio' (24960 KB)...
OKAY [ 4.422s]
writing 'radio'...
(bootloader) signature checking...
FAILED (remote: signature verify fail)
finished. total time: 7.547s
sending 'recovery' (3704 KB)...
OKAY [ 0.641s]
writing 'recovery'...
OKAY [ 1.141s]
finished. total time: 1.797s
sending 'splash1' (768 KB)...
OKAY [ 0.141s]
writing 'splash1'...
(bootloader) signature checking...
FAILED (remote: signature verify fail)
finished. total time: 0.250s
sending 'system' (571388 KB)...
OKAY [ 96.031s]
writing 'system'...
OKAY [ 48.203s]
finished. total time: 144.281s
...
(bootloader) Lock successfully...
FAILED (status read failed (Too many links))
finished. total time: 0.172s

************************************************************************
*	Installed stock ROM, Recovery and Radio.	*
*	Bootloader was prepared for further actions.	*
*	*
* Re-activate USB-Debugging if disabled and choose "Hack Ace" in menu! *
************************************************************************

Press any key to continue . . .

Rebooted phone. Checked USB debugging - was still enabled. Had been downgraded.

Next step was to run the Hack Ace option.

AAHK2 - HTCDHD - Hack Ace

Somewhat concerned about the 'Error opening copy file' messages (Lines 207, 208) and then Lines 235 onwards (Attempting to power cycle eMMC... Failed.). After this run finished, the phone rebooted and is stuck at the boot screen with the HTC logo. What should I do next?

Pastebin - pastebin.com/fitFPvAw

Ace Advanced Hack Kit 2

___________________________
MAIN MENU	|	|
1 - Hack Ace <----------------------------+	* S-OFF	|
|	* SIM Unlock	|
h - Prepare HTCdev unlocked device	|	* SuperCID	|
|	* Root	|
|	* Touch Recovery |
|	|
**********************************************************************
t - Toggle Flash Method - current method is fastbootRUU
**********************************************************************

q - Quit

[Select and press Enter]1
Android version is exploitable.
rm failed for /sdcard/PD98IMG.zip, No such file or directory
goldcard.img
goldcard
400 KB/s (19240 bytes in 0.046s)
1478 KB/s (4564992 bytes in 3.015s)
1458 KB/s (4458496 bytes in 2.984s)
1291 KB/s (557962 bytes in 0.421s)
306 KB/s (9796 bytes in 0.031s)
1325 KB/s (572752 bytes in 0.421s)
1200 KB/s (134401 bytes in 0.109s)
436 KB/s (13968 bytes in 0.031s)
ro.build.version.release=2.3.3
Setting up for Gingerbread restore...
1549 KB/s (2801664 bytes in 1.765s)
1426 KB/s (2830336 bytes in 1.937s)
1051 KB/s (285981 bytes in 0.265s)
1374 KB/s (285981 bytes in 0.203s)
1 file(s) copied.
Linux version 2.6.35.10-gd2564fb (htc-kernel@and18-2) (gcc version 4.4.0 (GCC) )
#1 PREEMPT Thu Jun 9 14:20:29 CST 2011
Kernel version is Gingerbread... Using fre3vo to temproot...
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 802160640
smem_len: 3145728
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 800
bits_per_pixel: 32
activate: 16
height: 106
width: 62
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Buffer offset:	00000000
Buffer size:	8192
Scanning region faa90000...
Scanning region fab80000...
Scanning region fac70000...
Scanning region fad60000...
Scanning region fae50000...
Scanning region faf40000...
Scanning region fb030000...
Scanning region fb120000...
Scanning region fb210000...
Scanning region fb300000…
Potential exploit area found at address fb30d200:e00.
Exploiting device...
* server not running *
/dev/block/vold/179:65 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,
uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharse
t=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
Creating goldcard...
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:

or to B. Kerler:

0+1 records in
0+1 records out
384 bytes transferred in 0.002 secs (192000 bytes/sec)
Setting mainver lower to allow downgrade...
--set_version set. VERSION will be changed to: 1.31.405.6
Misc partition is "/dev/block/mmcblk0p17"
Patching and backing up misc partition...
* server not running *
Starting flash process...
erasing 'cache'...
OKAY [ 1.031s]
finished. total time: 1.031s
Sending update...
This takes time. Please be patient!
sending 'zip' (18223 KB)...
OKAY [ 3.078s]
writing 'zip'...
(bootloader) adopting the signature contained in this image...
(bootloader) signature checking...
(bootloader) zip header checking...
(bootloader) zip info parsing...
(bootloader) checking model ID...
(bootloader) checking custom ID...
(bootloader) checking main version...
(bootloader) start image[boot] unzipping & flushing...
(bootloader) [RUU]UZ,boot,0
(bootloader) [RUU]UZ,boot,31
(bootloader) [RUU]UZ,boot,68
(bootloader) [RUU]UZ,boot,99
(bootloader) [RUU]UZ,boot,100
(bootloader) [RUU]WP,boot,0
(bootloader) [RUU]WP,boot,100
(bootloader) start image[recovery] unzipping & flushing...
(bootloader) [RUU]UZ,recovery,0
(bootloader) [RUU]UZ,recovery,20
(bootloader) [RUU]UZ,recovery,44
(bootloader) [RUU]UZ,recovery,66
(bootloader) [RUU]UZ,recovery,89
(bootloader) [RUU]UZ,recovery,100
(bootloader) [RUU]WP,recovery,0
(bootloader) [RUU]WP,recovery,100
(bootloader) start image[radio] unzipping & flushing...
(bootloader) [RUU]UZ,radio,0
(bootloader) [RUU]UZ,radio,8
(bootloader) [RUU]UZ,radio,13
(bootloader) [RUU]UZ,radio,20
(bootloader) [RUU]UZ,radio,25
(bootloader) [RUU]UZ,radio,33
(bootloader) [RUU]UZ,radio,41
(bootloader) [RUU]UZ,radio,49
(bootloader) [RUU]UZ,radio,57
(bootloader) [RUU]UZ,radio,62
(bootloader) [RUU]UZ,radio,70
(bootloader) [RUU]UZ,radio,79
(bootloader) [RUU]UZ,radio,86
(bootloader) [RUU]UZ,radio,94
(bootloader) [RUU]UZ,radio,99
(bootloader) [RUU]UZ,radio,100
(bootloader) [RUU]WP,radio,0
(bootloader) [RUU]WP,radio,6
(bootloader) [RUU]WP,radio,14
(bootloader) [RUU]WP,radio,19
(bootloader) [RUU]WP,radio,27
(bootloader) [RUU]WP,radio,36
(bootloader) [RUU]WP,radio,44
(bootloader) [RUU]WP,radio,51
(bootloader) [RUU]WP,radio,100
OKAY [111.672s]
finished. total time: 114.750s
rebooting...

finished. total time: 0.188s
Radio downgrade complete. Starting unlock process...
Linux version 2.6.32.21-gf3f553d (htc-kernel@and18-2) (gcc version 4.4.0 (GCC) )
#1 PREEMPT Thu Oct 28 13:24:11 CST 2010
Final rooting, setting super-cid and installing recovery now...
This takes time. Please be patient!
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.21-gf3f553d
New .modinfo section size: 204
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02a9e00, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02a9000
Kernel memory mapped to 0x40000000
Searching for brq filter...
- Address: 0xc02a9e00 + 0x34c
- 0x2a000012 -> 0xea000012
Patching and backing up partition 7...
Error opening copy file.
Error opening copy file.
^^^^^^^^^^^^^^^^^^^^^^^^
I- NORMAL ERROR HERE -I
error: device offline
* server not running *

error: device offline
* server not running *
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
Usage: mount [-r] [-w] [-o options] [-t type] device directory
Usage: mount [-r] [-w] [-o options] [-t type] device directory
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.21-gf3f553d
New .modinfo section size: 204
Attempting to power cycle eMMC... Failed.
Module failed to load: Operation not permitted
Can't open device: "/dev/block/mmcblk0"
Error in reading mbr!
failed with error: -1
Can't open device: "/dev/block/mmcblk0"
Error in reading mbr!
failed with error: -1
cp: permission denied
rm failed for /system/bin/su, Read-only file system
rm failed for /system/xbin/su, Read-only file system
rm failed for /system/bin/.ext/.su, No such file or directory
rm failed for /system/app/Superuser.apk, Read-only file system
rm failed for /system/app/Superuser.odex, Read-only file system
rm failed for /system/app/SuperUser.apk, Read-only file system
rm failed for /system/app/SuperUser.odex, Read-only file system
rm failed for /system/app/superuser.apk, Read-only file system
rm failed for /system/app/superuser.odex, Read-only file system
rm failed for /system/app/Supersu.apk, Read-only file system
rm failed for /system/app/Supersu.odex, Read-only file system
rm failed for /system/app/SuperSU.apk, Read-only file system
rm failed for /system/app/SuperSU.odex, Read-only file system
rm failed for /system/app/supersu.apk, Read-only file system
rm failed for /system/app/supersu.odex, Read-only file system
rm failed for /data/dalvik-cache/*com.noshufou.android.su*, No such file or dire
ctory
rm failed for /data/dalvik-cache/*Superuser.apk*, No such file or directory
rm failed for /data/dalvik-cache/*SuperUser.apk*, No such file or directory
rm failed for /data/dalvik-cache/*superuser.apk*, No such file or directory
rm failed for /data/dalvik-cache/*eu.chainfire.supersu*, No such file or directo
ry
rm failed for /data/dalvik-cache/*Supersu.apk*, No such file or directory
rm failed for /data/dalvik-cache/*SuperSU.apk*, No such file or directory
rm failed for /data/dalvik-cache/*supersu.apk*, No such file or directory
push: tools/afr/system/app/Superuser.apk -> /system/app/Superuser.apk
failed to copy 'tools/afr/system/app/Superuser.apk' to '/system/app/Superuser.ap
k': Read-only file system
Unable to chmod /system/bin/.ext: No such file or directory
Unable to chmod /system/bin/.ext/.su: No such file or directory
Unable to chmod /system/xbin/su: No such file or directory
Unable to chmod /system/app/Superuser.apk: No such file or directory
wpa_supplicant
surfaceflinger

**********************************************
* Installed ROOT and custom touch recovery! *
* Security flag and and Simlock are removed! *
**********************************************

Installing updated radio and custom ENG HBOOT...
Starting flash process...
erasing 'cache'...
OKAY [ 1.141s]
finished. total time: 1.141s
Sending update...
This takes time. Please be patient!
sending 'zip' (11429 KB)...
OKAY [ 1.953s]
writing 'zip'...
(bootloader) signature checking...
FAILED (remote: 12 signature verify fail)
finished. total time: 3.391s
rebooting...

finished. total time: 0.172s

************ Process complete **************
Press any key to continue . . .

Background info:

Using a Windows XP computer. (I would have loved to try to unlock, root my Desire HD and install Cyanogenmod on Linux, but I couldn't find instructions on how to do that that were sufficiently clear to me to give me confidence, hence I am on Windows). If guided on how to do this on Linux (I have Fedora), I would much prefer to understand what goes under the hood. Also, can document the process in a clear HowTo.

I have installed Android SDK in case I need it. So yes, both adb and fastboot commands are available.